This is a note to let you know that I've just added the patch titled
fs: prevent out-of-bounds array speculation when closing a file descriptor
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fs-prevent-out-of-bounds-array-speculation-when-closing-a-file-descriptor.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 609d54441493c99f21c1823dfd66fa7f4c512ff4 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@xxxxxxx>
Date: Mon, 6 Mar 2023 13:54:50 -0500
Subject: fs: prevent out-of-bounds array speculation when closing a file descriptor
From: Theodore Ts'o <tytso@xxxxxxx>
commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.
Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/file.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/file.c
+++ b/fs/file.c
@@ -629,6 +629,7 @@ int __close_fd(struct files_struct *file
fdt = files_fdtable(files);
if (fd >= fdt->max_fds)
goto out_unlock;
+ fd = array_index_nospec(fd, fdt->max_fds);
file = fdt->fd[fd];
if (!file)
goto out_unlock;
Patches currently in stable-queue which might be from tytso@xxxxxxx are
queue-4.14/ext4-fix-rename_whiteout-handling-for-inline-directories.patch
queue-4.14/ext4-zero-i_disksize-when-initializing-the-bootloader-inode.patch
queue-4.14/fs-prevent-out-of-bounds-array-speculation-when-closing-a-file-descriptor.patch
queue-4.14/ext4-move-where-set-the-may_inline_data-flag-is-set.patch
queue-4.14/ext4-fix-another-off-by-one-fsmap-error-on-1k-block-filesystems.patch
queue-4.14/ext4-fix-warning-in-ext4_update_inline_data.patch
