Skip to content
Commit eb6f8ae9 authored by Matthew Wilcox (Oracle)'s avatar Matthew Wilcox (Oracle) Committed by Paul Gortmaker
Browse files

XArray: Fix xa_find_next for large multi-index entries



commit bd40b17c upstream.

Coverity pointed out that xas_sibling() was shifting xa_offset without
promoting it to an unsigned long first, so the shift could cause an
overflow and we'd get the wrong answer.  The fix is obvious, and the
new test-case provokes UBSAN to report an error:
runtime error: shift exponent 60 is too large for 32-bit type 'int'

Fixes: 19c30f4d ("XArray: Fix xa_find_after with multi-index entries")
Reported-by: default avatarBjorn Helgaas <bhelgaas@google.com>
Reported-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaul Gortmaker <paul.gortmaker@windriver.com>
parent 77c73be1
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment