github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

parisc: unwind: Replace open-coded binary search with bsearch()

Browse Source 
There is a bug in the binary search where hi can underflow. If
addr is less than the first entry, then "hi = mid - 1" will underflow
to ULONG_MAX. Then we have an out-of-bounds read.

Replace the open-coded binary search with bsearch().

Issue found by an LLM.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Helge Deller <deller@gmx.de>
This commit is contained in:
Sean Young 2026-09-13 15:12:27 +01:00 committed by Helge Deller
parent df2908090c
commit 4485a01f4d
1 changed files with 15 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
arch/parisc/kernel/unwind.c
View File

@ -14,6 +14,7 @@
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/sort.h>
#include <linux/bsearch.h>
#include <linux/sched/task_stack.h>
#include <linux/uaccess.h>
@ -49,27 +50,23 @@ static DEFINE_SPINLOCK(unwind_lock);
static struct unwind_table kernel_unwind_table __ro_after_init;
static LIST_HEAD(unwind_tables);
static int cmp_unwind_entry(const void *key, const void *elt)
{
unsigned long addr = (unsigned long)key;
const struct unwind_table_entry *e = elt;
if (addr < e->region_start)
return -1;
if (addr > e->region_end)
return 1;
return 0;
}
static inline const struct unwind_table_entry *
find_unwind_entry_in_table(const struct unwind_table *table, unsigned long addr)
{
const struct unwind_table_entry *e = NULL;
unsigned long lo, hi, mid;
lo = 0;
hi = table->length - 1;
while (lo <= hi) {
mid = (hi - lo) / 2 + lo;
e = &table->table[mid];
if (addr < e->region_start)
hi = mid - 1;
else if (addr > e->region_end)
lo = mid + 1;
else
return e;
}
return NULL;
return bsearch((void *)addr, table->table, table->length,
sizeof(*table->table), cmp_unwind_entry);
}
static const struct unwind_table_entry *