Nathaniel Yazdani <n1ght.4nd.d4y@xxxxxxxxx> wrote: > + * stores triggered eventpoll entries in the 'out' array. The input array is > + * _not_ read-only, because the resulting event mask gets written back to each > + * entry's ->ep_events field. When successful, this will be the same as before > + * (plus EPOLLERR & EPOLLHUP). If ->ep_events gets cleared, then it is reasonable > + * to infer that the entry's ->ep_fildes was a bad file descriptor. > + */ > + if (!access_ok(VERIFY_WRITE, in, inc * sizeof(struct epoll))) > + goto out; > + for (i = 0; i < inc; ++i) { > + int fd, io; > + long long id; > + > + ret = -EFAULT; > + if (__get_user(fd, &in[i].ep_fildes) || > + __get_user(io, &in[i].ep_events) || > + __get_user(id, &in[i].ep_ident)) > + goto out; > + > + ep_control(file->private_data, fd, &io, id, 0); > + ret = -EFAULT; > + if (__put_user(io, &in[i].ep_events)) > + goto out; I don't think we should waste cycles writing to 'in' on success. -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html