make prepend_name() work correctly when called with negative *buflen
[firefly-linux-kernel-4.4.55.git] / fs / hpfs / map.c
1 /*
2  *  linux/fs/hpfs/map.c
3  *
4  *  Mikulas Patocka (mikulas@artax.karlin.mff.cuni.cz), 1998-1999
5  *
6  *  mapping structures to memory with some minimal checks
7  */
8
9 #include "hpfs_fn.h"
10
11 __le32 *hpfs_map_dnode_bitmap(struct super_block *s, struct quad_buffer_head *qbh)
12 {
13         return hpfs_map_4sectors(s, hpfs_sb(s)->sb_dmap, qbh, 0);
14 }
15
16 __le32 *hpfs_map_bitmap(struct super_block *s, unsigned bmp_block,
17                          struct quad_buffer_head *qbh, char *id)
18 {
19         secno sec;
20         __le32 *ret;
21         unsigned n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
22         if (hpfs_sb(s)->sb_chk) if (bmp_block >= n_bands) {
23                 hpfs_error(s, "hpfs_map_bitmap called with bad parameter: %08x at %s", bmp_block, id);
24                 return NULL;
25         }
26         sec = le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[bmp_block]);
27         if (!sec || sec > hpfs_sb(s)->sb_fs_size-4) {
28                 hpfs_error(s, "invalid bitmap block pointer %08x -> %08x at %s", bmp_block, sec, id);
29                 return NULL;
30         }
31         ret = hpfs_map_4sectors(s, sec, qbh, 4);
32         if (ret) hpfs_prefetch_bitmap(s, bmp_block + 1);
33         return ret;
34 }
35
36 void hpfs_prefetch_bitmap(struct super_block *s, unsigned bmp_block)
37 {
38         unsigned to_prefetch, next_prefetch;
39         unsigned n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
40         if (unlikely(bmp_block >= n_bands))
41                 return;
42         to_prefetch = le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[bmp_block]);
43         if (unlikely(bmp_block + 1 >= n_bands))
44                 next_prefetch = 0;
45         else
46                 next_prefetch = le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[bmp_block + 1]);
47         hpfs_prefetch_sectors(s, to_prefetch, 4 + 4 * (to_prefetch + 4 == next_prefetch));
48 }
49
50 /*
51  * Load first code page into kernel memory, return pointer to 256-byte array,
52  * first 128 bytes are uppercasing table for chars 128-255, next 128 bytes are
53  * lowercasing table
54  */
55
56 unsigned char *hpfs_load_code_page(struct super_block *s, secno cps)
57 {
58         struct buffer_head *bh;
59         secno cpds;
60         unsigned cpi;
61         unsigned char *ptr;
62         unsigned char *cp_table;
63         int i;
64         struct code_page_data *cpd;
65         struct code_page_directory *cp = hpfs_map_sector(s, cps, &bh, 0);
66         if (!cp) return NULL;
67         if (le32_to_cpu(cp->magic) != CP_DIR_MAGIC) {
68                 printk("HPFS: Code page directory magic doesn't match (magic = %08x)\n", le32_to_cpu(cp->magic));
69                 brelse(bh);
70                 return NULL;
71         }
72         if (!le32_to_cpu(cp->n_code_pages)) {
73                 printk("HPFS: n_code_pages == 0\n");
74                 brelse(bh);
75                 return NULL;
76         }
77         cpds = le32_to_cpu(cp->array[0].code_page_data);
78         cpi = le16_to_cpu(cp->array[0].index);
79         brelse(bh);
80
81         if (cpi >= 3) {
82                 printk("HPFS: Code page index out of array\n");
83                 return NULL;
84         }
85         
86         if (!(cpd = hpfs_map_sector(s, cpds, &bh, 0))) return NULL;
87         if (le16_to_cpu(cpd->offs[cpi]) > 0x178) {
88                 printk("HPFS: Code page index out of sector\n");
89                 brelse(bh);
90                 return NULL;
91         }
92         ptr = (unsigned char *)cpd + le16_to_cpu(cpd->offs[cpi]) + 6;
93         if (!(cp_table = kmalloc(256, GFP_KERNEL))) {
94                 printk("HPFS: out of memory for code page table\n");
95                 brelse(bh);
96                 return NULL;
97         }
98         memcpy(cp_table, ptr, 128);
99         brelse(bh);
100
101         /* Try to build lowercasing table from uppercasing one */
102
103         for (i=128; i<256; i++) cp_table[i]=i;
104         for (i=128; i<256; i++) if (cp_table[i-128]!=i && cp_table[i-128]>=128)
105                 cp_table[cp_table[i-128]] = i;
106         
107         return cp_table;
108 }
109
110 __le32 *hpfs_load_bitmap_directory(struct super_block *s, secno bmp)
111 {
112         struct buffer_head *bh;
113         int n = (hpfs_sb(s)->sb_fs_size + 0x200000 - 1) >> 21;
114         int i;
115         __le32 *b;
116         if (!(b = kmalloc(n * 512, GFP_KERNEL))) {
117                 printk("HPFS: can't allocate memory for bitmap directory\n");
118                 return NULL;
119         }       
120         for (i=0;i<n;i++) {
121                 __le32 *d = hpfs_map_sector(s, bmp+i, &bh, n - i - 1);
122                 if (!d) {
123                         kfree(b);
124                         return NULL;
125                 }
126                 memcpy((char *)b + 512 * i, d, 512);
127                 brelse(bh);
128         }
129         return b;
130 }
131
132 /*
133  * Load fnode to memory
134  */
135
136 struct fnode *hpfs_map_fnode(struct super_block *s, ino_t ino, struct buffer_head **bhp)
137 {
138         struct fnode *fnode;
139         if (hpfs_sb(s)->sb_chk) if (hpfs_chk_sectors(s, ino, 1, "fnode")) {
140                 return NULL;
141         }
142         if ((fnode = hpfs_map_sector(s, ino, bhp, FNODE_RD_AHEAD))) {
143                 if (hpfs_sb(s)->sb_chk) {
144                         struct extended_attribute *ea;
145                         struct extended_attribute *ea_end;
146                         if (le32_to_cpu(fnode->magic) != FNODE_MAGIC) {
147                                 hpfs_error(s, "bad magic on fnode %08lx",
148                                         (unsigned long)ino);
149                                 goto bail;
150                         }
151                         if (!fnode_is_dir(fnode)) {
152                                 if ((unsigned)fnode->btree.n_used_nodes + (unsigned)fnode->btree.n_free_nodes !=
153                                     (bp_internal(&fnode->btree) ? 12 : 8)) {
154                                         hpfs_error(s,
155                                            "bad number of nodes in fnode %08lx",
156                                             (unsigned long)ino);
157                                         goto bail;
158                                 }
159                                 if (le16_to_cpu(fnode->btree.first_free) !=
160                                     8 + fnode->btree.n_used_nodes * (bp_internal(&fnode->btree) ? 8 : 12)) {
161                                         hpfs_error(s,
162                                             "bad first_free pointer in fnode %08lx",
163                                             (unsigned long)ino);
164                                         goto bail;
165                                 }
166                         }
167                         if (le16_to_cpu(fnode->ea_size_s) && (le16_to_cpu(fnode->ea_offs) < 0xc4 ||
168                            le16_to_cpu(fnode->ea_offs) + le16_to_cpu(fnode->acl_size_s) + le16_to_cpu(fnode->ea_size_s) > 0x200)) {
169                                 hpfs_error(s,
170                                         "bad EA info in fnode %08lx: ea_offs == %04x ea_size_s == %04x",
171                                         (unsigned long)ino,
172                                         le16_to_cpu(fnode->ea_offs), le16_to_cpu(fnode->ea_size_s));
173                                 goto bail;
174                         }
175                         ea = fnode_ea(fnode);
176                         ea_end = fnode_end_ea(fnode);
177                         while (ea != ea_end) {
178                                 if (ea > ea_end) {
179                                         hpfs_error(s, "bad EA in fnode %08lx",
180                                                 (unsigned long)ino);
181                                         goto bail;
182                                 }
183                                 ea = next_ea(ea);
184                         }
185                 }
186         }
187         return fnode;
188         bail:
189         brelse(*bhp);
190         return NULL;
191 }
192
193 struct anode *hpfs_map_anode(struct super_block *s, anode_secno ano, struct buffer_head **bhp)
194 {
195         struct anode *anode;
196         if (hpfs_sb(s)->sb_chk) if (hpfs_chk_sectors(s, ano, 1, "anode")) return NULL;
197         if ((anode = hpfs_map_sector(s, ano, bhp, ANODE_RD_AHEAD)))
198                 if (hpfs_sb(s)->sb_chk) {
199                         if (le32_to_cpu(anode->magic) != ANODE_MAGIC) {
200                                 hpfs_error(s, "bad magic on anode %08x", ano);
201                                 goto bail;
202                         }
203                         if (le32_to_cpu(anode->self) != ano) {
204                                 hpfs_error(s, "self pointer invalid on anode %08x", ano);
205                                 goto bail;
206                         }
207                         if ((unsigned)anode->btree.n_used_nodes + (unsigned)anode->btree.n_free_nodes !=
208                             (bp_internal(&anode->btree) ? 60 : 40)) {
209                                 hpfs_error(s, "bad number of nodes in anode %08x", ano);
210                                 goto bail;
211                         }
212                         if (le16_to_cpu(anode->btree.first_free) !=
213                             8 + anode->btree.n_used_nodes * (bp_internal(&anode->btree) ? 8 : 12)) {
214                                 hpfs_error(s, "bad first_free pointer in anode %08x", ano);
215                                 goto bail;
216                         }
217                 }
218         return anode;
219         bail:
220         brelse(*bhp);
221         return NULL;
222 }
223
224 /*
225  * Load dnode to memory and do some checks
226  */
227
228 struct dnode *hpfs_map_dnode(struct super_block *s, unsigned secno,
229                              struct quad_buffer_head *qbh)
230 {
231         struct dnode *dnode;
232         if (hpfs_sb(s)->sb_chk) {
233                 if (hpfs_chk_sectors(s, secno, 4, "dnode")) return NULL;
234                 if (secno & 3) {
235                         hpfs_error(s, "dnode %08x not byte-aligned", secno);
236                         return NULL;
237                 }       
238         }
239         if ((dnode = hpfs_map_4sectors(s, secno, qbh, DNODE_RD_AHEAD)))
240                 if (hpfs_sb(s)->sb_chk) {
241                         unsigned p, pp = 0;
242                         unsigned char *d = (unsigned char *)dnode;
243                         int b = 0;
244                         if (le32_to_cpu(dnode->magic) != DNODE_MAGIC) {
245                                 hpfs_error(s, "bad magic on dnode %08x", secno);
246                                 goto bail;
247                         }
248                         if (le32_to_cpu(dnode->self) != secno)
249                                 hpfs_error(s, "bad self pointer on dnode %08x self = %08x", secno, le32_to_cpu(dnode->self));
250                         /* Check dirents - bad dirents would cause infinite
251                            loops or shooting to memory */
252                         if (le32_to_cpu(dnode->first_free) > 2048) {
253                                 hpfs_error(s, "dnode %08x has first_free == %08x", secno, le32_to_cpu(dnode->first_free));
254                                 goto bail;
255                         }
256                         for (p = 20; p < le32_to_cpu(dnode->first_free); p += d[p] + (d[p+1] << 8)) {
257                                 struct hpfs_dirent *de = (struct hpfs_dirent *)((char *)dnode + p);
258                                 if (le16_to_cpu(de->length) > 292 || (le16_to_cpu(de->length) < 32) || (le16_to_cpu(de->length) & 3) || p + le16_to_cpu(de->length) > 2048) {
259                                         hpfs_error(s, "bad dirent size in dnode %08x, dirent %03x, last %03x", secno, p, pp);
260                                         goto bail;
261                                 }
262                                 if (((31 + de->namelen + de->down*4 + 3) & ~3) != le16_to_cpu(de->length)) {
263                                         if (((31 + de->namelen + de->down*4 + 3) & ~3) < le16_to_cpu(de->length) && s->s_flags & MS_RDONLY) goto ok;
264                                         hpfs_error(s, "namelen does not match dirent size in dnode %08x, dirent %03x, last %03x", secno, p, pp);
265                                         goto bail;
266                                 }
267                                 ok:
268                                 if (hpfs_sb(s)->sb_chk >= 2) b |= 1 << de->down;
269                                 if (de->down) if (de_down_pointer(de) < 0x10) {
270                                         hpfs_error(s, "bad down pointer in dnode %08x, dirent %03x, last %03x", secno, p, pp);
271                                         goto bail;
272                                 }
273                                 pp = p;
274                                 
275                         }
276                         if (p != le32_to_cpu(dnode->first_free)) {
277                                 hpfs_error(s, "size on last dirent does not match first_free; dnode %08x", secno);
278                                 goto bail;
279                         }
280                         if (d[pp + 30] != 1 || d[pp + 31] != 255) {
281                                 hpfs_error(s, "dnode %08x does not end with \\377 entry", secno);
282                                 goto bail;
283                         }
284                         if (b == 3) printk("HPFS: warning: unbalanced dnode tree, dnode %08x; see hpfs.txt 4 more info\n", secno);
285                 }
286         return dnode;
287         bail:
288         hpfs_brelse4(qbh);
289         return NULL;
290 }
291
292 dnode_secno hpfs_fnode_dno(struct super_block *s, ino_t ino)
293 {
294         struct buffer_head *bh;
295         struct fnode *fnode;
296         dnode_secno dno;
297
298         fnode = hpfs_map_fnode(s, ino, &bh);
299         if (!fnode)
300                 return 0;
301
302         dno = le32_to_cpu(fnode->u.external[0].disk_secno);
303         brelse(bh);
304         return dno;
305 }