diff options
| -rw-r--r-- | fs/ntfs/ChangeLog | 6 | ||||
| -rw-r--r-- | fs/ntfs/attrib.c | 61 |
2 files changed, 48 insertions, 19 deletions
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog index 67994c9c248f..a6d2b943a148 100644 --- a/fs/ntfs/ChangeLog +++ b/fs/ntfs/ChangeLog @@ -139,6 +139,12 @@ ToDo/Notes: and ntfs_mapping_pairs_build() to allow the runlist encoding to be partial which is desirable when filling holes in sparse attributes. Update all callers. + - Change ntfs_map_runlist_nolock() to only decompress the mapping pairs + if the requested vcn is inside it. Otherwise we get into problems + when we try to map an out of bounds vcn because we then try to map + the already mapped runlist fragment which causes + ntfs_mapping_pairs_decompress() to fail and return error. Update + ntfs_attr_find_vcn_nolock() accordingly. 2.1.22 - Many bug and race fixes and error handling improvements. diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c index c6b2bb64d651..543d47fa5fc9 100644 --- a/fs/ntfs/attrib.c +++ b/fs/ntfs/attrib.c @@ -39,15 +39,19 @@ * * Map the part of a runlist containing the @vcn of the ntfs inode @ni. * - * Return 0 on success and -errno on error. + * Return 0 on success and -errno on error. There is one special error code + * which is not an error as such. This is -ENOENT. It means that @vcn is out + * of bounds of the runlist. * * Locking: - The runlist must be locked for writing. * - This function modifies the runlist. */ int ntfs_map_runlist_nolock(ntfs_inode *ni, VCN vcn) { + VCN end_vcn; ntfs_inode *base_ni; - MFT_RECORD *mrec; + MFT_RECORD *m; + ATTR_RECORD *a; ntfs_attr_search_ctx *ctx; runlist_element *rl; int err = 0; @@ -58,26 +62,43 @@ int ntfs_map_runlist_nolock(ntfs_inode *ni, VCN vcn) base_ni = ni; else base_ni = ni->ext.base_ntfs_ino; - mrec = map_mft_record(base_ni); - if (IS_ERR(mrec)) - return PTR_ERR(mrec); - ctx = ntfs_attr_get_search_ctx(base_ni, mrec); + m = map_mft_record(base_ni); + if (IS_ERR(m)) + return PTR_ERR(m); + ctx = ntfs_attr_get_search_ctx(base_ni, m); if (unlikely(!ctx)) { err = -ENOMEM; goto err_out; } err = ntfs_attr_lookup(ni->type, ni->name, ni->name_len, CASE_SENSITIVE, vcn, NULL, 0, ctx); - if (likely(!err)) { - rl = ntfs_mapping_pairs_decompress(ni->vol, ctx->attr, - ni->runlist.rl); - if (IS_ERR(rl)) - err = PTR_ERR(rl); - else - ni->runlist.rl = rl; + if (unlikely(err)) { + if (err == -ENOENT) + err = -EIO; + goto err_out; } - ntfs_attr_put_search_ctx(ctx); + a = ctx->attr; + /* + * Only decompress the mapping pairs if @vcn is inside it. Otherwise + * we get into problems when we try to map an out of bounds vcn because + * we then try to map the already mapped runlist fragment and + * ntfs_mapping_pairs_decompress() fails. + */ + end_vcn = sle64_to_cpu(a->data.non_resident.highest_vcn) + 1; + if (unlikely(!a->data.non_resident.lowest_vcn && end_vcn <= 1)) + end_vcn = ni->allocated_size >> ni->vol->cluster_size_bits; + if (unlikely(vcn >= end_vcn)) { + err = -ENOENT; + goto err_out; + } + rl = ntfs_mapping_pairs_decompress(ni->vol, a, ni->runlist.rl); + if (IS_ERR(rl)) + err = PTR_ERR(rl); + else + ni->runlist.rl = rl; err_out: + if (likely(ctx)) + ntfs_attr_put_search_ctx(ctx); unmap_mft_record(base_ni); return err; } @@ -89,7 +110,9 @@ err_out: * * Map the part of a runlist containing the @vcn of the ntfs inode @ni. * - * Return 0 on success and -errno on error. + * Return 0 on success and -errno on error. There is one special error code + * which is not an error as such. This is -ENOENT. It means that @vcn is out + * of bounds of the runlist. * * Locking: - The runlist must be unlocked on entry and is unlocked on return. * - This function takes the runlist lock for writing and modifies the @@ -287,11 +310,11 @@ retry_remap: goto retry_remap; } /* - * -EINVAL and -ENOENT coming from a failed mapping attempt are - * equivalent to i/o errors for us as they should not happen in - * our code paths. + * -EINVAL coming from a failed mapping attempt is equivalent + * to i/o error for us as it should not happen in our code + * paths. */ - if (err == -EINVAL || err == -ENOENT) + if (err == -EINVAL) err = -EIO; } else if (!err) err = -EIO; |