[PATCH] omfs: fix divide-by-zero on mount and bitmap slab-out-of-bounds accesses

[PATCH] omfs: fix divide-by-zero on mount and bitmap slab-out-of-bounds accesses

[Hui Peng]

Fix three bugs in fs/omfs/:

1. In omfs_fill_super() and omfs_get_bucket() (fs/omfs/inode.c,
   fs/omfs/dir.c), validate s_mirrors > 0 and s_sys_blocksize large
   enough that nbuckets > 0, preventing a hardware divide-by-zero (#DE)
   trap, and fix the error path so sbi->s_imap is not double-freed.
2. In omfs_count_free(), omfs_allocate_block(), and set_run()
   (fs/omfs/bitmap.c), bounds-check bitmap block indices against
   sbi->s_imap_size and clamp bit runs to the block size.

Fixes: 555e3775ced1 ("omfs: add inode routines")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/fs/omfs/bitmap.c b/fs/omfs/bitmap.c
index 7147ba6a6afc..58b361152979 100644
--- a/fs/omfs/bitmap.c
+++ b/fs/omfs/bitmap.c
@@ -53,6 +53,9 @@ static int set_run(struct super_block *sb, int map,
 	struct buffer_head *bh;
 	struct omfs_sb_info *sbi = OMFS_SB(sb);
 
+	if (map < 0 || map >= sbi->s_imap_size)
+		return -EINVAL;
+
  	err = -ENOMEM;
 	bh = sb_bread(sb, clus_to_blk(sbi, sbi->s_bitmap_ino) + map);
 	if (!bh)
@@ -65,6 +68,8 @@ static int set_run(struct super_block *sb, int map,
 
 			mark_buffer_dirty(bh);
 			brelse(bh);
+			if (map >= sbi->s_imap_size)
+				goto out;
 			bh = sb_bread(sb,
 				clus_to_blk(sbi, sbi->s_bitmap_ino) + map);
 			if (!bh)
diff --git a/fs/omfs/dir.c b/fs/omfs/dir.c
index 692297cf84e7..bad51587bc6f 100644
--- a/fs/omfs/dir.c
+++ b/fs/omfs/dir.c
@@ -232,7 +232,7 @@ static int omfs_dir_is_empty(struct inode *inode)
 			break;
 
 	brelse(bh);
-	return *ptr != ~0;
+	return i == nbuckets;
 }
 
 static int omfs_remove(struct inode *dir, struct dentry *dentry)
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
index 1d915ef72119..c4e05a53c9ae 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
@@ -265,7 +265,13 @@ struct inode *omfs_iget(struct super_block *sb, ino_t ino)
 static void omfs_put_super(struct super_block *sb)
 {
 	struct omfs_sb_info *sbi = OMFS_SB(sb);
-	kfree(sbi->s_imap);
+	int i;
+
+	if (sbi->s_imap) {
+		for (i = 0; i < sbi->s_imap_size; i++)
+			kfree(sbi->s_imap[i]);
+		kfree(sbi->s_imap);
+	}
 	kfree(sbi);
 	sb->s_fs_info = NULL;
 }
@@ -502,6 +508,11 @@ static int omfs_fill_super(struct super_block *sb, struct fs_context *fc)
 	sbi->s_sys_blocksize = be32_to_cpu(omfs_sb->s_sys_blocksize);
 	mutex_init(&sbi->s_bitmap_lock);
 
+	if (sbi->s_mirrors == 0) {
+		ret = -EINVAL;
+		goto out_brelse_bh;
+	}
+
 	if (sbi->s_num_blocks > OMFS_MAX_BLOCKS) {
 		printk(KERN_ERR "omfs: sysblock number (%llx) is out of range\n",
 		       (unsigned long long)sbi->s_num_blocks);
@@ -598,8 +609,16 @@ static int omfs_fill_super(struct super_block *sb, struct fs_context *fc)
 out_brelse_bh:
 	brelse(bh);
 end:
-	if (ret)
+	if (ret) {
+		if (sbi->s_imap) {
+			int i;
+
+			for (i = 0; i < sbi->s_imap_size; i++)
+				kfree(sbi->s_imap[i]);
+			kfree(sbi->s_imap);
+		}
 		kfree(sbi);
+	}
 	return ret;
 }