Commit effee6a0 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by David S. Miller

[NET]: File descriptor loss while receiving SCM_RIGHTS

If more than one file descriptor was sent with an SCM_RIGHTS message,
and on the receiving end, after installing a nonzero (but not all)
file descritpors the process runs out of fds, then the already
installed fds will be lost (userspace will have no way of knowing
about them).

The following patch makes sure, that at least the already installed
fds are sent to userspace.  It doesn't solve the issue of losing file
descriptors in case of an EFAULT on the userspace buffer.
Signed-off-by: default avatarMiklos Szeredi <miklos@szeredi.hu>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6aa2551c
...@@ -285,8 +285,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm) ...@@ -285,8 +285,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
if (i > 0) { if (i > 0) {
int cmlen = CMSG_COMPAT_LEN(i * sizeof(int)); int cmlen = CMSG_COMPAT_LEN(i * sizeof(int));
if (!err) err = put_user(SOL_SOCKET, &cm->cmsg_level);
err = put_user(SOL_SOCKET, &cm->cmsg_level);
if (!err) if (!err)
err = put_user(SCM_RIGHTS, &cm->cmsg_type); err = put_user(SCM_RIGHTS, &cm->cmsg_type);
if (!err) if (!err)
......
...@@ -245,8 +245,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) ...@@ -245,8 +245,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
if (i > 0) if (i > 0)
{ {
int cmlen = CMSG_LEN(i*sizeof(int)); int cmlen = CMSG_LEN(i*sizeof(int));
if (!err) err = put_user(SOL_SOCKET, &cm->cmsg_level);
err = put_user(SOL_SOCKET, &cm->cmsg_level);
if (!err) if (!err)
err = put_user(SCM_RIGHTS, &cm->cmsg_type); err = put_user(SCM_RIGHTS, &cm->cmsg_type);
if (!err) if (!err)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment