1 files changed, 81 insertions, 17 deletions

diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index 377ad172d74b..e7b2bafa1dd9 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -69,9 +69,53 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
         return desc + offset;
 }
 
+static int ext2_valid_block_bitmap(struct super_block *sb,
+                                        struct ext2_group_desc *desc,
+                                        unsigned int block_group,
+                                        struct buffer_head *bh)
+{
+        ext2_grpblk_t offset;
+        ext2_grpblk_t next_zero_bit;
+        ext2_fsblk_t bitmap_blk;
+        ext2_fsblk_t group_first_block;
+
+        group_first_block = ext2_group_first_block_no(sb, block_group);
+
+        /* check whether block bitmap block number is set */
+        bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
+        offset = bitmap_blk - group_first_block;
+        if (!ext2_test_bit(offset, bh->b_data))
+                /* bad block bitmap */
+                goto err_out;
+
+        /* check whether the inode bitmap block number is set */
+        bitmap_blk = le32_to_cpu(desc->bg_inode_bitmap);
+        offset = bitmap_blk - group_first_block;
+        if (!ext2_test_bit(offset, bh->b_data))
+                /* bad block bitmap */
+                goto err_out;
+
+        /* check whether the inode table block number is set */
+        bitmap_blk = le32_to_cpu(desc->bg_inode_table);
+        offset = bitmap_blk - group_first_block;
+        next_zero_bit = ext2_find_next_zero_bit(bh->b_data,
+                                offset + EXT2_SB(sb)->s_itb_per_group,
+                                offset);
+        if (next_zero_bit >= offset + EXT2_SB(sb)->s_itb_per_group)
+                /* good bitmap for inode tables */
+                return 1;
+
+err_out:
+        ext2_error(sb, __FUNCTION__,
+                        "Invalid block bitmap - "
+                        "block_group = %d, block = %lu",
+                        block_group, bitmap_blk);
+        return 0;
+}
+
 /*
- * Read the bitmap for a given block_group, reading into the specified 
- * slot in the superblock's bitmap cache.
+ * Read the bitmap for a given block_group,and validate the
+ * bits for block/inode/inode tables are set in the bitmaps
  *
  * Return buffer_head on success or NULL in case of failure.
  */
@@ -80,17 +124,36 @@ read_block_bitmap(struct super_block *sb, unsigned int block_group)
 {
         struct ext2_group_desc * desc;
         struct buffer_head * bh = NULL;
-        
-        desc = ext2_get_group_desc (sb, block_group, NULL);
+        ext2_fsblk_t bitmap_blk;
+
+        desc = ext2_get_group_desc(sb, block_group, NULL);
         if (!desc)
-                goto error_out;
-        bh = sb_bread(sb, le32_to_cpu(desc->bg_block_bitmap));
-        if (!bh)
-                ext2_error (sb, "read_block_bitmap",
+                return NULL;
+        bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
+        bh = sb_getblk(sb, bitmap_blk);
+        if (unlikely(!bh)) {
+                ext2_error(sb, __FUNCTION__,
+                            "Cannot read block bitmap - "
+                            "block_group = %d, block_bitmap = %u",
+                            block_group, le32_to_cpu(desc->bg_block_bitmap));
+                return NULL;
+        }
+        if (likely(bh_uptodate_or_lock(bh)))
+                return bh;
+
+        if (bh_submit_read(bh) < 0) {
+                brelse(bh);
+                ext2_error(sb, __FUNCTION__,
                             "Cannot read block bitmap - "
                             "block_group = %d, block_bitmap = %u",
                             block_group, le32_to_cpu(desc->bg_block_bitmap));
-error_out:
+                return NULL;
+        }
+        if (!ext2_valid_block_bitmap(sb, desc, block_group, bh)) {
+                brelse(bh);
+                return NULL;
+        }
+
         return bh;
 }
 
@@ -474,11 +537,13 @@ do_more:
             in_range (block, le32_to_cpu(desc->bg_inode_table),
                       sbi->s_itb_per_group) ||
             in_range (block + count - 1, le32_to_cpu(desc->bg_inode_table),
-                      sbi->s_itb_per_group))
+                      sbi->s_itb_per_group)) {
                 ext2_error (sb, "ext2_free_blocks",
                             "Freeing blocks in system zones - "
                             "Block = %lu, count = %lu",
                             block, count);
+                goto error_return;
+        }
 
         for (i = 0, group_freed = 0; i < count; i++) {
                 if (!ext2_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
@@ -1250,8 +1315,8 @@ retry_alloc:
         smp_rmb();
 
         /*
-         * Now search the rest of the groups.  We assume that 
-         * i and gdp correctly point to the last group visited.
+         * Now search the rest of the groups.  We assume that
+         * group_no and gdp correctly point to the last group visited.
          */
         for (bgi = 0; bgi < ngroups; bgi++) {
                 group_no++;
@@ -1311,11 +1376,13 @@ allocated:
             in_range(ret_block, le32_to_cpu(gdp->bg_inode_table),
                       EXT2_SB(sb)->s_itb_per_group) ||
             in_range(ret_block + num - 1, le32_to_cpu(gdp->bg_inode_table),
-                      EXT2_SB(sb)->s_itb_per_group))
+                      EXT2_SB(sb)->s_itb_per_group)) {
                 ext2_error(sb, "ext2_new_blocks",
                             "Allocating block in system zone - "
                             "blocks from "E2FSBLK", length %lu",
                             ret_block, num);
+                goto out;
+        }
 
         performed_allocation = 1;
 
@@ -1466,9 +1533,6 @@ int ext2_bg_has_super(struct super_block *sb, int group)
  */
 unsigned long ext2_bg_num_gdb(struct super_block *sb, int group)
 {
-        if (EXT2_HAS_RO_COMPAT_FEATURE(sb,EXT2_FEATURE_RO_COMPAT_SPARSE_SUPER)&&
-            !ext2_group_sparse(group))
-                return 0;
-        return EXT2_SB(sb)->s_gdb_count;
+        return ext2_bg_has_super(sb, group) ? EXT2_SB(sb)->s_gdb_count : 0;
 }