Re: [PATCH net-next] net/iucv: fix UAF in afiucv_netdev_event()

[Nagamani PV <nagamani@linux.ibm.com>]

On 04/08/26 7:00 PM, Alexandra Winter wrote:
> 
> 
> On 04.08.26 14:52, Nagamani PV wrote:
>>> I'd rather continue to work on a more complete fix than take this one,
>>> but both ways are possible.
>>>
>> Understood. This patch addresses the UAF on iucv_sk_list traversal
>> specifically. The lock_sock() concern is at a different level and
>> could be a follow-up.
>>
>> Could you clarify your preference — take this as an incremental fix
>> with a follow-up for lock_sock(), or hold and work toward a combined
>> solution?
> 
> I prefer to work on the combined solution

The combined solution is now posted as [PATCH net v2]:

  https://lore.kernel.org/netdev/20260917071706.23831-1-nagamani@linux.ibm.com/

The v2 fixes all three races in one patch using a two-pass algorithm:
Pass 1 under read_lock_bh() collects matching sockets with sock_hold();
Pass 2 under lock_sock() per socket calls iucv_send_ctrl() and updates
sk_state, serialising against iucv_sock_close() and sock_orphan().

All three bugs confirmed with KASAN + KCSAN TAP on IBM Z.

Thanks,
Nagamani PV