fix multiplication overflow in copy_fdtable()
[ Upstream commit4e89b72104
] cpy and set really should be size_t; we won't get an overflow on that, since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *), so nr that would've managed to overflow size_t on that multiplication won't get anywhere near copy_fdtable() - we'll fail with EMFILE before that. Cc: stable@kernel.org # v2.6.25+ Fixes:9cfe015aa4
(get rid of NR_OPEN and introduce a sysctl_nr_open) Reported-by: Thiago Macieira <thiago.macieira@intel.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
725b0bb0f9
commit
ac6f94d3be
|
@ -70,7 +70,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt,
|
||||||
*/
|
*/
|
||||||
static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
|
static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
|
||||||
{
|
{
|
||||||
unsigned int cpy, set;
|
size_t cpy, set;
|
||||||
|
|
||||||
BUG_ON(nfdt->max_fds < ofdt->max_fds);
|
BUG_ON(nfdt->max_fds < ofdt->max_fds);
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue