]> www.infradead.org Git - users/willy/xarray.git/commit
idr: Handle integer overflow correctly
authorMatthew Wilcox <willy@infradead.org>
Fri, 15 Feb 2019 20:08:36 +0000 (15:08 -0500)
committerMatthew Wilcox (Oracle) <willy@infradead.org>
Fri, 9 Aug 2019 01:38:16 +0000 (21:38 -0400)
commitec7ba201c8e7b37560cad8b97df9c78551476f71
tree863359cb4b751e326f1abb6066c63af9acb7e2f8
parentedfd903f77982a97daedbfb278e7a4deff546367
idr: Handle integer overflow correctly

If there is an entry at INT_MAX then idr_for_each_entry() will increment
id after handling it.  This is undefined behaviour, and is caught by
UBSAN.  Adding 1U to id forces the operation to be carried out as an
unsigned addition which (when assigned to id) will result in INT_MIN.
Since there is never an entry stored at INT_MIN, idr_get_next() will
return NULL, ending the loop as expected.

Signed-off-by: Matthew Wilcox <willy@infradead.org>
include/linux/idr.h