Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753855AbbBNAGr (ORCPT ); Fri, 13 Feb 2015 19:06:47 -0500 Received: from mail-qg0-f52.google.com ([209.85.192.52]:41552 "EHLO mail-qg0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753033AbbBNAGq convert rfc822-to-8bit (ORCPT ); Fri, 13 Feb 2015 19:06:46 -0500 Message-ID: <54DE9179.6080401@gmail.com> Date: Fri, 13 Feb 2015 19:06:17 -0500 From: Dan Rosenberg User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0 MIME-Version: 1.0 To: famz@redhat.com CC: "linux-kernel@vger.kernel.org" Subject: Re: [PATCH RFC v3 4/7] epoll: Add implementation for epoll_ctl_batch References: <54DE71E4.6070304@gmail.com> In-Reply-To: <54DE71E4.6070304@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 521 Lines: 13 > + if (ncmds <= 0 || !cmds) > + return -EINVAL; > + cmd_size = sizeof(struct epoll_ctl_cmd) * ncmds; > + kcmds = kmalloc(cmd_size, GFP_KERNEL); You should probably fix the integer overflow in the calculation of the cmd_size variable, unless you like root vulnerabilities. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/