From: Shashank Mohan Jain <jain.sm@gmail.com>
To: Yury Norov <yury.norov@gmail.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>,
Andrew Morton <akpm@linux-foundation.org>,
linux-kernel@vger.kernel.org
Subject: [PATCH v2 0/6] bitmap: fix three parsing bugs in bitmap_parse() and bitmap_parselist()
Date: Sat, 26 Sep 2026 06:56:45 +0530 [thread overview]
Message-ID: <20260926012651.15524-1-jain.sm@gmail.com> (raw)
This series fixes three cases where the bitmap string parsers accept
input they are documented to reject, or produce a different mask than
the one requested. Each fix is followed by a patch adding the failing
cases to lib/test_bitmap.c.
1-2: bitmap_parse() treats a non-hex character directly before a chunk
of exactly eight hex digits as a separator, so "x12345678" and
"0x0000000f" are accepted while "0xf" is rejected. This is a
regression from the bitmap_parse() rework; the old __bitmap_parse()
rejected all of them.
3-4: bitmap_parselist() does not check for the end of the region after
the group size of a "range:used/group" region, so since N and
all became valid region starts, "0-7:1/2N" or "0-7:1/2all" are
silently parsed as two regions.
5-6: bitmap_parselist() walks a "range:used/group" region with an
unsigned int that wraps around when the group size is close to
UINT_MAX, setting bits below the requested range. This needs an
absurd group size and never writes out of bounds.
With the series applied, test_bitmap reports "all 391544 tests passed"
(UML, x86_64). The three fixes are independent and can be applied in
any order.
These patches were prepared with Claude Code (Anthropic), model Claude Opus 5.5
(claude-opus-5-5): the analysis, the Lean models used to find and check the bugs,
the fixes and the tests. I reviewed them and take responsibility for them. The
trailer only says "Assisted-by: LLM", as Documentation/process/coding-assistants.rst
requires since commit 816d9992d9ed ("coding-assistants: simplify attribution").
Changes in v2:
- Resent with my full name, as asked by Yury.
- Stated the tool and model used above.
- No code changes.
v1: https://lore.kernel.org/r/20260925102307.49513-1-jain.sm@gmail.com
smjain (6):
bitmap: bitmap_parse(): reject non-hex character before 8 digits
bitmap: test bitmap_parse() with an illegal character before 8 hex
digits
bitmap: bitmap_parselist(): reject trailing characters after group
size
bitmap: test bitmap_parselist() with text after the group size
bitmap: bitmap_parselist(): don't wrap around on a huge group size
bitmap: test bitmap_parselist() with a group size close to UINT_MAX
lib/bitmap-str.c | 24 +++++++++++++++++++-----
lib/test_bitmap.c | 9 +++++++++
2 files changed, 28 insertions(+), 5 deletions(-)
--
2.43.0
next reply other threads:[~2026-09-26 1:26 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-26 1:26 Shashank Mohan Jain [this message]
2026-09-26 1:26 ` [PATCH v2 1/6] bitmap: bitmap_parse(): reject non-hex character before 8 digits Shashank Mohan Jain
2026-09-26 1:26 ` [PATCH v2 2/6] bitmap: test bitmap_parse() with an illegal character before 8 hex digits Shashank Mohan Jain
2026-09-26 1:26 ` [PATCH v2 3/6] bitmap: bitmap_parselist(): reject trailing characters after group size Shashank Mohan Jain
2026-09-26 1:26 ` [PATCH v2 4/6] bitmap: test bitmap_parselist() with text after the " Shashank Mohan Jain
2026-09-26 1:26 ` [PATCH v2 5/6] bitmap: bitmap_parselist(): don't wrap around on a huge " Shashank Mohan Jain
2026-09-26 1:26 ` [PATCH v2 6/6] bitmap: test bitmap_parselist() with a group size close to UINT_MAX Shashank Mohan Jain
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260926012651.15524-1-jain.sm@gmail.com \
--to=jain.sm@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@rasmusvillemoes.dk \
--cc=yury.norov@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®