diff options
| author | Matthew Wilcox (Oracle) <willy@infradead.org> | 2020-10-13 14:46:29 +0200 |
|---|---|---|
| committer | Matthew Wilcox (Oracle) <willy@infradead.org> | 2020-10-13 14:53:29 +0200 |
| commit | 84c34df158cf215b0cd1475ab3b8e6f212f81f23 (patch) | |
| tree | 744410b0a8b2a36fa895e0e1033bb7ec93c1cbd8 /lib | |
| parent | radix-tree: fix the comment of radix_tree_next_slot() (diff) | |
| download | linux-84c34df158cf215b0cd1475ab3b8e6f212f81f23.tar.xz linux-84c34df158cf215b0cd1475ab3b8e6f212f81f23.zip | |
XArray: Fix xas_create_range for ranges above 4 billion
The 'sibs' variable would be shifted as a 32-bit integer, so if 'shift'
is more than 32, this is undefined behaviour. In practice, this doesn't
happen because the page cache is the only user and nobody uses 16TB pages.
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/xarray.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/xarray.c b/lib/xarray.c index 1fa5c5658e63..2046d676ab41 100644 --- a/lib/xarray.c +++ b/lib/xarray.c @@ -703,7 +703,7 @@ void xas_create_range(struct xa_state *xas) unsigned char shift = xas->xa_shift; unsigned char sibs = xas->xa_sibs; - xas->xa_index |= ((sibs + 1) << shift) - 1; + xas->xa_index |= ((sibs + 1UL) << shift) - 1; if (xas_is_node(xas) && xas->xa_node->shift == xas->xa_shift) xas->xa_offset |= sibs; xas->xa_shift = 0; |