[JFFS2] Correct buggy length checks

The previous changes introduced wrong length calculations.

Signed-off-by: Artem B. Bityutskiy <dedekind@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index 007d52f394dd800522f2210e78bc470d17b1a1ef..b5f73ab6553c54e47091db3d5f8bc52973ccdd32 100644 (file)
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -7,7 +7,7 @@
  *
  * For licensing information, see the file 'LICENCE' in this directory.
  *
- * $Id: nodelist.c,v 1.107 2005/08/03 09:26:46 dedekind Exp $
+ * $Id: nodelist.c,v 1.108 2005/08/04 11:39:59 dedekind Exp $
  *
  */
 
@@ -412,7 +412,7 @@ static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info
 
        /* Calculate how many bytes were already checked */
        ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
-       len = ofs - (ofs & (PAGE_CACHE_SIZE - 1));
+       len = ofs & (c->wbuf_pagesize - 1);
        len = c->wbuf_pagesize - len;
 
        if (len >= tn->csize) {

diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index e6076fa5560f5c0a3b112bb5c56c21c70313e570..12a3aaeb2f7e0860ffc1d2835ce249f96b10868c 100644 (file)
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -7,7 +7,7 @@
  *
  * For licensing information, see the file 'LICENCE' in this directory.
  *
- * $Id: readinode.c,v 1.137 2005/08/03 09:26:46 dedekind Exp $
+ * $Id: readinode.c,v 1.138 2005/08/03 09:28:06 dedekind Exp $
  *
  */
 
@@ -278,7 +278,7 @@ static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
 
                        /* If we actually calculated the whole data CRC
                         * and it is wrong, drop the node. */
-                       if (len == csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
+                       if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
                                JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
                                        ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
                                goto free_out;