From: Al Viro Date: Thu, 1 Aug 2024 19:22:22 +0000 (-0400) Subject: protect the fetch of ->fd[fd] in do_dup2() from mispredictions X-Git-Tag: v6.11-rc2~26^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8aa37bde1a7b645816cda8b80df4753ecf172bf1;p=thirdparty%2Fkernel%2Flinux.git protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path. Cc: stable@vger.kernel.org Signed-off-by: Al Viro --- diff --git a/fs/file.c b/fs/file.c index a3b72aa64f116..a11e59b5d6026 100644 --- a/fs/file.c +++ b/fs/file.c @@ -1248,6 +1248,7 @@ __releases(&files->file_lock) * tables and this condition does not arise without those. */ fdt = files_fdtable(files); + fd = array_index_nospec(fd, fdt->max_fds); tofree = fdt->fd[fd]; if (!tofree && fd_is_open(fd, fdt)) goto Ebusy;