From: Matthew Wilcox (Oracle) Date: Sun, 3 Nov 2019 11:36:43 +0000 (-0500) Subject: idr: Fix integer overflow in idr_for_each_entry X-Git-Tag: Ubuntu-4.15.0-87.87~830 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=2323d3c7034940ed84c6f0b41d921a3bd0a44bf3;hp=8195d3e82ba8e6069b202552c6d9454e69ed5f25;p=mirror_ubuntu-bionic-kernel.git idr: Fix integer overflow in idr_for_each_entry BugLink: https://bugs.launchpad.net/bugs/1855787 [ Upstream commit f6341c5af4e6e15041be39976d16deca789555fa ] If there is an entry at INT_MAX then idr_for_each_entry() will increment id after handling it. This is undefined behaviour, and is caught by UBSAN. Adding 1U to id forces the operation to be carried out as an unsigned addition which (when assigned to id) will result in INT_MIN. Since there is never an entry stored at INT_MIN, idr_get_next() will return NULL, ending the loop as expected. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Sasha Levin Signed-off-by: Kamal Mostafa Signed-off-by: Kleber Sacilotto de Souza --- diff --git a/include/linux/idr.h b/include/linux/idr.h index fa14f834e4ed..51adb0b8dbc7 100644 --- a/include/linux/idr.h +++ b/include/linux/idr.h @@ -206,7 +206,7 @@ static inline void *idr_find(const struct idr *idr, int id) * is convenient for a "not found" value. */ #define idr_for_each_entry(idr, entry, id) \ - for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id) + for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U) #define idr_for_each_entry_ext(idr, entry, id) \ for (id = 0; ((entry) = idr_get_next_ext(idr, &(id))) != NULL; ++id)