Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

[safe/jmp/linux-2.6] / net / core / scm.c

diff --git a/net/core/scm.c b/net/core/scm.c
index ab242cc..b88f6f9 100644 (file)
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -26,6 +26,7 @@
 #include <linux/security.h>
 #include <linux/pid.h>
 #include <linux/nsproxy.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -44,11 +45,13 @@
 
 static __inline__ int scm_check_creds(struct ucred *creds)
 {
+       const struct cred *cred = current_cred();
+
        if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
-           ((creds->uid == current->uid || creds->uid == current->euid ||
-             creds->uid == current->suid) || capable(CAP_SETUID)) &&
-           ((creds->gid == current->gid || creds->gid == current->egid ||
-             creds->gid == current->sgid) || capable(CAP_SETGID))) {
+           ((creds->uid == cred->uid   || creds->uid == cred->euid ||
+             creds->uid == cred->suid) || capable(CAP_SETUID)) &&
+           ((creds->gid == cred->gid   || creds->gid == cred->egid ||
+             creds->gid == cred->sgid) || capable(CAP_SETGID))) {
               return 0;
        }
        return -EPERM;
@@ -75,7 +78,6 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                if (!fpl)
                        return -ENOMEM;
                *fplp = fpl;
-               INIT_LIST_HEAD(&fpl->list);
                fpl->count = 0;
        }
        fpp = &fpl->fp[fpl->count];
@@ -155,6 +157,8 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                switch (cmsg->cmsg_type)
                {
                case SCM_RIGHTS:
+                       if (!sock->ops || sock->ops->family != PF_UNIX)
+                               goto error;
                        err=scm_fp_copy(cmsg, &p->fp);
                        if (err<0)
                                goto error;
@@ -301,7 +305,6 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
 
        new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
        if (new_fpl) {
-               INIT_LIST_HEAD(&new_fpl->list);
                for (i=fpl->count-1; i>=0; i--)
                        get_file(fpl->fp[i]);
                memcpy(new_fpl, fpl, sizeof(*fpl));