From 1e46ce6f0b5f1e2f8197c24ff551f9ebdfc3f4de Mon Sep 17 00:00:00 2001
From: Hartmut Reuter <reuter@rzg.mpg.de>
Date: Mon, 23 Apr 2001 08:01:09 +0000
Subject: [PATCH] STABLE10-make-getfreetag-find-correct-free-tags-20010423

"I have found a "nice" bug in namei_ops.c:

In GetFreeTag() the following code was used to find a free place in the
link table entry:

    /* Now find a free column in this row and claim it. */
    coldata = 0x7;
    for (col = 0; col<NAMEI_MAXVOLS; col++) {
        coldata <<= col * 3;
        if ((row & coldata) == 0)
            break;
    }

What happens?
With col == 0 we look for the bits 0x7. This is ok.
With col == 1 we look for the bits 0x38. This is also ok.
With col == 2 we look for the bits 0xe00 instead of 0x1c0 !!!
But later the allocation is done correctly with 0x40.
Thus the next time he will find again a free place for col == 2 !
For higher values of col the test is also incorrect, of course."
---
 src/vol/namei_ops.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/vol/namei_ops.c b/src/vol/namei_ops.c
index d4fa19222..4694ed363 100644
--- a/src/vol/namei_ops.c
+++ b/src/vol/namei_ops.c
@@ -876,11 +876,10 @@ static int GetFreeTag(IHandle_t *ih, int vno)
     }
 	
     /* Now find a free column in this row and claim it. */
-    coldata = 0x7;
     for (col = 0; col<NAMEI_MAXVOLS; col++) {
-	coldata <<= col * 3;
-	if ((row & coldata) == 0)
-	    break;
+        coldata = 7 << (col * 3);
+        if ((row & coldata) == 0)
+            break;
     }
     if (col >= NAMEI_MAXVOLS)
 	goto badGetFreeTag;
-- 
2.39.5