Skip to content

Commit

Permalink
kernel/range.c: fix clean_sort_range() for the case of full array
Browse files Browse the repository at this point in the history
clean_sort_range() should return a number of nonempty elements of range
array, but if the array is full clean_sort_range() returns 0.

The problem is that the number of nonempty elements is evaluated by
finding the first empty element of the array.  If there is no such element
it returns an initial value of local variable nr_range that is zero.

The fix is trivial: it changes initial value of nr_range to size of the
array.

The bug can lead to loss of information regarding all ranges, since
typically returned value of clean_sort_range() is considered as an actual
number of ranges in the array after a series of add/subtract operations.

Found by Analytical Verification project of Linux Verification Center
(linuxtesting.org), thanks to Alexander Kolosov.

Signed-off-by: Alexey Khoroshilov <[email protected]>
Cc: Yinghai Lu <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Cc: Geert Uytterhoeven <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
khoroshilov authored and torvalds committed Nov 12, 2010
1 parent aec0428 commit 834b403
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion kernel/range.c
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ static int cmp_range(const void *x1, const void *x2)

int clean_sort_range(struct range *range, int az)
{
int i, j, k = az - 1, nr_range = 0;
int i, j, k = az - 1, nr_range = az;

for (i = 0; i < k; i++) {
if (range[i].end)
Expand Down

0 comments on commit 834b403

Please sign in to comment.