]> git.baikalelectronics.ru Git - kernel.git/commit
idr: Fix integer overflow in idr_for_each_entry
authorMatthew Wilcox (Oracle) <willy@infradead.org>
Sun, 3 Nov 2019 11:36:43 +0000 (06:36 -0500)
committerMatthew Wilcox (Oracle) <willy@infradead.org>
Sun, 3 Nov 2019 11:36:43 +0000 (06:36 -0500)
commit6fbcb1eb02a044047b5b1fc26b2a85b29cd1c9d7
tree46eddef8563735d4465c1903d662e5b790ac44be
parent5ae31e35a0a2dc03c8c8b859eb8a284b3b5854de
idr: Fix integer overflow in idr_for_each_entry

If there is an entry at INT_MAX then idr_for_each_entry() will increment
id after handling it.  This is undefined behaviour, and is caught by
UBSAN.  Adding 1U to id forces the operation to be carried out as an
unsigned addition which (when assigned to id) will result in INT_MIN.
Since there is never an entry stored at INT_MIN, idr_get_next() will
return NULL, ending the loop as expected.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
include/linux/idr.h