[PATCH net] net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

[PATCH net] net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

[Hidayath Khan]

afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC,
which can fail and return NULL. The connection-refused branch is
entered when the listen state check fails, the accept backlog is
full, or nsk is NULL - and unconditionally calls iucv_sock_kill(nsk).
When entered due to allocation failure, iucv_sock_kill() dereferences
the NULL pointer at the sock_flag(sk, SOCK_ZAPPED) check, causing a
NULL pointer dereference in softirq context.

Only kill the child socket if it was actually allocated.

Fixes: 3881ac441f64 ("af_iucv: add HiperSockets transport")
Cc: stable@vger.kernel.org
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
---
 net/iucv/af_iucv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 890d9df5ae36..a471fbe178e8 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1875,7 +1875,8 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb)
 		afiucv_swap_src_dest(skb);
 		trans_hdr->flags = AF_IUCV_FLAG_SYN | AF_IUCV_FLAG_FIN;
 		err = dev_queue_xmit(skb);
-		iucv_sock_kill(nsk);
+		if (nsk)
+			iucv_sock_kill(nsk);
 		bh_unlock_sock(sk);
 		goto out;
 	}
-- 
2.52.0