Matthew Wilcox (Oracle) fcbe159c90 idr: fix idr_alloc() returning an ID out of range ...

commit c6e8e595a0 upstream.

If you use an IDR with a non-zero base, and specify a range that lies
entirely below the base, 'max - base' becomes very large and
idr_get_free() can return an ID that lies outside of the requested range.

Link: https://lkml.kernel.org/r/20251128161853.3200058-1-willy@infradead.org
Fixes: 6ce711f275 ("idr: Make 1-based IDRs more efficient")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: Jan Sokolowski <jan.sokolowski@intel.com>
Reported-by: Koen Koning <koen.koning@intel.com>
Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6449
Reviewed-by: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-01-08 10:17:10 +01:00

..

.gitignore

tools: separate out shared radix-tree components

2024-09-01 20:25:55 -07:00

benchmark.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288

2019-06-05 17:36:37 +02:00

idr-test.c

idr: fix idr_alloc() returning an ID out of range

2026-01-08 10:17:10 +01:00

iteration_check_2.c

xarray: Fix early termination of xas_for_each_marked

2020-03-12 17:42:08 -04:00

iteration_check.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288

2019-06-05 17:36:37 +02:00

main.c

xarray: Fix early termination of xas_for_each_marked

2020-03-12 17:42:08 -04:00

Makefile

xarray: add xas_try_split() to split a multi-index entry

2025-03-17 22:06:59 -07:00

maple.c

Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:18:33 -07:00

multiorder.c

Xarray: do not return sibling entries from xas_find_marked()

2025-01-24 22:47:27 -08:00

regression1.c

radix tree test suite: fix incorrect allocation size for pthreads

2023-08-04 13:03:40 -07:00

regression2.c

radix tree test suite: Convert tag_tagged_items to XArray

2018-10-21 10:46:45 -04:00

regression3.c

page cache: Convert find_get_pages_contig to XArray

2018-10-21 10:46:34 -04:00

regression4.c

radix tree: Don't return retry entries from lookup

2018-12-06 08:26:16 -05:00

regression.h

radix tree: Don't return retry entries from lookup

2018-12-06 08:26:16 -05:00

tag_check.c

radix tree test suite: Convert tag_tagged_items to XArray

2018-10-21 10:46:45 -04:00

test.c

radix tree tests: Convert item_delete_rcu to XArray

2018-10-21 10:46:48 -04:00

test.h

radix tree test suite: Fix compilation

2020-10-07 09:07:49 -04:00

xarray.c

tools: separate out shared radix-tree components

2024-09-01 20:25:55 -07:00