1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18#ifdef __UBOOT__
19#include <hexdump.h>
20#include <log.h>
21#include <dm/devres.h>
22#include <linux/err.h>
23#endif
24#include "ubifs.h"
25
26
27
28
29
30
31
32
33
34static int scan_padding_bytes(void *buf, int len)
35{
36 int pad_len = 0, max_pad_len = min_t(int, UBIFS_PAD_NODE_SZ, len);
37 uint8_t *p = buf;
38
39 dbg_scan("not a node");
40
41 while (pad_len < max_pad_len && *p++ == UBIFS_PADDING_BYTE)
42 pad_len += 1;
43
44 if (!pad_len || (pad_len & 7))
45 return SCANNED_GARBAGE;
46
47 dbg_scan("%d padding bytes", pad_len);
48
49 return pad_len;
50}
51
52
53
54
55
56
57
58
59
60
61
62
63int ubifs_scan_a_node(const struct ubifs_info *c, void *buf, int len, int lnum,
64 int offs, int quiet)
65{
66 struct ubifs_ch *ch = buf;
67 uint32_t magic;
68
69 magic = le32_to_cpu(ch->magic);
70
71 if (magic == 0xFFFFFFFF) {
72 dbg_scan("hit empty space at LEB %d:%d", lnum, offs);
73 return SCANNED_EMPTY_SPACE;
74 }
75
76 if (magic != UBIFS_NODE_MAGIC)
77 return scan_padding_bytes(buf, len);
78
79 if (len < UBIFS_CH_SZ)
80 return SCANNED_GARBAGE;
81
82 dbg_scan("scanning %s at LEB %d:%d",
83 dbg_ntype(ch->node_type), lnum, offs);
84
85 if (ubifs_check_node(c, buf, lnum, offs, quiet, 1))
86 return SCANNED_A_CORRUPT_NODE;
87
88 if (ch->node_type == UBIFS_PAD_NODE) {
89 struct ubifs_pad_node *pad = buf;
90 int pad_len = le32_to_cpu(pad->pad_len);
91 int node_len = le32_to_cpu(ch->len);
92
93
94 if (pad_len < 0 ||
95 offs + node_len + pad_len > c->leb_size) {
96 if (!quiet) {
97 ubifs_err(c, "bad pad node at LEB %d:%d",
98 lnum, offs);
99 ubifs_dump_node(c, pad);
100 }
101 return SCANNED_A_BAD_PAD_NODE;
102 }
103
104
105 if ((node_len + pad_len) & 7) {
106 if (!quiet)
107 ubifs_err(c, "bad padding length %d - %d",
108 offs, offs + node_len + pad_len);
109 return SCANNED_A_BAD_PAD_NODE;
110 }
111
112 dbg_scan("%d bytes padded at LEB %d:%d, offset now %d", pad_len,
113 lnum, offs, ALIGN(offs + node_len + pad_len, 8));
114
115 return node_len + pad_len;
116 }
117
118 return SCANNED_A_NODE;
119}
120
121
122
123
124
125
126
127
128
129
130
131struct ubifs_scan_leb *ubifs_start_scan(const struct ubifs_info *c, int lnum,
132 int offs, void *sbuf)
133{
134 struct ubifs_scan_leb *sleb;
135 int err;
136
137 dbg_scan("scan LEB %d:%d", lnum, offs);
138
139 sleb = kzalloc(sizeof(struct ubifs_scan_leb), GFP_NOFS);
140 if (!sleb)
141 return ERR_PTR(-ENOMEM);
142
143 sleb->lnum = lnum;
144 INIT_LIST_HEAD(&sleb->nodes);
145 sleb->buf = sbuf;
146
147 err = ubifs_leb_read(c, lnum, sbuf + offs, offs, c->leb_size - offs, 0);
148 if (err && err != -EBADMSG) {
149 ubifs_err(c, "cannot read %d bytes from LEB %d:%d, error %d",
150 c->leb_size - offs, lnum, offs, err);
151 kfree(sleb);
152 return ERR_PTR(err);
153 }
154
155
156
157
158
159 return sleb;
160}
161
162
163
164
165
166
167
168
169void ubifs_end_scan(const struct ubifs_info *c, struct ubifs_scan_leb *sleb,
170 int lnum, int offs)
171{
172 lnum = lnum;
173 dbg_scan("stop scanning LEB %d at offset %d", lnum, offs);
174 ubifs_assert(offs % c->min_io_size == 0);
175
176 sleb->endpt = ALIGN(offs, c->min_io_size);
177}
178
179
180
181
182
183
184
185
186
187
188int ubifs_add_snod(const struct ubifs_info *c, struct ubifs_scan_leb *sleb,
189 void *buf, int offs)
190{
191 struct ubifs_ch *ch = buf;
192 struct ubifs_ino_node *ino = buf;
193 struct ubifs_scan_node *snod;
194
195 snod = kmalloc(sizeof(struct ubifs_scan_node), GFP_NOFS);
196 if (!snod)
197 return -ENOMEM;
198
199 snod->sqnum = le64_to_cpu(ch->sqnum);
200 snod->type = ch->node_type;
201 snod->offs = offs;
202 snod->len = le32_to_cpu(ch->len);
203 snod->node = buf;
204
205 switch (ch->node_type) {
206 case UBIFS_INO_NODE:
207 case UBIFS_DENT_NODE:
208 case UBIFS_XENT_NODE:
209 case UBIFS_DATA_NODE:
210
211
212
213
214 key_read(c, &ino->key, &snod->key);
215 break;
216 default:
217 invalid_key_init(c, &snod->key);
218 break;
219 }
220 list_add_tail(&snod->list, &sleb->nodes);
221 sleb->nodes_cnt += 1;
222 return 0;
223}
224
225
226
227
228
229
230
231
232void ubifs_scanned_corruption(const struct ubifs_info *c, int lnum, int offs,
233 void *buf)
234{
235 int len;
236
237 ubifs_err(c, "corruption at LEB %d:%d", lnum, offs);
238 len = c->leb_size - offs;
239 if (len > 8192)
240 len = 8192;
241 ubifs_err(c, "first %d bytes from LEB %d:%d", len, lnum, offs);
242 print_hex_dump("", DUMP_PREFIX_OFFSET, 32, 4, buf, len, 1);
243}
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261struct ubifs_scan_leb *ubifs_scan(const struct ubifs_info *c, int lnum,
262 int offs, void *sbuf, int quiet)
263{
264 void *buf = sbuf + offs;
265 int err, len = c->leb_size - offs;
266 struct ubifs_scan_leb *sleb;
267
268 sleb = ubifs_start_scan(c, lnum, offs, sbuf);
269 if (IS_ERR(sleb))
270 return sleb;
271
272 while (len >= 8) {
273 struct ubifs_ch *ch = buf;
274 int node_len, ret;
275
276 dbg_scan("look at LEB %d:%d (%d bytes left)",
277 lnum, offs, len);
278
279 cond_resched();
280
281 ret = ubifs_scan_a_node(c, buf, len, lnum, offs, quiet);
282 if (ret > 0) {
283
284 offs += ret;
285 buf += ret;
286 len -= ret;
287 continue;
288 }
289
290 if (ret == SCANNED_EMPTY_SPACE)
291
292 break;
293
294 switch (ret) {
295 case SCANNED_GARBAGE:
296 ubifs_err(c, "garbage");
297 goto corrupted;
298 case SCANNED_A_NODE:
299 break;
300 case SCANNED_A_CORRUPT_NODE:
301 case SCANNED_A_BAD_PAD_NODE:
302 ubifs_err(c, "bad node");
303 goto corrupted;
304 default:
305 ubifs_err(c, "unknown");
306 err = -EINVAL;
307 goto error;
308 }
309
310 err = ubifs_add_snod(c, sleb, buf, offs);
311 if (err)
312 goto error;
313
314 node_len = ALIGN(le32_to_cpu(ch->len), 8);
315 offs += node_len;
316 buf += node_len;
317 len -= node_len;
318 }
319
320 if (offs % c->min_io_size) {
321 if (!quiet)
322 ubifs_err(c, "empty space starts at non-aligned offset %d",
323 offs);
324 goto corrupted;
325 }
326
327 ubifs_end_scan(c, sleb, lnum, offs);
328
329 for (; len > 4; offs += 4, buf = buf + 4, len -= 4)
330 if (*(uint32_t *)buf != 0xffffffff)
331 break;
332 for (; len; offs++, buf++, len--)
333 if (*(uint8_t *)buf != 0xff) {
334 if (!quiet)
335 ubifs_err(c, "corrupt empty space at LEB %d:%d",
336 lnum, offs);
337 goto corrupted;
338 }
339
340 return sleb;
341
342corrupted:
343 if (!quiet) {
344 ubifs_scanned_corruption(c, lnum, offs, buf);
345 ubifs_err(c, "LEB %d scanning failed", lnum);
346 }
347 err = -EUCLEAN;
348 ubifs_scan_destroy(sleb);
349 return ERR_PTR(err);
350
351error:
352 ubifs_err(c, "LEB %d scanning failed, error %d", lnum, err);
353 ubifs_scan_destroy(sleb);
354 return ERR_PTR(err);
355}
356
357
358
359
360
361void ubifs_scan_destroy(struct ubifs_scan_leb *sleb)
362{
363 struct ubifs_scan_node *node;
364 struct list_head *head;
365
366 head = &sleb->nodes;
367 while (!list_empty(head)) {
368 node = list_entry(head->next, struct ubifs_scan_node, list);
369 list_del(&node->list);
370 kfree(node);
371 }
372 kfree(sleb);
373}
374