linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00

No description

C 96.8%
Assembly 0.9%
Rust 0.7%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Weiming Shi e00b169eaa net: sock: fix hardened usercopy panic in sock_recv_errqueue [ Upstream commit `2a71a1a8d0` ] skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error queue, accessing the sock_exterr_skb structure in skb->cb via put_cmsg() triggers a usercopy hardening violation: [ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)! [ 5.382796] kernel BUG at mm/usercopy.c:102! [ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7 [ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80 [ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490 [ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246 [ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74 [ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0 [ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74 [ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001 [ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00 [ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000 [ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0 [ 5.384903] PKRU: 55555554 [ 5.384903] Call Trace: [ 5.384903] <TASK> [ 5.384903] __check_heap_object+0x9a/0xd0 [ 5.384903] __check_object_size+0x46c/0x690 [ 5.384903] put_cmsg+0x129/0x5e0 [ 5.384903] sock_recv_errqueue+0x22f/0x380 [ 5.384903] tls_sw_recvmsg+0x7ed/0x1960 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? schedule+0x6d/0x270 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? mutex_unlock+0x81/0xd0 [ 5.384903] ? __pfx_mutex_unlock+0x10/0x10 [ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10 [ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0 [ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 The crash offset 296 corresponds to skb2->cb within skbuff_fclones: - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 - offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 = 272 + 24 (inside sock_exterr_skb.ee) This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure. [1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885 [2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104 [3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566 [4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491 [5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719 Fixes: `6d07d1cd30` ("usercopy: Restrict non-usercopy caches to size 0") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2026-01-17 16:35:23 +01:00
arch	arm64: dts: mba8mx: Fix Ethernet PHY IRQ support	2026-01-17 16:35:21 +01:00
block	block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()	2026-01-08 10:17:21 +01:00
certs	sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3	2024-09-20 19:52:48 +03:00
crypto	crypto: seqiv - Do not use req->iv after crypto_aead_encrypt	2026-01-08 10:16:43 +01:00
Documentation	dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets	2026-01-02 12:57:27 +01:00
drivers	net: phy: mxl-86110: Add power management and soft reset support	2026-01-17 16:35:23 +01:00
fs	netfs: Fix early read unlock of page with EOF in middle	2026-01-17 16:35:19 +01:00
include	btrfs: fix NULL dereference on root when tracing inode eviction	2026-01-17 16:35:18 +01:00
init	printk changes for 6.18	2025-10-04 11:13:11 -07:00
io_uring	io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic	2026-01-17 16:35:14 +01:00
ipc	namespace-6.18-rc1	2025-09-29 11:20:29 -07:00
kernel	PM: hibernate: Fix crash when freeing invalid crypto compressor	2026-01-17 16:35:14 +01:00
lib	lib/crypto: aes: Fix missing MMU protection for AES S-box	2026-01-17 16:35:12 +01:00
LICENSES	LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2	2025-07-24 11:15:39 +02:00
mm	mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of()	2026-01-08 10:17:21 +01:00
net	net: sock: fix hardened usercopy panic in sock_recv_errqueue	2026-01-17 16:35:23 +01:00
rust	rust: maple_tree: rcu_read_lock() in destructor to silence lockdep	2026-01-08 10:17:11 +01:00
samples	samples/ftrace: Adjust LoongArch register restore order in direct calls	2026-01-08 10:17:11 +01:00
scripts	mcb: Add missing modpost build support	2026-01-08 10:16:47 +01:00
security	kernel/kexec: change the prototype of kimage_map_segment()	2026-01-08 10:17:10 +01:00
sound	ALSA: hda/realtek: Add support for ASUS UM3406GA	2026-01-17 16:35:17 +01:00
tools	selftests/mm: fix thread state check in uffd-unit-tests	2026-01-08 10:17:11 +01:00
usr	gen_init_cpio: Ignore fsync() returning EINVAL on pipes	2025-10-07 09:53:05 -07:00
virt	KVM: Fix last_boosted_vcpu index assignment bug	2026-01-02 12:57:21 +01:00
.clang-format	memblock: drop for_each_free_mem_pfn_range_in_zone_from()	2025-09-14 08:49:03 +03:00
.clippy.toml	rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration	2025-05-07 00:11:47 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.editorconfig	.editorconfig: remove trim_trailing_whitespace option	2024-06-13 16:47:52 +02:00
.get_maintainer.ignore	MAINTAINERS: remove Alyssa Rosenzweig	2025-09-18 21:17:31 +02:00
.gitattributes	.gitattributes: set diff driver for Rust source code files	2023-05-31 17:48:25 +02:00
.gitignore	.gitignore: ignore compile_commands.json globally	2025-08-12 15:53:55 -07:00
.mailmap	8 hotfixes. 4 are cc:stable, 7 are against mm/.	2025-11-26 12:38:05 -08:00
.pylintrc	tools: docs: parse-headers.py: move it from sphinx dir	2025-08-29 15:54:42 -06:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: mark ISDN subsystem as orphan	2025-10-27 17:49:45 -07:00
Kbuild	sched: Make migrate_{en,dis}able() inline	2025-09-25 09:57:16 +02:00
Kconfig	io_uring: Rename KConfig to Kconfig	2025-02-19 14:53:27 -07:00
MAINTAINERS	soc: fixes for 6.18, part 4	2025-11-28 09:57:31 -08:00
Makefile	Linux 6.18.5	2026-01-11 15:26:20 +01:00
README	README: Fix spelling	2024-03-18 03:36:32 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.