omfs: check bounds on block numbers before passing to sb_bread

In case of filesystem corruption, passing unchecked block numbers into
sb_bread can result in an infinite loop in __getblk().  Introduce a wrapper
function omfs_sbread() to check the block numbers and to also perform the
clus_to_blk() scaling.

Signed-off-by: Bob Copeland <me@bobcopeland.com>

1 files changed, 8 insertions, 14 deletions

diff --git a/fs/omfs/dir.c b/fs/omfs/dir.c
index b42d62419034..393f3f659da7 100644
--- a/fs/omfs/dir.c
+++ b/fs/omfs/dir.c
@@ -25,11 +25,10 @@ static struct buffer_head *omfs_get_bucket(struct inode *dir,
                 const char *name, int namelen, int *ofs)
 {
         int nbuckets = (dir->i_size - OMFS_DIR_START)/8;
-        int block = clus_to_blk(OMFS_SB(dir->i_sb), dir->i_ino);
         int bucket = omfs_hash(name, namelen, nbuckets);
 
         *ofs = OMFS_DIR_START + bucket * 8;
-        return sb_bread(dir->i_sb, block);
+        return omfs_bread(dir->i_sb, dir->i_ino);
 }
 
 static struct buffer_head *omfs_scan_list(struct inode *dir, u64 block,
@@ -42,8 +41,7 @@ static struct buffer_head *omfs_scan_list(struct inode *dir, u64 block,
         *prev_block = ~0;
 
         while (block != ~0) {
-                bh = sb_bread(dir->i_sb,
-                        clus_to_blk(OMFS_SB(dir->i_sb), block));
+                bh = omfs_bread(dir->i_sb, block);
                 if (!bh) {
                         err = -EIO;
                         goto err;
@@ -86,11 +84,10 @@ static struct buffer_head *omfs_find_entry(struct inode *dir,
 int omfs_make_empty(struct inode *inode, struct super_block *sb)
 {
         struct omfs_sb_info *sbi = OMFS_SB(sb);
-        int block = clus_to_blk(sbi, inode->i_ino);
         struct buffer_head *bh;
         struct omfs_inode *oi;
 
-        bh = sb_bread(sb, block);
+        bh = omfs_bread(sb, inode->i_ino);
         if (!bh)
                 return -ENOMEM;
 
@@ -134,7 +131,7 @@ static int omfs_add_link(struct dentry *dentry, struct inode *inode)
         brelse(bh);
 
         /* now set the sibling and parent pointers on the new inode */
-        bh = sb_bread(dir->i_sb, clus_to_blk(OMFS_SB(dir->i_sb), inode->i_ino));
+        bh = omfs_bread(dir->i_sb, inode->i_ino);
         if (!bh)
                 goto out;
 
@@ -190,8 +187,7 @@ static int omfs_delete_entry(struct dentry *dentry)
         if (prev != ~0) {
                 /* found in middle of list, get list ptr */
                 brelse(bh);
-                bh = sb_bread(dir->i_sb,
-                        clus_to_blk(OMFS_SB(dir->i_sb), prev));
+                bh = omfs_bread(dir->i_sb, prev);
                 if (!bh)
                         goto out;
 
@@ -224,8 +220,7 @@ static int omfs_dir_is_empty(struct inode *inode)
         u64 *ptr;
         int i;
 
-        bh = sb_bread(inode->i_sb, clus_to_blk(OMFS_SB(inode->i_sb),
-                        inode->i_ino));
+        bh = omfs_bread(inode->i_sb, inode->i_ino);
 
         if (!bh)
                 return 0;
@@ -353,8 +348,7 @@ static int omfs_fill_chain(struct file *filp, void *dirent, filldir_t filldir,
 
         /* follow chain in this bucket */
         while (fsblock != ~0) {
-                bh = sb_bread(dir->i_sb, clus_to_blk(OMFS_SB(dir->i_sb),
-                                fsblock));
+                bh = omfs_bread(dir->i_sb, fsblock);
                 if (!bh)
                         goto out;
 
@@ -466,7 +460,7 @@ static int omfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
         hchain = (filp->f_pos >> 20) - 1;
         hindex = filp->f_pos & 0xfffff;
 
-        bh = sb_bread(dir->i_sb, clus_to_blk(OMFS_SB(dir->i_sb), dir->i_ino));
+        bh = omfs_bread(dir->i_sb, dir->i_ino);
         if (!bh)
                 goto out;