]> git.baikalelectronics.ru Git - kernel.git/commit
fix multiplication overflow in copy_fdtable()
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 19 May 2020 21:48:52 +0000 (17:48 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 19 May 2020 22:29:36 +0000 (18:29 -0400)
commit64a60972cef8935656d4f54476ac151a19bff9f6
tree23fa6410018b40b285702244099f20977db8a5f4
parent4f1162e51ee326674f6c7503dd4ec34be22ca7d9
fix multiplication overflow in copy_fdtable()

cpy and set really should be size_t; we won't get an overflow on that,
since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *),
so nr that would've managed to overflow size_t on that multiplication
won't get anywhere near copy_fdtable() - we'll fail with EMFILE
before that.

Cc: stable@kernel.org # v2.6.25+
Fixes: 6a9e3477ac14 (get rid of NR_OPEN and introduce a sysctl_nr_open)
Reported-by: Thiago Macieira <thiago.macieira@intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
fs/file.c