Merge branch 'linus' into stackprotector

Conflicts:
	arch/x86/include/asm/pda.h
	kernel/fork.c

3 files changed, 196 insertions, 145 deletions

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c647aab8d418..c6250d0055d2 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -164,7 +164,7 @@ static inline int unix_our_peer(struct sock *sk, struct sock *osk)
 
 static inline int unix_may_send(struct sock *sk, struct sock *osk)
 {
-        return (unix_peer(osk) == NULL || unix_our_peer(sk, osk));
+        return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
 }
 
 static inline int unix_recvq_full(struct sock const *sk)
@@ -197,7 +197,7 @@ static inline void unix_release_addr(struct unix_address *addr)
  *              - if started by zero, it is abstract name.
  */
 
-static int unix_mkname(struct sockaddr_un * sunaddr, int len, unsigned *hashp)
+static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned *hashp)
 {
         if (len <= sizeof(short) || len > sizeof(*sunaddr))
                 return -EINVAL;
@@ -211,12 +211,12 @@ static int unix_mkname(struct sockaddr_un * sunaddr, int len, unsigned *hashp)
                  * we are guaranteed that it is a valid memory location in our
                  * kernel address buffer.
                  */
-                ((char *)sunaddr)[len]=0;
+                ((char *)sunaddr)[len] = 0;
                 len = strlen(sunaddr->sun_path)+1+sizeof(short);
                 return len;
         }
 
-        *hashp = unix_hash_fold(csum_partial((char*)sunaddr, len, 0));
+        *hashp = unix_hash_fold(csum_partial(sunaddr, len, 0));
         return len;
 }
 
@@ -295,8 +295,7 @@ static struct sock *unix_find_socket_byinode(struct net *net, struct inode *i)
                 if (!net_eq(sock_net(s), net))
                         continue;
 
-                if(dentry && dentry->d_inode == i)
-                {
+                if (dentry && dentry->d_inode == i) {
                         sock_hold(s);
                         goto found;
                 }
@@ -354,7 +353,7 @@ static void unix_sock_destructor(struct sock *sk)
         WARN_ON(!sk_unhashed(sk));
         WARN_ON(sk->sk_socket);
         if (!sock_flag(sk, SOCK_DEAD)) {
-                printk("Attempt to release alive unix socket: %p\n", sk);
+                printk(KERN_INFO "Attempt to release alive unix socket: %p\n", sk);
                 return;
         }
 
@@ -362,12 +361,16 @@ static void unix_sock_destructor(struct sock *sk)
                 unix_release_addr(u->addr);
 
         atomic_dec(&unix_nr_socks);
+        local_bh_disable();
+        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+        local_bh_enable();
 #ifdef UNIX_REFCNT_DEBUG
-        printk(KERN_DEBUG "UNIX %p is destroyed, %d are still alive.\n", sk, atomic_read(&unix_nr_socks));
+        printk(KERN_DEBUG "UNIX %p is destroyed, %d are still alive.\n", sk,
+                atomic_read(&unix_nr_socks));
 #endif
 }
 
-static int unix_release_sock (struct sock *sk, int embrion)
+static int unix_release_sock(struct sock *sk, int embrion)
 {
         struct unix_sock *u = unix_sk(sk);
         struct dentry *dentry;
@@ -392,9 +395,9 @@ static int unix_release_sock (struct sock *sk, int embrion)
 
         wake_up_interruptible_all(&u->peer_wait);
 
-        skpair=unix_peer(sk);
+        skpair = unix_peer(sk);
 
-        if (skpair!=NULL) {
+        if (skpair != NULL) {
                 if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
                         unix_state_lock(skpair);
                         /* No more writes */
@@ -414,7 +417,7 @@ static int unix_release_sock (struct sock *sk, int embrion)
         /* Try to flush out this socket. Throw out buffers at least */
 
         while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                if (state==TCP_LISTEN)
+                if (state == TCP_LISTEN)
                         unix_release_sock(skb->sk, 1);
                 /* passed fds are erased in the kfree_skb hook        */
                 kfree_skb(skb);
@@ -453,11 +456,11 @@ static int unix_listen(struct socket *sock, int backlog)
         struct unix_sock *u = unix_sk(sk);
 
         err = -EOPNOTSUPP;
-        if (sock->type!=SOCK_STREAM && sock->type!=SOCK_SEQPACKET)
-                goto out;                       /* Only stream/seqpacket sockets accept */
+        if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
+                goto out;       /* Only stream/seqpacket sockets accept */
         err = -EINVAL;
         if (!u->addr)
-                goto out;                       /* No listens on an unbound socket */
+                goto out;       /* No listens on an unbound socket */
         unix_state_lock(sk);
         if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
                 goto out_unlock;
@@ -467,8 +470,7 @@ static int unix_listen(struct socket *sock, int backlog)
         sk->sk_state            = TCP_LISTEN;
         /* set credentials so connect can copy them */
         sk->sk_peercred.pid     = task_tgid_vnr(current);
-        sk->sk_peercred.uid     = current->euid;
-        sk->sk_peercred.gid     = current->egid;
+        current_euid_egid(&sk->sk_peercred.uid, &sk->sk_peercred.gid);
         err = 0;
 
 out_unlock:
@@ -566,9 +568,9 @@ static const struct proto_ops unix_seqpacket_ops = {
 };
 
 static struct proto unix_proto = {
-        .name     = "UNIX",
-        .owner    = THIS_MODULE,
-        .obj_size = sizeof(struct unix_sock),
+        .name                   = "UNIX",
+        .owner                  = THIS_MODULE,
+        .obj_size               = sizeof(struct unix_sock),
 };
 
 /*
@@ -579,7 +581,7 @@ static struct proto unix_proto = {
  */
 static struct lock_class_key af_unix_sk_receive_queue_lock_key;
 
-static struct sock * unix_create1(struct net *net, struct socket *sock)
+static struct sock *unix_create1(struct net *net, struct socket *sock)
 {
         struct sock *sk = NULL;
         struct unix_sock *u;
@@ -592,7 +594,7 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
         if (!sk)
                 goto out;
 
-        sock_init_data(sock,sk);
+        sock_init_data(sock, sk);
         lockdep_set_class(&sk->sk_receive_queue.lock,
                                 &af_unix_sk_receive_queue_lock_key);
 
@@ -611,6 +613,11 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
 out:
         if (sk == NULL)
                 atomic_dec(&unix_nr_socks);
+        else {
+                local_bh_disable();
+                sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+                local_bh_enable();
+        }
         return sk;
 }
 
@@ -630,7 +637,7 @@ static int unix_create(struct net *net, struct socket *sock, int protocol)
                  *      nothing uses it.
                  */
         case SOCK_RAW:
-                sock->type=SOCK_DGRAM;
+                sock->type = SOCK_DGRAM;
         case SOCK_DGRAM:
                 sock->ops = &unix_dgram_ops;
                 break;
@@ -653,7 +660,7 @@ static int unix_release(struct socket *sock)
 
         sock->sk = NULL;
 
-        return unix_release_sock (sk, 0);
+        return unix_release_sock(sk, 0);
 }
 
 static int unix_autobind(struct socket *sock)
@@ -662,7 +669,7 @@ static int unix_autobind(struct socket *sock)
         struct net *net = sock_net(sk);
         struct unix_sock *u = unix_sk(sk);
         static u32 ordernum = 1;
-        struct unix_address * addr;
+        struct unix_address *addr;
         int err;
 
         mutex_lock(&u->readlock);
@@ -681,7 +688,7 @@ static int unix_autobind(struct socket *sock)
 
 retry:
         addr->len = sprintf(addr->name->sun_path+1, "%05x", ordernum) + 1 + sizeof(short);
-        addr->hash = unix_hash_fold(csum_partial((void*)addr->name, addr->len, 0));
+        addr->hash = unix_hash_fold(csum_partial(addr->name, addr->len, 0));
 
         spin_lock(&unix_table_lock);
         ordernum = (ordernum+1)&0xFFFFF;
@@ -711,37 +718,39 @@ static struct sock *unix_find_other(struct net *net,
                                     int type, unsigned hash, int *error)
 {
         struct sock *u;
-        struct nameidata nd;
+        struct path path;
         int err = 0;
 
         if (sunname->sun_path[0]) {
-                err = path_lookup(sunname->sun_path, LOOKUP_FOLLOW, &nd);
+                struct inode *inode;
+                err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path);
                 if (err)
                         goto fail;
-                err = vfs_permission(&nd, MAY_WRITE);
+                inode = path.dentry->d_inode;
+                err = inode_permission(inode, MAY_WRITE);
                 if (err)
                         goto put_fail;
 
                 err = -ECONNREFUSED;
-                if (!S_ISSOCK(nd.path.dentry->d_inode->i_mode))
+                if (!S_ISSOCK(inode->i_mode))
                         goto put_fail;
-                u = unix_find_socket_byinode(net, nd.path.dentry->d_inode);
+                u = unix_find_socket_byinode(net, inode);
                 if (!u)
                         goto put_fail;
 
                 if (u->sk_type == type)
-                        touch_atime(nd.path.mnt, nd.path.dentry);
+                        touch_atime(path.mnt, path.dentry);
 
-                path_put(&nd.path);
+                path_put(&path);
 
-                err=-EPROTOTYPE;
+                err = -EPROTOTYPE;
                 if (u->sk_type != type) {
                         sock_put(u);
                         goto fail;
                 }
         } else {
                 err = -ECONNREFUSED;
-                u=unix_find_socket_byname(net, sunname, len, type, hash);
+                u = unix_find_socket_byname(net, sunname, len, type, hash);
                 if (u) {
                         struct dentry *dentry;
                         dentry = unix_sk(u)->dentry;
@@ -753,9 +762,9 @@ static struct sock *unix_find_other(struct net *net,
         return u;
 
 put_fail:
-        path_put(&nd.path);
+        path_put(&path);
 fail:
-        *error=err;
+        *error = err;
         return NULL;
 }
 
@@ -765,8 +774,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
         struct unix_sock *u = unix_sk(sk);
-        struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr;
-        struct dentry * dentry = NULL;
+        struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
+        struct dentry *dentry = NULL;
         struct nameidata nd;
         int err;
         unsigned hash;
@@ -777,7 +786,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (sunaddr->sun_family != AF_UNIX)
                 goto out;
 
-        if (addr_len==sizeof(short)) {
+        if (addr_len == sizeof(short)) {
                 err = unix_autobind(sock);
                 goto out;
         }
@@ -873,8 +882,8 @@ out_mknod_unlock:
         mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
         path_put(&nd.path);
 out_mknod_parent:
-        if (err==-EEXIST)
-                err=-EADDRINUSE;
+        if (err == -EEXIST)
+                err = -EADDRINUSE;
         unix_release_addr(addr);
         goto out_up;
 }
@@ -909,7 +918,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
 {
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
-        struct sockaddr_un *sunaddr=(struct sockaddr_un*)addr;
+        struct sockaddr_un *sunaddr = (struct sockaddr_un *)addr;
         struct sock *other;
         unsigned hash;
         int err;
@@ -925,7 +934,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
                         goto out;
 
 restart:
-                other=unix_find_other(net, sunaddr, alen, sock->type, hash, &err);
+                other = unix_find_other(net, sunaddr, alen, sock->type, hash, &err);
                 if (!other)
                         goto out;
 
@@ -959,14 +968,14 @@ restart:
          */
         if (unix_peer(sk)) {
                 struct sock *old_peer = unix_peer(sk);
-                unix_peer(sk)=other;
+                unix_peer(sk) = other;
                 unix_state_double_unlock(sk, other);
 
                 if (other != old_peer)
                         unix_dgram_disconnected(sk, old_peer);
                 sock_put(old_peer);
         } else {
-                unix_peer(sk)=other;
+                unix_peer(sk) = other;
                 unix_state_double_unlock(sk, other);
         }
         return 0;
@@ -1002,7 +1011,7 @@ static long unix_wait_for_peer(struct sock *other, long timeo)
 static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
                                int addr_len, int flags)
 {
-        struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr;
+        struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
         struct unix_sock *u = unix_sk(sk), *newu, *otheru;
@@ -1124,8 +1133,7 @@ restart:
         newsk->sk_state         = TCP_ESTABLISHED;
         newsk->sk_type          = sk->sk_type;
         newsk->sk_peercred.pid  = task_tgid_vnr(current);
-        newsk->sk_peercred.uid  = current->euid;
-        newsk->sk_peercred.gid  = current->egid;
+        current_euid_egid(&newsk->sk_peercred.uid, &newsk->sk_peercred.gid);
         newu = unix_sk(newsk);
         newsk->sk_sleep         = &newu->peer_wait;
         otheru = unix_sk(other);
@@ -1177,16 +1185,17 @@ out:
 
 static int unix_socketpair(struct socket *socka, struct socket *sockb)
 {
-        struct sock *ska=socka->sk, *skb = sockb->sk;
+        struct sock *ska = socka->sk, *skb = sockb->sk;
 
         /* Join our sockets back to back */
         sock_hold(ska);
         sock_hold(skb);
-        unix_peer(ska)=skb;
-        unix_peer(skb)=ska;
+        unix_peer(ska) = skb;
+        unix_peer(skb) = ska;
         ska->sk_peercred.pid = skb->sk_peercred.pid = task_tgid_vnr(current);
-        ska->sk_peercred.uid = skb->sk_peercred.uid = current->euid;
-        ska->sk_peercred.gid = skb->sk_peercred.gid = current->egid;
+        current_euid_egid(&skb->sk_peercred.uid, &skb->sk_peercred.gid);
+        ska->sk_peercred.uid = skb->sk_peercred.uid;
+        ska->sk_peercred.gid = skb->sk_peercred.gid;
 
         if (ska->sk_type != SOCK_DGRAM) {
                 ska->sk_state = TCP_ESTABLISHED;
@@ -1205,7 +1214,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
         int err;
 
         err = -EOPNOTSUPP;
-        if (sock->type!=SOCK_STREAM && sock->type!=SOCK_SEQPACKET)
+        if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
                 goto out;
 
         err = -EINVAL;
@@ -1244,7 +1253,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
 {
         struct sock *sk = sock->sk;
         struct unix_sock *u;
-        struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr;
+        struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
         int err = 0;
 
         if (peer) {
@@ -1284,7 +1293,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         skb->destructor = sock_wfree;
         UNIXCB(skb).fp = NULL;
 
-        for (i=scm->fp->count-1; i>=0; i--)
+        for (i = scm->fp->count-1; i >= 0; i--)
                 unix_notinflight(scm->fp->fp[i]);
 }
 
@@ -1300,14 +1309,23 @@ static void unix_destruct_fds(struct sk_buff *skb)
         sock_wfree(skb);
 }
 
-static void unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 {
         int i;
-        for (i=scm->fp->count-1; i>=0; i--)
+
+        /*
+         * Need to duplicate file references for the sake of garbage
+         * collection.  Otherwise a socket in the fps might become a
+         * candidate for GC while the skb is not yet queued.
+         */
+        UNIXCB(skb).fp = scm_fp_dup(scm->fp);
+        if (!UNIXCB(skb).fp)
+                return -ENOMEM;
+
+        for (i = scm->fp->count-1; i >= 0; i--)
                 unix_inflight(scm->fp->fp[i]);
-        UNIXCB(skb).fp = scm->fp;
         skb->destructor = unix_destruct_fds;
-        scm->fp = NULL;
+        return 0;
 }
 
 /*
@@ -1321,7 +1339,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
         struct unix_sock *u = unix_sk(sk);
-        struct sockaddr_un *sunaddr=msg->msg_name;
+        struct sockaddr_un *sunaddr = msg->msg_name;
         struct sock *other = NULL;
         int namelen = 0; /* fake GCC */
         int err;
@@ -1332,6 +1350,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
         err = scm_send(sock, msg, siocb->scm);
         if (err < 0)
                 return err;
@@ -1362,16 +1381,19 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 goto out;
 
         skb = sock_alloc_send_skb(sk, len, msg->msg_flags&MSG_DONTWAIT, &err);
-        if (skb==NULL)
+        if (skb == NULL)
                 goto out;
 
         memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
-        if (siocb->scm->fp)
-                unix_attach_fds(siocb->scm, skb);
+        if (siocb->scm->fp) {
+                err = unix_attach_fds(siocb->scm, skb);
+                if (err)
+                        goto out_free;
+        }
         unix_get_secdata(siocb->scm, skb);
 
         skb_reset_transport_header(skb);
-        err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
         if (err)
                 goto out_free;
 
@@ -1385,7 +1407,7 @@ restart:
 
                 other = unix_find_other(net, sunaddr, namelen, sk->sk_type,
                                         hash, &err);
-                if (other==NULL)
+                if (other == NULL)
                         goto out_free;
         }
 
@@ -1405,7 +1427,7 @@ restart:
                 err = 0;
                 unix_state_lock(sk);
                 if (unix_peer(sk) == other) {
-                        unix_peer(sk)=NULL;
+                        unix_peer(sk) = NULL;
                         unix_state_unlock(sk);
 
                         unix_dgram_disconnected(sk, other);
@@ -1471,14 +1493,15 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
         struct sock *sk = sock->sk;
         struct sock *other = NULL;
-        struct sockaddr_un *sunaddr=msg->msg_name;
-        int err,size;
+        struct sockaddr_un *sunaddr = msg->msg_name;
+        int err, size;
         struct sk_buff *skb;
-        int sent=0;
+        int sent = 0;
         struct scm_cookie tmp_scm;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
         err = scm_send(sock, msg, siocb->scm);
         if (err < 0)
                 return err;
@@ -1501,8 +1524,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (sk->sk_shutdown & SEND_SHUTDOWN)
                 goto pipe_err;
 
-        while(sent < len)
-        {
+        while (sent < len) {
                 /*
                  *      Optimisation for the fact that under 0.01% of X
                  *      messages typically need breaking up.
@@ -1521,9 +1543,10 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                  *      Grab a buffer
                  */
 
-                skb=sock_alloc_send_skb(sk,size,msg->msg_flags&MSG_DONTWAIT, &err);
+                skb = sock_alloc_send_skb(sk, size, msg->msg_flags&MSG_DONTWAIT,
+                                          &err);
 
-                if (skb==NULL)
+                if (skb == NULL)
                         goto out_err;
 
                 /*
@@ -1536,10 +1559,16 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 size = min_t(int, size, skb_tailroom(skb));
 
                 memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
-                if (siocb->scm->fp)
-                        unix_attach_fds(siocb->scm, skb);
+                if (siocb->scm->fp) {
+                        err = unix_attach_fds(siocb->scm, skb);
+                        if (err) {
+                                kfree_skb(skb);
+                                goto out_err;
+                        }
+                }
 
-                if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) {
+                err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
+                if (err) {
                         kfree_skb(skb);
                         goto out_err;
                 }
@@ -1553,7 +1582,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 skb_queue_tail(&other->sk_receive_queue, skb);
                 unix_state_unlock(other);
                 other->sk_data_ready(other, size);
-                sent+=size;
+                sent += size;
         }
 
         scm_destroy(siocb->scm);
@@ -1565,8 +1594,8 @@ pipe_err_free:
         unix_state_unlock(other);
         kfree_skb(skb);
 pipe_err:
-        if (sent==0 && !(msg->msg_flags&MSG_NOSIGNAL))
-                send_sig(SIGPIPE,current,0);
+        if (sent == 0 && !(msg->msg_flags&MSG_NOSIGNAL))
+                send_sig(SIGPIPE, current, 0);
         err = -EPIPE;
 out_err:
         scm_destroy(siocb->scm);
@@ -1656,13 +1685,10 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         siocb->scm->creds = *UNIXCREDS(skb);
         unix_set_secdata(siocb->scm, skb);
 
-        if (!(flags & MSG_PEEK))
-        {
+        if (!(flags & MSG_PEEK)) {
                 if (UNIXCB(skb).fp)
                         unix_detach_fds(siocb->scm, skb);
-        }
-        else
-        {
+        } else {
                 /* It is questionable: on PEEK we could:
                    - do not return fds - good, but too simple 8)
                    - return fds, and do not return them on read (old strategy,
@@ -1683,7 +1709,7 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         scm_recv(sock, msg, siocb->scm, flags);
 
 out_free:
-        skb_free_datagram(sk,skb);
+        skb_free_datagram(sk, skb);
 out_unlock:
         mutex_unlock(&u->readlock);
 out:
@@ -1694,7 +1720,7 @@ out:
  *      Sleep until data has arrive. But check for races..
  */
 
-static long unix_stream_data_wait(struct sock * sk, long timeo)
+static long unix_stream_data_wait(struct sock *sk, long timeo)
 {
         DEFINE_WAIT(wait);
 
@@ -1732,7 +1758,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct scm_cookie tmp_scm;
         struct sock *sk = sock->sk;
         struct unix_sock *u = unix_sk(sk);
-        struct sockaddr_un *sunaddr=msg->msg_name;
+        struct sockaddr_un *sunaddr = msg->msg_name;
         int copied = 0;
         int check_creds = 0;
         int target;
@@ -1763,15 +1789,13 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         mutex_lock(&u->readlock);
 
-        do
-        {
+        do {
                 int chunk;
                 struct sk_buff *skb;
 
                 unix_state_lock(sk);
                 skb = skb_dequeue(&sk->sk_receive_queue);
-                if (skb==NULL)
-                {
+                if (skb == NULL) {
                         if (copied >= target)
                                 goto unlock;
 
@@ -1779,7 +1803,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                          *      POSIX 1003.1g mandates this order.
                          */
 
-                        if ((err = sock_error(sk)) != 0)
+                        err = sock_error(sk);
+                        if (err)
                                 goto unlock;
                         if (sk->sk_shutdown & RCV_SHUTDOWN)
                                 goto unlock;
@@ -1806,7 +1831,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 if (check_creds) {
                         /* Never glue messages from different writers */
-                        if (memcmp(UNIXCREDS(skb), &siocb->scm->creds, sizeof(siocb->scm->creds)) != 0) {
+                        if (memcmp(UNIXCREDS(skb), &siocb->scm->creds,
+                                   sizeof(siocb->scm->creds)) != 0) {
                                 skb_queue_head(&sk->sk_receive_queue, skb);
                                 break;
                         }
@@ -1817,8 +1843,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 }
 
                 /* Copy address just once */
-                if (sunaddr)
-                {
+                if (sunaddr) {
                         unix_copy_addr(msg, skb->sk);
                         sunaddr = NULL;
                 }
@@ -1834,16 +1859,14 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 size -= chunk;
 
                 /* Mark read part of skb as used */
-                if (!(flags & MSG_PEEK))
-                {
+                if (!(flags & MSG_PEEK)) {
                         skb_pull(skb, chunk);
 
                         if (UNIXCB(skb).fp)
                                 unix_detach_fds(siocb->scm, skb);
 
                         /* put the skb back if we didn't use it up.. */
-                        if (skb->len)
-                        {
+                        if (skb->len) {
                                 skb_queue_head(&sk->sk_receive_queue, skb);
                                 break;
                         }
@@ -1852,9 +1875,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                         if (siocb->scm->fp)
                                 break;
-                }
-                else
-                {
+                } else {
                         /* It is questionable, see note in unix_dgram_recvmsg.
                          */
                         if (UNIXCB(skb).fp)
@@ -1882,7 +1903,7 @@ static int unix_shutdown(struct socket *sock, int mode)
         if (mode) {
                 unix_state_lock(sk);
                 sk->sk_shutdown |= mode;
-                other=unix_peer(sk);
+                other = unix_peer(sk);
                 if (other)
                         sock_hold(other);
                 unix_state_unlock(sk);
@@ -1917,16 +1938,15 @@ static int unix_shutdown(struct socket *sock, int mode)
 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
-        long amount=0;
+        long amount = 0;
         int err;
 
-        switch(cmd)
-        {
-                case SIOCOUTQ:
-                        amount = atomic_read(&sk->sk_wmem_alloc);
-                        err = put_user(amount, (int __user *)arg);
-                        break;
-                case SIOCINQ:
+        switch (cmd) {
+        case SIOCOUTQ:
+                amount = atomic_read(&sk->sk_wmem_alloc);
+                err = put_user(amount, (int __user *)arg);
+                break;
+        case SIOCINQ:
                 {
                         struct sk_buff *skb;
 
@@ -1943,21 +1963,21 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         } else {
                                 skb = skb_peek(&sk->sk_receive_queue);
                                 if (skb)
-                                        amount=skb->len;
+                                        amount = skb->len;
                         }
                         spin_unlock(&sk->sk_receive_queue.lock);
                         err = put_user(amount, (int __user *)arg);
                         break;
                 }
 
-                default:
-                        err = -ENOIOCTLCMD;
-                        break;
+        default:
+                err = -ENOIOCTLCMD;
+                break;
         }
         return err;
 }
 
-static unsigned int unix_poll(struct file * file, struct socket *sock, poll_table *wait)
+static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
         struct sock *sk = sock->sk;
         unsigned int mask;
@@ -1979,7 +1999,8 @@ static unsigned int unix_poll(struct file * file, struct socket *sock, poll_tabl
                 mask |= POLLIN | POLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
-        if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) && sk->sk_state == TCP_CLOSE)
+        if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) &&
+            sk->sk_state == TCP_CLOSE)
                 mask |= POLLHUP;
 
         /*
@@ -2075,6 +2096,7 @@ struct unix_iter_state {
         struct seq_net_private p;
         int i;
 };
+
 static struct sock *unix_seq_idx(struct seq_file *seq, loff_t pos)
 {
         struct unix_iter_state *iter = seq->private;
@@ -2091,7 +2113,6 @@ static struct sock *unix_seq_idx(struct seq_file *seq, loff_t pos)
         return NULL;
 }
 
-
 static void *unix_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(unix_table_lock)
 {
@@ -2171,7 +2192,6 @@ static const struct seq_operations unix_seq_ops = {
         .show   = unix_seq_show,
 };
 
-
 static int unix_seq_open(struct inode *inode, struct file *file)
 {
         return seq_open_net(inode, file, &unix_seq_ops,
@@ -2211,7 +2231,7 @@ static int unix_net_init(struct net *net)
 #endif
         error = 0;
 out:
-        return 0;
+        return error;
 }
 
 static void unix_net_exit(struct net *net)
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 2a27b84f740b..19c17e4a0c8b 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -80,6 +80,7 @@
 #include <linux/file.h>
 #include <linux/proc_fs.h>
 #include <linux/mutex.h>
+#include <linux/wait.h>
 
 #include <net/sock.h>
 #include <net/af_unix.h>
@@ -91,6 +92,7 @@
 static LIST_HEAD(gc_inflight_list);
 static LIST_HEAD(gc_candidates);
 static DEFINE_SPINLOCK(unix_gc_lock);
+static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 
 unsigned int unix_tot_inflight;
 
@@ -104,8 +106,8 @@ static struct sock *unix_get_socket(struct file *filp)
          *      Socket ?
          */
         if (S_ISSOCK(inode->i_mode)) {
-                struct socket * sock = SOCKET_I(inode);
-                struct sock * s = sock->sk;
+                struct socket *sock = SOCKET_I(inode);
+                struct sock *s = sock->sk;
 
                 /*
                  *      PF_UNIX ?
@@ -124,7 +126,7 @@ static struct sock *unix_get_socket(struct file *filp)
 void unix_inflight(struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
-        if(s) {
+        if (s) {
                 struct unix_sock *u = unix_sk(s);
                 spin_lock(&unix_gc_lock);
                 if (atomic_long_inc_return(&u->inflight) == 1) {
@@ -141,7 +143,7 @@ void unix_inflight(struct file *fp)
 void unix_notinflight(struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
-        if(s) {
+        if (s) {
                 struct unix_sock *u = unix_sk(s);
                 spin_lock(&unix_gc_lock);
                 BUG_ON(list_empty(&u->link));
@@ -154,7 +156,7 @@ void unix_notinflight(struct file *fp)
 
 static inline struct sk_buff *sock_queue_head(struct sock *sk)
 {
-        return (struct sk_buff *) &sk->sk_receive_queue;
+        return (struct sk_buff *)&sk->sk_receive_queue;
 }
 
 #define receive_queue_for_each_skb(sk, next, skb) \
@@ -186,8 +188,17 @@ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
                                  */
                                 struct sock *sk = unix_get_socket(*fp++);
                                 if (sk) {
-                                        hit = true;
-                                        func(unix_sk(sk));
+                                        struct unix_sock *u = unix_sk(sk);
+
+                                        /*
+                                         * Ignore non-candidates, they could
+                                         * have been added to the queues after
+                                         * starting the garbage collection
+                                         */
+                                        if (u->gc_candidate) {
+                                                hit = true;
+                                                func(u);
+                                        }
                                 }
                         }
                         if (hit && hitlist != NULL) {
@@ -249,24 +260,29 @@ static void inc_inflight_move_tail(struct unix_sock *u)
 {
         atomic_long_inc(&u->inflight);
         /*
-         * If this is still a candidate, move it to the end of the
-         * list, so that it's checked even if it was already passed
-         * over
+         * If this still might be part of a cycle, move it to the end
+         * of the list, so that it's checked even if it was already
+         * passed over
          */
-        if (u->gc_candidate)
+        if (u->gc_maybe_cycle)
                 list_move_tail(&u->link, &gc_candidates);
 }
 
-/* The external entry point: unix_gc() */
+static bool gc_in_progress = false;
 
-void unix_gc(void)
+void wait_for_unix_gc(void)
 {
-        static bool gc_in_progress = false;
+        wait_event(unix_gc_wait, gc_in_progress == false);
+}
 
+/* The external entry point: unix_gc() */
+void unix_gc(void)
+{
         struct unix_sock *u;
         struct unix_sock *next;
         struct sk_buff_head hitlist;
         struct list_head cursor;
+        LIST_HEAD(not_cycle_list);
 
         spin_lock(&unix_gc_lock);
 
@@ -282,10 +298,14 @@ void unix_gc(void)
          *
          * Holding unix_gc_lock will protect these candidates from
          * being detached, and hence from gaining an external
-         * reference.  This also means, that since there are no
-         * possible receivers, the receive queues of these sockets are
-         * static during the GC, even though the dequeue is done
-         * before the detach without atomicity guarantees.
+         * reference.  Since there are no possible receivers, all
+         * buffers currently on the candidates' queues stay there
+         * during the garbage collection.
+         *
+         * We also know that no new candidate can be added onto the
+         * receive queues.  Other, non candidate sockets _can_ be
+         * added to queue, so we must make sure only to touch
+         * candidates.
          */
         list_for_each_entry_safe(u, next, &gc_inflight_list, link) {
                 long total_refs;
@@ -299,6 +319,7 @@ void unix_gc(void)
                 if (total_refs == inflight_refs) {
                         list_move_tail(&u->link, &gc_candidates);
                         u->gc_candidate = 1;
+                        u->gc_maybe_cycle = 1;
                 }
         }
 
@@ -325,21 +346,31 @@ void unix_gc(void)
                 list_move(&cursor, &u->link);
 
                 if (atomic_long_read(&u->inflight) > 0) {
-                        list_move_tail(&u->link, &gc_inflight_list);
-                        u->gc_candidate = 0;
+                        list_move_tail(&u->link, &not_cycle_list);
+                        u->gc_maybe_cycle = 0;
                         scan_children(&u->sk, inc_inflight_move_tail, NULL);
                 }
         }
         list_del(&cursor);
 
         /*
+         * not_cycle_list contains those sockets which do not make up a
+         * cycle.  Restore these to the inflight list.
+         */
+        while (!list_empty(&not_cycle_list)) {
+                u = list_entry(not_cycle_list.next, struct unix_sock, link);
+                u->gc_candidate = 0;
+                list_move_tail(&u->link, &gc_inflight_list);
+        }
+
+        /*
          * Now gc_candidates contains only garbage.  Restore original
          * inflight counters for these as well, and remove the skbuffs
          * which are creating the cycle(s).
          */
         skb_queue_head_init(&hitlist);
         list_for_each_entry(u, &gc_candidates, link)
-                scan_children(&u->sk, inc_inflight, &hitlist);
+        scan_children(&u->sk, inc_inflight, &hitlist);
 
         spin_unlock(&unix_gc_lock);
 
@@ -351,6 +382,7 @@ void unix_gc(void)
         /* All candidates should have been detached by now. */
         BUG_ON(!list_empty(&gc_candidates));
         gc_in_progress = false;
+        wake_up(&unix_gc_wait);
 
  out:
         spin_unlock(&unix_gc_lock);
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 77513d7e35f2..83c093077ebc 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -21,7 +21,7 @@ static ctl_table unix_table[] = {
                 .data           = &init_net.unx.sysctl_max_dgram_qlen,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = proc_dointvec
         },
         { .ctl_name = 0 }
 };
@@ -61,4 +61,3 @@ void unix_sysctl_unregister(struct net *net)
         unregister_sysctl_table(net->unx.ctl);
         kfree(table);
 }
-