Unix GC Remastered
This technical article explores the mechanics of the Unix garbage collector (GC) within the kernel, specifically focusing on how it manages socket references. It details a recent rewrite of the subsystem and discusses the risks of memory-related bugs like Use-After-Free.
Why it matters
Understanding kernel-level memory management is critical for maintaining system stability and security in Unix-based operating systems.
The AF_UNIX garbage collector is an interesting piece of the kernel. It exists because sockets can be sent with SCM_RIGHTS but they can become unreachable from user-space while still being kept alive by the kernel, which is not memory efficient; in this situation, the garbage collector intervenes to free them. Not long ago, the subsystem was rewritten from scratch on top of a graph/Strongly-Connected-Components model; but it is still bug prone. This post walks the rewrite end-to-end, and discusses a Use-After-Free bug.
The content is purely technical and objective, focusing on kernel architecture.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in