1 files changed, 11 insertions, 0 deletions

diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 261a1c2f22dd..e1c1fc5ee239 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -636,6 +636,7 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent)
         unsigned block_size, super_block_size;
         unsigned flags;
         unsigned super_block_offset;
+        unsigned maxsymlen;
         int ret = -EINVAL;
 
         uspi = NULL;
@@ -1069,6 +1070,16 @@ magic_found:
                 uspi->s_maxsymlinklen =
                     fs32_to_cpu(sb, usb3->fs_un2.fs_44.fs_maxsymlinklen);
 
+        if (uspi->fs_magic == UFS2_MAGIC)
+                maxsymlen = 2 * 4 * (UFS_NDADDR + UFS_NINDIR);
+        else
+                maxsymlen = 4 * (UFS_NDADDR + UFS_NINDIR);
+        if (uspi->s_maxsymlinklen > maxsymlen) {
+                ufs_warning(sb, __func__, "ufs_read_super: excessive maximum "
+                            "fast symlink size (%u)\n", uspi->s_maxsymlinklen);
+                uspi->s_maxsymlinklen = maxsymlen;
+        }
+
         inode = ufs_iget(sb, UFS_ROOTINO);
         if (IS_ERR(inode)) {
                 ret = PTR_ERR(inode);