From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 1 Aug 2024 19:22:22 +0000 (-0400)
Subject: protect the fetch of ->fd[fd] in do_dup2() from mispredictions
X-Git-Tag: v6.11-rc2~26^2
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=8aa37bde1a7b645816cda8b80df4753ecf172bf1;p=users%2Fhch%2Fmisc.git

protect the fetch of ->fd[fd] in do_dup2() from mispredictions

both callers have verified that fd is not greater than ->max_fds;
however, misprediction might end up with
        tofree = fdt->fd[fd];
being speculatively executed.  That's wrong for the same reasons
why it's wrong in close_fd()/file_close_fd_locked(); the same
solution applies - array_index_nospec(fd, fdt->max_fds) could differ
from fd only in case of speculative execution on mispredicted path.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/fs/file.c b/fs/file.c
index a3b72aa64f11..a11e59b5d602 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -1248,6 +1248,7 @@ __releases(&files->file_lock)
 	 * tables and this condition does not arise without those.
 	 */
 	fdt = files_fdtable(files);
+	fd = array_index_nospec(fd, fdt->max_fds);
 	tofree = fdt->fd[fd];
 	if (!tofree && fd_is_open(fd, fdt))
 		goto Ebusy;