]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
copy_file_range: limit size if in compat mode
authorMiklos Szeredi <mszeredi@redhat.com>
Wed, 13 Aug 2025 15:11:05 +0000 (17:11 +0200)
committerChristian Brauner <brauner@kernel.org>
Fri, 15 Aug 2025 14:11:47 +0000 (16:11 +0200)
commitf8f59a2c05dc16d19432e3154a9ac7bc385f4b92
tree4b163667fb2d7e6beabda8c3a4a9b626f323f809
parent15769d9478bdb3e09184c5adbab6e2d2dfcbf1b1
copy_file_range: limit size if in compat mode

If the process runs in 32-bit compat mode, copy_file_range results can be
in the in-band error range.  In this case limit copy length to MAX_RW_COUNT
to prevent a signed overflow.

Reported-by: Florian Weimer <fweimer@redhat.com>
Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Link: https://lore.kernel.org/20250813151107.99856-1-mszeredi@redhat.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
fs/read_write.c