From f38bce9af9e2a3cced7d303a1476f21c1f42bcb7 Mon Sep 17 00:00:00 2001 From: Bryam Vargas Date: Wed, 28 Oct 2026 23:47:13 -0500 Subject: [PATCH] net/iucv: take a private, writable frame before rewriting it in place afiucv_hs_rcv() rewrites the frame in place -- EBCASC() on four name fields, then afiucv_swap_src_dest() swaps them and pushes an Ethernet header -- and can hand the same skb to dev_queue_xmit(), without making it private first, so a packet socket that also gets the frame reads the rewritten names. An ETH_P_ALL tap runs first and leaves af_iucv a cloned skb; a socket opened for ETH_P_AF_IUCV sits on a ptype_specific list, walked after ptype_base[], so deliver_skb() takes a reference and af_iucv runs on an skb that is shared but not cloned. Unshare, then cow, in that order: skb_cow() can reach pskb_expand_head(), which has BUG_ON(skb_shared()). skb_cow() tests skb_cloned(), which is what a rewrite of the data needs; skb_cow_head() tests only the header. Asking for ETH_HLEN also covers the unchecked push in afiucv_swap_src_dest(); on the ordinary path eth_type_trans() has already pulled that much, so it only compares. Fixes: 3881ac441f64 ("af_iucv: add HiperSockets transport") Closes: https://sashiko.dev/#/patchset/20260813-b4-disp-60433a46-v1-1-509e1200533e@proton.me?part=1 Signed-off-by: Bryam Vargas Reviewed-by: Simon Horman Link: https://patch.msgid.link/20261028-b4-disp-1edbbc34-v3-1-13495411f5b9@proton.me Signed-off-by: Paolo Abeni --- net/iucv/af_iucv.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c index 5ba875798aa4..ce13fe3c85b5 100644 --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -2080,11 +2080,20 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev, int err = NET_RX_SUCCESS; char nullstring[8]; + skb = skb_share_check(skb, GFP_ATOMIC); + if (!skb) + return NET_RX_SUCCESS; + if (!pskb_may_pull(skb, sizeof(*trans_hdr))) { kfree_skb(skb); return NET_RX_SUCCESS; } + if (skb_cow(skb, ETH_HLEN)) { + kfree_skb(skb); + return NET_RX_SUCCESS; + } + trans_hdr = iucv_trans_hdr(skb); EBCASC(trans_hdr->destAppName, sizeof(trans_hdr->destAppName)); EBCASC(trans_hdr->destUserID, sizeof(trans_hdr->destUserID));