Linux Audio

Check our new training course

Loading...
v3.1
 
  1/* scm.c - Socket level control messages processing.
  2 *
  3 * Author:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
  4 *              Alignment and value checking mods by Craig Metz
  5 *
  6 *		This program is free software; you can redistribute it and/or
  7 *		modify it under the terms of the GNU General Public License
  8 *		as published by the Free Software Foundation; either version
  9 *		2 of the License, or (at your option) any later version.
 10 */
 11
 12#include <linux/module.h>
 13#include <linux/signal.h>
 14#include <linux/capability.h>
 15#include <linux/errno.h>
 16#include <linux/sched.h>
 
 17#include <linux/mm.h>
 18#include <linux/kernel.h>
 19#include <linux/stat.h>
 20#include <linux/socket.h>
 21#include <linux/file.h>
 22#include <linux/fcntl.h>
 23#include <linux/net.h>
 24#include <linux/interrupt.h>
 25#include <linux/netdevice.h>
 26#include <linux/security.h>
 
 27#include <linux/pid.h>
 28#include <linux/nsproxy.h>
 29#include <linux/slab.h>
 
 
 30
 31#include <asm/system.h>
 32#include <asm/uaccess.h>
 33
 34#include <net/protocol.h>
 35#include <linux/skbuff.h>
 36#include <net/sock.h>
 37#include <net/compat.h>
 38#include <net/scm.h>
 
 
 39
 40
 41/*
 42 *	Only allow a user to send credentials, that they could set with
 43 *	setu(g)id.
 44 */
 45
 46static __inline__ int scm_check_creds(struct ucred *creds)
 47{
 48	const struct cred *cred = current_cred();
 
 
 
 
 
 49
 50	if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
 51	    ((creds->uid == cred->uid   || creds->uid == cred->euid ||
 52	      creds->uid == cred->suid) || capable(CAP_SETUID)) &&
 53	    ((creds->gid == cred->gid   || creds->gid == cred->egid ||
 54	      creds->gid == cred->sgid) || capable(CAP_SETGID))) {
 
 55	       return 0;
 56	}
 57	return -EPERM;
 58}
 59
 60static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
 61{
 62	int *fdp = (int*)CMSG_DATA(cmsg);
 63	struct scm_fp_list *fpl = *fplp;
 64	struct file **fpp;
 65	int i, num;
 66
 67	num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int);
 68
 69	if (num <= 0)
 70		return 0;
 71
 72	if (num > SCM_MAX_FD)
 73		return -EINVAL;
 74
 75	if (!fpl)
 76	{
 77		fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
 78		if (!fpl)
 79			return -ENOMEM;
 80		*fplp = fpl;
 81		fpl->count = 0;
 
 82		fpl->max = SCM_MAX_FD;
 
 
 
 
 
 
 
 83	}
 84	fpp = &fpl->fp[fpl->count];
 85
 86	if (fpl->count + num > fpl->max)
 87		return -EINVAL;
 88
 89	/*
 90	 *	Verify the descriptors and increment the usage count.
 91	 */
 92
 93	for (i=0; i< num; i++)
 94	{
 95		int fd = fdp[i];
 96		struct file *file;
 97
 98		if (fd < 0 || !(file = fget_raw(fd)))
 99			return -EBADF;
 
 
 
 
 
 
 
 
100		*fpp++ = file;
101		fpl->count++;
102	}
 
 
 
 
103	return num;
104}
105
106void __scm_destroy(struct scm_cookie *scm)
107{
108	struct scm_fp_list *fpl = scm->fp;
109	int i;
110
111	if (fpl) {
112		scm->fp = NULL;
113		if (current->scm_work_list) {
114			list_add_tail(&fpl->list, current->scm_work_list);
115		} else {
116			LIST_HEAD(work_list);
117
118			current->scm_work_list = &work_list;
119
120			list_add(&fpl->list, &work_list);
121			while (!list_empty(&work_list)) {
122				fpl = list_first_entry(&work_list, struct scm_fp_list, list);
123
124				list_del(&fpl->list);
125				for (i=fpl->count-1; i>=0; i--)
126					fput(fpl->fp[i]);
127				kfree(fpl);
128			}
129
130			current->scm_work_list = NULL;
131		}
132	}
133}
134EXPORT_SYMBOL(__scm_destroy);
135
136int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
137{
 
138	struct cmsghdr *cmsg;
139	int err;
140
141	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg))
142	{
143		err = -EINVAL;
144
145		/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
146		/* The first check was omitted in <= 2.2.5. The reasoning was
147		   that parser checks cmsg_len in any case, so that
148		   additional check would be work duplication.
149		   But if cmsg_level is not SOL_SOCKET, we do not check
150		   for too short ancillary data object at all! Oops.
151		   OK, let's add it...
152		 */
153		if (!CMSG_OK(msg, cmsg))
154			goto error;
155
156		if (cmsg->cmsg_level != SOL_SOCKET)
157			continue;
158
159		switch (cmsg->cmsg_type)
160		{
161		case SCM_RIGHTS:
162			if (!sock->ops || sock->ops->family != PF_UNIX)
163				goto error;
164			err=scm_fp_copy(cmsg, &p->fp);
165			if (err<0)
166				goto error;
167			break;
168		case SCM_CREDENTIALS:
 
 
 
 
169			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
170				goto error;
171			memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred));
172			err = scm_check_creds(&p->creds);
173			if (err)
174				goto error;
175
176			if (pid_vnr(p->pid) != p->creds.pid) {
 
177				struct pid *pid;
178				err = -ESRCH;
179				pid = find_get_pid(p->creds.pid);
180				if (!pid)
181					goto error;
182				put_pid(p->pid);
183				p->pid = pid;
184			}
185
186			if ((p->cred->euid != p->creds.uid) ||
187				(p->cred->egid != p->creds.gid)) {
188				struct cred *cred;
189				err = -ENOMEM;
190				cred = prepare_creds();
191				if (!cred)
192					goto error;
193
194				cred->uid = cred->euid = p->creds.uid;
195				cred->gid = cred->egid = p->creds.gid;
196				put_cred(p->cred);
197				p->cred = cred;
198			}
199			break;
 
200		default:
201			goto error;
202		}
203	}
204
205	if (p->fp && !p->fp->count)
206	{
207		kfree(p->fp);
208		p->fp = NULL;
209	}
210	return 0;
211
212error:
213	scm_destroy(p);
214	return err;
215}
216EXPORT_SYMBOL(__scm_send);
217
218int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
219{
220	struct cmsghdr __user *cm
221		= (__force struct cmsghdr __user *)msg->msg_control;
222	struct cmsghdr cmhdr;
223	int cmlen = CMSG_LEN(len);
224	int err;
225
226	if (MSG_CMSG_COMPAT & msg->msg_flags)
227		return put_cmsg_compat(msg, level, type, len, data);
228
229	if (cm==NULL || msg->msg_controllen < sizeof(*cm)) {
230		msg->msg_flags |= MSG_CTRUNC;
231		return 0; /* XXX: return error? check spec. */
232	}
233	if (msg->msg_controllen < cmlen) {
234		msg->msg_flags |= MSG_CTRUNC;
235		cmlen = msg->msg_controllen;
236	}
237	cmhdr.cmsg_level = level;
238	cmhdr.cmsg_type = type;
239	cmhdr.cmsg_len = cmlen;
240
241	err = -EFAULT;
242	if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
243		goto out;
244	if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
245		goto out;
246	cmlen = CMSG_SPACE(len);
247	if (msg->msg_controllen < cmlen)
248		cmlen = msg->msg_controllen;
249	msg->msg_control += cmlen;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
250	msg->msg_controllen -= cmlen;
251	err = 0;
252out:
253	return err;
 
 
 
254}
255EXPORT_SYMBOL(put_cmsg);
256
257void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
 
 
 
 
 
 
 
 
 
 
258{
259	struct cmsghdr __user *cm
260		= (__force struct cmsghdr __user*)msg->msg_control;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
261
262	int fdmax = 0;
263	int fdnum = scm->fp->count;
264	struct file **fp = scm->fp->fp;
265	int __user *cmfptr;
 
 
 
266	int err = 0, i;
267
268	if (MSG_CMSG_COMPAT & msg->msg_flags) {
 
 
 
 
269		scm_detach_fds_compat(msg, scm);
270		return;
271	}
272
273	if (msg->msg_controllen > sizeof(struct cmsghdr))
274		fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
275			 / sizeof(int));
276
277	if (fdnum < fdmax)
278		fdmax = fdnum;
279
280	for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
281	     i++, cmfptr++)
282	{
283		int new_fd;
284		err = security_file_receive(fp[i]);
285		if (err)
286			break;
287		err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags
288					  ? O_CLOEXEC : 0);
289		if (err < 0)
290			break;
291		new_fd = err;
292		err = put_user(new_fd, cmfptr);
293		if (err) {
294			put_unused_fd(new_fd);
295			break;
296		}
297		/* Bump the usage count and install the file. */
298		get_file(fp[i]);
299		fd_install(new_fd, fp[i]);
300	}
301
302	if (i > 0)
303	{
304		int cmlen = CMSG_LEN(i*sizeof(int));
305		err = put_user(SOL_SOCKET, &cm->cmsg_level);
306		if (!err)
307			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
308		if (!err)
309			err = put_user(cmlen, &cm->cmsg_len);
310		if (!err) {
311			cmlen = CMSG_SPACE(i*sizeof(int));
312			msg->msg_control += cmlen;
 
 
313			msg->msg_controllen -= cmlen;
314		}
315	}
316	if (i < fdnum || (fdnum && fdmax <= 0))
 
317		msg->msg_flags |= MSG_CTRUNC;
318
319	/*
320	 * All of the files that fit in the message have had their
321	 * usage counts incremented, so we just free the list.
322	 */
323	__scm_destroy(scm);
324}
325EXPORT_SYMBOL(scm_detach_fds);
326
327struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
328{
329	struct scm_fp_list *new_fpl;
330	int i;
331
332	if (!fpl)
333		return NULL;
334
335	new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
336			  GFP_KERNEL);
337	if (new_fpl) {
338		for (i = 0; i < fpl->count; i++)
339			get_file(fpl->fp[i]);
 
340		new_fpl->max = new_fpl->count;
 
 
 
 
 
 
341	}
342	return new_fpl;
343}
344EXPORT_SYMBOL(scm_fp_dup);
v6.13.7
  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/* scm.c - Socket level control messages processing.
  3 *
  4 * Author:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
  5 *              Alignment and value checking mods by Craig Metz
 
 
 
 
 
  6 */
  7
  8#include <linux/module.h>
  9#include <linux/signal.h>
 10#include <linux/capability.h>
 11#include <linux/errno.h>
 12#include <linux/sched.h>
 13#include <linux/sched/user.h>
 14#include <linux/mm.h>
 15#include <linux/kernel.h>
 16#include <linux/stat.h>
 17#include <linux/socket.h>
 18#include <linux/file.h>
 19#include <linux/fcntl.h>
 20#include <linux/net.h>
 21#include <linux/interrupt.h>
 22#include <linux/netdevice.h>
 23#include <linux/security.h>
 24#include <linux/pid_namespace.h>
 25#include <linux/pid.h>
 26#include <linux/nsproxy.h>
 27#include <linux/slab.h>
 28#include <linux/errqueue.h>
 29#include <linux/io_uring.h>
 30
 31#include <linux/uaccess.h>
 
 32
 33#include <net/protocol.h>
 34#include <linux/skbuff.h>
 35#include <net/sock.h>
 36#include <net/compat.h>
 37#include <net/scm.h>
 38#include <net/cls_cgroup.h>
 39#include <net/af_unix.h>
 40
 41
 42/*
 43 *	Only allow a user to send credentials, that they could set with
 44 *	setu(g)id.
 45 */
 46
 47static __inline__ int scm_check_creds(struct ucred *creds)
 48{
 49	const struct cred *cred = current_cred();
 50	kuid_t uid = make_kuid(cred->user_ns, creds->uid);
 51	kgid_t gid = make_kgid(cred->user_ns, creds->gid);
 52
 53	if (!uid_valid(uid) || !gid_valid(gid))
 54		return -EINVAL;
 55
 56	if ((creds->pid == task_tgid_vnr(current) ||
 57	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
 58	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
 59	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
 60	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
 61	      gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) {
 62	       return 0;
 63	}
 64	return -EPERM;
 65}
 66
 67static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
 68{
 69	int *fdp = (int*)CMSG_DATA(cmsg);
 70	struct scm_fp_list *fpl = *fplp;
 71	struct file **fpp;
 72	int i, num;
 73
 74	num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int);
 75
 76	if (num <= 0)
 77		return 0;
 78
 79	if (num > SCM_MAX_FD)
 80		return -EINVAL;
 81
 82	if (!fpl)
 83	{
 84		fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL_ACCOUNT);
 85		if (!fpl)
 86			return -ENOMEM;
 87		*fplp = fpl;
 88		fpl->count = 0;
 89		fpl->count_unix = 0;
 90		fpl->max = SCM_MAX_FD;
 91		fpl->user = NULL;
 92#if IS_ENABLED(CONFIG_UNIX)
 93		fpl->inflight = false;
 94		fpl->dead = false;
 95		fpl->edges = NULL;
 96		INIT_LIST_HEAD(&fpl->vertices);
 97#endif
 98	}
 99	fpp = &fpl->fp[fpl->count];
100
101	if (fpl->count + num > fpl->max)
102		return -EINVAL;
103
104	/*
105	 *	Verify the descriptors and increment the usage count.
106	 */
107
108	for (i=0; i< num; i++)
109	{
110		int fd = fdp[i];
111		struct file *file;
112
113		if (fd < 0 || !(file = fget_raw(fd)))
114			return -EBADF;
115		/* don't allow io_uring files */
116		if (io_is_uring_fops(file)) {
117			fput(file);
118			return -EINVAL;
119		}
120		if (unix_get_socket(file))
121			fpl->count_unix++;
122
123		*fpp++ = file;
124		fpl->count++;
125	}
126
127	if (!fpl->user)
128		fpl->user = get_uid(current_user());
129
130	return num;
131}
132
133void __scm_destroy(struct scm_cookie *scm)
134{
135	struct scm_fp_list *fpl = scm->fp;
136	int i;
137
138	if (fpl) {
139		scm->fp = NULL;
140		for (i=fpl->count-1; i>=0; i--)
141			fput(fpl->fp[i]);
142		free_uid(fpl->user);
143		kfree(fpl);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
144	}
145}
146EXPORT_SYMBOL(__scm_destroy);
147
148int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
149{
150	const struct proto_ops *ops = READ_ONCE(sock->ops);
151	struct cmsghdr *cmsg;
152	int err;
153
154	for_each_cmsghdr(cmsg, msg) {
 
155		err = -EINVAL;
156
157		/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
158		/* The first check was omitted in <= 2.2.5. The reasoning was
159		   that parser checks cmsg_len in any case, so that
160		   additional check would be work duplication.
161		   But if cmsg_level is not SOL_SOCKET, we do not check
162		   for too short ancillary data object at all! Oops.
163		   OK, let's add it...
164		 */
165		if (!CMSG_OK(msg, cmsg))
166			goto error;
167
168		if (cmsg->cmsg_level != SOL_SOCKET)
169			continue;
170
171		switch (cmsg->cmsg_type)
172		{
173		case SCM_RIGHTS:
174			if (!ops || ops->family != PF_UNIX)
175				goto error;
176			err=scm_fp_copy(cmsg, &p->fp);
177			if (err<0)
178				goto error;
179			break;
180		case SCM_CREDENTIALS:
181		{
182			struct ucred creds;
183			kuid_t uid;
184			kgid_t gid;
185			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
186				goto error;
187			memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred));
188			err = scm_check_creds(&creds);
189			if (err)
190				goto error;
191
192			p->creds.pid = creds.pid;
193			if (!p->pid || pid_vnr(p->pid) != creds.pid) {
194				struct pid *pid;
195				err = -ESRCH;
196				pid = find_get_pid(creds.pid);
197				if (!pid)
198					goto error;
199				put_pid(p->pid);
200				p->pid = pid;
201			}
202
203			err = -EINVAL;
204			uid = make_kuid(current_user_ns(), creds.uid);
205			gid = make_kgid(current_user_ns(), creds.gid);
206			if (!uid_valid(uid) || !gid_valid(gid))
207				goto error;
 
 
208
209			p->creds.uid = uid;
210			p->creds.gid = gid;
 
 
 
211			break;
212		}
213		default:
214			goto error;
215		}
216	}
217
218	if (p->fp && !p->fp->count)
219	{
220		kfree(p->fp);
221		p->fp = NULL;
222	}
223	return 0;
224
225error:
226	scm_destroy(p);
227	return err;
228}
229EXPORT_SYMBOL(__scm_send);
230
231int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
232{
 
 
 
233	int cmlen = CMSG_LEN(len);
 
234
235	if (msg->msg_flags & MSG_CMSG_COMPAT)
236		return put_cmsg_compat(msg, level, type, len, data);
237
238	if (!msg->msg_control || msg->msg_controllen < sizeof(struct cmsghdr)) {
239		msg->msg_flags |= MSG_CTRUNC;
240		return 0; /* XXX: return error? check spec. */
241	}
242	if (msg->msg_controllen < cmlen) {
243		msg->msg_flags |= MSG_CTRUNC;
244		cmlen = msg->msg_controllen;
245	}
246
247	if (msg->msg_control_is_user) {
248		struct cmsghdr __user *cm = msg->msg_control_user;
249
250		check_object_size(data, cmlen - sizeof(*cm), true);
251
252		if (!user_write_access_begin(cm, cmlen))
253			goto efault;
254
255		unsafe_put_user(cmlen, &cm->cmsg_len, efault_end);
256		unsafe_put_user(level, &cm->cmsg_level, efault_end);
257		unsafe_put_user(type, &cm->cmsg_type, efault_end);
258		unsafe_copy_to_user(CMSG_USER_DATA(cm), data,
259				    cmlen - sizeof(*cm), efault_end);
260		user_write_access_end();
261	} else {
262		struct cmsghdr *cm = msg->msg_control;
263
264		cm->cmsg_level = level;
265		cm->cmsg_type = type;
266		cm->cmsg_len = cmlen;
267		memcpy(CMSG_DATA(cm), data, cmlen - sizeof(*cm));
268	}
269
270	cmlen = min(CMSG_SPACE(len), msg->msg_controllen);
271	if (msg->msg_control_is_user)
272		msg->msg_control_user += cmlen;
273	else
274		msg->msg_control += cmlen;
275	msg->msg_controllen -= cmlen;
276	return 0;
277
278efault_end:
279	user_write_access_end();
280efault:
281	return -EFAULT;
282}
283EXPORT_SYMBOL(put_cmsg);
284
285int put_cmsg_notrunc(struct msghdr *msg, int level, int type, int len,
286		     void *data)
287{
288	/* Don't produce truncated CMSGs */
289	if (!msg->msg_control || msg->msg_controllen < CMSG_LEN(len))
290		return -ETOOSMALL;
291
292	return put_cmsg(msg, level, type, len, data);
293}
294
295void put_cmsg_scm_timestamping64(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
296{
297	struct scm_timestamping64 tss;
298	int i;
299
300	for (i = 0; i < ARRAY_SIZE(tss.ts); i++) {
301		tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;
302		tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;
303	}
304
305	put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_NEW, sizeof(tss), &tss);
306}
307EXPORT_SYMBOL(put_cmsg_scm_timestamping64);
308
309void put_cmsg_scm_timestamping(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
310{
311	struct scm_timestamping tss;
312	int i;
313
314	for (i = 0; i < ARRAY_SIZE(tss.ts); i++) {
315		tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;
316		tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;
317	}
318
319	put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_OLD, sizeof(tss), &tss);
320}
321EXPORT_SYMBOL(put_cmsg_scm_timestamping);
322
323static int scm_max_fds(struct msghdr *msg)
324{
325	if (msg->msg_controllen <= sizeof(struct cmsghdr))
326		return 0;
327	return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int);
328}
329
330void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
331{
332	struct cmsghdr __user *cm =
333		(__force struct cmsghdr __user *)msg->msg_control_user;
334	unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0;
335	int fdmax = min_t(int, scm_max_fds(msg), scm->fp->count);
336	int __user *cmsg_data = CMSG_USER_DATA(cm);
337	int err = 0, i;
338
339	/* no use for FD passing from kernel space callers */
340	if (WARN_ON_ONCE(!msg->msg_control_is_user))
341		return;
342
343	if (msg->msg_flags & MSG_CMSG_COMPAT) {
344		scm_detach_fds_compat(msg, scm);
345		return;
346	}
347
348	for (i = 0; i < fdmax; i++) {
349		err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
350		if (err < 0)
351			break;
 
 
 
 
 
 
 
 
 
352	}
353
354	if (i > 0) {
355		int cmlen = CMSG_LEN(i * sizeof(int));
356
357		err = put_user(SOL_SOCKET, &cm->cmsg_level);
358		if (!err)
359			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
360		if (!err)
361			err = put_user(cmlen, &cm->cmsg_len);
362		if (!err) {
363			cmlen = CMSG_SPACE(i * sizeof(int));
364			if (msg->msg_controllen < cmlen)
365				cmlen = msg->msg_controllen;
366			msg->msg_control_user += cmlen;
367			msg->msg_controllen -= cmlen;
368		}
369	}
370
371	if (i < scm->fp->count || (scm->fp->count && fdmax <= 0))
372		msg->msg_flags |= MSG_CTRUNC;
373
374	/*
375	 * All of the files that fit in the message have had their usage counts
376	 * incremented, so we just free the list.
377	 */
378	__scm_destroy(scm);
379}
380EXPORT_SYMBOL(scm_detach_fds);
381
382struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
383{
384	struct scm_fp_list *new_fpl;
385	int i;
386
387	if (!fpl)
388		return NULL;
389
390	new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
391			  GFP_KERNEL_ACCOUNT);
392	if (new_fpl) {
393		for (i = 0; i < fpl->count; i++)
394			get_file(fpl->fp[i]);
395
396		new_fpl->max = new_fpl->count;
397		new_fpl->user = get_uid(fpl->user);
398#if IS_ENABLED(CONFIG_UNIX)
399		new_fpl->inflight = false;
400		new_fpl->edges = NULL;
401		INIT_LIST_HEAD(&new_fpl->vertices);
402#endif
403	}
404	return new_fpl;
405}
406EXPORT_SYMBOL(scm_fp_dup);