diff options
author | Jeremy Allison <jra@samba.org> | 2020-03-11 14:47:50 -0700 |
---|---|---|
committer | Jeremy Allison <jra@samba.org> | 2020-03-18 18:03:28 +0000 |
commit | b90bc0f28918133badbf6810d5e298fc326bd1aa (patch) | |
tree | 1e887c9b78141588fb51d27c02ded2e12a5873c0 /source3/smbd/aio.c | |
parent | 0c952bba1edf7c8173d05ccdc6fdaa7232d2c6aa (diff) | |
download | samba-b90bc0f28918133badbf6810d5e298fc326bd1aa.tar.gz |
s3: smbd: Now we free fsp->aio_requests when it gets zero entries, talloc in chunks of 10 instead of 1.
Prevents incremental +1 tallocs, and the original
idea of this array was that it wasn't freed for
io efficiency reasons. Add paranoia integer wrap
protection also.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14301
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Diffstat (limited to 'source3/smbd/aio.c')
-rw-r--r-- | source3/smbd/aio.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c index afe76608cd3..cf35f3297ec 100644 --- a/source3/smbd/aio.c +++ b/source3/smbd/aio.c @@ -122,9 +122,19 @@ bool aio_add_req_to_fsp(files_struct *fsp, struct tevent_req *req) if (array_len <= fsp->num_aio_requests) { struct tevent_req **tmp; + if (fsp->num_aio_requests + 10 < 10) { + /* Integer wrap. */ + TALLOC_FREE(lnk); + return false; + } + + /* + * Allocate in blocks of 10 so we don't allocate + * on every aio request. + */ tmp = talloc_realloc( fsp, fsp->aio_requests, struct tevent_req *, - fsp->num_aio_requests+1); + fsp->num_aio_requests+10); if (tmp == NULL) { TALLOC_FREE(lnk); return false; |