1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * 4 * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved. 5 * 6 * Directory handling functions for NTFS-based filesystems. 7 * 8 */ 9 10 #include <linux/fs.h> 11 #include <linux/filelock.h> 12 #include <linux/nls.h> 13 14 #include "debug.h" 15 #include "ntfs.h" 16 #include "ntfs_fs.h" 17 18 /* Convert little endian UTF-16 to NLS string. */ 19 int ntfs_utf16_to_nls(struct ntfs_sb_info *sbi, const __le16 *name, u32 len, 20 u8 *buf, int buf_len) 21 { 22 int ret, warn; 23 u8 *op; 24 struct nls_table *nls = sbi->options->nls; 25 26 static_assert(sizeof(wchar_t) == sizeof(__le16)); 27 28 if (!nls) { 29 /* UTF-16 -> UTF-8 */ 30 ret = utf16s_to_utf8s((wchar_t *)name, len, UTF16_LITTLE_ENDIAN, 31 buf, buf_len); 32 buf[ret] = '\0'; 33 return ret; 34 } 35 36 op = buf; 37 warn = 0; 38 39 while (len--) { 40 u16 ec; 41 int charlen; 42 char dump[5]; 43 44 if (buf_len < NLS_MAX_CHARSET_SIZE) { 45 ntfs_warn(sbi->sb, 46 "filename was truncated while converting."); 47 break; 48 } 49 50 ec = le16_to_cpu(*name++); 51 charlen = nls->uni2char(ec, op, buf_len); 52 53 if (charlen > 0) { 54 op += charlen; 55 buf_len -= charlen; 56 continue; 57 } 58 59 *op++ = '_'; 60 buf_len -= 1; 61 if (warn) 62 continue; 63 64 warn = 1; 65 hex_byte_pack(&dump[0], ec >> 8); 66 hex_byte_pack(&dump[2], ec); 67 dump[4] = 0; 68 69 ntfs_err(sbi->sb, "failed to convert \"%s\" to %s", dump, 70 nls->charset); 71 } 72 73 *op = '\0'; 74 return op - buf; 75 } 76 77 // clang-format off 78 #define PLANE_SIZE 0x00010000 79 80 #define SURROGATE_PAIR 0x0000d800 81 #define SURROGATE_LOW 0x00000400 82 #define SURROGATE_BITS 0x000003ff 83 // clang-format on 84 85 /* 86 * put_utf16 - Modified version of put_utf16 from fs/nls/nls_base.c 87 * 88 * Function is sparse warnings free. 89 */ 90 static inline void put_utf16(wchar_t *s, unsigned int c, 91 enum utf16_endian endian) 92 { 93 static_assert(sizeof(wchar_t) == sizeof(__le16)); 94 static_assert(sizeof(wchar_t) == sizeof(__be16)); 95 96 switch (endian) { 97 default: 98 *s = (wchar_t)c; 99 break; 100 case UTF16_LITTLE_ENDIAN: 101 *(__le16 *)s = __cpu_to_le16(c); 102 break; 103 case UTF16_BIG_ENDIAN: 104 *(__be16 *)s = __cpu_to_be16(c); 105 break; 106 } 107 } 108 109 /* 110 * _utf8s_to_utf16s 111 * 112 * Modified version of 'utf8s_to_utf16s' allows to 113 * detect -ENAMETOOLONG without writing out of expected maximum. 114 */ 115 static int _utf8s_to_utf16s(const u8 *s, int inlen, enum utf16_endian endian, 116 wchar_t *pwcs, int maxout) 117 { 118 u16 *op; 119 int size; 120 unicode_t u; 121 122 op = pwcs; 123 while (inlen > 0 && *s) { 124 if (*s & 0x80) { 125 size = utf8_to_utf32(s, inlen, &u); 126 if (size < 0) 127 return -EINVAL; 128 s += size; 129 inlen -= size; 130 131 if (u >= PLANE_SIZE) { 132 if (maxout < 2) 133 return -ENAMETOOLONG; 134 135 u -= PLANE_SIZE; 136 put_utf16(op++, 137 SURROGATE_PAIR | 138 ((u >> 10) & SURROGATE_BITS), 139 endian); 140 put_utf16(op++, 141 SURROGATE_PAIR | SURROGATE_LOW | 142 (u & SURROGATE_BITS), 143 endian); 144 maxout -= 2; 145 } else { 146 if (maxout < 1) 147 return -ENAMETOOLONG; 148 149 put_utf16(op++, u, endian); 150 maxout--; 151 } 152 } else { 153 if (maxout < 1) 154 return -ENAMETOOLONG; 155 156 put_utf16(op++, *s++, endian); 157 inlen--; 158 maxout--; 159 } 160 } 161 return op - pwcs; 162 } 163 164 /* 165 * ntfs_nls_to_utf16 - Convert input string to UTF-16. 166 * @name: Input name. 167 * @name_len: Input name length. 168 * @uni: Destination memory. 169 * @max_ulen: Destination memory. 170 * @endian: Endian of target UTF-16 string. 171 * 172 * This function is called: 173 * - to create NTFS name 174 * - to create symlink 175 * 176 * Return: UTF-16 string length or error (if negative). 177 */ 178 int ntfs_nls_to_utf16(struct ntfs_sb_info *sbi, const u8 *name, u32 name_len, 179 struct cpu_str *uni, u32 max_ulen, 180 enum utf16_endian endian) 181 { 182 int ret, slen; 183 const u8 *end; 184 struct nls_table *nls = sbi->options->nls; 185 u16 *uname = uni->name; 186 187 static_assert(sizeof(wchar_t) == sizeof(u16)); 188 189 if (!nls) { 190 /* utf8 -> utf16 */ 191 ret = _utf8s_to_utf16s(name, name_len, endian, uname, max_ulen); 192 uni->len = ret; 193 return ret; 194 } 195 196 for (ret = 0, end = name + name_len; name < end; ret++, name += slen) { 197 if (ret >= max_ulen) 198 return -ENAMETOOLONG; 199 200 slen = nls->char2uni(name, end - name, uname + ret); 201 if (!slen) 202 return -EINVAL; 203 if (slen < 0) 204 return slen; 205 } 206 207 #ifdef __BIG_ENDIAN 208 if (endian == UTF16_LITTLE_ENDIAN) { 209 int i = ret; 210 211 while (i--) { 212 __cpu_to_le16s(uname); 213 uname++; 214 } 215 } 216 #else 217 if (endian == UTF16_BIG_ENDIAN) { 218 int i = ret; 219 220 while (i--) { 221 __cpu_to_be16s(uname); 222 uname++; 223 } 224 } 225 #endif 226 227 uni->len = ret; 228 return ret; 229 } 230 231 /* 232 * dir_search_u - Helper function. 233 */ 234 struct inode *dir_search_u(struct inode *dir, const struct cpu_str *uni, 235 struct ntfs_fnd *fnd) 236 { 237 int err = 0; 238 struct super_block *sb = dir->i_sb; 239 struct ntfs_sb_info *sbi = sb->s_fs_info; 240 struct ntfs_inode *ni = ntfs_i(dir); 241 struct NTFS_DE *e; 242 int diff; 243 struct inode *inode = NULL; 244 struct ntfs_fnd *fnd_a = NULL; 245 246 if (!fnd) { 247 fnd_a = fnd_get(); 248 if (!fnd_a) { 249 err = -ENOMEM; 250 goto out; 251 } 252 fnd = fnd_a; 253 } 254 255 err = indx_find(&ni->dir, ni, NULL, uni, 0, sbi, &diff, &e, fnd); 256 257 if (err) 258 goto out; 259 260 if (diff) { 261 err = -ENOENT; 262 goto out; 263 } 264 265 inode = ntfs_iget5(sb, &e->ref, uni); 266 if (!IS_ERR(inode) && is_bad_inode(inode)) { 267 iput(inode); 268 err = -EINVAL; 269 } 270 out: 271 fnd_put(fnd_a); 272 273 return err == -ENOENT ? NULL : err ? ERR_PTR(err) : inode; 274 } 275 276 /* 277 * returns false if 'ctx' if full 278 */ 279 static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi, 280 struct ntfs_inode *ni, const struct NTFS_DE *e, 281 u8 *name, struct dir_context *ctx) 282 { 283 const struct ATTR_FILE_NAME *fname; 284 unsigned long ino; 285 int name_len; 286 u32 dt_type; 287 288 fname = Add2Ptr(e, sizeof(struct NTFS_DE)); 289 290 if (fname->type == FILE_NAME_DOS) 291 return true; 292 293 if (!mi_is_ref(&ni->mi, &fname->home)) 294 return true; 295 296 ino = ino_get(&e->ref); 297 298 if (ino == MFT_REC_ROOT) 299 return true; 300 301 /* Skip meta files. Unless option to show metafiles is set. */ 302 if (!sbi->options->showmeta && ntfs_is_meta_file(sbi, ino)) 303 return true; 304 305 if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN)) 306 return true; 307 308 if (sizeof(struct NTFS_DE) + 309 offsetof(struct ATTR_FILE_NAME, name) + 310 fname->name_len * sizeof(short) > le16_to_cpu(e->size)) 311 return true; 312 313 name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name, 314 PATH_MAX); 315 if (name_len <= 0) { 316 ntfs_warn(sbi->sb, "failed to convert name for inode %lx.", 317 ino); 318 return true; 319 } 320 321 /* 322 * NTFS: symlinks are "dir + reparse" or "file + reparse" 323 * Unfortunately reparse attribute is used for many purposes (several dozens). 324 * It is not possible here to know is this name symlink or not. 325 * To get exactly the type of name we should to open inode (read mft). 326 * getattr for opened file (fstat) correctly returns symlink. 327 */ 328 dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; 329 330 /* 331 * It is not reliable to detect the type of name using duplicated information 332 * stored in parent directory. 333 * The only correct way to get the type of name - read MFT record and find ATTR_STD. 334 * The code below is not good idea. 335 * It does additional locks/reads just to get the type of name. 336 * Should we use additional mount option to enable branch below? 337 */ 338 if (fname->dup.extend_data && ino != ni->mi.rno) { 339 struct inode *inode = ntfs_iget5(sbi->sb, &e->ref, NULL); 340 if (!IS_ERR_OR_NULL(inode)) { 341 dt_type = fs_umode_to_dtype(inode->i_mode); 342 iput(inode); 343 } 344 } 345 346 return dir_emit(ctx, (s8 *)name, name_len, ino, dt_type); 347 } 348 349 /* 350 * ntfs_read_hdr - Helper function for ntfs_readdir(). 351 * 352 * returns 0 if ok. 353 * returns -EINVAL if directory is corrupted. 354 * returns +1 if 'ctx' is full. 355 */ 356 static int ntfs_read_hdr(struct ntfs_sb_info *sbi, struct ntfs_inode *ni, 357 const struct INDEX_HDR *hdr, u64 vbo, u64 pos, 358 u8 *name, struct dir_context *ctx) 359 { 360 const struct NTFS_DE *e; 361 u32 e_size; 362 u32 end = le32_to_cpu(hdr->used); 363 u32 off = le32_to_cpu(hdr->de_off); 364 365 for (;; off += e_size) { 366 if (off + sizeof(struct NTFS_DE) > end) 367 return -EINVAL; 368 369 e = Add2Ptr(hdr, off); 370 e_size = le16_to_cpu(e->size); 371 if (e_size < sizeof(struct NTFS_DE) || off + e_size > end) 372 return -EINVAL; 373 374 if (de_is_last(e)) 375 return 0; 376 377 /* Skip already enumerated. */ 378 if (vbo + off < pos) 379 continue; 380 381 if (le16_to_cpu(e->key_size) < SIZEOF_ATTRIBUTE_FILENAME) 382 return -EINVAL; 383 384 ctx->pos = vbo + off; 385 386 /* Submit the name to the filldir callback. */ 387 if (!ntfs_dir_emit(sbi, ni, e, name, ctx)) { 388 /* ctx is full. */ 389 return +1; 390 } 391 } 392 } 393 394 /* 395 * ntfs_readdir - file_operations::iterate_shared 396 * 397 * Use non sorted enumeration. 398 * Sorted enumeration may result infinite loop if names tree contains loop. 399 */ 400 static int ntfs_readdir(struct file *file, struct dir_context *ctx) 401 { 402 const struct INDEX_ROOT *root; 403 size_t bit; 404 int err = 0; 405 struct inode *dir = file_inode(file); 406 struct ntfs_inode *ni = ntfs_i(dir); 407 struct super_block *sb = dir->i_sb; 408 struct ntfs_sb_info *sbi = sb->s_fs_info; 409 loff_t i_size = i_size_read(dir); 410 u64 pos = ctx->pos; 411 u8 *name = NULL; 412 struct indx_node *node = NULL; 413 u8 index_bits = ni->dir.index_bits; 414 size_t max_bit = i_size >> ni->dir.index_bits; 415 loff_t eod = i_size + sbi->record_size; 416 417 /* Name is a buffer of PATH_MAX length. */ 418 static_assert(NTFS_NAME_LEN * 4 < PATH_MAX); 419 420 if (!pos) { 421 /* 422 * ni->dir.version increments each directory change. 423 * Save the initial value of ni->dir.version. 424 */ 425 file->private_data = (void *)ni->dir.version; 426 } 427 428 if (pos >= eod) { 429 if (file->private_data == (void *)ni->dir.version) { 430 /* No changes since first readdir. */ 431 return 0; 432 } 433 434 /* 435 * Handle directories that changed after the initial readdir(). 436 * 437 * Some user space code implements recursive removal like this instead 438 * of calling rmdir(2) directly: 439 * 440 * fd = opendir(path); 441 * while ((dent = readdir(fd))) 442 * unlinkat(dirfd(fd), dent->d_name, 0); 443 * closedir(fd); 444 * 445 * POSIX leaves unspecified what readdir() should return once the 446 * directory has been modified after opendir()/rewinddir(), so this 447 * pattern is not guaranteed to work on all filesystems or platforms. 448 * 449 * In ntfs3 the internal name tree may be reshaped while entries are 450 * being removed, so there is no stable anchor for continuing a 451 * single-pass walk based on the original readdir() order. 452 * 453 * In practice some widely used tools (for example certain rm(1) 454 * implementations) have used this readdir()/unlink() loop, and some 455 * filesystems behave in a way that effectively makes it work in the 456 * common case. 457 * 458 * The code below follows that practice and tries to provide 459 * "rmdir-like" behaviour for such callers on ntfs3, even though the 460 * situation is not strictly defined by the APIs. 461 * 462 * Apple documents the same readdir()/unlink() issue and a workaround 463 * for HFS file systems in: 464 * https://web.archive.org/web/20220122122948/https:/support.apple.com/kb/TA21420?locale=en_US 465 */ 466 ctx->pos = pos = 3; 467 file->private_data = (void *)ni->dir.version; 468 } 469 470 if (!dir_emit_dots(file, ctx)) 471 return 0; 472 473 name = kmalloc(PATH_MAX, GFP_KERNEL); 474 if (!name) 475 return -ENOMEM; 476 477 if (!ni->mi_loaded && ni->attr_list.size) { 478 /* 479 * Directory inode is locked for read. 480 * Load all subrecords to avoid 'write' access to 'ni' during 481 * directory reading. 482 */ 483 ni_lock(ni); 484 if (!ni->mi_loaded && ni->attr_list.size) { 485 err = ni_load_all_mi(ni); 486 if (!err) 487 ni->mi_loaded = true; 488 } 489 ni_unlock(ni); 490 if (err) 491 goto out; 492 } 493 494 /* 495 * Keep directory metadata stable for the whole walk. Loading subrecords 496 * once is not enough if concurrent writeback can still compact ATTR_LIST 497 * entries and free the record that ntfs_read_hdr() is currently walking. 498 */ 499 ni_lock(ni); 500 501 root = indx_get_root(&ni->dir, ni, NULL, NULL); 502 if (!root) { 503 err = -EINVAL; 504 goto out_unlock; 505 } 506 507 if (pos >= sbi->record_size) { 508 bit = (pos - sbi->record_size) >> index_bits; 509 } else { 510 /* 511 * Add each name from root in 'ctx'. 512 */ 513 err = ntfs_read_hdr(sbi, ni, &root->ihdr, 0, pos, name, ctx); 514 if (err) 515 goto out_unlock; 516 bit = 0; 517 } 518 519 /* 520 * Enumerate indexes until the end of dir. 521 */ 522 for (; bit < max_bit; bit += 1) { 523 /* Get the next used index. */ 524 err = indx_used_bit(&ni->dir, ni, &bit); 525 if (err) 526 goto out_unlock; 527 528 if (bit == MINUS_ONE_T) { 529 /* no more used indexes. end of dir. */ 530 break; 531 } 532 533 if (bit >= max_bit) { 534 /* Corrupted directory. */ 535 err = -EINVAL; 536 goto out_unlock; 537 } 538 539 err = indx_read_ra(&ni->dir, ni, bit << ni->dir.idx2vbn_bits, 540 &node, &file->f_ra); 541 if (err) 542 goto out_unlock; 543 544 /* 545 * Add each name from index in 'ctx'. 546 */ 547 err = ntfs_read_hdr(sbi, ni, &node->index->ihdr, 548 ((u64)bit << index_bits) + sbi->record_size, 549 pos, name, ctx); 550 if (err) 551 goto out_unlock; 552 } 553 554 out_unlock: 555 ni_unlock(ni); 556 557 out: 558 kfree(name); 559 put_indx_node(node); 560 561 if (!err) { 562 /* End of directory. */ 563 ctx->pos = eod; 564 } else if (err == 1) { 565 /* 'ctx' is full. */ 566 err = 0; 567 } else if (err == -ENOENT) { 568 err = 0; 569 ctx->pos = pos; 570 } else if (err < 0) { 571 if (err == -EINVAL) 572 _ntfs_bad_inode(dir); 573 ctx->pos = eod; 574 } 575 576 return err; 577 } 578 579 static int ntfs_dir_count(struct inode *dir, bool *is_empty, size_t *dirs, 580 size_t *files) 581 { 582 int err = 0; 583 struct ntfs_inode *ni = ntfs_i(dir); 584 struct NTFS_DE *e = NULL; 585 struct INDEX_ROOT *root; 586 struct INDEX_HDR *hdr; 587 const struct ATTR_FILE_NAME *fname; 588 u32 e_size, off, end; 589 size_t drs = 0, fles = 0, bit = 0; 590 struct indx_node *node = NULL; 591 size_t max_indx = i_size_read(&ni->vfs_inode) >> ni->dir.index_bits; 592 593 if (is_empty) 594 *is_empty = true; 595 596 root = indx_get_root(&ni->dir, ni, NULL, NULL); 597 if (!root) 598 return -EINVAL; 599 600 hdr = &root->ihdr; 601 602 for (;;) { 603 end = le32_to_cpu(hdr->used); 604 off = le32_to_cpu(hdr->de_off); 605 606 for (; off + sizeof(struct NTFS_DE) <= end; off += e_size) { 607 e = Add2Ptr(hdr, off); 608 e_size = le16_to_cpu(e->size); 609 if (e_size < sizeof(struct NTFS_DE) || 610 off + e_size > end) { 611 /* Looks like corruption. */ 612 break; 613 } 614 615 if (de_is_last(e)) 616 break; 617 618 fname = de_get_fname(e); 619 if (!fname) 620 continue; 621 622 if (fname->type == FILE_NAME_DOS) 623 continue; 624 625 if (is_empty) { 626 *is_empty = false; 627 if (!dirs && !files) 628 goto out; 629 } 630 631 if (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) 632 drs += 1; 633 else 634 fles += 1; 635 } 636 637 if (bit >= max_indx) 638 goto out; 639 640 err = indx_used_bit(&ni->dir, ni, &bit); 641 if (err) 642 goto out; 643 644 if (bit == MINUS_ONE_T) 645 goto out; 646 647 if (bit >= max_indx) 648 goto out; 649 650 err = indx_read(&ni->dir, ni, bit << ni->dir.idx2vbn_bits, 651 &node); 652 if (err) 653 goto out; 654 655 hdr = &node->index->ihdr; 656 bit += 1; 657 } 658 659 out: 660 put_indx_node(node); 661 if (dirs) 662 *dirs = drs; 663 if (files) 664 *files = fles; 665 666 return err; 667 } 668 669 bool dir_is_empty(struct inode *dir) 670 { 671 bool is_empty = false; 672 673 ntfs_dir_count(dir, &is_empty, NULL, NULL); 674 675 return is_empty; 676 } 677 678 // clang-format off 679 const struct file_operations ntfs_dir_operations = { 680 .llseek = generic_file_llseek, 681 .read = generic_read_dir, 682 .iterate_shared = ntfs_readdir, 683 .fsync = ntfs_file_fsync, 684 .open = ntfs_file_open, 685 .unlocked_ioctl = ntfs_ioctl, 686 #ifdef CONFIG_COMPAT 687 .compat_ioctl = ntfs_compat_ioctl, 688 #endif 689 .setlease = generic_setlease, 690 }; 691 // clang-format on 692