1 files changed, 9 insertions, 1 deletions

diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index b5128c6e63ad..a9079d035ae5 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -842,15 +842,23 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
 {
         jbd2_journal_revoke_header_t *header;
         int offset, max;
+        int csum_size = 0;
+        __u32 rcount;
         int record_len = 4;
 
         header = (jbd2_journal_revoke_header_t *) bh->b_data;
         offset = sizeof(jbd2_journal_revoke_header_t);
-        max = be32_to_cpu(header->r_count);
+        rcount = be32_to_cpu(header->r_count);
 
         if (!jbd2_revoke_block_csum_verify(journal, header))
                 return -EINVAL;
 
+        if (jbd2_journal_has_csum_v2or3(journal))
+                csum_size = sizeof(struct jbd2_journal_revoke_tail);
+        if (rcount > journal->j_blocksize - csum_size)
+                return -EINVAL;
+        max = rcount;
+
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
                 record_len = 8;