diff options
| author | Matthew Wilcox (Oracle) <willy@infradead.org> | 2020-01-31 05:07:55 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-04-08 09:08:40 +0200 |
| commit | 16696ee7b58101c90bf21c3ab2443c57df4af24e (patch) | |
| tree | 3c781b5e80356d9e2f08cb74c1cacabb0b390310 /lib/xarray.c | |
| parent | 4eb33cb9b56666ee59b291caab046588dd6b66eb (diff) | |
XArray: Fix xa_find_next for large multi-index entries
[ Upstream commit bd40b17ca49d7d110adf456e647701ce74de2241 ]
Coverity pointed out that xas_sibling() was shifting xa_offset without
promoting it to an unsigned long first, so the shift could cause an
overflow and we'd get the wrong answer. The fix is obvious, and the
new test-case provokes UBSAN to report an error:
runtime error: shift exponent 60 is too large for 32-bit type 'int'
Fixes: 19c30f4dd092 ("XArray: Fix xa_find_after with multi-index entries")
Reported-by: Bjorn Helgaas <bhelgaas@google.com>
Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'lib/xarray.c')
| -rw-r--r-- | lib/xarray.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/xarray.c b/lib/xarray.c index 1d9fab7db8da..acd1fad2e862 100644 --- a/lib/xarray.c +++ b/lib/xarray.c @@ -1839,7 +1839,8 @@ static bool xas_sibling(struct xa_state *xas) if (!node) return false; mask = (XA_CHUNK_SIZE << node->shift) - 1; - return (xas->xa_index & mask) > (xas->xa_offset << node->shift); + return (xas->xa_index & mask) > + ((unsigned long)xas->xa_offset << node->shift); } /** |