flex_array: fix get function for elements in base starting at non-zero
If all array elements fit into the base structure and data is copied using flex_array_put() starting at a non-zero index, flex_array_get() will fail to return the data. This fixes the bug by only checking for NULL parts when all elements do not fit in the base structure when flex_array_get() is used. Otherwise, fa_element_to_part_nr() will always be 0 since there are no parts structures needed and such element may never have been put. Thus, it will remain NULL due to the kzalloc() of the base. Additionally, flex_array_put() now only checks for a NULL part when all elements do not fit in the base structure. This is otherwise unnecessary since the base structure is guaranteed to exist (or we would have already hit a NULL pointer). Signed-off-by: David Rientjes <rientjes@google.com> Acked-by: Dave Hansen <dave@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
054b2b13cc
commit
a30b595d2c
|
@ -198,10 +198,11 @@ int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags
|
|||
return -ENOSPC;
|
||||
if (elements_fit_in_base(fa))
|
||||
part = (struct flex_array_part *)&fa->parts[0];
|
||||
else
|
||||
else {
|
||||
part = __fa_get_part(fa, part_nr, flags);
|
||||
if (!part)
|
||||
return -ENOMEM;
|
||||
if (!part)
|
||||
return -ENOMEM;
|
||||
}
|
||||
dst = &part->elements[index_inside_part(fa, element_nr)];
|
||||
memcpy(dst, src, fa->element_size);
|
||||
return 0;
|
||||
|
@ -257,11 +258,12 @@ void *flex_array_get(struct flex_array *fa, int element_nr)
|
|||
|
||||
if (element_nr >= fa->total_nr_elements)
|
||||
return NULL;
|
||||
if (!fa->parts[part_nr])
|
||||
return NULL;
|
||||
if (elements_fit_in_base(fa))
|
||||
part = (struct flex_array_part *)&fa->parts[0];
|
||||
else
|
||||
else {
|
||||
part = fa->parts[part_nr];
|
||||
if (!part)
|
||||
return NULL;
|
||||
}
|
||||
return &part->elements[index_inside_part(fa, element_nr)];
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue