Messages in this thread Patch in this message | | | From | Jiang Jiasheng <> | Subject | [PATCH 6/6] irq: Potentially 'offset out of size' bug | Date | Fri, 10 Sep 2021 03:26:12 +0000 |
| |
The find_next_bit() use nr_irqs as size, and using it without any check might cause its returned value out of the size
Signed-off-by: Jiang Jiasheng <jiasheng@iscas.ac.cn> --- kernel/irq/irqdesc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c index 4a617d73..5bb310a 100644 --- a/kernel/irq/irqdesc.c +++ b/kernel/irq/irqdesc.c @@ -820,7 +820,8 @@ EXPORT_SYMBOL_GPL(__irq_alloc_descs); */ unsigned int irq_get_next_irq(unsigned int offset) { - return find_next_bit(allocated_irqs, nr_irqs, offset); + offset = find_next_bit(allocated_irqs, nr_irqs, offset); + return offset < nr_irqs ? offset : nr_irqs; } struct irq_desc * -- 2.7.4
| |