diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2023-03-06 13:54:50 -0500 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2023-03-09 22:46:21 -0500 |
| commit | 609d54441493c99f21c1823dfd66fa7f4c512ff4 (patch) | |
| tree | 197db6ee1e1f8d89d60b9e0db4ce4634a53a2784 | |
| parent | c64c67c0748be5afb769a4eedbeb3ce6de36958f (diff) | |
fs: prevent out-of-bounds array speculation when closing a file descriptor
Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | fs/file.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/file.c b/fs/file.c index c942c89ca4cd..7893ea161d77 100644 --- a/fs/file.c +++ b/fs/file.c @@ -642,6 +642,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd) if (fd >= fdt->max_fds) return NULL; + fd = array_index_nospec(fd, fdt->max_fds); file = fdt->fd[fd]; if (file) { rcu_assign_pointer(fdt->fd[fd], NULL); |