[PATCH net 1/2] net/iucv: only send the window update on HiperSockets sockets
Bryam Vargas via B4 Relay <[email protected]>
| Newsgroups | org.kernel.vger.netdev,org.kernel.feeds.b4-sent,org.kernel.vger.linux-kernel,org.kernel.vger.linux-s390 |
|---|---|
| Message-ID | <[email protected]> |
From: Bryam Vargas <[email protected]> iucv_sock_recvmsg() sends AF_IUCV_FLAG_WIN without testing the transport, but that flag exists only on HiperSockets. On a classic z/VM socket iucv->hs_dev is NULL and iucv_send_ctrl() sizes the skb from LL_RESERVED_SPACE(iucv->hs_dev), so the read goes through NULL; afiucv_hs_send() then returns -ENODEV and recvmsg() moves the socket to IUCV_DISCONN. Reaching it takes an application that sets SO_MSGLIMIT to 1 on its own socket, since msg_recv is incremented only on the HiperSockets path, so this is a correctness fix rather than a security one. Test the transport. Three of the other four iucv_send_ctrl() callers do; the fourth, afiucv_netdev_event(), selects on hs_dev instead. Without relocate_lowcore the NULL read lands in mapped lowcore and the symptom is the spurious disconnect; with lowcore relocation it faults. Fixes: 3881ac441f64 ("af_iucv: add HiperSockets transport") Cc: [email protected] Signed-off-by: Bryam Vargas <[email protected]> --- net/iucv/af_iucv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c index ea047bab65e7..0bc4a15f4b56 100644 --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -1331,7 +1331,8 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg, if (skb_queue_empty(&iucv->backlog_skb_q)) { if (!list_empty(&iucv->message_q.list)) iucv_process_message_q(sk); - if (atomic_read(&iucv->msg_recv) >= + if (iucv->transport == AF_IUCV_TRANS_HIPER && + atomic_read(&iucv->msg_recv) >= iucv->msglimit / 2) { err = iucv_send_ctrl(sk, AF_IUCV_FLAG_WIN); if (err) { -- 2.55.0