linux-kernel - Re: [RFC PATCH 1/1] idr: do not create idr if new id would be outside given range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aShb9lLyR537WDNq@casper.infradead.org>
Date: Thu, 27 Nov 2025 14:11:02 +0000
From: Matthew Wilcox <willy@...radead.org>
To: Christian König <christian.koenig@....com>
Cc: Jan Sokolowski <jan.sokolowski@...el.com>, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-fsdevel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [RFC PATCH 1/1] idr: do not create idr if new id would be
 outside given range

On Thu, Nov 27, 2025 at 03:03:20PM +0100, Christian König wrote:
> On 11/27/25 14:54, Matthew Wilcox wrote:
> > On Thu, Nov 27, 2025 at 10:27:32AM +0100, Jan Sokolowski wrote:
> >> A scenario was found where trying to add id in range 0,1
> >> would return an id of 2, which is outside the range and thus
> >> now what the user would expect.
> > 
> > Can you do a bit better with this bug report?  Under what circumstances
> > does this happen?  Preferably answer in the form of a test case for the
> > IDR test suite.  Here's my attempt to recreate your situation based on
> > what I read in that thread.  It doesn't show a problem, so clearly I got
> > something wrong.
> 
> According to Jan the observation he has is that this code:
> 
> idr_init_base(&idr, 1);
> id = idr_alloc(&idr, dummy_ptr, 0, 1, GFP_KERNEL);
> 
> Gives him id=2 in return.

Hm.  That's not what it does for me.  It gives me id == 1, which isn't
correct!  I'll look into that, but it'd be helpful to know what
combination of inputs gives us 2.

To be completely clear, here's what I'm looking at:

+void idr_alloc2_test(void)
+{
+       int id;
+       struct idr idr = IDR_INIT_BASE(idr, 1);
+
+       id = idr_alloc(&idr, idr_alloc2_test, 0, 1, GFP_KERNEL);
+       printf("id = %d\n", id);

and I think that should return -ENOSPC instead of 1, since we told it to
allocate exclusive of 1.