1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This file is part of UBIFS.
4 *
5 * Copyright (C) 2006-2008 Nokia Corporation.
6 *
7 * Authors: Artem Bityutskiy (Битюцкий Артём)
8 * Adrian Hunter
9 */
10
11 /* This file implements reading and writing the master node */
12
13 #include "ubifs.h"
14
15 /**
16 * ubifs_compare_master_node - compare two UBIFS master nodes
17 * @c: UBIFS file-system description object
18 * @m1: the first node
19 * @m2: the second node
20 *
21 * This function compares two UBIFS master nodes. Returns 0 if they are equal
22 * and nonzero if not.
23 */
ubifs_compare_master_node(struct ubifs_info * c,void * m1,void * m2)24 int ubifs_compare_master_node(struct ubifs_info *c, void *m1, void *m2)
25 {
26 int ret;
27 int behind;
28 int hmac_offs = offsetof(struct ubifs_mst_node, hmac);
29
30 /*
31 * Do not compare the common node header since the sequence number and
32 * hence the CRC are different.
33 */
34 ret = memcmp(m1 + UBIFS_CH_SZ, m2 + UBIFS_CH_SZ,
35 hmac_offs - UBIFS_CH_SZ);
36 if (ret)
37 return ret;
38
39 /*
40 * Do not compare the embedded HMAC as well which also must be different
41 * due to the different common node header.
42 */
43 behind = hmac_offs + UBIFS_MAX_HMAC_LEN;
44
45 if (UBIFS_MST_NODE_SZ > behind)
46 return memcmp(m1 + behind, m2 + behind, UBIFS_MST_NODE_SZ - behind);
47
48 return 0;
49 }
50
51 /* mst_node_check_hash - Check hash of a master node
52 * @c: UBIFS file-system description object
53 * @mst: The master node
54 * @expected: The expected hash of the master node
55 *
56 * This checks the hash of a master node against a given expected hash.
57 * Note that we have two master nodes on a UBIFS image which have different
58 * sequence numbers and consequently different CRCs. To be able to match
59 * both master nodes we exclude the common node header containing the sequence
60 * number and CRC from the hash.
61 *
62 * Returns 0 if the hashes are equal, a negative error code otherwise.
63 */
mst_node_check_hash(const struct ubifs_info * c,const struct ubifs_mst_node * mst,const u8 * expected)64 static int mst_node_check_hash(const struct ubifs_info *c,
65 const struct ubifs_mst_node *mst,
66 const u8 *expected)
67 {
68 u8 calc[UBIFS_MAX_HASH_LEN];
69 const void *node = mst;
70
71 crypto_shash_tfm_digest(c->hash_tfm, node + sizeof(struct ubifs_ch),
72 UBIFS_MST_NODE_SZ - sizeof(struct ubifs_ch),
73 calc);
74
75 if (ubifs_check_hash(c, expected, calc))
76 return -EPERM;
77
78 return 0;
79 }
80
81 /**
82 * scan_for_master - search the valid master node.
83 * @c: UBIFS file-system description object
84 *
85 * This function scans the master node LEBs and search for the latest master
86 * node. Returns zero in case of success, %-EUCLEAN if there master area is
87 * corrupted and requires recovery, and a negative error code in case of
88 * failure.
89 */
scan_for_master(struct ubifs_info * c)90 static int scan_for_master(struct ubifs_info *c)
91 {
92 struct ubifs_scan_leb *sleb;
93 struct ubifs_scan_node *snod;
94 int lnum, offs = 0, nodes_cnt, err;
95
96 lnum = UBIFS_MST_LNUM;
97
98 sleb = ubifs_scan(c, lnum, 0, c->sbuf, 1);
99 if (IS_ERR(sleb))
100 return PTR_ERR(sleb);
101 nodes_cnt = sleb->nodes_cnt;
102 if (nodes_cnt > 0) {
103 snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node,
104 list);
105 if (snod->type != UBIFS_MST_NODE)
106 goto out_dump;
107 memcpy(c->mst_node, snod->node, snod->len);
108 offs = snod->offs;
109 }
110 ubifs_scan_destroy(sleb);
111
112 lnum += 1;
113
114 sleb = ubifs_scan(c, lnum, 0, c->sbuf, 1);
115 if (IS_ERR(sleb))
116 return PTR_ERR(sleb);
117 if (sleb->nodes_cnt != nodes_cnt)
118 goto out;
119 if (!sleb->nodes_cnt)
120 goto out;
121 snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node, list);
122 if (snod->type != UBIFS_MST_NODE)
123 goto out_dump;
124 if (snod->offs != offs)
125 goto out;
126 if (ubifs_compare_master_node(c, c->mst_node, snod->node))
127 goto out;
128
129 c->mst_offs = offs;
130 ubifs_scan_destroy(sleb);
131
132 if (!ubifs_authenticated(c))
133 return 0;
134
135 if (ubifs_hmac_zero(c, c->mst_node->hmac)) {
136 err = mst_node_check_hash(c, c->mst_node,
137 c->sup_node->hash_mst);
138 if (err)
139 ubifs_err(c, "Failed to verify master node hash");
140 } else {
141 err = ubifs_node_verify_hmac(c, c->mst_node,
142 sizeof(struct ubifs_mst_node),
143 offsetof(struct ubifs_mst_node, hmac));
144 if (err)
145 ubifs_err(c, "Failed to verify master node HMAC");
146 }
147
148 if (err)
149 return -EPERM;
150
151 return 0;
152
153 out:
154 ubifs_scan_destroy(sleb);
155 return -EUCLEAN;
156
157 out_dump:
158 ubifs_err(c, "unexpected node type %d master LEB %d:%d",
159 snod->type, lnum, snod->offs);
160 ubifs_scan_destroy(sleb);
161 return -EINVAL;
162 }
163
164 /**
165 * validate_master - validate master node.
166 * @c: UBIFS file-system description object
167 *
168 * This function validates data which was read from master node. Returns zero
169 * if the data is all right and %-EINVAL if not.
170 */
validate_master(const struct ubifs_info * c)171 static int validate_master(const struct ubifs_info *c)
172 {
173 long long main_sz;
174 int err;
175
176 if (c->max_sqnum >= SQNUM_WATERMARK) {
177 err = 1;
178 goto out;
179 }
180
181 if (c->cmt_no >= c->max_sqnum) {
182 err = 2;
183 goto out;
184 }
185
186 if (c->highest_inum >= INUM_WATERMARK) {
187 err = 3;
188 goto out;
189 }
190
191 if (c->lhead_lnum < UBIFS_LOG_LNUM ||
192 c->lhead_lnum >= UBIFS_LOG_LNUM + c->log_lebs ||
193 c->lhead_offs < 0 || c->lhead_offs >= c->leb_size ||
194 c->lhead_offs & (c->min_io_size - 1)) {
195 err = 4;
196 goto out;
197 }
198
199 if (c->zroot.lnum >= c->leb_cnt || c->zroot.lnum < c->main_first ||
200 c->zroot.offs >= c->leb_size || c->zroot.offs & 7) {
201 err = 5;
202 goto out;
203 }
204
205 if (c->zroot.len < c->ranges[UBIFS_IDX_NODE].min_len ||
206 c->zroot.len > c->ranges[UBIFS_IDX_NODE].max_len) {
207 err = 6;
208 goto out;
209 }
210
211 if (c->gc_lnum >= c->leb_cnt || c->gc_lnum < c->main_first) {
212 err = 7;
213 goto out;
214 }
215
216 if (c->ihead_lnum >= c->leb_cnt || c->ihead_lnum < c->main_first ||
217 c->ihead_offs % c->min_io_size || c->ihead_offs < 0 ||
218 c->ihead_offs > c->leb_size || c->ihead_offs & 7) {
219 err = 8;
220 goto out;
221 }
222
223 main_sz = (long long)c->main_lebs * c->leb_size;
224 if (c->bi.old_idx_sz & 7 || c->bi.old_idx_sz >= main_sz) {
225 err = 9;
226 goto out;
227 }
228
229 if (c->lpt_lnum < c->lpt_first || c->lpt_lnum > c->lpt_last ||
230 c->lpt_offs < 0 || c->lpt_offs + c->nnode_sz > c->leb_size) {
231 err = 10;
232 goto out;
233 }
234
235 if (c->nhead_lnum < c->lpt_first || c->nhead_lnum > c->lpt_last ||
236 c->nhead_offs < 0 || c->nhead_offs % c->min_io_size ||
237 c->nhead_offs > c->leb_size) {
238 err = 11;
239 goto out;
240 }
241
242 if (c->ltab_lnum < c->lpt_first || c->ltab_lnum > c->lpt_last ||
243 c->ltab_offs < 0 ||
244 c->ltab_offs + c->ltab_sz > c->leb_size) {
245 err = 12;
246 goto out;
247 }
248
249 if (c->big_lpt && (c->lsave_lnum < c->lpt_first ||
250 c->lsave_lnum > c->lpt_last || c->lsave_offs < 0 ||
251 c->lsave_offs + c->lsave_sz > c->leb_size)) {
252 err = 13;
253 goto out;
254 }
255
256 if (c->lscan_lnum < c->main_first || c->lscan_lnum >= c->leb_cnt) {
257 err = 14;
258 goto out;
259 }
260
261 if (c->lst.empty_lebs < 0 || c->lst.empty_lebs > c->main_lebs - 2) {
262 err = 15;
263 goto out;
264 }
265
266 if (c->lst.idx_lebs < 0 || c->lst.idx_lebs > c->main_lebs - 1) {
267 err = 16;
268 goto out;
269 }
270
271 if (c->lst.total_free < 0 || c->lst.total_free > main_sz ||
272 c->lst.total_free & 7) {
273 err = 17;
274 goto out;
275 }
276
277 if (c->lst.total_dirty < 0 || (c->lst.total_dirty & 7)) {
278 err = 18;
279 goto out;
280 }
281
282 if (c->lst.total_used < 0 || (c->lst.total_used & 7)) {
283 err = 19;
284 goto out;
285 }
286
287 if (c->lst.total_free + c->lst.total_dirty +
288 c->lst.total_used > main_sz) {
289 err = 20;
290 goto out;
291 }
292
293 if (c->lst.total_dead + c->lst.total_dark +
294 c->lst.total_used + c->bi.old_idx_sz > main_sz) {
295 err = 21;
296 goto out;
297 }
298
299 if (c->lst.total_dead < 0 ||
300 c->lst.total_dead > c->lst.total_free + c->lst.total_dirty ||
301 c->lst.total_dead & 7) {
302 err = 22;
303 goto out;
304 }
305
306 if (c->lst.total_dark < 0 ||
307 c->lst.total_dark > c->lst.total_free + c->lst.total_dirty ||
308 c->lst.total_dark & 7) {
309 err = 23;
310 goto out;
311 }
312
313 return 0;
314
315 out:
316 ubifs_err(c, "bad master node at offset %d error %d", c->mst_offs, err);
317 ubifs_dump_node(c, c->mst_node, c->mst_node_alsz);
318 return -EINVAL;
319 }
320
321 /**
322 * ubifs_read_master - read master node.
323 * @c: UBIFS file-system description object
324 *
325 * This function finds and reads the master node during file-system mount. If
326 * the flash is empty, it creates default master node as well. Returns zero in
327 * case of success and a negative error code in case of failure.
328 */
ubifs_read_master(struct ubifs_info * c)329 int ubifs_read_master(struct ubifs_info *c)
330 {
331 int err, old_leb_cnt;
332
333 c->mst_node = kzalloc(c->mst_node_alsz, GFP_KERNEL);
334 if (!c->mst_node)
335 return -ENOMEM;
336
337 err = scan_for_master(c);
338 if (err) {
339 if (err == -EUCLEAN)
340 err = ubifs_recover_master_node(c);
341 if (err)
342 /*
343 * Note, we do not free 'c->mst_node' here because the
344 * unmount routine will take care of this.
345 */
346 return err;
347 }
348
349 /* Make sure that the recovery flag is clear */
350 c->mst_node->flags &= cpu_to_le32(~UBIFS_MST_RCVRY);
351
352 c->max_sqnum = le64_to_cpu(c->mst_node->ch.sqnum);
353 c->highest_inum = le64_to_cpu(c->mst_node->highest_inum);
354 c->cmt_no = le64_to_cpu(c->mst_node->cmt_no);
355 c->zroot.lnum = le32_to_cpu(c->mst_node->root_lnum);
356 c->zroot.offs = le32_to_cpu(c->mst_node->root_offs);
357 c->zroot.len = le32_to_cpu(c->mst_node->root_len);
358 c->lhead_lnum = le32_to_cpu(c->mst_node->log_lnum);
359 c->gc_lnum = le32_to_cpu(c->mst_node->gc_lnum);
360 c->ihead_lnum = le32_to_cpu(c->mst_node->ihead_lnum);
361 c->ihead_offs = le32_to_cpu(c->mst_node->ihead_offs);
362 c->bi.old_idx_sz = le64_to_cpu(c->mst_node->index_size);
363 c->lpt_lnum = le32_to_cpu(c->mst_node->lpt_lnum);
364 c->lpt_offs = le32_to_cpu(c->mst_node->lpt_offs);
365 c->nhead_lnum = le32_to_cpu(c->mst_node->nhead_lnum);
366 c->nhead_offs = le32_to_cpu(c->mst_node->nhead_offs);
367 c->ltab_lnum = le32_to_cpu(c->mst_node->ltab_lnum);
368 c->ltab_offs = le32_to_cpu(c->mst_node->ltab_offs);
369 c->lsave_lnum = le32_to_cpu(c->mst_node->lsave_lnum);
370 c->lsave_offs = le32_to_cpu(c->mst_node->lsave_offs);
371 c->lscan_lnum = le32_to_cpu(c->mst_node->lscan_lnum);
372 c->lst.empty_lebs = le32_to_cpu(c->mst_node->empty_lebs);
373 c->lst.idx_lebs = le32_to_cpu(c->mst_node->idx_lebs);
374 old_leb_cnt = le32_to_cpu(c->mst_node->leb_cnt);
375 c->lst.total_free = le64_to_cpu(c->mst_node->total_free);
376 c->lst.total_dirty = le64_to_cpu(c->mst_node->total_dirty);
377 c->lst.total_used = le64_to_cpu(c->mst_node->total_used);
378 c->lst.total_dead = le64_to_cpu(c->mst_node->total_dead);
379 c->lst.total_dark = le64_to_cpu(c->mst_node->total_dark);
380
381 ubifs_copy_hash(c, c->mst_node->hash_root_idx, c->zroot.hash);
382
383 c->calc_idx_sz = c->bi.old_idx_sz;
384
385 if (c->mst_node->flags & cpu_to_le32(UBIFS_MST_NO_ORPHS))
386 c->no_orphs = 1;
387
388 if (old_leb_cnt != c->leb_cnt) {
389 /* The file system has been resized */
390 int growth = c->leb_cnt - old_leb_cnt;
391
392 if (c->leb_cnt < old_leb_cnt ||
393 c->leb_cnt < UBIFS_MIN_LEB_CNT) {
394 ubifs_err(c, "bad leb_cnt on master node");
395 ubifs_dump_node(c, c->mst_node, c->mst_node_alsz);
396 return -EINVAL;
397 }
398
399 dbg_mnt("Auto resizing (master) from %d LEBs to %d LEBs",
400 old_leb_cnt, c->leb_cnt);
401 c->lst.empty_lebs += growth;
402 c->lst.total_free += growth * (long long)c->leb_size;
403 c->lst.total_dark += growth * (long long)c->dark_wm;
404
405 /*
406 * Reflect changes back onto the master node. N.B. the master
407 * node gets written immediately whenever mounting (or
408 * remounting) in read-write mode, so we do not need to write it
409 * here.
410 */
411 c->mst_node->leb_cnt = cpu_to_le32(c->leb_cnt);
412 c->mst_node->empty_lebs = cpu_to_le32(c->lst.empty_lebs);
413 c->mst_node->total_free = cpu_to_le64(c->lst.total_free);
414 c->mst_node->total_dark = cpu_to_le64(c->lst.total_dark);
415 }
416
417 err = validate_master(c);
418 if (err)
419 return err;
420
421 err = dbg_old_index_check_init(c, &c->zroot);
422
423 return err;
424 }
425
426 /**
427 * ubifs_write_master - write master node.
428 * @c: UBIFS file-system description object
429 *
430 * This function writes the master node. Returns zero in case of success and a
431 * negative error code in case of failure. The master node is written twice to
432 * enable recovery.
433 */
ubifs_write_master(struct ubifs_info * c)434 int ubifs_write_master(struct ubifs_info *c)
435 {
436 int err, lnum, offs, len;
437
438 ubifs_assert(c, !c->ro_media && !c->ro_mount);
439 if (c->ro_error)
440 return -EROFS;
441
442 lnum = UBIFS_MST_LNUM;
443 offs = c->mst_offs + c->mst_node_alsz;
444 len = UBIFS_MST_NODE_SZ;
445
446 if (offs + UBIFS_MST_NODE_SZ > c->leb_size) {
447 err = ubifs_leb_unmap(c, lnum);
448 if (err)
449 return err;
450 offs = 0;
451 }
452
453 c->mst_offs = offs;
454 c->mst_node->highest_inum = cpu_to_le64(c->highest_inum);
455
456 ubifs_copy_hash(c, c->zroot.hash, c->mst_node->hash_root_idx);
457 err = ubifs_write_node_hmac(c, c->mst_node, len, lnum, offs,
458 offsetof(struct ubifs_mst_node, hmac));
459 if (err)
460 return err;
461
462 lnum += 1;
463
464 if (offs == 0) {
465 err = ubifs_leb_unmap(c, lnum);
466 if (err)
467 return err;
468 }
469 err = ubifs_write_node_hmac(c, c->mst_node, len, lnum, offs,
470 offsetof(struct ubifs_mst_node, hmac));
471
472 return err;
473 }
474