2 files changed, 143 insertions, 76 deletions

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 0b39b2451ea5..0722a25a3a33 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -117,7 +117,7 @@
 
 static struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
 static DEFINE_SPINLOCK(unix_table_lock);
-static atomic_t unix_nr_socks = ATOMIC_INIT(0);
+static atomic_long_t unix_nr_socks;
 
 #define unix_sockets_unbound    (&unix_socket_table[UNIX_HASH_SIZE])
 
@@ -207,7 +207,7 @@ static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned *hashp)
                 /*
                  * This may look like an off by one error but it is a bit more
                  * subtle. 108 is the longest valid AF_UNIX path for a binding.
-                 * sun_path[108] doesnt as such exist.  However in kernel space
+                 * sun_path[108] doesn't as such exist.  However in kernel space
                  * we are guaranteed that it is a valid memory location in our
                  * kernel address buffer.
                  */
@@ -316,7 +316,8 @@ static void unix_write_space(struct sock *sk)
         if (unix_writable(sk)) {
                 wq = rcu_dereference(sk->sk_wq);
                 if (wq_has_sleeper(wq))
-                        wake_up_interruptible_sync(&wq->wait);
+                        wake_up_interruptible_sync_poll(&wq->wait,
+                                POLLOUT | POLLWRNORM | POLLWRBAND);
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
         rcu_read_unlock();
@@ -360,13 +361,13 @@ static void unix_sock_destructor(struct sock *sk)
         if (u->addr)
                 unix_release_addr(u->addr);
 
-        atomic_dec(&unix_nr_socks);
+        atomic_long_dec(&unix_nr_socks);
         local_bh_disable();
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
         local_bh_enable();
 #ifdef UNIX_REFCNT_DEBUG
-        printk(KERN_DEBUG "UNIX %p is destroyed, %d are still alive.\n", sk,
-                atomic_read(&unix_nr_socks));
+        printk(KERN_DEBUG "UNIX %p is destroyed, %ld are still alive.\n", sk,
+                atomic_long_read(&unix_nr_socks));
 #endif
 }
 
@@ -523,6 +524,8 @@ static int unix_dgram_connect(struct socket *, struct sockaddr *,
                               int, int);
 static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
                                   struct msghdr *, size_t);
+static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
+                                  struct msghdr *, size_t, int);
 
 static const struct proto_ops unix_stream_ops = {
         .family =       PF_UNIX,
@@ -582,7 +585,7 @@ static const struct proto_ops unix_seqpacket_ops = {
         .setsockopt =   sock_no_setsockopt,
         .getsockopt =   sock_no_getsockopt,
         .sendmsg =      unix_seqpacket_sendmsg,
-        .recvmsg =      unix_dgram_recvmsg,
+        .recvmsg =      unix_seqpacket_recvmsg,
         .mmap =         sock_no_mmap,
         .sendpage =     sock_no_sendpage,
 };
@@ -606,8 +609,8 @@ static struct sock *unix_create1(struct net *net, struct socket *sock)
         struct sock *sk = NULL;
         struct unix_sock *u;
 
-        atomic_inc(&unix_nr_socks);
-        if (atomic_read(&unix_nr_socks) > 2 * get_max_files())
+        atomic_long_inc(&unix_nr_socks);
+        if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files())
                 goto out;
 
         sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_proto);
@@ -632,7 +635,7 @@ static struct sock *unix_create1(struct net *net, struct socket *sock)
         unix_insert_socket(unix_sockets_unbound, sk);
 out:
         if (sk == NULL)
-                atomic_dec(&unix_nr_socks);
+                atomic_long_dec(&unix_nr_socks);
         else {
                 local_bh_disable();
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
@@ -849,7 +852,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                  * Get the parent directory, calculate the hash for last
                  * component.
                  */
-                err = path_lookup(sunaddr->sun_path, LOOKUP_PARENT, &nd);
+                err = kern_path_parent(sunaddr->sun_path, &nd);
                 if (err)
                         goto out_mknod_parent;
 
@@ -1123,7 +1126,7 @@ restart:
 
         /* Latch our state.
 
-           It is tricky place. We need to grab write lock and cannot
+           It is tricky place. We need to grab our state lock and cannot
            drop lock on peer. It is dangerous because deadlock is
            possible. Connect to self case and simultaneous
            attempt to connect are eliminated by checking socket
@@ -1156,7 +1159,7 @@ restart:
                 goto restart;
         }
 
-        err = security_unix_stream_connect(sock, other->sk_socket, newsk);
+        err = security_unix_stream_connect(sk, other, newsk);
         if (err) {
                 unix_state_unlock(sk);
                 goto out_unlock;
@@ -1170,7 +1173,7 @@ restart:
         newsk->sk_type          = sk->sk_type;
         init_peercred(newsk);
         newu = unix_sk(newsk);
-        newsk->sk_wq            = &newu->peer_wq;
+        RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq);
         otheru = unix_sk(other);
 
         /* copy address information from listening to new sock*/
@@ -1343,9 +1346,25 @@ static void unix_destruct_scm(struct sk_buff *skb)
         sock_wfree(skb);
 }
 
+#define MAX_RECURSION_LEVEL 4
+
 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 {
         int i;
+        unsigned char max_level = 0;
+        int unix_sock_count = 0;
+
+        for (i = scm->fp->count - 1; i >= 0; i--) {
+                struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+                if (sk) {
+                        unix_sock_count++;
+                        max_level = max(max_level,
+                                        unix_sk(sk)->recursion_level);
+                }
+        }
+        if (unlikely(max_level > MAX_RECURSION_LEVEL))
+                return -ETOOMANYREFS;
 
         /*
          * Need to duplicate file references for the sake of garbage
@@ -1356,9 +1375,11 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         if (!UNIXCB(skb).fp)
                 return -ENOMEM;
 
-        for (i = scm->fp->count-1; i >= 0; i--)
-                unix_inflight(scm->fp->fp[i]);
-        return 0;
+        if (unix_sock_count) {
+                for (i = scm->fp->count - 1; i >= 0; i--)
+                        unix_inflight(scm->fp->fp[i]);
+        }
+        return max_level;
 }
 
 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
@@ -1393,6 +1414,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sk_buff *skb;
         long timeo;
         struct scm_cookie tmp_scm;
+        int max_level;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1431,8 +1453,9 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 goto out;
 
         err = unix_scm_to_skb(siocb->scm, skb, true);
-        if (err)
+        if (err < 0)
                 goto out_free;
+        max_level = err + 1;
         unix_get_secdata(siocb->scm, skb);
 
         skb_reset_transport_header(skb);
@@ -1454,6 +1477,12 @@ restart:
                         goto out_free;
         }
 
+        if (sk_filter(other, skb) < 0) {
+                /* Toss the packet but do not return any error to the sender */
+                err = len;
+                goto out_free;
+        }
+
         unix_state_lock(other);
         err = -EPERM;
         if (!unix_may_send(sk, other))
@@ -1511,7 +1540,11 @@ restart:
                 goto restart;
         }
 
+        if (sock_flag(other, SOCK_RCVTSTAMP))
+                __net_timestamp(skb);
         skb_queue_tail(&other->sk_receive_queue, skb);
+        if (max_level > unix_sk(other)->recursion_level)
+                unix_sk(other)->recursion_level = max_level;
         unix_state_unlock(other);
         other->sk_data_ready(other, len);
         sock_put(other);
@@ -1536,12 +1569,12 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
         struct sock *sk = sock->sk;
         struct sock *other = NULL;
-        struct sockaddr_un *sunaddr = msg->msg_name;
         int err, size;
         struct sk_buff *skb;
         int sent = 0;
         struct scm_cookie tmp_scm;
         bool fds_sent = false;
+        int max_level;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1558,7 +1591,6 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
                 goto out_err;
         } else {
-                sunaddr = NULL;
                 err = -ENOTCONN;
                 other = unix_peer(sk);
                 if (!other)
@@ -1605,10 +1637,11 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
                 /* Only send the fds in the first buffer */
                 err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
-                if (err) {
+                if (err < 0) {
                         kfree_skb(skb);
                         goto out_err;
                 }
+                max_level = err + 1;
                 fds_sent = true;
 
                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
@@ -1624,6 +1657,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                         goto pipe_err_free;
 
                 skb_queue_tail(&other->sk_receive_queue, skb);
+                if (max_level > unix_sk(other)->recursion_level)
+                        unix_sk(other)->recursion_level = max_level;
                 unix_state_unlock(other);
                 other->sk_data_ready(other, size);
                 sent += size;
@@ -1666,6 +1701,18 @@ static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock,
         return unix_dgram_sendmsg(kiocb, sock, msg, len);
 }
 
+static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
+                              struct msghdr *msg, size_t size,
+                              int flags)
+{
+        struct sock *sk = sock->sk;
+
+        if (sk->sk_state != TCP_ESTABLISHED)
+                return -ENOTCONN;
+
+        return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
+}
+
 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
 {
         struct unix_sock *u = unix_sk(sk);
@@ -1695,7 +1742,11 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         msg->msg_namelen = 0;
 
-        mutex_lock(&u->readlock);
+        err = mutex_lock_interruptible(&u->readlock);
+        if (err) {
+                err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
+                goto out;
+        }
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb) {
@@ -1708,7 +1759,8 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
                 goto out_unlock;
         }
 
-        wake_up_interruptible_sync(&u->peer_wait);
+        wake_up_interruptible_sync_poll(&u->peer_wait,
+                                        POLLOUT | POLLWRNORM | POLLWRBAND);
 
         if (msg->msg_name)
                 unix_copy_addr(msg, skb->sk);
@@ -1722,6 +1774,9 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (err)
                 goto out_free;
 
+        if (sock_flag(sk, SOCK_RCVTSTAMP))
+                __sock_recv_timestamp(msg, sk, skb);
+
         if (!siocb->scm) {
                 siocb->scm = &tmp_scm;
                 memset(&tmp_scm, 0, sizeof(tmp_scm));
@@ -1831,7 +1886,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 memset(&tmp_scm, 0, sizeof(tmp_scm));
         }
 
-        mutex_lock(&u->readlock);
+        err = mutex_lock_interruptible(&u->readlock);
+        if (err) {
+                err = sock_intr_errno(timeo);
+                goto out;
+        }
 
         do {
                 int chunk;
@@ -1840,6 +1899,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 unix_state_lock(sk);
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 if (skb == NULL) {
+                        unix_sk(sk)->recursion_level = 0;
                         if (copied >= target)
                                 goto unlock;
 
@@ -1861,11 +1921,12 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                         timeo = unix_stream_data_wait(sk, timeo);
 
-                        if (signal_pending(current)) {
+                        if (signal_pending(current)
+                            ||  mutex_lock_interruptible(&u->readlock)) {
                                 err = sock_intr_errno(timeo);
                                 goto out;
                         }
-                        mutex_lock(&u->readlock);
+
                         continue;
  unlock:
                         unix_state_unlock(sk);
@@ -1944,36 +2005,38 @@ static int unix_shutdown(struct socket *sock, int mode)
 
         mode = (mode+1)&(RCV_SHUTDOWN|SEND_SHUTDOWN);
 
-        if (mode) {
-                unix_state_lock(sk);
-                sk->sk_shutdown |= mode;
-                other = unix_peer(sk);
-                if (other)
-                        sock_hold(other);
-                unix_state_unlock(sk);
-                sk->sk_state_change(sk);
-
-                if (other &&
-                        (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)) {
-
-                        int peer_mode = 0;
-
-                        if (mode&RCV_SHUTDOWN)
-                                peer_mode |= SEND_SHUTDOWN;
-                        if (mode&SEND_SHUTDOWN)
-                                peer_mode |= RCV_SHUTDOWN;
-                        unix_state_lock(other);
-                        other->sk_shutdown |= peer_mode;
-                        unix_state_unlock(other);
-                        other->sk_state_change(other);
-                        if (peer_mode == SHUTDOWN_MASK)
-                                sk_wake_async(other, SOCK_WAKE_WAITD, POLL_HUP);
-                        else if (peer_mode & RCV_SHUTDOWN)
-                                sk_wake_async(other, SOCK_WAKE_WAITD, POLL_IN);
-                }
-                if (other)
-                        sock_put(other);
+        if (!mode)
+                return 0;
+
+        unix_state_lock(sk);
+        sk->sk_shutdown |= mode;
+        other = unix_peer(sk);
+        if (other)
+                sock_hold(other);
+        unix_state_unlock(sk);
+        sk->sk_state_change(sk);
+
+        if (other &&
+                (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)) {
+
+                int peer_mode = 0;
+
+                if (mode&RCV_SHUTDOWN)
+                        peer_mode |= SEND_SHUTDOWN;
+                if (mode&SEND_SHUTDOWN)
+                        peer_mode |= RCV_SHUTDOWN;
+                unix_state_lock(other);
+                other->sk_shutdown |= peer_mode;
+                unix_state_unlock(other);
+                other->sk_state_change(other);
+                if (peer_mode == SHUTDOWN_MASK)
+                        sk_wake_async(other, SOCK_WAKE_WAITD, POLL_HUP);
+                else if (peer_mode & RCV_SHUTDOWN)
+                        sk_wake_async(other, SOCK_WAKE_WAITD, POLL_IN);
         }
+        if (other)
+                sock_put(other);
+
         return 0;
 }
 
@@ -2033,11 +2096,10 @@ static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-            (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
@@ -2068,13 +2130,12 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
         if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
                 mask |= POLLERR;
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-            (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
@@ -2086,20 +2147,19 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
                         return mask;
         }
 
-        /* writable? */
-        writable = unix_writable(sk);
-        if (writable) {
-                other = unix_peer_get(sk);
-                if (other) {
-                        if (unix_peer(other) != sk) {
-                                sock_poll_wait(file, &unix_sk(other)->peer_wait,
-                                          wait);
-                                if (unix_recvq_full(other))
-                                        writable = 0;
-                        }
+        /* No write status requested, avoid expensive OUT tests. */
+        if (wait && !(wait->key & (POLLWRBAND | POLLWRNORM | POLLOUT)))
+                return mask;
 
-                        sock_put(other);
+        writable = unix_writable(sk);
+        other = unix_peer_get(sk);
+        if (other) {
+                if (unix_peer(other) != sk) {
+                        sock_poll_wait(file, &unix_sk(other)->peer_wait, wait);
+                        if (unix_recvq_full(other))
+                                writable = 0;
                 }
+                sock_put(other);
         }
 
         if (writable)
@@ -2194,7 +2254,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
                 struct unix_sock *u = unix_sk(s);
                 unix_state_lock(s);
 
-                seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
+                seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
                         s,
                         atomic_read(&s->sk_refcnt),
                         0,
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index c8df6fda0b1f..b6f4b994eb35 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -96,7 +96,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 unsigned int unix_tot_inflight;
 
 
-static struct sock *unix_get_socket(struct file *filp)
+struct sock *unix_get_socket(struct file *filp)
 {
         struct sock *u_sock = NULL;
         struct inode *inode = filp->f_path.dentry->d_inode;
@@ -104,7 +104,7 @@ static struct sock *unix_get_socket(struct file *filp)
         /*
          *      Socket ?
          */
-        if (S_ISSOCK(inode->i_mode)) {
+        if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) {
                 struct socket *sock = SOCKET_I(inode);
                 struct sock *s = sock->sk;
 
@@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
 }
 
 static bool gc_in_progress = false;
+#define UNIX_INFLIGHT_TRIGGER_GC 16000
 
 void wait_for_unix_gc(void)
 {
+        /*
+         * If number of inflight sockets is insane,
+         * force a garbage collect right now.
+         */
+        if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
+                unix_gc();
         wait_event(unix_gc_wait, gc_in_progress == false);
 }