net: unix: force garbage collection if too many inflight sockets

Patch vulnerability discussed on lkml:

http://lkml.org/lkml/2010/11/25/8

Patch author:       Eric Dumazet
(cherry picked from commit 0e876bd3ad5b259988a12785db5bbe3962f256d0)

Signed-off-by: nobodyAtall <tsogkas@ceid.upatras.gr>
Signed-off-by: garwedgess <garethwilliams21@gmail.com>

net/unix/garbage.c

@@ -269,9 +269,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
 }
 
 static bool gc_in_progress = false;
+#define UNIX_INFLIGHT_TRIGGER_GC 16000
 
 void wait_for_unix_gc(void)
 {
+	/*
+	 * If number of inflight sockets is insane,
+	 * force a garbage collect right now.
+	 */
+	if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
+		unix_gc();
 	wait_event(unix_gc_wait, gc_in_progress == false);
 }