Re: [PATCH 2/2] m68k: bitops - Never step beyond the end of the bitmap

[Akinobu Mita]

2011/4/3 Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>:
> find_next bitops on m68k (find_next_zero_bit, find_next_bit, and
> find_next_bit_le) may cause out of bounds memory access
> when the bitmap size in bits % 32 != 0 and offset (the bitnumber
> to start searching at) is very close to the bitmap size.
>
> For example,
>
>       unsigned long bitmap[2] = { 0, 0 };
>       find_next_bit(bitmap, 63, 62);
>
> 1. find_next_bit() tries to find any set bits in bitmap[1],
>   but no bits set.
>
> 2. Then find_first_bit(bimap + 2, -1)
>
> 3. Unfortunately find_first_bit() takes unsigned int as the size argument.
>
> 4. find_first_bit will access bitmap[2~] until it find any set bits.
>
> Add missing tests for stepping beyond the end of the bitmap to all
> find_{first,next}_*() functions, and make sure they never return a value
> larger than the bitmap size.
>
> Reported-by: Akinobu Mita <akinobu.mita@xxxxxxxxx>
> Cc: Andreas Schwab <schwab@xxxxxxxxxxxxxx>

These patches look good.

I checked that find_next_zero_bit_le() and find_next_bit_le() work
as I expect.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/