diff options
| author | Jeremy Allison <jra@samba.org> | 2020-03-11 14:47:50 -0700 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2020-04-07 08:12:34 +0000 |
| commit | 1ad202440c5469a1855af416575bd0593d1a1344 (patch) | |
| tree | b9f948732c32f8ddc06796c673a51d80ed2d0da6 | |
| parent | 8a6dc998ec6da2bfa19aea8b4060f27a1d2f11b9 (diff) | |
| download | samba-1ad202440c5469a1855af416575bd0593d1a1344.tar.gz | |
s3: smbd: Now we free fsp->aio_requests when it gets zero entries, talloc in chunks of 10 instead of 1.
Prevents incremental +1 tallocs, and the original
idea of this array was that it wasn't freed for
io efficiency reasons. Add paranoia integer wrap
protection also.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14301
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit b90bc0f28918133badbf6810d5e298fc326bd1aa)
| -rw-r--r-- | source3/smbd/aio.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c index afe76608cd3..cf35f3297ec 100644 --- a/source3/smbd/aio.c +++ b/source3/smbd/aio.c @@ -122,9 +122,19 @@ bool aio_add_req_to_fsp(files_struct *fsp, struct tevent_req *req) if (array_len <= fsp->num_aio_requests) { struct tevent_req **tmp; + if (fsp->num_aio_requests + 10 < 10) { + /* Integer wrap. */ + TALLOC_FREE(lnk); + return false; + } + + /* + * Allocate in blocks of 10 so we don't allocate + * on every aio request. + */ tmp = talloc_realloc( fsp, fsp->aio_requests, struct tevent_req *, - fsp->num_aio_requests+1); + fsp->num_aio_requests+10); if (tmp == NULL) { TALLOC_FREE(lnk); return false; |