The following commit has been merged in the linux branch: commit 47f365eb575735c6b2edf5d08e0d16d26a9c23bd Author: Jeff Mahoney jeffm@suse.com Date: Mon Oct 26 16:49:56 2009 -0700

hfs: fix oops on mount with corrupted btree extent records

A particular fsfuzzer run caused an hfs file system to crash on mount. This is due to a corrupted MDB extent record causing a miscalculation of HFS_I(inode)->first_blocks for the extent tree. If the extent records are zereod out, it won't trigger the first_blocks special case. Instead it falls through to the extent code which we're still in the middle of initializing.

This patch catches the 0 size extent records, reports the corruption, and fails the mount.

Reported-by: Ramon de Carvalho Valle rcvalle@linux.vnet.ibm.com Signed-off-by: Jeff Mahoney jeffm@suse.com Cc: Valdis Kletnieks Valdis.Kletnieks@vt.edu Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Linus Torvalds torvalds@linux-foundation.org

diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c index 9b9d639..052f214 100644 --- a/fs/hfs/btree.c +++ b/fs/hfs/btree.c @@ -58,6 +58,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke } unlock_new_inode(tree->inode);

+ if (!HFS_I(tree->inode)->first_blocks) { + printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n"); + goto free_inode; + } + mapping = tree->inode->i_mapping; page = read_mapping_page(mapping, 0, NULL); if (IS_ERR(page))