Commit 2411e3b5 authored by Al Viro's avatar Al Viro Committed by Long Li
Browse files

protect the fetch of ->fd[fd] in do_dup2() from mispredictions 

stable inclusion
from stable-v4.19.319
commit ed42e8ff509d2a61c6642d1825032072dab79f26
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPUO
CVE: CVE-2024-42265

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=tags/v4.19.320&id=ed42e8ff509d2a61c6642d1825032072dab79f26



--------------------------------

commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 upstream.

both callers have verified that fd is not greater than ->max_fds;
however, misprediction might end up with
        tofree = fdt->fd[fd];
being speculatively executed.  That's wrong for the same reasons
why it's wrong in close_fd()/file_close_fd_locked(); the same
solution applies - array_index_nospec(fd, fdt->max_fds) could differ
from fd only in case of speculative execution on mispredicted path.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Conflicts:
	fs/file.c
[conflict due to mergered commit 52cc1eccf6de ("cgroups: Resource
controller for open files")]
Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
parent 31e825c6

fs/file.c

+1 −0
Original line number Diff line number Diff line
@@ -978,6 +978,7 @@ __releases(&files->file_lock) 
	 * tables and this condition does not arise without those.

	 */

	fdt = files_fdtable(files);

	fd = array_index_nospec(fd, fdt->max_fds);

	tofree = fdt->fd[fd];

	if (!tofree && fd_is_open(fd, fdt)) {

		err = -EBUSY;