Re: [PATCH RFC net v3 3/7] net/iucv: run recvmsg() under the socket lock

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] net/iucv: missed shutdown wakeup in iucv_sock_sendmsg()
  during wmem wait
--

commit 16ffdad8f70763ae645ac7eca51d7e6e91eed12b
Author: Bryam Vargas <hexlabsecurity@proton.me>

net/iucv: run recvmsg() under the socket lock

This commit acquires the socket lock in iucv_sock_recvmsg() while dropping it
in sk_wait_event() when waiting for data, and drops the socket lock in
iucv_sock_sendmsg() while waiting for send buffer memory.

Link: https://lore.kernel.org/all/20260724222917.134769-1-hexlabsecurity@proton.me/

> diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
> index 133c1d1886b2a..639725917f3f8 100644
> --- a/net/iucv/af_iucv.c
> +++ b/net/iucv/af_iucv.c
> @@ -1041,7 +1041,17 @@ static int iucv_sock_sendmsg(struct socket *sock, struct msghdr *msg,
>  		}
>  	}
>  	skb = sock_alloc_send_pskb(sk, headroom + linear, len - linear,
> -				   noblock, &err, 0);
> +				   1, &err, 0);
> +	if (!skb && err == -EAGAIN && !noblock) {
> +		/* Wait without the socket lock: recvmsg() takes it, and over
> +		 * z/VM the memory comes back only when the peer reads, which
> +		 * may wait for our own reader.
> +		 */
> +		release_sock(sk);
> +		skb = sock_alloc_send_pskb(sk, headroom + linear,
> +					   len - linear, 0, &err, 0);
> +		lock_sock(sk);
> +	}

[Severity: Medium]
Can a writer waiting in sock_alloc_send_pskb() without lock_sock(sk) miss a
concurrent shutdown(SHUT_WR) wakeup when iucv_send_ctrl() temporarily clears
SEND_SHUTDOWN?

net/iucv/af_iucv.c:iucv_send_ctrl() {
    ...
	if (sk->sk_shutdown & SEND_SHUTDOWN) {
		/* controlling flags should be sent anyway */
		shutdown = sk->sk_shutdown;
		sk->sk_shutdown &= RCV_SHUTDOWN;
	}
	skb = sock_alloc_send_skb(sk, blen, 1, &err);
	if (skb) {
		skb_reserve(skb, blen);
		err = afiucv_hs_send(NULL, sk, skb, flags);
	}
	if (shutdown)
		sk->sk_shutdown = shutdown;
    ...
}

Because sock_wait_for_wmem() now runs unlocked, it can race with
iucv_send_ctrl() (called under lock_sock(sk) by iucv_sock_recvmsg() for a
window update):

CPU0                              CPU1
iucv_sock_sendmsg()
  release_sock(sk)
  sock_alloc_send_pskb()
    sock_wait_for_wmem()
      prepare_to_wait(...)
                                  iucv_sock_shutdown(SHUT_WR)
                                    sk->sk_shutdown |= SEND_SHUTDOWN
                                    sk->sk_state_change(sk)
                                  iucv_sock_recvmsg()
                                    iucv_send_ctrl()
                                      sk->sk_shutdown &= RCV_SHUTDOWN
      if (sk->sk_shutdown & SEND_SHUTDOWN)
        /* false */
                                      sk->sk_shutdown = shutdown
      schedule_timeout(timeo)  <-- sleeps despite SHUT_WR

Since iucv_send_ctrl() restores SEND_SHUTDOWN without waking sk_sleep(sk),
iucv_sock_sendmsg() stays blocked in schedule_timeout() until send memory is
freed or SO_SNDTIMEO expires instead of returning -EPIPE immediately.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110-b4-disp-2a6b4364-v3-0-35677b68e697@proton.me?part=3