]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
idr: Fix integer overflow in idr_for_each_entry
authorMatthew Wilcox (Oracle) <willy@infradead.org>
Sun, 3 Nov 2019 11:36:43 +0000 (06:36 -0500)
committerMarcelo Henrique Cerri <marcelo.cerri@canonical.com>
Fri, 17 Jan 2020 17:21:51 +0000 (14:21 -0300)
commit2323d3c7034940ed84c6f0b41d921a3bd0a44bf3
tree30591eb0c5875aae7262f2e7edae0f00ab57df3f
parent8195d3e82ba8e6069b202552c6d9454e69ed5f25
idr: Fix integer overflow in idr_for_each_entry

BugLink: https://bugs.launchpad.net/bugs/1855787
[ Upstream commit f6341c5af4e6e15041be39976d16deca789555fa ]

If there is an entry at INT_MAX then idr_for_each_entry() will increment
id after handling it.  This is undefined behaviour, and is caught by
UBSAN.  Adding 1U to id forces the operation to be carried out as an
unsigned addition which (when assigned to id) will result in INT_MIN.
Since there is never an entry stored at INT_MIN, idr_get_next() will
return NULL, ending the loop as expected.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
include/linux/idr.h