mirror of
https://github.com/torvalds/linux
synced 2024-09-21 03:28:37 +00:00
f82a519f12
find_next bitops on m68k (find_next_zero_bit, find_next_bit, and
find_next_bit_le) may cause out of bounds memory access
when the bitmap size in bits % 32 != 0 and offset (the bitnumber
to start searching at) is very close to the bitmap size.
For example,
unsigned long bitmap[2] = { 0, 0 };
find_next_bit(bitmap, 63, 62);
1. find_next_bit() tries to find any set bits in bitmap[1],
but no bits set.
2. Then find_first_bit(bimap + 2, -1)
3. Unfortunately find_first_bit() takes unsigned int as the size argument.
4. find_first_bit will access bitmap[2~] until it find any set bits.
Add missing tests for stepping beyond the end of the bitmap to all
find_{first,next}_*() functions, and make sure they never return a value
larger than the bitmap size.
Reported-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
|
||
|---|---|---|
| .. | ||
| amiga | ||
| apollo | ||
| atari | ||
| bvme6000 | ||
| configs | ||
| emu | ||
| fpsp040 | ||
| hp300 | ||
| ifpsp060 | ||
| include/asm | ||
| kernel | ||
| lib | ||
| mac | ||
| math-emu | ||
| mm | ||
| mvme16x | ||
| mvme147 | ||
| platform | ||
| q40 | ||
| sun3 | ||
| sun3x | ||
| tools/amiga | ||
| install.sh | ||
| Kconfig | ||
| Kconfig.debug | ||
| Kconfig.mmu | ||
| Kconfig.nommu | ||
| Makefile | ||
| Makefile_mm | ||
| Makefile_no | ||