1 files changed, 52 insertions, 15 deletions

diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index e49fcee1e293..22e4d4e32999 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -30,7 +30,7 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
         if (!tree)
                 return NULL;
 
-        init_MUTEX(&tree->tree_lock);
+        mutex_init(&tree->tree_lock);
         spin_lock_init(&tree->hash_lock);
         tree->sb = sb;
         tree->cnid = id;
@@ -39,10 +39,16 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
                 goto free_tree;
         tree->inode = inode;
 
+        if (!HFSPLUS_I(tree->inode)->first_blocks) {
+                printk(KERN_ERR
+                       "hfs: invalid btree extent records (0 size).\n");
+                goto free_inode;
+        }
+
         mapping = tree->inode->i_mapping;
         page = read_mapping_page(mapping, 0, NULL);
         if (IS_ERR(page))
-                goto free_tree;
+                goto free_inode;
 
         /* Load the header */
         head = (struct hfs_btree_header_rec *)(kmap(page) + sizeof(struct hfs_bnode_desc));
@@ -57,27 +63,56 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
         tree->max_key_len = be16_to_cpu(head->max_key_len);
         tree->depth = be16_to_cpu(head->depth);
 
-        /* Set the correct compare function */
-        if (id == HFSPLUS_EXT_CNID) {
+        /* Verify the tree and set the correct compare function */
+        switch (id) {
+        case HFSPLUS_EXT_CNID:
+                if (tree->max_key_len != HFSPLUS_EXT_KEYLEN - sizeof(u16)) {
+                        printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+                                tree->max_key_len);
+                        goto fail_page;
+                }
+                if (tree->attributes & HFS_TREE_VARIDXKEYS) {
+                        printk(KERN_ERR "hfs: invalid extent btree flag\n");
+                        goto fail_page;
+                }
+
                 tree->keycmp = hfsplus_ext_cmp_key;
-        } else if (id == HFSPLUS_CAT_CNID) {
-                if ((HFSPLUS_SB(sb).flags & HFSPLUS_SB_HFSX) &&
+                break;
+        case HFSPLUS_CAT_CNID:
+                if (tree->max_key_len != HFSPLUS_CAT_KEYLEN - sizeof(u16)) {
+                        printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+                                tree->max_key_len);
+                        goto fail_page;
+                }
+                if (!(tree->attributes & HFS_TREE_VARIDXKEYS)) {
+                        printk(KERN_ERR "hfs: invalid catalog btree flag\n");
+                        goto fail_page;
+                }
+
+                if (test_bit(HFSPLUS_SB_HFSX, &HFSPLUS_SB(sb)->flags) &&
                     (head->key_type == HFSPLUS_KEY_BINARY))
                         tree->keycmp = hfsplus_cat_bin_cmp_key;
                 else {
                         tree->keycmp = hfsplus_cat_case_cmp_key;
-                        HFSPLUS_SB(sb).flags |= HFSPLUS_SB_CASEFOLD;
+                        set_bit(HFSPLUS_SB_CASEFOLD, &HFSPLUS_SB(sb)->flags);
                 }
-        } else {
+                break;
+        default:
                 printk(KERN_ERR "hfs: unknown B*Tree requested\n");
                 goto fail_page;
         }
 
+        if (!(tree->attributes & HFS_TREE_BIGKEYS)) {
+                printk(KERN_ERR "hfs: invalid btree flag\n");
+                goto fail_page;
+        }
+
         size = tree->node_size;
         if (!is_power_of_2(size))
                 goto fail_page;
         if (!tree->node_count)
                 goto fail_page;
+
         tree->node_size_shift = ffs(size) - 1;
 
         tree->pages_per_bnode = (tree->node_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
@@ -87,10 +122,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
         return tree;
 
  fail_page:
-        tree->inode->i_mapping->a_ops = &hfsplus_aops;
         page_cache_release(page);
- free_tree:
+ free_inode:
+        tree->inode->i_mapping->a_ops = &hfsplus_aops;
         iput(tree->inode);
+ free_tree:
         kfree(tree);
         return NULL;
 }
@@ -192,17 +228,18 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
 
         while (!tree->free_nodes) {
                 struct inode *inode = tree->inode;
+                struct hfsplus_inode_info *hip = HFSPLUS_I(inode);
                 u32 count;
                 int res;
 
                 res = hfsplus_file_extend(inode);
                 if (res)
                         return ERR_PTR(res);
-                HFSPLUS_I(inode).phys_size = inode->i_size =
-                                (loff_t)HFSPLUS_I(inode).alloc_blocks <<
-                                HFSPLUS_SB(tree->sb).alloc_blksz_shift;
-                HFSPLUS_I(inode).fs_blocks = HFSPLUS_I(inode).alloc_blocks <<
-                                             HFSPLUS_SB(tree->sb).fs_shift;
+                hip->phys_size = inode->i_size =
+                        (loff_t)hip->alloc_blocks <<
+                                HFSPLUS_SB(tree->sb)->alloc_blksz_shift;
+                hip->fs_blocks =
+                        hip->alloc_blocks << HFSPLUS_SB(tree->sb)->fs_shift;
                 inode_set_bytes(inode, inode->i_size);
                 count = inode->i_size >> tree->node_size_shift;
                 tree->free_nodes = count - tree->node_count;