Matthew Wilcox (Oracle) 36cdde5c28 idr: fix idr_alloc() returning an ID out of range ...

commit c6e8e595a0 upstream.

If you use an IDR with a non-zero base, and specify a range that lies
entirely below the base, 'max - base' becomes very large and
idr_get_free() can return an ID that lies outside of the requested range.

Link: https://lkml.kernel.org/r/20251128161853.3200058-1-willy@infradead.org
Fixes: 6ce711f275 ("idr: Make 1-based IDRs more efficient")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: Jan Sokolowski <jan.sokolowski@intel.com>
Reported-by: Koen Koning <koen.koning@intel.com>
Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6449
Reviewed-by: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-08 10:14:50 +01:00

..

.gitignore

…

benchmark.c

…

idr-test.c

…

iteration_check_2.c

…

iteration_check.c

…

main.c

…

Makefile

…

maple.c

…

multiorder.c

…

regression1.c

…

regression2.c

…

regression3.c

…

regression4.c

…

regression.h

…

tag_check.c

…

test.c

…

test.h

…

xarray.c

…