diff options
| author | Akinobu Mita <akinobu.mita@gmail.com> | 2011-03-21 08:32:53 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2011-03-21 08:35:12 -0400 |
| commit | 69b195be51620d72956acbf3029adad5765695dc (patch) | |
| tree | 343d1786cf00b9d74f6ea7f5d5590c3bb7656180 /fs | |
| parent | c212f9aaf9101a037fb7f59e75e639437e11d758 (diff) | |
| download | op-kernel-dev-69b195be51620d72956acbf3029adad5765695dc.zip op-kernel-dev-69b195be51620d72956acbf3029adad5765695dc.tar.gz | |
bfs: fix bitmap size argument to find_first_zero_bit()
The usage of find_first_zero_bit() in bfs_create() is wrong for two
reasons.
The bitmap size argument to find_first_zero_bit() is info->si_lasti but
the correct bitmap size is info->si_lasti + 1 as info->si_lasti is the
last valid index in info->si_imap bitmap.
Another problem is that it is impossible to detect that info->si_imap
bitmap is full because there is an off-by-one bug in the return value
check for find_first_zero_bit(). If no zero bits exist in info->si_imap,
find_first_zero_bit() returns info->si_lasti. But the check can't catch
it due to the off-by-one.
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: "Tigran A. Aivazian" <tigran@aivazian.fsnet.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/bfs/dir.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/bfs/dir.c b/fs/bfs/dir.c index 685ecff..b14cebf 100644 --- a/fs/bfs/dir.c +++ b/fs/bfs/dir.c @@ -97,7 +97,7 @@ static int bfs_create(struct inode *dir, struct dentry *dentry, int mode, if (!inode) return -ENOSPC; mutex_lock(&info->bfs_lock); - ino = find_first_zero_bit(info->si_imap, info->si_lasti); + ino = find_first_zero_bit(info->si_imap, info->si_lasti + 1); if (ino > info->si_lasti) { mutex_unlock(&info->bfs_lock); iput(inode); |
