Skip to content

Commit 8351760

Browse files
norovtorvalds
authored andcommitted
lib: fix stall in __bitmap_parselist()
syzbot is catching stalls at __bitmap_parselist() (https://syzkaller.appspot.com/bug?id=ad7e0351fbc90535558514a71cd3edc11681997a). The trigger is unsigned long v = 0; bitmap_parselist("7:,", &v, BITS_PER_LONG); which results in hitting infinite loop at while (a <= b) { off = min(b - a + 1, used_size); bitmap_set(maskp, a, off); a += group_size; } due to used_size == group_size == 0. Link: http://lkml.kernel.org/r/[email protected] Fixes: 0a5ce08 ("lib/bitmap.c: make bitmap_parselist() thread-safe and much faster") Signed-off-by: Yury Norov <[email protected]> Reported-by: Tetsuo Handa <[email protected]> Reported-by: syzbot <[email protected]> Cc: Noam Camus <[email protected]> Cc: Rasmus Villemoes <[email protected]> Cc: Matthew Wilcox <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
1 parent 5df63c2 commit 8351760

File tree

2 files changed

+5
-1
lines changed

2 files changed

+5
-1
lines changed

lib/bitmap.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -607,7 +607,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
607607
/* if no digit is after '-', it's wrong*/
608608
if (at_start && in_range)
609609
return -EINVAL;
610-
if (!(a <= b) || !(used_size <= group_size))
610+
if (!(a <= b) || group_size == 0 || !(used_size <= group_size))
611611
return -EINVAL;
612612
if (b >= nmaskbits)
613613
return -ERANGE;

lib/test_bitmap.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,10 @@ static const struct test_bitmap_parselist parselist_tests[] __initconst = {
255255
{-EINVAL, "-1", NULL, 8, 0},
256256
{-EINVAL, "-0", NULL, 8, 0},
257257
{-EINVAL, "10-1", NULL, 8, 0},
258+
{-EINVAL, "0-31:", NULL, 8, 0},
259+
{-EINVAL, "0-31:0", NULL, 8, 0},
260+
{-EINVAL, "0-31:0/0", NULL, 8, 0},
261+
{-EINVAL, "0-31:1/0", NULL, 8, 0},
258262
{-EINVAL, "0-31:10/1", NULL, 8, 0},
259263
};
260264

0 commit comments

Comments
 (0)