redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

XArray: Fix infinite loop with entry at ULONG_MAX 

commit 430f24f94c upstream.

If there is an entry at ULONG_MAX, xa_for_each() will overflow the
'index + 1' in xa_find_after() and wrap around to 0.  Catch this case
and terminate the loop by returning NULL.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
5.4-rM2-2.2.x-imx-squashed
Matthew Wilcox (Oracle) 2020-01-17 17:45:12 -05:00 committed by Greg Kroah-Hartman
parent b8560e3d90
commit a5135ca1f9
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
lib/test_xarray.c
View File

@ -1046,11 +1046,28 @@ static noinline void check_find_3(struct xarray *xa)
xa_destroy(xa);
}
static noinline void check_find_4(struct xarray *xa)
{
unsigned long index = 0;
void *entry;
xa_store_index(xa, ULONG_MAX, GFP_KERNEL);
entry = xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT);
XA_BUG_ON(xa, entry != xa_mk_index(ULONG_MAX));
entry = xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT);
XA_BUG_ON(xa, entry);
xa_erase_index(xa, ULONG_MAX);
}
static noinline void check_find(struct xarray *xa)
{
check_find_1(xa);
check_find_2(xa);
check_find_3(xa);
check_find_4(xa);
check_multi_find(xa);
check_multi_find_2(xa);
}

3
lib/xarray.c
View File

@ -1847,6 +1847,9 @@ void *xa_find_after(struct xarray *xa, unsigned long *indexp,
XA_STATE(xas, xa, *indexp + 1);
void *entry;
if (xas.xa_index == 0)
return NULL;
rcu_read_lock();
for (;;) {
if ((__force unsigned int)filter < XA_MAX_MARKS)