Merge branch '2.6.36-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/xfsdev

* '2.6.36-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/xfsdev:
  xfs: do not discard page cache data on EAGAIN
  xfs: don't do memory allocation under the CIL context lock
  xfs: Reduce log force overhead for delayed logging
  xfs: dummy transactions should not dirty VFS state
  xfs: ensure f_ffree returned by statfs() is non-negative
  xfs: handle negative wbc->nr_to_write during sync writeback
  writeback: write_cache_pages doesn't terminate at nr_to_write <= 0
  xfs: fix untrusted inode number lookup
  xfs: ensure we mark all inodes in a freed cluster XFS_ISTALE
  xfs: unlock items before allowing the CIL to commit

1 files changed, 10 insertions, 6 deletions

diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index abf80ae1e95b..5371d2dc360e 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -1213,7 +1213,6 @@ xfs_imap_lookup(
         struct xfs_inobt_rec_incore rec;
         struct xfs_btree_cur    *cur;
         struct xfs_buf          *agbp;
-        xfs_agino_t             startino;
         int                     error;
         int                     i;
 
@@ -1227,13 +1226,13 @@ xfs_imap_lookup(
         }
 
         /*
-         * derive and lookup the exact inode record for the given agino. If the
-         * record cannot be found, then it's an invalid inode number and we
-         * should abort.
+         * Lookup the inode record for the given agino. If the record cannot be
+         * found, then it's an invalid inode number and we should abort. Once
+         * we have a record, we need to ensure it contains the inode number
+         * we are looking up.
          */
         cur = xfs_inobt_init_cursor(mp, tp, agbp, agno);
-        startino = agino & ~(XFS_IALLOC_INODES(mp) - 1);
-        error = xfs_inobt_lookup(cur, startino, XFS_LOOKUP_EQ, &i);
+        error = xfs_inobt_lookup(cur, agino, XFS_LOOKUP_LE, &i);
         if (!error) {
                 if (i)
                         error = xfs_inobt_get_rec(cur, &rec, &i);
@@ -1246,6 +1245,11 @@ xfs_imap_lookup(
         if (error)
                 return error;
 
+        /* check that the returned record contains the required inode */
+        if (rec.ir_startino > agino ||
+            rec.ir_startino + XFS_IALLOC_INODES(mp) <= agino)
+                return EINVAL;
+
         /* for untrusted inodes check it is allocated first */
         if ((flags & XFS_IGET_UNTRUSTED) &&
             (rec.ir_free & XFS_INOBT_MASK(agino - rec.ir_startino)))