* [PATCH net 0/2] net/iucv: fixes 2020-11-06
@ 2020-11-06 12:50 Julian Wiedmann
2020-11-06 12:50 ` [PATCH net 1/2] net/af_iucv: fix null pointer dereference on shutdown Julian Wiedmann
2020-11-06 12:50 ` [PATCH net 2/2] MAINTAINERS: remove Ursula Braun as s390 network maintainer Julian Wiedmann
0 siblings, 2 replies; 5+ messages in thread
From: Julian Wiedmann @ 2020-11-06 12:50 UTC (permalink / raw)
To: David Miller, Jakub Kicinski
Cc: linux-netdev, linux-s390, Heiko Carstens, Karsten Graul, Julian Wiedmann
Hi Jakub,
please apply the following patch series to netdev's net tree.
One fix in the shutdown path for af_iucv sockets. This is relevant for
stable as well.
Also sending along an update for the Maintainers file.
Thanks,
Julian
Ursula Braun (2):
net/af_iucv: fix null pointer dereference on shutdown
MAINTAINERS: remove Ursula Braun as s390 network maintainer
MAINTAINERS | 3 ---
net/iucv/af_iucv.c | 3 ++-
2 files changed, 2 insertions(+), 4 deletions(-)
--
2.17.1
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH net 1/2] net/af_iucv: fix null pointer dereference on shutdown
2020-11-06 12:50 [PATCH net 0/2] net/iucv: fixes 2020-11-06 Julian Wiedmann
@ 2020-11-06 12:50 ` Julian Wiedmann
2020-11-06 16:59 ` Jakub Kicinski
2020-11-06 12:50 ` [PATCH net 2/2] MAINTAINERS: remove Ursula Braun as s390 network maintainer Julian Wiedmann
1 sibling, 1 reply; 5+ messages in thread
From: Julian Wiedmann @ 2020-11-06 12:50 UTC (permalink / raw)
To: David Miller, Jakub Kicinski
Cc: linux-netdev, linux-s390, Heiko Carstens, Karsten Graul,
Julian Wiedmann, Ursula Braun
From: Ursula Braun <ubraun@linux.ibm.com>
syzbot reported the following KASAN finding:
BUG: KASAN: nullptr-dereference in iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
Read of size 2 at addr 000000000000021e by task syz-executor907/519
CPU: 0 PID: 519 Comm: syz-executor907 Not tainted 5.9.0-syzkaller-07043-gbcf9877ad213 #0
Hardware name: IBM 3906 M04 701 (KVM/Linux)
Call Trace:
[<00000000c576af60>] unwind_start arch/s390/include/asm/unwind.h:65 [inline]
[<00000000c576af60>] show_stack+0x180/0x228 arch/s390/kernel/dumpstack.c:135
[<00000000c9dcd1f8>] __dump_stack lib/dump_stack.c:77 [inline]
[<00000000c9dcd1f8>] dump_stack+0x268/0x2f0 lib/dump_stack.c:118
[<00000000c5fed016>] print_address_description.constprop.0+0x5e/0x218 mm/kasan/report.c:383
[<00000000c5fec82a>] __kasan_report mm/kasan/report.c:517 [inline]
[<00000000c5fec82a>] kasan_report+0x11a/0x168 mm/kasan/report.c:534
[<00000000c98b5b60>] iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
[<00000000c98b6262>] iucv_sock_shutdown+0x44a/0x4c0 net/iucv/af_iucv.c:1457
[<00000000c89d3a54>] __sys_shutdown+0x12c/0x1c8 net/socket.c:2204
[<00000000c89d3b70>] __do_sys_shutdown net/socket.c:2212 [inline]
[<00000000c89d3b70>] __s390x_sys_shutdown+0x38/0x48 net/socket.c:2210
[<00000000c9e36eac>] system_call+0xe0/0x28c arch/s390/kernel/entry.S:415
There is nothing to shutdown if a connection has never been established.
Besides that iucv->hs_dev is not yet initialized if a socket is in
IUCV_OPEN state and iucv->path is not yet initialized if socket is in
IUCV_BOUND state.
So, just skip the shutdown calls for a socket in these states.
Fixes: eac3731bd04c ("s390: Add AF_IUCV socket support")
Fixes: 82492a355fac ("af_iucv: add shutdown for HS transport")
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
---
net/iucv/af_iucv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index d80572074667..047238f01ba6 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1434,7 +1434,8 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
break;
}
- if (how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) {
+ if ((how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) &&
+ sk->sk_state == IUCV_CONNECTED) {
if (iucv->transport == AF_IUCV_TRANS_IUCV) {
txmsg.class = 0;
txmsg.tag = 0;
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH net 2/2] MAINTAINERS: remove Ursula Braun as s390 network maintainer
2020-11-06 12:50 [PATCH net 0/2] net/iucv: fixes 2020-11-06 Julian Wiedmann
2020-11-06 12:50 ` [PATCH net 1/2] net/af_iucv: fix null pointer dereference on shutdown Julian Wiedmann
@ 2020-11-06 12:50 ` Julian Wiedmann
1 sibling, 0 replies; 5+ messages in thread
From: Julian Wiedmann @ 2020-11-06 12:50 UTC (permalink / raw)
To: David Miller, Jakub Kicinski
Cc: linux-netdev, linux-s390, Heiko Carstens, Karsten Graul,
Julian Wiedmann, Ursula Braun
From: Ursula Braun <ubraun@linux.ibm.com>
I am retiring soon. Thus this patch removes myself from the
MAINTAINERS file (s390 network).
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
[jwi: fix up the subject]
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
---
MAINTAINERS | 3 ---
1 file changed, 3 deletions(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index e73636b75f29..d4462d7e2077 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -15259,7 +15259,6 @@ F: drivers/iommu/s390-iommu.c
S390 IUCV NETWORK LAYER
M: Julian Wiedmann <jwi@linux.ibm.com>
M: Karsten Graul <kgraul@linux.ibm.com>
-M: Ursula Braun <ubraun@linux.ibm.com>
L: linux-s390@vger.kernel.org
S: Supported
W: http://www.ibm.com/developerworks/linux/linux390/
@@ -15270,7 +15269,6 @@ F: net/iucv/
S390 NETWORK DRIVERS
M: Julian Wiedmann <jwi@linux.ibm.com>
M: Karsten Graul <kgraul@linux.ibm.com>
-M: Ursula Braun <ubraun@linux.ibm.com>
L: linux-s390@vger.kernel.org
S: Supported
W: http://www.ibm.com/developerworks/linux/linux390/
@@ -15844,7 +15842,6 @@ S: Maintained
F: drivers/misc/sgi-xp/
SHARED MEMORY COMMUNICATIONS (SMC) SOCKETS
-M: Ursula Braun <ubraun@linux.ibm.com>
M: Karsten Graul <kgraul@linux.ibm.com>
L: linux-s390@vger.kernel.org
S: Supported
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net 1/2] net/af_iucv: fix null pointer dereference on shutdown
2020-11-06 12:50 ` [PATCH net 1/2] net/af_iucv: fix null pointer dereference on shutdown Julian Wiedmann
@ 2020-11-06 16:59 ` Jakub Kicinski
2020-11-09 7:52 ` Julian Wiedmann
0 siblings, 1 reply; 5+ messages in thread
From: Jakub Kicinski @ 2020-11-06 16:59 UTC (permalink / raw)
To: Julian Wiedmann
Cc: David Miller, linux-netdev, linux-s390, Heiko Carstens,
Karsten Graul, Ursula Braun
On Fri, 6 Nov 2020 13:50:07 +0100 Julian Wiedmann wrote:
> From: Ursula Braun <ubraun@linux.ibm.com>
>
> syzbot reported the following KASAN finding:
>
> BUG: KASAN: nullptr-dereference in iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
> Read of size 2 at addr 000000000000021e by task syz-executor907/519
>
> CPU: 0 PID: 519 Comm: syz-executor907 Not tainted 5.9.0-syzkaller-07043-gbcf9877ad213 #0
> Hardware name: IBM 3906 M04 701 (KVM/Linux)
> Call Trace:
> [<00000000c576af60>] unwind_start arch/s390/include/asm/unwind.h:65 [inline]
> [<00000000c576af60>] show_stack+0x180/0x228 arch/s390/kernel/dumpstack.c:135
> [<00000000c9dcd1f8>] __dump_stack lib/dump_stack.c:77 [inline]
> [<00000000c9dcd1f8>] dump_stack+0x268/0x2f0 lib/dump_stack.c:118
> [<00000000c5fed016>] print_address_description.constprop.0+0x5e/0x218 mm/kasan/report.c:383
> [<00000000c5fec82a>] __kasan_report mm/kasan/report.c:517 [inline]
> [<00000000c5fec82a>] kasan_report+0x11a/0x168 mm/kasan/report.c:534
> [<00000000c98b5b60>] iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
> [<00000000c98b6262>] iucv_sock_shutdown+0x44a/0x4c0 net/iucv/af_iucv.c:1457
> [<00000000c89d3a54>] __sys_shutdown+0x12c/0x1c8 net/socket.c:2204
> [<00000000c89d3b70>] __do_sys_shutdown net/socket.c:2212 [inline]
> [<00000000c89d3b70>] __s390x_sys_shutdown+0x38/0x48 net/socket.c:2210
> [<00000000c9e36eac>] system_call+0xe0/0x28c arch/s390/kernel/entry.S:415
>
> There is nothing to shutdown if a connection has never been established.
> Besides that iucv->hs_dev is not yet initialized if a socket is in
> IUCV_OPEN state and iucv->path is not yet initialized if socket is in
> IUCV_BOUND state.
> So, just skip the shutdown calls for a socket in these states.
>
> Fixes: eac3731bd04c ("s390: Add AF_IUCV socket support")
> Fixes: 82492a355fac ("af_iucv: add shutdown for HS transport")
> Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
> Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Fixes tag: Fixes: eac3731bd04c ("s390: Add AF_IUCV socket support")
Has these problem(s):
- Subject does not match target commit subject
Just use
git log -1 --format='Fixes: %h ("%s")'
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net 1/2] net/af_iucv: fix null pointer dereference on shutdown
2020-11-06 16:59 ` Jakub Kicinski
@ 2020-11-09 7:52 ` Julian Wiedmann
0 siblings, 0 replies; 5+ messages in thread
From: Julian Wiedmann @ 2020-11-09 7:52 UTC (permalink / raw)
To: Jakub Kicinski
Cc: David Miller, linux-netdev, linux-s390, Heiko Carstens,
Karsten Graul, Ursula Braun
On 06.11.20 18:59, Jakub Kicinski wrote:
> On Fri, 6 Nov 2020 13:50:07 +0100 Julian Wiedmann wrote:
>> From: Ursula Braun <ubraun@linux.ibm.com>
>>
>> syzbot reported the following KASAN finding:
>>
>> BUG: KASAN: nullptr-dereference in iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
>> Read of size 2 at addr 000000000000021e by task syz-executor907/519
>>
>> CPU: 0 PID: 519 Comm: syz-executor907 Not tainted 5.9.0-syzkaller-07043-gbcf9877ad213 #0
>> Hardware name: IBM 3906 M04 701 (KVM/Linux)
>> Call Trace:
>> [<00000000c576af60>] unwind_start arch/s390/include/asm/unwind.h:65 [inline]
>> [<00000000c576af60>] show_stack+0x180/0x228 arch/s390/kernel/dumpstack.c:135
>> [<00000000c9dcd1f8>] __dump_stack lib/dump_stack.c:77 [inline]
>> [<00000000c9dcd1f8>] dump_stack+0x268/0x2f0 lib/dump_stack.c:118
>> [<00000000c5fed016>] print_address_description.constprop.0+0x5e/0x218 mm/kasan/report.c:383
>> [<00000000c5fec82a>] __kasan_report mm/kasan/report.c:517 [inline]
>> [<00000000c5fec82a>] kasan_report+0x11a/0x168 mm/kasan/report.c:534
>> [<00000000c98b5b60>] iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
>> [<00000000c98b6262>] iucv_sock_shutdown+0x44a/0x4c0 net/iucv/af_iucv.c:1457
>> [<00000000c89d3a54>] __sys_shutdown+0x12c/0x1c8 net/socket.c:2204
>> [<00000000c89d3b70>] __do_sys_shutdown net/socket.c:2212 [inline]
>> [<00000000c89d3b70>] __s390x_sys_shutdown+0x38/0x48 net/socket.c:2210
>> [<00000000c9e36eac>] system_call+0xe0/0x28c arch/s390/kernel/entry.S:415
>>
>> There is nothing to shutdown if a connection has never been established.
>> Besides that iucv->hs_dev is not yet initialized if a socket is in
>> IUCV_OPEN state and iucv->path is not yet initialized if socket is in
>> IUCV_BOUND state.
>> So, just skip the shutdown calls for a socket in these states.
>>
>> Fixes: eac3731bd04c ("s390: Add AF_IUCV socket support")
>> Fixes: 82492a355fac ("af_iucv: add shutdown for HS transport")
>> Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
>> Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
>> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
>
> Fixes tag: Fixes: eac3731bd04c ("s390: Add AF_IUCV socket support")
> Has these problem(s):
> - Subject does not match target commit subject
> Just use
> git log -1 --format='Fixes: %h ("%s")'
>
sigh... yes, that should have been
Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support")
Thanks. Will fix up and get you a v2 shortly.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-11-09 7:53 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-06 12:50 [PATCH net 0/2] net/iucv: fixes 2020-11-06 Julian Wiedmann
2020-11-06 12:50 ` [PATCH net 1/2] net/af_iucv: fix null pointer dereference on shutdown Julian Wiedmann
2020-11-06 16:59 ` Jakub Kicinski
2020-11-09 7:52 ` Julian Wiedmann
2020-11-06 12:50 ` [PATCH net 2/2] MAINTAINERS: remove Ursula Braun as s390 network maintainer Julian Wiedmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).