• Bob Copeland's avatar
    omfs: fix sign confusion for bitmap loop counter · c0345ee5
    Bob Copeland authored
    The count variable is used to iterate down to (below) zero from the size
    of the bitmap and handle the one-filling the remainder of the last
    partial bitmap block.  The loop conditional expects count to be signed
    in order to detect when the final block is processed, after which count
    goes negative.
    
    Unfortunately, a recent change made this unsigned along with some other
    related fields.  The result of is this is that during mount,
    omfs_get_imap will overrun the bitmap array and corrupt memory unless
    number of blocks happens to be a multiple of 8 * blocksize.
    
    Fix by changing count back to signed: it is guaranteed to fit in an s32
    without overflow due to an enforced limit on the number of blocks in the
    filesystem.
    Signed-off-by: default avatarBob Copeland <me@bobcopeland.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    c0345ee5
inode.c 13.7 KB