From: shashank <jain.sm@gmail.com>
To: Yury Norov <yury.norov@gmail.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>,
Andrew Morton <akpm@linux-foundation.org>,
linux-kernel@vger.kernel.org
Subject: [PATCH 0/6] bitmap: fix three parsing bugs in bitmap_parse() and bitmap_parselist()
Date: Fri, 25 Sep 2026 15:53:01 +0530 [thread overview]
Message-ID: <20260925102307.49513-1-jain.sm@gmail.com> (raw)
This series fixes three cases where the bitmap string parsers accept
input they are documented to reject, or produce a different mask than
the one requested. Each fix is followed by a patch adding the failing
cases to lib/test_bitmap.c.
1-2: bitmap_parse() treats a non-hex character directly before a chunk
of exactly eight hex digits as a separator, so "x12345678" and
"0x0000000f" are accepted while "0xf" is rejected. This is a
regression from the bitmap_parse() rework; the old __bitmap_parse()
rejected all of them.
3-4: bitmap_parselist() does not check for the end of the region after
the group size of a "range:used/group" region, so since N and
all became valid region starts, "0-7:1/2N" or "0-7:1/2all" are
silently parsed as two regions.
5-6: bitmap_parselist() walks a "range:used/group" region with an
unsigned int that wraps around when the group size is close to
UINT_MAX, setting bits below the requested range. This needs an
absurd group size and never writes out of bounds.
With the series applied, test_bitmap reports "all 391544 tests passed"
(UML, x86_64). The three fixes are independent and can be applied in
any order.
smjain (6):
bitmap: bitmap_parse(): reject non-hex character before 8 digits
bitmap: test bitmap_parse() with an illegal character before 8 hex
digits
bitmap: bitmap_parselist(): reject trailing characters after group
size
bitmap: test bitmap_parselist() with text after the group size
bitmap: bitmap_parselist(): don't wrap around on a huge group size
bitmap: test bitmap_parselist() with a group size close to UINT_MAX
lib/bitmap-str.c | 24 +++++++++++++++++++-----
lib/test_bitmap.c | 9 +++++++++
2 files changed, 28 insertions(+), 5 deletions(-)
--
2.43.0
next reply other threads:[~2026-09-25 10:23 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-25 10:23 shashank [this message]
2026-09-25 10:23 ` [PATCH 1/6] bitmap: bitmap_parse(): reject non-hex character before 8 digits shashank
2026-09-25 10:23 ` [PATCH 2/6] bitmap: test bitmap_parse() with an illegal character before 8 hex digits shashank
2026-09-25 10:23 ` [PATCH 3/6] bitmap: bitmap_parselist(): reject trailing characters after group size shashank
2026-09-25 10:23 ` [PATCH 4/6] bitmap: test bitmap_parselist() with text after the " shashank
2026-09-25 10:23 ` [PATCH 5/6] bitmap: bitmap_parselist(): don't wrap around on a huge " shashank
2026-09-25 10:23 ` [PATCH 6/6] bitmap: test bitmap_parselist() with a group size close to UINT_MAX shashank
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260925102307.49513-1-jain.sm@gmail.com \
--to=jain.sm@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@rasmusvillemoes.dk \
--cc=yury.norov@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®