]> pilppa.com Git - linux-2.6-omap-h63xx.git/commit
net: Fix recursive descent in __scm_destroy().
authorDavid Miller <davem@davemloft.net>
Thu, 6 Nov 2008 08:37:40 +0000 (00:37 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Thu, 6 Nov 2008 21:51:50 +0000 (13:51 -0800)
commitf8d570a4745835f2238a33b537218a1bb03fc671
tree776c2909523c684f0954949a2947ff0a792ba457
parent75fa67706cce5272bcfc51ed646f2da21f3bdb6e
net: Fix recursive descent in __scm_destroy().

__scm_destroy() walks the list of file descriptors in the scm_fp_list
pointed to by the scm_cookie argument.

Those, in turn, can close sockets and invoke __scm_destroy() again.

There is nothing which limits how deeply this can occur.

The idea for how to fix this is from Linus.  Basically, we do all of
the fput()s at the top level by collecting all of the scm_fp_list
objects hit by an fput().  Inside of the initial __scm_destroy() we
keep running the list until it is empty.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
include/linux/sched.h
include/net/scm.h
net/core/scm.c