af_unix: Allocate struct unix_edge for each inflight AF_UNIX fd.

commit 29b64e354029cfcf1eea4d91b146c7b769305930 upstream.

As with the previous patch, we preallocate to skb's scm_fp_list an
array of struct unix_edge in the number of inflight AF_UNIX fds.

There we just preallocate memory and do not use immediately because
sendmsg() could fail after this point.  The actual use will be in
the next patch.

When we queue skb with inflight edges, we will set the inflight
socket's unix_sock as unix_edge->predecessor and the receiver's
unix_sock as successor, and then we will link the edge to the
inflight socket's unix_vertex.edges.

Note that we set NULL to cloned scm_fp_list.edges in scm_fp_dup()
so that MSG_PEEK does not change the shape of the directed graph.

Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/20240325202425.60930-3-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index b41aff1ac6889a53d6ec438af6e91b1de5a31ee6..279087595966b082878ab8181e3a98e879f8f249 100644 (file)
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -33,6 +33,12 @@ struct unix_vertex {
        unsigned long out_degree;
 };
 
+struct unix_edge {
+       struct unix_sock *predecessor;
+       struct unix_sock *successor;
+       struct list_head vertex_entry;
+};
+
 struct sock *unix_peer_get(struct sock *sk);
 
 #define UNIX_HASH_MOD  (256 - 1)

diff --git a/include/net/scm.h b/include/net/scm.h
index 4183495d1981007bf49b2da1a1e7fa98ce22d217..19d7d802ed6ce72647c757659d3ea24630f4334f 100644 (file)
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -21,12 +21,17 @@ struct scm_creds {
        kgid_t  gid;
 };
 
+#ifdef CONFIG_UNIX
+struct unix_edge;
+#endif
+
 struct scm_fp_list {
        short                   count;
        short                   count_unix;
        short                   max;
 #ifdef CONFIG_UNIX
        struct list_head        vertices;
+       struct unix_edge        *edges;
 #endif
        struct user_struct      *user;
        struct file             *fp[SCM_MAX_FD];

diff --git a/net/core/scm.c b/net/core/scm.c
index 09bacb3d36f2b9fad4e946d5484d3c8a2cfffc3f..4c343729f960a87e4bed0e460bd6c729d741ef03 100644 (file)
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -90,6 +90,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                fpl->max = SCM_MAX_FD;
                fpl->user = NULL;
 #if IS_ENABLED(CONFIG_UNIX)
+               fpl->edges = NULL;
                INIT_LIST_HEAD(&fpl->vertices);
 #endif
        }
@@ -379,6 +380,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
                new_fpl->max = new_fpl->count;
                new_fpl->user = get_uid(fpl->user);
 #if IS_ENABLED(CONFIG_UNIX)
+               new_fpl->edges = NULL;
                INIT_LIST_HEAD(&new_fpl->vertices);
 #endif
        }

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 8ea7640e032e8d57c610bb837c0c091df07c0a99..912b7945692c9550aad34af809465c010cccaeb8 100644 (file)
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -127,6 +127,11 @@ int unix_prepare_fpl(struct scm_fp_list *fpl)
                list_add(&vertex->entry, &fpl->vertices);
        }
 
+       fpl->edges = kvmalloc_array(fpl->count_unix, sizeof(*fpl->edges),
+                                   GFP_KERNEL_ACCOUNT);
+       if (!fpl->edges)
+               goto err;
+
        return 0;
 
 err:
@@ -136,6 +141,7 @@ err:
 
 void unix_destroy_fpl(struct scm_fp_list *fpl)
 {
+       kvfree(fpl->edges);
        unix_free_vertices(fpl);
 }