loop: fix NULL dereference if mount fails

[safe/jmp/linux-2.6] / fs / omfs / file.c

diff --git a/fs/omfs/file.c b/fs/omfs/file.c
index 7e24990..399487c 100644 (file)
--- a/fs/omfs/file.c
+++ b/fs/omfs/file.c
@@ -11,19 +11,11 @@
 #include <linux/mpage.h>
 #include "omfs.h"
 
-static int omfs_sync_file(struct file *file, struct dentry *dentry,
-               int datasync)
+static u32 omfs_max_extents(struct omfs_sb_info *sbi, int offset)
 {
-       struct inode *inode = dentry->d_inode;
-       int err;
-
-       err = sync_mapping_buffers(inode->i_mapping);
-       if (!(inode->i_state & I_DIRTY))
-               return err;
-       if (datasync && !(inode->i_state & I_DIRTY_DATASYNC))
-               return err;
-       err |= omfs_sync_inode(inode);
-       return err ? -EIO : 0;
+       return (sbi->s_sys_blocksize - offset -
+               sizeof(struct omfs_extent)) /
+               sizeof(struct omfs_extent_entry) + 1;
 }
 
 void omfs_make_empty_table(struct buffer_head *bh, int offset)
@@ -45,6 +37,7 @@ int omfs_shrink_inode(struct inode *inode)
        struct buffer_head *bh;
        u64 next, last;
        u32 extent_count;
+       u32 max_extents;
        int ret;
 
        /* traverse extent table, freeing each entry that is greater
@@ -62,15 +55,18 @@ int omfs_shrink_inode(struct inode *inode)
                goto out;
 
        oe = (struct omfs_extent *)(&bh->b_data[OMFS_EXTENT_START]);
+       max_extents = omfs_max_extents(sbi, OMFS_EXTENT_START);
 
        for (;;) {
 
-               if (omfs_is_bad(sbi, (struct omfs_header *) bh->b_data, next)) {
-                       brelse(bh);
-                       goto out;
-               }
+               if (omfs_is_bad(sbi, (struct omfs_header *) bh->b_data, next))
+                       goto out_brelse;
 
                extent_count = be32_to_cpu(oe->e_extent_count);
+
+               if (extent_count > max_extents)
+                       goto out_brelse;
+
                last = next;
                next = be64_to_cpu(oe->e_next);
                entry = &oe->e_entry;
@@ -98,10 +94,14 @@ int omfs_shrink_inode(struct inode *inode)
                if (!bh)
                        goto out;
                oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]);
+               max_extents = omfs_max_extents(sbi, OMFS_EXTENT_CONT);
        }
        ret = 0;
 out:
        return ret;
+out_brelse:
+       brelse(bh);
+       return ret;
 }
 
 static void omfs_truncate(struct inode *inode)
@@ -154,9 +154,7 @@ static int omfs_grow_extent(struct inode *inode, struct omfs_extent *oe,
                        goto out;
                }
        }
-       max_count = (sbi->s_sys_blocksize - OMFS_EXTENT_START -
-               sizeof(struct omfs_extent)) /
-               sizeof(struct omfs_extent_entry) + 1;
+       max_count = omfs_max_extents(sbi, OMFS_EXTENT_START);
 
        /* TODO: add a continuation block here */
        if (be32_to_cpu(oe->e_extent_count) > max_count-1)
@@ -225,6 +223,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
        sector_t next, offset;
        int ret;
        u64 new_block;
+       u32 max_extents;
        int extent_count;
        struct omfs_extent *oe;
        struct omfs_extent_entry *entry;
@@ -238,6 +237,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
                goto out;
 
        oe = (struct omfs_extent *)(&bh->b_data[OMFS_EXTENT_START]);
+       max_extents = omfs_max_extents(sbi, OMFS_EXTENT_START);
        next = inode->i_ino;
 
        for (;;) {
@@ -249,6 +249,9 @@ static int omfs_get_block(struct inode *inode, sector_t block,
                next = be64_to_cpu(oe->e_next);
                entry = &oe->e_entry;
 
+               if (extent_count > max_extents)
+                       goto out_brelse;
+
                offset = find_block(inode, entry, block, extent_count, &remain);
                if (offset > 0) {
                        ret = 0;
@@ -266,6 +269,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
                if (!bh)
                        goto out;
                oe = (struct omfs_extent *) (&bh->b_data[OMFS_EXTENT_CONT]);
+               max_extents = omfs_max_extents(sbi, OMFS_EXTENT_CONT);
        }
        if (create) {
                ret = omfs_grow_extent(inode, oe, &new_block);
@@ -318,22 +322,22 @@ static sector_t omfs_bmap(struct address_space *mapping, sector_t block)
        return generic_block_bmap(mapping, block, omfs_get_block);
 }
 
-struct file_operations omfs_file_operations = {
+const struct file_operations omfs_file_operations = {
        .llseek = generic_file_llseek,
        .read = do_sync_read,
        .write = do_sync_write,
        .aio_read = generic_file_aio_read,
        .aio_write = generic_file_aio_write,
        .mmap = generic_file_mmap,
-       .fsync = omfs_sync_file,
+       .fsync = simple_fsync,
        .splice_read = generic_file_splice_read,
 };
 
-struct inode_operations omfs_file_inops = {
+const struct inode_operations omfs_file_inops = {
        .truncate = omfs_truncate
 };
 
-struct address_space_operations omfs_aops = {
+const struct address_space_operations omfs_aops = {
        .readpage = omfs_readpage,
        .readpages = omfs_readpages,
        .writepage = omfs_writepage,