Commit 1d51b370 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'jfs-7.1' of github.com:kleikamp/linux-shaggy 

Pull jfs updates from Dave Kleikamp:
 "More robust data integrity checking and some fixes"

* tag 'jfs-7.1' of github.com:kleikamp/linux-shaggy:
  jfs: avoid -Wtautological-constant-out-of-range-compare warning again
  JFS: always load filesystem UUID during mount
  jfs: hold LOG_LOCK on umount to avoid null-ptr-deref
  jfs: Set the lbmDone flag at the end of lbmIODone
  jfs: fix corrupted list in dbUpdatePMap
  jfs: add dmapctl integrity check to prevent invalid operations
  jfs: add dtpage integrity check to prevent index/pointer overflows
  jfs: add dtroot integrity check to prevent index out-of-bounds
parents 5414f3fd dad98c5b

fs/jfs/jfs_dmap.c

+111 −3
Original line number Diff line number Diff line
@@ -133,6 +133,93 @@ static const s8 budtab[256] = { 
	2, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, -1

};



/*

 * check_dmapctl - Validate integrity of a dmapctl structure

 * @dcp: Pointer to the dmapctl structure to check

 *

 * Return: true if valid, false if corrupted

 */

static bool check_dmapctl(struct dmapctl *dcp)

{

	s8 budmin = dcp->budmin;

	u32 nleafs, l2nleafs, leafidx, height;

	int i;



	nleafs = le32_to_cpu(dcp->nleafs);

	/* Check basic field ranges */

	if (unlikely(nleafs > LPERCTL)) {

		jfs_err("dmapctl: invalid nleafs %u (max %u)",

			nleafs, LPERCTL);

		return false;

	}



	l2nleafs = le32_to_cpu(dcp->l2nleafs);

	if (unlikely(l2nleafs > L2LPERCTL)) {

		jfs_err("dmapctl: invalid l2nleafs %u (max %u)",

			l2nleafs, L2LPERCTL);

		return false;

	}



	/* Verify nleafs matches l2nleafs (must be power of two) */

	if (unlikely((1U << l2nleafs) != nleafs)) {

		jfs_err("dmapctl: nleafs %u != 2^%u",

			nleafs, l2nleafs);

		return false;

	}



	leafidx = le32_to_cpu(dcp->leafidx);

	/* Check leaf index matches expected position */

	if (unlikely(leafidx != CTLLEAFIND)) {

		jfs_err("dmapctl: invalid leafidx %u (expected %u)",

			leafidx, CTLLEAFIND);

		return false;

	}



	height = le32_to_cpu(dcp->height);

	/* Check tree height is within valid range */

	if (unlikely(height > (L2LPERCTL >> 1))) {

		jfs_err("dmapctl: invalid height %u (max %u)",

			height, L2LPERCTL >> 1);

		return false;

	}



	/* Check budmin is valid (cannot be NOFREE for non-empty tree) */

	if (budmin == NOFREE) {

		if (unlikely(nleafs > 0)) {

			jfs_err("dmapctl: budmin is NOFREE but nleafs %u",

				nleafs);

			return false;

		}

	} else if (unlikely(budmin < BUDMIN)) {

		jfs_err("dmapctl: invalid budmin %d (min %d)",

			budmin, BUDMIN);

		return false;

	}



	/* Check leaf nodes fit within stree array */

	if (unlikely(leafidx + nleafs > CTLTREESIZE)) {

		jfs_err("dmapctl: leaf range exceeds stree size (end %u > %u)",

			leafidx + nleafs, CTLTREESIZE);

		return false;

	}



	/* Check leaf nodes have valid values */

	for (i = leafidx; i < leafidx + nleafs; i++) {

		s8 val = dcp->stree[i];



		if (unlikely(val < NOFREE)) {

			jfs_err("dmapctl: invalid leaf value %d at index %d",

					val, i);

			return false;

		} else if (unlikely(val > 31)) {

			jfs_err("dmapctl: leaf value %d too large at index %d", val, i);

			return false;

		}

	}



	return true;

}



/*

 * NAME:	dbMount()

 *
@@ -1372,7 +1459,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results) 
	dcp = (struct dmapctl *) mp->data;

	budmin = dcp->budmin;



	if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {

	if (unlikely(!check_dmapctl(dcp))) {

		jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n");

		release_metapage(mp);

		return -EIO;
@@ -1702,7 +1789,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno) 
		dcp = (struct dmapctl *) mp->data;

		budmin = dcp->budmin;



		if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {

		if (unlikely(!check_dmapctl(dcp))) {

			jfs_error(bmp->db_ipbmap->i_sb,

				  "Corrupt dmapctl page\n");

			release_metapage(mp);
@@ -2485,7 +2572,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) 
		return -EIO;

	dcp = (struct dmapctl *) mp->data;



	if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {

	if (unlikely(!check_dmapctl(dcp))) {

		jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n");

		release_metapage(mp);

		return -EIO;
@@ -3454,6 +3541,11 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) 
		return -EIO;

	}

	l2dcp = (struct dmapctl *) l2mp->data;

	if (unlikely(!check_dmapctl(l2dcp))) {

		jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");

		release_metapage(l2mp);

		return -EIO;

	}



	/* compute start L1 */

	k = blkno >> L2MAXL1SIZE;
@@ -3471,6 +3563,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) 
			if (l1mp == NULL)

				goto errout;

			l1dcp = (struct dmapctl *) l1mp->data;

			if (unlikely(!check_dmapctl(l1dcp))) {

				jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");

				goto errout;

			}



			/* compute start L0 */

			j = (blkno & (MAXL1SIZE - 1)) >> L2MAXL0SIZE;
@@ -3484,6 +3580,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) 
				goto errout;



			l1dcp = (struct dmapctl *) l1mp->data;

			if (unlikely(!check_dmapctl(l1dcp))) {

				jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");

				goto errout;

			}



			/* compute start L0 */

			j = 0;
@@ -3503,6 +3603,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) 
				if (l0mp == NULL)

					goto errout;

				l0dcp = (struct dmapctl *) l0mp->data;

				if (unlikely(!check_dmapctl(l0dcp))) {

					jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");

					goto errout;

				}



				/* compute start dmap */

				i = (blkno & (MAXL0SIZE - 1)) >>
@@ -3518,6 +3622,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) 
					goto errout;



				l0dcp = (struct dmapctl *) l0mp->data;

				if (unlikely(!check_dmapctl(l0dcp))) {

					jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n");

					goto errout;

				}



				/* compute start dmap */

				i = 0;

fs/jfs/jfs_dtree.c

+188 −4
Original line number Diff line number Diff line
@@ -115,10 +115,7 @@ struct dtsplit { 
do {									\

	BT_GETPAGE(IP, BN, MP, dtpage_t, SIZE, P, RC, i_dtroot);	\

	if (!(RC)) {							\

		if (((P)->header.nextindex >				\

		     (((BN) == 0) ? DTROOTMAXSLOT : (P)->header.maxslot)) || \

		    ((BN) && (((P)->header.maxslot > DTPAGEMAXSLOT) ||	\

		    ((P)->header.stblindex >= DTPAGEMAXSLOT)))) {	\

		if ((BN) && !check_dtpage(P)) {				\

			BT_PUTPAGE(MP);					\

			jfs_error((IP)->i_sb,				\

				  "DT_GETPAGE: dtree page corrupt\n");	\
@@ -4297,3 +4294,190 @@ int dtModify(tid_t tid, struct inode *ip, 


	return 0;

}



bool check_dtroot(dtroot_t *p)

{

	DECLARE_BITMAP(bitmap, DTROOTMAXSLOT) = {0};

	int i;



	/* freecnt cannot be negative or exceed DTROOTMAXSLOT-1

	 * (since slot[0] is occupied by the header).

	 */

	if (unlikely(p->header.freecnt < 0 ||

				p->header.freecnt > DTROOTMAXSLOT - 1)) {

		jfs_err("Bad freecnt:%d in dtroot\n", p->header.freecnt);

		return false;

	} else if (p->header.freecnt == 0) {

		/* No free slots: freelist must be -1 */

		if (unlikely(p->header.freelist != -1)) {

			jfs_err("freecnt=0, but freelist=%d in dtroot\n",

					p->header.freelist);

			return false;

		}

	} else {

		int fsi, i;

		/* When there are free slots, freelist must be a valid slot index in

		 * 1~DTROOTMAXSLOT-1(since slot[0] is occupied by the header).

		 */

		if (unlikely(p->header.freelist < 1 ||

					p->header.freelist >= DTROOTMAXSLOT)) {

			jfs_err("Bad freelist:%d in dtroot\n", p->header.freelist);

			return false;

		}



		/* Traverse the free list to check validity of all node indices */

		fsi = p->header.freelist;

		for (i = 0; i < p->header.freecnt - 1; i++) {

			/* Check for duplicate indices in the free list */

			if (unlikely(__test_and_set_bit(fsi, bitmap))) {

				jfs_err("duplicate index%d in slot in dtroot\n", fsi);

				return false;

			}

			fsi = p->slot[fsi].next;



			/* Ensure the next slot index in the free list is valid */

			if (unlikely(fsi < 1 || fsi >= DTROOTMAXSLOT)) {

				jfs_err("Bad index:%d in slot in dtroot\n", fsi);

				return false;

			}

		}



		/* The last node in the free list must terminate with next = -1 */

		if (unlikely(p->slot[fsi].next != -1)) {

			jfs_err("Bad next:%d of the last slot in dtroot\n",

					p->slot[fsi].next);

			return false;

		}

	}



	/* Validate nextindex (next free entry index in stbl)

	 * stbl array has size 8 (indices 0~7).

	 * It may get set to 8 when the last free slot has been filled.

	 */

	if (unlikely(p->header.nextindex > ARRAY_SIZE(p->header.stbl))) {

		jfs_err("Bad nextindex:%d in dtroot\n", p->header.nextindex);

		return false;

	}



	/* Validate index validity of stbl array (8 elements)

	 * Each entry in stbl is a slot index, with valid range: -1 (invalid)

	 * or 0~8 (slot[0]~slot[8])

	 */

	for (i = 0; i < p->header.nextindex; i++) {

		int idx = p->header.stbl[i];



		if (unlikely(idx < 0 || idx >= 9)) {

			jfs_err("Bad index:%d of stbl[%d] in dtroot\n", idx, i);

			return false; /* stbl entry points out of slot array range */

		}



		/* Check for duplicate valid indices (skip check for idx=0) */

		if (unlikely(idx && __test_and_set_bit(idx, bitmap))) {

			jfs_err("Duplicate index:%d in stbl in dtroot\n", idx);

			return false;

		}

	}



	return true;

}



bool check_dtpage(dtpage_t *p)

{

	DECLARE_BITMAP(bitmap, DTPAGEMAXSLOT) = {0};

	const int stblsize = ((PSIZE >> L2DTSLOTSIZE) + 31) >> L2DTSLOTSIZE;

	int i;



	/* Validate maxslot (maximum number of slots in the page)

	 * dtpage_t slot array is defined to hold up to DTPAGEMAXSLOT (128) slots

	 */

	if (unlikely(p->header.maxslot != DTPAGEMAXSLOT)) {

		jfs_err("Bad maxslot:%d in dtpage (expected %d)\n",

				p->header.maxslot, DTPAGEMAXSLOT);

		return false;

	}



	/* freecnt cannot be negative or exceed DTPAGEMAXSLOT-1

	 * (since slot[0] is occupied by the header).

	 */

	if (unlikely(p->header.freecnt < 0 ||

				p->header.freecnt > DTPAGEMAXSLOT - 1)) {

		jfs_err("Bad freecnt:%d in dtpage\n", p->header.freecnt);

		return false;

	} else if (p->header.freecnt == 0) {

		/* No free slots: freelist must be -1 */

		if (unlikely(p->header.freelist != -1)) {

			jfs_err("freecnt=0 but freelist=%d in dtpage\n",

					p->header.freelist);

			return false;

		}

	} else {

		int fsi;



		if (unlikely(p->header.freelist < 1)) {

			jfs_err("Bad freelist:%d in dtpage\n", p->header.freelist);

			return false;

		}



		/* Traverse the free list to check validity of all node indices */

		fsi = p->header.freelist;

		for (i = 0; i < p->header.freecnt - 1; i++) {

			/* Check for duplicate indices in the free list */

			if (unlikely(__test_and_set_bit(fsi, bitmap))) {

				jfs_err("duplicate index%d in slot in dtpage\n", fsi);

				return false;

			}

			fsi = p->slot[fsi].next;



			/* Ensure the next slot index in the free list is valid */

			if (unlikely(fsi < 1 || fsi >= DTPAGEMAXSLOT)) {

				jfs_err("Bad index:%d in slot in dtpage\n", fsi);

				return false;

			}

		}



		/* The last node in the free list must terminate with next = -1 */

		if (unlikely(p->slot[fsi].next != -1)) {

			jfs_err("Bad next:%d of the last slot in dtpage\n",

					p->slot[fsi].next);

			return false;

		}

	}



	/* stbl must be little then DTPAGEMAXSLOT */

	if (unlikely(p->header.stblindex >= DTPAGEMAXSLOT - stblsize)) {

		jfs_err("Bad stblindex:%d in dtpage (stbl size %d)\n",

				p->header.stblindex, stblsize);

		return false;

	}



	/* nextindex must be little then stblsize*32 */

	if (unlikely(p->header.nextindex > (stblsize << L2DTSLOTSIZE))) {

		jfs_err("Bad nextindex:%d in dtpage (stbl size %d)\n",

				p->header.nextindex, stblsize);

		return false;

	}



	/* Validate stbl entries

	 * Each entry is a slot index, valid range: -1 (invalid) or

	 * [0, nextindex-1] (valid data slots)

	 * (stblindex and higher slots are reserved for stbl itself)

	 */

	for (i = 0; i < p->header.nextindex; i++) {

		int idx = DT_GETSTBL(p)[i];



		/* Check if index is out of valid data slot range */

		if (unlikely(idx < 1 || idx >= DTPAGEMAXSLOT)) {

			jfs_err("Bad stbl[%d] index:%d (stblindex %d) in dtpage\n",

					i, idx, p->header.stblindex);

			return false;

		}



		/* Check for duplicate valid indices (skip -1) */

		if (unlikely(__test_and_set_bit(idx, bitmap))) {

			jfs_err("Duplicate index:%d in stbl of dtpage\n", idx);

			return false;

		}

	}



	return true;

}

fs/jfs/jfs_dtree.h

+4 −0
Original line number Diff line number Diff line
@@ -253,4 +253,8 @@ extern int dtModify(tid_t tid, struct inode *ip, struct component_name * key, 
		    ino_t * orig_ino, ino_t new_ino, int flag);



extern int jfs_readdir(struct file *file, struct dir_context *ctx);



extern bool check_dtroot(dtroot_t *p);



extern bool check_dtpage(dtpage_t *p);

#endif				/* !_H_JFS_DTREE */

fs/jfs/jfs_imap.c

+4 −0
Original line number Diff line number Diff line
@@ -3102,6 +3102,10 @@ static int copy_from_dinode(struct dinode * dip, struct inode *ip) 


	if (S_ISDIR(ip->i_mode)) {

		memcpy(&jfs_ip->u.dir, &dip->u._dir, 384);

		if (!check_dtroot(&jfs_ip->i_dtroot)) {

			jfs_error(ip->i_sb, "Corrupt dtroot\n");

			return -EIO;

		}

	} else if (S_ISREG(ip->i_mode) || S_ISLNK(ip->i_mode)) {

		memcpy(&jfs_ip->i_xtroot, &dip->di_xtroot, 288);

	} else

fs/jfs/jfs_logmgr.c

+14 −20
Original line number Diff line number Diff line
@@ -74,12 +74,6 @@ static struct lbuf *log_redrive_list; 
static DEFINE_SPINLOCK(log_redrive_lock);





/*

 *	log read/write serialization (per log)

 */

#define LOG_LOCK_INIT(log)	mutex_init(&(log)->loglock)

#define LOG_LOCK(log)		mutex_lock(&((log)->loglock))

#define LOG_UNLOCK(log)		mutex_unlock(&((log)->loglock))





/*
@@ -204,8 +198,12 @@ static void write_special_inodes(struct jfs_log *log, 
	struct jfs_sb_info *sbi;



	list_for_each_entry(sbi, &log->sb_list, log_list) {

		/* These pointers can be NULL before list_del during umount */

		if (sbi->ipbmap)

			writer(sbi->ipbmap->i_mapping);

		if (sbi->ipimap)

			writer(sbi->ipimap->i_mapping);

		if (sbi->direct_inode)

			writer(sbi->direct_inode->i_mapping);

	}

}
@@ -2180,8 +2178,6 @@ static void lbmIODone(struct bio *bio) 


	LCACHE_LOCK(flags);		/* disable+lock */



	bp->l_flag |= lbmDONE;



	if (bio->bi_status) {

		bp->l_flag |= lbmERROR;
@@ -2196,12 +2192,10 @@ static void lbmIODone(struct bio *bio) 
	if (bp->l_flag & lbmREAD) {

		bp->l_flag &= ~lbmREAD;



		LCACHE_UNLOCK(flags);	/* unlock+enable */



		/* wakeup I/O initiator */

		LCACHE_WAKEUP(&bp->l_ioevent);



		return;

		goto out;

	}



	/*
@@ -2225,8 +2219,7 @@ static void lbmIODone(struct bio *bio) 


	if (bp->l_flag & lbmDIRECT) {

		LCACHE_WAKEUP(&bp->l_ioevent);

		LCACHE_UNLOCK(flags);

		return;

		goto out;

	}



	tail = log->wqueue;
@@ -2278,8 +2271,6 @@ static void lbmIODone(struct bio *bio) 
	 * leave buffer for i/o initiator to dispose

	 */

	if (bp->l_flag & lbmSYNC) {

		LCACHE_UNLOCK(flags);	/* unlock+enable */



		/* wakeup I/O initiator */

		LCACHE_WAKEUP(&bp->l_ioevent);

	}
@@ -2290,6 +2281,7 @@ static void lbmIODone(struct bio *bio) 
	else if (bp->l_flag & lbmGC) {

		LCACHE_UNLOCK(flags);

		lmPostGC(bp);

		LCACHE_LOCK(flags);		/* disable+lock */

	}



	/*
@@ -2302,9 +2294,11 @@ static void lbmIODone(struct bio *bio) 
		assert(bp->l_flag & lbmRELEASE);

		assert(bp->l_flag & lbmFREE);

		lbmfree(bp);



		LCACHE_UNLOCK(flags);	/* unlock+enable */

	}



out:

	bp->l_flag |= lbmDONE;

	LCACHE_UNLOCK(flags);

}



int jfsIOWait(void *arg)