From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BACB2EF653; Wed, 20 May 2026 02:00:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779242405; cv=none; b=F2UTQp4qgJmosP2eRizPIqKybWd60A/FdfCx15nfzCDkEgrkoisZBGV26LLz9LQVCJswDlHF03pg3B8Zen+UlohnaR8WstPIbB896X4jMhKkWP9eY64PXrhsfQhwgRDFgkjX07/QOe5qyevgJOKuDsoK0YtBImXNhHHAd3sP+xk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779242405; c=relaxed/simple; bh=hKBEjkBeMstZ1c6Gd/LoUWXY9tNVRCfCjbXJBLjXIuc=; h=Content-Type:MIME-Version:Subject:From:Message-Id:Date:References: In-Reply-To:To:Cc; b=JM2gySh0hmlJtF56ZwMG8bO/9Dt/Mo3O2iNrum5Cm9pEd9eEbVrxYQXHHveuyR4+wWGL9lptWixOfuJ4sTZU+g6H1gQViIKbxLADMfAlSLevTj1n30VKvsUKh+ZIUh5VVx4+CHZFAMk9Q7Ss/5ABecLocFf5JNaDIV+oyKKcoPs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nv7yLkGr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nv7yLkGr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C58141F00893; Wed, 20 May 2026 02:00:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779242403; bh=dR/8v3e09UhAOIRZ3hglRVOtYohxPzpuknZycuXiDak=; h=Subject:From:Date:References:In-Reply-To:To:Cc; b=nv7yLkGrLIotlnFTB03VueCyXYawMtkpjjTFVjk9B0/qbo/mYnhr5QPpLAu/j1VQ7 q4NQNysnp9F4S2H/zJZNHipzcVaNv6VaJlj5+rK8w3IaaS3X9SJ75yE21IR4G7lpbs aT3yzRjmcnxix+ZvzNGUNwRgEqG8ABWFuzp/6XRuBnXg3nca1jE6oTKlmsfeVVL9Nx Poga8OQtdlm8Ztk4U+ELdUtQ0E+n1uWSdTsW3uEVfjQlggKQKfem4e74rvqnfPqlnN D5lKyQT+pq3EiEN7NuZpwNk/IkhViQJ2vuEkEBI4joXe/4JI+ml3GQmmJA0IPMBdYg bcKrRO7Lq1ujA== Received: from [10.30.226.235] (localhost [IPv6:::1]) by aws-us-west-2-korg-oddjob-rhel9-1.codeaurora.org (Postfix) with ESMTP id D0958383BF53; Wed, 20 May 2026 02:00:15 +0000 (UTC) Content-Type: text/plain; charset="utf-8" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: Re: [PATCH net v2] af_unix: Fix UAF read of tail->len in unix_stream_data_wait() From: patchwork-bot+netdevbpf@kernel.org Message-Id: <177924241439.2949285.2336931812292012916.git-patchwork-notify@kernel.org> Date: Wed, 20 May 2026 02:00:14 +0000 References: <20260518-b4-unix-recv-wait-hotfix-v2-1-83e29ce8ad31@google.com> In-Reply-To: <20260518-b4-unix-recv-wait-hotfix-v2-1-83e29ce8ad31@google.com> To: Jann Horn Cc: kuniyu@google.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, hannes@stressinduktion.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski : On Mon, 18 May 2026 18:51:30 +0200 you wrote: > unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without > holding any lock that prevents SKBs on that queue from being dequeued and > freed. > This has been the case since commit 79f632c71bea ("unix/stream: fix > peeking with an offset larger than data in queue"). > The first consequence of this is that the pointer comparison > `tail != last` can be false even if `last` semantically refers to an > already-freed SKB while `tail` is a new SKB allocated at the same address; > which can cause unix_stream_data_wait() to wrongly keep blocking after new > data has arrived, but only in a weird scenario where a peeking recv() and > a normal recv() on the same socket are racing, which is probably not a > real problem. > > [...] Here is the summary with links: - [net,v2] af_unix: Fix UAF read of tail->len in unix_stream_data_wait() https://git.kernel.org/netdev/net/c/be309f8eae8b You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html