Commit 89ac9b4d authored by Sougata Santra's avatar Sougata Santra Committed by Linus Torvalds
Browse files

hfsplus: fix longname handling 



Longname is not correctly handled by hfsplus driver.  If an attempt to
create a longname(>255) file/directory is made, it succeeds by creating a
file/directory with HFSPLUS_MAX_STRLEN and incorrect catalog key.  Thus
leaving the volume in an inconsistent state.  This patch fixes this issue.

Although lookup is always called first to create a negative entry, so just
doing a check in lookup would probably fix this issue.  I choose to
propagate error to other iops as well.

Please NOTE: I have factored out hfsplus_cat_build_key_with_cnid from
hfsplus_cat_build_key, to avoid unncessary branching.

Thanks a lot.

  TEST:
  ------
  dir="TEST_DIR"
  cdir=`pwd`
  name255="_123456789_123456789_123456789_123456789_123456789_123456789\
  _123456789_123456789_123456789_123456789_123456789_123456789_123456789\
  _123456789_123456789_123456789_123456789_123456789_123456789_123456789\
  _123456789_123456789_123456789_123456789_123456789_1234"
  name256="${name255}5"

  mkdir $dir
  cd $dir
  touch $name255
  rm -f $name255
  touch $name256
  ls -la
  cd $cdir
  rm -rf $dir

  RESULT:
  -------
  [sougata@ultrabook tmp]$ cdir=`pwd`
  [sougata@ultrabook tmp]$
  name255="_123456789_123456789_123456789_123456789_123456789_123456789\
   > _123456789_123456789_123456789_123456789_123456789_123456789_123456789\
   > _123456789_123456789_123456789_123456789_123456789_123456789_123456789\
   > _123456789_123456789_123456789_123456789_123456789_1234"
  [sougata@ultrabook tmp]$ name256="${name255}5"
  [sougata@ultrabook tmp]$
  [sougata@ultrabook tmp]$ mkdir $dir
  [sougata@ultrabook tmp]$ cd $dir
  [sougata@ultrabook TEST_DIR]$ touch $name255
  [sougata@ultrabook TEST_DIR]$ rm -f $name255
  [sougata@ultrabook TEST_DIR]$ touch $name256
  [sougata@ultrabook TEST_DIR]$ ls -la
  ls: cannot access
  _123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_1234:
  No such file or directory
  total 0
  drwxrwxr-x 1 sougata sougata 3 Feb 20 19:56 .
  drwxrwxrwx 1 root    root    6 Feb 20 19:56 ..
  -????????? ? ?       ?       ?            ?
  _123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_123456789_1234
  [sougata@ultrabook TEST_DIR]$ cd $cdir
  [sougata@ultrabook tmp]$ rm -rf $dir
  rm: cannot remove `TEST_DIR': Directory not empty

-ENAMETOOLONG returned from hfsplus_asc2uni was not propaged to iops.
This allowed hfsplus to create files/directories with HFSPLUS_MAX_STRLEN
and incorrect keys, leaving the FS in an inconsistent state.  This patch
fixes this issue.

Signed-off-by: default avatarSougata Santra <sougata@tuxera.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 859f7ef1

fs/hfsplus/catalog.c

+65 −24
Original line number Diff line number Diff line
@@ -38,21 +38,30 @@ int hfsplus_cat_bin_cmp_key(const hfsplus_btree_key *k1, 
	return hfsplus_strcmp(&k1->cat.name, &k2->cat.name);

}



void hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key,

			   u32 parent, struct qstr *str)

/* Generates key for catalog file/folders record. */

int hfsplus_cat_build_key(struct super_block *sb,

		hfsplus_btree_key *key, u32 parent, struct qstr *str)

{

	int len;

	int len, err;



	key->cat.parent = cpu_to_be32(parent);

	if (str) {

		hfsplus_asc2uni(sb, &key->cat.name, HFSPLUS_MAX_STRLEN,

	err = hfsplus_asc2uni(sb, &key->cat.name, HFSPLUS_MAX_STRLEN,

			str->name, str->len);

	if (unlikely(err < 0))

		return err;



	len = be16_to_cpu(key->cat.name.length);

	} else {

		key->cat.name.length = 0;

		len = 0;

	}

	key->key_len = cpu_to_be16(6 + 2 * len);

	return 0;

}



/* Generates key for catalog thread record. */

void hfsplus_cat_build_key_with_cnid(struct super_block *sb,

			hfsplus_btree_key *key, u32 parent)

{

	key->cat.parent = cpu_to_be32(parent);

	key->cat.name.length = 0;

	key->key_len = cpu_to_be16(6);

}



static void hfsplus_cat_build_key_uni(hfsplus_btree_key *key, u32 parent,
@@ -167,11 +176,16 @@ static int hfsplus_fill_cat_thread(struct super_block *sb, 
				   hfsplus_cat_entry *entry, int type,

				   u32 parentid, struct qstr *str)

{

	int err;



	entry->type = cpu_to_be16(type);

	entry->thread.reserved = 0;

	entry->thread.parentID = cpu_to_be32(parentid);

	hfsplus_asc2uni(sb, &entry->thread.nodeName, HFSPLUS_MAX_STRLEN,

	err = hfsplus_asc2uni(sb, &entry->thread.nodeName, HFSPLUS_MAX_STRLEN,

				str->name, str->len);

	if (unlikely(err < 0))

		return err;



	return 10 + be16_to_cpu(entry->thread.nodeName.length) * 2;

}
@@ -183,7 +197,7 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid, 
	int err;

	u16 type;



	hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);

	hfsplus_cat_build_key_with_cnid(sb, fd->search_key, cnid);

	err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));

	if (err)

		return err;
@@ -250,11 +264,16 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir, 
	if (err)

		return err;



	hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);

	hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);

	entry_size = hfsplus_fill_cat_thread(sb, &entry,

		S_ISDIR(inode->i_mode) ?

			HFSPLUS_FOLDER_THREAD : HFSPLUS_FILE_THREAD,

		dir->i_ino, str);

	if (unlikely(entry_size < 0)) {

		err = entry_size;

		goto err2;

	}



	err = hfs_brec_find(&fd, hfs_find_rec_by_key);

	if (err != -ENOENT) {

		if (!err)
@@ -265,7 +284,10 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir, 
	if (err)

		goto err2;



	hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);

	err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);

	if (unlikely(err))

		goto err1;



	entry_size = hfsplus_cat_build_record(&entry, cnid, inode);

	err = hfs_brec_find(&fd, hfs_find_rec_by_key);

	if (err != -ENOENT) {
@@ -288,7 +310,7 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir, 
	return 0;



err1:

	hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);

	hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);

	if (!hfs_brec_find(&fd, hfs_find_rec_by_key))

		hfs_brec_remove(&fd);

err2:
@@ -313,7 +335,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str) 
	if (!str) {

		int len;



		hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);

		hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);

		err = hfs_brec_find(&fd, hfs_find_rec_by_key);

		if (err)

			goto out;
@@ -329,7 +351,9 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str) 
			off + 2, len);

		fd.search_key->key_len = cpu_to_be16(6 + len);

	} else

		hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);

		err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);

		if (unlikely(err))

			goto out;



	err = hfs_brec_find(&fd, hfs_find_rec_by_key);

	if (err)
@@ -360,7 +384,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str) 
	if (err)

		goto out;



	hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);

	hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);

	err = hfs_brec_find(&fd, hfs_find_rec_by_key);

	if (err)

		goto out;
@@ -405,7 +429,11 @@ int hfsplus_rename_cat(u32 cnid, 
	dst_fd = src_fd;



	/* find the old dir entry and read the data */

	hfsplus_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);

	err = hfsplus_cat_build_key(sb, src_fd.search_key,

			src_dir->i_ino, src_name);

	if (unlikely(err))

		goto out;



	err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);

	if (err)

		goto out;
@@ -419,7 +447,11 @@ int hfsplus_rename_cat(u32 cnid, 
	type = be16_to_cpu(entry.type);



	/* create new dir entry with the data from the old entry */

	hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name);

	err = hfsplus_cat_build_key(sb, dst_fd.search_key,

			dst_dir->i_ino, dst_name);

	if (unlikely(err))

		goto out;



	err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key);

	if (err != -ENOENT) {

		if (!err)
@@ -436,7 +468,11 @@ int hfsplus_rename_cat(u32 cnid, 
	dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC;



	/* finally remove the old entry */

	hfsplus_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);

	err = hfsplus_cat_build_key(sb, src_fd.search_key,

			src_dir->i_ino, src_name);

	if (unlikely(err))

		goto out;



	err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);

	if (err)

		goto out;
@@ -449,7 +485,7 @@ int hfsplus_rename_cat(u32 cnid, 
	src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC;



	/* remove old thread entry */

	hfsplus_cat_build_key(sb, src_fd.search_key, cnid, NULL);

	hfsplus_cat_build_key_with_cnid(sb, src_fd.search_key, cnid);

	err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);

	if (err)

		goto out;
@@ -459,9 +495,14 @@ int hfsplus_rename_cat(u32 cnid, 
		goto out;



	/* create new thread entry */

	hfsplus_cat_build_key(sb, dst_fd.search_key, cnid, NULL);

	hfsplus_cat_build_key_with_cnid(sb, dst_fd.search_key, cnid);

	entry_size = hfsplus_fill_cat_thread(sb, &entry, type,

		dst_dir->i_ino, dst_name);

	if (unlikely(entry_size < 0)) {

		err = entry_size;

		goto out;

	}



	err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key);

	if (err != -ENOENT) {

		if (!err)

fs/hfsplus/dir.c

+8 −3
Original line number Diff line number Diff line
@@ -44,7 +44,10 @@ static struct dentry *hfsplus_lookup(struct inode *dir, struct dentry *dentry, 
	err = hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);

	if (err)

		return ERR_PTR(err);

	hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, &dentry->d_name);

	err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino,

			&dentry->d_name);

	if (unlikely(err < 0))

		goto fail;

again:

	err = hfs_brec_read(&fd, &entry, sizeof(entry));

	if (err) {
@@ -97,9 +100,11 @@ again: 
					be32_to_cpu(entry.file.permissions.dev);

				str.len = sprintf(name, "iNode%d", linkid);

				str.name = name;

				hfsplus_cat_build_key(sb, fd.search_key,

				err = hfsplus_cat_build_key(sb, fd.search_key,

					HFSPLUS_SB(sb)->hidden_dir->i_ino,

					&str);

				if (unlikely(err < 0))

					goto fail;

				goto again;

			}

		} else if (!dentry->d_fsdata)
@@ -145,7 +150,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx) 
		err = -ENOMEM;

		goto out;

	}

	hfsplus_cat_build_key(sb, fd.search_key, inode->i_ino, NULL);

	hfsplus_cat_build_key_with_cnid(sb, fd.search_key, inode->i_ino);

	err = hfs_brec_find(&fd, hfs_find_rec_by_key);

	if (err)

		goto out;

fs/hfsplus/hfsplus_fs.h

+3 −1
Original line number Diff line number Diff line
@@ -443,8 +443,10 @@ int hfsplus_cat_case_cmp_key(const hfsplus_btree_key *k1, 
			     const hfsplus_btree_key *k2);

int hfsplus_cat_bin_cmp_key(const hfsplus_btree_key *k1,

			    const hfsplus_btree_key *k2);

void hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key,

int hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key,

			   u32 parent, struct qstr *str);

void hfsplus_cat_build_key_with_cnid(struct super_block *sb,

				     hfsplus_btree_key *key, u32 parent);

void hfsplus_cat_set_perms(struct inode *inode, struct hfsplus_perm *perms);

int hfsplus_find_cat(struct super_block *sb, u32 cnid,

		     struct hfs_find_data *fd);

fs/hfsplus/super.c

+3 −1
Original line number Diff line number Diff line
@@ -515,7 +515,9 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent) 
	err = hfs_find_init(sbi->cat_tree, &fd);

	if (err)

		goto out_put_root;

	hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str);

	err = hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str);

	if (unlikely(err < 0))

		goto out_put_root;

	if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {

		hfs_find_exit(&fd);

		if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))

CRA Git | Maintained and supported by SUSTech CRA and CCSE