Re: [PATCH net] net/iucv: take a reference on the socket found in afiucv_hs_rcv()

[Bryam Vargas <hexlabsecurity@proton.me>]

Alexandra,

Agreed -- and thanks for the pointer to f558120cd709. The reference pin
closes the lookup-without-hold free in afiucv_hs_rcv(), but sashiko is
right that it doesn't touch the larger gap: the receive path changes
sk_state from softirq without honoring sock_owned_by_user(), so it still
races a process-context lock_sock(). Same class as the close-path UAF you
fixed.

I'll take a first pass. Plan is an RFC that routes the softirq state
changes through the standard sock_owned_by_user()/backlog path instead of
mutating the socket under bh_lock_sock() alone, so a held socket defers
rather than races. af_iucv is s390-only and I don't have HiperSockets
hardware -- I verify against a KASAN model of the receive path -- so I'd
rely on you or Hidayath to validate each revision on real HW before it
lands.

I'm already in this code from a separate severed-path UAF fix [1]. If
you'd rather keep the rework in-house on the s390 side, say so and I'll
send my analysis and the model instead.

[1] https://lore.kernel.org/all/20260707-b4-disp-783fedbb-v1-1-463b9dbda2ea@proton.me/

Thanks,
Bryam