tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking

[karo-tx-linux.git] / fs / gfs2 / export.c

diff --git a/fs/gfs2/export.c b/fs/gfs2/export.c
index 70ba891654f8ce3582c456e208feda6d56e90a1a..fdef7f0e28ab3d64e9980b59e334a717ee0af072 100644 (file)
--- a/fs/gfs2/export.c
+++ b/fs/gfs2/export.c
@@ -168,6 +168,8 @@ static struct dentry *gfs2_fh_to_dentry(struct super_block *sb, struct fid *fid,
        case GFS2_SMALL_FH_SIZE:
        case GFS2_LARGE_FH_SIZE:
        case GFS2_OLD_FH_SIZE:
+               if (fh_len < GFS2_SMALL_FH_SIZE)
+                       return NULL;
                this.no_formal_ino = ((u64)be32_to_cpu(fh[0])) << 32;
                this.no_formal_ino |= be32_to_cpu(fh[1]);
                this.no_addr = ((u64)be32_to_cpu(fh[2])) << 32;
@@ -187,6 +189,8 @@ static struct dentry *gfs2_fh_to_parent(struct super_block *sb, struct fid *fid,
        switch (fh_type) {
        case GFS2_LARGE_FH_SIZE:
        case GFS2_OLD_FH_SIZE:
+               if (fh_len < GFS2_LARGE_FH_SIZE)
+                       return NULL;
                parent.no_formal_ino = ((u64)be32_to_cpu(fh[4])) << 32;
                parent.no_formal_ino |= be32_to_cpu(fh[5]);
                parent.no_addr = ((u64)be32_to_cpu(fh[6])) << 32;