Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph...

[linux-drm-fsl-dcu.git] / fs / ceph / export.c

diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index 862887004d2060bb0fce8e4cac8a0b65d1f5c728..9349bb37a2fe68df93651e6afeb384468157edd2 100644 (file)
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -101,7 +101,7 @@ static int ceph_encode_fh(struct inode *inode, u32 *rawfh, int *max_len,
  * FIXME: we should try harder by querying the mds for the ino.
  */
 static struct dentry *__fh_to_dentry(struct super_block *sb,
-                                    struct ceph_nfs_fh *fh)
+                                    struct ceph_nfs_fh *fh, int fh_len)
 {
        struct ceph_mds_client *mdsc = ceph_sb_to_client(sb)->mdsc;
        struct inode *inode;
@@ -109,6 +109,9 @@ static struct dentry *__fh_to_dentry(struct super_block *sb,
        struct ceph_vino vino;
        int err;
 
+       if (fh_len < sizeof(*fh) / 4)
+               return ERR_PTR(-ESTALE);
+
        dout("__fh_to_dentry %llx\n", fh->ino);
        vino.ino = fh->ino;
        vino.snap = CEPH_NOSNAP;
@@ -152,7 +155,7 @@ static struct dentry *__fh_to_dentry(struct super_block *sb,
  * convert connectable fh to dentry
  */
 static struct dentry *__cfh_to_dentry(struct super_block *sb,
-                                     struct ceph_nfs_confh *cfh)
+                                     struct ceph_nfs_confh *cfh, int fh_len)
 {
        struct ceph_mds_client *mdsc = ceph_sb_to_client(sb)->mdsc;
        struct inode *inode;
@@ -160,6 +163,9 @@ static struct dentry *__cfh_to_dentry(struct super_block *sb,
        struct ceph_vino vino;
        int err;
 
+       if (fh_len < sizeof(*cfh) / 4)
+               return ERR_PTR(-ESTALE);
+
        dout("__cfh_to_dentry %llx (%llx/%x)\n",
             cfh->ino, cfh->parent_ino, cfh->parent_name_hash);
 
@@ -209,9 +215,11 @@ static struct dentry *ceph_fh_to_dentry(struct super_block *sb, struct fid *fid,
                                        int fh_len, int fh_type)
 {
        if (fh_type == 1)
-               return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw);
+               return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw,
+                                                               fh_len);
        else
-               return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw);
+               return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw,
+                                                               fh_len);
 }
 
 /*
@@ -232,6 +240,8 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb,
 
        if (fh_type == 1)
                return ERR_PTR(-ESTALE);
+       if (fh_len < sizeof(*cfh) / 4)
+               return ERR_PTR(-ESTALE);
 
        pr_debug("fh_to_parent %llx/%d\n", cfh->parent_ino,
                 cfh->parent_name_hash);