• David Miller's avatar
    net: Fix recursive descent in __scm_destroy(). · f8d570a4
    David Miller authored
    __scm_destroy() walks the list of file descriptors in the scm_fp_list
    pointed to by the scm_cookie argument.
    
    Those, in turn, can close sockets and invoke __scm_destroy() again.
    
    There is nothing which limits how deeply this can occur.
    
    The idea for how to fix this is from Linus.  Basically, we do all of
    the fput()s at the top level by collecting all of the scm_fp_list
    objects hit by an fput().  Inside of the initial __scm_destroy() we
    keep running the list until it is empty.
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    f8d570a4
scm.c 6.99 KB