diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c index 162711cc5b20..143ce8ba6071 100644 --- a/fs/ocfs2/alloc.c +++ b/fs/ocfs2/alloc.c @@ -5941,6 +5941,16 @@ static int ocfs2_replay_truncate_records(struct ocfs2_super *osb, di = (struct ocfs2_dinode *) tl_bh->b_data; tl = &di->id2.i_dealloc; + if (le16_to_cpu(tl->tl_count) != ocfs2_truncate_recs_per_inode(osb->sb)) { + status = -EINVAL; + mlog_errno(status); + goto bail; + } + if (le16_to_cpu(tl->tl_used) >= le16_to_cpu(tl->tl_count)) { + status = -EINVAL; + mlog_errno(status); + goto bail; + } i = le16_to_cpu(tl->tl_used) - 1; while (i >= 0) { handle = ocfs2_start_trans(osb, OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);