lkml.org 
[lkml]   [2020]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 10/81] fix multiplication overflow in copy_fdtable()
    Date
    From: Al Viro <viro@zeniv.linux.org.uk>

    [ Upstream commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b ]

    cpy and set really should be size_t; we won't get an overflow on that,
    since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *),
    so nr that would've managed to overflow size_t on that multiplication
    won't get anywhere near copy_fdtable() - we'll fail with EMFILE
    before that.

    Cc: stable@kernel.org # v2.6.25+
    Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open)
    Reported-by: Thiago Macieira <thiago.macieira@intel.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/file.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/file.c b/fs/file.c
    index 780d29e58847..3762a3f136fd 100644
    --- a/fs/file.c
    +++ b/fs/file.c
    @@ -70,7 +70,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt,
    */
    static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
    {
    - unsigned int cpy, set;
    + size_t cpy, set;

    BUG_ON(nfdt->max_fds < ofdt->max_fds);

    --
    2.25.1


    \
     
     \ /
      Last update: 2020-05-26 21:29    [W:4.095 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site