From: Matthew Wilcox Date: Fri, 15 Feb 2019 20:08:36 +0000 (-0500) Subject: idr: Handle integer overflow correctly X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=ec7ba201c8e7b37560cad8b97df9c78551476f71;p=users%2Fwilly%2Fxarray.git idr: Handle integer overflow correctly If there is an entry at INT_MAX then idr_for_each_entry() will increment id after handling it. This is undefined behaviour, and is caught by UBSAN. Adding 1U to id forces the operation to be carried out as an unsigned addition which (when assigned to id) will result in INT_MIN. Since there is never an entry stored at INT_MIN, idr_get_next() will return NULL, ending the loop as expected. Signed-off-by: Matthew Wilcox --- diff --git a/include/linux/idr.h b/include/linux/idr.h index 6e556350857a..13bb71eb4fd9 100644 --- a/include/linux/idr.h +++ b/include/linux/idr.h @@ -136,7 +136,7 @@ static inline bool idr_is_empty(const struct idr *idr) * is convenient for a "not found" value. */ #define idr_for_each_entry(idr, entry, id) \ - for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id) + for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U) /** * idr_for_each_entry_continue() - Continue iteration over an IDR's elements of a given type