Re: [PATCH] iucv: fix lockless sk_for_each in afiucv_netdev_event

[Alexandra Winter]

On 19.10.26 15:22, Haoran Wang wrote:
> afiucv_netdev_event() traverses iucv_sk_list.head with sk_for_each()
> without holding iucv_sk_list.lock:
> 
>     /* net/iucv/af_iucv.c:2218 */
>     sk_for_each(sk, &iucv_sk_list.head) {
>         iucv = iucv_sk(sk);
>         if ((iucv->hs_dev == event_dev) &&
>             (sk->sk_state == IUCV_CONNECTED)) {
>             if (event == NETDEV_GOING_DOWN)
>                 iucv_send_ctrl(sk, AF_IUCV_FLAG_FIN);
>             sk->sk_state = IUCV_DISCONN;
>             sk->sk_state_change(sk);
>         }
>     }
> 

Hello Haoran Wang,
thank you for your contribution.
I think the issue you are fixing is the same that Nagamani already sent a fix for [1].

We are currently working on hardening the basic socket locking mechanism in af_iucv [2],
and I asked Nagamani to hold off until that work is done.

So I think this issue is already being worked on (please correct me, if I'm wrong).
Feel free to comment on Nagamani's proposal, as you have an understanding of the issue.

Kind regards
Alexandra


Link: https://lore.kernel.org/netdev/20260803182053.2355882-1-nagamani@xxxxxxxxxxxxx/ [1]
Link: https://lore.kernel.org/netdev/20260724222917.134769-1-hexlabsecurity@xxxxxxxxx/ [2]