• Miklos Szeredi's avatar
    net: unix: fix inflight counting bug in garbage collector · 6209344f
    Miklos Szeredi authored
    Previously I assumed that the receive queues of candidates don't
    change during the GC.  This is only half true, nothing can be received
    from the queues (see comment in unix_gc()), but buffers could be added
    through the other half of the socket pair, which may still have file
    descriptors referring to it.
    
    This can result in inc_inflight_move_tail() erronously increasing the
    "inflight" counter for a unix socket for which dec_inflight() wasn't
    previously called.  This in turn can trigger the "BUG_ON(total_refs <
    inflight_refs)" in a later garbage collection run.
    
    Fix this by only manipulating the "inflight" counter for sockets which
    are candidates themselves.  Duplicating the file references in
    unix_attach_fds() is also needed to prevent a socket becoming a
    candidate for GC while the skb that contains it is not yet queued.
    Reported-by: default avatarAndrea Bittau <a.bittau@cs.ucl.ac.uk>
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
    CC: stable@kernel.org
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    6209344f
garbage.c 10.3 KB