f2fs: sanity check size of nat and sit cache

Make sure number of entires doesn't exceed max journal size.

Cc: stable@vger.kernel.org
Signed-off-by: Jin Qian <jinqian@android.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index c1026b78cdfc1a92ad6b44507a8c23c2b1569988..a739803b6513600c9592d959bf0a358d38e1983d 100644 (file)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -2495,6 +2495,8 @@ static int read_normal_summaries(struct f2fs_sb_info *sbi, int type)
 
 static int restore_curseg_summaries(struct f2fs_sb_info *sbi)
 {
+       struct f2fs_journal *sit_j = CURSEG_I(sbi, CURSEG_COLD_DATA)->journal;
+       struct f2fs_journal *nat_j = CURSEG_I(sbi, CURSEG_HOT_DATA)->journal;
        int type = CURSEG_HOT_DATA;
        int err;
 
@@ -2521,6 +2523,11 @@ static int restore_curseg_summaries(struct f2fs_sb_info *sbi)
                        return err;
        }
 
+       /* sanity check for summary blocks */
+       if (nats_in_cursum(nat_j) > NAT_JOURNAL_ENTRIES ||
+                       sits_in_cursum(sit_j) > SIT_JOURNAL_ENTRIES)
+               return -EINVAL;
+
        return 0;
 }