1 // SPDX-License-Identifier: GPL-2.0-or-later
13  *  - object w/ a bit
14  *  - free list
18  *  - explicit stack instead of recursion
19  *  - tail recurse on first born instead of immediate push/pop
20  *  - we gather the stuff that should not be killed into tree
25  *  - don't just push entire root set; process in place
32  *		of foo to bar and vice versa. Current code chokes on that.
38  *		upon the beginning and unmark non-junk ones.
56  *		parents (->gc_tree).
58  *		Damn. Added missing check for ->dead in listen queues scanning.
97 	spin_lock(&x->sk_receive_queue.lock);  in scan_inflight()
98 	skb_queue_walk_safe(&x->sk_receive_queue, skb, next) {  in scan_inflight()
103 			int nfd = UNIXCB(skb).fp->count;  in scan_inflight()
104 			struct file **fp = UNIXCB(skb).fp->fp;  in scan_inflight()
106 			while (nfd--) {  in scan_inflight()
113 					/* Ignore non-candidates, they could  in scan_inflight()
117 					if (test_bit(UNIX_GC_CANDIDATE, &u->gc_flags)) {  in scan_inflight()
125 				__skb_unlink(skb, &x->sk_receive_queue);  in scan_inflight()
130 	spin_unlock(&x->sk_receive_queue.lock);  in scan_inflight()
136 	if (x->sk_state != TCP_LISTEN) {  in scan_children()
147 		spin_lock(&x->sk_receive_queue.lock);  in scan_children()
148 		skb_queue_walk_safe(&x->sk_receive_queue, skb, next) {  in scan_children()
149 			u = unix_sk(skb->sk);  in scan_children()
151 			/* An embryo cannot be in-flight, so it's safe  in scan_children()
154 			BUG_ON(!list_empty(&u->link));  in scan_children()
155 			list_add_tail(&u->link, &embryos);  in scan_children()
157 		spin_unlock(&x->sk_receive_queue.lock);  in scan_children()
161 			scan_inflight(&u->sk, func, hitlist);  in scan_children()
162 			list_del_init(&u->link);  in scan_children()
169 	usk->inflight--;  in dec_inflight()
174 	usk->inflight++;  in inc_inflight()
179 	u->inflight++;  in inc_inflight_move_tail()
185 	if (test_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags))  in inc_inflight_move_tail()
186 		list_move_tail(&u->link, &gc_candidates);  in inc_inflight_move_tail()
225 	 * in-flight sockets are considered, and from those only ones  in unix_gc()
236 	 * added to queue, so we must make sure only to touch  in unix_gc()
241 	 * being added to a listener's queue, an embryo may already  in unix_gc()
245 	 * enqueued.  Therefore, we must ensure that no SCM-laden  in unix_gc()
246 	 * embryo appears in a (candidate) listener's queue between  in unix_gc()
250 		struct sock *sk = &u->sk;  in unix_gc()
253 		total_refs = file_count(sk->sk_socket->file);  in unix_gc()
255 		BUG_ON(!u->inflight);  in unix_gc()
256 		BUG_ON(total_refs < u->inflight);  in unix_gc()
257 		if (total_refs == u->inflight) {  in unix_gc()
258 			list_move_tail(&u->link, &gc_candidates);  in unix_gc()
259 			__set_bit(UNIX_GC_CANDIDATE, &u->gc_flags);  in unix_gc()
260 			__set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);  in unix_gc()
262 			if (sk->sk_state == TCP_LISTEN) {  in unix_gc()
269 	/* Now remove all internal in-flight reference to children of  in unix_gc()
273 		scan_children(&u->sk, dec_inflight, NULL);  in unix_gc()
287 		list_move(&cursor, &u->link);  in unix_gc()
289 		if (u->inflight) {  in unix_gc()
290 			list_move_tail(&u->link, &not_cycle_list);  in unix_gc()
291 			__clear_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);  in unix_gc()
292 			scan_children(&u->sk, inc_inflight_move_tail, NULL);  in unix_gc()
303 		scan_children(&u->sk, inc_inflight, &hitlist);  in unix_gc()
306 		if (u->oob_skb) {  in unix_gc()
307 			kfree_skb(u->oob_skb);  in unix_gc()
308 			u->oob_skb = NULL;  in unix_gc()
318 		__clear_bit(UNIX_GC_CANDIDATE, &u->gc_flags);  in unix_gc()
319 		list_move_tail(&u->link, &gc_inflight_list);  in unix_gc()
331 		if (skb->destructor == io_uring_destruct_scm) {  in unix_gc()
333 			skb_queue_tail(&skb->sk->sk_receive_queue, skb);  in unix_gc()
346 		list_move_tail(&u->link, &gc_inflight_list);  in unix_gc()