kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/fs/omfs
History
Bob Copeland 45948a314f omfs: fix sign confusion for bitmap loop counter 
[ Upstream commit c0345ee57d ]

The count variable is used to iterate down to (below) zero from the size
of the bitmap and handle the one-filling the remainder of the last
partial bitmap block.  The loop conditional expects count to be signed
in order to detect when the final block is processed, after which count
goes negative.

Unfortunately, a recent change made this unsigned along with some other
related fields.  The result of is this is that during mount,
omfs_get_imap will overrun the bitmap array and corrupt memory unless
number of blocks happens to be a multiple of 8 * blocksize.

Fix by changing count back to signed: it is guaranteed to fit in an s32
without overflow due to an enforced limit on the number of blocks in the
filesystem.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2015-06-09 13:43:51 -04:00
..
bitmap.c tree-wide: fix assorted typos all over the place 2009-12-04 15:39:55 +01:00
dir.c [readdir] convert omfs 2013-06-29 12:56:37 +04:00
file.c write_iter variants of {__,}generic_file_aio_write() 2014-05-06 17:38:00 -04:00
inode.c omfs: fix sign confusion for bitmap loop counter 2015-06-09 13:43:51 -04:00
Kconfig fs/Kconfig: move omfs out 2009-01-22 13:15:58 +03:00
Makefile omfs: update kbuild to include OMFS 2008-07-26 12:00:05 -07:00
omfs.h userns: Convert omfs to use kuid and kgid where appropriate 2012-09-21 03:13:16 -07:00
omfs_fs.h FS/OMFS: block number sanity check during fill_super operation 2014-10-14 02:18:22 +02:00