Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Jiasheng Jiang <jiasheng@iscas.ac.cn>
To:     viro@zeniv.linux.org.uk
Cc:     linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        Jiasheng Jiang <jiasheng@iscas.ac.cn>
Subject: [PATCH] seq_file: Fix potential addition overflow
Date:   Mon, 25 Oct 2021 07:31:18 +0000
Message-Id: <1635147078-2409190-1-git-send-email-jiasheng@iscas.ac.cn>
Precedence: bulk

After seq_hlist_start_percpu(), the value of &iter->li_cpu might be
MAX_UINT.
In that case, there will be addition overflow in the cpumask_next().
Therefore, it might be better to add the check before.

Fixes: 0bc7738 ("seq_file: add seq_list_*_percpu helpers")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
---
 fs/seq_file.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/seq_file.c b/fs/seq_file.c
index 5059248..f768c28 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -1105,6 +1105,9 @@ seq_hlist_next_percpu(void *v, struct hlist_head __percpu *head,
 	if (node->next)
 		return node->next;
 
+	if (*cpu >= nr_cpu_ids)
+		return NULL;
+
 	for (*cpu = cpumask_next(*cpu, cpu_possible_mask); *cpu < nr_cpu_ids;
 	     *cpu = cpumask_next(*cpu, cpu_possible_mask)) {
 		struct hlist_head *bucket = per_cpu_ptr(head, *cpu);
-- 
2.7.4