This is a note to let you know that I've just added the patch titled
lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}()
to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch
and it can be found in the queue-3.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From ea5d05b34aca25c066e0699512d0ffbd8ee6ac3e Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@xxxxxxx>
Date: Wed, 29 Oct 2014 14:50:44 -0700
Subject: lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}()
From: Jan Kara <jack@xxxxxxx>
commit ea5d05b34aca25c066e0699512d0ffbd8ee6ac3e upstream.
If __bitmap_shift_left() or __bitmap_shift_right() are asked to shift by
a multiple of BITS_PER_LONG, they will try to shift a long value by
BITS_PER_LONG bits which is undefined. Change the functions to avoid
the undefined shift.
Coverity id: 1192175
Coverity id: 1192174
Signed-off-by: Jan Kara <jack@xxxxxxx>
Cc: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
lib/bitmap.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long
lower = src[off + k];
if (left && off + k == lim - 1)
lower &= mask;
- dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem;
+ dst[k] = lower >> rem;
+ if (rem)
+ dst[k] |= upper << (BITS_PER_LONG - rem);
if (left && k == lim - 1)
dst[k] &= mask;
}
@@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long *
upper = src[k];
if (left && k == lim - 1)
upper &= (1UL << left) - 1;
- dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem;
+ dst[k + off] = upper << rem;
+ if (rem)
+ dst[k + off] |= lower >> (BITS_PER_LONG - rem);
if (left && k + off == lim - 1)
dst[k + off] &= (1UL << left) - 1;
}
Patches currently in stable-queue which might be from jack@xxxxxxx are
queue-3.10/evm-check-xattr-value-length-and-type-in-evm_inode_setxattr.patch
queue-3.10/scsi-fix-error-handling-in-scsi_ioctl_send_command.patch
queue-3.10/ext4-don-t-check-quota-format-when-there-are-no-quota-files.patch
queue-3.10/lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch
queue-3.10/ext4-fix-oops-when-loading-block-bitmap-failed.patch
queue-3.10/vfs-fix-data-corruption-when-blocksize-pagesize-for-mmaped-data.patch
queue-3.10/ext4-fix-overflow-when-updating-superblock-backups-after-resize.patch
queue-3.10/ext4-grab-missed-write_count-for-ext4_ioc_swap_boot.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html