linux-kernel - Re: [PATCH 2/2] m68k: bitops - Never step beyond the end of the bitmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <BANLkTin8ok0bMBM3YrcU43FVEr1MuzegBQ@mail.gmail.com>
Date:	Sun, 17 Apr 2011 22:50:35 +0900
From:	Akinobu Mita <akinobu.mita@...il.com>
To:	Geert Uytterhoeven <geert@...ux-m68k.org>
Cc:	linux-m68k@...r.kernel.org, linux-kernel@...r.kernel.org,
	Andreas Schwab <schwab@...ux-m68k.org>
Subject: Re: [PATCH 2/2] m68k: bitops - Never step beyond the end of the bitmap

2011/4/3 Geert Uytterhoeven <geert@...ux-m68k.org>:
> find_next bitops on m68k (find_next_zero_bit, find_next_bit, and
> find_next_bit_le) may cause out of bounds memory access
> when the bitmap size in bits % 32 != 0 and offset (the bitnumber
> to start searching at) is very close to the bitmap size.
>
> For example,
>
>       unsigned long bitmap[2] = { 0, 0 };
>       find_next_bit(bitmap, 63, 62);
>
> 1. find_next_bit() tries to find any set bits in bitmap[1],
>   but no bits set.
>
> 2. Then find_first_bit(bimap + 2, -1)
>
> 3. Unfortunately find_first_bit() takes unsigned int as the size argument.
>
> 4. find_first_bit will access bitmap[2~] until it find any set bits.
>
> Add missing tests for stepping beyond the end of the bitmap to all
> find_{first,next}_*() functions, and make sure they never return a value
> larger than the bitmap size.
>
> Reported-by: Akinobu Mita <akinobu.mita@...il.com>
> Cc: Andreas Schwab <schwab@...ux-m68k.org>

These patches look good.

I checked that find_next_zero_bit_le() and find_next_bit_le() work
as I expect.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/