size = sizeof(*klist) + sizeof(*key) * max; 
size = sizeof(*klist) + sizeof(struct key *) * max; 
int __key_link(struct key *keyring, struct key *key){	struct keyring_list *klist, *nklist;	unsigned max;	size_t size;	int ret;	ret = -EKEYREVOKED;	if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))		goto error;	ret = -ENOTDIR;	if (keyring->type != &key_type_keyring)		goto error;	/* serialise link/link calls to prevent parallel calls causing a	 * cycle when applied to two keyring in opposite orders */	down_write(&keyring_serialise_link_sem);	/* check that we aren't going to create a cycle adding one keyring to	 * another */	if (key->type == &key_type_keyring) {		ret = keyring_detect_cycle(keyring, key);		if (ret < 0)			goto error2;	}	/* check that we aren't going to overrun the user's quota */	ret = key_payload_reserve(keyring,				  keyring->datalen + KEYQUOTA_LINK_BYTES);	if (ret < 0)		goto error2;	klist = keyring->payload.subscriptions;	if (klist && klist->nkeys < klist->maxkeys) {		/* there's sufficient slack space to add directly */		atomic_inc(&key->usage);		klist->keys[klist->nkeys] = key;		smp_wmb();		klist->nkeys++;		smp_wmb();		ret = 0;	}	else {		/* grow the key list */		max = 4;		if (klist)			max += klist->maxkeys;		ret = -ENFILE;		if (max > 65535)			goto error3;		size = sizeof(*klist) + sizeof(*key) * max;		if (size > PAGE_SIZE)			goto error3;		ret = -ENOMEM;		nklist = kmalloc(size, GFP_KERNEL);		if (!nklist)			goto error3;		nklist->maxkeys = max;		nklist->nkeys = 0;		if (klist) {			nklist->nkeys = klist->nkeys;			memcpy(nklist->keys,			       klist->keys,			       sizeof(struct key *) * klist->nkeys);		}		/* add the key into the new space */		atomic_inc(&key->usage);		nklist->keys[nklist->nkeys++] = key;		rcu_assign_pointer(keyring->payload.subscriptions, nklist);		/* dispose of the old keyring list */		if (klist)			call_rcu(&klist->rcu, keyring_link_rcu_disposal);		ret = 0;	} error2:	up_write(&keyring_serialise_link_sem); error:	return ret; error3:	/* undo the quota changes */	key_payload_reserve(keyring,			    keyring->datalen - KEYQUOTA_LINK_BYTES);	goto error2;} /* end __key_link() */
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/a4014d8f61a6a136d22422cf8aa978e6495dbad9/keyring.c/buggy/security/keys/keyring.c