Re: [PATCH net-next v2 3/3] af_unix: Clean up unix_schedule_gc()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unconditional garbage collector scheduling in `do_exit()` causes severe lock contention and system-wide DoS when a live AF_UNIX cycle exists.
--

--- Patch [3]: [PATCH net-next v2 3/3] af_unix: Clean up unix_schedule_gc() ---
commit 649d449e71c2d27619a029df46ed559c6fa2ae0c
Author: Nam Cao <namcao@xxxxxxxxxxxxx>

af_unix: Clean up unix_schedule_gc()

This patch simplifies unix_schedule_gc() by removing its parameter,
as it was only called with NULL. The user struct parameter and the
logic depending on it are removed.

[ ... ]

> diff --git a/kernel/exit.c b/kernel/exit.c
> index b507b2a24693a..f3bee7cc637d0 100644
> --- a/kernel/exit.c
> +++ b/kernel/exit.c
> @@ -998,7 +998,7 @@ void __noreturn do_exit(long code)
>  	exit_sem(tsk);
>  	exit_shm(tsk);
>  	exit_files(tsk);
> -	unix_schedule_gc(NULL); /* Must be after exit_files() */
> +	unix_schedule_gc(); /* Must be after exit_files() */

[Severity: High]
Does this call trigger the garbage collector for every exiting task in the
system?

If an unprivileged user creates a live AF_UNIX cyclic reference and leaves
them open, while queueing a large number of normal inflight sockets up to
RLIMIT_NOFILE, the live cycle causes unix_graph_state to persistently be
UNIX_GRAPH_CYCLIC.

Every task exit would then constantly queue unix_gc_work, which executes
unix_walk_scc_fast() under the unix_gc_lock spinlock, iterating over all
inflight sockets:

net/unix/garbage.c:unix_walk_scc_fast() {
    ...
    while (!list_empty(&unix_unvisited_vertices)) {
    ...
}

Could this O(N) loop iterating over all inflight sockets while holding the
unix_gc_lock cause severe lock contention and a system-wide performance
degradation for any AF_UNIX operations like sendmsg and recvmsg that block
on this lock?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1784268931.git.namcao@xxxxxxxxxxxxx?part=3