Function m_dispose_extcontrolm

freebsd/kern/uipc_syscalls.c:1595–1638

* Dispose of externalized rights from an SCM_RIGHTS message. This function * should be used in error or truncation cases to avoid leaking file descriptors * into the recipient's (the current thread's) table. */

 * into the recipient's (the current thread's) table.
 */
void
m_dispose_extcontrolm(struct mbuf *m)
{
	struct cmsghdr *cm;
	struct file *fp;
	struct thread *td;
	socklen_t clen, datalen;
	int error, fd, *fds, nfd;

	td = curthread;
	for (; m != NULL; m = m->m_next) {
		if (m->m_type != MT_EXTCONTROL)
			continue;
		cm = mtod(m, struct cmsghdr *);
		clen = m->m_len;
		while (clen > 0) {
			if (clen < sizeof(*cm))
				panic("%s: truncated mbuf %p", __func__, m);
			datalen = CMSG_SPACE(cm->cmsg_len - CMSG_SPACE(0));
			if (clen < datalen)
				panic("%s: truncated mbuf %p", __func__, m);

			if (cm->cmsg_level == SOL_SOCKET &&
			    cm->cmsg_type == SCM_RIGHTS) {
				fds = (int *)CMSG_DATA(cm);
				nfd = (cm->cmsg_len - CMSG_SPACE(0)) /
				    sizeof(int);

				while (nfd-- > 0) {
					fd = *fds++;
					error = fget(td, fd, &cap_no_rights,
					    &fp);
					if (error == 0) {
						fdclose(td, fp, fd);
						fdrop(fp, td);
					}
				}
			}
			clen -= datalen;
			cm = (struct cmsghdr *)((uint8_t *)cm + datalen);
		}
		m_chtype(m, MT_CONTROL);
	}
}