In bfs_move_blocks() (fs/bfs/file.c), compute the destination block
number as start + i (instead of start + dblock, which shifts the
destination past the allocated extent when dblock > 0) and check for
NULL return from sb_getblk() before memcpy().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/fs/bfs/file.c b/fs/bfs/file.c
index d33d6bde992b..e6916c2b2671 100644
--- a/fs/bfs/file.c
+++ b/fs/bfs/file.c
@@ -40,6 +40,10 @@ static int bfs_move_block(unsigned long from, unsigned long to,
 	if (!bh)
 		return -EIO;
 	new = sb_getblk(sb, to);
+	if (!new) {
+		brelse(bh);
+		return -EIO;
+	}
 	memcpy(new->b_data, bh->b_data, bh->b_size);
 	mark_buffer_dirty(new);
 	bforget(bh);
@@ -54,9 +58,9 @@ static int bfs_move_blocks(struct super_block *sb, unsigned long start,
 
 	dprintf("%08lx-%08lx->%08lx\n", start, end, where);
 	for (i = start; i <= end; i++)
-		if(bfs_move_block(i, where + i, sb)) {
+		if (bfs_move_block(i, where + i - start, sb)) {
 			dprintf("failed to move block %08lx -> %08lx\n", i,
-								where + i);
+							where + i - start);
 			return -EIO;
 		}
 	return 0;