aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2020-05-19 17:48:52 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2020-05-19 18:29:36 -0400
commit4e89b7210403fa4a8acafe7c602b6212b7af6c3b (patch)
tree23fa6410018b40b285702244099f20977db8a5f4
parentb0d3869ce9eeacbb1bbd541909beeef4126426d5 (diff)
downloadlinux-4e89b7210403fa4a8acafe7c602b6212b7af6c3b.tar.gz
fix multiplication overflow in copy_fdtable()
cpy and set really should be size_t; we won't get an overflow on that, since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *), so nr that would've managed to overflow size_t on that multiplication won't get anywhere near copy_fdtable() - we'll fail with EMFILE before that. Cc: stable@kernel.org # v2.6.25+ Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open) Reported-by: Thiago Macieira <thiago.macieira@intel.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--fs/file.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/file.c b/fs/file.c
index c8a4e4c86e55..abb8b7081d7a 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -70,7 +70,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt,
*/
static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
{
- unsigned int cpy, set;
+ size_t cpy, set;
BUG_ON(nfdt->max_fds < ofdt->max_fds);