mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-03-21 23:16:50 +08:00
e5b31d988a
Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed by commitcbcf01128d("af_unix: fix garbage collect vs MSG_PEEK"). After GC was replaced with the current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same issue. The problem is that MSG_PEEK bumps a file refcount without interacting with GC. Consider an SCC containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B. The bad thing happens if sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for sk-A and sk-B. GC thread User thread --------- ----------- unix_vertex_dead(sk-A) -> true <------. \ `------ recv(sk-B, MSG_PEEK) invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B) -> sk-B's file refcount : 2 -> 1 unix_vertex_dead(sk-B) -> true Initially, sk-A's file refcount is 1 by the inflight fd in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight fds. However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous evaluation. At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in sk-A. The subsequent close() releases one refcount by the former. Finally, GC incorrectly concludes that both sk-A and sk-B are dead. One option is to restore the locking dance in unix_peek_fds(), but we can resolve this more elegantly thanks to the new algorithm. The point is that the issue does not occur without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC detection. When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount being decremented by close(), it can just give up garbage-collecting the SCC. Therefore, we only need to signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC. Let's use seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run. This way no locking is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily. Note that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task splat from abusive MSG_PEEK calls. Fixes:118f457da9("af_unix: Remove lock dance in unix_peek_fds().") Reported-by: Igor Ushakov <sysroot314@gmail.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260311054043.1231316-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
72 lines
1.9 KiB
C
72 lines
1.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __AF_UNIX_H
|
|
#define __AF_UNIX_H
|
|
|
|
#include <linux/uidgid.h>
|
|
|
|
#define UNIX_HASH_MOD (256 - 1)
|
|
#define UNIX_HASH_SIZE (256 * 2)
|
|
#define UNIX_HASH_BITS 8
|
|
|
|
struct sock *unix_peer_get(struct sock *sk);
|
|
|
|
struct unix_skb_parms {
|
|
struct pid *pid; /* skb credentials */
|
|
kuid_t uid;
|
|
kgid_t gid;
|
|
struct scm_fp_list *fp; /* Passed files */
|
|
#ifdef CONFIG_SECURITY_NETWORK
|
|
u32 secid; /* Security ID */
|
|
#endif
|
|
u32 consumed;
|
|
} __randomize_layout;
|
|
|
|
#define UNIXCB(skb) (*(struct unix_skb_parms *)&((skb)->cb))
|
|
|
|
/* GC for SCM_RIGHTS */
|
|
void unix_add_edges(struct scm_fp_list *fpl, struct unix_sock *receiver);
|
|
void unix_del_edges(struct scm_fp_list *fpl);
|
|
void unix_update_edges(struct unix_sock *receiver);
|
|
int unix_prepare_fpl(struct scm_fp_list *fpl);
|
|
void unix_destroy_fpl(struct scm_fp_list *fpl);
|
|
void unix_peek_fpl(struct scm_fp_list *fpl);
|
|
void unix_schedule_gc(struct user_struct *user);
|
|
|
|
/* SOCK_DIAG */
|
|
long unix_inq_len(struct sock *sk);
|
|
long unix_outq_len(struct sock *sk);
|
|
|
|
/* sysctl */
|
|
#ifdef CONFIG_SYSCTL
|
|
int unix_sysctl_register(struct net *net);
|
|
void unix_sysctl_unregister(struct net *net);
|
|
#else
|
|
static inline int unix_sysctl_register(struct net *net)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void unix_sysctl_unregister(struct net *net)
|
|
{
|
|
}
|
|
#endif
|
|
|
|
/* BPF SOCKMAP */
|
|
int __unix_dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t size, int flags);
|
|
int __unix_stream_recvmsg(struct sock *sk, struct msghdr *msg, size_t size, int flags);
|
|
|
|
#ifdef CONFIG_BPF_SYSCALL
|
|
extern struct proto unix_dgram_proto;
|
|
extern struct proto unix_stream_proto;
|
|
|
|
int unix_dgram_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore);
|
|
int unix_stream_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore);
|
|
void __init unix_bpf_build_proto(void);
|
|
#else
|
|
static inline void __init unix_bpf_build_proto(void)
|
|
{
|
|
}
|
|
#endif
|
|
|
|
#endif
|