[PATCH 6.1 001/143] fs: prevent out-of-bounds array speculation when closing a file descriptor

From: Theodore Ts'o tytso@mit.edu

commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.

Google-Bug-Id: 114199369 Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Al Viro viro@zeniv.linux.org.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/file.c | 1 + 1 file changed, 1 insertion(+)

--- a/fs/file.c +++ b/fs/file.c @@ -642,6 +642,7 @@ static struct file *pick_file(struct fil if (fd >= fdt->max_fds) return NULL;

+ fd = array_index_nospec(fd, fdt->max_fds); file = fdt->fd[fd]; if (file) { rcu_assign_pointer(fdt->fd[fd], NULL);