diff options
| author | Jeff Mahoney <jeffm@suse.com> | 2009-10-27 00:49:56 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-10-29 15:39:29 +0100 |
| commit | 47f365eb575735c6b2edf5d08e0d16d26a9c23bd (patch) | |
| tree | 3a6cbb4a7e6bbb9365c8092541a04d3ea1f77ce6 /fs/hfs | |
| parent | loop: fix NULL dereference if mount fails (diff) | |
| download | linux-47f365eb575735c6b2edf5d08e0d16d26a9c23bd.tar.xz linux-47f365eb575735c6b2edf5d08e0d16d26a9c23bd.zip | |
hfs: fix oops on mount with corrupted btree extent records
A particular fsfuzzer run caused an hfs file system to crash on mount.
This is due to a corrupted MDB extent record causing a miscalculation of
HFS_I(inode)->first_blocks for the extent tree. If the extent records are
zereod out, it won't trigger the first_blocks special case. Instead it
falls through to the extent code which we're still in the middle of
initializing.
This patch catches the 0 size extent records, reports the corruption, and
fails the mount.
Reported-by: Ramon de Carvalho Valle <rcvalle@linux.vnet.ibm.com>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Cc: Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/hfs')
| -rw-r--r-- | fs/hfs/btree.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c index 9b9d6395bad3..052f214ea6f0 100644 --- a/fs/hfs/btree.c +++ b/fs/hfs/btree.c @@ -58,6 +58,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke } unlock_new_inode(tree->inode); + if (!HFS_I(tree->inode)->first_blocks) { + printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n"); + goto free_inode; + } + mapping = tree->inode->i_mapping; page = read_mapping_page(mapping, 0, NULL); if (IS_ERR(page)) |