hfs: handle more on-disk corruptions without oopsing

PATCH New Eric Sandeen 2 participants 6 messages Dec 19, 2007 – Jan 7, 2008 HFS filesystem

Share & tools

Eric Sandeen

author

2007-12-19 22:33 UTC #0 lore raw

PATCH 1/1 hfs: handle more on-disk corruptions without oopsing

hfs seems prone to bad things when it encounters on disk corruption. Many values are read from disk, and used as lengths to memcpy, as an example. This patch fixes up several of these problematic cases.

o sanity check the on-disk maximum key lengths on mount (these are set to a defined value at mkfs time and shouldn't differ)
o check on-disk node keylens against the maximum key length for each tree
o fix hfs_btree_open so that going out via free_tree: doesn't wind up in hfs_releasepage, which wants to follow the very pointer we were trying to set up:

	HFS_SB(sb)->cat_tree = hfs_btree_open()
		...
		failure gets to hfs_releasepage and tries
		to follow HFS_SB(sb)->cat_tree

Tested with the fsfuzzer; it survives more than it used to.

Signed-off-by Eric Sandeen <[email protected]>

---

fs/hfs/brec.c +13 -2

Index: linux-2.6.24-rc3/fs/hfs/brec.c
===================================================================
@@ -44,10 +44,21 @@ u16 hfs_brec_keylen(struct hfs_bnode *no
 		recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
 		if (!recoff)
 			return 0;
-		if (node->tree->attributes & HFS_TREE_BIGKEYS)
+		if (node->tree->attributes & HFS_TREE_BIGKEYS) {
 			retval = hfs_bnode_read_u16(node, recoff) + 2;
-		else
+			if (retval > node->tree->max_key_len + 2) {
+				printk(KERN_ERR "hfs: keylen %d too large\n",
+					retval);
+				retval = HFS_BAD_KEYLEN;
+			}
+		} else {
 			retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
+			if (retval > node->tree->max_key_len + 1) {
+				printk(KERN_ERR "hfs: keylen %d too large\n",
+					retval);
+				retval = HFS_BAD_KEYLEN;
+			}
+		}
 	}
 	return retval;
 }

fs/hfs/bfind.c +15 -0

Index: linux-2.6.24-rc3/fs/hfs/bfind.c
===================================================================
@@ -52,6 +52,11 @@ int __hfs_brec_find(struct hfs_bnode *bn
 		rec = (e + b) / 2;
 		len = hfs_brec_lenoff(bnode, rec, &off);
 		keylen = hfs_brec_keylen(bnode, rec);
+		if (keylen == HFS_BAD_KEYLEN) {
+			printk(KERN_ERR "hfs: keylen %d too long\n", keylen);
+			res = -EINVAL;
+			goto done;
+		}
 		hfs_bnode_read(bnode, fd->key, off, keylen);
 		cmpval = bnode->tree->keycmp(fd->key, fd->search_key);
 		if (!cmpval) {

@@ -67,6 +72,11 @@ int __hfs_brec_find(struct hfs_bnode *bn
 	if (rec != e && e >= 0) {
 		len = hfs_brec_lenoff(bnode, e, &off);
 		keylen = hfs_brec_keylen(bnode, e);
+		if (keylen == HFS_BAD_KEYLEN) {
+			printk(KERN_ERR "hfs: keylen %d too long\n", keylen);
+			res = -EINVAL;
+			goto done;
+		}
 		hfs_bnode_read(bnode, fd->key, off, keylen);
 	}
 done:

@@ -198,6 +208,11 @@ int hfs_brec_goto(struct hfs_find_data *
 
 	len = hfs_brec_lenoff(bnode, fd->record, &off);
 	keylen = hfs_brec_keylen(bnode, fd->record);
+	if (keylen == HFS_BAD_KEYLEN) {
+		printk(KERN_ERR "hfs: keylen %d too long\n", keylen);
+		res = -EINVAL;
+		goto out;
+	}
 	fd->keyoffset = off;
 	fd->keylength = keylen;
 	fd->entryoffset = off + keylen;

fs/hfs/hfs.h +5 -0

Index: linux-2.6.24-rc3/fs/hfs/hfs.h
===================================================================
@@ -28,6 +28,8 @@
 #define HFS_MAX_NAMELEN		128
 #define HFS_MAX_VALENCE		32767U
 
+#define HFS_BAD_KEYLEN		0xFF
+
 /* Meanings of the drAtrb field of the MDB,
  * Reference: _Inside Macintosh: Files_ p. 2-61
  */

@@ -167,6 +169,9 @@ typedef union hfs_btree_key {
 	struct hfs_ext_key ext;
 } hfs_btree_key;
 
+#define HFS_MAX_CAT_KEYLEN	(sizeof(struct hfs_cat_key) - sizeof(u8))
+#define HFS_MAX_EXT_KEYLEN	(sizeof(struct hfs_ext_key) - sizeof(u8))
+
 typedef union hfs_btree_key btree_key;
 
 struct hfs_extent {

fs/hfs/btree.c +12 -1

Index: linux-2.6.24-rc3/fs/hfs/btree.c
===================================================================
@@ -81,6 +81,17 @@ struct hfs_btree *hfs_btree_open(struct 
 		goto fail_page;
 	if (!tree->node_count)
 		goto fail_page;
+	if ((id == HFS_EXT_CNID) && (tree->max_key_len != HFS_MAX_EXT_KEYLEN)) {
+		printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+			tree->max_key_len);
+		goto fail_page;
+	}
+	if ((id == HFS_CAT_CNID) && (tree->max_key_len != HFS_MAX_CAT_KEYLEN)) {
+		printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+			tree->max_key_len);
+		goto fail_page;
+	}
+
 	tree->node_size_shift = ffs(size) - 1;
 	tree->pages_per_bnode = (tree->node_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;

@@ -89,9 +100,9 @@ struct hfs_btree *hfs_btree_open(struct 
 	return tree;
 
  fail_page:
-	tree->inode->i_mapping->a_ops = &hfs_aops;
 	page_cache_release(page);
  free_tree:
+	tree->inode->i_mapping->a_ops = &hfs_aops;
 	iput(tree->inode);
 	kfree(tree);
 	return NULL;

Eric Sandeen

author

2007-12-20 15:51 UTC #1 lore raw

PATCH 1/1 UPDATED: hfs: handle more on-disk corruptions without oopsing

Andrew, I double-issued warnings in some cases. Mind replacing with this one?

Thanks,
-Eric

	HFS_SB(sb)->cat_tree = hfs_btree_open()
		...
		failure gets to hfs_releasepage and tries
		to follow HFS_SB(sb)->cat_tree

Tested with the fsfuzzer; it survives more than it used to.

Signed-off-by Eric Sandeen <[email protected]>

---

fs/hfs/brec.c +13 -2

Index: linux-2.6.24-rc3/fs/hfs/brec.c
===================================================================
@@ -44,10 +44,21 @@ u16 hfs_brec_keylen(struct hfs_bnode *no
 		recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
 		if (!recoff)
 			return 0;
-		if (node->tree->attributes & HFS_TREE_BIGKEYS)
+		if (node->tree->attributes & HFS_TREE_BIGKEYS) {
 			retval = hfs_bnode_read_u16(node, recoff) + 2;
-		else
+			if (retval > node->tree->max_key_len + 2) {
+				printk(KERN_ERR "hfs: keylen %d too large\n",
+					retval);
+				retval = HFS_BAD_KEYLEN;
+			}
+		} else {
 			retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
+			if (retval > node->tree->max_key_len + 1) {
+				printk(KERN_ERR "hfs: keylen %d too large\n",
+					retval);
+				retval = HFS_BAD_KEYLEN;
+			}
+		}
 	}
 	return retval;
 }

fs/hfs/bfind.c +12 -0

Index: linux-2.6.24-rc3/fs/hfs/bfind.c
===================================================================
@@ -52,6 +52,10 @@ int __hfs_brec_find(struct hfs_bnode *bn
 		rec = (e + b) / 2;
 		len = hfs_brec_lenoff(bnode, rec, &off);
 		keylen = hfs_brec_keylen(bnode, rec);
+		if (keylen == HFS_BAD_KEYLEN) {
+			res = -EINVAL;
+			goto done;
+		}
 		hfs_bnode_read(bnode, fd->key, off, keylen);
 		cmpval = bnode->tree->keycmp(fd->key, fd->search_key);
 		if (!cmpval) {

@@ -67,6 +71,10 @@ int __hfs_brec_find(struct hfs_bnode *bn
 	if (rec != e && e >= 0) {
 		len = hfs_brec_lenoff(bnode, e, &off);
 		keylen = hfs_brec_keylen(bnode, e);
+		if (keylen == HFS_BAD_KEYLEN) {
+			res = -EINVAL;
+			goto done;
+		}
 		hfs_bnode_read(bnode, fd->key, off, keylen);
 	}
 done:

@@ -198,6 +206,10 @@ int hfs_brec_goto(struct hfs_find_data *
 
 	len = hfs_brec_lenoff(bnode, fd->record, &off);
 	keylen = hfs_brec_keylen(bnode, fd->record);
+	if (keylen == HFS_BAD_KEYLEN) {
+		res = -EINVAL;
+		goto out;
+	}
 	fd->keyoffset = off;
 	fd->keylength = keylen;
 	fd->entryoffset = off + keylen;

fs/hfs/hfs.h +5 -0

Index: linux-2.6.24-rc3/fs/hfs/hfs.h
===================================================================
@@ -28,6 +28,8 @@
 #define HFS_MAX_NAMELEN		128
 #define HFS_MAX_VALENCE		32767U
 
+#define HFS_BAD_KEYLEN		0xFF
+
 /* Meanings of the drAtrb field of the MDB,
  * Reference: _Inside Macintosh: Files_ p. 2-61
  */

@@ -167,6 +169,9 @@ typedef union hfs_btree_key {
 	struct hfs_ext_key ext;
 } hfs_btree_key;
 
+#define HFS_MAX_CAT_KEYLEN	(sizeof(struct hfs_cat_key) - sizeof(u8))
+#define HFS_MAX_EXT_KEYLEN	(sizeof(struct hfs_ext_key) - sizeof(u8))
+
 typedef union hfs_btree_key btree_key;
 
 struct hfs_extent {

fs/hfs/btree.c +12 -1

Index: linux-2.6.24-rc3/fs/hfs/btree.c
===================================================================
@@ -81,6 +81,17 @@ struct hfs_btree *hfs_btree_open(struct 
 		goto fail_page;
 	if (!tree->node_count)
 		goto fail_page;
+	if ((id == HFS_EXT_CNID) && (tree->max_key_len != HFS_MAX_EXT_KEYLEN)) {
+		printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+			tree->max_key_len);
+		goto fail_page;
+	}
+	if ((id == HFS_CAT_CNID) && (tree->max_key_len != HFS_MAX_CAT_KEYLEN)) {
+		printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+			tree->max_key_len);
+		goto fail_page;
+	}
+
 	tree->node_size_shift = ffs(size) - 1;
 	tree->pages_per_bnode = (tree->node_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;

@@ -89,9 +100,9 @@ struct hfs_btree *hfs_btree_open(struct 
 	return tree;
 
  fail_page:
-	tree->inode->i_mapping->a_ops = &hfs_aops;
 	page_cache_release(page);
  free_tree:
+	tree->inode->i_mapping->a_ops = &hfs_aops;
 	iput(tree->inode);
 	kfree(tree);
 	return NULL;

Roman Zippel

2007-12-24 02:50 UTC #2 lore raw

Re: [PATCH] UPDATED: hfs: handle more on-disk corruptions without oopsing

Hi,

Quoted 18 lines · Eric Sandeen

Index: linux-2.6.24-rc3/fs/hfs/brec.c
===================================================================

fs/hfs/brec.c +7 -2

@@ -44,10 +44,21 @@ u16 hfs_brec_keylen(struct hfs_bnode *no
 		recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) *
 2); if (!recoff)
 			return 0;
-		if (node->tree->attributes & HFS_TREE_BIGKEYS)
+		if (node->tree->attributes & HFS_TREE_BIGKEYS) {
 			retval = hfs_bnode_read_u16(node, recoff) + 2;
-		else
+			if (retval > node->tree->max_key_len + 2) {
+				printk(KERN_ERR "hfs: keylen %d too large\n",
+					retval);
+				retval = HFS_BAD_KEYLEN;
+			}
+		} else {

fs/hfs/brec.c u16 hfs_brec_keylen(struct hfs_bnode *no · line 64

Quoted 10 lines

fs/hfs/brec.c +6 -0

 			retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
+			if (retval > node->tree->max_key_len + 1) {
+				printk(KERN_ERR "hfs: keylen %d too large\n",
+					retval);
+				retval = HFS_BAD_KEYLEN;
+			}
+		}
 	}
 	return retval;
 }

You can reuse 0 as failure value, a key has to be of nonzero size.

Quoted 13 lines

Index: linux-2.6.24-rc3/fs/hfs/btree.c
===================================================================

fs/hfs/btree.c +4 -0

@@ -81,6 +81,17 @@ struct hfs_btree *hfs_btree_open(struct
 		goto fail_page;
 	if (!tree->node_count)
 		goto fail_page;
+	if ((id == HFS_EXT_CNID) && (tree->max_key_len != HFS_MAX_EXT_KEYLEN)) {
+		printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+			tree->max_key_len);
+		goto fail_page;

fs/hfs/btree.c struct hfs_btree *hfs_btree_open(struct · line 97

Quoted 10 lines

fs/hfs/btree.c +7 -0

+	}
+	if ((id == HFS_CAT_CNID) && (tree->max_key_len != HFS_MAX_CAT_KEYLEN)) {
+		printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+			tree->max_key_len);
+		goto fail_page;
+	}
+
 	tree->node_size_shift = ffs(size) - 1;
 	tree->pages_per_bnode = (tree->node_size + PAGE_CACHE_SIZE - 1) >>
 PAGE_CACHE_SHIFT;

I'd prefer a switch statement here.

It would be nice if you could do the same changes for hfsplus, so both stay in sync.
Thanks.

bye, Roman

Eric Sandeen

author

2007-12-24 05:07 UTC #3 lore raw

Re: [PATCH] UPDATED: hfs: handle more on-disk corruptions without oopsing

Quoted 26 lines · Roman Zippel

Hi,

Quoted 22 lines · Eric Sandeen

Index: linux-2.6.24-rc3/fs/hfs/brec.c
===================================================================

fs/hfs/brec.c +10 -2

@@ -44,10 +44,21 @@ u16 hfs_brec_keylen(struct hfs_bnode *no
 		recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) *
 2); if (!recoff)
 			return 0;
-		if (node->tree->attributes & HFS_TREE_BIGKEYS)
+		if (node->tree->attributes & HFS_TREE_BIGKEYS) {
 			retval = hfs_bnode_read_u16(node, recoff) + 2;
-		else
+			if (retval > node->tree->max_key_len + 2) {
+				printk(KERN_ERR "hfs: keylen %d too large\n",
+					retval);
+				retval = HFS_BAD_KEYLEN;
+			}
+		} else {
 			retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
+			if (retval > node->tree->max_key_len + 1) {
+				printk(KERN_ERR "hfs: keylen %d too large\n",
+					retval);

Quoted 8 lines

fs/hfs/brec.c u16 hfs_brec_keylen(struct hfs_bnode *no · line 64
Quoted 6 lines
fs/hfs/brec.c +3 -0
+				retval = HFS_BAD_KEYLEN;
+			}
+		}
 	}
 	return retval;
 }
You can reuse 0 as failure value, a key has to be of nonzero size.

Ok. Based on the other 0 returns I wasn't sure if they were considered real errors or not... but also ISTR I ran into problems with a simple 0 return; I probably just to be sure need the callers check for it.

Quoted 17 lines

Index: linux-2.6.24-rc3/fs/hfs/btree.c
===================================================================

fs/hfs/btree.c +9 -0

@@ -81,6 +81,17 @@ struct hfs_btree *hfs_btree_open(struct
 		goto fail_page;
 	if (!tree->node_count)
 		goto fail_page;
+	if ((id == HFS_EXT_CNID) && (tree->max_key_len != HFS_MAX_EXT_KEYLEN)) {
+		printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+			tree->max_key_len);
+		goto fail_page;
+	}
+	if ((id == HFS_CAT_CNID) && (tree->max_key_len != HFS_MAX_CAT_KEYLEN)) {
+		printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+			tree->max_key_len);
+		goto fail_page;

Quoted 8 lines

fs/hfs/btree.c struct hfs_btree *hfs_btree_open(struct
Quoted 6 lines
fs/hfs/btree.c +2 -0
+	}
+
 	tree->node_size_shift = ffs(size) - 1;
 	tree->pages_per_bnode = (tree->node_size + PAGE_CACHE_SIZE - 1) >>
 PAGE_CACHE_SHIFT;
I'd prefer a switch statement here.

Ok, I'd thought about doing it that way... :)

Quoted 2 lines

It would be nice if you could do the same changes for hfsplus, so both stay in sync.

Yep, wanted to first see if it'd fly for HFS...

Thanks for the feedback,
-Eric

Quoted 3 lines

Thanks.
bye, Roman

Eric Sandeen

author

2008-01-02 17:38 UTC #4 lore raw

PATCH 1/1 UPDATED2: hfs: handle more on-disk corruptions without oopsing

In reply to Roman Zippel

Roman, with this on top does it look better to you? I'll get hfsplus done in a bit.

Thanks,
-Eric

-----------------

Fix up previous hfs fsfuzzer patch to address Roman's comments.

Signed-off-by Eric Sandeen <[email protected]>

---

fs/hfs/brec.c +2 -2

diff -u linux-2.6.24-rc3/fs/hfs/brec.c linux-2.6.24-rc3/fs/hfs/brec.c
@@ -49,14 +49,14 @@
 			if (retval > node->tree->max_key_len + 2) {
 				printk(KERN_ERR "hfs: keylen %d too large\n",
 					retval);
-				retval = HFS_BAD_KEYLEN;
+				retval = 0;
 			}
 		} else {
 			retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
 			if (retval > node->tree->max_key_len + 1) {
 				printk(KERN_ERR "hfs: keylen %d too large\n",
 					retval);
-				retval = HFS_BAD_KEYLEN;
+				retval = 0;
 			}
 		}
 	}

fs/hfs/bfind.c +3 -3

diff -u linux-2.6.24-rc3/fs/hfs/bfind.c linux-2.6.24-rc3/fs/hfs/bfind.c
@@ -52,7 +52,7 @@
 		rec = (e + b) / 2;
 		len = hfs_brec_lenoff(bnode, rec, &off);
 		keylen = hfs_brec_keylen(bnode, rec);
-		if (keylen == HFS_BAD_KEYLEN) {
+		if (keylen == 0) {
 			res = -EINVAL;
 			goto fail;
 		}

@@ -71,7 +71,7 @@
 	if (rec != e && e >= 0) {
 		len = hfs_brec_lenoff(bnode, e, &off);
 		keylen = hfs_brec_keylen(bnode, e);
-		if (keylen == HFS_BAD_KEYLEN) {
+		if (keylen == 0) {
 			res = -EINVAL;
 			goto fail;
 		}

@@ -207,7 +207,7 @@
 
 	len = hfs_brec_lenoff(bnode, fd->record, &off);
 	keylen = hfs_brec_keylen(bnode, fd->record);
-	if (keylen == HFS_BAD_KEYLEN) {
+	if (keylen == 0) {
 		res = -EINVAL;
 		goto out;
 	}

fs/hfs/hfs.h +0 -2

diff -u linux-2.6.24-rc3/fs/hfs/hfs.h linux-2.6.24-rc3/fs/hfs/hfs.h
@@ -28,8 +28,6 @@
 #define HFS_MAX_NAMELEN		128
 #define HFS_MAX_VALENCE		32767U
 
-#define HFS_BAD_KEYLEN		0xFF
-
 /* Meanings of the drAtrb field of the MDB,
  * Reference: _Inside Macintosh: Files_ p. 2-61
  */

fs/hfs/btree.c +17 -9

diff -u linux-2.6.24-rc3/fs/hfs/btree.c linux-2.6.24-rc3/fs/hfs/btree.c
@@ -81,15 +81,23 @@
 		goto fail_page;
 	if (!tree->node_count)
 		goto fail_page;
-	if ((id == HFS_EXT_CNID) && (tree->max_key_len != HFS_MAX_EXT_KEYLEN)) {
-		printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
-			tree->max_key_len);
-		goto fail_page;
-	}
-	if ((id == HFS_CAT_CNID) && (tree->max_key_len != HFS_MAX_CAT_KEYLEN)) {
-		printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
-			tree->max_key_len);
-		goto fail_page;
+	switch(id) {
+	case HFS_EXT_CNID:
+		if (tree->max_key_len != HFS_MAX_EXT_KEYLEN) {
+			printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+				tree->max_key_len);
+			goto fail_page;
+		}
+		break;
+	case HFS_CAT_CNID:
+		if (tree->max_key_len != HFS_MAX_CAT_KEYLEN) {
+			printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+				tree->max_key_len);
+			goto fail_page;
+		}
+		break;
+	default:
+		BUG();
 	}

Roman Zippel

2008-01-07 03:36 UTC #5 lore raw

Re: [PATCH] UPDATED2: hfs: handle more on-disk corruptions without oopsing

Hi,

Quoted 1 line · Eric Sandeen

Roman, with this on top does it look better to you?

Looks good, thanks.

Quoted 1 line

I'll get hfsplus done in a bit.

I'm mainly concerned about brec.c/bfind.c, the patch should be pretty much identical.

bye, Roman