debug lk

hc

2024-02-20 e636c8d336489bf3eed5878299e6cc045bbad077

 kernel/fs/gfs2/glops.c
..
..
@@ -405,6 +405,7 @@
405
405
 
406
406
 static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
407
407
 {
408
+	struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
408
409
 	const struct gfs2_dinode *str = buf;
409
410
 	struct timespec64 atime;
410
411
 	u16 height, depth;
..
..
@@ -444,7 +445,7 @@
444
445
 	/* i_diskflags and i_eattr must be set before gfs2_set_inode_flags() */
445
446
 	gfs2_set_inode_flags(&ip->i_inode);
446
447
 	height = be16_to_cpu(str->di_height);
447
-	if (unlikely(height > GFS2_MAX_META_HEIGHT))
448
+	if (unlikely(height > sdp->sd_max_height))
448
449
 		goto corrupt;
449
450
 	ip->i_height = (u8)height;
450
451
 
..
..
@@ -454,6 +455,9 @@
454
455
 	ip->i_depth = (u8)depth;
455
456
 	ip->i_entries = be32_to_cpu(str->di_entries);
456
457
 
458
+	if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip))
459
+		goto corrupt;
460
+
457
461
 	if (S_ISREG(ip->i_inode.i_mode))
458
462
 		gfs2_set_aops(&ip->i_inode);
459
463