From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Christian Brauner <brauner@kernel.org>,
Kuniyuki Iwashima <kuniyu@amazon.com>,
Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>,
Jens Axboe <axboe@kernel.dk>, Sasha Levin <sashal@kernel.org>,
Michal Luczaj <mhal@rbox.co>, Rao Shoaib <Rao.Shoaib@oracle.com>,
Pavel Begunkov <asml.silence@gmail.com>,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org
Cc: stable@vger.kernel.org, Simon Horman <horms@kernel.org>
Subject: [PATCH v6.1 02/27] af_unix: Return struct unix_sock from unix_get_socket().
Date: Wed, 21 May 2025 16:27:01 +0100 [thread overview]
Message-ID: <20250521152920.1116756-3-lee@kernel.org> (raw)
In-Reply-To: <20250521152920.1116756-1-lee@kernel.org>
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit 5b17307bd0789edea0675d524a2b277b93bbde62 ]
Currently, unix_get_socket() returns struct sock, but after calling
it, we always cast it to unix_sk().
Let's return struct unix_sock from unix_get_socket().
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240123170856.41348-4-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 5b17307bd0789edea0675d524a2b277b93bbde62)
Signed-off-by: Lee Jones <lee@kernel.org>
---
include/net/af_unix.h | 2 +-
net/unix/garbage.c | 19 +++++++------------
net/unix/scm.c | 19 +++++++------------
3 files changed, 15 insertions(+), 25 deletions(-)
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index e7d71a516bd4..52ae023c3e93 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -13,7 +13,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp);
void unix_destruct_scm(struct sk_buff *skb);
void unix_gc(void);
void wait_for_unix_gc(void);
-struct sock *unix_get_socket(struct file *filp);
+struct unix_sock *unix_get_socket(struct file *filp);
struct sock *unix_peer_get(struct sock *sk);
#define UNIX_HASH_MOD (256 - 1)
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index d2fc795394a5..438f5d9b9173 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -105,20 +105,15 @@ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
while (nfd--) {
/* Get the socket the fd matches if it indeed does so */
- struct sock *sk = unix_get_socket(*fp++);
+ struct unix_sock *u = unix_get_socket(*fp++);
- if (sk) {
- struct unix_sock *u = unix_sk(sk);
+ /* Ignore non-candidates, they could have been added
+ * to the queues after starting the garbage collection
+ */
+ if (u && test_bit(UNIX_GC_CANDIDATE, &u->gc_flags)) {
+ hit = true;
- /* Ignore non-candidates, they could
- * have been added to the queues after
- * starting the garbage collection
- */
- if (test_bit(UNIX_GC_CANDIDATE, &u->gc_flags)) {
- hit = true;
-
- func(u);
- }
+ func(u);
}
}
if (hit && hitlist != NULL) {
diff --git a/net/unix/scm.c b/net/unix/scm.c
index 4eff7da9f6f9..693817a31ad8 100644
--- a/net/unix/scm.c
+++ b/net/unix/scm.c
@@ -21,9 +21,8 @@ EXPORT_SYMBOL(gc_inflight_list);
DEFINE_SPINLOCK(unix_gc_lock);
EXPORT_SYMBOL(unix_gc_lock);
-struct sock *unix_get_socket(struct file *filp)
+struct unix_sock *unix_get_socket(struct file *filp)
{
- struct sock *u_sock = NULL;
struct inode *inode = file_inode(filp);
/* Socket ? */
@@ -33,10 +32,10 @@ struct sock *unix_get_socket(struct file *filp)
/* PF_UNIX ? */
if (s && sock->ops && sock->ops->family == PF_UNIX)
- u_sock = s;
+ return unix_sk(s);
}
- return u_sock;
+ return NULL;
}
EXPORT_SYMBOL(unix_get_socket);
@@ -45,13 +44,11 @@ EXPORT_SYMBOL(unix_get_socket);
*/
void unix_inflight(struct user_struct *user, struct file *fp)
{
- struct sock *s = unix_get_socket(fp);
+ struct unix_sock *u = unix_get_socket(fp);
spin_lock(&unix_gc_lock);
- if (s) {
- struct unix_sock *u = unix_sk(s);
-
+ if (u) {
if (!u->inflight) {
BUG_ON(!list_empty(&u->link));
list_add_tail(&u->link, &gc_inflight_list);
@@ -68,13 +65,11 @@ void unix_inflight(struct user_struct *user, struct file *fp)
void unix_notinflight(struct user_struct *user, struct file *fp)
{
- struct sock *s = unix_get_socket(fp);
+ struct unix_sock *u = unix_get_socket(fp);
spin_lock(&unix_gc_lock);
- if (s) {
- struct unix_sock *u = unix_sk(s);
-
+ if (u) {
BUG_ON(!u->inflight);
BUG_ON(list_empty(&u->link));
--
2.49.0.1143.g0be31eac6b-goog
next prev parent reply other threads:[~2025-05-21 15:32 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-21 15:26 [PATCH v6.1 00/27] af_unix: Align with upstream to avoid a potential UAF Lee Jones
2025-05-21 15:27 ` [PATCH v6.1 01/27] af_unix: Kconfig: make CONFIG_UNIX bool Lee Jones
2025-05-22 2:08 ` Sasha Levin
2025-05-21 15:27 ` Lee Jones [this message]
2025-05-22 2:07 ` [PATCH v6.1 02/27] af_unix: Return struct unix_sock from unix_get_socket() Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 03/27] af_unix: Run GC on only one CPU Lee Jones
2025-05-22 2:08 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 04/27] af_unix: Try to run GC async Lee Jones
2025-05-22 2:04 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 05/27] af_unix: Replace BUG_ON() with WARN_ON_ONCE() Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-23 21:14 ` David Laight
2025-06-04 13:43 ` Lee Jones
2025-06-04 18:45 ` Kuniyuki Iwashima
2025-05-21 15:27 ` [PATCH v6.1 06/27] af_unix: Remove io_uring code for GC Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 07/27] af_unix: Remove CONFIG_UNIX_SCM Lee Jones
2025-05-22 2:07 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 08/27] af_unix: Allocate struct unix_vertex for each inflight AF_UNIX fd Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 09/27] af_unix: Allocate struct unix_edge " Lee Jones
2025-05-22 2:04 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 10/27] af_unix: Link struct unix_edge when queuing skb Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 11/27] af_unix: Bulk update unix_tot_inflight/unix_inflight " Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 12/27] af_unix: Iterate all vertices by DFS Lee Jones
2025-05-22 2:06 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 13/27] af_unix: Detect Strongly Connected Components Lee Jones
2025-05-22 2:04 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 14/27] af_unix: Save listener for embryo socket Lee Jones
2025-05-22 2:08 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 15/27] af_unix: Fix up unix_edge.successor " Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 16/27] af_unix: Save O(n) setup of Tarjan's algo Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 17/27] af_unix: Skip GC if no cycle exists Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 18/27] af_unix: Avoid Tarjan's algorithm if unnecessary Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 19/27] af_unix: Assign a unique index to SCC Lee Jones
2025-05-22 2:04 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 20/27] af_unix: Detect dead SCC Lee Jones
2025-05-22 2:06 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 21/27] af_unix: Replace garbage collection algorithm Lee Jones
2025-05-22 2:07 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 22/27] af_unix: Remove lock dance in unix_peek_fds() Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 23/27] af_unix: Try not to hold unix_gc_lock during accept() Lee Jones
2025-05-22 2:05 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 24/27] af_unix: Don't access successor in unix_del_edges() during GC Lee Jones
2025-05-22 2:07 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 25/27] af_unix: Add dead flag to struct scm_fp_list Lee Jones
2025-05-22 2:07 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 26/27] af_unix: Fix garbage collection of embryos carrying OOB with SCM_RIGHTS Lee Jones
2025-05-22 2:06 ` Sasha Levin
2025-05-21 15:27 ` [PATCH v6.1 27/27] af_unix: Fix uninit-value in __unix_walk_scc() Lee Jones
2025-05-22 2:04 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250521152920.1116756-3-lee@kernel.org \
--to=lee@kernel.org \
--cc=Rao.Shoaib@oracle.com \
--cc=aleksandr.mikhalitsyn@canonical.com \
--cc=asml.silence@gmail.com \
--cc=axboe@kernel.dk \
--cc=brauner@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=kuniyu@amazon.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mhal@rbox.co \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.