[PATCH] spoll_create size check

From: Davide Libenzi <davidel@xmailserver.org>

This is a sanity check on the size parameter.  Nothing explodes w/out, but
the conversion to unsigned simply triggers a big allocation.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 1c808398903372f4784996eeef0406b62f95e29d..bc30a3cdd168ec5133d094c1d0348c6bac9cabd9 100644 (file)
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -499,6 +499,11 @@ asmlinkage long sys_epoll_create(int size)
        DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d)\n",
                     current, size));
 
+       /* Sanity check on the size parameter */
+       error = -EINVAL;
+       if (size <= 0)
+               goto eexit_1;
+
        /* Correctly size the hash */
        hashbits = ep_get_hash_bits((unsigned int) size);