3 files changed, 29 insertions, 9 deletions

diff --git a/include/linux/sched.h b/include/linux/sched.h
index edad7a43edea..fbf25f19b3b5 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -830,6 +830,7 @@ struct user_struct {
         unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
 #endif
         unsigned long locked_shm; /* How many pages of mlocked shm ? */
+        unsigned long unix_inflight;    /* How many files in flight in unix sockets */
 
 #ifdef CONFIG_KEYS
         struct key *uid_keyring;        /* UID specific keyring */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index ef05cd9403d4..e3f85bc8b135 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1513,6 +1513,21 @@ static void unix_destruct_scm(struct sk_buff *skb)
         sock_wfree(skb);
 }
 
+/*
+ * The "user->unix_inflight" variable is protected by the garbage
+ * collection lock, and we just read it locklessly here. If you go
+ * over the limit, there might be a tiny race in actually noticing
+ * it across threads. Tough.
+ */
+static inline bool too_many_unix_fds(struct task_struct *p)
+{
+        struct user_struct *user = current_user();
+
+        if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
+                return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
+        return false;
+}
+
 #define MAX_RECURSION_LEVEL 4
 
 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
@@ -1521,6 +1536,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         unsigned char max_level = 0;
         int unix_sock_count = 0;
 
+        if (too_many_unix_fds(current))
+                return -ETOOMANYREFS;
+
         for (i = scm->fp->count - 1; i >= 0; i--) {
                 struct sock *sk = unix_get_socket(scm->fp->fp[i]);
 
@@ -1542,10 +1560,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         if (!UNIXCB(skb).fp)
                 return -ENOMEM;
 
-        if (unix_sock_count) {
-                for (i = scm->fp->count - 1; i >= 0; i--)
-                        unix_inflight(scm->fp->fp[i]);
-        }
+        for (i = scm->fp->count - 1; i >= 0; i--)
+                unix_inflight(scm->fp->fp[i]);
         return max_level;
 }
 
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index a73a226f2d33..8fcdc2283af5 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -120,11 +120,11 @@ void unix_inflight(struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
 
+        spin_lock(&unix_gc_lock);
+
         if (s) {
                 struct unix_sock *u = unix_sk(s);
 
-                spin_lock(&unix_gc_lock);
-
                 if (atomic_long_inc_return(&u->inflight) == 1) {
                         BUG_ON(!list_empty(&u->link));
                         list_add_tail(&u->link, &gc_inflight_list);
@@ -132,25 +132,28 @@ void unix_inflight(struct file *fp)
                         BUG_ON(list_empty(&u->link));
                 }
                 unix_tot_inflight++;
-                spin_unlock(&unix_gc_lock);
         }
+        fp->f_cred->user->unix_inflight++;
+        spin_unlock(&unix_gc_lock);
 }
 
 void unix_notinflight(struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
 
+        spin_lock(&unix_gc_lock);
+
         if (s) {
                 struct unix_sock *u = unix_sk(s);
 
-                spin_lock(&unix_gc_lock);
                 BUG_ON(list_empty(&u->link));
 
                 if (atomic_long_dec_and_test(&u->inflight))
                         list_del_init(&u->link);
                 unix_tot_inflight--;
-                spin_unlock(&unix_gc_lock);
         }
+        fp->f_cred->user->unix_inflight--;
+        spin_unlock(&unix_gc_lock);
 }
 
 static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),