tree ef7385c244e4affbec1e58b4f4cef068a80c6a4e
parent 67ba049f94ebe49ed557e590dd243b6db45c9aff
author Al Viro <viro@zeniv.linux.org.uk> 1527379807 -0400
committer Al Viro <viro@zeniv.linux.org.uk> 1527650417 -0400

aio: sanitize the limit checking in io_submit(2)

as it is, the logics in native io_submit(2) is "if asked for
more than LONG_MAX/sizeof(pointer) iocbs to submit, don't
bother with more than LONG_MAX/sizeof(pointer)" (i.e.
512M requests on 32bit and 1E requests on 64bit) while
compat io_submit(2) goes with "stop after the first
PAGE_SIZE/sizeof(pointer) iocbs", i.e. 1K or so.  Which is
	* inconsistent
	* *way* too much in native case
	* possibly too little in compat one
and
	* wrong anyway, since the natural point where we
ought to stop bothering is ctx->nr_events

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>