OrgACRN
/
acrn-kernel
mirror of https://github.com/projectacrn/acrn-kernel.git
1
0
Fork 0
Code Issues Releases Wiki Activity

lib/generic-radix-tree.c: Don't overflow in peek() 

[ Upstream commit 9492261ff2460252cf2d8de89cdf854c7e2b28a0 ]

When we started spreading new inode numbers throughout most of the 64
bit inode space, that triggered some corner case bugs, in particular
some integer overflows related to the radix tree code. Oops.

Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Kent Overstreet 2021-02-12 20:11:25 -05:00 committed by Greg Kroah-Hartman
parent c56df79d68
commit 784d01f9bb
2 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
include/linux/generic-radix-tree.h
View File

@ -38,6 +38,7 @@
#include <asm/page.h>
#include <linux/bug.h>
#include <linux/limits.h>
#include <linux/log2.h>
#include <linux/math.h>
#include <linux/types.h>
@ -184,6 +185,12 @@ void *__genradix_iter_peek(struct genradix_iter *, struct __genradix *, size_t);
static inline void __genradix_iter_advance(struct genradix_iter *iter,
size_t obj_size)
{
if (iter->offset + obj_size < iter->offset) {
iter->offset = SIZE_MAX;
iter->pos = SIZE_MAX;
return;
}
iter->offset += obj_size;
if (!is_power_of_2(obj_size) &&

17
lib/generic-radix-tree.c
View File

@ -166,6 +166,10 @@ void *__genradix_iter_peek(struct genradix_iter *iter,
struct genradix_root *r;
struct genradix_node *n;
unsigned level, i;
if (iter->offset == SIZE_MAX)
return NULL;
restart:
r = READ_ONCE(radix->root);
if (!r)
@ -184,10 +188,17 @@ void *__genradix_iter_peek(struct genradix_iter *iter,
(GENRADIX_ARY - 1);
while (!n->children[i]) {
size_t objs_per_ptr = genradix_depth_size(level);
if (iter->offset + objs_per_ptr < iter->offset) {
iter->offset = SIZE_MAX;
iter->pos = SIZE_MAX;
return NULL;
}
i++;
iter->offset = round_down(iter->offset +
genradix_depth_size(level),
genradix_depth_size(level));
iter->offset = round_down(iter->offset + objs_per_ptr,
objs_per_ptr);
iter->pos = (iter->offset >> PAGE_SHIFT) *
objs_per_page;
if (i == GENRADIX_ARY)