HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
[linux/fpc-iii.git] / fs / jffs2 / file.c
blob3361979d728c0b5e7d1714c02e7b34428fcc658c
1 /*
2 * JFFS2 -- Journalling Flash File System, Version 2.
4 * Copyright © 2001-2007 Red Hat, Inc.
5 * Copyright © 2004-2010 David Woodhouse <dwmw2@infradead.org>
7 * Created by David Woodhouse <dwmw2@infradead.org>
9 * For licensing information, see the file 'LICENCE' in this directory.
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 #include <linux/kernel.h>
16 #include <linux/fs.h>
17 #include <linux/time.h>
18 #include <linux/pagemap.h>
19 #include <linux/highmem.h>
20 #include <linux/crc32.h>
21 #include <linux/jffs2.h>
22 #include "nodelist.h"
24 static int jffs2_write_end(struct file *filp, struct address_space *mapping,
25 loff_t pos, unsigned len, unsigned copied,
26 struct page *pg, void *fsdata);
27 static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
28 loff_t pos, unsigned len, unsigned flags,
29 struct page **pagep, void **fsdata);
30 static int jffs2_readpage (struct file *filp, struct page *pg);
32 int jffs2_fsync(struct file *filp, loff_t start, loff_t end, int datasync)
34 struct inode *inode = filp->f_mapping->host;
35 struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
36 int ret;
38 ret = filemap_write_and_wait_range(inode->i_mapping, start, end);
39 if (ret)
40 return ret;
42 mutex_lock(&inode->i_mutex);
43 /* Trigger GC to flush any pending writes for this inode */
44 jffs2_flush_wbuf_gc(c, inode->i_ino);
45 mutex_unlock(&inode->i_mutex);
47 return 0;
50 const struct file_operations jffs2_file_operations =
52 .llseek = generic_file_llseek,
53 .open = generic_file_open,
54 .read_iter = generic_file_read_iter,
55 .write_iter = generic_file_write_iter,
56 .unlocked_ioctl=jffs2_ioctl,
57 .mmap = generic_file_readonly_mmap,
58 .fsync = jffs2_fsync,
59 .splice_read = generic_file_splice_read,
62 /* jffs2_file_inode_operations */
64 const struct inode_operations jffs2_file_inode_operations =
66 .get_acl = jffs2_get_acl,
67 .set_acl = jffs2_set_acl,
68 .setattr = jffs2_setattr,
69 .setxattr = jffs2_setxattr,
70 .getxattr = jffs2_getxattr,
71 .listxattr = jffs2_listxattr,
72 .removexattr = jffs2_removexattr
75 const struct address_space_operations jffs2_file_address_operations =
77 .readpage = jffs2_readpage,
78 .write_begin = jffs2_write_begin,
79 .write_end = jffs2_write_end,
82 static int jffs2_do_readpage_nolock (struct inode *inode, struct page *pg)
84 struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
85 struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
86 unsigned char *pg_buf;
87 int ret;
89 jffs2_dbg(2, "%s(): ino #%lu, page at offset 0x%lx\n",
90 __func__, inode->i_ino, pg->index << PAGE_CACHE_SHIFT);
92 BUG_ON(!PageLocked(pg));
94 pg_buf = kmap(pg);
95 /* FIXME: Can kmap fail? */
97 ret = jffs2_read_inode_range(c, f, pg_buf, pg->index << PAGE_CACHE_SHIFT, PAGE_CACHE_SIZE);
99 if (ret) {
100 ClearPageUptodate(pg);
101 SetPageError(pg);
102 } else {
103 SetPageUptodate(pg);
104 ClearPageError(pg);
107 flush_dcache_page(pg);
108 kunmap(pg);
110 jffs2_dbg(2, "readpage finished\n");
111 return ret;
114 int jffs2_do_readpage_unlock(struct inode *inode, struct page *pg)
116 int ret = jffs2_do_readpage_nolock(inode, pg);
117 unlock_page(pg);
118 return ret;
122 static int jffs2_readpage (struct file *filp, struct page *pg)
124 struct jffs2_inode_info *f = JFFS2_INODE_INFO(pg->mapping->host);
125 int ret;
127 mutex_lock(&f->sem);
128 ret = jffs2_do_readpage_unlock(pg->mapping->host, pg);
129 mutex_unlock(&f->sem);
130 return ret;
133 static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
134 loff_t pos, unsigned len, unsigned flags,
135 struct page **pagep, void **fsdata)
137 struct page *pg;
138 struct inode *inode = mapping->host;
139 struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
140 pgoff_t index = pos >> PAGE_CACHE_SHIFT;
141 uint32_t pageofs = index << PAGE_CACHE_SHIFT;
142 int ret = 0;
144 pg = grab_cache_page_write_begin(mapping, index, flags);
145 if (!pg)
146 return -ENOMEM;
147 *pagep = pg;
149 jffs2_dbg(1, "%s()\n", __func__);
151 if (pageofs > inode->i_size) {
152 /* Make new hole frag from old EOF to new page */
153 struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
154 struct jffs2_raw_inode ri;
155 struct jffs2_full_dnode *fn;
156 uint32_t alloc_len;
158 jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n",
159 (unsigned int)inode->i_size, pageofs);
161 ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
162 ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
163 if (ret)
164 goto out_page;
166 mutex_lock(&f->sem);
167 memset(&ri, 0, sizeof(ri));
169 ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
170 ri.nodetype = cpu_to_je16(JFFS2_NODETYPE_INODE);
171 ri.totlen = cpu_to_je32(sizeof(ri));
172 ri.hdr_crc = cpu_to_je32(crc32(0, &ri, sizeof(struct jffs2_unknown_node)-4));
174 ri.ino = cpu_to_je32(f->inocache->ino);
175 ri.version = cpu_to_je32(++f->highest_version);
176 ri.mode = cpu_to_jemode(inode->i_mode);
177 ri.uid = cpu_to_je16(i_uid_read(inode));
178 ri.gid = cpu_to_je16(i_gid_read(inode));
179 ri.isize = cpu_to_je32(max((uint32_t)inode->i_size, pageofs));
180 ri.atime = ri.ctime = ri.mtime = cpu_to_je32(get_seconds());
181 ri.offset = cpu_to_je32(inode->i_size);
182 ri.dsize = cpu_to_je32(pageofs - inode->i_size);
183 ri.csize = cpu_to_je32(0);
184 ri.compr = JFFS2_COMPR_ZERO;
185 ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
186 ri.data_crc = cpu_to_je32(0);
188 fn = jffs2_write_dnode(c, f, &ri, NULL, 0, ALLOC_NORMAL);
190 if (IS_ERR(fn)) {
191 ret = PTR_ERR(fn);
192 jffs2_complete_reservation(c);
193 mutex_unlock(&f->sem);
194 goto out_page;
196 ret = jffs2_add_full_dnode_to_inode(c, f, fn);
197 if (f->metadata) {
198 jffs2_mark_node_obsolete(c, f->metadata->raw);
199 jffs2_free_full_dnode(f->metadata);
200 f->metadata = NULL;
202 if (ret) {
203 jffs2_dbg(1, "Eep. add_full_dnode_to_inode() failed in write_begin, returned %d\n",
204 ret);
205 jffs2_mark_node_obsolete(c, fn->raw);
206 jffs2_free_full_dnode(fn);
207 jffs2_complete_reservation(c);
208 mutex_unlock(&f->sem);
209 goto out_page;
211 jffs2_complete_reservation(c);
212 inode->i_size = pageofs;
213 mutex_unlock(&f->sem);
217 * Read in the page if it wasn't already present. Cannot optimize away
218 * the whole page write case until jffs2_write_end can handle the
219 * case of a short-copy.
221 if (!PageUptodate(pg)) {
222 mutex_lock(&f->sem);
223 ret = jffs2_do_readpage_nolock(inode, pg);
224 mutex_unlock(&f->sem);
225 if (ret)
226 goto out_page;
228 jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags);
229 return ret;
231 out_page:
232 unlock_page(pg);
233 page_cache_release(pg);
234 return ret;
237 static int jffs2_write_end(struct file *filp, struct address_space *mapping,
238 loff_t pos, unsigned len, unsigned copied,
239 struct page *pg, void *fsdata)
241 /* Actually commit the write from the page cache page we're looking at.
242 * For now, we write the full page out each time. It sucks, but it's simple
244 struct inode *inode = mapping->host;
245 struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
246 struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
247 struct jffs2_raw_inode *ri;
248 unsigned start = pos & (PAGE_CACHE_SIZE - 1);
249 unsigned end = start + copied;
250 unsigned aligned_start = start & ~3;
251 int ret = 0;
252 uint32_t writtenlen = 0;
254 jffs2_dbg(1, "%s(): ino #%lu, page at 0x%lx, range %d-%d, flags %lx\n",
255 __func__, inode->i_ino, pg->index << PAGE_CACHE_SHIFT,
256 start, end, pg->flags);
258 /* We need to avoid deadlock with page_cache_read() in
259 jffs2_garbage_collect_pass(). So the page must be
260 up to date to prevent page_cache_read() from trying
261 to re-lock it. */
262 BUG_ON(!PageUptodate(pg));
264 if (end == PAGE_CACHE_SIZE) {
265 /* When writing out the end of a page, write out the
266 _whole_ page. This helps to reduce the number of
267 nodes in files which have many short writes, like
268 syslog files. */
269 aligned_start = 0;
272 ri = jffs2_alloc_raw_inode();
274 if (!ri) {
275 jffs2_dbg(1, "%s(): Allocation of raw inode failed\n",
276 __func__);
277 unlock_page(pg);
278 page_cache_release(pg);
279 return -ENOMEM;
282 /* Set the fields that the generic jffs2_write_inode_range() code can't find */
283 ri->ino = cpu_to_je32(inode->i_ino);
284 ri->mode = cpu_to_jemode(inode->i_mode);
285 ri->uid = cpu_to_je16(i_uid_read(inode));
286 ri->gid = cpu_to_je16(i_gid_read(inode));
287 ri->isize = cpu_to_je32((uint32_t)inode->i_size);
288 ri->atime = ri->ctime = ri->mtime = cpu_to_je32(get_seconds());
290 /* In 2.4, it was already kmapped by generic_file_write(). Doesn't
291 hurt to do it again. The alternative is ifdefs, which are ugly. */
292 kmap(pg);
294 ret = jffs2_write_inode_range(c, f, ri, page_address(pg) + aligned_start,
295 (pg->index << PAGE_CACHE_SHIFT) + aligned_start,
296 end - aligned_start, &writtenlen);
298 kunmap(pg);
300 if (ret) {
301 /* There was an error writing. */
302 SetPageError(pg);
305 /* Adjust writtenlen for the padding we did, so we don't confuse our caller */
306 writtenlen -= min(writtenlen, (start - aligned_start));
308 if (writtenlen) {
309 if (inode->i_size < pos + writtenlen) {
310 inode->i_size = pos + writtenlen;
311 inode->i_blocks = (inode->i_size + 511) >> 9;
313 inode->i_ctime = inode->i_mtime = ITIME(je32_to_cpu(ri->ctime));
317 jffs2_free_raw_inode(ri);
319 if (start+writtenlen < end) {
320 /* generic_file_write has written more to the page cache than we've
321 actually written to the medium. Mark the page !Uptodate so that
322 it gets reread */
323 jffs2_dbg(1, "%s(): Not all bytes written. Marking page !uptodate\n",
324 __func__);
325 SetPageError(pg);
326 ClearPageUptodate(pg);
329 jffs2_dbg(1, "%s() returning %d\n",
330 __func__, writtenlen > 0 ? writtenlen : ret);
331 unlock_page(pg);
332 page_cache_release(pg);
333 return writtenlen > 0 ? writtenlen : ret;