xref: /openbmc/linux/fs/ntfs3/fslog.c (revision 5e20797c)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *
4  * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved.
5  *
6  */
7 
8 #include <linux/blkdev.h>
9 #include <linux/fs.h>
10 #include <linux/random.h>
11 #include <linux/slab.h>
12 
13 #include "debug.h"
14 #include "ntfs.h"
15 #include "ntfs_fs.h"
16 
17 /*
18  * LOG FILE structs
19  */
20 
21 // clang-format off
22 
23 #define MaxLogFileSize     0x100000000ull
24 #define DefaultLogPageSize 4096
25 #define MinLogRecordPages  0x30
26 
27 struct RESTART_HDR {
28 	struct NTFS_RECORD_HEADER rhdr; // 'RSTR'
29 	__le32 sys_page_size; // 0x10: Page size of the system which initialized the log.
30 	__le32 page_size;     // 0x14: Log page size used for this log file.
31 	__le16 ra_off;        // 0x18:
32 	__le16 minor_ver;     // 0x1A:
33 	__le16 major_ver;     // 0x1C:
34 	__le16 fixups[];
35 };
36 
37 #define LFS_NO_CLIENT 0xffff
38 #define LFS_NO_CLIENT_LE cpu_to_le16(0xffff)
39 
40 struct CLIENT_REC {
41 	__le64 oldest_lsn;
42 	__le64 restart_lsn; // 0x08:
43 	__le16 prev_client; // 0x10:
44 	__le16 next_client; // 0x12:
45 	__le16 seq_num;     // 0x14:
46 	u8 align[6];        // 0x16:
47 	__le32 name_bytes;  // 0x1C: In bytes.
48 	__le16 name[32];    // 0x20: Name of client.
49 };
50 
51 static_assert(sizeof(struct CLIENT_REC) == 0x60);
52 
53 /* Two copies of these will exist at the beginning of the log file */
54 struct RESTART_AREA {
55 	__le64 current_lsn;    // 0x00: Current logical end of log file.
56 	__le16 log_clients;    // 0x08: Maximum number of clients.
57 	__le16 client_idx[2];  // 0x0A: Free/use index into the client record arrays.
58 	__le16 flags;          // 0x0E: See RESTART_SINGLE_PAGE_IO.
59 	__le32 seq_num_bits;   // 0x10: The number of bits in sequence number.
60 	__le16 ra_len;         // 0x14:
61 	__le16 client_off;     // 0x16:
62 	__le64 l_size;         // 0x18: Usable log file size.
63 	__le32 last_lsn_data_len; // 0x20:
64 	__le16 rec_hdr_len;    // 0x24: Log page data offset.
65 	__le16 data_off;       // 0x26: Log page data length.
66 	__le32 open_log_count; // 0x28:
67 	__le32 align[5];       // 0x2C:
68 	struct CLIENT_REC clients[]; // 0x40:
69 };
70 
71 struct LOG_REC_HDR {
72 	__le16 redo_op;      // 0x00:  NTFS_LOG_OPERATION
73 	__le16 undo_op;      // 0x02:  NTFS_LOG_OPERATION
74 	__le16 redo_off;     // 0x04:  Offset to Redo record.
75 	__le16 redo_len;     // 0x06:  Redo length.
76 	__le16 undo_off;     // 0x08:  Offset to Undo record.
77 	__le16 undo_len;     // 0x0A:  Undo length.
78 	__le16 target_attr;  // 0x0C:
79 	__le16 lcns_follow;  // 0x0E:
80 	__le16 record_off;   // 0x10:
81 	__le16 attr_off;     // 0x12:
82 	__le16 cluster_off;  // 0x14:
83 	__le16 reserved;     // 0x16:
84 	__le64 target_vcn;   // 0x18:
85 	__le64 page_lcns[];  // 0x20:
86 };
87 
88 static_assert(sizeof(struct LOG_REC_HDR) == 0x20);
89 
90 #define RESTART_ENTRY_ALLOCATED    0xFFFFFFFF
91 #define RESTART_ENTRY_ALLOCATED_LE cpu_to_le32(0xFFFFFFFF)
92 
93 struct RESTART_TABLE {
94 	__le16 size;       // 0x00: In bytes
95 	__le16 used;       // 0x02: Entries
96 	__le16 total;      // 0x04: Entries
97 	__le16 res[3];     // 0x06:
98 	__le32 free_goal;  // 0x0C:
99 	__le32 first_free; // 0x10:
100 	__le32 last_free;  // 0x14:
101 
102 };
103 
104 static_assert(sizeof(struct RESTART_TABLE) == 0x18);
105 
106 struct ATTR_NAME_ENTRY {
107 	__le16 off; // Offset in the Open attribute Table.
108 	__le16 name_bytes;
109 	__le16 name[];
110 };
111 
112 struct OPEN_ATTR_ENRTY {
113 	__le32 next;            // 0x00: RESTART_ENTRY_ALLOCATED if allocated
114 	__le32 bytes_per_index; // 0x04:
115 	enum ATTR_TYPE type;    // 0x08:
116 	u8 is_dirty_pages;      // 0x0C:
117 	u8 is_attr_name;        // 0x0B: Faked field to manage 'ptr'
118 	u8 name_len;            // 0x0C: Faked field to manage 'ptr'
119 	u8 res;
120 	struct MFT_REF ref;     // 0x10: File Reference of file containing attribute
121 	__le64 open_record_lsn; // 0x18:
122 	void *ptr;              // 0x20:
123 };
124 
125 /* 32 bit version of 'struct OPEN_ATTR_ENRTY' */
126 struct OPEN_ATTR_ENRTY_32 {
127 	__le32 next;            // 0x00: RESTART_ENTRY_ALLOCATED if allocated
128 	__le32 ptr;             // 0x04:
129 	struct MFT_REF ref;     // 0x08:
130 	__le64 open_record_lsn; // 0x10:
131 	u8 is_dirty_pages;      // 0x18:
132 	u8 is_attr_name;        // 0x19:
133 	u8 res1[2];
134 	enum ATTR_TYPE type;    // 0x1C:
135 	u8 name_len;            // 0x20: In wchar
136 	u8 res2[3];
137 	__le32 AttributeName;   // 0x24:
138 	__le32 bytes_per_index; // 0x28:
139 };
140 
141 #define SIZEOF_OPENATTRIBUTEENTRY0 0x2c
142 // static_assert( 0x2C == sizeof(struct OPEN_ATTR_ENRTY_32) );
143 static_assert(sizeof(struct OPEN_ATTR_ENRTY) < SIZEOF_OPENATTRIBUTEENTRY0);
144 
145 /*
146  * One entry exists in the Dirty Pages Table for each page which is dirty at
147  * the time the Restart Area is written.
148  */
149 struct DIR_PAGE_ENTRY {
150 	__le32 next;         // 0x00: RESTART_ENTRY_ALLOCATED if allocated
151 	__le32 target_attr;  // 0x04: Index into the Open attribute Table
152 	__le32 transfer_len; // 0x08:
153 	__le32 lcns_follow;  // 0x0C:
154 	__le64 vcn;          // 0x10: Vcn of dirty page
155 	__le64 oldest_lsn;   // 0x18:
156 	__le64 page_lcns[];  // 0x20:
157 };
158 
159 static_assert(sizeof(struct DIR_PAGE_ENTRY) == 0x20);
160 
161 /* 32 bit version of 'struct DIR_PAGE_ENTRY' */
162 struct DIR_PAGE_ENTRY_32 {
163 	__le32 next;		// 0x00: RESTART_ENTRY_ALLOCATED if allocated
164 	__le32 target_attr;	// 0x04: Index into the Open attribute Table
165 	__le32 transfer_len;	// 0x08:
166 	__le32 lcns_follow;	// 0x0C:
167 	__le32 reserved;	// 0x10:
168 	__le32 vcn_low;		// 0x14: Vcn of dirty page
169 	__le32 vcn_hi;		// 0x18: Vcn of dirty page
170 	__le32 oldest_lsn_low;	// 0x1C:
171 	__le32 oldest_lsn_hi;	// 0x1C:
172 	__le32 page_lcns_low;	// 0x24:
173 	__le32 page_lcns_hi;	// 0x24:
174 };
175 
176 static_assert(offsetof(struct DIR_PAGE_ENTRY_32, vcn_low) == 0x14);
177 static_assert(sizeof(struct DIR_PAGE_ENTRY_32) == 0x2c);
178 
179 enum transact_state {
180 	TransactionUninitialized = 0,
181 	TransactionActive,
182 	TransactionPrepared,
183 	TransactionCommitted
184 };
185 
186 struct TRANSACTION_ENTRY {
187 	__le32 next;          // 0x00: RESTART_ENTRY_ALLOCATED if allocated
188 	u8 transact_state;    // 0x04:
189 	u8 reserved[3];       // 0x05:
190 	__le64 first_lsn;     // 0x08:
191 	__le64 prev_lsn;      // 0x10:
192 	__le64 undo_next_lsn; // 0x18:
193 	__le32 undo_records;  // 0x20: Number of undo log records pending abort
194 	__le32 undo_len;      // 0x24: Total undo size
195 };
196 
197 static_assert(sizeof(struct TRANSACTION_ENTRY) == 0x28);
198 
199 struct NTFS_RESTART {
200 	__le32 major_ver;             // 0x00:
201 	__le32 minor_ver;             // 0x04:
202 	__le64 check_point_start;     // 0x08:
203 	__le64 open_attr_table_lsn;   // 0x10:
204 	__le64 attr_names_lsn;        // 0x18:
205 	__le64 dirty_pages_table_lsn; // 0x20:
206 	__le64 transact_table_lsn;    // 0x28:
207 	__le32 open_attr_len;         // 0x30: In bytes
208 	__le32 attr_names_len;        // 0x34: In bytes
209 	__le32 dirty_pages_len;       // 0x38: In bytes
210 	__le32 transact_table_len;    // 0x3C: In bytes
211 };
212 
213 static_assert(sizeof(struct NTFS_RESTART) == 0x40);
214 
215 struct NEW_ATTRIBUTE_SIZES {
216 	__le64 alloc_size;
217 	__le64 valid_size;
218 	__le64 data_size;
219 	__le64 total_size;
220 };
221 
222 struct BITMAP_RANGE {
223 	__le32 bitmap_off;
224 	__le32 bits;
225 };
226 
227 struct LCN_RANGE {
228 	__le64 lcn;
229 	__le64 len;
230 };
231 
232 /* The following type defines the different log record types. */
233 #define LfsClientRecord  cpu_to_le32(1)
234 #define LfsClientRestart cpu_to_le32(2)
235 
236 /* This is used to uniquely identify a client for a particular log file. */
237 struct CLIENT_ID {
238 	__le16 seq_num;
239 	__le16 client_idx;
240 };
241 
242 /* This is the header that begins every Log Record in the log file. */
243 struct LFS_RECORD_HDR {
244 	__le64 this_lsn;		// 0x00:
245 	__le64 client_prev_lsn;		// 0x08:
246 	__le64 client_undo_next_lsn;	// 0x10:
247 	__le32 client_data_len;		// 0x18:
248 	struct CLIENT_ID client;	// 0x1C: Owner of this log record.
249 	__le32 record_type;		// 0x20: LfsClientRecord or LfsClientRestart.
250 	__le32 transact_id;		// 0x24:
251 	__le16 flags;			// 0x28: LOG_RECORD_MULTI_PAGE
252 	u8 align[6];			// 0x2A:
253 };
254 
255 #define LOG_RECORD_MULTI_PAGE cpu_to_le16(1)
256 
257 static_assert(sizeof(struct LFS_RECORD_HDR) == 0x30);
258 
259 struct LFS_RECORD {
260 	__le16 next_record_off;	// 0x00: Offset of the free space in the page,
261 	u8 align[6];		// 0x02:
262 	__le64 last_end_lsn;	// 0x08: lsn for the last log record which ends on the page,
263 };
264 
265 static_assert(sizeof(struct LFS_RECORD) == 0x10);
266 
267 struct RECORD_PAGE_HDR {
268 	struct NTFS_RECORD_HEADER rhdr;	// 'RCRD'
269 	__le32 rflags;			// 0x10: See LOG_PAGE_LOG_RECORD_END
270 	__le16 page_count;		// 0x14:
271 	__le16 page_pos;		// 0x16:
272 	struct LFS_RECORD record_hdr;	// 0x18:
273 	__le16 fixups[10];		// 0x28:
274 	__le32 file_off;		// 0x3c: Used when major version >= 2
275 };
276 
277 // clang-format on
278 
279 // Page contains the end of a log record.
280 #define LOG_PAGE_LOG_RECORD_END cpu_to_le32(0x00000001)
281 
is_log_record_end(const struct RECORD_PAGE_HDR * hdr)282 static inline bool is_log_record_end(const struct RECORD_PAGE_HDR *hdr)
283 {
284 	return hdr->rflags & LOG_PAGE_LOG_RECORD_END;
285 }
286 
287 static_assert(offsetof(struct RECORD_PAGE_HDR, file_off) == 0x3c);
288 
289 /*
290  * END of NTFS LOG structures
291  */
292 
293 /* Define some tuning parameters to keep the restart tables a reasonable size. */
294 #define INITIAL_NUMBER_TRANSACTIONS 5
295 
296 enum NTFS_LOG_OPERATION {
297 
298 	Noop = 0x00,
299 	CompensationLogRecord = 0x01,
300 	InitializeFileRecordSegment = 0x02,
301 	DeallocateFileRecordSegment = 0x03,
302 	WriteEndOfFileRecordSegment = 0x04,
303 	CreateAttribute = 0x05,
304 	DeleteAttribute = 0x06,
305 	UpdateResidentValue = 0x07,
306 	UpdateNonresidentValue = 0x08,
307 	UpdateMappingPairs = 0x09,
308 	DeleteDirtyClusters = 0x0A,
309 	SetNewAttributeSizes = 0x0B,
310 	AddIndexEntryRoot = 0x0C,
311 	DeleteIndexEntryRoot = 0x0D,
312 	AddIndexEntryAllocation = 0x0E,
313 	DeleteIndexEntryAllocation = 0x0F,
314 	WriteEndOfIndexBuffer = 0x10,
315 	SetIndexEntryVcnRoot = 0x11,
316 	SetIndexEntryVcnAllocation = 0x12,
317 	UpdateFileNameRoot = 0x13,
318 	UpdateFileNameAllocation = 0x14,
319 	SetBitsInNonresidentBitMap = 0x15,
320 	ClearBitsInNonresidentBitMap = 0x16,
321 	HotFix = 0x17,
322 	EndTopLevelAction = 0x18,
323 	PrepareTransaction = 0x19,
324 	CommitTransaction = 0x1A,
325 	ForgetTransaction = 0x1B,
326 	OpenNonresidentAttribute = 0x1C,
327 	OpenAttributeTableDump = 0x1D,
328 	AttributeNamesDump = 0x1E,
329 	DirtyPageTableDump = 0x1F,
330 	TransactionTableDump = 0x20,
331 	UpdateRecordDataRoot = 0x21,
332 	UpdateRecordDataAllocation = 0x22,
333 
334 	UpdateRelativeDataInIndex =
335 		0x23, // NtOfsRestartUpdateRelativeDataInIndex
336 	UpdateRelativeDataInIndex2 = 0x24,
337 	ZeroEndOfFileRecord = 0x25,
338 };
339 
340 /*
341  * Array for log records which require a target attribute.
342  * A true indicates that the corresponding restart operation
343  * requires a target attribute.
344  */
345 static const u8 AttributeRequired[] = {
346 	0xFC, 0xFB, 0xFF, 0x10, 0x06,
347 };
348 
is_target_required(u16 op)349 static inline bool is_target_required(u16 op)
350 {
351 	bool ret = op <= UpdateRecordDataAllocation &&
352 		   (AttributeRequired[op >> 3] >> (op & 7) & 1);
353 	return ret;
354 }
355 
can_skip_action(enum NTFS_LOG_OPERATION op)356 static inline bool can_skip_action(enum NTFS_LOG_OPERATION op)
357 {
358 	switch (op) {
359 	case Noop:
360 	case DeleteDirtyClusters:
361 	case HotFix:
362 	case EndTopLevelAction:
363 	case PrepareTransaction:
364 	case CommitTransaction:
365 	case ForgetTransaction:
366 	case CompensationLogRecord:
367 	case OpenNonresidentAttribute:
368 	case OpenAttributeTableDump:
369 	case AttributeNamesDump:
370 	case DirtyPageTableDump:
371 	case TransactionTableDump:
372 		return true;
373 	default:
374 		return false;
375 	}
376 }
377 
378 enum { lcb_ctx_undo_next, lcb_ctx_prev, lcb_ctx_next };
379 
380 /* Bytes per restart table. */
bytes_per_rt(const struct RESTART_TABLE * rt)381 static inline u32 bytes_per_rt(const struct RESTART_TABLE *rt)
382 {
383 	return le16_to_cpu(rt->used) * le16_to_cpu(rt->size) +
384 	       sizeof(struct RESTART_TABLE);
385 }
386 
387 /* Log record length. */
lrh_length(const struct LOG_REC_HDR * lr)388 static inline u32 lrh_length(const struct LOG_REC_HDR *lr)
389 {
390 	u16 t16 = le16_to_cpu(lr->lcns_follow);
391 
392 	return struct_size(lr, page_lcns, max_t(u16, 1, t16));
393 }
394 
395 struct lcb {
396 	struct LFS_RECORD_HDR *lrh; // Log record header of the current lsn.
397 	struct LOG_REC_HDR *log_rec;
398 	u32 ctx_mode; // lcb_ctx_undo_next/lcb_ctx_prev/lcb_ctx_next
399 	struct CLIENT_ID client;
400 	bool alloc; // If true the we should deallocate 'log_rec'.
401 };
402 
lcb_put(struct lcb * lcb)403 static void lcb_put(struct lcb *lcb)
404 {
405 	if (lcb->alloc)
406 		kfree(lcb->log_rec);
407 	kfree(lcb->lrh);
408 	kfree(lcb);
409 }
410 
411 /* Find the oldest lsn from active clients. */
oldest_client_lsn(const struct CLIENT_REC * ca,__le16 next_client,u64 * oldest_lsn)412 static inline void oldest_client_lsn(const struct CLIENT_REC *ca,
413 				     __le16 next_client, u64 *oldest_lsn)
414 {
415 	while (next_client != LFS_NO_CLIENT_LE) {
416 		const struct CLIENT_REC *cr = ca + le16_to_cpu(next_client);
417 		u64 lsn = le64_to_cpu(cr->oldest_lsn);
418 
419 		/* Ignore this block if it's oldest lsn is 0. */
420 		if (lsn && lsn < *oldest_lsn)
421 			*oldest_lsn = lsn;
422 
423 		next_client = cr->next_client;
424 	}
425 }
426 
is_rst_page_hdr_valid(u32 file_off,const struct RESTART_HDR * rhdr)427 static inline bool is_rst_page_hdr_valid(u32 file_off,
428 					 const struct RESTART_HDR *rhdr)
429 {
430 	u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
431 	u32 page_size = le32_to_cpu(rhdr->page_size);
432 	u32 end_usa;
433 	u16 ro;
434 
435 	if (sys_page < SECTOR_SIZE || page_size < SECTOR_SIZE ||
436 	    sys_page & (sys_page - 1) || page_size & (page_size - 1)) {
437 		return false;
438 	}
439 
440 	/* Check that if the file offset isn't 0, it is the system page size. */
441 	if (file_off && file_off != sys_page)
442 		return false;
443 
444 	/* Check support version 1.1+. */
445 	if (le16_to_cpu(rhdr->major_ver) <= 1 && !rhdr->minor_ver)
446 		return false;
447 
448 	if (le16_to_cpu(rhdr->major_ver) > 2)
449 		return false;
450 
451 	ro = le16_to_cpu(rhdr->ra_off);
452 	if (!IS_ALIGNED(ro, 8) || ro > sys_page)
453 		return false;
454 
455 	end_usa = ((sys_page >> SECTOR_SHIFT) + 1) * sizeof(short);
456 	end_usa += le16_to_cpu(rhdr->rhdr.fix_off);
457 
458 	if (ro < end_usa)
459 		return false;
460 
461 	return true;
462 }
463 
is_rst_area_valid(const struct RESTART_HDR * rhdr)464 static inline bool is_rst_area_valid(const struct RESTART_HDR *rhdr)
465 {
466 	const struct RESTART_AREA *ra;
467 	u16 cl, fl, ul;
468 	u32 off, l_size, seq_bits;
469 	u16 ro = le16_to_cpu(rhdr->ra_off);
470 	u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
471 
472 	if (ro + offsetof(struct RESTART_AREA, l_size) >
473 	    SECTOR_SIZE - sizeof(short))
474 		return false;
475 
476 	ra = Add2Ptr(rhdr, ro);
477 	cl = le16_to_cpu(ra->log_clients);
478 
479 	if (cl > 1)
480 		return false;
481 
482 	off = le16_to_cpu(ra->client_off);
483 
484 	if (!IS_ALIGNED(off, 8) || ro + off > SECTOR_SIZE - sizeof(short))
485 		return false;
486 
487 	off += cl * sizeof(struct CLIENT_REC);
488 
489 	if (off > sys_page)
490 		return false;
491 
492 	/*
493 	 * Check the restart length field and whether the entire
494 	 * restart area is contained that length.
495 	 */
496 	if (le16_to_cpu(rhdr->ra_off) + le16_to_cpu(ra->ra_len) > sys_page ||
497 	    off > le16_to_cpu(ra->ra_len)) {
498 		return false;
499 	}
500 
501 	/*
502 	 * As a final check make sure that the use list and the free list
503 	 * are either empty or point to a valid client.
504 	 */
505 	fl = le16_to_cpu(ra->client_idx[0]);
506 	ul = le16_to_cpu(ra->client_idx[1]);
507 	if ((fl != LFS_NO_CLIENT && fl >= cl) ||
508 	    (ul != LFS_NO_CLIENT && ul >= cl))
509 		return false;
510 
511 	/* Make sure the sequence number bits match the log file size. */
512 	l_size = le64_to_cpu(ra->l_size);
513 
514 	seq_bits = sizeof(u64) * 8 + 3;
515 	while (l_size) {
516 		l_size >>= 1;
517 		seq_bits -= 1;
518 	}
519 
520 	if (seq_bits != ra->seq_num_bits)
521 		return false;
522 
523 	/* The log page data offset and record header length must be quad-aligned. */
524 	if (!IS_ALIGNED(le16_to_cpu(ra->data_off), 8) ||
525 	    !IS_ALIGNED(le16_to_cpu(ra->rec_hdr_len), 8))
526 		return false;
527 
528 	return true;
529 }
530 
is_client_area_valid(const struct RESTART_HDR * rhdr,bool usa_error)531 static inline bool is_client_area_valid(const struct RESTART_HDR *rhdr,
532 					bool usa_error)
533 {
534 	u16 ro = le16_to_cpu(rhdr->ra_off);
535 	const struct RESTART_AREA *ra = Add2Ptr(rhdr, ro);
536 	u16 ra_len = le16_to_cpu(ra->ra_len);
537 	const struct CLIENT_REC *ca;
538 	u32 i;
539 
540 	if (usa_error && ra_len + ro > SECTOR_SIZE - sizeof(short))
541 		return false;
542 
543 	/* Find the start of the client array. */
544 	ca = Add2Ptr(ra, le16_to_cpu(ra->client_off));
545 
546 	/*
547 	 * Start with the free list.
548 	 * Check that all the clients are valid and that there isn't a cycle.
549 	 * Do the in-use list on the second pass.
550 	 */
551 	for (i = 0; i < 2; i++) {
552 		u16 client_idx = le16_to_cpu(ra->client_idx[i]);
553 		bool first_client = true;
554 		u16 clients = le16_to_cpu(ra->log_clients);
555 
556 		while (client_idx != LFS_NO_CLIENT) {
557 			const struct CLIENT_REC *cr;
558 
559 			if (!clients ||
560 			    client_idx >= le16_to_cpu(ra->log_clients))
561 				return false;
562 
563 			clients -= 1;
564 			cr = ca + client_idx;
565 
566 			client_idx = le16_to_cpu(cr->next_client);
567 
568 			if (first_client) {
569 				first_client = false;
570 				if (cr->prev_client != LFS_NO_CLIENT_LE)
571 					return false;
572 			}
573 		}
574 	}
575 
576 	return true;
577 }
578 
579 /*
580  * remove_client
581  *
582  * Remove a client record from a client record list an restart area.
583  */
remove_client(struct CLIENT_REC * ca,const struct CLIENT_REC * cr,__le16 * head)584 static inline void remove_client(struct CLIENT_REC *ca,
585 				 const struct CLIENT_REC *cr, __le16 *head)
586 {
587 	if (cr->prev_client == LFS_NO_CLIENT_LE)
588 		*head = cr->next_client;
589 	else
590 		ca[le16_to_cpu(cr->prev_client)].next_client = cr->next_client;
591 
592 	if (cr->next_client != LFS_NO_CLIENT_LE)
593 		ca[le16_to_cpu(cr->next_client)].prev_client = cr->prev_client;
594 }
595 
596 /*
597  * add_client - Add a client record to the start of a list.
598  */
add_client(struct CLIENT_REC * ca,u16 index,__le16 * head)599 static inline void add_client(struct CLIENT_REC *ca, u16 index, __le16 *head)
600 {
601 	struct CLIENT_REC *cr = ca + index;
602 
603 	cr->prev_client = LFS_NO_CLIENT_LE;
604 	cr->next_client = *head;
605 
606 	if (*head != LFS_NO_CLIENT_LE)
607 		ca[le16_to_cpu(*head)].prev_client = cpu_to_le16(index);
608 
609 	*head = cpu_to_le16(index);
610 }
611 
612 /*
613  * Enumerate restart table.
614  *
615  * @t - table to enumerate.
616  * @c - current enumerated element.
617  *
618  * enumeration starts with @c == NULL
619  * returns next element or NULL
620  */
enum_rstbl(struct RESTART_TABLE * t,void * c)621 static inline void *enum_rstbl(struct RESTART_TABLE *t, void *c)
622 {
623 	__le32 *e;
624 	u32 bprt;
625 	u16 rsize;
626 
627 	if (!t)
628 		return NULL;
629 
630 	rsize = le16_to_cpu(t->size);
631 
632 	if (!c) {
633 		/* start enumeration. */
634 		if (!t->total)
635 			return NULL;
636 		e = Add2Ptr(t, sizeof(struct RESTART_TABLE));
637 	} else {
638 		e = Add2Ptr(c, rsize);
639 	}
640 
641 	/* Loop until we hit the first one allocated, or the end of the list. */
642 	for (bprt = bytes_per_rt(t); PtrOffset(t, e) < bprt;
643 	     e = Add2Ptr(e, rsize)) {
644 		if (*e == RESTART_ENTRY_ALLOCATED_LE)
645 			return e;
646 	}
647 	return NULL;
648 }
649 
650 /*
651  * find_dp - Search for a @vcn in Dirty Page Table.
652  */
find_dp(struct RESTART_TABLE * dptbl,u32 target_attr,u64 vcn)653 static inline struct DIR_PAGE_ENTRY *find_dp(struct RESTART_TABLE *dptbl,
654 					     u32 target_attr, u64 vcn)
655 {
656 	__le32 ta = cpu_to_le32(target_attr);
657 	struct DIR_PAGE_ENTRY *dp = NULL;
658 
659 	while ((dp = enum_rstbl(dptbl, dp))) {
660 		u64 dp_vcn = le64_to_cpu(dp->vcn);
661 
662 		if (dp->target_attr == ta && vcn >= dp_vcn &&
663 		    vcn < dp_vcn + le32_to_cpu(dp->lcns_follow)) {
664 			return dp;
665 		}
666 	}
667 	return NULL;
668 }
669 
norm_file_page(u32 page_size,u32 * l_size,bool use_default)670 static inline u32 norm_file_page(u32 page_size, u32 *l_size, bool use_default)
671 {
672 	if (use_default)
673 		page_size = DefaultLogPageSize;
674 
675 	/* Round the file size down to a system page boundary. */
676 	*l_size &= ~(page_size - 1);
677 
678 	/* File should contain at least 2 restart pages and MinLogRecordPages pages. */
679 	if (*l_size < (MinLogRecordPages + 2) * page_size)
680 		return 0;
681 
682 	return page_size;
683 }
684 
check_log_rec(const struct LOG_REC_HDR * lr,u32 bytes,u32 tr,u32 bytes_per_attr_entry)685 static bool check_log_rec(const struct LOG_REC_HDR *lr, u32 bytes, u32 tr,
686 			  u32 bytes_per_attr_entry)
687 {
688 	u16 t16;
689 
690 	if (bytes < sizeof(struct LOG_REC_HDR))
691 		return false;
692 	if (!tr)
693 		return false;
694 
695 	if ((tr - sizeof(struct RESTART_TABLE)) %
696 	    sizeof(struct TRANSACTION_ENTRY))
697 		return false;
698 
699 	if (le16_to_cpu(lr->redo_off) & 7)
700 		return false;
701 
702 	if (le16_to_cpu(lr->undo_off) & 7)
703 		return false;
704 
705 	if (lr->target_attr)
706 		goto check_lcns;
707 
708 	if (is_target_required(le16_to_cpu(lr->redo_op)))
709 		return false;
710 
711 	if (is_target_required(le16_to_cpu(lr->undo_op)))
712 		return false;
713 
714 check_lcns:
715 	if (!lr->lcns_follow)
716 		goto check_length;
717 
718 	t16 = le16_to_cpu(lr->target_attr);
719 	if ((t16 - sizeof(struct RESTART_TABLE)) % bytes_per_attr_entry)
720 		return false;
721 
722 check_length:
723 	if (bytes < lrh_length(lr))
724 		return false;
725 
726 	return true;
727 }
728 
check_rstbl(const struct RESTART_TABLE * rt,size_t bytes)729 static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes)
730 {
731 	u32 ts;
732 	u32 i, off;
733 	u16 rsize = le16_to_cpu(rt->size);
734 	u16 ne = le16_to_cpu(rt->used);
735 	u32 ff = le32_to_cpu(rt->first_free);
736 	u32 lf = le32_to_cpu(rt->last_free);
737 
738 	ts = rsize * ne + sizeof(struct RESTART_TABLE);
739 
740 	if (!rsize || rsize > bytes ||
741 	    rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts ||
742 	    le16_to_cpu(rt->total) > ne ||
743 			ff > ts - sizeof(__le32) || lf > ts - sizeof(__le32) ||
744 	    (ff && ff < sizeof(struct RESTART_TABLE)) ||
745 	    (lf && lf < sizeof(struct RESTART_TABLE))) {
746 		return false;
747 	}
748 
749 	/*
750 	 * Verify each entry is either allocated or points
751 	 * to a valid offset the table.
752 	 */
753 	for (i = 0; i < ne; i++) {
754 		off = le32_to_cpu(*(__le32 *)Add2Ptr(
755 			rt, i * rsize + sizeof(struct RESTART_TABLE)));
756 
757 		if (off != RESTART_ENTRY_ALLOCATED && off &&
758 		    (off < sizeof(struct RESTART_TABLE) ||
759 		     ((off - sizeof(struct RESTART_TABLE)) % rsize))) {
760 			return false;
761 		}
762 	}
763 
764 	/*
765 	 * Walk through the list headed by the first entry to make
766 	 * sure none of the entries are currently being used.
767 	 */
768 	for (off = ff; off;) {
769 		if (off == RESTART_ENTRY_ALLOCATED)
770 			return false;
771 
772 		off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
773 
774 		if (off > ts - sizeof(__le32))
775 			return false;
776 	}
777 
778 	return true;
779 }
780 
781 /*
782  * free_rsttbl_idx - Free a previously allocated index a Restart Table.
783  */
free_rsttbl_idx(struct RESTART_TABLE * rt,u32 off)784 static inline void free_rsttbl_idx(struct RESTART_TABLE *rt, u32 off)
785 {
786 	__le32 *e;
787 	u32 lf = le32_to_cpu(rt->last_free);
788 	__le32 off_le = cpu_to_le32(off);
789 
790 	e = Add2Ptr(rt, off);
791 
792 	if (off < le32_to_cpu(rt->free_goal)) {
793 		*e = rt->first_free;
794 		rt->first_free = off_le;
795 		if (!lf)
796 			rt->last_free = off_le;
797 	} else {
798 		if (lf)
799 			*(__le32 *)Add2Ptr(rt, lf) = off_le;
800 		else
801 			rt->first_free = off_le;
802 
803 		rt->last_free = off_le;
804 		*e = 0;
805 	}
806 
807 	le16_sub_cpu(&rt->total, 1);
808 }
809 
init_rsttbl(u16 esize,u16 used)810 static inline struct RESTART_TABLE *init_rsttbl(u16 esize, u16 used)
811 {
812 	__le32 *e, *last_free;
813 	u32 off;
814 	u32 bytes = esize * used + sizeof(struct RESTART_TABLE);
815 	u32 lf = sizeof(struct RESTART_TABLE) + (used - 1) * esize;
816 	struct RESTART_TABLE *t = kzalloc(bytes, GFP_NOFS);
817 
818 	if (!t)
819 		return NULL;
820 
821 	t->size = cpu_to_le16(esize);
822 	t->used = cpu_to_le16(used);
823 	t->free_goal = cpu_to_le32(~0u);
824 	t->first_free = cpu_to_le32(sizeof(struct RESTART_TABLE));
825 	t->last_free = cpu_to_le32(lf);
826 
827 	e = (__le32 *)(t + 1);
828 	last_free = Add2Ptr(t, lf);
829 
830 	for (off = sizeof(struct RESTART_TABLE) + esize; e < last_free;
831 	     e = Add2Ptr(e, esize), off += esize) {
832 		*e = cpu_to_le32(off);
833 	}
834 	return t;
835 }
836 
extend_rsttbl(struct RESTART_TABLE * tbl,u32 add,u32 free_goal)837 static inline struct RESTART_TABLE *extend_rsttbl(struct RESTART_TABLE *tbl,
838 						  u32 add, u32 free_goal)
839 {
840 	u16 esize = le16_to_cpu(tbl->size);
841 	__le32 osize = cpu_to_le32(bytes_per_rt(tbl));
842 	u32 used = le16_to_cpu(tbl->used);
843 	struct RESTART_TABLE *rt;
844 
845 	rt = init_rsttbl(esize, used + add);
846 	if (!rt)
847 		return NULL;
848 
849 	memcpy(rt + 1, tbl + 1, esize * used);
850 
851 	rt->free_goal = free_goal == ~0u ?
852 				cpu_to_le32(~0u) :
853 				cpu_to_le32(sizeof(struct RESTART_TABLE) +
854 					    free_goal * esize);
855 
856 	if (tbl->first_free) {
857 		rt->first_free = tbl->first_free;
858 		*(__le32 *)Add2Ptr(rt, le32_to_cpu(tbl->last_free)) = osize;
859 	} else {
860 		rt->first_free = osize;
861 	}
862 
863 	rt->total = tbl->total;
864 
865 	kfree(tbl);
866 	return rt;
867 }
868 
869 /*
870  * alloc_rsttbl_idx
871  *
872  * Allocate an index from within a previously initialized Restart Table.
873  */
alloc_rsttbl_idx(struct RESTART_TABLE ** tbl)874 static inline void *alloc_rsttbl_idx(struct RESTART_TABLE **tbl)
875 {
876 	u32 off;
877 	__le32 *e;
878 	struct RESTART_TABLE *t = *tbl;
879 
880 	if (!t->first_free) {
881 		*tbl = t = extend_rsttbl(t, 16, ~0u);
882 		if (!t)
883 			return NULL;
884 	}
885 
886 	off = le32_to_cpu(t->first_free);
887 
888 	/* Dequeue this entry and zero it. */
889 	e = Add2Ptr(t, off);
890 
891 	t->first_free = *e;
892 
893 	memset(e, 0, le16_to_cpu(t->size));
894 
895 	*e = RESTART_ENTRY_ALLOCATED_LE;
896 
897 	/* If list is going empty, then we fix the last_free as well. */
898 	if (!t->first_free)
899 		t->last_free = 0;
900 
901 	le16_add_cpu(&t->total, 1);
902 
903 	return Add2Ptr(t, off);
904 }
905 
906 /*
907  * alloc_rsttbl_from_idx
908  *
909  * Allocate a specific index from within a previously initialized Restart Table.
910  */
alloc_rsttbl_from_idx(struct RESTART_TABLE ** tbl,u32 vbo)911 static inline void *alloc_rsttbl_from_idx(struct RESTART_TABLE **tbl, u32 vbo)
912 {
913 	u32 off;
914 	__le32 *e;
915 	struct RESTART_TABLE *rt = *tbl;
916 	u32 bytes = bytes_per_rt(rt);
917 	u16 esize = le16_to_cpu(rt->size);
918 
919 	/* If the entry is not the table, we will have to extend the table. */
920 	if (vbo >= bytes) {
921 		/*
922 		 * Extend the size by computing the number of entries between
923 		 * the existing size and the desired index and adding 1 to that.
924 		 */
925 		u32 bytes2idx = vbo - bytes;
926 
927 		/*
928 		 * There should always be an integral number of entries
929 		 * being added. Now extend the table.
930 		 */
931 		*tbl = rt = extend_rsttbl(rt, bytes2idx / esize + 1, bytes);
932 		if (!rt)
933 			return NULL;
934 	}
935 
936 	/* See if the entry is already allocated, and just return if it is. */
937 	e = Add2Ptr(rt, vbo);
938 
939 	if (*e == RESTART_ENTRY_ALLOCATED_LE)
940 		return e;
941 
942 	/*
943 	 * Walk through the table, looking for the entry we're
944 	 * interested and the previous entry.
945 	 */
946 	off = le32_to_cpu(rt->first_free);
947 	e = Add2Ptr(rt, off);
948 
949 	if (off == vbo) {
950 		/* this is a match */
951 		rt->first_free = *e;
952 		goto skip_looking;
953 	}
954 
955 	/*
956 	 * Need to walk through the list looking for the predecessor
957 	 * of our entry.
958 	 */
959 	for (;;) {
960 		/* Remember the entry just found */
961 		u32 last_off = off;
962 		__le32 *last_e = e;
963 
964 		/* Should never run of entries. */
965 
966 		/* Lookup up the next entry the list. */
967 		off = le32_to_cpu(*last_e);
968 		e = Add2Ptr(rt, off);
969 
970 		/* If this is our match we are done. */
971 		if (off == vbo) {
972 			*last_e = *e;
973 
974 			/*
975 			 * If this was the last entry, we update that
976 			 * table as well.
977 			 */
978 			if (le32_to_cpu(rt->last_free) == off)
979 				rt->last_free = cpu_to_le32(last_off);
980 			break;
981 		}
982 	}
983 
984 skip_looking:
985 	/* If the list is now empty, we fix the last_free as well. */
986 	if (!rt->first_free)
987 		rt->last_free = 0;
988 
989 	/* Zero this entry. */
990 	memset(e, 0, esize);
991 	*e = RESTART_ENTRY_ALLOCATED_LE;
992 
993 	le16_add_cpu(&rt->total, 1);
994 
995 	return e;
996 }
997 
998 struct restart_info {
999 	u64 last_lsn;
1000 	struct RESTART_HDR *r_page;
1001 	u32 vbo;
1002 	bool chkdsk_was_run;
1003 	bool valid_page;
1004 	bool initialized;
1005 	bool restart;
1006 };
1007 
1008 #define RESTART_SINGLE_PAGE_IO cpu_to_le16(0x0001)
1009 
1010 #define NTFSLOG_WRAPPED 0x00000001
1011 #define NTFSLOG_MULTIPLE_PAGE_IO 0x00000002
1012 #define NTFSLOG_NO_LAST_LSN 0x00000004
1013 #define NTFSLOG_REUSE_TAIL 0x00000010
1014 #define NTFSLOG_NO_OLDEST_LSN 0x00000020
1015 
1016 /* Helper struct to work with NTFS $LogFile. */
1017 struct ntfs_log {
1018 	struct ntfs_inode *ni;
1019 
1020 	u32 l_size;
1021 	u32 orig_file_size;
1022 	u32 sys_page_size;
1023 	u32 sys_page_mask;
1024 	u32 page_size;
1025 	u32 page_mask; // page_size - 1
1026 	u8 page_bits;
1027 	struct RECORD_PAGE_HDR *one_page_buf;
1028 
1029 	struct RESTART_TABLE *open_attr_tbl;
1030 	u32 transaction_id;
1031 	u32 clst_per_page;
1032 
1033 	u32 first_page;
1034 	u32 next_page;
1035 	u32 ra_off;
1036 	u32 data_off;
1037 	u32 restart_size;
1038 	u32 data_size;
1039 	u16 record_header_len;
1040 	u64 seq_num;
1041 	u32 seq_num_bits;
1042 	u32 file_data_bits;
1043 	u32 seq_num_mask; /* (1 << file_data_bits) - 1 */
1044 
1045 	struct RESTART_AREA *ra; /* In-memory image of the next restart area. */
1046 	u32 ra_size; /* The usable size of the restart area. */
1047 
1048 	/*
1049 	 * If true, then the in-memory restart area is to be written
1050 	 * to the first position on the disk.
1051 	 */
1052 	bool init_ra;
1053 	bool set_dirty; /* True if we need to set dirty flag. */
1054 
1055 	u64 oldest_lsn;
1056 
1057 	u32 oldest_lsn_off;
1058 	u64 last_lsn;
1059 
1060 	u32 total_avail;
1061 	u32 total_avail_pages;
1062 	u32 total_undo_commit;
1063 	u32 max_current_avail;
1064 	u32 current_avail;
1065 	u32 reserved;
1066 
1067 	short major_ver;
1068 	short minor_ver;
1069 
1070 	u32 l_flags; /* See NTFSLOG_XXX */
1071 	u32 current_openlog_count; /* On-disk value for open_log_count. */
1072 
1073 	struct CLIENT_ID client_id;
1074 	u32 client_undo_commit;
1075 
1076 	struct restart_info rst_info, rst_info2;
1077 };
1078 
lsn_to_vbo(struct ntfs_log * log,const u64 lsn)1079 static inline u32 lsn_to_vbo(struct ntfs_log *log, const u64 lsn)
1080 {
1081 	u32 vbo = (lsn << log->seq_num_bits) >> (log->seq_num_bits - 3);
1082 
1083 	return vbo;
1084 }
1085 
1086 /* Compute the offset in the log file of the next log page. */
next_page_off(struct ntfs_log * log,u32 off)1087 static inline u32 next_page_off(struct ntfs_log *log, u32 off)
1088 {
1089 	off = (off & ~log->sys_page_mask) + log->page_size;
1090 	return off >= log->l_size ? log->first_page : off;
1091 }
1092 
lsn_to_page_off(struct ntfs_log * log,u64 lsn)1093 static inline u32 lsn_to_page_off(struct ntfs_log *log, u64 lsn)
1094 {
1095 	return (((u32)lsn) << 3) & log->page_mask;
1096 }
1097 
vbo_to_lsn(struct ntfs_log * log,u32 off,u64 Seq)1098 static inline u64 vbo_to_lsn(struct ntfs_log *log, u32 off, u64 Seq)
1099 {
1100 	return (off >> 3) + (Seq << log->file_data_bits);
1101 }
1102 
is_lsn_in_file(struct ntfs_log * log,u64 lsn)1103 static inline bool is_lsn_in_file(struct ntfs_log *log, u64 lsn)
1104 {
1105 	return lsn >= log->oldest_lsn &&
1106 	       lsn <= le64_to_cpu(log->ra->current_lsn);
1107 }
1108 
hdr_file_off(struct ntfs_log * log,struct RECORD_PAGE_HDR * hdr)1109 static inline u32 hdr_file_off(struct ntfs_log *log,
1110 			       struct RECORD_PAGE_HDR *hdr)
1111 {
1112 	if (log->major_ver < 2)
1113 		return le64_to_cpu(hdr->rhdr.lsn);
1114 
1115 	return le32_to_cpu(hdr->file_off);
1116 }
1117 
base_lsn(struct ntfs_log * log,const struct RECORD_PAGE_HDR * hdr,u64 lsn)1118 static inline u64 base_lsn(struct ntfs_log *log,
1119 			   const struct RECORD_PAGE_HDR *hdr, u64 lsn)
1120 {
1121 	u64 h_lsn = le64_to_cpu(hdr->rhdr.lsn);
1122 	u64 ret = (((h_lsn >> log->file_data_bits) +
1123 		    (lsn < (lsn_to_vbo(log, h_lsn) & ~log->page_mask) ? 1 : 0))
1124 		   << log->file_data_bits) +
1125 		  ((((is_log_record_end(hdr) &&
1126 		      h_lsn <= le64_to_cpu(hdr->record_hdr.last_end_lsn)) ?
1127 			     le16_to_cpu(hdr->record_hdr.next_record_off) :
1128 			     log->page_size) +
1129 		    lsn) >>
1130 		   3);
1131 
1132 	return ret;
1133 }
1134 
verify_client_lsn(struct ntfs_log * log,const struct CLIENT_REC * client,u64 lsn)1135 static inline bool verify_client_lsn(struct ntfs_log *log,
1136 				     const struct CLIENT_REC *client, u64 lsn)
1137 {
1138 	return lsn >= le64_to_cpu(client->oldest_lsn) &&
1139 	       lsn <= le64_to_cpu(log->ra->current_lsn) && lsn;
1140 }
1141 
read_log_page(struct ntfs_log * log,u32 vbo,struct RECORD_PAGE_HDR ** buffer,bool * usa_error)1142 static int read_log_page(struct ntfs_log *log, u32 vbo,
1143 			 struct RECORD_PAGE_HDR **buffer, bool *usa_error)
1144 {
1145 	int err = 0;
1146 	u32 page_idx = vbo >> log->page_bits;
1147 	u32 page_off = vbo & log->page_mask;
1148 	u32 bytes = log->page_size - page_off;
1149 	void *to_free = NULL;
1150 	u32 page_vbo = page_idx << log->page_bits;
1151 	struct RECORD_PAGE_HDR *page_buf;
1152 	struct ntfs_inode *ni = log->ni;
1153 	bool bBAAD;
1154 
1155 	if (vbo >= log->l_size)
1156 		return -EINVAL;
1157 
1158 	if (!*buffer) {
1159 		to_free = kmalloc(log->page_size, GFP_NOFS);
1160 		if (!to_free)
1161 			return -ENOMEM;
1162 		*buffer = to_free;
1163 	}
1164 
1165 	page_buf = page_off ? log->one_page_buf : *buffer;
1166 
1167 	err = ntfs_read_run_nb(ni->mi.sbi, &ni->file.run, page_vbo, page_buf,
1168 			       log->page_size, NULL);
1169 	if (err)
1170 		goto out;
1171 
1172 	if (page_buf->rhdr.sign != NTFS_FFFF_SIGNATURE)
1173 		ntfs_fix_post_read(&page_buf->rhdr, PAGE_SIZE, false);
1174 
1175 	if (page_buf != *buffer)
1176 		memcpy(*buffer, Add2Ptr(page_buf, page_off), bytes);
1177 
1178 	bBAAD = page_buf->rhdr.sign == NTFS_BAAD_SIGNATURE;
1179 
1180 	if (usa_error)
1181 		*usa_error = bBAAD;
1182 	/* Check that the update sequence array for this page is valid */
1183 	/* If we don't allow errors, raise an error status */
1184 	else if (bBAAD)
1185 		err = -EINVAL;
1186 
1187 out:
1188 	if (err && to_free) {
1189 		kfree(to_free);
1190 		*buffer = NULL;
1191 	}
1192 
1193 	return err;
1194 }
1195 
1196 /*
1197  * log_read_rst
1198  *
1199  * It walks through 512 blocks of the file looking for a valid
1200  * restart page header. It will stop the first time we find a
1201  * valid page header.
1202  */
log_read_rst(struct ntfs_log * log,bool first,struct restart_info * info)1203 static int log_read_rst(struct ntfs_log *log, bool first,
1204 			struct restart_info *info)
1205 {
1206 	u32 skip;
1207 	u64 vbo;
1208 	struct RESTART_HDR *r_page = NULL;
1209 
1210 	/* Determine which restart area we are looking for. */
1211 	if (first) {
1212 		vbo = 0;
1213 		skip = 512;
1214 	} else {
1215 		vbo = 512;
1216 		skip = 0;
1217 	}
1218 
1219 	/* Loop continuously until we succeed. */
1220 	for (; vbo < log->l_size; vbo = 2 * vbo + skip, skip = 0) {
1221 		bool usa_error;
1222 		bool brst, bchk;
1223 		struct RESTART_AREA *ra;
1224 
1225 		/* Read a page header at the current offset. */
1226 		if (read_log_page(log, vbo, (struct RECORD_PAGE_HDR **)&r_page,
1227 				  &usa_error)) {
1228 			/* Ignore any errors. */
1229 			continue;
1230 		}
1231 
1232 		/* Exit if the signature is a log record page. */
1233 		if (r_page->rhdr.sign == NTFS_RCRD_SIGNATURE) {
1234 			info->initialized = true;
1235 			break;
1236 		}
1237 
1238 		brst = r_page->rhdr.sign == NTFS_RSTR_SIGNATURE;
1239 		bchk = r_page->rhdr.sign == NTFS_CHKD_SIGNATURE;
1240 
1241 		if (!bchk && !brst) {
1242 			if (r_page->rhdr.sign != NTFS_FFFF_SIGNATURE) {
1243 				/*
1244 				 * Remember if the signature does not
1245 				 * indicate uninitialized file.
1246 				 */
1247 				info->initialized = true;
1248 			}
1249 			continue;
1250 		}
1251 
1252 		ra = NULL;
1253 		info->valid_page = false;
1254 		info->initialized = true;
1255 		info->vbo = vbo;
1256 
1257 		/* Let's check the restart area if this is a valid page. */
1258 		if (!is_rst_page_hdr_valid(vbo, r_page))
1259 			goto check_result;
1260 		ra = Add2Ptr(r_page, le16_to_cpu(r_page->ra_off));
1261 
1262 		if (!is_rst_area_valid(r_page))
1263 			goto check_result;
1264 
1265 		/*
1266 		 * We have a valid restart page header and restart area.
1267 		 * If chkdsk was run or we have no clients then we have
1268 		 * no more checking to do.
1269 		 */
1270 		if (bchk || ra->client_idx[1] == LFS_NO_CLIENT_LE) {
1271 			info->valid_page = true;
1272 			goto check_result;
1273 		}
1274 
1275 		if (is_client_area_valid(r_page, usa_error)) {
1276 			info->valid_page = true;
1277 			ra = Add2Ptr(r_page, le16_to_cpu(r_page->ra_off));
1278 		}
1279 
1280 check_result:
1281 		/*
1282 		 * If chkdsk was run then update the caller's
1283 		 * values and return.
1284 		 */
1285 		if (r_page->rhdr.sign == NTFS_CHKD_SIGNATURE) {
1286 			info->chkdsk_was_run = true;
1287 			info->last_lsn = le64_to_cpu(r_page->rhdr.lsn);
1288 			info->restart = true;
1289 			info->r_page = r_page;
1290 			return 0;
1291 		}
1292 
1293 		/*
1294 		 * If we have a valid page then copy the values
1295 		 * we need from it.
1296 		 */
1297 		if (info->valid_page) {
1298 			info->last_lsn = le64_to_cpu(ra->current_lsn);
1299 			info->restart = true;
1300 			info->r_page = r_page;
1301 			return 0;
1302 		}
1303 	}
1304 
1305 	kfree(r_page);
1306 
1307 	return 0;
1308 }
1309 
1310 /*
1311  * Ilog_init_pg_hdr - Init @log from restart page header.
1312  */
log_init_pg_hdr(struct ntfs_log * log,u16 major_ver,u16 minor_ver)1313 static void log_init_pg_hdr(struct ntfs_log *log, u16 major_ver, u16 minor_ver)
1314 {
1315 	log->sys_page_size = log->page_size;
1316 	log->sys_page_mask = log->page_mask;
1317 
1318 	log->clst_per_page = log->page_size >> log->ni->mi.sbi->cluster_bits;
1319 	if (!log->clst_per_page)
1320 		log->clst_per_page = 1;
1321 
1322 	log->first_page = major_ver >= 2 ? 0x22 * log->page_size :
1323 					   4 * log->page_size;
1324 	log->major_ver = major_ver;
1325 	log->minor_ver = minor_ver;
1326 }
1327 
1328 /*
1329  * log_create - Init @log in cases when we don't have a restart area to use.
1330  */
log_create(struct ntfs_log * log,const u64 last_lsn,u32 open_log_count,bool wrapped,bool use_multi_page)1331 static void log_create(struct ntfs_log *log, const u64 last_lsn,
1332 		       u32 open_log_count, bool wrapped, bool use_multi_page)
1333 {
1334 	/* All file offsets must be quadword aligned. */
1335 	log->file_data_bits = blksize_bits(log->l_size) - 3;
1336 	log->seq_num_mask = (8 << log->file_data_bits) - 1;
1337 	log->seq_num_bits = sizeof(u64) * 8 - log->file_data_bits;
1338 	log->seq_num = (last_lsn >> log->file_data_bits) + 2;
1339 	log->next_page = log->first_page;
1340 	log->oldest_lsn = log->seq_num << log->file_data_bits;
1341 	log->oldest_lsn_off = 0;
1342 	log->last_lsn = log->oldest_lsn;
1343 
1344 	log->l_flags |= NTFSLOG_NO_LAST_LSN | NTFSLOG_NO_OLDEST_LSN;
1345 
1346 	/* Set the correct flags for the I/O and indicate if we have wrapped. */
1347 	if (wrapped)
1348 		log->l_flags |= NTFSLOG_WRAPPED;
1349 
1350 	if (use_multi_page)
1351 		log->l_flags |= NTFSLOG_MULTIPLE_PAGE_IO;
1352 
1353 	/* Compute the log page values. */
1354 	log->data_off = ALIGN(
1355 		offsetof(struct RECORD_PAGE_HDR, fixups) +
1356 			sizeof(short) * ((log->page_size >> SECTOR_SHIFT) + 1),
1357 		8);
1358 	log->data_size = log->page_size - log->data_off;
1359 	log->record_header_len = sizeof(struct LFS_RECORD_HDR);
1360 
1361 	/* Remember the different page sizes for reservation. */
1362 	log->reserved = log->data_size - log->record_header_len;
1363 
1364 	/* Compute the restart page values. */
1365 	log->ra_off = ALIGN(
1366 		offsetof(struct RESTART_HDR, fixups) +
1367 			sizeof(short) *
1368 				((log->sys_page_size >> SECTOR_SHIFT) + 1),
1369 		8);
1370 	log->restart_size = log->sys_page_size - log->ra_off;
1371 	log->ra_size = struct_size(log->ra, clients, 1);
1372 	log->current_openlog_count = open_log_count;
1373 
1374 	/*
1375 	 * The total available log file space is the number of
1376 	 * log file pages times the space available on each page.
1377 	 */
1378 	log->total_avail_pages = log->l_size - log->first_page;
1379 	log->total_avail = log->total_avail_pages >> log->page_bits;
1380 
1381 	/*
1382 	 * We assume that we can't use the end of the page less than
1383 	 * the file record size.
1384 	 * Then we won't need to reserve more than the caller asks for.
1385 	 */
1386 	log->max_current_avail = log->total_avail * log->reserved;
1387 	log->total_avail = log->total_avail * log->data_size;
1388 	log->current_avail = log->max_current_avail;
1389 }
1390 
1391 /*
1392  * log_create_ra - Fill a restart area from the values stored in @log.
1393  */
log_create_ra(struct ntfs_log * log)1394 static struct RESTART_AREA *log_create_ra(struct ntfs_log *log)
1395 {
1396 	struct CLIENT_REC *cr;
1397 	struct RESTART_AREA *ra = kzalloc(log->restart_size, GFP_NOFS);
1398 
1399 	if (!ra)
1400 		return NULL;
1401 
1402 	ra->current_lsn = cpu_to_le64(log->last_lsn);
1403 	ra->log_clients = cpu_to_le16(1);
1404 	ra->client_idx[1] = LFS_NO_CLIENT_LE;
1405 	if (log->l_flags & NTFSLOG_MULTIPLE_PAGE_IO)
1406 		ra->flags = RESTART_SINGLE_PAGE_IO;
1407 	ra->seq_num_bits = cpu_to_le32(log->seq_num_bits);
1408 	ra->ra_len = cpu_to_le16(log->ra_size);
1409 	ra->client_off = cpu_to_le16(offsetof(struct RESTART_AREA, clients));
1410 	ra->l_size = cpu_to_le64(log->l_size);
1411 	ra->rec_hdr_len = cpu_to_le16(log->record_header_len);
1412 	ra->data_off = cpu_to_le16(log->data_off);
1413 	ra->open_log_count = cpu_to_le32(log->current_openlog_count + 1);
1414 
1415 	cr = ra->clients;
1416 
1417 	cr->prev_client = LFS_NO_CLIENT_LE;
1418 	cr->next_client = LFS_NO_CLIENT_LE;
1419 
1420 	return ra;
1421 }
1422 
final_log_off(struct ntfs_log * log,u64 lsn,u32 data_len)1423 static u32 final_log_off(struct ntfs_log *log, u64 lsn, u32 data_len)
1424 {
1425 	u32 base_vbo = lsn << 3;
1426 	u32 final_log_off = (base_vbo & log->seq_num_mask) & ~log->page_mask;
1427 	u32 page_off = base_vbo & log->page_mask;
1428 	u32 tail = log->page_size - page_off;
1429 
1430 	page_off -= 1;
1431 
1432 	/* Add the length of the header. */
1433 	data_len += log->record_header_len;
1434 
1435 	/*
1436 	 * If this lsn is contained this log page we are done.
1437 	 * Otherwise we need to walk through several log pages.
1438 	 */
1439 	if (data_len > tail) {
1440 		data_len -= tail;
1441 		tail = log->data_size;
1442 		page_off = log->data_off - 1;
1443 
1444 		for (;;) {
1445 			final_log_off = next_page_off(log, final_log_off);
1446 
1447 			/*
1448 			 * We are done if the remaining bytes
1449 			 * fit on this page.
1450 			 */
1451 			if (data_len <= tail)
1452 				break;
1453 			data_len -= tail;
1454 		}
1455 	}
1456 
1457 	/*
1458 	 * We add the remaining bytes to our starting position on this page
1459 	 * and then add that value to the file offset of this log page.
1460 	 */
1461 	return final_log_off + data_len + page_off;
1462 }
1463 
next_log_lsn(struct ntfs_log * log,const struct LFS_RECORD_HDR * rh,u64 * lsn)1464 static int next_log_lsn(struct ntfs_log *log, const struct LFS_RECORD_HDR *rh,
1465 			u64 *lsn)
1466 {
1467 	int err;
1468 	u64 this_lsn = le64_to_cpu(rh->this_lsn);
1469 	u32 vbo = lsn_to_vbo(log, this_lsn);
1470 	u32 end =
1471 		final_log_off(log, this_lsn, le32_to_cpu(rh->client_data_len));
1472 	u32 hdr_off = end & ~log->sys_page_mask;
1473 	u64 seq = this_lsn >> log->file_data_bits;
1474 	struct RECORD_PAGE_HDR *page = NULL;
1475 
1476 	/* Remember if we wrapped. */
1477 	if (end <= vbo)
1478 		seq += 1;
1479 
1480 	/* Log page header for this page. */
1481 	err = read_log_page(log, hdr_off, &page, NULL);
1482 	if (err)
1483 		return err;
1484 
1485 	/*
1486 	 * If the lsn we were given was not the last lsn on this page,
1487 	 * then the starting offset for the next lsn is on a quad word
1488 	 * boundary following the last file offset for the current lsn.
1489 	 * Otherwise the file offset is the start of the data on the next page.
1490 	 */
1491 	if (this_lsn == le64_to_cpu(page->rhdr.lsn)) {
1492 		/* If we wrapped, we need to increment the sequence number. */
1493 		hdr_off = next_page_off(log, hdr_off);
1494 		if (hdr_off == log->first_page)
1495 			seq += 1;
1496 
1497 		vbo = hdr_off + log->data_off;
1498 	} else {
1499 		vbo = ALIGN(end, 8);
1500 	}
1501 
1502 	/* Compute the lsn based on the file offset and the sequence count. */
1503 	*lsn = vbo_to_lsn(log, vbo, seq);
1504 
1505 	/*
1506 	 * If this lsn is within the legal range for the file, we return true.
1507 	 * Otherwise false indicates that there are no more lsn's.
1508 	 */
1509 	if (!is_lsn_in_file(log, *lsn))
1510 		*lsn = 0;
1511 
1512 	kfree(page);
1513 
1514 	return 0;
1515 }
1516 
1517 /*
1518  * current_log_avail - Calculate the number of bytes available for log records.
1519  */
current_log_avail(struct ntfs_log * log)1520 static u32 current_log_avail(struct ntfs_log *log)
1521 {
1522 	u32 oldest_off, next_free_off, free_bytes;
1523 
1524 	if (log->l_flags & NTFSLOG_NO_LAST_LSN) {
1525 		/* The entire file is available. */
1526 		return log->max_current_avail;
1527 	}
1528 
1529 	/*
1530 	 * If there is a last lsn the restart area then we know that we will
1531 	 * have to compute the free range.
1532 	 * If there is no oldest lsn then start at the first page of the file.
1533 	 */
1534 	oldest_off = (log->l_flags & NTFSLOG_NO_OLDEST_LSN) ?
1535 			     log->first_page :
1536 			     (log->oldest_lsn_off & ~log->sys_page_mask);
1537 
1538 	/*
1539 	 * We will use the next log page offset to compute the next free page.
1540 	 * If we are going to reuse this page go to the next page.
1541 	 * If we are at the first page then use the end of the file.
1542 	 */
1543 	next_free_off = (log->l_flags & NTFSLOG_REUSE_TAIL) ?
1544 				log->next_page + log->page_size :
1545 			log->next_page == log->first_page ? log->l_size :
1546 							    log->next_page;
1547 
1548 	/* If the two offsets are the same then there is no available space. */
1549 	if (oldest_off == next_free_off)
1550 		return 0;
1551 	/*
1552 	 * If the free offset follows the oldest offset then subtract
1553 	 * this range from the total available pages.
1554 	 */
1555 	free_bytes =
1556 		oldest_off < next_free_off ?
1557 			log->total_avail_pages - (next_free_off - oldest_off) :
1558 			oldest_off - next_free_off;
1559 
1560 	free_bytes >>= log->page_bits;
1561 	return free_bytes * log->reserved;
1562 }
1563 
check_subseq_log_page(struct ntfs_log * log,const struct RECORD_PAGE_HDR * rp,u32 vbo,u64 seq)1564 static bool check_subseq_log_page(struct ntfs_log *log,
1565 				  const struct RECORD_PAGE_HDR *rp, u32 vbo,
1566 				  u64 seq)
1567 {
1568 	u64 lsn_seq;
1569 	const struct NTFS_RECORD_HEADER *rhdr = &rp->rhdr;
1570 	u64 lsn = le64_to_cpu(rhdr->lsn);
1571 
1572 	if (rhdr->sign == NTFS_FFFF_SIGNATURE || !rhdr->sign)
1573 		return false;
1574 
1575 	/*
1576 	 * If the last lsn on the page occurs was written after the page
1577 	 * that caused the original error then we have a fatal error.
1578 	 */
1579 	lsn_seq = lsn >> log->file_data_bits;
1580 
1581 	/*
1582 	 * If the sequence number for the lsn the page is equal or greater
1583 	 * than lsn we expect, then this is a subsequent write.
1584 	 */
1585 	return lsn_seq >= seq ||
1586 	       (lsn_seq == seq - 1 && log->first_page == vbo &&
1587 		vbo != (lsn_to_vbo(log, lsn) & ~log->page_mask));
1588 }
1589 
1590 /*
1591  * last_log_lsn
1592  *
1593  * Walks through the log pages for a file, searching for the
1594  * last log page written to the file.
1595  */
last_log_lsn(struct ntfs_log * log)1596 static int last_log_lsn(struct ntfs_log *log)
1597 {
1598 	int err;
1599 	bool usa_error = false;
1600 	bool replace_page = false;
1601 	bool reuse_page = log->l_flags & NTFSLOG_REUSE_TAIL;
1602 	bool wrapped_file, wrapped;
1603 
1604 	u32 page_cnt = 1, page_pos = 1;
1605 	u32 page_off = 0, page_off1 = 0, saved_off = 0;
1606 	u32 final_off, second_off, final_off_prev = 0, second_off_prev = 0;
1607 	u32 first_file_off = 0, second_file_off = 0;
1608 	u32 part_io_count = 0;
1609 	u32 tails = 0;
1610 	u32 this_off, curpage_off, nextpage_off, remain_pages;
1611 
1612 	u64 expected_seq, seq_base = 0, lsn_base = 0;
1613 	u64 best_lsn, best_lsn1, best_lsn2;
1614 	u64 lsn_cur, lsn1, lsn2;
1615 	u64 last_ok_lsn = reuse_page ? log->last_lsn : 0;
1616 
1617 	u16 cur_pos, best_page_pos;
1618 
1619 	struct RECORD_PAGE_HDR *page = NULL;
1620 	struct RECORD_PAGE_HDR *tst_page = NULL;
1621 	struct RECORD_PAGE_HDR *first_tail = NULL;
1622 	struct RECORD_PAGE_HDR *second_tail = NULL;
1623 	struct RECORD_PAGE_HDR *tail_page = NULL;
1624 	struct RECORD_PAGE_HDR *second_tail_prev = NULL;
1625 	struct RECORD_PAGE_HDR *first_tail_prev = NULL;
1626 	struct RECORD_PAGE_HDR *page_bufs = NULL;
1627 	struct RECORD_PAGE_HDR *best_page;
1628 
1629 	if (log->major_ver >= 2) {
1630 		final_off = 0x02 * log->page_size;
1631 		second_off = 0x12 * log->page_size;
1632 
1633 		// 0x10 == 0x12 - 0x2
1634 		page_bufs = kmalloc(log->page_size * 0x10, GFP_NOFS);
1635 		if (!page_bufs)
1636 			return -ENOMEM;
1637 	} else {
1638 		second_off = log->first_page - log->page_size;
1639 		final_off = second_off - log->page_size;
1640 	}
1641 
1642 next_tail:
1643 	/* Read second tail page (at pos 3/0x12000). */
1644 	if (read_log_page(log, second_off, &second_tail, &usa_error) ||
1645 	    usa_error || second_tail->rhdr.sign != NTFS_RCRD_SIGNATURE) {
1646 		kfree(second_tail);
1647 		second_tail = NULL;
1648 		second_file_off = 0;
1649 		lsn2 = 0;
1650 	} else {
1651 		second_file_off = hdr_file_off(log, second_tail);
1652 		lsn2 = le64_to_cpu(second_tail->record_hdr.last_end_lsn);
1653 	}
1654 
1655 	/* Read first tail page (at pos 2/0x2000). */
1656 	if (read_log_page(log, final_off, &first_tail, &usa_error) ||
1657 	    usa_error || first_tail->rhdr.sign != NTFS_RCRD_SIGNATURE) {
1658 		kfree(first_tail);
1659 		first_tail = NULL;
1660 		first_file_off = 0;
1661 		lsn1 = 0;
1662 	} else {
1663 		first_file_off = hdr_file_off(log, first_tail);
1664 		lsn1 = le64_to_cpu(first_tail->record_hdr.last_end_lsn);
1665 	}
1666 
1667 	if (log->major_ver < 2) {
1668 		int best_page;
1669 
1670 		first_tail_prev = first_tail;
1671 		final_off_prev = first_file_off;
1672 		second_tail_prev = second_tail;
1673 		second_off_prev = second_file_off;
1674 		tails = 1;
1675 
1676 		if (!first_tail && !second_tail)
1677 			goto tail_read;
1678 
1679 		if (first_tail && second_tail)
1680 			best_page = lsn1 < lsn2 ? 1 : 0;
1681 		else if (first_tail)
1682 			best_page = 0;
1683 		else
1684 			best_page = 1;
1685 
1686 		page_off = best_page ? second_file_off : first_file_off;
1687 		seq_base = (best_page ? lsn2 : lsn1) >> log->file_data_bits;
1688 		goto tail_read;
1689 	}
1690 
1691 	best_lsn1 = first_tail ? base_lsn(log, first_tail, first_file_off) : 0;
1692 	best_lsn2 = second_tail ? base_lsn(log, second_tail, second_file_off) :
1693 				  0;
1694 
1695 	if (first_tail && second_tail) {
1696 		if (best_lsn1 > best_lsn2) {
1697 			best_lsn = best_lsn1;
1698 			best_page = first_tail;
1699 			this_off = first_file_off;
1700 		} else {
1701 			best_lsn = best_lsn2;
1702 			best_page = second_tail;
1703 			this_off = second_file_off;
1704 		}
1705 	} else if (first_tail) {
1706 		best_lsn = best_lsn1;
1707 		best_page = first_tail;
1708 		this_off = first_file_off;
1709 	} else if (second_tail) {
1710 		best_lsn = best_lsn2;
1711 		best_page = second_tail;
1712 		this_off = second_file_off;
1713 	} else {
1714 		goto tail_read;
1715 	}
1716 
1717 	best_page_pos = le16_to_cpu(best_page->page_pos);
1718 
1719 	if (!tails) {
1720 		if (best_page_pos == page_pos) {
1721 			seq_base = best_lsn >> log->file_data_bits;
1722 			saved_off = page_off = le32_to_cpu(best_page->file_off);
1723 			lsn_base = best_lsn;
1724 
1725 			memmove(page_bufs, best_page, log->page_size);
1726 
1727 			page_cnt = le16_to_cpu(best_page->page_count);
1728 			if (page_cnt > 1)
1729 				page_pos += 1;
1730 
1731 			tails = 1;
1732 		}
1733 	} else if (seq_base == (best_lsn >> log->file_data_bits) &&
1734 		   saved_off + log->page_size == this_off &&
1735 		   lsn_base < best_lsn &&
1736 		   (page_pos != page_cnt || best_page_pos == page_pos ||
1737 		    best_page_pos == 1) &&
1738 		   (page_pos >= page_cnt || best_page_pos == page_pos)) {
1739 		u16 bppc = le16_to_cpu(best_page->page_count);
1740 
1741 		saved_off += log->page_size;
1742 		lsn_base = best_lsn;
1743 
1744 		memmove(Add2Ptr(page_bufs, tails * log->page_size), best_page,
1745 			log->page_size);
1746 
1747 		tails += 1;
1748 
1749 		if (best_page_pos != bppc) {
1750 			page_cnt = bppc;
1751 			page_pos = best_page_pos;
1752 
1753 			if (page_cnt > 1)
1754 				page_pos += 1;
1755 		} else {
1756 			page_pos = page_cnt = 1;
1757 		}
1758 	} else {
1759 		kfree(first_tail);
1760 		kfree(second_tail);
1761 		goto tail_read;
1762 	}
1763 
1764 	kfree(first_tail_prev);
1765 	first_tail_prev = first_tail;
1766 	final_off_prev = first_file_off;
1767 	first_tail = NULL;
1768 
1769 	kfree(second_tail_prev);
1770 	second_tail_prev = second_tail;
1771 	second_off_prev = second_file_off;
1772 	second_tail = NULL;
1773 
1774 	final_off += log->page_size;
1775 	second_off += log->page_size;
1776 
1777 	if (tails < 0x10)
1778 		goto next_tail;
1779 tail_read:
1780 	first_tail = first_tail_prev;
1781 	final_off = final_off_prev;
1782 
1783 	second_tail = second_tail_prev;
1784 	second_off = second_off_prev;
1785 
1786 	page_cnt = page_pos = 1;
1787 
1788 	curpage_off = seq_base == log->seq_num ? min(log->next_page, page_off) :
1789 						 log->next_page;
1790 
1791 	wrapped_file =
1792 		curpage_off == log->first_page &&
1793 		!(log->l_flags & (NTFSLOG_NO_LAST_LSN | NTFSLOG_REUSE_TAIL));
1794 
1795 	expected_seq = wrapped_file ? (log->seq_num + 1) : log->seq_num;
1796 
1797 	nextpage_off = curpage_off;
1798 
1799 next_page:
1800 	tail_page = NULL;
1801 	/* Read the next log page. */
1802 	err = read_log_page(log, curpage_off, &page, &usa_error);
1803 
1804 	/* Compute the next log page offset the file. */
1805 	nextpage_off = next_page_off(log, curpage_off);
1806 	wrapped = nextpage_off == log->first_page;
1807 
1808 	if (tails > 1) {
1809 		struct RECORD_PAGE_HDR *cur_page =
1810 			Add2Ptr(page_bufs, curpage_off - page_off);
1811 
1812 		if (curpage_off == saved_off) {
1813 			tail_page = cur_page;
1814 			goto use_tail_page;
1815 		}
1816 
1817 		if (page_off > curpage_off || curpage_off >= saved_off)
1818 			goto use_tail_page;
1819 
1820 		if (page_off1)
1821 			goto use_cur_page;
1822 
1823 		if (!err && !usa_error &&
1824 		    page->rhdr.sign == NTFS_RCRD_SIGNATURE &&
1825 		    cur_page->rhdr.lsn == page->rhdr.lsn &&
1826 		    cur_page->record_hdr.next_record_off ==
1827 			    page->record_hdr.next_record_off &&
1828 		    ((page_pos == page_cnt &&
1829 		      le16_to_cpu(page->page_pos) == 1) ||
1830 		     (page_pos != page_cnt &&
1831 		      le16_to_cpu(page->page_pos) == page_pos + 1 &&
1832 		      le16_to_cpu(page->page_count) == page_cnt))) {
1833 			cur_page = NULL;
1834 			goto use_tail_page;
1835 		}
1836 
1837 		page_off1 = page_off;
1838 
1839 use_cur_page:
1840 
1841 		lsn_cur = le64_to_cpu(cur_page->rhdr.lsn);
1842 
1843 		if (last_ok_lsn !=
1844 			    le64_to_cpu(cur_page->record_hdr.last_end_lsn) &&
1845 		    ((lsn_cur >> log->file_data_bits) +
1846 		     ((curpage_off <
1847 		       (lsn_to_vbo(log, lsn_cur) & ~log->page_mask)) ?
1848 			      1 :
1849 			      0)) != expected_seq) {
1850 			goto check_tail;
1851 		}
1852 
1853 		if (!is_log_record_end(cur_page)) {
1854 			tail_page = NULL;
1855 			last_ok_lsn = lsn_cur;
1856 			goto next_page_1;
1857 		}
1858 
1859 		log->seq_num = expected_seq;
1860 		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
1861 		log->last_lsn = le64_to_cpu(cur_page->record_hdr.last_end_lsn);
1862 		log->ra->current_lsn = cur_page->record_hdr.last_end_lsn;
1863 
1864 		if (log->record_header_len <=
1865 		    log->page_size -
1866 			    le16_to_cpu(cur_page->record_hdr.next_record_off)) {
1867 			log->l_flags |= NTFSLOG_REUSE_TAIL;
1868 			log->next_page = curpage_off;
1869 		} else {
1870 			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
1871 			log->next_page = nextpage_off;
1872 		}
1873 
1874 		if (wrapped_file)
1875 			log->l_flags |= NTFSLOG_WRAPPED;
1876 
1877 		last_ok_lsn = le64_to_cpu(cur_page->record_hdr.last_end_lsn);
1878 		goto next_page_1;
1879 	}
1880 
1881 	/*
1882 	 * If we are at the expected first page of a transfer check to see
1883 	 * if either tail copy is at this offset.
1884 	 * If this page is the last page of a transfer, check if we wrote
1885 	 * a subsequent tail copy.
1886 	 */
1887 	if (page_cnt == page_pos || page_cnt == page_pos + 1) {
1888 		/*
1889 		 * Check if the offset matches either the first or second
1890 		 * tail copy. It is possible it will match both.
1891 		 */
1892 		if (curpage_off == final_off)
1893 			tail_page = first_tail;
1894 
1895 		/*
1896 		 * If we already matched on the first page then
1897 		 * check the ending lsn's.
1898 		 */
1899 		if (curpage_off == second_off) {
1900 			if (!tail_page ||
1901 			    (second_tail &&
1902 			     le64_to_cpu(second_tail->record_hdr.last_end_lsn) >
1903 				     le64_to_cpu(first_tail->record_hdr
1904 							 .last_end_lsn))) {
1905 				tail_page = second_tail;
1906 			}
1907 		}
1908 	}
1909 
1910 use_tail_page:
1911 	if (tail_page) {
1912 		/* We have a candidate for a tail copy. */
1913 		lsn_cur = le64_to_cpu(tail_page->record_hdr.last_end_lsn);
1914 
1915 		if (last_ok_lsn < lsn_cur) {
1916 			/*
1917 			 * If the sequence number is not expected,
1918 			 * then don't use the tail copy.
1919 			 */
1920 			if (expected_seq != (lsn_cur >> log->file_data_bits))
1921 				tail_page = NULL;
1922 		} else if (last_ok_lsn > lsn_cur) {
1923 			/*
1924 			 * If the last lsn is greater than the one on
1925 			 * this page then forget this tail.
1926 			 */
1927 			tail_page = NULL;
1928 		}
1929 	}
1930 
1931 	/*
1932 	 *If we have an error on the current page,
1933 	 * we will break of this loop.
1934 	 */
1935 	if (err || usa_error)
1936 		goto check_tail;
1937 
1938 	/*
1939 	 * Done if the last lsn on this page doesn't match the previous known
1940 	 * last lsn or the sequence number is not expected.
1941 	 */
1942 	lsn_cur = le64_to_cpu(page->rhdr.lsn);
1943 	if (last_ok_lsn != lsn_cur &&
1944 	    expected_seq != (lsn_cur >> log->file_data_bits)) {
1945 		goto check_tail;
1946 	}
1947 
1948 	/*
1949 	 * Check that the page position and page count values are correct.
1950 	 * If this is the first page of a transfer the position must be 1
1951 	 * and the count will be unknown.
1952 	 */
1953 	if (page_cnt == page_pos) {
1954 		if (page->page_pos != cpu_to_le16(1) &&
1955 		    (!reuse_page || page->page_pos != page->page_count)) {
1956 			/*
1957 			 * If the current page is the first page we are
1958 			 * looking at and we are reusing this page then
1959 			 * it can be either the first or last page of a
1960 			 * transfer. Otherwise it can only be the first.
1961 			 */
1962 			goto check_tail;
1963 		}
1964 	} else if (le16_to_cpu(page->page_count) != page_cnt ||
1965 		   le16_to_cpu(page->page_pos) != page_pos + 1) {
1966 		/*
1967 		 * The page position better be 1 more than the last page
1968 		 * position and the page count better match.
1969 		 */
1970 		goto check_tail;
1971 	}
1972 
1973 	/*
1974 	 * We have a valid page the file and may have a valid page
1975 	 * the tail copy area.
1976 	 * If the tail page was written after the page the file then
1977 	 * break of the loop.
1978 	 */
1979 	if (tail_page &&
1980 	    le64_to_cpu(tail_page->record_hdr.last_end_lsn) > lsn_cur) {
1981 		/* Remember if we will replace the page. */
1982 		replace_page = true;
1983 		goto check_tail;
1984 	}
1985 
1986 	tail_page = NULL;
1987 
1988 	if (is_log_record_end(page)) {
1989 		/*
1990 		 * Since we have read this page we know the sequence number
1991 		 * is the same as our expected value.
1992 		 */
1993 		log->seq_num = expected_seq;
1994 		log->last_lsn = le64_to_cpu(page->record_hdr.last_end_lsn);
1995 		log->ra->current_lsn = page->record_hdr.last_end_lsn;
1996 		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
1997 
1998 		/*
1999 		 * If there is room on this page for another header then
2000 		 * remember we want to reuse the page.
2001 		 */
2002 		if (log->record_header_len <=
2003 		    log->page_size -
2004 			    le16_to_cpu(page->record_hdr.next_record_off)) {
2005 			log->l_flags |= NTFSLOG_REUSE_TAIL;
2006 			log->next_page = curpage_off;
2007 		} else {
2008 			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
2009 			log->next_page = nextpage_off;
2010 		}
2011 
2012 		/* Remember if we wrapped the log file. */
2013 		if (wrapped_file)
2014 			log->l_flags |= NTFSLOG_WRAPPED;
2015 	}
2016 
2017 	/*
2018 	 * Remember the last page count and position.
2019 	 * Also remember the last known lsn.
2020 	 */
2021 	page_cnt = le16_to_cpu(page->page_count);
2022 	page_pos = le16_to_cpu(page->page_pos);
2023 	last_ok_lsn = le64_to_cpu(page->rhdr.lsn);
2024 
2025 next_page_1:
2026 
2027 	if (wrapped) {
2028 		expected_seq += 1;
2029 		wrapped_file = 1;
2030 	}
2031 
2032 	curpage_off = nextpage_off;
2033 	kfree(page);
2034 	page = NULL;
2035 	reuse_page = 0;
2036 	goto next_page;
2037 
2038 check_tail:
2039 	if (tail_page) {
2040 		log->seq_num = expected_seq;
2041 		log->last_lsn = le64_to_cpu(tail_page->record_hdr.last_end_lsn);
2042 		log->ra->current_lsn = tail_page->record_hdr.last_end_lsn;
2043 		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
2044 
2045 		if (log->page_size -
2046 			    le16_to_cpu(
2047 				    tail_page->record_hdr.next_record_off) >=
2048 		    log->record_header_len) {
2049 			log->l_flags |= NTFSLOG_REUSE_TAIL;
2050 			log->next_page = curpage_off;
2051 		} else {
2052 			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
2053 			log->next_page = nextpage_off;
2054 		}
2055 
2056 		if (wrapped)
2057 			log->l_flags |= NTFSLOG_WRAPPED;
2058 	}
2059 
2060 	/* Remember that the partial IO will start at the next page. */
2061 	second_off = nextpage_off;
2062 
2063 	/*
2064 	 * If the next page is the first page of the file then update
2065 	 * the sequence number for log records which begon the next page.
2066 	 */
2067 	if (wrapped)
2068 		expected_seq += 1;
2069 
2070 	/*
2071 	 * If we have a tail copy or are performing single page I/O we can
2072 	 * immediately look at the next page.
2073 	 */
2074 	if (replace_page || (log->ra->flags & RESTART_SINGLE_PAGE_IO)) {
2075 		page_cnt = 2;
2076 		page_pos = 1;
2077 		goto check_valid;
2078 	}
2079 
2080 	if (page_pos != page_cnt)
2081 		goto check_valid;
2082 	/*
2083 	 * If the next page causes us to wrap to the beginning of the log
2084 	 * file then we know which page to check next.
2085 	 */
2086 	if (wrapped) {
2087 		page_cnt = 2;
2088 		page_pos = 1;
2089 		goto check_valid;
2090 	}
2091 
2092 	cur_pos = 2;
2093 
2094 next_test_page:
2095 	kfree(tst_page);
2096 	tst_page = NULL;
2097 
2098 	/* Walk through the file, reading log pages. */
2099 	err = read_log_page(log, nextpage_off, &tst_page, &usa_error);
2100 
2101 	/*
2102 	 * If we get a USA error then assume that we correctly found
2103 	 * the end of the original transfer.
2104 	 */
2105 	if (usa_error)
2106 		goto file_is_valid;
2107 
2108 	/*
2109 	 * If we were able to read the page, we examine it to see if it
2110 	 * is the same or different Io block.
2111 	 */
2112 	if (err)
2113 		goto next_test_page_1;
2114 
2115 	if (le16_to_cpu(tst_page->page_pos) == cur_pos &&
2116 	    check_subseq_log_page(log, tst_page, nextpage_off, expected_seq)) {
2117 		page_cnt = le16_to_cpu(tst_page->page_count) + 1;
2118 		page_pos = le16_to_cpu(tst_page->page_pos);
2119 		goto check_valid;
2120 	} else {
2121 		goto file_is_valid;
2122 	}
2123 
2124 next_test_page_1:
2125 
2126 	nextpage_off = next_page_off(log, curpage_off);
2127 	wrapped = nextpage_off == log->first_page;
2128 
2129 	if (wrapped) {
2130 		expected_seq += 1;
2131 		page_cnt = 2;
2132 		page_pos = 1;
2133 	}
2134 
2135 	cur_pos += 1;
2136 	part_io_count += 1;
2137 	if (!wrapped)
2138 		goto next_test_page;
2139 
2140 check_valid:
2141 	/* Skip over the remaining pages this transfer. */
2142 	remain_pages = page_cnt - page_pos - 1;
2143 	part_io_count += remain_pages;
2144 
2145 	while (remain_pages--) {
2146 		nextpage_off = next_page_off(log, curpage_off);
2147 		wrapped = nextpage_off == log->first_page;
2148 
2149 		if (wrapped)
2150 			expected_seq += 1;
2151 	}
2152 
2153 	/* Call our routine to check this log page. */
2154 	kfree(tst_page);
2155 	tst_page = NULL;
2156 
2157 	err = read_log_page(log, nextpage_off, &tst_page, &usa_error);
2158 	if (!err && !usa_error &&
2159 	    check_subseq_log_page(log, tst_page, nextpage_off, expected_seq)) {
2160 		err = -EINVAL;
2161 		goto out;
2162 	}
2163 
2164 file_is_valid:
2165 
2166 	/* We have a valid file. */
2167 	if (page_off1 || tail_page) {
2168 		struct RECORD_PAGE_HDR *tmp_page;
2169 
2170 		if (sb_rdonly(log->ni->mi.sbi->sb)) {
2171 			err = -EROFS;
2172 			goto out;
2173 		}
2174 
2175 		if (page_off1) {
2176 			tmp_page = Add2Ptr(page_bufs, page_off1 - page_off);
2177 			tails -= (page_off1 - page_off) / log->page_size;
2178 			if (!tail_page)
2179 				tails -= 1;
2180 		} else {
2181 			tmp_page = tail_page;
2182 			tails = 1;
2183 		}
2184 
2185 		while (tails--) {
2186 			u64 off = hdr_file_off(log, tmp_page);
2187 
2188 			if (!page) {
2189 				page = kmalloc(log->page_size, GFP_NOFS);
2190 				if (!page) {
2191 					err = -ENOMEM;
2192 					goto out;
2193 				}
2194 			}
2195 
2196 			/*
2197 			 * Correct page and copy the data from this page
2198 			 * into it and flush it to disk.
2199 			 */
2200 			memcpy(page, tmp_page, log->page_size);
2201 
2202 			/* Fill last flushed lsn value flush the page. */
2203 			if (log->major_ver < 2)
2204 				page->rhdr.lsn = page->record_hdr.last_end_lsn;
2205 			else
2206 				page->file_off = 0;
2207 
2208 			page->page_pos = page->page_count = cpu_to_le16(1);
2209 
2210 			ntfs_fix_pre_write(&page->rhdr, log->page_size);
2211 
2212 			err = ntfs_sb_write_run(log->ni->mi.sbi,
2213 						&log->ni->file.run, off, page,
2214 						log->page_size, 0);
2215 
2216 			if (err)
2217 				goto out;
2218 
2219 			if (part_io_count && second_off == off) {
2220 				second_off += log->page_size;
2221 				part_io_count -= 1;
2222 			}
2223 
2224 			tmp_page = Add2Ptr(tmp_page, log->page_size);
2225 		}
2226 	}
2227 
2228 	if (part_io_count) {
2229 		if (sb_rdonly(log->ni->mi.sbi->sb)) {
2230 			err = -EROFS;
2231 			goto out;
2232 		}
2233 	}
2234 
2235 out:
2236 	kfree(second_tail);
2237 	kfree(first_tail);
2238 	kfree(page);
2239 	kfree(tst_page);
2240 	kfree(page_bufs);
2241 
2242 	return err;
2243 }
2244 
2245 /*
2246  * read_log_rec_buf - Copy a log record from the file to a buffer.
2247  *
2248  * The log record may span several log pages and may even wrap the file.
2249  */
read_log_rec_buf(struct ntfs_log * log,const struct LFS_RECORD_HDR * rh,void * buffer)2250 static int read_log_rec_buf(struct ntfs_log *log,
2251 			    const struct LFS_RECORD_HDR *rh, void *buffer)
2252 {
2253 	int err;
2254 	struct RECORD_PAGE_HDR *ph = NULL;
2255 	u64 lsn = le64_to_cpu(rh->this_lsn);
2256 	u32 vbo = lsn_to_vbo(log, lsn) & ~log->page_mask;
2257 	u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;
2258 	u32 data_len = le32_to_cpu(rh->client_data_len);
2259 
2260 	/*
2261 	 * While there are more bytes to transfer,
2262 	 * we continue to attempt to perform the read.
2263 	 */
2264 	for (;;) {
2265 		bool usa_error;
2266 		u32 tail = log->page_size - off;
2267 
2268 		if (tail >= data_len)
2269 			tail = data_len;
2270 
2271 		data_len -= tail;
2272 
2273 		err = read_log_page(log, vbo, &ph, &usa_error);
2274 		if (err)
2275 			goto out;
2276 
2277 		/*
2278 		 * The last lsn on this page better be greater or equal
2279 		 * to the lsn we are copying.
2280 		 */
2281 		if (lsn > le64_to_cpu(ph->rhdr.lsn)) {
2282 			err = -EINVAL;
2283 			goto out;
2284 		}
2285 
2286 		memcpy(buffer, Add2Ptr(ph, off), tail);
2287 
2288 		/* If there are no more bytes to transfer, we exit the loop. */
2289 		if (!data_len) {
2290 			if (!is_log_record_end(ph) ||
2291 			    lsn > le64_to_cpu(ph->record_hdr.last_end_lsn)) {
2292 				err = -EINVAL;
2293 				goto out;
2294 			}
2295 			break;
2296 		}
2297 
2298 		if (ph->rhdr.lsn == ph->record_hdr.last_end_lsn ||
2299 		    lsn > le64_to_cpu(ph->rhdr.lsn)) {
2300 			err = -EINVAL;
2301 			goto out;
2302 		}
2303 
2304 		vbo = next_page_off(log, vbo);
2305 		off = log->data_off;
2306 
2307 		/*
2308 		 * Adjust our pointer the user's buffer to transfer
2309 		 * the next block to.
2310 		 */
2311 		buffer = Add2Ptr(buffer, tail);
2312 	}
2313 
2314 out:
2315 	kfree(ph);
2316 	return err;
2317 }
2318 
read_rst_area(struct ntfs_log * log,struct NTFS_RESTART ** rst_,u64 * lsn)2319 static int read_rst_area(struct ntfs_log *log, struct NTFS_RESTART **rst_,
2320 			 u64 *lsn)
2321 {
2322 	int err;
2323 	struct LFS_RECORD_HDR *rh = NULL;
2324 	const struct CLIENT_REC *cr =
2325 		Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off));
2326 	u64 lsnr, lsnc = le64_to_cpu(cr->restart_lsn);
2327 	u32 len;
2328 	struct NTFS_RESTART *rst;
2329 
2330 	*lsn = 0;
2331 	*rst_ = NULL;
2332 
2333 	/* If the client doesn't have a restart area, go ahead and exit now. */
2334 	if (!lsnc)
2335 		return 0;
2336 
2337 	err = read_log_page(log, lsn_to_vbo(log, lsnc),
2338 			    (struct RECORD_PAGE_HDR **)&rh, NULL);
2339 	if (err)
2340 		return err;
2341 
2342 	rst = NULL;
2343 	lsnr = le64_to_cpu(rh->this_lsn);
2344 
2345 	if (lsnc != lsnr) {
2346 		/* If the lsn values don't match, then the disk is corrupt. */
2347 		err = -EINVAL;
2348 		goto out;
2349 	}
2350 
2351 	*lsn = lsnr;
2352 	len = le32_to_cpu(rh->client_data_len);
2353 
2354 	if (!len) {
2355 		err = 0;
2356 		goto out;
2357 	}
2358 
2359 	if (len < sizeof(struct NTFS_RESTART)) {
2360 		err = -EINVAL;
2361 		goto out;
2362 	}
2363 
2364 	rst = kmalloc(len, GFP_NOFS);
2365 	if (!rst) {
2366 		err = -ENOMEM;
2367 		goto out;
2368 	}
2369 
2370 	/* Copy the data into the 'rst' buffer. */
2371 	err = read_log_rec_buf(log, rh, rst);
2372 	if (err)
2373 		goto out;
2374 
2375 	*rst_ = rst;
2376 	rst = NULL;
2377 
2378 out:
2379 	kfree(rh);
2380 	kfree(rst);
2381 
2382 	return err;
2383 }
2384 
find_log_rec(struct ntfs_log * log,u64 lsn,struct lcb * lcb)2385 static int find_log_rec(struct ntfs_log *log, u64 lsn, struct lcb *lcb)
2386 {
2387 	int err;
2388 	struct LFS_RECORD_HDR *rh = lcb->lrh;
2389 	u32 rec_len, len;
2390 
2391 	/* Read the record header for this lsn. */
2392 	if (!rh) {
2393 		err = read_log_page(log, lsn_to_vbo(log, lsn),
2394 				    (struct RECORD_PAGE_HDR **)&rh, NULL);
2395 
2396 		lcb->lrh = rh;
2397 		if (err)
2398 			return err;
2399 	}
2400 
2401 	/*
2402 	 * If the lsn the log record doesn't match the desired
2403 	 * lsn then the disk is corrupt.
2404 	 */
2405 	if (lsn != le64_to_cpu(rh->this_lsn))
2406 		return -EINVAL;
2407 
2408 	len = le32_to_cpu(rh->client_data_len);
2409 
2410 	/*
2411 	 * Check that the length field isn't greater than the total
2412 	 * available space the log file.
2413 	 */
2414 	rec_len = len + log->record_header_len;
2415 	if (rec_len >= log->total_avail)
2416 		return -EINVAL;
2417 
2418 	/*
2419 	 * If the entire log record is on this log page,
2420 	 * put a pointer to the log record the context block.
2421 	 */
2422 	if (rh->flags & LOG_RECORD_MULTI_PAGE) {
2423 		void *lr = kmalloc(len, GFP_NOFS);
2424 
2425 		if (!lr)
2426 			return -ENOMEM;
2427 
2428 		lcb->log_rec = lr;
2429 		lcb->alloc = true;
2430 
2431 		/* Copy the data into the buffer returned. */
2432 		err = read_log_rec_buf(log, rh, lr);
2433 		if (err)
2434 			return err;
2435 	} else {
2436 		/* If beyond the end of the current page -> an error. */
2437 		u32 page_off = lsn_to_page_off(log, lsn);
2438 
2439 		if (page_off + len + log->record_header_len > log->page_size)
2440 			return -EINVAL;
2441 
2442 		lcb->log_rec = Add2Ptr(rh, sizeof(struct LFS_RECORD_HDR));
2443 		lcb->alloc = false;
2444 	}
2445 
2446 	return 0;
2447 }
2448 
2449 /*
2450  * read_log_rec_lcb - Init the query operation.
2451  */
read_log_rec_lcb(struct ntfs_log * log,u64 lsn,u32 ctx_mode,struct lcb ** lcb_)2452 static int read_log_rec_lcb(struct ntfs_log *log, u64 lsn, u32 ctx_mode,
2453 			    struct lcb **lcb_)
2454 {
2455 	int err;
2456 	const struct CLIENT_REC *cr;
2457 	struct lcb *lcb;
2458 
2459 	switch (ctx_mode) {
2460 	case lcb_ctx_undo_next:
2461 	case lcb_ctx_prev:
2462 	case lcb_ctx_next:
2463 		break;
2464 	default:
2465 		return -EINVAL;
2466 	}
2467 
2468 	/* Check that the given lsn is the legal range for this client. */
2469 	cr = Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off));
2470 
2471 	if (!verify_client_lsn(log, cr, lsn))
2472 		return -EINVAL;
2473 
2474 	lcb = kzalloc(sizeof(struct lcb), GFP_NOFS);
2475 	if (!lcb)
2476 		return -ENOMEM;
2477 	lcb->client = log->client_id;
2478 	lcb->ctx_mode = ctx_mode;
2479 
2480 	/* Find the log record indicated by the given lsn. */
2481 	err = find_log_rec(log, lsn, lcb);
2482 	if (err)
2483 		goto out;
2484 
2485 	*lcb_ = lcb;
2486 	return 0;
2487 
2488 out:
2489 	lcb_put(lcb);
2490 	*lcb_ = NULL;
2491 	return err;
2492 }
2493 
2494 /*
2495  * find_client_next_lsn
2496  *
2497  * Attempt to find the next lsn to return to a client based on the context mode.
2498  */
find_client_next_lsn(struct ntfs_log * log,struct lcb * lcb,u64 * lsn)2499 static int find_client_next_lsn(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
2500 {
2501 	int err;
2502 	u64 next_lsn;
2503 	struct LFS_RECORD_HDR *hdr;
2504 
2505 	hdr = lcb->lrh;
2506 	*lsn = 0;
2507 
2508 	if (lcb_ctx_next != lcb->ctx_mode)
2509 		goto check_undo_next;
2510 
2511 	/* Loop as long as another lsn can be found. */
2512 	for (;;) {
2513 		u64 current_lsn;
2514 
2515 		err = next_log_lsn(log, hdr, &current_lsn);
2516 		if (err)
2517 			goto out;
2518 
2519 		if (!current_lsn)
2520 			break;
2521 
2522 		if (hdr != lcb->lrh)
2523 			kfree(hdr);
2524 
2525 		hdr = NULL;
2526 		err = read_log_page(log, lsn_to_vbo(log, current_lsn),
2527 				    (struct RECORD_PAGE_HDR **)&hdr, NULL);
2528 		if (err)
2529 			goto out;
2530 
2531 		if (memcmp(&hdr->client, &lcb->client,
2532 			   sizeof(struct CLIENT_ID))) {
2533 			/*err = -EINVAL; */
2534 		} else if (LfsClientRecord == hdr->record_type) {
2535 			kfree(lcb->lrh);
2536 			lcb->lrh = hdr;
2537 			*lsn = current_lsn;
2538 			return 0;
2539 		}
2540 	}
2541 
2542 out:
2543 	if (hdr != lcb->lrh)
2544 		kfree(hdr);
2545 	return err;
2546 
2547 check_undo_next:
2548 	if (lcb_ctx_undo_next == lcb->ctx_mode)
2549 		next_lsn = le64_to_cpu(hdr->client_undo_next_lsn);
2550 	else if (lcb_ctx_prev == lcb->ctx_mode)
2551 		next_lsn = le64_to_cpu(hdr->client_prev_lsn);
2552 	else
2553 		return 0;
2554 
2555 	if (!next_lsn)
2556 		return 0;
2557 
2558 	if (!verify_client_lsn(
2559 		    log, Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off)),
2560 		    next_lsn))
2561 		return 0;
2562 
2563 	hdr = NULL;
2564 	err = read_log_page(log, lsn_to_vbo(log, next_lsn),
2565 			    (struct RECORD_PAGE_HDR **)&hdr, NULL);
2566 	if (err)
2567 		return err;
2568 	kfree(lcb->lrh);
2569 	lcb->lrh = hdr;
2570 
2571 	*lsn = next_lsn;
2572 
2573 	return 0;
2574 }
2575 
read_next_log_rec(struct ntfs_log * log,struct lcb * lcb,u64 * lsn)2576 static int read_next_log_rec(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
2577 {
2578 	int err;
2579 
2580 	err = find_client_next_lsn(log, lcb, lsn);
2581 	if (err)
2582 		return err;
2583 
2584 	if (!*lsn)
2585 		return 0;
2586 
2587 	if (lcb->alloc)
2588 		kfree(lcb->log_rec);
2589 
2590 	lcb->log_rec = NULL;
2591 	lcb->alloc = false;
2592 	kfree(lcb->lrh);
2593 	lcb->lrh = NULL;
2594 
2595 	return find_log_rec(log, *lsn, lcb);
2596 }
2597 
check_index_header(const struct INDEX_HDR * hdr,size_t bytes)2598 bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes)
2599 {
2600 	__le16 mask;
2601 	u32 min_de, de_off, used, total;
2602 	const struct NTFS_DE *e;
2603 
2604 	if (hdr_has_subnode(hdr)) {
2605 		min_de = sizeof(struct NTFS_DE) + sizeof(u64);
2606 		mask = NTFS_IE_HAS_SUBNODES;
2607 	} else {
2608 		min_de = sizeof(struct NTFS_DE);
2609 		mask = 0;
2610 	}
2611 
2612 	de_off = le32_to_cpu(hdr->de_off);
2613 	used = le32_to_cpu(hdr->used);
2614 	total = le32_to_cpu(hdr->total);
2615 
2616 	if (de_off > bytes - min_de || used > bytes || total > bytes ||
2617 	    de_off + min_de > used || used > total) {
2618 		return false;
2619 	}
2620 
2621 	e = Add2Ptr(hdr, de_off);
2622 	for (;;) {
2623 		u16 esize = le16_to_cpu(e->size);
2624 		struct NTFS_DE *next = Add2Ptr(e, esize);
2625 
2626 		if (esize < min_de || PtrOffset(hdr, next) > used ||
2627 		    (e->flags & NTFS_IE_HAS_SUBNODES) != mask) {
2628 			return false;
2629 		}
2630 
2631 		if (de_is_last(e))
2632 			break;
2633 
2634 		e = next;
2635 	}
2636 
2637 	return true;
2638 }
2639 
check_index_buffer(const struct INDEX_BUFFER * ib,u32 bytes)2640 static inline bool check_index_buffer(const struct INDEX_BUFFER *ib, u32 bytes)
2641 {
2642 	u16 fo;
2643 	const struct NTFS_RECORD_HEADER *r = &ib->rhdr;
2644 
2645 	if (r->sign != NTFS_INDX_SIGNATURE)
2646 		return false;
2647 
2648 	fo = (SECTOR_SIZE - ((bytes >> SECTOR_SHIFT) + 1) * sizeof(short));
2649 
2650 	if (le16_to_cpu(r->fix_off) > fo)
2651 		return false;
2652 
2653 	if ((le16_to_cpu(r->fix_num) - 1) * SECTOR_SIZE != bytes)
2654 		return false;
2655 
2656 	return check_index_header(&ib->ihdr,
2657 				  bytes - offsetof(struct INDEX_BUFFER, ihdr));
2658 }
2659 
check_index_root(const struct ATTRIB * attr,struct ntfs_sb_info * sbi)2660 static inline bool check_index_root(const struct ATTRIB *attr,
2661 				    struct ntfs_sb_info *sbi)
2662 {
2663 	bool ret;
2664 	const struct INDEX_ROOT *root = resident_data(attr);
2665 	u8 index_bits = le32_to_cpu(root->index_block_size) >=
2666 					sbi->cluster_size ?
2667 				sbi->cluster_bits :
2668 				SECTOR_SHIFT;
2669 	u8 block_clst = root->index_block_clst;
2670 
2671 	if (le32_to_cpu(attr->res.data_size) < sizeof(struct INDEX_ROOT) ||
2672 	    (root->type != ATTR_NAME && root->type != ATTR_ZERO) ||
2673 	    (root->type == ATTR_NAME &&
2674 	     root->rule != NTFS_COLLATION_TYPE_FILENAME) ||
2675 	    (le32_to_cpu(root->index_block_size) !=
2676 	     (block_clst << index_bits)) ||
2677 	    (block_clst != 1 && block_clst != 2 && block_clst != 4 &&
2678 	     block_clst != 8 && block_clst != 0x10 && block_clst != 0x20 &&
2679 	     block_clst != 0x40 && block_clst != 0x80)) {
2680 		return false;
2681 	}
2682 
2683 	ret = check_index_header(&root->ihdr,
2684 				 le32_to_cpu(attr->res.data_size) -
2685 					 offsetof(struct INDEX_ROOT, ihdr));
2686 	return ret;
2687 }
2688 
check_attr(const struct MFT_REC * rec,const struct ATTRIB * attr,struct ntfs_sb_info * sbi)2689 static inline bool check_attr(const struct MFT_REC *rec,
2690 			      const struct ATTRIB *attr,
2691 			      struct ntfs_sb_info *sbi)
2692 {
2693 	u32 asize = le32_to_cpu(attr->size);
2694 	u32 rsize = 0;
2695 	u64 dsize, svcn, evcn;
2696 	u16 run_off;
2697 
2698 	/* Check the fixed part of the attribute record header. */
2699 	if (asize >= sbi->record_size ||
2700 	    asize + PtrOffset(rec, attr) >= sbi->record_size ||
2701 	    (attr->name_len &&
2702 	     le16_to_cpu(attr->name_off) + attr->name_len * sizeof(short) >
2703 		     asize)) {
2704 		return false;
2705 	}
2706 
2707 	/* Check the attribute fields. */
2708 	switch (attr->non_res) {
2709 	case 0:
2710 		rsize = le32_to_cpu(attr->res.data_size);
2711 		if (rsize >= asize ||
2712 		    le16_to_cpu(attr->res.data_off) + rsize > asize) {
2713 			return false;
2714 		}
2715 		break;
2716 
2717 	case 1:
2718 		dsize = le64_to_cpu(attr->nres.data_size);
2719 		svcn = le64_to_cpu(attr->nres.svcn);
2720 		evcn = le64_to_cpu(attr->nres.evcn);
2721 		run_off = le16_to_cpu(attr->nres.run_off);
2722 
2723 		if (svcn > evcn + 1 || run_off >= asize ||
2724 		    le64_to_cpu(attr->nres.valid_size) > dsize ||
2725 		    dsize > le64_to_cpu(attr->nres.alloc_size)) {
2726 			return false;
2727 		}
2728 
2729 		if (run_off > asize)
2730 			return false;
2731 
2732 		if (run_unpack(NULL, sbi, 0, svcn, evcn, svcn,
2733 			       Add2Ptr(attr, run_off), asize - run_off) < 0) {
2734 			return false;
2735 		}
2736 
2737 		return true;
2738 
2739 	default:
2740 		return false;
2741 	}
2742 
2743 	switch (attr->type) {
2744 	case ATTR_NAME:
2745 		if (fname_full_size(Add2Ptr(
2746 			    attr, le16_to_cpu(attr->res.data_off))) > asize) {
2747 			return false;
2748 		}
2749 		break;
2750 
2751 	case ATTR_ROOT:
2752 		return check_index_root(attr, sbi);
2753 
2754 	case ATTR_STD:
2755 		if (rsize < sizeof(struct ATTR_STD_INFO5) &&
2756 		    rsize != sizeof(struct ATTR_STD_INFO)) {
2757 			return false;
2758 		}
2759 		break;
2760 
2761 	case ATTR_LIST:
2762 	case ATTR_ID:
2763 	case ATTR_SECURE:
2764 	case ATTR_LABEL:
2765 	case ATTR_VOL_INFO:
2766 	case ATTR_DATA:
2767 	case ATTR_ALLOC:
2768 	case ATTR_BITMAP:
2769 	case ATTR_REPARSE:
2770 	case ATTR_EA_INFO:
2771 	case ATTR_EA:
2772 	case ATTR_PROPERTYSET:
2773 	case ATTR_LOGGED_UTILITY_STREAM:
2774 		break;
2775 
2776 	default:
2777 		return false;
2778 	}
2779 
2780 	return true;
2781 }
2782 
check_file_record(const struct MFT_REC * rec,const struct MFT_REC * rec2,struct ntfs_sb_info * sbi)2783 static inline bool check_file_record(const struct MFT_REC *rec,
2784 				     const struct MFT_REC *rec2,
2785 				     struct ntfs_sb_info *sbi)
2786 {
2787 	const struct ATTRIB *attr;
2788 	u16 fo = le16_to_cpu(rec->rhdr.fix_off);
2789 	u16 fn = le16_to_cpu(rec->rhdr.fix_num);
2790 	u16 ao = le16_to_cpu(rec->attr_off);
2791 	u32 rs = sbi->record_size;
2792 
2793 	/* Check the file record header for consistency. */
2794 	if (rec->rhdr.sign != NTFS_FILE_SIGNATURE ||
2795 	    fo > (SECTOR_SIZE - ((rs >> SECTOR_SHIFT) + 1) * sizeof(short)) ||
2796 	    (fn - 1) * SECTOR_SIZE != rs || ao < MFTRECORD_FIXUP_OFFSET_1 ||
2797 	    ao > sbi->record_size - SIZEOF_RESIDENT || !is_rec_inuse(rec) ||
2798 	    le32_to_cpu(rec->total) != rs) {
2799 		return false;
2800 	}
2801 
2802 	/* Loop to check all of the attributes. */
2803 	for (attr = Add2Ptr(rec, ao); attr->type != ATTR_END;
2804 	     attr = Add2Ptr(attr, le32_to_cpu(attr->size))) {
2805 		if (check_attr(rec, attr, sbi))
2806 			continue;
2807 		return false;
2808 	}
2809 
2810 	return true;
2811 }
2812 
check_lsn(const struct NTFS_RECORD_HEADER * hdr,const u64 * rlsn)2813 static inline int check_lsn(const struct NTFS_RECORD_HEADER *hdr,
2814 			    const u64 *rlsn)
2815 {
2816 	u64 lsn;
2817 
2818 	if (!rlsn)
2819 		return true;
2820 
2821 	lsn = le64_to_cpu(hdr->lsn);
2822 
2823 	if (hdr->sign == NTFS_HOLE_SIGNATURE)
2824 		return false;
2825 
2826 	if (*rlsn > lsn)
2827 		return true;
2828 
2829 	return false;
2830 }
2831 
check_if_attr(const struct MFT_REC * rec,const struct LOG_REC_HDR * lrh)2832 static inline bool check_if_attr(const struct MFT_REC *rec,
2833 				 const struct LOG_REC_HDR *lrh)
2834 {
2835 	u16 ro = le16_to_cpu(lrh->record_off);
2836 	u16 o = le16_to_cpu(rec->attr_off);
2837 	const struct ATTRIB *attr = Add2Ptr(rec, o);
2838 
2839 	while (o < ro) {
2840 		u32 asize;
2841 
2842 		if (attr->type == ATTR_END)
2843 			break;
2844 
2845 		asize = le32_to_cpu(attr->size);
2846 		if (!asize)
2847 			break;
2848 
2849 		o += asize;
2850 		attr = Add2Ptr(attr, asize);
2851 	}
2852 
2853 	return o == ro;
2854 }
2855 
check_if_index_root(const struct MFT_REC * rec,const struct LOG_REC_HDR * lrh)2856 static inline bool check_if_index_root(const struct MFT_REC *rec,
2857 				       const struct LOG_REC_HDR *lrh)
2858 {
2859 	u16 ro = le16_to_cpu(lrh->record_off);
2860 	u16 o = le16_to_cpu(rec->attr_off);
2861 	const struct ATTRIB *attr = Add2Ptr(rec, o);
2862 
2863 	while (o < ro) {
2864 		u32 asize;
2865 
2866 		if (attr->type == ATTR_END)
2867 			break;
2868 
2869 		asize = le32_to_cpu(attr->size);
2870 		if (!asize)
2871 			break;
2872 
2873 		o += asize;
2874 		attr = Add2Ptr(attr, asize);
2875 	}
2876 
2877 	return o == ro && attr->type == ATTR_ROOT;
2878 }
2879 
check_if_root_index(const struct ATTRIB * attr,const struct INDEX_HDR * hdr,const struct LOG_REC_HDR * lrh)2880 static inline bool check_if_root_index(const struct ATTRIB *attr,
2881 				       const struct INDEX_HDR *hdr,
2882 				       const struct LOG_REC_HDR *lrh)
2883 {
2884 	u16 ao = le16_to_cpu(lrh->attr_off);
2885 	u32 de_off = le32_to_cpu(hdr->de_off);
2886 	u32 o = PtrOffset(attr, hdr) + de_off;
2887 	const struct NTFS_DE *e = Add2Ptr(hdr, de_off);
2888 	u32 asize = le32_to_cpu(attr->size);
2889 
2890 	while (o < ao) {
2891 		u16 esize;
2892 
2893 		if (o >= asize)
2894 			break;
2895 
2896 		esize = le16_to_cpu(e->size);
2897 		if (!esize)
2898 			break;
2899 
2900 		o += esize;
2901 		e = Add2Ptr(e, esize);
2902 	}
2903 
2904 	return o == ao;
2905 }
2906 
check_if_alloc_index(const struct INDEX_HDR * hdr,u32 attr_off)2907 static inline bool check_if_alloc_index(const struct INDEX_HDR *hdr,
2908 					u32 attr_off)
2909 {
2910 	u32 de_off = le32_to_cpu(hdr->de_off);
2911 	u32 o = offsetof(struct INDEX_BUFFER, ihdr) + de_off;
2912 	const struct NTFS_DE *e = Add2Ptr(hdr, de_off);
2913 	u32 used = le32_to_cpu(hdr->used);
2914 
2915 	while (o < attr_off) {
2916 		u16 esize;
2917 
2918 		if (de_off >= used)
2919 			break;
2920 
2921 		esize = le16_to_cpu(e->size);
2922 		if (!esize)
2923 			break;
2924 
2925 		o += esize;
2926 		de_off += esize;
2927 		e = Add2Ptr(e, esize);
2928 	}
2929 
2930 	return o == attr_off;
2931 }
2932 
change_attr_size(struct MFT_REC * rec,struct ATTRIB * attr,u32 nsize)2933 static inline void change_attr_size(struct MFT_REC *rec, struct ATTRIB *attr,
2934 				    u32 nsize)
2935 {
2936 	u32 asize = le32_to_cpu(attr->size);
2937 	int dsize = nsize - asize;
2938 	u8 *next = Add2Ptr(attr, asize);
2939 	u32 used = le32_to_cpu(rec->used);
2940 
2941 	memmove(Add2Ptr(attr, nsize), next, used - PtrOffset(rec, next));
2942 
2943 	rec->used = cpu_to_le32(used + dsize);
2944 	attr->size = cpu_to_le32(nsize);
2945 }
2946 
2947 struct OpenAttr {
2948 	struct ATTRIB *attr;
2949 	struct runs_tree *run1;
2950 	struct runs_tree run0;
2951 	struct ntfs_inode *ni;
2952 	// CLST rno;
2953 };
2954 
2955 /*
2956  * cmp_type_and_name
2957  *
2958  * Return: 0 if 'attr' has the same type and name.
2959  */
cmp_type_and_name(const struct ATTRIB * a1,const struct ATTRIB * a2)2960 static inline int cmp_type_and_name(const struct ATTRIB *a1,
2961 				    const struct ATTRIB *a2)
2962 {
2963 	return a1->type != a2->type || a1->name_len != a2->name_len ||
2964 	       (a1->name_len && memcmp(attr_name(a1), attr_name(a2),
2965 				       a1->name_len * sizeof(short)));
2966 }
2967 
find_loaded_attr(struct ntfs_log * log,const struct ATTRIB * attr,CLST rno)2968 static struct OpenAttr *find_loaded_attr(struct ntfs_log *log,
2969 					 const struct ATTRIB *attr, CLST rno)
2970 {
2971 	struct OPEN_ATTR_ENRTY *oe = NULL;
2972 
2973 	while ((oe = enum_rstbl(log->open_attr_tbl, oe))) {
2974 		struct OpenAttr *op_attr;
2975 
2976 		if (ino_get(&oe->ref) != rno)
2977 			continue;
2978 
2979 		op_attr = (struct OpenAttr *)oe->ptr;
2980 		if (!cmp_type_and_name(op_attr->attr, attr))
2981 			return op_attr;
2982 	}
2983 	return NULL;
2984 }
2985 
attr_create_nonres_log(struct ntfs_sb_info * sbi,enum ATTR_TYPE type,u64 size,const u16 * name,size_t name_len,__le16 flags)2986 static struct ATTRIB *attr_create_nonres_log(struct ntfs_sb_info *sbi,
2987 					     enum ATTR_TYPE type, u64 size,
2988 					     const u16 *name, size_t name_len,
2989 					     __le16 flags)
2990 {
2991 	struct ATTRIB *attr;
2992 	u32 name_size = ALIGN(name_len * sizeof(short), 8);
2993 	bool is_ext = flags & (ATTR_FLAG_COMPRESSED | ATTR_FLAG_SPARSED);
2994 	u32 asize = name_size +
2995 		    (is_ext ? SIZEOF_NONRESIDENT_EX : SIZEOF_NONRESIDENT);
2996 
2997 	attr = kzalloc(asize, GFP_NOFS);
2998 	if (!attr)
2999 		return NULL;
3000 
3001 	attr->type = type;
3002 	attr->size = cpu_to_le32(asize);
3003 	attr->flags = flags;
3004 	attr->non_res = 1;
3005 	attr->name_len = name_len;
3006 
3007 	attr->nres.evcn = cpu_to_le64((u64)bytes_to_cluster(sbi, size) - 1);
3008 	attr->nres.alloc_size = cpu_to_le64(ntfs_up_cluster(sbi, size));
3009 	attr->nres.data_size = cpu_to_le64(size);
3010 	attr->nres.valid_size = attr->nres.data_size;
3011 	if (is_ext) {
3012 		attr->name_off = SIZEOF_NONRESIDENT_EX_LE;
3013 		if (is_attr_compressed(attr))
3014 			attr->nres.c_unit = NTFS_LZNT_CUNIT;
3015 
3016 		attr->nres.run_off =
3017 			cpu_to_le16(SIZEOF_NONRESIDENT_EX + name_size);
3018 		memcpy(Add2Ptr(attr, SIZEOF_NONRESIDENT_EX), name,
3019 		       name_len * sizeof(short));
3020 	} else {
3021 		attr->name_off = SIZEOF_NONRESIDENT_LE;
3022 		attr->nres.run_off =
3023 			cpu_to_le16(SIZEOF_NONRESIDENT + name_size);
3024 		memcpy(Add2Ptr(attr, SIZEOF_NONRESIDENT), name,
3025 		       name_len * sizeof(short));
3026 	}
3027 
3028 	return attr;
3029 }
3030 
3031 /*
3032  * do_action - Common routine for the Redo and Undo Passes.
3033  * @rlsn: If it is NULL then undo.
3034  */
do_action(struct ntfs_log * log,struct OPEN_ATTR_ENRTY * oe,const struct LOG_REC_HDR * lrh,u32 op,void * data,u32 dlen,u32 rec_len,const u64 * rlsn)3035 static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
3036 		     const struct LOG_REC_HDR *lrh, u32 op, void *data,
3037 		     u32 dlen, u32 rec_len, const u64 *rlsn)
3038 {
3039 	int err = 0;
3040 	struct ntfs_sb_info *sbi = log->ni->mi.sbi;
3041 	struct inode *inode = NULL, *inode_parent;
3042 	struct mft_inode *mi = NULL, *mi2_child = NULL;
3043 	CLST rno = 0, rno_base = 0;
3044 	struct INDEX_BUFFER *ib = NULL;
3045 	struct MFT_REC *rec = NULL;
3046 	struct ATTRIB *attr = NULL, *attr2;
3047 	struct INDEX_HDR *hdr;
3048 	struct INDEX_ROOT *root;
3049 	struct NTFS_DE *e, *e1, *e2;
3050 	struct NEW_ATTRIBUTE_SIZES *new_sz;
3051 	struct ATTR_FILE_NAME *fname;
3052 	struct OpenAttr *oa, *oa2;
3053 	u32 nsize, t32, asize, used, esize, off, bits;
3054 	u16 id, id2;
3055 	u32 record_size = sbi->record_size;
3056 	u64 t64;
3057 	u16 roff = le16_to_cpu(lrh->record_off);
3058 	u16 aoff = le16_to_cpu(lrh->attr_off);
3059 	u64 lco = 0;
3060 	u64 cbo = (u64)le16_to_cpu(lrh->cluster_off) << SECTOR_SHIFT;
3061 	u64 tvo = le64_to_cpu(lrh->target_vcn) << sbi->cluster_bits;
3062 	u64 vbo = cbo + tvo;
3063 	void *buffer_le = NULL;
3064 	u32 bytes = 0;
3065 	bool a_dirty = false;
3066 	u16 data_off;
3067 
3068 	oa = oe->ptr;
3069 
3070 	/* Big switch to prepare. */
3071 	switch (op) {
3072 	/* ============================================================
3073 	 * Process MFT records, as described by the current log record.
3074 	 * ============================================================
3075 	 */
3076 	case InitializeFileRecordSegment:
3077 	case DeallocateFileRecordSegment:
3078 	case WriteEndOfFileRecordSegment:
3079 	case CreateAttribute:
3080 	case DeleteAttribute:
3081 	case UpdateResidentValue:
3082 	case UpdateMappingPairs:
3083 	case SetNewAttributeSizes:
3084 	case AddIndexEntryRoot:
3085 	case DeleteIndexEntryRoot:
3086 	case SetIndexEntryVcnRoot:
3087 	case UpdateFileNameRoot:
3088 	case UpdateRecordDataRoot:
3089 	case ZeroEndOfFileRecord:
3090 		rno = vbo >> sbi->record_bits;
3091 		inode = ilookup(sbi->sb, rno);
3092 		if (inode) {
3093 			mi = &ntfs_i(inode)->mi;
3094 		} else if (op == InitializeFileRecordSegment) {
3095 			mi = kzalloc(sizeof(struct mft_inode), GFP_NOFS);
3096 			if (!mi)
3097 				return -ENOMEM;
3098 			err = mi_format_new(mi, sbi, rno, 0, false);
3099 			if (err)
3100 				goto out;
3101 		} else {
3102 			/* Read from disk. */
3103 			err = mi_get(sbi, rno, &mi);
3104 			if (err)
3105 				return err;
3106 		}
3107 		rec = mi->mrec;
3108 
3109 		if (op == DeallocateFileRecordSegment)
3110 			goto skip_load_parent;
3111 
3112 		if (InitializeFileRecordSegment != op) {
3113 			if (rec->rhdr.sign == NTFS_BAAD_SIGNATURE)
3114 				goto dirty_vol;
3115 			if (!check_lsn(&rec->rhdr, rlsn))
3116 				goto out;
3117 			if (!check_file_record(rec, NULL, sbi))
3118 				goto dirty_vol;
3119 			attr = Add2Ptr(rec, roff);
3120 		}
3121 
3122 		if (is_rec_base(rec) || InitializeFileRecordSegment == op) {
3123 			rno_base = rno;
3124 			goto skip_load_parent;
3125 		}
3126 
3127 		rno_base = ino_get(&rec->parent_ref);
3128 		inode_parent = ntfs_iget5(sbi->sb, &rec->parent_ref, NULL);
3129 		if (IS_ERR(inode_parent))
3130 			goto skip_load_parent;
3131 
3132 		if (is_bad_inode(inode_parent)) {
3133 			iput(inode_parent);
3134 			goto skip_load_parent;
3135 		}
3136 
3137 		if (ni_load_mi_ex(ntfs_i(inode_parent), rno, &mi2_child)) {
3138 			iput(inode_parent);
3139 		} else {
3140 			if (mi2_child->mrec != mi->mrec)
3141 				memcpy(mi2_child->mrec, mi->mrec,
3142 				       sbi->record_size);
3143 
3144 			if (inode)
3145 				iput(inode);
3146 			else if (mi)
3147 				mi_put(mi);
3148 
3149 			inode = inode_parent;
3150 			mi = mi2_child;
3151 			rec = mi2_child->mrec;
3152 			attr = Add2Ptr(rec, roff);
3153 		}
3154 
3155 skip_load_parent:
3156 		inode_parent = NULL;
3157 		break;
3158 
3159 	/*
3160 	 * Process attributes, as described by the current log record.
3161 	 */
3162 	case UpdateNonresidentValue:
3163 	case AddIndexEntryAllocation:
3164 	case DeleteIndexEntryAllocation:
3165 	case WriteEndOfIndexBuffer:
3166 	case SetIndexEntryVcnAllocation:
3167 	case UpdateFileNameAllocation:
3168 	case SetBitsInNonresidentBitMap:
3169 	case ClearBitsInNonresidentBitMap:
3170 	case UpdateRecordDataAllocation:
3171 		attr = oa->attr;
3172 		bytes = UpdateNonresidentValue == op ? dlen : 0;
3173 		lco = (u64)le16_to_cpu(lrh->lcns_follow) << sbi->cluster_bits;
3174 
3175 		if (attr->type == ATTR_ALLOC) {
3176 			t32 = le32_to_cpu(oe->bytes_per_index);
3177 			if (bytes < t32)
3178 				bytes = t32;
3179 		}
3180 
3181 		if (!bytes)
3182 			bytes = lco - cbo;
3183 
3184 		bytes += roff;
3185 		if (attr->type == ATTR_ALLOC)
3186 			bytes = (bytes + 511) & ~511; // align
3187 
3188 		buffer_le = kmalloc(bytes, GFP_NOFS);
3189 		if (!buffer_le)
3190 			return -ENOMEM;
3191 
3192 		err = ntfs_read_run_nb(sbi, oa->run1, vbo, buffer_le, bytes,
3193 				       NULL);
3194 		if (err)
3195 			goto out;
3196 
3197 		if (attr->type == ATTR_ALLOC && *(int *)buffer_le)
3198 			ntfs_fix_post_read(buffer_le, bytes, false);
3199 		break;
3200 
3201 	default:
3202 		WARN_ON(1);
3203 	}
3204 
3205 	/* Big switch to do operation. */
3206 	switch (op) {
3207 	case InitializeFileRecordSegment:
3208 		if (roff + dlen > record_size)
3209 			goto dirty_vol;
3210 
3211 		memcpy(Add2Ptr(rec, roff), data, dlen);
3212 		mi->dirty = true;
3213 		break;
3214 
3215 	case DeallocateFileRecordSegment:
3216 		clear_rec_inuse(rec);
3217 		le16_add_cpu(&rec->seq, 1);
3218 		mi->dirty = true;
3219 		break;
3220 
3221 	case WriteEndOfFileRecordSegment:
3222 		attr2 = (struct ATTRIB *)data;
3223 		if (!check_if_attr(rec, lrh) || roff + dlen > record_size)
3224 			goto dirty_vol;
3225 
3226 		memmove(attr, attr2, dlen);
3227 		rec->used = cpu_to_le32(ALIGN(roff + dlen, 8));
3228 
3229 		mi->dirty = true;
3230 		break;
3231 
3232 	case CreateAttribute:
3233 		attr2 = (struct ATTRIB *)data;
3234 		asize = le32_to_cpu(attr2->size);
3235 		used = le32_to_cpu(rec->used);
3236 
3237 		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
3238 		    !IS_ALIGNED(asize, 8) ||
3239 		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
3240 		    dlen > record_size - used) {
3241 			goto dirty_vol;
3242 		}
3243 
3244 		memmove(Add2Ptr(attr, asize), attr, used - roff);
3245 		memcpy(attr, attr2, asize);
3246 
3247 		rec->used = cpu_to_le32(used + asize);
3248 		id = le16_to_cpu(rec->next_attr_id);
3249 		id2 = le16_to_cpu(attr2->id);
3250 		if (id <= id2)
3251 			rec->next_attr_id = cpu_to_le16(id2 + 1);
3252 		if (is_attr_indexed(attr))
3253 			le16_add_cpu(&rec->hard_links, 1);
3254 
3255 		oa2 = find_loaded_attr(log, attr, rno_base);
3256 		if (oa2) {
3257 			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3258 					   GFP_NOFS);
3259 			if (p2) {
3260 				// run_close(oa2->run1);
3261 				kfree(oa2->attr);
3262 				oa2->attr = p2;
3263 			}
3264 		}
3265 
3266 		mi->dirty = true;
3267 		break;
3268 
3269 	case DeleteAttribute:
3270 		asize = le32_to_cpu(attr->size);
3271 		used = le32_to_cpu(rec->used);
3272 
3273 		if (!check_if_attr(rec, lrh))
3274 			goto dirty_vol;
3275 
3276 		rec->used = cpu_to_le32(used - asize);
3277 		if (is_attr_indexed(attr))
3278 			le16_add_cpu(&rec->hard_links, -1);
3279 
3280 		memmove(attr, Add2Ptr(attr, asize), used - asize - roff);
3281 
3282 		mi->dirty = true;
3283 		break;
3284 
3285 	case UpdateResidentValue:
3286 		nsize = aoff + dlen;
3287 
3288 		if (!check_if_attr(rec, lrh))
3289 			goto dirty_vol;
3290 
3291 		asize = le32_to_cpu(attr->size);
3292 		used = le32_to_cpu(rec->used);
3293 
3294 		if (lrh->redo_len == lrh->undo_len) {
3295 			if (nsize > asize)
3296 				goto dirty_vol;
3297 			goto move_data;
3298 		}
3299 
3300 		if (nsize > asize && nsize - asize > record_size - used)
3301 			goto dirty_vol;
3302 
3303 		nsize = ALIGN(nsize, 8);
3304 		data_off = le16_to_cpu(attr->res.data_off);
3305 
3306 		if (nsize < asize) {
3307 			memmove(Add2Ptr(attr, aoff), data, dlen);
3308 			data = NULL; // To skip below memmove().
3309 		}
3310 
3311 		memmove(Add2Ptr(attr, nsize), Add2Ptr(attr, asize),
3312 			used - le16_to_cpu(lrh->record_off) - asize);
3313 
3314 		rec->used = cpu_to_le32(used + nsize - asize);
3315 		attr->size = cpu_to_le32(nsize);
3316 		attr->res.data_size = cpu_to_le32(aoff + dlen - data_off);
3317 
3318 move_data:
3319 		if (data)
3320 			memmove(Add2Ptr(attr, aoff), data, dlen);
3321 
3322 		oa2 = find_loaded_attr(log, attr, rno_base);
3323 		if (oa2) {
3324 			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3325 					   GFP_NOFS);
3326 			if (p2) {
3327 				// run_close(&oa2->run0);
3328 				oa2->run1 = &oa2->run0;
3329 				kfree(oa2->attr);
3330 				oa2->attr = p2;
3331 			}
3332 		}
3333 
3334 		mi->dirty = true;
3335 		break;
3336 
3337 	case UpdateMappingPairs:
3338 		nsize = aoff + dlen;
3339 		asize = le32_to_cpu(attr->size);
3340 		used = le32_to_cpu(rec->used);
3341 
3342 		if (!check_if_attr(rec, lrh) || !attr->non_res ||
3343 		    aoff < le16_to_cpu(attr->nres.run_off) || aoff > asize ||
3344 		    (nsize > asize && nsize - asize > record_size - used)) {
3345 			goto dirty_vol;
3346 		}
3347 
3348 		nsize = ALIGN(nsize, 8);
3349 
3350 		memmove(Add2Ptr(attr, nsize), Add2Ptr(attr, asize),
3351 			used - le16_to_cpu(lrh->record_off) - asize);
3352 		rec->used = cpu_to_le32(used + nsize - asize);
3353 		attr->size = cpu_to_le32(nsize);
3354 		memmove(Add2Ptr(attr, aoff), data, dlen);
3355 
3356 		if (run_get_highest_vcn(le64_to_cpu(attr->nres.svcn),
3357 					attr_run(attr), &t64)) {
3358 			goto dirty_vol;
3359 		}
3360 
3361 		attr->nres.evcn = cpu_to_le64(t64);
3362 		oa2 = find_loaded_attr(log, attr, rno_base);
3363 		if (oa2 && oa2->attr->non_res)
3364 			oa2->attr->nres.evcn = attr->nres.evcn;
3365 
3366 		mi->dirty = true;
3367 		break;
3368 
3369 	case SetNewAttributeSizes:
3370 		new_sz = data;
3371 		if (!check_if_attr(rec, lrh) || !attr->non_res)
3372 			goto dirty_vol;
3373 
3374 		attr->nres.alloc_size = new_sz->alloc_size;
3375 		attr->nres.data_size = new_sz->data_size;
3376 		attr->nres.valid_size = new_sz->valid_size;
3377 
3378 		if (dlen >= sizeof(struct NEW_ATTRIBUTE_SIZES))
3379 			attr->nres.total_size = new_sz->total_size;
3380 
3381 		oa2 = find_loaded_attr(log, attr, rno_base);
3382 		if (oa2) {
3383 			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3384 					   GFP_NOFS);
3385 			if (p2) {
3386 				kfree(oa2->attr);
3387 				oa2->attr = p2;
3388 			}
3389 		}
3390 		mi->dirty = true;
3391 		break;
3392 
3393 	case AddIndexEntryRoot:
3394 		e = (struct NTFS_DE *)data;
3395 		esize = le16_to_cpu(e->size);
3396 		root = resident_data(attr);
3397 		hdr = &root->ihdr;
3398 		used = le32_to_cpu(hdr->used);
3399 
3400 		if (!check_if_index_root(rec, lrh) ||
3401 		    !check_if_root_index(attr, hdr, lrh) ||
3402 		    Add2Ptr(data, esize) > Add2Ptr(lrh, rec_len) ||
3403 		    esize > le32_to_cpu(rec->total) - le32_to_cpu(rec->used)) {
3404 			goto dirty_vol;
3405 		}
3406 
3407 		e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3408 
3409 		change_attr_size(rec, attr, le32_to_cpu(attr->size) + esize);
3410 
3411 		memmove(Add2Ptr(e1, esize), e1,
3412 			PtrOffset(e1, Add2Ptr(hdr, used)));
3413 		memmove(e1, e, esize);
3414 
3415 		le32_add_cpu(&attr->res.data_size, esize);
3416 		hdr->used = cpu_to_le32(used + esize);
3417 		le32_add_cpu(&hdr->total, esize);
3418 
3419 		mi->dirty = true;
3420 		break;
3421 
3422 	case DeleteIndexEntryRoot:
3423 		root = resident_data(attr);
3424 		hdr = &root->ihdr;
3425 		used = le32_to_cpu(hdr->used);
3426 
3427 		if (!check_if_index_root(rec, lrh) ||
3428 		    !check_if_root_index(attr, hdr, lrh)) {
3429 			goto dirty_vol;
3430 		}
3431 
3432 		e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3433 		esize = le16_to_cpu(e1->size);
3434 		e2 = Add2Ptr(e1, esize);
3435 
3436 		memmove(e1, e2, PtrOffset(e2, Add2Ptr(hdr, used)));
3437 
3438 		le32_sub_cpu(&attr->res.data_size, esize);
3439 		hdr->used = cpu_to_le32(used - esize);
3440 		le32_sub_cpu(&hdr->total, esize);
3441 
3442 		change_attr_size(rec, attr, le32_to_cpu(attr->size) - esize);
3443 
3444 		mi->dirty = true;
3445 		break;
3446 
3447 	case SetIndexEntryVcnRoot:
3448 		root = resident_data(attr);
3449 		hdr = &root->ihdr;
3450 
3451 		if (!check_if_index_root(rec, lrh) ||
3452 		    !check_if_root_index(attr, hdr, lrh)) {
3453 			goto dirty_vol;
3454 		}
3455 
3456 		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3457 
3458 		de_set_vbn_le(e, *(__le64 *)data);
3459 		mi->dirty = true;
3460 		break;
3461 
3462 	case UpdateFileNameRoot:
3463 		root = resident_data(attr);
3464 		hdr = &root->ihdr;
3465 
3466 		if (!check_if_index_root(rec, lrh) ||
3467 		    !check_if_root_index(attr, hdr, lrh)) {
3468 			goto dirty_vol;
3469 		}
3470 
3471 		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3472 		fname = (struct ATTR_FILE_NAME *)(e + 1);
3473 		memmove(&fname->dup, data, sizeof(fname->dup)); //
3474 		mi->dirty = true;
3475 		break;
3476 
3477 	case UpdateRecordDataRoot:
3478 		root = resident_data(attr);
3479 		hdr = &root->ihdr;
3480 
3481 		if (!check_if_index_root(rec, lrh) ||
3482 		    !check_if_root_index(attr, hdr, lrh)) {
3483 			goto dirty_vol;
3484 		}
3485 
3486 		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3487 
3488 		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
3489 
3490 		mi->dirty = true;
3491 		break;
3492 
3493 	case ZeroEndOfFileRecord:
3494 		if (roff + dlen > record_size)
3495 			goto dirty_vol;
3496 
3497 		memset(attr, 0, dlen);
3498 		mi->dirty = true;
3499 		break;
3500 
3501 	case UpdateNonresidentValue:
3502 		if (lco < cbo + roff + dlen)
3503 			goto dirty_vol;
3504 
3505 		memcpy(Add2Ptr(buffer_le, roff), data, dlen);
3506 
3507 		a_dirty = true;
3508 		if (attr->type == ATTR_ALLOC)
3509 			ntfs_fix_pre_write(buffer_le, bytes);
3510 		break;
3511 
3512 	case AddIndexEntryAllocation:
3513 		ib = Add2Ptr(buffer_le, roff);
3514 		hdr = &ib->ihdr;
3515 		e = data;
3516 		esize = le16_to_cpu(e->size);
3517 		e1 = Add2Ptr(ib, aoff);
3518 
3519 		if (is_baad(&ib->rhdr))
3520 			goto dirty_vol;
3521 		if (!check_lsn(&ib->rhdr, rlsn))
3522 			goto out;
3523 
3524 		used = le32_to_cpu(hdr->used);
3525 
3526 		if (!check_index_buffer(ib, bytes) ||
3527 		    !check_if_alloc_index(hdr, aoff) ||
3528 		    Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||
3529 		    used + esize > le32_to_cpu(hdr->total)) {
3530 			goto dirty_vol;
3531 		}
3532 
3533 		memmove(Add2Ptr(e1, esize), e1,
3534 			PtrOffset(e1, Add2Ptr(hdr, used)));
3535 		memcpy(e1, e, esize);
3536 
3537 		hdr->used = cpu_to_le32(used + esize);
3538 
3539 		a_dirty = true;
3540 
3541 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3542 		break;
3543 
3544 	case DeleteIndexEntryAllocation:
3545 		ib = Add2Ptr(buffer_le, roff);
3546 		hdr = &ib->ihdr;
3547 		e = Add2Ptr(ib, aoff);
3548 		esize = le16_to_cpu(e->size);
3549 
3550 		if (is_baad(&ib->rhdr))
3551 			goto dirty_vol;
3552 		if (!check_lsn(&ib->rhdr, rlsn))
3553 			goto out;
3554 
3555 		if (!check_index_buffer(ib, bytes) ||
3556 		    !check_if_alloc_index(hdr, aoff)) {
3557 			goto dirty_vol;
3558 		}
3559 
3560 		e1 = Add2Ptr(e, esize);
3561 		nsize = esize;
3562 		used = le32_to_cpu(hdr->used);
3563 
3564 		memmove(e, e1, PtrOffset(e1, Add2Ptr(hdr, used)));
3565 
3566 		hdr->used = cpu_to_le32(used - nsize);
3567 
3568 		a_dirty = true;
3569 
3570 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3571 		break;
3572 
3573 	case WriteEndOfIndexBuffer:
3574 		ib = Add2Ptr(buffer_le, roff);
3575 		hdr = &ib->ihdr;
3576 		e = Add2Ptr(ib, aoff);
3577 
3578 		if (is_baad(&ib->rhdr))
3579 			goto dirty_vol;
3580 		if (!check_lsn(&ib->rhdr, rlsn))
3581 			goto out;
3582 		if (!check_index_buffer(ib, bytes) ||
3583 		    !check_if_alloc_index(hdr, aoff) ||
3584 		    aoff + dlen > offsetof(struct INDEX_BUFFER, ihdr) +
3585 					  le32_to_cpu(hdr->total)) {
3586 			goto dirty_vol;
3587 		}
3588 
3589 		hdr->used = cpu_to_le32(dlen + PtrOffset(hdr, e));
3590 		memmove(e, data, dlen);
3591 
3592 		a_dirty = true;
3593 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3594 		break;
3595 
3596 	case SetIndexEntryVcnAllocation:
3597 		ib = Add2Ptr(buffer_le, roff);
3598 		hdr = &ib->ihdr;
3599 		e = Add2Ptr(ib, aoff);
3600 
3601 		if (is_baad(&ib->rhdr))
3602 			goto dirty_vol;
3603 
3604 		if (!check_lsn(&ib->rhdr, rlsn))
3605 			goto out;
3606 		if (!check_index_buffer(ib, bytes) ||
3607 		    !check_if_alloc_index(hdr, aoff)) {
3608 			goto dirty_vol;
3609 		}
3610 
3611 		de_set_vbn_le(e, *(__le64 *)data);
3612 
3613 		a_dirty = true;
3614 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3615 		break;
3616 
3617 	case UpdateFileNameAllocation:
3618 		ib = Add2Ptr(buffer_le, roff);
3619 		hdr = &ib->ihdr;
3620 		e = Add2Ptr(ib, aoff);
3621 
3622 		if (is_baad(&ib->rhdr))
3623 			goto dirty_vol;
3624 
3625 		if (!check_lsn(&ib->rhdr, rlsn))
3626 			goto out;
3627 		if (!check_index_buffer(ib, bytes) ||
3628 		    !check_if_alloc_index(hdr, aoff)) {
3629 			goto dirty_vol;
3630 		}
3631 
3632 		fname = (struct ATTR_FILE_NAME *)(e + 1);
3633 		memmove(&fname->dup, data, sizeof(fname->dup));
3634 
3635 		a_dirty = true;
3636 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3637 		break;
3638 
3639 	case SetBitsInNonresidentBitMap:
3640 		off = le32_to_cpu(((struct BITMAP_RANGE *)data)->bitmap_off);
3641 		bits = le32_to_cpu(((struct BITMAP_RANGE *)data)->bits);
3642 
3643 		if (cbo + (off + 7) / 8 > lco ||
3644 		    cbo + ((off + bits + 7) / 8) > lco) {
3645 			goto dirty_vol;
3646 		}
3647 
3648 		ntfs_bitmap_set_le(Add2Ptr(buffer_le, roff), off, bits);
3649 		a_dirty = true;
3650 		break;
3651 
3652 	case ClearBitsInNonresidentBitMap:
3653 		off = le32_to_cpu(((struct BITMAP_RANGE *)data)->bitmap_off);
3654 		bits = le32_to_cpu(((struct BITMAP_RANGE *)data)->bits);
3655 
3656 		if (cbo + (off + 7) / 8 > lco ||
3657 		    cbo + ((off + bits + 7) / 8) > lco) {
3658 			goto dirty_vol;
3659 		}
3660 
3661 		ntfs_bitmap_clear_le(Add2Ptr(buffer_le, roff), off, bits);
3662 		a_dirty = true;
3663 		break;
3664 
3665 	case UpdateRecordDataAllocation:
3666 		ib = Add2Ptr(buffer_le, roff);
3667 		hdr = &ib->ihdr;
3668 		e = Add2Ptr(ib, aoff);
3669 
3670 		if (is_baad(&ib->rhdr))
3671 			goto dirty_vol;
3672 
3673 		if (!check_lsn(&ib->rhdr, rlsn))
3674 			goto out;
3675 		if (!check_index_buffer(ib, bytes) ||
3676 		    !check_if_alloc_index(hdr, aoff)) {
3677 			goto dirty_vol;
3678 		}
3679 
3680 		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
3681 
3682 		a_dirty = true;
3683 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3684 		break;
3685 
3686 	default:
3687 		WARN_ON(1);
3688 	}
3689 
3690 	if (rlsn) {
3691 		__le64 t64 = cpu_to_le64(*rlsn);
3692 
3693 		if (rec)
3694 			rec->rhdr.lsn = t64;
3695 		if (ib)
3696 			ib->rhdr.lsn = t64;
3697 	}
3698 
3699 	if (mi && mi->dirty) {
3700 		err = mi_write(mi, 0);
3701 		if (err)
3702 			goto out;
3703 	}
3704 
3705 	if (a_dirty) {
3706 		attr = oa->attr;
3707 		err = ntfs_sb_write_run(sbi, oa->run1, vbo, buffer_le, bytes,
3708 					0);
3709 		if (err)
3710 			goto out;
3711 	}
3712 
3713 out:
3714 
3715 	if (inode)
3716 		iput(inode);
3717 	else if (mi != mi2_child)
3718 		mi_put(mi);
3719 
3720 	kfree(buffer_le);
3721 
3722 	return err;
3723 
3724 dirty_vol:
3725 	log->set_dirty = true;
3726 	goto out;
3727 }
3728 
3729 /*
3730  * log_replay - Replays log and empties it.
3731  *
3732  * This function is called during mount operation.
3733  * It replays log and empties it.
3734  * Initialized is set false if logfile contains '-1'.
3735  */
log_replay(struct ntfs_inode * ni,bool * initialized)3736 int log_replay(struct ntfs_inode *ni, bool *initialized)
3737 {
3738 	int err;
3739 	struct ntfs_sb_info *sbi = ni->mi.sbi;
3740 	struct ntfs_log *log;
3741 
3742 	u64 rec_lsn, checkpt_lsn = 0, rlsn = 0;
3743 	struct ATTR_NAME_ENTRY *attr_names = NULL;
3744 	u32 attr_names_bytes = 0;
3745 	u32 oatbl_bytes = 0;
3746 	struct RESTART_TABLE *dptbl = NULL;
3747 	struct RESTART_TABLE *trtbl = NULL;
3748 	const struct RESTART_TABLE *rt;
3749 	struct RESTART_TABLE *oatbl = NULL;
3750 	struct inode *inode;
3751 	struct OpenAttr *oa;
3752 	struct ntfs_inode *ni_oe;
3753 	struct ATTRIB *attr = NULL;
3754 	u64 size, vcn, undo_next_lsn;
3755 	CLST rno, lcn, lcn0, len0, clen;
3756 	void *data;
3757 	struct NTFS_RESTART *rst = NULL;
3758 	struct lcb *lcb = NULL;
3759 	struct OPEN_ATTR_ENRTY *oe;
3760 	struct ATTR_NAME_ENTRY *ane;
3761 	struct TRANSACTION_ENTRY *tr;
3762 	struct DIR_PAGE_ENTRY *dp;
3763 	u32 i, bytes_per_attr_entry;
3764 	u32 vbo, tail, off, dlen;
3765 	u32 saved_len, rec_len, transact_id;
3766 	bool use_second_page;
3767 	struct RESTART_AREA *ra2, *ra = NULL;
3768 	struct CLIENT_REC *ca, *cr;
3769 	__le16 client;
3770 	struct RESTART_HDR *rh;
3771 	const struct LFS_RECORD_HDR *frh;
3772 	const struct LOG_REC_HDR *lrh;
3773 	bool is_mapped;
3774 	bool is_ro = sb_rdonly(sbi->sb);
3775 	u64 t64;
3776 	u16 t16;
3777 	u32 t32;
3778 
3779 	log = kzalloc(sizeof(struct ntfs_log), GFP_NOFS);
3780 	if (!log)
3781 		return -ENOMEM;
3782 
3783 	log->ni = ni;
3784 	log->l_size = log->orig_file_size = ni->vfs_inode.i_size;
3785 
3786 	/* Get the size of page. NOTE: To replay we can use default page. */
3787 #if PAGE_SIZE >= DefaultLogPageSize && PAGE_SIZE <= DefaultLogPageSize * 2
3788 	log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, true);
3789 #else
3790 	log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, false);
3791 #endif
3792 	if (!log->page_size) {
3793 		err = -EINVAL;
3794 		goto out;
3795 	}
3796 
3797 	log->one_page_buf = kmalloc(log->page_size, GFP_NOFS);
3798 	if (!log->one_page_buf) {
3799 		err = -ENOMEM;
3800 		goto out;
3801 	}
3802 
3803 	log->page_mask = log->page_size - 1;
3804 	log->page_bits = blksize_bits(log->page_size);
3805 
3806 	/* Look for a restart area on the disk. */
3807 	err = log_read_rst(log, true, &log->rst_info);
3808 	if (err)
3809 		goto out;
3810 
3811 	/* remember 'initialized' */
3812 	*initialized = log->rst_info.initialized;
3813 
3814 	if (!log->rst_info.restart) {
3815 		if (log->rst_info.initialized) {
3816 			/* No restart area but the file is not initialized. */
3817 			err = -EINVAL;
3818 			goto out;
3819 		}
3820 
3821 		log_init_pg_hdr(log, 1, 1);
3822 		log_create(log, 0, get_random_u32(), false, false);
3823 
3824 		ra = log_create_ra(log);
3825 		if (!ra) {
3826 			err = -ENOMEM;
3827 			goto out;
3828 		}
3829 		log->ra = ra;
3830 		log->init_ra = true;
3831 
3832 		goto process_log;
3833 	}
3834 
3835 	/*
3836 	 * If the restart offset above wasn't zero then we won't
3837 	 * look for a second restart.
3838 	 */
3839 	if (log->rst_info.vbo)
3840 		goto check_restart_area;
3841 
3842 	err = log_read_rst(log, false, &log->rst_info2);
3843 	if (err)
3844 		goto out;
3845 
3846 	/* Determine which restart area to use. */
3847 	if (!log->rst_info2.restart ||
3848 	    log->rst_info2.last_lsn <= log->rst_info.last_lsn)
3849 		goto use_first_page;
3850 
3851 	use_second_page = true;
3852 
3853 	if (log->rst_info.chkdsk_was_run &&
3854 	    log->page_size != log->rst_info.vbo) {
3855 		struct RECORD_PAGE_HDR *sp = NULL;
3856 		bool usa_error;
3857 
3858 		if (!read_log_page(log, log->page_size, &sp, &usa_error) &&
3859 		    sp->rhdr.sign == NTFS_CHKD_SIGNATURE) {
3860 			use_second_page = false;
3861 		}
3862 		kfree(sp);
3863 	}
3864 
3865 	if (use_second_page) {
3866 		kfree(log->rst_info.r_page);
3867 		memcpy(&log->rst_info, &log->rst_info2,
3868 		       sizeof(struct restart_info));
3869 		log->rst_info2.r_page = NULL;
3870 	}
3871 
3872 use_first_page:
3873 	kfree(log->rst_info2.r_page);
3874 
3875 check_restart_area:
3876 	/*
3877 	 * If the restart area is at offset 0, we want
3878 	 * to write the second restart area first.
3879 	 */
3880 	log->init_ra = !!log->rst_info.vbo;
3881 
3882 	/* If we have a valid page then grab a pointer to the restart area. */
3883 	ra2 = log->rst_info.valid_page ?
3884 		      Add2Ptr(log->rst_info.r_page,
3885 			      le16_to_cpu(log->rst_info.r_page->ra_off)) :
3886 		      NULL;
3887 
3888 	if (log->rst_info.chkdsk_was_run ||
3889 	    (ra2 && ra2->client_idx[1] == LFS_NO_CLIENT_LE)) {
3890 		bool wrapped = false;
3891 		bool use_multi_page = false;
3892 		u32 open_log_count;
3893 
3894 		/* Do some checks based on whether we have a valid log page. */
3895 		open_log_count = log->rst_info.valid_page ?
3896 					 le32_to_cpu(ra2->open_log_count) :
3897 					 get_random_u32();
3898 
3899 		log_init_pg_hdr(log, 1, 1);
3900 
3901 		log_create(log, log->rst_info.last_lsn, open_log_count, wrapped,
3902 			   use_multi_page);
3903 
3904 		ra = log_create_ra(log);
3905 		if (!ra) {
3906 			err = -ENOMEM;
3907 			goto out;
3908 		}
3909 		log->ra = ra;
3910 
3911 		/* Put the restart areas and initialize
3912 		 * the log file as required.
3913 		 */
3914 		goto process_log;
3915 	}
3916 
3917 	if (!ra2) {
3918 		err = -EINVAL;
3919 		goto out;
3920 	}
3921 
3922 	/*
3923 	 * If the log page or the system page sizes have changed, we can't
3924 	 * use the log file. We must use the system page size instead of the
3925 	 * default size if there is not a clean shutdown.
3926 	 */
3927 	t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);
3928 	if (log->page_size != t32) {
3929 		log->l_size = log->orig_file_size;
3930 		log->page_size = norm_file_page(t32, &log->l_size,
3931 						t32 == DefaultLogPageSize);
3932 	}
3933 
3934 	if (log->page_size != t32 ||
3935 	    log->page_size != le32_to_cpu(log->rst_info.r_page->page_size)) {
3936 		err = -EINVAL;
3937 		goto out;
3938 	}
3939 
3940 	log->page_mask = log->page_size - 1;
3941 	log->page_bits = blksize_bits(log->page_size);
3942 
3943 	/* If the file size has shrunk then we won't mount it. */
3944 	if (log->l_size < le64_to_cpu(ra2->l_size)) {
3945 		err = -EINVAL;
3946 		goto out;
3947 	}
3948 
3949 	log_init_pg_hdr(log, le16_to_cpu(log->rst_info.r_page->major_ver),
3950 			le16_to_cpu(log->rst_info.r_page->minor_ver));
3951 
3952 	log->l_size = le64_to_cpu(ra2->l_size);
3953 	log->seq_num_bits = le32_to_cpu(ra2->seq_num_bits);
3954 	log->file_data_bits = sizeof(u64) * 8 - log->seq_num_bits;
3955 	log->seq_num_mask = (8 << log->file_data_bits) - 1;
3956 	log->last_lsn = le64_to_cpu(ra2->current_lsn);
3957 	log->seq_num = log->last_lsn >> log->file_data_bits;
3958 	log->ra_off = le16_to_cpu(log->rst_info.r_page->ra_off);
3959 	log->restart_size = log->sys_page_size - log->ra_off;
3960 	log->record_header_len = le16_to_cpu(ra2->rec_hdr_len);
3961 	log->ra_size = le16_to_cpu(ra2->ra_len);
3962 	log->data_off = le16_to_cpu(ra2->data_off);
3963 	log->data_size = log->page_size - log->data_off;
3964 	log->reserved = log->data_size - log->record_header_len;
3965 
3966 	vbo = lsn_to_vbo(log, log->last_lsn);
3967 
3968 	if (vbo < log->first_page) {
3969 		/* This is a pseudo lsn. */
3970 		log->l_flags |= NTFSLOG_NO_LAST_LSN;
3971 		log->next_page = log->first_page;
3972 		goto find_oldest;
3973 	}
3974 
3975 	/* Find the end of this log record. */
3976 	off = final_log_off(log, log->last_lsn,
3977 			    le32_to_cpu(ra2->last_lsn_data_len));
3978 
3979 	/* If we wrapped the file then increment the sequence number. */
3980 	if (off <= vbo) {
3981 		log->seq_num += 1;
3982 		log->l_flags |= NTFSLOG_WRAPPED;
3983 	}
3984 
3985 	/* Now compute the next log page to use. */
3986 	vbo &= ~log->sys_page_mask;
3987 	tail = log->page_size - (off & log->page_mask) - 1;
3988 
3989 	/*
3990 	 *If we can fit another log record on the page,
3991 	 * move back a page the log file.
3992 	 */
3993 	if (tail >= log->record_header_len) {
3994 		log->l_flags |= NTFSLOG_REUSE_TAIL;
3995 		log->next_page = vbo;
3996 	} else {
3997 		log->next_page = next_page_off(log, vbo);
3998 	}
3999 
4000 find_oldest:
4001 	/*
4002 	 * Find the oldest client lsn. Use the last
4003 	 * flushed lsn as a starting point.
4004 	 */
4005 	log->oldest_lsn = log->last_lsn;
4006 	oldest_client_lsn(Add2Ptr(ra2, le16_to_cpu(ra2->client_off)),
4007 			  ra2->client_idx[1], &log->oldest_lsn);
4008 	log->oldest_lsn_off = lsn_to_vbo(log, log->oldest_lsn);
4009 
4010 	if (log->oldest_lsn_off < log->first_page)
4011 		log->l_flags |= NTFSLOG_NO_OLDEST_LSN;
4012 
4013 	if (!(ra2->flags & RESTART_SINGLE_PAGE_IO))
4014 		log->l_flags |= NTFSLOG_WRAPPED | NTFSLOG_MULTIPLE_PAGE_IO;
4015 
4016 	log->current_openlog_count = le32_to_cpu(ra2->open_log_count);
4017 	log->total_avail_pages = log->l_size - log->first_page;
4018 	log->total_avail = log->total_avail_pages >> log->page_bits;
4019 	log->max_current_avail = log->total_avail * log->reserved;
4020 	log->total_avail = log->total_avail * log->data_size;
4021 
4022 	log->current_avail = current_log_avail(log);
4023 
4024 	ra = kzalloc(log->restart_size, GFP_NOFS);
4025 	if (!ra) {
4026 		err = -ENOMEM;
4027 		goto out;
4028 	}
4029 	log->ra = ra;
4030 
4031 	t16 = le16_to_cpu(ra2->client_off);
4032 	if (t16 == offsetof(struct RESTART_AREA, clients)) {
4033 		memcpy(ra, ra2, log->ra_size);
4034 	} else {
4035 		memcpy(ra, ra2, offsetof(struct RESTART_AREA, clients));
4036 		memcpy(ra->clients, Add2Ptr(ra2, t16),
4037 		       le16_to_cpu(ra2->ra_len) - t16);
4038 
4039 		log->current_openlog_count = get_random_u32();
4040 		ra->open_log_count = cpu_to_le32(log->current_openlog_count);
4041 		log->ra_size = offsetof(struct RESTART_AREA, clients) +
4042 			       sizeof(struct CLIENT_REC);
4043 		ra->client_off =
4044 			cpu_to_le16(offsetof(struct RESTART_AREA, clients));
4045 		ra->ra_len = cpu_to_le16(log->ra_size);
4046 	}
4047 
4048 	le32_add_cpu(&ra->open_log_count, 1);
4049 
4050 	/* Now we need to walk through looking for the last lsn. */
4051 	err = last_log_lsn(log);
4052 	if (err)
4053 		goto out;
4054 
4055 	log->current_avail = current_log_avail(log);
4056 
4057 	/* Remember which restart area to write first. */
4058 	log->init_ra = log->rst_info.vbo;
4059 
4060 process_log:
4061 	/* 1.0, 1.1, 2.0 log->major_ver/minor_ver - short values. */
4062 	switch ((log->major_ver << 16) + log->minor_ver) {
4063 	case 0x10000:
4064 	case 0x10001:
4065 	case 0x20000:
4066 		break;
4067 	default:
4068 		ntfs_warn(sbi->sb, "\x24LogFile version %d.%d is not supported",
4069 			  log->major_ver, log->minor_ver);
4070 		err = -EOPNOTSUPP;
4071 		log->set_dirty = true;
4072 		goto out;
4073 	}
4074 
4075 	/* One client "NTFS" per logfile. */
4076 	ca = Add2Ptr(ra, le16_to_cpu(ra->client_off));
4077 
4078 	for (client = ra->client_idx[1];; client = cr->next_client) {
4079 		if (client == LFS_NO_CLIENT_LE) {
4080 			/* Insert "NTFS" client LogFile. */
4081 			client = ra->client_idx[0];
4082 			if (client == LFS_NO_CLIENT_LE) {
4083 				err = -EINVAL;
4084 				goto out;
4085 			}
4086 
4087 			t16 = le16_to_cpu(client);
4088 			cr = ca + t16;
4089 
4090 			remove_client(ca, cr, &ra->client_idx[0]);
4091 
4092 			cr->restart_lsn = 0;
4093 			cr->oldest_lsn = cpu_to_le64(log->oldest_lsn);
4094 			cr->name_bytes = cpu_to_le32(8);
4095 			cr->name[0] = cpu_to_le16('N');
4096 			cr->name[1] = cpu_to_le16('T');
4097 			cr->name[2] = cpu_to_le16('F');
4098 			cr->name[3] = cpu_to_le16('S');
4099 
4100 			add_client(ca, t16, &ra->client_idx[1]);
4101 			break;
4102 		}
4103 
4104 		cr = ca + le16_to_cpu(client);
4105 
4106 		if (cpu_to_le32(8) == cr->name_bytes &&
4107 		    cpu_to_le16('N') == cr->name[0] &&
4108 		    cpu_to_le16('T') == cr->name[1] &&
4109 		    cpu_to_le16('F') == cr->name[2] &&
4110 		    cpu_to_le16('S') == cr->name[3])
4111 			break;
4112 	}
4113 
4114 	/* Update the client handle with the client block information. */
4115 	log->client_id.seq_num = cr->seq_num;
4116 	log->client_id.client_idx = client;
4117 
4118 	err = read_rst_area(log, &rst, &checkpt_lsn);
4119 	if (err)
4120 		goto out;
4121 
4122 	if (!rst)
4123 		goto out;
4124 
4125 	bytes_per_attr_entry = !rst->major_ver ? 0x2C : 0x28;
4126 
4127 	if (rst->check_point_start)
4128 		checkpt_lsn = le64_to_cpu(rst->check_point_start);
4129 
4130 	/* Allocate and Read the Transaction Table. */
4131 	if (!rst->transact_table_len)
4132 		goto check_dirty_page_table;
4133 
4134 	t64 = le64_to_cpu(rst->transact_table_lsn);
4135 	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4136 	if (err)
4137 		goto out;
4138 
4139 	lrh = lcb->log_rec;
4140 	frh = lcb->lrh;
4141 	rec_len = le32_to_cpu(frh->client_data_len);
4142 
4143 	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4144 			   bytes_per_attr_entry)) {
4145 		err = -EINVAL;
4146 		goto out;
4147 	}
4148 
4149 	t16 = le16_to_cpu(lrh->redo_off);
4150 
4151 	rt = Add2Ptr(lrh, t16);
4152 	t32 = rec_len - t16;
4153 
4154 	/* Now check that this is a valid restart table. */
4155 	if (!check_rstbl(rt, t32)) {
4156 		err = -EINVAL;
4157 		goto out;
4158 	}
4159 
4160 	trtbl = kmemdup(rt, t32, GFP_NOFS);
4161 	if (!trtbl) {
4162 		err = -ENOMEM;
4163 		goto out;
4164 	}
4165 
4166 	lcb_put(lcb);
4167 	lcb = NULL;
4168 
4169 check_dirty_page_table:
4170 	/* The next record back should be the Dirty Pages Table. */
4171 	if (!rst->dirty_pages_len)
4172 		goto check_attribute_names;
4173 
4174 	t64 = le64_to_cpu(rst->dirty_pages_table_lsn);
4175 	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4176 	if (err)
4177 		goto out;
4178 
4179 	lrh = lcb->log_rec;
4180 	frh = lcb->lrh;
4181 	rec_len = le32_to_cpu(frh->client_data_len);
4182 
4183 	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4184 			   bytes_per_attr_entry)) {
4185 		err = -EINVAL;
4186 		goto out;
4187 	}
4188 
4189 	t16 = le16_to_cpu(lrh->redo_off);
4190 
4191 	rt = Add2Ptr(lrh, t16);
4192 	t32 = rec_len - t16;
4193 
4194 	/* Now check that this is a valid restart table. */
4195 	if (!check_rstbl(rt, t32)) {
4196 		err = -EINVAL;
4197 		goto out;
4198 	}
4199 
4200 	dptbl = kmemdup(rt, t32, GFP_NOFS);
4201 	if (!dptbl) {
4202 		err = -ENOMEM;
4203 		goto out;
4204 	}
4205 
4206 	/* Convert Ra version '0' into version '1'. */
4207 	if (rst->major_ver)
4208 		goto end_conv_1;
4209 
4210 	dp = NULL;
4211 	while ((dp = enum_rstbl(dptbl, dp))) {
4212 		struct DIR_PAGE_ENTRY_32 *dp0 = (struct DIR_PAGE_ENTRY_32 *)dp;
4213 		// NOTE: Danger. Check for of boundary.
4214 		memmove(&dp->vcn, &dp0->vcn_low,
4215 			2 * sizeof(u64) +
4216 				le32_to_cpu(dp->lcns_follow) * sizeof(u64));
4217 	}
4218 
4219 end_conv_1:
4220 	lcb_put(lcb);
4221 	lcb = NULL;
4222 
4223 	/*
4224 	 * Go through the table and remove the duplicates,
4225 	 * remembering the oldest lsn values.
4226 	 */
4227 	if (sbi->cluster_size <= log->page_size)
4228 		goto trace_dp_table;
4229 
4230 	dp = NULL;
4231 	while ((dp = enum_rstbl(dptbl, dp))) {
4232 		struct DIR_PAGE_ENTRY *next = dp;
4233 
4234 		while ((next = enum_rstbl(dptbl, next))) {
4235 			if (next->target_attr == dp->target_attr &&
4236 			    next->vcn == dp->vcn) {
4237 				if (le64_to_cpu(next->oldest_lsn) <
4238 				    le64_to_cpu(dp->oldest_lsn)) {
4239 					dp->oldest_lsn = next->oldest_lsn;
4240 				}
4241 
4242 				free_rsttbl_idx(dptbl, PtrOffset(dptbl, next));
4243 			}
4244 		}
4245 	}
4246 trace_dp_table:
4247 check_attribute_names:
4248 	/* The next record should be the Attribute Names. */
4249 	if (!rst->attr_names_len)
4250 		goto check_attr_table;
4251 
4252 	t64 = le64_to_cpu(rst->attr_names_lsn);
4253 	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4254 	if (err)
4255 		goto out;
4256 
4257 	lrh = lcb->log_rec;
4258 	frh = lcb->lrh;
4259 	rec_len = le32_to_cpu(frh->client_data_len);
4260 
4261 	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4262 			   bytes_per_attr_entry)) {
4263 		err = -EINVAL;
4264 		goto out;
4265 	}
4266 
4267 	t32 = lrh_length(lrh);
4268 	rec_len -= t32;
4269 
4270 	attr_names = kmemdup(Add2Ptr(lrh, t32), rec_len, GFP_NOFS);
4271 	if (!attr_names) {
4272 		err = -ENOMEM;
4273 		goto out;
4274 	}
4275 
4276 	lcb_put(lcb);
4277 	lcb = NULL;
4278 
4279 check_attr_table:
4280 	/* The next record should be the attribute Table. */
4281 	if (!rst->open_attr_len)
4282 		goto check_attribute_names2;
4283 
4284 	t64 = le64_to_cpu(rst->open_attr_table_lsn);
4285 	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4286 	if (err)
4287 		goto out;
4288 
4289 	lrh = lcb->log_rec;
4290 	frh = lcb->lrh;
4291 	rec_len = le32_to_cpu(frh->client_data_len);
4292 
4293 	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4294 			   bytes_per_attr_entry)) {
4295 		err = -EINVAL;
4296 		goto out;
4297 	}
4298 
4299 	t16 = le16_to_cpu(lrh->redo_off);
4300 
4301 	rt = Add2Ptr(lrh, t16);
4302 	t32 = rec_len - t16;
4303 
4304 	if (!check_rstbl(rt, t32)) {
4305 		err = -EINVAL;
4306 		goto out;
4307 	}
4308 
4309 	oatbl = kmemdup(rt, t32, GFP_NOFS);
4310 	if (!oatbl) {
4311 		err = -ENOMEM;
4312 		goto out;
4313 	}
4314 
4315 	log->open_attr_tbl = oatbl;
4316 
4317 	/* Clear all of the Attr pointers. */
4318 	oe = NULL;
4319 	while ((oe = enum_rstbl(oatbl, oe))) {
4320 		if (!rst->major_ver) {
4321 			struct OPEN_ATTR_ENRTY_32 oe0;
4322 
4323 			/* Really 'oe' points to OPEN_ATTR_ENRTY_32. */
4324 			memcpy(&oe0, oe, SIZEOF_OPENATTRIBUTEENTRY0);
4325 
4326 			oe->bytes_per_index = oe0.bytes_per_index;
4327 			oe->type = oe0.type;
4328 			oe->is_dirty_pages = oe0.is_dirty_pages;
4329 			oe->name_len = 0;
4330 			oe->ref = oe0.ref;
4331 			oe->open_record_lsn = oe0.open_record_lsn;
4332 		}
4333 
4334 		oe->is_attr_name = 0;
4335 		oe->ptr = NULL;
4336 	}
4337 
4338 	lcb_put(lcb);
4339 	lcb = NULL;
4340 
4341 check_attribute_names2:
4342 	if (attr_names && oatbl) {
4343 		off = 0;
4344 		for (;;) {
4345 			/* Check we can use attribute name entry 'ane'. */
4346 			static_assert(sizeof(*ane) == 4);
4347 			if (off + sizeof(*ane) > attr_names_bytes) {
4348 				/* just ignore the rest. */
4349 				break;
4350 			}
4351 
4352 			ane = Add2Ptr(attr_names, off);
4353 			t16 = le16_to_cpu(ane->off);
4354 			if (!t16) {
4355 				/* this is the only valid exit. */
4356 				break;
4357 			}
4358 
4359 			/* Check we can use open attribute entry 'oe'. */
4360 			if (t16 + sizeof(*oe) > oatbl_bytes) {
4361 				/* just ignore the rest. */
4362 				break;
4363 			}
4364 
4365 			/* TODO: Clear table on exit! */
4366 			oe = Add2Ptr(oatbl, t16);
4367 			t16 = le16_to_cpu(ane->name_bytes);
4368 			off += t16 + sizeof(*ane);
4369 			if (off > attr_names_bytes) {
4370 				/* just ignore the rest. */
4371 				break;
4372 			}
4373 			oe->name_len = t16 / sizeof(short);
4374 			oe->ptr = ane->name;
4375 			oe->is_attr_name = 2;
4376 		}
4377 	}
4378 
4379 	/*
4380 	 * If the checkpt_lsn is zero, then this is a freshly
4381 	 * formatted disk and we have no work to do.
4382 	 */
4383 	if (!checkpt_lsn) {
4384 		err = 0;
4385 		goto out;
4386 	}
4387 
4388 	if (!oatbl) {
4389 		oatbl = init_rsttbl(bytes_per_attr_entry, 8);
4390 		if (!oatbl) {
4391 			err = -ENOMEM;
4392 			goto out;
4393 		}
4394 	}
4395 
4396 	log->open_attr_tbl = oatbl;
4397 
4398 	/* Start the analysis pass from the Checkpoint lsn. */
4399 	rec_lsn = checkpt_lsn;
4400 
4401 	/* Read the first lsn. */
4402 	err = read_log_rec_lcb(log, checkpt_lsn, lcb_ctx_next, &lcb);
4403 	if (err)
4404 		goto out;
4405 
4406 	/* Loop to read all subsequent records to the end of the log file. */
4407 next_log_record_analyze:
4408 	err = read_next_log_rec(log, lcb, &rec_lsn);
4409 	if (err)
4410 		goto out;
4411 
4412 	if (!rec_lsn)
4413 		goto end_log_records_enumerate;
4414 
4415 	frh = lcb->lrh;
4416 	transact_id = le32_to_cpu(frh->transact_id);
4417 	rec_len = le32_to_cpu(frh->client_data_len);
4418 	lrh = lcb->log_rec;
4419 
4420 	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
4421 		err = -EINVAL;
4422 		goto out;
4423 	}
4424 
4425 	/*
4426 	 * The first lsn after the previous lsn remembered
4427 	 * the checkpoint is the first candidate for the rlsn.
4428 	 */
4429 	if (!rlsn)
4430 		rlsn = rec_lsn;
4431 
4432 	if (LfsClientRecord != frh->record_type)
4433 		goto next_log_record_analyze;
4434 
4435 	/*
4436 	 * Now update the Transaction Table for this transaction. If there
4437 	 * is no entry present or it is unallocated we allocate the entry.
4438 	 */
4439 	if (!trtbl) {
4440 		trtbl = init_rsttbl(sizeof(struct TRANSACTION_ENTRY),
4441 				    INITIAL_NUMBER_TRANSACTIONS);
4442 		if (!trtbl) {
4443 			err = -ENOMEM;
4444 			goto out;
4445 		}
4446 	}
4447 
4448 	tr = Add2Ptr(trtbl, transact_id);
4449 
4450 	if (transact_id >= bytes_per_rt(trtbl) ||
4451 	    tr->next != RESTART_ENTRY_ALLOCATED_LE) {
4452 		tr = alloc_rsttbl_from_idx(&trtbl, transact_id);
4453 		if (!tr) {
4454 			err = -ENOMEM;
4455 			goto out;
4456 		}
4457 		tr->transact_state = TransactionActive;
4458 		tr->first_lsn = cpu_to_le64(rec_lsn);
4459 	}
4460 
4461 	tr->prev_lsn = tr->undo_next_lsn = cpu_to_le64(rec_lsn);
4462 
4463 	/*
4464 	 * If this is a compensation log record, then change
4465 	 * the undo_next_lsn to be the undo_next_lsn of this record.
4466 	 */
4467 	if (lrh->undo_op == cpu_to_le16(CompensationLogRecord))
4468 		tr->undo_next_lsn = frh->client_undo_next_lsn;
4469 
4470 	/* Dispatch to handle log record depending on type. */
4471 	switch (le16_to_cpu(lrh->redo_op)) {
4472 	case InitializeFileRecordSegment:
4473 	case DeallocateFileRecordSegment:
4474 	case WriteEndOfFileRecordSegment:
4475 	case CreateAttribute:
4476 	case DeleteAttribute:
4477 	case UpdateResidentValue:
4478 	case UpdateNonresidentValue:
4479 	case UpdateMappingPairs:
4480 	case SetNewAttributeSizes:
4481 	case AddIndexEntryRoot:
4482 	case DeleteIndexEntryRoot:
4483 	case AddIndexEntryAllocation:
4484 	case DeleteIndexEntryAllocation:
4485 	case WriteEndOfIndexBuffer:
4486 	case SetIndexEntryVcnRoot:
4487 	case SetIndexEntryVcnAllocation:
4488 	case UpdateFileNameRoot:
4489 	case UpdateFileNameAllocation:
4490 	case SetBitsInNonresidentBitMap:
4491 	case ClearBitsInNonresidentBitMap:
4492 	case UpdateRecordDataRoot:
4493 	case UpdateRecordDataAllocation:
4494 	case ZeroEndOfFileRecord:
4495 		t16 = le16_to_cpu(lrh->target_attr);
4496 		t64 = le64_to_cpu(lrh->target_vcn);
4497 		dp = find_dp(dptbl, t16, t64);
4498 
4499 		if (dp)
4500 			goto copy_lcns;
4501 
4502 		/*
4503 		 * Calculate the number of clusters per page the system
4504 		 * which wrote the checkpoint, possibly creating the table.
4505 		 */
4506 		if (dptbl) {
4507 			t32 = (le16_to_cpu(dptbl->size) -
4508 			       sizeof(struct DIR_PAGE_ENTRY)) /
4509 			      sizeof(u64);
4510 		} else {
4511 			t32 = log->clst_per_page;
4512 			kfree(dptbl);
4513 			dptbl = init_rsttbl(struct_size(dp, page_lcns, t32),
4514 					    32);
4515 			if (!dptbl) {
4516 				err = -ENOMEM;
4517 				goto out;
4518 			}
4519 		}
4520 
4521 		dp = alloc_rsttbl_idx(&dptbl);
4522 		if (!dp) {
4523 			err = -ENOMEM;
4524 			goto out;
4525 		}
4526 		dp->target_attr = cpu_to_le32(t16);
4527 		dp->transfer_len = cpu_to_le32(t32 << sbi->cluster_bits);
4528 		dp->lcns_follow = cpu_to_le32(t32);
4529 		dp->vcn = cpu_to_le64(t64 & ~((u64)t32 - 1));
4530 		dp->oldest_lsn = cpu_to_le64(rec_lsn);
4531 
4532 copy_lcns:
4533 		/*
4534 		 * Copy the Lcns from the log record into the Dirty Page Entry.
4535 		 * TODO: For different page size support, must somehow make
4536 		 * whole routine a loop, case Lcns do not fit below.
4537 		 */
4538 		t16 = le16_to_cpu(lrh->lcns_follow);
4539 		for (i = 0; i < t16; i++) {
4540 			size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
4541 					    le64_to_cpu(dp->vcn));
4542 			dp->page_lcns[j + i] = lrh->page_lcns[i];
4543 		}
4544 
4545 		goto next_log_record_analyze;
4546 
4547 	case DeleteDirtyClusters: {
4548 		u32 range_count =
4549 			le16_to_cpu(lrh->redo_len) / sizeof(struct LCN_RANGE);
4550 		const struct LCN_RANGE *r =
4551 			Add2Ptr(lrh, le16_to_cpu(lrh->redo_off));
4552 
4553 		/* Loop through all of the Lcn ranges this log record. */
4554 		for (i = 0; i < range_count; i++, r++) {
4555 			u64 lcn0 = le64_to_cpu(r->lcn);
4556 			u64 lcn_e = lcn0 + le64_to_cpu(r->len) - 1;
4557 
4558 			dp = NULL;
4559 			while ((dp = enum_rstbl(dptbl, dp))) {
4560 				u32 j;
4561 
4562 				t32 = le32_to_cpu(dp->lcns_follow);
4563 				for (j = 0; j < t32; j++) {
4564 					t64 = le64_to_cpu(dp->page_lcns[j]);
4565 					if (t64 >= lcn0 && t64 <= lcn_e)
4566 						dp->page_lcns[j] = 0;
4567 				}
4568 			}
4569 		}
4570 		goto next_log_record_analyze;
4571 		;
4572 	}
4573 
4574 	case OpenNonresidentAttribute:
4575 		t16 = le16_to_cpu(lrh->target_attr);
4576 		if (t16 >= bytes_per_rt(oatbl)) {
4577 			/*
4578 			 * Compute how big the table needs to be.
4579 			 * Add 10 extra entries for some cushion.
4580 			 */
4581 			u32 new_e = t16 / le16_to_cpu(oatbl->size);
4582 
4583 			new_e += 10 - le16_to_cpu(oatbl->used);
4584 
4585 			oatbl = extend_rsttbl(oatbl, new_e, ~0u);
4586 			log->open_attr_tbl = oatbl;
4587 			if (!oatbl) {
4588 				err = -ENOMEM;
4589 				goto out;
4590 			}
4591 		}
4592 
4593 		/* Point to the entry being opened. */
4594 		oe = alloc_rsttbl_from_idx(&oatbl, t16);
4595 		log->open_attr_tbl = oatbl;
4596 		if (!oe) {
4597 			err = -ENOMEM;
4598 			goto out;
4599 		}
4600 
4601 		/* Initialize this entry from the log record. */
4602 		t16 = le16_to_cpu(lrh->redo_off);
4603 		if (!rst->major_ver) {
4604 			/* Convert version '0' into version '1'. */
4605 			struct OPEN_ATTR_ENRTY_32 *oe0 = Add2Ptr(lrh, t16);
4606 
4607 			oe->bytes_per_index = oe0->bytes_per_index;
4608 			oe->type = oe0->type;
4609 			oe->is_dirty_pages = oe0->is_dirty_pages;
4610 			oe->name_len = 0; //oe0.name_len;
4611 			oe->ref = oe0->ref;
4612 			oe->open_record_lsn = oe0->open_record_lsn;
4613 		} else {
4614 			memcpy(oe, Add2Ptr(lrh, t16), bytes_per_attr_entry);
4615 		}
4616 
4617 		t16 = le16_to_cpu(lrh->undo_len);
4618 		if (t16) {
4619 			oe->ptr = kmalloc(t16, GFP_NOFS);
4620 			if (!oe->ptr) {
4621 				err = -ENOMEM;
4622 				goto out;
4623 			}
4624 			oe->name_len = t16 / sizeof(short);
4625 			memcpy(oe->ptr,
4626 			       Add2Ptr(lrh, le16_to_cpu(lrh->undo_off)), t16);
4627 			oe->is_attr_name = 1;
4628 		} else {
4629 			oe->ptr = NULL;
4630 			oe->is_attr_name = 0;
4631 		}
4632 
4633 		goto next_log_record_analyze;
4634 
4635 	case HotFix:
4636 		t16 = le16_to_cpu(lrh->target_attr);
4637 		t64 = le64_to_cpu(lrh->target_vcn);
4638 		dp = find_dp(dptbl, t16, t64);
4639 		if (dp) {
4640 			size_t j = le64_to_cpu(lrh->target_vcn) -
4641 				   le64_to_cpu(dp->vcn);
4642 			if (dp->page_lcns[j])
4643 				dp->page_lcns[j] = lrh->page_lcns[0];
4644 		}
4645 		goto next_log_record_analyze;
4646 
4647 	case EndTopLevelAction:
4648 		tr = Add2Ptr(trtbl, transact_id);
4649 		tr->prev_lsn = cpu_to_le64(rec_lsn);
4650 		tr->undo_next_lsn = frh->client_undo_next_lsn;
4651 		goto next_log_record_analyze;
4652 
4653 	case PrepareTransaction:
4654 		tr = Add2Ptr(trtbl, transact_id);
4655 		tr->transact_state = TransactionPrepared;
4656 		goto next_log_record_analyze;
4657 
4658 	case CommitTransaction:
4659 		tr = Add2Ptr(trtbl, transact_id);
4660 		tr->transact_state = TransactionCommitted;
4661 		goto next_log_record_analyze;
4662 
4663 	case ForgetTransaction:
4664 		free_rsttbl_idx(trtbl, transact_id);
4665 		goto next_log_record_analyze;
4666 
4667 	case Noop:
4668 	case OpenAttributeTableDump:
4669 	case AttributeNamesDump:
4670 	case DirtyPageTableDump:
4671 	case TransactionTableDump:
4672 		/* The following cases require no action the Analysis Pass. */
4673 		goto next_log_record_analyze;
4674 
4675 	default:
4676 		/*
4677 		 * All codes will be explicitly handled.
4678 		 * If we see a code we do not expect, then we are trouble.
4679 		 */
4680 		goto next_log_record_analyze;
4681 	}
4682 
4683 end_log_records_enumerate:
4684 	lcb_put(lcb);
4685 	lcb = NULL;
4686 
4687 	/*
4688 	 * Scan the Dirty Page Table and Transaction Table for
4689 	 * the lowest lsn, and return it as the Redo lsn.
4690 	 */
4691 	dp = NULL;
4692 	while ((dp = enum_rstbl(dptbl, dp))) {
4693 		t64 = le64_to_cpu(dp->oldest_lsn);
4694 		if (t64 && t64 < rlsn)
4695 			rlsn = t64;
4696 	}
4697 
4698 	tr = NULL;
4699 	while ((tr = enum_rstbl(trtbl, tr))) {
4700 		t64 = le64_to_cpu(tr->first_lsn);
4701 		if (t64 && t64 < rlsn)
4702 			rlsn = t64;
4703 	}
4704 
4705 	/*
4706 	 * Only proceed if the Dirty Page Table or Transaction
4707 	 * table are not empty.
4708 	 */
4709 	if ((!dptbl || !dptbl->total) && (!trtbl || !trtbl->total))
4710 		goto end_reply;
4711 
4712 	sbi->flags |= NTFS_FLAGS_NEED_REPLAY;
4713 	if (is_ro)
4714 		goto out;
4715 
4716 	/* Reopen all of the attributes with dirty pages. */
4717 	oe = NULL;
4718 next_open_attribute:
4719 
4720 	oe = enum_rstbl(oatbl, oe);
4721 	if (!oe) {
4722 		err = 0;
4723 		dp = NULL;
4724 		goto next_dirty_page;
4725 	}
4726 
4727 	oa = kzalloc(sizeof(struct OpenAttr), GFP_NOFS);
4728 	if (!oa) {
4729 		err = -ENOMEM;
4730 		goto out;
4731 	}
4732 
4733 	inode = ntfs_iget5(sbi->sb, &oe->ref, NULL);
4734 	if (IS_ERR(inode))
4735 		goto fake_attr;
4736 
4737 	if (is_bad_inode(inode)) {
4738 		iput(inode);
4739 fake_attr:
4740 		if (oa->ni) {
4741 			iput(&oa->ni->vfs_inode);
4742 			oa->ni = NULL;
4743 		}
4744 
4745 		attr = attr_create_nonres_log(sbi, oe->type, 0, oe->ptr,
4746 					      oe->name_len, 0);
4747 		if (!attr) {
4748 			kfree(oa);
4749 			err = -ENOMEM;
4750 			goto out;
4751 		}
4752 		oa->attr = attr;
4753 		oa->run1 = &oa->run0;
4754 		goto final_oe;
4755 	}
4756 
4757 	ni_oe = ntfs_i(inode);
4758 	oa->ni = ni_oe;
4759 
4760 	attr = ni_find_attr(ni_oe, NULL, NULL, oe->type, oe->ptr, oe->name_len,
4761 			    NULL, NULL);
4762 
4763 	if (!attr)
4764 		goto fake_attr;
4765 
4766 	t32 = le32_to_cpu(attr->size);
4767 	oa->attr = kmemdup(attr, t32, GFP_NOFS);
4768 	if (!oa->attr)
4769 		goto fake_attr;
4770 
4771 	if (!S_ISDIR(inode->i_mode)) {
4772 		if (attr->type == ATTR_DATA && !attr->name_len) {
4773 			oa->run1 = &ni_oe->file.run;
4774 			goto final_oe;
4775 		}
4776 	} else {
4777 		if (attr->type == ATTR_ALLOC &&
4778 		    attr->name_len == ARRAY_SIZE(I30_NAME) &&
4779 		    !memcmp(attr_name(attr), I30_NAME, sizeof(I30_NAME))) {
4780 			oa->run1 = &ni_oe->dir.alloc_run;
4781 			goto final_oe;
4782 		}
4783 	}
4784 
4785 	if (attr->non_res) {
4786 		u16 roff = le16_to_cpu(attr->nres.run_off);
4787 		CLST svcn = le64_to_cpu(attr->nres.svcn);
4788 
4789 		if (roff > t32) {
4790 			kfree(oa->attr);
4791 			oa->attr = NULL;
4792 			goto fake_attr;
4793 		}
4794 
4795 		err = run_unpack(&oa->run0, sbi, inode->i_ino, svcn,
4796 				 le64_to_cpu(attr->nres.evcn), svcn,
4797 				 Add2Ptr(attr, roff), t32 - roff);
4798 		if (err < 0) {
4799 			kfree(oa->attr);
4800 			oa->attr = NULL;
4801 			goto fake_attr;
4802 		}
4803 		err = 0;
4804 	}
4805 	oa->run1 = &oa->run0;
4806 	attr = oa->attr;
4807 
4808 final_oe:
4809 	if (oe->is_attr_name == 1)
4810 		kfree(oe->ptr);
4811 	oe->is_attr_name = 0;
4812 	oe->ptr = oa;
4813 	oe->name_len = attr->name_len;
4814 
4815 	goto next_open_attribute;
4816 
4817 	/*
4818 	 * Now loop through the dirty page table to extract all of the Vcn/Lcn.
4819 	 * Mapping that we have, and insert it into the appropriate run.
4820 	 */
4821 next_dirty_page:
4822 	dp = enum_rstbl(dptbl, dp);
4823 	if (!dp)
4824 		goto do_redo_1;
4825 
4826 	oe = Add2Ptr(oatbl, le32_to_cpu(dp->target_attr));
4827 
4828 	if (oe->next != RESTART_ENTRY_ALLOCATED_LE)
4829 		goto next_dirty_page;
4830 
4831 	oa = oe->ptr;
4832 	if (!oa)
4833 		goto next_dirty_page;
4834 
4835 	i = -1;
4836 next_dirty_page_vcn:
4837 	i += 1;
4838 	if (i >= le32_to_cpu(dp->lcns_follow))
4839 		goto next_dirty_page;
4840 
4841 	vcn = le64_to_cpu(dp->vcn) + i;
4842 	size = (vcn + 1) << sbi->cluster_bits;
4843 
4844 	if (!dp->page_lcns[i])
4845 		goto next_dirty_page_vcn;
4846 
4847 	rno = ino_get(&oe->ref);
4848 	if (rno <= MFT_REC_MIRR &&
4849 	    size < (MFT_REC_VOL + 1) * sbi->record_size &&
4850 	    oe->type == ATTR_DATA) {
4851 		goto next_dirty_page_vcn;
4852 	}
4853 
4854 	lcn = le64_to_cpu(dp->page_lcns[i]);
4855 
4856 	if ((!run_lookup_entry(oa->run1, vcn, &lcn0, &len0, NULL) ||
4857 	     lcn0 != lcn) &&
4858 	    !run_add_entry(oa->run1, vcn, lcn, 1, false)) {
4859 		err = -ENOMEM;
4860 		goto out;
4861 	}
4862 	attr = oa->attr;
4863 	if (size > le64_to_cpu(attr->nres.alloc_size)) {
4864 		attr->nres.valid_size = attr->nres.data_size =
4865 			attr->nres.alloc_size = cpu_to_le64(size);
4866 	}
4867 	goto next_dirty_page_vcn;
4868 
4869 do_redo_1:
4870 	/*
4871 	 * Perform the Redo Pass, to restore all of the dirty pages to the same
4872 	 * contents that they had immediately before the crash. If the dirty
4873 	 * page table is empty, then we can skip the entire Redo Pass.
4874 	 */
4875 	if (!dptbl || !dptbl->total)
4876 		goto do_undo_action;
4877 
4878 	rec_lsn = rlsn;
4879 
4880 	/*
4881 	 * Read the record at the Redo lsn, before falling
4882 	 * into common code to handle each record.
4883 	 */
4884 	err = read_log_rec_lcb(log, rlsn, lcb_ctx_next, &lcb);
4885 	if (err)
4886 		goto out;
4887 
4888 	/*
4889 	 * Now loop to read all of our log records forwards, until
4890 	 * we hit the end of the file, cleaning up at the end.
4891 	 */
4892 do_action_next:
4893 	frh = lcb->lrh;
4894 
4895 	if (LfsClientRecord != frh->record_type)
4896 		goto read_next_log_do_action;
4897 
4898 	transact_id = le32_to_cpu(frh->transact_id);
4899 	rec_len = le32_to_cpu(frh->client_data_len);
4900 	lrh = lcb->log_rec;
4901 
4902 	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
4903 		err = -EINVAL;
4904 		goto out;
4905 	}
4906 
4907 	/* Ignore log records that do not update pages. */
4908 	if (lrh->lcns_follow)
4909 		goto find_dirty_page;
4910 
4911 	goto read_next_log_do_action;
4912 
4913 find_dirty_page:
4914 	t16 = le16_to_cpu(lrh->target_attr);
4915 	t64 = le64_to_cpu(lrh->target_vcn);
4916 	dp = find_dp(dptbl, t16, t64);
4917 
4918 	if (!dp)
4919 		goto read_next_log_do_action;
4920 
4921 	if (rec_lsn < le64_to_cpu(dp->oldest_lsn))
4922 		goto read_next_log_do_action;
4923 
4924 	t16 = le16_to_cpu(lrh->target_attr);
4925 	if (t16 >= bytes_per_rt(oatbl)) {
4926 		err = -EINVAL;
4927 		goto out;
4928 	}
4929 
4930 	oe = Add2Ptr(oatbl, t16);
4931 
4932 	if (oe->next != RESTART_ENTRY_ALLOCATED_LE) {
4933 		err = -EINVAL;
4934 		goto out;
4935 	}
4936 
4937 	oa = oe->ptr;
4938 
4939 	if (!oa) {
4940 		err = -EINVAL;
4941 		goto out;
4942 	}
4943 	attr = oa->attr;
4944 
4945 	vcn = le64_to_cpu(lrh->target_vcn);
4946 
4947 	if (!run_lookup_entry(oa->run1, vcn, &lcn, NULL, NULL) ||
4948 	    lcn == SPARSE_LCN) {
4949 		goto read_next_log_do_action;
4950 	}
4951 
4952 	/* Point to the Redo data and get its length. */
4953 	data = Add2Ptr(lrh, le16_to_cpu(lrh->redo_off));
4954 	dlen = le16_to_cpu(lrh->redo_len);
4955 
4956 	/* Shorten length by any Lcns which were deleted. */
4957 	saved_len = dlen;
4958 
4959 	for (i = le16_to_cpu(lrh->lcns_follow); i; i--) {
4960 		size_t j;
4961 		u32 alen, voff;
4962 
4963 		voff = le16_to_cpu(lrh->record_off) +
4964 		       le16_to_cpu(lrh->attr_off);
4965 		voff += le16_to_cpu(lrh->cluster_off) << SECTOR_SHIFT;
4966 
4967 		/* If the Vcn question is allocated, we can just get out. */
4968 		j = le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn);
4969 		if (dp->page_lcns[j + i - 1])
4970 			break;
4971 
4972 		if (!saved_len)
4973 			saved_len = 1;
4974 
4975 		/*
4976 		 * Calculate the allocated space left relative to the
4977 		 * log record Vcn, after removing this unallocated Vcn.
4978 		 */
4979 		alen = (i - 1) << sbi->cluster_bits;
4980 
4981 		/*
4982 		 * If the update described this log record goes beyond
4983 		 * the allocated space, then we will have to reduce the length.
4984 		 */
4985 		if (voff >= alen)
4986 			dlen = 0;
4987 		else if (voff + dlen > alen)
4988 			dlen = alen - voff;
4989 	}
4990 
4991 	/*
4992 	 * If the resulting dlen from above is now zero,
4993 	 * we can skip this log record.
4994 	 */
4995 	if (!dlen && saved_len)
4996 		goto read_next_log_do_action;
4997 
4998 	t16 = le16_to_cpu(lrh->redo_op);
4999 	if (can_skip_action(t16))
5000 		goto read_next_log_do_action;
5001 
5002 	/* Apply the Redo operation a common routine. */
5003 	err = do_action(log, oe, lrh, t16, data, dlen, rec_len, &rec_lsn);
5004 	if (err)
5005 		goto out;
5006 
5007 	/* Keep reading and looping back until end of file. */
5008 read_next_log_do_action:
5009 	err = read_next_log_rec(log, lcb, &rec_lsn);
5010 	if (!err && rec_lsn)
5011 		goto do_action_next;
5012 
5013 	lcb_put(lcb);
5014 	lcb = NULL;
5015 
5016 do_undo_action:
5017 	/* Scan Transaction Table. */
5018 	tr = NULL;
5019 transaction_table_next:
5020 	tr = enum_rstbl(trtbl, tr);
5021 	if (!tr)
5022 		goto undo_action_done;
5023 
5024 	if (TransactionActive != tr->transact_state || !tr->undo_next_lsn) {
5025 		free_rsttbl_idx(trtbl, PtrOffset(trtbl, tr));
5026 		goto transaction_table_next;
5027 	}
5028 
5029 	log->transaction_id = PtrOffset(trtbl, tr);
5030 	undo_next_lsn = le64_to_cpu(tr->undo_next_lsn);
5031 
5032 	/*
5033 	 * We only have to do anything if the transaction has
5034 	 * something its undo_next_lsn field.
5035 	 */
5036 	if (!undo_next_lsn)
5037 		goto commit_undo;
5038 
5039 	/* Read the first record to be undone by this transaction. */
5040 	err = read_log_rec_lcb(log, undo_next_lsn, lcb_ctx_undo_next, &lcb);
5041 	if (err)
5042 		goto out;
5043 
5044 	/*
5045 	 * Now loop to read all of our log records forwards,
5046 	 * until we hit the end of the file, cleaning up at the end.
5047 	 */
5048 undo_action_next:
5049 
5050 	lrh = lcb->log_rec;
5051 	frh = lcb->lrh;
5052 	transact_id = le32_to_cpu(frh->transact_id);
5053 	rec_len = le32_to_cpu(frh->client_data_len);
5054 
5055 	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
5056 		err = -EINVAL;
5057 		goto out;
5058 	}
5059 
5060 	if (lrh->undo_op == cpu_to_le16(Noop))
5061 		goto read_next_log_undo_action;
5062 
5063 	oe = Add2Ptr(oatbl, le16_to_cpu(lrh->target_attr));
5064 	oa = oe->ptr;
5065 
5066 	t16 = le16_to_cpu(lrh->lcns_follow);
5067 	if (!t16)
5068 		goto add_allocated_vcns;
5069 
5070 	is_mapped = run_lookup_entry(oa->run1, le64_to_cpu(lrh->target_vcn),
5071 				     &lcn, &clen, NULL);
5072 
5073 	/*
5074 	 * If the mapping isn't already the table or the  mapping
5075 	 * corresponds to a hole the mapping, we need to make sure
5076 	 * there is no partial page already memory.
5077 	 */
5078 	if (is_mapped && lcn != SPARSE_LCN && clen >= t16)
5079 		goto add_allocated_vcns;
5080 
5081 	vcn = le64_to_cpu(lrh->target_vcn);
5082 	vcn &= ~(u64)(log->clst_per_page - 1);
5083 
5084 add_allocated_vcns:
5085 	for (i = 0, vcn = le64_to_cpu(lrh->target_vcn),
5086 	    size = (vcn + 1) << sbi->cluster_bits;
5087 	     i < t16; i++, vcn += 1, size += sbi->cluster_size) {
5088 		attr = oa->attr;
5089 		if (!attr->non_res) {
5090 			if (size > le32_to_cpu(attr->res.data_size))
5091 				attr->res.data_size = cpu_to_le32(size);
5092 		} else {
5093 			if (size > le64_to_cpu(attr->nres.data_size))
5094 				attr->nres.valid_size = attr->nres.data_size =
5095 					attr->nres.alloc_size =
5096 						cpu_to_le64(size);
5097 		}
5098 	}
5099 
5100 	t16 = le16_to_cpu(lrh->undo_op);
5101 	if (can_skip_action(t16))
5102 		goto read_next_log_undo_action;
5103 
5104 	/* Point to the Redo data and get its length. */
5105 	data = Add2Ptr(lrh, le16_to_cpu(lrh->undo_off));
5106 	dlen = le16_to_cpu(lrh->undo_len);
5107 
5108 	/* It is time to apply the undo action. */
5109 	err = do_action(log, oe, lrh, t16, data, dlen, rec_len, NULL);
5110 
5111 read_next_log_undo_action:
5112 	/*
5113 	 * Keep reading and looping back until we have read the
5114 	 * last record for this transaction.
5115 	 */
5116 	err = read_next_log_rec(log, lcb, &rec_lsn);
5117 	if (err)
5118 		goto out;
5119 
5120 	if (rec_lsn)
5121 		goto undo_action_next;
5122 
5123 	lcb_put(lcb);
5124 	lcb = NULL;
5125 
5126 commit_undo:
5127 	free_rsttbl_idx(trtbl, log->transaction_id);
5128 
5129 	log->transaction_id = 0;
5130 
5131 	goto transaction_table_next;
5132 
5133 undo_action_done:
5134 
5135 	ntfs_update_mftmirr(sbi, 0);
5136 
5137 	sbi->flags &= ~NTFS_FLAGS_NEED_REPLAY;
5138 
5139 end_reply:
5140 
5141 	err = 0;
5142 	if (is_ro)
5143 		goto out;
5144 
5145 	rh = kzalloc(log->page_size, GFP_NOFS);
5146 	if (!rh) {
5147 		err = -ENOMEM;
5148 		goto out;
5149 	}
5150 
5151 	rh->rhdr.sign = NTFS_RSTR_SIGNATURE;
5152 	rh->rhdr.fix_off = cpu_to_le16(offsetof(struct RESTART_HDR, fixups));
5153 	t16 = (log->page_size >> SECTOR_SHIFT) + 1;
5154 	rh->rhdr.fix_num = cpu_to_le16(t16);
5155 	rh->sys_page_size = cpu_to_le32(log->page_size);
5156 	rh->page_size = cpu_to_le32(log->page_size);
5157 
5158 	t16 = ALIGN(offsetof(struct RESTART_HDR, fixups) + sizeof(short) * t16,
5159 		    8);
5160 	rh->ra_off = cpu_to_le16(t16);
5161 	rh->minor_ver = cpu_to_le16(1); // 0x1A:
5162 	rh->major_ver = cpu_to_le16(1); // 0x1C:
5163 
5164 	ra2 = Add2Ptr(rh, t16);
5165 	memcpy(ra2, ra, sizeof(struct RESTART_AREA));
5166 
5167 	ra2->client_idx[0] = 0;
5168 	ra2->client_idx[1] = LFS_NO_CLIENT_LE;
5169 	ra2->flags = cpu_to_le16(2);
5170 
5171 	le32_add_cpu(&ra2->open_log_count, 1);
5172 
5173 	ntfs_fix_pre_write(&rh->rhdr, log->page_size);
5174 
5175 	err = ntfs_sb_write_run(sbi, &ni->file.run, 0, rh, log->page_size, 0);
5176 	if (!err)
5177 		err = ntfs_sb_write_run(sbi, &log->ni->file.run, log->page_size,
5178 					rh, log->page_size, 0);
5179 
5180 	kfree(rh);
5181 	if (err)
5182 		goto out;
5183 
5184 out:
5185 	kfree(rst);
5186 	if (lcb)
5187 		lcb_put(lcb);
5188 
5189 	/*
5190 	 * Scan the Open Attribute Table to close all of
5191 	 * the open attributes.
5192 	 */
5193 	oe = NULL;
5194 	while ((oe = enum_rstbl(oatbl, oe))) {
5195 		rno = ino_get(&oe->ref);
5196 
5197 		if (oe->is_attr_name == 1) {
5198 			kfree(oe->ptr);
5199 			oe->ptr = NULL;
5200 			continue;
5201 		}
5202 
5203 		if (oe->is_attr_name)
5204 			continue;
5205 
5206 		oa = oe->ptr;
5207 		if (!oa)
5208 			continue;
5209 
5210 		run_close(&oa->run0);
5211 		kfree(oa->attr);
5212 		if (oa->ni)
5213 			iput(&oa->ni->vfs_inode);
5214 		kfree(oa);
5215 	}
5216 
5217 	kfree(trtbl);
5218 	kfree(oatbl);
5219 	kfree(dptbl);
5220 	kfree(attr_names);
5221 	kfree(log->rst_info.r_page);
5222 
5223 	kfree(ra);
5224 	kfree(log->one_page_buf);
5225 
5226 	if (err)
5227 		sbi->flags |= NTFS_FLAGS_NEED_REPLAY;
5228 
5229 	if (err == -EROFS)
5230 		err = 0;
5231 	else if (log->set_dirty)
5232 		ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
5233 
5234 	kfree(log);
5235 
5236 	return err;
5237 }
5238