| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20240203030058.60750-8-kuniyu@amazon.com>
Date: Fri, 2 Feb 2024 19:00:49 -0800
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: "David S. Miller" <davem@...emloft.net>, Eric Dumazet
<edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
<pabeni@...hat.com>
CC: Kuniyuki Iwashima <kuniyu@...zon.com>, Kuniyuki Iwashima
<kuni1840@...il.com>, <netdev@...r.kernel.org>
Subject: [PATCH v1 net-next 07/16] af_unix: Detect Strongly Connected Components.
In the new GC, we use a simple graph algorithm, Tarjan's Strongly
Connected Components (SCC) algorithm, to find cyclic references.
The algorithm visits every vertex exactly once using depth-first
search (DFS). We implement it without recursion so that no one can
abuse it.
There could be multiple graphs, so we iterate unix_unvisited_vertices
in unix_walk_scc() and do DFS in __unix_walk_scc(), where we move
visited vertices to another list, unix_visited_vertices, not to
restart DFS twice on a visited vertex later in unix_walk_scc().
DFS starts by pushing an input vertex to a stack and assigning it
a unique number. Two fields, index and lowlink, are initialised
with the number, but lowlink could be updated later during DFS.
If a vertex has an edge to an unvisited inflight vertex, we visit
it and do the same processing. So, we will have vertices in the
stack in the order they appear and number them consecutively in
the same order.
If a vertex has an edge to a visited vertex in stack, so-called
back-edge, we update the predecessor's lowlink with the successor's
index.
After iterating edges from the vertex, we check if its index
equals its lowlink.
If the lowlink is different from the index, it shows there was a
back-edge. Then, we propagate the lowlink to its predecessor.
If the lowlink is the same as the index, we pop vertices before
and including the vertex from the stack. Then, the set of vertices
is SCC, possibly forming a cycle. At the same time, we move the
vertices to unix_visited_vertices.
When we finish the algorithm, all vertices in each SCC will be
linked via unix_vertex.scc_entry.
Let's take an example. We have a graph including five inflight
vertices (F is not inflight):
A -> B -> C -> D -> E (-> F)
^ |
`---------'
Suppose that we start DFS from C. We will visit C, D, and B first
and initialise their index and lowlink. Then, the stack looks like
this:
> B = (3, 3) (index, lowlink)
D = (2, 2)
C = (1, 1)
When checking B's edge to C, we update B's lowlink with C's index
and propagate it to D.
> B = (3, 1) (index, lowlink)
D = (2, 1)
C = (1, 1)
Next, we visit E, which has no edge to an inflight vertex.
> E = (4, 4) (index, lowlink)
B = (3, 1)
D = (2, 1)
C = (1, 1)
When we leave from E, its index and lowlink are the same, so we pop
E from the stack.
B = (3, 1) (index, lowlink)
D = (2, 1)
> C = (1, 1)
Then, we leave C, whose index and lowlink are the same, so we pop
B, D and C as SCC.
Last, we do DFS for the rest of vertices, A, which is also a
single-vertex SCC.
Finally, each unix_vertex.scc_entry is linked as follows:
A -. B -> C -> D E -.
^ | ^ | ^ |
`--' `---------' `--'
Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>
---
include/net/af_unix.h | 5 +++
net/unix/garbage.c | 80 +++++++++++++++++++++++++++++++++++++++++++
2 files changed, 85 insertions(+)
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 2d8e93775e61..0874f6b41adc 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -34,7 +34,11 @@ void wait_for_unix_gc(struct scm_fp_list *fpl);
struct unix_vertex {
struct list_head edges;
struct list_head entry;
+ struct list_head scc_entry;
unsigned long out_degree;
+ unsigned long index;
+ unsigned long lowlink;
+ bool on_stack;
};
struct unix_edge {
@@ -42,6 +46,7 @@ struct unix_edge {
struct unix_vertex *successor;
struct list_head entry;
struct list_head embryo_entry;
+ struct list_head stack_entry;
};
struct sock *unix_peer_get(struct sock *sk);
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 42ed886c75d1..e235c03ee3c3 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -108,6 +108,7 @@ void unix_init_vertex(struct unix_sock *u)
vertex->out_degree = 0;
INIT_LIST_HEAD(&vertex->edges);
INIT_LIST_HEAD(&vertex->entry);
+ INIT_LIST_HEAD(&vertex->scc_entry);
}
DEFINE_SPINLOCK(unix_gc_lock);
@@ -217,6 +218,83 @@ void unix_free_edges(struct scm_fp_list *fpl)
kvfree(fpl->edges);
}
+enum unix_vertex_index {
+ UNIX_VERTEX_INDEX_UNVISITED,
+ UNIX_VERTEX_INDEX_START,
+};
+
+static LIST_HEAD(unix_visited_vertices);
+
+static void __unix_walk_scc(struct unix_vertex *vertex)
+{
+ unsigned long index = UNIX_VERTEX_INDEX_START;
+ LIST_HEAD(vertex_stack);
+ struct unix_edge *edge;
+ LIST_HEAD(edge_stack);
+
+next_vertex:
+ vertex->index = index;
+ vertex->lowlink = index;
+ index++;
+
+ vertex->on_stack = true;
+ list_move(&vertex->scc_entry, &vertex_stack);
+
+ list_for_each_entry(edge, &vertex->edges, entry) {
+ if (!edge->successor->out_degree)
+ continue;
+
+ if (edge->successor->index == UNIX_VERTEX_INDEX_UNVISITED) {
+ list_add(&edge->stack_entry, &edge_stack);
+
+ vertex = edge->successor;
+ goto next_vertex;
+ }
+
+ if (edge->successor->on_stack)
+ vertex->lowlink = min(vertex->lowlink, edge->successor->index);
+next_edge:
+ }
+
+ if (vertex->index == vertex->lowlink) {
+ LIST_HEAD(scc);
+
+ list_cut_position(&scc, &vertex_stack, &vertex->scc_entry);
+
+ list_for_each_entry_reverse(vertex, &scc, scc_entry) {
+ list_move_tail(&vertex->entry, &unix_visited_vertices);
+
+ vertex->on_stack = false;
+ }
+
+ list_del(&scc);
+ }
+
+ if (!list_empty(&edge_stack)) {
+ edge = list_first_entry(&edge_stack, typeof(*edge), stack_entry);
+ list_del_init(&edge->stack_entry);
+
+ vertex = edge->predecessor;
+ vertex->lowlink = min(vertex->lowlink, edge->successor->lowlink);
+ goto next_edge;
+ }
+}
+
+static void unix_walk_scc(void)
+{
+ struct unix_vertex *vertex;
+
+ list_for_each_entry(vertex, &unix_unvisited_vertices, entry)
+ vertex->index = UNIX_VERTEX_INDEX_UNVISITED;
+
+ while (!list_empty(&unix_unvisited_vertices)) {
+ vertex = list_first_entry(&unix_unvisited_vertices, typeof(*vertex), entry);
+ __unix_walk_scc(vertex);
+ }
+
+ list_replace_init(&unix_visited_vertices, &unix_unvisited_vertices);
+}
+
static LIST_HEAD(gc_candidates);
static LIST_HEAD(gc_inflight_list);
@@ -364,6 +442,8 @@ static void __unix_gc(struct work_struct *work)
spin_lock(&unix_gc_lock);
+ unix_walk_scc();
+
/* First, select candidates for garbage collection. Only
* in-flight sockets are considered, and from those only ones
* which don't have any external reference.
--
2.30.2
Powered by blists - more mailing lists