From: Theodore Ts'o <tytso@mit.edu>
Date: Mon, 6 Mar 2023 18:54:50 +0000 (-0500)
Subject: fs: prevent out-of-bounds array speculation when closing a file descriptor
X-Git-Tag: v6.6.7~3309^2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=609d54441493c99f21c1823dfd66fa7f4c512ff4;p=platform%2Fkernel%2Flinux-starfive.git

fs: prevent out-of-bounds array speculation when closing a file descriptor

Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/fs/file.c b/fs/file.c
index c942c89ca4cd..7893ea161d77 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -642,6 +642,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd)
 	if (fd >= fdt->max_fds)
 		return NULL;
 
+	fd = array_index_nospec(fd, fdt->max_fds);
 	file = fdt->fd[fd];
 	if (file) {
 		rcu_assign_pointer(fdt->fd[fd], NULL);