Re: [PATCH net] net/iucv: take a reference on the socket found in afiucv_hs_rcv()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Sun, 05 Jul 2026 22:24:36 -0500 you wrote:
> From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> 
> afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock,
> drops the lock, and then passes the socket to the afiucv_hs_callback_*()
> handlers without holding a reference. AF_IUCV sockets are not
> RCU-protected and are freed synchronously by iucv_sock_kill() ->
> sock_put(), so a concurrent close can free the socket in the window
> between read_unlock() and the handler, which then dereferences freed
> memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()).
> 
> [...]

Here is the summary with links:
  - [net] net/iucv: take a reference on the socket found in afiucv_hs_rcv()
    https://git.kernel.org/netdev/net/c/4fa349156043

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html