diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 0ab83bb7bbdf..e919de01c42a 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key, static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp, int ri, struct component_name * key, int flag); -static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key, - ddata_t * data, struct dt_lock **); +static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key, + ddata_t * data, struct dt_lock **); static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp, struct dt_lock ** sdtlock, struct dt_lock ** ddtlock, @@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip, lv->length = 1; dtlck->index++; - dtInsertEntry(p, index, name, &data, &dtlck); + if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck))) + return rc; /* linelock stbl of non-root leaf page */ if (!(p->header.flag & BT_ROOT)) { @@ -3625,9 +3626,10 @@ static void dtGetKey(dtpage_t * p, int i, /* entry index */ * function: allocate free slot(s) and * write a leaf/internal entry * - * return: entry slot index + * * return: 0 - success; + * errno - failure; */ -static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key, +static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key, ddata_t * data, struct dt_lock ** dtlock) { struct dtslot *h, *t; @@ -3649,6 +3651,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key, /* allocate a free slot */ hsi = fsi = p->header.freelist; + if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) { + jfs_err("Encountered corrupted dtpage before insert"); + return -EIO; + } h = &p->slot[fsi]; p->header.freelist = h->next; --p->header.freecnt; @@ -3697,6 +3703,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key, while (klen) { /* get free slot */ fsi = p->header.freelist; + if (fsi >= ((p->header.flag & BT_ROOT) ? DTROOTMAXSLOT : p->header.maxslot)) { + jfs_err("Encountered corrupted dtpage before insert"); + return -EIO; + } t = &p->slot[fsi]; p->header.freelist = t->next; --p->header.freecnt; @@ -3774,6 +3784,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key, /* advance next available entry index of stbl */ ++p->header.nextindex; + + return 0; }