linux-kernel - [PATCH] bfs: fix bitmap size argument to find_first_zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed,  2 Mar 2011 20:36:39 +0900
From:	Akinobu Mita <akinobu.mita@...il.com>
To:	linux-kernel@...r.kernel.org
Cc:	Akinobu Mita <akinobu.mita@...il.com>,
	"Tigran A. Aivazian" <tigran@...azian.fsnet.co.uk>,
	linux-fsdevel@...r.kernel.org
Subject: [PATCH] bfs: fix bitmap size argument to find_first_zero_bit()

The usage of find_first_zero_bit() in bfs_create() is wrong for
two reasons.

The bitmap size argument to find_first_zero_bit() is info->si_lasti
but the correct bitmap size is info->si_lasti + 1 as info->si_lasti
is the last valid index in info->si_imap bitmap.

Another problem is that it is impossible to detect that info->si_imap
bitmap is full because there is an off-by-one bug in the return value
check for find_first_zero_bit().  If no zero bits exist in info->si_imap,
find_first_zero_bit() returns info->si_lasti. But the check can't catch it
due to the off-by-one.

Signed-off-by: Akinobu Mita <akinobu.mita@...il.com>
Cc: "Tigran A. Aivazian" <tigran@...azian.fsnet.co.uk>
Cc: linux-fsdevel@...r.kernel.org
---
 fs/bfs/dir.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/fs/bfs/dir.c b/fs/bfs/dir.c
index 685ecff..b14cebf 100644
--- a/fs/bfs/dir.c
+++ b/fs/bfs/dir.c
@@ -97,7 +97,7 @@ static int bfs_create(struct inode *dir, struct dentry *dentry, int mode,
 	if (!inode)
 		return -ENOSPC;
 	mutex_lock(&info->bfs_lock);
-	ino = find_first_zero_bit(info->si_imap, info->si_lasti);
+	ino = find_first_zero_bit(info->si_imap, info->si_lasti + 1);
 	if (ino > info->si_lasti) {
 		mutex_unlock(&info->bfs_lock);
 		iput(inode);
-- 
1.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/