net: Fix recursive descent in __scm_destroy().
authorDavid S. Miller <davem@davemloft.net>
Thu, 6 Nov 2008 23:45:32 +0000 (15:45 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 6 Nov 2008 23:45:32 +0000 (15:45 -0800)
commit3b53fbf4314594fa04544b02b2fc6e607912da18
treeaf88f6c7ecbdf06719c92cc8891f75f497b70555
parent518a09ef11f8454f4676125d47c3e775b300c6a5
net: Fix recursive descent in __scm_destroy().

__scm_destroy() walks the list of file descriptors in the scm_fp_list
pointed to by the scm_cookie argument.

Those, in turn, can close sockets and invoke __scm_destroy() again.

There is nothing which limits how deeply this can occur.

The idea for how to fix this is from Linus.  Basically, we do all of
the fput()s at the top level by collecting all of the scm_fp_list
objects hit by an fput().  Inside of the initial __scm_destroy() we
keep running the list until it is empty.

Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/sched.h
include/net/scm.h
net/core/scm.c