aboutsummaryrefslogtreecommitdiffstats
path: root/net/unix
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2018-05-26 20:10:07 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2018-05-29 23:20:17 -0400
commit1da92779e2e8f309d5aecbbed346e7f812b174e8 (patch)
treeef7385c244e4affbec1e58b4f4cef068a80c6a4e /net/unix
parentaio: fold do_io_submit() into callers (diff)
downloadlinux-dev-1da92779e2e8f309d5aecbbed346e7f812b174e8.tar.xz
linux-dev-1da92779e2e8f309d5aecbbed346e7f812b174e8.zip
aio: sanitize the limit checking in io_submit(2)
as it is, the logics in native io_submit(2) is "if asked for more than LONG_MAX/sizeof(pointer) iocbs to submit, don't bother with more than LONG_MAX/sizeof(pointer)" (i.e. 512M requests on 32bit and 1E requests on 64bit) while compat io_submit(2) goes with "stop after the first PAGE_SIZE/sizeof(pointer) iocbs", i.e. 1K or so. Which is * inconsistent * *way* too much in native case * possibly too little in compat one and * wrong anyway, since the natural point where we ought to stop bothering is ctx->nr_events Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'net/unix')
0 files changed, 0 insertions, 0 deletions