Commit af07685b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fs_for_v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 

Pull ext2 and reiserfs updates from Jan Kara:
 "A fix for ext2 handling of a corrupted fs image and cleanups in ext2
  and reiserfs"

* tag 'fs_for_v5.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  ext2: Add more validity checks for inode counts
  fs/reiserfs/inode: remove dead code in _get_block_create_0()
  fs/ext2: replace ternary operator with min_t()
parents eb43bbac fa78f336

fs/ext2/super.c

+12 −6
Original line number Diff line number Diff line
@@ -1059,9 +1059,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) 
			sbi->s_frags_per_group);

		goto failed_mount;

	}

	if (sbi->s_inodes_per_group > sb->s_blocksize * 8) {

	if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||

	    sbi->s_inodes_per_group > sb->s_blocksize * 8) {

		ext2_msg(sb, KERN_ERR,

			"error: #inodes per group too big: %lu",

			"error: invalid #inodes per group: %lu",

			sbi->s_inodes_per_group);

		goto failed_mount;

	}
@@ -1071,6 +1072,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) 
	sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -

				le32_to_cpu(es->s_first_data_block) - 1)

					/ EXT2_BLOCKS_PER_GROUP(sb)) + 1;

	if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group !=

	    le32_to_cpu(es->s_inodes_count)) {

		ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu",

			 le32_to_cpu(es->s_inodes_count),

			 (u64)sbi->s_groups_count * sbi->s_inodes_per_group);

		goto failed_mount;

	}

	db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /

		   EXT2_DESC_PER_BLOCK(sb);

	sbi->s_group_desc = kmalloc_array(db_count,
@@ -1490,8 +1498,7 @@ static ssize_t ext2_quota_read(struct super_block *sb, int type, char *data, 
		len = i_size-off;

	toread = len;

	while (toread > 0) {

		tocopy = sb->s_blocksize - offset < toread ?

				sb->s_blocksize - offset : toread;

		tocopy = min_t(size_t, sb->s_blocksize - offset, toread);



		tmp_bh.b_state = 0;

		tmp_bh.b_size = sb->s_blocksize;
@@ -1529,8 +1536,7 @@ static ssize_t ext2_quota_write(struct super_block *sb, int type, 
	struct buffer_head *bh;



	while (towrite > 0) {

		tocopy = sb->s_blocksize - offset < towrite ?

				sb->s_blocksize - offset : towrite;

		tocopy = min_t(size_t, sb->s_blocksize - offset, towrite);



		tmp_bh.b_state = 0;

		tmp_bh.b_size = sb->s_blocksize;

fs/reiserfs/inode.c

+2 −10
Original line number Diff line number Diff line
@@ -290,7 +290,7 @@ static int _get_block_create_0(struct inode *inode, sector_t block, 
	struct buffer_head *bh;

	struct item_head *ih, tmp_ih;

	b_blocknr_t blocknr;

	char *p = NULL;

	char *p;

	int chars;

	int ret;

	int result;
@@ -305,8 +305,6 @@ static int _get_block_create_0(struct inode *inode, sector_t block, 
	result = search_for_position_by_key(inode->i_sb, &key, &path);

	if (result != POSITION_FOUND) {

		pathrelse(&path);

		if (p)

			kunmap(bh_result->b_page);

		if (result == IO_ERROR)

			return -EIO;

		/*
@@ -352,8 +350,6 @@ static int _get_block_create_0(struct inode *inode, sector_t block, 
		}



		pathrelse(&path);

		if (p)

			kunmap(bh_result->b_page);

		return ret;

	}

	/* requested data are in direct item(s) */
@@ -363,8 +359,6 @@ static int _get_block_create_0(struct inode *inode, sector_t block, 
		 * when it is stored in direct item(s)

		 */

		pathrelse(&path);

		if (p)

			kunmap(bh_result->b_page);

		return -ENOENT;

	}
@@ -396,9 +390,7 @@ static int _get_block_create_0(struct inode *inode, sector_t block, 
	 * sure we need to.  But, this means the item might move if

	 * kmap schedules

	 */

	if (!p)

	p = (char *)kmap(bh_result->b_page);



	p += offset;

	memset(p, 0, inode->i_sb->s_blocksize);

	do {