1 files changed, 80 insertions, 47 deletions

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index fc12ba51c1fc..87c794d8fa2d 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -174,11 +174,11 @@ static struct sock *unix_peer_get(struct sock *s)
 {
         struct sock *peer;
 
-        unix_state_rlock(s);
+        unix_state_lock(s);
         peer = unix_peer(s);
         if (peer)
                 sock_hold(peer);
-        unix_state_runlock(s);
+        unix_state_unlock(s);
         return peer;
 }
 
@@ -369,7 +369,7 @@ static int unix_release_sock (struct sock *sk, int embrion)
         unix_remove_socket(sk);
 
         /* Clear state */
-        unix_state_wlock(sk);
+        unix_state_lock(sk);
         sock_orphan(sk);
         sk->sk_shutdown = SHUTDOWN_MASK;
         dentry       = u->dentry;
@@ -378,7 +378,7 @@ static int unix_release_sock (struct sock *sk, int embrion)
         u->mnt       = NULL;
         state = sk->sk_state;
         sk->sk_state = TCP_CLOSE;
-        unix_state_wunlock(sk);
+        unix_state_unlock(sk);
 
         wake_up_interruptible_all(&u->peer_wait);
 
@@ -386,12 +386,12 @@ static int unix_release_sock (struct sock *sk, int embrion)
 
         if (skpair!=NULL) {
                 if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
-                        unix_state_wlock(skpair);
+                        unix_state_lock(skpair);
                         /* No more writes */
                         skpair->sk_shutdown = SHUTDOWN_MASK;
                         if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)
                                 skpair->sk_err = ECONNRESET;
-                        unix_state_wunlock(skpair);
+                        unix_state_unlock(skpair);
                         skpair->sk_state_change(skpair);
                         read_lock(&skpair->sk_callback_lock);
                         sk_wake_async(skpair,1,POLL_HUP);
@@ -448,7 +448,7 @@ static int unix_listen(struct socket *sock, int backlog)
         err = -EINVAL;
         if (!u->addr)
                 goto out;                       /* No listens on an unbound socket */
-        unix_state_wlock(sk);
+        unix_state_lock(sk);
         if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
                 goto out_unlock;
         if (backlog > sk->sk_max_ack_backlog)
@@ -462,7 +462,7 @@ static int unix_listen(struct socket *sock, int backlog)
         err = 0;
 
 out_unlock:
-        unix_state_wunlock(sk);
+        unix_state_unlock(sk);
 out:
         return err;
 }
@@ -858,6 +858,31 @@ out_mknod_parent:
         goto out_up;
 }
 
+static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
+{
+        if (unlikely(sk1 == sk2) || !sk2) {
+                unix_state_lock(sk1);
+                return;
+        }
+        if (sk1 < sk2) {
+                unix_state_lock(sk1);
+                unix_state_lock_nested(sk2);
+        } else {
+                unix_state_lock(sk2);
+                unix_state_lock_nested(sk1);
+        }
+}
+
+static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
+{
+        if (unlikely(sk1 == sk2) || !sk2) {
+                unix_state_unlock(sk1);
+                return;
+        }
+        unix_state_unlock(sk1);
+        unix_state_unlock(sk2);
+}
+
 static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
                               int alen, int flags)
 {
@@ -877,11 +902,19 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
                     !unix_sk(sk)->addr && (err = unix_autobind(sock)) != 0)
                         goto out;
 
+restart:
                 other=unix_find_other(sunaddr, alen, sock->type, hash, &err);
                 if (!other)
                         goto out;
 
-                unix_state_wlock(sk);
+                unix_state_double_lock(sk, other);
+
+                /* Apparently VFS overslept socket death. Retry. */
+                if (sock_flag(other, SOCK_DEAD)) {
+                        unix_state_double_unlock(sk, other);
+                        sock_put(other);
+                        goto restart;
+                }
 
                 err = -EPERM;
                 if (!unix_may_send(sk, other))
@@ -896,7 +929,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
                  *      1003.1g breaking connected state with AF_UNSPEC
                  */
                 other = NULL;
-                unix_state_wlock(sk);
+                unix_state_double_lock(sk, other);
         }
 
         /*
@@ -905,19 +938,19 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
         if (unix_peer(sk)) {
                 struct sock *old_peer = unix_peer(sk);
                 unix_peer(sk)=other;
-                unix_state_wunlock(sk);
+                unix_state_double_unlock(sk, other);
 
                 if (other != old_peer)
                         unix_dgram_disconnected(sk, old_peer);
                 sock_put(old_peer);
         } else {
                 unix_peer(sk)=other;
-                unix_state_wunlock(sk);
+                unix_state_double_unlock(sk, other);
         }
         return 0;
 
 out_unlock:
-        unix_state_wunlock(sk);
+        unix_state_double_unlock(sk, other);
         sock_put(other);
 out:
         return err;
@@ -936,7 +969,7 @@ static long unix_wait_for_peer(struct sock *other, long timeo)
                 (skb_queue_len(&other->sk_receive_queue) >
                  other->sk_max_ack_backlog);
 
-        unix_state_runlock(other);
+        unix_state_unlock(other);
 
         if (sched)
                 timeo = schedule_timeout(timeo);
@@ -994,11 +1027,11 @@ restart:
                 goto out;
 
         /* Latch state of peer */
-        unix_state_rlock(other);
+        unix_state_lock(other);
 
         /* Apparently VFS overslept socket death. Retry. */
         if (sock_flag(other, SOCK_DEAD)) {
-                unix_state_runlock(other);
+                unix_state_unlock(other);
                 sock_put(other);
                 goto restart;
         }
@@ -1048,18 +1081,18 @@ restart:
                 goto out_unlock;
         }
 
-        unix_state_wlock_nested(sk);
+        unix_state_lock_nested(sk);
 
         if (sk->sk_state != st) {
-                unix_state_wunlock(sk);
-                unix_state_runlock(other);
+                unix_state_unlock(sk);
+                unix_state_unlock(other);
                 sock_put(other);
                 goto restart;
         }
 
         err = security_unix_stream_connect(sock, other->sk_socket, newsk);
         if (err) {
-                unix_state_wunlock(sk);
+                unix_state_unlock(sk);
                 goto out_unlock;
         }
 
@@ -1096,7 +1129,7 @@ restart:
         smp_mb__after_atomic_inc();     /* sock_hold() does an atomic_inc() */
         unix_peer(sk)   = newsk;
 
-        unix_state_wunlock(sk);
+        unix_state_unlock(sk);
 
         /* take ten and and send info to listening sock */
         spin_lock(&other->sk_receive_queue.lock);
@@ -1105,14 +1138,14 @@ restart:
          * is installed to listening socket. */
         atomic_inc(&newu->inflight);
         spin_unlock(&other->sk_receive_queue.lock);
-        unix_state_runlock(other);
+        unix_state_unlock(other);
         other->sk_data_ready(other, 0);
         sock_put(other);
         return 0;
 
 out_unlock:
         if (other)
-                unix_state_runlock(other);
+                unix_state_unlock(other);
 
 out:
         if (skb)
@@ -1178,10 +1211,10 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
         wake_up_interruptible(&unix_sk(sk)->peer_wait);
 
         /* attach accepted sock to socket */
-        unix_state_wlock(tsk);
+        unix_state_lock(tsk);
         newsock->state = SS_CONNECTED;
         sock_graft(tsk, newsock);
-        unix_state_wunlock(tsk);
+        unix_state_unlock(tsk);
         return 0;
 
 out:
@@ -1208,7 +1241,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
         }
 
         u = unix_sk(sk);
-        unix_state_rlock(sk);
+        unix_state_lock(sk);
         if (!u->addr) {
                 sunaddr->sun_family = AF_UNIX;
                 sunaddr->sun_path[0] = 0;
@@ -1219,7 +1252,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
                 *uaddr_len = addr->len;
                 memcpy(sunaddr, addr->name, *uaddr_len);
         }
-        unix_state_runlock(sk);
+        unix_state_unlock(sk);
         sock_put(sk);
 out:
         return err;
@@ -1337,7 +1370,7 @@ restart:
                         goto out_free;
         }
 
-        unix_state_rlock(other);
+        unix_state_lock(other);
         err = -EPERM;
         if (!unix_may_send(sk, other))
                 goto out_unlock;
@@ -1347,20 +1380,20 @@ restart:
                  *      Check with 1003.1g - what should
                  *      datagram error
                  */
-                unix_state_runlock(other);
+                unix_state_unlock(other);
                 sock_put(other);
 
                 err = 0;
-                unix_state_wlock(sk);
+                unix_state_lock(sk);
                 if (unix_peer(sk) == other) {
                         unix_peer(sk)=NULL;
-                        unix_state_wunlock(sk);
+                        unix_state_unlock(sk);
 
                         unix_dgram_disconnected(sk, other);
                         sock_put(other);
                         err = -ECONNREFUSED;
                 } else {
-                        unix_state_wunlock(sk);
+                        unix_state_unlock(sk);
                 }
 
                 other = NULL;
@@ -1397,14 +1430,14 @@ restart:
         }
 
         skb_queue_tail(&other->sk_receive_queue, skb);
-        unix_state_runlock(other);
+        unix_state_unlock(other);
         other->sk_data_ready(other, len);
         sock_put(other);
         scm_destroy(siocb->scm);
         return len;
 
 out_unlock:
-        unix_state_runlock(other);
+        unix_state_unlock(other);
 out_free:
         kfree_skb(skb);
 out:
@@ -1494,14 +1527,14 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                         goto out_err;
                 }
 
-                unix_state_rlock(other);
+                unix_state_lock(other);
 
                 if (sock_flag(other, SOCK_DEAD) ||
                     (other->sk_shutdown & RCV_SHUTDOWN))
                         goto pipe_err_free;
 
                 skb_queue_tail(&other->sk_receive_queue, skb);
-                unix_state_runlock(other);
+                unix_state_unlock(other);
                 other->sk_data_ready(other, size);
                 sent+=size;
         }
@@ -1512,7 +1545,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         return sent;
 
 pipe_err_free:
-        unix_state_runlock(other);
+        unix_state_unlock(other);
         kfree_skb(skb);
 pipe_err:
         if (sent==0 && !(msg->msg_flags&MSG_NOSIGNAL))
@@ -1641,7 +1674,7 @@ static long unix_stream_data_wait(struct sock * sk, long timeo)
 {
         DEFINE_WAIT(wait);
 
-        unix_state_rlock(sk);
+        unix_state_lock(sk);
 
         for (;;) {
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
@@ -1654,14 +1687,14 @@ static long unix_stream_data_wait(struct sock * sk, long timeo)
                         break;
 
                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-                unix_state_runlock(sk);
+                unix_state_unlock(sk);
                 timeo = schedule_timeout(timeo);
-                unix_state_rlock(sk);
+                unix_state_lock(sk);
                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         }
 
         finish_wait(sk->sk_sleep, &wait);
-        unix_state_runlock(sk);
+        unix_state_unlock(sk);
         return timeo;
 }
 
@@ -1816,12 +1849,12 @@ static int unix_shutdown(struct socket *sock, int mode)
         mode = (mode+1)&(RCV_SHUTDOWN|SEND_SHUTDOWN);
 
         if (mode) {
-                unix_state_wlock(sk);
+                unix_state_lock(sk);
                 sk->sk_shutdown |= mode;
                 other=unix_peer(sk);
                 if (other)
                         sock_hold(other);
-                unix_state_wunlock(sk);
+                unix_state_unlock(sk);
                 sk->sk_state_change(sk);
 
                 if (other &&
@@ -1833,9 +1866,9 @@ static int unix_shutdown(struct socket *sock, int mode)
                                 peer_mode |= SEND_SHUTDOWN;
                         if (mode&SEND_SHUTDOWN)
                                 peer_mode |= RCV_SHUTDOWN;
-                        unix_state_wlock(other);
+                        unix_state_lock(other);
                         other->sk_shutdown |= peer_mode;
-                        unix_state_wunlock(other);
+                        unix_state_unlock(other);
                         other->sk_state_change(other);
                         read_lock(&other->sk_callback_lock);
                         if (peer_mode == SHUTDOWN_MASK)
@@ -1973,7 +2006,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
         else {
                 struct sock *s = v;
                 struct unix_sock *u = unix_sk(s);
-                unix_state_rlock(s);
+                unix_state_lock(s);
 
                 seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
                         s,
@@ -2001,7 +2034,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
                         for ( ; i < len; i++)
                                 seq_putc(seq, u->addr->name->sun_path[i]);
                 }
-                unix_state_runlock(s);
+                unix_state_unlock(s);
                 seq_putc(seq, '\n');
         }