Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a30b595d authored by David Rientjes's avatar David Rientjes Committed by Linus Torvalds
Browse files

flex_array: fix get function for elements in base starting at non-zero 



If all array elements fit into the base structure and data is copied using
flex_array_put() starting at a non-zero index, flex_array_get() will fail
to return the data.

This fixes the bug by only checking for NULL parts when all elements do
not fit in the base structure when flex_array_get() is used.  Otherwise,
fa_element_to_part_nr() will always be 0 since there are no parts
structures needed and such element may never have been put.  Thus, it will
remain NULL due to the kzalloc() of the base.

Additionally, flex_array_put() now only checks for a NULL part when all
elements do not fit in the base structure.  This is otherwise unnecessary
since the base structure is guaranteed to exist (or we would have already
hit a NULL pointer).

Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
Acked-by: default avatarDave Hansen <dave@linux.vnet.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 054b2b13

lib/flex_array.c

+8 −6
Original line number Diff line number Diff line
@@ -198,10 +198,11 @@ int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags 
		return -ENOSPC;

	if (elements_fit_in_base(fa))

		part = (struct flex_array_part *)&fa->parts[0];

	else

	else {

		part = __fa_get_part(fa, part_nr, flags);

		if (!part)

			return -ENOMEM;

	}

	dst = &part->elements[index_inside_part(fa, element_nr)];

	memcpy(dst, src, fa->element_size);

	return 0;
@@ -257,11 +258,12 @@ void *flex_array_get(struct flex_array *fa, int element_nr) 


	if (element_nr >= fa->total_nr_elements)

		return NULL;

	if (!fa->parts[part_nr])

		return NULL;

	if (elements_fit_in_base(fa))

		part = (struct flex_array_part *)&fa->parts[0];

	else

	else {

		part = fa->parts[part_nr];

		if (!part)

			return NULL;

	}

	return &part->elements[index_inside_part(fa, element_nr)];

}