A scenario was found where trying to add id in range 0,1 would return an id of 2, which is outside the range and thus now what the user would expect. Return -EINVAL if new id would fall outside the range. Signed-off-by: Jan Sokolowski Cc: "Christian König" Cc: Matthew Wilcox Cc: Andrew Morton Cc: linux-fsdevel@vger.kernel.org Cc: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org --- lib/idr.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/lib/idr.c b/lib/idr.c index e2adc457abb4..8c786e50f2da 100644 --- a/lib/idr.c +++ b/lib/idr.c @@ -74,6 +74,7 @@ EXPORT_SYMBOL_GPL(idr_alloc_u32); * exclude simultaneous writers. * * Return: The newly allocated ID, -ENOMEM if memory allocation failed, + * -EINVAL is start value is less than 0 or if new id would be in wrong range, * or -ENOSPC if no free IDs could be found. */ int idr_alloc(struct idr *idr, void *ptr, int start, int end, gfp_t gfp) @@ -88,6 +89,11 @@ int idr_alloc(struct idr *idr, void *ptr, int start, int end, gfp_t gfp) if (ret) return ret; + if (WARN_ON_ONCE(id < start || (id >= end && end != 0))) { + idr_remove(idr, id); + return -EINVAL; + } + return id; } EXPORT_SYMBOL_GPL(idr_alloc); @@ -112,6 +118,7 @@ EXPORT_SYMBOL_GPL(idr_alloc); * exclude simultaneous writers. * * Return: The newly allocated ID, -ENOMEM if memory allocation failed, + * -EINVAL if new id would be in wrong range, * or -ENOSPC if no free IDs could be found. */ int idr_alloc_cyclic(struct idr *idr, void *ptr, int start, int end, gfp_t gfp) @@ -130,6 +137,11 @@ int idr_alloc_cyclic(struct idr *idr, void *ptr, int start, int end, gfp_t gfp) if (err) return err; + if (WARN_ON_ONCE(id < start || (id >= end && end != 0))) { + idr_remove(idr, id); + return -EINVAL; + } + idr->idr_next = id + 1; return id; } -- 2.43.0