[PATCH v1 net] af_unix: Convert unsigned long to u64 for GC.

[PATCH v1 net] af_unix: Convert unsigned long to u64 for GC.

[Kuniyuki Iwashima]

Lim Chanyoun reported that unix_vertex_max_scc_index could
wrap around on 32-bit kernels, which confuses GC into purging
a live socket receive queue.

I apparently designed GC with u64 in mind to avoid wraparound. [0]

Let's make it true on 32-bit kernels.

Note that unix_vertex.{out_degree,index} are converted for
consistency; they are bounded by the number of allocated
objects and do not exceed UINT_MAX on 32-bit kernels.

Fixes: 4090fa373f0e ("af_unix: Replace garbage collection algorithm.")
Link: https://lore.kernel.org/netdev/20240228030508.31297-1-kuniyu@amazon.com/ #[0]
Reported-by: Lim Chanyoun <onleaf322@gmail.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
 net/unix/garbage.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index da774f56ca64..a0b515354e8b 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -78,9 +78,9 @@ struct unix_vertex {
 	struct list_head edges;
 	struct list_head entry;
 	struct list_head scc_entry;
-	unsigned long out_degree;
-	unsigned long index;
-	unsigned long scc_index;
+	u64 out_degree;
+	u64 index;
+	u64 scc_index;
 };
 
 struct unix_edge {
@@ -148,8 +148,8 @@ enum unix_vertex_index {
 	UNIX_VERTEX_INDEX_START,
 };
 
-static unsigned long unix_vertex_unvisited_index = UNIX_VERTEX_INDEX_MARK1;
-static unsigned long unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START;
+static u64 unix_vertex_unvisited_index = UNIX_VERTEX_INDEX_MARK1;
+static u64 unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START;
 
 static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge)
 {
@@ -372,7 +372,7 @@ static bool unix_vertex_dead(struct unix_vertex *vertex)
 }
 
 static LIST_HEAD(unix_visited_vertices);
-static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2;
+static u64 unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2;
 
 static bool unix_scc_dead(struct list_head *scc)
 {
@@ -450,14 +450,14 @@ static bool unix_scc_cyclic(struct list_head *scc)
 	return false;
 }
 
-static unsigned long __unix_walk_scc(struct unix_vertex *vertex,
-				     unsigned long *last_index,
-				     struct sk_buff_head *hitlist)
+static u64 __unix_walk_scc(struct unix_vertex *vertex,
+			   u64 *last_index,
+			   struct sk_buff_head *hitlist)
 {
-	unsigned long cyclic_sccs = 0;
 	LIST_HEAD(vertex_stack);
 	struct unix_edge *edge;
 	LIST_HEAD(edge_stack);
+	u64 cyclic_sccs = 0;
 
 next_vertex:
 	/* Push vertex to vertex_stack and mark it as on-stack
@@ -553,12 +553,12 @@ static unsigned long __unix_walk_scc(struct unix_vertex *vertex,
 	return cyclic_sccs;
 }
 
-static unsigned long unix_graph_cyclic_sccs;
+static u64 unix_graph_cyclic_sccs;
 
 static void unix_walk_scc(struct sk_buff_head *hitlist)
 {
-	unsigned long last_index = UNIX_VERTEX_INDEX_START;
-	unsigned long cyclic_sccs = 0;
+	u64 last_index = UNIX_VERTEX_INDEX_START;
+	u64 cyclic_sccs = 0;
 
 	unix_vertex_max_scc_index = UNIX_VERTEX_INDEX_START;
 
@@ -582,7 +582,7 @@ static void unix_walk_scc(struct sk_buff_head *hitlist)
 
 static void unix_walk_scc_fast(struct sk_buff_head *hitlist)
 {
-	unsigned long cyclic_sccs = unix_graph_cyclic_sccs;
+	u64 cyclic_sccs = unix_graph_cyclic_sccs;
 
 	while (!list_empty(&unix_unvisited_vertices)) {
 		struct unix_vertex *vertex;
-- 
2.56.0.385.gac671c819a-goog

Re: [PATCH v1 net] af_unix: Convert unsigned long to u64 for GC.

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH v1 net] af_unix: Convert unsigned long to u64 for GC.

[Kuniyuki Iwashima]

On Wed, Nov 4, 2026 at 12:23 AM <netdev-bot+sinfo@kernel.org> wrote:
>
> Hi!
>
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
>
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.

The reporter mentioned LLM-assisted static analysis.

>
>  - Whether the issue was actually triggered,

The reporter triggered it.


> or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
>
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
>
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Re: [PATCH v1 net] af_unix: Convert unsigned long to u64 for GC.

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  4 Nov 2026 08:20:55 +0000 you wrote:
> Lim Chanyoun reported that unix_vertex_max_scc_index could
> wrap around on 32-bit kernels, which confuses GC into purging
> a live socket receive queue.
> 
> I apparently designed GC with u64 in mind to avoid wraparound. [0]
> 
> Let's make it true on 32-bit kernels.
> 
> [...]

Here is the summary with links:
  - [v1,net] af_unix: Convert unsigned long to u64 for GC.
    https://git.kernel.org/netdev/net/c/d5f898d4c472

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html