From: Jeremy Allison <jra@samba.org>
Date: Wed, 11 Mar 2020 21:47:50 +0000 (-0700)
Subject: s3: smbd: Now we free fsp->aio_requests when it gets zero entries, talloc in chunks... 
X-Git-Tag: ldb-2.2.0~1441
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b90bc0f28918133badbf6810d5e298fc326bd1aa;p=thirdparty%2Fsamba.git

s3: smbd: Now we free fsp->aio_requests when it gets zero entries, talloc in chunks of 10 instead of 1.

Prevents incremental +1 tallocs, and the original
idea of this array was that it wasn't freed for
io efficiency reasons. Add paranoia integer wrap
protection also.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14301

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c
index afe76608cd3..cf35f3297ec 100644
--- a/source3/smbd/aio.c
+++ b/source3/smbd/aio.c
@@ -122,9 +122,19 @@ bool aio_add_req_to_fsp(files_struct *fsp, struct tevent_req *req)
 	if (array_len <= fsp->num_aio_requests) {
 		struct tevent_req **tmp;
 
+		if (fsp->num_aio_requests + 10 < 10) {
+			/* Integer wrap. */
+			TALLOC_FREE(lnk);
+			return false;
+		}
+
+		/*
+		 * Allocate in blocks of 10 so we don't allocate
+		 * on every aio request.
+		 */
 		tmp = talloc_realloc(
 			fsp, fsp->aio_requests, struct tevent_req *,
-			fsp->num_aio_requests+1);
+			fsp->num_aio_requests+10);
 		if (tmp == NULL) {
 			TALLOC_FREE(lnk);
 			return false;