Lubancat2/kernel
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

idr: Fix idr_get_next_ul race with idr_remove

Browse Source 
[ Upstream commit 5a74ac4c4a97bd8b7dba054304d598e2a882fea6 ]

Commit 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove")
neglected to fix idr_get_next_ul().  As far as I can tell, nobody's
actually using this interface under the RCU read lock, but fix it now
before anybody decides to use it.

Fixes: 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Matthew Wilcox (Oracle)
2019-11-01 21:36:39 -04:00
committed by Greg Kroah-Hartman
parent 052d878cc2
commit 0cec640db8
1 changed files with 11 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
lib/idr.c
View File

@ -218,7 +218,7 @@ int idr_for_each(const struct idr *idr,
EXPORT_SYMBOL(idr_for_each); EXPORT_SYMBOL(idr_for_each);
/** /**
* idr_get_next() - Find next populated entry. * idr_get_next_ul() - Find next populated entry.
* @idr: IDR handle. * @idr: IDR handle.
* @nextid: Pointer to an ID. * @nextid: Pointer to an ID.
* *
@ -227,7 +227,7 @@ EXPORT_SYMBOL(idr_for_each);
* to the ID of the found value. To use in a loop, the value pointed to by * to the ID of the found value. To use in a loop, the value pointed to by
* nextid must be incremented by the user. * nextid must be incremented by the user.
*/ */
void *idr_get_next(struct idr *idr, int *nextid) void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
{ {
struct radix_tree_iter iter; struct radix_tree_iter iter;
void __rcu **slot; void __rcu **slot;
@ -249,18 +249,14 @@ void *idr_get_next(struct idr *idr, int *nextid)
} }
if (!slot) if (!slot)
return NULL; return NULL;
id = iter.index + base;
if (WARN_ON_ONCE(id > INT_MAX)) *nextid = iter.index + base;
return NULL;
*nextid = id;
return entry; return entry;
} }
EXPORT_SYMBOL(idr_get_next); EXPORT_SYMBOL(idr_get_next_ul);
/** /**
* idr_get_next_ul() - Find next populated entry. * idr_get_next() - Find next populated entry.
* @idr: IDR handle. * @idr: IDR handle.
* @nextid: Pointer to an ID. * @nextid: Pointer to an ID.
* *
@ -269,22 +265,17 @@ EXPORT_SYMBOL(idr_get_next);
* to the ID of the found value. To use in a loop, the value pointed to by * to the ID of the found value. To use in a loop, the value pointed to by
* nextid must be incremented by the user. * nextid must be incremented by the user.
*/ */
void *idr_get_next_ul(struct idr *idr, unsigned long *nextid) void *idr_get_next(struct idr *idr, int *nextid)
{ {
struct radix_tree_iter iter;
void __rcu **slot;
unsigned long base = idr->idr_base;
unsigned long id = *nextid; unsigned long id = *nextid;
void *entry = idr_get_next_ul(idr, &id);
id = (id < base) ? 0 : id - base; if (WARN_ON_ONCE(id > INT_MAX))
slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
if (!slot)
return NULL; return NULL;
*nextid = id;
*nextid = iter.index + base; return entry;
return rcu_dereference_raw(*slot);
} }
EXPORT_SYMBOL(idr_get_next_ul); EXPORT_SYMBOL(idr_get_next);
/** /**
* idr_replace() - replace pointer for given ID. * idr_replace() - replace pointer for given ID.