1
0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-11 00:50:21 +00:00
Matthew Wilcox (Oracle) c6e8e595a0 idr: fix idr_alloc() returning an ID out of range
If you use an IDR with a non-zero base, and specify a range that lies
entirely below the base, 'max - base' becomes very large and
idr_get_free() can return an ID that lies outside of the requested range.

Link: https://lkml.kernel.org/r/20251128161853.3200058-1-willy@infradead.org
Fixes: 6ce711f27500 ("idr: Make 1-based IDRs more efficient")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: Jan Sokolowski <jan.sokolowski@intel.com>
Reported-by: Koen Koning <koen.koning@intel.com>
Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6449
Reviewed-by: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-23 11:23:11 -08:00
..
2025-03-16 22:30:49 -07:00
2025-04-11 17:32:38 -07:00
2025-04-11 17:32:37 -07:00
2024-07-12 16:39:53 -07:00
2025-10-05 10:48:33 -07:00
2025-07-08 19:11:57 -04:00
2025-01-12 20:21:15 -08:00
2025-11-27 23:00:45 +01:00
2025-01-14 19:45:35 +01:00
2025-10-24 21:39:27 +02:00
2024-10-14 16:33:24 -05:00
2025-11-27 23:00:45 +01:00
2025-03-17 12:17:00 -07:00
2025-11-27 14:24:30 -08:00
2024-02-15 12:17:28 -05:00
2025-03-25 10:18:31 -03:00
2024-12-09 13:48:29 -08:00
2025-09-13 16:54:46 -07:00