diff mbox series

fs: prevent out-of-bounds array speculation when closing a file descriptor

Message ID 20230306185450.1028235-1-tytso@mit.edu
State New
Headers
Series fs: prevent out-of-bounds array speculation when closing a file descriptor |

Commit Message

Theodore Ts'o March 6, 2023, 6:54 p.m. UTC 
  Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---

I had sent this a while back, and failed to follow up when it
apparently get missed.  $WORK has been carrying this (or the
equivalent) as an out-of-tree security patch since 2018, and now some
folks are now nagging me about why hasn't this gone upstream yet...

 fs/file.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Al Viro March 10, 2023, 3:47 a.m. UTC | #1 
On Mon, Mar 06, 2023 at 01:54:50PM -0500, Theodore Ts'o wrote:
> Google-Bug-Id: 114199369
> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
> ---
> 
> I had sent this a while back, and failed to follow up when it
> apparently get missed.  $WORK has been carrying this (or the
> equivalent) as an out-of-tree security patch since 2018, and now some
> folks are now nagging me about why hasn't this gone upstream yet...

Applied (#fixes), will go to Linus this weekend.
diff mbox series

Patch

diff --git a/fs/file.c b/fs/file.c
index c942c89ca4cd..7893ea161d77 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -642,6 +642,7 @@  static struct file *pick_file(struct files_struct *files, unsigned fd)
 	if (fd >= fdt->max_fds)
 		return NULL;
 
+	fd = array_index_nospec(fd, fdt->max_fds);
 	file = fdt->fd[fd];
 	if (file) {
 		rcu_assign_pointer(fdt->fd[fd], NULL);