Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b6b41424 authored by Al Viro's avatar Al Viro Committed by Christoph Hellwig
Browse files

hfsplus: hfs_bnode_find() can fail, resulting in hfs_bnode_split() breakage 



oops and fs corruption; the latter can happen even on valid fs in case of oom.

[hch: port of commit 3d10a15d from hfs]

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarChristoph Hellwig <hch@tuxera.com>
parent ee527162

fs/hfsplus/brec.c

+15 −3
Original line number Diff line number Diff line
@@ -216,7 +216,7 @@ int hfs_brec_remove(struct hfs_find_data *fd) 
static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)

{

	struct hfs_btree *tree;

	struct hfs_bnode *node, *new_node;

	struct hfs_bnode *node, *new_node, *next_node;

	struct hfs_bnode_desc node_desc;

	int num_recs, new_rec_off, new_off, old_rec_off;

	int data_start, data_end, size;
@@ -235,6 +235,17 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd) 
	new_node->type = node->type;

	new_node->height = node->height;



	if (node->next)

		next_node = hfs_bnode_find(tree, node->next);

	else

		next_node = NULL;



	if (IS_ERR(next_node)) {

		hfs_bnode_put(node);

		hfs_bnode_put(new_node);

		return next_node;

	}



	size = tree->node_size / 2 - node->num_recs * 2 - 14;

	old_rec_off = tree->node_size - 4;

	num_recs = 1;
@@ -248,6 +259,8 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd) 
		/* panic? */

		hfs_bnode_put(node);

		hfs_bnode_put(new_node);

		if (next_node)

			hfs_bnode_put(next_node);

		return ERR_PTR(-ENOSPC);

	}
@@ -302,8 +315,7 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd) 
	hfs_bnode_write(node, &node_desc, 0, sizeof(node_desc));



	/* update next bnode header */

	if (new_node->next) {

		struct hfs_bnode *next_node = hfs_bnode_find(tree, new_node->next);

	if (next_node) {

		next_node->prev = new_node->this;

		hfs_bnode_read(next_node, &node_desc, 0, sizeof(node_desc));

		node_desc.prev = cpu_to_be32(next_node->prev);