1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * This file is part of UBIFS. |
4 | * |
5 | * Copyright (C) 2006-2008 Nokia Corporation. |
6 | * |
7 | * Authors: Artem Bityutskiy (Битюцкий Артём) |
8 | * Adrian Hunter |
9 | */ |
10 | |
11 | /* This file implements reading and writing the master node */ |
12 | |
13 | #include "ubifs.h" |
14 | |
15 | /** |
16 | * ubifs_compare_master_node - compare two UBIFS master nodes |
17 | * @c: UBIFS file-system description object |
18 | * @m1: the first node |
19 | * @m2: the second node |
20 | * |
21 | * This function compares two UBIFS master nodes. Returns 0 if they are equal |
22 | * and nonzero if not. |
23 | */ |
24 | int ubifs_compare_master_node(struct ubifs_info *c, void *m1, void *m2) |
25 | { |
26 | int ret; |
27 | int behind; |
28 | int hmac_offs = offsetof(struct ubifs_mst_node, hmac); |
29 | |
30 | /* |
31 | * Do not compare the common node header since the sequence number and |
32 | * hence the CRC are different. |
33 | */ |
34 | ret = memcmp(p: m1 + UBIFS_CH_SZ, q: m2 + UBIFS_CH_SZ, |
35 | size: hmac_offs - UBIFS_CH_SZ); |
36 | if (ret) |
37 | return ret; |
38 | |
39 | /* |
40 | * Do not compare the embedded HMAC as well which also must be different |
41 | * due to the different common node header. |
42 | */ |
43 | behind = hmac_offs + UBIFS_MAX_HMAC_LEN; |
44 | |
45 | if (UBIFS_MST_NODE_SZ > behind) |
46 | return memcmp(p: m1 + behind, q: m2 + behind, UBIFS_MST_NODE_SZ - behind); |
47 | |
48 | return 0; |
49 | } |
50 | |
51 | /* mst_node_check_hash - Check hash of a master node |
52 | * @c: UBIFS file-system description object |
53 | * @mst: The master node |
54 | * @expected: The expected hash of the master node |
55 | * |
56 | * This checks the hash of a master node against a given expected hash. |
57 | * Note that we have two master nodes on a UBIFS image which have different |
58 | * sequence numbers and consequently different CRCs. To be able to match |
59 | * both master nodes we exclude the common node header containing the sequence |
60 | * number and CRC from the hash. |
61 | * |
62 | * Returns 0 if the hashes are equal, a negative error code otherwise. |
63 | */ |
64 | static int mst_node_check_hash(const struct ubifs_info *c, |
65 | const struct ubifs_mst_node *mst, |
66 | const u8 *expected) |
67 | { |
68 | u8 calc[UBIFS_MAX_HASH_LEN]; |
69 | const void *node = mst; |
70 | |
71 | crypto_shash_tfm_digest(tfm: c->hash_tfm, data: node + sizeof(struct ubifs_ch), |
72 | UBIFS_MST_NODE_SZ - sizeof(struct ubifs_ch), |
73 | out: calc); |
74 | |
75 | if (ubifs_check_hash(c, expected, got: calc)) |
76 | return -EPERM; |
77 | |
78 | return 0; |
79 | } |
80 | |
81 | /** |
82 | * scan_for_master - search the valid master node. |
83 | * @c: UBIFS file-system description object |
84 | * |
85 | * This function scans the master node LEBs and search for the latest master |
86 | * node. Returns zero in case of success, %-EUCLEAN if there master area is |
87 | * corrupted and requires recovery, and a negative error code in case of |
88 | * failure. |
89 | */ |
90 | static int scan_for_master(struct ubifs_info *c) |
91 | { |
92 | struct ubifs_scan_leb *sleb; |
93 | struct ubifs_scan_node *snod; |
94 | int lnum, offs = 0, nodes_cnt, err; |
95 | |
96 | lnum = UBIFS_MST_LNUM; |
97 | |
98 | sleb = ubifs_scan(c, lnum, offs: 0, sbuf: c->sbuf, quiet: 1); |
99 | if (IS_ERR(ptr: sleb)) |
100 | return PTR_ERR(ptr: sleb); |
101 | nodes_cnt = sleb->nodes_cnt; |
102 | if (nodes_cnt > 0) { |
103 | snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node, |
104 | list); |
105 | if (snod->type != UBIFS_MST_NODE) |
106 | goto out_dump; |
107 | memcpy(c->mst_node, snod->node, snod->len); |
108 | offs = snod->offs; |
109 | } |
110 | ubifs_scan_destroy(sleb); |
111 | |
112 | lnum += 1; |
113 | |
114 | sleb = ubifs_scan(c, lnum, offs: 0, sbuf: c->sbuf, quiet: 1); |
115 | if (IS_ERR(ptr: sleb)) |
116 | return PTR_ERR(ptr: sleb); |
117 | if (sleb->nodes_cnt != nodes_cnt) |
118 | goto out; |
119 | if (!sleb->nodes_cnt) |
120 | goto out; |
121 | snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node, list); |
122 | if (snod->type != UBIFS_MST_NODE) |
123 | goto out_dump; |
124 | if (snod->offs != offs) |
125 | goto out; |
126 | if (ubifs_compare_master_node(c, m1: c->mst_node, m2: snod->node)) |
127 | goto out; |
128 | |
129 | c->mst_offs = offs; |
130 | ubifs_scan_destroy(sleb); |
131 | |
132 | if (!ubifs_authenticated(c)) |
133 | return 0; |
134 | |
135 | if (ubifs_hmac_zero(c, hmac: c->mst_node->hmac)) { |
136 | err = mst_node_check_hash(c, mst: c->mst_node, |
137 | expected: c->sup_node->hash_mst); |
138 | if (err) |
139 | ubifs_err(c, fmt: "Failed to verify master node hash" ); |
140 | } else { |
141 | err = ubifs_node_verify_hmac(c, buf: c->mst_node, |
142 | len: sizeof(struct ubifs_mst_node), |
143 | offsetof(struct ubifs_mst_node, hmac)); |
144 | if (err) |
145 | ubifs_err(c, fmt: "Failed to verify master node HMAC" ); |
146 | } |
147 | |
148 | if (err) |
149 | return -EPERM; |
150 | |
151 | return 0; |
152 | |
153 | out: |
154 | ubifs_scan_destroy(sleb); |
155 | return -EUCLEAN; |
156 | |
157 | out_dump: |
158 | ubifs_err(c, fmt: "unexpected node type %d master LEB %d:%d" , |
159 | snod->type, lnum, snod->offs); |
160 | ubifs_scan_destroy(sleb); |
161 | return -EINVAL; |
162 | } |
163 | |
164 | /** |
165 | * validate_master - validate master node. |
166 | * @c: UBIFS file-system description object |
167 | * |
168 | * This function validates data which was read from master node. Returns zero |
169 | * if the data is all right and %-EINVAL if not. |
170 | */ |
171 | static int validate_master(const struct ubifs_info *c) |
172 | { |
173 | long long main_sz; |
174 | int err; |
175 | |
176 | if (c->max_sqnum >= SQNUM_WATERMARK) { |
177 | err = 1; |
178 | goto out; |
179 | } |
180 | |
181 | if (c->cmt_no >= c->max_sqnum) { |
182 | err = 2; |
183 | goto out; |
184 | } |
185 | |
186 | if (c->highest_inum >= INUM_WATERMARK) { |
187 | err = 3; |
188 | goto out; |
189 | } |
190 | |
191 | if (c->lhead_lnum < UBIFS_LOG_LNUM || |
192 | c->lhead_lnum >= UBIFS_LOG_LNUM + c->log_lebs || |
193 | c->lhead_offs < 0 || c->lhead_offs >= c->leb_size || |
194 | c->lhead_offs & (c->min_io_size - 1)) { |
195 | err = 4; |
196 | goto out; |
197 | } |
198 | |
199 | if (c->zroot.lnum >= c->leb_cnt || c->zroot.lnum < c->main_first || |
200 | c->zroot.offs >= c->leb_size || c->zroot.offs & 7) { |
201 | err = 5; |
202 | goto out; |
203 | } |
204 | |
205 | if (c->zroot.len < c->ranges[UBIFS_IDX_NODE].min_len || |
206 | c->zroot.len > c->ranges[UBIFS_IDX_NODE].max_len) { |
207 | err = 6; |
208 | goto out; |
209 | } |
210 | |
211 | if (c->gc_lnum >= c->leb_cnt || c->gc_lnum < c->main_first) { |
212 | err = 7; |
213 | goto out; |
214 | } |
215 | |
216 | if (c->ihead_lnum >= c->leb_cnt || c->ihead_lnum < c->main_first || |
217 | c->ihead_offs % c->min_io_size || c->ihead_offs < 0 || |
218 | c->ihead_offs > c->leb_size || c->ihead_offs & 7) { |
219 | err = 8; |
220 | goto out; |
221 | } |
222 | |
223 | main_sz = (long long)c->main_lebs * c->leb_size; |
224 | if (c->bi.old_idx_sz & 7 || c->bi.old_idx_sz >= main_sz) { |
225 | err = 9; |
226 | goto out; |
227 | } |
228 | |
229 | if (c->lpt_lnum < c->lpt_first || c->lpt_lnum > c->lpt_last || |
230 | c->lpt_offs < 0 || c->lpt_offs + c->nnode_sz > c->leb_size) { |
231 | err = 10; |
232 | goto out; |
233 | } |
234 | |
235 | if (c->nhead_lnum < c->lpt_first || c->nhead_lnum > c->lpt_last || |
236 | c->nhead_offs < 0 || c->nhead_offs % c->min_io_size || |
237 | c->nhead_offs > c->leb_size) { |
238 | err = 11; |
239 | goto out; |
240 | } |
241 | |
242 | if (c->ltab_lnum < c->lpt_first || c->ltab_lnum > c->lpt_last || |
243 | c->ltab_offs < 0 || |
244 | c->ltab_offs + c->ltab_sz > c->leb_size) { |
245 | err = 12; |
246 | goto out; |
247 | } |
248 | |
249 | if (c->big_lpt && (c->lsave_lnum < c->lpt_first || |
250 | c->lsave_lnum > c->lpt_last || c->lsave_offs < 0 || |
251 | c->lsave_offs + c->lsave_sz > c->leb_size)) { |
252 | err = 13; |
253 | goto out; |
254 | } |
255 | |
256 | if (c->lscan_lnum < c->main_first || c->lscan_lnum >= c->leb_cnt) { |
257 | err = 14; |
258 | goto out; |
259 | } |
260 | |
261 | if (c->lst.empty_lebs < 0 || c->lst.empty_lebs > c->main_lebs - 2) { |
262 | err = 15; |
263 | goto out; |
264 | } |
265 | |
266 | if (c->lst.idx_lebs < 0 || c->lst.idx_lebs > c->main_lebs - 1) { |
267 | err = 16; |
268 | goto out; |
269 | } |
270 | |
271 | if (c->lst.total_free < 0 || c->lst.total_free > main_sz || |
272 | c->lst.total_free & 7) { |
273 | err = 17; |
274 | goto out; |
275 | } |
276 | |
277 | if (c->lst.total_dirty < 0 || (c->lst.total_dirty & 7)) { |
278 | err = 18; |
279 | goto out; |
280 | } |
281 | |
282 | if (c->lst.total_used < 0 || (c->lst.total_used & 7)) { |
283 | err = 19; |
284 | goto out; |
285 | } |
286 | |
287 | if (c->lst.total_free + c->lst.total_dirty + |
288 | c->lst.total_used > main_sz) { |
289 | err = 20; |
290 | goto out; |
291 | } |
292 | |
293 | if (c->lst.total_dead + c->lst.total_dark + |
294 | c->lst.total_used + c->bi.old_idx_sz > main_sz) { |
295 | err = 21; |
296 | goto out; |
297 | } |
298 | |
299 | if (c->lst.total_dead < 0 || |
300 | c->lst.total_dead > c->lst.total_free + c->lst.total_dirty || |
301 | c->lst.total_dead & 7) { |
302 | err = 22; |
303 | goto out; |
304 | } |
305 | |
306 | if (c->lst.total_dark < 0 || |
307 | c->lst.total_dark > c->lst.total_free + c->lst.total_dirty || |
308 | c->lst.total_dark & 7) { |
309 | err = 23; |
310 | goto out; |
311 | } |
312 | |
313 | return 0; |
314 | |
315 | out: |
316 | ubifs_err(c, fmt: "bad master node at offset %d error %d" , c->mst_offs, err); |
317 | ubifs_dump_node(c, node: c->mst_node, node_len: c->mst_node_alsz); |
318 | return -EINVAL; |
319 | } |
320 | |
321 | /** |
322 | * ubifs_read_master - read master node. |
323 | * @c: UBIFS file-system description object |
324 | * |
325 | * This function finds and reads the master node during file-system mount. If |
326 | * the flash is empty, it creates default master node as well. Returns zero in |
327 | * case of success and a negative error code in case of failure. |
328 | */ |
329 | int ubifs_read_master(struct ubifs_info *c) |
330 | { |
331 | int err, old_leb_cnt; |
332 | |
333 | c->mst_node = kzalloc(size: c->mst_node_alsz, GFP_KERNEL); |
334 | if (!c->mst_node) |
335 | return -ENOMEM; |
336 | |
337 | err = scan_for_master(c); |
338 | if (err) { |
339 | if (err == -EUCLEAN) |
340 | err = ubifs_recover_master_node(c); |
341 | if (err) |
342 | /* |
343 | * Note, we do not free 'c->mst_node' here because the |
344 | * unmount routine will take care of this. |
345 | */ |
346 | return err; |
347 | } |
348 | |
349 | /* Make sure that the recovery flag is clear */ |
350 | c->mst_node->flags &= cpu_to_le32(~UBIFS_MST_RCVRY); |
351 | |
352 | c->max_sqnum = le64_to_cpu(c->mst_node->ch.sqnum); |
353 | c->highest_inum = le64_to_cpu(c->mst_node->highest_inum); |
354 | c->cmt_no = le64_to_cpu(c->mst_node->cmt_no); |
355 | c->zroot.lnum = le32_to_cpu(c->mst_node->root_lnum); |
356 | c->zroot.offs = le32_to_cpu(c->mst_node->root_offs); |
357 | c->zroot.len = le32_to_cpu(c->mst_node->root_len); |
358 | c->lhead_lnum = le32_to_cpu(c->mst_node->log_lnum); |
359 | c->gc_lnum = le32_to_cpu(c->mst_node->gc_lnum); |
360 | c->ihead_lnum = le32_to_cpu(c->mst_node->ihead_lnum); |
361 | c->ihead_offs = le32_to_cpu(c->mst_node->ihead_offs); |
362 | c->bi.old_idx_sz = le64_to_cpu(c->mst_node->index_size); |
363 | c->lpt_lnum = le32_to_cpu(c->mst_node->lpt_lnum); |
364 | c->lpt_offs = le32_to_cpu(c->mst_node->lpt_offs); |
365 | c->nhead_lnum = le32_to_cpu(c->mst_node->nhead_lnum); |
366 | c->nhead_offs = le32_to_cpu(c->mst_node->nhead_offs); |
367 | c->ltab_lnum = le32_to_cpu(c->mst_node->ltab_lnum); |
368 | c->ltab_offs = le32_to_cpu(c->mst_node->ltab_offs); |
369 | c->lsave_lnum = le32_to_cpu(c->mst_node->lsave_lnum); |
370 | c->lsave_offs = le32_to_cpu(c->mst_node->lsave_offs); |
371 | c->lscan_lnum = le32_to_cpu(c->mst_node->lscan_lnum); |
372 | c->lst.empty_lebs = le32_to_cpu(c->mst_node->empty_lebs); |
373 | c->lst.idx_lebs = le32_to_cpu(c->mst_node->idx_lebs); |
374 | old_leb_cnt = le32_to_cpu(c->mst_node->leb_cnt); |
375 | c->lst.total_free = le64_to_cpu(c->mst_node->total_free); |
376 | c->lst.total_dirty = le64_to_cpu(c->mst_node->total_dirty); |
377 | c->lst.total_used = le64_to_cpu(c->mst_node->total_used); |
378 | c->lst.total_dead = le64_to_cpu(c->mst_node->total_dead); |
379 | c->lst.total_dark = le64_to_cpu(c->mst_node->total_dark); |
380 | |
381 | ubifs_copy_hash(c, from: c->mst_node->hash_root_idx, to: c->zroot.hash); |
382 | |
383 | c->calc_idx_sz = c->bi.old_idx_sz; |
384 | |
385 | if (c->mst_node->flags & cpu_to_le32(UBIFS_MST_NO_ORPHS)) |
386 | c->no_orphs = 1; |
387 | |
388 | if (old_leb_cnt != c->leb_cnt) { |
389 | /* The file system has been resized */ |
390 | int growth = c->leb_cnt - old_leb_cnt; |
391 | |
392 | if (c->leb_cnt < old_leb_cnt || |
393 | c->leb_cnt < UBIFS_MIN_LEB_CNT) { |
394 | ubifs_err(c, fmt: "bad leb_cnt on master node" ); |
395 | ubifs_dump_node(c, node: c->mst_node, node_len: c->mst_node_alsz); |
396 | return -EINVAL; |
397 | } |
398 | |
399 | dbg_mnt("Auto resizing (master) from %d LEBs to %d LEBs" , |
400 | old_leb_cnt, c->leb_cnt); |
401 | c->lst.empty_lebs += growth; |
402 | c->lst.total_free += growth * (long long)c->leb_size; |
403 | c->lst.total_dark += growth * (long long)c->dark_wm; |
404 | |
405 | /* |
406 | * Reflect changes back onto the master node. N.B. the master |
407 | * node gets written immediately whenever mounting (or |
408 | * remounting) in read-write mode, so we do not need to write it |
409 | * here. |
410 | */ |
411 | c->mst_node->leb_cnt = cpu_to_le32(c->leb_cnt); |
412 | c->mst_node->empty_lebs = cpu_to_le32(c->lst.empty_lebs); |
413 | c->mst_node->total_free = cpu_to_le64(c->lst.total_free); |
414 | c->mst_node->total_dark = cpu_to_le64(c->lst.total_dark); |
415 | } |
416 | |
417 | err = validate_master(c); |
418 | if (err) |
419 | return err; |
420 | |
421 | err = dbg_old_index_check_init(c, zroot: &c->zroot); |
422 | |
423 | return err; |
424 | } |
425 | |
426 | /** |
427 | * ubifs_write_master - write master node. |
428 | * @c: UBIFS file-system description object |
429 | * |
430 | * This function writes the master node. Returns zero in case of success and a |
431 | * negative error code in case of failure. The master node is written twice to |
432 | * enable recovery. |
433 | */ |
434 | int ubifs_write_master(struct ubifs_info *c) |
435 | { |
436 | int err, lnum, offs, len; |
437 | |
438 | ubifs_assert(c, !c->ro_media && !c->ro_mount); |
439 | if (c->ro_error) |
440 | return -EROFS; |
441 | |
442 | lnum = UBIFS_MST_LNUM; |
443 | offs = c->mst_offs + c->mst_node_alsz; |
444 | len = UBIFS_MST_NODE_SZ; |
445 | |
446 | if (offs + UBIFS_MST_NODE_SZ > c->leb_size) { |
447 | err = ubifs_leb_unmap(c, lnum); |
448 | if (err) |
449 | return err; |
450 | offs = 0; |
451 | } |
452 | |
453 | c->mst_offs = offs; |
454 | c->mst_node->highest_inum = cpu_to_le64(c->highest_inum); |
455 | |
456 | ubifs_copy_hash(c, from: c->zroot.hash, to: c->mst_node->hash_root_idx); |
457 | err = ubifs_write_node_hmac(c, buf: c->mst_node, len, lnum, offs, |
458 | offsetof(struct ubifs_mst_node, hmac)); |
459 | if (err) |
460 | return err; |
461 | |
462 | lnum += 1; |
463 | |
464 | if (offs == 0) { |
465 | err = ubifs_leb_unmap(c, lnum); |
466 | if (err) |
467 | return err; |
468 | } |
469 | err = ubifs_write_node_hmac(c, buf: c->mst_node, len, lnum, offs, |
470 | offsetof(struct ubifs_mst_node, hmac)); |
471 | |
472 | return err; |
473 | } |
474 | |