diff options
| author |   Breno Leitao <leitao@debian.org> | 2026-05-21 07:11:45 -0700 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2026-05-22 17:40:32 -0700 |
| commit | 3589d20a666caf30ad100c960a2de7de390fce88 (patch) | |
| tree | 33f017e3d93f71ded4411688ee827c9665f5a883 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | net/smc: Do not re-initialize smc hashtables (diff) | |
net/iucv: fix locking in .getsockopt
Mirror iucv_sock_setsockopt() and wrap the whole switch in
lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock
becomes redundant and is removed.
Any AF_IUCV HIPER user can potentially crash the kernel by racing
recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences
iucv->hs_dev->mtu after iucv_sock_close() (called from the racing
recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference
oops.
Suggested-by: Stanislav Fomichev <sdf.kernel@gmail.com>
Fixes: 51363b8751a6 ("af_iucv: allow retrieval of maximum message size")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Tested-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20260521-af_iucv_fix2-v1-1-f16b1c510aa9@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions