Messages in this thread Patch in this message | | | From | "Theodore Ts'o" <> | Subject | [PATCH] fs: prevent out-of-bounds array speculation when closing a file descriptor | Date | Mon, 6 Mar 2023 13:54:50 -0500 |
| |
Google-Bug-Id: 114199369 Signed-off-by: Theodore Ts'o <tytso@mit.edu> ---
I had sent this a while back, and failed to follow up when it apparently get missed. $WORK has been carrying this (or the equivalent) as an out-of-tree security patch since 2018, and now some folks are now nagging me about why hasn't this gone upstream yet...
fs/file.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/fs/file.c b/fs/file.c index c942c89ca4cd..7893ea161d77 100644 --- a/fs/file.c +++ b/fs/file.c @@ -642,6 +642,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd) if (fd >= fdt->max_fds) return NULL; + fd = array_index_nospec(fd, fdt->max_fds); file = fdt->fd[fd]; if (file) { rcu_assign_pointer(fdt->fd[fd], NULL); -- 2.31.0
| |