Similarly, other callers of idr_get_next_ul() suffer the same overflow bug as they don't handle it properly either. Introduce idr_for_each_entry_continue_ul() to help these callers iterate from a given ID. cls_flower needs more care here because it still has overflow when does arg->cookie++, we have to fold its nested loops into one and remove the arg->cookie++.
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -216,6 +216,20 @@ static inline void idr_preload_end(void) · 215 unmodified lines | ||
| 216 | 216 | entry; \ |
| 217 | 217 | ++id, (entry) = idr_get_next((idr), &(id))) |
| 218 | 218 | |
| 219 | +/** | |
| 220 | + * idr_for_each_entry_continue_ul() - Continue iteration over an IDR's elements of a given type | |
| 221 | + * @idr: IDR handle. | |
| 222 | + * @entry: The type * to use as a cursor. | |
| 223 | + * @tmp: A temporary placeholder for ID. | |
| 224 | + * @id: Entry ID. | |
| 225 | + * | |
| 226 | + * Continue to iterate over entries, continuing after the current position. | |
| 227 | + */ | |
| 228 | +#define idr_for_each_entry_continue_ul(idr, entry, tmp, id) \ | |
| 229 | + for (tmp = id; \ | |
| 230 | + tmp <= id && ((entry) = idr_get_next_ul(idr, &(id))) != NULL; \ | |
| 231 | + tmp = id, ++id) | |
| 232 | + | |
| 219 | 233 | /* |
| 220 | 234 | * IDA - ID Allocator, use when translation from id to pointer isn't necessary. |
| 221 | 235 | */ |