> While the check in question is clearly buggy, simply removing the
> check isn't the right answer -- there needs to be some limit on the
> number of poll array elements because the kernel allocates a chunk of
> kernel memory to cover them; if the size is unlimited, the user can
> ask the kernel to allocate essentially arbitrary amounts of kernel
> memory.
> 
> But how do we determine what's a reasonable limit?
> 

Could it be coded so that the list is read in chunks and
the main data area only allocated for slots with non -ve
fd numbers?
You could even manage to only allocate data for each open fd
once.  That way the kernel memory grabbed would be limited
to the number of open files that the process actually has.


	David

-- 
David Laight: david@l8s.co.uk