)]}'
{
  "commit": "e6ed59127c865d56c836747a23cf72cdae465e7b",
  "tree": "388fd64332fc6c6877292ecff40004060115e056",
  "parents": [
    "2eb5b31ac1e3398173e2bf5a042f638056b9fd7f"
  ],
  "author": {
    "name": "Kuniyuki Iwashima",
    "email": "kuniyu@amazon.com",
    "time": "Mon Aug 21 10:55:05 2023 -0700"
  },
  "committer": {
    "name": "Lee Jones",
    "email": "joneslee@google.com",
    "time": "Tue Sep 12 15:01:22 2023 +0100"
  },
  "message": "UPSTREAM: af_unix: Fix null-ptr-deref in unix_stream_sendpage().\n\nBing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage()\nwith detailed analysis and a nice repro.\n\nunix_stream_sendpage() tries to add data to the last skb in the peer\u0027s\nrecv queue without locking the queue.\n\nIf the peer\u0027s FD is passed to another socket and the socket\u0027s FD is\npassed to the peer, there is a loop between them.  If we close both\nsockets without receiving FD, the sockets will be cleaned up by garbage\ncollection.\n\nThe garbage collection iterates such sockets and unlinks skb with\nFD from the socket\u0027s receive queue under the queue\u0027s lock.\n\nSo, there is a race where unix_stream_sendpage() could access an skb\nlocklessly that is being released by garbage collection, resulting in\nuse-after-free.\n\nTo avoid the issue, unix_stream_sendpage() must lock the peer\u0027s recv\nqueue.\n\nNote the issue does not exist in 6.5+ thanks to the recent sendpage()\nrefactoring.\n\nThis patch is originally written by Linus Torvalds.\n\nBUG: unable to handle page fault for address: ffff988004dd6870\nPF: supervisor read access in kernel mode\nPF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nPREEMPT SMP PTI\nCPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0\nCode: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 \u003c49\u003e 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44\nRSP: 0018:ffffc9000079fac0 EFLAGS: 00000246\nRAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284\nRDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0\nRBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00\nR13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8\nFS:  00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __die_body.cold+0x1a/0x1f\n ? page_fault_oops+0xa9/0x1e0\n ? fixup_exception+0x1d/0x310\n ? exc_page_fault+0xa8/0x150\n ? asm_exc_page_fault+0x22/0x30\n ? kmem_cache_alloc_node+0xa2/0x1e0\n ? __alloc_skb+0x16c/0x1e0\n __alloc_skb+0x16c/0x1e0\n alloc_skb_with_frags+0x48/0x1e0\n sock_alloc_send_pskb+0x234/0x270\n unix_stream_sendmsg+0x1f5/0x690\n sock_sendmsg+0x5d/0x60\n ____sys_sendmsg+0x210/0x260\n ___sys_sendmsg+0x83/0xd0\n ? kmem_cache_alloc+0xc6/0x1c0\n ? avc_disable+0x20/0x20\n ? percpu_counter_add_batch+0x53/0xc0\n ? alloc_empty_file+0x5d/0xb0\n ? alloc_file+0x91/0x170\n ? alloc_file_pseudo+0x94/0x100\n ? __fget_light+0x9f/0x120\n __sys_sendmsg+0x54/0xa0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x69/0xd3\nRIP: 0033:0x7f174d639a7d\nCode: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48\nRSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d\nRDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007\nRBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff\nR10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28\nR13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000\n \u003c/TASK\u003e\n\nBug: 299922588\nFixes: 869e7c62486e (\"net: af_unix: implement stream sendpage support\")\nReported-by: Bing-Jhong Billy Jheng \u003cbilly@starlabs.sg\u003e\nReviewed-by: Bing-Jhong Billy Jheng \u003cbilly@starlabs.sg\u003e\nCo-developed-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit 790c2f9d15b594350ae9bca7b236f2b1859de02c)\nSigned-off-by: Lee Jones \u003cjoneslee@google.com\u003e\nChange-Id: Ied4a40e6ae0e594ef84f36287bc6194602935585\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8c05d9aaaefdfa9c6088fc2ac301ffe4f1376e95",
      "old_mode": 33188,
      "old_path": "net/unix/af_unix.c",
      "new_id": "999182d3c1a2fcaf925515e8c61a764ad1902e98",
      "new_mode": 33188,
      "new_path": "net/unix/af_unix.c"
    }
  ]
}