fs/seq_file: fix out-of-bounds read

[pandora-kernel.git] / fs / ocfs2 / suballoc.c

diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index ba5d97e..b7e74b5 100644 (file)
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -600,7 +600,7 @@ static void ocfs2_bg_alloc_cleanup(handle_t *handle,
                ret = ocfs2_free_clusters(handle, cluster_ac->ac_inode,
                                          cluster_ac->ac_bh,
                                          le64_to_cpu(rec->e_blkno),
-                                         le32_to_cpu(rec->e_leaf_clusters));
+                                         le16_to_cpu(rec->e_leaf_clusters));
                if (ret)
                        mlog_errno(ret);
                /* Try all the clusters to free */
@@ -642,7 +642,7 @@ ocfs2_block_group_alloc_discontig(handle_t *handle,
         * cluster groups will be staying in cache for the duration of
         * this operation.
         */
-       ac->ac_allow_chain_relink = 0;
+       ac->ac_disable_chain_relink = 1;
 
        /* Claim the first region */
        status = ocfs2_block_group_claim_bits(osb, handle, ac, min_bits,
@@ -1628,7 +1628,7 @@ static int ocfs2_bg_discontig_fix_by_rec(struct ocfs2_suballoc_result *res,
 {
        unsigned int bpc = le16_to_cpu(cl->cl_bpc);
        unsigned int bitoff = le32_to_cpu(rec->e_cpos) * bpc;
-       unsigned int bitcount = le32_to_cpu(rec->e_leaf_clusters) * bpc;
+       unsigned int bitcount = le16_to_cpu(rec->e_leaf_clusters) * bpc;
 
        if (res->sr_bit_offset < bitoff)
                return 0;
@@ -1823,7 +1823,7 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context *ac,
         * Do this *after* figuring out how many bits we're taking out
         * of our target group.
         */
-       if (ac->ac_allow_chain_relink &&
+       if (!ac->ac_disable_chain_relink &&
            (prev_group_bh) &&
            (ocfs2_block_group_reasonably_empty(bg, res->sr_bits))) {
                status = ocfs2_relink_block_group(handle, alloc_inode,
@@ -1928,7 +1928,6 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_alloc_context *ac,
 
        victim = ocfs2_find_victim_chain(cl);
        ac->ac_chain = victim;
-       ac->ac_allow_chain_relink = 1;
 
        status = ocfs2_search_chain(ac, handle, bits_wanted, min_bits,
                                    res, &bits_left);
@@ -1947,7 +1946,7 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_alloc_context *ac,
         * searching each chain in order. Don't allow chain relinking
         * because we only calculate enough journal credits for one
         * relink per alloc. */
-       ac->ac_allow_chain_relink = 0;
+       ac->ac_disable_chain_relink = 1;
        for (i = 0; i < le16_to_cpu(cl->cl_next_free_rec); i ++) {
                if (i == victim)
                        continue;