From patchwork Mon May 18 11:34:37 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bob Copeland X-Patchwork-Id: 6428391 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 90B9DC0432 for ; Mon, 18 May 2015 11:37:38 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A1DF520602 for ; Mon, 18 May 2015 11:37:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id AE35F205EB for ; Mon, 18 May 2015 11:37:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753808AbbERLhe (ORCPT ); Mon, 18 May 2015 07:37:34 -0400 Received: from mail-ig0-f177.google.com ([209.85.213.177]:38782 "EHLO mail-ig0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753791AbbERLhc (ORCPT ); Mon, 18 May 2015 07:37:32 -0400 Received: by igcau1 with SMTP id au1so44724685igc.1 for ; Mon, 18 May 2015 04:37:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=UZ2Qw5KoJ+ZYV1F9wOKcNVc1zetW/WjDDQs0/bCemps=; b=DgShF+GmKeXeEmKIgJ7J6wvFcPL6s1eXzqnIS1j1h/XoTcJpIU+IHA587Be2D1FkfP wRHj/hMN/R7qNSILMl3gPwAPRnGq866KAiE5oIAYYSd2huSAu7HiE2DIdhJKR00XTFY/ x6aeDmODB8XkB6W6StWhLWATGk0lZ8Ukoj7UvInaO6TIseTRVqTawWM0jYC0gNVBRagO 8j08zjO/Bhm47pG7Ff8hbihGqB2AsYh9c3cTsY/ePvDntJ7/kOlikZxLDPiVW9hJEq8l rAKXltGSm2vUESDi3pVMw3uvKrXN/x272OArKnsTYO68+nxoWU7vowcM98CcY0rvNuqu LLaA== X-Gm-Message-State: ALoCoQn1u5euKFWzRkoE6JCtJQsumRxkDldzDr9258uhOlhjcai7CDAZm1CTCntClx4NeiSoA8S9 X-Received: by 10.50.78.199 with SMTP id d7mr13980048igx.18.1431949050799; Mon, 18 May 2015 04:37:30 -0700 (PDT) Received: from hash ([2001:470:1d:6db:230:48ff:fe9d:9c89]) by mx.google.com with ESMTPSA id fm3sm5638379igb.1.2015.05.18.04.37.29 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 May 2015 04:37:29 -0700 (PDT) Received: from glass.lan ([192.168.1.51] helo=glass) by hash with esmtp (Exim 4.84) (envelope-from ) id 1YuJMI-0005dK-4I; Mon, 18 May 2015 07:37:22 -0400 Received: from bob by glass with local (Exim 4.84) (envelope-from ) id 1YuJKE-0000za-P6; Mon, 18 May 2015 07:35:14 -0400 From: Bob Copeland To: akpm@linux-foundation.org Cc: linux-fsdevel@vger.kernel.org, Bob Copeland , stable@vger.kernel.org Subject: [PATCH 3/4] omfs: fix sign confusion for bitmap loop counter Date: Mon, 18 May 2015 07:34:37 -0400 Message-Id: <1431948878-3756-4-git-send-email-me@bobcopeland.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1431948878-3756-1-git-send-email-me@bobcopeland.com> References: <1431948878-3756-1-git-send-email-me@bobcopeland.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The count variable is used to iterate down to (below) zero from the size of the bitmap and handle the one-filling the remainder of the last partial bitmap block. The loop conditional expects count to be signed in order to detect when the final block is processed, after which count goes negative. Unfortunately, a recent change made this unsigned along with some other related fields. The result of is this is that during mount, omfs_get_imap will overrun the bitmap array and corrupt memory unless number of blocks happens to be a multiple of 8 * blocksize. Fix by changing count back to signed: it is guaranteed to fit in an s32 without overflow due to an enforced limit on the number of blocks in the filesystem. Cc: stable@vger.kernel.org Signed-off-by: Bob Copeland --- fs/omfs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c index 6ce542c11f98..3d935c81789a 100644 --- a/fs/omfs/inode.c +++ b/fs/omfs/inode.c @@ -306,7 +306,8 @@ static const struct super_operations omfs_sops = { */ static int omfs_get_imap(struct super_block *sb) { - unsigned int bitmap_size, count, array_size; + unsigned int bitmap_size, array_size; + int count; struct omfs_sb_info *sbi = OMFS_SB(sb); struct buffer_head *bh; unsigned long **ptr;