Patch "fs/file: fix the check in find_next_fd()" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    fs/file: fix the check in find_next_fd()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fs-file-fix-the-check-in-find_next_fd.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ea1ccda240634b66c9583df34b85dd9d165e6f8d
Author: Yuntao Wang <yuntao.wang@xxxxxxxxx>
Date:   Thu May 30 00:06:56 2024 +0800

    fs/file: fix the check in find_next_fd()
    
    [ Upstream commit ed8c7fbdfe117abbef81f65428ba263118ef298a ]
    
    The maximum possible return value of find_next_zero_bit(fdt->full_fds_bits,
    maxbit, bitbit) is maxbit. This return value, multiplied by BITS_PER_LONG,
    gives the value of bitbit, which can never be greater than maxfd, it can
    only be equal to maxfd at most, so the following check 'if (bitbit > maxfd)'
    will never be true.
    
    Moreover, when bitbit equals maxfd, it indicates that there are no unused
    fds, and the function can directly return.
    
    Fix this check.
    
    Signed-off-by: Yuntao Wang <yuntao.wang@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20240529160656.209352-1-yuntao.wang@xxxxxxxxx
    Reviewed-by: Jan Kara <jack@xxxxxxx>
    Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/file.c b/fs/file.c
index dbca26ef7a01a..69386c2e37c50 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -481,12 +481,12 @@ struct files_struct init_files = {
 
 static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start)
 {
-	unsigned int maxfd = fdt->max_fds;
+	unsigned int maxfd = fdt->max_fds; /* always multiple of BITS_PER_LONG */
 	unsigned int maxbit = maxfd / BITS_PER_LONG;
 	unsigned int bitbit = start / BITS_PER_LONG;
 
 	bitbit = find_next_zero_bit(fdt->full_fds_bits, maxbit, bitbit) * BITS_PER_LONG;
-	if (bitbit > maxfd)
+	if (bitbit >= maxfd)
 		return maxfd;
 	if (bitbit > start)
 		start = bitbit;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux