[PATCH] fs/ufs: return early from ufs_free_fragments on invalid input

[PATCH] fs/ufs: return early from ufs_free_fragments on invalid input

[Muhammad Mahdi Amirpour]

The check for an out-of-range fragment count in ufs_free_fragments()
only calls ufs_error(), which marks the filesystem read-only but does
not return. Execution then continues with the invalid fragment and
count values.

The sibling function ufs_free_blocks() performs an equivalent check
and bails out via goto failed. Mirror that behaviour here so that a
corrupt image cannot push the code past the check into paths that
assume the invariant holds.

No functional change for valid inputs.

Signed-off-by: Muhammad Mahdi Amirpour <ampr.mhd@gmail.com>
---
 fs/ufs/balloc.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index 628edfde3..377ba77fb 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -73,8 +73,12 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
 	UFSD("ENTER, fragment %llu, count %u\n",
 	     (unsigned long long)fragment, count);
 	
-	if (ufs_fragnum(fragment) + count > uspi->s_fpb)
-		ufs_error (sb, "ufs_free_fragments", "internal error");
+	if (ufs_fragnum(fragment) + count > uspi->s_fpb) {
+		ufs_error(sb, "ufs_free_fragments",
+			  "invalid fragment %llu, count %u",
+			  (unsigned long long)fragment, count);
+		return;
+	}
 
 	mutex_lock(&UFS_SB(sb)->s_lock);
 	
-- 
2.55.0