diff options
| author | Al Viro <viro@ftp.linux.org.uk> | 2010-10-14 09:53:42 -0400 |
|---|---|---|
| committer | Christoph Hellwig <hch@lst.de> | 2010-10-14 09:53:42 -0400 |
| commit | b6b41424f0ec28e9a167fa29b003327860b4b71b (patch) | |
| tree | 9e17a235542259f82a3a1e2c3d2a1906f2ac4749 /fs/hfsplus | |
| parent | ee52716245877b821f5ddbb3ace85b73084fb450 (diff) | |
| download | linux-b6b41424f0ec28e9a167fa29b003327860b4b71b.tar.bz2 | |
hfsplus: hfs_bnode_find() can fail, resulting in hfs_bnode_split() breakage
oops and fs corruption; the latter can happen even on valid fs in case of oom.
[hch: port of commit 3d10a15d6919488204bdb264050d156ced20d9aa from hfs]
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Christoph Hellwig <hch@tuxera.com>
Diffstat (limited to 'fs/hfsplus')
| -rw-r--r-- | fs/hfsplus/brec.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c index c88e5d72a402..fa903641992f 100644 --- a/fs/hfsplus/brec.c +++ b/fs/hfsplus/brec.c @@ -216,7 +216,7 @@ skip: static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd) { struct hfs_btree *tree; - struct hfs_bnode *node, *new_node; + struct hfs_bnode *node, *new_node, *next_node; struct hfs_bnode_desc node_desc; int num_recs, new_rec_off, new_off, old_rec_off; int data_start, data_end, size; @@ -235,6 +235,17 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd) new_node->type = node->type; new_node->height = node->height; + if (node->next) + next_node = hfs_bnode_find(tree, node->next); + else + next_node = NULL; + + if (IS_ERR(next_node)) { + hfs_bnode_put(node); + hfs_bnode_put(new_node); + return next_node; + } + size = tree->node_size / 2 - node->num_recs * 2 - 14; old_rec_off = tree->node_size - 4; num_recs = 1; @@ -248,6 +259,8 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd) /* panic? */ hfs_bnode_put(node); hfs_bnode_put(new_node); + if (next_node) + hfs_bnode_put(next_node); return ERR_PTR(-ENOSPC); } @@ -302,8 +315,7 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd) hfs_bnode_write(node, &node_desc, 0, sizeof(node_desc)); /* update next bnode header */ - if (new_node->next) { - struct hfs_bnode *next_node = hfs_bnode_find(tree, new_node->next); + if (next_node) { next_node->prev = new_node->this; hfs_bnode_read(next_node, &node_desc, 0, sizeof(node_desc)); node_desc.prev = cpu_to_be32(next_node->prev); |