6 files changed, 60 insertions, 31 deletions

diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index a6779b3e873c..07eeb0b4ca74 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -543,12 +543,12 @@ xfs_btree_ptr_addr(
  */
 STATIC struct xfs_btree_block *
 xfs_btree_get_iroot(
-       struct xfs_btree_cur    *cur)
+        struct xfs_btree_cur    *cur)
 {
-       struct xfs_ifork        *ifp;
+        struct xfs_ifork        *ifp;
 
-       ifp = XFS_IFORK_PTR(cur->bc_private.b.ip, cur->bc_private.b.whichfork);
-       return (struct xfs_btree_block *)ifp->if_broot;
+        ifp = XFS_IFORK_PTR(cur->bc_private.b.ip, cur->bc_private.b.whichfork);
+        return (struct xfs_btree_block *)ifp->if_broot;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index dc97eb21af07..adb204d40f22 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -1435,41 +1435,57 @@ typedef __be64 xfs_bmbt_ptr_t, xfs_bmdr_ptr_t;
  * with the crc feature bit, and all accesses to them must be conditional on
  * that flag.
  */
+/* short form block header */
+struct xfs_btree_block_shdr {
+        __be32          bb_leftsib;
+        __be32          bb_rightsib;
+
+        __be64          bb_blkno;
+        __be64          bb_lsn;
+        uuid_t          bb_uuid;
+        __be32          bb_owner;
+        __le32          bb_crc;
+};
+
+/* long form block header */
+struct xfs_btree_block_lhdr {
+        __be64          bb_leftsib;
+        __be64          bb_rightsib;
+
+        __be64          bb_blkno;
+        __be64          bb_lsn;
+        uuid_t          bb_uuid;
+        __be64          bb_owner;
+        __le32          bb_crc;
+        __be32          bb_pad; /* padding for alignment */
+};
+
 struct xfs_btree_block {
         __be32          bb_magic;       /* magic number for block type */
         __be16          bb_level;       /* 0 is a leaf */
         __be16          bb_numrecs;     /* current # of data records */
         union {
-                struct {
-                        __be32          bb_leftsib;
-                        __be32          bb_rightsib;
-
-                        __be64          bb_blkno;
-                        __be64          bb_lsn;
-                        uuid_t          bb_uuid;
-                        __be32          bb_owner;
-                        __le32          bb_crc;
-                } s;                    /* short form pointers */
-                struct  {
-                        __be64          bb_leftsib;
-                        __be64          bb_rightsib;
-
-                        __be64          bb_blkno;
-                        __be64          bb_lsn;
-                        uuid_t          bb_uuid;
-                        __be64          bb_owner;
-                        __le32          bb_crc;
-                        __be32          bb_pad; /* padding for alignment */
-                } l;                    /* long form pointers */
+                struct xfs_btree_block_shdr s;
+                struct xfs_btree_block_lhdr l;
         } bb_u;                         /* rest */
 };
 
-#define XFS_BTREE_SBLOCK_LEN    16      /* size of a short form block */
-#define XFS_BTREE_LBLOCK_LEN    24      /* size of a long form block */
+/* size of a short form block */
+#define XFS_BTREE_SBLOCK_LEN \
+        (offsetof(struct xfs_btree_block, bb_u) + \
+         offsetof(struct xfs_btree_block_shdr, bb_blkno))
+/* size of a long form block */
+#define XFS_BTREE_LBLOCK_LEN \
+        (offsetof(struct xfs_btree_block, bb_u) + \
+         offsetof(struct xfs_btree_block_lhdr, bb_blkno))
 
 /* sizes of CRC enabled btree blocks */
-#define XFS_BTREE_SBLOCK_CRC_LEN        (XFS_BTREE_SBLOCK_LEN + 40)
-#define XFS_BTREE_LBLOCK_CRC_LEN        (XFS_BTREE_LBLOCK_LEN + 48)
+#define XFS_BTREE_SBLOCK_CRC_LEN \
+        (offsetof(struct xfs_btree_block, bb_u) + \
+         sizeof(struct xfs_btree_block_shdr))
+#define XFS_BTREE_LBLOCK_CRC_LEN \
+        (offsetof(struct xfs_btree_block, bb_u) + \
+         sizeof(struct xfs_btree_block_lhdr))
 
 #define XFS_BTREE_SBLOCK_CRC_OFF \
         offsetof(struct xfs_btree_block, bb_u.s.bb_crc)
diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c
index 355619ae5e3e..ed7ee4e8af73 100644
--- a/fs/xfs/xfs_error.c
+++ b/fs/xfs/xfs_error.c
@@ -55,7 +55,7 @@ xfs_error_test(int error_tag, int *fsidp, char *expression,
 }
 
 int
-xfs_errortag_add(int error_tag, xfs_mount_t *mp)
+xfs_errortag_add(unsigned int error_tag, xfs_mount_t *mp)
 {
         int i;
         int len;
diff --git a/fs/xfs/xfs_error.h b/fs/xfs/xfs_error.h
index 4ed3042a0f16..2e4f67f68856 100644
--- a/fs/xfs/xfs_error.h
+++ b/fs/xfs/xfs_error.h
@@ -128,7 +128,7 @@ extern int xfs_error_test(int, int *, char *, int, char *, unsigned long);
          xfs_error_test((tag), (mp)->m_fixedfsid, "expr", __LINE__, __FILE__, \
                         (rf))))
 
-extern int xfs_errortag_add(int error_tag, struct xfs_mount *mp);
+extern int xfs_errortag_add(unsigned int error_tag, struct xfs_mount *mp);
 extern int xfs_errortag_clearall(struct xfs_mount *mp, int loud);
 #else
 #define XFS_TEST_ERROR(expr, mp, tag, rf)       (expr)
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index dbca7375deef..408f3ad348ab 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1575,6 +1575,17 @@ xfs_ioc_swapext(
                 goto out_put_tmp_file;
         }
 
+        /*
+         * We need to ensure that the fds passed in point to XFS inodes
+         * before we cast and access them as XFS structures as we have no
+         * control over what the user passes us here.
+         */
+        if (f.file->f_op != &xfs_file_operations ||
+            tmp.file->f_op != &xfs_file_operations) {
+                error = -EINVAL;
+                goto out_put_tmp_file;
+        }
+
         ip = XFS_I(file_inode(f.file));
         tip = XFS_I(file_inode(tmp.file));
 
diff --git a/fs/xfs/xfs_ondisk.h b/fs/xfs/xfs_ondisk.h
index 027230134098..17ec0248f771 100644
--- a/fs/xfs/xfs_ondisk.h
+++ b/fs/xfs/xfs_ondisk.h
@@ -39,6 +39,8 @@ xfs_check_ondisk_structs(void)
         XFS_CHECK_STRUCT_SIZE(struct xfs_bmbt_key,              8);
         XFS_CHECK_STRUCT_SIZE(struct xfs_bmbt_rec,              16);
         XFS_CHECK_STRUCT_SIZE(struct xfs_bmdr_block,            4);
+        XFS_CHECK_STRUCT_SIZE(struct xfs_btree_block_shdr,      48);
+        XFS_CHECK_STRUCT_SIZE(struct xfs_btree_block_lhdr,      64);
         XFS_CHECK_STRUCT_SIZE(struct xfs_btree_block,           72);
         XFS_CHECK_STRUCT_SIZE(struct xfs_dinode,                176);
         XFS_CHECK_STRUCT_SIZE(struct xfs_disk_dquot,            104);