diff options
author | Pavel Emelyanov <xemul@openvz.org> | 2008-11-14 17:51:45 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-11-14 17:51:45 -0500 |
commit | 5421ae0153b4ba0469967cfd8de96144e3bf3979 (patch) | |
tree | 99a47894d513e8726cc96b5eff26b16adfc619b9 | |
parent | d8c3e23d06c1020f38b7b6290135a9522a2e3052 (diff) |
scm: fix scm_fp_list->list initialization made in wrong place
This is the next page of the scm recursion story (the commit
f8d570a4 net: Fix recursive descent in __scm_destroy()).
In function scm_fp_dup(), the INIT_LIST_HEAD(&fpl->list) of newly
created fpl is done *before* the subsequent memcpy from the old
structure and thus the freshly initialized list is overwritten.
But that's OK, since this initialization is not required at all,
since the fpl->list is list_add-ed at the destruction time in any
case (and is unused in other code), so I propose to drop both
initializations, rather than moving it after the memcpy.
Please, correct me if I miss something significant.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | net/core/scm.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/net/core/scm.c b/net/core/scm.c index ab242cc1acca..b12303dd39d9 100644 --- a/net/core/scm.c +++ b/net/core/scm.c | |||
@@ -75,7 +75,6 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) | |||
75 | if (!fpl) | 75 | if (!fpl) |
76 | return -ENOMEM; | 76 | return -ENOMEM; |
77 | *fplp = fpl; | 77 | *fplp = fpl; |
78 | INIT_LIST_HEAD(&fpl->list); | ||
79 | fpl->count = 0; | 78 | fpl->count = 0; |
80 | } | 79 | } |
81 | fpp = &fpl->fp[fpl->count]; | 80 | fpp = &fpl->fp[fpl->count]; |
@@ -301,7 +300,6 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) | |||
301 | 300 | ||
302 | new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL); | 301 | new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL); |
303 | if (new_fpl) { | 302 | if (new_fpl) { |
304 | INIT_LIST_HEAD(&new_fpl->list); | ||
305 | for (i=fpl->count-1; i>=0; i--) | 303 | for (i=fpl->count-1; i>=0; i--) |
306 | get_file(fpl->fp[i]); | 304 | get_file(fpl->fp[i]); |
307 | memcpy(new_fpl, fpl, sizeof(*fpl)); | 305 | memcpy(new_fpl, fpl, sizeof(*fpl)); |