From: Al Viro <viro@zeniv.linux.org.uk>
Date: Tue, 19 May 2020 21:48:52 +0000 (-0400)
Subject: fix multiplication overflow in copy_fdtable()
X-Git-Tag: v4.9.225~57
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=26204c47c87966ec458258a74555bc11ce6fca68;p=thirdparty%2Fkernel%2Fstable.git

fix multiplication overflow in copy_fdtable()

[ Upstream commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b ]

cpy and set really should be size_t; we won't get an overflow on that,
since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *),
so nr that would've managed to overflow size_t on that multiplication
won't get anywhere near copy_fdtable() - we'll fail with EMFILE
before that.

Cc: stable@kernel.org # v2.6.25+
Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open)
Reported-by: Thiago Macieira <thiago.macieira@intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/fs/file.c b/fs/file.c
index 09aac4d4729b9..82d3f925bab39 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -89,7 +89,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt,
  */
 static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
 {
-	unsigned int cpy, set;
+	size_t cpy, set;
 
 	BUG_ON(nfdt->max_fds < ofdt->max_fds);