Unverified Commit fc5b1a61 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12353 ida: Fix crash in ida_free when the bitmap is empty 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wenyu Huang <huangwenyu5@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VWNYD4IPN67MPZI4ORMC3L2SFXL4OBMT/ 
 
https://gitee.com/openeuler/kernel/issues/IAZAKK 
 
Link:https://gitee.com/openeuler/kernel/pulls/12353

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 3c02090e 173a1b3a

lib/idr.c

+1 −1
Original line number Diff line number Diff line
@@ -471,7 +471,7 @@ static void ida_remove(struct ida *ida, int id) 
	} else {

		btmp = bitmap->bitmap;

	}

	if (!test_bit(offset, btmp))

	if (!bitmap || !test_bit(offset, btmp))

		goto err;



	__clear_bit(offset, btmp);

lib/test_ida.c

+40 −0
Original line number Diff line number Diff line
@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida) 
	IDA_BUG_ON(ida, !ida_is_empty(ida));

}



/*

 * Check various situations where we attempt to free an ID we don't own.

 */

static void ida_check_bad_free(struct ida *ida)

{

	unsigned long i;



	printk("vvv Ignore \"not allocated\" warnings\n");

	/* IDA is empty; all of these will fail */

	ida_free(ida, 0);

	for (i = 0; i < 31; i++)

		ida_free(ida, 1 << i);



	/* IDA contains a single value entry */

	IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3);

	ida_free(ida, 0);

	for (i = 0; i < 31; i++)

		ida_free(ida, 1 << i);



	/* IDA contains a single bitmap */

	IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023);

	ida_free(ida, 0);

	for (i = 0; i < 31; i++)

		ida_free(ida, 1 << i);



	/* IDA contains a tree */

	IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1);

	ida_free(ida, 0);

	for (i = 0; i < 31; i++)

		ida_free(ida, 1 << i);

	printk("^^^ \"not allocated\" warnings over\n");



	ida_free(ida, 3);

	ida_free(ida, 1023);

	ida_free(ida, (1 << 20) - 1);



	IDA_BUG_ON(ida, !ida_is_empty(ida));

}



static DEFINE_IDA(ida);



static int ida_checks(void)
@@ -162,6 +201,7 @@ static int ida_checks(void) 
	ida_check_leaf(&ida, 1024 * 64);

	ida_check_max(&ida);

	ida_check_conv(&ida);

	ida_check_bad_free(&ida);



	printk("IDA: %u of %u tests passed\n", tests_passed, tests_run);

	return (tests_run != tests_passed) ? 0 : -EINVAL;