android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs: prevent out-of-bounds array speculation when closing a file descriptor

Browse Source 
commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.

Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Theodore Ts'o 2023-03-06 13:54:50 -05:00 committed by Greg Kroah-Hartman
parent b829e8b6e1
commit 6631c8da02
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fs/file.c
View File

@ -654,6 +654,7 @@ int __close_fd_get_file(unsigned int fd, struct file **res)
fdt = files_fdtable(files); fdt = files_fdtable(files);
if (fd >= fdt->max_fds) if (fd >= fdt->max_fds)
goto out_unlock; goto out_unlock;
fd = array_index_nospec(fd, fdt->max_fds);
file = fdt->fd[fd]; file = fdt->fd[fd];
if (!file) if (!file)
goto out_unlock; goto out_unlock;