1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 *
4 * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved.
5 *
6 * Directory handling functions for NTFS-based filesystems.
7 *
8 */
9
10 #include <linux/fs.h>
11 #include <linux/filelock.h>
12 #include <linux/nls.h>
13
14 #include "debug.h"
15 #include "ntfs.h"
16 #include "ntfs_fs.h"
17
18 /* Convert little endian UTF-16 to NLS string. */
ntfs_utf16_to_nls(struct ntfs_sb_info * sbi,const __le16 * name,u32 len,u8 * buf,int buf_len)19 int ntfs_utf16_to_nls(struct ntfs_sb_info *sbi, const __le16 *name, u32 len,
20 u8 *buf, int buf_len)
21 {
22 int ret, warn;
23 u8 *op;
24 struct nls_table *nls = sbi->options->nls;
25
26 static_assert(sizeof(wchar_t) == sizeof(__le16));
27
28 if (buf_len <= 0)
29 return -EINVAL;
30
31 buf_len -= 1;
32
33 if (!nls) {
34 /* UTF-16 -> UTF-8 */
35 ret = utf16s_to_utf8s((wchar_t *)name, len, UTF16_LITTLE_ENDIAN,
36 buf, buf_len);
37 buf[ret] = '\0';
38 return ret;
39 }
40
41 op = buf;
42 warn = 0;
43
44 while (len--) {
45 u16 ec;
46 int charlen;
47 char dump[5];
48
49 if (buf_len < NLS_MAX_CHARSET_SIZE) {
50 ntfs_warn(sbi->sb,
51 "filename was truncated while converting.");
52 break;
53 }
54
55 ec = le16_to_cpu(*name++);
56 charlen = nls->uni2char(ec, op, buf_len);
57
58 if (charlen > 0) {
59 op += charlen;
60 buf_len -= charlen;
61 continue;
62 }
63
64 *op++ = '_';
65 buf_len -= 1;
66 if (warn)
67 continue;
68
69 warn = 1;
70 hex_byte_pack(&dump[0], ec >> 8);
71 hex_byte_pack(&dump[2], ec);
72 dump[4] = 0;
73
74 ntfs_err(sbi->sb, "failed to convert \"%s\" to %s", dump,
75 nls->charset);
76 }
77
78 *op = '\0';
79 return op - buf;
80 }
81
82 // clang-format off
83 #define PLANE_SIZE 0x00010000
84
85 #define SURROGATE_PAIR 0x0000d800
86 #define SURROGATE_LOW 0x00000400
87 #define SURROGATE_BITS 0x000003ff
88 // clang-format on
89
90 /*
91 * put_utf16 - Modified version of put_utf16 from fs/nls/nls_base.c
92 *
93 * Function is sparse warnings free.
94 */
put_utf16(wchar_t * s,unsigned int c,enum utf16_endian endian)95 static inline void put_utf16(wchar_t *s, unsigned int c,
96 enum utf16_endian endian)
97 {
98 static_assert(sizeof(wchar_t) == sizeof(__le16));
99 static_assert(sizeof(wchar_t) == sizeof(__be16));
100
101 switch (endian) {
102 default:
103 *s = (wchar_t)c;
104 break;
105 case UTF16_LITTLE_ENDIAN:
106 *(__le16 *)s = __cpu_to_le16(c);
107 break;
108 case UTF16_BIG_ENDIAN:
109 *(__be16 *)s = __cpu_to_be16(c);
110 break;
111 }
112 }
113
114 /*
115 * _utf8s_to_utf16s
116 *
117 * Modified version of 'utf8s_to_utf16s' allows to
118 * detect -ENAMETOOLONG without writing out of expected maximum.
119 */
_utf8s_to_utf16s(const u8 * s,int inlen,enum utf16_endian endian,wchar_t * pwcs,int maxout)120 static int _utf8s_to_utf16s(const u8 *s, int inlen, enum utf16_endian endian,
121 wchar_t *pwcs, int maxout)
122 {
123 u16 *op;
124 int size;
125 unicode_t u;
126
127 op = pwcs;
128 while (inlen > 0 && *s) {
129 if (*s & 0x80) {
130 size = utf8_to_utf32(s, inlen, &u);
131 if (size < 0)
132 return -EINVAL;
133 s += size;
134 inlen -= size;
135
136 if (u >= PLANE_SIZE) {
137 if (maxout < 2)
138 return -ENAMETOOLONG;
139
140 u -= PLANE_SIZE;
141 put_utf16(op++,
142 SURROGATE_PAIR |
143 ((u >> 10) & SURROGATE_BITS),
144 endian);
145 put_utf16(op++,
146 SURROGATE_PAIR | SURROGATE_LOW |
147 (u & SURROGATE_BITS),
148 endian);
149 maxout -= 2;
150 } else {
151 if (maxout < 1)
152 return -ENAMETOOLONG;
153
154 put_utf16(op++, u, endian);
155 maxout--;
156 }
157 } else {
158 if (maxout < 1)
159 return -ENAMETOOLONG;
160
161 put_utf16(op++, *s++, endian);
162 inlen--;
163 maxout--;
164 }
165 }
166 return op - pwcs;
167 }
168
169 /*
170 * ntfs_nls_to_utf16 - Convert input string to UTF-16.
171 * @name: Input name.
172 * @name_len: Input name length.
173 * @uni: Destination memory.
174 * @max_ulen: Destination memory.
175 * @endian: Endian of target UTF-16 string.
176 *
177 * This function is called:
178 * - to create NTFS name
179 * - to create symlink
180 *
181 * Return: UTF-16 string length or error (if negative).
182 */
ntfs_nls_to_utf16(struct ntfs_sb_info * sbi,const u8 * name,u32 name_len,struct cpu_str * uni,u32 max_ulen,enum utf16_endian endian)183 int ntfs_nls_to_utf16(struct ntfs_sb_info *sbi, const u8 *name, u32 name_len,
184 struct cpu_str *uni, u32 max_ulen,
185 enum utf16_endian endian)
186 {
187 int ret, slen, i;
188 const u8 *end;
189 struct nls_table *nls = sbi->options->nls;
190 u16 *uname = uni->name;
191
192 static_assert(sizeof(wchar_t) == sizeof(u16));
193
194 if (!nls) {
195 /* utf8 -> utf16 */
196 ret = _utf8s_to_utf16s(name, name_len, endian, uname, max_ulen);
197 } else {
198 for (ret = 0, end = name + name_len; name < end;
199 ret++, name += slen) {
200 if (ret >= max_ulen)
201 return -ENAMETOOLONG;
202
203 slen = nls->char2uni(name, end - name, uname + ret);
204 if (!slen)
205 return -EINVAL;
206 if (slen < 0)
207 return slen;
208 }
209
210 #ifdef __BIG_ENDIAN
211 if (endian == UTF16_LITTLE_ENDIAN) {
212 i = ret;
213
214 while (i--) {
215 __cpu_to_le16s(uname);
216 uname++;
217 }
218 }
219 #else
220 if (endian == UTF16_BIG_ENDIAN) {
221 i = ret;
222
223 while (i--) {
224 __cpu_to_be16s(uname);
225 uname++;
226 }
227 }
228 #endif
229 }
230
231 uni->len = ret;
232 uni->ads_len = 0;
233 if (ret > 0 && sbi->options->ads) {
234 uname = uni->name;
235 /* Find delimiter in range [1 : ret-2). */
236 for (i = 1; i + 1 < ret; i++) {
237 if (uname[i] == ':') {
238 uni->ads_len = ret - i - 1;
239 uni->len = i;
240 uname[i] = 0;
241 ret = i;
242
243 uname += i + 1;
244 i = uni->ads_len;
245 /* Return ADS name as little endian. Always */
246 #ifdef __BIG_ENDIAN
247 if (endian == UTF16_LITTLE_ENDIAN) {
248 while (i--) {
249 __cpu_to_le16s(uname);
250 uname++;
251 }
252 }
253 #else
254 if (endian == UTF16_BIG_ENDIAN) {
255 while (i--) {
256 __cpu_to_be16s(uname);
257 uname++;
258 }
259 }
260 #endif
261 break;
262 }
263 }
264 }
265
266 return ret;
267 }
268
269 /*
270 * dir_search_u - Helper function.
271 */
dir_search_flags(struct inode * dir,const struct cpu_str * uni,struct ntfs_fnd * fnd,u32 flags)272 struct inode *dir_search_flags(struct inode *dir, const struct cpu_str *uni,
273 struct ntfs_fnd *fnd, u32 flags)
274 {
275 int err = 0;
276 struct super_block *sb = dir->i_sb;
277 struct ntfs_sb_info *sbi = sb->s_fs_info;
278 struct ntfs_inode *ni = ntfs_i(dir);
279 struct NTFS_DE *e;
280 int diff;
281 struct inode *inode = NULL;
282 struct ntfs_fnd *fnd_a = NULL;
283
284 if (!fnd) {
285 fnd_a = fnd_get();
286 if (!fnd_a) {
287 err = -ENOMEM;
288 goto out;
289 }
290 fnd = fnd_a;
291 }
292
293 err = indx_find(&ni->dir, ni, NULL, uni, 0, sbi, &diff, &e, fnd);
294
295 if (err)
296 goto out;
297
298 if (diff) {
299 err = -ENOENT;
300 goto out;
301 }
302
303 inode = ntfs_iget5_flags(sb, &e->ref, uni, flags);
304 if (!IS_ERR(inode) && is_bad_inode(inode)) {
305 iput(inode);
306 err = -EINVAL;
307 }
308 out:
309 fnd_put(fnd_a);
310
311 return err == -ENOENT ? NULL : err ? ERR_PTR(err) : inode;
312 }
313
de_fname_fits(const struct NTFS_DE * e,u32 e_size,const struct ATTR_FILE_NAME * fname)314 static inline bool de_fname_fits(const struct NTFS_DE *e, u32 e_size,
315 const struct ATTR_FILE_NAME *fname)
316 {
317 return sizeof(struct NTFS_DE) + fname_full_size(fname) <= e_size;
318 }
319
320 /*
321 * returns false if 'ctx' if full
322 */
ntfs_dir_emit(struct ntfs_sb_info * sbi,struct ntfs_inode * ni,const struct NTFS_DE * e,u8 * name,struct dir_context * ctx)323 static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi,
324 struct ntfs_inode *ni, const struct NTFS_DE *e,
325 u8 *name, struct dir_context *ctx)
326 {
327 const struct ATTR_FILE_NAME *fname;
328 u64 ino;
329 int name_len;
330 u32 dt_type;
331
332 fname = Add2Ptr(e, sizeof(struct NTFS_DE));
333
334 if (fname->type == FILE_NAME_DOS)
335 return true;
336
337 if (!mi_is_ref(&ni->mi, &fname->home))
338 return true;
339
340 ino = ino_get(&e->ref);
341
342 if (ino == MFT_REC_ROOT)
343 return true;
344
345 /* Skip meta files. Unless option to show metafiles is set. */
346 if (!sbi->options->showmeta && ntfs_is_meta_file(sbi, ino))
347 return true;
348
349 if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN))
350 return true;
351
352 if (!de_fname_fits(e, le16_to_cpu(e->size), fname))
353 return true;
354
355 name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name,
356 PATH_MAX);
357 if (name_len <= 0) {
358 ntfs_warn(sbi->sb, "failed to convert name for inode %llx.",
359 ino);
360 return true;
361 }
362
363 /*
364 * NTFS: symlinks are "dir + reparse" or "file + reparse"
365 * Unfortunately reparse attribute is used for many purposes (several dozens).
366 * It is not possible here to know is this name symlink or not.
367 * To get exactly the type of name we should to open inode (read mft).
368 * getattr for opened file (fstat) correctly returns symlink.
369 */
370 dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG;
371
372 /*
373 * It is not reliable to detect the type of name using duplicated information
374 * stored in parent directory.
375 * The only correct way to get the type of name - read MFT record and find ATTR_STD.
376 * The code below is not good idea.
377 * It does additional locks/reads just to get the type of name.
378 * Should we use additional mount option to enable branch below?
379 */
380 if (fname->dup.extend_data && ino != ni->mi.rno) {
381 struct inode *inode = ntfs_iget5(sbi->sb, &e->ref, NULL);
382 if (!IS_ERR_OR_NULL(inode)) {
383 dt_type = fs_umode_to_dtype(inode->i_mode);
384 iput(inode);
385 }
386 }
387
388 return dir_emit(ctx, (s8 *)name, name_len, ino, dt_type);
389 }
390
391 /*
392 * ntfs_read_hdr - Helper function for ntfs_readdir().
393 *
394 * returns 0 if ok.
395 * returns -EINVAL if directory is corrupted.
396 * returns +1 if 'ctx' is full.
397 */
ntfs_read_hdr(struct ntfs_sb_info * sbi,struct ntfs_inode * ni,const struct INDEX_HDR * hdr,u64 vbo,u64 pos,u8 * name,struct dir_context * ctx)398 static int ntfs_read_hdr(struct ntfs_sb_info *sbi, struct ntfs_inode *ni,
399 const struct INDEX_HDR *hdr, u64 vbo, u64 pos,
400 u8 *name, struct dir_context *ctx)
401 {
402 const struct NTFS_DE *e;
403 u32 e_size;
404 u32 end = le32_to_cpu(hdr->used);
405 u32 off = le32_to_cpu(hdr->de_off);
406
407 for (;; off += e_size) {
408 if (off + sizeof(struct NTFS_DE) > end)
409 return -EINVAL;
410
411 e = Add2Ptr(hdr, off);
412 e_size = le16_to_cpu(e->size);
413 if (e_size < sizeof(struct NTFS_DE) || off + e_size > end)
414 return -EINVAL;
415
416 if (de_is_last(e))
417 return 0;
418
419 /* Skip already enumerated. */
420 if (vbo + off < pos)
421 continue;
422
423 if (le16_to_cpu(e->key_size) < SIZEOF_ATTRIBUTE_FILENAME)
424 return -EINVAL;
425
426 ctx->pos = vbo + off;
427
428 /* Submit the name to the filldir callback. */
429 if (!ntfs_dir_emit(sbi, ni, e, name, ctx)) {
430 /* ctx is full. */
431 return +1;
432 }
433 }
434 }
435
436 /*
437 * ntfs_readdir - file_operations::iterate_shared
438 *
439 * Use non sorted enumeration.
440 * Sorted enumeration may result infinite loop if names tree contains loop.
441 */
ntfs_readdir(struct file * file,struct dir_context * ctx)442 static int ntfs_readdir(struct file *file, struct dir_context *ctx)
443 {
444 const struct INDEX_ROOT *root;
445 size_t bit;
446 int err = 0;
447 struct inode *dir = file_inode(file);
448 struct ntfs_inode *ni = ntfs_i(dir);
449 struct super_block *sb = dir->i_sb;
450 struct ntfs_sb_info *sbi = sb->s_fs_info;
451 loff_t i_size = i_size_read(dir);
452 u64 pos = ctx->pos;
453 u8 *name = NULL;
454 struct indx_node *node = NULL;
455 u8 index_bits = ni->dir.index_bits;
456 size_t max_bit = i_size >> ni->dir.index_bits;
457 loff_t eod = i_size + sbi->record_size;
458
459 /* Name is a buffer of PATH_MAX length. */
460 static_assert(NTFS_NAME_LEN * 4 < PATH_MAX);
461
462 if (!pos) {
463 /*
464 * ni->dir.version increments each directory change.
465 * Save the initial value of ni->dir.version.
466 */
467 file->private_data = (void *)ni->dir.version;
468 }
469
470 if (pos >= eod) {
471 if (file->private_data == (void *)ni->dir.version) {
472 /* No changes since first readdir. */
473 return 0;
474 }
475
476 /*
477 * Handle directories that changed after the initial readdir().
478 *
479 * Some user space code implements recursive removal like this instead
480 * of calling rmdir(2) directly:
481 *
482 * fd = opendir(path);
483 * while ((dent = readdir(fd)))
484 * unlinkat(dirfd(fd), dent->d_name, 0);
485 * closedir(fd);
486 *
487 * POSIX leaves unspecified what readdir() should return once the
488 * directory has been modified after opendir()/rewinddir(), so this
489 * pattern is not guaranteed to work on all filesystems or platforms.
490 *
491 * In ntfs3 the internal name tree may be reshaped while entries are
492 * being removed, so there is no stable anchor for continuing a
493 * single-pass walk based on the original readdir() order.
494 *
495 * In practice some widely used tools (for example certain rm(1)
496 * implementations) have used this readdir()/unlink() loop, and some
497 * filesystems behave in a way that effectively makes it work in the
498 * common case.
499 *
500 * The code below follows that practice and tries to provide
501 * "rmdir-like" behaviour for such callers on ntfs3, even though the
502 * situation is not strictly defined by the APIs.
503 *
504 * Apple documents the same readdir()/unlink() issue and a workaround
505 * for HFS file systems in:
506 * https://web.archive.org/web/20220122122948/https:/support.apple.com/kb/TA21420?locale=en_US
507 */
508 ctx->pos = pos = 3;
509 file->private_data = (void *)ni->dir.version;
510 }
511
512 if (!dir_emit_dots(file, ctx))
513 return 0;
514
515 name = kmalloc(PATH_MAX, GFP_KERNEL);
516 if (!name)
517 return -ENOMEM;
518
519 if (!ni->mi_loaded && ni->attr_list.size) {
520 /*
521 * Directory inode is locked for read.
522 * Load all subrecords to avoid 'write' access to 'ni' during
523 * directory reading.
524 */
525 ni_lock(ni);
526 if (!ni->mi_loaded && ni->attr_list.size) {
527 err = ni_load_all_mi(ni);
528 if (!err)
529 ni->mi_loaded = true;
530 }
531 ni_unlock(ni);
532 if (err)
533 goto out;
534 }
535
536 /*
537 * Keep directory metadata stable for the whole walk. Loading subrecords
538 * once is not enough if concurrent writeback can still compact ATTR_LIST
539 * entries and free the record that ntfs_read_hdr() is currently walking.
540 */
541 ni_lock(ni);
542
543 root = indx_get_root(&ni->dir, ni, NULL, NULL);
544 if (!root) {
545 err = -EINVAL;
546 goto out_unlock;
547 }
548
549 if (pos >= sbi->record_size) {
550 bit = (pos - sbi->record_size) >> index_bits;
551 } else {
552 /*
553 * Add each name from root in 'ctx'.
554 */
555 err = ntfs_read_hdr(sbi, ni, &root->ihdr, 0, pos, name, ctx);
556 if (err)
557 goto out_unlock;
558 bit = 0;
559 }
560
561 /*
562 * Enumerate indexes until the end of dir.
563 */
564 for (; bit < max_bit; bit += 1) {
565 /* Get the next used index. */
566 err = indx_used_bit(&ni->dir, ni, &bit);
567 if (err)
568 goto out_unlock;
569
570 if (bit == MINUS_ONE_T) {
571 /* no more used indexes. end of dir. */
572 break;
573 }
574
575 if (bit >= max_bit) {
576 /* Corrupted directory. */
577 err = -EINVAL;
578 goto out_unlock;
579 }
580
581 err = indx_read_ra(&ni->dir, ni, bit << ni->dir.idx2vbn_bits,
582 &node, &file->f_ra);
583 if (err)
584 goto out_unlock;
585
586 /*
587 * Add each name from index in 'ctx'.
588 */
589 err = ntfs_read_hdr(sbi, ni, &node->index->ihdr,
590 ((u64)bit << index_bits) + sbi->record_size,
591 pos, name, ctx);
592 if (err)
593 goto out_unlock;
594 }
595
596 out_unlock:
597 ni_unlock(ni);
598
599 out:
600 kfree(name);
601 put_indx_node(node);
602
603 if (!err) {
604 /* End of directory. */
605 ctx->pos = eod;
606 } else if (err == 1) {
607 /* 'ctx' is full. */
608 err = 0;
609 } else if (err == -ENOENT) {
610 err = 0;
611 ctx->pos = pos;
612 } else if (err < 0) {
613 if (err == -EINVAL)
614 _ntfs_bad_inode(dir);
615 ctx->pos = eod;
616 }
617
618 return err;
619 }
620
621 /*
622 * Return fname when @e passes the same checks as ntfs_dir_emit() before
623 * exposing an entry (valid key, non-DOS, fname fits in e->size).
624 */
625 static inline const struct ATTR_FILE_NAME *
de_countable_fname(const struct NTFS_DE * e,u32 e_size)626 de_countable_fname(const struct NTFS_DE *e, u32 e_size)
627 {
628 const struct ATTR_FILE_NAME *fname;
629
630 fname = de_get_fname(e);
631 if (!fname || fname->type == FILE_NAME_DOS ||
632 !de_fname_fits(e, e_size, fname))
633 return NULL;
634
635 return fname;
636 }
637
ntfs_dir_count(struct inode * dir,bool * is_empty,size_t * dirs,size_t * files)638 static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs,
639 size_t *files)
640 {
641 int err = 0;
642 struct ntfs_inode *ni = ntfs_i(dir);
643 struct NTFS_DE *e = NULL;
644 struct INDEX_ROOT *root;
645 struct INDEX_HDR *hdr;
646 const struct ATTR_FILE_NAME *fname;
647 u32 e_size, off, end;
648 size_t drs = 0, fles = 0, bit = 0;
649 struct indx_node *node = NULL;
650 size_t max_indx = i_size_read(&ni->vfs_inode) >> ni->dir.index_bits;
651
652 if (is_empty)
653 *is_empty = true;
654
655 root = indx_get_root(&ni->dir, ni, NULL, NULL);
656 if (!root)
657 return -EINVAL;
658
659 hdr = &root->ihdr;
660
661 for (;;) {
662 end = le32_to_cpu(hdr->used);
663 off = le32_to_cpu(hdr->de_off);
664
665 for (; off + sizeof(struct NTFS_DE) <= end; off += e_size) {
666 e = Add2Ptr(hdr, off);
667 e_size = le16_to_cpu(e->size);
668 if (e_size < sizeof(struct NTFS_DE) ||
669 off + e_size > end) {
670 /* Looks like corruption. */
671 break;
672 }
673
674 if (de_is_last(e))
675 break;
676
677 fname = de_countable_fname(e, e_size);
678 if (!fname)
679 continue;
680
681 if (is_empty) {
682 *is_empty = false;
683 if (!dirs && !files)
684 goto out;
685 }
686
687 if (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY)
688 drs += 1;
689 else
690 fles += 1;
691 }
692
693 if (bit >= max_indx)
694 goto out;
695
696 err = indx_used_bit(&ni->dir, ni, &bit);
697 if (err)
698 goto out;
699
700 if (bit == MINUS_ONE_T)
701 goto out;
702
703 if (bit >= max_indx)
704 goto out;
705
706 err = indx_read(&ni->dir, ni, bit << ni->dir.idx2vbn_bits,
707 &node);
708 if (err)
709 goto out;
710
711 hdr = &node->index->ihdr;
712 bit += 1;
713 }
714
715 out:
716 put_indx_node(node);
717 if (dirs)
718 *dirs = drs;
719 if (files)
720 *files = fles;
721
722 return err;
723 }
724
dir_is_empty(struct inode * dir)725 bool dir_is_empty(struct inode *dir)
726 {
727 bool is_empty = false;
728
729 ntfs_dir_count(dir, &is_empty, NULL, NULL);
730
731 return is_empty;
732 }
733
734 // clang-format off
735 const struct file_operations ntfs_dir_operations = {
736 .llseek = generic_file_llseek,
737 .read = generic_read_dir,
738 .iterate_shared = ntfs_readdir,
739 .fsync = ntfs_file_fsync,
740 .open = ntfs_file_open,
741 .unlocked_ioctl = ntfs_ioctl,
742 #ifdef CONFIG_COMPAT
743 .compat_ioctl = ntfs_compat_ioctl,
744 #endif
745 .setlease = generic_setlease,
746 };
747 // clang-format on
748