Similarly, other callers of idr_get_next_ul() suffer the same overflow bug as they don't handle it properly either. Introduce idr_for_each_entry_continue_ul() to help these callers iterate from a given ID. cls_flower needs more care here because it still has overflow when does arg->cookie++, we have to fold its nested loops into one and remove the arg->cookie++.
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -216,6 +216,20 @@ static inline void idr_preload_end(void) · 215 unmodified lines | |||
| 216 | entry; \ | 216 | entry; \ |
| 217 | ++id, (entry) = idr_get_next((idr), &(id))) | 217 | ++id, (entry) = idr_get_next((idr), &(id))) |
| 218 | 218 | ||
| 219 | /** | ||
| 220 | * idr_for_each_entry_continue_ul() - Continue iteration over an IDR's elements of a given type | ||
| 221 | * @idr: IDR handle. | ||
| 222 | * @entry: The type * to use as a cursor. | ||
| 223 | * @tmp: A temporary placeholder for ID. | ||
| 224 | * @id: Entry ID. | ||
| 225 | * | ||
| 226 | * Continue to iterate over entries, continuing after the current position. | ||
| 227 | */ | ||
| 228 | #define idr_for_each_entry_continue_ul(idr, entry, tmp, id) \ | ||
| 229 | for (tmp = id; \ | ||
| 230 | tmp <= id && ((entry) = idr_get_next_ul(idr, &(id))) != NULL; \ | ||
| 231 | tmp = id, ++id) | ||
| 232 | |||
| 219 | /* | 233 | /* |
| 220 | * IDA - ID Allocator, use when translation from id to pointer isn't necessary. | 234 | * IDA - ID Allocator, use when translation from id to pointer isn't necessary. |
| 221 | */ | 235 | */ |