static const struct inet_connection_sock_af_ops ipv6_specific = {
  .queue_xmit    = inet6_csk_xmit,
  .send_check    = tcp_v6_send_check,
  .rebuild_header    = inet6_sk_rebuild_header,
  .sk_rx_dst_set     = inet6_sk_rx_dst_set,
  .conn_request      = tcp_v6_conn_request,
  .syn_recv_sock     = tcp_v6_syn_recv_sock,
  .net_header_len    = sizeof(struct ipv6hdr),
  .net_frag_header_len = sizeof(struct frag_hdr),
  .setsockopt    = ipv6_setsockopt,
  .getsockopt    = ipv6_getsockopt,
  .addr2sockaddr     = inet6_csk_addr2sockaddr,
  .sockaddr_len      = sizeof(struct sockaddr_in6),

  .compat_setsockopt = compat_ipv6_setsockopt,
  .compat_getsockopt = compat_ipv6_getsockopt,

  .mtu_reduced       = tcp_v6_mtu_reduced,
};

► f 0 c025b1b8 sk_clone_lock
   f 1 c02b1278 inet_csk_clone_lock+16
   f 2 c02c561c tcp_create_openreq_child+24
   f 3 c02c2574 tcp_v4_syn_recv_sock+48
   f 4 c02c5c08 tcp_check_req+696
   f 5 c02c28a4 tcp_v4_do_rcv+360
   f 6 c02c28a4 tcp_v4_do_rcv+360
   f 7 c02c4d84 tcp_v4_rcv+1736
   f 8 c02a72ac ip_local_deliver_finish+284
   f 9 c0265c10 __netif_receive_skb+940
   f 10 c0265cd8 process_backlog+112

 /*
   * Pointers to address related TCP functions
   * (i.e. things that depend on the address family)
   */
  struct inet_connection_sock_af_ops

/** inet_connection_sock - INET connection oriented sock
*
* @icsk_accept_queue:     FIFO of established children
* @icsk_bind_hash:    Bind node
* @icsk_timeout:      Timeout
* @icsk_retransmit_timer: Resend (no ack)
* @icsk_rto:          Retransmit timeout
* @icsk_pmtu_cookie       Last pmtu seen by socket
* @icsk_ca_ops        Pluggable congestion control hook
* @icsk_af_ops        Operations which are AF_INET{4,6} specific
* @icsk_ulp_ops       Pluggable ULP control hook
* @icsk_ulp_data      ULP private data
* @icsk_ca_state:     Congestion control state
* @icsk_retransmits:      Number of unrecovered [RTO] timeouts
* @icsk_pending:      Scheduled timer event
* @icsk_backoff:      Backoff
* @icsk_syn_retries:      Number of allowed SYN (or equivalent) retries
* @icsk_probes_out:       unanswered 0 window probes
* @icsk_ext_hdr_len:      Network protocol overhead (IP/IPv6 options)
* @icsk_ack:          Delayed ACK control data
* @icsk_mtup;         MTU probing control data
*/
struct inet_connection_sock;

struct tcp_sock {
  /* inet_connection_sock has to be the first member of tcp_sock */
  struct inet_connection_sock inet_conn;
  u16 tcp_header_len; /* Bytes of tcp header to send      */
  // ...
}

►f 0 ffffffff847f4090 tcp_v6_syn_recv_sock
   f 1 ffffffff84655422 tcp_get_cookie_sock+258
   f 2 ffffffff84847bdd cookie_v6_check+6013
   f 3 ffffffff847f9d6d tcp_v6_do_rcv+3661
   f 4 ffffffff847f9d6d tcp_v6_do_rcv+3661
   f 5 ffffffff847fc73e tcp_v6_rcv+8942
   f 6 ffffffff8472c76f ip6_input_finish+879
   f 7 ffffffff8472dbe9 ip6_input+233
   f 8 ffffffff8472dbe9 ip6_input+233
   f 9 ffffffff8472be09 ip6_rcv_finish+425
   f 10 ffffffff8472be09 ip6_rcv_finish+425

static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
                   struct request_sock *req,
                   struct dst_entry *dst,
                   struct request_sock *req_unhash,
                   bool *own_req)

  if (skb->protocol == htons(ETH_P_IP)) {
      /*
       *  v6 mapped
       */

      newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
                       req_unhash, own_req);
      // ...
  }

newsk = tcp_create_openreq_child(sk, req, skb);

if (sk->sk_protocol == IPPROTO_TCP) {
                  struct inet_connection_sock *icsk = inet_csk(sk);
                  local_bh_disable();
                  sock_prot_inuse_add(net, sk->sk_prot, -1);
                  sock_prot_inuse_add(net, &tcp_prot, 1);
                  local_bh_enable();
                  sk->sk_prot = &tcp_prot; // **BOOM**
                  icsk->icsk_af_ops = &ipv4_specific;
                  sk->sk_socket->ops = &inet_stream_ops;
                  sk->sk_family = PF_INET;
                  tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
              }

// net/tls/tls_main.c

static inline void update_sk_prot(struct sock *sk, struct tls_context *ctx)
{
  sk->sk_prot = &tls_prots[ctx->tx_conf];
}

static int __init tls_register(void)
{
  build_protos(tls_prots, &tcp_prot);

  tcp_register_ulp(&tcp_tls_ulp_ops);

  return 0;
}

  newtcp6sk = (struct tcp6_sock *)newsk;
  inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;

  newtp = tcp_sk(newsk);
  newinet = inet_sk(newsk);
  newnp = inet6_sk(newsk);

  memcpy(newnp, np, sizeof(struct ipv6_pinfo));

static inline struct ipv6_pinfo *inet6_sk(const struct sock *__sk)
{
  return sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL;
}

struct tcp6_sock {
  struct tcp_sock   tcp;
  /* ipv6_pinfo has to be the last member of tcp6_sock, see inet6_sk_generic */
  struct ipv6_pinfo inet6;
};

struct tcp6_sock {
        struct tcp_sock            tcp;                  /*     0  2528 */
        /* --- cacheline 39 boundary (2496 bytes) was 32 bytes ago --- */
        struct ipv6_pinfo          inet6;                /*  2528   160 */
        /* --- cacheline 42 boundary (2688 bytes) --- */

        /* size: 2688, cachelines: 42, members: 2 */
};

[   60.682681] The buggy address belongs to the object at ffff880066e4ea80
[   60.682681]  which belongs to the cache TCP of size 2528
[   60.685803] The buggy address is located 0 bytes to the right of
[   60.685803]  2528-byte region [ffff880066e4ea80, ffff880066e4f460)
[   60.689011] The buggy address belongs to the page:
[   60.690323] page:000000002b421986 count:1 mapcount:0 mapping:000000007a7e240e index:0xffff880066e4fffd compound_mapcount: 0
[   60.693179] flags: 0x1fffc0000008100(slab|head)
[   60.694336] raw: 01fffc0000008100 ffff880066e4e000 ffff880066e4fffd 0000000100000003
[   60.696251] raw: ffff88006a4b9348 ffffea0001ab0ca0 ffff8800690afdc0 0000000000000000
[   60.698152] page dumped because: kasan: bad access detected
[   60.699617]
[   60.700021] Memory state around the buggy address:
[   60.701230]  ffff880066e4f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   60.703039]  ffff880066e4f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   60.704813] >ffff880066e4f400: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
[   60.706484]                                                        ^
[   60.708036]  ffff880066e4f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   60.709746]  ffff880066e4f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   60.711449] ==================================================================

 ► f 0 ffffffff8468e1a0 tls_init
   f 1 ffffffff845724e9 tcp_set_ulp+345
   f 2 ffffffff844db4f6 do_tcp_setsockopt.isra+790
   f 3 ffffffff844dd3c0 tcp_setsockopt+176
   f 4 ffffffff842011b5 sock_common_setsockopt+149
   f 5 ffffffff841fc999 sys_setsockopt+393
   f 6 ffffffff841fc999 sys_setsockopt+393
   f 7 ffffffff8524bb11 entry_SYSCALL_64+113

sock = socket(AF_INET, SOCK_STREAM, 0);
setsockopt(sock, SOL_TCP, TCP_ULP, "tls", sizeof("tls"));

commit d91c3e17f75f218022140dee18cf515292184a8f
Author: Ilya Lesokhin <ilyal@mellanox.com>
Date:   Tue Jan 16 15:31:52 2018 +0200

    net/tls: Only attach to sockets in ESTABLISHED state

    Calling accept on a TCP socket with a TLS ulp attached results
    in two sockets that share the same ulp context.
    The ulp context is freed while a socket is destroyed, so
    after one of the sockets is released, the second second will
    trigger a use after free when it tries to access the ulp context
    attached to it.
    We restrict the TLS ulp to sockets in ESTABLISHED state
    to prevent the scenario above.

    Fixes: 3c4d7559159b ("tls: kernel TLS support")
    Reported-by: syzbot+904e7cd6c5c741609228@syzkaller.appspotmail.com
    Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index e07ee3a..7b7a70e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -454,6 +454,15 @@ static int tls_init(struct sock *sk)
        struct tls_context *ctx;
        int rc = 0;

+       /* The TLS ulp is currently supported only for TCP sockets
+        * in ESTABLISHED state.
+        * Supporting sockets in LISTEN state will require us
+        * to modify the accept implementation to clone rather then
+        * share the ulp context.
+        */
+       if (sk->sk_state != TCP_ESTABLISHED)
+               return -ENOTSUPP;
+
        /* allocate tls context */
        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
        if (!ctx) {

$ egrep "sk->sk_prot = " -nr net/
net/core/sock.c:1530:		sk->sk_prot = sk->sk_prot_creator = prot;
net/ipv6/ipv6_sockglue.c:218:				sk->sk_prot = &tcp_prot;
net/ipv6/ipv6_sockglue.c:232:				sk->sk_prot = prot;
net/tls/tls_main.c:58:	sk->sk_prot = &tls_prots[ctx->tx_conf];

  if (sk->sk_protocol == IPPROTO_TCP) {
      struct inet_connection_sock *icsk = inet_csk(sk);
      local_bh_disable();
      sock_prot_inuse_add(net, sk->sk_prot, -1);
      sock_prot_inuse_add(net, &tcp_prot, 1);
      local_bh_enable();
      sk->sk_prot = &tcp_prot;
      icsk->icsk_af_ops = &ipv4_specific;
      sk->sk_socket->ops = &inet_stream_ops;
      sk->sk_family = PF_INET;
      tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
  } else {
      struct proto *prot = &udp_prot;

      if (sk->sk_protocol == IPPROTO_UDPLITE)
          prot = &udplite_prot;
      local_bh_disable();
      sock_prot_inuse_add(net, sk->sk_prot, -1);
      sock_prot_inuse_add(net, prot, 1);
      local_bh_enable();
      sk->sk_prot = prot;
      sk->sk_socket->ops = &inet_dgram_ops;
      sk->sk_family = PF_INET;
  }

$ egrep "\<sk_clone_lock"  -rn --binary-files=without-match net/
net/ipv4/inet_connection_sock.c:781:	struct sock *newsk = sk_clone_lock(sk, priority);
net/ipv4/inet_connection_sock.c:852:	/* sk_clone_lock locked the socket and set refcnt to 2 */
net/core/sock.c:1638: *	sk_clone_lock - clone a socket, and lock its clone
net/core/sock.c:1644:struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
net/core/sock.c:1752:EXPORT_SYMBOL_GPL(sk_clone_lock);

int socket(int domain, int type, int protocol);

SYSCALL_DEFINE3(socket, xxx....)

$ egrep "SYSCALL_DEFINE[[:digit:]]" -n -r net/
net/socket.c:1325:SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
net/socket.c:1366:SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
net/socket.c:1447:SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
net/socket.c:1476:SYSCALL_DEFINE2(listen, int, fd, int, backlog)
net/socket.c:1509:SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
net/socket.c:1583:SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
net/socket.c:1601:SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
...

/**
*  struct socket - general BSD socket
*  @state: socket state (%SS_CONNECTED, etc)
*  @type: socket type (%SOCK_STREAM, etc)
*  @flags: socket flags (%SOCK_ASYNC_NOSPACE, etc)
*  @ops: protocol specific socket operations
*  @file: File back pointer for gc
*  @sk: internal networking protocol agnostic socket representation
*  @wq: wait queue for several uses
*/
struct socket {
  socket_state        state;

  kmemcheck_bitfield_begin(type);
  short           type;
  kmemcheck_bitfield_end(type);

  unsigned long       flags;

  struct socket_wq __rcu  *wq;

  struct file     *file;
  struct sock     *sk;
  const struct proto_ops  *ops;
};

sock = SOCKET_I(inode);

static struct inode *alloc_inode(struct super_block *sb)
{
  struct inode *inode;

  if (sb->s_op->alloc_inode)
      inode = sb->s_op->alloc_inode(sb);
  else
      inode = kmem_cache_alloc(inode_cachep, GFP_KERNEL);
// ...
}

static struct inode *sock_alloc_inode(struct super_block *sb)
{
  struct socket_alloc *ei;
  struct socket_wq *wq;

  ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
  if (!ei)
      return NULL;
  wq = kmalloc(sizeof(*wq), GFP_KERNEL);
  if (!wq) {
      kmem_cache_free(sock_inode_cachep, ei);
      return NULL;
  }
  init_waitqueue_head(&wq->wait);
  wq->fasync_list = NULL;
  wq->flags = 0;
  RCU_INIT_POINTER(ei->socket.wq, wq);

  ei->socket.state = SS_UNCONNECTED;
  ei->socket.flags = 0;
  ei->socket.ops = NULL;
  ei->socket.sk = NULL;
  ei->socket.file = NULL;

  return &ei->vfs_inode;
}

$ grep "\.create" -r -n net/
net/ipv4/af_inet.c:1016:	.create = inet_create, 
net/ipv6/af_inet6.c:613:	.create = inet6_create,
...

  /* The inetsw table contains everything that inet_create needs to
   * build a new socket.
   */
  static struct list_head inetsw[SOCK_MAX];
// inet_create
list_for_each_entry_rcu(answer, &inetsw[sock->type], list) {
	       /* Check the non-wild match. */
          if (protocol == answer->protocol) {
              if (protocol != IPPROTO_IP)
                  break;
          } else {
              /* Check for the two wild cases. */
              if (IPPROTO_IP == protocol) {
                  protocol = answer->protocol;
                  break;
              }
              if (IPPROTO_IP == answer->protocol)
                  break;
          }
          err = -EPROTONOSUPPORT;
}

static int __init inet_init(void)
{
  struct inet_protosw *q;
  struct list_head *r;
  int rc = -EINVAL;

  sock_skb_cb_check_size(sizeof(struct inet_skb_parm));

  rc = proto_register(&tcp_prot, 1);
  if (rc)
      goto out;

  rc = proto_register(&udp_prot, 1);
  if (rc)
      goto out_unregister_tcp_proto;

  rc = proto_register(&raw_prot, 1);
  if (rc)
      goto out_unregister_udp_proto;

  rc = proto_register(&ping_prot, 1);
  if (rc)
      goto out_unregister_raw_proto;
// ...

      /* Register the socket-side information for inet_create. */
  for (r = &inetsw[0]; r < &inetsw[SOCK_MAX]; ++r)
      INIT_LIST_HEAD(r);

  for (q = inetsw_array; q < &inetsw_array[INETSW_ARRAY_LEN]; ++q)
      inet_register_protosw(q);

// ...
      /*
   *  Set the ARP module up
   */

  arp_init();

  /*
   *  Set the IP module up
   */

  ip_init();

  /* Setup TCP slab cache for open requests. */
  tcp_init();

  /* Setup UDP memory threshold */
  udp_init();
}

// net/ipv4/tcp_ipv4.c
struct proto tcp_prot = {
  .name           = "TCP",
  .owner          = THIS_MODULE,
  .close          = tcp_close,
  .connect        = tcp_v4_connect,
  .disconnect     = tcp_disconnect,
  .accept         = inet_csk_accept,
   // ...
}

static struct inet_protosw inetsw_array[] =
{
  {
      .type =       SOCK_STREAM,
      .protocol =   IPPROTO_TCP,
      .prot =       &tcp_prot,
      .ops =        &inet_stream_ops,
      .flags =      INET_PROTOSW_PERMANENT |
                INET_PROTOSW_ICSK,
  },
// ..
}

int proto_register(struct proto *prot, int alloc_slab)
{
  if (alloc_slab) {
      prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0,
                  SLAB_HWCACHE_ALIGN | prot->slab_flags,
                  NULL);
    //...
  }
}

// net/ipv6/tcp_ipv6.c
struct proto tcpv6_prot = {
  .name           = "TCPv6",
  .owner          = THIS_MODULE,
  .close          = tcp_close,
  .connect        = tcp_v6_connect,
  .disconnect     = tcp_disconnect,
  .accept         = inet_csk_accept,
  .ioctl          = tcp_ioctl,
  // ... 
  .obj_size       = sizeof(struct tcp6_sock),
}

struct tcp6_sock {
  struct tcp_sock   tcp;
  /* ipv6_pinfo has to be the last member of tcp6_sock, see inet6_sk_generic */
  struct ipv6_pinfo inet6;
};

socket(AF_INET, SOCK_STREAM, 0);
socket(AF_INET6, SOCK_STREAM, 0);

/*
*  For accept, we attempt to create a new socket, set up the link
*  with the client, wake up the client, then return the new
*  connected fd. We collect the address of the connector in kernel
*  space and move it to user at the very end. This is unclean because
*  we open the socket then return an error.
*
*  1003.1g adds the ability to recvmsg() to query connection pending
*  status to recvmsg. We need to add that support in a way thats
*  clean when we restucture accept also.
*/

SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
      int __user *, upeer_addrlen, int, flags)
{
     struct socket *sock, *newsock;
//...
     sock = sockfd_lookup_light(fd, &err, &fput_needed);
//...
     newsock = sock_alloc();
//...
     newsock->type = sock->type;
     newsock->ops = sock->ops;
// ...
    err = sock->ops->accept(sock, newsock, sock->file->f_flags, false);
}

  int inet_accept(struct socket *sock, struct socket *newsock, int flags,
          bool kern)
  {
      struct sock *sk1 = sock->sk;
      int err = -EINVAL;
      struct sock *sk2 = sk1->sk_prot->accept(sk1, flags, &err, kern);
  	  // ...
  }

static void sk_prot_free(struct proto *prot, struct sock *sk)
{
  struct kmem_cache *slab;
  struct module *owner;

  owner = prot->owner;
  slab = prot->slab;

  cgroup_sk_free(&sk->sk_cgrp_data);
  mem_cgroup_sk_free(sk);
  security_sk_free(sk);
  if (slab != NULL)
      kmem_cache_free(slab, sk);
  else
      kfree(sk);
  module_put(owner);
}

IPV6_ADDRFORM
      Turn an AF_INET6 socket into a socket of a different address
      family.  Only AF_INET is currently supported for that.  It is
      allowed only for IPv6 sockets that are connected and bound to
      a v4-mapped-on-v6 address.  The argument is a pointer to an
      integer containing AF_INET.  This is useful to pass v4-mapped
      sockets as file descriptors to programs that don't know how to
      deal with the IPv6 API.

  if (sk->sk_protocol == IPPROTO_TCP) {
      struct inet_connection_sock *icsk = inet_csk(sk);
      local_bh_disable();
      sock_prot_inuse_add(net, sk->sk_prot, -1);
      sock_prot_inuse_add(net, &tcp_prot, 1);
      local_bh_enable();
      sk->sk_prot = &tcp_prot;
      icsk->icsk_af_ops = &ipv4_specific;
      sk->sk_socket->ops = &inet_stream_ops;
      sk->sk_family = PF_INET;
      tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
  }

  /*
   * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
   * even temporarly, because of RCU lookups. sk_node should also be left as is.
   * We must not copy fields between sk_dontcopy_begin and sk_dontcopy_end
   */
  static void sock_copy(struct sock *nsk, const struct sock *osk)
  {
      memcpy(nsk, osk, offsetof(struct sock, sk_dontcopy_begin));
      memcpy(&nsk->sk_dontcopy_end, &osk->sk_dontcopy_end,
             osk->sk_prot->obj_size - offsetof(struct sock, sk_dontcopy_end));
  }

struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
{
  struct sock *newsk;
  bool is_charged = true;

  newsk = sk_prot_alloc(sk->sk_prot, priority, sk->sk_family);
  if (newsk != NULL) {
      struct sk_filter *filter;

      sock_copy(newsk, sk);
    //...
  }
}

  /**
   *  inet_csk_clone_lock - clone an inet socket, and lock its clone
   *  @sk: the socket to clone
   *  @req: request_sock
   *  @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
   *
   *  Caller must unlock socket even in error path (bh_unlock_sock(newsk))
   */
  struct sock *inet_csk_clone_lock(const struct sock *sk,
                   const struct request_sock *req,
                   const gfp_t priority)
  {
      struct sock *newsk = sk_clone_lock(sk, priority);
  	  // ...
  }

net/ipv4/inet_connection_sock.c：sk_clone_lock
net/ipv4/tcp_minisocks.c：tcp_create_openreq_child
net/ipv4/tcp_ipv4.c：tcp_v4_syn_recv_sock
net/ipv6/tcp_ipv6.c：tcp_v6_syn_recv_sock

/*
* The three way handshake has completed - we got a valid synack -
* now create the new socket.
*/
struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
                struct request_sock *req,
                struct dst_entry *dst,
                struct request_sock *req_unhash,
                bool *own_req)

 ► f 0 c025b1b8 sk_clone_lock
   f 1 c02b1278 inet_csk_clone_lock+16
   f 2 c02c561c tcp_create_openreq_child+24
   f 3 c02c2574 tcp_v4_syn_recv_sock+48
   f 4 c02c5c08 tcp_check_req+696
   f 5 c02c28a4 tcp_v4_do_rcv+360
   f 6 c02c28a4 tcp_v4_do_rcv+360
   f 7 c02c4d84 tcp_v4_rcv+1736
   f 8 c02a72ac ip_local_deliver_finish+284
   f 9 c0265c10 __netif_receive_skb+940
   f 10 c0265cd8 process_backlog+112

cat /etc/passwd

$ ls -l test
-rw-r--r-- 1 pan staff 0 Nov 21 14:35 test

$ setfacl -m u:evilpan:r /etc/passwd

struct cred {
	atomic_t	usage;
#ifdef CONFIG_DEBUG_CREDENTIALS
	atomic_t	subscribers;	/* number of processes subscribed */
	void		*put_addr;
	unsigned	magic;
#define CRED_MAGIC	0x43736564
#define CRED_MAGIC_DEAD	0x44656144
#endif
	kuid_t		uid;		/* real UID of the task */
	kgid_t		gid;		/* real GID of the task */
	kuid_t		suid;		/* saved UID of the task */
	kgid_t		sgid;		/* saved GID of the task */
	kuid_t		euid;		/* effective UID of the task */
	kgid_t		egid;		/* effective GID of the task */
	kuid_t		fsuid;		/* UID for VFS ops */
	kgid_t		fsgid;		/* GID for VFS ops */
	// ...
} __randomize_layout;

static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file)
{
	/* Handle suid and sgid on files */
	struct inode *inode;
	unsigned int mode;
	kuid_t uid;
	kgid_t gid;

	if (!mnt_may_suid(file->f_path.mnt))
		return;

	if (task_no_new_privs(current))
		return;

	inode = file->f_path.dentry->d_inode;
	mode = READ_ONCE(inode->i_mode);
	if (!(mode & (S_ISUID|S_ISGID)))
		return;

	/* Be careful if suid/sgid is set */
	inode_lock(inode);

	/* reload atomically mode/uid/gid now that lock held */
	mode = inode->i_mode;
	uid = inode->i_uid;
	gid = inode->i_gid;
	inode_unlock(inode);

	/* We ignore suid/sgid if there are no mappings for them in the ns */
	if (!kuid_has_mapping(bprm->cred->user_ns, uid) ||
		 !kgid_has_mapping(bprm->cred->user_ns, gid))
		return;

	if (mode & S_ISUID) {
		bprm->per_clear |= PER_CLEAR_ON_SETID;
		bprm->cred->euid = uid;
	}

	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
		bprm->per_clear |= PER_CLEAR_ON_SETID;
		bprm->cred->egid = gid;
	}
}

struct cred {
	// ...
	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
	kernel_cap_t	cap_permitted;	/* caps we're permitted */
	kernel_cap_t	cap_effective;	/* caps we can actually use */
	kernel_cap_t	cap_bset;	/* capability bounding set */
	kernel_cap_t	cap_ambient;	/* Ambient capability set */
  // ...
}

#include <sys/capability.h>

int capget(cap_user_header_t hdrp, cap_user_data_t datap);
int capset(cap_user_header_t hdrp, const cap_user_data_t datap);

typedef struct __user_cap_header_struct {
  __u32 version;
  int pid;
} *cap_user_header_t;

typedef struct __user_cap_data_struct {
  __u32 effective;
  __u32 permitted;
  __u32 inheritable;
} *cap_user_data_t;

generic:/ # ls -lZ /
total 2424
dr-xr-xr-x  3 root   root   u:object_r:cgroup:s0                 0 1970-01-01 08:00 acct
lrwxrwxrwx  1 root   root   u:object_r:rootfs:s0                50 1970-01-01 08:00 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
drwxrwx---  6 system cache  u:object_r:cache_file:s0          4096 2019-12-23 16:52 cache
lrwxrwxrwx  1 root   root   u:object_r:rootfs:s0                13 1970-01-01 08:00 charger -> /sbin/healthd
dr-x------  2 root   root   u:object_r:rootfs:s0                40 1970-01-01 08:00 config
lrwxrwxrwx  1 root   root   u:object_r:rootfs:s0                17 1970-01-01 08:00 d -> /sys/kernel/debug
drwxrwx--x 38 system system u:object_r:system_data_file:s0    4096 1970-01-01 08:00 data

generic:/ # ps -Z
LABEL                          USER      PID   PPID  VSIZE  RSS   WCHAN            PC  NAME
u:r:init:s0                    root      1     0     7856   1556  SyS_epoll_ 0008e458 S /init
u:r:kernel:s0                  root      2     0     0      0       kthreadd 00000000 S kthreadd
u:r:platform_app:s0:c512,c768  u0_a28    1642  885   1669496 105556 binder_thr ab777494 D com.android.systemui
u:r:fingerprintd:s0            system    901   1     8260   3536  binder_thr b12da494 S /system/bin/fingerprintd
u:r:gatekeeperd:s0             system    902   1     7244   2888  binder_thr b21a1494 S /system/bin/gatekeeperd
u:r:perfprofd:s0               root      903   1     4104   1740  hrtimer_na a72f0378 S /system/xbin/perfprofd
u:r:logd:s0                    logd      906   1     4644   2184  __skb_recv ac3d3584 S /system/bin/logcat
u:r:shell:s0                   shell     909   884   3544   1896  sigsuspend af915698 S /system/bin/sh

type=1400 audit(18.250:15): avc: denied { getattr } for pid=939 comm="ls" path="/ueventd.rc" dev="rootfs" ino=2842 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=0

rule_name source_type target_type:class perm_set;

allow initrc_t acct_exec_t:file { getattr read execute };

#define call_int_hook(FUNC, IRC, ...) ({			\
	int RC = IRC;						\
	do {							\
		struct security_hook_list *P;			\
								\
		list_for_each_entry(P, &security_hook_heads.FUNC, list) { \
			RC = P->hook.FUNC(__VA_ARGS__);		\
			if (RC != 0)				\
				break;				\
		}						\
	} while (0);						\
	RC;							\
})

int security_inode_permission(struct inode *inode, int mask)
{
	if (unlikely(IS_PRIVATE(inode)))
		return 0;
	return call_int_hook(inode_permission, 0, inode, mask);
}

struct security_hook_heads {
	struct list_head binder_set_context_mgr;
	struct list_head binder_transaction;
	struct list_head binder_transfer_binder;
	struct list_head binder_transfer_file;
	struct list_head ptrace_access_check;
	struct list_head ptrace_traceme;
	struct list_head capget;
	struct list_head capset;
  //...
  struct list_head inode_permission;
  // ...
}

static struct security_hook_list selinux_hooks[] = {
	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),

	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
	LSM_HOOK_INIT(capget, selinux_capget),
	LSM_HOOK_INIT(capset, selinux_capset),
	// ...
	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
	// ...
}

static int selinux_inode_permission(struct inode *inode, int mask)
{
	const struct cred *cred = current_cred();
	u32 perms;
	bool from_access;
	unsigned flags = mask & MAY_NOT_BLOCK;
	struct inode_security_struct *isec;
	u32 sid;
	struct av_decision avd;
	int rc, rc2;
	u32 audited, denied;

	from_access = mask & MAY_ACCESS;
	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);

	/* No permission to check.  Existence test. */
	if (!mask)
		return 0;

	validate_creds(cred);

	if (unlikely(IS_PRIVATE(inode)))
		return 0;

	perms = file_mask_to_av(inode->i_mode, mask);

	sid = cred_sid(cred);
	isec = inode->i_security;

	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
	audited = avc_audit_required(perms, &avd, rc,
				     from_access ? FILE__AUDIT_ACCESS : 0,
				     &denied);
	if (likely(!audited))
		return rc;

	rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
	if (rc2)
		return rc2;
	return rc;
}

/* Convert a Linux mode and permission mask to an access vector. */
static inline u32 file_mask_to_av(int mode, int mask)
{
	u32 av = 0;

	if (!S_ISDIR(mode)) {
		if (mask & MAY_EXEC)
			av |= FILE__EXECUTE;
		if (mask & MAY_READ)
			av |= FILE__READ;

		if (mask & MAY_APPEND)
			av |= FILE__APPEND;
		else if (mask & MAY_WRITE)
			av |= FILE__WRITE;

	} else {
		if (mask & MAY_EXEC)
			av |= DIR__SEARCH;
		if (mask & MAY_WRITE)
			av |= DIR__WRITE;
		if (mask & MAY_READ)
			av |= DIR__READ;
	}

	return av;
}

$ tcpdump -d -i lo0 tcp
(000) ld       [0]
(001) jeq      #0x1e000000      jt 2	jf 7
(002) ldb      [10]
(003) jeq      #0x6             jt 10	jf 4
(004) jeq      #0x2c            jt 5	jf 11
(005) ldb      [44]
(006) jeq      #0x6             jt 10	jf 11
(007) jeq      #0x2000000       jt 8	jf 11
(008) ldb      [13]
(009) jeq      #0x6             jt 10	jf 11
(010) ret      #262144
(011) ret      #0

int seccomp(unsigned int operation, unsigned int flags, void *args);

64K * 2^4 = 1024K

  /* Free memory management - zoned buddy allocator.  */
  #ifndef CONFIG_FORCE_MAX_ZONEORDER
  #define MAX_ORDER 11
  #else
  #define MAX_ORDER CONFIG_FORCE_MAX_ZONEORDER
  #endif
  #define MAX_ORDER_NR_PAGES (1 << (MAX_ORDER - 1))