• Kuniyuki Iwashima's avatar
    af_unix: Remove dead code in unix_stream_read_generic(). · b5c08988
    Kuniyuki Iwashima authored
    When splice() support was added in commit 2b514574 ("net:
    af_unix: implement splice for stream af_unix sockets"), we had
    to release unix_sk(sk)->readlock (current iolock) before calling
    splice_to_pipe().
    
    Due to the unlock, commit 73ed5d25 ("af-unix: fix use-after-free
    with concurrent readers while splicing") added a safeguard in
    unix_stream_read_generic(); we had to bump the skb refcount before
    calling ->recv_actor() and then check if the skb was consumed by a
    concurrent reader.
    
    However, the pipe side locking was refactored, and since commit
    25869262 ("skb_splice_bits(): get rid of callback"), we can
    call splice_to_pipe() without releasing unix_sk(sk)->iolock.
    
    Now, the skb is always alive after the ->recv_actor() callback,
    so let's remove the unnecessary drop_skb logic.
    
    This is mostly the revert of commit 73ed5d25 ("af-unix: fix
    use-after-free with concurrent readers while splicing").
    Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
    Link: https://lore.kernel.org/r/20240529144648.68591-1-kuniyu@amazon.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    b5c08988
af_unix.c 86.2 KB