Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

[linux-2.6] / fs / reiserfs / dir.c

diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
index 9dd71e8070349c20f73102aad0d73de003cb7628..e6b03d2020c1c51aedbe6e443ccc7e236c50d242 100644 (file)
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -2,27 +2,28 @@
  * Copyright 2000 by Hans Reiser, licensing governed by reiserfs/README
  */
 
-#include <linux/config.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/reiserfs_fs.h>
 #include <linux/stat.h>
-#include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 #include <asm/uaccess.h>
 
-extern struct reiserfs_key MIN_KEY;
+extern const struct reiserfs_key MIN_KEY;
 
 static int reiserfs_readdir(struct file *, void *, filldir_t);
 static int reiserfs_dir_fsync(struct file *filp, struct dentry *dentry,
                              int datasync);
 
-struct file_operations reiserfs_dir_operations = {
+const struct file_operations reiserfs_dir_operations = {
        .read = generic_read_dir,
        .readdir = reiserfs_readdir,
        .fsync = reiserfs_dir_fsync,
        .ioctl = reiserfs_ioctl,
+#ifdef CONFIG_COMPAT
+       .compat_ioctl = reiserfs_compat_ioctl,
+#endif
 };
 
 static int reiserfs_dir_fsync(struct file *filp, struct dentry *dentry,
@@ -43,7 +44,7 @@ static int reiserfs_dir_fsync(struct file *filp, struct dentry *dentry,
 //
 static int reiserfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
 {
-       struct inode *inode = filp->f_dentry->d_inode;
+       struct inode *inode = filp->f_path.dentry->d_inode;
        struct cpu_key pos_key; /* key of current position in the directory (key of directory entry) */
        INITIALIZE_PATH(path_to_entry);
        struct buffer_head *bh;
@@ -120,6 +121,16 @@ static int reiserfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                                        continue;
                                d_reclen = entry_length(bh, ih, entry_num);
                                d_name = B_I_DEH_ENTRY_FILE_NAME(bh, ih, deh);
+
+                               if (d_reclen <= 0 ||
+                                   d_name + d_reclen > bh->b_data + bh->b_size) {
+                                       /* There is corrupted data in entry,
+                                        * We'd better stop here */
+                                       pathrelse(&path_to_entry);
+                                       ret = -EIO;
+                                       goto out;
+                               }
+
                                if (!d_name[d_reclen - 1])
                                        d_reclen = strlen(d_name);
 
@@ -133,7 +144,7 @@ static int reiserfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                                /* Ignore the .reiserfs_priv entry */
                                if (reiserfs_xattrs(inode->i_sb) &&
                                    !old_format_only(inode->i_sb) &&
-                                   filp->f_dentry == inode->i_sb->s_root &&
+                                   filp->f_path.dentry == inode->i_sb->s_root &&
                                    REISERFS_SB(inode->i_sb)->priv_root &&
                                    REISERFS_SB(inode->i_sb)->priv_root->d_inode
                                    && deh_objectid(deh) ==
@@ -150,18 +161,15 @@ static int reiserfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                                if (d_reclen <= 32) {
                                        local_buf = small_buf;
                                } else {
-                                       local_buf =
-                                           reiserfs_kmalloc(d_reclen, GFP_NOFS,
-                                                            inode->i_sb);
+                                       local_buf = kmalloc(d_reclen,
+                                                           GFP_NOFS);
                                        if (!local_buf) {
                                                pathrelse(&path_to_entry);
                                                ret = -ENOMEM;
                                                goto out;
                                        }
                                        if (item_moved(&tmp_ih, &path_to_entry)) {
-                                               reiserfs_kfree(local_buf,
-                                                              d_reclen,
-                                                              inode->i_sb);
+                                               kfree(local_buf);
                                                goto research;
                                        }
                                }
@@ -174,15 +182,12 @@ static int reiserfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                                    (dirent, local_buf, d_reclen, d_off, d_ino,
                                     DT_UNKNOWN) < 0) {
                                        if (local_buf != small_buf) {
-                                               reiserfs_kfree(local_buf,
-                                                              d_reclen,
-                                                              inode->i_sb);
+                                               kfree(local_buf);
                                        }
                                        goto end;
                                }
                                if (local_buf != small_buf) {
-                                       reiserfs_kfree(local_buf, d_reclen,
-                                                      inode->i_sb);
+                                       kfree(local_buf);
                                }
                                // next entry should be looked for with such offset
                                next_pos = deh_offset(deh) + 1;