Unverified Commit 508ce6ae authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4097 [sync] PR-4090: ida: Fix crash in ida_free when the bitmap is empty 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/4090 
 
PR sync from: Cheng Yu <serein.chengyu@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/AWNFFZV53OQVGD4KCDTY7LBVJGIXP32A/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8WBGZ 
 
Link:https://gitee.com/openeuler/kernel/pulls/4097

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents a60664c9 d42a492b

lib/idr.c

+1 −1
Original line number Diff line number Diff line
@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id) 
			goto delete;

		xas_store(&xas, xa_mk_value(v));

	} else {

		if (!test_bit(bit, bitmap->bitmap))

		if (!bitmap || !test_bit(bit, bitmap->bitmap))

			goto err;

		__clear_bit(bit, bitmap->bitmap);

		xas_set_mark(&xas, XA_FREE_MARK);

lib/test_ida.c

+40 −0
Original line number Diff line number Diff line
@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida) 
	IDA_BUG_ON(ida, !ida_is_empty(ida));

}



/*

 * Check various situations where we attempt to free an ID we don't own.

 */

static void ida_check_bad_free(struct ida *ida)

{

	unsigned long i;



	printk("vvv Ignore \"not allocated\" warnings\n");

	/* IDA is empty; all of these will fail */

	ida_free(ida, 0);

	for (i = 0; i < 31; i++)

		ida_free(ida, 1 << i);



	/* IDA contains a single value entry */

	IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3);

	ida_free(ida, 0);

	for (i = 0; i < 31; i++)

		ida_free(ida, 1 << i);



	/* IDA contains a single bitmap */

	IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023);

	ida_free(ida, 0);

	for (i = 0; i < 31; i++)

		ida_free(ida, 1 << i);



	/* IDA contains a tree */

	IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1);

	ida_free(ida, 0);

	for (i = 0; i < 31; i++)

		ida_free(ida, 1 << i);

	printk("^^^ \"not allocated\" warnings over\n");



	ida_free(ida, 3);

	ida_free(ida, 1023);

	ida_free(ida, (1 << 20) - 1);



	IDA_BUG_ON(ida, !ida_is_empty(ida));

}



static DEFINE_IDA(ida);



static int ida_checks(void)
@@ -162,6 +201,7 @@ static int ida_checks(void) 
	ida_check_leaf(&ida, 1024 * 64);

	ida_check_max(&ida);

	ida_check_conv(&ida);

	ida_check_bad_free(&ida);



	printk("IDA: %u of %u tests passed\n", tests_passed, tests_run);

	return (tests_run != tests_passed) ? 0 : -EINVAL;