1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * 4 * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved. 5 * 6 */ 7 8 #include <linux/fs.h> 9 10 #include "debug.h" 11 #include "ntfs.h" 12 #include "ntfs_fs.h" 13 14 static inline int compare_attr(const struct ATTRIB *left, enum ATTR_TYPE type, 15 const __le16 *name, u8 name_len, 16 const u16 *upcase) 17 { 18 /* First, compare the type codes. */ 19 int diff = le32_to_cpu(left->type) - le32_to_cpu(type); 20 21 if (diff) 22 return diff; 23 24 /* They have the same type code, so we have to compare the names. */ 25 return ntfs_cmp_names(attr_name(left), left->name_len, name, name_len, 26 upcase, true); 27 } 28 29 /* 30 * mi_new_attt_id 31 * 32 * Return: Unused attribute id that is less than mrec->next_attr_id. 33 */ 34 static __le16 mi_new_attt_id(struct ntfs_inode *ni, struct mft_inode *mi) 35 { 36 u16 free_id, max_id, t16; 37 struct MFT_REC *rec = mi->mrec; 38 struct ATTRIB *attr; 39 __le16 id; 40 41 id = rec->next_attr_id; 42 free_id = le16_to_cpu(id); 43 if (free_id < 0x7FFF) { 44 rec->next_attr_id = cpu_to_le16(free_id + 1); 45 return id; 46 } 47 48 /* One record can store up to 1024/24 ~= 42 attributes. */ 49 free_id = 0; 50 max_id = 0; 51 52 attr = NULL; 53 54 for (;;) { 55 attr = mi_enum_attr(ni, mi, attr); 56 if (!attr) { 57 rec->next_attr_id = cpu_to_le16(max_id + 1); 58 mi->dirty = true; 59 return cpu_to_le16(free_id); 60 } 61 62 t16 = le16_to_cpu(attr->id); 63 if (t16 == free_id) { 64 free_id += 1; 65 attr = NULL; 66 } else if (max_id < t16) 67 max_id = t16; 68 } 69 } 70 71 int mi_get(struct ntfs_sb_info *sbi, CLST rno, struct mft_inode **mi) 72 { 73 int err; 74 struct mft_inode *m = kzalloc_obj(struct mft_inode, GFP_NOFS); 75 76 if (!m) 77 return -ENOMEM; 78 79 err = mi_init(m, sbi, rno); 80 if (err) { 81 kfree(m); 82 return err; 83 } 84 85 err = mi_read(m, false); 86 if (err) { 87 mi_put(m); 88 return err; 89 } 90 91 *mi = m; 92 return 0; 93 } 94 95 void mi_put(struct mft_inode *mi) 96 { 97 mi_clear(mi); 98 kfree(mi); 99 } 100 101 int mi_init(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno) 102 { 103 mi->sbi = sbi; 104 mi->rno = rno; 105 mi->mrec = kmalloc(sbi->record_size, GFP_NOFS); 106 if (!mi->mrec) 107 return -ENOMEM; 108 109 return 0; 110 } 111 112 /* 113 * mi_read - Read MFT data. 114 */ 115 int mi_read(struct mft_inode *mi, bool is_mft) 116 { 117 int err; 118 struct MFT_REC *rec = mi->mrec; 119 struct ntfs_sb_info *sbi = mi->sbi; 120 u32 bpr = sbi->record_size; 121 u64 vbo = (u64)mi->rno << sbi->record_bits; 122 struct ntfs_inode *mft_ni = sbi->mft.ni; 123 struct runs_tree *run = mft_ni ? &mft_ni->file.run : NULL; 124 struct rw_semaphore *rw_lock = NULL; 125 126 if (is_mounted(sbi)) { 127 if (!is_mft && mft_ni) { 128 rw_lock = &mft_ni->file.run_lock; 129 down_read(rw_lock); 130 } 131 } 132 133 err = ntfs_read_bh(sbi, run, vbo, &rec->rhdr, bpr, &mi->nb); 134 if (rw_lock) 135 up_read(rw_lock); 136 if (!err) 137 goto ok; 138 139 if (err == -E_NTFS_FIXUP) { 140 mi->dirty = true; 141 goto ok; 142 } 143 144 if (err != -ENOENT) 145 goto out; 146 147 if (rw_lock) { 148 ni_lock(mft_ni); 149 down_write(rw_lock); 150 } 151 err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, run, 152 vbo >> sbi->cluster_bits); 153 if (rw_lock) { 154 up_write(rw_lock); 155 ni_unlock(mft_ni); 156 } 157 if (err) 158 goto out; 159 160 if (rw_lock) 161 down_read(rw_lock); 162 err = ntfs_read_bh(sbi, run, vbo, &rec->rhdr, bpr, &mi->nb); 163 if (rw_lock) 164 up_read(rw_lock); 165 166 if (err == -E_NTFS_FIXUP) { 167 mi->dirty = true; 168 goto ok; 169 } 170 if (err) 171 goto out; 172 173 ok: 174 /* Check field 'total' only here. */ 175 if (le32_to_cpu(rec->total) != bpr) { 176 err = -EINVAL; 177 goto out; 178 } 179 180 return 0; 181 182 out: 183 if (err == -E_NTFS_CORRUPT) { 184 ntfs_err(sbi->sb, "mft corrupted"); 185 ntfs_set_state(sbi, NTFS_DIRTY_ERROR); 186 err = -EINVAL; 187 } 188 189 return err; 190 } 191 192 /* 193 * mi_enum_attr - start/continue attributes enumeration in record. 194 * 195 * NOTE: mi->mrec - memory of size sbi->record_size 196 * here we sure that mi->mrec->total == sbi->record_size (see mi_read) 197 */ 198 struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi, 199 struct ATTRIB *attr) 200 { 201 const struct MFT_REC *rec = mi->mrec; 202 u32 used = le32_to_cpu(rec->used); 203 u32 t32, off, asize, prev_type; 204 u16 t16; 205 u64 svcn, evcn, data_size, alloc_size, tot_size; 206 207 if (!attr) { 208 u32 total = le32_to_cpu(rec->total); 209 210 off = le16_to_cpu(rec->attr_off); 211 212 if (used > total) 213 goto out; 214 215 if (off >= used || off < MFTRECORD_FIXUP_OFFSET_1 || 216 !IS_ALIGNED(off, 8)) { 217 goto out; 218 } 219 220 /* Skip non-resident records. */ 221 if (!is_rec_inuse(rec)) 222 return NULL; 223 224 prev_type = 0; 225 attr = Add2Ptr(rec, off); 226 } else { 227 /* 228 * We don't need to check previous attr here. There is 229 * a bounds checking in the previous round. 230 */ 231 off = PtrOffset(rec, attr); 232 233 asize = le32_to_cpu(attr->size); 234 235 prev_type = le32_to_cpu(attr->type); 236 attr = Add2Ptr(attr, asize); 237 off += asize; 238 } 239 240 /* 241 * Can we use the first fields: 242 * attr->type, 243 * attr->size 244 */ 245 if (off + 8 > used) { 246 static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8); 247 goto out; 248 } 249 250 if (attr->type == ATTR_END) { 251 /* End of enumeration. */ 252 return NULL; 253 } 254 255 /* 0x100 is last known attribute for now. */ 256 t32 = le32_to_cpu(attr->type); 257 if (!t32 || (t32 & 0xf) || (t32 > 0x100)) 258 goto out; 259 260 /* attributes in record must be ordered by type */ 261 if (t32 < prev_type) 262 goto out; 263 264 asize = le32_to_cpu(attr->size); 265 266 if (!IS_ALIGNED(asize, 8)) 267 goto out; 268 269 /* Check overflow and boundary. */ 270 if (off + asize < off || off + asize > used) 271 goto out; 272 273 /* Can we use the field attr->non_res. */ 274 if (off + 9 > used) 275 goto out; 276 277 /* Check size of attribute. */ 278 if (!attr->non_res) { 279 /* Check resident fields. */ 280 if (asize < SIZEOF_RESIDENT) 281 goto out; 282 283 t16 = le16_to_cpu(attr->res.data_off); 284 if (t16 > asize) 285 goto out; 286 287 if (le32_to_cpu(attr->res.data_size) > asize - t16) 288 goto out; 289 290 t32 = sizeof(short) * attr->name_len; 291 if (t32 && le16_to_cpu(attr->name_off) + t32 > t16) 292 goto out; 293 294 return attr; 295 } 296 297 /* Check nonresident fields. */ 298 if (attr->non_res != 1) 299 goto out; 300 301 /* Can we use memory including attr->nres.valid_size? */ 302 if (asize < SIZEOF_NONRESIDENT) 303 goto out; 304 305 t16 = le16_to_cpu(attr->nres.run_off); 306 if (t16 > asize) 307 goto out; 308 309 t32 = sizeof(short) * attr->name_len; 310 if (t32 && le16_to_cpu(attr->name_off) + t32 > t16) 311 goto out; 312 313 /* 314 * Check start/end vcn. svcn == 0 with evcn == -1 (U64_MAX) is the 315 * sentinel for an empty non-resident attribute (no allocated 316 * clusters) and must be accepted: "svcn > evcn + 1" tolerates it, 317 * since "(u64)-1 + 1" is 0 and "0 > 0" is false. 318 * 319 * For a non-empty attribute evcn is a cluster index and must lie 320 * within the volume (sbi->used.bitmap.nbits, set up in 321 * ntfs_init_from_boot() before any caller of mi_enum_attr() runs). 322 * Bounding evcn also prevents a malformed value close to U64_MAX 323 * from slipping through the near-wrap "evcn + 1" upper bound. 324 */ 325 svcn = le64_to_cpu(attr->nres.svcn); 326 evcn = le64_to_cpu(attr->nres.evcn); 327 if (svcn > evcn + 1) 328 goto out; 329 330 if (is_attr_ext(attr)) { 331 /* sparsed/compressed attribute. */ 332 #ifdef CONFIG_NTFS3_64BIT_CLUSTER 333 /* No limits. */ 334 #else 335 /* Check evcn fits into 32 bits. */ 336 if (evcn != U64_MAX && evcn >= (1ull << 32)) 337 goto out; 338 #endif 339 } else { 340 /* Check out of volume for normal attribute. */ 341 if (evcn != U64_MAX && evcn >= mi->sbi->used.bitmap.nbits) 342 goto out; 343 } 344 345 data_size = le64_to_cpu(attr->nres.data_size); 346 if (le64_to_cpu(attr->nres.valid_size) > data_size) 347 goto out; 348 349 alloc_size = le64_to_cpu(attr->nres.alloc_size); 350 if (data_size > alloc_size) 351 goto out; 352 353 t32 = mi->sbi->cluster_mask; 354 if (alloc_size & t32) 355 goto out; 356 357 if (!attr->nres.svcn && is_attr_ext(attr)) { 358 /* First segment of sparse/compressed attribute */ 359 /* Can we use memory including attr->nres.total_size? */ 360 if (asize < SIZEOF_NONRESIDENT_EX) 361 goto out; 362 363 tot_size = le64_to_cpu(attr->nres.total_size); 364 if (tot_size & t32) 365 goto out; 366 367 if (tot_size > alloc_size) 368 goto out; 369 } else { 370 if (attr->nres.c_unit) 371 goto out; 372 373 if (alloc_size > mi->sbi->volume.size) 374 goto out; 375 } 376 377 return attr; 378 379 out: 380 _ntfs_bad_inode(&ni->vfs_inode); 381 return NULL; 382 } 383 384 /* 385 * mi_find_attr - Find the attribute by type and name and id. 386 */ 387 struct ATTRIB *mi_find_attr(struct ntfs_inode *ni, struct mft_inode *mi, 388 struct ATTRIB *attr, enum ATTR_TYPE type, 389 const __le16 *name, u8 name_len, const __le16 *id) 390 { 391 u32 type_in = le32_to_cpu(type); 392 u32 atype; 393 394 next_attr: 395 attr = mi_enum_attr(ni, mi, attr); 396 if (!attr) 397 return NULL; 398 399 atype = le32_to_cpu(attr->type); 400 if (atype > type_in) 401 return NULL; 402 403 if (atype < type_in) 404 goto next_attr; 405 406 if (attr->name_len != name_len) 407 goto next_attr; 408 409 if (name_len && memcmp(attr_name(attr), name, name_len * sizeof(short))) 410 goto next_attr; 411 412 if (id && *id != attr->id) 413 goto next_attr; 414 415 return attr; 416 } 417 418 int mi_write(struct mft_inode *mi, int wait) 419 { 420 struct MFT_REC *rec; 421 int err; 422 struct ntfs_sb_info *sbi; 423 424 if (!mi->dirty) 425 return 0; 426 427 sbi = mi->sbi; 428 rec = mi->mrec; 429 430 err = ntfs_write_bh(sbi, &rec->rhdr, &mi->nb, wait); 431 if (err) 432 return err; 433 434 if (mi->rno < sbi->mft.recs_mirr) 435 sbi->flags |= NTFS_FLAGS_MFTMIRR; 436 437 mi->dirty = false; 438 439 return 0; 440 } 441 442 int mi_format_new(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno, 443 __le16 flags, bool is_mft) 444 { 445 int err; 446 u16 seq = 1; 447 struct MFT_REC *rec; 448 u64 vbo = (u64)rno << sbi->record_bits; 449 450 err = mi_init(mi, sbi, rno); 451 if (err) 452 return err; 453 454 rec = mi->mrec; 455 456 if (rno == MFT_REC_MFT) { 457 ; 458 } else if (rno < MFT_REC_FREE) { 459 seq = rno; 460 } else if (rno >= sbi->mft.used) { 461 ; 462 } else if (mi_read(mi, is_mft)) { 463 ; 464 } else if (rec->rhdr.sign == NTFS_FILE_SIGNATURE) { 465 /* Record is reused. Update its sequence number. */ 466 seq = le16_to_cpu(rec->seq) + 1; 467 if (!seq) 468 seq = 1; 469 } 470 471 memcpy(rec, sbi->new_rec, sbi->record_size); 472 473 rec->seq = cpu_to_le16(seq); 474 rec->flags = RECORD_FLAG_IN_USE | flags; 475 if (MFTRECORD_FIXUP_OFFSET == MFTRECORD_FIXUP_OFFSET_3) 476 rec->mft_record = cpu_to_le32(rno); 477 478 mi->dirty = true; 479 480 if (!mi->nb.nbufs) { 481 struct ntfs_inode *ni = sbi->mft.ni; 482 bool lock = false; 483 484 if (is_mounted(sbi) && !is_mft) { 485 down_read(&ni->file.run_lock); 486 lock = true; 487 } 488 489 err = ntfs_get_bh(sbi, &ni->file.run, vbo, sbi->record_size, 490 &mi->nb); 491 if (lock) 492 up_read(&ni->file.run_lock); 493 } 494 495 return err; 496 } 497 498 /* 499 * mi_insert_attr - Reserve space for new attribute. 500 * 501 * Return: Not full constructed attribute or NULL if not possible to create. 502 */ 503 struct ATTRIB *mi_insert_attr(struct ntfs_inode *ni, struct mft_inode *mi, 504 enum ATTR_TYPE type, const __le16 *name, 505 u8 name_len, u32 asize, u16 name_off) 506 { 507 size_t tail; 508 struct ATTRIB *attr; 509 __le16 id; 510 struct MFT_REC *rec = mi->mrec; 511 struct ntfs_sb_info *sbi = mi->sbi; 512 u32 used = le32_to_cpu(rec->used); 513 const u16 *upcase = sbi->upcase; 514 515 /* Can we insert mi attribute? */ 516 if (used + asize > sbi->record_size) 517 return NULL; 518 519 /* 520 * Scan through the list of attributes to find the point 521 * at which we should insert it. 522 */ 523 attr = NULL; 524 while ((attr = mi_enum_attr(ni, mi, attr))) { 525 int diff = compare_attr(attr, type, name, name_len, upcase); 526 527 if (diff < 0) 528 continue; 529 530 if (!diff && !is_attr_indexed(attr)) 531 return NULL; 532 break; 533 } 534 535 if (!attr) { 536 /* Append. */ 537 tail = 8; 538 attr = Add2Ptr(rec, used - 8); 539 } else { 540 /* Insert before 'attr'. */ 541 tail = used - PtrOffset(rec, attr); 542 } 543 544 id = mi_new_attt_id(ni, mi); 545 546 memmove(Add2Ptr(attr, asize), attr, tail); 547 memset(attr, 0, asize); 548 549 attr->type = type; 550 attr->size = cpu_to_le32(asize); 551 attr->name_len = name_len; 552 attr->name_off = cpu_to_le16(name_off); 553 attr->id = id; 554 555 memmove(Add2Ptr(attr, name_off), name, name_len * sizeof(short)); 556 rec->used = cpu_to_le32(used + asize); 557 558 mi->dirty = true; 559 560 return attr; 561 } 562 563 /* 564 * mi_remove_attr - Remove the attribute from record. 565 * 566 * NOTE: The source attr will point to next attribute. 567 */ 568 bool mi_remove_attr(struct ntfs_inode *ni, struct mft_inode *mi, 569 struct ATTRIB *attr) 570 { 571 struct MFT_REC *rec = mi->mrec; 572 u32 aoff = PtrOffset(rec, attr); 573 u32 used = le32_to_cpu(rec->used); 574 u32 asize = le32_to_cpu(attr->size); 575 576 if (aoff + asize > used) 577 return false; 578 579 if (ni && is_attr_indexed(attr) && attr->type == ATTR_NAME) { 580 u16 links = le16_to_cpu(ni->mi.mrec->hard_links); 581 if (!links) { 582 /* minor error. Not critical. */ 583 } else { 584 ni->mi.mrec->hard_links = cpu_to_le16(links - 1); 585 ni->mi.dirty = true; 586 } 587 } 588 589 used -= asize; 590 memmove(attr, Add2Ptr(attr, asize), used - aoff); 591 rec->used = cpu_to_le32(used); 592 mi->dirty = true; 593 594 return true; 595 } 596 597 /* bytes = "new attribute size" - "old attribute size" */ 598 bool mi_resize_attr(struct mft_inode *mi, struct ATTRIB *attr, int bytes) 599 { 600 struct MFT_REC *rec = mi->mrec; 601 u32 aoff = PtrOffset(rec, attr); 602 u32 total, used = le32_to_cpu(rec->used); 603 u32 nsize, asize = le32_to_cpu(attr->size); 604 u32 rsize = le32_to_cpu(attr->res.data_size); 605 int tail = (int)(used - aoff - asize); 606 int dsize; 607 char *next; 608 609 if (tail < 0 || aoff >= used) 610 return false; 611 612 if (!bytes) 613 return true; 614 615 total = le32_to_cpu(rec->total); 616 next = Add2Ptr(attr, asize); 617 618 if (bytes > 0) { 619 dsize = ALIGN(bytes, 8); 620 if (used + dsize > total) 621 return false; 622 nsize = asize + dsize; 623 /* Move tail */ 624 memmove(next + dsize, next, tail); 625 memset(next, 0, dsize); 626 used += dsize; 627 rsize += dsize; 628 } else { 629 dsize = ALIGN(-bytes, 8); 630 if (dsize > asize) 631 return false; 632 nsize = asize - dsize; 633 memmove(next - dsize, next, tail); 634 used -= dsize; 635 rsize -= dsize; 636 } 637 638 rec->used = cpu_to_le32(used); 639 attr->size = cpu_to_le32(nsize); 640 if (!attr->non_res) 641 attr->res.data_size = cpu_to_le32(rsize); 642 mi->dirty = true; 643 644 return true; 645 } 646 647 /* 648 * Pack runs in MFT record. 649 * If failed record is not changed. 650 */ 651 int mi_pack_runs(struct mft_inode *mi, struct ATTRIB *attr, 652 const struct runs_tree *run, CLST len) 653 { 654 int err = 0; 655 struct ntfs_sb_info *sbi = mi->sbi; 656 u32 new_run_size; 657 CLST plen; 658 struct MFT_REC *rec = mi->mrec; 659 CLST svcn = le64_to_cpu(attr->nres.svcn); 660 u32 used = le32_to_cpu(rec->used); 661 u32 aoff = PtrOffset(rec, attr); 662 u32 asize = le32_to_cpu(attr->size); 663 char *next = Add2Ptr(attr, asize); 664 u16 run_off = le16_to_cpu(attr->nres.run_off); 665 u32 run_size = asize - run_off; 666 u32 tail = used - aoff - asize; 667 u32 dsize = sbi->record_size - used; 668 669 /* Make a maximum gap in current record. */ 670 memmove(next + dsize, next, tail); 671 672 /* Pack as much as possible. */ 673 err = run_pack(run, svcn, len, Add2Ptr(attr, run_off), run_size + dsize, 674 &plen); 675 if (err < 0) { 676 memmove(next, next + dsize, tail); 677 return err; 678 } 679 680 new_run_size = ALIGN(err, 8); 681 682 memmove(next + new_run_size - run_size, next + dsize, tail); 683 684 attr->size = cpu_to_le32(asize + new_run_size - run_size); 685 attr->nres.evcn = cpu_to_le64(svcn + plen - 1); 686 rec->used = cpu_to_le32(used + new_run_size - run_size); 687 mi->dirty = true; 688 689 return 0; 690 } 691