Re: [PATCH net 1/2] net/iucv: clear hs_dev before dropping its reference

[Bryam Vargas <hexlabsecurity@proton.me>]

On Tue, 27 Oct 2026 02:50:23 +0000, netdev-bot+sashiko@kernel.org wrote:
> - [Medium] In afiucv_hs_callback_syn(), the child now takes a reference
>   on skb->dev every time, instead of copying the listener's hs_dev.

Right, that interleaving exists, and it is the orphan the notes below
the patch describe: a SYN that passes the IUCV_LISTEN check after
close() drained the accept queue leaves a child nobody accepts or
kills. Pre-existing: bh_lock_sock() in the callback does not exclude
lock_sock() in close(). The locking series [1] is what closes it (the
callback runs under the socket lock there, so a SYN sees the listener
or a closed socket, never the gap).

What 1/2 changes is which reference the orphan holds. Before, it held
the listener's device or nothing, depending on which side of the clear
the callback read; now it holds the ingress device, which after
80230a18c164 is the same device. IOW the device leak was already there
in one of the two interleavings and 1/2 extends it to the other. Yes,
an unregister of that device then waits in netdev_wait_allrefs() for a
reference nothing drops. Both go away with the series, and I'd rather
not add a state re-check in the callback that the series removes
again. 1/2 is unchanged in v2.

The three pre-existing items: the notifier's unlocked walk and its
iucv_send_ctrl() with hs_dev cleared (Nagamani PV's patch [2] and
Haoran Wang's [3]), the child leaked on every refused SYN (Hidayath
Khan's [4]), and the child published before its parent is set (the
series).

[1] https://lore.kernel.org/netdev/20261022-b4-disp-1d26b87a-v2-0-7ee1264d812a@proton.me/
[2] https://lore.kernel.org/netdev/20260917071706.23831-1-nagamani@linux.ibm.com/
[3] https://lore.kernel.org/netdev/179241612354.5916.12881323209252769976@whr/
[4] https://lore.kernel.org/netdev/5f88daf4-cd8e-4464-b132-ac45be205121@linux.ibm.com/

Thanks,
Bryam