shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 02:50:49 +09:00
Code Issues Packages Projects Releases Wiki Activity

protect the fetch of ->fd[fd] in do_dup2() from mispredictions

Browse Source 
commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 upstream.

both callers have verified that fd is not greater than ->max_fds;
however, misprediction might end up with
        tofree = fdt->fd[fd];
being speculatively executed.  That's wrong for the same reasons
why it's wrong in close_fd()/file_close_fd_locked(); the same
solution applies - array_index_nospec(fd, fdt->max_fds) could differ
from fd only in case of speculative execution on mispredicted path.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Al Viro
2024-08-01 15:22:22 -04:00
committed by Greg Kroah-Hartman
parent 36dac67972
commit 5db999fff5
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
fs/file.c
View File

@@ -1122,6 +1122,7 @@ __releases(&files->file_lock)
* tables and this condition does not arise without those. * tables and this condition does not arise without those.
*/ */
fdt = files_fdtable(files); fdt = files_fdtable(files);
fd = array_index_nospec(fd, fdt->max_fds);
tofree = fdt->fd[fd]; tofree = fdt->fd[fd];
if (!tofree && fd_is_open(fd, fdt)) if (!tofree && fd_is_open(fd, fdt))
goto Ebusy; goto Ebusy;