omfs: check bounds on block numbers before passing to sb_bread

In case of filesystem corruption, passing unchecked block numbers into
sb_bread can result in an infinite loop in __getblk().  Introduce a wrapper
function omfs_sbread() to check the block numbers and to also perform the
clus_to_blk() scaling.

Signed-off-by: Bob Copeland <me@bobcopeland.com>

1 files changed, 4 insertions, 4 deletions

diff --git a/fs/omfs/file.c b/fs/omfs/file.c
index 6e7a3291bbe8..76bc21b91a8a 100644
--- a/fs/omfs/file.c
+++ b/fs/omfs/file.c
@@ -50,7 +50,7 @@ int omfs_shrink_inode(struct inode *inode)
         if (inode->i_size != 0)
                 goto out;
 
-        bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
+        bh = omfs_bread(inode->i_sb, next);
         if (!bh)
                 goto out;
 
@@ -90,7 +90,7 @@ int omfs_shrink_inode(struct inode *inode)
                 if (next == ~0)
                         break;
 
-                bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
+                bh = omfs_bread(inode->i_sb, next);
                 if (!bh)
                         goto out;
                 oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]);
@@ -232,7 +232,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
         int remain;
 
         ret = -EIO;
-        bh = sb_bread(inode->i_sb, clus_to_blk(sbi, inode->i_ino));
+        bh = omfs_bread(inode->i_sb, inode->i_ino);
         if (!bh)
                 goto out;
 
@@ -265,7 +265,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
                         break;
 
                 brelse(bh);
-                bh = sb_bread(inode->i_sb, clus_to_blk(sbi, next));
+                bh = omfs_bread(inode->i_sb, next);
                 if (!bh)
                         goto out;
                 oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]);