Hidayath Khan 47a5116e56 net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() ...

afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC.
If the allocation fails, nsk is NULL.

The connection-refused path is entered when the listen state check
fails, the accept backlog is full, or nsk is NULL. The code
unconditionally calls iucv_sock_kill(nsk) in that path.

iucv_sock_kill() does not accept a NULL socket pointer and immediately
dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL,
calling iucv_sock_kill(nsk) results in a NULL pointer dereference.

Only call iucv_sock_kill() when a child socket was successfully
allocated.

Fixes: 3881ac441f ("af_iucv: add HiperSockets transport")
Cc: [email protected]
Reviewed-by: Alexandra Winter <[email protected]>
Signed-off-by: Hidayath Khan <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

2026-07-21 13:36:35 -07:00

..

af_iucv.c

net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

2026-07-21 13:36:35 -07:00

iucv.c

net/iucv: Add missing kernel-doc return value descriptions

2026-03-31 20:14:56 -07:00

Kconfig

…

Makefile

…