Patch "fs: prevent out-of-bounds array speculation when closing a file descriptor" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    fs: prevent out-of-bounds array speculation when closing a file descriptor

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fs-prevent-out-of-bounds-array-speculation-when-closing-a-file-descriptor.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From 609d54441493c99f21c1823dfd66fa7f4c512ff4 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@xxxxxxx>
Date: Mon, 6 Mar 2023 13:54:50 -0500
Subject: fs: prevent out-of-bounds array speculation when closing a file descriptor

From: Theodore Ts'o <tytso@xxxxxxx>

commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.

Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 fs/file.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/file.c
+++ b/fs/file.c
@@ -627,6 +627,7 @@ int __close_fd(struct files_struct *file
 	fdt = files_fdtable(files);
 	if (fd >= fdt->max_fds)
 		goto out_unlock;
+	fd = array_index_nospec(fd, fdt->max_fds);
 	file = fdt->fd[fd];
 	if (!file)
 		goto out_unlock;


Patches currently in stable-queue which might be from tytso@xxxxxxx are

queue-4.19/ext4-fix-rename_whiteout-handling-for-inline-directories.patch
queue-4.19/ext4-zero-i_disksize-when-initializing-the-bootloader-inode.patch
queue-4.19/fs-prevent-out-of-bounds-array-speculation-when-closing-a-file-descriptor.patch
queue-4.19/ext4-move-where-set-the-may_inline_data-flag-is-set.patch
queue-4.19/ext4-fix-another-off-by-one-fsmap-error-on-1k-block-filesystems.patch
queue-4.19/ext4-fix-warning-in-ext4_update_inline_data.patch



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux