.. | .. |
---|
405 | 405 | |
---|
406 | 406 | static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) |
---|
407 | 407 | { |
---|
| 408 | + struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode); |
---|
408 | 409 | const struct gfs2_dinode *str = buf; |
---|
409 | 410 | struct timespec64 atime; |
---|
410 | 411 | u16 height, depth; |
---|
.. | .. |
---|
444 | 445 | /* i_diskflags and i_eattr must be set before gfs2_set_inode_flags() */ |
---|
445 | 446 | gfs2_set_inode_flags(&ip->i_inode); |
---|
446 | 447 | height = be16_to_cpu(str->di_height); |
---|
447 | | - if (unlikely(height > GFS2_MAX_META_HEIGHT)) |
---|
| 448 | + if (unlikely(height > sdp->sd_max_height)) |
---|
448 | 449 | goto corrupt; |
---|
449 | 450 | ip->i_height = (u8)height; |
---|
450 | 451 | |
---|
.. | .. |
---|
454 | 455 | ip->i_depth = (u8)depth; |
---|
455 | 456 | ip->i_entries = be32_to_cpu(str->di_entries); |
---|
456 | 457 | |
---|
| 458 | + if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip)) |
---|
| 459 | + goto corrupt; |
---|
| 460 | + |
---|
457 | 461 | if (S_ISREG(ip->i_inode.i_mode)) |
---|
458 | 462 | gfs2_set_aops(&ip->i_inode); |
---|
459 | 463 | |
---|