Whamcloud - gitweb
libext2fs: avoid buffer overflow if s_first_meta_bg is too big
[tools/e2fsprogs.git] / lib / ext2fs / closefs.c
1 /*
2  * closefs.c --- close an ext2 filesystem
3  *
4  * Copyright (C) 1993, 1994, 1995, 1996 Theodore Ts'o.
5  *
6  * %Begin-Header%
7  * This file may be redistributed under the terms of the GNU Library
8  * General Public License, version 2.
9  * %End-Header%
10  */
11
12 #include "config.h"
13 #include <stdio.h>
14 #if HAVE_UNISTD_H
15 #include <unistd.h>
16 #endif
17 #include <time.h>
18 #include <string.h>
19
20 #include "ext2_fs.h"
21 #include "ext2fsP.h"
22
23 static int test_root(unsigned int a, unsigned int b)
24 {
25         while (1) {
26                 if (a < b)
27                         return 0;
28                 if (a == b)
29                         return 1;
30                 if (a % b)
31                         return 0;
32                 a = a / b;
33         }
34 }
35
36 int ext2fs_bg_has_super(ext2_filsys fs, dgrp_t group)
37 {
38         if (group == 0)
39                 return 1;
40         if (fs->super->s_feature_compat & EXT4_FEATURE_COMPAT_SPARSE_SUPER2) {
41                 if (group == fs->super->s_backup_bgs[0] ||
42                     group == fs->super->s_backup_bgs[1])
43                         return 1;
44                 return 0;
45         }
46         if ((group <= 1) || !(fs->super->s_feature_ro_compat &
47                               EXT2_FEATURE_RO_COMPAT_SPARSE_SUPER))
48                 return 1;
49         if (!(group & 1))
50                 return 0;
51         if (test_root(group, 3) || (test_root(group, 5)) ||
52             test_root(group, 7))
53                 return 1;
54
55         return 0;
56 }
57
58 /*
59  * ext2fs_super_and_bgd_loc2()
60  * @fs:                 ext2 fs pointer
61  * @group               given block group
62  * @ret_super_blk:      if !NULL, returns super block location
63  * @ret_old_desc_blk:   if !NULL, returns location of the old block
64  *                      group descriptor
65  * @ret_new_desc_blk:   if !NULL, returns location of meta_bg block
66  *                      group descriptor
67  * @ret_used_blks:      if !NULL, returns number of blocks used by
68  *                      super block and group_descriptors.
69  *
70  * Returns errcode_t of 0
71  */
72 errcode_t ext2fs_super_and_bgd_loc2(ext2_filsys fs,
73                                            dgrp_t group,
74                                            blk64_t *ret_super_blk,
75                                            blk64_t *ret_old_desc_blk,
76                                            blk64_t *ret_new_desc_blk,
77                                            blk_t *ret_used_blks)
78 {
79         blk64_t group_block, super_blk = 0, old_desc_blk = 0, new_desc_blk = 0;
80         unsigned int meta_bg, meta_bg_size;
81         blk_t   numblocks = 0;
82         blk64_t old_desc_blocks;
83         int     has_super;
84
85         group_block = ext2fs_group_first_block2(fs, group);
86         if (group_block == 0 && fs->blocksize == 1024)
87                 group_block = 1; /* Deal with 1024 blocksize && bigalloc */
88
89         if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
90                 old_desc_blocks = fs->super->s_first_meta_bg;
91         else
92                 old_desc_blocks =
93                         fs->desc_blocks + fs->super->s_reserved_gdt_blocks;
94
95         has_super = ext2fs_bg_has_super(fs, group);
96
97         if (has_super) {
98                 super_blk = group_block;
99                 numblocks++;
100         }
101         meta_bg_size = EXT2_DESC_PER_BLOCK(fs->super);
102         meta_bg = group / meta_bg_size;
103
104         if (!(fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) ||
105             (meta_bg < fs->super->s_first_meta_bg)) {
106                 if (has_super) {
107                         old_desc_blk = group_block + 1;
108                         numblocks += old_desc_blocks;
109                 }
110         } else {
111                 if (((group % meta_bg_size) == 0) ||
112                     ((group % meta_bg_size) == 1) ||
113                     ((group % meta_bg_size) == (meta_bg_size-1))) {
114                         if (has_super)
115                                 has_super = 1;
116                         new_desc_blk = group_block + has_super;
117                         numblocks++;
118                 }
119         }
120
121         if (ret_super_blk)
122                 *ret_super_blk = super_blk;
123         if (ret_old_desc_blk)
124                 *ret_old_desc_blk = old_desc_blk;
125         if (ret_new_desc_blk)
126                 *ret_new_desc_blk = new_desc_blk;
127         if (ret_used_blks)
128                 *ret_used_blks = numblocks;
129
130         return 0;
131 }
132
133 /*
134  * This function returns the location of the superblock, block group
135  * descriptors for a given block group.  It currently returns the
136  * number of free blocks assuming that inode table and allocation
137  * bitmaps will be in the group.  This is not necessarily the case
138  * when the flex_bg feature is enabled, so callers should take care!
139  * It was only really intended for use by mke2fs, and even there it's
140  * not that useful.
141  *
142  * The ext2fs_super_and_bgd_loc2() function is 64-bit block number
143  * capable and returns the number of blocks used by super block and
144  * group descriptors.
145  */
146 int ext2fs_super_and_bgd_loc(ext2_filsys fs,
147                              dgrp_t group,
148                              blk_t *ret_super_blk,
149                              blk_t *ret_old_desc_blk,
150                              blk_t *ret_new_desc_blk,
151                              int *ret_meta_bg)
152 {
153         blk64_t ret_super_blk2;
154         blk64_t ret_old_desc_blk2;
155         blk64_t ret_new_desc_blk2;
156         blk_t ret_used_blks;
157         blk_t numblocks;
158         unsigned int meta_bg_size;
159
160         ext2fs_super_and_bgd_loc2(fs, group, &ret_super_blk2,
161                                         &ret_old_desc_blk2,
162                                         &ret_new_desc_blk2,
163                                         &ret_used_blks);
164
165         numblocks = ext2fs_group_blocks_count(fs, group);
166
167         if (ret_super_blk)
168                 *ret_super_blk = (blk_t)ret_super_blk2;
169         if (ret_old_desc_blk)
170                 *ret_old_desc_blk = (blk_t)ret_old_desc_blk2;
171         if (ret_new_desc_blk)
172                 *ret_new_desc_blk = (blk_t)ret_new_desc_blk2;
173         if (ret_meta_bg) {
174                 meta_bg_size = EXT2_DESC_PER_BLOCK(fs->super);
175                 *ret_meta_bg = group / meta_bg_size;
176         }
177
178         numblocks -= 2 + fs->inode_blocks_per_group + ret_used_blks;
179
180         return numblocks;
181 }
182
183 /*
184  * This function forces out the primary superblock.  We need to only
185  * write out those fields which we have changed, since if the
186  * filesystem is mounted, it may have changed some of the other
187  * fields.
188  *
189  * It takes as input a superblock which has already been byte swapped
190  * (if necessary).
191  *
192  */
193 static errcode_t write_primary_superblock(ext2_filsys fs,
194                                           struct ext2_super_block *super)
195 {
196         __u16           *old_super, *new_super;
197         int             check_idx, write_idx, size;
198         errcode_t       retval;
199
200         if (!fs->io->manager->write_byte || !fs->orig_super) {
201         fallback:
202                 io_channel_set_blksize(fs->io, SUPERBLOCK_OFFSET);
203                 retval = io_channel_write_blk64(fs->io, 1, -SUPERBLOCK_SIZE,
204                                               super);
205                 io_channel_set_blksize(fs->io, fs->blocksize);
206                 return retval;
207         }
208
209         old_super = (__u16 *) fs->orig_super;
210         new_super = (__u16 *) super;
211
212         for (check_idx = 0; check_idx < SUPERBLOCK_SIZE/2; check_idx++) {
213                 if (old_super[check_idx] == new_super[check_idx])
214                         continue;
215                 write_idx = check_idx;
216                 for (check_idx++; check_idx < SUPERBLOCK_SIZE/2; check_idx++)
217                         if (old_super[check_idx] == new_super[check_idx])
218                                 break;
219                 size = 2 * (check_idx - write_idx);
220 #if 0
221                 printf("Writing %d bytes starting at %d\n",
222                        size, write_idx*2);
223 #endif
224                 retval = io_channel_write_byte(fs->io,
225                                SUPERBLOCK_OFFSET + (2 * write_idx), size,
226                                                new_super + write_idx);
227                 if (retval == EXT2_ET_UNIMPLEMENTED)
228                         goto fallback;
229                 if (retval)
230                         return retval;
231         }
232         memcpy(fs->orig_super, super, SUPERBLOCK_SIZE);
233         return 0;
234 }
235
236
237 /*
238  * Updates the revision to EXT2_DYNAMIC_REV
239  */
240 void ext2fs_update_dynamic_rev(ext2_filsys fs)
241 {
242         struct ext2_super_block *sb = fs->super;
243
244         if (sb->s_rev_level > EXT2_GOOD_OLD_REV)
245                 return;
246
247         sb->s_rev_level = EXT2_DYNAMIC_REV;
248         sb->s_first_ino = EXT2_GOOD_OLD_FIRST_INO;
249         sb->s_inode_size = EXT2_GOOD_OLD_INODE_SIZE;
250         /* s_uuid is handled by e2fsck already */
251         /* other fields should be left alone */
252 }
253
254 static errcode_t write_backup_super(ext2_filsys fs, dgrp_t group,
255                                     blk64_t group_block,
256                                     struct ext2_super_block *super_shadow)
257 {
258         dgrp_t  sgrp = group;
259
260         if (sgrp > ((1 << 16) - 1))
261                 sgrp = (1 << 16) - 1;
262 #ifdef WORDS_BIGENDIAN
263         super_shadow->s_block_group_nr = ext2fs_swab16(sgrp);
264 #else
265         fs->super->s_block_group_nr = sgrp;
266 #endif
267
268         return io_channel_write_blk64(fs->io, group_block, -SUPERBLOCK_SIZE,
269                                     super_shadow);
270 }
271
272 errcode_t ext2fs_flush(ext2_filsys fs)
273 {
274         return ext2fs_flush2(fs, 0);
275 }
276
277 errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
278 {
279         dgrp_t          i;
280         errcode_t       retval;
281         unsigned long   fs_state;
282         __u32           feature_incompat;
283         struct ext2_super_block *super_shadow = 0;
284         struct ext2_group_desc *group_shadow = 0;
285 #ifdef WORDS_BIGENDIAN
286         struct ext2_group_desc *gdp;
287         dgrp_t          j;
288 #endif
289         char    *group_ptr;
290         int     old_desc_blocks;
291         struct ext2fs_numeric_progress_struct progress;
292
293         EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
294
295         fs_state = fs->super->s_state;
296         feature_incompat = fs->super->s_feature_incompat;
297
298         fs->super->s_wtime = fs->now ? fs->now : time(NULL);
299         fs->super->s_block_group_nr = 0;
300 #ifdef WORDS_BIGENDIAN
301         retval = EXT2_ET_NO_MEMORY;
302         retval = ext2fs_get_mem(SUPERBLOCK_SIZE, &super_shadow);
303         if (retval)
304                 goto errout;
305         retval = ext2fs_get_array(fs->desc_blocks, fs->blocksize,
306                                   &group_shadow);
307         if (retval)
308                 goto errout;
309         memcpy(group_shadow, fs->group_desc, (size_t) fs->blocksize *
310                fs->desc_blocks);
311
312         /* swap the group descriptors */
313         for (j = 0; j < fs->group_desc_count; j++) {
314                 gdp = ext2fs_group_desc(fs, group_shadow, j);
315                 ext2fs_swap_group_desc2(fs, gdp);
316         }
317 #else
318         super_shadow = fs->super;
319         group_shadow = ext2fs_group_desc(fs, fs->group_desc, 0);
320 #endif
321
322         /*
323          * Set the state of the FS to be non-valid.  (The state has
324          * already been backed up earlier, and will be restored after
325          * we write out the backup superblocks.)
326          */
327         fs->super->s_state &= ~EXT2_VALID_FS;
328         fs->super->s_feature_incompat &= ~EXT3_FEATURE_INCOMPAT_RECOVER;
329 #ifdef WORDS_BIGENDIAN
330         *super_shadow = *fs->super;
331         ext2fs_swap_super(super_shadow);
332 #endif
333
334         /*
335          * If this is an external journal device, don't write out the
336          * block group descriptors or any of the backup superblocks
337          */
338         if (fs->super->s_feature_incompat &
339             EXT3_FEATURE_INCOMPAT_JOURNAL_DEV)
340                 goto write_primary_superblock_only;
341
342         /*
343          * Write out the master group descriptors, and the backup
344          * superblocks and group descriptors.
345          */
346         group_ptr = (char *) group_shadow;
347         if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
348                 old_desc_blocks = fs->super->s_first_meta_bg;
349                 if (old_desc_blocks > fs->super->s_first_meta_bg)
350                         old_desc_blocks = fs->desc_blocks;
351         } else
352                 old_desc_blocks = fs->desc_blocks;
353
354         ext2fs_numeric_progress_init(fs, &progress, NULL,
355                                      fs->group_desc_count);
356
357
358         for (i = 0; i < fs->group_desc_count; i++) {
359                 blk64_t super_blk, old_desc_blk, new_desc_blk;
360
361                 ext2fs_numeric_progress_update(fs, &progress, i);
362                 ext2fs_super_and_bgd_loc2(fs, i, &super_blk, &old_desc_blk,
363                                          &new_desc_blk, 0);
364
365                 if (!(fs->flags & EXT2_FLAG_MASTER_SB_ONLY) &&i && super_blk) {
366                         retval = write_backup_super(fs, i, super_blk,
367                                                     super_shadow);
368                         if (retval)
369                                 goto errout;
370                 }
371                 if (fs->flags & EXT2_FLAG_SUPER_ONLY)
372                         continue;
373                 if ((old_desc_blk) &&
374                     (!(fs->flags & EXT2_FLAG_MASTER_SB_ONLY) || (i == 0))) {
375                         retval = io_channel_write_blk64(fs->io,
376                               old_desc_blk, old_desc_blocks, group_ptr);
377                         if (retval)
378                                 goto errout;
379                 }
380                 if (new_desc_blk) {
381                         int meta_bg = i / EXT2_DESC_PER_BLOCK(fs->super);
382
383                         retval = io_channel_write_blk64(fs->io, new_desc_blk,
384                                 1, group_ptr + (meta_bg*fs->blocksize));
385                         if (retval)
386                                 goto errout;
387                 }
388         }
389
390         ext2fs_numeric_progress_close(fs, &progress, NULL);
391
392         /*
393          * If the write_bitmaps() function is present, call it to
394          * flush the bitmaps.  This is done this way so that a simple
395          * program that doesn't mess with the bitmaps doesn't need to
396          * drag in the bitmaps.c code.
397          */
398         if (fs->write_bitmaps) {
399                 retval = fs->write_bitmaps(fs);
400                 if (retval)
401                         goto errout;
402         }
403
404 write_primary_superblock_only:
405         /*
406          * Write out master superblock.  This has to be done
407          * separately, since it is located at a fixed location
408          * (SUPERBLOCK_OFFSET).  We flush all other pending changes
409          * out to disk first, just to avoid a race condition with an
410          * insy-tinsy window....
411          */
412
413         fs->super->s_block_group_nr = 0;
414         fs->super->s_state = fs_state;
415         fs->super->s_feature_incompat = feature_incompat;
416 #ifdef WORDS_BIGENDIAN
417         *super_shadow = *fs->super;
418         ext2fs_swap_super(super_shadow);
419 #endif
420
421         if (!(flags & EXT2_FLAG_FLUSH_NO_SYNC))
422                 retval = io_channel_flush(fs->io);
423         retval = write_primary_superblock(fs, super_shadow);
424         if (retval)
425                 goto errout;
426
427         fs->flags &= ~EXT2_FLAG_DIRTY;
428
429         if (!(flags & EXT2_FLAG_FLUSH_NO_SYNC))
430                 retval = io_channel_flush(fs->io);
431 errout:
432         fs->super->s_state = fs_state;
433 #ifdef WORDS_BIGENDIAN
434         if (super_shadow)
435                 ext2fs_free_mem(&super_shadow);
436         if (group_shadow)
437                 ext2fs_free_mem(&group_shadow);
438 #endif
439         return retval;
440 }
441
442 errcode_t ext2fs_close_free(ext2_filsys *fs_ptr)
443 {
444         errcode_t ret;
445         ext2_filsys fs = *fs_ptr;
446
447         ret = ext2fs_close2(fs, 0);
448         if (ret)
449                 ext2fs_free(fs);
450         *fs_ptr = NULL;
451         return ret;
452 }
453
454 errcode_t ext2fs_close(ext2_filsys fs)
455 {
456         return ext2fs_close2(fs, 0);
457 }
458
459 errcode_t ext2fs_close2(ext2_filsys fs, int flags)
460 {
461         errcode_t       retval;
462         int             meta_blks;
463         io_stats stats = 0;
464
465         EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
466
467         if (fs->write_bitmaps) {
468                 retval = fs->write_bitmaps(fs);
469                 if (retval)
470                         return retval;
471         }
472         if (fs->super->s_kbytes_written &&
473             fs->io->manager->get_stats)
474                 fs->io->manager->get_stats(fs->io, &stats);
475         if (stats && stats->bytes_written && (fs->flags & EXT2_FLAG_RW)) {
476                 fs->super->s_kbytes_written += stats->bytes_written >> 10;
477                 meta_blks = fs->desc_blocks + 1;
478                 if (!(fs->flags & EXT2_FLAG_SUPER_ONLY))
479                         fs->super->s_kbytes_written += meta_blks /
480                                 (fs->blocksize / 1024);
481                 if ((fs->flags & EXT2_FLAG_DIRTY) == 0)
482                         fs->flags |= EXT2_FLAG_SUPER_ONLY | EXT2_FLAG_DIRTY;
483         }
484         if (fs->flags & EXT2_FLAG_DIRTY) {
485                 retval = ext2fs_flush2(fs, flags);
486                 if (retval)
487                         return retval;
488         }
489
490         retval = ext2fs_mmp_stop(fs);
491         if (retval)
492                 return retval;
493
494         ext2fs_free(fs);
495         return 0;
496 }
497