scm: lower SCM_MAX_FD

[net-next-2.6.git] / net / core / scm.c

diff --git a/net/core/scm.c b/net/core/scm.c
index b88f6f9d0b97503ddd353e163e73680704cde79a..bbe4544508016925726522f275e95aefadeb1664 100644 (file)
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -79,10 +79,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                        return -ENOMEM;
                *fplp = fpl;
                fpl->count = 0;
+               fpl->max = SCM_MAX_FD;
        }
        fpp = &fpl->fp[fpl->count];
 
-       if (fpl->count + num > SCM_MAX_FD)
+       if (fpl->count + num > fpl->max)
                return -EINVAL;
 
        /*
@@ -130,6 +131,7 @@ void __scm_destroy(struct scm_cookie *scm)
                }
        }
 }
+EXPORT_SYMBOL(__scm_destroy);
 
 int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
 {
@@ -170,6 +172,30 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                        err = scm_check_creds(&p->creds);
                        if (err)
                                goto error;
+
+                       if (pid_vnr(p->pid) != p->creds.pid) {
+                               struct pid *pid;
+                               err = -ESRCH;
+                               pid = find_get_pid(p->creds.pid);
+                               if (!pid)
+                                       goto error;
+                               put_pid(p->pid);
+                               p->pid = pid;
+                       }
+
+                       if ((p->cred->euid != p->creds.uid) ||
+                               (p->cred->egid != p->creds.gid)) {
+                               struct cred *cred;
+                               err = -ENOMEM;
+                               cred = prepare_creds();
+                               if (!cred)
+                                       goto error;
+
+                               cred->uid = cred->euid = p->creds.uid;
+                               cred->gid = cred->egid = p->creds.uid;
+                               put_cred(p->cred);
+                               p->cred = cred;
+                       }
                        break;
                default:
                        goto error;
@@ -187,6 +213,7 @@ error:
        scm_destroy(p);
        return err;
 }
+EXPORT_SYMBOL(__scm_send);
 
 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
 {
@@ -225,6 +252,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
 out:
        return err;
 }
+EXPORT_SYMBOL(put_cmsg);
 
 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
 {
@@ -294,6 +322,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
         */
        __scm_destroy(scm);
 }
+EXPORT_SYMBOL(scm_detach_fds);
 
 struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
 {
@@ -303,17 +332,13 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
        if (!fpl)
                return NULL;
 
-       new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
+       new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
+                         GFP_KERNEL);
        if (new_fpl) {
-               for (i=fpl->count-1; i>=0; i--)
+               for (i = 0; i < fpl->count; i++)
                        get_file(fpl->fp[i]);
-               memcpy(new_fpl, fpl, sizeof(*fpl));
+               new_fpl->max = new_fpl->count;
        }
        return new_fpl;
 }
-
-EXPORT_SYMBOL(__scm_destroy);
-EXPORT_SYMBOL(__scm_send);
-EXPORT_SYMBOL(put_cmsg);
-EXPORT_SYMBOL(scm_detach_fds);
 EXPORT_SYMBOL(scm_fp_dup);