A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 18:51:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

lib/radix-tree.c: fix overflow in radix_tree_range_tag_if_tagged()

Browse source 
When radix_tree_maxindex() is ~0UL, it can happen that scanning overflows
index and tree traversal code goes astray reading memory until it hits
unreadable memory.  Check for overflow and exit in that case.

Signed-off-by: Jan Kara <[email protected]>
Cc: Christoph Hellwig <[email protected]>
Cc: Nick Piggin <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Jan Kara 2010-08-19 14:13:33 -07:00 • committed by Linus Torvalds
commit d5ed3a4af7
2 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/radix-tree.c
View file

@ -625,6 +625,8 @@ EXPORT_SYMBOL(radix_tree_tag_get);
*
* The function returns number of leaves where the tag was set and sets
* *first_indexp to the first unscanned index.
* WARNING! *first_indexp can wrap if last_index is ULONG_MAX. Caller must
* be prepared to handle that.
*/
unsigned long radix_tree_range_tag_if_tagged(struct radix_tree_root *root,
unsigned long *first_indexp, unsigned long last_index,
@ -675,7 +677,8 @@ unsigned long radix_tree_range_tag_if_tagged(struct radix_tree_root *root,
next:
/* Go to next item at level determined by 'shift' */
index = ((index >> shift) + 1) << shift;
if (index > last_index)
/* Overflow can happen when last_index is ~0UL... */
if (index > last_index || !index)
break;
if (tagged >= nr_to_tag)
break;