diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2020-05-19 17:48:52 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-05-27 17:46:12 +0200 |
| commit | ac6f94d3be65c88b9e56f8921b8bef40c9b13576 (patch) | |
| tree | d5939cb0545c2c9c3332e3f62365121dd8f405be /fs/file.c | |
| parent | 725b0bb0f94d384d4cea2baedcf44b84041ff03e (diff) | |
| download | linux-stable-ac6f94d3be65c88b9e56f8921b8bef40c9b13576.tar.gz linux-stable-ac6f94d3be65c88b9e56f8921b8bef40c9b13576.tar.bz2 linux-stable-ac6f94d3be65c88b9e56f8921b8bef40c9b13576.zip | |
fix multiplication overflow in copy_fdtable()
[ Upstream commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b ]
cpy and set really should be size_t; we won't get an overflow on that,
since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *),
so nr that would've managed to overflow size_t on that multiplication
won't get anywhere near copy_fdtable() - we'll fail with EMFILE
before that.
Cc: stable@kernel.org # v2.6.25+
Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open)
Reported-by: Thiago Macieira <thiago.macieira@intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/file.c')
| -rw-r--r-- | fs/file.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/file.c b/fs/file.c index 3da91a112bab..e5d328335f88 100644 --- a/fs/file.c +++ b/fs/file.c @@ -70,7 +70,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt, */ static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt) { - unsigned int cpy, set; + size_t cpy, set; BUG_ON(nfdt->max_fds < ofdt->max_fds); |