4 files changed, 31 insertions, 23 deletions

diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 39f877898565..3d2512c21f05 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -622,7 +622,6 @@ static int ufs1_read_inode(struct inode *inode, struct ufs_inode *ufs_inode)
         struct ufs_inode_info *ufsi = UFS_I(inode);
         struct super_block *sb = inode->i_sb;
         mode_t mode;
-        unsigned i;
 
         /*
          * Copy data to the in-core inode.
@@ -655,11 +654,12 @@ static int ufs1_read_inode(struct inode *inode, struct ufs_inode *ufs_inode)
 
         
         if (S_ISCHR(mode) || S_ISBLK(mode) || inode->i_blocks) {
-                for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
-                        ufsi->i_u1.i_data[i] = ufs_inode->ui_u2.ui_addr.ui_db[i];
+                memcpy(ufsi->i_u1.i_data, &ufs_inode->ui_u2.ui_addr,
+                       sizeof(ufs_inode->ui_u2.ui_addr));
         } else {
-                for (i = 0; i < (UFS_NDADDR + UFS_NINDIR) * 4; i++)
-                        ufsi->i_u1.i_symlink[i] = ufs_inode->ui_u2.ui_symlink[i];
+                memcpy(ufsi->i_u1.i_symlink, ufs_inode->ui_u2.ui_symlink,
+                       sizeof(ufs_inode->ui_u2.ui_symlink) - 1);
+                ufsi->i_u1.i_symlink[sizeof(ufs_inode->ui_u2.ui_symlink) - 1] = 0;
         }
         return 0;
 }
@@ -669,7 +669,6 @@ static int ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
         struct ufs_inode_info *ufsi = UFS_I(inode);
         struct super_block *sb = inode->i_sb;
         mode_t mode;
-        unsigned i;
 
         UFSD("Reading ufs2 inode, ino %lu\n", inode->i_ino);
         /*
@@ -704,12 +703,12 @@ static int ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
         */
 
         if (S_ISCHR(mode) || S_ISBLK(mode) || inode->i_blocks) {
-                for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
-                        ufsi->i_u1.u2_i_data[i] =
-                                ufs2_inode->ui_u2.ui_addr.ui_db[i];
+                memcpy(ufsi->i_u1.u2_i_data, &ufs2_inode->ui_u2.ui_addr,
+                       sizeof(ufs2_inode->ui_u2.ui_addr));
         } else {
-                for (i = 0; i < (UFS_NDADDR + UFS_NINDIR) * 4; i++)
-                        ufsi->i_u1.i_symlink[i] = ufs2_inode->ui_u2.ui_symlink[i];
+                memcpy(ufsi->i_u1.i_symlink, ufs2_inode->ui_u2.ui_symlink,
+                       sizeof(ufs2_inode->ui_u2.ui_symlink) - 1);
+                ufsi->i_u1.i_symlink[sizeof(ufs2_inode->ui_u2.ui_symlink) - 1] = 0;
         }
         return 0;
 }
@@ -781,7 +780,6 @@ static void ufs1_update_inode(struct inode *inode, struct ufs_inode *ufs_inode)
 {
         struct super_block *sb = inode->i_sb;
         struct ufs_inode_info *ufsi = UFS_I(inode);
-        unsigned i;
 
         ufs_inode->ui_mode = cpu_to_fs16(sb, inode->i_mode);
         ufs_inode->ui_nlink = cpu_to_fs16(sb, inode->i_nlink);
@@ -809,12 +807,12 @@ static void ufs1_update_inode(struct inode *inode, struct ufs_inode *ufs_inode)
                 /* ufs_inode->ui_u2.ui_addr.ui_db[0] = cpu_to_fs32(sb, inode->i_rdev); */
                 ufs_inode->ui_u2.ui_addr.ui_db[0] = ufsi->i_u1.i_data[0];
         } else if (inode->i_blocks) {
-                for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
-                        ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.i_data[i];
+                memcpy(&ufs_inode->ui_u2.ui_addr, ufsi->i_u1.i_data,
+                       sizeof(ufs_inode->ui_u2.ui_addr));
         }
         else {
-                for (i = 0; i < (UFS_NDADDR + UFS_NINDIR) * 4; i++)
-                        ufs_inode->ui_u2.ui_symlink[i] = ufsi->i_u1.i_symlink[i];
+                memcpy(&ufs_inode->ui_u2.ui_symlink, ufsi->i_u1.i_symlink,
+                       sizeof(ufs_inode->ui_u2.ui_symlink));
         }
 
         if (!inode->i_nlink)
@@ -825,7 +823,6 @@ static void ufs2_update_inode(struct inode *inode, struct ufs2_inode *ufs_inode)
 {
         struct super_block *sb = inode->i_sb;
         struct ufs_inode_info *ufsi = UFS_I(inode);
-        unsigned i;
 
         UFSD("ENTER\n");
         ufs_inode->ui_mode = cpu_to_fs16(sb, inode->i_mode);
@@ -850,11 +847,11 @@ static void ufs2_update_inode(struct inode *inode, struct ufs2_inode *ufs_inode)
                 /* ufs_inode->ui_u2.ui_addr.ui_db[0] = cpu_to_fs32(sb, inode->i_rdev); */
                 ufs_inode->ui_u2.ui_addr.ui_db[0] = ufsi->i_u1.u2_i_data[0];
         } else if (inode->i_blocks) {
-                for (i = 0; i < (UFS_NDADDR + UFS_NINDIR); i++)
-                        ufs_inode->ui_u2.ui_addr.ui_db[i] = ufsi->i_u1.u2_i_data[i];
+                memcpy(&ufs_inode->ui_u2.ui_addr, ufsi->i_u1.u2_i_data,
+                       sizeof(ufs_inode->ui_u2.ui_addr));
         } else {
-                for (i = 0; i < (UFS_NDADDR + UFS_NINDIR) * 4; i++)
-                        ufs_inode->ui_u2.ui_symlink[i] = ufsi->i_u1.i_symlink[i];
+                memcpy(&ufs_inode->ui_u2.ui_symlink, ufsi->i_u1.i_symlink,
+                       sizeof(ufs_inode->ui_u2.ui_symlink));
         }
 
         if (!inode->i_nlink)
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index e3a9b1fac75a..23119fe7ad62 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -147,7 +147,7 @@ static int ufs_symlink (struct inode * dir, struct dentry * dentry,
         } else {
                 /* fast symlink */
                 inode->i_op = &ufs_fast_symlink_inode_operations;
-                memcpy((char*)&UFS_I(inode)->i_u1.i_data,symname,l);
+                memcpy(UFS_I(inode)->i_u1.i_symlink, symname, l);
                 inode->i_size = l-1;
         }
         mark_inode_dirty(inode);
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 261a1c2f22dd..e1c1fc5ee239 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -636,6 +636,7 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent)
         unsigned block_size, super_block_size;
         unsigned flags;
         unsigned super_block_offset;
+        unsigned maxsymlen;
         int ret = -EINVAL;
 
         uspi = NULL;
@@ -1069,6 +1070,16 @@ magic_found:
                 uspi->s_maxsymlinklen =
                     fs32_to_cpu(sb, usb3->fs_un2.fs_44.fs_maxsymlinklen);
 
+        if (uspi->fs_magic == UFS2_MAGIC)
+                maxsymlen = 2 * 4 * (UFS_NDADDR + UFS_NINDIR);
+        else
+                maxsymlen = 4 * (UFS_NDADDR + UFS_NINDIR);
+        if (uspi->s_maxsymlinklen > maxsymlen) {
+                ufs_warning(sb, __func__, "ufs_read_super: excessive maximum "
+                            "fast symlink size (%u)\n", uspi->s_maxsymlinklen);
+                uspi->s_maxsymlinklen = maxsymlen;
+        }
+
         inode = ufs_iget(sb, UFS_ROOTINO);
         if (IS_ERR(inode)) {
                 ret = PTR_ERR(inode);
diff --git a/fs/ufs/ufs.h b/fs/ufs/ufs.h
index 11c035168ea6..69b3427d7885 100644
--- a/fs/ufs/ufs.h
+++ b/fs/ufs/ufs.h
@@ -23,7 +23,7 @@ struct ufs_sb_info {
 struct ufs_inode_info {
         union {
                 __fs32  i_data[15];
-                __u8    i_symlink[4*15];
+                __u8    i_symlink[2 * 4 * 15];
                 __fs64  u2_i_data[15];
         } i_u1;
         __u32   i_flags;