diff options
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/jbd2/recovery.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c index 73063285b13f..59cc9c5231ed 100644 --- a/fs/jbd2/recovery.c +++ b/fs/jbd2/recovery.c @@ -718,11 +718,16 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh, { jbd2_journal_revoke_header_t *header; int offset, max; + __u32 rcount; int record_len = 4; header = (jbd2_journal_revoke_header_t *) bh->b_data; offset = sizeof(jbd2_journal_revoke_header_t); - max = be32_to_cpu(header->r_count); + rcount = be32_to_cpu(header->r_count); + + if (rcount > journal->j_blocksize) + return -EINVAL; + max = rcount; if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) record_len = 8; |