Re: [PATCH net-next v2 1/3] af_unix: Schedule the garbage collector at task exit

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch reuses `unix_schedule_gc()` in `do_exit()`, but its `gc_in_progress` optimization introduces a race condition that leaks cyclic sockets during concurrent task exits.
--

--- Patch [1]: [PATCH net-next v2 1/3] af_unix: Schedule the garbage collector at task exit ---
commit a622ecdd6ba9403d5e403273ed947355870471a8
Author: Nam Cao <[email protected]>

af_unix: Schedule the garbage collector at task exit

This commit aims to resolve an issue where dead cyclic reference AF_UNIX
sockets stay behind indefinitely when a task exits. It does so by
scheduling the garbage collector during task exit, after the task's file
descriptors have been closed.

> diff --git a/kernel/exit.c b/kernel/exit.c
> --- a/kernel/exit.c
> +++ b/kernel/exit.c
> @@ -997,6 +998,7 @@ void __noreturn do_exit(long code)
>  	exit_sem(tsk);
>  	exit_shm(tsk);
>  	exit_files(tsk);
> +	unix_schedule_gc(NULL); /* Must be after exit_files() */

[Severity: Medium]
Will this race with concurrent task exits and leak cyclic sockets?

In net/unix/garbage.c, unix_schedule_gc() only queues the work if a garbage
collection is not already running:

void unix_schedule_gc(void)
{
        if (!READ_ONCE(gc_in_progress))
                queue_work(system_dfl_wq, &unix_gc_work);
}

If Task A and Task B exit concurrently with dead cyclic sockets:

Task A calls unix_schedule_gc() and triggers the work, which sets
gc_in_progress to true.

Task B then calls unix_schedule_gc() while the GC is running, observes
gc_in_progress is true, and silently skips queuing the work.

Task B's newly dead cycles might be missed by the currently running GC pass.
Since no new GC is queued by Task B, won't those sockets stay behind
indefinitely until another unrelated task exits, defeating the purpose of
the patch for concurrent exits?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1