fs: prevent out-of-bounds array speculation when closing a file descriptor

commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.

Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/file.c b/fs/file.c
index 214364e19d76f45b87509eb945a93d759fab8570..ee1c350ec58a2cb458c6c40057df85a292d36dd2 100644 (file)
--- a/fs/file.c
+++ b/fs/file.c
@@ -646,6 +646,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd)
                file = ERR_PTR(-EINVAL);
                goto out_unlock;
        }
+       fd = array_index_nospec(fd, fdt->max_fds);
        file = fdt->fd[fd];
        if (!file) {
                file = ERR_PTR(-EBADF);