HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
[linux/fpc-iii.git] / fs / romfs / super.c
blob5f4f1882dc7d1dda1164a5cca1aba2175231ee5d
1 /* Block- or MTD-based romfs
3 * Copyright © 2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * Derived from: ROMFS file system, Linux implementation
8 * Copyright © 1997-1999 Janos Farkas <chexum@shadow.banki.hu>
10 * Using parts of the minix filesystem
11 * Copyright © 1991, 1992 Linus Torvalds
13 * and parts of the affs filesystem additionally
14 * Copyright © 1993 Ray Burr
15 * Copyright © 1996 Hans-Joachim Widmaier
17 * Changes
18 * Changed for 2.1.19 modules
19 * Jan 1997 Initial release
20 * Jun 1997 2.1.43+ changes
21 * Proper page locking in readpage
22 * Changed to work with 2.1.45+ fs
23 * Jul 1997 Fixed follow_link
24 * 2.1.47
25 * lookup shouldn't return -ENOENT
26 * from Horst von Brand:
27 * fail on wrong checksum
28 * double unlock_super was possible
29 * correct namelen for statfs
30 * spotted by Bill Hawes:
31 * readlink shouldn't iput()
32 * Jun 1998 2.1.106 from Avery Pennarun: glibc scandir()
33 * exposed a problem in readdir
34 * 2.1.107 code-freeze spellchecker run
35 * Aug 1998 2.1.118+ VFS changes
36 * Sep 1998 2.1.122 another VFS change (follow_link)
37 * Apr 1999 2.2.7 no more EBADF checking in
38 * lookup/readdir, use ERR_PTR
39 * Jun 1999 2.3.6 d_alloc_root use changed
40 * 2.3.9 clean up usage of ENOENT/negative
41 * dentries in lookup
42 * clean up page flags setting
43 * (error, uptodate, locking) in
44 * in readpage
45 * use init_special_inode for
46 * fifos/sockets (and streamline) in
47 * read_inode, fix _ops table order
48 * Aug 1999 2.3.16 __initfunc() => __init change
49 * Oct 1999 2.3.24 page->owner hack obsoleted
50 * Nov 1999 2.3.27 2.3.25+ page->offset => index change
53 * This program is free software; you can redistribute it and/or
54 * modify it under the terms of the GNU General Public Licence
55 * as published by the Free Software Foundation; either version
56 * 2 of the Licence, or (at your option) any later version.
59 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
61 #include <linux/module.h>
62 #include <linux/string.h>
63 #include <linux/fs.h>
64 #include <linux/time.h>
65 #include <linux/slab.h>
66 #include <linux/init.h>
67 #include <linux/blkdev.h>
68 #include <linux/parser.h>
69 #include <linux/mount.h>
70 #include <linux/namei.h>
71 #include <linux/statfs.h>
72 #include <linux/mtd/super.h>
73 #include <linux/ctype.h>
74 #include <linux/highmem.h>
75 #include <linux/pagemap.h>
76 #include <linux/uaccess.h>
77 #include <linux/major.h>
78 #include "internal.h"
80 static struct kmem_cache *romfs_inode_cachep;
82 static const umode_t romfs_modemap[8] = {
83 0, /* hard link */
84 S_IFDIR | 0644, /* directory */
85 S_IFREG | 0644, /* regular file */
86 S_IFLNK | 0777, /* symlink */
87 S_IFBLK | 0600, /* blockdev */
88 S_IFCHR | 0600, /* chardev */
89 S_IFSOCK | 0644, /* socket */
90 S_IFIFO | 0644 /* FIFO */
93 static const unsigned char romfs_dtype_table[] = {
94 DT_UNKNOWN, DT_DIR, DT_REG, DT_LNK, DT_BLK, DT_CHR, DT_SOCK, DT_FIFO
97 static struct inode *romfs_iget(struct super_block *sb, unsigned long pos);
100 * read a page worth of data from the image
102 static int romfs_readpage(struct file *file, struct page *page)
104 struct inode *inode = page->mapping->host;
105 loff_t offset, size;
106 unsigned long fillsize, pos;
107 void *buf;
108 int ret;
110 buf = kmap(page);
111 if (!buf)
112 return -ENOMEM;
114 /* 32 bit warning -- but not for us :) */
115 offset = page_offset(page);
116 size = i_size_read(inode);
117 fillsize = 0;
118 ret = 0;
119 if (offset < size) {
120 size -= offset;
121 fillsize = size > PAGE_SIZE ? PAGE_SIZE : size;
123 pos = ROMFS_I(inode)->i_dataoffset + offset;
125 ret = romfs_dev_read(inode->i_sb, pos, buf, fillsize);
126 if (ret < 0) {
127 SetPageError(page);
128 fillsize = 0;
129 ret = -EIO;
133 if (fillsize < PAGE_SIZE)
134 memset(buf + fillsize, 0, PAGE_SIZE - fillsize);
135 if (ret == 0)
136 SetPageUptodate(page);
138 flush_dcache_page(page);
139 kunmap(page);
140 unlock_page(page);
141 return ret;
144 static const struct address_space_operations romfs_aops = {
145 .readpage = romfs_readpage
149 * read the entries from a directory
151 static int romfs_readdir(struct file *file, struct dir_context *ctx)
153 struct inode *i = file_inode(file);
154 struct romfs_inode ri;
155 unsigned long offset, maxoff;
156 int j, ino, nextfh;
157 char fsname[ROMFS_MAXFN]; /* XXX dynamic? */
158 int ret;
160 maxoff = romfs_maxsize(i->i_sb);
162 offset = ctx->pos;
163 if (!offset) {
164 offset = i->i_ino & ROMFH_MASK;
165 ret = romfs_dev_read(i->i_sb, offset, &ri, ROMFH_SIZE);
166 if (ret < 0)
167 goto out;
168 offset = be32_to_cpu(ri.spec) & ROMFH_MASK;
171 /* Not really failsafe, but we are read-only... */
172 for (;;) {
173 if (!offset || offset >= maxoff) {
174 offset = maxoff;
175 ctx->pos = offset;
176 goto out;
178 ctx->pos = offset;
180 /* Fetch inode info */
181 ret = romfs_dev_read(i->i_sb, offset, &ri, ROMFH_SIZE);
182 if (ret < 0)
183 goto out;
185 j = romfs_dev_strnlen(i->i_sb, offset + ROMFH_SIZE,
186 sizeof(fsname) - 1);
187 if (j < 0)
188 goto out;
190 ret = romfs_dev_read(i->i_sb, offset + ROMFH_SIZE, fsname, j);
191 if (ret < 0)
192 goto out;
193 fsname[j] = '\0';
195 ino = offset;
196 nextfh = be32_to_cpu(ri.next);
197 if ((nextfh & ROMFH_TYPE) == ROMFH_HRD)
198 ino = be32_to_cpu(ri.spec);
199 if (!dir_emit(ctx, fsname, j, ino,
200 romfs_dtype_table[nextfh & ROMFH_TYPE]))
201 goto out;
203 offset = nextfh & ROMFH_MASK;
205 out:
206 return 0;
210 * look up an entry in a directory
212 static struct dentry *romfs_lookup(struct inode *dir, struct dentry *dentry,
213 unsigned int flags)
215 unsigned long offset, maxoff;
216 struct inode *inode;
217 struct romfs_inode ri;
218 const char *name; /* got from dentry */
219 int len, ret;
221 offset = dir->i_ino & ROMFH_MASK;
222 ret = romfs_dev_read(dir->i_sb, offset, &ri, ROMFH_SIZE);
223 if (ret < 0)
224 goto error;
226 /* search all the file entries in the list starting from the one
227 * pointed to by the directory's special data */
228 maxoff = romfs_maxsize(dir->i_sb);
229 offset = be32_to_cpu(ri.spec) & ROMFH_MASK;
231 name = dentry->d_name.name;
232 len = dentry->d_name.len;
234 for (;;) {
235 if (!offset || offset >= maxoff)
236 goto out0;
238 ret = romfs_dev_read(dir->i_sb, offset, &ri, sizeof(ri));
239 if (ret < 0)
240 goto error;
242 /* try to match the first 16 bytes of name */
243 ret = romfs_dev_strcmp(dir->i_sb, offset + ROMFH_SIZE, name,
244 len);
245 if (ret < 0)
246 goto error;
247 if (ret == 1)
248 break;
250 /* next entry */
251 offset = be32_to_cpu(ri.next) & ROMFH_MASK;
254 /* Hard link handling */
255 if ((be32_to_cpu(ri.next) & ROMFH_TYPE) == ROMFH_HRD)
256 offset = be32_to_cpu(ri.spec) & ROMFH_MASK;
258 inode = romfs_iget(dir->i_sb, offset);
259 if (IS_ERR(inode)) {
260 ret = PTR_ERR(inode);
261 goto error;
263 goto outi;
266 * it's a bit funky, _lookup needs to return an error code
267 * (negative) or a NULL, both as a dentry. ENOENT should not
268 * be returned, instead we need to create a negative dentry by
269 * d_add(dentry, NULL); and return 0 as no error.
270 * (Although as I see, it only matters on writable file
271 * systems).
273 out0:
274 inode = NULL;
275 outi:
276 d_add(dentry, inode);
277 ret = 0;
278 error:
279 return ERR_PTR(ret);
282 static const struct file_operations romfs_dir_operations = {
283 .read = generic_read_dir,
284 .iterate = romfs_readdir,
285 .llseek = default_llseek,
288 static const struct inode_operations romfs_dir_inode_operations = {
289 .lookup = romfs_lookup,
293 * get a romfs inode based on its position in the image (which doubles as the
294 * inode number)
296 static struct inode *romfs_iget(struct super_block *sb, unsigned long pos)
298 struct romfs_inode_info *inode;
299 struct romfs_inode ri;
300 struct inode *i;
301 unsigned long nlen;
302 unsigned nextfh;
303 int ret;
304 umode_t mode;
306 /* we might have to traverse a chain of "hard link" file entries to get
307 * to the actual file */
308 for (;;) {
309 ret = romfs_dev_read(sb, pos, &ri, sizeof(ri));
310 if (ret < 0)
311 goto error;
313 /* XXX: do romfs_checksum here too (with name) */
315 nextfh = be32_to_cpu(ri.next);
316 if ((nextfh & ROMFH_TYPE) != ROMFH_HRD)
317 break;
319 pos = be32_to_cpu(ri.spec) & ROMFH_MASK;
322 /* determine the length of the filename */
323 nlen = romfs_dev_strnlen(sb, pos + ROMFH_SIZE, ROMFS_MAXFN);
324 if (IS_ERR_VALUE(nlen))
325 goto eio;
327 /* get an inode for this image position */
328 i = iget_locked(sb, pos);
329 if (!i)
330 return ERR_PTR(-ENOMEM);
332 if (!(i->i_state & I_NEW))
333 return i;
335 /* precalculate the data offset */
336 inode = ROMFS_I(i);
337 inode->i_metasize = (ROMFH_SIZE + nlen + 1 + ROMFH_PAD) & ROMFH_MASK;
338 inode->i_dataoffset = pos + inode->i_metasize;
340 set_nlink(i, 1); /* Hard to decide.. */
341 i->i_size = be32_to_cpu(ri.size);
342 i->i_mtime.tv_sec = i->i_atime.tv_sec = i->i_ctime.tv_sec = 0;
343 i->i_mtime.tv_nsec = i->i_atime.tv_nsec = i->i_ctime.tv_nsec = 0;
345 /* set up mode and ops */
346 mode = romfs_modemap[nextfh & ROMFH_TYPE];
348 switch (nextfh & ROMFH_TYPE) {
349 case ROMFH_DIR:
350 i->i_size = ROMFS_I(i)->i_metasize;
351 i->i_op = &romfs_dir_inode_operations;
352 i->i_fop = &romfs_dir_operations;
353 if (nextfh & ROMFH_EXEC)
354 mode |= S_IXUGO;
355 break;
356 case ROMFH_REG:
357 i->i_fop = &romfs_ro_fops;
358 i->i_data.a_ops = &romfs_aops;
359 if (nextfh & ROMFH_EXEC)
360 mode |= S_IXUGO;
361 break;
362 case ROMFH_SYM:
363 i->i_op = &page_symlink_inode_operations;
364 i->i_data.a_ops = &romfs_aops;
365 mode |= S_IRWXUGO;
366 break;
367 default:
368 /* depending on MBZ for sock/fifos */
369 nextfh = be32_to_cpu(ri.spec);
370 init_special_inode(i, mode, MKDEV(nextfh >> 16,
371 nextfh & 0xffff));
372 break;
375 i->i_mode = mode;
377 unlock_new_inode(i);
378 return i;
380 eio:
381 ret = -EIO;
382 error:
383 pr_err("read error for inode 0x%lx\n", pos);
384 return ERR_PTR(ret);
388 * allocate a new inode
390 static struct inode *romfs_alloc_inode(struct super_block *sb)
392 struct romfs_inode_info *inode;
394 inode = kmem_cache_alloc(romfs_inode_cachep, GFP_KERNEL);
395 return inode ? &inode->vfs_inode : NULL;
399 * return a spent inode to the slab cache
401 static void romfs_i_callback(struct rcu_head *head)
403 struct inode *inode = container_of(head, struct inode, i_rcu);
405 kmem_cache_free(romfs_inode_cachep, ROMFS_I(inode));
408 static void romfs_destroy_inode(struct inode *inode)
410 call_rcu(&inode->i_rcu, romfs_i_callback);
414 * get filesystem statistics
416 static int romfs_statfs(struct dentry *dentry, struct kstatfs *buf)
418 struct super_block *sb = dentry->d_sb;
419 u64 id = 0;
421 /* When calling huge_encode_dev(),
422 * use sb->s_bdev->bd_dev when,
423 * - CONFIG_ROMFS_ON_BLOCK defined
424 * use sb->s_dev when,
425 * - CONFIG_ROMFS_ON_BLOCK undefined and
426 * - CONFIG_ROMFS_ON_MTD defined
427 * leave id as 0 when,
428 * - CONFIG_ROMFS_ON_BLOCK undefined and
429 * - CONFIG_ROMFS_ON_MTD undefined
431 if (sb->s_bdev)
432 id = huge_encode_dev(sb->s_bdev->bd_dev);
433 else if (sb->s_dev)
434 id = huge_encode_dev(sb->s_dev);
436 buf->f_type = ROMFS_MAGIC;
437 buf->f_namelen = ROMFS_MAXFN;
438 buf->f_bsize = ROMBSIZE;
439 buf->f_bfree = buf->f_bavail = buf->f_ffree;
440 buf->f_blocks =
441 (romfs_maxsize(dentry->d_sb) + ROMBSIZE - 1) >> ROMBSBITS;
442 buf->f_fsid.val[0] = (u32)id;
443 buf->f_fsid.val[1] = (u32)(id >> 32);
444 return 0;
448 * remounting must involve read-only
450 static int romfs_remount(struct super_block *sb, int *flags, char *data)
452 sync_filesystem(sb);
453 *flags |= MS_RDONLY;
454 return 0;
457 static const struct super_operations romfs_super_ops = {
458 .alloc_inode = romfs_alloc_inode,
459 .destroy_inode = romfs_destroy_inode,
460 .statfs = romfs_statfs,
461 .remount_fs = romfs_remount,
465 * checksum check on part of a romfs filesystem
467 static __u32 romfs_checksum(const void *data, int size)
469 const __be32 *ptr = data;
470 __u32 sum;
472 sum = 0;
473 size >>= 2;
474 while (size > 0) {
475 sum += be32_to_cpu(*ptr++);
476 size--;
478 return sum;
482 * fill in the superblock
484 static int romfs_fill_super(struct super_block *sb, void *data, int silent)
486 struct romfs_super_block *rsb;
487 struct inode *root;
488 unsigned long pos, img_size;
489 const char *storage;
490 size_t len;
491 int ret;
493 #ifdef CONFIG_BLOCK
494 if (!sb->s_mtd) {
495 sb_set_blocksize(sb, ROMBSIZE);
496 } else {
497 sb->s_blocksize = ROMBSIZE;
498 sb->s_blocksize_bits = blksize_bits(ROMBSIZE);
500 #endif
502 sb->s_maxbytes = 0xFFFFFFFF;
503 sb->s_magic = ROMFS_MAGIC;
504 sb->s_flags |= MS_RDONLY | MS_NOATIME;
505 sb->s_op = &romfs_super_ops;
507 #ifdef CONFIG_ROMFS_ON_MTD
508 /* Use same dev ID from the underlying mtdblock device */
509 if (sb->s_mtd)
510 sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, sb->s_mtd->index);
511 #endif
512 /* read the image superblock and check it */
513 rsb = kmalloc(512, GFP_KERNEL);
514 if (!rsb)
515 return -ENOMEM;
517 sb->s_fs_info = (void *) 512;
518 ret = romfs_dev_read(sb, 0, rsb, 512);
519 if (ret < 0)
520 goto error_rsb;
522 img_size = be32_to_cpu(rsb->size);
524 if (sb->s_mtd && img_size > sb->s_mtd->size)
525 goto error_rsb_inval;
527 sb->s_fs_info = (void *) img_size;
529 if (rsb->word0 != ROMSB_WORD0 || rsb->word1 != ROMSB_WORD1 ||
530 img_size < ROMFH_SIZE) {
531 if (!silent)
532 pr_warn("VFS: Can't find a romfs filesystem on dev %s.\n",
533 sb->s_id);
534 goto error_rsb_inval;
537 if (romfs_checksum(rsb, min_t(size_t, img_size, 512))) {
538 pr_err("bad initial checksum on dev %s.\n", sb->s_id);
539 goto error_rsb_inval;
542 storage = sb->s_mtd ? "MTD" : "the block layer";
544 len = strnlen(rsb->name, ROMFS_MAXFN);
545 if (!silent)
546 pr_notice("Mounting image '%*.*s' through %s\n",
547 (unsigned) len, (unsigned) len, rsb->name, storage);
549 kfree(rsb);
550 rsb = NULL;
552 /* find the root directory */
553 pos = (ROMFH_SIZE + len + 1 + ROMFH_PAD) & ROMFH_MASK;
555 root = romfs_iget(sb, pos);
556 if (IS_ERR(root))
557 return PTR_ERR(root);
559 sb->s_root = d_make_root(root);
560 if (!sb->s_root)
561 return -ENOMEM;
563 return 0;
565 error_rsb_inval:
566 ret = -EINVAL;
567 error_rsb:
568 kfree(rsb);
569 return ret;
573 * get a superblock for mounting
575 static struct dentry *romfs_mount(struct file_system_type *fs_type,
576 int flags, const char *dev_name,
577 void *data)
579 struct dentry *ret = ERR_PTR(-EINVAL);
581 #ifdef CONFIG_ROMFS_ON_MTD
582 ret = mount_mtd(fs_type, flags, dev_name, data, romfs_fill_super);
583 #endif
584 #ifdef CONFIG_ROMFS_ON_BLOCK
585 if (ret == ERR_PTR(-EINVAL))
586 ret = mount_bdev(fs_type, flags, dev_name, data,
587 romfs_fill_super);
588 #endif
589 return ret;
593 * destroy a romfs superblock in the appropriate manner
595 static void romfs_kill_sb(struct super_block *sb)
597 #ifdef CONFIG_ROMFS_ON_MTD
598 if (sb->s_mtd) {
599 kill_mtd_super(sb);
600 return;
602 #endif
603 #ifdef CONFIG_ROMFS_ON_BLOCK
604 if (sb->s_bdev) {
605 kill_block_super(sb);
606 return;
608 #endif
611 static struct file_system_type romfs_fs_type = {
612 .owner = THIS_MODULE,
613 .name = "romfs",
614 .mount = romfs_mount,
615 .kill_sb = romfs_kill_sb,
616 .fs_flags = FS_REQUIRES_DEV,
618 MODULE_ALIAS_FS("romfs");
621 * inode storage initialiser
623 static void romfs_i_init_once(void *_inode)
625 struct romfs_inode_info *inode = _inode;
627 inode_init_once(&inode->vfs_inode);
631 * romfs module initialisation
633 static int __init init_romfs_fs(void)
635 int ret;
637 pr_info("ROMFS MTD (C) 2007 Red Hat, Inc.\n");
639 romfs_inode_cachep =
640 kmem_cache_create("romfs_i",
641 sizeof(struct romfs_inode_info), 0,
642 SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD,
643 romfs_i_init_once);
645 if (!romfs_inode_cachep) {
646 pr_err("Failed to initialise inode cache\n");
647 return -ENOMEM;
649 ret = register_filesystem(&romfs_fs_type);
650 if (ret) {
651 pr_err("Failed to register filesystem\n");
652 goto error_register;
654 return 0;
656 error_register:
657 kmem_cache_destroy(romfs_inode_cachep);
658 return ret;
662 * romfs module removal
664 static void __exit exit_romfs_fs(void)
666 unregister_filesystem(&romfs_fs_type);
668 * Make sure all delayed rcu free inodes are flushed before we
669 * destroy cache.
671 rcu_barrier();
672 kmem_cache_destroy(romfs_inode_cachep);
675 module_init(init_romfs_fs);
676 module_exit(exit_romfs_fs);
678 MODULE_DESCRIPTION("Direct-MTD Capable RomFS");
679 MODULE_AUTHOR("Red Hat, Inc.");
680 MODULE_LICENSE("GPL"); /* Actually dual-licensed, but it doesn't matter for */