| Message ID | 491D8C1A.5060003@openvz.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Pavel Emelyanov <xemul@openvz.org> Date: Fri, 14 Nov 2008 17:32:58 +0300 > This is the next page of the scm recursion story (the commit > f8d570a4 net: Fix recursive descent in __scm_destroy()). > > In function scm_fp_dup(), the INIT_LIST_HEAD(&fpl->list) of newly > created fpl is done *before* the subsequent memcpy from the old > structure and thus the freshly initialized list is overwritten. > > But that's OK, since this initialization is not required at all, > since the fpl->list is list_add-ed at the destruction time in any > case (and is unused in other code), so I propose to drop both > initializations, rather than moving it after the memcpy. > > Please, correct me if I miss something significant. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Yep, this is totally correct. Linus even noticed this in my original patch but kept them there because they seemed harmless to him. Patch applied to net-2.6, thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/core/scm.c b/net/core/scm.c index ab242cc..b12303d 100644 --- a/net/core/scm.c +++ b/net/core/scm.c @@ -75,7 +75,6 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) if (!fpl) return -ENOMEM; *fplp = fpl; - INIT_LIST_HEAD(&fpl->list); fpl->count = 0; } fpp = &fpl->fp[fpl->count]; @@ -301,7 +300,6 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL); if (new_fpl) { - INIT_LIST_HEAD(&new_fpl->list); for (i=fpl->count-1; i>=0; i--) get_file(fpl->fp[i]); memcpy(new_fpl, fpl, sizeof(*fpl));
This is the next page of the scm recursion story (the commit f8d570a4 net: Fix recursive descent in __scm_destroy()). In function scm_fp_dup(), the INIT_LIST_HEAD(&fpl->list) of newly created fpl is done *before* the subsequent memcpy from the old structure and thus the freshly initialized list is overwritten. But that's OK, since this initialization is not required at all, since the fpl->list is list_add-ed at the destruction time in any case (and is unused in other code), so I propose to drop both initializations, rather than moving it after the memcpy. Please, correct me if I miss something significant. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html