fix multiplication overflow in copy_fdtable()
authorAl Viro <viro@zeniv.linux.org.uk>
Tue, 19 May 2020 21:48:52 +0000 (17:48 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 May 2020 14:42:51 +0000 (16:42 +0200)
commit2a738364667b485709c28942be9c0b1681b28199
tree7bc29f7f52acd409dad5a1ba21419f290b648182
parentfa63cb9b6ddaa6142cea2b47f0ed0450f48e7f77
fix multiplication overflow in copy_fdtable()

[ Upstream commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b ]

cpy and set really should be size_t; we won't get an overflow on that,
since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *),
so nr that would've managed to overflow size_t on that multiplication
won't get anywhere near copy_fdtable() - we'll fail with EMFILE
before that.

Cc: stable@kernel.org # v2.6.25+
Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open)
Reported-by: Thiago Macieira <thiago.macieira@intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/file.c