* [PATCH 6/6] irq: Potentially 'offset out of size' bug
@ 2021-09-10 3:26 Jiang Jiasheng
2021-09-10 10:28 ` Thomas Gleixner
0 siblings, 1 reply; 2+ messages in thread
From: Jiang Jiasheng @ 2021-09-10 3:26 UTC (permalink / raw)
To: tglx; +Cc: linux-kernel, Jiang Jiasheng
The find_next_bit() use nr_irqs as size, and using it without
any check might cause its returned value out of the size
Signed-off-by: Jiang Jiasheng <jiasheng@iscas.ac.cn>
---
kernel/irq/irqdesc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 4a617d73..5bb310a 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -820,7 +820,8 @@ EXPORT_SYMBOL_GPL(__irq_alloc_descs);
*/
unsigned int irq_get_next_irq(unsigned int offset)
{
- return find_next_bit(allocated_irqs, nr_irqs, offset);
+ offset = find_next_bit(allocated_irqs, nr_irqs, offset);
+ return offset < nr_irqs ? offset : nr_irqs;
}
struct irq_desc *
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 6/6] irq: Potentially 'offset out of size' bug
2021-09-10 3:26 [PATCH 6/6] irq: Potentially 'offset out of size' bug Jiang Jiasheng
@ 2021-09-10 10:28 ` Thomas Gleixner
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Gleixner @ 2021-09-10 10:28 UTC (permalink / raw)
To: Jiang Jiasheng; +Cc: linux-kernel, Jiang Jiasheng
On Fri, Sep 10 2021 at 03:26, Jiang Jiasheng wrote:
> The find_next_bit() use nr_irqs as size, and using it without
> any check might cause its returned value out of the size
Why exactly is this a problem? The return value has to be checked at the
call site anyway.
Thanks,
tglx
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-09-10 10:28 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-10 3:26 [PATCH 6/6] irq: Potentially 'offset out of size' bug Jiang Jiasheng
2021-09-10 10:28 ` Thomas Gleixner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).