• Al Viro's avatar
    aio: sanitize the limit checking in io_submit(2) · 1da92779
    Al Viro authored
    as it is, the logics in native io_submit(2) is "if asked for
    more than LONG_MAX/sizeof(pointer) iocbs to submit, don't
    bother with more than LONG_MAX/sizeof(pointer)" (i.e.
    512M requests on 32bit and 1E requests on 64bit) while
    compat io_submit(2) goes with "stop after the first
    PAGE_SIZE/sizeof(pointer) iocbs", i.e. 1K or so.  Which is
    	* inconsistent
    	* *way* too much in native case
    	* possibly too little in compat one
    and
    	* wrong anyway, since the natural point where we
    ought to stop bothering is ctx->nr_events
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    1da92779
aio.c 52.7 KB