Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ext4: Avoid rec_len overflow with 64KB block size

Browse source 
With 64KB blocksize, a directory entry can have size 64KB which does not fit
into 16 bits we have for entry lenght. So we store 0xffff instead and convert
value when read from / written to disk. The patch also converts some places
to use ext4_next_entry() when we are changing them anyway.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Mingming Cao <cmm@us.ibm.com>
This commit is contained in:
Jan Kara 2008-01-28 23:58:27 -05:00 committed by Theodore Ts'o
parent afc7cbca5b
commit a72d7f834e
3 changed files with 63 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
fs/ext4/dir.c
View file

@ -67,7 +67,7 @@ int ext4_check_dir_entry (const char * function, struct inode * dir,
unsigned long offset) unsigned long offset)
{ {
const char * error_msg = NULL; const char * error_msg = NULL;
const int rlen = le16_to_cpu(de->rec_len); const int rlen = ext4_rec_len_from_disk(de->rec_len);
if (rlen < EXT4_DIR_REC_LEN(1)) if (rlen < EXT4_DIR_REC_LEN(1))
error_msg = "rec_len is smaller than minimal"; error_msg = "rec_len is smaller than minimal";
@ -172,10 +172,10 @@ static int ext4_readdir(struct file * filp,
* least that it is non-zero. A * least that it is non-zero. A
* failure will be detected in the * failure will be detected in the
* dirent test below. */ * dirent test below. */
if (le16_to_cpu(de->rec_len) < if (ext4_rec_len_from_disk(de->rec_len)
EXT4_DIR_REC_LEN(1)) < EXT4_DIR_REC_LEN(1))
break; break;
i += le16_to_cpu(de->rec_len); i += ext4_rec_len_from_disk(de->rec_len);
} }
offset = i; offset = i;
filp->f_pos = (filp->f_pos & ~(sb->s_blocksize - 1)) filp->f_pos = (filp->f_pos & ~(sb->s_blocksize - 1))
@ -197,7 +197,7 @@ static int ext4_readdir(struct file * filp,
ret = stored; ret = stored;
goto out; goto out;
} }
offset += le16_to_cpu(de->rec_len); offset += ext4_rec_len_from_disk(de->rec_len);
if (le32_to_cpu(de->inode)) { if (le32_to_cpu(de->inode)) {
/* We might block in the next section /* We might block in the next section
* if the data destination is * if the data destination is
@ -219,7 +219,7 @@ static int ext4_readdir(struct file * filp,
goto revalidate; goto revalidate;
stored ++; stored ++;
} }
filp->f_pos += le16_to_cpu(de->rec_len); filp->f_pos += ext4_rec_len_from_disk(de->rec_len);
} }
offset = 0; offset = 0;
brelse (bh); brelse (bh);

77
fs/ext4/namei.c
View file

@ -280,7 +280,7 @@ static struct stats dx_show_leaf(struct dx_hash_info *hinfo, struct ext4_dir_ent
space += EXT4_DIR_REC_LEN(de->name_len); space += EXT4_DIR_REC_LEN(de->name_len);
names++; names++;
} }
de = (struct ext4_dir_entry_2 *) ((char *) de + le16_to_cpu(de->rec_len)); de = ext4_next_entry(de);
} }
printk("(%i)\n", names); printk("(%i)\n", names);
return (struct stats) { names, space, 1 }; return (struct stats) { names, space, 1 };
@ -551,7 +551,8 @@ static int ext4_htree_next_block(struct inode *dir, __u32 hash,
*/ */
static inline struct ext4_dir_entry_2 *ext4_next_entry(struct ext4_dir_entry_2 *p) static inline struct ext4_dir_entry_2 *ext4_next_entry(struct ext4_dir_entry_2 *p)
{ {
return (struct ext4_dir_entry_2 *)((char*)p + le16_to_cpu(p->rec_len)); return (struct ext4_dir_entry_2 *)((char *)p +
ext4_rec_len_from_disk(p->rec_len));
} }
/* /*
@ -720,7 +721,7 @@ static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
cond_resched(); cond_resched();
} }
/* XXX: do we need to check rec_len == 0 case? -Chris */ /* XXX: do we need to check rec_len == 0 case? -Chris */
de = (struct ext4_dir_entry_2 *) ((char *) de + le16_to_cpu(de->rec_len)); de = ext4_next_entry(de);
} }
return count; return count;
} }
@ -820,7 +821,7 @@ static inline int search_dirblock(struct buffer_head * bh,
return 1; return 1;
} }
/* prevent looping on a bad block */ /* prevent looping on a bad block */
de_len = le16_to_cpu(de->rec_len); de_len = ext4_rec_len_from_disk(de->rec_len);
if (de_len <= 0) if (de_len <= 0)
return -1; return -1;
offset += de_len; offset += de_len;
@ -1128,7 +1129,7 @@ dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
rec_len = EXT4_DIR_REC_LEN(de->name_len); rec_len = EXT4_DIR_REC_LEN(de->name_len);
memcpy (to, de, rec_len); memcpy (to, de, rec_len);
((struct ext4_dir_entry_2 *) to)->rec_len = ((struct ext4_dir_entry_2 *) to)->rec_len =
cpu_to_le16(rec_len); ext4_rec_len_to_disk(rec_len);
de->inode = 0; de->inode = 0;
map++; map++;
to += rec_len; to += rec_len;
@ -1147,13 +1148,12 @@ static struct ext4_dir_entry_2* dx_pack_dirents(char *base, int size)
prev = to = de; prev = to = de;
while ((char*)de < base + size) { while ((char*)de < base + size) {
next = (struct ext4_dir_entry_2 *) ((char *) de + next = ext4_next_entry(de);
le16_to_cpu(de->rec_len));
if (de->inode && de->name_len) { if (de->inode && de->name_len) {
rec_len = EXT4_DIR_REC_LEN(de->name_len); rec_len = EXT4_DIR_REC_LEN(de->name_len);
if (de > to) if (de > to)
memmove(to, de, rec_len); memmove(to, de, rec_len);
to->rec_len = cpu_to_le16(rec_len); to->rec_len = ext4_rec_len_to_disk(rec_len);
prev = to; prev = to;
to = (struct ext4_dir_entry_2 *) (((char *) to) + rec_len); to = (struct ext4_dir_entry_2 *) (((char *) to) + rec_len);
} }
@ -1227,8 +1227,8 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
/* Fancy dance to stay within two buffers */ /* Fancy dance to stay within two buffers */
de2 = dx_move_dirents(data1, data2, map + split, count - split); de2 = dx_move_dirents(data1, data2, map + split, count - split);
de = dx_pack_dirents(data1,blocksize); de = dx_pack_dirents(data1,blocksize);
de->rec_len = cpu_to_le16(data1 + blocksize - (char *) de); de->rec_len = ext4_rec_len_to_disk(data1 + blocksize - (char *) de);
de2->rec_len = cpu_to_le16(data2 + blocksize - (char *) de2); de2->rec_len = ext4_rec_len_to_disk(data2 + blocksize - (char *) de2);
dxtrace(dx_show_leaf (hinfo, (struct ext4_dir_entry_2 *) data1, blocksize, 1)); dxtrace(dx_show_leaf (hinfo, (struct ext4_dir_entry_2 *) data1, blocksize, 1));
dxtrace(dx_show_leaf (hinfo, (struct ext4_dir_entry_2 *) data2, blocksize, 1)); dxtrace(dx_show_leaf (hinfo, (struct ext4_dir_entry_2 *) data2, blocksize, 1));
@ -1297,7 +1297,7 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,
return -EEXIST; return -EEXIST;
} }
nlen = EXT4_DIR_REC_LEN(de->name_len); nlen = EXT4_DIR_REC_LEN(de->name_len);
rlen = le16_to_cpu(de->rec_len); rlen = ext4_rec_len_from_disk(de->rec_len);
if ((de->inode? rlen - nlen: rlen) >= reclen) if ((de->inode? rlen - nlen: rlen) >= reclen)
break; break;
de = (struct ext4_dir_entry_2 *)((char *)de + rlen); de = (struct ext4_dir_entry_2 *)((char *)de + rlen);
@ -1316,11 +1316,11 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,
/* By now the buffer is marked for journaling */ /* By now the buffer is marked for journaling */
nlen = EXT4_DIR_REC_LEN(de->name_len); nlen = EXT4_DIR_REC_LEN(de->name_len);
rlen = le16_to_cpu(de->rec_len); rlen = ext4_rec_len_from_disk(de->rec_len);
if (de->inode) { if (de->inode) {
struct ext4_dir_entry_2 *de1 = (struct ext4_dir_entry_2 *)((char *)de + nlen); struct ext4_dir_entry_2 *de1 = (struct ext4_dir_entry_2 *)((char *)de + nlen);
de1->rec_len = cpu_to_le16(rlen - nlen); de1->rec_len = ext4_rec_len_to_disk(rlen - nlen);
de->rec_len = cpu_to_le16(nlen); de->rec_len = ext4_rec_len_to_disk(nlen);
de = de1; de = de1;
} }
de->file_type = EXT4_FT_UNKNOWN; de->file_type = EXT4_FT_UNKNOWN;
@ -1397,17 +1397,18 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
/* The 0th block becomes the root, move the dirents out */ /* The 0th block becomes the root, move the dirents out */
fde = &root->dotdot; fde = &root->dotdot;
de = (struct ext4_dir_entry_2 *)((char *)fde + le16_to_cpu(fde->rec_len)); de = (struct ext4_dir_entry_2 *)((char *)fde +
ext4_rec_len_from_disk(fde->rec_len));
len = ((char *) root) + blocksize - (char *) de; len = ((char *) root) + blocksize - (char *) de;
memcpy (data1, de, len); memcpy (data1, de, len);
de = (struct ext4_dir_entry_2 *) data1; de = (struct ext4_dir_entry_2 *) data1;
top = data1 + len; top = data1 + len;
while ((char *)(de2=(void*)de+le16_to_cpu(de->rec_len)) < top) while ((char *)(de2 = ext4_next_entry(de)) < top)
de = de2; de = de2;
de->rec_len = cpu_to_le16(data1 + blocksize - (char *) de); de->rec_len = ext4_rec_len_to_disk(data1 + blocksize - (char *) de);
/* Initialize the root; the dot dirents already exist */ /* Initialize the root; the dot dirents already exist */
de = (struct ext4_dir_entry_2 *) (&root->dotdot); de = (struct ext4_dir_entry_2 *) (&root->dotdot);
de->rec_len = cpu_to_le16(blocksize - EXT4_DIR_REC_LEN(2)); de->rec_len = ext4_rec_len_to_disk(blocksize - EXT4_DIR_REC_LEN(2));
memset (&root->info, 0, sizeof(root->info)); memset (&root->info, 0, sizeof(root->info));
root->info.info_length = sizeof(root->info); root->info.info_length = sizeof(root->info);
root->info.hash_version = EXT4_SB(dir->i_sb)->s_def_hash_version; root->info.hash_version = EXT4_SB(dir->i_sb)->s_def_hash_version;
@ -1487,7 +1488,7 @@ static int ext4_add_entry (handle_t *handle, struct dentry *dentry,
return retval; return retval;
de = (struct ext4_dir_entry_2 *) bh->b_data; de = (struct ext4_dir_entry_2 *) bh->b_data;
de->inode = 0; de->inode = 0;
de->rec_len = cpu_to_le16(blocksize); de->rec_len = ext4_rec_len_to_disk(blocksize);
return add_dirent_to_buf(handle, dentry, inode, de, bh); return add_dirent_to_buf(handle, dentry, inode, de, bh);
} }
@ -1550,7 +1551,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
goto cleanup; goto cleanup;
node2 = (struct dx_node *)(bh2->b_data); node2 = (struct dx_node *)(bh2->b_data);
entries2 = node2->entries; entries2 = node2->entries;
node2->fake.rec_len = cpu_to_le16(sb->s_blocksize); node2->fake.rec_len = ext4_rec_len_to_disk(sb->s_blocksize);
node2->fake.inode = 0; node2->fake.inode = 0;
BUFFER_TRACE(frame->bh, "get_write_access"); BUFFER_TRACE(frame->bh, "get_write_access");
err = ext4_journal_get_write_access(handle, frame->bh); err = ext4_journal_get_write_access(handle, frame->bh);
@ -1648,9 +1649,9 @@ static int ext4_delete_entry (handle_t *handle,
BUFFER_TRACE(bh, "get_write_access"); BUFFER_TRACE(bh, "get_write_access");
ext4_journal_get_write_access(handle, bh); ext4_journal_get_write_access(handle, bh);
if (pde) if (pde)
pde->rec_len = pde->rec_len = ext4_rec_len_to_disk(
cpu_to_le16(le16_to_cpu(pde->rec_len) + ext4_rec_len_from_disk(pde->rec_len) +
le16_to_cpu(de->rec_len)); ext4_rec_len_from_disk(de->rec_len));
else else
de->inode = 0; de->inode = 0;
dir->i_version++; dir->i_version++;
@ -1658,10 +1659,9 @@ static int ext4_delete_entry (handle_t *handle,
ext4_journal_dirty_metadata(handle, bh); ext4_journal_dirty_metadata(handle, bh);
return 0; return 0;
} }
i += le16_to_cpu(de->rec_len); i += ext4_rec_len_from_disk(de->rec_len);
pde = de; pde = de;
de = (struct ext4_dir_entry_2 *) de = ext4_next_entry(de);
((char *) de + le16_to_cpu(de->rec_len));
} }
return -ENOENT; return -ENOENT;
} }
@ -1824,13 +1824,13 @@ static int ext4_mkdir(struct inode * dir, struct dentry * dentry, int mode)
de = (struct ext4_dir_entry_2 *) dir_block->b_data; de = (struct ext4_dir_entry_2 *) dir_block->b_data;
de->inode = cpu_to_le32(inode->i_ino); de->inode = cpu_to_le32(inode->i_ino);
de->name_len = 1; de->name_len = 1;
de->rec_len = cpu_to_le16(EXT4_DIR_REC_LEN(de->name_len)); de->rec_len = ext4_rec_len_to_disk(EXT4_DIR_REC_LEN(de->name_len));
strcpy (de->name, "."); strcpy (de->name, ".");
ext4_set_de_type(dir->i_sb, de, S_IFDIR); ext4_set_de_type(dir->i_sb, de, S_IFDIR);
de = (struct ext4_dir_entry_2 *) de = ext4_next_entry(de);
((char *) de + le16_to_cpu(de->rec_len));
de->inode = cpu_to_le32(dir->i_ino); de->inode = cpu_to_le32(dir->i_ino);
de->rec_len = cpu_to_le16(inode->i_sb->s_blocksize-EXT4_DIR_REC_LEN(1)); de->rec_len = ext4_rec_len_to_disk(inode->i_sb->s_blocksize -
EXT4_DIR_REC_LEN(1));
de->name_len = 2; de->name_len = 2;
strcpy (de->name, ".."); strcpy (de->name, "..");
ext4_set_de_type(dir->i_sb, de, S_IFDIR); ext4_set_de_type(dir->i_sb, de, S_IFDIR);
@ -1882,8 +1882,7 @@ static int empty_dir (struct inode * inode)
return 1; return 1;
} }
de = (struct ext4_dir_entry_2 *) bh->b_data; de = (struct ext4_dir_entry_2 *) bh->b_data;
de1 = (struct ext4_dir_entry_2 *) de1 = ext4_next_entry(de);
((char *) de + le16_to_cpu(de->rec_len));
if (le32_to_cpu(de->inode) != inode->i_ino || if (le32_to_cpu(de->inode) != inode->i_ino ||
!le32_to_cpu(de1->inode) || !le32_to_cpu(de1->inode) ||
strcmp (".", de->name) || strcmp (".", de->name) ||
@ -1894,9 +1893,9 @@ static int empty_dir (struct inode * inode)
brelse (bh); brelse (bh);
return 1; return 1;
} }
offset = le16_to_cpu(de->rec_len) + le16_to_cpu(de1->rec_len); offset = ext4_rec_len_from_disk(de->rec_len) +
de = (struct ext4_dir_entry_2 *) ext4_rec_len_from_disk(de1->rec_len);
((char *) de1 + le16_to_cpu(de1->rec_len)); de = ext4_next_entry(de1);
while (offset < inode->i_size ) { while (offset < inode->i_size ) {
if (!bh || if (!bh ||
(void *) de >= (void *) (bh->b_data+sb->s_blocksize)) { (void *) de >= (void *) (bh->b_data+sb->s_blocksize)) {
@ -1925,9 +1924,8 @@ static int empty_dir (struct inode * inode)
brelse (bh); brelse (bh);
return 0; return 0;
} }
offset += le16_to_cpu(de->rec_len); offset += ext4_rec_len_from_disk(de->rec_len);
de = (struct ext4_dir_entry_2 *) de = ext4_next_entry(de);
((char *) de + le16_to_cpu(de->rec_len));
} }
brelse (bh); brelse (bh);
return 1; return 1;
@ -2282,8 +2280,7 @@ static int ext4_link (struct dentry * old_dentry,
} }
#define PARENT_INO(buffer) \ #define PARENT_INO(buffer) \
((struct ext4_dir_entry_2 *) ((char *) buffer + \ (ext4_next_entry((struct ext4_dir_entry_2 *)(buffer))->inode)
le16_to_cpu(((struct ext4_dir_entry_2 *) buffer)->rec_len)))->inode
/* /*
* Anybody can rename anything with this: the permission checks are left to the * Anybody can rename anything with this: the permission checks are left to the

20
include/linux/ext4_fs.h
View file

@ -767,6 +767,26 @@ struct ext4_dir_entry_2 {
#define EXT4_DIR_ROUND (EXT4_DIR_PAD - 1) #define EXT4_DIR_ROUND (EXT4_DIR_PAD - 1)
#define EXT4_DIR_REC_LEN(name_len) (((name_len) + 8 + EXT4_DIR_ROUND) & \ #define EXT4_DIR_REC_LEN(name_len) (((name_len) + 8 + EXT4_DIR_ROUND) & \
~EXT4_DIR_ROUND) ~EXT4_DIR_ROUND)
#define EXT4_MAX_REC_LEN ((1<<16)-1)
static inline unsigned ext4_rec_len_from_disk(__le16 dlen)
{
unsigned len = le16_to_cpu(dlen);
if (len == EXT4_MAX_REC_LEN)
return 1 << 16;
return len;
}
static inline __le16 ext4_rec_len_to_disk(unsigned len)
{
if (len == (1 << 16))
return cpu_to_le16(EXT4_MAX_REC_LEN);
else if (len > (1 << 16))
BUG();
return cpu_to_le16(len);
}
/* /*
* Hash Tree Directory indexing * Hash Tree Directory indexing
* (c) Daniel Phillips, 2001 * (c) Daniel Phillips, 2001