)]}'
{
  "commit": "4fa349156043dc119721d067329714179f501749",
  "tree": "39e4f1b0afa78cd461c8a51293879d5e8b66f985",
  "parents": [
    "f2f152e94a67bc746afaf05a1b2702c195553112"
  ],
  "author": {
    "name": "Bryam Vargas",
    "email": "hexlabsecurity@proton.me",
    "time": "Sun Jul 05 22:24:36 2026 -0500"
  },
  "committer": {
    "name": "Paolo Abeni",
    "email": "pabeni@redhat.com",
    "time": "Fri Jul 10 16:24:43 2026 +0200"
  },
  "message": "net/iucv: take a reference on the socket found in afiucv_hs_rcv()\n\nafiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock,\ndrops the lock, and then passes the socket to the afiucv_hs_callback_*()\nhandlers without holding a reference. AF_IUCV sockets are not\nRCU-protected and are freed synchronously by iucv_sock_kill() -\u003e\nsock_put(), so a concurrent close can free the socket in the window\nbetween read_unlock() and the handler, which then dereferences freed\nmemory (for example sk-\u003esk_data_ready() in afiucv_hs_callback_syn()).\n\nTake a reference with sock_hold() while the socket is still on the list\nand release it with sock_put() once the handler has run.\n\nFixes: 3881ac441f64 (\"af_iucv: add HiperSockets transport\")\nSigned-off-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nReviewed-by: Hidayath Khan \u003chidayath@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260705-b4-disp-fc79c0dc-v1-1-d2cdcb57afa9@proton.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fed240b453bd9b517a571d65640f939fa3bbfd0d",
      "old_mode": 33188,
      "old_path": "net/iucv/af_iucv.c",
      "new_id": "b85fb9767dec211918f7e8d6a16e88c0b20455b8",
      "new_mode": 33188,
      "new_path": "net/iucv/af_iucv.c"
    }
  ]
}