• Geert Uytterhoeven's avatar
    m68k: bitops - Never step beyond the end of the bitmap · f82a519f
    Geert Uytterhoeven authored
    find_next bitops on m68k (find_next_zero_bit, find_next_bit, and
    find_next_bit_le) may cause out of bounds memory access
    when the bitmap size in bits % 32 != 0 and offset (the bitnumber
    to start searching at) is very close to the bitmap size.
    
    For example,
    
           unsigned long bitmap[2] = { 0, 0 };
           find_next_bit(bitmap, 63, 62);
    
    1. find_next_bit() tries to find any set bits in bitmap[1],
       but no bits set.
    
    2. Then find_first_bit(bimap + 2, -1)
    
    3. Unfortunately find_first_bit() takes unsigned int as the size argument.
    
    4. find_first_bit will access bitmap[2~] until it find any set bits.
    
    Add missing tests for stepping beyond the end of the bitmap to all
    find_{first,next}_*() functions, and make sure they never return a value
    larger than the bitmap size.
    Reported-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
    Cc: Andreas Schwab <schwab@linux-m68k.org>
    Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
    f82a519f
bitops_mm.h 10.7 KB