Tejun Heo ffb48adac0 idr: fix a subtle bug in idr_get_next() ... commit 6cdae7416a upstream. The iteration logic of idr_get_next() is borrowed mostly verbatim from idr_for_each(). It walks down the tree looking for the slot matching the current ID. If the matching slot is not found, the ID is incremented by the distance of single slot at the given level and repeats. The implementation assumes that during the whole iteration id is aligned to the layer boundaries of the level closest to the leaf, which is true for all iterations starting from zero or an existing element and thus is fine for idr_for_each(). However, idr_get_next() may be given any point and if the starting id hits in the middle of a non-existent layer, increment to the next layer will end up skipping the same offset into it. For example, an IDR with IDs filled between [64, 127] would look like the following. [ 0 64 ... ] /----/ | | | NULL [ 64 ... 127 ] If idr_get_next() is called with 63 as the starting point, it will try to follow down the pointer from 0. As it is NULL, it will then try to proceed to the next slot in the same level by adding the slot distance at that level which is 64 - making the next try 127. It goes around the loop and finds and returns 127 skipping [64, 126]. Note that this bug also triggers in idr_for_each_entry() loop which deletes during iteration as deletions can make layers go away leaving the iteration with unaligned ID into missing layers. Fix it by ensuring proceeding to the next slot doesn't carry over the unaligned offset - ie. use round_up(id + 1, slot_distance) instead of id += slot_distance. Bug: 19665182 Bug: 18069309 Bug: 19236185 Change-Id: Iddd4b6fb27c39d7607bc778fc00bafe6ec289478 Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: David Teigland <teigland@redhat.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-03-11 21:59:58 -07:00
..
lzo
mpi	mpi: Avoid using freed pointer in mpi_lshift_limbs()	2012-04-18 12:14:28 +10:00
raid6	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
reed_solomon
xz
zlib_deflate
zlib_inflate
.gitignore
argv_split.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
atomic64.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
atomic64_test.c	bug.h: add include of it to various implicit C users	2012-02-29 17:15:08 -05:00
audit.c
average.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
bcd.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
bch.c
bitmap.c	lib: add bitmap_find_next_zero_area_off()	2013-02-20 01:32:25 -08:00
bitrev.c
bsearch.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
btree.c	btree: export btree_get_prev() so modules can use btree_for_each	2012-01-10 16:30:49 -08:00
bug.c	bugs, x86: Fix printk levels for panic, softlockups and stack dumps	2012-01-26 21:28:45 +01:00
bust_spinlocks.c
check_signature.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
checksum.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
clz_tab.c	lib: Fix multiple definitions of clz_tab	2012-02-02 10:34:23 +11:00
cmdline.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
cordic.c	Docs: wording: functions -> algorithm	2011-10-29 21:20:22 +02:00
cpu-notifier-error-inject.c
cpu_rmap.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
cpumask.c	lib/cpumask.c: remove __any_online_cpu()	2012-03-28 17:14:35 -07:00
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c
crc7.c
crc8.c
crc16.c
crc32.c	crc32: add self-test code for crc32c	2012-03-23 16:58:38 -07:00
crc32defs.h	crc32: select an algorithm via Kconfig	2012-03-23 16:58:38 -07:00
ctype.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
debug_locks.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
debugobjects.c	debugobjects: Fix selftest for static warnings	2012-03-05 15:49:43 -08:00
dec_and_lock.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
decompress.c
decompress_bunzip2.c	decompress_bunzip2: remove invalid vi modeline	2011-12-06 10:00:05 +01:00
decompress_inflate.c
decompress_unlzma.c	treewide: Fix comment and string typo 'bufer'	2011-12-06 09:53:40 +01:00
decompress_unlzo.c	unlzo: fix input buffer free	2012-01-12 20:13:13 -08:00
decompress_unxz.c
devres.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
digsig.c	lib/digsig: checks for NULL return value	2012-02-02 00:24:04 +11:00
div64.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
dma-debug.c	Remove useless get_driver()/put_driver() calls	2012-01-24 16:00:35 -08:00
dump_stack.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
dynamic_debug.c	dynamic_debug: process multiple debug-queries on a line	2012-01-24 12:50:36 -08:00
dynamic_queue_limits.c	dql: Fix undefined jiffies	2012-03-11 19:59:43 -07:00
extable.c
fault-inject.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
find_last_bit.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
find_next_bit.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
flex_array.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
gcd.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
gen_crc32table.c	crc32: bolt on crc32c	2012-03-23 16:58:38 -07:00
genalloc.c	lib: Pass the correct align offset to bitmap_find_next_zero_area_off	2013-03-07 15:19:10 -08:00
halfmd4.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
hexdump.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
hweight.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
idr.c	idr: fix a subtle bug in idr_get_next()	2015-03-11 21:59:58 -07:00
inflate.c
int_sqrt.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
iomap.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
iomap_copy.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
iommu-helper.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
ioremap.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
irq_regs.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
is_single_threaded.c
kasprintf.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
Kconfig	crc32: add help text for the algorithm select option	2012-03-28 17:14:37 -07:00
Kconfig.debug	Allow CONFIG_STACKTRACE to be enabled by itself.	2012-04-09 13:57:51 -07:00
Kconfig.kgdb
Kconfig.kmemcheck
klist.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
kobject.c	kobject: provide more diagnostic info for kobject_add_internal() failures	2012-04-10 14:48:51 -07:00
kobject_uevent.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
kstrtox.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
kstrtox.h	lib/kstrtox: common code between kstrto*() and simple_strto*() functions	2011-10-31 17:30:56 -07:00
lcm.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
libcrc32c.c
list_debug.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
list_sort.c
llist.c	Disintegrate and delete asm/system.h	2012-03-28 15:58:21 -07:00
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
lru_cache.c
Makefile	lib: memory alloc	2013-02-20 01:32:22 -08:00
md5.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
memory_alloc.c	Update copyright to The Linux Foundation	2013-03-15 17:07:39 -07:00
nlattr.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
parser.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
pci_iomap.c	lib: add NO_GENERIC_PCI_IOPORT_MAP	2012-01-31 23:19:47 +02:00
percpu_counter.c	lib/percpu_counter.c: enclose hotplug only variables in hotplug ifdef	2011-10-31 17:30:56 -07:00
plist.c	bug.h: add include of it to various implicit C users	2012-02-29 17:15:08 -05:00
prio_heap.c
prio_tree.c	prio_tree: introduce prio_set_parent()	2012-03-23 16:58:36 -07:00
proportions.c
radix-tree.c	radix-tree: rewrite gang lookup using iterator	2012-03-28 17:14:37 -07:00
random32.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
ratelimit.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
rational.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
rbtree.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
reciprocal_div.c	sch_red: Adaptative RED AQM	2011-12-08 19:52:43 -05:00
rwsem-spinlock.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
rwsem.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
scatterlist.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
sha1.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
show_mem.c
smp_processor_id.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
sort.c
spinlock_debug.c	spinlock_debug: Print offset in addition to symbol name	2013-02-27 18:18:25 -08:00
string.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
string_helpers.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
swiotlb.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
syscall.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
test-kstrtox.c
textsearch.c
timerqueue.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
ts_bm.c
ts_fsm.c
ts_kmp.c
uuid.c	lib: reduce the use of module.h wherever possible	2012-03-07 15:04:04 -05:00
vsprintf.c	vsprintf: Fix %ps on non symbols when using kallsyms	2013-02-08 15:14:22 -08:00