diff options
| author | Pavel Emelyanov <xemul@openvz.org> | 2007-11-10 22:08:30 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-11-10 22:08:30 -0800 |
| commit | 284b327be2f86cf751316ff344b6945e580e654f (patch) | |
| tree | 61a5e5b353be80e092795e357863509861a6a774 | |
| parent | 5c80f1ae9842a8b7985acd0f02efb9828effb05f (diff) | |
| download | linux-284b327be2f86cf751316ff344b6945e580e654f.tar.bz2 | |
[UNIX]: The unix_nr_socks limit can be exceeded
The unix_nr_socks value is limited with the 2 * get_max_files() value,
as seen from the unix_create1(). However, the check and the actual
increment are separated with the GFP_KERNEL allocation, so this limit
can be exceeded under a memory pressure - task may go to sleep freeing
the pages and some other task will be allowed to allocate a new sock
and so on and so forth.
So make the increment before the check (similar thing is done in the
sock_kmalloc) and go to kmalloc after this.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/unix/af_unix.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index ab9048ac197f..e835da8fc091 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -599,15 +599,14 @@ static struct sock * unix_create1(struct net *net, struct socket *sock) struct sock *sk = NULL; struct unix_sock *u; - if (atomic_read(&unix_nr_socks) >= 2*get_max_files()) + atomic_inc(&unix_nr_socks); + if (atomic_read(&unix_nr_socks) > 2 * get_max_files()) goto out; sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_proto); if (!sk) goto out; - atomic_inc(&unix_nr_socks); - sock_init_data(sock,sk); lockdep_set_class(&sk->sk_receive_queue.lock, &af_unix_sk_receive_queue_lock_key); @@ -625,6 +624,8 @@ static struct sock * unix_create1(struct net *net, struct socket *sock) init_waitqueue_head(&u->peer_wait); unix_insert_socket(unix_sockets_unbound, sk); out: + if (sk == NULL) + atomic_dec(&unix_nr_socks); return sk; } |