net: unix: properly re-increment inflight counter of GC discarded candidates

[pandora-kernel.git] / net / unix / garbage.c

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 33a2126..fe03e13 100644 (file)
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -150,6 +150,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
 
        if (s) {
                struct unix_sock *u = unix_sk(s);
+               BUG_ON(!atomic_long_read(&u->inflight));
                BUG_ON(list_empty(&u->link));
                if (atomic_long_dec_and_test(&u->inflight))
                        list_del_init(&u->link);
@@ -356,6 +357,14 @@ void unix_gc(void)
        }
        list_del(&cursor);
 
+       /* Now gc_candidates contains only garbage.  Restore original
+        * inflight counters for these as well, and remove the skbuffs
+        * which are creating the cycle(s).
+        */
+       skb_queue_head_init(&hitlist);
+       list_for_each_entry(u, &gc_candidates, link)
+               scan_children(&u->sk, inc_inflight, &hitlist);
+
        /*
         * not_cycle_list contains those sockets which do not make up a
         * cycle.  Restore these to the inflight list.
@@ -366,15 +375,6 @@ void unix_gc(void)
                list_move_tail(&u->link, &gc_inflight_list);
        }
 
-       /*
-        * Now gc_candidates contains only garbage.  Restore original
-        * inflight counters for these as well, and remove the skbuffs
-        * which are creating the cycle(s).
-        */
-       skb_queue_head_init(&hitlist);
-       list_for_each_entry(u, &gc_candidates, link)
-       scan_children(&u->sk, inc_inflight, &hitlist);
-
        spin_unlock(&unix_gc_lock);
 
        /* Here we are. Hitlist is filled. Die. */