RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 20:37:35 +00:00
Code Issues Activity Actions

Kernel: Limit the number of file descriptors sys$poll() can handle

Browse source 
Just slap an arbitrary limit on there so we don't panic if somebody
asks us to poll 1 fajillion fds.

Found by fuzz-syscalls. :^)
This commit is contained in:
Andreas Kling 2021-02-13 00:58:33 +01:00
parent 7551090056
commit 62f0f73bf0
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Kernel/Syscalls/select.cpp
View file

@ -147,6 +147,10 @@ int Process::sys$poll(Userspace<const Syscall::SC_poll_params*> user_params)
if (!copy_from_user(&params, user_params)) if (!copy_from_user(&params, user_params))
return -EFAULT; return -EFAULT;
// This limit is just a number from the place where numbers come from.
if (params.nfds >= 16384)
return -ENOBUFS;
Thread::BlockTimeout timeout; Thread::BlockTimeout timeout;
if (params.timeout) { if (params.timeout) {
timespec timeout_copy; timespec timeout_copy;