Re: [PATCH net v2 1/3] net/iucv: only send the window update on HiperSockets sockets

[Alexandra Winter <wintera@linux.ibm.com>]

On 21.08.26 13:17, Bryam Vargas via B4 Relay wrote:
> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> iucv_sock_recvmsg() sends AF_IUCV_FLAG_WIN without testing the transport,
> but that flag exists only on HiperSockets. On a classic z/VM socket
> iucv->hs_dev is NULL and iucv_send_ctrl() sizes the skb from
> LL_RESERVED_SPACE(iucv->hs_dev), so the read goes through NULL. It is one
> recvmsg() away for an unprivileged process on a socket of its own:
> SO_MSGLIMIT accepts 1, so msglimit / 2 is 0 and msg_recv never leaves 0 on
> a classic socket. The read lands in mapped lowcore on a default kernel and
> the socket takes a spurious disconnect; with relocate_lowcore it faults.


Hi Bryam,

FYI, I tried to reproduce the fault with boot parameter relocate_lowcore.
It did not run into a page fault. My AI says: "relocate_lowcore moves the
lowcore mapping from 0x0 to 0x70000. It does not necessarily unmap all of page 0."
So a garbage read still happens.

The bug is very valid and I can reproduce the spurious disconnect, and that
it is fixed with the proposed fix.
But you may want to adapt the commit message.