BACKPORT: f2fs: sanity check size of nat and sit cache

Make sure number of entires doesn't exceed max journal size.

Cc: stable@vger.kernel.org
Signed-off-by: Jin Qian <jinqian@android.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(url https://sourceforge.net/p/linux-f2fs/mailman/message/35872032)
Bug: 36819470

Change-Id: I0db498cdc996ec204f56617bba5c4ab5ac6ade14

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index f77b3258454a6f9b55810a72982436e9bf7a162e..7965957dd0e6173c51522ae2b63ca0eade85f0e8 100644 (file)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1623,6 +1623,10 @@ static int read_normal_summaries(struct f2fs_sb_info *sbi, int type)
 
 static int restore_curseg_summaries(struct f2fs_sb_info *sbi)
 {
+       struct f2fs_summary_block *s_sits =
+               CURSEG_I(sbi, CURSEG_COLD_DATA)->sum_blk;
+       struct f2fs_summary_block *s_nats =
+               CURSEG_I(sbi, CURSEG_HOT_DATA)->sum_blk;
        int type = CURSEG_HOT_DATA;
        int err;
 
@@ -1649,6 +1653,11 @@ static int restore_curseg_summaries(struct f2fs_sb_info *sbi)
                        return err;
        }
 
+       /* sanity check for summary blocks */
+       if (nats_in_cursum(s_nats) > NAT_JOURNAL_ENTRIES ||
+                       sits_in_cursum(s_sits) > SIT_JOURNAL_ENTRIES)
+               return -EINVAL;
+
        return 0;
 }