On Sat, Sep 13, 2008 at 07:06:06PM -0400, Oren Laadan wrote: > +int cr_scan_fds(struct files_struct *files, int **fdtable) > +{ > + struct fdtable *fdt; > + int *fds; > + int i, n, tot; > + > + n = 0; > + tot = CR_DEFAULT_FDTABLE; Why not? | int i; | int n = 0; | int tot = CR_DEFAULT_FDTABLE; IHMO easier readable. > + spin_lock(&files->file_lock); > + fdt = files_fdtable(files); > + for (i = 0; i < fdt->max_fds; i++) { The process is suspended at this state? > + if (n == tot) { > + /* > + * fcheck_files() is safe with drop/re-acquire > + * of the lock, because it tests: fd < max_fds > + */ > + spin_unlock(&files->file_lock); > + tot *= 2; > + if (tot < 0) { /* overflow ? */ _NO_. tot is signed, this does not have documented overflow behaviour. You need to restrict this to a sane number. > + kfree(fds); > + return -EMFILE; > + } > + fds = krealloc(fds, tot * sizeof(*fds), GFP_KERNEL); > + if (!fds) krealloc does not free the memory on error, so this is a leak. Bastian -- The more complex the mind, the greater the need for the simplicity of play. -- Kirk, "Shore Leave", stardate 3025.8 _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers