[PATCH net v2 1/3] net/iucv: only send the window update on HiperSockets sockets
Bryam Vargas via B4 Relay <[email protected]>
| Newsgroups | org.kernel.vger.netdev,org.kernel.feeds.b4-sent,org.kernel.vger.linux-kernel,org.kernel.vger.linux-s390 |
|---|---|
| Message-ID | <[email protected]> |
From: Bryam Vargas <[email protected]> iucv_sock_recvmsg() sends AF_IUCV_FLAG_WIN without testing the transport, but that flag exists only on HiperSockets. On a classic z/VM socket iucv->hs_dev is NULL and iucv_send_ctrl() sizes the skb from LL_RESERVED_SPACE(iucv->hs_dev), so the read goes through NULL. It is one recvmsg() away for an unprivileged process on a socket of its own: SO_MSGLIMIT accepts 1, so msglimit / 2 is 0 and msg_recv never leaves 0 on a classic socket. The read lands in mapped lowcore on a default kernel and the socket takes a spurious disconnect; with relocate_lowcore it faults. Test the transport. The unconditional send is older than that, but stayed harmless while iucv_send_ctrl() used a constant ETH_HLEN. Fixes: 238965b71b96 ("net/af_iucv: build proper skbs for HiperTransport") Cc: [email protected] Signed-off-by: Bryam Vargas <[email protected]> --- net/iucv/af_iucv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c index ea047bab65e7..0bc4a15f4b56 100644 --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -1331,7 +1331,8 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg, if (skb_queue_empty(&iucv->backlog_skb_q)) { if (!list_empty(&iucv->message_q.list)) iucv_process_message_q(sk); - if (atomic_read(&iucv->msg_recv) >= + if (iucv->transport == AF_IUCV_TRANS_HIPER && + atomic_read(&iucv->msg_recv) >= iucv->msglimit / 2) { err = iucv_send_ctrl(sk, AF_IUCV_FLAG_WIN); if (err) { -- 2.55.0