ich777/linux_media
1
0
Fork 0
mirror of https://github.com/tbsdtv/linux_media.git synced 2025-07-23 04:33:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

XArray: Fix infinite loop with entry at ULONG_MAX

Browse Source 
If there is an entry at ULONG_MAX, xa_for_each() will overflow the
'index + 1' in xa_find_after() and wrap around to 0.  Catch this case
and terminate the loop by returning NULL.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org
This commit is contained in:
Matthew Wilcox (Oracle)
2020-01-17 17:45:12 -05:00
parent 82a958497d
commit 430f24f94c
2 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/test_xarray.c
View File

@@ -1046,11 +1046,28 @@ static noinline void check_find_3(struct xarray *xa)
xa_destroy(xa);
}
static noinline void check_find_4(struct xarray *xa)
{
unsigned long index = 0;
void *entry;
xa_store_index(xa, ULONG_MAX, GFP_KERNEL);
entry = xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT);
XA_BUG_ON(xa, entry != xa_mk_index(ULONG_MAX));
entry = xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT);
XA_BUG_ON(xa, entry);
xa_erase_index(xa, ULONG_MAX);
}
static noinline void check_find(struct xarray *xa)
{
check_find_1(xa);
check_find_2(xa);
check_find_3(xa);
check_find_4(xa);
check_multi_find(xa);
check_multi_find_2(xa);
}