From: Al Viro viro@zeniv.linux.org.uk

stable inclusion from stable-v5.10.223 commit 08775b3d6ed117cf4518754ec7300ee42b6a5368 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPUO CVE: CVE-2024-42265

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=t...

--------------------------------

commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 upstream.

both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path.

Cc: stable@vger.kernel.org Signed-off-by: Al Viro viro@zeniv.linux.org.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Long Li leo.lilong@huawei.com --- fs/file.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/fs/file.c b/fs/file.c index f1b6faa87e3d..4ad1eaac9f5d 100644 --- a/fs/file.c +++ b/fs/file.c @@ -1128,6 +1128,7 @@ __releases(&files->file_lock) * tables and this condition does not arise without those. */ fdt = files_fdtable(files); + fd = array_index_nospec(fd, fdt->max_fds); tofree = fdt->fd[fd]; if (!tofree && fd_is_open(fd, fdt)) { err = -EBUSY;