From 78c2a9806ea5035f4ea005a877987feb3e365e7f Mon Sep 17 00:00:00 2001 From: Conrad Meyer Date: Thu, 1 Nov 2018 23:46:23 +0000 Subject: [PATCH] kern_poll: Restore explanatory comment removed in r177374 The comment isn't stale. The check is bogus in the sense that poll(2) does not require pollfd entries to be unique in fd space, so there is no reason there cannot be more pollfd entries than open or even allowed fds. The check is mostly a seatbelt against accidental misuse or abuse. FD_SETSIZE, while usually unrelated to poll, is used as an arbitrary floor for systems with very low kern.maxfilesperproc. Additionally, document this possible EINVAL condition in the poll.2 manual. No functional change. Reviewed by: markj Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D17671 --- lib/libc/sys/poll.2 | 12 ++++++++++-- sys/kern/sys_generic.c | 7 +++++++ 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/lib/libc/sys/poll.2 b/lib/libc/sys/poll.2 index dbd641f50bf7..feed43151624 100644 --- a/lib/libc/sys/poll.2 +++ b/lib/libc/sys/poll.2 @@ -28,7 +28,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd November 13, 2014 +.Dd November 1, 2018 .Dt POLL 2 .Os .Sh NAME @@ -232,7 +232,15 @@ points outside the process's allocated address space. A signal was delivered before the time limit expired and before any of the selected events occurred. .It Bq Er EINVAL -The specified time limit is invalid. One of its components is negative or too large. +The specified time limit is invalid. +One of its components is negative or too large. +.It Bq Er EINVAL +The number of pollfd structures specified by +.Fa nfds +exceeds the system tunable +.Va kern.maxfilesperproc +and +.Dv FD_SETSIZE . .El .Sh SEE ALSO .Xr accept 2 , diff --git a/sys/kern/sys_generic.c b/sys/kern/sys_generic.c index 0e8e173654c5..300c80930ca5 100644 --- a/sys/kern/sys_generic.c +++ b/sys/kern/sys_generic.c @@ -1339,6 +1339,13 @@ kern_poll(struct thread *td, struct pollfd *ufds, u_int nfds, } else sbt = -1; + /* + * This is kinda bogus. We have fd limits, but that is not + * really related to the size of the pollfd array. Make sure + * we let the process use at least FD_SETSIZE entries and at + * least enough for the system-wide limits. We want to be reasonably + * safe, but not overly restrictive. + */ if (nfds > maxfilesperproc && nfds > FD_SETSIZE) return (EINVAL); if (nfds > nitems(stackfds))