Matthew Wilcox (Oracle) 16696ee7b5 XArray: Fix xa_find_next for large multi-index entries
[ Upstream commit bd40b17ca49d7d110adf456e647701ce74de2241 ]

Coverity pointed out that xas_sibling() was shifting xa_offset without
promoting it to an unsigned long first, so the shift could cause an
overflow and we'd get the wrong answer.  The fix is obvious, and the
new test-case provokes UBSAN to report an error:
runtime error: shift exponent 60 is too large for 32-bit type 'int'

Fixes: 19c30f4dd092 ("XArray: Fix xa_find_after with multi-index entries")
Reported-by: Bjorn Helgaas <bhelgaas@google.com>
Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-08 09:08:40 +02:00
..
2019-09-20 09:06:26 -07:00
2018-08-22 10:52:48 -07:00
2018-10-12 09:17:46 +02:00
2019-07-25 15:47:37 +02:00
2018-08-16 12:14:42 -07:00
2018-08-22 10:52:48 -07:00
2019-07-12 15:13:55 -07:00
2017-02-24 17:46:57 -08:00
2019-09-24 15:54:08 -07:00
2018-10-16 13:45:44 +02:00
2019-07-11 15:17:41 -07:00
2018-06-27 18:58:49 +03:00
2018-10-15 16:31:29 -04:00
2019-05-06 11:12:09 -07:00
2017-08-15 09:02:07 -07:00