Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76e51210 authored by Fabian Frederick's avatar Fabian Frederick Committed by Linus Torvalds
Browse files

FS/OMFS: block number sanity check during fill_super operation 



This patch defines maximum block number to 2^31.  It also converts
bitmap_size and array_size to unsigned int in omfs_get_imap

Signed-off-by: default avatarFabian Frederick <fabf@skynet.be>
Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Suggested-by: default avatarBob Copeland <me@bobcopeland.com>
Acked-by: default avatarBob Copeland <me@bobcopeland.com>
Tested-by: default avatarBob Copeland <me@bobcopeland.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5ef98192

fs/omfs/inode.c

+7 −3
Original line number Original line Diff line number Diff line
@@ -306,9 +306,7 @@ static const struct super_operations omfs_sops = { 
 */

 */

static int omfs_get_imap(struct super_block *sb)

static int omfs_get_imap(struct super_block *sb)

{

{

	int bitmap_size;

	unsigned int bitmap_size, count, array_size;

	int array_size;

	int count;

	struct omfs_sb_info *sbi = OMFS_SB(sb);

	struct omfs_sb_info *sbi = OMFS_SB(sb);

	struct buffer_head *bh;

	struct buffer_head *bh;

	unsigned long **ptr;

	unsigned long **ptr;
@@ -473,6 +471,12 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent) 
	sbi->s_sys_blocksize = be32_to_cpu(omfs_sb->s_sys_blocksize);

	sbi->s_sys_blocksize = be32_to_cpu(omfs_sb->s_sys_blocksize);

	mutex_init(&sbi->s_bitmap_lock);

	mutex_init(&sbi->s_bitmap_lock);





	if (sbi->s_num_blocks > OMFS_MAX_BLOCKS) {

		printk(KERN_ERR "omfs: sysblock number (%llx) is out of range\n",

		       (unsigned long long)sbi->s_num_blocks);

		goto out_brelse_bh;

	}



	if (sbi->s_sys_blocksize > PAGE_SIZE) {

	if (sbi->s_sys_blocksize > PAGE_SIZE) {

		printk(KERN_ERR "omfs: sysblock size (%d) is out of range\n",

		printk(KERN_ERR "omfs: sysblock size (%d) is out of range\n",

			sbi->s_sys_blocksize);

			sbi->s_sys_blocksize);

fs/omfs/omfs_fs.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -18,6 +18,7 @@ 
#define OMFS_XOR_COUNT 19

#define OMFS_XOR_COUNT 19

#define OMFS_MAX_BLOCK_SIZE 8192

#define OMFS_MAX_BLOCK_SIZE 8192

#define OMFS_MAX_CLUSTER_SIZE 8

#define OMFS_MAX_CLUSTER_SIZE 8

#define OMFS_MAX_BLOCKS (1ul << 31)





struct omfs_super_block {

struct omfs_super_block {

	char s_fill1[256];

	char s_fill1[256];