Files
linux/fs/hfs/dir.c
Linus Torvalds d29fd593e6 Merge tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs
Pull hfs/hfsplus updates from Viacheslav Dubeyko:
 "Several fixes in HFS/HFS+ of syzbot reported issues and HFS//HFS+
  fixes of xfstests failures.

   - fix a null-ptr-deref issue reported by syzbot (Edward Adam Davis)

     If the attributes file is not loaded during system mount
     hfsplus_create_attributes_file can dereference a NULL pointer.

     Also, add a b-tree node size check in hfs_btree_open() with the
     goal to prevent an uninit-value bug reported by syzbot for the case
     of corrupted HFS+ image.

   - fix __hfs_bnode_create() by using kzalloc_flex() instead of
     kzalloc() (Rosen Penev)

   - fix early return in hfs_bnode_read() (Tristan Madani)

     hfs_bnode_read() can return early without writing to the output
     buffer when is_bnode_offset_valid() fails or when
     check_and_correct_requested_ length() corrects the length to zero.
     Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass
     stack-allocated buffers and use the result unconditionally, leading
     to KMSAN uninit-value reports.

  The rest fix (1) generic/637, generic/729 issue for the case of HFS+
  file system, (2) generic/003, generic/637 for the case of HFS file
  system"

* tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs:
  hfs: rework hfsplus_readdir() logic
  hfs: disable the updating of file access times (atime)
  hfs: fix incorrect inode ID assignment in hfs_new_inode()
  hfsplus: rework hfsplus_readdir() logic
  hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
  hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
  hfsplus: Add a sanity check for btree node size
  hfsplus: fix issue of direct writes beyond end-of-file
  hfs/hfxplus: use kzalloc_flex()
  hfsplus: Remove the duplicate attr inode dirty marking action
2026-06-16 12:27:23 +05:30

332 lines
8.1 KiB
C

/*
* linux/fs/hfs/dir.c
*
* Copyright (C) 1995-1997 Paul H. Hargrove
* (C) 2003 Ardis Technologies <roman@ardistech.com>
* This file may be distributed under the terms of the GNU General Public License.
*
* This file contains directory-related functions independent of which
* scheme is being used to represent forks.
*
* Based on the minix file system code, (C) 1991, 1992 by Linus Torvalds
*/
#include "hfs_fs.h"
#include "btree.h"
/*
* hfs_lookup()
*/
static struct dentry *hfs_lookup(struct inode *dir, struct dentry *dentry,
unsigned int flags)
{
hfs_cat_rec rec;
struct hfs_find_data fd;
struct inode *inode = NULL;
int res;
res = hfs_find_init(HFS_SB(dir->i_sb)->cat_tree, &fd);
if (res)
return ERR_PTR(res);
hfs_cat_build_key(dir->i_sb, fd.search_key, dir->i_ino, &dentry->d_name);
res = hfs_brec_read(&fd, &rec, sizeof(rec));
if (res) {
if (res != -ENOENT)
inode = ERR_PTR(res);
} else {
inode = hfs_iget(dir->i_sb, &fd.search_key->cat, &rec);
if (!inode)
inode = ERR_PTR(-EACCES);
}
hfs_find_exit(&fd);
return d_splice_alias(inode, dentry);
}
/*
* hfs_readdir
*/
static int hfs_readdir(struct file *file, struct dir_context *ctx)
{
struct inode *inode = file_inode(file);
struct super_block *sb = inode->i_sb;
int len, err;
char strbuf[HFS_MAX_NAMELEN];
union hfs_cat_rec entry;
struct hfs_find_data fd;
struct hfs_readdir_data *rd;
u16 type;
if (ctx->pos >= inode->i_size)
return 0;
err = hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
if (err)
return err;
hfs_cat_build_key(sb, fd.search_key, inode->i_ino, NULL);
err = hfs_brec_find(&fd);
if (err)
goto out;
if (ctx->pos == 0) {
/* This is completely artificial... */
if (!dir_emit_dot(file, ctx))
goto out;
ctx->pos = 1;
}
if (ctx->pos == 1) {
if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
err = -EIO;
goto out;
}
hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
if (entry.type != HFS_CDR_THD) {
pr_err("bad catalog folder thread\n");
err = -EIO;
goto out;
}
//if (fd.entrylength < HFS_MIN_THREAD_SZ) {
// pr_err("truncated catalog thread\n");
// err = -EIO;
// goto out;
//}
if (!dir_emit(ctx, "..", 2,
be32_to_cpu(entry.thread.ParID), DT_DIR))
goto out;
ctx->pos = 2;
}
if (ctx->pos >= inode->i_size)
goto out;
rd = file->private_data;
if (rd && rd->pos == ctx->pos) {
memcpy(fd.search_key, &rd->key, sizeof(struct hfs_cat_key));
err = hfs_brec_find(&fd);
if (err == -ENOENT)
err = hfs_brec_goto(&fd, 1);
} else {
err = hfs_brec_goto(&fd, ctx->pos - 1);
}
if (err)
goto out;
for (;;) {
if (be32_to_cpu(fd.key->cat.ParID) != inode->i_ino) {
pr_err("walked past end of dir\n");
err = -EIO;
goto out;
}
if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
err = -EIO;
goto out;
}
hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
type = entry.type;
len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName);
if (type == HFS_CDR_DIR) {
if (fd.entrylength < sizeof(struct hfs_cat_dir)) {
pr_err("small dir entry\n");
err = -EIO;
goto out;
}
if (!dir_emit(ctx, strbuf, len,
be32_to_cpu(entry.dir.DirID), DT_DIR))
break;
} else if (type == HFS_CDR_FIL) {
if (fd.entrylength < sizeof(struct hfs_cat_file)) {
pr_err("small file entry\n");
err = -EIO;
goto out;
}
if (!dir_emit(ctx, strbuf, len,
be32_to_cpu(entry.file.FlNum), DT_REG))
break;
} else {
pr_err("bad catalog entry type %d\n", type);
err = -EIO;
goto out;
}
ctx->pos++;
if (ctx->pos >= inode->i_size)
goto out;
err = hfs_brec_goto(&fd, 1);
if (err)
goto out;
}
if (!rd) {
rd = kmalloc_obj(struct hfs_readdir_data);
if (!rd) {
err = -ENOMEM;
goto out;
}
file->private_data = rd;
}
rd->pos = ctx->pos;
memcpy(&rd->key, &fd.key->cat, sizeof(struct hfs_cat_key));
out:
hfs_find_exit(&fd);
return err;
}
static int hfs_dir_release(struct inode *inode, struct file *file)
{
kfree(file->private_data);
return 0;
}
/*
* hfs_create()
*
* This is the create() entry in the inode_operations structure for
* regular HFS directories. The purpose is to create a new file in
* a directory and return a corresponding inode, given the inode for
* the directory and the name (and its length) of the new file.
*/
static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, umode_t mode, bool excl)
{
struct inode *inode;
int res;
inode = hfs_new_inode(dir, &dentry->d_name, mode);
if (IS_ERR(inode))
return PTR_ERR(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
clear_nlink(inode);
hfs_delete_inode(inode);
iput(inode);
return res;
}
d_instantiate(dentry, inode);
mark_inode_dirty(inode);
return 0;
}
/*
* hfs_mkdir()
*
* This is the mkdir() entry in the inode_operations structure for
* regular HFS directories. The purpose is to create a new directory
* in a directory, given the inode for the parent directory and the
* name (and its length) of the new directory.
*/
static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, umode_t mode)
{
struct inode *inode;
int res;
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
if (IS_ERR(inode))
return ERR_CAST(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
clear_nlink(inode);
hfs_delete_inode(inode);
iput(inode);
return ERR_PTR(res);
}
d_instantiate(dentry, inode);
mark_inode_dirty(inode);
return NULL;
}
/*
* hfs_remove()
*
* This serves as both unlink() and rmdir() in the inode_operations
* structure for regular HFS directories. The purpose is to delete
* an existing child, given the inode for the parent directory and
* the name (and its length) of the existing directory.
*
* HFS does not have hardlinks, so both rmdir and unlink set the
* link count to 0. The only difference is the emptiness check.
*/
static int hfs_remove(struct inode *dir, struct dentry *dentry)
{
struct super_block *sb = dir->i_sb;
struct inode *inode = d_inode(dentry);
int res;
if (S_ISDIR(inode->i_mode) && inode->i_size != 2)
return -ENOTEMPTY;
if (unlikely(!is_hfs_cnid_counts_valid(sb))) {
pr_err("cannot remove file/folder\n");
return -ERANGE;
}
res = hfs_cat_delete(inode->i_ino, dir, &dentry->d_name);
if (res)
return res;
clear_nlink(inode);
inode_set_ctime_current(inode);
hfs_delete_inode(inode);
mark_inode_dirty(inode);
return 0;
}
/*
* hfs_rename()
*
* This is the rename() entry in the inode_operations structure for
* regular HFS directories. The purpose is to rename an existing
* file or directory, given the inode for the current directory and
* the name (and its length) of the existing file/directory and the
* inode for the new directory and the name (and its length) of the
* new file/directory.
* XXX: how do you handle must_be dir?
*/
static int hfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
struct dentry *old_dentry, struct inode *new_dir,
struct dentry *new_dentry, unsigned int flags)
{
int res;
if (flags & ~RENAME_NOREPLACE)
return -EINVAL;
/* Unlink destination if it already exists */
if (d_really_is_positive(new_dentry)) {
res = hfs_remove(new_dir, new_dentry);
if (res)
return res;
}
res = hfs_cat_move(d_inode(old_dentry)->i_ino,
old_dir, &old_dentry->d_name,
new_dir, &new_dentry->d_name);
if (!res) {
struct inode *inode = d_inode(old_dentry);
hfs_cat_build_key(old_dir->i_sb,
(btree_key *)&HFS_I(inode)->cat_key,
new_dir->i_ino, &new_dentry->d_name);
inode_set_ctime_current(inode);
mark_inode_dirty(inode);
}
return res;
}
const struct file_operations hfs_dir_operations = {
.read = generic_read_dir,
.iterate_shared = hfs_readdir,
.llseek = generic_file_llseek,
.release = hfs_dir_release,
};
const struct inode_operations hfs_dir_inode_operations = {
.create = hfs_create,
.lookup = hfs_lookup,
.unlink = hfs_remove,
.mkdir = hfs_mkdir,
.rmdir = hfs_remove,
.rename = hfs_rename,
.setattr = hfs_inode_setattr,
.fileattr_get = hfs_fileattr_get,
};