Skip to content

Commit

Permalink
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
Browse files Browse the repository at this point in the history
both callers have verified that fd is not greater than ->max_fds;
however, misprediction might end up with
        tofree = fdt->fd[fd];
being speculatively executed.  That's wrong for the same reasons
why it's wrong in close_fd()/file_close_fd_locked(); the same
solution applies - array_index_nospec(fd, fdt->max_fds) could differ
from fd only in case of speculative execution on mispredicted path.

Cc: [email protected]
Signed-off-by: Al Viro <[email protected]>
  • Loading branch information
Al Viro committed Aug 1, 2024
1 parent 8400291 commit 8aa37bd
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions fs/file.c
Original file line number Diff line number Diff line change
Expand Up @@ -1248,6 +1248,7 @@ __releases(&files->file_lock)
* tables and this condition does not arise without those.
*/
fdt = files_fdtable(files);
fd = array_index_nospec(fd, fdt->max_fds);
tofree = fdt->fd[fd];
if (!tofree && fd_is_open(fd, fdt))
goto Ebusy;
Expand Down

0 comments on commit 8aa37bd

Please sign in to comment.