fs: prevent out-of-bounds array speculation when closing a file descriptor
commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream. Google-Bug-Id: 114199369 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
4f95ee925a
commit
3d5d9501b6
1 changed files with 1 additions and 0 deletions
|
@ -627,6 +627,7 @@ int __close_fd(struct files_struct *files, unsigned fd)
|
|||
fdt = files_fdtable(files);
|
||||
if (fd >= fdt->max_fds)
|
||||
goto out_unlock;
|
||||
fd = array_index_nospec(fd, fdt->max_fds);
|
||||
file = fdt->fd[fd];
|
||||
if (!file)
|
||||
goto out_unlock;
|
||||
|
|
Loading…
Reference in a new issue