diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2023-03-11 06:04:10 +0300 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2023-03-11 06:04:10 +0300 |
| commit | 4831f76247bc939ed1b6d71ddd23337ec8b56b8e (patch) | |
| tree | fae332017a782d0fa48c64944624a349f493c0f3 /fs | |
| parent | a0aefd306ebb394ea72e04f53f64d76b05d5e39f (diff) | |
| parent | 609d54441493c99f21c1823dfd66fa7f4c512ff4 (diff) | |
| download | linux-4831f76247bc939ed1b6d71ddd23337ec8b56b8e.tar.xz | |
Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull misc fixes from Al Viro:
"pick_file() speculation fix + fix for alpha mis(merge,cherry-pick)
The fs/file.c one is a genuine missing speculation barrier in
pick_file() (reachable e.g. via close(2)). The alpha one is strictly
speaking not a bug fix, but only because confusion between
preempt_enable() and preempt_disable() is harmless on architecture
without CONFIG_PREEMPT.
Looks like alpha.git picked the wrong version of patch - that braino
used to be there in early versions, but it had been fixed quite a
while ago..."
* tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
fs: prevent out-of-bounds array speculation when closing a file descriptor
alpha: fix lazy-FPU mis(merged/applied/whatnot)
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/file.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/file.c b/fs/file.c index c942c89ca4cd..7893ea161d77 100644 --- a/fs/file.c +++ b/fs/file.c @@ -642,6 +642,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd) if (fd >= fdt->max_fds) return NULL; + fd = array_index_nospec(fd, fdt->max_fds); file = fdt->fd[fd]; if (file) { rcu_assign_pointer(fdt->fd[fd], NULL); |