summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAkinobu Mita <akinobu.mita@gmail.com>2011-03-21 08:32:53 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2011-03-21 08:35:12 -0400
commit69b195be51620d72956acbf3029adad5765695dc (patch)
tree343d1786cf00b9d74f6ea7f5d5590c3bb7656180
parentc212f9aaf9101a037fb7f59e75e639437e11d758 (diff)
downloadlinux-69b195be51620d72956acbf3029adad5765695dc.tar.bz2
bfs: fix bitmap size argument to find_first_zero_bit()
The usage of find_first_zero_bit() in bfs_create() is wrong for two reasons. The bitmap size argument to find_first_zero_bit() is info->si_lasti but the correct bitmap size is info->si_lasti + 1 as info->si_lasti is the last valid index in info->si_imap bitmap. Another problem is that it is impossible to detect that info->si_imap bitmap is full because there is an off-by-one bug in the return value check for find_first_zero_bit(). If no zero bits exist in info->si_imap, find_first_zero_bit() returns info->si_lasti. But the check can't catch it due to the off-by-one. Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Acked-by: "Tigran A. Aivazian" <tigran@aivazian.fsnet.co.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--fs/bfs/dir.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/bfs/dir.c b/fs/bfs/dir.c
index 685ecff3ab31..b14cebfd9047 100644
--- a/fs/bfs/dir.c
+++ b/fs/bfs/dir.c
@@ -97,7 +97,7 @@ static int bfs_create(struct inode *dir, struct dentry *dentry, int mode,
if (!inode)
return -ENOSPC;
mutex_lock(&info->bfs_lock);
- ino = find_first_zero_bit(info->si_imap, info->si_lasti);
+ ino = find_first_zero_bit(info->si_imap, info->si_lasti + 1);
if (ino > info->si_lasti) {
mutex_unlock(&info->bfs_lock);
iput(inode);