summaryrefslogtreecommitdiffstats
path: root/include/net/scm.h
diff options
context:
space:
mode:
authorDavid Miller <davem@davemloft.net>2008-11-06 00:37:40 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2008-11-06 13:51:50 -0800
commitf8d570a4745835f2238a33b537218a1bb03fc671 (patch)
tree776c2909523c684f0954949a2947ff0a792ba457 /include/net/scm.h
parent75fa67706cce5272bcfc51ed646f2da21f3bdb6e (diff)
downloadop-kernel-dev-f8d570a4745835f2238a33b537218a1bb03fc671.zip
op-kernel-dev-f8d570a4745835f2238a33b537218a1bb03fc671.tar.gz
net: Fix recursive descent in __scm_destroy().
__scm_destroy() walks the list of file descriptors in the scm_fp_list pointed to by the scm_cookie argument. Those, in turn, can close sockets and invoke __scm_destroy() again. There is nothing which limits how deeply this can occur. The idea for how to fix this is from Linus. Basically, we do all of the fput()s at the top level by collecting all of the scm_fp_list objects hit by an fput(). Inside of the initial __scm_destroy() we keep running the list until it is empty. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/net/scm.h')
-rw-r--r--include/net/scm.h5
1 files changed, 3 insertions, 2 deletions
diff --git a/include/net/scm.h b/include/net/scm.h
index 06df126..33e9986 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -14,8 +14,9 @@
struct scm_fp_list
{
- int count;
- struct file *fp[SCM_MAX_FD];
+ struct list_head list;
+ int count;
+ struct file *fp[SCM_MAX_FD];
};
struct scm_cookie
OpenPOWER on IntegriCloud