fs: prevent out-of-bounds array speculation when closing a file descriptor

commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.

Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/file.c b/fs/file.c
index 51f53a7dc2218dcb8237b616c9d9af37f9061e57..e56059fa1b309fd4f2030e0160a5329e9c9e755d 100644 (file)
--- a/fs/file.c
+++ b/fs/file.c
@@ -654,6 +654,7 @@ int __close_fd_get_file(unsigned int fd, struct file **res)
        fdt = files_fdtable(files);
        if (fd >= fdt->max_fds)
                goto out_unlock;
+       fd = array_index_nospec(fd, fdt->max_fds);
        file = fdt->fd[fd];
        if (!file)
                goto out_unlock;