hc
2024-10-22 8ac6c7a54ed1b98d142dce24b11c6de6a1e239a5
kernel/fs/udf/balloc.c
....@@ -36,18 +36,41 @@
3636 unsigned long bitmap_nr)
3737 {
3838 struct buffer_head *bh = NULL;
39
- int retval = 0;
39
+ int i;
40
+ int max_bits, off, count;
4041 struct kernel_lb_addr loc;
4142
4243 loc.logicalBlockNum = bitmap->s_extPosition;
4344 loc.partitionReferenceNum = UDF_SB(sb)->s_partition;
4445
4546 bh = udf_tread(sb, udf_get_lb_pblock(sb, &loc, block));
46
- if (!bh)
47
- retval = -EIO;
48
-
4947 bitmap->s_block_bitmap[bitmap_nr] = bh;
50
- return retval;
48
+ if (!bh)
49
+ return -EIO;
50
+
51
+ /* Check consistency of Space Bitmap buffer. */
52
+ max_bits = sb->s_blocksize * 8;
53
+ if (!bitmap_nr) {
54
+ off = sizeof(struct spaceBitmapDesc) << 3;
55
+ count = min(max_bits - off, bitmap->s_nr_groups);
56
+ } else {
57
+ /*
58
+ * Rough check if bitmap number is too big to have any bitmap
59
+ * blocks reserved.
60
+ */
61
+ if (bitmap_nr >
62
+ (bitmap->s_nr_groups >> (sb->s_blocksize_bits + 3)) + 2)
63
+ return 0;
64
+ off = 0;
65
+ count = bitmap->s_nr_groups - bitmap_nr * max_bits +
66
+ (sizeof(struct spaceBitmapDesc) << 3);
67
+ count = min(count, max_bits);
68
+ }
69
+
70
+ for (i = 0; i < count; i++)
71
+ if (udf_test_bit(i + off, bh->b_data))
72
+ return -EFSCORRUPTED;
73
+ return 0;
5174 }
5275
5376 static int __load_block_bitmap(struct super_block *sb,