write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/net/unix/scm.c
..
..
@@ -8,6 +8,7 @@
8
8
 #include <net/af_unix.h>
9
9
 #include <net/scm.h>
10
10
 #include <linux/init.h>
11
+#include <linux/io_uring.h>
11
12
 
12
13
 #include "scm.h"
13
14
 
..
..
@@ -33,6 +34,9 @@
33
34
 		/* PF_UNIX ? */
34
35
 		if (s && sock->ops && sock->ops->family == PF_UNIX)
35
36
 			u_sock = s;
37
+	} else {
38
+		/* Could be an io_uring instance */
39
+		u_sock = io_uring_get_socket(filp);
36
40
 	}
37
41
 	return u_sock;
38
42
 }
..
..
@@ -59,7 +63,7 @@
59
63
 		/* Paired with READ_ONCE() in wait_for_unix_gc() */
60
64
 		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1);
61
65
 	}
62
-	user->unix_inflight++;
66
+	WRITE_ONCE(user->unix_inflight, user->unix_inflight + 1);
63
67
 	spin_unlock(&unix_gc_lock);
64
68
 }
65
69
 
..
..
@@ -80,7 +84,7 @@
80
84
 		/* Paired with READ_ONCE() in wait_for_unix_gc() */
81
85
 		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1);
82
86
 	}
83
-	user->unix_inflight--;
87
+	WRITE_ONCE(user->unix_inflight, user->unix_inflight - 1);
84
88
 	spin_unlock(&unix_gc_lock);
85
89
 }
86
90
 
..
..
@@ -94,7 +98,7 @@
94
98
 {
95
99
 	struct user_struct *user = current_user();
96
100
 
97
-	if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
101
+	if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE)))
98
102
 		return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
99
103
 	return false;
100
104
 }