1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * Squashfs - a compressed read only filesystem for Linux |
4 | * |
5 | * Copyright (c) 2010 |
6 | * Phillip Lougher <phillip@squashfs.org.uk> |
7 | * |
8 | * xattr_id.c |
9 | */ |
10 | |
11 | /* |
12 | * This file implements code to map the 32-bit xattr id stored in the inode |
13 | * into the on disk location of the xattr data. |
14 | */ |
15 | |
16 | #include <linux/fs.h> |
17 | #include <linux/vfs.h> |
18 | #include <linux/slab.h> |
19 | |
20 | #include "squashfs_fs.h" |
21 | #include "squashfs_fs_sb.h" |
22 | #include "squashfs.h" |
23 | #include "xattr.h" |
24 | |
25 | /* |
26 | * Map xattr id using the xattr id look up table |
27 | */ |
28 | int squashfs_xattr_lookup(struct super_block *sb, unsigned int index, |
29 | int *count, unsigned int *size, unsigned long long *xattr) |
30 | { |
31 | struct squashfs_sb_info *msblk = sb->s_fs_info; |
32 | int block = SQUASHFS_XATTR_BLOCK(index); |
33 | int offset = SQUASHFS_XATTR_BLOCK_OFFSET(index); |
34 | u64 start_block; |
35 | struct squashfs_xattr_id id; |
36 | int err; |
37 | |
38 | if (index >= msblk->xattr_ids) |
39 | return -EINVAL; |
40 | |
41 | start_block = le64_to_cpu(msblk->xattr_id_table[block]); |
42 | |
43 | err = squashfs_read_metadata(sb, &id, &start_block, &offset, |
44 | sizeof(id)); |
45 | if (err < 0) |
46 | return err; |
47 | |
48 | *xattr = le64_to_cpu(id.xattr); |
49 | *size = le32_to_cpu(id.size); |
50 | *count = le32_to_cpu(id.count); |
51 | return 0; |
52 | } |
53 | |
54 | |
55 | /* |
56 | * Read uncompressed xattr id lookup table indexes from disk into memory |
57 | */ |
58 | __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, |
59 | u64 *xattr_table_start, unsigned int *xattr_ids) |
60 | { |
61 | struct squashfs_sb_info *msblk = sb->s_fs_info; |
62 | unsigned int len, indexes; |
63 | struct squashfs_xattr_id_table *id_table; |
64 | __le64 *table; |
65 | u64 start, end; |
66 | int n; |
67 | |
68 | id_table = squashfs_read_table(sb, table_start, sizeof(*id_table)); |
69 | if (IS_ERR(ptr: id_table)) |
70 | return (__le64 *) id_table; |
71 | |
72 | *xattr_table_start = le64_to_cpu(id_table->xattr_table_start); |
73 | *xattr_ids = le32_to_cpu(id_table->xattr_ids); |
74 | kfree(objp: id_table); |
75 | |
76 | /* Sanity check values */ |
77 | |
78 | /* there is always at least one xattr id */ |
79 | if (*xattr_ids == 0) |
80 | return ERR_PTR(error: -EINVAL); |
81 | |
82 | len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); |
83 | indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids); |
84 | |
85 | /* |
86 | * The computed size of the index table (len bytes) should exactly |
87 | * match the table start and end points |
88 | */ |
89 | start = table_start + sizeof(*id_table); |
90 | end = msblk->bytes_used; |
91 | |
92 | if (len != (end - start)) |
93 | return ERR_PTR(error: -EINVAL); |
94 | |
95 | table = squashfs_read_table(sb, start, len); |
96 | if (IS_ERR(ptr: table)) |
97 | return table; |
98 | |
99 | /* table[0], table[1], ... table[indexes - 1] store the locations |
100 | * of the compressed xattr id blocks. Each entry should be less than |
101 | * the next (i.e. table[0] < table[1]), and the difference between them |
102 | * should be SQUASHFS_METADATA_SIZE or less. table[indexes - 1] |
103 | * should be less than table_start, and again the difference |
104 | * shouls be SQUASHFS_METADATA_SIZE or less. |
105 | * |
106 | * Finally xattr_table_start should be less than table[0]. |
107 | */ |
108 | for (n = 0; n < (indexes - 1); n++) { |
109 | start = le64_to_cpu(table[n]); |
110 | end = le64_to_cpu(table[n + 1]); |
111 | |
112 | if (start >= end || (end - start) > |
113 | (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
114 | kfree(objp: table); |
115 | return ERR_PTR(error: -EINVAL); |
116 | } |
117 | } |
118 | |
119 | start = le64_to_cpu(table[indexes - 1]); |
120 | if (start >= table_start || (table_start - start) > |
121 | (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
122 | kfree(objp: table); |
123 | return ERR_PTR(error: -EINVAL); |
124 | } |
125 | |
126 | if (*xattr_table_start >= le64_to_cpu(table[0])) { |
127 | kfree(objp: table); |
128 | return ERR_PTR(error: -EINVAL); |
129 | } |
130 | |
131 | return table; |
132 | } |
133 | |