History

idr: Fix integer overflow in idr_for_each_entry

If there is an entry at INT_MAX then idr_for_each_entry() will increment id after handling it. This is undefined behaviour, and is caught by UBSAN. Adding 1U to id forces the operation to be carried out as an unsigned addition which (when assigned to id) will result in INT_MIN. Since there is never an entry stored at INT_MIN, idr_get_next() will return NULL, ending the loop as expected.

Matthew Wilcox (Oracle) committed 7 years ago

Commit f6341c51 parent 797060e1 file · +1 −1Browse files

Unified · Split

include/linux/idr.h+1−1
@@ -185,7 +185,7 @@ static inline void idr_preload_end(void) · 184 unmodified lines
185 * is convenient for a "not found" value.185 * is convenient for a "not found" value.
186 */186 */
187#define idr_for_each_entry(idr, entry, id) \187#define idr_for_each_entry(idr, entry, id) \
188 for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id)188 for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U)
189 189
190/**190/**
191 * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.191 * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t