Messages in this thread | | | Date | Sun, 14 Sep 2008 11:51:06 +0200 | From | Bastian Blank <> | Subject | Re: [RFC v5][PATCH 8/8] Dump open file descriptors |
| |
On Sat, Sep 13, 2008 at 07:06:06PM -0400, Oren Laadan wrote: > +int cr_scan_fds(struct files_struct *files, int **fdtable) > +{ > + struct fdtable *fdt; > + int *fds; > + int i, n, tot; > + > + n = 0; > + tot = CR_DEFAULT_FDTABLE;
Why not? | int i; | int n = 0; | int tot = CR_DEFAULT_FDTABLE;
IHMO easier readable.
> + spin_lock(&files->file_lock); > + fdt = files_fdtable(files); > + for (i = 0; i < fdt->max_fds; i++) {
The process is suspended at this state?
> + if (n == tot) { > + /* > + * fcheck_files() is safe with drop/re-acquire > + * of the lock, because it tests: fd < max_fds > + */ > + spin_unlock(&files->file_lock); > + tot *= 2; > + if (tot < 0) { /* overflow ? */
_NO_. tot is signed, this does not have documented overflow behaviour. You need to restrict this to a sane number.
> + kfree(fds); > + return -EMFILE; > + } > + fds = krealloc(fds, tot * sizeof(*fds), GFP_KERNEL); > + if (!fds)
krealloc does not free the memory on error, so this is a leak.
Bastian
-- The more complex the mind, the greater the need for the simplicity of play. -- Kirk, "Shore Leave", stardate 3025.8
| |