netdev - Re: [REGRESSION] af_unix: Introduce SO_PASSRIGHTS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <CAD52833-6A51-494F-A437-2459B772E768@linux.dev>
Date: Wed, 18 Jun 2025 00:30:58 -0700
From: Matthew Schwartz <matthew.schwartz@...ux.dev>
To: Kuniyuki Iwashima <kuni1840@...il.com>
Cc: christian@...sel.eu,
 davem@...emloft.net,
 difrost.kernel@...il.com,
 dnaim@...hyos.org,
 edumazet@...gle.com,
 horms@...nel.org,
 kuba@...nel.org,
 kuniyu@...zon.com,
 linux-kernel@...r.kernel.org,
 mario.limonciello@....com,
 netdev@...r.kernel.org,
 pabeni@...hat.com,
 regressions@...ts.linux.dev
Subject: Re: [REGRESSION] af_unix: Introduce SO_PASSRIGHTS - break OpenGL



> On Jun 11, 2025, at 9:42 AM, Kuniyuki Iwashima <kuni1840@...il.com> wrote:
> 
> From: Christian Heusel <christian@...sel.eu>
> Date: Wed, 11 Jun 2025 13:46:01 +0200
>> On 25/06/10 09:22PM, Jacek Łuczak wrote:
>>> Hi,
>> 
>> Hey,
>> 
>>> Bisection points to:
>>> [3f84d577b79d2fce8221244f2509734940609ca6] af_unix: Inherit sk_flags
>>> at connect().
>> 
>> I'm also suffering from an issue that I have bisected to the same commit,
>> although in a totally different environment and with other reproduction
>> steps: For me the Xorg server crashes as soon as I re-plug my laptops
>> power chord and afterwards I can only switch to a TTY to debug. No
>> errors are logged in the dmesg.
>> 
>> This is the relevant excerpt from the Xorg log (full one is attached):
>> 
>> [    36.544] (EE) modeset(0): Failed to set CTM property: -13
>> [    36.544] (EE) modeset(0): Failed to set CTM property: -13
>> [    36.544] (II) modeset(0): EDID vendor "LEN", prod id 16553
>> [    36.544] (II) modeset(0): Printing DDC gathered Modelines:
>> [    36.544] (II) modeset(0): Modeline "1920x1080"x0.0  138.78  1920 1968 2000 2080  1080 1090 1096 1112 -hsync -vsync (66.7 kHz eP)
>> [    36.547] (EE) modeset(0): Failed to set CTM property: -13
>> [    36.547] (EE) modeset(0): Failed to set CTM property: -13
>> [    36.547] (II) modeset(0): EDID vendor "LEN", prod id 16553
>> [    36.547] (II) modeset(0): Printing DDC gathered Modelines:
>> [    36.547] (II) modeset(0): Modeline "1920x1080"x0.0  138.78  1920 1968 2000 2080  1080 1090 1096 1112 -hsync -vsync (66.7 kHz eP)
>> [    36.897] (WW) modeset(0): Present-unflip: queue flip during flip on CRTC 0 failed: Permission denied
>> [    37.196] (EE) modeset(0): Failed to set CTM property: -13
>> [    37.196] (EE) modeset(0): failed to set mode: No such file or directory
>> 
>> 
>> I can also confirm that reverting the patch on top of 6.16-rc1 fixes the
>> issue for me (thanks for coming up with the revert to Naim from the
>> CachyOS team!).
>> 
>> My xorg version is 21.1.16-1 on Arch Linux and I have attached the
>> revert, my xorg log from the crash and bisection log to this mail!
>> 
>> I'll also CC a few of the netdev people that might have further insights
>> for this issue!
>> 
>>> Reverting entire SO_PASSRIGHTS fixes the issue.
> 
> Thanks for the report.
> 
> Could you test the diff below ?
> 
> look like some programs start listen()ing before setting
> SO_PASSCRED or SO_PASSPIDFD and there's a small race window.
> 
> ---8<---
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index fd6b5e17f6c4..87439d7f965d 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -1971,7 +1971,8 @@ static void unix_maybe_add_creds(struct sk_buff *skb, const struct sock *sk,
> if (UNIXCB(skb).pid)
> return;
> 
> - if (unix_may_passcred(sk) || unix_may_passcred(other)) {
> + if (unix_may_passcred(sk) || unix_may_passcred(other) ||
> +     !other->sk_socket) {
> UNIXCB(skb).pid = get_pid(task_tgid(current));
> current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
> }
> ---8<---

Hello, 

On my MSI Claw with Lunar Lake chipset I am unable to make it past my bootloader even with this posted diff.
I bisected and it led to af_unix: Inherit sk_flags at connect().

In my case, I am unable to attach any logs because my device completely freezes before the journal initializes.

This diff, which makes it essentially a full revert, lets me boot into a kernel built from latest master:

---8<---
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 22e170fb5dda..4dfe94c6d00c 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1708,7 +1708,6 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
        unix_peer(newsk) = sk;
        newsk->sk_state = TCP_ESTABLISHED;
        newsk->sk_type = sk->sk_type;
-       newsk->sk_scm_recv_flags = other->sk_scm_recv_flags;
        init_peercred(newsk, &peercred);
 
        newu = unix_sk(newsk);
@@ -1840,6 +1839,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock,
        unix_state_lock(tsk);
        unix_update_edges(unix_sk(tsk));
        newsock->state = SS_CONNECTED;
+       tsk->sk_scm_recv_flags = READ_ONCE(sk->sk_scm_recv_flags);
        sock_graft(tsk, newsock);
        unix_state_unlock(tsk);
        return 0;
---8<---