From 70d9e384aa7df681cfffd65947af72b22e86690e Mon Sep 17 00:00:00 2001 From: Davidlohr Bueso Date: Tue, 6 Jul 2010 00:50:58 -0400 Subject: omfs: fix memory leak In the error path of omfs_fill_super(), the FS super block info (sbi) is not being freed. Correct this. Signed-off-by: Davidlohr Bueso Signed-off-by: Bob Copeland --- fs/omfs/inode.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'fs/omfs/inode.c') diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c index 089839a6cc64..b5d6380e03fb 100644 --- a/fs/omfs/inode.c +++ b/fs/omfs/inode.c @@ -529,6 +529,8 @@ out_brelse_bh2: out_brelse_bh: brelse(bh); end: + if (ret) + kfree(sbi); return ret; } -- cgit v1.2.2 From f068272cb2f134a194b93e94a8e0672bfce48cd8 Mon Sep 17 00:00:00 2001 From: Bob Copeland Date: Sat, 6 Sep 2008 17:51:53 -0400 Subject: omfs: check bounds on block numbers before passing to sb_bread In case of filesystem corruption, passing unchecked block numbers into sb_bread can result in an infinite loop in __getblk(). Introduce a wrapper function omfs_sbread() to check the block numbers and to also perform the clus_to_blk() scaling. Signed-off-by: Bob Copeland --- fs/omfs/inode.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) (limited to 'fs/omfs/inode.c') diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c index b5d6380e03fb..bd4bf753a63b 100644 --- a/fs/omfs/inode.c +++ b/fs/omfs/inode.c @@ -19,6 +19,15 @@ MODULE_AUTHOR("Bob Copeland "); MODULE_DESCRIPTION("OMFS (ReplayTV/Karma) Filesystem for Linux"); MODULE_LICENSE("GPL"); +struct buffer_head *omfs_bread(struct super_block *sb, sector_t block) +{ + struct omfs_sb_info *sbi = OMFS_SB(sb); + if (block >= sbi->s_num_blocks) + return NULL; + + return sb_bread(sb, clus_to_blk(sbi, block)); +} + struct inode *omfs_new_inode(struct inode *dir, int mode) { struct inode *inode; @@ -93,15 +102,13 @@ static int __omfs_write_inode(struct inode *inode, int wait) struct omfs_inode *oi; struct omfs_sb_info *sbi = OMFS_SB(inode->i_sb); struct buffer_head *bh, *bh2; - unsigned int block; u64 ctime; int i; int ret = -EIO; int sync_failed = 0; /* get current inode since we may have written sibling ptrs etc. */ - block = clus_to_blk(sbi, inode->i_ino); - bh = sb_bread(inode->i_sb, block); + bh = omfs_bread(inode->i_sb, inode->i_ino); if (!bh) goto out; @@ -140,8 +147,7 @@ static int __omfs_write_inode(struct inode *inode, int wait) /* if mirroring writes, copy to next fsblock */ for (i = 1; i < sbi->s_mirrors; i++) { - bh2 = sb_bread(inode->i_sb, block + i * - (sbi->s_blocksize / sbi->s_sys_blocksize)); + bh2 = omfs_bread(inode->i_sb, inode->i_ino + i); if (!bh2) goto out_brelse; @@ -193,7 +199,6 @@ struct inode *omfs_iget(struct super_block *sb, ino_t ino) struct omfs_sb_info *sbi = OMFS_SB(sb); struct omfs_inode *oi; struct buffer_head *bh; - unsigned int block; u64 ctime; unsigned long nsecs; struct inode *inode; @@ -204,8 +209,7 @@ struct inode *omfs_iget(struct super_block *sb, ino_t ino) if (!(inode->i_state & I_NEW)) return inode; - block = clus_to_blk(sbi, ino); - bh = sb_bread(inode->i_sb, block); + bh = omfs_bread(inode->i_sb, ino); if (!bh) goto iget_failed; @@ -319,6 +323,9 @@ static int omfs_get_imap(struct super_block *sb) goto nomem; block = clus_to_blk(sbi, sbi->s_bitmap_ino); + if (block >= sbi->s_num_blocks) + goto nomem; + ptr = sbi->s_imap; for (count = bitmap_size; count > 0; count -= sb->s_blocksize) { bh = sb_bread(sb, block++); @@ -417,7 +424,6 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent) struct omfs_root_block *omfs_rb; struct omfs_sb_info *sbi; struct inode *root; - sector_t start; int ret = -EINVAL; save_mount_options(sb, (char *) data); @@ -486,8 +492,7 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent) sbi->s_block_shift = get_bitmask_order(sbi->s_blocksize) - get_bitmask_order(sbi->s_sys_blocksize); - start = clus_to_blk(sbi, be64_to_cpu(omfs_sb->s_root_block)); - bh2 = sb_bread(sb, start); + bh2 = omfs_bread(sb, be64_to_cpu(omfs_sb->s_root_block)); if (!bh2) goto out_brelse_bh; -- cgit v1.2.2 From 9442e54f433eff9b6fbd0836611df4c1919df370 Mon Sep 17 00:00:00 2001 From: Bob Copeland Date: Thu, 14 Aug 2008 18:43:59 -0400 Subject: omfs: refuse to mount if bitmap pointer is obviously wrong If the free space bitmap pointer is corrupted such that it lies outside of the number of blocks in the filesystem, print a message and fail the mount so the user can fix it offline. Signed-off-by: Bob Copeland --- fs/omfs/inode.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'fs/omfs/inode.c') diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c index bd4bf753a63b..0af5d0af9f32 100644 --- a/fs/omfs/inode.c +++ b/fs/omfs/inode.c @@ -509,6 +509,15 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent) goto out_brelse_bh2; } + if (sbi->s_bitmap_ino != ~0ULL && + sbi->s_bitmap_ino > sbi->s_num_blocks) { + printk(KERN_ERR "omfs: free space bitmap location is corrupt " + "(%llx, total blocks %llx)\n", + (unsigned long long) sbi->s_bitmap_ino, + (unsigned long long) sbi->s_num_blocks); + goto out_brelse_bh2; + } + ret = omfs_get_imap(sb); if (ret) goto out_brelse_bh2; -- cgit v1.2.2 From 8800a044c71a128633cf3febaf4780531a991334 Mon Sep 17 00:00:00 2001 From: Bob Copeland Date: Tue, 6 Jul 2010 11:16:46 -0400 Subject: omfs: sanity check cluster size A corrupt filesystem could have a bad cluster size; this could result in the filesystem allocating too much space for files if too large, or getting stuck in omfs_allocate_block if too small. The proper range is 1-8 blocks. Reported-by: Eric Sesterhenn Signed-off-by: Bob Copeland --- fs/omfs/inode.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'fs/omfs/inode.c') diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c index 0af5d0af9f32..579d33fedddd 100644 --- a/fs/omfs/inode.c +++ b/fs/omfs/inode.c @@ -517,6 +517,12 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent) (unsigned long long) sbi->s_num_blocks); goto out_brelse_bh2; } + if (sbi->s_clustersize < 1 || + sbi->s_clustersize > OMFS_MAX_CLUSTER_SIZE) { + printk(KERN_ERR "omfs: cluster size out of range (%d)", + sbi->s_clustersize); + goto out_brelse_bh2; + } ret = omfs_get_imap(sb); if (ret) -- cgit v1.2.2 From 69c9e750176b409559b2361fbb28fa7bbf3c5461 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 6 Jun 2010 10:12:01 -0400 Subject: switch omfs to ->evict_inode() Signed-off-by: Al Viro --- fs/omfs/inode.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'fs/omfs/inode.c') diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c index 089839a6cc64..56121debc22b 100644 --- a/fs/omfs/inode.c +++ b/fs/omfs/inode.c @@ -175,9 +175,13 @@ int omfs_sync_inode(struct inode *inode) * called when an entry is deleted, need to clear the bits in the * bitmaps. */ -static void omfs_delete_inode(struct inode *inode) +static void omfs_evict_inode(struct inode *inode) { truncate_inode_pages(&inode->i_data, 0); + end_writeback(inode); + + if (inode->i_nlink) + return; if (S_ISREG(inode->i_mode)) { inode->i_size = 0; @@ -185,7 +189,6 @@ static void omfs_delete_inode(struct inode *inode) } omfs_clear_range(inode->i_sb, inode->i_ino, 2); - clear_inode(inode); } struct inode *omfs_iget(struct super_block *sb, ino_t ino) @@ -284,7 +287,7 @@ static int omfs_statfs(struct dentry *dentry, struct kstatfs *buf) static const struct super_operations omfs_sops = { .write_inode = omfs_write_inode, - .delete_inode = omfs_delete_inode, + .evict_inode = omfs_evict_inode, .put_super = omfs_put_super, .statfs = omfs_statfs, .show_options = generic_show_options, -- cgit v1.2.2