[PATCH net 1/1] af_unix: read UNIX_DIAG_VFS data under unix_state_lock

[PATCH net 1/1] af_unix: read UNIX_DIAG_VFS data under unix_state_lock

[Ren Wei]

From: Jiexun Wang <wangjiexun2025@gmail.com>

Exact UNIX diag lookups hold a reference to the socket, but not to
u->path. Meanwhile, unix_release_sock() clears u->path under
unix_state_lock() and drops the path reference after unlocking.

Read the inode and device numbers for UNIX_DIAG_VFS while holding
unix_state_lock(), then emit the netlink attribute after dropping the
lock.

This keeps the VFS data stable while the reply is being built.

Fixes: 5f7b0569460b ("unix_diag: Unix inode info NLA")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
 net/unix/diag.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/net/unix/diag.c b/net/unix/diag.c
index ca3473026151..76b2c48137dd 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -28,18 +28,23 @@ static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)
 
 static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
 {
-	struct dentry *dentry = unix_sk(sk)->path.dentry;
+	struct dentry *dentry;
+	struct unix_diag_vfs uv;
+	bool have_vfs = false;
 
+	unix_state_lock(sk);
+	dentry = unix_sk(sk)->path.dentry;
 	if (dentry) {
-		struct unix_diag_vfs uv = {
-			.udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
-			.udiag_vfs_dev = dentry->d_sb->s_dev,
-		};
-
-		return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
+		uv.udiag_vfs_ino = d_backing_inode(dentry)->i_ino;
+		uv.udiag_vfs_dev = dentry->d_sb->s_dev;
+		have_vfs = true;
 	}
+	unix_state_unlock(sk);
 
-	return 0;
+	if (!have_vfs)
+		return 0;
+
+	return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
 }
 
 static int sk_diag_dump_peer(struct sock *sk, struct sk_buff *nlskb)
-- 
2.34.1

Re: [PATCH net 1/1] af_unix: read UNIX_DIAG_VFS data under unix_state_lock

[Kuniyuki Iwashima]

On Mon, Apr 6, 2026 at 6:53 AM Ren Wei <n05ec@lzu.edu.cn> wrote:
>
> From: Jiexun Wang <wangjiexun2025@gmail.com>
>
> Exact UNIX diag lookups hold a reference to the socket, but not to
> u->path. Meanwhile, unix_release_sock() clears u->path under
> unix_state_lock() and drops the path reference after unlocking.
>
> Read the inode and device numbers for UNIX_DIAG_VFS while holding
> unix_state_lock(), then emit the netlink attribute after dropping the
> lock.
>
> This keeps the VFS data stable while the reply is being built.
>
> Fixes: 5f7b0569460b ("unix_diag: Unix inode info NLA")
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Co-developed-by: Yuan Tan <yuantan098@gmail.com>
> Signed-off-by: Yuan Tan <yuantan098@gmail.com>
> Suggested-by: Xin Liu <bird@lzu.edu.cn>
> Tested-by: Ren Wei <enjou1224z@gmail.com>
> Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
> ---
>  net/unix/diag.c | 21 +++++++++++++--------
>  1 file changed, 13 insertions(+), 8 deletions(-)
>
> diff --git a/net/unix/diag.c b/net/unix/diag.c
> index ca3473026151..76b2c48137dd 100644
> --- a/net/unix/diag.c
> +++ b/net/unix/diag.c
> @@ -28,18 +28,23 @@ static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)
>
>  static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
>  {
> -       struct dentry *dentry = unix_sk(sk)->path.dentry;
> +       struct dentry *dentry;
> +       struct unix_diag_vfs uv;
> +       bool have_vfs = false;

nit: Please keep the reverse xmas order.
https://www.kernel.org/doc/html/v6.6/process/maintainer-netdev.html#local-variable-ordering-reverse-xmas-tree-rcs


>
> +       unix_state_lock(sk);
> +       dentry = unix_sk(sk)->path.dentry;
>         if (dentry) {
> -               struct unix_diag_vfs uv = {
> -                       .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
> -                       .udiag_vfs_dev = dentry->d_sb->s_dev,
> -               };
> -
> -               return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
> +               uv.udiag_vfs_ino = d_backing_inode(dentry)->i_ino;
> +               uv.udiag_vfs_dev = dentry->d_sb->s_dev;
> +               have_vfs = true;
>         }
> +       unix_state_unlock(sk);
>
> -       return 0;
> +       if (!have_vfs)
> +               return 0;
> +
> +       return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
>  }
>
>  static int sk_diag_dump_peer(struct sock *sk, struct sk_buff *nlskb)
> --
> 2.34.1
>

[PATCH net v2 1/1] af_unix: read UNIX_DIAG_VFS data under unix_state_lock

[Ren Wei]

From: Jiexun Wang <wangjiexun2025@gmail.com>

Exact UNIX diag lookups hold a reference to the socket, but not to
u->path. Meanwhile, unix_release_sock() clears u->path under
unix_state_lock() and drops the path reference after unlocking.

Read the inode and device numbers for UNIX_DIAG_VFS while holding
unix_state_lock(), then emit the netlink attribute after dropping the
lock.

This keeps the VFS data stable while the reply is being built.

Fixes: 5f7b0569460b ("unix_diag: Unix inode info NLA")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
Changes in v2:
- reorder local variables in reverse xmas tree order

 net/unix/diag.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/net/unix/diag.c b/net/unix/diag.c
index ca3473026151..c9c1e51c4419 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -28,18 +28,23 @@ static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)
 
 static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
 {
-	struct dentry *dentry = unix_sk(sk)->path.dentry;
+	struct unix_diag_vfs uv;
+	struct dentry *dentry;
+	bool have_vfs = false;
 
+	unix_state_lock(sk);
+	dentry = unix_sk(sk)->path.dentry;
 	if (dentry) {
-		struct unix_diag_vfs uv = {
-			.udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
-			.udiag_vfs_dev = dentry->d_sb->s_dev,
-		};
-
-		return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
+		uv.udiag_vfs_ino = d_backing_inode(dentry)->i_ino;
+		uv.udiag_vfs_dev = dentry->d_sb->s_dev;
+		have_vfs = true;
 	}
+	unix_state_unlock(sk);
 
-	return 0;
+	if (!have_vfs)
+		return 0;
+
+	return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
 }
 
 static int sk_diag_dump_peer(struct sock *sk, struct sk_buff *nlskb)
-- 
2.34.1

Re: [PATCH net v2 1/1] af_unix: read UNIX_DIAG_VFS data under unix_state_lock

[Jason Xing]

On Tue, Apr 7, 2026 at 4:01 PM Ren Wei <n05ec@lzu.edu.cn> wrote:
>
> From: Jiexun Wang <wangjiexun2025@gmail.com>
>
> Exact UNIX diag lookups hold a reference to the socket, but not to
> u->path. Meanwhile, unix_release_sock() clears u->path under
> unix_state_lock() and drops the path reference after unlocking.
>
> Read the inode and device numbers for UNIX_DIAG_VFS while holding
> unix_state_lock(), then emit the netlink attribute after dropping the
> lock.
>
> This keeps the VFS data stable while the reply is being built.
>
> Fixes: 5f7b0569460b ("unix_diag: Unix inode info NLA")
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Co-developed-by: Yuan Tan <yuantan098@gmail.com>
> Signed-off-by: Yuan Tan <yuantan098@gmail.com>
> Suggested-by: Xin Liu <bird@lzu.edu.cn>
> Tested-by: Ren Wei <enjou1224z@gmail.com>
> Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>

Next time, please, you should obey the submission rules. One of them
is to at least wait ~24 hours before posting a new version, which
makes reviewers from all over the world have a chance to take a look
at your patch.

Thanks,
Jason

Re: [PATCH net v2 1/1] af_unix: read UNIX_DIAG_VFS data under unix_state_lock

[Kuniyuki Iwashima]

On Tue, Apr 7, 2026 at 1:00 AM Ren Wei <n05ec@lzu.edu.cn> wrote:
>
> From: Jiexun Wang <wangjiexun2025@gmail.com>
>
> Exact UNIX diag lookups hold a reference to the socket, but not to
> u->path. Meanwhile, unix_release_sock() clears u->path under
> unix_state_lock() and drops the path reference after unlocking.
>
> Read the inode and device numbers for UNIX_DIAG_VFS while holding
> unix_state_lock(), then emit the netlink attribute after dropping the
> lock.
>
> This keeps the VFS data stable while the reply is being built.
>
> Fixes: 5f7b0569460b ("unix_diag: Unix inode info NLA")
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Co-developed-by: Yuan Tan <yuantan098@gmail.com>
> Signed-off-by: Yuan Tan <yuantan098@gmail.com>
> Suggested-by: Xin Liu <bird@lzu.edu.cn>
> Tested-by: Ren Wei <enjou1224z@gmail.com>
> Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>

Looks good, thanks !

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Next time your team post patches, please make sure
to follow this guideline:

Documentation/process/maintainer-netdev.rst

(e.g. post a next revision as a separate thread, etc)



> ---
> Changes in v2:
> - reorder local variables in reverse xmas tree order
>
>  net/unix/diag.c | 21 +++++++++++++--------
>  1 file changed, 13 insertions(+), 8 deletions(-)
>
> diff --git a/net/unix/diag.c b/net/unix/diag.c
> index ca3473026151..c9c1e51c4419 100644
> --- a/net/unix/diag.c
> +++ b/net/unix/diag.c
> @@ -28,18 +28,23 @@ static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)
>
>  static int sk_diag_dump_vfs(struct sock *sk, struct sk_buff *nlskb)
>  {
> -       struct dentry *dentry = unix_sk(sk)->path.dentry;
> +       struct unix_diag_vfs uv;
> +       struct dentry *dentry;
> +       bool have_vfs = false;
>
> +       unix_state_lock(sk);
> +       dentry = unix_sk(sk)->path.dentry;
>         if (dentry) {
> -               struct unix_diag_vfs uv = {
> -                       .udiag_vfs_ino = d_backing_inode(dentry)->i_ino,
> -                       .udiag_vfs_dev = dentry->d_sb->s_dev,
> -               };
> -
> -               return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
> +               uv.udiag_vfs_ino = d_backing_inode(dentry)->i_ino;
> +               uv.udiag_vfs_dev = dentry->d_sb->s_dev;
> +               have_vfs = true;
>         }
> +       unix_state_unlock(sk);
>
> -       return 0;
> +       if (!have_vfs)
> +               return 0;
> +
> +       return nla_put(nlskb, UNIX_DIAG_VFS, sizeof(uv), &uv);
>  }
>
>  static int sk_diag_dump_peer(struct sock *sk, struct sk_buff *nlskb)
> --
> 2.34.1
>

Re: [PATCH net v2 1/1] af_unix: read UNIX_DIAG_VFS data under unix_state_lock

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue,  7 Apr 2026 16:00:14 +0800 you wrote:
> From: Jiexun Wang <wangjiexun2025@gmail.com>
> 
> Exact UNIX diag lookups hold a reference to the socket, but not to
> u->path. Meanwhile, unix_release_sock() clears u->path under
> unix_state_lock() and drops the path reference after unlocking.
> 
> Read the inode and device numbers for UNIX_DIAG_VFS while holding
> unix_state_lock(), then emit the netlink attribute after dropping the
> lock.
> 
> [...]

Here is the summary with links:
  - [net,v2,1/1] af_unix: read UNIX_DIAG_VFS data under unix_state_lock
    https://git.kernel.org/netdev/net/c/39897df38637

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html