The quilt patch titled
Subject: fs: prevent out-of-bounds array speculation when closing a file descriptor
has been removed from the -mm tree. Its filename was
fs-prevent-out-of-bounds-array-speculation-when-closing-a-file-descriptor.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: "Theodore Ts'o" <tytso@xxxxxxx>
Subject: fs: prevent out-of-bounds array speculation when closing a file descriptor
Date: Mon, 6 Mar 2023 13:54:50 -0500
Google-Bug-Id: 114199369
Link: https://lkml.kernel.org/r/20230306185450.1028235-1-tytso@xxxxxxx
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
--- a/fs/file.c~fs-prevent-out-of-bounds-array-speculation-when-closing-a-file-descriptor
+++ a/fs/file.c
@@ -642,6 +642,7 @@ static struct file *pick_file(struct fil
if (fd >= fdt->max_fds)
return NULL;
+ fd = array_index_nospec(fd, fdt->max_fds);
file = fdt->fd[fd];
if (file) {
rcu_assign_pointer(fdt->fd[fd], NULL);
_
Patches currently in -mm which might be from tytso@xxxxxxx are
