1 files changed, 16 insertions, 6 deletions

diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 4884d5edfe65..12e83f67eee4 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -229,9 +229,16 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
            check anyway. */
         if (!tn->fn->size) {
                 if (rii->mdata_tn) {
-                        /* We had a candidate mdata node already */
-                        dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
-                        jffs2_kill_tn(c, rii->mdata_tn);
+                        if (rii->mdata_tn->version < tn->version) {
+                                /* We had a candidate mdata node already */
+                                dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
+                                jffs2_kill_tn(c, rii->mdata_tn);
+                        } else {
+                                dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
+                                              tn->version, rii->mdata_tn->version);
+                                jffs2_kill_tn(c, tn);
+                                return 0;
+                        }
                 }
                 rii->mdata_tn = tn;
                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
@@ -1044,7 +1051,8 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
 
                 case JFFS2_NODETYPE_DIRENT:
 
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
+                            len < sizeof(struct jffs2_raw_dirent)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;
@@ -1058,7 +1066,8 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
 
                 case JFFS2_NODETYPE_INODE:
 
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
+                            len < sizeof(struct jffs2_raw_inode)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;
@@ -1071,7 +1080,8 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
                         break;
 
                 default:
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
+                            len < sizeof(struct jffs2_unknown_node)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;