Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0cec640d authored by Matthew Wilcox (Oracle)'s avatar Matthew Wilcox (Oracle) Committed by Greg Kroah-Hartman
Browse files

idr: Fix idr_get_next_ul race with idr_remove 



[ Upstream commit 5a74ac4c4a97bd8b7dba054304d598e2a882fea6 ]

Commit 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove")
neglected to fix idr_get_next_ul().  As far as I can tell, nobody's
actually using this interface under the RCU read lock, but fix it now
before anybody decides to use it.

Fixes: 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove")
Signed-off-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 052d878c

lib/idr.c

+11 −20
Original line number Original line Diff line number Diff line
@@ -218,7 +218,7 @@ int idr_for_each(const struct idr *idr, 
EXPORT_SYMBOL(idr_for_each);

EXPORT_SYMBOL(idr_for_each);





/**

/**

 * idr_get_next() - Find next populated entry.

 * idr_get_next_ul() - Find next populated entry.

 * @idr: IDR handle.

 * @idr: IDR handle.

 * @nextid: Pointer to an ID.

 * @nextid: Pointer to an ID.

 *

 *
@@ -227,7 +227,7 @@ EXPORT_SYMBOL(idr_for_each); 
 * to the ID of the found value.  To use in a loop, the value pointed to by

 * to the ID of the found value.  To use in a loop, the value pointed to by

 * nextid must be incremented by the user.

 * nextid must be incremented by the user.

 */

 */

void *idr_get_next(struct idr *idr, int *nextid)

void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)

{

{

	struct radix_tree_iter iter;

	struct radix_tree_iter iter;

	void __rcu **slot;

	void __rcu **slot;
@@ -249,18 +249,14 @@ void *idr_get_next(struct idr *idr, int *nextid) 
	}

	}

	if (!slot)

	if (!slot)

		return NULL;

		return NULL;

	id = iter.index + base;



	if (WARN_ON_ONCE(id > INT_MAX))

		return NULL;





	*nextid = id;

	*nextid = iter.index + base;

	return entry;

	return entry;

}

}

EXPORT_SYMBOL(idr_get_next);

EXPORT_SYMBOL(idr_get_next_ul);





/**

/**

 * idr_get_next_ul() - Find next populated entry.

 * idr_get_next() - Find next populated entry.

 * @idr: IDR handle.

 * @idr: IDR handle.

 * @nextid: Pointer to an ID.

 * @nextid: Pointer to an ID.

 *

 *
@@ -269,22 +265,17 @@ EXPORT_SYMBOL(idr_get_next); 
 * to the ID of the found value.  To use in a loop, the value pointed to by

 * to the ID of the found value.  To use in a loop, the value pointed to by

 * nextid must be incremented by the user.

 * nextid must be incremented by the user.

 */

 */

void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)

void *idr_get_next(struct idr *idr, int *nextid)

{

{

	struct radix_tree_iter iter;

	void __rcu **slot;

	unsigned long base = idr->idr_base;

	unsigned long id = *nextid;

	unsigned long id = *nextid;

	void *entry = idr_get_next_ul(idr, &id);





	id = (id < base) ? 0 : id - base;

	if (WARN_ON_ONCE(id > INT_MAX))

	slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);

	if (!slot)

		return NULL;

		return NULL;



	*nextid = id;

	*nextid = iter.index + base;

	return entry;

	return rcu_dereference_raw(*slot);

}

}

EXPORT_SYMBOL(idr_get_next_ul);

EXPORT_SYMBOL(idr_get_next);





/**

/**

 * idr_replace() - replace pointer for given ID.

 * idr_replace() - replace pointer for given ID.