renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-16 09:13:55 +08:00
Code

hfsplus: fix longname handling

Browse Source 
Longname is not correctly handled by hfsplus driver.  If an attempt to
create a longname(>255) file/directory is made, it succeeds by creating a
file/directory with HFSPLUS_MAX_STRLEN and incorrect catalog key.  Thus
leaving the volume in an inconsistent state.  This patch fixes this issue.

Although lookup is always called first to create a negative entry, so just
doing a check in lookup would probably fix this issue.  I choose to
propagate error to other iops as well.

Please NOTE: I have factored out hfsplus_cat_build_key_with_cnid from
hfsplus_cat_build_key, to avoid unncessary branching.

Thanks a lot.

  TEST:
  ------
  dir="TEST_DIR"
  cdir=`pwd`
  name255="_123456789_123456789_123456789_123456789_123456789_123456789\
  _123456789_123456789_123456789_123456789_123456789_123456789_123456789\
  _123456789_123456789_123456789_123456789_123456789_123456789_123456789\
  _123456789_123456789_123456789_123456789_123456789_1234"
  name256="${name255}5"

  mkdir $dir
  cd $dir
  touch $name255
  rm -f $name255
  touch $name256
  ls -la
  cd $cdir
  rm -rf $dir

  RESULT:
  -------
  [sougata@ultrabook tmp]$ cdir=`pwd`
  [sougata@ultrabook tmp]$
  name255="_123456789_123456789_123456789_123456789_123456789_123456789\
   > _123456789_123456789_123456789_123456789_123456789_123456789_123456789\
   > _123456789_123456789_123456789_123456789_123456789_123456789_123456789\
   > _123456789_123456789_123456789_123456789_123456789_1234"
  [sougata@ultrabook tmp]$ name256="${name255}5"
  [sougata@ultrabook tmp]$
  [sougata@ultrabook tmp]$ mkdir $dir
  [sougata@ultrabook tmp]$ cd $dir
  [sougata@ultrabook TEST_DIR]$ touch $name255
  [sougata@ultrabook TEST_DIR]$ rm -f $name255
  [sougata@ultrabook TEST_DIR]$ touch $name256
  [sougata@ultrabook TEST_DIR]$ ls -la
  ls: cannot access
  _123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_1234:
  No such file or directory
  total 0
  drwxrwxr-x 1 sougata sougata 3 Feb 20 19:56 .
  drwxrwxrwx 1 root    root    6 Feb 20 19:56 ..
  -????????? ? ?       ?       ?            ?
  _123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_1234
  [sougata@ultrabook TEST_DIR]$ cd $cdir
  [sougata@ultrabook tmp]$ rm -rf $dir
  rm: cannot remove `TEST_DIR': Directory not empty

-ENAMETOOLONG returned from hfsplus_asc2uni was not propaged to iops.
This allowed hfsplus to create files/directories with HFSPLUS_MAX_STRLEN
and incorrect keys, leaving the FS in an inconsistent state.  This patch
fixes this issue.

Signed-off-by: Sougata Santra <sougata@tuxera.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Sougata Santra 2014-12-18 16:17:12 -08:00 committed by Linus Torvalds
parent 859f7ef142
commit 89ac9b4d3d
4 changed files with 79 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

89
fs/hfsplus/catalog.c
View File

@ -38,21 +38,30 @@ int hfsplus_cat_bin_cmp_key(const hfsplus_btree_key *k1,
return hfsplus_strcmp(&k1->cat.name, &k2->cat.name); return hfsplus_strcmp(&k1->cat.name, &k2->cat.name);
} }
void hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key, /* Generates key for catalog file/folders record. */
u32 parent, struct qstr *str) int hfsplus_cat_build_key(struct super_block *sb,
hfsplus_btree_key *key, u32 parent, struct qstr *str)
{ {
int len; int len, err;
key->cat.parent = cpu_to_be32(parent); key->cat.parent = cpu_to_be32(parent);
if (str) { err = hfsplus_asc2uni(sb, &key->cat.name, HFSPLUS_MAX_STRLEN,
hfsplus_asc2uni(sb, &key->cat.name, HFSPLUS_MAX_STRLEN, str->name, str->len);
str->name, str->len); if (unlikely(err < 0))
len = be16_to_cpu(key->cat.name.length); return err;
} else {
key->cat.name.length = 0; len = be16_to_cpu(key->cat.name.length);
len = 0;
}
key->key_len = cpu_to_be16(6 + 2 * len); key->key_len = cpu_to_be16(6 + 2 * len);
return 0;
}
/* Generates key for catalog thread record. */
void hfsplus_cat_build_key_with_cnid(struct super_block *sb,
hfsplus_btree_key *key, u32 parent)
{
key->cat.parent = cpu_to_be32(parent);
key->cat.name.length = 0;
key->key_len = cpu_to_be16(6);
} }
static void hfsplus_cat_build_key_uni(hfsplus_btree_key *key, u32 parent, static void hfsplus_cat_build_key_uni(hfsplus_btree_key *key, u32 parent,
@ -167,11 +176,16 @@ static int hfsplus_fill_cat_thread(struct super_block *sb,
hfsplus_cat_entry *entry, int type, hfsplus_cat_entry *entry, int type,
u32 parentid, struct qstr *str) u32 parentid, struct qstr *str)
{ {
int err;
entry->type = cpu_to_be16(type); entry->type = cpu_to_be16(type);
entry->thread.reserved = 0; entry->thread.reserved = 0;
entry->thread.parentID = cpu_to_be32(parentid); entry->thread.parentID = cpu_to_be32(parentid);
hfsplus_asc2uni(sb, &entry->thread.nodeName, HFSPLUS_MAX_STRLEN, err = hfsplus_asc2uni(sb, &entry->thread.nodeName, HFSPLUS_MAX_STRLEN,
str->name, str->len); str->name, str->len);
if (unlikely(err < 0))
return err;
return 10 + be16_to_cpu(entry->thread.nodeName.length) * 2; return 10 + be16_to_cpu(entry->thread.nodeName.length) * 2;
} }
@ -183,7 +197,7 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
int err; int err;
u16 type; u16 type;
hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL); hfsplus_cat_build_key_with_cnid(sb, fd->search_key, cnid);
err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry)); err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
if (err) if (err)
return err; return err;
@ -250,11 +264,16 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
if (err) if (err)
return err; return err;
hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL); hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
entry_size = hfsplus_fill_cat_thread(sb, &entry, entry_size = hfsplus_fill_cat_thread(sb, &entry,
S_ISDIR(inode->i_mode) ? S_ISDIR(inode->i_mode) ?
HFSPLUS_FOLDER_THREAD : HFSPLUS_FILE_THREAD, HFSPLUS_FOLDER_THREAD : HFSPLUS_FILE_THREAD,
dir->i_ino, str); dir->i_ino, str);
if (unlikely(entry_size < 0)) {
err = entry_size;
goto err2;
}
err = hfs_brec_find(&fd, hfs_find_rec_by_key); err = hfs_brec_find(&fd, hfs_find_rec_by_key);
if (err != -ENOENT) { if (err != -ENOENT) {
if (!err) if (!err)
@ -265,7 +284,10 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
if (err) if (err)
goto err2; goto err2;
hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str); err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
if (unlikely(err))
goto err1;
entry_size = hfsplus_cat_build_record(&entry, cnid, inode); entry_size = hfsplus_cat_build_record(&entry, cnid, inode);
err = hfs_brec_find(&fd, hfs_find_rec_by_key); err = hfs_brec_find(&fd, hfs_find_rec_by_key);
if (err != -ENOENT) { if (err != -ENOENT) {
@ -288,7 +310,7 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
return 0; return 0;
err1: err1:
hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL); hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
if (!hfs_brec_find(&fd, hfs_find_rec_by_key)) if (!hfs_brec_find(&fd, hfs_find_rec_by_key))
hfs_brec_remove(&fd); hfs_brec_remove(&fd);
err2: err2:
@ -313,7 +335,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
if (!str) { if (!str) {
int len; int len;
hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL); hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
err = hfs_brec_find(&fd, hfs_find_rec_by_key); err = hfs_brec_find(&fd, hfs_find_rec_by_key);
if (err) if (err)
goto out; goto out;
@ -329,7 +351,9 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
off + 2, len); off + 2, len);
fd.search_key->key_len = cpu_to_be16(6 + len); fd.search_key->key_len = cpu_to_be16(6 + len);
} else } else
hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str); err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
if (unlikely(err))
goto out;
err = hfs_brec_find(&fd, hfs_find_rec_by_key); err = hfs_brec_find(&fd, hfs_find_rec_by_key);
if (err) if (err)
@ -360,7 +384,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
if (err) if (err)
goto out; goto out;
hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL); hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
err = hfs_brec_find(&fd, hfs_find_rec_by_key); err = hfs_brec_find(&fd, hfs_find_rec_by_key);
if (err) if (err)
goto out; goto out;
@ -405,7 +429,11 @@ int hfsplus_rename_cat(u32 cnid,
dst_fd = src_fd; dst_fd = src_fd;
/* find the old dir entry and read the data */ /* find the old dir entry and read the data */
hfsplus_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name); err = hfsplus_cat_build_key(sb, src_fd.search_key,
src_dir->i_ino, src_name);
if (unlikely(err))
goto out;
err = hfs_brec_find(&src_fd, hfs_find_rec_by_key); err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
if (err) if (err)
goto out; goto out;
@ -419,7 +447,11 @@ int hfsplus_rename_cat(u32 cnid,
type = be16_to_cpu(entry.type); type = be16_to_cpu(entry.type);
/* create new dir entry with the data from the old entry */ /* create new dir entry with the data from the old entry */
hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name); err = hfsplus_cat_build_key(sb, dst_fd.search_key,
dst_dir->i_ino, dst_name);
if (unlikely(err))
goto out;
err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key); err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key);
if (err != -ENOENT) { if (err != -ENOENT) {
if (!err) if (!err)
@ -436,7 +468,11 @@ int hfsplus_rename_cat(u32 cnid,
dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC; dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC;
/* finally remove the old entry */ /* finally remove the old entry */
hfsplus_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name); err = hfsplus_cat_build_key(sb, src_fd.search_key,
src_dir->i_ino, src_name);
if (unlikely(err))
goto out;
err = hfs_brec_find(&src_fd, hfs_find_rec_by_key); err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
if (err) if (err)
goto out; goto out;
@ -449,7 +485,7 @@ int hfsplus_rename_cat(u32 cnid,
src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC; src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC;
/* remove old thread entry */ /* remove old thread entry */
hfsplus_cat_build_key(sb, src_fd.search_key, cnid, NULL); hfsplus_cat_build_key_with_cnid(sb, src_fd.search_key, cnid);
err = hfs_brec_find(&src_fd, hfs_find_rec_by_key); err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
if (err) if (err)
goto out; goto out;
@ -459,9 +495,14 @@ int hfsplus_rename_cat(u32 cnid,
goto out; goto out;
/* create new thread entry */ /* create new thread entry */
hfsplus_cat_build_key(sb, dst_fd.search_key, cnid, NULL); hfsplus_cat_build_key_with_cnid(sb, dst_fd.search_key, cnid);
entry_size = hfsplus_fill_cat_thread(sb, &entry, type, entry_size = hfsplus_fill_cat_thread(sb, &entry, type,
dst_dir->i_ino, dst_name); dst_dir->i_ino, dst_name);
if (unlikely(entry_size < 0)) {
err = entry_size;
goto out;
}
err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key); err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key);
if (err != -ENOENT) { if (err != -ENOENT) {
if (!err) if (!err)

11
fs/hfsplus/dir.c
View File

@ -44,7 +44,10 @@ static struct dentry *hfsplus_lookup(struct inode *dir, struct dentry *dentry,
err = hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd); err = hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
if (err) if (err)
return ERR_PTR(err); return ERR_PTR(err);
hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, &dentry->d_name); err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino,
&dentry->d_name);
if (unlikely(err < 0))
goto fail;
again: again:
err = hfs_brec_read(&fd, &entry, sizeof(entry)); err = hfs_brec_read(&fd, &entry, sizeof(entry));
if (err) { if (err) {
@ -97,9 +100,11 @@ again:
be32_to_cpu(entry.file.permissions.dev); be32_to_cpu(entry.file.permissions.dev);
str.len = sprintf(name, "iNode%d", linkid); str.len = sprintf(name, "iNode%d", linkid);
str.name = name; str.name = name;
hfsplus_cat_build_key(sb, fd.search_key, err = hfsplus_cat_build_key(sb, fd.search_key,
HFSPLUS_SB(sb)->hidden_dir->i_ino, HFSPLUS_SB(sb)->hidden_dir->i_ino,
&str); &str);
if (unlikely(err < 0))
goto fail;
goto again; goto again;
} }
} else if (!dentry->d_fsdata) } else if (!dentry->d_fsdata)
@ -145,7 +150,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
err = -ENOMEM; err = -ENOMEM;
goto out; goto out;
} }
hfsplus_cat_build_key(sb, fd.search_key, inode->i_ino, NULL); hfsplus_cat_build_key_with_cnid(sb, fd.search_key, inode->i_ino);
err = hfs_brec_find(&fd, hfs_find_rec_by_key); err = hfs_brec_find(&fd, hfs_find_rec_by_key);
if (err) if (err)
goto out; goto out;

4
fs/hfsplus/hfsplus_fs.h
View File

@ -443,8 +443,10 @@ int hfsplus_cat_case_cmp_key(const hfsplus_btree_key *k1,
const hfsplus_btree_key *k2); const hfsplus_btree_key *k2);
int hfsplus_cat_bin_cmp_key(const hfsplus_btree_key *k1, int hfsplus_cat_bin_cmp_key(const hfsplus_btree_key *k1,
const hfsplus_btree_key *k2); const hfsplus_btree_key *k2);
void hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key, int hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key,
u32 parent, struct qstr *str); u32 parent, struct qstr *str);
void hfsplus_cat_build_key_with_cnid(struct super_block *sb,
hfsplus_btree_key *key, u32 parent);
void hfsplus_cat_set_perms(struct inode *inode, struct hfsplus_perm *perms); void hfsplus_cat_set_perms(struct inode *inode, struct hfsplus_perm *perms);
int hfsplus_find_cat(struct super_block *sb, u32 cnid, int hfsplus_find_cat(struct super_block *sb, u32 cnid,
struct hfs_find_data *fd); struct hfs_find_data *fd);

4
fs/hfsplus/super.c
View File

@ -515,7 +515,9 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
err = hfs_find_init(sbi->cat_tree, &fd); err = hfs_find_init(sbi->cat_tree, &fd);
if (err) if (err)
goto out_put_root; goto out_put_root;
hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str); err = hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str);
if (unlikely(err < 0))
goto out_put_root;
if (!hfs_brec_read(&fd, &entry, sizeof(entry))) { if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
hfs_find_exit(&fd); hfs_find_exit(&fd);
if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))