From: Akinobu Mita Date: Mon, 21 Mar 2011 12:32:53 +0000 (-0400) Subject: bfs: fix bitmap size argument to find_first_zero_bit() X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=69b195be51620d72956acbf3029adad5765695dc;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git bfs: fix bitmap size argument to find_first_zero_bit() The usage of find_first_zero_bit() in bfs_create() is wrong for two reasons. The bitmap size argument to find_first_zero_bit() is info->si_lasti but the correct bitmap size is info->si_lasti + 1 as info->si_lasti is the last valid index in info->si_imap bitmap. Another problem is that it is impossible to detect that info->si_imap bitmap is full because there is an off-by-one bug in the return value check for find_first_zero_bit(). If no zero bits exist in info->si_imap, find_first_zero_bit() returns info->si_lasti. But the check can't catch it due to the off-by-one. Signed-off-by: Akinobu Mita Acked-by: "Tigran A. Aivazian" Signed-off-by: Andrew Morton Signed-off-by: Al Viro --- diff --git a/fs/bfs/dir.c b/fs/bfs/dir.c index 685ecff3ab31..b14cebfd9047 100644 --- a/fs/bfs/dir.c +++ b/fs/bfs/dir.c @@ -97,7 +97,7 @@ static int bfs_create(struct inode *dir, struct dentry *dentry, int mode, if (!inode) return -ENOSPC; mutex_lock(&info->bfs_lock); - ino = find_first_zero_bit(info->si_imap, info->si_lasti); + ino = find_first_zero_bit(info->si_imap, info->si_lasti + 1); if (ino > info->si_lasti) { mutex_unlock(&info->bfs_lock); iput(inode);