5 files changed, 54 insertions, 0 deletions

diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index deaa3d33a0aa..0d58075f34e2 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -942,6 +942,18 @@ int nilfs_cpfile_read(struct super_block *sb, size_t cpsize,
         struct inode *cpfile;
         int err;
 
+        if (cpsize > sb->s_blocksize) {
+                printk(KERN_ERR
+                       "NILFS: too large checkpoint size: %zu bytes.\n",
+                       cpsize);
+                return -EINVAL;
+        } else if (cpsize < NILFS_MIN_CHECKPOINT_SIZE) {
+                printk(KERN_ERR
+                       "NILFS: too small checkpoint size: %zu bytes.\n",
+                       cpsize);
+                return -EINVAL;
+        }
+
         cpfile = nilfs_iget_locked(sb, NULL, NILFS_CPFILE_INO);
         if (unlikely(!cpfile))
                 return -ENOMEM;
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index fa0f80308c2d..0d5fada91191 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -484,6 +484,18 @@ int nilfs_dat_read(struct super_block *sb, size_t entry_size,
         struct nilfs_dat_info *di;
         int err;
 
+        if (entry_size > sb->s_blocksize) {
+                printk(KERN_ERR
+                       "NILFS: too large DAT entry size: %zu bytes.\n",
+                       entry_size);
+                return -EINVAL;
+        } else if (entry_size < NILFS_MIN_DAT_ENTRY_SIZE) {
+                printk(KERN_ERR
+                       "NILFS: too small DAT entry size: %zu bytes.\n",
+                       entry_size);
+                return -EINVAL;
+        }
+
         dat = nilfs_iget_locked(sb, NULL, NILFS_DAT_INO);
         if (unlikely(!dat))
                 return -ENOMEM;
diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index 84e384dae663..2a869c35c362 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -1169,6 +1169,18 @@ int nilfs_sufile_read(struct super_block *sb, size_t susize,
         void *kaddr;
         int err;
 
+        if (susize > sb->s_blocksize) {
+                printk(KERN_ERR
+                       "NILFS: too large segment usage size: %zu bytes.\n",
+                       susize);
+                return -EINVAL;
+        } else if (susize < NILFS_MIN_SEGMENT_USAGE_SIZE) {
+                printk(KERN_ERR
+                       "NILFS: too small segment usage size: %zu bytes.\n",
+                       susize);
+                return -EINVAL;
+        }
+
         sufile = nilfs_iget_locked(sb, NULL, NILFS_SUFILE_INO);
         if (unlikely(!sufile))
                 return -ENOMEM;
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 94c451ce6d24..8ba8229ba076 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -399,6 +399,16 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
                 return -EINVAL;
 
         nilfs->ns_inode_size = le16_to_cpu(sbp->s_inode_size);
+        if (nilfs->ns_inode_size > nilfs->ns_blocksize) {
+                printk(KERN_ERR "NILFS: too large inode size: %d bytes.\n",
+                       nilfs->ns_inode_size);
+                return -EINVAL;
+        } else if (nilfs->ns_inode_size < NILFS_MIN_INODE_SIZE) {
+                printk(KERN_ERR "NILFS: too small inode size: %d bytes.\n",
+                       nilfs->ns_inode_size);
+                return -EINVAL;
+        }
+
         nilfs->ns_first_ino = le32_to_cpu(sbp->s_first_ino);
 
         nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment);
diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
index 1fb465f9baf2..ff3fea3194c6 100644
--- a/include/linux/nilfs2_fs.h
+++ b/include/linux/nilfs2_fs.h
@@ -82,6 +82,8 @@ struct nilfs_inode {
         __le32  i_pad;
 };
 
+#define NILFS_MIN_INODE_SIZE            128
+
 /**
  * struct nilfs_super_root - structure of super root
  * @sr_sum: check sum
@@ -482,6 +484,8 @@ struct nilfs_dat_entry {
         __le64 de_rsv;
 };
 
+#define NILFS_MIN_DAT_ENTRY_SIZE        32
+
 /**
  * struct nilfs_snapshot_list - snapshot list
  * @ssl_next: next checkpoint number on snapshot list
@@ -520,6 +524,8 @@ struct nilfs_checkpoint {
         struct nilfs_inode cp_ifile_inode;
 };
 
+#define NILFS_MIN_CHECKPOINT_SIZE       (64 + NILFS_MIN_INODE_SIZE)
+
 /* checkpoint flags */
 enum {
         NILFS_CHECKPOINT_SNAPSHOT,
@@ -615,6 +621,8 @@ struct nilfs_segment_usage {
         __le32 su_flags;
 };
 
+#define NILFS_MIN_SEGMENT_USAGE_SIZE    16
+
 /* segment usage flag */
 enum {
         NILFS_SEGMENT_USAGE_ACTIVE,