[PATCH 5.15 001/145] fs: prevent out-of-bounds array speculation when closing a file descriptor

From: Theodore Ts'o tytso@mit.edu

commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.

Google-Bug-Id: 114199369 Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Al Viro viro@zeniv.linux.org.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/file.c | 1 + 1 file changed, 1 insertion(+)

--- a/fs/file.c +++ b/fs/file.c @@ -646,6 +646,7 @@ static struct file *pick_file(struct fil file = ERR_PTR(-EINVAL); goto out_unlock; } + fd = array_index_nospec(fd, fdt->max_fds); file = fdt->fd[fd]; if (!file) { file = ERR_PTR(-EBADF);