Re: [PATCH] af_unix: Fix wrong socket tested in the symmetric half of unix_state_lock_cmp_fn().

[Kuniyuki Iwashima]

> [PATCH] af_unix: Fix wrong socket tested in the symmetric half

This is net-next material, so it should be

  [PATCH net-next vX] af_unix: ...

see Documentation/process/maintainer-netdev.rst.


On Sat, 07 Nov 2026 04:18:22 +0800, lirongqing wrote:
> From: Li RongQing <lirongqing@xxxxxxxxx>
> 
> The second half of unix_state_lock_cmp_fn() is meant to mirror the
> first one with the roles of a and b swapped, but it switches on b's
> state again:
> 
> 	if (b->sk.sk_state == TCP_LISTEN) {
> 		switch (b->sk.sk_state) {
> 		case TCP_CLOSE:
> 		case TCP_ESTABLISHED:
> 			return 1;
> 
> The enclosing if already established that b is TCP_LISTEN, so the
> switch can only reach the default label and the branch always returns
> 0, "no order known", instead of the intended 1.
> 
> Test a's state, as the first half does.  The code is only compiled with
> CONFIG_PROVE_LOCKING, so there is no runtime memory-safety impact; the
> effect is that lockdep cannot validate this nesting order of
> unix_state_lock().
> 
> Fixes: 98f706de445b ("af_unix: Define locking order for U_LOCK_SECOND in unix_stream_connect().")

Please drop the tag.

As commented, the branch never hits and no real issue exists,
not worth backporting.


> Signed-off-by: Li RongQing <lirongqing@xxxxxxxxx>
> ---
>  net/unix/af_unix.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index e7a0582..501e693 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -163,7 +163,7 @@ static int unix_state_lock_cmp_fn(const struct lockdep_map *_a,
>  
>  	/* Should never happen.  Just to be symmetric. */
>  	if (b->sk.sk_state == TCP_LISTEN) {
> -		switch (b->sk.sk_state) {
> +		switch (a->sk.sk_state) {
>  		case TCP_CLOSE:
>  		case TCP_ESTABLISHED:
>  			return 1;
> -- 
> 2.9.4
>