On 03/09/2015 09:49 PM, Fam Zheng wrote: > + if (!cmds || ncmds <= 0 || ncmds > EP_MAX_BATCH) > + return -EINVAL; > + cmd_size = sizeof(struct epoll_ctl_cmd) * ncmds; > + /* TODO: optimize for small arguments like select/poll with a stack > + * allocated buffer */ > + > + kcmds = kmalloc(cmd_size, GFP_KERNEL); > + if (!kcmds) > + return -ENOMEM; You probably want to define EP_MAX_BATCH as some sane value much less than INT_MAX/(sizeof(struct epoll_ctl_cmd)). While this avoids the integer overflow from before, any user can cause the kernel to kmalloc up to INT_MAX bytes. Probably not a huge deal because it's freed at the end of the syscall, but generally not a great idea.
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
