2 files changed, 76 insertions, 28 deletions

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 2358f2690ec5..928691c43408 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -85,7 +85,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/stat.h>
@@ -100,7 +100,7 @@
 #include <linux/in.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <net/net_namespace.h>
@@ -117,6 +117,7 @@
 #include <net/checksum.h>
 #include <linux/security.h>
 #include <linux/freezer.h>
+#include <linux/file.h>
 
 struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
 EXPORT_SYMBOL_GPL(unix_socket_table);
@@ -315,7 +316,7 @@ static struct sock *unix_find_socket_byinode(struct inode *i)
                     &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
                 struct dentry *dentry = unix_sk(s)->path.dentry;
 
-                if (dentry && d_real_inode(dentry) == i) {
+                if (dentry && d_backing_inode(dentry) == i) {
                         sock_hold(s);
                         goto found;
                 }
@@ -635,7 +636,7 @@ static int unix_bind(struct socket *, struct sockaddr *, int);
 static int unix_stream_connect(struct socket *, struct sockaddr *,
                                int addr_len, int flags);
 static int unix_socketpair(struct socket *, struct socket *);
-static int unix_accept(struct socket *, struct socket *, int);
+static int unix_accept(struct socket *, struct socket *, int, bool);
 static int unix_getname(struct socket *, struct sockaddr *, int *, int);
 static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
 static unsigned int unix_dgram_poll(struct file *, struct socket *,
@@ -913,7 +914,7 @@ static struct sock *unix_find_other(struct net *net,
                 err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path);
                 if (err)
                         goto fail;
-                inode = d_real_inode(path.dentry);
+                inode = d_backing_inode(path.dentry);
                 err = inode_permission(inode, MAY_WRITE);
                 if (err)
                         goto put_fail;
@@ -995,6 +996,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         unsigned int hash;
         struct unix_address *addr;
         struct hlist_head *list;
+        struct path path = { NULL, NULL };
 
         err = -EINVAL;
         if (sunaddr->sun_family != AF_UNIX)
@@ -1010,9 +1012,20 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         addr_len = err;
 
+        if (sun_path[0]) {
+                umode_t mode = S_IFSOCK |
+                       (SOCK_INODE(sock)->i_mode & ~current_umask());
+                err = unix_mknod(sun_path, mode, &path);
+                if (err) {
+                        if (err == -EEXIST)
+                                err = -EADDRINUSE;
+                        goto out;
+                }
+        }
+
         err = mutex_lock_interruptible(&u->bindlock);
         if (err)
-                goto out;
+                goto out_put;
 
         err = -EINVAL;
         if (u->addr)
@@ -1029,18 +1042,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         atomic_set(&addr->refcnt, 1);
 
         if (sun_path[0]) {
-                struct path path;
-                umode_t mode = S_IFSOCK |
-                       (SOCK_INODE(sock)->i_mode & ~current_umask());
-                err = unix_mknod(sun_path, mode, &path);
-                if (err) {
-                        if (err == -EEXIST)
-                                err = -EADDRINUSE;
-                        unix_release_addr(addr);
-                        goto out_up;
-                }
                 addr->hash = UNIX_HASH_SIZE;
-                hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
+                hash = d_backing_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
                 spin_lock(&unix_table_lock);
                 u->path = path;
                 list = &unix_socket_table[hash];
@@ -1065,6 +1068,9 @@ out_unlock:
         spin_unlock(&unix_table_lock);
 out_up:
         mutex_unlock(&u->bindlock);
+out_put:
+        if (err)
+                path_put(&path);
 out:
         return err;
 }
@@ -1396,7 +1402,8 @@ static void unix_sock_inherit_flags(const struct socket *old,
                 set_bit(SOCK_PASSSEC, &new->flags);
 }
 
-static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
+static int unix_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sock *sk = sock->sk;
         struct sock *tsk;
@@ -2113,8 +2120,8 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
                 mutex_lock(&u->iolock);
 
                 skip = sk_peek_offset(sk, flags);
-                skb = __skb_try_recv_datagram(sk, flags, &peeked, &skip, &err,
-                                              &last);
+                skb = __skb_try_recv_datagram(sk, flags, NULL, &peeked, &skip,
+                                              &err, &last);
                 if (skb)
                         break;
 
@@ -2587,6 +2594,43 @@ long unix_outq_len(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(unix_outq_len);
 
+static int unix_open_file(struct sock *sk)
+{
+        struct path path;
+        struct file *f;
+        int fd;
+
+        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+                return -EPERM;
+
+        unix_state_lock(sk);
+        path = unix_sk(sk)->path;
+        if (!path.dentry) {
+                unix_state_unlock(sk);
+                return -ENOENT;
+        }
+
+        path_get(&path);
+        unix_state_unlock(sk);
+
+        fd = get_unused_fd_flags(O_CLOEXEC);
+        if (fd < 0)
+                goto out;
+
+        f = dentry_open(&path, O_PATH, current_cred());
+        if (IS_ERR(f)) {
+                put_unused_fd(fd);
+                fd = PTR_ERR(f);
+                goto out;
+        }
+
+        fd_install(fd, f);
+out:
+        path_put(&path);
+
+        return fd;
+}
+
 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
@@ -2605,6 +2649,9 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 else
                         err = put_user(amount, (int __user *)arg);
                 break;
+        case SIOCUNIXFILE:
+                err = unix_open_file(sk);
+                break;
         default:
                 err = -ENOIOCTLCMD;
                 break;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6a0d48525fcf..c36757e72844 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -146,6 +146,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
         if (s) {
                 struct unix_sock *u = unix_sk(s);
 
+                BUG_ON(!atomic_long_read(&u->inflight));
                 BUG_ON(list_empty(&u->link));
 
                 if (atomic_long_dec_and_test(&u->inflight))
@@ -341,6 +342,14 @@ void unix_gc(void)
         }
         list_del(&cursor);
 
+        /* Now gc_candidates contains only garbage.  Restore original
+         * inflight counters for these as well, and remove the skbuffs
+         * which are creating the cycle(s).
+         */
+        skb_queue_head_init(&hitlist);
+        list_for_each_entry(u, &gc_candidates, link)
+                scan_children(&u->sk, inc_inflight, &hitlist);
+
         /* not_cycle_list contains those sockets which do not make up a
          * cycle.  Restore these to the inflight list.
          */
@@ -350,14 +359,6 @@ void unix_gc(void)
                 list_move_tail(&u->link, &gc_inflight_list);
         }
 
-        /* Now gc_candidates contains only garbage.  Restore original
-         * inflight counters for these as well, and remove the skbuffs
-         * which are creating the cycle(s).
-         */
-        skb_queue_head_init(&hitlist);
-        list_for_each_entry(u, &gc_candidates, link)
-        scan_children(&u->sk, inc_inflight, &hitlist);
-
         spin_unlock(&unix_gc_lock);
 
         /* Here we are. Hitlist is filled. Die. */