Al Viro f66906a79c fix misuses of f_count() in ppp and netlink ... commit 24dff96a37 upstream. we used to check for "nobody else could start doing anything with that opened file" by checking that refcount was 2 or less - one for descriptor table and one we'd acquired in fget() on the way to wherever we are. That was race-prone (somebody else might have had a reference to descriptor table and do fget() just as we'd been checking) and it had become flat-out incorrect back when we switched to fget_light() on those codepaths - unlike fget(), it doesn't grab an extra reference unless the descriptor table is shared. The same change allowed a race-free check, though - we are safe exactly when refcount is less than 2. It was a long time ago; pre-2.6.12 for ioctl() (the codepath leading to ppp one) and 2.6.17 for sendmsg() (netlink one). OTOH, netlink hadn't grown that check until 3.9 and ppp used to live in drivers/net, not drivers/net/ppp until 3.1. The bug existed well before that, though, and the same fix used to apply in old location of file. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-11-14 08:59:48 -08:00
..
af_netlink.c	fix misuses of f_count() in ppp and netlink	2014-11-14 08:59:48 -08:00
af_netlink.h	netlink: Eliminate kmalloc in netlink dump operation.	2013-08-15 15:51:20 -07:00
diag.c	netlink: Fix build with mmap disabled.	2013-04-23 15:39:03 -04:00
genetlink.c	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-06-26 15:15:38 -04:00
Kconfig	netlink: kconfig: move mmap i/o into netlink kconfig	2013-05-01 15:02:42 -04:00
Makefile	netlink: Diag core and basic socket info dumping (v2)	2013-03-21 12:38:03 -04:00