mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 06:10:56 +00:00
pick_file() speculation fix + fix for alpha mis(merge,cherry-pick)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQQqUNBr3gm4hGXdBJlZ7Krx/gZQ6wUCZAuQ7gAKCRBZ7Krx/gZQ 6xSmAPsFPc3ykvOWwCl7eTGS65gHZpK80e5lX9kZB8KIa5JjaAEA551vgRWi34+D PWvDDpN1QUFL6HHL+FR7heLJr2SKIwA= =RsPH -----END PGP SIGNATURE----- Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc fixes from Al Viro: "pick_file() speculation fix + fix for alpha mis(merge,cherry-pick) The fs/file.c one is a genuine missing speculation barrier in pick_file() (reachable e.g. via close(2)). The alpha one is strictly speaking not a bug fix, but only because confusion between preempt_enable() and preempt_disable() is harmless on architecture without CONFIG_PREEMPT. Looks like alpha.git picked the wrong version of patch - that braino used to be there in early versions, but it had been fixed quite a while ago..." * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: prevent out-of-bounds array speculation when closing a file descriptor alpha: fix lazy-FPU mis(merged/applied/whatnot)
This commit is contained in:
commit
4831f76247
2 changed files with 3 additions and 2 deletions
|
@ -23,7 +23,7 @@ alpha_read_fp_reg (unsigned long reg)
|
|||
|
||||
if (unlikely(reg >= 32))
|
||||
return 0;
|
||||
preempt_enable();
|
||||
preempt_disable();
|
||||
if (current_thread_info()->status & TS_SAVED_FP)
|
||||
val = current_thread_info()->fp[reg];
|
||||
else switch (reg) {
|
||||
|
@ -133,7 +133,7 @@ alpha_read_fp_reg_s (unsigned long reg)
|
|||
if (unlikely(reg >= 32))
|
||||
return 0;
|
||||
|
||||
preempt_enable();
|
||||
preempt_disable();
|
||||
if (current_thread_info()->status & TS_SAVED_FP) {
|
||||
LDT(0, current_thread_info()->fp[reg]);
|
||||
STS(0, val);
|
||||
|
|
|
@ -642,6 +642,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd)
|
|||
if (fd >= fdt->max_fds)
|
||||
return NULL;
|
||||
|
||||
fd = array_index_nospec(fd, fdt->max_fds);
|
||||
file = fdt->fd[fd];
|
||||
if (file) {
|
||||
rcu_assign_pointer(fdt->fd[fd], NULL);
|
||||
|
|
Loading…
Reference in a new issue