Commit a3593474 authored by Bob Copeland's avatar Bob Copeland Committed by Greg Kroah-Hartman

omfs: fix sign confusion for bitmap loop counter

commit c0345ee5 upstream.

The count variable is used to iterate down to (below) zero from the size
of the bitmap and handle the one-filling the remainder of the last
partial bitmap block.  The loop conditional expects count to be signed
in order to detect when the final block is processed, after which count
goes negative.

Unfortunately, a recent change made this unsigned along with some other
related fields.  The result of is this is that during mount,
omfs_get_imap will overrun the bitmap array and corrupt memory unless
number of blocks happens to be a multiple of 8 * blocksize.

Fix by changing count back to signed: it is guaranteed to fit in an s32
without overflow due to an enforced limit on the number of blocks in the
filesystem.
Signed-off-by: default avatarBob Copeland <me@bobcopeland.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4215727c
...@@ -306,7 +306,8 @@ static const struct super_operations omfs_sops = { ...@@ -306,7 +306,8 @@ static const struct super_operations omfs_sops = {
*/ */
static int omfs_get_imap(struct super_block *sb) static int omfs_get_imap(struct super_block *sb)
{ {
unsigned int bitmap_size, count, array_size; unsigned int bitmap_size, array_size;
int count;
struct omfs_sb_info *sbi = OMFS_SB(sb); struct omfs_sb_info *sbi = OMFS_SB(sb);
struct buffer_head *bh; struct buffer_head *bh;
unsigned long **ptr; unsigned long **ptr;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment