Re: [RFC v5][PATCH 8/8] Dump open file descriptors

Bastian Blank
2008-09-14T09:51:21Z

On Sat, Sep 13, 2008 at 07:06:06PM -0400, Oren Laadan wrote:
> +int cr_scan_fds(struct files_struct *files, int **fdtable)
> +{
> + struct fdtable *fdt;
> + int *fds;
> + int i, n, tot;
> +
> + n = 0;
> + tot = CR_DEFAULT_FDTABLE;

Why not?
| int i;
| int n = 0;
| int tot = CR_DEFAULT_FDTABLE;

IHMO easier readable.

> + spin_lock(&files->file_lock);
> + fdt = files_fdtable(files);
> + for (i = 0; i < fdt->max_fds; i++) {

The process is suspended at this state?

> + if (n == tot) {
> + /*
> + * fcheck_files() is safe with drop/re-acquire
> + * of the lock, because it tests: fd < max_fds
> + */
> + spin_unlock(&files->file_lock);
> + tot *= 2;
> + if (tot < 0) { /* overflow ? */

_NO_. tot is signed, this does not have documented overflow behaviour.
You need to restrict this to a sane number.

> + kfree(fds);
> + return -EMFILE;
> + }
> + fds = krealloc(fds, tot * sizeof(*fds), GFP_KERNEL);
> + if (!fds)

krealloc does not free the memory on error, so this is a leak.

Bastian

--
The more complex the mind, the greater the need for the simplicity of play.
-- Kirk, "Shore Leave", stardate 3025.8