8 files changed, 27 insertions, 3 deletions

diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index 0d200068d0af..cdb41a1f6a64 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/swap.h>
 
 #include "btree.h"
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 052f214ea6f0..38a0a9917d7f 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/log2.h>
 
 #include "btree.h"
diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
index 6d98f116ca03..424b0337f524 100644
--- a/fs/hfs/catalog.c
+++ b/fs/hfs/catalog.c
@@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode *src_dir, struct qstr *src_name,
         err = hfs_brec_find(&src_fd);
         if (err)
                 goto out;
+        if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
+                err = -EIO;
+                goto out;
+        }
 
         hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                             src_fd.entrylength);
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 7c69b98a2e45..2b3b8611b41b 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 filp->f_pos++;
                 /* fall through */
         case 1:
+                if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+                        err = -EIO;
+                        goto out;
+                }
+
                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
                 if (entry.type != HFS_CDR_THD) {
                         printk(KERN_ERR "hfs: bad catalog folder thread\n");
@@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         err = -EIO;
                         goto out;
                 }
+
+                if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+                        err = -EIO;
+                        goto out;
+                }
+
                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
                 type = entry.type;
                 len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName);
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index 052387e11671..fe35e3b626c4 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -188,7 +188,7 @@ extern const struct address_space_operations hfs_btree_aops;
 
 extern struct inode *hfs_new_inode(struct inode *, struct qstr *, int);
 extern void hfs_inode_write_fork(struct inode *, struct hfs_extent *, __be32 *, __be32 *);
-extern int hfs_write_inode(struct inode *, int);
+extern int hfs_write_inode(struct inode *, struct writeback_control *);
 extern int hfs_inode_setattr(struct dentry *, struct iattr *);
 extern void hfs_inode_read_fork(struct inode *inode, struct hfs_extent *ext,
                         __be32 log_size, __be32 phys_size, u32 clump_size);
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index a1cbff2b4d99..14f5cb1b9fdc 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -381,7 +381,7 @@ void hfs_inode_write_fork(struct inode *inode, struct hfs_extent *ext,
                                          HFS_SB(inode->i_sb)->alloc_blksz);
 }
 
-int hfs_write_inode(struct inode *inode, int unused)
+int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct inode *main_inode = inode;
         struct hfs_find_data fd;
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 8bbe03c3f6d5..86428f5ac991 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -11,6 +11,7 @@
 #include <linux/cdrom.h>
 #include <linux/genhd.h>
 #include <linux/nls.h>
+#include <linux/slab.h>
 
 #include "hfs_fs.h"
 #include "btree.h"
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index f7fcbe49da72..0a81eb7111f3 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -19,6 +19,7 @@
 #include <linux/nls.h>
 #include <linux/parser.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/vfs.h>
 
@@ -409,8 +410,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
         /* try to get the root inode */
         hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
         res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
-        if (!res)
+        if (!res) {
+                if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
+                        res =  -EIO;
+                        goto bail;
+                }
                 hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
+        }
         if (res) {
                 hfs_find_exit(&fd);
                 goto bail_no_root;