lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

omfs: check bounds on block numbers before passing to sb_bread

Browse Source 
In case of filesystem corruption, passing unchecked block numbers into
sb_bread can result in an infinite loop in __getblk().  Introduce a wrapper
function omfs_sbread() to check the block numbers and to also perform the
clus_to_blk() scaling.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
This commit is contained in:
Bob Copeland
2008-09-06 17:51:53 -04:00
parent 70d9e384aa
commit f068272cb2
4 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
fs/omfs/file.c
View File

@@ -50,7 +50,7 @@ int omfs_shrink_inode(struct inode *inode)
if (inode->i_size != 0)
goto out;
bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
bh = omfs_bread(inode->i_sb, next);
if (!bh)
goto out;
@@ -90,7 +90,7 @@ int omfs_shrink_inode(struct inode *inode)
if (next == ~0)
break;
bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
bh = omfs_bread(inode->i_sb, next);
if (!bh)
goto out;
oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]);
@@ -232,7 +232,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
int remain;
ret = -EIO;
bh = sb_bread(inode->i_sb, clus_to_blk(sbi, inode->i_ino));
bh = omfs_bread(inode->i_sb, inode->i_ino);
if (!bh)
goto out;
@@ -265,7 +265,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
break;
brelse(bh);
bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
bh = omfs_bread(inode->i_sb, next);
if (!bh)
goto out;
oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]);