linux-kernel - [RFC PATCH 1/1] idr: do not create idr if new id would be outside given range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251127092732.684959-2-jan.sokolowski@intel.com>
Date: Thu, 27 Nov 2025 10:27:32 +0100
From: Jan Sokolowski <jan.sokolowski@...el.com>
To: linux-kernel@...r.kernel.org
Cc: Jan Sokolowski <jan.sokolowski@...el.com>,
	Christian König <christian.koenig@....com>,
	Matthew Wilcox <willy@...radead.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-fsdevel@...r.kernel.org,
	linux-mm@...ck.org
Subject: [RFC PATCH 1/1] idr: do not create idr if new id would be outside given range

A scenario was found where trying to add id in range 0,1
would return an id of 2, which is outside the range and thus
now what the user would expect.

Return -EINVAL if new id would fall outside the range.

Signed-off-by: Jan Sokolowski <jan.sokolowski@...el.com>
Cc: "Christian König" <christian.koenig@....com>
Cc: Matthew Wilcox <willy@...radead.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-fsdevel@...r.kernel.org
Cc: linux-mm@...ck.org
Cc: linux-kernel@...r.kernel.org
---
 lib/idr.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/idr.c b/lib/idr.c
index e2adc457abb4..8c786e50f2da 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -74,6 +74,7 @@ EXPORT_SYMBOL_GPL(idr_alloc_u32);
  * exclude simultaneous writers.
  *
  * Return: The newly allocated ID, -ENOMEM if memory allocation failed,
+ * -EINVAL is start value is less than 0 or if new id would be in wrong range,
  * or -ENOSPC if no free IDs could be found.
  */
 int idr_alloc(struct idr *idr, void *ptr, int start, int end, gfp_t gfp)
@@ -88,6 +89,11 @@ int idr_alloc(struct idr *idr, void *ptr, int start, int end, gfp_t gfp)
 	if (ret)
 		return ret;
 
+	if (WARN_ON_ONCE(id < start || (id >= end && end != 0))) {
+		idr_remove(idr, id);
+		return -EINVAL;
+	}
+
 	return id;
 }
 EXPORT_SYMBOL_GPL(idr_alloc);
@@ -112,6 +118,7 @@ EXPORT_SYMBOL_GPL(idr_alloc);
  * exclude simultaneous writers.
  *
  * Return: The newly allocated ID, -ENOMEM if memory allocation failed,
+ * -EINVAL if new id would be in wrong range,
  * or -ENOSPC if no free IDs could be found.
  */
 int idr_alloc_cyclic(struct idr *idr, void *ptr, int start, int end, gfp_t gfp)
@@ -130,6 +137,11 @@ int idr_alloc_cyclic(struct idr *idr, void *ptr, int start, int end, gfp_t gfp)
 	if (err)
 		return err;
 
+	if (WARN_ON_ONCE(id < start || (id >= end && end != 0))) {
+		idr_remove(idr, id);
+		return -EINVAL;
+	}
+
 	idr->idr_next = id + 1;
 	return id;
 }
-- 
2.43.0