$ wget https://mirrors.tuna.tsinghua.edu.cn/kernel/v6.x/linux-6.0.2.tar.xz
$ tar -xvf linux-6.0.2.tar.xz
# KASAN: 设置 make menuconfig 设置"Kernel hacking" ->"Memory Debugging" -> "KASan: runtime memory debugger"。
$ make -j32
$ make all
$ make modules
# 编译出的bzImage目录：/arch/x86/boot/bzImage。

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 9fcf534f2d927..7be5bb4c94b6d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -803,6 +803,7 @@ typedef unsigned char *sk_buff_data_t;
  *	@csum_level: indicates the number of consecutive checksums found in
  *		the packet minus one that have been verified as
  *		CHECKSUM_UNNECESSARY (max 3)
+ *	@scm_io_uring: SKB holds io_uring registered files
  *	@dst_pending_confirm: need to confirm neighbour
  *	@decrypted: Decrypted SKB
  *	@slow_gro: state present at GRO time, slower prepare step required
@@ -982,6 +983,7 @@ struct sk_buff {
 #endif
 	__u8			slow_gro:1;
 	__u8			csum_not_inet:1;
+	__u8			scm_io_uring:1;
 
 #ifdef CONFIG_NET_SCHED
 	__u16			tc_index;	/* traffic control index */
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 6f88ded0e7e56..012fdb04ec238 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -855,6 +855,7 @@ int __io_scm_file_account(struct io_ring_ctx *ctx, struct file *file)
 
 		UNIXCB(skb).fp = fpl;
 		skb->sk = sk;
+		skb->scm_io_uring = 1;		// 对于使用 `io_uring_register` 功能进行注册的文件，其生成的 skb 标记 scm_io_uring 成员位
 		skb->destructor = unix_destruct_scm;
 		refcount_add(skb->truesize, &sk->sk_wmem_alloc);
 	}
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index d45d5366115a7..dc27635403932 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -204,6 +204,7 @@ void wait_for_unix_gc(void)
 /* The external entry point: unix_gc() */
 void unix_gc(void)
 {
+	struct sk_buff *next_skb, *skb;
 	struct unix_sock *u;
 	struct unix_sock *next;
 	struct sk_buff_head hitlist;
@@ -297,11 +298,30 @@ void unix_gc(void)
 
 	spin_unlock(&unix_gc_lock);
 
+	/* We need io_uring to clean its registered files, ignore all io_uring
+	 * originated skbs. It's fine as io_uring doesn't keep references to
+	 * other io_uring instances and so killing all other files in the cycle
+	 * will put all io_uring references forcing it to go through normal
+	 * release.path eventually putting registered files.
+	 */
+	skb_queue_walk_safe(&hitlist, skb, next_skb) {
+		if (skb->scm_io_uring) {		// unix_gc() 不处理通过 `io_uring` 注册的文件
+			__skb_unlink(skb, &hitlist);
+			skb_queue_tail(&skb->sk->sk_receive_queue, skb);
+		}
+	}
+
 	/* Here we are. Hitlist is filled. Die. */
 	__skb_queue_purge(&hitlist);
 
 	spin_lock(&unix_gc_lock);
 
+	/* There could be io_uring registered files, just push them back to
+	 * the inflight list
+	 */
+	list_for_each_entry_safe(u, next, &gc_candidates, link)
+		list_move_tail(&u->link, &gc_inflight_list);
+
 	/* All candidates should have been detached by now. */
 	BUG_ON(!list_empty(&gc_candidates));

static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
			      size_t len)
{
	struct scm_cookie scm;
	··· 
	err = scm_send(sock, msg, &scm, false);// [1] 先调用`scm_send()`获取用户传入的文件描述符对应的文件，然后初始化 scm_cookie 结构（scm_cookie->fp->fp指向待传递的`file`结构列表），此时会增加文件引用计数，表示SCM正在处理该文件，最后在[3]处调用scm_destroy()减少文件引用计数。
    ···    
	skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
				   msg->msg_flags & MSG_DONTWAIT, &err,
				   PAGE_ALLOC_COSTLY_ORDER);
	if (skb == NULL)
		goto out;

	err = unix_scm_to_skb(&scm, skb, true);// [2] 调用 unix_scm_to_skb()->unix_attach_fds() 将 `scm_cookie->fp` 文件列表绑定到相应的skb对象，并增加文件引用计数（调用scm_fp_dup()）和飞行计数（调用unix_inflight()）
	···
    scm_destroy(&scm);// [3] 发送结束后释放scm，将刚刚初始化scm时增加的文件引用计数减少（调用fput()）
    ···
    skb_queue_tail(&other->sk_receive_queue, skb);// [4] 将skb添加到对端的接收队列
}

static struct file *io_uring_get_file(struct io_ring_ctx *ctx)
{
	struct file *file;
#if defined(CONFIG_UNIX)
	int ret;

	ret = sock_create_kern(&init_net, PF_UNIX, SOCK_RAW, IPPROTO_IP,
				&ctx->ring_sock); // 给 ctx->ring_sock 初始化一个sock结构体
	if (ret)
		return ERR_PTR(ret);
#endif

	file = anon_inode_getfile("[io_uring]", &io_uring_fops, ctx,
					O_RDWR | O_CLOEXEC); // 初始化一个file对象，其fd后续给用户使用
#if defined(CONFIG_UNIX)
	if (IS_ERR(file)) {
		sock_release(ctx->ring_sock);
		ctx->ring_sock = NULL;
	} else {
		ctx->ring_sock->file = file;
	}
#endif
	return file;
}  

SYSCALL_DEFINE4(io_uring_register, unsigned int, fd, unsigned int, opcode,
		void __user *, arg, unsigned int, nr_args)
{
	···
	ret = __io_uring_register(ctx, opcode, arg, nr_args);
	···
}

static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,//2602
				 unsigned nr_args, u64 __user *tags)
{
	···
    // [1] nr_user_files 用户绑定的文件数量，遍历所有用户传进来的文件描述符
	for (i = 0; i < nr_args; i++, ctx->nr_user_files++) {
		u64 tag = 0;

		if ((tags && copy_from_user(&tag, &tags[i], sizeof(tag))) ||
		    copy_from_user(&fd, &fds[i], sizeof(fd))) {// [1] 获取用户传递的文件描述符fd
			ret = -EFAULT;
			goto out_fput;
		}
		···
		file = fget(fd);					// [1] 获取文件结构体，fget会对文件引用次数+1
		···
		if (file->f_op == &io_uring_fops) {	// 不能io_uring 注册自己
			fput(file);
			goto out_fput;
		}
		ctx->file_data->tags[i] = tag;
		io_fixed_file_set(io_fixed_file_slot(&ctx->file_table, i), file);
	}

	ret = io_sqe_files_scm(ctx);			// [2] 关键函数，进一步逻辑
	···
}

static int __io_sqe_files_scm(struct io_ring_ctx *ctx, int nr, int offset)//ctx,thisfiles total
{
	struct sock *sk = ctx->ring_sock->sk;	// [1] sock 是最开始 io_uring 初始化的时候创建的
	struct scm_fp_list *fpl;
	struct sk_buff *skb;
	int i, nr_files;

	fpl = kzalloc(sizeof(*fpl), GFP_KERNEL);
	···
	skb = alloc_skb(0, GFP_KERNEL);			// [2] 申请一个sk_buff，可以保存多个用户传入的 `file` 结构
	···
	skb->sk = sk;							// skb->sk 指向 io_uring 的 sk

	nr_files = 0;
	fpl->user = get_uid(current_user());
	for (i = 0; i < nr; i++) {				// [2] 遍历所有文件
		struct file *file = io_file_from_index(ctx, i + offset);// 获得文件结构体

		if (!file)
			continue;
		fpl->fp[nr_files] = get_file(file);	// [2] get_file同样会使file引用次数+1，把文件注册到fpl中
		unix_inflight(fpl->user, fpl->fp[nr_files]);	// [2] 把文件添加到发送队列，会增加sock类型文件的inflight飞行计数
		nr_files++;
	}

	if (nr_files) {
		fpl->max = SCM_MAX_FD;
		fpl->count = nr_files;
		UNIXCB(skb).fp = fpl;				// [2] fpl 给skb
		skb->destructor = unix_destruct_scm;
		refcount_add(skb->truesize, &sk->sk_wmem_alloc);
		skb_queue_head(&sk->sk_receive_queue, skb);// [2] 将新分配的skb添加到sk->sk_receive_queue中 ！！！！！！ 漏洞点 ！！！！！！

		for (i = 0; i < nr_files; i++)
			fput(fpl->fp[i]);				// [3] 对这些文件使用fput，平衡刚刚使用的get_file
	} else {
		kfree_skb(skb);
		kfree(fpl);
	}

	return 0;
}

int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
			  unsigned nr_args, u64 __user *tags)
{
	...
    ret = io_rsrc_data_alloc(ctx, io_rsrc_file_put, tags, nr_args,	// 读取 tags
				 &ctx->file_data);
    ...
	for (i = 0; i < nr_args; i++, ctx->nr_user_files++) {	// [1] 遍历 nr_args 个用户传进来的文件描述符
		struct io_fixed_file *file_slot;

		if (fds && copy_from_user(&fd, &fds[i], sizeof(fd))) {	// 获取文件描述符 fd
			ret = -EFAULT;
			goto fail;
		}
		...
		file = fget(fd);										// 获取 file 结构体，fget对文件引用次数+1
		...
		if (io_is_uring_fops(file)) {							// 判断 file->f_op == &io_uring_fops
			fput(file);
			goto fail;
		}
		ret = io_scm_file_account(ctx, file);					// [2] 关键漏洞函数
		if (ret) {
			fput(file);
			goto fail;
		}
		file_slot = io_fixed_file_slot(&ctx->file_table, i);
		io_fixed_file_set(file_slot, file);
		io_file_bitmap_set(&ctx->file_table, i);
	}
	...
}

int __io_scm_file_account(struct io_ring_ctx *ctx, struct file *file)
{
#if defined(CONFIG_UNIX)
	struct sock *sk = ctx->ring_sock->sk;			// [1] sock 是最开始 io_uring 初始化的时候创建的
	struct sk_buff_head *head = &sk->sk_receive_queue;
	struct scm_fp_list *fpl;
	struct sk_buff *skb;

    // 看能否将本 file 整合到现有的 skb SCM_RIGHTS file 集合（sk->sk_receive_queue）中，如果没有则分配新的skb
	spin_lock_irq(&head->lock);
	skb = skb_peek(head);
	if (skb && UNIXCB(skb).fp->count < SCM_MAX_FD)
		__skb_unlink(skb, head);
	else
		skb = NULL;
	spin_unlock_irq(&head->lock);

	if (!skb) {
		fpl = kzalloc(sizeof(*fpl), GFP_KERNEL);
		if (!fpl)
			return -ENOMEM;

		skb = alloc_skb(0, GFP_KERNEL);				// [2] 每注册一个文件，都会申请一个 sk_buff (skb)

		fpl->user = get_uid(current_user());
		fpl->max = SCM_MAX_FD;
		fpl->count = 0;

		UNIXCB(skb).fp = fpl;
		skb->sk = sk;								// skb->sk 指向 io_uring 的 sk        
		skb->destructor = unix_destruct_scm;
		refcount_add(skb->truesize, &sk->sk_wmem_alloc);
	}

	fpl = UNIXCB(skb).fp;
	fpl->fp[fpl->count++] = get_file(file);			// 文件引用次数+1，将用户传入的文件加入到 sk->fp->fp 中
	unix_inflight(fpl->user, file);					// 把文件添加到发送队列，会增加sock类型文件的inflight飞行计数
	skb_queue_head(head, skb);						// 将新分配的skb添加到sk->sk_receive_queue中 ！！！！！！ 漏洞点 ！！！！！！
	fput(file);										// [3] 文件引用次数-1
#endif
	return 0;
}

static int io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
			 const struct io_uring_sqe *sqe)
{
	struct io_submit_link *link = &ctx->submit_state.link;
	int ret;

	ret = io_init_req(ctx, req, sqe);	// 初始化调用任务
	···
	ret = io_req_prep(req, sqe);		// 准备调用任务，这里会进行文件权限的判断
	···
		} else {
			io_queue_sqe(req);			// 尝试执行
	···
}

static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
{
	if (unlikely(!(req->file->f_mode & FMODE_WRITE)))
		return -EBADF;
	return io_prep_rw(req, sqe);
}

static int io_write(struct io_kiocb *req, unsigned int issue_flags)
{
    ...
    ret = io_rw_init_file(req, FMODE_WRITE);
    ...
}

static int io_rw_init_file(struct io_kiocb *req, fmode_t mode)
{
    ...
    if (unlikely(!file || !(file->f_mode & mode)))		// 检查文件写权限
		return -EBADF;
    ...
}