1 files changed, 14 insertions, 5 deletions

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 51c02bf07878..68000a50ceb6 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -74,7 +74,7 @@
 static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
                         int nblocks);
 static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval);
-static void dbBackSplit(dmtree_t * tp, int leafno);
+static int dbBackSplit(dmtree_t * tp, int leafno);
 static int dbJoin(dmtree_t * tp, int leafno, int newval);
 static void dbAdjTree(dmtree_t * tp, int leafno, int newval);
 static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc,
@@ -2466,7 +2466,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
                  * that it is at the front of a binary buddy system.
                  */
                 if (oldval == NOFREE) {
-                        dbBackSplit((dmtree_t *) dcp, leafno);
+                        rc = dbBackSplit((dmtree_t *) dcp, leafno);
+                        if (rc)
+                                return rc;
                         oldval = dcp->stree[ti];
                 }
                 dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval);
@@ -2626,7 +2628,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
  *
  * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;
  */
-static void dbBackSplit(dmtree_t * tp, int leafno)
+static int dbBackSplit(dmtree_t * tp, int leafno)
 {
         int budsz, bud, w, bsz, size;
         int cursz;
@@ -2661,7 +2663,10 @@ static void dbBackSplit(dmtree_t * tp, int leafno)
                  */
                 for (w = leafno, bsz = budsz;; bsz <<= 1,
                      w = (w < bud) ? w : bud) {
-                        assert(bsz < le32_to_cpu(tp->dmt_nleafs));
+                        if (bsz >= le32_to_cpu(tp->dmt_nleafs)) {
+                                jfs_err("JFS: block map error in dbBackSplit");
+                                return -EIO;
+                        }
 
                         /* determine the buddy.
                          */
@@ -2680,7 +2685,11 @@ static void dbBackSplit(dmtree_t * tp, int leafno)
                 }
         }
 
-        assert(leaf[leafno] == size);
+        if (leaf[leafno] != size) {
+                jfs_err("JFS: wrong leaf value in dbBackSplit");
+                return -EIO;
+        }
+        return 0;
 }