From d92f640ed04e4a22da33711af934af5edfa74e68 Mon Sep 17 00:00:00 2001 From: Zhang Enpei Date: Fri, 27 Jun 2025 15:08:25 +0800 Subject: [PATCH] protect the fetch of ->fd[fd] in do_dup2() from mispredictions commit da72e783afd27d9f487836b2e6738146c0edd149 upstream. commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 upstream. both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path. Cc: stable@vger.kernel.org Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman Fixes: CVE-2024-42265 Signed-off-by: Enpei Zhang Signed-off-by: Wenya Zhang Reviewed-by: Xuexin Jiang --- fs/file.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/file.c b/fs/file.c index 578864368f6d..cdee1ff8cf42 100644 --- a/fs/file.c +++ b/fs/file.c @@ -1208,6 +1208,7 @@ __releases(&files->file_lock) * tables and this condition does not arise without those. */ fdt = files_fdtable(files); + fd = array_index_nospec(fd, fdt->max_fds); tofree = fdt->fd[fd]; if (!tofree && fd_is_open(fd, fdt)) goto Ebusy; -- Gitee