From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792595558; b=QPrDeJBe8PvO9c1miHRopy64RI7nPYn0hpiwFE0sOH0tASwTZ2JVFKVkFrNATEkPCcyL ABhoh2cDtBbUIeAEHps1I8KhuL9JdfskxdIURzpWaU1EZn5GiUQhzs/tc366D6a44g9Kr 2+Q6nP/DSj6pd0ukWx7drYdIqhBpk9BrBCxEOO4VzYg5nOsP1m07A4zy1HR4/BNFDXmPr kds5e/HTf+4KPxcC9cr+tJRlRrvULu70xdYwGfhhJzwiUA0P4T7iSCmruPYFWyvdyETCT PX50B1JAemogBbvpAk/7FapIlQLDVEKnsVjpnHWalstfIti9U6suOD75Do0DEEfyW/w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792595558; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=6KPhP5CQ70cTMfnSIh6rT1BD4TANfuWGfbFTVNU69q0=; b=dhjMzJNLVZAkVwG3L9yE11rvNW37qAysGMmcde/DJYTPQdbrmZXkWhN88Mz5H8pUD5aB Lg/xKbAP8zuhYKLZMknfSiZYgMEZlx5990JsjE1uqns8CjwwmRi2bggEz4UJQvLgmoCei HP8/1j43jX85jlcVIJBnHicT8RjZCHRbXXEO0+QCv23GfFf3j0CaZhXlO+OwI1Hp8rbtd AyzN4Z91JfQPWYaBSx+dGyLj6k5K9SzRnr7TEI2fDOIjqWaI82e+H15IQbJLij+AHn79L IFKPtqs+Tr0qNOrNoQv9NbUa9ulA7h6CzTjEoep8YqGpU9gCyNYgv/XiCEG3s43aRow== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=reqoNSFE; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 28A96606A325 for ; Wed, 21 Oct 2026 15:12:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=reqoNSFE Received: by smtp.kernel.org (Postfix) with ESMTPSA id 770001F000C5; Wed, 21 Oct 2026 15:12:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792595558; bh=6KPhP5CQ70cTMfnSIh6rT1BD4TANfuWGfbFTVNU69q0=; h=Subject:To:Cc:From:Date; b=reqoNSFEyYPiFcs6VRwLAwDOlzbbcNA/B7A2RhrE456KEzcg5guOXKSNiQbJQ7598 H0AoP80i1TMUs7lkSX4DT0/c3k24SSyI0ryimoLjpUtYf3muAgJgBIverDGuaaAIY7 TysiSnghS9MHldeRBuZ75bwnCXO/CHApHMNoD/Kc= Subject: FAILED: patch "[PATCH] net/iucv: fix the recvmsg window update" failed to apply to 5.10-stable tree To: hexlabsecurity@proton.me,aswin@linux.ibm.com,kuba@kernel.org,wintera@linux.ibm.com Cc: From: Date: Wed, 21 Oct 2026 17:08:05 +0200 Message-ID: <2026102105-deuce-amnesty-4222@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x fa5acd038ea657ad5033713d6916214cbd349151 # git commit -s git send-email --to '' --in-reply-to '2026102105-deuce-amnesty-4222@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From fa5acd038ea657ad5033713d6916214cbd349151 Mon Sep 17 00:00:00 2001 From: Bryam Vargas Date: Fri, 28 Aug 2026 14:07:47 -0500 Subject: [PATCH] net/iucv: fix the recvmsg window update iucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without testing the transport, so on a classic z/VM socket iucv_send_ctrl() sizes the skb through a NULL iucv->hs_dev. SO_MSGLIMIT accepts 1, so msglimit / 2 is zero and one recvmsg() on its own socket is enough for an unprivileged process to take a spurious disconnect. It also calls iucv_send_ctrl() under spin_lock_bh(&message_q.lock), which allocates GFP_KERNEL inside a section the code treats as atomic. Sending outside that lock lets two recvmsg() reach afiucv_hs_send() at once, where msg_recv is sampled for the advertised window and subtracted after dev_queue_xmit() -- and sendmsg reaches that counter under lock_sock() while recvmsg holds no socket lock, so both can subtract the same value, the counter goes negative and the credit reaches the peer twice. Test the transport, claim the credit with atomic_xchg() after the last error exit and hand it back if the transmit fails, and send once the lock is dropped. Fixes: 3881ac441f64 ("af_iucv: add HiperSockets transport") Fixes: 238965b71b96 ("net/af_iucv: build proper skbs for HiperTransport") Cc: stable@vger.kernel.org Tested-by: Aswin Karuvally Signed-off-by: Bryam Vargas Reviewed-by: Alexandra Winter Link: https://patch.msgid.link/20260828-b4-disp-33fac0ed-v3-1-e6d061880ee0@proton.me Signed-off-by: Jakub Kicinski diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c index 4e5cc9da6e06..db261ecd19af 100644 --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -210,12 +210,6 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock, phs_hdr->flags = flags; if (flags == AF_IUCV_FLAG_SYN) phs_hdr->window = iucv->msglimit; - else if ((flags == AF_IUCV_FLAG_WIN) || !flags) { - confirm_recv = atomic_read(&iucv->msg_recv); - phs_hdr->window = confirm_recv; - if (confirm_recv) - phs_hdr->flags = phs_hdr->flags | AF_IUCV_FLAG_WIN; - } memcpy(phs_hdr->destUserID, iucv->dst_user_id, 8); memcpy(phs_hdr->destAppName, iucv->dst_name, 8); memcpy(phs_hdr->srcUserID, iucv->src_user_id, 8); @@ -250,13 +244,22 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock, } skb->protocol = cpu_to_be16(ETH_P_AF_IUCV); + /* Claim the receive credit here, not while building the header: every + * way this frame can be dropped has now been ruled out, so the window + * is zeroed only for as long as the transmit itself takes. + */ + if (flags == AF_IUCV_FLAG_WIN || !flags) { + confirm_recv = atomic_xchg(&iucv->msg_recv, 0); + phs_hdr->window = confirm_recv; + if (confirm_recv) + phs_hdr->flags = phs_hdr->flags | AF_IUCV_FLAG_WIN; + } + atomic_inc(&iucv->skbs_in_xmit); err = dev_queue_xmit(skb); if (net_xmit_eval(err)) { atomic_dec(&iucv->skbs_in_xmit); - } else { - atomic_sub(confirm_recv, &iucv->msg_recv); - WARN_ON(atomic_read(&iucv->msg_recv) < 0); + atomic_add(confirm_recv, &iucv->msg_recv); } return net_xmit_eval(err); @@ -1241,6 +1244,7 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg, struct iucv_sock *iucv = iucv_sk(sk); unsigned int copied, rlen; struct sk_buff *skb, *rskb, *cskb; + bool send_win = false; int err = 0; u32 offset; @@ -1331,16 +1335,20 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg, if (skb_queue_empty(&iucv->backlog_skb_q)) { if (!list_empty(&iucv->message_q.list)) iucv_process_message_q(sk); - if (atomic_read(&iucv->msg_recv) >= - iucv->msglimit / 2) { - err = iucv_send_ctrl(sk, AF_IUCV_FLAG_WIN); - if (err) { - sk->sk_state = IUCV_DISCONN; - sk->sk_state_change(sk); - } - } + if (iucv->transport == AF_IUCV_TRANS_HIPER && + atomic_read(&iucv->msg_recv) >= + iucv->msglimit / 2) + send_win = true; } spin_unlock_bh(&iucv->message_q.lock); + + if (send_win) { + err = iucv_send_ctrl(sk, AF_IUCV_FLAG_WIN); + if (err) { + sk->sk_state = IUCV_DISCONN; + sk->sk_state_change(sk); + } + } } done: