[PATCH v2] lib/idr: fix infinite loop in idr_get_next()

[PATCH v2] lib/idr: fix infinite loop in idr_get_next()

[Josh Law]

From: Josh Law <objecting@objecting.org>

In idr_get_next(), if the returned id from idr_get_next_ul() is greater
than INT_MAX, the function issues a warning and returns NULL without
updating the *nextid pointer. This causes a soft lockup for any caller
iterating over an IDR (e.g. via idr_for_each_entry) because they will
receive NULL, fail to advance their index, and repeatedly query the same
state forever.

Fix this by setting *nextid to INT_MAX when the bounds check fails,
ensuring the caller's iteration will terminate.

Signed-off-by: Josh Law <objecting@objecting.org>
---
 lib/idr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/idr.c b/lib/idr.c
index f25bd2b9e9a4..07098eb4ddc3 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -268,8 +268,10 @@ void *idr_get_next(struct idr *idr, int *nextid)
 	unsigned long id = *nextid;
 	void *entry = idr_get_next_ul(idr, &id);
 
-	if (WARN_ON_ONCE(id > INT_MAX))
+	if (WARN_ON_ONCE(id > INT_MAX)) {
+		*nextid = INT_MAX;
 		return NULL;
+	}
 	*nextid = id;
 	return entry;
 }
-- 
2.34.1

Re: [PATCH v2] lib/idr: fix infinite loop in idr_get_next()

[Matthew Wilcox]

On Thu, Mar 12, 2026 at 05:12:38PM +0000, Josh Law wrote:
> From: Josh Law <objecting@objecting.org>
> 
> In idr_get_next(), if the returned id from idr_get_next_ul() is greater
> than INT_MAX, the function issues a warning and returns NULL without
> updating the *nextid pointer. This causes a soft lockup for any caller
> iterating over an IDR (e.g. via idr_for_each_entry) because they will
> receive NULL, fail to advance their index, and repeatedly query the same
> state forever.
> 
> Fix this by setting *nextid to INT_MAX when the bounds check fails,
> ensuring the caller's iteration will terminate.

Can you add a test-case for this?  And the IDA patch you also sent?

Re: [PATCH v2] lib/idr: fix infinite loop in idr_get_next()

[Josh Law]

12 Mar 2026 17:26:44 Matthew Wilcox <willy@infradead.org>:

> On Thu, Mar 12, 2026 at 05:12:38PM +0000, Josh Law wrote:
>> From: Josh Law <objecting@objecting.org>
>>
>> In idr_get_next(), if the returned id from idr_get_next_ul() is greater
>> than INT_MAX, the function issues a warning and returns NULL without
>> updating the *nextid pointer. This causes a soft lockup for any caller
>> iterating over an IDR (e.g. via idr_for_each_entry) because they will
>> receive NULL, fail to advance their index, and repeatedly query the same
>> state forever.
>>
>> Fix this by setting *nextid to INT_MAX when the bounds check fails,
>> ensuring the caller's iteration will terminate.
>
> Can you add a test-case for this?  And the IDA patch you also sent?

Lmao you and your test cases, absolutely ill add some test cases