1 // SPDX-License-Identifier: GPL-2.0-or-later
13  *  - object w/ a bit
14  *  - free list
18  *  - explicit stack instead of recursion
19  *  - tail recurse on first born instead of immediate push/pop
20  *  - we gather the stuff that should not be killed into tree
25  *  - don't just push entire root set; process in place
32  *		of foo to bar and vice versa. Current code chokes on that.
38  *		upon the beginning and unmark non-junk ones.
56  *		parents (->gc_tree).
58  *		Damn. Added missing check for ->dead in listen queues scanning.
97 	spin_lock(&x->sk_receive_queue.lock);  in scan_inflight()
98 	skb_queue_walk_safe(&x->sk_receive_queue, skb, next) {  in scan_inflight()
103 			int nfd = UNIXCB(skb).fp->count;  in scan_inflight()
104 			struct file **fp = UNIXCB(skb).fp->fp;  in scan_inflight()
106 			while (nfd--) {  in scan_inflight()
113 					/* Ignore non-candidates, they could  in scan_inflight()
117 					if (test_bit(UNIX_GC_CANDIDATE, &u->gc_flags)) {  in scan_inflight()
125 				__skb_unlink(skb, &x->sk_receive_queue);  in scan_inflight()
130 	spin_unlock(&x->sk_receive_queue.lock);  in scan_inflight()
136 	if (x->sk_state != TCP_LISTEN) {  in scan_children()
147 		spin_lock(&x->sk_receive_queue.lock);  in scan_children()
148 		skb_queue_walk_safe(&x->sk_receive_queue, skb, next) {  in scan_children()
149 			u = unix_sk(skb->sk);  in scan_children()
151 			/* An embryo cannot be in-flight, so it's safe  in scan_children()
154 			BUG_ON(!list_empty(&u->link));  in scan_children()
155 			list_add_tail(&u->link, &embryos);  in scan_children()
157 		spin_unlock(&x->sk_receive_queue.lock);  in scan_children()
161 			scan_inflight(&u->sk, func, hitlist);  in scan_children()
162 			list_del_init(&u->link);  in scan_children()
169 	atomic_long_dec(&usk->inflight);  in dec_inflight()
174 	atomic_long_inc(&usk->inflight);  in inc_inflight()
179 	atomic_long_inc(&u->inflight);  in inc_inflight_move_tail()
184 	if (test_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags))  in inc_inflight_move_tail()
185 		list_move_tail(&u->link, &gc_candidates);  in inc_inflight_move_tail()
224 	 * in-flight sockets are considered, and from those only ones  in unix_gc()
235 	 * added to queue, so we must make sure only to touch  in unix_gc()
242 		total_refs = file_count(u->sk.sk_socket->file);  in unix_gc()
243 		inflight_refs = atomic_long_read(&u->inflight);  in unix_gc()
248 			list_move_tail(&u->link, &gc_candidates);  in unix_gc()
249 			__set_bit(UNIX_GC_CANDIDATE, &u->gc_flags);  in unix_gc()
250 			__set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);  in unix_gc()
254 	/* Now remove all internal in-flight reference to children of  in unix_gc()
258 		scan_children(&u->sk, dec_inflight, NULL);  in unix_gc()
272 		list_move(&cursor, &u->link);  in unix_gc()
274 		if (atomic_long_read(&u->inflight) > 0) {  in unix_gc()
275 			list_move_tail(&u->link, &not_cycle_list);  in unix_gc()
276 			__clear_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);  in unix_gc()
277 			scan_children(&u->sk, inc_inflight_move_tail, NULL);  in unix_gc()
288 		scan_children(&u->sk, inc_inflight, &hitlist);  in unix_gc()
291 		if (u->oob_skb) {  in unix_gc()
292 			kfree_skb(u->oob_skb);  in unix_gc()
293 			u->oob_skb = NULL;  in unix_gc()
303 		__clear_bit(UNIX_GC_CANDIDATE, &u->gc_flags);  in unix_gc()
304 		list_move_tail(&u->link, &gc_inflight_list);  in unix_gc()
316 		if (skb->destructor == io_uring_destruct_scm) {  in unix_gc()
318 			skb_queue_tail(&skb->sk->sk_receive_queue, skb);  in unix_gc()
331 		list_move_tail(&u->link, &gc_inflight_list);  in unix_gc()