commit b6b41424f0ec28e9a167fa29b003327860b4b71b
author Al Viro <viro@ftp.linux.org.uk> Thu Oct 14 09:53:42 2010 -0400
committer Christoph Hellwig <hch@lst.de> Thu Oct 14 09:53:42 2010 -0400
tree 9e17a235542259f82a3a1e2c3d2a1906f2ac4749
parent ee52716245877b821f5ddbb3ace85b73084fb450

hfsplus: hfs_bnode_find() can fail, resulting in hfs_bnode_split() breakage

oops and fs corruption; the latter can happen even on valid fs in case of oom.

[hch: port of commit 3d10a15d6919488204bdb264050d156ced20d9aa from hfs]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Christoph Hellwig <hch@tuxera.com>

fs/hfsplus/brec.c

diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
index c88e5d7..fa90364 100644
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -216,7 +216,7 @@
 static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
 {
 	struct hfs_btree *tree;
-	struct hfs_bnode *node, *new_node;
+	struct hfs_bnode *node, *new_node, *next_node;
 	struct hfs_bnode_desc node_desc;
 	int num_recs, new_rec_off, new_off, old_rec_off;
 	int data_start, data_end, size;
@@ -235,6 +235,17 @@
 	new_node->type = node->type;
 	new_node->height = node->height;
 
+	if (node->next)
+		next_node = hfs_bnode_find(tree, node->next);
+	else
+		next_node = NULL;
+
+	if (IS_ERR(next_node)) {
+		hfs_bnode_put(node);
+		hfs_bnode_put(new_node);
+		return next_node;
+	}
+
 	size = tree->node_size / 2 - node->num_recs * 2 - 14;
 	old_rec_off = tree->node_size - 4;
 	num_recs = 1;
@@ -248,6 +259,8 @@
 		/* panic? */
 		hfs_bnode_put(node);
 		hfs_bnode_put(new_node);
+		if (next_node)
+			hfs_bnode_put(next_node);
 		return ERR_PTR(-ENOSPC);
 	}
 
@@ -302,8 +315,7 @@
 	hfs_bnode_write(node, &node_desc, 0, sizeof(node_desc));
 
 	/* update next bnode header */
-	if (new_node->next) {
-		struct hfs_bnode *next_node = hfs_bnode_find(tree, new_node->next);
+	if (next_node) {
 		next_node->prev = new_node->this;
 		hfs_bnode_read(next_node, &node_desc, 0, sizeof(node_desc));
 		node_desc.prev = cpu_to_be32(next_node->prev);