Commit 4e89b721 authored May 19, 2020 by Al Viro

fix multiplication overflow in copy_fdtable()



cpy and set really should be size_t; we won't get an overflow on that,
since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *),
so nr that would've managed to overflow size_t on that multiplication
won't get anywhere near copy_fdtable() - we'll fail with EMFILE
before that.

Cc: stable@kernel.org # v2.6.25+
Fixes: 9cfe015a (get rid of NR_OPEN and introduce a sysctl_nr_open)
Reported-by: Thiago Macieira <thiago.macieira@intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

parent b0d3869c

fs/file.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -70,7 +70,7 @@ static void copy_fd_bitmaps(struct fdtable nfdt, struct fdtable ofdt,
		*/
		static void copy_fdtable(struct fdtable nfdt, struct fdtable ofdt)
		{
		unsigned int cpy, set;
		size_t cpy, set;

		BUG_ON(nfdt->max_fds < ofdt->max_fds);

Admin message