]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
XArray: Fix xa_find_next for large multi-index entries
authorMatthew Wilcox (Oracle) <willy@infradead.org>
Fri, 31 Jan 2020 10:07:55 +0000 (05:07 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Apr 2020 07:09:59 +0000 (09:09 +0200)
commit5b0c20f436b693a44971ad5c73f905e23825992b
tree8dea3ac55bebc27063caa88bd6594578155dba0d
parent4b3e6c11d430471beee643b537a3d6071857c40b
XArray: Fix xa_find_next for large multi-index entries

[ Upstream commit bd40b17ca49d7d110adf456e647701ce74de2241 ]

Coverity pointed out that xas_sibling() was shifting xa_offset without
promoting it to an unsigned long first, so the shift could cause an
overflow and we'd get the wrong answer.  The fix is obvious, and the
new test-case provokes UBSAN to report an error:
runtime error: shift exponent 60 is too large for 32-bit type 'int'

Fixes: 19c30f4dd092 ("XArray: Fix xa_find_after with multi-index entries")
Reported-by: Bjorn Helgaas <bhelgaas@google.com>
Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
lib/test_xarray.c
lib/xarray.c