Re: [Patch net 0/3] idr: fix overflow cases on 32-bit CPU

From: Matthew Wilcox <willy@infradead.org>
Date: Mon, 1 Jul 2019 19:37:30 -0700

On Mon, Jul 01, 2019 at 07:16:00PM -0700, David Miller wrote:

quoted

From: Cong Wang <redacted>
Date: Fri, 28 Jun 2019 11:03:40 -0700

quoted

idr_get_next_ul() is problematic by design, it can't handle
the following overflow case well on 32-bit CPU:

u32 id = UINT_MAX;
idr_alloc_u32(&id);
while (idr_get_next_ul(&id) != NULL)
 id++;

when 'id' overflows and becomes 0 after UINT_MAX, the loop
goes infinite.

Fix this by eliminating external users of idr_get_next_ul()
and migrating them to idr_for_each_entry_continue_ul(). And
add an additional parameter for these iteration macros to detect
overflow properly.

Please merge this through networking tree, as all the users
are in networking subsystem.

Series applied, thanks Cong.

Ugh, I don't even get the weekend to reply?

I think this is just a bad idea.  It'd be better to apply the conversion
patches to use XArray than fix up this crappy interface.  I didn't
reply before because I wanted to check those patches still apply and
post them as part of the response.  Now they're definitely broken and
need to be redone.

Please work this out with Cong.

I think his approach is safe for net and thus -stable than an xarray
conversion.