[PATCH 1/1] fs: cap max_files at LONG_MAX

[Christian Brauner]

The percpu counters can only deal with long ints but max_files is declared
as an unsigned long. We have already started to reject anything exceeding
LONG_INT in the file-max sysctl as well [1].
Should we ever have the need and precision for unsigned long percpu
counters we can simply switch to that api for the sysctls and then lift the
LONG_MAX cap from files_maxfiles_init() as well.

Note, that in a quick discussion with Tejun investigating percpu unsigned
long counters it became obvious that technically, both LONG_MAX and
ULONG_MAX should be unreachable. Given that an fd is usually larger than 2
bytes one would likely run out of address space before even reaching the
LONG_MAX limit.

[1]: https://lkml.org/lkml/2018/10/17/74

Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
Signed-off-by: Christian Brauner <christian.brauner@xxxxxxxxxx>
---
 fs/file_table.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/file_table.c b/fs/file_table.c
index e49af4caf15d..2e3cddce20d6 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -10,6 +10,7 @@
 #include <linux/file.h>
 #include <linux/fdtable.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/security.h>
@@ -386,4 +387,11 @@ void __init files_maxfiles_init(void)
 	n = ((totalram_pages - memreserve) * (PAGE_SIZE / 1024)) / 10;
 
 	files_stat.max_files = max_t(unsigned long, n, NR_FILE);
+
+	/*
+	 * The percpu counters only handle long ints so cap maximum number of
+	 * files at LONG_MAX.
+	 */
+	if (files_stat.max_files > LONG_MAX)
+		files_stat.max_files = LONG_MAX;
 }
-- 
2.19.1