linux-kernel - Re: [REGRESSION] af_unix: Introduce SO_PASSRIGHTS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250611164339.2828069-1-kuni1840@gmail.com>
Date: Wed, 11 Jun 2025 09:42:20 -0700
From: Kuniyuki Iwashima <kuni1840@...il.com>
To: christian@...sel.eu
Cc: davem@...emloft.net,
	difrost.kernel@...il.com,
	dnaim@...hyos.org,
	edumazet@...gle.com,
	horms@...nel.org,
	kuba@...nel.org,
	kuni1840@...il.com,
	kuniyu@...zon.com,
	linux-kernel@...r.kernel.org,
	mario.limonciello@....com,
	netdev@...r.kernel.org,
	pabeni@...hat.com,
	regressions@...ts.linux.dev
Subject: Re: [REGRESSION] af_unix: Introduce SO_PASSRIGHTS - break OpenGL

From: Christian Heusel <christian@...sel.eu>
Date: Wed, 11 Jun 2025 13:46:01 +0200
> On 25/06/10 09:22PM, Jacek Łuczak wrote:
> > Hi,
> 
> Hey,
> 
> > Bisection points to:
> > [3f84d577b79d2fce8221244f2509734940609ca6] af_unix: Inherit sk_flags
> > at connect().
> 
> I'm also suffering from an issue that I have bisected to the same commit,
> although in a totally different environment and with other reproduction
> steps: For me the Xorg server crashes as soon as I re-plug my laptops
> power chord and afterwards I can only switch to a TTY to debug. No
> errors are logged in the dmesg.
> 
> This is the relevant excerpt from the Xorg log (full one is attached):
> 
> [    36.544] (EE) modeset(0): Failed to set CTM property: -13
> [    36.544] (EE) modeset(0): Failed to set CTM property: -13
> [    36.544] (II) modeset(0): EDID vendor "LEN", prod id 16553
> [    36.544] (II) modeset(0): Printing DDC gathered Modelines:
> [    36.544] (II) modeset(0): Modeline "1920x1080"x0.0  138.78  1920 1968 2000 2080  1080 1090 1096 1112 -hsync -vsync (66.7 kHz eP)
> [    36.547] (EE) modeset(0): Failed to set CTM property: -13
> [    36.547] (EE) modeset(0): Failed to set CTM property: -13
> [    36.547] (II) modeset(0): EDID vendor "LEN", prod id 16553
> [    36.547] (II) modeset(0): Printing DDC gathered Modelines:
> [    36.547] (II) modeset(0): Modeline "1920x1080"x0.0  138.78  1920 1968 2000 2080  1080 1090 1096 1112 -hsync -vsync (66.7 kHz eP)
> [    36.897] (WW) modeset(0): Present-unflip: queue flip during flip on CRTC 0 failed: Permission denied
> [    37.196] (EE) modeset(0): Failed to set CTM property: -13
> [    37.196] (EE) modeset(0): failed to set mode: No such file or directory
> 
> 
> I can also confirm that reverting the patch on top of 6.16-rc1 fixes the
> issue for me (thanks for coming up with the revert to Naim from the
> CachyOS team!).
> 
> My xorg version is 21.1.16-1 on Arch Linux and I have attached the
> revert, my xorg log from the crash and bisection log to this mail!
> 
> I'll also CC a few of the netdev people that might have further insights
> for this issue!
> 
> > Reverting entire SO_PASSRIGHTS fixes the issue.

Thanks for the report.

Could you test the diff below ?

look like some programs start listen()ing before setting
SO_PASSCRED or SO_PASSPIDFD and there's a small race window.

---8<---
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index fd6b5e17f6c4..87439d7f965d 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1971,7 +1971,8 @@ static void unix_maybe_add_creds(struct sk_buff *skb, const struct sock *sk,
 	if (UNIXCB(skb).pid)
 		return;
 
-	if (unix_may_passcred(sk) || unix_may_passcred(other)) {
+	if (unix_may_passcred(sk) || unix_may_passcred(other) ||
+	    !other->sk_socket) {
 		UNIXCB(skb).pid = get_pid(task_tgid(current));
 		current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
 	}
---8<---