Re: [PATCH v1 net-next] af_unix: Unlink scc_entry in unix_del_edge().

On Tue, Aug 04, 2026 at 12:21:54AM +0000, Kuniyuki Iwashima wrote:
> Kyle Zeng reported that GC could free a dead SCC partially.
> 
> The scenario is as follows:
> 
>    1) Create two SCCs:
> 
>        X -.   A <-> B
>        ^--'
> 
>    2) Run the following concurrently:
> 
>       2-1) send() sk-B to sk-B from sk-X
>       2-2) close() both A and B
> 
> At 2-1), there is a small window where unix_add_edges()
> publishes a new edge (B <-> B) to GC but its skb is not queued
> by skb_queue_tail().
> 
> If 2-2) completes before skb_queue_tail() and GC is triggered,
> it judges A <-> B as dead, but B is not freed because GC cannot
> collect the not-yet-queued skb holding the B <-> B edge.
> 
>        X -.   A <-> B -. This edge is visible
>        ^--'         ^..'  but skb is not
> 
> This itself is not a problem since the next GC run will judge
> B as dead as well and free it finally.
> 
>        X -.   A <.> B -.
>        ^--'         ^--'
> 
> However, X's SCC forces the next GC to call unix_walk_scc_fast(),
> and it iterates over A through B's scc_entry.
> 
> Let's unlink scc_entry before freeing the vertex in unix_del_edge().
> 
> Fixes: 4090fa373f0e ("af_unix: Replace garbage collection algorithm.")
> Reported-by: Kyle Zeng <[email protected]>
> Signed-off-by: Kuniyuki Iwashima <[email protected]>
> ---
>  net/unix/garbage.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/unix/garbage.c b/net/unix/garbage.c
> index 0783555e2526..9fcaaf55cba5 100644
> --- a/net/unix/garbage.c
> +++ b/net/unix/garbage.c
> @@ -186,6 +186,7 @@ static void unix_del_edge(struct scm_fp_list *fpl, struct unix_edge *edge)
>  	if (!vertex->out_degree) {
>  		edge->predecessor->vertex = NULL;
>  		list_move_tail(&vertex->entry, &fpl->vertices);
> +		list_del(&vertex->scc_entry);
>  	}
>  }
>  
> -- 
> 2.55.0.571.g244d577d93-goog
> 

Reviewed-by: Kyle Zeng <[email protected]>