Merge tag 'io_uring-2019-03-06' of git://git.kernel.dk/linux-block

[thirdparty/kernel/linux.git] / net / unix / af_unix.c

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index a95d479caeea022df4ae98c2267ad4b3427d751d..ddb838a1b74c0bf04fb8dda43fa2bb471925ad5c 100644 (file)
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -119,6 +119,8 @@
 #include <linux/freezer.h>
 #include <linux/file.h>
 
+#include "scm.h"
+
 struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
 EXPORT_SYMBOL_GPL(unix_socket_table);
 DEFINE_SPINLOCK(unix_table_lock);
@@ -1496,67 +1498,6 @@ out:
        return err;
 }
 
-static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
-{
-       int i;
-
-       scm->fp = UNIXCB(skb).fp;
-       UNIXCB(skb).fp = NULL;
-
-       for (i = scm->fp->count-1; i >= 0; i--)
-               unix_notinflight(scm->fp->user, scm->fp->fp[i]);
-}
-
-static void unix_destruct_scm(struct sk_buff *skb)
-{
-       struct scm_cookie scm;
-       memset(&scm, 0, sizeof(scm));
-       scm.pid  = UNIXCB(skb).pid;
-       if (UNIXCB(skb).fp)
-               unix_detach_fds(&scm, skb);
-
-       /* Alas, it calls VFS */
-       /* So fscking what? fput() had been SMP-safe since the last Summer */
-       scm_destroy(&scm);
-       sock_wfree(skb);
-}
-
-/*
- * The "user->unix_inflight" variable is protected by the garbage
- * collection lock, and we just read it locklessly here. If you go
- * over the limit, there might be a tiny race in actually noticing
- * it across threads. Tough.
- */
-static inline bool too_many_unix_fds(struct task_struct *p)
-{
-       struct user_struct *user = current_user();
-
-       if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
-               return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
-       return false;
-}
-
-static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
-{
-       int i;
-
-       if (too_many_unix_fds(current))
-               return -ETOOMANYREFS;
-
-       /*
-        * Need to duplicate file references for the sake of garbage
-        * collection.  Otherwise a socket in the fps might become a
-        * candidate for GC while the skb is not yet queued.
-        */
-       UNIXCB(skb).fp = scm_fp_dup(scm->fp);
-       if (!UNIXCB(skb).fp)
-               return -ENOMEM;
-
-       for (i = scm->fp->count - 1; i >= 0; i--)
-               unix_inflight(scm->fp->user, scm->fp->fp[i]);
-       return 0;
-}
-
 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
 {
        int err = 0;