diff options
author | Matthew Wilcox (Oracle) <willy@infradead.org> | 2020-01-31 05:07:55 -0500 |
---|---|---|
committer | Matthew Wilcox (Oracle) <willy@infradead.org> | 2020-01-31 15:09:36 -0500 |
commit | bd40b17ca49d7d110adf456e647701ce74de2241 (patch) | |
tree | 5b08f821b4204ae3698a8763f63a8d66b73da381 /Documentation/RCU | |
parent | d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 (diff) |
XArray: Fix xa_find_next for large multi-index entries
Coverity pointed out that xas_sibling() was shifting xa_offset without
promoting it to an unsigned long first, so the shift could cause an
overflow and we'd get the wrong answer. The fix is obvious, and the
new test-case provokes UBSAN to report an error:
runtime error: shift exponent 60 is too large for 32-bit type 'int'
Fixes: 19c30f4dd092 ("XArray: Fix xa_find_after with multi-index entries")
Reported-by: Bjorn Helgaas <bhelgaas@google.com>
Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org
Diffstat (limited to 'Documentation/RCU')
0 files changed, 0 insertions, 0 deletions