[lkml]   [2005]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH] prevent possible infinite loop in fs/select.c::do_pollfd()
    If a sufficiently large 'num' is passed to the function, the for loop 
    becomes an infinite loop - as far as I can see, that's a bug waiting to
    happen. Sure, 'len' in struct poll_list is currently an int, so currently
    this can't happen, but that might change in the future. In my oppinion,
    a function should be able to function correctly with the complete range
    of values that can potentially be passed via its parameters, and without
    the patch below that's just not true for this function.

    Signed-off-by: Jesper Juhl <>

    --- linux-2.6.12-rc2-mm3-orig/fs/select.c 2005-04-05 21:21:47.000000000 +0200
    +++ linux-2.6.12-rc2-mm3/fs/select.c 2005-04-24 01:11:13.000000000 +0200
    @@ -397,7 +397,7 @@ struct poll_list {
    static void do_pollfd(unsigned int num, struct pollfd * fdpage,
    poll_table ** pwait, int *count)
    - int i;
    + unsigned int i;

    for (i = 0; i < num; i++) {
    int fd;

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-04-24 01:23    [W:0.025 / U:134.448 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site