diff --git a/fs/file.c b/fs/file.c
index c942c89ca4cda90b94eaf724a2dabd63853bb52e..7893ea161d77075ca0ab524d7c8021ab668c0978 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -642,6 +642,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd)
 	if (fd >= fdt->max_fds)
 		return NULL;
 
+	fd = array_index_nospec(fd, fdt->max_fds);
 	file = fdt->fd[fd];
 	if (file) {
 		rcu_assign_pointer(fdt->fd[fd], NULL);