mirror of
https://github.com/torvalds/linux.git
synced 2026-06-13 01:08:08 +02:00
6209344f5a
Previously I assumed that the receive queues of candidates don't change during the GC. This is only half true, nothing can be received from the queues (see comment in unix_gc()), but buffers could be added through the other half of the socket pair, which may still have file descriptors referring to it. This can result in inc_inflight_move_tail() erronously increasing the "inflight" counter for a unix socket for which dec_inflight() wasn't previously called. This in turn can trigger the "BUG_ON(total_refs < inflight_refs)" in a later garbage collection run. Fix this by only manipulating the "inflight" counter for sockets which are candidates themselves. Duplicating the file references in unix_attach_fds() is also needed to prevent a socket becoming a candidate for GC while the skb that contains it is not yet queued. Reported-by: Andrea Bittau <a.bittau@cs.ucl.ac.uk> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|---|---|---|
| .. | ||
| 9p | ||
| bluetooth | ||
| irda | ||
| iucv | ||
| netfilter | ||
| netns | ||
| phonet | ||
| sctp | ||
| tc_act | ||
| tipc | ||
| act_api.h | ||
| addrconf.h | ||
| af_rxrpc.h | ||
| af_unix.h | ||
| ah.h | ||
| arp.h | ||
| atmclip.h | ||
| ax25.h | ||
| ax88796.h | ||
| cfg80211.h | ||
| checksum.h | ||
| cipso_ipv4.h | ||
| compat.h | ||
| datalink.h | ||
| dn_dev.h | ||
| dn_fib.h | ||
| dn_neigh.h | ||
| dn_nsp.h | ||
| dn_route.h | ||
| dn.h | ||
| dsa.h | ||
| dsfield.h | ||
| dst.h | ||
| esp.h | ||
| fib_rules.h | ||
| flow.h | ||
| garp.h | ||
| gen_stats.h | ||
| genetlink.h | ||
| icmp.h | ||
| ieee80211_crypt.h | ||
| ieee80211_radiotap.h | ||
| ieee80211.h | ||
| if_inet6.h | ||
| inet_common.h | ||
| inet_connection_sock.h | ||
| inet_ecn.h | ||
| inet_frag.h | ||
| inet_hashtables.h | ||
| inet_sock.h | ||
| inet_timewait_sock.h | ||
| inet6_connection_sock.h | ||
| inet6_hashtables.h | ||
| inetpeer.h | ||
| ip_fib.h | ||
| ip_vs.h | ||
| ip.h | ||
| ip6_checksum.h | ||
| ip6_fib.h | ||
| ip6_route.h | ||
| ip6_tunnel.h | ||
| ipcomp.h | ||
| ipconfig.h | ||
| ipip.h | ||
| ipv6.h | ||
| ipx.h | ||
| iw_handler.h | ||
| lapb.h | ||
| llc_c_ac.h | ||
| llc_c_ev.h | ||
| llc_c_st.h | ||
| llc_conn.h | ||
| llc_if.h | ||
| llc_pdu.h | ||
| llc_s_ac.h | ||
| llc_s_ev.h | ||
| llc_s_st.h | ||
| llc_sap.h | ||
| llc.h | ||
| mac80211.h | ||
| mip6.h | ||
| ndisc.h | ||
| neighbour.h | ||
| net_namespace.h | ||
| netdma.h | ||
| netevent.h | ||
| netlabel.h | ||
| netlink.h | ||
| netrom.h | ||
| nexthop.h | ||
| p8022.h | ||
| pkt_cls.h | ||
| pkt_sched.h | ||
| protocol.h | ||
| psnap.h | ||
| raw.h | ||
| rawv6.h | ||
| red.h | ||
| request_sock.h | ||
| rose.h | ||
| route.h | ||
| rtnetlink.h | ||
| sch_generic.h | ||
| scm.h | ||
| slhc_vj.h | ||
| snmp.h | ||
| sock.h | ||
| stp.h | ||
| syncppp.h | ||
| tcp_states.h | ||
| tcp.h | ||
| timewait_sock.h | ||
| transp_v6.h | ||
| udp.h | ||
| udplite.h | ||
| wext.h | ||
| wireless.h | ||
| x25.h | ||
| x25device.h | ||
| xfrm.h | ||