[PATCH] hfs: fix oops on mount with corrupted btree extent records

[Jeff Mahoney <jeffm@suse.com>]

 A particular fsfuzzer run caused an hfs file system to crash on mount. This
 is due to a corrupted MDB extent record causing a miscalculation of
 HFS_I(inode)->first_blocks for the extent tree. If the extent records
 are zereod out, it won't trigger the first_blocks special case. Instead
 it falls through to the extent code which we're still in the middle
 of initializing.

 This patch catches the 0 size extent records, reports the corruption,
 and fails the mount.

Reported-by: Ramon de Carvalho Valle <rcvalle@linux.vnet.ibm.com>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
---
 fs/hfs/btree.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -58,6 +58,11 @@ struct hfs_btree *hfs_btree_open(struct
 	}
 	unlock_new_inode(tree->inode);
 
+	if (!HFS_I(tree->inode)->first_blocks) {
+		printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
+		goto free_inode;
+	}
+
 	mapping = tree->inode->i_mapping;
 	page = read_mapping_page(mapping, 0, NULL);
 	if (IS_ERR(page))
-- 
Jeff Mahoney
SUSE Labs