summaryrefslogtreecommitdiff
path: root/fs/omfs/file.c
diff options
context:
space:
mode:
authorBob Copeland <me@bobcopeland.com>2008-09-06 17:51:53 -0400
committerBob Copeland <me@bobcopeland.com>2010-07-10 14:37:06 -0400
commitf068272cb2f134a194b93e94a8e0672bfce48cd8 (patch)
treec6a2a67951646eee3d040b732b384fa5c98fe78c /fs/omfs/file.c
parent70d9e384aa7df681cfffd65947af72b22e86690e (diff)
downloadlinux-3.10-f068272cb2f134a194b93e94a8e0672bfce48cd8.tar.gz
linux-3.10-f068272cb2f134a194b93e94a8e0672bfce48cd8.tar.bz2
linux-3.10-f068272cb2f134a194b93e94a8e0672bfce48cd8.zip
omfs: check bounds on block numbers before passing to sb_bread
In case of filesystem corruption, passing unchecked block numbers into sb_bread can result in an infinite loop in __getblk(). Introduce a wrapper function omfs_sbread() to check the block numbers and to also perform the clus_to_blk() scaling. Signed-off-by: Bob Copeland <me@bobcopeland.com>
Diffstat (limited to 'fs/omfs/file.c')
-rw-r--r--fs/omfs/file.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/omfs/file.c b/fs/omfs/file.c
index 6e7a3291bbe..76bc21b91a8 100644
--- a/fs/omfs/file.c
+++ b/fs/omfs/file.c
@@ -50,7 +50,7 @@ int omfs_shrink_inode(struct inode *inode)
if (inode->i_size != 0)
goto out;
- bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
+ bh = omfs_bread(inode->i_sb, next);
if (!bh)
goto out;
@@ -90,7 +90,7 @@ int omfs_shrink_inode(struct inode *inode)
if (next == ~0)
break;
- bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
+ bh = omfs_bread(inode->i_sb, next);
if (!bh)
goto out;
oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]);
@@ -232,7 +232,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
int remain;
ret = -EIO;
- bh = sb_bread(inode->i_sb, clus_to_blk(sbi, inode->i_ino));
+ bh = omfs_bread(inode->i_sb, inode->i_ino);
if (!bh)
goto out;
@@ -265,7 +265,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
break;
brelse(bh);
- bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
+ bh = omfs_bread(inode->i_sb, next);
if (!bh)
goto out;
oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]);