diff options
| author | Bob Copeland <me@bobcopeland.com> | 2008-09-06 17:51:53 -0400 |
|---|---|---|
| committer | Bob Copeland <me@bobcopeland.com> | 2010-07-10 14:37:06 -0400 |
| commit | f068272cb2f134a194b93e94a8e0672bfce48cd8 (patch) | |
| tree | c6a2a67951646eee3d040b732b384fa5c98fe78c /fs/omfs/file.c | |
| parent | 70d9e384aa7df681cfffd65947af72b22e86690e (diff) | |
| download | linux-3.10-f068272cb2f134a194b93e94a8e0672bfce48cd8.tar.gz linux-3.10-f068272cb2f134a194b93e94a8e0672bfce48cd8.tar.bz2 linux-3.10-f068272cb2f134a194b93e94a8e0672bfce48cd8.zip | |
omfs: check bounds on block numbers before passing to sb_bread
In case of filesystem corruption, passing unchecked block numbers into
sb_bread can result in an infinite loop in __getblk(). Introduce a wrapper
function omfs_sbread() to check the block numbers and to also perform the
clus_to_blk() scaling.
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Diffstat (limited to 'fs/omfs/file.c')
| -rw-r--r-- | fs/omfs/file.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/omfs/file.c b/fs/omfs/file.c index 6e7a3291bbe..76bc21b91a8 100644 --- a/fs/omfs/file.c +++ b/fs/omfs/file.c @@ -50,7 +50,7 @@ int omfs_shrink_inode(struct inode *inode) if (inode->i_size != 0) goto out; - bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next)); + bh = omfs_bread(inode->i_sb, next); if (!bh) goto out; @@ -90,7 +90,7 @@ int omfs_shrink_inode(struct inode *inode) if (next == ~0) break; - bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next)); + bh = omfs_bread(inode->i_sb, next); if (!bh) goto out; oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]); @@ -232,7 +232,7 @@ static int omfs_get_block(struct inode *inode, sector_t block, int remain; ret = -EIO; - bh = sb_bread(inode->i_sb, clus_to_blk(sbi, inode->i_ino)); + bh = omfs_bread(inode->i_sb, inode->i_ino); if (!bh) goto out; @@ -265,7 +265,7 @@ static int omfs_get_block(struct inode *inode, sector_t block, break; brelse(bh); - bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next)); + bh = omfs_bread(inode->i_sb, next); if (!bh) goto out; oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]); |