Re: [KJ] [Patch] fs/ kzalloc conversions
From: Zach Brown <hidden>
Date: 2006-02-25 00:07:28
Also in:
linux-fsdevel
So the test isn't useless and we should use kcalloc here, otherwise an unthinking sysadmin can increment the aio_max_nr sysctl value to, let's say, 0x7fffffff. On a 32-bit machine, the multiplication will wrap, maybe turn into a small positive number, and we'll gleefully walk off the end of the array, corrupting data as we go.
nr_events isn't just limited by aio_max_nr, it's also clamped (oddly) by:
/* Prevent overflows */
if ((nr_events > (0x10000000U / sizeof(struct io_event))) ||
(nr_events > (0x10000000U / sizeof(struct kiocb)))) {
pr_debug("ENOMEM: nr_events too high\n");
return ERR_PTR(-EINVAL);
}
Does that put your mind at ease? (Barring reasonable unease at the
existence of confusing code :))
And we should set the .extra1 and .extra2 values in the FS_AIO_MAX_NR clause of kernel/sysctl.c anyway. Does anyone have thoughts on what the *useful* range of this variable is?
Well, the tunable exists to cap the amount of kernel memory pinned in event buffers. So some relation to the number of pages in the machine wouldn't surprise me. I don't know what default portion would be considered reasonable, though.. - z _______________________________________________ Kernel-janitors mailing list Kernel-janitors@lists.osdl.org https://lists.osdl.org/mailman/listinfo/kernel-janitors