netdev - Re: [REGRESSION] af_unix: Introduce SO_PASSRIGHTS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20250917013352.722151-1-kuniyu@google.com>
Date: Wed, 17 Sep 2025 01:33:33 +0000
From: Kuniyuki Iwashima <kuniyu@...gle.com>
To: brian.scott.sampson@...il.com
Cc: christian@...sel.eu, davem@...emloft.net, difrost.kernel@...il.com, 
	dnaim@...hyos.org, edumazet@...gle.com, horms@...nel.org, kuba@...nel.org, 
	kuni1840@...il.com, kuniyu@...gle.com, linux-kernel@...r.kernel.org, 
	mario.limonciello@....com, netdev@...r.kernel.org, pabeni@...hat.com, 
	regressions@...ts.linux.dev
Subject: Re: [REGRESSION] af_unix: Introduce SO_PASSRIGHTS - break OpenGL

From: brian.scott.sampson@...il.com
Date: Tue, 16 Sep 2025 17:16:40 -0500
> > Thanks for the report.
> > 
> > Could you test the diff below ?
> > 
> > look like some programs start listen()ing before setting
> > SO_PASSCRED or SO_PASSPIDFD and there's a small race window.
> > 
> > ---8<---
> > diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> > index fd6b5e17f6c4..87439d7f965d 100644
> > --- a/net/unix/af_unix.c
> > +++ b/net/unix/af_unix.c
> > @@ -1971,7 +1971,8 @@ static void unix_maybe_add_creds(struct sk_buff
> > *skb, const struct sock *sk,
> >  	if (UNIXCB(skb).pid)
> >  		return;
> >  
> > -	if (unix_may_passcred(sk) || unix_may_passcred(other)) {
> > +	if (unix_may_passcred(sk) || unix_may_passcred(other) ||
> > +	    !other->sk_socket) {
> >  		UNIXCB(skb).pid = get_pid(task_tgid(current));
> >  		current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
> >  	}
> > ---8<---
> Just came across this when troubleshooting a resume from suspend issue
> where I'm get a black screen after suspend. Initially saw this with my
> distribution's(Linux 6.16.7-2-cachyos) kernel, and confirmed the issue
> in the latest version of the vanilla mainline kernel. Bisection is also
> pointing to commit 3f84d577b79d2fce8221244f2509734940609ca6.
> 
> This patch appears to be already applied in the mainline kernel, so
> this might be something different. I'm new to mailing lists, so wasn't
> sure if I should report this issue here or start a new email chain.

Could you test it with this diff and see if 2 or 3 splats are logged
in dmesg ?  and in that case, please share the stack traces.

I expect this won't trigger the black screen and you can check dmesg
after resume.

Thanks!

---8<---
diff --git a/include/net/sock.h b/include/net/sock.h
index fb13322a11fc..211084602e01 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -539,7 +539,9 @@ struct sock {
 				sk_scm_security : 1,
 				sk_scm_pidfd : 1,
 				sk_scm_rights : 1,
-				sk_scm_unused : 4;
+				sk_scm_embryo_cred: 1,
+				sk_scm_parent_cred: 1,
+				sk_scm_unused : 2;
 		};
 	};
 	u8			sk_clockid;
diff --git a/net/core/scm.c b/net/core/scm.c
index 072d5742440a..e603bf5400e0 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -510,7 +510,7 @@ static bool __scm_recv_common(struct sock *sk, struct msghdr *msg,
 		return false;
 	}
 
-	if (sk->sk_scm_credentials) {
+	if (sk->sk_scm_credentials || sk->sk_scm_parent_cred) {
 		struct user_namespace *current_ns = current_user_ns();
 		struct ucred ucreds = {
 			.pid = scm->creds.pid,
@@ -518,6 +518,11 @@ static bool __scm_recv_common(struct sock *sk, struct msghdr *msg,
 			.gid = from_kgid_munged(current_ns, scm->creds.gid),
 		};
 
+		WARN_ON_ONCE(!sk->sk_scm_credentials && sk->sk_scm_parent_cred &&
+			     sk->sk_scm_embryo_cred);
+		WARN_ON_ONCE(!sk->sk_scm_credentials && sk->sk_scm_parent_cred &&
+			     !sk->sk_scm_embryo_cred);
+
 		put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds);
 	}
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 158bddd23134..ff68b8f7c119 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1545,6 +1545,9 @@ int sk_setsockopt(struct sock *sk, int level, int optname,
 		break;
 
 	case SO_PASSCRED:
+		WARN_ON_ONCE(sk_is_unix(sk) && sk->sk_state == TCP_LISTEN &&
+			     skb_queue_len_lockless(&sk->sk_receive_queue));
+
 		if (sk_may_scm_recv(sk))
 			sk->sk_scm_credentials = valbool;
 		else
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 6d7c110814ff..c8ea44f6d1d7 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1897,6 +1897,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock,
 	unix_state_lock(tsk);
 	unix_update_edges(unix_sk(tsk));
 	newsock->state = SS_CONNECTED;
+	tsk->sk_scm_parent_cred = sk->sk_scm_credentials;
 	sock_graft(tsk, newsock);
 	unix_state_unlock(tsk);
 	return 0;
@@ -2037,7 +2038,7 @@ static void unix_skb_to_scm(struct sk_buff *skb, struct scm_cookie *scm)
  * Return: On success zero, on error a negative error code is returned.
  */
 static int unix_maybe_add_creds(struct sk_buff *skb, const struct sock *sk,
-				const struct sock *other)
+				struct sock *other)
 {
 	if (UNIXCB(skb).pid)
 		return 0;
@@ -2047,6 +2048,9 @@ static int unix_maybe_add_creds(struct sk_buff *skb, const struct sock *sk,
 		struct pid *pid;
 		int err;
 
+		if (!other->sk_socket)
+			other->sk_scm_embryo_cred = true;
+
 		pid = task_tgid(current);
 		err = pidfs_register_pid(pid);
 		if (unlikely(err))
---8<---