fix multiplication overflow in copy_fdtable()

cpy and set really should be size_t; we won't get an overflow on that,
since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *),
so nr that would've managed to overflow size_t on that multiplication
won't get anywhere near copy_fdtable() - we'll fail with EMFILE
before that.

Cc: # v2.6.25+
Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open)
Reported-by: Thiago Macieira <>
Signed-off-by: Al Viro <>
diff --git a/fs/file.c b/fs/file.c
index c8a4e4c..abb8b70 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -70,7 +70,7 @@
 static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
-	unsigned int cpy, set;
+	size_t cpy, set;
 	BUG_ON(nfdt->max_fds < ofdt->max_fds);