From 99c3b2db897a4a0878e24d92fd1181da71416d80 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 22 Sep 2020 10:21:03 +0800 Subject: [PATCH] fix multiplication overflow in copy_fdtable() stable inclusion from linux-4.19.125 commit b23af87aabc04ee63935b7f80664f2b36f74fdef -------------------------------- [ Upstream commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b ] cpy and set really should be size_t; we won't get an overflow on that, since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *), so nr that would've managed to overflow size_t on that multiplication won't get anywhere near copy_fdtable() - we'll fail with EMFILE before that. Cc: stable@kernel.org # v2.6.25+ Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open) Reported-by: Thiago Macieira Signed-off-by: Al Viro Signed-off-by: Sasha Levin Signed-off-by: Yang Yingliang --- fs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/file.c b/fs/file.c index 5b191c3a3acf..6dd55640e91f 100644 --- a/fs/file.c +++ b/fs/file.c @@ -71,7 +71,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt, */ static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt) { - unsigned int cpy, set; + size_t cpy, set; BUG_ON(nfdt->max_fds < ofdt->max_fds); -- GitLab