mirror of
https://github.com/SCST-project/scst.git
synced 2026-10-22 14:12:33 +00:00
Gleb Chesnokov
2d7183ce83
When every valid fallback tag is occupied, find_first_zero_bit returns tag_num. The old loop calls test_and_set_bit before checking that sentinel. If the bit was clear, it even exits the loop without checking the range and uses tag_num as an index into tgt_cmd_map. For word-aligned pool sizes this touches a word beyond the bitmap. For other sizes it can claim padding in the last word. Both cases can return an out-of-range command-map entry and let memset overwrite memory beyond the map. Manual review found this bounds bug while auditing the fallback allocation flagged by Coccinelle null/kmerr.cocci. No separate analyzer diagnostic reported the invalid bitmap or command-map access. Check the sentinel before test_and_set_bit and return -ENOENT when no tag is available. Preserve the retry when another allocator wins the bit. Expose the helper to the QLA KUnit suite in qla2x00tgt.ko. Add KUnit cases for exhausted pools at word and non-word boundaries, an empty pool, unchanged guard words and reuse of the final valid tag. A spare guard word makes the old invalid access observable without needing an actual out-of-bounds access in the test fixture.
