[PATCH] fs: prevent out-of-bounds array speculation when closing a file descriptor

[PATCH] fs: prevent out-of-bounds array speculation when closing a file descriptor

[Theodore Ts'o]

Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---

I had sent this a while back, and failed to follow up when it
apparently get missed.  $WORK has been carrying this (or the
equivalent) as an out-of-tree security patch since 2018, and now some
folks are now nagging me about why hasn't this gone upstream yet...

 fs/file.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/file.c b/fs/file.c
index c942c89ca4cd..7893ea161d77 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -642,6 +642,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd)
 	if (fd >= fdt->max_fds)
 		return NULL;
 
+	fd = array_index_nospec(fd, fdt->max_fds);
 	file = fdt->fd[fd];
 	if (file) {
 		rcu_assign_pointer(fdt->fd[fd], NULL);
-- 
2.31.0

Re: [PATCH] fs: prevent out-of-bounds array speculation when closing a file descriptor

[Al Viro]

On Mon, Mar 06, 2023 at 01:54:50PM -0500, Theodore Ts'o wrote:
> Google-Bug-Id: 114199369
> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
> ---
> 
> I had sent this a while back, and failed to follow up when it
> apparently get missed.  $WORK has been carrying this (or the
> equivalent) as an out-of-tree security patch since 2018, and now some
> folks are now nagging me about why hasn't this gone upstream yet...

Applied (#fixes), will go to Linus this weekend.