ACK: [SRU][N][PATCH 1/1] af_unix: Initialise scc_index in unix_add_edge().

[Stefan Bader]

On 06/01/2026 20:20, Tim Whisonant wrote:
> From: Kuniyuki Iwashima <kuniyu at google.com>
> 
> Quang Le reported that the AF_UNIX GC could garbage-collect a
> receive queue of an alive in-flight socket, with a nice repro.
> 
> The repro consists of three stages.
> 
>    1)
>      1-a. Create a single cyclic reference with many sockets
>      1-b. close() all sockets
>      1-c. Trigger GC
> 
>    2)
>      2-a. Pass sk-A to an embryo sk-B
>      2-b. Pass sk-X to sk-X
>      2-c. Trigger GC
> 
>    3)
>      3-a. accept() the embryo sk-B
>      3-b. Pass sk-B to sk-C
>      3-c. close() the in-flight sk-A
>      3-d. Trigger GC
> 
> As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,
> and unix_walk_scc() groups them into two different SCCs:
> 
>    unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
>    unix_sk(sk-X)->vertex->scc_index = 3
> 
> Once GC completes, unix_graph_grouped is set to true.
> Also, unix_graph_maybe_cyclic is set to true due to sk-X's
> cyclic self-reference, which makes close() trigger GC.
> 
> At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and
> links it to unix_unvisited_vertices.
> 
> unix_update_graph() is called at 3-a. and 3-b., but neither
> unix_graph_grouped nor unix_graph_maybe_cyclic is changed
> because both sk-B's listener and sk-C are not in-flight.
> 
> 3-c decrements sk-A's file refcnt to 1.
> 
> Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast()
> is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:
> 
>    sk-A -> sk-B (-> sk-C)
>    sk-X -> sk-X
> 
> This is totally fine.  All of them are not yet close()d and
> should be grouped into different SCCs.
> 
> However, unix_vertex_dead() misjudges that sk-A and sk-B are
> in the same SCC and sk-A is dead.
> 
>    unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong!
>    &&
>    sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree
>                                         ^-- 1 in-flight count for sk-B
>    -> sk-A is dead !?
> 
> The problem is that unix_add_edge() does not initialise scc_index.
> 
> Stage 1) is used for heap spraying, making a newly allocated
> vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START)
> set by unix_walk_scc() at 1-c.
> 
> Let's track the max SCC index from the previous unix_walk_scc()
> call and assign the max + 1 to a new vertex's scc_index.
> 
> This way, we can continue to avoid Tarjan's algorithm while
> preventing misjudgments.
> 
> Fixes: ad081928a8b0 ("af_unix: Avoid Tarjan's algorithm if unnecessary.")
> Reported-by: Quang Le <quanglex97 at gmail.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu at google.com>
> Link: https://patch.msgid.link/20251109025233.3659187-1-kuniyu@google.com
> Signed-off-by: Paolo Abeni <pabeni at redhat.com>
> 
> (cherry picked from commit 60e6489f8e3b086bd1130ad4450a2c112e863791)
> CVE-2025-40214
> Signed-off-by: Tim Whisonant <tim.whisonant at canonical.com>

Acked-by: Stefan Bader <stefan.bader at canonical.com>
> ---
>   net/unix/garbage.c | 14 +++++++++++---
>   1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/net/unix/garbage.c b/net/unix/garbage.c
> index 0068e758be4dd..66fd606c43f45 100644
> --- a/net/unix/garbage.c
> +++ b/net/unix/garbage.c
> @@ -136,6 +136,7 @@ enum unix_vertex_index {
>   };
>   
>   static unsigned long unix_vertex_unvisited_index = UNIX_VERTEX_INDEX_MARK1;
> +static unsigned long unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START;
>   
>   static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge)
>   {
> @@ -144,6 +145,7 @@ static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge)
>   	if (!vertex) {
>   		vertex = list_first_entry(&fpl->vertices, typeof(*vertex), entry);
>   		vertex->index = unix_vertex_unvisited_index;
> +		vertex->scc_index = ++unix_vertex_max_scc_index;
>   		vertex->out_degree = 0;
>   		INIT_LIST_HEAD(&vertex->edges);
>   		INIT_LIST_HEAD(&vertex->scc_entry);
> @@ -480,10 +482,15 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde
>   				scc_dead = unix_vertex_dead(v);
>   		}
>   
> -		if (scc_dead)
> +		if (scc_dead) {
>   			unix_collect_skb(&scc, hitlist);
> -		else if (!unix_graph_maybe_cyclic)
> -			unix_graph_maybe_cyclic = unix_scc_cyclic(&scc);
> +		} else {
> +			if (unix_vertex_max_scc_index < vertex->scc_index)
> +				unix_vertex_max_scc_index = vertex->scc_index;
> +
> +			if (!unix_graph_maybe_cyclic)
> +				unix_graph_maybe_cyclic = unix_scc_cyclic(&scc);
> +		}
>   
>   		list_del(&scc);
>   	}
> @@ -498,6 +505,7 @@ static void unix_walk_scc(struct sk_buff_head *hitlist)
>   	unsigned long last_index = UNIX_VERTEX_INDEX_START;
>   
>   	unix_graph_maybe_cyclic = false;
> +	unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START;
>   
>   	/* Visit every vertex exactly once.
>   	 * __unix_walk_scc() moves visited vertices to unix_visited_vertices.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260108/78c98657/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260108/78c98657/attachment-0001.sig>