This is a note to let you know that I've just added the patch titled
fs: prevent out-of-bounds array speculation when closing a file descriptor
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fs-prevent-out-of-bounds-array-speculation-when-closing-a-file-descriptor.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 609d54441493c99f21c1823dfd66fa7f4c512ff4 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@xxxxxxx>
Date: Mon, 6 Mar 2023 13:54:50 -0500
Subject: fs: prevent out-of-bounds array speculation when closing a file descriptor
From: Theodore Ts'o <tytso@xxxxxxx>
commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.
Google-Bug-Id: 114199369
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/file.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/file.c
+++ b/fs/file.c
@@ -646,6 +646,7 @@ static struct file *pick_file(struct fil
file = ERR_PTR(-EINVAL);
goto out_unlock;
}
+ fd = array_index_nospec(fd, fdt->max_fds);
file = fdt->fd[fd];
if (!file) {
file = ERR_PTR(-EBADF);
Patches currently in stable-queue which might be from tytso@xxxxxxx are
queue-5.15/ext4-fix-rename_whiteout-handling-for-inline-directories.patch
queue-5.15/ext4-zero-i_disksize-when-initializing-the-bootloader-inode.patch
queue-5.15/fs-prevent-out-of-bounds-array-speculation-when-closing-a-file-descriptor.patch
queue-5.15/ext4-move-where-set-the-may_inline_data-flag-is-set.patch
queue-5.15/ext4-fix-cgroup-writeback-accounting-with-fs-layer-encryption.patch
queue-5.15/ext4-fix-another-off-by-one-fsmap-error-on-1k-block-filesystems.patch
queue-5.15/ext4-fix-warning-in-ext4_update_inline_data.patch
