)]}'
{
  "commit": "5d50d9defad33f7338599079ca039107113994b5",
  "tree": "1353bfedfddc3e8c843781736a403be3bb26f1ef",
  "parents": [
    "baa1f1d60074f0938c665e64a11e639c274a8c11"
  ],
  "author": {
    "name": "Kuniyuki Iwashima",
    "email": "kuniyu@amazon.com",
    "time": "Mon Sep 08 14:16:00 2025 -0400"
  },
  "committer": {
    "name": "Miri Amarilio",
    "email": "mirilio@google.com",
    "time": "Thu Oct 09 13:56:06 2025 -0700"
  },
  "message": "net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.\n\n[ Upstream commit 0bb2f7a1ad1f11d861f58e5ee5051c8974ff9569 ]\n\nWhen I ran the repro [0] and waited a few seconds, I observed two\nLOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1]\n\nReproduction Steps:\n\n  1) Mount CIFS\n  2) Add an iptables rule to drop incoming FIN packets for CIFS\n  3) Unmount CIFS\n  4) Unload the CIFS module\n  5) Remove the iptables rule\n\nAt step 3), the CIFS module calls sock_release() for the underlying\nTCP socket, and it returns quickly.  However, the socket remains in\nFIN_WAIT_1 because incoming FIN packets are dropped.\n\nAt this point, the module\u0027s refcnt is 0 while the socket is still\nalive, so the following rmmod command succeeds.\n\n  # ss -tan\n  State      Recv-Q Send-Q Local Address:Port  Peer Address:Port\n  FIN-WAIT-1 0      477        10.0.2.15:51062   10.0.0.137:445\n\n  # lsmod | grep cifs\n  cifs                 1159168  0\n\nThis highlights a discrepancy between the lifetime of the CIFS module\nand the underlying TCP socket.  Even after CIFS calls sock_release()\nand it returns, the TCP socket does not die immediately in order to\nclose the connection gracefully.\n\nWhile this is generally fine, it causes an issue with LOCKDEP because\nCIFS assigns a different lock class to the TCP socket\u0027s sk-\u003esk_lock\nusing sock_lock_init_class_and_name().\n\nOnce an incoming packet is processed for the socket or a timer fires,\nsk-\u003esk_lock is acquired.\n\nThen, LOCKDEP checks the lock context in check_wait_context(), where\nhlock_class() is called to retrieve the lock class.  However, since\nthe module has already been unloaded, hlock_class() logs a warning\nand returns NULL, triggering the null-ptr-deref.\n\nIf LOCKDEP is enabled, we must ensure that a module calling\nsock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded\nwhile such a socket is still alive to prevent this issue.\n\nLet\u0027s hold the module reference in sock_lock_init_class_and_name()\nand release it when the socket is freed in sk_prot_free().\n\nNote that sock_lock_init() clears sk-\u003esk_owner for svc_create_socket()\nthat calls sock_lock_init_class_and_name() for a listening socket,\nwhich clones a socket by sk_clone_lock() without GFP_ZERO.\n\n[0]:\nCIFS_SERVER\u003d\"10.0.0.137\"\nCIFS_PATH\u003d\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\"\nDEV\u003d\"enp0s3\"\nCRED\u003d\"/root/WindowsCredential.txt\"\n\nMNT\u003d$(mktemp -d /tmp/XXXXXX)\nmount -t cifs ${CIFS_PATH} ${MNT} -o vers\u003d3.0,credentials\u003d${CRED},cache\u003dnone,echo_interval\u003d1\n\niptables -A INPUT -s ${CIFS_SERVER} -j DROP\n\nfor i in $(seq 10);\ndo\n    umount ${MNT}\n    rmmod cifs\n    sleep 1\ndone\n\nrm -r ${MNT}\n\niptables -D INPUT -s ${CIFS_SERVER} -j DROP\n\n[1]:\nDEBUG_LOCKS_WARN_ON(1)\nWARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)\nModules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\nCPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)\n...\nCall Trace:\n \u003cIRQ\u003e\n __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178)\n lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816)\n _raw_spin_lock_nested (kernel/locking/spinlock.c:379)\n tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350)\n...\n\nBUG: kernel NULL pointer dereference, address: 00000000000000c4\n PF: supervisor read access in kernel mode\n PF: error_code(0x0000) - not-present page\nPGD 0\nOops: Oops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G        W          6.14.0 #36\nTainted: [W]\u003dWARN\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:__lock_acquire (kernel/locking/lockdep.c:4852 kernel/locking/lockdep.c:5178)\nCode: 15 41 09 c7 41 8b 44 24 20 25 ff 1f 00 00 41 09 c7 8b 84 24 a0 00 00 00 45 89 7c 24 20 41 89 44 24 24 e8 e1 bc ff ff 4c 89 e7 \u003c44\u003e 0f b6 b8 c4 00 00 00 e8 d1 bc ff ff 0f b6 80 c5 00 00 00 88 44\nRSP: 0018:ffa0000000468a10 EFLAGS: 00010046\nRAX: 0000000000000000 RBX: ff1100010091cc38 RCX: 0000000000000027\nRDX: ff1100081f09ca48 RSI: 0000000000000001 RDI: ff1100010091cc88\nRBP: ff1100010091c200 R08: ff1100083fe6e228 R09: 00000000ffffbfff\nR10: ff1100081eca0000 R11: ff1100083fe10dc0 R12: ff1100010091cc88\nR13: 0000000000000001 R14: 0000000000000000 R15: 00000000000424b1\nFS:  0000000000000000(0000) GS:ff1100081f080000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000000c4 CR3: 0000000002c4a003 CR4: 0000000000771ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816)\n _raw_spin_lock_nested (kernel/locking/spinlock.c:379)\n tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350)\n ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205 (discriminator 1))\n ip_local_deliver_finish (./include/linux/rcupdate.h:878 net/ipv4/ip_input.c:234)\n ip_sublist_rcv_finish (net/ipv4/ip_input.c:576)\n ip_list_rcv_finish (net/ipv4/ip_input.c:628)\n ip_list_rcv (net/ipv4/ip_input.c:670)\n __netif_receive_skb_list_core (net/core/dev.c:5939 net/core/dev.c:5986)\n netif_receive_skb_list_internal (net/core/dev.c:6040 net/core/dev.c:6129)\n napi_complete_done (./include/linux/list.h:37 ./include/net/gro.h:519 ./include/net/gro.h:514 net/core/dev.c:6496)\n e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3815)\n __napi_poll.constprop.0 (net/core/dev.c:7191)\n net_rx_action (net/core/dev.c:7262 net/core/dev.c:7382)\n handle_softirqs (kernel/softirq.c:561)\n __irq_exit_rcu (kernel/softirq.c:596 kernel/softirq.c:435 kernel/softirq.c:662)\n irq_exit_rcu (kernel/softirq.c:680)\n common_interrupt (arch/x86/kernel/irq.c:280 (discriminator 14))\n  \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_common_interrupt (./arch/x86/include/asm/idtentry.h:693)\nRIP: 0010:default_idle (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:92 arch/x86/kernel/process.c:744)\nCode: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d c3 2b 15 00 fb f4 \u003cfa\u003e c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90\nRSP: 0018:ffa00000000ffee8 EFLAGS: 00000202\nRAX: 000000000000640b RBX: ff1100010091c200 RCX: 0000000000061aa4\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff812f30c5\nRBP: 000000000000000a R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n ? do_idle (kernel/sched/idle.c:186 kernel/sched/idle.c:325)\n default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:118)\n do_idle (kernel/sched/idle.c:186 kernel/sched/idle.c:325)\n cpu_startup_entry (kernel/sched/idle.c:422 (discriminator 1))\n start_secondary (arch/x86/kernel/smpboot.c:315)\n common_startup_64 (arch/x86/kernel/head_64.S:421)\n \u003c/TASK\u003e\nModules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\nCR2: 00000000000000c4\n\nBUG\u003db/446333467\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-23143 in the Linux kernel.\n\nFixes: ed07536ed673 (\"[PATCH] lockdep: annotate nfs/nfsd in-kernel sockets\")\nChange-Id: I3c5b263ff92f875c0d3ecda1b64913886fa3c458\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20250407163313.22682-1-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n[ Adjust context ]\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/113823\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5dd89dc1b35de39ff24d9474a97ecf66d6df79f6",
      "old_mode": 33188,
      "old_path": "include/net/sock.h",
      "new_id": "14ae686e53cb423d3b22baf8937048f563370ea2",
      "new_mode": 33188,
      "new_path": "include/net/sock.h"
    },
    {
      "type": "modify",
      "old_id": "f4c38980a4cdc394216c356c0114e5c00848a9e2",
      "old_mode": 33188,
      "old_path": "net/core/sock.c",
      "new_id": "93146f8142da23b5a3ebd2e1d5ff75cc93cd667f",
      "new_mode": 33188,
      "new_path": "net/core/sock.c"
    }
  ]
}