[linux.git] / net / core / scm.c

/* scm.c - Socket level control messages processing.
 *
 * Author:	Alexey Kuznetsov, <[email protected]>
 *              Alignment and value checking mods by Craig Metz
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>
#include <linux/signal.h>
#include <linux/capability.h>
#include <linux/errno.h>
#include <linux/sched.h>
#include <linux/sched/user.h>
#include <linux/mm.h>
#include <linux/kernel.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/file.h>
#include <linux/fcntl.h>
#include <linux/net.h>
#include <linux/interrupt.h>
#include <linux/netdevice.h>
#include <linux/security.h>
#include <linux/pid_namespace.h>
#include <linux/pid.h>
#include <linux/nsproxy.h>
#include <linux/slab.h>

#include <linux/uaccess.h>

#include <net/protocol.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/compat.h>
#include <net/scm.h>
#include <net/cls_cgroup.h>


/*
 *	Only allow a user to send credentials, that they could set with
 *	setu(g)id.
 */

static __inline__ int scm_check_creds(struct ucred *creds)
{
	const struct cred *cred = current_cred();
	kuid_t uid = make_kuid(cred->user_ns, creds->uid);
	kgid_t gid = make_kgid(cred->user_ns, creds->gid);

	if (!uid_valid(uid) || !gid_valid(gid))
		return -EINVAL;

	if ((creds->pid == task_tgid_vnr(current) ||
	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
	      gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) {
	       return 0;
	}
	return -EPERM;
}

static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
{
	int *fdp = (int*)CMSG_DATA(cmsg);
	struct scm_fp_list *fpl = *fplp;
	struct file **fpp;
	int i, num;

	num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int);

	if (num <= 0)
		return 0;

	if (num > SCM_MAX_FD)
		return -EINVAL;

	if (!fpl)
	{
		fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
		if (!fpl)
			return -ENOMEM;
		*fplp = fpl;
		fpl->count = 0;
		fpl->max = SCM_MAX_FD;
		fpl->user = NULL;
	}
	fpp = &fpl->fp[fpl->count];

	if (fpl->count + num > fpl->max)
		return -EINVAL;

	/*
	 *	Verify the descriptors and increment the usage count.
	 */

	for (i=0; i< num; i++)
	{
		int fd = fdp[i];
		struct file *file;

		if (fd < 0 || !(file = fget_raw(fd)))
			return -EBADF;
		*fpp++ = file;
		fpl->count++;
	}

	if (!fpl->user)
		fpl->user = get_uid(current_user());

	return num;
}

void __scm_destroy(struct scm_cookie *scm)
{
	struct scm_fp_list *fpl = scm->fp;
	int i;

	if (fpl) {
		scm->fp = NULL;
		for (i=fpl->count-1; i>=0; i--)
			fput(fpl->fp[i]);
		free_uid(fpl->user);
		kfree(fpl);
	}
}
EXPORT_SYMBOL(__scm_destroy);

int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
{
	struct cmsghdr *cmsg;
	int err;

	for_each_cmsghdr(cmsg, msg) {
		err = -EINVAL;

		/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
		/* The first check was omitted in <= 2.2.5. The reasoning was
		   that parser checks cmsg_len in any case, so that
		   additional check would be work duplication.
		   But if cmsg_level is not SOL_SOCKET, we do not check
		   for too short ancillary data object at all! Oops.
		   OK, let's add it...
		 */
		if (!CMSG_OK(msg, cmsg))
			goto error;

		if (cmsg->cmsg_level != SOL_SOCKET)
			continue;

		switch (cmsg->cmsg_type)
		{
		case SCM_RIGHTS:
			if (!sock->ops || sock->ops->family != PF_UNIX)
				goto error;
			err=scm_fp_copy(cmsg, &p->fp);
			if (err<0)
				goto error;
			break;
		case SCM_CREDENTIALS:
		{
			struct ucred creds;
			kuid_t uid;
			kgid_t gid;
			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
				goto error;
			memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred));
			err = scm_check_creds(&creds);
			if (err)
				goto error;

			p->creds.pid = creds.pid;
			if (!p->pid || pid_vnr(p->pid) != creds.pid) {
				struct pid *pid;
				err = -ESRCH;
				pid = find_get_pid(creds.pid);
				if (!pid)
					goto error;
				put_pid(p->pid);
				p->pid = pid;
			}

			err = -EINVAL;
			uid = make_kuid(current_user_ns(), creds.uid);
			gid = make_kgid(current_user_ns(), creds.gid);
			if (!uid_valid(uid) || !gid_valid(gid))
				goto error;

			p->creds.uid = uid;
			p->creds.gid = gid;
			break;
		}
		default:
			goto error;
		}
	}

	if (p->fp && !p->fp->count)
	{
		kfree(p->fp);
		p->fp = NULL;
	}
	return 0;

error:
	scm_destroy(p);
	return err;
}
EXPORT_SYMBOL(__scm_send);

int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
{
	struct cmsghdr __user *cm
		= (__force struct cmsghdr __user *)msg->msg_control;
	struct cmsghdr cmhdr;
	int cmlen = CMSG_LEN(len);
	int err;

	if (MSG_CMSG_COMPAT & msg->msg_flags)
		return put_cmsg_compat(msg, level, type, len, data);

	if (cm==NULL || msg->msg_controllen < sizeof(*cm)) {
		msg->msg_flags |= MSG_CTRUNC;
		return 0; /* XXX: return error? check spec. */
	}
	if (msg->msg_controllen < cmlen) {
		msg->msg_flags |= MSG_CTRUNC;
		cmlen = msg->msg_controllen;
	}
	cmhdr.cmsg_level = level;
	cmhdr.cmsg_type = type;
	cmhdr.cmsg_len = cmlen;

	err = -EFAULT;
	if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
		goto out;
	if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
		goto out;
	cmlen = CMSG_SPACE(len);
	if (msg->msg_controllen < cmlen)
		cmlen = msg->msg_controllen;
	msg->msg_control += cmlen;
	msg->msg_controllen -= cmlen;
	err = 0;
out:
	return err;
}
EXPORT_SYMBOL(put_cmsg);

void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
{
	struct cmsghdr __user *cm
		= (__force struct cmsghdr __user*)msg->msg_control;

	int fdmax = 0;
	int fdnum = scm->fp->count;
	struct file **fp = scm->fp->fp;
	int __user *cmfptr;
	int err = 0, i;

	if (MSG_CMSG_COMPAT & msg->msg_flags) {
		scm_detach_fds_compat(msg, scm);
		return;
	}

	if (msg->msg_controllen > sizeof(struct cmsghdr))
		fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
			 / sizeof(int));

	if (fdnum < fdmax)
		fdmax = fdnum;

	for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
	     i++, cmfptr++)
	{
		struct socket *sock;
		int new_fd;
		err = security_file_receive(fp[i]);
		if (err)
			break;
		err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags
					  ? O_CLOEXEC : 0);
		if (err < 0)
			break;
		new_fd = err;
		err = put_user(new_fd, cmfptr);
		if (err) {
			put_unused_fd(new_fd);
			break;
		}
		/* Bump the usage count and install the file. */
		sock = sock_from_file(fp[i], &err);
		if (sock) {
			sock_update_netprioidx(&sock->sk->sk_cgrp_data);
			sock_update_classid(&sock->sk->sk_cgrp_data);
		}
		fd_install(new_fd, get_file(fp[i]));
	}

	if (i > 0)
	{
		int cmlen = CMSG_LEN(i*sizeof(int));
		err = put_user(SOL_SOCKET, &cm->cmsg_level);
		if (!err)
			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
		if (!err)
			err = put_user(cmlen, &cm->cmsg_len);
		if (!err) {
			cmlen = CMSG_SPACE(i*sizeof(int));
			if (msg->msg_controllen < cmlen)
				cmlen = msg->msg_controllen;
			msg->msg_control += cmlen;
			msg->msg_controllen -= cmlen;
		}
	}
	if (i < fdnum || (fdnum && fdmax <= 0))
		msg->msg_flags |= MSG_CTRUNC;

	/*
	 * All of the files that fit in the message have had their
	 * usage counts incremented, so we just free the list.
	 */
	__scm_destroy(scm);
}
EXPORT_SYMBOL(scm_detach_fds);

struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
{
	struct scm_fp_list *new_fpl;
	int i;

	if (!fpl)
		return NULL;

	new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
			  GFP_KERNEL);
	if (new_fpl) {
		for (i = 0; i < fpl->count; i++)
			get_file(fpl->fp[i]);
		new_fpl->max = new_fpl->count;
		new_fpl->user = get_uid(fpl->user);
	}
	return new_fpl;
}
EXPORT_SYMBOL(scm_fp_dup);
Commit	Line	Data
1da177e4 LT	1	/* scm.c - Socket level control messages processing.
	2	*
	3	* Author: Alexey Kuznetsov, <[email protected]>
	4	* Alignment and value checking mods by Craig Metz
	5	*
	6	* This program is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU General Public License
	8	* as published by the Free Software Foundation; either version
	9	* 2 of the License, or (at your option) any later version.
	10	*/
	11
	12	#include <linux/module.h>
	13	#include <linux/signal.h>
4fc268d2	14	#include <linux/capability.h>
1da177e4 LT	15	#include <linux/errno.h>
1da177e4 LT	16	#include <linux/sched.h>
8703e8a4	17	#include <linux/sched/user.h>
1da177e4 LT	18	#include <linux/mm.h>
1da177e4 LT	19	#include <linux/kernel.h>
1da177e4 LT	20	#include <linux/stat.h>
	21	#include <linux/socket.h>
	22	#include <linux/file.h>
	23	#include <linux/fcntl.h>
	24	#include <linux/net.h>
	25	#include <linux/interrupt.h>
	26	#include <linux/netdevice.h>
	27	#include <linux/security.h>
92f28d97	28	#include <linux/pid_namespace.h>
b488893a PE	29	#include <linux/pid.h>
b488893a PE	30	#include <linux/nsproxy.h>
5a0e3ad6	31	#include <linux/slab.h>
1da177e4	32
7c0f6ba6	33	#include <linux/uaccess.h>
1da177e4 LT	34
	35	#include <net/protocol.h>
	36	#include <linux/skbuff.h>
	37	#include <net/sock.h>
	38	#include <net/compat.h>
	39	#include <net/scm.h>
d8429506	40	#include <net/cls_cgroup.h>
1da177e4 LT	41
	42
	43	/*
4ec93edb	44	* Only allow a user to send credentials, that they could set with
1da177e4 LT	45	* setu(g)id.
	46	*/
	47
	48	static __inline__ int scm_check_creds(struct ucred *creds)
	49	{
86a264ab	50	const struct cred *cred = current_cred();
b2e4f544 EB	51	kuid_t uid = make_kuid(cred->user_ns, creds->uid);
	52	kgid_t gid = make_kgid(cred->user_ns, creds->gid);
	53
	54	if (!uid_valid(uid) \|\| !gid_valid(gid))
	55	return -EINVAL;
b6dff3ec	56
92f28d97	57	if ((creds->pid == task_tgid_vnr(current) \|\|
d661684c	58	ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
b2e4f544	59	((uid_eq(uid, cred->uid) \|\| uid_eq(uid, cred->euid) \|\|
c7b96acf	60	uid_eq(uid, cred->suid)) \|\| ns_capable(cred->user_ns, CAP_SETUID)) &&
b2e4f544	61	((gid_eq(gid, cred->gid) \|\| gid_eq(gid, cred->egid) \|\|
c7b96acf	62	gid_eq(gid, cred->sgid)) \|\| ns_capable(cred->user_ns, CAP_SETGID))) {
1da177e4 LT	63	return 0;
	64	}
	65	return -EPERM;
	66	}
	67
	68	static int scm_fp_copy(struct cmsghdr cmsg, struct scm_fp_list *fplp)
	69	{
	70	int fdp = (int)CMSG_DATA(cmsg);
	71	struct scm_fp_list fpl = fplp;
	72	struct file **fpp;
	73	int i, num;
	74
1ff8cebf	75	num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int);
1da177e4 LT	76
	77	if (num <= 0)
	78	return 0;
	79
	80	if (num > SCM_MAX_FD)
	81	return -EINVAL;
	82
	83	if (!fpl)
	84	{
	85	fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
	86	if (!fpl)
	87	return -ENOMEM;
	88	*fplp = fpl;
	89	fpl->count = 0;
bba14de9	90	fpl->max = SCM_MAX_FD;
415e3d3e	91	fpl->user = NULL;
1da177e4 LT	92	}
	93	fpp = &fpl->fp[fpl->count];
	94
bba14de9	95	if (fpl->count + num > fpl->max)
1da177e4	96	return -EINVAL;
4ec93edb	97
1da177e4 LT	98	/*
	99	* Verify the descriptors and increment the usage count.
	100	*/
4ec93edb	101
1da177e4 LT	102	for (i=0; i< num; i++)
	103	{
	104	int fd = fdp[i];
	105	struct file *file;
	106
326be7b4	107	if (fd < 0 \|\| !(file = fget_raw(fd)))
1da177e4 LT	108	return -EBADF;
	109	*fpp++ = file;
	110	fpl->count++;
	111	}
415e3d3e HFS	112
	113	if (!fpl->user)
	114	fpl->user = get_uid(current_user());
	115
1da177e4 LT	116	return num;
	117	}
	118
	119	void __scm_destroy(struct scm_cookie *scm)
	120	{
	121	struct scm_fp_list *fpl = scm->fp;
	122	int i;
	123
	124	if (fpl) {
	125	scm->fp = NULL;
6120d3db AV	126	for (i=fpl->count-1; i>=0; i--)
6120d3db AV	127	fput(fpl->fp[i]);
415e3d3e	128	free_uid(fpl->user);
6120d3db	129	kfree(fpl);
1da177e4 LT	130	}
1da177e4 LT	131	}
9e34a5b5	132	EXPORT_SYMBOL(__scm_destroy);
1da177e4 LT	133
	134	int __scm_send(struct socket sock, struct msghdr msg, struct scm_cookie *p)
	135	{
	136	struct cmsghdr *cmsg;
	137	int err;
	138
f95b414e	139	for_each_cmsghdr(cmsg, msg) {
1da177e4 LT	140	err = -EINVAL;
	141
	142	/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
	143	/* The first check was omitted in <= 2.2.5. The reasoning was
	144	that parser checks cmsg_len in any case, so that
	145	additional check would be work duplication.
4ec93edb	146	But if cmsg_level is not SOL_SOCKET, we do not check
1da177e4 LT	147	for too short ancillary data object at all! Oops.
	148	OK, let's add it...
	149	*/
	150	if (!CMSG_OK(msg, cmsg))
	151	goto error;
	152
	153	if (cmsg->cmsg_level != SOL_SOCKET)
	154	continue;
	155
	156	switch (cmsg->cmsg_type)
	157	{
	158	case SCM_RIGHTS:
76dadd76 EB	159	if (!sock->ops \|\| sock->ops->family != PF_UNIX)
76dadd76 EB	160	goto error;
1da177e4 LT	161	err=scm_fp_copy(cmsg, &p->fp);
	162	if (err<0)
	163	goto error;
	164	break;
	165	case SCM_CREDENTIALS:
b2e4f544	166	{
dbe9a417	167	struct ucred creds;
b2e4f544 EB	168	kuid_t uid;
b2e4f544 EB	169	kgid_t gid;
1da177e4 LT	170	if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
1da177e4 LT	171	goto error;
dbe9a417 EB	172	memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred));
dbe9a417 EB	173	err = scm_check_creds(&creds);
1da177e4 LT	174	if (err)
1da177e4 LT	175	goto error;
257b5358	176
dbe9a417 EB	177	p->creds.pid = creds.pid;
dbe9a417 EB	178	if (!p->pid \|\| pid_vnr(p->pid) != creds.pid) {
257b5358 EB	179	struct pid *pid;
257b5358 EB	180	err = -ESRCH;
dbe9a417	181	pid = find_get_pid(creds.pid);
257b5358 EB	182	if (!pid)
	183	goto error;
	184	put_pid(p->pid);
	185	p->pid = pid;
	186	}
	187
b2e4f544	188	err = -EINVAL;
dbe9a417 EB	189	uid = make_kuid(current_user_ns(), creds.uid);
dbe9a417 EB	190	gid = make_kgid(current_user_ns(), creds.gid);
b2e4f544 EB	191	if (!uid_valid(uid) \|\| !gid_valid(gid))
	192	goto error;
	193
dbe9a417 EB	194	p->creds.uid = uid;
dbe9a417 EB	195	p->creds.gid = gid;
1da177e4	196	break;
b2e4f544	197	}
1da177e4 LT	198	default:
	199	goto error;
	200	}
	201	}
	202
	203	if (p->fp && !p->fp->count)
	204	{
	205	kfree(p->fp);
	206	p->fp = NULL;
	207	}
	208	return 0;
4ec93edb	209
1da177e4 LT	210	error:
	211	scm_destroy(p);
	212	return err;
	213	}
9e34a5b5	214	EXPORT_SYMBOL(__scm_send);
1da177e4 LT	215
	216	int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
	217	{
cfcabdcc SH	218	struct cmsghdr __user *cm
cfcabdcc SH	219	= (__force struct cmsghdr __user *)msg->msg_control;
1da177e4 LT	220	struct cmsghdr cmhdr;
	221	int cmlen = CMSG_LEN(len);
	222	int err;
	223
	224	if (MSG_CMSG_COMPAT & msg->msg_flags)
	225	return put_cmsg_compat(msg, level, type, len, data);
	226
	227	if (cm==NULL \|\| msg->msg_controllen < sizeof(*cm)) {
	228	msg->msg_flags \|= MSG_CTRUNC;
	229	return 0; /* XXX: return error? check spec. */
	230	}
	231	if (msg->msg_controllen < cmlen) {
	232	msg->msg_flags \|= MSG_CTRUNC;
	233	cmlen = msg->msg_controllen;
	234	}
	235	cmhdr.cmsg_level = level;
	236	cmhdr.cmsg_type = type;
	237	cmhdr.cmsg_len = cmlen;
	238
	239	err = -EFAULT;
	240	if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
4ec93edb	241	goto out;
1da177e4 LT	242	if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
	243	goto out;
	244	cmlen = CMSG_SPACE(len);
1ac70e7a WY	245	if (msg->msg_controllen < cmlen)
1ac70e7a WY	246	cmlen = msg->msg_controllen;
1da177e4 LT	247	msg->msg_control += cmlen;
	248	msg->msg_controllen -= cmlen;
	249	err = 0;
	250	out:
	251	return err;
	252	}
9e34a5b5	253	EXPORT_SYMBOL(put_cmsg);
1da177e4 LT	254
	255	void scm_detach_fds(struct msghdr msg, struct scm_cookie scm)
	256	{
cfcabdcc SH	257	struct cmsghdr __user *cm
cfcabdcc SH	258	= (__force struct cmsghdr __user*)msg->msg_control;
1da177e4 LT	259
	260	int fdmax = 0;
	261	int fdnum = scm->fp->count;
	262	struct file **fp = scm->fp->fp;
	263	int __user *cmfptr;
	264	int err = 0, i;
	265
	266	if (MSG_CMSG_COMPAT & msg->msg_flags) {
	267	scm_detach_fds_compat(msg, scm);
	268	return;
	269	}
	270
	271	if (msg->msg_controllen > sizeof(struct cmsghdr))
	272	fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
	273	/ sizeof(int));
	274
	275	if (fdnum < fdmax)
	276	fdmax = fdnum;
	277
cfcabdcc SH	278	for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
cfcabdcc SH	279	i++, cmfptr++)
1da177e4	280	{
48a87cc2	281	struct socket *sock;
1da177e4 LT	282	int new_fd;
	283	err = security_file_receive(fp[i]);
	284	if (err)
	285	break;
4a19542e UD	286	err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags
4a19542e UD	287	? O_CLOEXEC : 0);
1da177e4 LT	288	if (err < 0)
	289	break;
	290	new_fd = err;
	291	err = put_user(new_fd, cmfptr);
	292	if (err) {
	293	put_unused_fd(new_fd);
	294	break;
	295	}
	296	/* Bump the usage count and install the file. */
48a87cc2	297	sock = sock_from_file(fp[i], &err);
d8429506	298	if (sock) {
2a56a1fe TH	299	sock_update_netprioidx(&sock->sk->sk_cgrp_data);
2a56a1fe TH	300	sock_update_classid(&sock->sk->sk_cgrp_data);
d8429506	301	}
cb0942b8	302	fd_install(new_fd, get_file(fp[i]));
1da177e4 LT	303	}
	304
	305	if (i > 0)
	306	{
	307	int cmlen = CMSG_LEN(i*sizeof(int));
effee6a0	308	err = put_user(SOL_SOCKET, &cm->cmsg_level);
1da177e4 LT	309	if (!err)
	310	err = put_user(SCM_RIGHTS, &cm->cmsg_type);
	311	if (!err)
	312	err = put_user(cmlen, &cm->cmsg_len);
	313	if (!err) {
	314	cmlen = CMSG_SPACE(i*sizeof(int));
6900317f DB	315	if (msg->msg_controllen < cmlen)
6900317f DB	316	cmlen = msg->msg_controllen;
1da177e4 LT	317	msg->msg_control += cmlen;
	318	msg->msg_controllen -= cmlen;
	319	}
	320	}
	321	if (i < fdnum \|\| (fdnum && fdmax <= 0))
	322	msg->msg_flags \|= MSG_CTRUNC;
	323
	324	/*
	325	* All of the files that fit in the message have had their
	326	* usage counts incremented, so we just free the list.
	327	*/
	328	__scm_destroy(scm);
	329	}
9e34a5b5	330	EXPORT_SYMBOL(scm_detach_fds);
1da177e4 LT	331
	332	struct scm_fp_list scm_fp_dup(struct scm_fp_list fpl)
	333	{
	334	struct scm_fp_list *new_fpl;
	335	int i;
	336
	337	if (!fpl)
	338	return NULL;
	339
bba14de9 ED	340	new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
bba14de9 ED	341	GFP_KERNEL);
1da177e4	342	if (new_fpl) {
bba14de9	343	for (i = 0; i < fpl->count; i++)
1da177e4	344	get_file(fpl->fp[i]);
bba14de9	345	new_fpl->max = new_fpl->count;
415e3d3e	346	new_fpl->user = get_uid(fpl->user);
1da177e4 LT	347	}
	348	return new_fpl;
	349	}
1da177e4	350	EXPORT_SYMBOL(scm_fp_dup);