diff options
| -rw-r--r-- | lib/libc/sys/poll.2 | 12 | ||||
| -rw-r--r-- | sys/kern/sys_generic.c | 7 |
2 files changed, 17 insertions, 2 deletions
diff --git a/lib/libc/sys/poll.2 b/lib/libc/sys/poll.2 index dbd641f50bf79..feed431516246 100644 --- a/lib/libc/sys/poll.2 +++ b/lib/libc/sys/poll.2 @@ -28,7 +28,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd November 13, 2014 +.Dd November 1, 2018 .Dt POLL 2 .Os .Sh NAME @@ -232,7 +232,15 @@ points outside the process's allocated address space. A signal was delivered before the time limit expired and before any of the selected events occurred. .It Bq Er EINVAL -The specified time limit is invalid. One of its components is negative or too large. +The specified time limit is invalid. +One of its components is negative or too large. +.It Bq Er EINVAL +The number of pollfd structures specified by +.Fa nfds +exceeds the system tunable +.Va kern.maxfilesperproc +and +.Dv FD_SETSIZE . .El .Sh SEE ALSO .Xr accept 2 , diff --git a/sys/kern/sys_generic.c b/sys/kern/sys_generic.c index 0e8e173654c5c..300c80930ca53 100644 --- a/sys/kern/sys_generic.c +++ b/sys/kern/sys_generic.c @@ -1339,6 +1339,13 @@ kern_poll(struct thread *td, struct pollfd *ufds, u_int nfds, } else sbt = -1; + /* + * This is kinda bogus. We have fd limits, but that is not + * really related to the size of the pollfd array. Make sure + * we let the process use at least FD_SETSIZE entries and at + * least enough for the system-wide limits. We want to be reasonably + * safe, but not overly restrictive. + */ if (nfds > maxfilesperproc && nfds > FD_SETSIZE) return (EINVAL); if (nfds > nitems(stackfds)) |