From af015599ea0e0a449f377862b3cec4c763921a73 Mon Sep 17 00:00:00 2001 From: Ingo Weinhold Date: Mon, 5 May 2008 00:27:34 +0000 Subject: [PATCH] When sending a file descriptor via SCM_RIGHTS we also need to acquire an open reference to it. Otherwise the descriptor could be closed while being on the way. This fixes the ssh login problem with non-root users. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@25318 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/add-ons/kernel/network/protocols/unix/unix.cpp | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/add-ons/kernel/network/protocols/unix/unix.cpp b/src/add-ons/kernel/network/protocols/unix/unix.cpp index ddbeb40f14..65fc818b2e 100644 --- a/src/add-ons/kernel/network/protocols/unix/unix.cpp +++ b/src/add-ons/kernel/network/protocols/unix/unix.cpp @@ -48,8 +48,10 @@ destroy_scm_rights_descriptors(const ancillary_data_header* header, file_descriptor** descriptors = (file_descriptor**)data; for (int i = 0; i < count; i++) { - if (descriptors[i] != NULL) + if (descriptors[i] != NULL) { + close_fd(descriptors[i]); put_fd(descriptors[i]); + } } } @@ -308,7 +310,7 @@ unix_add_ancillary_data(net_protocol *self, ancillary_data_container *container, status_t error = B_OK; for (int i = 0; i < count; i++) { - descriptors[i] = get_fd(ioContext, fds[i]); + descriptors[i] = get_open_fd(ioContext, fds[i]); if (descriptors[i] == NULL) { error = EBADF; break; @@ -332,8 +334,10 @@ unix_add_ancillary_data(net_protocol *self, ancillary_data_container *container, // cleanup on error if (error != B_OK) { for (int i = 0; i < count; i++) { - if (descriptors[i] != NULL) + if (descriptors[i] != NULL) { + close_fd(descriptors[i]); put_fd(descriptors[i]); + } } } @@ -374,7 +378,9 @@ unix_process_ancillary_data(net_protocol *self, status_t error = B_OK; for (int i = 0; i < count; i++) { - // get an additional reference which will go to the FD table index + // Get an additional reference which will go to the FD table index. The + // reference and open reference acquired in unix_add_ancillary_data() + // will be released when the container is destroyed. inc_fd_ref_count(descriptors[i]); fds[i] = new_fd(ioContext, descriptors[i]);