Re: [PATCH v1 net-next] af_unix: Unlink scc_entry in unix_del_edge().

[Kuniyuki Iwashima <kuniyu@google.com>]

> [PATCH v1 net-next] af_unix: Unlink scc_entry in unix_del_edge().

Sorry, this is for net.git.


On Mon, Aug 3, 2026 at 5:21 PM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> Kyle Zeng reported that GC could free a dead SCC partially.
>
> The scenario is as follows:
>
>    1) Create two SCCs:
>
>        X -.   A <-> B
>        ^--'
>
>    2) Run the following concurrently:
>
>       2-1) send() sk-B to sk-B from sk-X
>       2-2) close() both A and B
>
> At 2-1), there is a small window where unix_add_edges()
> publishes a new edge (B <-> B) to GC but its skb is not queued
> by skb_queue_tail().
>
> If 2-2) completes before skb_queue_tail() and GC is triggered,
> it judges A <-> B as dead, but B is not freed because GC cannot
> collect the not-yet-queued skb holding the B <-> B edge.
>
>        X -.   A <-> B -. This edge is visible
>        ^--'         ^..'  but skb is not
>
> This itself is not a problem since the next GC run will judge
> B as dead as well and free it finally.
>
>        X -.   A <.> B -.
>        ^--'         ^--'
>
> However, X's SCC forces the next GC to call unix_walk_scc_fast(),
> and it iterates over A through B's scc_entry.
>
> Let's unlink scc_entry before freeing the vertex in unix_del_edge().
>
> Fixes: 4090fa373f0e ("af_unix: Replace garbage collection algorithm.")
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> ---
>  net/unix/garbage.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/net/unix/garbage.c b/net/unix/garbage.c
> index 0783555e2526..9fcaaf55cba5 100644
> --- a/net/unix/garbage.c
> +++ b/net/unix/garbage.c
> @@ -186,6 +186,7 @@ static void unix_del_edge(struct scm_fp_list *fpl, struct unix_edge *edge)
>         if (!vertex->out_degree) {
>                 edge->predecessor->vertex = NULL;
>                 list_move_tail(&vertex->entry, &fpl->vertices);
> +               list_del(&vertex->scc_entry);
>         }
>  }
>
> --
> 2.55.0.571.g244d577d93-goog
>