mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00

The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] <TASK> [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] </TASK> [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x320 [ 174.883144][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.883595][ T9784] hfsplus_rmdir+0x106/0x1b0 [ 174.884004][ T9784] vfs_rmdir+0x206/0x690 [ 174.884379][ T9784] do_rmdir+0x2b7/0x390 [ 174.884751][ T9784] __x64_sys_rmdir+0xc5/0x110 [ 174.885167][ T9784] do_syscall_64+0xc9/0x480 [ 174.885568][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.886083][ T9784] [ 174.886293][ T9784] The buggy address belongs to the object at ffff88810b5fc600 [ 174.886293][ T9784] which belongs to the cache kmalloc-192 of size 192 [ 174.887507][ T9784] The buggy address is located 40 bytes to the right of [ 174.887507][ T9784] allocated 152-byte region [ffff88810b5fc600, ffff88810b5fc698) [ 174.888766][ T9784] [ 174.888976][ T9784] The buggy address belongs to the physical page: [ 174.889533][ T9784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b5fc [ 174.890295][ T9784] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 174.890927][ T9784] page_type: f5(slab) [ 174.891284][ T9784] raw: 057ff00000000000 ffff88801b4423c0 ffffea000426dc80 dead000000000002 [ 174.892032][ T9784] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 174.892774][ T9784] page dumped because: kasan: bad access detected [ 174.893327][ T9784] page_owner tracks the page as allocated [ 174.893825][ T9784] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c00(GFP_NOIO|__GFP_NOWARN|__GFP_NO1 [ 174.895373][ T9784] post_alloc_hook+0x1c0/0x230 [ 174.895801][ T9784] get_page_from_freelist+0xdeb/0x3b30 [ 174.896284][ T9784] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 174.896810][ T9784] alloc_pages_mpol+0x1fb/0x550 [ 174.897242][ T9784] new_slab+0x23b/0x340 [ 174.897614][ T9784] ___slab_alloc+0xd81/0x1960 [ 174.898028][ T9784] __slab_alloc.isra.0+0x56/0xb0 [ 174.898468][ T9784] __kmalloc_noprof+0x2b0/0x550 [ 174.898896][ T9784] usb_alloc_urb+0x73/0xa0 [ 174.899289][ T9784] usb_control_msg+0x1cb/0x4a0 [ 174.899718][ T9784] usb_get_string+0xab/0x1a0 [ 174.900133][ T9784] usb_string_sub+0x107/0x3c0 [ 174.900549][ T9784] usb_string+0x307/0x670 [ 174.900933][ T9784] usb_cache_string+0x80/0x150 [ 174.901355][ T9784] usb_new_device+0x1d0/0x19d0 [ 174.901786][ T9784] register_root_hub+0x299/0x730 [ 174.902231][ T9784] page last free pid 10 tgid 10 stack trace: [ 174.902757][ T9784] __free_frozen_pages+0x80c/0x1250 [ 174.903217][ T9784] vfree.part.0+0x12b/0xab0 [ 174.903645][ T9784] delayed_vfree_work+0x93/0xd0 [ 174.904073][ T9784] process_one_work+0x9b5/0x1b80 [ 174.904519][ T9784] worker_thread+0x630/0xe60 [ 174.904927][ T9784] kthread+0x3a8/0x770 [ 174.905291][ T9784] ret_from_fork+0x517/0x6e0 [ 174.905709][ T9784] ret_from_fork_asm+0x1a/0x30 [ 174.906128][ T9784] [ 174.906338][ T9784] Memory state around the buggy address: [ 174.906828][ T9784] ffff88810b5fc580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.907528][ T9784] ffff88810b5fc600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 174.908222][ T9784] >ffff88810b5fc680: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 174.908917][ T9784] ^ [ 174.909481][ T9784] ffff88810b5fc700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.910432][ T9784] ffff88810b5fc780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.911401][ T9784] ================================================================== The reason of the issue that code doesn't check the correctness of the requested offset and length. As a result, incorrect value of offset or/and length could result in access out of allocated memory. This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfsplus_bnode_read(), hfsplus_bnode_write(), hfsplus_bnode_clear(), hfsplus_bnode_copy(), and hfsplus_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash. Reported-by: Kun Hu <huk23@m.fudan.edu.cn> Reported-by: Jiaji Qin <jjtan24@m.fudan.edu.cn> Reported-by: Shuoran Bai <baishuoran@hrbeu.edu.cn> Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Link: https://lore.kernel.org/r/20250703214804.244077-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
750 lines
18 KiB
C
750 lines
18 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* linux/fs/hfsplus/bnode.c
|
|
*
|
|
* Copyright (C) 2001
|
|
* Brad Boyer (flar@allandria.com)
|
|
* (C) 2003 Ardis Technologies <roman@ardistech.com>
|
|
*
|
|
* Handle basic btree node operations
|
|
*/
|
|
|
|
#include <linux/string.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/pagemap.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/swap.h>
|
|
|
|
#include "hfsplus_fs.h"
|
|
#include "hfsplus_raw.h"
|
|
|
|
static inline
|
|
bool is_bnode_offset_valid(struct hfs_bnode *node, int off)
|
|
{
|
|
bool is_valid = off < node->tree->node_size;
|
|
|
|
if (!is_valid) {
|
|
pr_err("requested invalid offset: "
|
|
"NODE: id %u, type %#x, height %u, "
|
|
"node_size %u, offset %d\n",
|
|
node->this, node->type, node->height,
|
|
node->tree->node_size, off);
|
|
}
|
|
|
|
return is_valid;
|
|
}
|
|
|
|
static inline
|
|
int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len)
|
|
{
|
|
unsigned int node_size;
|
|
|
|
if (!is_bnode_offset_valid(node, off))
|
|
return 0;
|
|
|
|
node_size = node->tree->node_size;
|
|
|
|
if ((off + len) > node_size) {
|
|
int new_len = (int)node_size - off;
|
|
|
|
pr_err("requested length has been corrected: "
|
|
"NODE: id %u, type %#x, height %u, "
|
|
"node_size %u, offset %d, "
|
|
"requested_len %d, corrected_len %d\n",
|
|
node->this, node->type, node->height,
|
|
node->tree->node_size, off, len, new_len);
|
|
|
|
return new_len;
|
|
}
|
|
|
|
return len;
|
|
}
|
|
|
|
/* Copy a specified range of bytes from the raw data of a node */
|
|
void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
|
|
{
|
|
struct page **pagep;
|
|
int l;
|
|
|
|
if (!is_bnode_offset_valid(node, off))
|
|
return;
|
|
|
|
if (len == 0) {
|
|
pr_err("requested zero length: "
|
|
"NODE: id %u, type %#x, height %u, "
|
|
"node_size %u, offset %d, len %d\n",
|
|
node->this, node->type, node->height,
|
|
node->tree->node_size, off, len);
|
|
return;
|
|
}
|
|
|
|
len = check_and_correct_requested_length(node, off, len);
|
|
|
|
off += node->page_offset;
|
|
pagep = node->page + (off >> PAGE_SHIFT);
|
|
off &= ~PAGE_MASK;
|
|
|
|
l = min_t(int, len, PAGE_SIZE - off);
|
|
memcpy_from_page(buf, *pagep, off, l);
|
|
|
|
while ((len -= l) != 0) {
|
|
buf += l;
|
|
l = min_t(int, len, PAGE_SIZE);
|
|
memcpy_from_page(buf, *++pagep, 0, l);
|
|
}
|
|
}
|
|
|
|
u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
|
|
{
|
|
__be16 data;
|
|
/* TODO: optimize later... */
|
|
hfs_bnode_read(node, &data, off, 2);
|
|
return be16_to_cpu(data);
|
|
}
|
|
|
|
u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off)
|
|
{
|
|
u8 data;
|
|
/* TODO: optimize later... */
|
|
hfs_bnode_read(node, &data, off, 1);
|
|
return data;
|
|
}
|
|
|
|
void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
|
|
{
|
|
struct hfs_btree *tree;
|
|
int key_len;
|
|
|
|
tree = node->tree;
|
|
if (node->type == HFS_NODE_LEAF ||
|
|
tree->attributes & HFS_TREE_VARIDXKEYS ||
|
|
node->tree->cnid == HFSPLUS_ATTR_CNID)
|
|
key_len = hfs_bnode_read_u16(node, off) + 2;
|
|
else
|
|
key_len = tree->max_key_len + 2;
|
|
|
|
if (key_len > sizeof(hfsplus_btree_key) || key_len < 1) {
|
|
memset(key, 0, sizeof(hfsplus_btree_key));
|
|
pr_err("hfsplus: Invalid key length: %d\n", key_len);
|
|
return;
|
|
}
|
|
|
|
hfs_bnode_read(node, key, off, key_len);
|
|
}
|
|
|
|
void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)
|
|
{
|
|
struct page **pagep;
|
|
int l;
|
|
|
|
if (!is_bnode_offset_valid(node, off))
|
|
return;
|
|
|
|
if (len == 0) {
|
|
pr_err("requested zero length: "
|
|
"NODE: id %u, type %#x, height %u, "
|
|
"node_size %u, offset %d, len %d\n",
|
|
node->this, node->type, node->height,
|
|
node->tree->node_size, off, len);
|
|
return;
|
|
}
|
|
|
|
len = check_and_correct_requested_length(node, off, len);
|
|
|
|
off += node->page_offset;
|
|
pagep = node->page + (off >> PAGE_SHIFT);
|
|
off &= ~PAGE_MASK;
|
|
|
|
l = min_t(int, len, PAGE_SIZE - off);
|
|
memcpy_to_page(*pagep, off, buf, l);
|
|
set_page_dirty(*pagep);
|
|
|
|
while ((len -= l) != 0) {
|
|
buf += l;
|
|
l = min_t(int, len, PAGE_SIZE);
|
|
memcpy_to_page(*++pagep, 0, buf, l);
|
|
set_page_dirty(*pagep);
|
|
}
|
|
}
|
|
|
|
void hfs_bnode_write_u16(struct hfs_bnode *node, int off, u16 data)
|
|
{
|
|
__be16 v = cpu_to_be16(data);
|
|
/* TODO: optimize later... */
|
|
hfs_bnode_write(node, &v, off, 2);
|
|
}
|
|
|
|
void hfs_bnode_clear(struct hfs_bnode *node, int off, int len)
|
|
{
|
|
struct page **pagep;
|
|
int l;
|
|
|
|
if (!is_bnode_offset_valid(node, off))
|
|
return;
|
|
|
|
if (len == 0) {
|
|
pr_err("requested zero length: "
|
|
"NODE: id %u, type %#x, height %u, "
|
|
"node_size %u, offset %d, len %d\n",
|
|
node->this, node->type, node->height,
|
|
node->tree->node_size, off, len);
|
|
return;
|
|
}
|
|
|
|
len = check_and_correct_requested_length(node, off, len);
|
|
|
|
off += node->page_offset;
|
|
pagep = node->page + (off >> PAGE_SHIFT);
|
|
off &= ~PAGE_MASK;
|
|
|
|
l = min_t(int, len, PAGE_SIZE - off);
|
|
memzero_page(*pagep, off, l);
|
|
set_page_dirty(*pagep);
|
|
|
|
while ((len -= l) != 0) {
|
|
l = min_t(int, len, PAGE_SIZE);
|
|
memzero_page(*++pagep, 0, l);
|
|
set_page_dirty(*pagep);
|
|
}
|
|
}
|
|
|
|
void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,
|
|
struct hfs_bnode *src_node, int src, int len)
|
|
{
|
|
struct page **src_page, **dst_page;
|
|
int l;
|
|
|
|
hfs_dbg(BNODE_MOD, "copybytes: %u,%u,%u\n", dst, src, len);
|
|
if (!len)
|
|
return;
|
|
|
|
len = check_and_correct_requested_length(src_node, src, len);
|
|
len = check_and_correct_requested_length(dst_node, dst, len);
|
|
|
|
src += src_node->page_offset;
|
|
dst += dst_node->page_offset;
|
|
src_page = src_node->page + (src >> PAGE_SHIFT);
|
|
src &= ~PAGE_MASK;
|
|
dst_page = dst_node->page + (dst >> PAGE_SHIFT);
|
|
dst &= ~PAGE_MASK;
|
|
|
|
if (src == dst) {
|
|
l = min_t(int, len, PAGE_SIZE - src);
|
|
memcpy_page(*dst_page, src, *src_page, src, l);
|
|
set_page_dirty(*dst_page);
|
|
|
|
while ((len -= l) != 0) {
|
|
l = min_t(int, len, PAGE_SIZE);
|
|
memcpy_page(*++dst_page, 0, *++src_page, 0, l);
|
|
set_page_dirty(*dst_page);
|
|
}
|
|
} else {
|
|
void *src_ptr, *dst_ptr;
|
|
|
|
do {
|
|
dst_ptr = kmap_local_page(*dst_page) + dst;
|
|
src_ptr = kmap_local_page(*src_page) + src;
|
|
if (PAGE_SIZE - src < PAGE_SIZE - dst) {
|
|
l = PAGE_SIZE - src;
|
|
src = 0;
|
|
dst += l;
|
|
} else {
|
|
l = PAGE_SIZE - dst;
|
|
src += l;
|
|
dst = 0;
|
|
}
|
|
l = min(len, l);
|
|
memcpy(dst_ptr, src_ptr, l);
|
|
kunmap_local(src_ptr);
|
|
set_page_dirty(*dst_page);
|
|
kunmap_local(dst_ptr);
|
|
if (!dst)
|
|
dst_page++;
|
|
else
|
|
src_page++;
|
|
} while ((len -= l));
|
|
}
|
|
}
|
|
|
|
void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)
|
|
{
|
|
struct page **src_page, **dst_page;
|
|
void *src_ptr, *dst_ptr;
|
|
int l;
|
|
|
|
hfs_dbg(BNODE_MOD, "movebytes: %u,%u,%u\n", dst, src, len);
|
|
if (!len)
|
|
return;
|
|
|
|
len = check_and_correct_requested_length(node, src, len);
|
|
len = check_and_correct_requested_length(node, dst, len);
|
|
|
|
src += node->page_offset;
|
|
dst += node->page_offset;
|
|
if (dst > src) {
|
|
src += len - 1;
|
|
src_page = node->page + (src >> PAGE_SHIFT);
|
|
src = (src & ~PAGE_MASK) + 1;
|
|
dst += len - 1;
|
|
dst_page = node->page + (dst >> PAGE_SHIFT);
|
|
dst = (dst & ~PAGE_MASK) + 1;
|
|
|
|
if (src == dst) {
|
|
while (src < len) {
|
|
dst_ptr = kmap_local_page(*dst_page);
|
|
src_ptr = kmap_local_page(*src_page);
|
|
memmove(dst_ptr, src_ptr, src);
|
|
kunmap_local(src_ptr);
|
|
set_page_dirty(*dst_page);
|
|
kunmap_local(dst_ptr);
|
|
len -= src;
|
|
src = PAGE_SIZE;
|
|
src_page--;
|
|
dst_page--;
|
|
}
|
|
src -= len;
|
|
dst_ptr = kmap_local_page(*dst_page);
|
|
src_ptr = kmap_local_page(*src_page);
|
|
memmove(dst_ptr + src, src_ptr + src, len);
|
|
kunmap_local(src_ptr);
|
|
set_page_dirty(*dst_page);
|
|
kunmap_local(dst_ptr);
|
|
} else {
|
|
do {
|
|
dst_ptr = kmap_local_page(*dst_page) + dst;
|
|
src_ptr = kmap_local_page(*src_page) + src;
|
|
if (src < dst) {
|
|
l = src;
|
|
src = PAGE_SIZE;
|
|
dst -= l;
|
|
} else {
|
|
l = dst;
|
|
src -= l;
|
|
dst = PAGE_SIZE;
|
|
}
|
|
l = min(len, l);
|
|
memmove(dst_ptr - l, src_ptr - l, l);
|
|
kunmap_local(src_ptr);
|
|
set_page_dirty(*dst_page);
|
|
kunmap_local(dst_ptr);
|
|
if (dst == PAGE_SIZE)
|
|
dst_page--;
|
|
else
|
|
src_page--;
|
|
} while ((len -= l));
|
|
}
|
|
} else {
|
|
src_page = node->page + (src >> PAGE_SHIFT);
|
|
src &= ~PAGE_MASK;
|
|
dst_page = node->page + (dst >> PAGE_SHIFT);
|
|
dst &= ~PAGE_MASK;
|
|
|
|
if (src == dst) {
|
|
l = min_t(int, len, PAGE_SIZE - src);
|
|
|
|
dst_ptr = kmap_local_page(*dst_page) + src;
|
|
src_ptr = kmap_local_page(*src_page) + src;
|
|
memmove(dst_ptr, src_ptr, l);
|
|
kunmap_local(src_ptr);
|
|
set_page_dirty(*dst_page);
|
|
kunmap_local(dst_ptr);
|
|
|
|
while ((len -= l) != 0) {
|
|
l = min_t(int, len, PAGE_SIZE);
|
|
dst_ptr = kmap_local_page(*++dst_page);
|
|
src_ptr = kmap_local_page(*++src_page);
|
|
memmove(dst_ptr, src_ptr, l);
|
|
kunmap_local(src_ptr);
|
|
set_page_dirty(*dst_page);
|
|
kunmap_local(dst_ptr);
|
|
}
|
|
} else {
|
|
do {
|
|
dst_ptr = kmap_local_page(*dst_page) + dst;
|
|
src_ptr = kmap_local_page(*src_page) + src;
|
|
if (PAGE_SIZE - src <
|
|
PAGE_SIZE - dst) {
|
|
l = PAGE_SIZE - src;
|
|
src = 0;
|
|
dst += l;
|
|
} else {
|
|
l = PAGE_SIZE - dst;
|
|
src += l;
|
|
dst = 0;
|
|
}
|
|
l = min(len, l);
|
|
memmove(dst_ptr, src_ptr, l);
|
|
kunmap_local(src_ptr);
|
|
set_page_dirty(*dst_page);
|
|
kunmap_local(dst_ptr);
|
|
if (!dst)
|
|
dst_page++;
|
|
else
|
|
src_page++;
|
|
} while ((len -= l));
|
|
}
|
|
}
|
|
}
|
|
|
|
void hfs_bnode_dump(struct hfs_bnode *node)
|
|
{
|
|
struct hfs_bnode_desc desc;
|
|
__be32 cnid;
|
|
int i, off, key_off;
|
|
|
|
hfs_dbg(BNODE_MOD, "bnode: %d\n", node->this);
|
|
hfs_bnode_read(node, &desc, 0, sizeof(desc));
|
|
hfs_dbg(BNODE_MOD, "%d, %d, %d, %d, %d\n",
|
|
be32_to_cpu(desc.next), be32_to_cpu(desc.prev),
|
|
desc.type, desc.height, be16_to_cpu(desc.num_recs));
|
|
|
|
off = node->tree->node_size - 2;
|
|
for (i = be16_to_cpu(desc.num_recs); i >= 0; off -= 2, i--) {
|
|
key_off = hfs_bnode_read_u16(node, off);
|
|
hfs_dbg(BNODE_MOD, " %d", key_off);
|
|
if (i && node->type == HFS_NODE_INDEX) {
|
|
int tmp;
|
|
|
|
if (node->tree->attributes & HFS_TREE_VARIDXKEYS ||
|
|
node->tree->cnid == HFSPLUS_ATTR_CNID)
|
|
tmp = hfs_bnode_read_u16(node, key_off) + 2;
|
|
else
|
|
tmp = node->tree->max_key_len + 2;
|
|
hfs_dbg_cont(BNODE_MOD, " (%d", tmp);
|
|
hfs_bnode_read(node, &cnid, key_off + tmp, 4);
|
|
hfs_dbg_cont(BNODE_MOD, ",%d)", be32_to_cpu(cnid));
|
|
} else if (i && node->type == HFS_NODE_LEAF) {
|
|
int tmp;
|
|
|
|
tmp = hfs_bnode_read_u16(node, key_off);
|
|
hfs_dbg_cont(BNODE_MOD, " (%d)", tmp);
|
|
}
|
|
}
|
|
hfs_dbg_cont(BNODE_MOD, "\n");
|
|
}
|
|
|
|
void hfs_bnode_unlink(struct hfs_bnode *node)
|
|
{
|
|
struct hfs_btree *tree;
|
|
struct hfs_bnode *tmp;
|
|
__be32 cnid;
|
|
|
|
tree = node->tree;
|
|
if (node->prev) {
|
|
tmp = hfs_bnode_find(tree, node->prev);
|
|
if (IS_ERR(tmp))
|
|
return;
|
|
tmp->next = node->next;
|
|
cnid = cpu_to_be32(tmp->next);
|
|
hfs_bnode_write(tmp, &cnid,
|
|
offsetof(struct hfs_bnode_desc, next), 4);
|
|
hfs_bnode_put(tmp);
|
|
} else if (node->type == HFS_NODE_LEAF)
|
|
tree->leaf_head = node->next;
|
|
|
|
if (node->next) {
|
|
tmp = hfs_bnode_find(tree, node->next);
|
|
if (IS_ERR(tmp))
|
|
return;
|
|
tmp->prev = node->prev;
|
|
cnid = cpu_to_be32(tmp->prev);
|
|
hfs_bnode_write(tmp, &cnid,
|
|
offsetof(struct hfs_bnode_desc, prev), 4);
|
|
hfs_bnode_put(tmp);
|
|
} else if (node->type == HFS_NODE_LEAF)
|
|
tree->leaf_tail = node->prev;
|
|
|
|
/* move down? */
|
|
if (!node->prev && !node->next)
|
|
hfs_dbg(BNODE_MOD, "hfs_btree_del_level\n");
|
|
if (!node->parent) {
|
|
tree->root = 0;
|
|
tree->depth = 0;
|
|
}
|
|
set_bit(HFS_BNODE_DELETED, &node->flags);
|
|
}
|
|
|
|
static inline int hfs_bnode_hash(u32 num)
|
|
{
|
|
num = (num >> 16) + num;
|
|
num += num >> 8;
|
|
return num & (NODE_HASH_SIZE - 1);
|
|
}
|
|
|
|
struct hfs_bnode *hfs_bnode_findhash(struct hfs_btree *tree, u32 cnid)
|
|
{
|
|
struct hfs_bnode *node;
|
|
|
|
if (cnid >= tree->node_count) {
|
|
pr_err("request for non-existent node %d in B*Tree\n",
|
|
cnid);
|
|
return NULL;
|
|
}
|
|
|
|
for (node = tree->node_hash[hfs_bnode_hash(cnid)];
|
|
node; node = node->next_hash)
|
|
if (node->this == cnid)
|
|
return node;
|
|
return NULL;
|
|
}
|
|
|
|
static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid)
|
|
{
|
|
struct hfs_bnode *node, *node2;
|
|
struct address_space *mapping;
|
|
struct page *page;
|
|
int size, block, i, hash;
|
|
loff_t off;
|
|
|
|
if (cnid >= tree->node_count) {
|
|
pr_err("request for non-existent node %d in B*Tree\n",
|
|
cnid);
|
|
return NULL;
|
|
}
|
|
|
|
size = sizeof(struct hfs_bnode) + tree->pages_per_bnode *
|
|
sizeof(struct page *);
|
|
node = kzalloc(size, GFP_KERNEL);
|
|
if (!node)
|
|
return NULL;
|
|
node->tree = tree;
|
|
node->this = cnid;
|
|
set_bit(HFS_BNODE_NEW, &node->flags);
|
|
atomic_set(&node->refcnt, 1);
|
|
hfs_dbg(BNODE_REFS, "new_node(%d:%d): 1\n",
|
|
node->tree->cnid, node->this);
|
|
init_waitqueue_head(&node->lock_wq);
|
|
spin_lock(&tree->hash_lock);
|
|
node2 = hfs_bnode_findhash(tree, cnid);
|
|
if (!node2) {
|
|
hash = hfs_bnode_hash(cnid);
|
|
node->next_hash = tree->node_hash[hash];
|
|
tree->node_hash[hash] = node;
|
|
tree->node_hash_cnt++;
|
|
} else {
|
|
spin_unlock(&tree->hash_lock);
|
|
kfree(node);
|
|
wait_event(node2->lock_wq,
|
|
!test_bit(HFS_BNODE_NEW, &node2->flags));
|
|
return node2;
|
|
}
|
|
spin_unlock(&tree->hash_lock);
|
|
|
|
mapping = tree->inode->i_mapping;
|
|
off = (loff_t)cnid << tree->node_size_shift;
|
|
block = off >> PAGE_SHIFT;
|
|
node->page_offset = off & ~PAGE_MASK;
|
|
for (i = 0; i < tree->pages_per_bnode; block++, i++) {
|
|
page = read_mapping_page(mapping, block, NULL);
|
|
if (IS_ERR(page))
|
|
goto fail;
|
|
node->page[i] = page;
|
|
}
|
|
|
|
return node;
|
|
fail:
|
|
set_bit(HFS_BNODE_ERROR, &node->flags);
|
|
return node;
|
|
}
|
|
|
|
void hfs_bnode_unhash(struct hfs_bnode *node)
|
|
{
|
|
struct hfs_bnode **p;
|
|
|
|
hfs_dbg(BNODE_REFS, "remove_node(%d:%d): %d\n",
|
|
node->tree->cnid, node->this, atomic_read(&node->refcnt));
|
|
for (p = &node->tree->node_hash[hfs_bnode_hash(node->this)];
|
|
*p && *p != node; p = &(*p)->next_hash)
|
|
;
|
|
BUG_ON(!*p);
|
|
*p = node->next_hash;
|
|
node->tree->node_hash_cnt--;
|
|
}
|
|
|
|
/* Load a particular node out of a tree */
|
|
struct hfs_bnode *hfs_bnode_find(struct hfs_btree *tree, u32 num)
|
|
{
|
|
struct hfs_bnode *node;
|
|
struct hfs_bnode_desc *desc;
|
|
int i, rec_off, off, next_off;
|
|
int entry_size, key_size;
|
|
|
|
spin_lock(&tree->hash_lock);
|
|
node = hfs_bnode_findhash(tree, num);
|
|
if (node) {
|
|
hfs_bnode_get(node);
|
|
spin_unlock(&tree->hash_lock);
|
|
wait_event(node->lock_wq,
|
|
!test_bit(HFS_BNODE_NEW, &node->flags));
|
|
if (test_bit(HFS_BNODE_ERROR, &node->flags))
|
|
goto node_error;
|
|
return node;
|
|
}
|
|
spin_unlock(&tree->hash_lock);
|
|
node = __hfs_bnode_create(tree, num);
|
|
if (!node)
|
|
return ERR_PTR(-ENOMEM);
|
|
if (test_bit(HFS_BNODE_ERROR, &node->flags))
|
|
goto node_error;
|
|
if (!test_bit(HFS_BNODE_NEW, &node->flags))
|
|
return node;
|
|
|
|
desc = (struct hfs_bnode_desc *)(kmap_local_page(node->page[0]) +
|
|
node->page_offset);
|
|
node->prev = be32_to_cpu(desc->prev);
|
|
node->next = be32_to_cpu(desc->next);
|
|
node->num_recs = be16_to_cpu(desc->num_recs);
|
|
node->type = desc->type;
|
|
node->height = desc->height;
|
|
kunmap_local(desc);
|
|
|
|
switch (node->type) {
|
|
case HFS_NODE_HEADER:
|
|
case HFS_NODE_MAP:
|
|
if (node->height != 0)
|
|
goto node_error;
|
|
break;
|
|
case HFS_NODE_LEAF:
|
|
if (node->height != 1)
|
|
goto node_error;
|
|
break;
|
|
case HFS_NODE_INDEX:
|
|
if (node->height <= 1 || node->height > tree->depth)
|
|
goto node_error;
|
|
break;
|
|
default:
|
|
goto node_error;
|
|
}
|
|
|
|
rec_off = tree->node_size - 2;
|
|
off = hfs_bnode_read_u16(node, rec_off);
|
|
if (off != sizeof(struct hfs_bnode_desc))
|
|
goto node_error;
|
|
for (i = 1; i <= node->num_recs; off = next_off, i++) {
|
|
rec_off -= 2;
|
|
next_off = hfs_bnode_read_u16(node, rec_off);
|
|
if (next_off <= off ||
|
|
next_off > tree->node_size ||
|
|
next_off & 1)
|
|
goto node_error;
|
|
entry_size = next_off - off;
|
|
if (node->type != HFS_NODE_INDEX &&
|
|
node->type != HFS_NODE_LEAF)
|
|
continue;
|
|
key_size = hfs_bnode_read_u16(node, off) + 2;
|
|
if (key_size >= entry_size || key_size & 1)
|
|
goto node_error;
|
|
}
|
|
clear_bit(HFS_BNODE_NEW, &node->flags);
|
|
wake_up(&node->lock_wq);
|
|
return node;
|
|
|
|
node_error:
|
|
set_bit(HFS_BNODE_ERROR, &node->flags);
|
|
clear_bit(HFS_BNODE_NEW, &node->flags);
|
|
wake_up(&node->lock_wq);
|
|
hfs_bnode_put(node);
|
|
return ERR_PTR(-EIO);
|
|
}
|
|
|
|
void hfs_bnode_free(struct hfs_bnode *node)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < node->tree->pages_per_bnode; i++)
|
|
if (node->page[i])
|
|
put_page(node->page[i]);
|
|
kfree(node);
|
|
}
|
|
|
|
struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
|
|
{
|
|
struct hfs_bnode *node;
|
|
struct page **pagep;
|
|
int i;
|
|
|
|
spin_lock(&tree->hash_lock);
|
|
node = hfs_bnode_findhash(tree, num);
|
|
spin_unlock(&tree->hash_lock);
|
|
if (node) {
|
|
pr_crit("new node %u already hashed?\n", num);
|
|
WARN_ON(1);
|
|
return node;
|
|
}
|
|
node = __hfs_bnode_create(tree, num);
|
|
if (!node)
|
|
return ERR_PTR(-ENOMEM);
|
|
if (test_bit(HFS_BNODE_ERROR, &node->flags)) {
|
|
hfs_bnode_put(node);
|
|
return ERR_PTR(-EIO);
|
|
}
|
|
|
|
pagep = node->page;
|
|
memzero_page(*pagep, node->page_offset,
|
|
min_t(int, PAGE_SIZE, tree->node_size));
|
|
set_page_dirty(*pagep);
|
|
for (i = 1; i < tree->pages_per_bnode; i++) {
|
|
memzero_page(*++pagep, 0, PAGE_SIZE);
|
|
set_page_dirty(*pagep);
|
|
}
|
|
clear_bit(HFS_BNODE_NEW, &node->flags);
|
|
wake_up(&node->lock_wq);
|
|
|
|
return node;
|
|
}
|
|
|
|
void hfs_bnode_get(struct hfs_bnode *node)
|
|
{
|
|
if (node) {
|
|
atomic_inc(&node->refcnt);
|
|
hfs_dbg(BNODE_REFS, "get_node(%d:%d): %d\n",
|
|
node->tree->cnid, node->this,
|
|
atomic_read(&node->refcnt));
|
|
}
|
|
}
|
|
|
|
/* Dispose of resources used by a node */
|
|
void hfs_bnode_put(struct hfs_bnode *node)
|
|
{
|
|
if (node) {
|
|
struct hfs_btree *tree = node->tree;
|
|
int i;
|
|
|
|
hfs_dbg(BNODE_REFS, "put_node(%d:%d): %d\n",
|
|
node->tree->cnid, node->this,
|
|
atomic_read(&node->refcnt));
|
|
BUG_ON(!atomic_read(&node->refcnt));
|
|
if (!atomic_dec_and_lock(&node->refcnt, &tree->hash_lock))
|
|
return;
|
|
for (i = 0; i < tree->pages_per_bnode; i++) {
|
|
if (!node->page[i])
|
|
continue;
|
|
mark_page_accessed(node->page[i]);
|
|
}
|
|
|
|
if (test_bit(HFS_BNODE_DELETED, &node->flags)) {
|
|
hfs_bnode_unhash(node);
|
|
spin_unlock(&tree->hash_lock);
|
|
if (hfs_bnode_need_zeroout(tree))
|
|
hfs_bnode_clear(node, 0, tree->node_size);
|
|
hfs_bmap_free(node);
|
|
hfs_bnode_free(node);
|
|
return;
|
|
}
|
|
spin_unlock(&tree->hash_lock);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Unused nodes have to be zeroed if this is the catalog tree and
|
|
* a corresponding flag in the volume header is set.
|
|
*/
|
|
bool hfs_bnode_need_zeroout(struct hfs_btree *tree)
|
|
{
|
|
struct super_block *sb = tree->inode->i_sb;
|
|
struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
|
|
const u32 volume_attr = be32_to_cpu(sbi->s_vhdr->attributes);
|
|
|
|
return tree->cnid == HFSPLUS_CAT_CNID &&
|
|
volume_attr & HFSPLUS_VOL_UNUSED_NODE_FIX;
|
|
}
|