| blob | 4aef6c76406f6c70a703e5b50c312c64444e52e2 |
1 ext4: Avoid rec_len overflow with 64KB block size
3 From: Jan Kara <jack@suse.cz>
5 With 64KB blocksize, a directory entry can have size 64KB which does not fit
6 into 16 bits we have for entry lenght. So we store 0xffff instead and convert
7 value when read from / written to disk. The patch also converts some places
8 to use ext4_next_entry() when we are changing them anyway.
10 Signed-off-by: Jan Kara <jack@suse.cz>
11 Signed-off-by: Mingming Cao <cmm@us.ibm.com>
12 ---
14 fs/ext4/dir.c | 12 ++++---
15 fs/ext4/namei.c | 77 +++++++++++++++++++++++------------------------
16 include/linux/ext4_fs.h | 20 ++++++++++++
17 3 files changed, 63 insertions(+), 46 deletions(-)
20 diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
21 index f612bef..145a9c0 100644
22 --- a/fs/ext4/dir.c
23 +++ b/fs/ext4/dir.c
24 @@ -67,7 +67,7 @@ int ext4_check_dir_entry (const char * function, struct inode * dir,
25 unsigned long offset)
26 {
27 const char * error_msg = NULL;
28 - const int rlen = le16_to_cpu(de->rec_len);
29 + const int rlen = ext4_rec_len_from_disk(de->rec_len);
31 if (rlen < EXT4_DIR_REC_LEN(1))
32 error_msg = "rec_len is smaller than minimal";
33 @@ -172,10 +172,10 @@ revalidate:
34 * least that it is non-zero. A
35 * failure will be detected in the
36 * dirent test below. */
37 - if (le16_to_cpu(de->rec_len) <
38 - EXT4_DIR_REC_LEN(1))
39 + if (ext4_rec_len_from_disk(de->rec_len)
40 + < EXT4_DIR_REC_LEN(1))
41 break;
42 - i += le16_to_cpu(de->rec_len);
43 + i += ext4_rec_len_from_disk(de->rec_len);
44 }
45 offset = i;
46 filp->f_pos = (filp->f_pos & ~(sb->s_blocksize - 1))
47 @@ -197,7 +197,7 @@ revalidate:
48 ret = stored;
49 goto out;
50 }
51 - offset += le16_to_cpu(de->rec_len);
52 + offset += ext4_rec_len_from_disk(de->rec_len);
53 if (le32_to_cpu(de->inode)) {
54 /* We might block in the next section
55 * if the data destination is
56 @@ -219,7 +219,7 @@ revalidate:
57 goto revalidate;
58 stored ++;
59 }
60 - filp->f_pos += le16_to_cpu(de->rec_len);
61 + filp->f_pos += ext4_rec_len_from_disk(de->rec_len);
62 }
63 offset = 0;
64 brelse (bh);
65 diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
66 index 94ee6f3..d9a3a2f 100644
67 --- a/fs/ext4/namei.c
68 +++ b/fs/ext4/namei.c
69 @@ -280,7 +280,7 @@ static struct stats dx_show_leaf(struct dx_hash_info *hinfo, struct ext4_dir_ent
70 space += EXT4_DIR_REC_LEN(de->name_len);
71 names++;
72 }
73 - de = (struct ext4_dir_entry_2 *) ((char *) de + le16_to_cpu(de->rec_len));
74 + de = ext4_next_entry(de);
75 }
76 printk("(%i)\n", names);
77 return (struct stats) { names, space, 1 };
78 @@ -551,7 +551,8 @@ static int ext4_htree_next_block(struct inode *dir, __u32 hash,
79 */
80 static inline struct ext4_dir_entry_2 *ext4_next_entry(struct ext4_dir_entry_2 *p)
81 {
82 - return (struct ext4_dir_entry_2 *)((char*)p + le16_to_cpu(p->rec_len));
83 + return (struct ext4_dir_entry_2 *)((char *)p +
84 + ext4_rec_len_from_disk(p->rec_len));
85 }
87 /*
88 @@ -720,7 +721,7 @@ static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
89 cond_resched();
90 }
91 /* XXX: do we need to check rec_len == 0 case? -Chris */
92 - de = (struct ext4_dir_entry_2 *) ((char *) de + le16_to_cpu(de->rec_len));
93 + de = ext4_next_entry(de);
94 }
95 return count;
96 }
97 @@ -820,7 +821,7 @@ static inline int search_dirblock(struct buffer_head * bh,
98 return 1;
99 }
100 /* prevent looping on a bad block */
101 - de_len = le16_to_cpu(de->rec_len);
102 + de_len = ext4_rec_len_from_disk(de->rec_len);
103 if (de_len <= 0)
104 return -1;
105 offset += de_len;
106 @@ -1128,7 +1129,7 @@ dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
107 rec_len = EXT4_DIR_REC_LEN(de->name_len);
108 memcpy (to, de, rec_len);
109 ((struct ext4_dir_entry_2 *) to)->rec_len =
110 - cpu_to_le16(rec_len);
111 + ext4_rec_len_to_disk(rec_len);
112 de->inode = 0;
113 map++;
114 to += rec_len;
115 @@ -1147,13 +1148,12 @@ static struct ext4_dir_entry_2* dx_pack_dirents(char *base, int size)
117 prev = to = de;
118 while ((char*)de < base + size) {
119 - next = (struct ext4_dir_entry_2 *) ((char *) de +
120 - le16_to_cpu(de->rec_len));
121 + next = ext4_next_entry(de);
122 if (de->inode && de->name_len) {
123 rec_len = EXT4_DIR_REC_LEN(de->name_len);
124 if (de > to)
125 memmove(to, de, rec_len);
126 - to->rec_len = cpu_to_le16(rec_len);
127 + to->rec_len = ext4_rec_len_to_disk(rec_len);
128 prev = to;
129 to = (struct ext4_dir_entry_2 *) (((char *) to) + rec_len);
130 }
131 @@ -1227,8 +1227,8 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
132 /* Fancy dance to stay within two buffers */
133 de2 = dx_move_dirents(data1, data2, map + split, count - split);
134 de = dx_pack_dirents(data1,blocksize);
135 - de->rec_len = cpu_to_le16(data1 + blocksize - (char *) de);
136 - de2->rec_len = cpu_to_le16(data2 + blocksize - (char *) de2);
137 + de->rec_len = ext4_rec_len_to_disk(data1 + blocksize - (char *) de);
138 + de2->rec_len = ext4_rec_len_to_disk(data2 + blocksize - (char *) de2);
139 dxtrace(dx_show_leaf (hinfo, (struct ext4_dir_entry_2 *) data1, blocksize, 1));
140 dxtrace(dx_show_leaf (hinfo, (struct ext4_dir_entry_2 *) data2, blocksize, 1));
142 @@ -1297,7 +1297,7 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,
143 return -EEXIST;
144 }
145 nlen = EXT4_DIR_REC_LEN(de->name_len);
146 - rlen = le16_to_cpu(de->rec_len);
147 + rlen = ext4_rec_len_from_disk(de->rec_len);
148 if ((de->inode? rlen - nlen: rlen) >= reclen)
149 break;
150 de = (struct ext4_dir_entry_2 *)((char *)de + rlen);
151 @@ -1316,11 +1316,11 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,
153 /* By now the buffer is marked for journaling */
154 nlen = EXT4_DIR_REC_LEN(de->name_len);
155 - rlen = le16_to_cpu(de->rec_len);
156 + rlen = ext4_rec_len_from_disk(de->rec_len);
157 if (de->inode) {
158 struct ext4_dir_entry_2 *de1 = (struct ext4_dir_entry_2 *)((char *)de + nlen);
159 - de1->rec_len = cpu_to_le16(rlen - nlen);
160 - de->rec_len = cpu_to_le16(nlen);
161 + de1->rec_len = ext4_rec_len_to_disk(rlen - nlen);
162 + de->rec_len = ext4_rec_len_to_disk(nlen);
163 de = de1;
164 }
165 de->file_type = EXT4_FT_UNKNOWN;
166 @@ -1397,17 +1397,18 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
168 /* The 0th block becomes the root, move the dirents out */
169 fde = &root->dotdot;
170 - de = (struct ext4_dir_entry_2 *)((char *)fde + le16_to_cpu(fde->rec_len));
171 + de = (struct ext4_dir_entry_2 *)((char *)fde +
172 + ext4_rec_len_from_disk(fde->rec_len));
173 len = ((char *) root) + blocksize - (char *) de;
174 memcpy (data1, de, len);
175 de = (struct ext4_dir_entry_2 *) data1;
176 top = data1 + len;
177 - while ((char *)(de2=(void*)de+le16_to_cpu(de->rec_len)) < top)
178 + while ((char *)(de2 = ext4_next_entry(de)) < top)
179 de = de2;
180 - de->rec_len = cpu_to_le16(data1 + blocksize - (char *) de);
181 + de->rec_len = ext4_rec_len_to_disk(data1 + blocksize - (char *) de);
182 /* Initialize the root; the dot dirents already exist */
183 de = (struct ext4_dir_entry_2 *) (&root->dotdot);
184 - de->rec_len = cpu_to_le16(blocksize - EXT4_DIR_REC_LEN(2));
185 + de->rec_len = ext4_rec_len_to_disk(blocksize - EXT4_DIR_REC_LEN(2));
186 memset (&root->info, 0, sizeof(root->info));
187 root->info.info_length = sizeof(root->info);
188 root->info.hash_version = EXT4_SB(dir->i_sb)->s_def_hash_version;
189 @@ -1487,7 +1488,7 @@ static int ext4_add_entry (handle_t *handle, struct dentry *dentry,
190 return retval;
191 de = (struct ext4_dir_entry_2 *) bh->b_data;
192 de->inode = 0;
193 - de->rec_len = cpu_to_le16(blocksize);
194 + de->rec_len = ext4_rec_len_to_disk(blocksize);
195 return add_dirent_to_buf(handle, dentry, inode, de, bh);
196 }
198 @@ -1550,7 +1551,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
199 goto cleanup;
200 node2 = (struct dx_node *)(bh2->b_data);
201 entries2 = node2->entries;
202 - node2->fake.rec_len = cpu_to_le16(sb->s_blocksize);
203 + node2->fake.rec_len = ext4_rec_len_to_disk(sb->s_blocksize);
204 node2->fake.inode = 0;
205 BUFFER_TRACE(frame->bh, "get_write_access");
206 err = ext4_journal_get_write_access(handle, frame->bh);
207 @@ -1648,9 +1649,9 @@ static int ext4_delete_entry (handle_t *handle,
208 BUFFER_TRACE(bh, "get_write_access");
209 ext4_journal_get_write_access(handle, bh);
210 if (pde)
211 - pde->rec_len =
212 - cpu_to_le16(le16_to_cpu(pde->rec_len) +
213 - le16_to_cpu(de->rec_len));
214 + pde->rec_len = ext4_rec_len_to_disk(
215 + ext4_rec_len_from_disk(pde->rec_len) +
216 + ext4_rec_len_from_disk(de->rec_len));
217 else
218 de->inode = 0;
219 dir->i_version++;
220 @@ -1658,10 +1659,9 @@ static int ext4_delete_entry (handle_t *handle,
221 ext4_journal_dirty_metadata(handle, bh);
222 return 0;
223 }
224 - i += le16_to_cpu(de->rec_len);
225 + i += ext4_rec_len_from_disk(de->rec_len);
226 pde = de;
227 - de = (struct ext4_dir_entry_2 *)
228 - ((char *) de + le16_to_cpu(de->rec_len));
229 + de = ext4_next_entry(de);
230 }
231 return -ENOENT;
232 }
233 @@ -1824,13 +1824,13 @@ retry:
234 de = (struct ext4_dir_entry_2 *) dir_block->b_data;
235 de->inode = cpu_to_le32(inode->i_ino);
236 de->name_len = 1;
237 - de->rec_len = cpu_to_le16(EXT4_DIR_REC_LEN(de->name_len));
238 + de->rec_len = ext4_rec_len_to_disk(EXT4_DIR_REC_LEN(de->name_len));
239 strcpy (de->name, ".");
240 ext4_set_de_type(dir->i_sb, de, S_IFDIR);
241 - de = (struct ext4_dir_entry_2 *)
242 - ((char *) de + le16_to_cpu(de->rec_len));
243 + de = ext4_next_entry(de);
244 de->inode = cpu_to_le32(dir->i_ino);
245 - de->rec_len = cpu_to_le16(inode->i_sb->s_blocksize-EXT4_DIR_REC_LEN(1));
246 + de->rec_len = ext4_rec_len_to_disk(inode->i_sb->s_blocksize -
247 + EXT4_DIR_REC_LEN(1));
248 de->name_len = 2;
249 strcpy (de->name, "..");
250 ext4_set_de_type(dir->i_sb, de, S_IFDIR);
251 @@ -1882,8 +1882,7 @@ static int empty_dir (struct inode * inode)
252 return 1;
253 }
254 de = (struct ext4_dir_entry_2 *) bh->b_data;
255 - de1 = (struct ext4_dir_entry_2 *)
256 - ((char *) de + le16_to_cpu(de->rec_len));
257 + de1 = ext4_next_entry(de);
258 if (le32_to_cpu(de->inode) != inode->i_ino ||
259 !le32_to_cpu(de1->inode) ||
260 strcmp (".", de->name) ||
261 @@ -1894,9 +1893,9 @@ static int empty_dir (struct inode * inode)
262 brelse (bh);
263 return 1;
264 }
265 - offset = le16_to_cpu(de->rec_len) + le16_to_cpu(de1->rec_len);
266 - de = (struct ext4_dir_entry_2 *)
267 - ((char *) de1 + le16_to_cpu(de1->rec_len));
268 + offset = ext4_rec_len_from_disk(de->rec_len) +
269 + ext4_rec_len_from_disk(de1->rec_len);
270 + de = ext4_next_entry(de1);
271 while (offset < inode->i_size ) {
272 if (!bh ||
273 (void *) de >= (void *) (bh->b_data+sb->s_blocksize)) {
274 @@ -1925,9 +1924,8 @@ static int empty_dir (struct inode * inode)
275 brelse (bh);
276 return 0;
277 }
278 - offset += le16_to_cpu(de->rec_len);
279 - de = (struct ext4_dir_entry_2 *)
280 - ((char *) de + le16_to_cpu(de->rec_len));
281 + offset += ext4_rec_len_from_disk(de->rec_len);
282 + de = ext4_next_entry(de);
283 }
284 brelse (bh);
285 return 1;
286 @@ -2282,8 +2280,7 @@ retry:
287 }
289 #define PARENT_INO(buffer) \
290 - ((struct ext4_dir_entry_2 *) ((char *) buffer + \
291 - le16_to_cpu(((struct ext4_dir_entry_2 *) buffer)->rec_len)))->inode
292 + (ext4_next_entry((struct ext4_dir_entry_2 *)(buffer))->inode)
294 /*
295 * Anybody can rename anything with this: the permission checks are left to the
296 diff --git a/include/linux/ext4_fs.h b/include/linux/ext4_fs.h
297 index dfe4487..fb31c1a 100644
298 --- a/include/linux/ext4_fs.h
299 +++ b/include/linux/ext4_fs.h
300 @@ -767,6 +767,26 @@ struct ext4_dir_entry_2 {
301 #define EXT4_DIR_ROUND (EXT4_DIR_PAD - 1)
302 #define EXT4_DIR_REC_LEN(name_len) (((name_len) + 8 + EXT4_DIR_ROUND) & \
303 ~EXT4_DIR_ROUND)
304 +#define EXT4_MAX_REC_LEN ((1<<16)-1)
305 +
306 +static inline unsigned ext4_rec_len_from_disk(__le16 dlen)
307 +{
308 + unsigned len = le16_to_cpu(dlen);
309 +
310 + if (len == EXT4_MAX_REC_LEN)
311 + return 1 << 16;
312 + return len;
313 +}
314 +
315 +static inline __le16 ext4_rec_len_to_disk(unsigned len)
316 +{
317 + if (len == (1 << 16))
318 + return cpu_to_le16(EXT4_MAX_REC_LEN);
319 + else if (len > (1 << 16))
320 + BUG();
321 + return cpu_to_le16(len);
322 +}
323 +
324 /*
325 * Hash Tree Directory indexing
326 * (c) Daniel Phillips, 2001