Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6631c8da authored by Theodore Ts'o's avatar Theodore Ts'o Committed by Greg Kroah-Hartman
Browse files

fs: prevent out-of-bounds array speculation when closing a file descriptor 



commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.

Google-Bug-Id: 114199369
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b829e8b6

fs/file.c

+1 −0
Original line number Diff line number Diff line
@@ -654,6 +654,7 @@ int __close_fd_get_file(unsigned int fd, struct file **res) 
	fdt = files_fdtable(files);

	if (fd >= fdt->max_fds)

		goto out_unlock;

	fd = array_index_nospec(fd, fdt->max_fds);

	file = fdt->fd[fd];

	if (!file)

		goto out_unlock;