xref: /linux/fs/ntfs3/index.c (revision ca220141fa8ebae09765a242076b2b77338106b0)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *
4  * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved.
5  *
6  */
7 
8 #include <linux/blkdev.h>
9 #include <linux/buffer_head.h>
10 #include <linux/fs.h>
11 #include <linux/kernel.h>
12 
13 #include "debug.h"
14 #include "ntfs.h"
15 #include "ntfs_fs.h"
16 
17 static const struct INDEX_NAMES {
18 	const __le16 *name;
19 	u8 name_len;
20 } s_index_names[INDEX_MUTEX_TOTAL] = {
21 	{ I30_NAME, ARRAY_SIZE(I30_NAME) }, { SII_NAME, ARRAY_SIZE(SII_NAME) },
22 	{ SDH_NAME, ARRAY_SIZE(SDH_NAME) }, { SO_NAME, ARRAY_SIZE(SO_NAME) },
23 	{ SQ_NAME, ARRAY_SIZE(SQ_NAME) },   { SR_NAME, ARRAY_SIZE(SR_NAME) },
24 };
25 
26 /*
27  * cmp_fnames - Compare two names in index.
28  *
29  * if l1 != 0
30  *   Both names are little endian on-disk ATTR_FILE_NAME structs.
31  * else
32  *   key1 - cpu_str, key2 - ATTR_FILE_NAME
33  */
34 static int cmp_fnames(const void *key1, size_t l1, const void *key2, size_t l2,
35 		      const void *data)
36 {
37 	const struct ATTR_FILE_NAME *f2 = key2;
38 	const struct ntfs_sb_info *sbi = data;
39 	const struct ATTR_FILE_NAME *f1;
40 	u16 fsize2;
41 	bool both_case;
42 
43 	if (l2 <= offsetof(struct ATTR_FILE_NAME, name))
44 		return -1;
45 
46 	fsize2 = fname_full_size(f2);
47 	if (l2 < fsize2)
48 		return -1;
49 
50 	both_case = f2->type != FILE_NAME_DOS && !sbi->options->nocase;
51 	if (!l1) {
52 		const struct le_str *s2 = (struct le_str *)&f2->name_len;
53 
54 		/*
55 		 * If names are equal (case insensitive)
56 		 * try to compare it case sensitive.
57 		 */
58 		return ntfs_cmp_names_cpu(key1, s2, sbi->upcase, both_case);
59 	}
60 
61 	f1 = key1;
62 	return ntfs_cmp_names(f1->name, f1->name_len, f2->name, f2->name_len,
63 			      sbi->upcase, both_case);
64 }
65 
66 /*
67  * cmp_uint - $SII of $Secure and $Q of Quota
68  */
69 static int cmp_uint(const void *key1, size_t l1, const void *key2, size_t l2,
70 		    const void *data)
71 {
72 	const u32 *k1 = key1;
73 	const u32 *k2 = key2;
74 
75 	if (l2 < sizeof(u32))
76 		return -1;
77 
78 	if (*k1 < *k2)
79 		return -1;
80 	if (*k1 > *k2)
81 		return 1;
82 	return 0;
83 }
84 
85 /*
86  * cmp_sdh - $SDH of $Secure
87  */
88 static int cmp_sdh(const void *key1, size_t l1, const void *key2, size_t l2,
89 		   const void *data)
90 {
91 	const struct SECURITY_KEY *k1 = key1;
92 	const struct SECURITY_KEY *k2 = key2;
93 	u32 t1, t2;
94 
95 	if (l2 < sizeof(struct SECURITY_KEY))
96 		return -1;
97 
98 	t1 = le32_to_cpu(k1->hash);
99 	t2 = le32_to_cpu(k2->hash);
100 
101 	/* First value is a hash value itself. */
102 	if (t1 < t2)
103 		return -1;
104 	if (t1 > t2)
105 		return 1;
106 
107 	/* Second value is security Id. */
108 	if (data) {
109 		t1 = le32_to_cpu(k1->sec_id);
110 		t2 = le32_to_cpu(k2->sec_id);
111 		if (t1 < t2)
112 			return -1;
113 		if (t1 > t2)
114 			return 1;
115 	}
116 
117 	return 0;
118 }
119 
120 /*
121  * cmp_uints - $O of ObjId and "$R" for Reparse.
122  */
123 static int cmp_uints(const void *key1, size_t l1, const void *key2, size_t l2,
124 		     const void *data)
125 {
126 	const __le32 *k1 = key1;
127 	const __le32 *k2 = key2;
128 	size_t count;
129 
130 	if ((size_t)data == 1) {
131 		/*
132 		 * ni_delete_all -> ntfs_remove_reparse ->
133 		 * delete all with this reference.
134 		 * k1, k2 - pointers to REPARSE_KEY
135 		 */
136 
137 		k1 += 1; // Skip REPARSE_KEY.ReparseTag
138 		k2 += 1; // Skip REPARSE_KEY.ReparseTag
139 		if (l2 <= sizeof(int))
140 			return -1;
141 		l2 -= sizeof(int);
142 		if (l1 <= sizeof(int))
143 			return 1;
144 		l1 -= sizeof(int);
145 	}
146 
147 	if (l2 < sizeof(int))
148 		return -1;
149 
150 	for (count = min(l1, l2) >> 2; count > 0; --count, ++k1, ++k2) {
151 		u32 t1 = le32_to_cpu(*k1);
152 		u32 t2 = le32_to_cpu(*k2);
153 
154 		if (t1 > t2)
155 			return 1;
156 		if (t1 < t2)
157 			return -1;
158 	}
159 
160 	if (l1 > l2)
161 		return 1;
162 	if (l1 < l2)
163 		return -1;
164 
165 	return 0;
166 }
167 
168 static inline NTFS_CMP_FUNC get_cmp_func(const struct INDEX_ROOT *root)
169 {
170 	switch (root->type) {
171 	case ATTR_NAME:
172 		if (root->rule == NTFS_COLLATION_TYPE_FILENAME)
173 			return &cmp_fnames;
174 		break;
175 	case ATTR_ZERO:
176 		switch (root->rule) {
177 		case NTFS_COLLATION_TYPE_UINT:
178 			return &cmp_uint;
179 		case NTFS_COLLATION_TYPE_SECURITY_HASH:
180 			return &cmp_sdh;
181 		case NTFS_COLLATION_TYPE_UINTS:
182 			return &cmp_uints;
183 		default:
184 			break;
185 		}
186 		break;
187 	default:
188 		break;
189 	}
190 
191 	return NULL;
192 }
193 
194 struct bmp_buf {
195 	struct ATTRIB *b;
196 	struct mft_inode *mi;
197 	struct buffer_head *bh;
198 	ulong *buf;
199 	size_t bit;
200 	u32 nbits;
201 	u64 new_valid;
202 };
203 
204 static int bmp_buf_get(struct ntfs_index *indx, struct ntfs_inode *ni,
205 		       size_t bit, struct bmp_buf *bbuf)
206 {
207 	struct ATTRIB *b;
208 	size_t data_size, valid_size, vbo, off = bit >> 3;
209 	struct ntfs_sb_info *sbi = ni->mi.sbi;
210 	CLST vcn = off >> sbi->cluster_bits;
211 	struct ATTR_LIST_ENTRY *le = NULL;
212 	struct buffer_head *bh;
213 	struct super_block *sb;
214 	u32 blocksize;
215 	const struct INDEX_NAMES *in = &s_index_names[indx->type];
216 
217 	bbuf->bh = NULL;
218 
219 	b = ni_find_attr(ni, NULL, &le, ATTR_BITMAP, in->name, in->name_len,
220 			 &vcn, &bbuf->mi);
221 	bbuf->b = b;
222 	if (!b)
223 		return -EINVAL;
224 
225 	if (!b->non_res) {
226 		data_size = le32_to_cpu(b->res.data_size);
227 
228 		if (off >= data_size)
229 			return -EINVAL;
230 
231 		bbuf->buf = (ulong *)resident_data(b);
232 		bbuf->bit = 0;
233 		bbuf->nbits = data_size * 8;
234 
235 		return 0;
236 	}
237 
238 	data_size = le64_to_cpu(b->nres.data_size);
239 	if (WARN_ON(off >= data_size)) {
240 		/* Looks like filesystem error. */
241 		return -EINVAL;
242 	}
243 
244 	valid_size = le64_to_cpu(b->nres.valid_size);
245 
246 	bh = ntfs_bread_run(sbi, &indx->bitmap_run, off);
247 	if (!bh)
248 		return -EIO;
249 
250 	if (IS_ERR(bh))
251 		return PTR_ERR(bh);
252 
253 	bbuf->bh = bh;
254 
255 	wait_on_buffer(bh);
256 	lock_buffer(bh);
257 
258 	sb = sbi->sb;
259 	blocksize = sb->s_blocksize;
260 
261 	vbo = off & ~(size_t)sbi->block_mask;
262 
263 	bbuf->new_valid = vbo + blocksize;
264 	if (bbuf->new_valid <= valid_size)
265 		bbuf->new_valid = 0;
266 	else if (bbuf->new_valid > data_size)
267 		bbuf->new_valid = data_size;
268 
269 	if (vbo >= valid_size) {
270 		memset(bh->b_data, 0, blocksize);
271 	} else if (vbo + blocksize > valid_size) {
272 		u32 voff = valid_size & sbi->block_mask;
273 
274 		memset(bh->b_data + voff, 0, blocksize - voff);
275 	}
276 
277 	bbuf->buf = (ulong *)bh->b_data;
278 	bbuf->bit = 8 * (off & ~(size_t)sbi->block_mask);
279 	bbuf->nbits = 8 * blocksize;
280 
281 	return 0;
282 }
283 
284 static void bmp_buf_put(struct bmp_buf *bbuf, bool dirty)
285 {
286 	struct buffer_head *bh = bbuf->bh;
287 	struct ATTRIB *b = bbuf->b;
288 
289 	if (!bh) {
290 		if (b && !b->non_res && dirty)
291 			bbuf->mi->dirty = true;
292 		return;
293 	}
294 
295 	if (!dirty)
296 		goto out;
297 
298 	if (bbuf->new_valid) {
299 		b->nres.valid_size = cpu_to_le64(bbuf->new_valid);
300 		bbuf->mi->dirty = true;
301 	}
302 
303 	set_buffer_uptodate(bh);
304 	mark_buffer_dirty(bh);
305 
306 out:
307 	unlock_buffer(bh);
308 	put_bh(bh);
309 }
310 
311 /*
312  * indx_mark_used - Mark the bit @bit as used.
313  */
314 static int indx_mark_used(struct ntfs_index *indx, struct ntfs_inode *ni,
315 			  size_t bit)
316 {
317 	int err;
318 	struct bmp_buf bbuf;
319 
320 	err = bmp_buf_get(indx, ni, bit, &bbuf);
321 	if (err)
322 		return err;
323 
324 	__set_bit_le(bit - bbuf.bit, bbuf.buf);
325 
326 	bmp_buf_put(&bbuf, true);
327 
328 	return 0;
329 }
330 
331 /*
332  * indx_mark_free - Mark the bit @bit as free.
333  */
334 static int indx_mark_free(struct ntfs_index *indx, struct ntfs_inode *ni,
335 			  size_t bit)
336 {
337 	int err;
338 	struct bmp_buf bbuf;
339 
340 	err = bmp_buf_get(indx, ni, bit, &bbuf);
341 	if (err)
342 		return err;
343 
344 	__clear_bit_le(bit - bbuf.bit, bbuf.buf);
345 
346 	bmp_buf_put(&bbuf, true);
347 
348 	return 0;
349 }
350 
351 /*
352  * scan_nres_bitmap
353  *
354  * If ntfs_readdir calls this function (indx_used_bit -> scan_nres_bitmap),
355  * inode is shared locked and no ni_lock.
356  * Use rw_semaphore for read/write access to bitmap_run.
357  */
358 static int scan_nres_bitmap(struct ntfs_inode *ni, struct ATTRIB *bitmap,
359 			    struct ntfs_index *indx, size_t from,
360 			    bool (*fn)(const ulong *buf, u32 bit, u32 bits,
361 				       size_t *ret),
362 			    size_t *ret)
363 {
364 	struct ntfs_sb_info *sbi = ni->mi.sbi;
365 	struct super_block *sb = sbi->sb;
366 	struct runs_tree *run = &indx->bitmap_run;
367 	struct rw_semaphore *lock = &indx->run_lock;
368 	u32 nbits = sb->s_blocksize * 8;
369 	u32 blocksize = sb->s_blocksize;
370 	u64 valid_size = le64_to_cpu(bitmap->nres.valid_size);
371 	u64 data_size = le64_to_cpu(bitmap->nres.data_size);
372 	sector_t eblock = bytes_to_block(sb, data_size);
373 	size_t vbo = from >> 3;
374 	sector_t blk = (vbo & sbi->cluster_mask) >> sb->s_blocksize_bits;
375 	sector_t vblock = vbo >> sb->s_blocksize_bits;
376 	sector_t blen, block;
377 	CLST lcn, clen, vcn, vcn_next;
378 	size_t idx;
379 	struct buffer_head *bh;
380 	bool ok;
381 
382 	*ret = MINUS_ONE_T;
383 
384 	if (vblock >= eblock)
385 		return 0;
386 
387 	from &= nbits - 1;
388 	vcn = vbo >> sbi->cluster_bits;
389 
390 	down_read(lock);
391 	ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx);
392 	up_read(lock);
393 
394 next_run:
395 	if (!ok) {
396 		int err;
397 		const struct INDEX_NAMES *name = &s_index_names[indx->type];
398 
399 		down_write(lock);
400 		err = attr_load_runs_vcn(ni, ATTR_BITMAP, name->name,
401 					 name->name_len, run, vcn);
402 		up_write(lock);
403 		if (err)
404 			return err;
405 		down_read(lock);
406 		ok = run_lookup_entry(run, vcn, &lcn, &clen, &idx);
407 		up_read(lock);
408 		if (!ok)
409 			return -EINVAL;
410 	}
411 
412 	blen = (sector_t)clen * sbi->blocks_per_cluster;
413 	block = (sector_t)lcn * sbi->blocks_per_cluster;
414 
415 	for (; blk < blen; blk++, from = 0) {
416 		bh = ntfs_bread(sb, block + blk);
417 		if (!bh)
418 			return -EIO;
419 
420 		vbo = (u64)vblock << sb->s_blocksize_bits;
421 		if (vbo >= valid_size) {
422 			memset(bh->b_data, 0, blocksize);
423 		} else if (vbo + blocksize > valid_size) {
424 			u32 voff = valid_size & sbi->block_mask;
425 
426 			memset(bh->b_data + voff, 0, blocksize - voff);
427 		}
428 
429 		if (vbo + blocksize > data_size)
430 			nbits = 8 * (data_size - vbo);
431 
432 		ok = nbits > from ?
433 			     (*fn)((ulong *)bh->b_data, from, nbits, ret) :
434 			     false;
435 		put_bh(bh);
436 
437 		if (ok) {
438 			*ret += 8 * vbo;
439 			return 0;
440 		}
441 
442 		if (++vblock >= eblock) {
443 			*ret = MINUS_ONE_T;
444 			return 0;
445 		}
446 	}
447 	blk = 0;
448 	vcn_next = vcn + clen;
449 	down_read(lock);
450 	ok = run_get_entry(run, ++idx, &vcn, &lcn, &clen) && vcn == vcn_next;
451 	if (!ok)
452 		vcn = vcn_next;
453 	up_read(lock);
454 	goto next_run;
455 }
456 
457 static bool scan_for_free(const ulong *buf, u32 bit, u32 bits, size_t *ret)
458 {
459 	size_t pos = find_next_zero_bit_le(buf, bits, bit);
460 
461 	if (pos >= bits)
462 		return false;
463 	*ret = pos;
464 	return true;
465 }
466 
467 /*
468  * indx_find_free - Look for free bit.
469  *
470  * Return: -1 if no free bits.
471  */
472 static int indx_find_free(struct ntfs_index *indx, struct ntfs_inode *ni,
473 			  size_t *bit, struct ATTRIB **bitmap)
474 {
475 	struct ATTRIB *b;
476 	struct ATTR_LIST_ENTRY *le = NULL;
477 	const struct INDEX_NAMES *in = &s_index_names[indx->type];
478 	int err;
479 
480 	b = ni_find_attr(ni, NULL, &le, ATTR_BITMAP, in->name, in->name_len,
481 			 NULL, NULL);
482 
483 	if (!b)
484 		return -ENOENT;
485 
486 	*bitmap = b;
487 	*bit = MINUS_ONE_T;
488 
489 	if (!b->non_res) {
490 		u32 nbits = 8 * le32_to_cpu(b->res.data_size);
491 		size_t pos = find_next_zero_bit_le(resident_data(b), nbits, 0);
492 
493 		if (pos < nbits)
494 			*bit = pos;
495 	} else {
496 		err = scan_nres_bitmap(ni, b, indx, 0, &scan_for_free, bit);
497 
498 		if (err)
499 			return err;
500 	}
501 
502 	return 0;
503 }
504 
505 static bool scan_for_used(const ulong *buf, u32 bit, u32 bits, size_t *ret)
506 {
507 	size_t pos = find_next_bit_le(buf, bits, bit);
508 
509 	if (pos >= bits)
510 		return false;
511 	*ret = pos;
512 	return true;
513 }
514 
515 /*
516  * indx_used_bit - Look for used bit.
517  *
518  * Return: MINUS_ONE_T if no used bits.
519  */
520 int indx_used_bit(struct ntfs_index *indx, struct ntfs_inode *ni, size_t *bit)
521 {
522 	struct ATTRIB *b;
523 	struct ATTR_LIST_ENTRY *le = NULL;
524 	size_t from = *bit;
525 	const struct INDEX_NAMES *in = &s_index_names[indx->type];
526 	int err;
527 
528 	b = ni_find_attr(ni, NULL, &le, ATTR_BITMAP, in->name, in->name_len,
529 			 NULL, NULL);
530 
531 	if (!b)
532 		return -ENOENT;
533 
534 	*bit = MINUS_ONE_T;
535 
536 	if (!b->non_res) {
537 		u32 nbits = le32_to_cpu(b->res.data_size) * 8;
538 		size_t pos = find_next_bit_le(resident_data(b), nbits, from);
539 
540 		if (pos < nbits)
541 			*bit = pos;
542 	} else {
543 		err = scan_nres_bitmap(ni, b, indx, from, &scan_for_used, bit);
544 		if (err)
545 			return err;
546 	}
547 
548 	return 0;
549 }
550 
551 /*
552  * hdr_find_split
553  *
554  * Find a point at which the index allocation buffer would like to be split.
555  * NOTE: This function should never return 'END' entry NULL returns on error.
556  */
557 static const struct NTFS_DE *hdr_find_split(const struct INDEX_HDR *hdr)
558 {
559 	size_t o;
560 	const struct NTFS_DE *e = hdr_first_de(hdr);
561 	u32 used_2 = le32_to_cpu(hdr->used) >> 1;
562 	u16 esize;
563 
564 	if (!e || de_is_last(e))
565 		return NULL;
566 
567 	esize = le16_to_cpu(e->size);
568 	for (o = le32_to_cpu(hdr->de_off) + esize; o < used_2; o += esize) {
569 		const struct NTFS_DE *p = e;
570 
571 		e = Add2Ptr(hdr, o);
572 
573 		/* We must not return END entry. */
574 		if (de_is_last(e))
575 			return p;
576 
577 		esize = le16_to_cpu(e->size);
578 	}
579 
580 	return e;
581 }
582 
583 /*
584  * hdr_insert_head - Insert some entries at the beginning of the buffer.
585  *
586  * It is used to insert entries into a newly-created buffer.
587  */
588 static const struct NTFS_DE *hdr_insert_head(struct INDEX_HDR *hdr,
589 					     const void *ins, u32 ins_bytes)
590 {
591 	u32 to_move;
592 	struct NTFS_DE *e = hdr_first_de(hdr);
593 	u32 used = le32_to_cpu(hdr->used);
594 
595 	if (!e)
596 		return NULL;
597 
598 	/* Now we just make room for the inserted entries and jam it in. */
599 	to_move = used - le32_to_cpu(hdr->de_off);
600 	memmove(Add2Ptr(e, ins_bytes), e, to_move);
601 	memcpy(e, ins, ins_bytes);
602 	hdr->used = cpu_to_le32(used + ins_bytes);
603 
604 	return e;
605 }
606 
607 /*
608  * index_hdr_check
609  *
610  * return true if INDEX_HDR is valid
611  */
612 static bool index_hdr_check(const struct INDEX_HDR *hdr, u32 bytes)
613 {
614 	u32 end = le32_to_cpu(hdr->used);
615 	u32 tot = le32_to_cpu(hdr->total);
616 	u32 off = le32_to_cpu(hdr->de_off);
617 
618 	if (!IS_ALIGNED(off, 8) || tot > bytes || end > tot ||
619 	    size_add(off, sizeof(struct NTFS_DE)) > end) {
620 		/* incorrect index buffer. */
621 		return false;
622 	}
623 
624 	return true;
625 }
626 
627 /*
628  * index_buf_check
629  *
630  * return true if INDEX_BUFFER seems is valid
631  */
632 static bool index_buf_check(const struct INDEX_BUFFER *ib, u32 bytes,
633 			    const CLST *vbn)
634 {
635 	const struct NTFS_RECORD_HEADER *rhdr = &ib->rhdr;
636 	u16 fo = le16_to_cpu(rhdr->fix_off);
637 	u16 fn = le16_to_cpu(rhdr->fix_num);
638 
639 	if (bytes <= offsetof(struct INDEX_BUFFER, ihdr) ||
640 	    rhdr->sign != NTFS_INDX_SIGNATURE ||
641 	    fo < sizeof(struct INDEX_BUFFER)
642 	    /* Check index buffer vbn. */
643 	    || (vbn && *vbn != le64_to_cpu(ib->vbn)) || (fo % sizeof(short)) ||
644 	    fo + fn * sizeof(short) >= bytes ||
645 	    fn != ((bytes >> SECTOR_SHIFT) + 1)) {
646 		/* incorrect index buffer. */
647 		return false;
648 	}
649 
650 	return index_hdr_check(&ib->ihdr,
651 			       bytes - offsetof(struct INDEX_BUFFER, ihdr));
652 }
653 
654 void fnd_clear(struct ntfs_fnd *fnd)
655 {
656 	int i;
657 
658 	for (i = fnd->level - 1; i >= 0; i--) {
659 		struct indx_node *n = fnd->nodes[i];
660 
661 		if (!n)
662 			continue;
663 
664 		put_indx_node(n);
665 		fnd->nodes[i] = NULL;
666 	}
667 	fnd->level = 0;
668 	fnd->root_de = NULL;
669 }
670 
671 static int fnd_push(struct ntfs_fnd *fnd, struct indx_node *n,
672 		    struct NTFS_DE *e)
673 {
674 	int i = fnd->level;
675 
676 	if (i < 0 || i >= ARRAY_SIZE(fnd->nodes))
677 		return -EINVAL;
678 	fnd->nodes[i] = n;
679 	fnd->de[i] = e;
680 	fnd->level += 1;
681 	return 0;
682 }
683 
684 static struct indx_node *fnd_pop(struct ntfs_fnd *fnd)
685 {
686 	struct indx_node *n;
687 	int i = fnd->level;
688 
689 	i -= 1;
690 	n = fnd->nodes[i];
691 	fnd->nodes[i] = NULL;
692 	fnd->level = i;
693 
694 	return n;
695 }
696 
697 static bool fnd_is_empty(struct ntfs_fnd *fnd)
698 {
699 	if (!fnd->level)
700 		return !fnd->root_de;
701 
702 	return !fnd->de[fnd->level - 1];
703 }
704 
705 /*
706  * hdr_find_e - Locate an entry the index buffer.
707  *
708  * If no matching entry is found, it returns the first entry which is greater
709  * than the desired entry If the search key is greater than all the entries the
710  * buffer, it returns the 'end' entry. This function does a binary search of the
711  * current index buffer, for the first entry that is <= to the search value.
712  *
713  * Return: NULL if error.
714  */
715 static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx,
716 				  const struct INDEX_HDR *hdr, const void *key,
717 				  size_t key_len, const void *ctx, int *diff)
718 {
719 	struct NTFS_DE *e, *found = NULL;
720 	NTFS_CMP_FUNC cmp = indx->cmp;
721 	int min_idx = 0, mid_idx, max_idx = 0;
722 	int diff2;
723 	int table_size = 8;
724 	u32 e_size, e_key_len;
725 	u32 end = le32_to_cpu(hdr->used);
726 	u32 off = le32_to_cpu(hdr->de_off);
727 	u32 total = le32_to_cpu(hdr->total);
728 	u16 offs[128];
729 
730 	if (unlikely(!cmp))
731 		return NULL;
732 
733 fill_table:
734 	if (end > total)
735 		return NULL;
736 
737 	if (size_add(off, sizeof(struct NTFS_DE)) > end)
738 		return NULL;
739 
740 	e = Add2Ptr(hdr, off);
741 	e_size = le16_to_cpu(e->size);
742 
743 	if (e_size < sizeof(struct NTFS_DE) || off + e_size > end)
744 		return NULL;
745 
746 	if (!de_is_last(e)) {
747 		offs[max_idx] = off;
748 		off += e_size;
749 
750 		max_idx++;
751 		if (max_idx < table_size)
752 			goto fill_table;
753 
754 		max_idx--;
755 	}
756 
757 binary_search:
758 	e_key_len = le16_to_cpu(e->key_size);
759 
760 	diff2 = (*cmp)(key, key_len, e + 1, e_key_len, ctx);
761 	if (diff2 > 0) {
762 		if (found) {
763 			min_idx = mid_idx + 1;
764 		} else {
765 			if (de_is_last(e))
766 				return NULL;
767 
768 			max_idx = 0;
769 			table_size = min(table_size * 2, (int)ARRAY_SIZE(offs));
770 			goto fill_table;
771 		}
772 	} else if (diff2 < 0) {
773 		if (found)
774 			max_idx = mid_idx - 1;
775 		else
776 			max_idx--;
777 
778 		found = e;
779 	} else {
780 		*diff = 0;
781 		return e;
782 	}
783 
784 	if (min_idx > max_idx) {
785 		*diff = -1;
786 		return found;
787 	}
788 
789 	mid_idx = (min_idx + max_idx) >> 1;
790 	e = Add2Ptr(hdr, offs[mid_idx]);
791 
792 	goto binary_search;
793 }
794 
795 /*
796  * hdr_insert_de - Insert an index entry into the buffer.
797  *
798  * 'before' should be a pointer previously returned from hdr_find_e.
799  */
800 static struct NTFS_DE *hdr_insert_de(const struct ntfs_index *indx,
801 				     struct INDEX_HDR *hdr,
802 				     const struct NTFS_DE *de,
803 				     struct NTFS_DE *before, const void *ctx)
804 {
805 	int diff;
806 	size_t off = PtrOffset(hdr, before);
807 	u32 used = le32_to_cpu(hdr->used);
808 	u32 total = le32_to_cpu(hdr->total);
809 	u16 de_size = le16_to_cpu(de->size);
810 
811 	/* First, check to see if there's enough room. */
812 	if (used + de_size > total)
813 		return NULL;
814 
815 	/* We know there's enough space, so we know we'll succeed. */
816 	if (before) {
817 		/* Check that before is inside Index. */
818 		if (off >= used || off < le32_to_cpu(hdr->de_off) ||
819 		    off + le16_to_cpu(before->size) > total) {
820 			return NULL;
821 		}
822 		goto ok;
823 	}
824 	/* No insert point is applied. Get it manually. */
825 	before = hdr_find_e(indx, hdr, de + 1, le16_to_cpu(de->key_size), ctx,
826 			    &diff);
827 	if (!before)
828 		return NULL;
829 	off = PtrOffset(hdr, before);
830 
831 ok:
832 	/* Now we just make room for the entry and jam it in. */
833 	memmove(Add2Ptr(before, de_size), before, used - off);
834 
835 	hdr->used = cpu_to_le32(used + de_size);
836 	memcpy(before, de, de_size);
837 
838 	return before;
839 }
840 
841 /*
842  * hdr_delete_de - Remove an entry from the index buffer.
843  */
844 static inline struct NTFS_DE *hdr_delete_de(struct INDEX_HDR *hdr,
845 					    struct NTFS_DE *re)
846 {
847 	u32 used = le32_to_cpu(hdr->used);
848 	u16 esize = le16_to_cpu(re->size);
849 	u32 off = PtrOffset(hdr, re);
850 	int bytes = used - (off + esize);
851 
852 	/* check INDEX_HDR valid before using INDEX_HDR */
853 	if (!check_index_header(hdr, le32_to_cpu(hdr->total)))
854 		return NULL;
855 
856 	if (off >= used || esize < sizeof(struct NTFS_DE) ||
857 	    bytes < sizeof(struct NTFS_DE))
858 		return NULL;
859 
860 	hdr->used = cpu_to_le32(used - esize);
861 	memmove(re, Add2Ptr(re, esize), bytes);
862 
863 	return re;
864 }
865 
866 void indx_clear(struct ntfs_index *indx)
867 {
868 	run_close(&indx->alloc_run);
869 	run_close(&indx->bitmap_run);
870 }
871 
872 int indx_init(struct ntfs_index *indx, struct ntfs_sb_info *sbi,
873 	      const struct ATTRIB *attr, enum index_mutex_classed type)
874 {
875 	u32 t32;
876 	const struct INDEX_ROOT *root = resident_data(attr);
877 
878 	t32 = le32_to_cpu(attr->res.data_size);
879 	if (t32 <= offsetof(struct INDEX_ROOT, ihdr) ||
880 	    !index_hdr_check(&root->ihdr,
881 			     t32 - offsetof(struct INDEX_ROOT, ihdr))) {
882 		goto out;
883 	}
884 
885 	/* Check root fields. */
886 	if (!root->index_block_clst)
887 		goto out;
888 
889 	indx->type = type;
890 	indx->idx2vbn_bits = __ffs(root->index_block_clst);
891 
892 	t32 = le32_to_cpu(root->index_block_size);
893 	indx->index_bits = blksize_bits(t32);
894 
895 	/* Check index record size. */
896 	if (t32 < sbi->cluster_size) {
897 		/* Index record is smaller than a cluster, use 512 blocks. */
898 		if (t32 != root->index_block_clst * SECTOR_SIZE)
899 			goto out;
900 
901 		/* Check alignment to a cluster. */
902 		if ((sbi->cluster_size >> SECTOR_SHIFT) &
903 		    (root->index_block_clst - 1)) {
904 			goto out;
905 		}
906 
907 		indx->vbn2vbo_bits = SECTOR_SHIFT;
908 	} else {
909 		/* Index record must be a multiple of cluster size. */
910 		if (t32 != root->index_block_clst << sbi->cluster_bits)
911 			goto out;
912 
913 		indx->vbn2vbo_bits = sbi->cluster_bits;
914 	}
915 
916 	init_rwsem(&indx->run_lock);
917 
918 	indx->cmp = get_cmp_func(root);
919 	if (!indx->cmp)
920 		goto out;
921 
922 	return 0;
923 
924 out:
925 	ntfs_set_state(sbi, NTFS_DIRTY_DIRTY);
926 	return -EINVAL;
927 }
928 
929 static struct indx_node *indx_new(struct ntfs_index *indx,
930 				  struct ntfs_inode *ni, CLST vbn,
931 				  const __le64 *sub_vbn)
932 {
933 	int err;
934 	struct NTFS_DE *e;
935 	struct indx_node *r;
936 	struct INDEX_HDR *hdr;
937 	struct INDEX_BUFFER *index;
938 	u64 vbo = (u64)vbn << indx->vbn2vbo_bits;
939 	u32 bytes = 1u << indx->index_bits;
940 	u16 fn;
941 	u32 eo;
942 
943 	r = kzalloc(sizeof(struct indx_node), GFP_NOFS);
944 	if (!r)
945 		return ERR_PTR(-ENOMEM);
946 
947 	index = kzalloc(bytes, GFP_NOFS);
948 	if (!index) {
949 		kfree(r);
950 		return ERR_PTR(-ENOMEM);
951 	}
952 
953 	err = ntfs_get_bh(ni->mi.sbi, &indx->alloc_run, vbo, bytes, &r->nb);
954 
955 	if (err) {
956 		kfree(index);
957 		kfree(r);
958 		return ERR_PTR(err);
959 	}
960 
961 	/* Create header. */
962 	index->rhdr.sign = NTFS_INDX_SIGNATURE;
963 	index->rhdr.fix_off = cpu_to_le16(sizeof(struct INDEX_BUFFER)); // 0x28
964 	fn = (bytes >> SECTOR_SHIFT) + 1; // 9
965 	index->rhdr.fix_num = cpu_to_le16(fn);
966 	index->vbn = cpu_to_le64(vbn);
967 	hdr = &index->ihdr;
968 	eo = ALIGN(sizeof(struct INDEX_BUFFER) + fn * sizeof(short), 8);
969 	hdr->de_off = cpu_to_le32(eo);
970 
971 	e = Add2Ptr(hdr, eo);
972 
973 	if (sub_vbn) {
974 		e->flags = NTFS_IE_LAST | NTFS_IE_HAS_SUBNODES;
975 		e->size = cpu_to_le16(sizeof(struct NTFS_DE) + sizeof(u64));
976 		hdr->used =
977 			cpu_to_le32(eo + sizeof(struct NTFS_DE) + sizeof(u64));
978 		de_set_vbn_le(e, *sub_vbn);
979 		hdr->flags = NTFS_INDEX_HDR_HAS_SUBNODES;
980 	} else {
981 		e->size = cpu_to_le16(sizeof(struct NTFS_DE));
982 		hdr->used = cpu_to_le32(eo + sizeof(struct NTFS_DE));
983 		e->flags = NTFS_IE_LAST;
984 	}
985 
986 	hdr->total = cpu_to_le32(bytes - offsetof(struct INDEX_BUFFER, ihdr));
987 
988 	r->index = index;
989 	return r;
990 }
991 
992 struct INDEX_ROOT *indx_get_root(struct ntfs_index *indx, struct ntfs_inode *ni,
993 				 struct ATTRIB **attr, struct mft_inode **mi)
994 {
995 	struct ATTR_LIST_ENTRY *le = NULL;
996 	struct ATTRIB *a;
997 	const struct INDEX_NAMES *in = &s_index_names[indx->type];
998 	struct INDEX_ROOT *root;
999 
1000 	a = ni_find_attr(ni, NULL, &le, ATTR_ROOT, in->name, in->name_len, NULL,
1001 			 mi);
1002 	if (!a)
1003 		return NULL;
1004 
1005 	if (attr)
1006 		*attr = a;
1007 
1008 	root = resident_data_ex(a, sizeof(struct INDEX_ROOT));
1009 
1010 	/* length check */
1011 	if (root &&
1012 	    offsetof(struct INDEX_ROOT, ihdr) + le32_to_cpu(root->ihdr.used) >
1013 		    le32_to_cpu(a->res.data_size)) {
1014 		return NULL;
1015 	}
1016 
1017 	return root;
1018 }
1019 
1020 static int indx_write(struct ntfs_index *indx, struct ntfs_inode *ni,
1021 		      struct indx_node *node, int sync)
1022 {
1023 	struct INDEX_BUFFER *ib = node->index;
1024 
1025 	return ntfs_write_bh(ni->mi.sbi, &ib->rhdr, &node->nb, sync);
1026 }
1027 
1028 /*
1029  * indx_read_ra
1030  *
1031  * If ntfs_readdir calls this function
1032  * inode is shared locked and no ni_lock.
1033  * Use rw_semaphore for read/write access to alloc_run.
1034  */
1035 int indx_read_ra(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn,
1036 		 struct indx_node **node, struct file_ra_state *ra)
1037 {
1038 	int err;
1039 	struct INDEX_BUFFER *ib;
1040 	struct ntfs_sb_info *sbi = ni->mi.sbi;
1041 	struct runs_tree *run = &indx->alloc_run;
1042 	struct rw_semaphore *lock = &indx->run_lock;
1043 	u64 vbo = (u64)vbn << indx->vbn2vbo_bits;
1044 	u32 bytes = 1u << indx->index_bits;
1045 	struct indx_node *in = *node;
1046 	const struct INDEX_NAMES *name;
1047 
1048 	if (!in) {
1049 		in = kzalloc(sizeof(struct indx_node), GFP_NOFS);
1050 		if (!in)
1051 			return -ENOMEM;
1052 	} else {
1053 		nb_put(&in->nb);
1054 	}
1055 
1056 	ib = in->index;
1057 	if (!ib) {
1058 		ib = kmalloc(bytes, GFP_NOFS);
1059 		if (!ib) {
1060 			err = -ENOMEM;
1061 			goto out;
1062 		}
1063 	}
1064 
1065 	down_read(lock);
1066 	err = ntfs_read_bh_ra(sbi, run, vbo, &ib->rhdr, bytes, &in->nb, ra);
1067 	up_read(lock);
1068 	if (!err)
1069 		goto ok;
1070 
1071 	if (err == -E_NTFS_FIXUP)
1072 		goto ok;
1073 
1074 	if (err != -ENOENT)
1075 		goto out;
1076 
1077 	name = &s_index_names[indx->type];
1078 	down_write(lock);
1079 	err = attr_load_runs_range(ni, ATTR_ALLOC, name->name, name->name_len,
1080 				   run, vbo, vbo + bytes);
1081 	up_write(lock);
1082 	if (err)
1083 		goto out;
1084 
1085 	down_read(lock);
1086 	err = ntfs_read_bh_ra(sbi, run, vbo, &ib->rhdr, bytes, &in->nb, ra);
1087 	up_read(lock);
1088 	if (err == -E_NTFS_FIXUP)
1089 		goto ok;
1090 
1091 	if (err)
1092 		goto out;
1093 
1094 ok:
1095 	if (!index_buf_check(ib, bytes, &vbn)) {
1096 		_ntfs_bad_inode(&ni->vfs_inode);
1097 		err = -EINVAL;
1098 		goto out;
1099 	}
1100 
1101 	if (err == -E_NTFS_FIXUP) {
1102 		ntfs_write_bh(sbi, &ib->rhdr, &in->nb, 0);
1103 		err = 0;
1104 	}
1105 
1106 	/* check for index header length */
1107 	if (offsetof(struct INDEX_BUFFER, ihdr) + le32_to_cpu(ib->ihdr.used) >
1108 	    bytes) {
1109 		err = -EINVAL;
1110 		goto out;
1111 	}
1112 
1113 	in->index = ib;
1114 	*node = in;
1115 
1116 out:
1117 	if (err == -E_NTFS_CORRUPT) {
1118 		_ntfs_bad_inode(&ni->vfs_inode);
1119 		err = -EINVAL;
1120 	}
1121 
1122 	if (ib != in->index)
1123 		kfree(ib);
1124 
1125 	if (*node != in) {
1126 		nb_put(&in->nb);
1127 		kfree(in);
1128 	}
1129 
1130 	return err;
1131 }
1132 
1133 /*
1134  * indx_find - Scan NTFS directory for given entry.
1135  */
1136 int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni,
1137 	      const struct INDEX_ROOT *root, const void *key, size_t key_len,
1138 	      const void *ctx, int *diff, struct NTFS_DE **entry,
1139 	      struct ntfs_fnd *fnd)
1140 {
1141 	int err;
1142 	struct NTFS_DE *e;
1143 	struct indx_node *node;
1144 
1145 	if (!root)
1146 		root = indx_get_root(&ni->dir, ni, NULL, NULL);
1147 
1148 	if (!root) {
1149 		/* Should not happen. */
1150 		return -EINVAL;
1151 	}
1152 
1153 	/* Check cache. */
1154 	e = fnd->level ? fnd->de[fnd->level - 1] : fnd->root_de;
1155 	if (e && !de_is_last(e) &&
1156 	    !(*indx->cmp)(key, key_len, e + 1, le16_to_cpu(e->key_size), ctx)) {
1157 		*entry = e;
1158 		*diff = 0;
1159 		return 0;
1160 	}
1161 
1162 	/* Soft finder reset. */
1163 	fnd_clear(fnd);
1164 
1165 	/* Lookup entry that is <= to the search value. */
1166 	e = hdr_find_e(indx, &root->ihdr, key, key_len, ctx, diff);
1167 	if (!e)
1168 		return -EINVAL;
1169 
1170 	fnd->root_de = e;
1171 
1172 	for (;;) {
1173 		node = NULL;
1174 		if (*diff >= 0 || !de_has_vcn_ex(e))
1175 			break;
1176 
1177 		/* Read next level. */
1178 		err = indx_read(indx, ni, de_get_vbn(e), &node);
1179 		if (err) {
1180 			/* io error? */
1181 			return err;
1182 		}
1183 
1184 		/* Lookup entry that is <= to the search value. */
1185 		e = hdr_find_e(indx, &node->index->ihdr, key, key_len, ctx,
1186 			       diff);
1187 		if (!e) {
1188 			put_indx_node(node);
1189 			return -EINVAL;
1190 		}
1191 
1192 		err = fnd_push(fnd, node, e);
1193 
1194 		if (err) {
1195 			put_indx_node(node);
1196 			return err;
1197 		}
1198 	}
1199 
1200 	*entry = e;
1201 	return 0;
1202 }
1203 
1204 int indx_find_sort(struct ntfs_index *indx, struct ntfs_inode *ni,
1205 		   const struct INDEX_ROOT *root, struct NTFS_DE **entry,
1206 		   struct ntfs_fnd *fnd)
1207 {
1208 	int err;
1209 	struct indx_node *n = NULL;
1210 	struct NTFS_DE *e;
1211 	size_t iter = 0;
1212 	int level = fnd->level;
1213 
1214 	if (!*entry) {
1215 		/* Start find. */
1216 		e = hdr_first_de(&root->ihdr);
1217 		if (!e)
1218 			return 0;
1219 		fnd_clear(fnd);
1220 		fnd->root_de = e;
1221 	} else if (!level) {
1222 		if (de_is_last(fnd->root_de)) {
1223 			*entry = NULL;
1224 			return 0;
1225 		}
1226 
1227 		e = hdr_next_de(&root->ihdr, fnd->root_de);
1228 		if (!e)
1229 			return -EINVAL;
1230 		fnd->root_de = e;
1231 	} else {
1232 		n = fnd->nodes[level - 1];
1233 		e = fnd->de[level - 1];
1234 
1235 		if (de_is_last(e))
1236 			goto pop_level;
1237 
1238 		e = hdr_next_de(&n->index->ihdr, e);
1239 		if (!e)
1240 			return -EINVAL;
1241 
1242 		fnd->de[level - 1] = e;
1243 	}
1244 
1245 	/* Just to avoid tree cycle. */
1246 next_iter:
1247 	if (iter++ >= 1000)
1248 		return -EINVAL;
1249 
1250 	while (de_has_vcn_ex(e)) {
1251 		if (le16_to_cpu(e->size) <
1252 		    sizeof(struct NTFS_DE) + sizeof(u64)) {
1253 			if (n) {
1254 				fnd_pop(fnd);
1255 				kfree(n);
1256 			}
1257 			return -EINVAL;
1258 		}
1259 
1260 		/* Read next level. */
1261 		err = indx_read(indx, ni, de_get_vbn(e), &n);
1262 		if (err)
1263 			return err;
1264 
1265 		/* Try next level. */
1266 		e = hdr_first_de(&n->index->ihdr);
1267 		if (!e) {
1268 			kfree(n);
1269 			return -EINVAL;
1270 		}
1271 
1272 		fnd_push(fnd, n, e);
1273 	}
1274 
1275 	if (le16_to_cpu(e->size) > sizeof(struct NTFS_DE)) {
1276 		*entry = e;
1277 		return 0;
1278 	}
1279 
1280 pop_level:
1281 	for (;;) {
1282 		if (!de_is_last(e))
1283 			goto next_iter;
1284 
1285 		/* Pop one level. */
1286 		if (n) {
1287 			fnd_pop(fnd);
1288 			kfree(n);
1289 		}
1290 
1291 		level = fnd->level;
1292 
1293 		if (level) {
1294 			n = fnd->nodes[level - 1];
1295 			e = fnd->de[level - 1];
1296 		} else if (fnd->root_de) {
1297 			n = NULL;
1298 			e = fnd->root_de;
1299 			fnd->root_de = NULL;
1300 		} else {
1301 			*entry = NULL;
1302 			return 0;
1303 		}
1304 
1305 		if (le16_to_cpu(e->size) > sizeof(struct NTFS_DE)) {
1306 			*entry = e;
1307 			if (!fnd->root_de)
1308 				fnd->root_de = e;
1309 			return 0;
1310 		}
1311 	}
1312 }
1313 
1314 int indx_find_raw(struct ntfs_index *indx, struct ntfs_inode *ni,
1315 		  const struct INDEX_ROOT *root, struct NTFS_DE **entry,
1316 		  size_t *off, struct ntfs_fnd *fnd)
1317 {
1318 	int err;
1319 	struct indx_node *n = NULL;
1320 	struct NTFS_DE *e = NULL;
1321 	struct NTFS_DE *e2;
1322 	size_t bit;
1323 	CLST next_used_vbn;
1324 	CLST next_vbn;
1325 	u32 record_size = ni->mi.sbi->record_size;
1326 
1327 	/* Use non sorted algorithm. */
1328 	if (!*entry) {
1329 		/* This is the first call. */
1330 		e = hdr_first_de(&root->ihdr);
1331 		if (!e)
1332 			return 0;
1333 		fnd_clear(fnd);
1334 		fnd->root_de = e;
1335 
1336 		/* The first call with setup of initial element. */
1337 		if (*off >= record_size) {
1338 			next_vbn = (((*off - record_size) >> indx->index_bits))
1339 				   << indx->idx2vbn_bits;
1340 			/* Jump inside cycle 'for'. */
1341 			goto next;
1342 		}
1343 
1344 		/* Start enumeration from root. */
1345 		*off = 0;
1346 	} else if (!fnd->root_de)
1347 		return -EINVAL;
1348 
1349 	for (;;) {
1350 		/* Check if current entry can be used. */
1351 		if (e && le16_to_cpu(e->size) > sizeof(struct NTFS_DE))
1352 			goto ok;
1353 
1354 		if (!fnd->level) {
1355 			/* Continue to enumerate root. */
1356 			if (!de_is_last(fnd->root_de)) {
1357 				e = hdr_next_de(&root->ihdr, fnd->root_de);
1358 				if (!e)
1359 					return -EINVAL;
1360 				fnd->root_de = e;
1361 				continue;
1362 			}
1363 
1364 			/* Start to enumerate indexes from 0. */
1365 			next_vbn = 0;
1366 		} else {
1367 			/* Continue to enumerate indexes. */
1368 			e2 = fnd->de[fnd->level - 1];
1369 
1370 			n = fnd->nodes[fnd->level - 1];
1371 
1372 			if (!de_is_last(e2)) {
1373 				e = hdr_next_de(&n->index->ihdr, e2);
1374 				if (!e)
1375 					return -EINVAL;
1376 				fnd->de[fnd->level - 1] = e;
1377 				continue;
1378 			}
1379 
1380 			/* Continue with next index. */
1381 			next_vbn = le64_to_cpu(n->index->vbn) +
1382 				   root->index_block_clst;
1383 		}
1384 
1385 next:
1386 		/* Release current index. */
1387 		if (n) {
1388 			fnd_pop(fnd);
1389 			put_indx_node(n);
1390 			n = NULL;
1391 		}
1392 
1393 		/* Skip all free indexes. */
1394 		bit = next_vbn >> indx->idx2vbn_bits;
1395 		err = indx_used_bit(indx, ni, &bit);
1396 		if (err == -ENOENT || bit == MINUS_ONE_T) {
1397 			/* No used indexes. */
1398 			*entry = NULL;
1399 			return 0;
1400 		}
1401 
1402 		next_used_vbn = bit << indx->idx2vbn_bits;
1403 
1404 		/* Read buffer into memory. */
1405 		err = indx_read(indx, ni, next_used_vbn, &n);
1406 		if (err)
1407 			return err;
1408 
1409 		e = hdr_first_de(&n->index->ihdr);
1410 		fnd_push(fnd, n, e);
1411 		if (!e)
1412 			return -EINVAL;
1413 	}
1414 
1415 ok:
1416 	/* Return offset to restore enumerator if necessary. */
1417 	if (!n) {
1418 		/* 'e' points in root, */
1419 		*off = PtrOffset(&root->ihdr, e);
1420 	} else {
1421 		/* 'e' points in index, */
1422 		*off = (le64_to_cpu(n->index->vbn) << indx->vbn2vbo_bits) +
1423 		       record_size + PtrOffset(&n->index->ihdr, e);
1424 	}
1425 
1426 	*entry = e;
1427 	return 0;
1428 }
1429 
1430 /*
1431  * indx_create_allocate - Create "Allocation + Bitmap" attributes.
1432  */
1433 static int indx_create_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
1434 				CLST *vbn)
1435 {
1436 	int err;
1437 	struct ntfs_sb_info *sbi = ni->mi.sbi;
1438 	struct ATTRIB *bitmap;
1439 	struct ATTRIB *alloc;
1440 	u32 data_size = 1u << indx->index_bits;
1441 	u32 alloc_size = ntfs_up_cluster(sbi, data_size);
1442 	CLST len = alloc_size >> sbi->cluster_bits;
1443 	const struct INDEX_NAMES *in = &s_index_names[indx->type];
1444 	CLST alen;
1445 	struct runs_tree run;
1446 
1447 	run_init(&run);
1448 
1449 	err = attr_allocate_clusters(sbi, &run, NULL, 0, 0, len, NULL,
1450 				     ALLOCATE_DEF, &alen, 0, NULL, NULL);
1451 	if (err)
1452 		goto out;
1453 
1454 	err = ni_insert_nonresident(ni, ATTR_ALLOC, in->name, in->name_len,
1455 				    &run, 0, len, 0, &alloc, NULL, NULL);
1456 	if (err)
1457 		goto out1;
1458 
1459 	alloc->nres.valid_size = alloc->nres.data_size = cpu_to_le64(data_size);
1460 
1461 	err = ni_insert_resident(ni, ntfs3_bitmap_size(1), ATTR_BITMAP,
1462 				 in->name, in->name_len, &bitmap, NULL, NULL);
1463 	if (err)
1464 		goto out2;
1465 
1466 	if (in->name == I30_NAME) {
1467 		i_size_write(&ni->vfs_inode, data_size);
1468 		inode_set_bytes(&ni->vfs_inode, alloc_size);
1469 	}
1470 
1471 	memcpy(&indx->alloc_run, &run, sizeof(run));
1472 
1473 	*vbn = 0;
1474 
1475 	return 0;
1476 
1477 out2:
1478 	mi_remove_attr(NULL, &ni->mi, alloc);
1479 
1480 out1:
1481 	run_deallocate(sbi, &run, false);
1482 
1483 out:
1484 	return err;
1485 }
1486 
1487 /*
1488  * indx_add_allocate - Add clusters to index.
1489  */
1490 static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
1491 			     CLST *vbn)
1492 {
1493 	int err;
1494 	size_t bit;
1495 	u64 data_size;
1496 	u64 bmp_size, bmp_size_v;
1497 	struct ATTRIB *bmp, *alloc;
1498 	struct mft_inode *mi;
1499 	const struct INDEX_NAMES *in = &s_index_names[indx->type];
1500 
1501 	err = indx_find_free(indx, ni, &bit, &bmp);
1502 	if (err)
1503 		goto out1;
1504 
1505 	if (bit != MINUS_ONE_T) {
1506 		bmp = NULL;
1507 	} else {
1508 		if (bmp->non_res) {
1509 			bmp_size = le64_to_cpu(bmp->nres.data_size);
1510 			bmp_size_v = le64_to_cpu(bmp->nres.valid_size);
1511 		} else {
1512 			bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
1513 		}
1514 
1515 		/*
1516 		 * Index blocks exist, but $BITMAP has zero valid bits.
1517 		 * This implies an on-disk corruption and must be rejected.
1518 		 */
1519 		if (in->name == I30_NAME &&
1520 		    unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
1521 			err = -EINVAL;
1522 			goto out1;
1523 		}
1524 
1525 		bit = bmp_size << 3;
1526 	}
1527 
1528 	data_size = (u64)(bit + 1) << indx->index_bits;
1529 
1530 	if (bmp) {
1531 		/* Increase bitmap. */
1532 		err = attr_set_size(ni, ATTR_BITMAP, in->name, in->name_len,
1533 				    &indx->bitmap_run,
1534 				    ntfs3_bitmap_size(bit + 1), NULL, true);
1535 		if (err)
1536 			goto out1;
1537 	}
1538 
1539 	alloc = ni_find_attr(ni, NULL, NULL, ATTR_ALLOC, in->name, in->name_len,
1540 			     NULL, &mi);
1541 	if (!alloc) {
1542 		err = -EINVAL;
1543 		if (bmp)
1544 			goto out2;
1545 		goto out1;
1546 	}
1547 
1548 	if (data_size <= le64_to_cpu(alloc->nres.data_size)) {
1549 		/* Reuse index. */
1550 		goto out;
1551 	}
1552 
1553 	/* Increase allocation. */
1554 	err = attr_set_size(ni, ATTR_ALLOC, in->name, in->name_len,
1555 			    &indx->alloc_run, data_size, &data_size, true);
1556 	if (err) {
1557 		if (bmp)
1558 			goto out2;
1559 		goto out1;
1560 	}
1561 
1562 	if (in->name == I30_NAME)
1563 		i_size_write(&ni->vfs_inode, data_size);
1564 
1565 out:
1566 	*vbn = bit << indx->idx2vbn_bits;
1567 
1568 	return 0;
1569 
1570 out2:
1571 	/* Ops. No space? */
1572 	attr_set_size(ni, ATTR_BITMAP, in->name, in->name_len,
1573 		      &indx->bitmap_run, bmp_size, &bmp_size_v, false);
1574 
1575 out1:
1576 	return err;
1577 }
1578 
1579 /*
1580  * indx_insert_into_root - Attempt to insert an entry into the index root.
1581  *
1582  * @undo - True if we undoing previous remove.
1583  * If necessary, it will twiddle the index b-tree.
1584  */
1585 static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni,
1586 				 const struct NTFS_DE *new_de,
1587 				 struct NTFS_DE *root_de, const void *ctx,
1588 				 struct ntfs_fnd *fnd, bool undo)
1589 {
1590 	int err = 0;
1591 	struct NTFS_DE *e, *e0, *re;
1592 	struct mft_inode *mi;
1593 	struct ATTRIB *attr;
1594 	struct INDEX_HDR *hdr;
1595 	struct indx_node *n;
1596 	CLST new_vbn;
1597 	__le64 *sub_vbn, t_vbn;
1598 	u16 new_de_size;
1599 	u32 hdr_used, hdr_total, asize, to_move;
1600 	u32 root_size, new_root_size;
1601 	struct ntfs_sb_info *sbi;
1602 	int ds_root;
1603 	struct INDEX_ROOT *root, *a_root;
1604 
1605 	/* Get the record this root placed in. */
1606 	root = indx_get_root(indx, ni, &attr, &mi);
1607 	if (!root)
1608 		return -EINVAL;
1609 
1610 	/*
1611 	 * Try easy case:
1612 	 * hdr_insert_de will succeed if there's
1613 	 * room the root for the new entry.
1614 	 */
1615 	hdr = &root->ihdr;
1616 	sbi = ni->mi.sbi;
1617 	new_de_size = le16_to_cpu(new_de->size);
1618 	hdr_used = le32_to_cpu(hdr->used);
1619 	hdr_total = le32_to_cpu(hdr->total);
1620 	asize = le32_to_cpu(attr->size);
1621 	root_size = le32_to_cpu(attr->res.data_size);
1622 
1623 	ds_root = new_de_size + hdr_used - hdr_total;
1624 
1625 	/* If 'undo' is set then reduce requirements. */
1626 	if ((undo || asize + ds_root < sbi->max_bytes_per_attr) &&
1627 	    mi_resize_attr(mi, attr, ds_root)) {
1628 		hdr->total = cpu_to_le32(hdr_total + ds_root);
1629 		e = hdr_insert_de(indx, hdr, new_de, root_de, ctx);
1630 		WARN_ON(!e);
1631 		fnd_clear(fnd);
1632 		fnd->root_de = e;
1633 
1634 		return 0;
1635 	}
1636 
1637 	/* Make a copy of root attribute to restore if error. */
1638 	a_root = kmemdup(attr, asize, GFP_NOFS);
1639 	if (!a_root)
1640 		return -ENOMEM;
1641 
1642 	/*
1643 	 * Copy all the non-end entries from
1644 	 * the index root to the new buffer.
1645 	 */
1646 	to_move = 0;
1647 	e0 = hdr_first_de(hdr);
1648 
1649 	/* Calculate the size to copy. */
1650 	for (e = e0;; e = hdr_next_de(hdr, e)) {
1651 		if (!e) {
1652 			err = -EINVAL;
1653 			goto out_free_root;
1654 		}
1655 
1656 		if (de_is_last(e))
1657 			break;
1658 		to_move += le16_to_cpu(e->size);
1659 	}
1660 
1661 	if (!to_move) {
1662 		re = NULL;
1663 	} else {
1664 		re = kmemdup(e0, to_move, GFP_NOFS);
1665 		if (!re) {
1666 			err = -ENOMEM;
1667 			goto out_free_root;
1668 		}
1669 	}
1670 
1671 	sub_vbn = NULL;
1672 	if (de_has_vcn(e)) {
1673 		t_vbn = de_get_vbn_le(e);
1674 		sub_vbn = &t_vbn;
1675 	}
1676 
1677 	new_root_size = sizeof(struct INDEX_ROOT) + sizeof(struct NTFS_DE) +
1678 			sizeof(u64);
1679 	ds_root = new_root_size - root_size;
1680 
1681 	if (ds_root > 0 && asize + ds_root > sbi->max_bytes_per_attr) {
1682 		/* Make root external. */
1683 		err = -EOPNOTSUPP;
1684 		goto out_free_re;
1685 	}
1686 
1687 	if (ds_root)
1688 		mi_resize_attr(mi, attr, ds_root);
1689 
1690 	/* Fill first entry (vcn will be set later). */
1691 	e = (struct NTFS_DE *)(root + 1);
1692 	memset(e, 0, sizeof(struct NTFS_DE));
1693 	e->size = cpu_to_le16(sizeof(struct NTFS_DE) + sizeof(u64));
1694 	e->flags = NTFS_IE_HAS_SUBNODES | NTFS_IE_LAST;
1695 
1696 	hdr->flags = NTFS_INDEX_HDR_HAS_SUBNODES;
1697 	hdr->used = hdr->total =
1698 		cpu_to_le32(new_root_size - offsetof(struct INDEX_ROOT, ihdr));
1699 
1700 	fnd->root_de = hdr_first_de(hdr);
1701 	mi->dirty = true;
1702 
1703 	/* Create alloc and bitmap attributes (if not). */
1704 	err = run_is_empty(&indx->alloc_run) ?
1705 		      indx_create_allocate(indx, ni, &new_vbn) :
1706 		      indx_add_allocate(indx, ni, &new_vbn);
1707 
1708 	/* Layout of record may be changed, so rescan root. */
1709 	root = indx_get_root(indx, ni, &attr, &mi);
1710 	if (!root) {
1711 		/* Bug? */
1712 		ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
1713 		err = -EINVAL;
1714 		goto out_free_re;
1715 	}
1716 
1717 	if (err) {
1718 		/* Restore root. */
1719 		if (mi_resize_attr(mi, attr, -ds_root)) {
1720 			memcpy(attr, a_root, asize);
1721 		} else {
1722 			/* Bug? */
1723 			ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
1724 		}
1725 		goto out_free_re;
1726 	}
1727 
1728 	e = (struct NTFS_DE *)(root + 1);
1729 	*(__le64 *)(e + 1) = cpu_to_le64(new_vbn);
1730 	mi->dirty = true;
1731 
1732 	/* Now we can create/format the new buffer and copy the entries into. */
1733 	n = indx_new(indx, ni, new_vbn, sub_vbn);
1734 	if (IS_ERR(n)) {
1735 		err = PTR_ERR(n);
1736 		goto out_free_re;
1737 	}
1738 
1739 	hdr = &n->index->ihdr;
1740 	hdr_used = le32_to_cpu(hdr->used);
1741 	hdr_total = le32_to_cpu(hdr->total);
1742 
1743 	/* Copy root entries into new buffer. */
1744 	hdr_insert_head(hdr, re, to_move);
1745 
1746 	/* Update bitmap attribute. */
1747 	indx_mark_used(indx, ni, new_vbn >> indx->idx2vbn_bits);
1748 
1749 	/* Check if we can insert new entry new index buffer. */
1750 	if (hdr_used + new_de_size > hdr_total) {
1751 		/*
1752 		 * This occurs if MFT record is the same or bigger than index
1753 		 * buffer. Move all root new index and have no space to add
1754 		 * new entry classic case when MFT record is 1K and index
1755 		 * buffer 4K the problem should not occurs.
1756 		 */
1757 		kfree(re);
1758 		indx_write(indx, ni, n, 0);
1759 
1760 		put_indx_node(n);
1761 		fnd_clear(fnd);
1762 		err = indx_insert_entry(indx, ni, new_de, ctx, fnd, undo);
1763 		goto out_free_root;
1764 	}
1765 
1766 	/*
1767 	 * Now root is a parent for new index buffer.
1768 	 * Insert NewEntry a new buffer.
1769 	 */
1770 	e = hdr_insert_de(indx, hdr, new_de, NULL, ctx);
1771 	if (!e) {
1772 		err = -EINVAL;
1773 		goto out_put_n;
1774 	}
1775 	fnd_push(fnd, n, e);
1776 
1777 	/* Just write updates index into disk. */
1778 	indx_write(indx, ni, n, 0);
1779 
1780 	n = NULL;
1781 
1782 out_put_n:
1783 	put_indx_node(n);
1784 out_free_re:
1785 	kfree(re);
1786 out_free_root:
1787 	kfree(a_root);
1788 	return err;
1789 }
1790 
1791 /*
1792  * indx_insert_into_buffer
1793  *
1794  * Attempt to insert an entry into an Index Allocation Buffer.
1795  * If necessary, it will split the buffer.
1796  */
1797 static int
1798 indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
1799 			struct INDEX_ROOT *root, const struct NTFS_DE *new_de,
1800 			const void *ctx, int level, struct ntfs_fnd *fnd)
1801 {
1802 	int err;
1803 	const struct NTFS_DE *sp;
1804 	struct NTFS_DE *e, *de_t, *up_e;
1805 	struct indx_node *n2;
1806 	struct indx_node *n1 = fnd->nodes[level];
1807 	struct INDEX_HDR *hdr1 = &n1->index->ihdr;
1808 	struct INDEX_HDR *hdr2;
1809 	u32 to_copy, used, used1;
1810 	CLST new_vbn;
1811 	__le64 t_vbn, *sub_vbn;
1812 	u16 sp_size;
1813 	void *hdr1_saved = NULL;
1814 
1815 	/* Try the most easy case. */
1816 	e = fnd->level - 1 == level ? fnd->de[level] : NULL;
1817 	e = hdr_insert_de(indx, hdr1, new_de, e, ctx);
1818 	fnd->de[level] = e;
1819 	if (e) {
1820 		/* Just write updated index into disk. */
1821 		indx_write(indx, ni, n1, 0);
1822 		return 0;
1823 	}
1824 
1825 	/*
1826 	 * No space to insert into buffer. Split it.
1827 	 * To split we:
1828 	 *  - Save split point ('cause index buffers will be changed)
1829 	 * - Allocate NewBuffer and copy all entries <= sp into new buffer
1830 	 * - Remove all entries (sp including) from TargetBuffer
1831 	 * - Insert NewEntry into left or right buffer (depending on sp <=>
1832 	 *     NewEntry)
1833 	 * - Insert sp into parent buffer (or root)
1834 	 * - Make sp a parent for new buffer
1835 	 */
1836 	sp = hdr_find_split(hdr1);
1837 	if (!sp)
1838 		return -EINVAL;
1839 
1840 	sp_size = le16_to_cpu(sp->size);
1841 	up_e = kmalloc(sp_size + sizeof(u64), GFP_NOFS);
1842 	if (!up_e)
1843 		return -ENOMEM;
1844 	memcpy(up_e, sp, sp_size);
1845 
1846 	used1 = le32_to_cpu(hdr1->used);
1847 	hdr1_saved = kmemdup(hdr1, used1, GFP_NOFS);
1848 	if (!hdr1_saved) {
1849 		err = -ENOMEM;
1850 		goto out;
1851 	}
1852 
1853 	if (!hdr1->flags) {
1854 		up_e->flags |= NTFS_IE_HAS_SUBNODES;
1855 		up_e->size = cpu_to_le16(sp_size + sizeof(u64));
1856 		sub_vbn = NULL;
1857 	} else {
1858 		t_vbn = de_get_vbn_le(up_e);
1859 		sub_vbn = &t_vbn;
1860 	}
1861 
1862 	/* Allocate on disk a new index allocation buffer. */
1863 	err = indx_add_allocate(indx, ni, &new_vbn);
1864 	if (err)
1865 		goto out;
1866 
1867 	/* Allocate and format memory a new index buffer. */
1868 	n2 = indx_new(indx, ni, new_vbn, sub_vbn);
1869 	if (IS_ERR(n2)) {
1870 		err = PTR_ERR(n2);
1871 		goto out;
1872 	}
1873 
1874 	hdr2 = &n2->index->ihdr;
1875 
1876 	/* Make sp a parent for new buffer. */
1877 	de_set_vbn(up_e, new_vbn);
1878 
1879 	/* Copy all the entries <= sp into the new buffer. */
1880 	de_t = hdr_first_de(hdr1);
1881 	to_copy = PtrOffset(de_t, sp);
1882 	hdr_insert_head(hdr2, de_t, to_copy);
1883 
1884 	/* Remove all entries (sp including) from hdr1. */
1885 	used = used1 - to_copy - sp_size;
1886 	memmove(de_t, Add2Ptr(sp, sp_size), used - le32_to_cpu(hdr1->de_off));
1887 	hdr1->used = cpu_to_le32(used);
1888 
1889 	/*
1890 	 * Insert new entry into left or right buffer
1891 	 * (depending on sp <=> new_de).
1892 	 */
1893 	hdr_insert_de(indx,
1894 		      (*indx->cmp)(new_de + 1, le16_to_cpu(new_de->key_size),
1895 				   up_e + 1, le16_to_cpu(up_e->key_size),
1896 				   ctx) < 0 ?
1897 			      hdr2 :
1898 			      hdr1,
1899 		      new_de, NULL, ctx);
1900 
1901 	indx_mark_used(indx, ni, new_vbn >> indx->idx2vbn_bits);
1902 
1903 	indx_write(indx, ni, n1, 0);
1904 	indx_write(indx, ni, n2, 0);
1905 
1906 	put_indx_node(n2);
1907 
1908 	/*
1909 	 * We've finished splitting everybody, so we are ready to
1910 	 * insert the promoted entry into the parent.
1911 	 */
1912 	if (!level) {
1913 		/* Insert in root. */
1914 		err = indx_insert_into_root(indx, ni, up_e, NULL, ctx, fnd, 0);
1915 	} else {
1916 		/*
1917 		 * The target buffer's parent is another index buffer.
1918 		 * TODO: Remove recursion.
1919 		 */
1920 		err = indx_insert_into_buffer(indx, ni, root, up_e, ctx,
1921 					      level - 1, fnd);
1922 	}
1923 
1924 	if (err) {
1925 		/*
1926 		 * Undo critical operations.
1927 		 */
1928 		indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
1929 		unsafe_memcpy(hdr1, hdr1_saved, used1,
1930 			      "There are entries after the structure");
1931 		indx_write(indx, ni, n1, 0);
1932 	}
1933 
1934 out:
1935 	kfree(up_e);
1936 	kfree(hdr1_saved);
1937 
1938 	return err;
1939 }
1940 
1941 /*
1942  * indx_insert_entry - Insert new entry into index.
1943  *
1944  * @undo - True if we undoing previous remove.
1945  */
1946 int indx_insert_entry(struct ntfs_index *indx, struct ntfs_inode *ni,
1947 		      const struct NTFS_DE *new_de, const void *ctx,
1948 		      struct ntfs_fnd *fnd, bool undo)
1949 {
1950 	int err;
1951 	int diff;
1952 	struct NTFS_DE *e;
1953 	struct ntfs_fnd *fnd_a = NULL;
1954 	struct INDEX_ROOT *root;
1955 
1956 	if (!fnd) {
1957 		fnd_a = fnd_get();
1958 		if (!fnd_a) {
1959 			err = -ENOMEM;
1960 			goto out1;
1961 		}
1962 		fnd = fnd_a;
1963 	}
1964 
1965 	root = indx_get_root(indx, ni, NULL, NULL);
1966 	if (!root) {
1967 		err = -EINVAL;
1968 		goto out;
1969 	}
1970 
1971 	if (fnd_is_empty(fnd)) {
1972 		/*
1973 		 * Find the spot the tree where we want to
1974 		 * insert the new entry.
1975 		 */
1976 		err = indx_find(indx, ni, root, new_de + 1,
1977 				le16_to_cpu(new_de->key_size), ctx, &diff, &e,
1978 				fnd);
1979 		if (err)
1980 			goto out;
1981 
1982 		if (!diff) {
1983 			err = -EEXIST;
1984 			goto out;
1985 		}
1986 	}
1987 
1988 	if (!fnd->level) {
1989 		/*
1990 		 * The root is also a leaf, so we'll insert the
1991 		 * new entry into it.
1992 		 */
1993 		err = indx_insert_into_root(indx, ni, new_de, fnd->root_de, ctx,
1994 					    fnd, undo);
1995 	} else {
1996 		/*
1997 		 * Found a leaf buffer, so we'll insert the new entry into it.
1998 		 */
1999 		err = indx_insert_into_buffer(indx, ni, root, new_de, ctx,
2000 					      fnd->level - 1, fnd);
2001 	}
2002 
2003 	indx->version += 1;
2004 out:
2005 	fnd_put(fnd_a);
2006 out1:
2007 	return err;
2008 }
2009 
2010 /*
2011  * indx_find_buffer - Locate a buffer from the tree.
2012  */
2013 static struct indx_node *indx_find_buffer(struct ntfs_index *indx,
2014 					  struct ntfs_inode *ni,
2015 					  const struct INDEX_ROOT *root,
2016 					  __le64 vbn, struct indx_node *n)
2017 {
2018 	int err;
2019 	const struct NTFS_DE *e;
2020 	struct indx_node *r;
2021 	const struct INDEX_HDR *hdr = n ? &n->index->ihdr : &root->ihdr;
2022 
2023 	/* Step 1: Scan one level. */
2024 	for (e = hdr_first_de(hdr);; e = hdr_next_de(hdr, e)) {
2025 		if (!e)
2026 			return ERR_PTR(-EINVAL);
2027 
2028 		if (de_has_vcn(e) && vbn == de_get_vbn_le(e))
2029 			return n;
2030 
2031 		if (de_is_last(e))
2032 			break;
2033 	}
2034 
2035 	/* Step2: Do recursion. */
2036 	e = Add2Ptr(hdr, le32_to_cpu(hdr->de_off));
2037 	for (;;) {
2038 		if (de_has_vcn_ex(e)) {
2039 			err = indx_read(indx, ni, de_get_vbn(e), &n);
2040 			if (err)
2041 				return ERR_PTR(err);
2042 
2043 			r = indx_find_buffer(indx, ni, root, vbn, n);
2044 			if (r)
2045 				return r;
2046 		}
2047 
2048 		if (de_is_last(e))
2049 			break;
2050 
2051 		e = Add2Ptr(e, le16_to_cpu(e->size));
2052 	}
2053 
2054 	return NULL;
2055 }
2056 
2057 /*
2058  * indx_shrink - Deallocate unused tail indexes.
2059  */
2060 static int indx_shrink(struct ntfs_index *indx, struct ntfs_inode *ni,
2061 		       size_t bit)
2062 {
2063 	int err = 0;
2064 	u64 bpb, new_data;
2065 	size_t nbits;
2066 	struct ATTRIB *b;
2067 	struct ATTR_LIST_ENTRY *le = NULL;
2068 	const struct INDEX_NAMES *in = &s_index_names[indx->type];
2069 
2070 	b = ni_find_attr(ni, NULL, &le, ATTR_BITMAP, in->name, in->name_len,
2071 			 NULL, NULL);
2072 
2073 	if (!b)
2074 		return -ENOENT;
2075 
2076 	if (!b->non_res) {
2077 		unsigned long pos;
2078 		const unsigned long *bm = resident_data(b);
2079 
2080 		nbits = (size_t)le32_to_cpu(b->res.data_size) * 8;
2081 
2082 		if (bit >= nbits)
2083 			return 0;
2084 
2085 		pos = find_next_bit_le(bm, nbits, bit);
2086 		if (pos < nbits)
2087 			return 0;
2088 	} else {
2089 		size_t used = MINUS_ONE_T;
2090 
2091 		nbits = le64_to_cpu(b->nres.data_size) * 8;
2092 
2093 		if (bit >= nbits)
2094 			return 0;
2095 
2096 		err = scan_nres_bitmap(ni, b, indx, bit, &scan_for_used, &used);
2097 		if (err)
2098 			return err;
2099 
2100 		if (used != MINUS_ONE_T)
2101 			return 0;
2102 	}
2103 
2104 	new_data = (u64)bit << indx->index_bits;
2105 
2106 	err = attr_set_size(ni, ATTR_ALLOC, in->name, in->name_len,
2107 			    &indx->alloc_run, new_data, &new_data, false);
2108 	if (err)
2109 		return err;
2110 
2111 	if (in->name == I30_NAME)
2112 		i_size_write(&ni->vfs_inode, new_data);
2113 
2114 	bpb = ntfs3_bitmap_size(bit);
2115 	if (bpb * 8 == nbits)
2116 		return 0;
2117 
2118 	err = attr_set_size(ni, ATTR_BITMAP, in->name, in->name_len,
2119 			    &indx->bitmap_run, bpb, &bpb, false);
2120 
2121 	return err;
2122 }
2123 
2124 static int indx_free_children(struct ntfs_index *indx, struct ntfs_inode *ni,
2125 			      const struct NTFS_DE *e, bool trim)
2126 {
2127 	int err;
2128 	struct indx_node *n = NULL;
2129 	struct INDEX_HDR *hdr;
2130 	CLST vbn = de_get_vbn(e);
2131 	size_t i;
2132 
2133 	err = indx_read(indx, ni, vbn, &n);
2134 	if (err)
2135 		return err;
2136 
2137 	hdr = &n->index->ihdr;
2138 	/* First, recurse into the children, if any. */
2139 	if (hdr_has_subnode(hdr)) {
2140 		for (e = hdr_first_de(hdr); e; e = hdr_next_de(hdr, e)) {
2141 			indx_free_children(indx, ni, e, false);
2142 			if (de_is_last(e))
2143 				break;
2144 		}
2145 	}
2146 
2147 	put_indx_node(n);
2148 
2149 	i = vbn >> indx->idx2vbn_bits;
2150 	/*
2151 	 * We've gotten rid of the children; add this buffer to the free list.
2152 	 */
2153 	indx_mark_free(indx, ni, i);
2154 
2155 	if (!trim)
2156 		return 0;
2157 
2158 	/*
2159 	 * If there are no used indexes after current free index
2160 	 * then we can truncate allocation and bitmap.
2161 	 * Use bitmap to estimate the case.
2162 	 */
2163 	indx_shrink(indx, ni, i + 1);
2164 	return 0;
2165 }
2166 
2167 /*
2168  * indx_get_entry_to_replace
2169  *
2170  * Find a replacement entry for a deleted entry.
2171  * Always returns a node entry:
2172  * NTFS_IE_HAS_SUBNODES is set the flags and the size includes the sub_vcn.
2173  */
2174 static int indx_get_entry_to_replace(struct ntfs_index *indx,
2175 				     struct ntfs_inode *ni,
2176 				     const struct NTFS_DE *de_next,
2177 				     struct NTFS_DE **de_to_replace,
2178 				     struct ntfs_fnd *fnd)
2179 {
2180 	int err;
2181 	int level = -1;
2182 	CLST vbn;
2183 	struct NTFS_DE *e, *te, *re;
2184 	struct indx_node *n;
2185 	struct INDEX_BUFFER *ib;
2186 
2187 	*de_to_replace = NULL;
2188 
2189 	/* Find first leaf entry down from de_next. */
2190 	vbn = de_get_vbn(de_next);
2191 	for (;;) {
2192 		n = NULL;
2193 		err = indx_read(indx, ni, vbn, &n);
2194 		if (err)
2195 			goto out;
2196 
2197 		e = hdr_first_de(&n->index->ihdr);
2198 		fnd_push(fnd, n, e);
2199 		if (!e) {
2200 			err = -EINVAL;
2201 			goto out;
2202 		}
2203 
2204 		if (!de_is_last(e)) {
2205 			/*
2206 			 * This buffer is non-empty, so its first entry
2207 			 * could be used as the replacement entry.
2208 			 */
2209 			level = fnd->level - 1;
2210 		}
2211 
2212 		if (!de_has_vcn(e))
2213 			break;
2214 
2215 		/* This buffer is a node. Continue to go down. */
2216 		vbn = de_get_vbn(e);
2217 	}
2218 
2219 	if (level == -1)
2220 		goto out;
2221 
2222 	n = fnd->nodes[level];
2223 	te = hdr_first_de(&n->index->ihdr);
2224 	if (!te) {
2225 		err = -EINVAL;
2226 		goto out;
2227 	}
2228 	/* Copy the candidate entry into the replacement entry buffer. */
2229 	re = kmalloc(le16_to_cpu(te->size) + sizeof(u64), GFP_NOFS);
2230 	if (!re) {
2231 		err = -ENOMEM;
2232 		goto out;
2233 	}
2234 
2235 	*de_to_replace = re;
2236 	memcpy(re, te, le16_to_cpu(te->size));
2237 
2238 	if (!de_has_vcn(re)) {
2239 		/*
2240 		 * The replacement entry we found doesn't have a sub_vcn.
2241 		 * increase its size to hold one.
2242 		 */
2243 		le16_add_cpu(&re->size, sizeof(u64));
2244 		re->flags |= NTFS_IE_HAS_SUBNODES;
2245 	} else {
2246 		/*
2247 		 * The replacement entry we found was a node entry, which
2248 		 * means that all its child buffers are empty. Return them
2249 		 * to the free pool.
2250 		 */
2251 		indx_free_children(indx, ni, te, true);
2252 	}
2253 
2254 	/*
2255 	 * Expunge the replacement entry from its former location,
2256 	 * and then write that buffer.
2257 	 */
2258 	ib = n->index;
2259 	e = hdr_delete_de(&ib->ihdr, te);
2260 
2261 	fnd->de[level] = e;
2262 	indx_write(indx, ni, n, 0);
2263 
2264 	if (ib_is_leaf(ib) && ib_is_empty(ib)) {
2265 		/* An empty leaf. */
2266 		return 0;
2267 	}
2268 
2269 out:
2270 	fnd_clear(fnd);
2271 	return err;
2272 }
2273 
2274 /*
2275  * indx_delete_entry - Delete an entry from the index.
2276  */
2277 int indx_delete_entry(struct ntfs_index *indx, struct ntfs_inode *ni,
2278 		      const void *key, u32 key_len, const void *ctx)
2279 {
2280 	int err, diff;
2281 	struct INDEX_ROOT *root;
2282 	struct INDEX_HDR *hdr;
2283 	struct ntfs_fnd *fnd, *fnd2;
2284 	struct INDEX_BUFFER *ib;
2285 	struct NTFS_DE *e, *re, *next, *prev, *me;
2286 	struct indx_node *n, *n2d = NULL;
2287 	__le64 sub_vbn;
2288 	int level, level2;
2289 	struct ATTRIB *attr;
2290 	struct mft_inode *mi;
2291 	u32 e_size, root_size, new_root_size;
2292 	size_t trim_bit;
2293 	const struct INDEX_NAMES *in;
2294 
2295 	fnd = fnd_get();
2296 	if (!fnd) {
2297 		err = -ENOMEM;
2298 		goto out2;
2299 	}
2300 
2301 	fnd2 = fnd_get();
2302 	if (!fnd2) {
2303 		err = -ENOMEM;
2304 		goto out1;
2305 	}
2306 
2307 	root = indx_get_root(indx, ni, &attr, &mi);
2308 	if (!root) {
2309 		err = -EINVAL;
2310 		goto out;
2311 	}
2312 
2313 	/* Locate the entry to remove. */
2314 	err = indx_find(indx, ni, root, key, key_len, ctx, &diff, &e, fnd);
2315 	if (err)
2316 		goto out;
2317 
2318 	if (!e || diff) {
2319 		err = -ENOENT;
2320 		goto out;
2321 	}
2322 
2323 	level = fnd->level;
2324 
2325 	if (level) {
2326 		n = fnd->nodes[level - 1];
2327 		e = fnd->de[level - 1];
2328 		ib = n->index;
2329 		hdr = &ib->ihdr;
2330 	} else {
2331 		hdr = &root->ihdr;
2332 		e = fnd->root_de;
2333 		n = NULL;
2334 		ib = NULL;
2335 	}
2336 
2337 	e_size = le16_to_cpu(e->size);
2338 
2339 	if (!de_has_vcn_ex(e)) {
2340 		/* The entry to delete is a leaf, so we can just rip it out. */
2341 		hdr_delete_de(hdr, e);
2342 
2343 		if (!level) {
2344 			hdr->total = hdr->used;
2345 
2346 			/* Shrink resident root attribute. */
2347 			mi_resize_attr(mi, attr, 0 - e_size);
2348 			goto out;
2349 		}
2350 
2351 		indx_write(indx, ni, n, 0);
2352 
2353 		/*
2354 		 * Check to see if removing that entry made
2355 		 * the leaf empty.
2356 		 */
2357 		if (ib && ib_is_leaf(ib) && ib_is_empty(ib)) {
2358 			fnd_pop(fnd);
2359 			fnd_push(fnd2, n, e);
2360 		}
2361 	} else {
2362 		/*
2363 		 * The entry we wish to delete is a node buffer, so we
2364 		 * have to find a replacement for it.
2365 		 */
2366 		next = de_get_next(e);
2367 
2368 		err = indx_get_entry_to_replace(indx, ni, next, &re, fnd2);
2369 		if (err)
2370 			goto out;
2371 
2372 		if (re) {
2373 			de_set_vbn_le(re, de_get_vbn_le(e));
2374 			hdr_delete_de(hdr, e);
2375 
2376 			err = level ? indx_insert_into_buffer(indx, ni, root,
2377 							      re, ctx,
2378 							      fnd->level - 1,
2379 							      fnd) :
2380 				      indx_insert_into_root(indx, ni, re, e,
2381 							    ctx, fnd, 0);
2382 			kfree(re);
2383 
2384 			if (err)
2385 				goto out;
2386 		} else {
2387 			/*
2388 			 * There is no replacement for the current entry.
2389 			 * This means that the subtree rooted at its node
2390 			 * is empty, and can be deleted, which turn means
2391 			 * that the node can just inherit the deleted
2392 			 * entry sub_vcn.
2393 			 */
2394 			indx_free_children(indx, ni, next, true);
2395 
2396 			de_set_vbn_le(next, de_get_vbn_le(e));
2397 			hdr_delete_de(hdr, e);
2398 			if (level) {
2399 				indx_write(indx, ni, n, 0);
2400 			} else {
2401 				hdr->total = hdr->used;
2402 
2403 				/* Shrink resident root attribute. */
2404 				mi_resize_attr(mi, attr, 0 - e_size);
2405 			}
2406 		}
2407 	}
2408 
2409 	/* Delete a branch of tree. */
2410 	if (!fnd2 || !fnd2->level)
2411 		goto out;
2412 
2413 	/* Reinit root 'cause it can be changed. */
2414 	root = indx_get_root(indx, ni, &attr, &mi);
2415 	if (!root) {
2416 		err = -EINVAL;
2417 		goto out;
2418 	}
2419 
2420 	n2d = NULL;
2421 	sub_vbn = fnd2->nodes[0]->index->vbn;
2422 	level2 = 0;
2423 	level = fnd->level;
2424 
2425 	hdr = level ? &fnd->nodes[level - 1]->index->ihdr : &root->ihdr;
2426 
2427 	/* Scan current level. */
2428 	for (e = hdr_first_de(hdr);; e = hdr_next_de(hdr, e)) {
2429 		if (!e) {
2430 			err = -EINVAL;
2431 			goto out;
2432 		}
2433 
2434 		if (de_has_vcn(e) && sub_vbn == de_get_vbn_le(e))
2435 			break;
2436 
2437 		if (de_is_last(e)) {
2438 			e = NULL;
2439 			break;
2440 		}
2441 	}
2442 
2443 	if (!e) {
2444 		/* Do slow search from root. */
2445 		struct indx_node *in;
2446 
2447 		fnd_clear(fnd);
2448 
2449 		in = indx_find_buffer(indx, ni, root, sub_vbn, NULL);
2450 		if (IS_ERR(in)) {
2451 			err = PTR_ERR(in);
2452 			goto out;
2453 		}
2454 
2455 		if (in)
2456 			fnd_push(fnd, in, NULL);
2457 	}
2458 
2459 	/* Merge fnd2 -> fnd. */
2460 	for (level = 0; level < fnd2->level; level++) {
2461 		fnd_push(fnd, fnd2->nodes[level], fnd2->de[level]);
2462 		fnd2->nodes[level] = NULL;
2463 	}
2464 	fnd2->level = 0;
2465 
2466 	hdr = NULL;
2467 	for (level = fnd->level; level; level--) {
2468 		struct indx_node *in = fnd->nodes[level - 1];
2469 
2470 		ib = in->index;
2471 		if (ib_is_empty(ib)) {
2472 			sub_vbn = ib->vbn;
2473 		} else {
2474 			hdr = &ib->ihdr;
2475 			n2d = in;
2476 			level2 = level;
2477 			break;
2478 		}
2479 	}
2480 
2481 	if (!hdr)
2482 		hdr = &root->ihdr;
2483 
2484 	e = hdr_first_de(hdr);
2485 	if (!e) {
2486 		err = -EINVAL;
2487 		goto out;
2488 	}
2489 
2490 	if (hdr != &root->ihdr || !de_is_last(e)) {
2491 		prev = NULL;
2492 		while (!de_is_last(e)) {
2493 			if (de_has_vcn(e) && sub_vbn == de_get_vbn_le(e))
2494 				break;
2495 			prev = e;
2496 			e = hdr_next_de(hdr, e);
2497 			if (!e) {
2498 				err = -EINVAL;
2499 				goto out;
2500 			}
2501 		}
2502 
2503 		if (sub_vbn != de_get_vbn_le(e)) {
2504 			/*
2505 			 * Didn't find the parent entry, although this buffer
2506 			 * is the parent trail. Something is corrupt.
2507 			 */
2508 			err = -EINVAL;
2509 			goto out;
2510 		}
2511 
2512 		if (de_is_last(e)) {
2513 			/*
2514 			 * Since we can't remove the end entry, we'll remove
2515 			 * its predecessor instead. This means we have to
2516 			 * transfer the predecessor's sub_vcn to the end entry.
2517 			 * Note: This index block is not empty, so the
2518 			 * predecessor must exist.
2519 			 */
2520 			if (!prev) {
2521 				err = -EINVAL;
2522 				goto out;
2523 			}
2524 
2525 			if (de_has_vcn(prev)) {
2526 				de_set_vbn_le(e, de_get_vbn_le(prev));
2527 			} else if (de_has_vcn(e)) {
2528 				le16_sub_cpu(&e->size, sizeof(u64));
2529 				e->flags &= ~NTFS_IE_HAS_SUBNODES;
2530 				le32_sub_cpu(&hdr->used, sizeof(u64));
2531 			}
2532 			e = prev;
2533 		}
2534 
2535 		/*
2536 		 * Copy the current entry into a temporary buffer (stripping
2537 		 * off its down-pointer, if any) and delete it from the current
2538 		 * buffer or root, as appropriate.
2539 		 */
2540 		e_size = le16_to_cpu(e->size);
2541 		me = kmemdup(e, e_size, GFP_NOFS);
2542 		if (!me) {
2543 			err = -ENOMEM;
2544 			goto out;
2545 		}
2546 
2547 		if (de_has_vcn(me)) {
2548 			me->flags &= ~NTFS_IE_HAS_SUBNODES;
2549 			le16_sub_cpu(&me->size, sizeof(u64));
2550 		}
2551 
2552 		hdr_delete_de(hdr, e);
2553 
2554 		if (hdr == &root->ihdr) {
2555 			level = 0;
2556 			hdr->total = hdr->used;
2557 
2558 			/* Shrink resident root attribute. */
2559 			mi_resize_attr(mi, attr, 0 - e_size);
2560 		} else {
2561 			indx_write(indx, ni, n2d, 0);
2562 			level = level2;
2563 		}
2564 
2565 		/* Mark unused buffers as free. */
2566 		trim_bit = -1;
2567 		for (; level < fnd->level; level++) {
2568 			ib = fnd->nodes[level]->index;
2569 			if (ib_is_empty(ib)) {
2570 				size_t k = le64_to_cpu(ib->vbn) >>
2571 					   indx->idx2vbn_bits;
2572 
2573 				indx_mark_free(indx, ni, k);
2574 				if (k < trim_bit)
2575 					trim_bit = k;
2576 			}
2577 		}
2578 
2579 		fnd_clear(fnd);
2580 		/*fnd->root_de = NULL;*/
2581 
2582 		/*
2583 		 * Re-insert the entry into the tree.
2584 		 * Find the spot the tree where we want to insert the new entry.
2585 		 */
2586 		err = indx_insert_entry(indx, ni, me, ctx, fnd, 0);
2587 		kfree(me);
2588 		if (err)
2589 			goto out;
2590 
2591 		if (trim_bit != -1)
2592 			indx_shrink(indx, ni, trim_bit);
2593 	} else {
2594 		/*
2595 		 * This tree needs to be collapsed down to an empty root.
2596 		 * Recreate the index root as an empty leaf and free all
2597 		 * the bits the index allocation bitmap.
2598 		 */
2599 		fnd_clear(fnd);
2600 		fnd_clear(fnd2);
2601 
2602 		in = &s_index_names[indx->type];
2603 
2604 		err = attr_set_size(ni, ATTR_ALLOC, in->name, in->name_len,
2605 				    &indx->alloc_run, 0, NULL, false);
2606 		if (in->name == I30_NAME)
2607 			i_size_write(&ni->vfs_inode, 0);
2608 
2609 		err = ni_remove_attr(ni, ATTR_ALLOC, in->name, in->name_len,
2610 				     false, NULL);
2611 		run_close(&indx->alloc_run);
2612 
2613 		err = attr_set_size(ni, ATTR_BITMAP, in->name, in->name_len,
2614 				    &indx->bitmap_run, 0, NULL, false);
2615 		err = ni_remove_attr(ni, ATTR_BITMAP, in->name, in->name_len,
2616 				     false, NULL);
2617 		run_close(&indx->bitmap_run);
2618 
2619 		root = indx_get_root(indx, ni, &attr, &mi);
2620 		if (!root) {
2621 			err = -EINVAL;
2622 			goto out;
2623 		}
2624 
2625 		root_size = le32_to_cpu(attr->res.data_size);
2626 		new_root_size =
2627 			sizeof(struct INDEX_ROOT) + sizeof(struct NTFS_DE);
2628 
2629 		if (new_root_size != root_size &&
2630 		    !mi_resize_attr(mi, attr, new_root_size - root_size)) {
2631 			err = -EINVAL;
2632 			goto out;
2633 		}
2634 
2635 		/* Fill first entry. */
2636 		e = (struct NTFS_DE *)(root + 1);
2637 		e->ref.low = 0;
2638 		e->ref.high = 0;
2639 		e->ref.seq = 0;
2640 		e->size = cpu_to_le16(sizeof(struct NTFS_DE));
2641 		e->flags = NTFS_IE_LAST; // 0x02
2642 		e->key_size = 0;
2643 		e->res = 0;
2644 
2645 		hdr = &root->ihdr;
2646 		hdr->flags = 0;
2647 		hdr->used = hdr->total = cpu_to_le32(
2648 			new_root_size - offsetof(struct INDEX_ROOT, ihdr));
2649 		mi->dirty = true;
2650 	}
2651 
2652 	indx->version += 1;
2653 out:
2654 	fnd_put(fnd2);
2655 out1:
2656 	fnd_put(fnd);
2657 out2:
2658 	return err;
2659 }
2660 
2661 /*
2662  * Update duplicated information in directory entry
2663  * 'dup' - info from MFT record
2664  */
2665 int indx_update_dup(struct ntfs_inode *ni, struct ntfs_sb_info *sbi,
2666 		    const struct ATTR_FILE_NAME *fname,
2667 		    const struct NTFS_DUP_INFO *dup, int sync)
2668 {
2669 	int err, diff;
2670 	struct NTFS_DE *e = NULL;
2671 	struct ATTR_FILE_NAME *e_fname;
2672 	struct ntfs_fnd *fnd;
2673 	struct INDEX_ROOT *root;
2674 	struct mft_inode *mi;
2675 	struct ntfs_index *indx = &ni->dir;
2676 
2677 	fnd = fnd_get();
2678 	if (!fnd)
2679 		return -ENOMEM;
2680 
2681 	root = indx_get_root(indx, ni, NULL, &mi);
2682 	if (!root) {
2683 		err = -EINVAL;
2684 		goto out;
2685 	}
2686 
2687 	/* Find entry in directory. */
2688 	err = indx_find(indx, ni, root, fname, fname_full_size(fname), sbi,
2689 			&diff, &e, fnd);
2690 	if (err)
2691 		goto out;
2692 
2693 	if (!e) {
2694 		err = -EINVAL;
2695 		goto out;
2696 	}
2697 
2698 	if (diff) {
2699 		err = -EINVAL;
2700 		goto out;
2701 	}
2702 
2703 	e_fname = (struct ATTR_FILE_NAME *)(e + 1);
2704 
2705 	if (!memcmp(&e_fname->dup, dup, sizeof(*dup))) {
2706 		/*
2707 		 * Nothing to update in index! Try to avoid this call.
2708 		 */
2709 		goto out;
2710 	}
2711 
2712 	memcpy(&e_fname->dup, dup, sizeof(*dup));
2713 
2714 	if (fnd->level) {
2715 		/* Directory entry in index. */
2716 		err = indx_write(indx, ni, fnd->nodes[fnd->level - 1], sync);
2717 	} else {
2718 		/* Directory entry in directory MFT record. */
2719 		mi->dirty = true;
2720 		if (sync)
2721 			err = mi_write(mi, 1);
2722 		else
2723 			mark_inode_dirty(&ni->vfs_inode);
2724 	}
2725 
2726 out:
2727 	fnd_put(fnd);
2728 	return err;
2729 }
2730