changeset 10255:721c9dbb02ea

6352258 poll can be tricked into allocating WAY too much memory
author William Kucharski <William.Kucharski@Sun.COM>
date Tue, 04 Aug 2009 06:13:32 -0600
parents c36cdccb4d35
children a296cc1c90a8
files usr/src/uts/common/syscall/poll.c
diffstat 1 files changed, 10 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/usr/src/uts/common/syscall/poll.c	Mon Aug 03 23:01:56 2009 -0700
+++ b/usr/src/uts/common/syscall/poll.c	Tue Aug 04 06:13:32 2009 -0600
@@ -389,8 +389,16 @@
 	old_nfds = ps->ps_nfds;
 	if (nfds != old_nfds) {
 
-		kmem_free(ps->ps_pollfd, old_nfds * sizeof (pollfd_t));
-		pollfdp = kmem_alloc(nfds * sizeof (pollfd_t), KM_SLEEP);
+		if (old_nfds != 0)
+			kmem_free(ps->ps_pollfd, old_nfds * sizeof (pollfd_t));
+
+		if ((pollfdp =
+		    kmem_alloc(nfds * sizeof (pollfd_t), KM_NOSLEEP)) == NULL) {
+			ps->ps_nfds = 0;
+			error = EAGAIN;
+			goto pollout;
+		}
+
 		ps->ps_pollfd = pollfdp;
 		ps->ps_nfds = nfds;
 	}