> + * so we have to walk the tree.  Both inodes and file data are allocated
quoted text
> + * from the same map.  This array can be big (300k) so we allocate
> + * in units of the blocksize.

sbi->s_num_blocks doesn't appear to be validated at the time of mount ?

quoted text
> +static int omfs_fill_super(struct super_block *sb, void *data, int silent)
> +{

quoted text
> +	sbi->s_num_blocks = be64_to_cpu(omfs_sb->s_num_blocks);
> +	sbi->s_blocksize = be32_to_cpu(omfs_sb->s_blocksize);
> +	sbi->s_mirrors = be32_to_cpu(omfs_sb->s_mirrors);
> +	sbi->s_root_ino = be64_to_cpu(omfs_sb->s_root_block);
> +	sbi->s_sys_blocksize = be32_to_cpu(omfs_sb->s_sys_blocksize);

Several of these look like they should be checked before use elsewhere in
the code (eg blocksize is fed into shifts later)

--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/