unix: properly account for FDs passed over unix sockets

[pandora-kernel.git] / net / unix / garbage.c

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 00d3e56..fd1a840 100644 (file)
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -125,9 +125,11 @@ struct sock *unix_get_socket(struct file *filp)
 void unix_inflight(struct file *fp)
 {
        struct sock *s = unix_get_socket(fp);
+
+       spin_lock(&unix_gc_lock);
+
        if (s) {
                struct unix_sock *u = unix_sk(s);
-               spin_lock(&unix_gc_lock);
                if (atomic_long_inc_return(&u->inflight) == 1) {
                        BUG_ON(!list_empty(&u->link));
                        list_add_tail(&u->link, &gc_inflight_list);
@@ -135,22 +137,26 @@ void unix_inflight(struct file *fp)
                        BUG_ON(list_empty(&u->link));
                }
                unix_tot_inflight++;
-               spin_unlock(&unix_gc_lock);
        }
+       fp->f_cred->user->unix_inflight++;
+       spin_unlock(&unix_gc_lock);
 }
 
 void unix_notinflight(struct file *fp)
 {
        struct sock *s = unix_get_socket(fp);
+
+       spin_lock(&unix_gc_lock);
+
        if (s) {
                struct unix_sock *u = unix_sk(s);
-               spin_lock(&unix_gc_lock);
                BUG_ON(list_empty(&u->link));
                if (atomic_long_dec_and_test(&u->inflight))
                        list_del_init(&u->link);
                unix_tot_inflight--;
-               spin_unlock(&unix_gc_lock);
        }
+       fp->f_cred->user->unix_inflight--;
+       spin_unlock(&unix_gc_lock);
 }
 
 static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),