On Sat, Sep 13, 2008 at 07:06:06PM -0400, Oren Laadan wrote:
> +int cr_scan_fds(struct files_struct *files, int **fdtable)
> +{
> + struct fdtable *fdt;
> + int *fds;
> + int i, n, tot;
> +
> + n = 0;
> + tot = CR_DEFAULT_FDTABLE;
Why not?
| int i;
| int n = 0;
| int tot = CR_DEFAULT_FDTABLE;
IHMO easier readable.
> + spin_lock(&files->file_lock);
> + fdt = files_fdtable(files);
> + for (i = 0; i < fdt->max_fds; i++) {
The process is suspended at this state?
> + if (n == tot) {
> + /*
> + * fcheck_files() is safe with drop/re-acquire
> + * of the lock, because it tests: fd < max_fds
> + */
> + spin_unlock(&files->file_lock);
> + tot *= 2;
> + if (tot < 0) { /* overflow ? */
_NO_. tot is signed, this does not have documented overflow behaviour.
You need to restrict this to a sane number.
> + kfree(fds);
> + return -EMFILE;
> + }
> + fds = krealloc(fds, tot * sizeof(*fds), GFP_KERNEL);
> + if (!fds)
krealloc does not free the memory on error, so this is a leak.
Bastian
--
The more complex the mind, the greater the need for the simplicity of play.
-- Kirk, "Shore Leave", stardate 3025.8
_______________________________________________
Containers mailing list
[EMAIL PROTECTED]
https://lists.linux-foundation.org/mailman/listinfo/containers
_______________________________________________
Devel mailing list
[email protected]
https://openvz.org/mailman/listinfo/devel
