xref: /openbmc/linux/fs/ntfs3/fslog.c (revision 2cac0df3)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *
4  * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved.
5  *
6  */
7 
8 #include <linux/blkdev.h>
9 #include <linux/fs.h>
10 #include <linux/random.h>
11 #include <linux/slab.h>
12 
13 #include "debug.h"
14 #include "ntfs.h"
15 #include "ntfs_fs.h"
16 
17 /*
18  * LOG FILE structs
19  */
20 
21 // clang-format off
22 
23 #define MaxLogFileSize     0x100000000ull
24 #define DefaultLogPageSize 4096
25 #define MinLogRecordPages  0x30
26 
27 struct RESTART_HDR {
28 	struct NTFS_RECORD_HEADER rhdr; // 'RSTR'
29 	__le32 sys_page_size; // 0x10: Page size of the system which initialized the log.
30 	__le32 page_size;     // 0x14: Log page size used for this log file.
31 	__le16 ra_off;        // 0x18:
32 	__le16 minor_ver;     // 0x1A:
33 	__le16 major_ver;     // 0x1C:
34 	__le16 fixups[];
35 };
36 
37 #define LFS_NO_CLIENT 0xffff
38 #define LFS_NO_CLIENT_LE cpu_to_le16(0xffff)
39 
40 struct CLIENT_REC {
41 	__le64 oldest_lsn;
42 	__le64 restart_lsn; // 0x08:
43 	__le16 prev_client; // 0x10:
44 	__le16 next_client; // 0x12:
45 	__le16 seq_num;     // 0x14:
46 	u8 align[6];        // 0x16:
47 	__le32 name_bytes;  // 0x1C: In bytes.
48 	__le16 name[32];    // 0x20: Name of client.
49 };
50 
51 static_assert(sizeof(struct CLIENT_REC) == 0x60);
52 
53 /* Two copies of these will exist at the beginning of the log file */
54 struct RESTART_AREA {
55 	__le64 current_lsn;    // 0x00: Current logical end of log file.
56 	__le16 log_clients;    // 0x08: Maximum number of clients.
57 	__le16 client_idx[2];  // 0x0A: Free/use index into the client record arrays.
58 	__le16 flags;          // 0x0E: See RESTART_SINGLE_PAGE_IO.
59 	__le32 seq_num_bits;   // 0x10: The number of bits in sequence number.
60 	__le16 ra_len;         // 0x14:
61 	__le16 client_off;     // 0x16:
62 	__le64 l_size;         // 0x18: Usable log file size.
63 	__le32 last_lsn_data_len; // 0x20:
64 	__le16 rec_hdr_len;    // 0x24: Log page data offset.
65 	__le16 data_off;       // 0x26: Log page data length.
66 	__le32 open_log_count; // 0x28:
67 	__le32 align[5];       // 0x2C:
68 	struct CLIENT_REC clients[]; // 0x40:
69 };
70 
71 struct LOG_REC_HDR {
72 	__le16 redo_op;      // 0x00:  NTFS_LOG_OPERATION
73 	__le16 undo_op;      // 0x02:  NTFS_LOG_OPERATION
74 	__le16 redo_off;     // 0x04:  Offset to Redo record.
75 	__le16 redo_len;     // 0x06:  Redo length.
76 	__le16 undo_off;     // 0x08:  Offset to Undo record.
77 	__le16 undo_len;     // 0x0A:  Undo length.
78 	__le16 target_attr;  // 0x0C:
79 	__le16 lcns_follow;  // 0x0E:
80 	__le16 record_off;   // 0x10:
81 	__le16 attr_off;     // 0x12:
82 	__le16 cluster_off;  // 0x14:
83 	__le16 reserved;     // 0x16:
84 	__le64 target_vcn;   // 0x18:
85 	__le64 page_lcns[];  // 0x20:
86 };
87 
88 static_assert(sizeof(struct LOG_REC_HDR) == 0x20);
89 
90 #define RESTART_ENTRY_ALLOCATED    0xFFFFFFFF
91 #define RESTART_ENTRY_ALLOCATED_LE cpu_to_le32(0xFFFFFFFF)
92 
93 struct RESTART_TABLE {
94 	__le16 size;       // 0x00: In bytes
95 	__le16 used;       // 0x02: Entries
96 	__le16 total;      // 0x04: Entries
97 	__le16 res[3];     // 0x06:
98 	__le32 free_goal;  // 0x0C:
99 	__le32 first_free; // 0x10:
100 	__le32 last_free;  // 0x14:
101 
102 };
103 
104 static_assert(sizeof(struct RESTART_TABLE) == 0x18);
105 
106 struct ATTR_NAME_ENTRY {
107 	__le16 off; // Offset in the Open attribute Table.
108 	__le16 name_bytes;
109 	__le16 name[];
110 };
111 
112 struct OPEN_ATTR_ENRTY {
113 	__le32 next;            // 0x00: RESTART_ENTRY_ALLOCATED if allocated
114 	__le32 bytes_per_index; // 0x04:
115 	enum ATTR_TYPE type;    // 0x08:
116 	u8 is_dirty_pages;      // 0x0C:
117 	u8 is_attr_name;        // 0x0B: Faked field to manage 'ptr'
118 	u8 name_len;            // 0x0C: Faked field to manage 'ptr'
119 	u8 res;
120 	struct MFT_REF ref;     // 0x10: File Reference of file containing attribute
121 	__le64 open_record_lsn; // 0x18:
122 	void *ptr;              // 0x20:
123 };
124 
125 /* 32 bit version of 'struct OPEN_ATTR_ENRTY' */
126 struct OPEN_ATTR_ENRTY_32 {
127 	__le32 next;            // 0x00: RESTART_ENTRY_ALLOCATED if allocated
128 	__le32 ptr;             // 0x04:
129 	struct MFT_REF ref;     // 0x08:
130 	__le64 open_record_lsn; // 0x10:
131 	u8 is_dirty_pages;      // 0x18:
132 	u8 is_attr_name;        // 0x19:
133 	u8 res1[2];
134 	enum ATTR_TYPE type;    // 0x1C:
135 	u8 name_len;            // 0x20: In wchar
136 	u8 res2[3];
137 	__le32 AttributeName;   // 0x24:
138 	__le32 bytes_per_index; // 0x28:
139 };
140 
141 #define SIZEOF_OPENATTRIBUTEENTRY0 0x2c
142 // static_assert( 0x2C == sizeof(struct OPEN_ATTR_ENRTY_32) );
143 static_assert(sizeof(struct OPEN_ATTR_ENRTY) < SIZEOF_OPENATTRIBUTEENTRY0);
144 
145 /*
146  * One entry exists in the Dirty Pages Table for each page which is dirty at
147  * the time the Restart Area is written.
148  */
149 struct DIR_PAGE_ENTRY {
150 	__le32 next;         // 0x00: RESTART_ENTRY_ALLOCATED if allocated
151 	__le32 target_attr;  // 0x04: Index into the Open attribute Table
152 	__le32 transfer_len; // 0x08:
153 	__le32 lcns_follow;  // 0x0C:
154 	__le64 vcn;          // 0x10: Vcn of dirty page
155 	__le64 oldest_lsn;   // 0x18:
156 	__le64 page_lcns[];  // 0x20:
157 };
158 
159 static_assert(sizeof(struct DIR_PAGE_ENTRY) == 0x20);
160 
161 /* 32 bit version of 'struct DIR_PAGE_ENTRY' */
162 struct DIR_PAGE_ENTRY_32 {
163 	__le32 next;		// 0x00: RESTART_ENTRY_ALLOCATED if allocated
164 	__le32 target_attr;	// 0x04: Index into the Open attribute Table
165 	__le32 transfer_len;	// 0x08:
166 	__le32 lcns_follow;	// 0x0C:
167 	__le32 reserved;	// 0x10:
168 	__le32 vcn_low;		// 0x14: Vcn of dirty page
169 	__le32 vcn_hi;		// 0x18: Vcn of dirty page
170 	__le32 oldest_lsn_low;	// 0x1C:
171 	__le32 oldest_lsn_hi;	// 0x1C:
172 	__le32 page_lcns_low;	// 0x24:
173 	__le32 page_lcns_hi;	// 0x24:
174 };
175 
176 static_assert(offsetof(struct DIR_PAGE_ENTRY_32, vcn_low) == 0x14);
177 static_assert(sizeof(struct DIR_PAGE_ENTRY_32) == 0x2c);
178 
179 enum transact_state {
180 	TransactionUninitialized = 0,
181 	TransactionActive,
182 	TransactionPrepared,
183 	TransactionCommitted
184 };
185 
186 struct TRANSACTION_ENTRY {
187 	__le32 next;          // 0x00: RESTART_ENTRY_ALLOCATED if allocated
188 	u8 transact_state;    // 0x04:
189 	u8 reserved[3];       // 0x05:
190 	__le64 first_lsn;     // 0x08:
191 	__le64 prev_lsn;      // 0x10:
192 	__le64 undo_next_lsn; // 0x18:
193 	__le32 undo_records;  // 0x20: Number of undo log records pending abort
194 	__le32 undo_len;      // 0x24: Total undo size
195 };
196 
197 static_assert(sizeof(struct TRANSACTION_ENTRY) == 0x28);
198 
199 struct NTFS_RESTART {
200 	__le32 major_ver;             // 0x00:
201 	__le32 minor_ver;             // 0x04:
202 	__le64 check_point_start;     // 0x08:
203 	__le64 open_attr_table_lsn;   // 0x10:
204 	__le64 attr_names_lsn;        // 0x18:
205 	__le64 dirty_pages_table_lsn; // 0x20:
206 	__le64 transact_table_lsn;    // 0x28:
207 	__le32 open_attr_len;         // 0x30: In bytes
208 	__le32 attr_names_len;        // 0x34: In bytes
209 	__le32 dirty_pages_len;       // 0x38: In bytes
210 	__le32 transact_table_len;    // 0x3C: In bytes
211 };
212 
213 static_assert(sizeof(struct NTFS_RESTART) == 0x40);
214 
215 struct NEW_ATTRIBUTE_SIZES {
216 	__le64 alloc_size;
217 	__le64 valid_size;
218 	__le64 data_size;
219 	__le64 total_size;
220 };
221 
222 struct BITMAP_RANGE {
223 	__le32 bitmap_off;
224 	__le32 bits;
225 };
226 
227 struct LCN_RANGE {
228 	__le64 lcn;
229 	__le64 len;
230 };
231 
232 /* The following type defines the different log record types. */
233 #define LfsClientRecord  cpu_to_le32(1)
234 #define LfsClientRestart cpu_to_le32(2)
235 
236 /* This is used to uniquely identify a client for a particular log file. */
237 struct CLIENT_ID {
238 	__le16 seq_num;
239 	__le16 client_idx;
240 };
241 
242 /* This is the header that begins every Log Record in the log file. */
243 struct LFS_RECORD_HDR {
244 	__le64 this_lsn;		// 0x00:
245 	__le64 client_prev_lsn;		// 0x08:
246 	__le64 client_undo_next_lsn;	// 0x10:
247 	__le32 client_data_len;		// 0x18:
248 	struct CLIENT_ID client;	// 0x1C: Owner of this log record.
249 	__le32 record_type;		// 0x20: LfsClientRecord or LfsClientRestart.
250 	__le32 transact_id;		// 0x24:
251 	__le16 flags;			// 0x28: LOG_RECORD_MULTI_PAGE
252 	u8 align[6];			// 0x2A:
253 };
254 
255 #define LOG_RECORD_MULTI_PAGE cpu_to_le16(1)
256 
257 static_assert(sizeof(struct LFS_RECORD_HDR) == 0x30);
258 
259 struct LFS_RECORD {
260 	__le16 next_record_off;	// 0x00: Offset of the free space in the page,
261 	u8 align[6];		// 0x02:
262 	__le64 last_end_lsn;	// 0x08: lsn for the last log record which ends on the page,
263 };
264 
265 static_assert(sizeof(struct LFS_RECORD) == 0x10);
266 
267 struct RECORD_PAGE_HDR {
268 	struct NTFS_RECORD_HEADER rhdr;	// 'RCRD'
269 	__le32 rflags;			// 0x10: See LOG_PAGE_LOG_RECORD_END
270 	__le16 page_count;		// 0x14:
271 	__le16 page_pos;		// 0x16:
272 	struct LFS_RECORD record_hdr;	// 0x18:
273 	__le16 fixups[10];		// 0x28:
274 	__le32 file_off;		// 0x3c: Used when major version >= 2
275 };
276 
277 // clang-format on
278 
279 // Page contains the end of a log record.
280 #define LOG_PAGE_LOG_RECORD_END cpu_to_le32(0x00000001)
281 
is_log_record_end(const struct RECORD_PAGE_HDR * hdr)282 static inline bool is_log_record_end(const struct RECORD_PAGE_HDR *hdr)
283 {
284 	return hdr->rflags & LOG_PAGE_LOG_RECORD_END;
285 }
286 
287 static_assert(offsetof(struct RECORD_PAGE_HDR, file_off) == 0x3c);
288 
289 /*
290  * END of NTFS LOG structures
291  */
292 
293 /* Define some tuning parameters to keep the restart tables a reasonable size. */
294 #define INITIAL_NUMBER_TRANSACTIONS 5
295 
296 enum NTFS_LOG_OPERATION {
297 
298 	Noop = 0x00,
299 	CompensationLogRecord = 0x01,
300 	InitializeFileRecordSegment = 0x02,
301 	DeallocateFileRecordSegment = 0x03,
302 	WriteEndOfFileRecordSegment = 0x04,
303 	CreateAttribute = 0x05,
304 	DeleteAttribute = 0x06,
305 	UpdateResidentValue = 0x07,
306 	UpdateNonresidentValue = 0x08,
307 	UpdateMappingPairs = 0x09,
308 	DeleteDirtyClusters = 0x0A,
309 	SetNewAttributeSizes = 0x0B,
310 	AddIndexEntryRoot = 0x0C,
311 	DeleteIndexEntryRoot = 0x0D,
312 	AddIndexEntryAllocation = 0x0E,
313 	DeleteIndexEntryAllocation = 0x0F,
314 	WriteEndOfIndexBuffer = 0x10,
315 	SetIndexEntryVcnRoot = 0x11,
316 	SetIndexEntryVcnAllocation = 0x12,
317 	UpdateFileNameRoot = 0x13,
318 	UpdateFileNameAllocation = 0x14,
319 	SetBitsInNonresidentBitMap = 0x15,
320 	ClearBitsInNonresidentBitMap = 0x16,
321 	HotFix = 0x17,
322 	EndTopLevelAction = 0x18,
323 	PrepareTransaction = 0x19,
324 	CommitTransaction = 0x1A,
325 	ForgetTransaction = 0x1B,
326 	OpenNonresidentAttribute = 0x1C,
327 	OpenAttributeTableDump = 0x1D,
328 	AttributeNamesDump = 0x1E,
329 	DirtyPageTableDump = 0x1F,
330 	TransactionTableDump = 0x20,
331 	UpdateRecordDataRoot = 0x21,
332 	UpdateRecordDataAllocation = 0x22,
333 
334 	UpdateRelativeDataInIndex =
335 		0x23, // NtOfsRestartUpdateRelativeDataInIndex
336 	UpdateRelativeDataInIndex2 = 0x24,
337 	ZeroEndOfFileRecord = 0x25,
338 };
339 
340 /*
341  * Array for log records which require a target attribute.
342  * A true indicates that the corresponding restart operation
343  * requires a target attribute.
344  */
345 static const u8 AttributeRequired[] = {
346 	0xFC, 0xFB, 0xFF, 0x10, 0x06,
347 };
348 
is_target_required(u16 op)349 static inline bool is_target_required(u16 op)
350 {
351 	bool ret = op <= UpdateRecordDataAllocation &&
352 		   (AttributeRequired[op >> 3] >> (op & 7) & 1);
353 	return ret;
354 }
355 
can_skip_action(enum NTFS_LOG_OPERATION op)356 static inline bool can_skip_action(enum NTFS_LOG_OPERATION op)
357 {
358 	switch (op) {
359 	case Noop:
360 	case DeleteDirtyClusters:
361 	case HotFix:
362 	case EndTopLevelAction:
363 	case PrepareTransaction:
364 	case CommitTransaction:
365 	case ForgetTransaction:
366 	case CompensationLogRecord:
367 	case OpenNonresidentAttribute:
368 	case OpenAttributeTableDump:
369 	case AttributeNamesDump:
370 	case DirtyPageTableDump:
371 	case TransactionTableDump:
372 		return true;
373 	default:
374 		return false;
375 	}
376 }
377 
378 enum { lcb_ctx_undo_next, lcb_ctx_prev, lcb_ctx_next };
379 
380 /* Bytes per restart table. */
bytes_per_rt(const struct RESTART_TABLE * rt)381 static inline u32 bytes_per_rt(const struct RESTART_TABLE *rt)
382 {
383 	return le16_to_cpu(rt->used) * le16_to_cpu(rt->size) +
384 	       sizeof(struct RESTART_TABLE);
385 }
386 
387 /* Log record length. */
lrh_length(const struct LOG_REC_HDR * lr)388 static inline u32 lrh_length(const struct LOG_REC_HDR *lr)
389 {
390 	u16 t16 = le16_to_cpu(lr->lcns_follow);
391 
392 	return struct_size(lr, page_lcns, max_t(u16, 1, t16));
393 }
394 
395 struct lcb {
396 	struct LFS_RECORD_HDR *lrh; // Log record header of the current lsn.
397 	struct LOG_REC_HDR *log_rec;
398 	u32 ctx_mode; // lcb_ctx_undo_next/lcb_ctx_prev/lcb_ctx_next
399 	struct CLIENT_ID client;
400 	bool alloc; // If true the we should deallocate 'log_rec'.
401 };
402 
lcb_put(struct lcb * lcb)403 static void lcb_put(struct lcb *lcb)
404 {
405 	if (lcb->alloc)
406 		kfree(lcb->log_rec);
407 	kfree(lcb->lrh);
408 	kfree(lcb);
409 }
410 
411 /* Find the oldest lsn from active clients. */
oldest_client_lsn(const struct CLIENT_REC * ca,__le16 next_client,u64 * oldest_lsn)412 static inline void oldest_client_lsn(const struct CLIENT_REC *ca,
413 				     __le16 next_client, u64 *oldest_lsn)
414 {
415 	while (next_client != LFS_NO_CLIENT_LE) {
416 		const struct CLIENT_REC *cr = ca + le16_to_cpu(next_client);
417 		u64 lsn = le64_to_cpu(cr->oldest_lsn);
418 
419 		/* Ignore this block if it's oldest lsn is 0. */
420 		if (lsn && lsn < *oldest_lsn)
421 			*oldest_lsn = lsn;
422 
423 		next_client = cr->next_client;
424 	}
425 }
426 
is_rst_page_hdr_valid(u32 file_off,const struct RESTART_HDR * rhdr)427 static inline bool is_rst_page_hdr_valid(u32 file_off,
428 					 const struct RESTART_HDR *rhdr)
429 {
430 	u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
431 	u32 page_size = le32_to_cpu(rhdr->page_size);
432 	u32 end_usa;
433 	u16 ro;
434 
435 	if (sys_page < SECTOR_SIZE || page_size < SECTOR_SIZE ||
436 	    sys_page & (sys_page - 1) || page_size & (page_size - 1)) {
437 		return false;
438 	}
439 
440 	/* Check that if the file offset isn't 0, it is the system page size. */
441 	if (file_off && file_off != sys_page)
442 		return false;
443 
444 	/* Check support version 1.1+. */
445 	if (le16_to_cpu(rhdr->major_ver) <= 1 && !rhdr->minor_ver)
446 		return false;
447 
448 	if (le16_to_cpu(rhdr->major_ver) > 2)
449 		return false;
450 
451 	ro = le16_to_cpu(rhdr->ra_off);
452 	if (!IS_ALIGNED(ro, 8) || ro > sys_page)
453 		return false;
454 
455 	end_usa = ((sys_page >> SECTOR_SHIFT) + 1) * sizeof(short);
456 	end_usa += le16_to_cpu(rhdr->rhdr.fix_off);
457 
458 	if (ro < end_usa)
459 		return false;
460 
461 	return true;
462 }
463 
is_rst_area_valid(const struct RESTART_HDR * rhdr)464 static inline bool is_rst_area_valid(const struct RESTART_HDR *rhdr)
465 {
466 	const struct RESTART_AREA *ra;
467 	u16 cl, fl, ul;
468 	u32 off, l_size, seq_bits;
469 	u16 ro = le16_to_cpu(rhdr->ra_off);
470 	u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
471 
472 	if (ro + offsetof(struct RESTART_AREA, l_size) >
473 	    SECTOR_SIZE - sizeof(short))
474 		return false;
475 
476 	ra = Add2Ptr(rhdr, ro);
477 	cl = le16_to_cpu(ra->log_clients);
478 
479 	if (cl > 1)
480 		return false;
481 
482 	off = le16_to_cpu(ra->client_off);
483 
484 	if (!IS_ALIGNED(off, 8) || ro + off > SECTOR_SIZE - sizeof(short))
485 		return false;
486 
487 	off += cl * sizeof(struct CLIENT_REC);
488 
489 	if (off > sys_page)
490 		return false;
491 
492 	/*
493 	 * Check the restart length field and whether the entire
494 	 * restart area is contained that length.
495 	 */
496 	if (le16_to_cpu(rhdr->ra_off) + le16_to_cpu(ra->ra_len) > sys_page ||
497 	    off > le16_to_cpu(ra->ra_len)) {
498 		return false;
499 	}
500 
501 	/*
502 	 * As a final check make sure that the use list and the free list
503 	 * are either empty or point to a valid client.
504 	 */
505 	fl = le16_to_cpu(ra->client_idx[0]);
506 	ul = le16_to_cpu(ra->client_idx[1]);
507 	if ((fl != LFS_NO_CLIENT && fl >= cl) ||
508 	    (ul != LFS_NO_CLIENT && ul >= cl))
509 		return false;
510 
511 	/* Make sure the sequence number bits match the log file size. */
512 	l_size = le64_to_cpu(ra->l_size);
513 
514 	seq_bits = sizeof(u64) * 8 + 3;
515 	while (l_size) {
516 		l_size >>= 1;
517 		seq_bits -= 1;
518 	}
519 
520 	if (seq_bits != ra->seq_num_bits)
521 		return false;
522 
523 	/* The log page data offset and record header length must be quad-aligned. */
524 	if (!IS_ALIGNED(le16_to_cpu(ra->data_off), 8) ||
525 	    !IS_ALIGNED(le16_to_cpu(ra->rec_hdr_len), 8))
526 		return false;
527 
528 	return true;
529 }
530 
is_client_area_valid(const struct RESTART_HDR * rhdr,bool usa_error)531 static inline bool is_client_area_valid(const struct RESTART_HDR *rhdr,
532 					bool usa_error)
533 {
534 	u16 ro = le16_to_cpu(rhdr->ra_off);
535 	const struct RESTART_AREA *ra = Add2Ptr(rhdr, ro);
536 	u16 ra_len = le16_to_cpu(ra->ra_len);
537 	const struct CLIENT_REC *ca;
538 	u32 i;
539 
540 	if (usa_error && ra_len + ro > SECTOR_SIZE - sizeof(short))
541 		return false;
542 
543 	/* Find the start of the client array. */
544 	ca = Add2Ptr(ra, le16_to_cpu(ra->client_off));
545 
546 	/*
547 	 * Start with the free list.
548 	 * Check that all the clients are valid and that there isn't a cycle.
549 	 * Do the in-use list on the second pass.
550 	 */
551 	for (i = 0; i < 2; i++) {
552 		u16 client_idx = le16_to_cpu(ra->client_idx[i]);
553 		bool first_client = true;
554 		u16 clients = le16_to_cpu(ra->log_clients);
555 
556 		while (client_idx != LFS_NO_CLIENT) {
557 			const struct CLIENT_REC *cr;
558 
559 			if (!clients ||
560 			    client_idx >= le16_to_cpu(ra->log_clients))
561 				return false;
562 
563 			clients -= 1;
564 			cr = ca + client_idx;
565 
566 			client_idx = le16_to_cpu(cr->next_client);
567 
568 			if (first_client) {
569 				first_client = false;
570 				if (cr->prev_client != LFS_NO_CLIENT_LE)
571 					return false;
572 			}
573 		}
574 	}
575 
576 	return true;
577 }
578 
579 /*
580  * remove_client
581  *
582  * Remove a client record from a client record list an restart area.
583  */
remove_client(struct CLIENT_REC * ca,const struct CLIENT_REC * cr,__le16 * head)584 static inline void remove_client(struct CLIENT_REC *ca,
585 				 const struct CLIENT_REC *cr, __le16 *head)
586 {
587 	if (cr->prev_client == LFS_NO_CLIENT_LE)
588 		*head = cr->next_client;
589 	else
590 		ca[le16_to_cpu(cr->prev_client)].next_client = cr->next_client;
591 
592 	if (cr->next_client != LFS_NO_CLIENT_LE)
593 		ca[le16_to_cpu(cr->next_client)].prev_client = cr->prev_client;
594 }
595 
596 /*
597  * add_client - Add a client record to the start of a list.
598  */
add_client(struct CLIENT_REC * ca,u16 index,__le16 * head)599 static inline void add_client(struct CLIENT_REC *ca, u16 index, __le16 *head)
600 {
601 	struct CLIENT_REC *cr = ca + index;
602 
603 	cr->prev_client = LFS_NO_CLIENT_LE;
604 	cr->next_client = *head;
605 
606 	if (*head != LFS_NO_CLIENT_LE)
607 		ca[le16_to_cpu(*head)].prev_client = cpu_to_le16(index);
608 
609 	*head = cpu_to_le16(index);
610 }
611 
enum_rstbl(struct RESTART_TABLE * t,void * c)612 static inline void *enum_rstbl(struct RESTART_TABLE *t, void *c)
613 {
614 	__le32 *e;
615 	u32 bprt;
616 	u16 rsize = t ? le16_to_cpu(t->size) : 0;
617 
618 	if (!c) {
619 		if (!t || !t->total)
620 			return NULL;
621 		e = Add2Ptr(t, sizeof(struct RESTART_TABLE));
622 	} else {
623 		e = Add2Ptr(c, rsize);
624 	}
625 
626 	/* Loop until we hit the first one allocated, or the end of the list. */
627 	for (bprt = bytes_per_rt(t); PtrOffset(t, e) < bprt;
628 	     e = Add2Ptr(e, rsize)) {
629 		if (*e == RESTART_ENTRY_ALLOCATED_LE)
630 			return e;
631 	}
632 	return NULL;
633 }
634 
635 /*
636  * find_dp - Search for a @vcn in Dirty Page Table.
637  */
find_dp(struct RESTART_TABLE * dptbl,u32 target_attr,u64 vcn)638 static inline struct DIR_PAGE_ENTRY *find_dp(struct RESTART_TABLE *dptbl,
639 					     u32 target_attr, u64 vcn)
640 {
641 	__le32 ta = cpu_to_le32(target_attr);
642 	struct DIR_PAGE_ENTRY *dp = NULL;
643 
644 	while ((dp = enum_rstbl(dptbl, dp))) {
645 		u64 dp_vcn = le64_to_cpu(dp->vcn);
646 
647 		if (dp->target_attr == ta && vcn >= dp_vcn &&
648 		    vcn < dp_vcn + le32_to_cpu(dp->lcns_follow)) {
649 			return dp;
650 		}
651 	}
652 	return NULL;
653 }
654 
norm_file_page(u32 page_size,u32 * l_size,bool use_default)655 static inline u32 norm_file_page(u32 page_size, u32 *l_size, bool use_default)
656 {
657 	if (use_default)
658 		page_size = DefaultLogPageSize;
659 
660 	/* Round the file size down to a system page boundary. */
661 	*l_size &= ~(page_size - 1);
662 
663 	/* File should contain at least 2 restart pages and MinLogRecordPages pages. */
664 	if (*l_size < (MinLogRecordPages + 2) * page_size)
665 		return 0;
666 
667 	return page_size;
668 }
669 
check_log_rec(const struct LOG_REC_HDR * lr,u32 bytes,u32 tr,u32 bytes_per_attr_entry)670 static bool check_log_rec(const struct LOG_REC_HDR *lr, u32 bytes, u32 tr,
671 			  u32 bytes_per_attr_entry)
672 {
673 	u16 t16;
674 
675 	if (bytes < sizeof(struct LOG_REC_HDR))
676 		return false;
677 	if (!tr)
678 		return false;
679 
680 	if ((tr - sizeof(struct RESTART_TABLE)) %
681 	    sizeof(struct TRANSACTION_ENTRY))
682 		return false;
683 
684 	if (le16_to_cpu(lr->redo_off) & 7)
685 		return false;
686 
687 	if (le16_to_cpu(lr->undo_off) & 7)
688 		return false;
689 
690 	if (lr->target_attr)
691 		goto check_lcns;
692 
693 	if (is_target_required(le16_to_cpu(lr->redo_op)))
694 		return false;
695 
696 	if (is_target_required(le16_to_cpu(lr->undo_op)))
697 		return false;
698 
699 check_lcns:
700 	if (!lr->lcns_follow)
701 		goto check_length;
702 
703 	t16 = le16_to_cpu(lr->target_attr);
704 	if ((t16 - sizeof(struct RESTART_TABLE)) % bytes_per_attr_entry)
705 		return false;
706 
707 check_length:
708 	if (bytes < lrh_length(lr))
709 		return false;
710 
711 	return true;
712 }
713 
check_rstbl(const struct RESTART_TABLE * rt,size_t bytes)714 static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes)
715 {
716 	u32 ts;
717 	u32 i, off;
718 	u16 rsize = le16_to_cpu(rt->size);
719 	u16 ne = le16_to_cpu(rt->used);
720 	u32 ff = le32_to_cpu(rt->first_free);
721 	u32 lf = le32_to_cpu(rt->last_free);
722 
723 	ts = rsize * ne + sizeof(struct RESTART_TABLE);
724 
725 	if (!rsize || rsize > bytes ||
726 	    rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts ||
727 	    le16_to_cpu(rt->total) > ne ||
728 			ff > ts - sizeof(__le32) || lf > ts - sizeof(__le32) ||
729 	    (ff && ff < sizeof(struct RESTART_TABLE)) ||
730 	    (lf && lf < sizeof(struct RESTART_TABLE))) {
731 		return false;
732 	}
733 
734 	/*
735 	 * Verify each entry is either allocated or points
736 	 * to a valid offset the table.
737 	 */
738 	for (i = 0; i < ne; i++) {
739 		off = le32_to_cpu(*(__le32 *)Add2Ptr(
740 			rt, i * rsize + sizeof(struct RESTART_TABLE)));
741 
742 		if (off != RESTART_ENTRY_ALLOCATED && off &&
743 		    (off < sizeof(struct RESTART_TABLE) ||
744 		     ((off - sizeof(struct RESTART_TABLE)) % rsize))) {
745 			return false;
746 		}
747 	}
748 
749 	/*
750 	 * Walk through the list headed by the first entry to make
751 	 * sure none of the entries are currently being used.
752 	 */
753 	for (off = ff; off;) {
754 		if (off == RESTART_ENTRY_ALLOCATED)
755 			return false;
756 
757 		off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
758 
759 		if (off > ts - sizeof(__le32))
760 			return false;
761 	}
762 
763 	return true;
764 }
765 
766 /*
767  * free_rsttbl_idx - Free a previously allocated index a Restart Table.
768  */
free_rsttbl_idx(struct RESTART_TABLE * rt,u32 off)769 static inline void free_rsttbl_idx(struct RESTART_TABLE *rt, u32 off)
770 {
771 	__le32 *e;
772 	u32 lf = le32_to_cpu(rt->last_free);
773 	__le32 off_le = cpu_to_le32(off);
774 
775 	e = Add2Ptr(rt, off);
776 
777 	if (off < le32_to_cpu(rt->free_goal)) {
778 		*e = rt->first_free;
779 		rt->first_free = off_le;
780 		if (!lf)
781 			rt->last_free = off_le;
782 	} else {
783 		if (lf)
784 			*(__le32 *)Add2Ptr(rt, lf) = off_le;
785 		else
786 			rt->first_free = off_le;
787 
788 		rt->last_free = off_le;
789 		*e = 0;
790 	}
791 
792 	le16_sub_cpu(&rt->total, 1);
793 }
794 
init_rsttbl(u16 esize,u16 used)795 static inline struct RESTART_TABLE *init_rsttbl(u16 esize, u16 used)
796 {
797 	__le32 *e, *last_free;
798 	u32 off;
799 	u32 bytes = esize * used + sizeof(struct RESTART_TABLE);
800 	u32 lf = sizeof(struct RESTART_TABLE) + (used - 1) * esize;
801 	struct RESTART_TABLE *t = kzalloc(bytes, GFP_NOFS);
802 
803 	if (!t)
804 		return NULL;
805 
806 	t->size = cpu_to_le16(esize);
807 	t->used = cpu_to_le16(used);
808 	t->free_goal = cpu_to_le32(~0u);
809 	t->first_free = cpu_to_le32(sizeof(struct RESTART_TABLE));
810 	t->last_free = cpu_to_le32(lf);
811 
812 	e = (__le32 *)(t + 1);
813 	last_free = Add2Ptr(t, lf);
814 
815 	for (off = sizeof(struct RESTART_TABLE) + esize; e < last_free;
816 	     e = Add2Ptr(e, esize), off += esize) {
817 		*e = cpu_to_le32(off);
818 	}
819 	return t;
820 }
821 
extend_rsttbl(struct RESTART_TABLE * tbl,u32 add,u32 free_goal)822 static inline struct RESTART_TABLE *extend_rsttbl(struct RESTART_TABLE *tbl,
823 						  u32 add, u32 free_goal)
824 {
825 	u16 esize = le16_to_cpu(tbl->size);
826 	__le32 osize = cpu_to_le32(bytes_per_rt(tbl));
827 	u32 used = le16_to_cpu(tbl->used);
828 	struct RESTART_TABLE *rt;
829 
830 	rt = init_rsttbl(esize, used + add);
831 	if (!rt)
832 		return NULL;
833 
834 	memcpy(rt + 1, tbl + 1, esize * used);
835 
836 	rt->free_goal = free_goal == ~0u ?
837 				cpu_to_le32(~0u) :
838 				cpu_to_le32(sizeof(struct RESTART_TABLE) +
839 					    free_goal * esize);
840 
841 	if (tbl->first_free) {
842 		rt->first_free = tbl->first_free;
843 		*(__le32 *)Add2Ptr(rt, le32_to_cpu(tbl->last_free)) = osize;
844 	} else {
845 		rt->first_free = osize;
846 	}
847 
848 	rt->total = tbl->total;
849 
850 	kfree(tbl);
851 	return rt;
852 }
853 
854 /*
855  * alloc_rsttbl_idx
856  *
857  * Allocate an index from within a previously initialized Restart Table.
858  */
alloc_rsttbl_idx(struct RESTART_TABLE ** tbl)859 static inline void *alloc_rsttbl_idx(struct RESTART_TABLE **tbl)
860 {
861 	u32 off;
862 	__le32 *e;
863 	struct RESTART_TABLE *t = *tbl;
864 
865 	if (!t->first_free) {
866 		*tbl = t = extend_rsttbl(t, 16, ~0u);
867 		if (!t)
868 			return NULL;
869 	}
870 
871 	off = le32_to_cpu(t->first_free);
872 
873 	/* Dequeue this entry and zero it. */
874 	e = Add2Ptr(t, off);
875 
876 	t->first_free = *e;
877 
878 	memset(e, 0, le16_to_cpu(t->size));
879 
880 	*e = RESTART_ENTRY_ALLOCATED_LE;
881 
882 	/* If list is going empty, then we fix the last_free as well. */
883 	if (!t->first_free)
884 		t->last_free = 0;
885 
886 	le16_add_cpu(&t->total, 1);
887 
888 	return Add2Ptr(t, off);
889 }
890 
891 /*
892  * alloc_rsttbl_from_idx
893  *
894  * Allocate a specific index from within a previously initialized Restart Table.
895  */
alloc_rsttbl_from_idx(struct RESTART_TABLE ** tbl,u32 vbo)896 static inline void *alloc_rsttbl_from_idx(struct RESTART_TABLE **tbl, u32 vbo)
897 {
898 	u32 off;
899 	__le32 *e;
900 	struct RESTART_TABLE *rt = *tbl;
901 	u32 bytes = bytes_per_rt(rt);
902 	u16 esize = le16_to_cpu(rt->size);
903 
904 	/* If the entry is not the table, we will have to extend the table. */
905 	if (vbo >= bytes) {
906 		/*
907 		 * Extend the size by computing the number of entries between
908 		 * the existing size and the desired index and adding 1 to that.
909 		 */
910 		u32 bytes2idx = vbo - bytes;
911 
912 		/*
913 		 * There should always be an integral number of entries
914 		 * being added. Now extend the table.
915 		 */
916 		*tbl = rt = extend_rsttbl(rt, bytes2idx / esize + 1, bytes);
917 		if (!rt)
918 			return NULL;
919 	}
920 
921 	/* See if the entry is already allocated, and just return if it is. */
922 	e = Add2Ptr(rt, vbo);
923 
924 	if (*e == RESTART_ENTRY_ALLOCATED_LE)
925 		return e;
926 
927 	/*
928 	 * Walk through the table, looking for the entry we're
929 	 * interested and the previous entry.
930 	 */
931 	off = le32_to_cpu(rt->first_free);
932 	e = Add2Ptr(rt, off);
933 
934 	if (off == vbo) {
935 		/* this is a match */
936 		rt->first_free = *e;
937 		goto skip_looking;
938 	}
939 
940 	/*
941 	 * Need to walk through the list looking for the predecessor
942 	 * of our entry.
943 	 */
944 	for (;;) {
945 		/* Remember the entry just found */
946 		u32 last_off = off;
947 		__le32 *last_e = e;
948 
949 		/* Should never run of entries. */
950 
951 		/* Lookup up the next entry the list. */
952 		off = le32_to_cpu(*last_e);
953 		e = Add2Ptr(rt, off);
954 
955 		/* If this is our match we are done. */
956 		if (off == vbo) {
957 			*last_e = *e;
958 
959 			/*
960 			 * If this was the last entry, we update that
961 			 * table as well.
962 			 */
963 			if (le32_to_cpu(rt->last_free) == off)
964 				rt->last_free = cpu_to_le32(last_off);
965 			break;
966 		}
967 	}
968 
969 skip_looking:
970 	/* If the list is now empty, we fix the last_free as well. */
971 	if (!rt->first_free)
972 		rt->last_free = 0;
973 
974 	/* Zero this entry. */
975 	memset(e, 0, esize);
976 	*e = RESTART_ENTRY_ALLOCATED_LE;
977 
978 	le16_add_cpu(&rt->total, 1);
979 
980 	return e;
981 }
982 
983 struct restart_info {
984 	u64 last_lsn;
985 	struct RESTART_HDR *r_page;
986 	u32 vbo;
987 	bool chkdsk_was_run;
988 	bool valid_page;
989 	bool initialized;
990 	bool restart;
991 };
992 
993 #define RESTART_SINGLE_PAGE_IO cpu_to_le16(0x0001)
994 
995 #define NTFSLOG_WRAPPED 0x00000001
996 #define NTFSLOG_MULTIPLE_PAGE_IO 0x00000002
997 #define NTFSLOG_NO_LAST_LSN 0x00000004
998 #define NTFSLOG_REUSE_TAIL 0x00000010
999 #define NTFSLOG_NO_OLDEST_LSN 0x00000020
1000 
1001 /* Helper struct to work with NTFS $LogFile. */
1002 struct ntfs_log {
1003 	struct ntfs_inode *ni;
1004 
1005 	u32 l_size;
1006 	u32 orig_file_size;
1007 	u32 sys_page_size;
1008 	u32 sys_page_mask;
1009 	u32 page_size;
1010 	u32 page_mask; // page_size - 1
1011 	u8 page_bits;
1012 	struct RECORD_PAGE_HDR *one_page_buf;
1013 
1014 	struct RESTART_TABLE *open_attr_tbl;
1015 	u32 transaction_id;
1016 	u32 clst_per_page;
1017 
1018 	u32 first_page;
1019 	u32 next_page;
1020 	u32 ra_off;
1021 	u32 data_off;
1022 	u32 restart_size;
1023 	u32 data_size;
1024 	u16 record_header_len;
1025 	u64 seq_num;
1026 	u32 seq_num_bits;
1027 	u32 file_data_bits;
1028 	u32 seq_num_mask; /* (1 << file_data_bits) - 1 */
1029 
1030 	struct RESTART_AREA *ra; /* In-memory image of the next restart area. */
1031 	u32 ra_size; /* The usable size of the restart area. */
1032 
1033 	/*
1034 	 * If true, then the in-memory restart area is to be written
1035 	 * to the first position on the disk.
1036 	 */
1037 	bool init_ra;
1038 	bool set_dirty; /* True if we need to set dirty flag. */
1039 
1040 	u64 oldest_lsn;
1041 
1042 	u32 oldest_lsn_off;
1043 	u64 last_lsn;
1044 
1045 	u32 total_avail;
1046 	u32 total_avail_pages;
1047 	u32 total_undo_commit;
1048 	u32 max_current_avail;
1049 	u32 current_avail;
1050 	u32 reserved;
1051 
1052 	short major_ver;
1053 	short minor_ver;
1054 
1055 	u32 l_flags; /* See NTFSLOG_XXX */
1056 	u32 current_openlog_count; /* On-disk value for open_log_count. */
1057 
1058 	struct CLIENT_ID client_id;
1059 	u32 client_undo_commit;
1060 
1061 	struct restart_info rst_info, rst_info2;
1062 };
1063 
lsn_to_vbo(struct ntfs_log * log,const u64 lsn)1064 static inline u32 lsn_to_vbo(struct ntfs_log *log, const u64 lsn)
1065 {
1066 	u32 vbo = (lsn << log->seq_num_bits) >> (log->seq_num_bits - 3);
1067 
1068 	return vbo;
1069 }
1070 
1071 /* Compute the offset in the log file of the next log page. */
next_page_off(struct ntfs_log * log,u32 off)1072 static inline u32 next_page_off(struct ntfs_log *log, u32 off)
1073 {
1074 	off = (off & ~log->sys_page_mask) + log->page_size;
1075 	return off >= log->l_size ? log->first_page : off;
1076 }
1077 
lsn_to_page_off(struct ntfs_log * log,u64 lsn)1078 static inline u32 lsn_to_page_off(struct ntfs_log *log, u64 lsn)
1079 {
1080 	return (((u32)lsn) << 3) & log->page_mask;
1081 }
1082 
vbo_to_lsn(struct ntfs_log * log,u32 off,u64 Seq)1083 static inline u64 vbo_to_lsn(struct ntfs_log *log, u32 off, u64 Seq)
1084 {
1085 	return (off >> 3) + (Seq << log->file_data_bits);
1086 }
1087 
is_lsn_in_file(struct ntfs_log * log,u64 lsn)1088 static inline bool is_lsn_in_file(struct ntfs_log *log, u64 lsn)
1089 {
1090 	return lsn >= log->oldest_lsn &&
1091 	       lsn <= le64_to_cpu(log->ra->current_lsn);
1092 }
1093 
hdr_file_off(struct ntfs_log * log,struct RECORD_PAGE_HDR * hdr)1094 static inline u32 hdr_file_off(struct ntfs_log *log,
1095 			       struct RECORD_PAGE_HDR *hdr)
1096 {
1097 	if (log->major_ver < 2)
1098 		return le64_to_cpu(hdr->rhdr.lsn);
1099 
1100 	return le32_to_cpu(hdr->file_off);
1101 }
1102 
base_lsn(struct ntfs_log * log,const struct RECORD_PAGE_HDR * hdr,u64 lsn)1103 static inline u64 base_lsn(struct ntfs_log *log,
1104 			   const struct RECORD_PAGE_HDR *hdr, u64 lsn)
1105 {
1106 	u64 h_lsn = le64_to_cpu(hdr->rhdr.lsn);
1107 	u64 ret = (((h_lsn >> log->file_data_bits) +
1108 		    (lsn < (lsn_to_vbo(log, h_lsn) & ~log->page_mask) ? 1 : 0))
1109 		   << log->file_data_bits) +
1110 		  ((((is_log_record_end(hdr) &&
1111 		      h_lsn <= le64_to_cpu(hdr->record_hdr.last_end_lsn)) ?
1112 			     le16_to_cpu(hdr->record_hdr.next_record_off) :
1113 			     log->page_size) +
1114 		    lsn) >>
1115 		   3);
1116 
1117 	return ret;
1118 }
1119 
verify_client_lsn(struct ntfs_log * log,const struct CLIENT_REC * client,u64 lsn)1120 static inline bool verify_client_lsn(struct ntfs_log *log,
1121 				     const struct CLIENT_REC *client, u64 lsn)
1122 {
1123 	return lsn >= le64_to_cpu(client->oldest_lsn) &&
1124 	       lsn <= le64_to_cpu(log->ra->current_lsn) && lsn;
1125 }
1126 
read_log_page(struct ntfs_log * log,u32 vbo,struct RECORD_PAGE_HDR ** buffer,bool * usa_error)1127 static int read_log_page(struct ntfs_log *log, u32 vbo,
1128 			 struct RECORD_PAGE_HDR **buffer, bool *usa_error)
1129 {
1130 	int err = 0;
1131 	u32 page_idx = vbo >> log->page_bits;
1132 	u32 page_off = vbo & log->page_mask;
1133 	u32 bytes = log->page_size - page_off;
1134 	void *to_free = NULL;
1135 	u32 page_vbo = page_idx << log->page_bits;
1136 	struct RECORD_PAGE_HDR *page_buf;
1137 	struct ntfs_inode *ni = log->ni;
1138 	bool bBAAD;
1139 
1140 	if (vbo >= log->l_size)
1141 		return -EINVAL;
1142 
1143 	if (!*buffer) {
1144 		to_free = kmalloc(log->page_size, GFP_NOFS);
1145 		if (!to_free)
1146 			return -ENOMEM;
1147 		*buffer = to_free;
1148 	}
1149 
1150 	page_buf = page_off ? log->one_page_buf : *buffer;
1151 
1152 	err = ntfs_read_run_nb(ni->mi.sbi, &ni->file.run, page_vbo, page_buf,
1153 			       log->page_size, NULL);
1154 	if (err)
1155 		goto out;
1156 
1157 	if (page_buf->rhdr.sign != NTFS_FFFF_SIGNATURE)
1158 		ntfs_fix_post_read(&page_buf->rhdr, PAGE_SIZE, false);
1159 
1160 	if (page_buf != *buffer)
1161 		memcpy(*buffer, Add2Ptr(page_buf, page_off), bytes);
1162 
1163 	bBAAD = page_buf->rhdr.sign == NTFS_BAAD_SIGNATURE;
1164 
1165 	if (usa_error)
1166 		*usa_error = bBAAD;
1167 	/* Check that the update sequence array for this page is valid */
1168 	/* If we don't allow errors, raise an error status */
1169 	else if (bBAAD)
1170 		err = -EINVAL;
1171 
1172 out:
1173 	if (err && to_free) {
1174 		kfree(to_free);
1175 		*buffer = NULL;
1176 	}
1177 
1178 	return err;
1179 }
1180 
1181 /*
1182  * log_read_rst
1183  *
1184  * It walks through 512 blocks of the file looking for a valid
1185  * restart page header. It will stop the first time we find a
1186  * valid page header.
1187  */
log_read_rst(struct ntfs_log * log,bool first,struct restart_info * info)1188 static int log_read_rst(struct ntfs_log *log, bool first,
1189 			struct restart_info *info)
1190 {
1191 	u32 skip;
1192 	u64 vbo;
1193 	struct RESTART_HDR *r_page = NULL;
1194 
1195 	/* Determine which restart area we are looking for. */
1196 	if (first) {
1197 		vbo = 0;
1198 		skip = 512;
1199 	} else {
1200 		vbo = 512;
1201 		skip = 0;
1202 	}
1203 
1204 	/* Loop continuously until we succeed. */
1205 	for (; vbo < log->l_size; vbo = 2 * vbo + skip, skip = 0) {
1206 		bool usa_error;
1207 		bool brst, bchk;
1208 		struct RESTART_AREA *ra;
1209 
1210 		/* Read a page header at the current offset. */
1211 		if (read_log_page(log, vbo, (struct RECORD_PAGE_HDR **)&r_page,
1212 				  &usa_error)) {
1213 			/* Ignore any errors. */
1214 			continue;
1215 		}
1216 
1217 		/* Exit if the signature is a log record page. */
1218 		if (r_page->rhdr.sign == NTFS_RCRD_SIGNATURE) {
1219 			info->initialized = true;
1220 			break;
1221 		}
1222 
1223 		brst = r_page->rhdr.sign == NTFS_RSTR_SIGNATURE;
1224 		bchk = r_page->rhdr.sign == NTFS_CHKD_SIGNATURE;
1225 
1226 		if (!bchk && !brst) {
1227 			if (r_page->rhdr.sign != NTFS_FFFF_SIGNATURE) {
1228 				/*
1229 				 * Remember if the signature does not
1230 				 * indicate uninitialized file.
1231 				 */
1232 				info->initialized = true;
1233 			}
1234 			continue;
1235 		}
1236 
1237 		ra = NULL;
1238 		info->valid_page = false;
1239 		info->initialized = true;
1240 		info->vbo = vbo;
1241 
1242 		/* Let's check the restart area if this is a valid page. */
1243 		if (!is_rst_page_hdr_valid(vbo, r_page))
1244 			goto check_result;
1245 		ra = Add2Ptr(r_page, le16_to_cpu(r_page->ra_off));
1246 
1247 		if (!is_rst_area_valid(r_page))
1248 			goto check_result;
1249 
1250 		/*
1251 		 * We have a valid restart page header and restart area.
1252 		 * If chkdsk was run or we have no clients then we have
1253 		 * no more checking to do.
1254 		 */
1255 		if (bchk || ra->client_idx[1] == LFS_NO_CLIENT_LE) {
1256 			info->valid_page = true;
1257 			goto check_result;
1258 		}
1259 
1260 		if (is_client_area_valid(r_page, usa_error)) {
1261 			info->valid_page = true;
1262 			ra = Add2Ptr(r_page, le16_to_cpu(r_page->ra_off));
1263 		}
1264 
1265 check_result:
1266 		/*
1267 		 * If chkdsk was run then update the caller's
1268 		 * values and return.
1269 		 */
1270 		if (r_page->rhdr.sign == NTFS_CHKD_SIGNATURE) {
1271 			info->chkdsk_was_run = true;
1272 			info->last_lsn = le64_to_cpu(r_page->rhdr.lsn);
1273 			info->restart = true;
1274 			info->r_page = r_page;
1275 			return 0;
1276 		}
1277 
1278 		/*
1279 		 * If we have a valid page then copy the values
1280 		 * we need from it.
1281 		 */
1282 		if (info->valid_page) {
1283 			info->last_lsn = le64_to_cpu(ra->current_lsn);
1284 			info->restart = true;
1285 			info->r_page = r_page;
1286 			return 0;
1287 		}
1288 	}
1289 
1290 	kfree(r_page);
1291 
1292 	return 0;
1293 }
1294 
1295 /*
1296  * Ilog_init_pg_hdr - Init @log from restart page header.
1297  */
log_init_pg_hdr(struct ntfs_log * log,u16 major_ver,u16 minor_ver)1298 static void log_init_pg_hdr(struct ntfs_log *log, u16 major_ver, u16 minor_ver)
1299 {
1300 	log->sys_page_size = log->page_size;
1301 	log->sys_page_mask = log->page_mask;
1302 
1303 	log->clst_per_page = log->page_size >> log->ni->mi.sbi->cluster_bits;
1304 	if (!log->clst_per_page)
1305 		log->clst_per_page = 1;
1306 
1307 	log->first_page = major_ver >= 2 ? 0x22 * log->page_size :
1308 					   4 * log->page_size;
1309 	log->major_ver = major_ver;
1310 	log->minor_ver = minor_ver;
1311 }
1312 
1313 /*
1314  * log_create - Init @log in cases when we don't have a restart area to use.
1315  */
log_create(struct ntfs_log * log,const u64 last_lsn,u32 open_log_count,bool wrapped,bool use_multi_page)1316 static void log_create(struct ntfs_log *log, const u64 last_lsn,
1317 		       u32 open_log_count, bool wrapped, bool use_multi_page)
1318 {
1319 	/* All file offsets must be quadword aligned. */
1320 	log->file_data_bits = blksize_bits(log->l_size) - 3;
1321 	log->seq_num_mask = (8 << log->file_data_bits) - 1;
1322 	log->seq_num_bits = sizeof(u64) * 8 - log->file_data_bits;
1323 	log->seq_num = (last_lsn >> log->file_data_bits) + 2;
1324 	log->next_page = log->first_page;
1325 	log->oldest_lsn = log->seq_num << log->file_data_bits;
1326 	log->oldest_lsn_off = 0;
1327 	log->last_lsn = log->oldest_lsn;
1328 
1329 	log->l_flags |= NTFSLOG_NO_LAST_LSN | NTFSLOG_NO_OLDEST_LSN;
1330 
1331 	/* Set the correct flags for the I/O and indicate if we have wrapped. */
1332 	if (wrapped)
1333 		log->l_flags |= NTFSLOG_WRAPPED;
1334 
1335 	if (use_multi_page)
1336 		log->l_flags |= NTFSLOG_MULTIPLE_PAGE_IO;
1337 
1338 	/* Compute the log page values. */
1339 	log->data_off = ALIGN(
1340 		offsetof(struct RECORD_PAGE_HDR, fixups) +
1341 			sizeof(short) * ((log->page_size >> SECTOR_SHIFT) + 1),
1342 		8);
1343 	log->data_size = log->page_size - log->data_off;
1344 	log->record_header_len = sizeof(struct LFS_RECORD_HDR);
1345 
1346 	/* Remember the different page sizes for reservation. */
1347 	log->reserved = log->data_size - log->record_header_len;
1348 
1349 	/* Compute the restart page values. */
1350 	log->ra_off = ALIGN(
1351 		offsetof(struct RESTART_HDR, fixups) +
1352 			sizeof(short) *
1353 				((log->sys_page_size >> SECTOR_SHIFT) + 1),
1354 		8);
1355 	log->restart_size = log->sys_page_size - log->ra_off;
1356 	log->ra_size = struct_size(log->ra, clients, 1);
1357 	log->current_openlog_count = open_log_count;
1358 
1359 	/*
1360 	 * The total available log file space is the number of
1361 	 * log file pages times the space available on each page.
1362 	 */
1363 	log->total_avail_pages = log->l_size - log->first_page;
1364 	log->total_avail = log->total_avail_pages >> log->page_bits;
1365 
1366 	/*
1367 	 * We assume that we can't use the end of the page less than
1368 	 * the file record size.
1369 	 * Then we won't need to reserve more than the caller asks for.
1370 	 */
1371 	log->max_current_avail = log->total_avail * log->reserved;
1372 	log->total_avail = log->total_avail * log->data_size;
1373 	log->current_avail = log->max_current_avail;
1374 }
1375 
1376 /*
1377  * log_create_ra - Fill a restart area from the values stored in @log.
1378  */
log_create_ra(struct ntfs_log * log)1379 static struct RESTART_AREA *log_create_ra(struct ntfs_log *log)
1380 {
1381 	struct CLIENT_REC *cr;
1382 	struct RESTART_AREA *ra = kzalloc(log->restart_size, GFP_NOFS);
1383 
1384 	if (!ra)
1385 		return NULL;
1386 
1387 	ra->current_lsn = cpu_to_le64(log->last_lsn);
1388 	ra->log_clients = cpu_to_le16(1);
1389 	ra->client_idx[1] = LFS_NO_CLIENT_LE;
1390 	if (log->l_flags & NTFSLOG_MULTIPLE_PAGE_IO)
1391 		ra->flags = RESTART_SINGLE_PAGE_IO;
1392 	ra->seq_num_bits = cpu_to_le32(log->seq_num_bits);
1393 	ra->ra_len = cpu_to_le16(log->ra_size);
1394 	ra->client_off = cpu_to_le16(offsetof(struct RESTART_AREA, clients));
1395 	ra->l_size = cpu_to_le64(log->l_size);
1396 	ra->rec_hdr_len = cpu_to_le16(log->record_header_len);
1397 	ra->data_off = cpu_to_le16(log->data_off);
1398 	ra->open_log_count = cpu_to_le32(log->current_openlog_count + 1);
1399 
1400 	cr = ra->clients;
1401 
1402 	cr->prev_client = LFS_NO_CLIENT_LE;
1403 	cr->next_client = LFS_NO_CLIENT_LE;
1404 
1405 	return ra;
1406 }
1407 
final_log_off(struct ntfs_log * log,u64 lsn,u32 data_len)1408 static u32 final_log_off(struct ntfs_log *log, u64 lsn, u32 data_len)
1409 {
1410 	u32 base_vbo = lsn << 3;
1411 	u32 final_log_off = (base_vbo & log->seq_num_mask) & ~log->page_mask;
1412 	u32 page_off = base_vbo & log->page_mask;
1413 	u32 tail = log->page_size - page_off;
1414 
1415 	page_off -= 1;
1416 
1417 	/* Add the length of the header. */
1418 	data_len += log->record_header_len;
1419 
1420 	/*
1421 	 * If this lsn is contained this log page we are done.
1422 	 * Otherwise we need to walk through several log pages.
1423 	 */
1424 	if (data_len > tail) {
1425 		data_len -= tail;
1426 		tail = log->data_size;
1427 		page_off = log->data_off - 1;
1428 
1429 		for (;;) {
1430 			final_log_off = next_page_off(log, final_log_off);
1431 
1432 			/*
1433 			 * We are done if the remaining bytes
1434 			 * fit on this page.
1435 			 */
1436 			if (data_len <= tail)
1437 				break;
1438 			data_len -= tail;
1439 		}
1440 	}
1441 
1442 	/*
1443 	 * We add the remaining bytes to our starting position on this page
1444 	 * and then add that value to the file offset of this log page.
1445 	 */
1446 	return final_log_off + data_len + page_off;
1447 }
1448 
next_log_lsn(struct ntfs_log * log,const struct LFS_RECORD_HDR * rh,u64 * lsn)1449 static int next_log_lsn(struct ntfs_log *log, const struct LFS_RECORD_HDR *rh,
1450 			u64 *lsn)
1451 {
1452 	int err;
1453 	u64 this_lsn = le64_to_cpu(rh->this_lsn);
1454 	u32 vbo = lsn_to_vbo(log, this_lsn);
1455 	u32 end =
1456 		final_log_off(log, this_lsn, le32_to_cpu(rh->client_data_len));
1457 	u32 hdr_off = end & ~log->sys_page_mask;
1458 	u64 seq = this_lsn >> log->file_data_bits;
1459 	struct RECORD_PAGE_HDR *page = NULL;
1460 
1461 	/* Remember if we wrapped. */
1462 	if (end <= vbo)
1463 		seq += 1;
1464 
1465 	/* Log page header for this page. */
1466 	err = read_log_page(log, hdr_off, &page, NULL);
1467 	if (err)
1468 		return err;
1469 
1470 	/*
1471 	 * If the lsn we were given was not the last lsn on this page,
1472 	 * then the starting offset for the next lsn is on a quad word
1473 	 * boundary following the last file offset for the current lsn.
1474 	 * Otherwise the file offset is the start of the data on the next page.
1475 	 */
1476 	if (this_lsn == le64_to_cpu(page->rhdr.lsn)) {
1477 		/* If we wrapped, we need to increment the sequence number. */
1478 		hdr_off = next_page_off(log, hdr_off);
1479 		if (hdr_off == log->first_page)
1480 			seq += 1;
1481 
1482 		vbo = hdr_off + log->data_off;
1483 	} else {
1484 		vbo = ALIGN(end, 8);
1485 	}
1486 
1487 	/* Compute the lsn based on the file offset and the sequence count. */
1488 	*lsn = vbo_to_lsn(log, vbo, seq);
1489 
1490 	/*
1491 	 * If this lsn is within the legal range for the file, we return true.
1492 	 * Otherwise false indicates that there are no more lsn's.
1493 	 */
1494 	if (!is_lsn_in_file(log, *lsn))
1495 		*lsn = 0;
1496 
1497 	kfree(page);
1498 
1499 	return 0;
1500 }
1501 
1502 /*
1503  * current_log_avail - Calculate the number of bytes available for log records.
1504  */
current_log_avail(struct ntfs_log * log)1505 static u32 current_log_avail(struct ntfs_log *log)
1506 {
1507 	u32 oldest_off, next_free_off, free_bytes;
1508 
1509 	if (log->l_flags & NTFSLOG_NO_LAST_LSN) {
1510 		/* The entire file is available. */
1511 		return log->max_current_avail;
1512 	}
1513 
1514 	/*
1515 	 * If there is a last lsn the restart area then we know that we will
1516 	 * have to compute the free range.
1517 	 * If there is no oldest lsn then start at the first page of the file.
1518 	 */
1519 	oldest_off = (log->l_flags & NTFSLOG_NO_OLDEST_LSN) ?
1520 			     log->first_page :
1521 			     (log->oldest_lsn_off & ~log->sys_page_mask);
1522 
1523 	/*
1524 	 * We will use the next log page offset to compute the next free page.
1525 	 * If we are going to reuse this page go to the next page.
1526 	 * If we are at the first page then use the end of the file.
1527 	 */
1528 	next_free_off = (log->l_flags & NTFSLOG_REUSE_TAIL) ?
1529 				log->next_page + log->page_size :
1530 			log->next_page == log->first_page ? log->l_size :
1531 							    log->next_page;
1532 
1533 	/* If the two offsets are the same then there is no available space. */
1534 	if (oldest_off == next_free_off)
1535 		return 0;
1536 	/*
1537 	 * If the free offset follows the oldest offset then subtract
1538 	 * this range from the total available pages.
1539 	 */
1540 	free_bytes =
1541 		oldest_off < next_free_off ?
1542 			log->total_avail_pages - (next_free_off - oldest_off) :
1543 			oldest_off - next_free_off;
1544 
1545 	free_bytes >>= log->page_bits;
1546 	return free_bytes * log->reserved;
1547 }
1548 
check_subseq_log_page(struct ntfs_log * log,const struct RECORD_PAGE_HDR * rp,u32 vbo,u64 seq)1549 static bool check_subseq_log_page(struct ntfs_log *log,
1550 				  const struct RECORD_PAGE_HDR *rp, u32 vbo,
1551 				  u64 seq)
1552 {
1553 	u64 lsn_seq;
1554 	const struct NTFS_RECORD_HEADER *rhdr = &rp->rhdr;
1555 	u64 lsn = le64_to_cpu(rhdr->lsn);
1556 
1557 	if (rhdr->sign == NTFS_FFFF_SIGNATURE || !rhdr->sign)
1558 		return false;
1559 
1560 	/*
1561 	 * If the last lsn on the page occurs was written after the page
1562 	 * that caused the original error then we have a fatal error.
1563 	 */
1564 	lsn_seq = lsn >> log->file_data_bits;
1565 
1566 	/*
1567 	 * If the sequence number for the lsn the page is equal or greater
1568 	 * than lsn we expect, then this is a subsequent write.
1569 	 */
1570 	return lsn_seq >= seq ||
1571 	       (lsn_seq == seq - 1 && log->first_page == vbo &&
1572 		vbo != (lsn_to_vbo(log, lsn) & ~log->page_mask));
1573 }
1574 
1575 /*
1576  * last_log_lsn
1577  *
1578  * Walks through the log pages for a file, searching for the
1579  * last log page written to the file.
1580  */
last_log_lsn(struct ntfs_log * log)1581 static int last_log_lsn(struct ntfs_log *log)
1582 {
1583 	int err;
1584 	bool usa_error = false;
1585 	bool replace_page = false;
1586 	bool reuse_page = log->l_flags & NTFSLOG_REUSE_TAIL;
1587 	bool wrapped_file, wrapped;
1588 
1589 	u32 page_cnt = 1, page_pos = 1;
1590 	u32 page_off = 0, page_off1 = 0, saved_off = 0;
1591 	u32 final_off, second_off, final_off_prev = 0, second_off_prev = 0;
1592 	u32 first_file_off = 0, second_file_off = 0;
1593 	u32 part_io_count = 0;
1594 	u32 tails = 0;
1595 	u32 this_off, curpage_off, nextpage_off, remain_pages;
1596 
1597 	u64 expected_seq, seq_base = 0, lsn_base = 0;
1598 	u64 best_lsn, best_lsn1, best_lsn2;
1599 	u64 lsn_cur, lsn1, lsn2;
1600 	u64 last_ok_lsn = reuse_page ? log->last_lsn : 0;
1601 
1602 	u16 cur_pos, best_page_pos;
1603 
1604 	struct RECORD_PAGE_HDR *page = NULL;
1605 	struct RECORD_PAGE_HDR *tst_page = NULL;
1606 	struct RECORD_PAGE_HDR *first_tail = NULL;
1607 	struct RECORD_PAGE_HDR *second_tail = NULL;
1608 	struct RECORD_PAGE_HDR *tail_page = NULL;
1609 	struct RECORD_PAGE_HDR *second_tail_prev = NULL;
1610 	struct RECORD_PAGE_HDR *first_tail_prev = NULL;
1611 	struct RECORD_PAGE_HDR *page_bufs = NULL;
1612 	struct RECORD_PAGE_HDR *best_page;
1613 
1614 	if (log->major_ver >= 2) {
1615 		final_off = 0x02 * log->page_size;
1616 		second_off = 0x12 * log->page_size;
1617 
1618 		// 0x10 == 0x12 - 0x2
1619 		page_bufs = kmalloc(log->page_size * 0x10, GFP_NOFS);
1620 		if (!page_bufs)
1621 			return -ENOMEM;
1622 	} else {
1623 		second_off = log->first_page - log->page_size;
1624 		final_off = second_off - log->page_size;
1625 	}
1626 
1627 next_tail:
1628 	/* Read second tail page (at pos 3/0x12000). */
1629 	if (read_log_page(log, second_off, &second_tail, &usa_error) ||
1630 	    usa_error || second_tail->rhdr.sign != NTFS_RCRD_SIGNATURE) {
1631 		kfree(second_tail);
1632 		second_tail = NULL;
1633 		second_file_off = 0;
1634 		lsn2 = 0;
1635 	} else {
1636 		second_file_off = hdr_file_off(log, second_tail);
1637 		lsn2 = le64_to_cpu(second_tail->record_hdr.last_end_lsn);
1638 	}
1639 
1640 	/* Read first tail page (at pos 2/0x2000). */
1641 	if (read_log_page(log, final_off, &first_tail, &usa_error) ||
1642 	    usa_error || first_tail->rhdr.sign != NTFS_RCRD_SIGNATURE) {
1643 		kfree(first_tail);
1644 		first_tail = NULL;
1645 		first_file_off = 0;
1646 		lsn1 = 0;
1647 	} else {
1648 		first_file_off = hdr_file_off(log, first_tail);
1649 		lsn1 = le64_to_cpu(first_tail->record_hdr.last_end_lsn);
1650 	}
1651 
1652 	if (log->major_ver < 2) {
1653 		int best_page;
1654 
1655 		first_tail_prev = first_tail;
1656 		final_off_prev = first_file_off;
1657 		second_tail_prev = second_tail;
1658 		second_off_prev = second_file_off;
1659 		tails = 1;
1660 
1661 		if (!first_tail && !second_tail)
1662 			goto tail_read;
1663 
1664 		if (first_tail && second_tail)
1665 			best_page = lsn1 < lsn2 ? 1 : 0;
1666 		else if (first_tail)
1667 			best_page = 0;
1668 		else
1669 			best_page = 1;
1670 
1671 		page_off = best_page ? second_file_off : first_file_off;
1672 		seq_base = (best_page ? lsn2 : lsn1) >> log->file_data_bits;
1673 		goto tail_read;
1674 	}
1675 
1676 	best_lsn1 = first_tail ? base_lsn(log, first_tail, first_file_off) : 0;
1677 	best_lsn2 = second_tail ? base_lsn(log, second_tail, second_file_off) :
1678 				  0;
1679 
1680 	if (first_tail && second_tail) {
1681 		if (best_lsn1 > best_lsn2) {
1682 			best_lsn = best_lsn1;
1683 			best_page = first_tail;
1684 			this_off = first_file_off;
1685 		} else {
1686 			best_lsn = best_lsn2;
1687 			best_page = second_tail;
1688 			this_off = second_file_off;
1689 		}
1690 	} else if (first_tail) {
1691 		best_lsn = best_lsn1;
1692 		best_page = first_tail;
1693 		this_off = first_file_off;
1694 	} else if (second_tail) {
1695 		best_lsn = best_lsn2;
1696 		best_page = second_tail;
1697 		this_off = second_file_off;
1698 	} else {
1699 		goto tail_read;
1700 	}
1701 
1702 	best_page_pos = le16_to_cpu(best_page->page_pos);
1703 
1704 	if (!tails) {
1705 		if (best_page_pos == page_pos) {
1706 			seq_base = best_lsn >> log->file_data_bits;
1707 			saved_off = page_off = le32_to_cpu(best_page->file_off);
1708 			lsn_base = best_lsn;
1709 
1710 			memmove(page_bufs, best_page, log->page_size);
1711 
1712 			page_cnt = le16_to_cpu(best_page->page_count);
1713 			if (page_cnt > 1)
1714 				page_pos += 1;
1715 
1716 			tails = 1;
1717 		}
1718 	} else if (seq_base == (best_lsn >> log->file_data_bits) &&
1719 		   saved_off + log->page_size == this_off &&
1720 		   lsn_base < best_lsn &&
1721 		   (page_pos != page_cnt || best_page_pos == page_pos ||
1722 		    best_page_pos == 1) &&
1723 		   (page_pos >= page_cnt || best_page_pos == page_pos)) {
1724 		u16 bppc = le16_to_cpu(best_page->page_count);
1725 
1726 		saved_off += log->page_size;
1727 		lsn_base = best_lsn;
1728 
1729 		memmove(Add2Ptr(page_bufs, tails * log->page_size), best_page,
1730 			log->page_size);
1731 
1732 		tails += 1;
1733 
1734 		if (best_page_pos != bppc) {
1735 			page_cnt = bppc;
1736 			page_pos = best_page_pos;
1737 
1738 			if (page_cnt > 1)
1739 				page_pos += 1;
1740 		} else {
1741 			page_pos = page_cnt = 1;
1742 		}
1743 	} else {
1744 		kfree(first_tail);
1745 		kfree(second_tail);
1746 		goto tail_read;
1747 	}
1748 
1749 	kfree(first_tail_prev);
1750 	first_tail_prev = first_tail;
1751 	final_off_prev = first_file_off;
1752 	first_tail = NULL;
1753 
1754 	kfree(second_tail_prev);
1755 	second_tail_prev = second_tail;
1756 	second_off_prev = second_file_off;
1757 	second_tail = NULL;
1758 
1759 	final_off += log->page_size;
1760 	second_off += log->page_size;
1761 
1762 	if (tails < 0x10)
1763 		goto next_tail;
1764 tail_read:
1765 	first_tail = first_tail_prev;
1766 	final_off = final_off_prev;
1767 
1768 	second_tail = second_tail_prev;
1769 	second_off = second_off_prev;
1770 
1771 	page_cnt = page_pos = 1;
1772 
1773 	curpage_off = seq_base == log->seq_num ? min(log->next_page, page_off) :
1774 						 log->next_page;
1775 
1776 	wrapped_file =
1777 		curpage_off == log->first_page &&
1778 		!(log->l_flags & (NTFSLOG_NO_LAST_LSN | NTFSLOG_REUSE_TAIL));
1779 
1780 	expected_seq = wrapped_file ? (log->seq_num + 1) : log->seq_num;
1781 
1782 	nextpage_off = curpage_off;
1783 
1784 next_page:
1785 	tail_page = NULL;
1786 	/* Read the next log page. */
1787 	err = read_log_page(log, curpage_off, &page, &usa_error);
1788 
1789 	/* Compute the next log page offset the file. */
1790 	nextpage_off = next_page_off(log, curpage_off);
1791 	wrapped = nextpage_off == log->first_page;
1792 
1793 	if (tails > 1) {
1794 		struct RECORD_PAGE_HDR *cur_page =
1795 			Add2Ptr(page_bufs, curpage_off - page_off);
1796 
1797 		if (curpage_off == saved_off) {
1798 			tail_page = cur_page;
1799 			goto use_tail_page;
1800 		}
1801 
1802 		if (page_off > curpage_off || curpage_off >= saved_off)
1803 			goto use_tail_page;
1804 
1805 		if (page_off1)
1806 			goto use_cur_page;
1807 
1808 		if (!err && !usa_error &&
1809 		    page->rhdr.sign == NTFS_RCRD_SIGNATURE &&
1810 		    cur_page->rhdr.lsn == page->rhdr.lsn &&
1811 		    cur_page->record_hdr.next_record_off ==
1812 			    page->record_hdr.next_record_off &&
1813 		    ((page_pos == page_cnt &&
1814 		      le16_to_cpu(page->page_pos) == 1) ||
1815 		     (page_pos != page_cnt &&
1816 		      le16_to_cpu(page->page_pos) == page_pos + 1 &&
1817 		      le16_to_cpu(page->page_count) == page_cnt))) {
1818 			cur_page = NULL;
1819 			goto use_tail_page;
1820 		}
1821 
1822 		page_off1 = page_off;
1823 
1824 use_cur_page:
1825 
1826 		lsn_cur = le64_to_cpu(cur_page->rhdr.lsn);
1827 
1828 		if (last_ok_lsn !=
1829 			    le64_to_cpu(cur_page->record_hdr.last_end_lsn) &&
1830 		    ((lsn_cur >> log->file_data_bits) +
1831 		     ((curpage_off <
1832 		       (lsn_to_vbo(log, lsn_cur) & ~log->page_mask)) ?
1833 			      1 :
1834 			      0)) != expected_seq) {
1835 			goto check_tail;
1836 		}
1837 
1838 		if (!is_log_record_end(cur_page)) {
1839 			tail_page = NULL;
1840 			last_ok_lsn = lsn_cur;
1841 			goto next_page_1;
1842 		}
1843 
1844 		log->seq_num = expected_seq;
1845 		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
1846 		log->last_lsn = le64_to_cpu(cur_page->record_hdr.last_end_lsn);
1847 		log->ra->current_lsn = cur_page->record_hdr.last_end_lsn;
1848 
1849 		if (log->record_header_len <=
1850 		    log->page_size -
1851 			    le16_to_cpu(cur_page->record_hdr.next_record_off)) {
1852 			log->l_flags |= NTFSLOG_REUSE_TAIL;
1853 			log->next_page = curpage_off;
1854 		} else {
1855 			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
1856 			log->next_page = nextpage_off;
1857 		}
1858 
1859 		if (wrapped_file)
1860 			log->l_flags |= NTFSLOG_WRAPPED;
1861 
1862 		last_ok_lsn = le64_to_cpu(cur_page->record_hdr.last_end_lsn);
1863 		goto next_page_1;
1864 	}
1865 
1866 	/*
1867 	 * If we are at the expected first page of a transfer check to see
1868 	 * if either tail copy is at this offset.
1869 	 * If this page is the last page of a transfer, check if we wrote
1870 	 * a subsequent tail copy.
1871 	 */
1872 	if (page_cnt == page_pos || page_cnt == page_pos + 1) {
1873 		/*
1874 		 * Check if the offset matches either the first or second
1875 		 * tail copy. It is possible it will match both.
1876 		 */
1877 		if (curpage_off == final_off)
1878 			tail_page = first_tail;
1879 
1880 		/*
1881 		 * If we already matched on the first page then
1882 		 * check the ending lsn's.
1883 		 */
1884 		if (curpage_off == second_off) {
1885 			if (!tail_page ||
1886 			    (second_tail &&
1887 			     le64_to_cpu(second_tail->record_hdr.last_end_lsn) >
1888 				     le64_to_cpu(first_tail->record_hdr
1889 							 .last_end_lsn))) {
1890 				tail_page = second_tail;
1891 			}
1892 		}
1893 	}
1894 
1895 use_tail_page:
1896 	if (tail_page) {
1897 		/* We have a candidate for a tail copy. */
1898 		lsn_cur = le64_to_cpu(tail_page->record_hdr.last_end_lsn);
1899 
1900 		if (last_ok_lsn < lsn_cur) {
1901 			/*
1902 			 * If the sequence number is not expected,
1903 			 * then don't use the tail copy.
1904 			 */
1905 			if (expected_seq != (lsn_cur >> log->file_data_bits))
1906 				tail_page = NULL;
1907 		} else if (last_ok_lsn > lsn_cur) {
1908 			/*
1909 			 * If the last lsn is greater than the one on
1910 			 * this page then forget this tail.
1911 			 */
1912 			tail_page = NULL;
1913 		}
1914 	}
1915 
1916 	/*
1917 	 *If we have an error on the current page,
1918 	 * we will break of this loop.
1919 	 */
1920 	if (err || usa_error)
1921 		goto check_tail;
1922 
1923 	/*
1924 	 * Done if the last lsn on this page doesn't match the previous known
1925 	 * last lsn or the sequence number is not expected.
1926 	 */
1927 	lsn_cur = le64_to_cpu(page->rhdr.lsn);
1928 	if (last_ok_lsn != lsn_cur &&
1929 	    expected_seq != (lsn_cur >> log->file_data_bits)) {
1930 		goto check_tail;
1931 	}
1932 
1933 	/*
1934 	 * Check that the page position and page count values are correct.
1935 	 * If this is the first page of a transfer the position must be 1
1936 	 * and the count will be unknown.
1937 	 */
1938 	if (page_cnt == page_pos) {
1939 		if (page->page_pos != cpu_to_le16(1) &&
1940 		    (!reuse_page || page->page_pos != page->page_count)) {
1941 			/*
1942 			 * If the current page is the first page we are
1943 			 * looking at and we are reusing this page then
1944 			 * it can be either the first or last page of a
1945 			 * transfer. Otherwise it can only be the first.
1946 			 */
1947 			goto check_tail;
1948 		}
1949 	} else if (le16_to_cpu(page->page_count) != page_cnt ||
1950 		   le16_to_cpu(page->page_pos) != page_pos + 1) {
1951 		/*
1952 		 * The page position better be 1 more than the last page
1953 		 * position and the page count better match.
1954 		 */
1955 		goto check_tail;
1956 	}
1957 
1958 	/*
1959 	 * We have a valid page the file and may have a valid page
1960 	 * the tail copy area.
1961 	 * If the tail page was written after the page the file then
1962 	 * break of the loop.
1963 	 */
1964 	if (tail_page &&
1965 	    le64_to_cpu(tail_page->record_hdr.last_end_lsn) > lsn_cur) {
1966 		/* Remember if we will replace the page. */
1967 		replace_page = true;
1968 		goto check_tail;
1969 	}
1970 
1971 	tail_page = NULL;
1972 
1973 	if (is_log_record_end(page)) {
1974 		/*
1975 		 * Since we have read this page we know the sequence number
1976 		 * is the same as our expected value.
1977 		 */
1978 		log->seq_num = expected_seq;
1979 		log->last_lsn = le64_to_cpu(page->record_hdr.last_end_lsn);
1980 		log->ra->current_lsn = page->record_hdr.last_end_lsn;
1981 		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
1982 
1983 		/*
1984 		 * If there is room on this page for another header then
1985 		 * remember we want to reuse the page.
1986 		 */
1987 		if (log->record_header_len <=
1988 		    log->page_size -
1989 			    le16_to_cpu(page->record_hdr.next_record_off)) {
1990 			log->l_flags |= NTFSLOG_REUSE_TAIL;
1991 			log->next_page = curpage_off;
1992 		} else {
1993 			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
1994 			log->next_page = nextpage_off;
1995 		}
1996 
1997 		/* Remember if we wrapped the log file. */
1998 		if (wrapped_file)
1999 			log->l_flags |= NTFSLOG_WRAPPED;
2000 	}
2001 
2002 	/*
2003 	 * Remember the last page count and position.
2004 	 * Also remember the last known lsn.
2005 	 */
2006 	page_cnt = le16_to_cpu(page->page_count);
2007 	page_pos = le16_to_cpu(page->page_pos);
2008 	last_ok_lsn = le64_to_cpu(page->rhdr.lsn);
2009 
2010 next_page_1:
2011 
2012 	if (wrapped) {
2013 		expected_seq += 1;
2014 		wrapped_file = 1;
2015 	}
2016 
2017 	curpage_off = nextpage_off;
2018 	kfree(page);
2019 	page = NULL;
2020 	reuse_page = 0;
2021 	goto next_page;
2022 
2023 check_tail:
2024 	if (tail_page) {
2025 		log->seq_num = expected_seq;
2026 		log->last_lsn = le64_to_cpu(tail_page->record_hdr.last_end_lsn);
2027 		log->ra->current_lsn = tail_page->record_hdr.last_end_lsn;
2028 		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
2029 
2030 		if (log->page_size -
2031 			    le16_to_cpu(
2032 				    tail_page->record_hdr.next_record_off) >=
2033 		    log->record_header_len) {
2034 			log->l_flags |= NTFSLOG_REUSE_TAIL;
2035 			log->next_page = curpage_off;
2036 		} else {
2037 			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
2038 			log->next_page = nextpage_off;
2039 		}
2040 
2041 		if (wrapped)
2042 			log->l_flags |= NTFSLOG_WRAPPED;
2043 	}
2044 
2045 	/* Remember that the partial IO will start at the next page. */
2046 	second_off = nextpage_off;
2047 
2048 	/*
2049 	 * If the next page is the first page of the file then update
2050 	 * the sequence number for log records which begon the next page.
2051 	 */
2052 	if (wrapped)
2053 		expected_seq += 1;
2054 
2055 	/*
2056 	 * If we have a tail copy or are performing single page I/O we can
2057 	 * immediately look at the next page.
2058 	 */
2059 	if (replace_page || (log->ra->flags & RESTART_SINGLE_PAGE_IO)) {
2060 		page_cnt = 2;
2061 		page_pos = 1;
2062 		goto check_valid;
2063 	}
2064 
2065 	if (page_pos != page_cnt)
2066 		goto check_valid;
2067 	/*
2068 	 * If the next page causes us to wrap to the beginning of the log
2069 	 * file then we know which page to check next.
2070 	 */
2071 	if (wrapped) {
2072 		page_cnt = 2;
2073 		page_pos = 1;
2074 		goto check_valid;
2075 	}
2076 
2077 	cur_pos = 2;
2078 
2079 next_test_page:
2080 	kfree(tst_page);
2081 	tst_page = NULL;
2082 
2083 	/* Walk through the file, reading log pages. */
2084 	err = read_log_page(log, nextpage_off, &tst_page, &usa_error);
2085 
2086 	/*
2087 	 * If we get a USA error then assume that we correctly found
2088 	 * the end of the original transfer.
2089 	 */
2090 	if (usa_error)
2091 		goto file_is_valid;
2092 
2093 	/*
2094 	 * If we were able to read the page, we examine it to see if it
2095 	 * is the same or different Io block.
2096 	 */
2097 	if (err)
2098 		goto next_test_page_1;
2099 
2100 	if (le16_to_cpu(tst_page->page_pos) == cur_pos &&
2101 	    check_subseq_log_page(log, tst_page, nextpage_off, expected_seq)) {
2102 		page_cnt = le16_to_cpu(tst_page->page_count) + 1;
2103 		page_pos = le16_to_cpu(tst_page->page_pos);
2104 		goto check_valid;
2105 	} else {
2106 		goto file_is_valid;
2107 	}
2108 
2109 next_test_page_1:
2110 
2111 	nextpage_off = next_page_off(log, curpage_off);
2112 	wrapped = nextpage_off == log->first_page;
2113 
2114 	if (wrapped) {
2115 		expected_seq += 1;
2116 		page_cnt = 2;
2117 		page_pos = 1;
2118 	}
2119 
2120 	cur_pos += 1;
2121 	part_io_count += 1;
2122 	if (!wrapped)
2123 		goto next_test_page;
2124 
2125 check_valid:
2126 	/* Skip over the remaining pages this transfer. */
2127 	remain_pages = page_cnt - page_pos - 1;
2128 	part_io_count += remain_pages;
2129 
2130 	while (remain_pages--) {
2131 		nextpage_off = next_page_off(log, curpage_off);
2132 		wrapped = nextpage_off == log->first_page;
2133 
2134 		if (wrapped)
2135 			expected_seq += 1;
2136 	}
2137 
2138 	/* Call our routine to check this log page. */
2139 	kfree(tst_page);
2140 	tst_page = NULL;
2141 
2142 	err = read_log_page(log, nextpage_off, &tst_page, &usa_error);
2143 	if (!err && !usa_error &&
2144 	    check_subseq_log_page(log, tst_page, nextpage_off, expected_seq)) {
2145 		err = -EINVAL;
2146 		goto out;
2147 	}
2148 
2149 file_is_valid:
2150 
2151 	/* We have a valid file. */
2152 	if (page_off1 || tail_page) {
2153 		struct RECORD_PAGE_HDR *tmp_page;
2154 
2155 		if (sb_rdonly(log->ni->mi.sbi->sb)) {
2156 			err = -EROFS;
2157 			goto out;
2158 		}
2159 
2160 		if (page_off1) {
2161 			tmp_page = Add2Ptr(page_bufs, page_off1 - page_off);
2162 			tails -= (page_off1 - page_off) / log->page_size;
2163 			if (!tail_page)
2164 				tails -= 1;
2165 		} else {
2166 			tmp_page = tail_page;
2167 			tails = 1;
2168 		}
2169 
2170 		while (tails--) {
2171 			u64 off = hdr_file_off(log, tmp_page);
2172 
2173 			if (!page) {
2174 				page = kmalloc(log->page_size, GFP_NOFS);
2175 				if (!page) {
2176 					err = -ENOMEM;
2177 					goto out;
2178 				}
2179 			}
2180 
2181 			/*
2182 			 * Correct page and copy the data from this page
2183 			 * into it and flush it to disk.
2184 			 */
2185 			memcpy(page, tmp_page, log->page_size);
2186 
2187 			/* Fill last flushed lsn value flush the page. */
2188 			if (log->major_ver < 2)
2189 				page->rhdr.lsn = page->record_hdr.last_end_lsn;
2190 			else
2191 				page->file_off = 0;
2192 
2193 			page->page_pos = page->page_count = cpu_to_le16(1);
2194 
2195 			ntfs_fix_pre_write(&page->rhdr, log->page_size);
2196 
2197 			err = ntfs_sb_write_run(log->ni->mi.sbi,
2198 						&log->ni->file.run, off, page,
2199 						log->page_size, 0);
2200 
2201 			if (err)
2202 				goto out;
2203 
2204 			if (part_io_count && second_off == off) {
2205 				second_off += log->page_size;
2206 				part_io_count -= 1;
2207 			}
2208 
2209 			tmp_page = Add2Ptr(tmp_page, log->page_size);
2210 		}
2211 	}
2212 
2213 	if (part_io_count) {
2214 		if (sb_rdonly(log->ni->mi.sbi->sb)) {
2215 			err = -EROFS;
2216 			goto out;
2217 		}
2218 	}
2219 
2220 out:
2221 	kfree(second_tail);
2222 	kfree(first_tail);
2223 	kfree(page);
2224 	kfree(tst_page);
2225 	kfree(page_bufs);
2226 
2227 	return err;
2228 }
2229 
2230 /*
2231  * read_log_rec_buf - Copy a log record from the file to a buffer.
2232  *
2233  * The log record may span several log pages and may even wrap the file.
2234  */
read_log_rec_buf(struct ntfs_log * log,const struct LFS_RECORD_HDR * rh,void * buffer)2235 static int read_log_rec_buf(struct ntfs_log *log,
2236 			    const struct LFS_RECORD_HDR *rh, void *buffer)
2237 {
2238 	int err;
2239 	struct RECORD_PAGE_HDR *ph = NULL;
2240 	u64 lsn = le64_to_cpu(rh->this_lsn);
2241 	u32 vbo = lsn_to_vbo(log, lsn) & ~log->page_mask;
2242 	u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;
2243 	u32 data_len = le32_to_cpu(rh->client_data_len);
2244 
2245 	/*
2246 	 * While there are more bytes to transfer,
2247 	 * we continue to attempt to perform the read.
2248 	 */
2249 	for (;;) {
2250 		bool usa_error;
2251 		u32 tail = log->page_size - off;
2252 
2253 		if (tail >= data_len)
2254 			tail = data_len;
2255 
2256 		data_len -= tail;
2257 
2258 		err = read_log_page(log, vbo, &ph, &usa_error);
2259 		if (err)
2260 			goto out;
2261 
2262 		/*
2263 		 * The last lsn on this page better be greater or equal
2264 		 * to the lsn we are copying.
2265 		 */
2266 		if (lsn > le64_to_cpu(ph->rhdr.lsn)) {
2267 			err = -EINVAL;
2268 			goto out;
2269 		}
2270 
2271 		memcpy(buffer, Add2Ptr(ph, off), tail);
2272 
2273 		/* If there are no more bytes to transfer, we exit the loop. */
2274 		if (!data_len) {
2275 			if (!is_log_record_end(ph) ||
2276 			    lsn > le64_to_cpu(ph->record_hdr.last_end_lsn)) {
2277 				err = -EINVAL;
2278 				goto out;
2279 			}
2280 			break;
2281 		}
2282 
2283 		if (ph->rhdr.lsn == ph->record_hdr.last_end_lsn ||
2284 		    lsn > le64_to_cpu(ph->rhdr.lsn)) {
2285 			err = -EINVAL;
2286 			goto out;
2287 		}
2288 
2289 		vbo = next_page_off(log, vbo);
2290 		off = log->data_off;
2291 
2292 		/*
2293 		 * Adjust our pointer the user's buffer to transfer
2294 		 * the next block to.
2295 		 */
2296 		buffer = Add2Ptr(buffer, tail);
2297 	}
2298 
2299 out:
2300 	kfree(ph);
2301 	return err;
2302 }
2303 
read_rst_area(struct ntfs_log * log,struct NTFS_RESTART ** rst_,u64 * lsn)2304 static int read_rst_area(struct ntfs_log *log, struct NTFS_RESTART **rst_,
2305 			 u64 *lsn)
2306 {
2307 	int err;
2308 	struct LFS_RECORD_HDR *rh = NULL;
2309 	const struct CLIENT_REC *cr =
2310 		Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off));
2311 	u64 lsnr, lsnc = le64_to_cpu(cr->restart_lsn);
2312 	u32 len;
2313 	struct NTFS_RESTART *rst;
2314 
2315 	*lsn = 0;
2316 	*rst_ = NULL;
2317 
2318 	/* If the client doesn't have a restart area, go ahead and exit now. */
2319 	if (!lsnc)
2320 		return 0;
2321 
2322 	err = read_log_page(log, lsn_to_vbo(log, lsnc),
2323 			    (struct RECORD_PAGE_HDR **)&rh, NULL);
2324 	if (err)
2325 		return err;
2326 
2327 	rst = NULL;
2328 	lsnr = le64_to_cpu(rh->this_lsn);
2329 
2330 	if (lsnc != lsnr) {
2331 		/* If the lsn values don't match, then the disk is corrupt. */
2332 		err = -EINVAL;
2333 		goto out;
2334 	}
2335 
2336 	*lsn = lsnr;
2337 	len = le32_to_cpu(rh->client_data_len);
2338 
2339 	if (!len) {
2340 		err = 0;
2341 		goto out;
2342 	}
2343 
2344 	if (len < sizeof(struct NTFS_RESTART)) {
2345 		err = -EINVAL;
2346 		goto out;
2347 	}
2348 
2349 	rst = kmalloc(len, GFP_NOFS);
2350 	if (!rst) {
2351 		err = -ENOMEM;
2352 		goto out;
2353 	}
2354 
2355 	/* Copy the data into the 'rst' buffer. */
2356 	err = read_log_rec_buf(log, rh, rst);
2357 	if (err)
2358 		goto out;
2359 
2360 	*rst_ = rst;
2361 	rst = NULL;
2362 
2363 out:
2364 	kfree(rh);
2365 	kfree(rst);
2366 
2367 	return err;
2368 }
2369 
find_log_rec(struct ntfs_log * log,u64 lsn,struct lcb * lcb)2370 static int find_log_rec(struct ntfs_log *log, u64 lsn, struct lcb *lcb)
2371 {
2372 	int err;
2373 	struct LFS_RECORD_HDR *rh = lcb->lrh;
2374 	u32 rec_len, len;
2375 
2376 	/* Read the record header for this lsn. */
2377 	if (!rh) {
2378 		err = read_log_page(log, lsn_to_vbo(log, lsn),
2379 				    (struct RECORD_PAGE_HDR **)&rh, NULL);
2380 
2381 		lcb->lrh = rh;
2382 		if (err)
2383 			return err;
2384 	}
2385 
2386 	/*
2387 	 * If the lsn the log record doesn't match the desired
2388 	 * lsn then the disk is corrupt.
2389 	 */
2390 	if (lsn != le64_to_cpu(rh->this_lsn))
2391 		return -EINVAL;
2392 
2393 	len = le32_to_cpu(rh->client_data_len);
2394 
2395 	/*
2396 	 * Check that the length field isn't greater than the total
2397 	 * available space the log file.
2398 	 */
2399 	rec_len = len + log->record_header_len;
2400 	if (rec_len >= log->total_avail)
2401 		return -EINVAL;
2402 
2403 	/*
2404 	 * If the entire log record is on this log page,
2405 	 * put a pointer to the log record the context block.
2406 	 */
2407 	if (rh->flags & LOG_RECORD_MULTI_PAGE) {
2408 		void *lr = kmalloc(len, GFP_NOFS);
2409 
2410 		if (!lr)
2411 			return -ENOMEM;
2412 
2413 		lcb->log_rec = lr;
2414 		lcb->alloc = true;
2415 
2416 		/* Copy the data into the buffer returned. */
2417 		err = read_log_rec_buf(log, rh, lr);
2418 		if (err)
2419 			return err;
2420 	} else {
2421 		/* If beyond the end of the current page -> an error. */
2422 		u32 page_off = lsn_to_page_off(log, lsn);
2423 
2424 		if (page_off + len + log->record_header_len > log->page_size)
2425 			return -EINVAL;
2426 
2427 		lcb->log_rec = Add2Ptr(rh, sizeof(struct LFS_RECORD_HDR));
2428 		lcb->alloc = false;
2429 	}
2430 
2431 	return 0;
2432 }
2433 
2434 /*
2435  * read_log_rec_lcb - Init the query operation.
2436  */
read_log_rec_lcb(struct ntfs_log * log,u64 lsn,u32 ctx_mode,struct lcb ** lcb_)2437 static int read_log_rec_lcb(struct ntfs_log *log, u64 lsn, u32 ctx_mode,
2438 			    struct lcb **lcb_)
2439 {
2440 	int err;
2441 	const struct CLIENT_REC *cr;
2442 	struct lcb *lcb;
2443 
2444 	switch (ctx_mode) {
2445 	case lcb_ctx_undo_next:
2446 	case lcb_ctx_prev:
2447 	case lcb_ctx_next:
2448 		break;
2449 	default:
2450 		return -EINVAL;
2451 	}
2452 
2453 	/* Check that the given lsn is the legal range for this client. */
2454 	cr = Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off));
2455 
2456 	if (!verify_client_lsn(log, cr, lsn))
2457 		return -EINVAL;
2458 
2459 	lcb = kzalloc(sizeof(struct lcb), GFP_NOFS);
2460 	if (!lcb)
2461 		return -ENOMEM;
2462 	lcb->client = log->client_id;
2463 	lcb->ctx_mode = ctx_mode;
2464 
2465 	/* Find the log record indicated by the given lsn. */
2466 	err = find_log_rec(log, lsn, lcb);
2467 	if (err)
2468 		goto out;
2469 
2470 	*lcb_ = lcb;
2471 	return 0;
2472 
2473 out:
2474 	lcb_put(lcb);
2475 	*lcb_ = NULL;
2476 	return err;
2477 }
2478 
2479 /*
2480  * find_client_next_lsn
2481  *
2482  * Attempt to find the next lsn to return to a client based on the context mode.
2483  */
find_client_next_lsn(struct ntfs_log * log,struct lcb * lcb,u64 * lsn)2484 static int find_client_next_lsn(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
2485 {
2486 	int err;
2487 	u64 next_lsn;
2488 	struct LFS_RECORD_HDR *hdr;
2489 
2490 	hdr = lcb->lrh;
2491 	*lsn = 0;
2492 
2493 	if (lcb_ctx_next != lcb->ctx_mode)
2494 		goto check_undo_next;
2495 
2496 	/* Loop as long as another lsn can be found. */
2497 	for (;;) {
2498 		u64 current_lsn;
2499 
2500 		err = next_log_lsn(log, hdr, &current_lsn);
2501 		if (err)
2502 			goto out;
2503 
2504 		if (!current_lsn)
2505 			break;
2506 
2507 		if (hdr != lcb->lrh)
2508 			kfree(hdr);
2509 
2510 		hdr = NULL;
2511 		err = read_log_page(log, lsn_to_vbo(log, current_lsn),
2512 				    (struct RECORD_PAGE_HDR **)&hdr, NULL);
2513 		if (err)
2514 			goto out;
2515 
2516 		if (memcmp(&hdr->client, &lcb->client,
2517 			   sizeof(struct CLIENT_ID))) {
2518 			/*err = -EINVAL; */
2519 		} else if (LfsClientRecord == hdr->record_type) {
2520 			kfree(lcb->lrh);
2521 			lcb->lrh = hdr;
2522 			*lsn = current_lsn;
2523 			return 0;
2524 		}
2525 	}
2526 
2527 out:
2528 	if (hdr != lcb->lrh)
2529 		kfree(hdr);
2530 	return err;
2531 
2532 check_undo_next:
2533 	if (lcb_ctx_undo_next == lcb->ctx_mode)
2534 		next_lsn = le64_to_cpu(hdr->client_undo_next_lsn);
2535 	else if (lcb_ctx_prev == lcb->ctx_mode)
2536 		next_lsn = le64_to_cpu(hdr->client_prev_lsn);
2537 	else
2538 		return 0;
2539 
2540 	if (!next_lsn)
2541 		return 0;
2542 
2543 	if (!verify_client_lsn(
2544 		    log, Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off)),
2545 		    next_lsn))
2546 		return 0;
2547 
2548 	hdr = NULL;
2549 	err = read_log_page(log, lsn_to_vbo(log, next_lsn),
2550 			    (struct RECORD_PAGE_HDR **)&hdr, NULL);
2551 	if (err)
2552 		return err;
2553 	kfree(lcb->lrh);
2554 	lcb->lrh = hdr;
2555 
2556 	*lsn = next_lsn;
2557 
2558 	return 0;
2559 }
2560 
read_next_log_rec(struct ntfs_log * log,struct lcb * lcb,u64 * lsn)2561 static int read_next_log_rec(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
2562 {
2563 	int err;
2564 
2565 	err = find_client_next_lsn(log, lcb, lsn);
2566 	if (err)
2567 		return err;
2568 
2569 	if (!*lsn)
2570 		return 0;
2571 
2572 	if (lcb->alloc)
2573 		kfree(lcb->log_rec);
2574 
2575 	lcb->log_rec = NULL;
2576 	lcb->alloc = false;
2577 	kfree(lcb->lrh);
2578 	lcb->lrh = NULL;
2579 
2580 	return find_log_rec(log, *lsn, lcb);
2581 }
2582 
check_index_header(const struct INDEX_HDR * hdr,size_t bytes)2583 bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes)
2584 {
2585 	__le16 mask;
2586 	u32 min_de, de_off, used, total;
2587 	const struct NTFS_DE *e;
2588 
2589 	if (hdr_has_subnode(hdr)) {
2590 		min_de = sizeof(struct NTFS_DE) + sizeof(u64);
2591 		mask = NTFS_IE_HAS_SUBNODES;
2592 	} else {
2593 		min_de = sizeof(struct NTFS_DE);
2594 		mask = 0;
2595 	}
2596 
2597 	de_off = le32_to_cpu(hdr->de_off);
2598 	used = le32_to_cpu(hdr->used);
2599 	total = le32_to_cpu(hdr->total);
2600 
2601 	if (de_off > bytes - min_de || used > bytes || total > bytes ||
2602 	    de_off + min_de > used || used > total) {
2603 		return false;
2604 	}
2605 
2606 	e = Add2Ptr(hdr, de_off);
2607 	for (;;) {
2608 		u16 esize = le16_to_cpu(e->size);
2609 		struct NTFS_DE *next = Add2Ptr(e, esize);
2610 
2611 		if (esize < min_de || PtrOffset(hdr, next) > used ||
2612 		    (e->flags & NTFS_IE_HAS_SUBNODES) != mask) {
2613 			return false;
2614 		}
2615 
2616 		if (de_is_last(e))
2617 			break;
2618 
2619 		e = next;
2620 	}
2621 
2622 	return true;
2623 }
2624 
check_index_buffer(const struct INDEX_BUFFER * ib,u32 bytes)2625 static inline bool check_index_buffer(const struct INDEX_BUFFER *ib, u32 bytes)
2626 {
2627 	u16 fo;
2628 	const struct NTFS_RECORD_HEADER *r = &ib->rhdr;
2629 
2630 	if (r->sign != NTFS_INDX_SIGNATURE)
2631 		return false;
2632 
2633 	fo = (SECTOR_SIZE - ((bytes >> SECTOR_SHIFT) + 1) * sizeof(short));
2634 
2635 	if (le16_to_cpu(r->fix_off) > fo)
2636 		return false;
2637 
2638 	if ((le16_to_cpu(r->fix_num) - 1) * SECTOR_SIZE != bytes)
2639 		return false;
2640 
2641 	return check_index_header(&ib->ihdr,
2642 				  bytes - offsetof(struct INDEX_BUFFER, ihdr));
2643 }
2644 
check_index_root(const struct ATTRIB * attr,struct ntfs_sb_info * sbi)2645 static inline bool check_index_root(const struct ATTRIB *attr,
2646 				    struct ntfs_sb_info *sbi)
2647 {
2648 	bool ret;
2649 	const struct INDEX_ROOT *root = resident_data(attr);
2650 	u8 index_bits = le32_to_cpu(root->index_block_size) >=
2651 					sbi->cluster_size ?
2652 				sbi->cluster_bits :
2653 				SECTOR_SHIFT;
2654 	u8 block_clst = root->index_block_clst;
2655 
2656 	if (le32_to_cpu(attr->res.data_size) < sizeof(struct INDEX_ROOT) ||
2657 	    (root->type != ATTR_NAME && root->type != ATTR_ZERO) ||
2658 	    (root->type == ATTR_NAME &&
2659 	     root->rule != NTFS_COLLATION_TYPE_FILENAME) ||
2660 	    (le32_to_cpu(root->index_block_size) !=
2661 	     (block_clst << index_bits)) ||
2662 	    (block_clst != 1 && block_clst != 2 && block_clst != 4 &&
2663 	     block_clst != 8 && block_clst != 0x10 && block_clst != 0x20 &&
2664 	     block_clst != 0x40 && block_clst != 0x80)) {
2665 		return false;
2666 	}
2667 
2668 	ret = check_index_header(&root->ihdr,
2669 				 le32_to_cpu(attr->res.data_size) -
2670 					 offsetof(struct INDEX_ROOT, ihdr));
2671 	return ret;
2672 }
2673 
check_attr(const struct MFT_REC * rec,const struct ATTRIB * attr,struct ntfs_sb_info * sbi)2674 static inline bool check_attr(const struct MFT_REC *rec,
2675 			      const struct ATTRIB *attr,
2676 			      struct ntfs_sb_info *sbi)
2677 {
2678 	u32 asize = le32_to_cpu(attr->size);
2679 	u32 rsize = 0;
2680 	u64 dsize, svcn, evcn;
2681 	u16 run_off;
2682 
2683 	/* Check the fixed part of the attribute record header. */
2684 	if (asize >= sbi->record_size ||
2685 	    asize + PtrOffset(rec, attr) >= sbi->record_size ||
2686 	    (attr->name_len &&
2687 	     le16_to_cpu(attr->name_off) + attr->name_len * sizeof(short) >
2688 		     asize)) {
2689 		return false;
2690 	}
2691 
2692 	/* Check the attribute fields. */
2693 	switch (attr->non_res) {
2694 	case 0:
2695 		rsize = le32_to_cpu(attr->res.data_size);
2696 		if (rsize >= asize ||
2697 		    le16_to_cpu(attr->res.data_off) + rsize > asize) {
2698 			return false;
2699 		}
2700 		break;
2701 
2702 	case 1:
2703 		dsize = le64_to_cpu(attr->nres.data_size);
2704 		svcn = le64_to_cpu(attr->nres.svcn);
2705 		evcn = le64_to_cpu(attr->nres.evcn);
2706 		run_off = le16_to_cpu(attr->nres.run_off);
2707 
2708 		if (svcn > evcn + 1 || run_off >= asize ||
2709 		    le64_to_cpu(attr->nres.valid_size) > dsize ||
2710 		    dsize > le64_to_cpu(attr->nres.alloc_size)) {
2711 			return false;
2712 		}
2713 
2714 		if (run_off > asize)
2715 			return false;
2716 
2717 		if (run_unpack(NULL, sbi, 0, svcn, evcn, svcn,
2718 			       Add2Ptr(attr, run_off), asize - run_off) < 0) {
2719 			return false;
2720 		}
2721 
2722 		return true;
2723 
2724 	default:
2725 		return false;
2726 	}
2727 
2728 	switch (attr->type) {
2729 	case ATTR_NAME:
2730 		if (fname_full_size(Add2Ptr(
2731 			    attr, le16_to_cpu(attr->res.data_off))) > asize) {
2732 			return false;
2733 		}
2734 		break;
2735 
2736 	case ATTR_ROOT:
2737 		return check_index_root(attr, sbi);
2738 
2739 	case ATTR_STD:
2740 		if (rsize < sizeof(struct ATTR_STD_INFO5) &&
2741 		    rsize != sizeof(struct ATTR_STD_INFO)) {
2742 			return false;
2743 		}
2744 		break;
2745 
2746 	case ATTR_LIST:
2747 	case ATTR_ID:
2748 	case ATTR_SECURE:
2749 	case ATTR_LABEL:
2750 	case ATTR_VOL_INFO:
2751 	case ATTR_DATA:
2752 	case ATTR_ALLOC:
2753 	case ATTR_BITMAP:
2754 	case ATTR_REPARSE:
2755 	case ATTR_EA_INFO:
2756 	case ATTR_EA:
2757 	case ATTR_PROPERTYSET:
2758 	case ATTR_LOGGED_UTILITY_STREAM:
2759 		break;
2760 
2761 	default:
2762 		return false;
2763 	}
2764 
2765 	return true;
2766 }
2767 
check_file_record(const struct MFT_REC * rec,const struct MFT_REC * rec2,struct ntfs_sb_info * sbi)2768 static inline bool check_file_record(const struct MFT_REC *rec,
2769 				     const struct MFT_REC *rec2,
2770 				     struct ntfs_sb_info *sbi)
2771 {
2772 	const struct ATTRIB *attr;
2773 	u16 fo = le16_to_cpu(rec->rhdr.fix_off);
2774 	u16 fn = le16_to_cpu(rec->rhdr.fix_num);
2775 	u16 ao = le16_to_cpu(rec->attr_off);
2776 	u32 rs = sbi->record_size;
2777 
2778 	/* Check the file record header for consistency. */
2779 	if (rec->rhdr.sign != NTFS_FILE_SIGNATURE ||
2780 	    fo > (SECTOR_SIZE - ((rs >> SECTOR_SHIFT) + 1) * sizeof(short)) ||
2781 	    (fn - 1) * SECTOR_SIZE != rs || ao < MFTRECORD_FIXUP_OFFSET_1 ||
2782 	    ao > sbi->record_size - SIZEOF_RESIDENT || !is_rec_inuse(rec) ||
2783 	    le32_to_cpu(rec->total) != rs) {
2784 		return false;
2785 	}
2786 
2787 	/* Loop to check all of the attributes. */
2788 	for (attr = Add2Ptr(rec, ao); attr->type != ATTR_END;
2789 	     attr = Add2Ptr(attr, le32_to_cpu(attr->size))) {
2790 		if (check_attr(rec, attr, sbi))
2791 			continue;
2792 		return false;
2793 	}
2794 
2795 	return true;
2796 }
2797 
check_lsn(const struct NTFS_RECORD_HEADER * hdr,const u64 * rlsn)2798 static inline int check_lsn(const struct NTFS_RECORD_HEADER *hdr,
2799 			    const u64 *rlsn)
2800 {
2801 	u64 lsn;
2802 
2803 	if (!rlsn)
2804 		return true;
2805 
2806 	lsn = le64_to_cpu(hdr->lsn);
2807 
2808 	if (hdr->sign == NTFS_HOLE_SIGNATURE)
2809 		return false;
2810 
2811 	if (*rlsn > lsn)
2812 		return true;
2813 
2814 	return false;
2815 }
2816 
check_if_attr(const struct MFT_REC * rec,const struct LOG_REC_HDR * lrh)2817 static inline bool check_if_attr(const struct MFT_REC *rec,
2818 				 const struct LOG_REC_HDR *lrh)
2819 {
2820 	u16 ro = le16_to_cpu(lrh->record_off);
2821 	u16 o = le16_to_cpu(rec->attr_off);
2822 	const struct ATTRIB *attr = Add2Ptr(rec, o);
2823 
2824 	while (o < ro) {
2825 		u32 asize;
2826 
2827 		if (attr->type == ATTR_END)
2828 			break;
2829 
2830 		asize = le32_to_cpu(attr->size);
2831 		if (!asize)
2832 			break;
2833 
2834 		o += asize;
2835 		attr = Add2Ptr(attr, asize);
2836 	}
2837 
2838 	return o == ro;
2839 }
2840 
check_if_index_root(const struct MFT_REC * rec,const struct LOG_REC_HDR * lrh)2841 static inline bool check_if_index_root(const struct MFT_REC *rec,
2842 				       const struct LOG_REC_HDR *lrh)
2843 {
2844 	u16 ro = le16_to_cpu(lrh->record_off);
2845 	u16 o = le16_to_cpu(rec->attr_off);
2846 	const struct ATTRIB *attr = Add2Ptr(rec, o);
2847 
2848 	while (o < ro) {
2849 		u32 asize;
2850 
2851 		if (attr->type == ATTR_END)
2852 			break;
2853 
2854 		asize = le32_to_cpu(attr->size);
2855 		if (!asize)
2856 			break;
2857 
2858 		o += asize;
2859 		attr = Add2Ptr(attr, asize);
2860 	}
2861 
2862 	return o == ro && attr->type == ATTR_ROOT;
2863 }
2864 
check_if_root_index(const struct ATTRIB * attr,const struct INDEX_HDR * hdr,const struct LOG_REC_HDR * lrh)2865 static inline bool check_if_root_index(const struct ATTRIB *attr,
2866 				       const struct INDEX_HDR *hdr,
2867 				       const struct LOG_REC_HDR *lrh)
2868 {
2869 	u16 ao = le16_to_cpu(lrh->attr_off);
2870 	u32 de_off = le32_to_cpu(hdr->de_off);
2871 	u32 o = PtrOffset(attr, hdr) + de_off;
2872 	const struct NTFS_DE *e = Add2Ptr(hdr, de_off);
2873 	u32 asize = le32_to_cpu(attr->size);
2874 
2875 	while (o < ao) {
2876 		u16 esize;
2877 
2878 		if (o >= asize)
2879 			break;
2880 
2881 		esize = le16_to_cpu(e->size);
2882 		if (!esize)
2883 			break;
2884 
2885 		o += esize;
2886 		e = Add2Ptr(e, esize);
2887 	}
2888 
2889 	return o == ao;
2890 }
2891 
check_if_alloc_index(const struct INDEX_HDR * hdr,u32 attr_off)2892 static inline bool check_if_alloc_index(const struct INDEX_HDR *hdr,
2893 					u32 attr_off)
2894 {
2895 	u32 de_off = le32_to_cpu(hdr->de_off);
2896 	u32 o = offsetof(struct INDEX_BUFFER, ihdr) + de_off;
2897 	const struct NTFS_DE *e = Add2Ptr(hdr, de_off);
2898 	u32 used = le32_to_cpu(hdr->used);
2899 
2900 	while (o < attr_off) {
2901 		u16 esize;
2902 
2903 		if (de_off >= used)
2904 			break;
2905 
2906 		esize = le16_to_cpu(e->size);
2907 		if (!esize)
2908 			break;
2909 
2910 		o += esize;
2911 		de_off += esize;
2912 		e = Add2Ptr(e, esize);
2913 	}
2914 
2915 	return o == attr_off;
2916 }
2917 
change_attr_size(struct MFT_REC * rec,struct ATTRIB * attr,u32 nsize)2918 static inline void change_attr_size(struct MFT_REC *rec, struct ATTRIB *attr,
2919 				    u32 nsize)
2920 {
2921 	u32 asize = le32_to_cpu(attr->size);
2922 	int dsize = nsize - asize;
2923 	u8 *next = Add2Ptr(attr, asize);
2924 	u32 used = le32_to_cpu(rec->used);
2925 
2926 	memmove(Add2Ptr(attr, nsize), next, used - PtrOffset(rec, next));
2927 
2928 	rec->used = cpu_to_le32(used + dsize);
2929 	attr->size = cpu_to_le32(nsize);
2930 }
2931 
2932 struct OpenAttr {
2933 	struct ATTRIB *attr;
2934 	struct runs_tree *run1;
2935 	struct runs_tree run0;
2936 	struct ntfs_inode *ni;
2937 	// CLST rno;
2938 };
2939 
2940 /*
2941  * cmp_type_and_name
2942  *
2943  * Return: 0 if 'attr' has the same type and name.
2944  */
cmp_type_and_name(const struct ATTRIB * a1,const struct ATTRIB * a2)2945 static inline int cmp_type_and_name(const struct ATTRIB *a1,
2946 				    const struct ATTRIB *a2)
2947 {
2948 	return a1->type != a2->type || a1->name_len != a2->name_len ||
2949 	       (a1->name_len && memcmp(attr_name(a1), attr_name(a2),
2950 				       a1->name_len * sizeof(short)));
2951 }
2952 
find_loaded_attr(struct ntfs_log * log,const struct ATTRIB * attr,CLST rno)2953 static struct OpenAttr *find_loaded_attr(struct ntfs_log *log,
2954 					 const struct ATTRIB *attr, CLST rno)
2955 {
2956 	struct OPEN_ATTR_ENRTY *oe = NULL;
2957 
2958 	while ((oe = enum_rstbl(log->open_attr_tbl, oe))) {
2959 		struct OpenAttr *op_attr;
2960 
2961 		if (ino_get(&oe->ref) != rno)
2962 			continue;
2963 
2964 		op_attr = (struct OpenAttr *)oe->ptr;
2965 		if (!cmp_type_and_name(op_attr->attr, attr))
2966 			return op_attr;
2967 	}
2968 	return NULL;
2969 }
2970 
attr_create_nonres_log(struct ntfs_sb_info * sbi,enum ATTR_TYPE type,u64 size,const u16 * name,size_t name_len,__le16 flags)2971 static struct ATTRIB *attr_create_nonres_log(struct ntfs_sb_info *sbi,
2972 					     enum ATTR_TYPE type, u64 size,
2973 					     const u16 *name, size_t name_len,
2974 					     __le16 flags)
2975 {
2976 	struct ATTRIB *attr;
2977 	u32 name_size = ALIGN(name_len * sizeof(short), 8);
2978 	bool is_ext = flags & (ATTR_FLAG_COMPRESSED | ATTR_FLAG_SPARSED);
2979 	u32 asize = name_size +
2980 		    (is_ext ? SIZEOF_NONRESIDENT_EX : SIZEOF_NONRESIDENT);
2981 
2982 	attr = kzalloc(asize, GFP_NOFS);
2983 	if (!attr)
2984 		return NULL;
2985 
2986 	attr->type = type;
2987 	attr->size = cpu_to_le32(asize);
2988 	attr->flags = flags;
2989 	attr->non_res = 1;
2990 	attr->name_len = name_len;
2991 
2992 	attr->nres.evcn = cpu_to_le64((u64)bytes_to_cluster(sbi, size) - 1);
2993 	attr->nres.alloc_size = cpu_to_le64(ntfs_up_cluster(sbi, size));
2994 	attr->nres.data_size = cpu_to_le64(size);
2995 	attr->nres.valid_size = attr->nres.data_size;
2996 	if (is_ext) {
2997 		attr->name_off = SIZEOF_NONRESIDENT_EX_LE;
2998 		if (is_attr_compressed(attr))
2999 			attr->nres.c_unit = NTFS_LZNT_CUNIT;
3000 
3001 		attr->nres.run_off =
3002 			cpu_to_le16(SIZEOF_NONRESIDENT_EX + name_size);
3003 		memcpy(Add2Ptr(attr, SIZEOF_NONRESIDENT_EX), name,
3004 		       name_len * sizeof(short));
3005 	} else {
3006 		attr->name_off = SIZEOF_NONRESIDENT_LE;
3007 		attr->nres.run_off =
3008 			cpu_to_le16(SIZEOF_NONRESIDENT + name_size);
3009 		memcpy(Add2Ptr(attr, SIZEOF_NONRESIDENT), name,
3010 		       name_len * sizeof(short));
3011 	}
3012 
3013 	return attr;
3014 }
3015 
3016 /*
3017  * do_action - Common routine for the Redo and Undo Passes.
3018  * @rlsn: If it is NULL then undo.
3019  */
do_action(struct ntfs_log * log,struct OPEN_ATTR_ENRTY * oe,const struct LOG_REC_HDR * lrh,u32 op,void * data,u32 dlen,u32 rec_len,const u64 * rlsn)3020 static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
3021 		     const struct LOG_REC_HDR *lrh, u32 op, void *data,
3022 		     u32 dlen, u32 rec_len, const u64 *rlsn)
3023 {
3024 	int err = 0;
3025 	struct ntfs_sb_info *sbi = log->ni->mi.sbi;
3026 	struct inode *inode = NULL, *inode_parent;
3027 	struct mft_inode *mi = NULL, *mi2_child = NULL;
3028 	CLST rno = 0, rno_base = 0;
3029 	struct INDEX_BUFFER *ib = NULL;
3030 	struct MFT_REC *rec = NULL;
3031 	struct ATTRIB *attr = NULL, *attr2;
3032 	struct INDEX_HDR *hdr;
3033 	struct INDEX_ROOT *root;
3034 	struct NTFS_DE *e, *e1, *e2;
3035 	struct NEW_ATTRIBUTE_SIZES *new_sz;
3036 	struct ATTR_FILE_NAME *fname;
3037 	struct OpenAttr *oa, *oa2;
3038 	u32 nsize, t32, asize, used, esize, off, bits;
3039 	u16 id, id2;
3040 	u32 record_size = sbi->record_size;
3041 	u64 t64;
3042 	u16 roff = le16_to_cpu(lrh->record_off);
3043 	u16 aoff = le16_to_cpu(lrh->attr_off);
3044 	u64 lco = 0;
3045 	u64 cbo = (u64)le16_to_cpu(lrh->cluster_off) << SECTOR_SHIFT;
3046 	u64 tvo = le64_to_cpu(lrh->target_vcn) << sbi->cluster_bits;
3047 	u64 vbo = cbo + tvo;
3048 	void *buffer_le = NULL;
3049 	u32 bytes = 0;
3050 	bool a_dirty = false;
3051 	u16 data_off;
3052 
3053 	oa = oe->ptr;
3054 
3055 	/* Big switch to prepare. */
3056 	switch (op) {
3057 	/* ============================================================
3058 	 * Process MFT records, as described by the current log record.
3059 	 * ============================================================
3060 	 */
3061 	case InitializeFileRecordSegment:
3062 	case DeallocateFileRecordSegment:
3063 	case WriteEndOfFileRecordSegment:
3064 	case CreateAttribute:
3065 	case DeleteAttribute:
3066 	case UpdateResidentValue:
3067 	case UpdateMappingPairs:
3068 	case SetNewAttributeSizes:
3069 	case AddIndexEntryRoot:
3070 	case DeleteIndexEntryRoot:
3071 	case SetIndexEntryVcnRoot:
3072 	case UpdateFileNameRoot:
3073 	case UpdateRecordDataRoot:
3074 	case ZeroEndOfFileRecord:
3075 		rno = vbo >> sbi->record_bits;
3076 		inode = ilookup(sbi->sb, rno);
3077 		if (inode) {
3078 			mi = &ntfs_i(inode)->mi;
3079 		} else if (op == InitializeFileRecordSegment) {
3080 			mi = kzalloc(sizeof(struct mft_inode), GFP_NOFS);
3081 			if (!mi)
3082 				return -ENOMEM;
3083 			err = mi_format_new(mi, sbi, rno, 0, false);
3084 			if (err)
3085 				goto out;
3086 		} else {
3087 			/* Read from disk. */
3088 			err = mi_get(sbi, rno, &mi);
3089 			if (err)
3090 				return err;
3091 		}
3092 		rec = mi->mrec;
3093 
3094 		if (op == DeallocateFileRecordSegment)
3095 			goto skip_load_parent;
3096 
3097 		if (InitializeFileRecordSegment != op) {
3098 			if (rec->rhdr.sign == NTFS_BAAD_SIGNATURE)
3099 				goto dirty_vol;
3100 			if (!check_lsn(&rec->rhdr, rlsn))
3101 				goto out;
3102 			if (!check_file_record(rec, NULL, sbi))
3103 				goto dirty_vol;
3104 			attr = Add2Ptr(rec, roff);
3105 		}
3106 
3107 		if (is_rec_base(rec) || InitializeFileRecordSegment == op) {
3108 			rno_base = rno;
3109 			goto skip_load_parent;
3110 		}
3111 
3112 		rno_base = ino_get(&rec->parent_ref);
3113 		inode_parent = ntfs_iget5(sbi->sb, &rec->parent_ref, NULL);
3114 		if (IS_ERR(inode_parent))
3115 			goto skip_load_parent;
3116 
3117 		if (is_bad_inode(inode_parent)) {
3118 			iput(inode_parent);
3119 			goto skip_load_parent;
3120 		}
3121 
3122 		if (ni_load_mi_ex(ntfs_i(inode_parent), rno, &mi2_child)) {
3123 			iput(inode_parent);
3124 		} else {
3125 			if (mi2_child->mrec != mi->mrec)
3126 				memcpy(mi2_child->mrec, mi->mrec,
3127 				       sbi->record_size);
3128 
3129 			if (inode)
3130 				iput(inode);
3131 			else if (mi)
3132 				mi_put(mi);
3133 
3134 			inode = inode_parent;
3135 			mi = mi2_child;
3136 			rec = mi2_child->mrec;
3137 			attr = Add2Ptr(rec, roff);
3138 		}
3139 
3140 skip_load_parent:
3141 		inode_parent = NULL;
3142 		break;
3143 
3144 	/*
3145 	 * Process attributes, as described by the current log record.
3146 	 */
3147 	case UpdateNonresidentValue:
3148 	case AddIndexEntryAllocation:
3149 	case DeleteIndexEntryAllocation:
3150 	case WriteEndOfIndexBuffer:
3151 	case SetIndexEntryVcnAllocation:
3152 	case UpdateFileNameAllocation:
3153 	case SetBitsInNonresidentBitMap:
3154 	case ClearBitsInNonresidentBitMap:
3155 	case UpdateRecordDataAllocation:
3156 		attr = oa->attr;
3157 		bytes = UpdateNonresidentValue == op ? dlen : 0;
3158 		lco = (u64)le16_to_cpu(lrh->lcns_follow) << sbi->cluster_bits;
3159 
3160 		if (attr->type == ATTR_ALLOC) {
3161 			t32 = le32_to_cpu(oe->bytes_per_index);
3162 			if (bytes < t32)
3163 				bytes = t32;
3164 		}
3165 
3166 		if (!bytes)
3167 			bytes = lco - cbo;
3168 
3169 		bytes += roff;
3170 		if (attr->type == ATTR_ALLOC)
3171 			bytes = (bytes + 511) & ~511; // align
3172 
3173 		buffer_le = kmalloc(bytes, GFP_NOFS);
3174 		if (!buffer_le)
3175 			return -ENOMEM;
3176 
3177 		err = ntfs_read_run_nb(sbi, oa->run1, vbo, buffer_le, bytes,
3178 				       NULL);
3179 		if (err)
3180 			goto out;
3181 
3182 		if (attr->type == ATTR_ALLOC && *(int *)buffer_le)
3183 			ntfs_fix_post_read(buffer_le, bytes, false);
3184 		break;
3185 
3186 	default:
3187 		WARN_ON(1);
3188 	}
3189 
3190 	/* Big switch to do operation. */
3191 	switch (op) {
3192 	case InitializeFileRecordSegment:
3193 		if (roff + dlen > record_size)
3194 			goto dirty_vol;
3195 
3196 		memcpy(Add2Ptr(rec, roff), data, dlen);
3197 		mi->dirty = true;
3198 		break;
3199 
3200 	case DeallocateFileRecordSegment:
3201 		clear_rec_inuse(rec);
3202 		le16_add_cpu(&rec->seq, 1);
3203 		mi->dirty = true;
3204 		break;
3205 
3206 	case WriteEndOfFileRecordSegment:
3207 		attr2 = (struct ATTRIB *)data;
3208 		if (!check_if_attr(rec, lrh) || roff + dlen > record_size)
3209 			goto dirty_vol;
3210 
3211 		memmove(attr, attr2, dlen);
3212 		rec->used = cpu_to_le32(ALIGN(roff + dlen, 8));
3213 
3214 		mi->dirty = true;
3215 		break;
3216 
3217 	case CreateAttribute:
3218 		attr2 = (struct ATTRIB *)data;
3219 		asize = le32_to_cpu(attr2->size);
3220 		used = le32_to_cpu(rec->used);
3221 
3222 		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
3223 		    !IS_ALIGNED(asize, 8) ||
3224 		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
3225 		    dlen > record_size - used) {
3226 			goto dirty_vol;
3227 		}
3228 
3229 		memmove(Add2Ptr(attr, asize), attr, used - roff);
3230 		memcpy(attr, attr2, asize);
3231 
3232 		rec->used = cpu_to_le32(used + asize);
3233 		id = le16_to_cpu(rec->next_attr_id);
3234 		id2 = le16_to_cpu(attr2->id);
3235 		if (id <= id2)
3236 			rec->next_attr_id = cpu_to_le16(id2 + 1);
3237 		if (is_attr_indexed(attr))
3238 			le16_add_cpu(&rec->hard_links, 1);
3239 
3240 		oa2 = find_loaded_attr(log, attr, rno_base);
3241 		if (oa2) {
3242 			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3243 					   GFP_NOFS);
3244 			if (p2) {
3245 				// run_close(oa2->run1);
3246 				kfree(oa2->attr);
3247 				oa2->attr = p2;
3248 			}
3249 		}
3250 
3251 		mi->dirty = true;
3252 		break;
3253 
3254 	case DeleteAttribute:
3255 		asize = le32_to_cpu(attr->size);
3256 		used = le32_to_cpu(rec->used);
3257 
3258 		if (!check_if_attr(rec, lrh))
3259 			goto dirty_vol;
3260 
3261 		rec->used = cpu_to_le32(used - asize);
3262 		if (is_attr_indexed(attr))
3263 			le16_add_cpu(&rec->hard_links, -1);
3264 
3265 		memmove(attr, Add2Ptr(attr, asize), used - asize - roff);
3266 
3267 		mi->dirty = true;
3268 		break;
3269 
3270 	case UpdateResidentValue:
3271 		nsize = aoff + dlen;
3272 
3273 		if (!check_if_attr(rec, lrh))
3274 			goto dirty_vol;
3275 
3276 		asize = le32_to_cpu(attr->size);
3277 		used = le32_to_cpu(rec->used);
3278 
3279 		if (lrh->redo_len == lrh->undo_len) {
3280 			if (nsize > asize)
3281 				goto dirty_vol;
3282 			goto move_data;
3283 		}
3284 
3285 		if (nsize > asize && nsize - asize > record_size - used)
3286 			goto dirty_vol;
3287 
3288 		nsize = ALIGN(nsize, 8);
3289 		data_off = le16_to_cpu(attr->res.data_off);
3290 
3291 		if (nsize < asize) {
3292 			memmove(Add2Ptr(attr, aoff), data, dlen);
3293 			data = NULL; // To skip below memmove().
3294 		}
3295 
3296 		memmove(Add2Ptr(attr, nsize), Add2Ptr(attr, asize),
3297 			used - le16_to_cpu(lrh->record_off) - asize);
3298 
3299 		rec->used = cpu_to_le32(used + nsize - asize);
3300 		attr->size = cpu_to_le32(nsize);
3301 		attr->res.data_size = cpu_to_le32(aoff + dlen - data_off);
3302 
3303 move_data:
3304 		if (data)
3305 			memmove(Add2Ptr(attr, aoff), data, dlen);
3306 
3307 		oa2 = find_loaded_attr(log, attr, rno_base);
3308 		if (oa2) {
3309 			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3310 					   GFP_NOFS);
3311 			if (p2) {
3312 				// run_close(&oa2->run0);
3313 				oa2->run1 = &oa2->run0;
3314 				kfree(oa2->attr);
3315 				oa2->attr = p2;
3316 			}
3317 		}
3318 
3319 		mi->dirty = true;
3320 		break;
3321 
3322 	case UpdateMappingPairs:
3323 		nsize = aoff + dlen;
3324 		asize = le32_to_cpu(attr->size);
3325 		used = le32_to_cpu(rec->used);
3326 
3327 		if (!check_if_attr(rec, lrh) || !attr->non_res ||
3328 		    aoff < le16_to_cpu(attr->nres.run_off) || aoff > asize ||
3329 		    (nsize > asize && nsize - asize > record_size - used)) {
3330 			goto dirty_vol;
3331 		}
3332 
3333 		nsize = ALIGN(nsize, 8);
3334 
3335 		memmove(Add2Ptr(attr, nsize), Add2Ptr(attr, asize),
3336 			used - le16_to_cpu(lrh->record_off) - asize);
3337 		rec->used = cpu_to_le32(used + nsize - asize);
3338 		attr->size = cpu_to_le32(nsize);
3339 		memmove(Add2Ptr(attr, aoff), data, dlen);
3340 
3341 		if (run_get_highest_vcn(le64_to_cpu(attr->nres.svcn),
3342 					attr_run(attr), &t64)) {
3343 			goto dirty_vol;
3344 		}
3345 
3346 		attr->nres.evcn = cpu_to_le64(t64);
3347 		oa2 = find_loaded_attr(log, attr, rno_base);
3348 		if (oa2 && oa2->attr->non_res)
3349 			oa2->attr->nres.evcn = attr->nres.evcn;
3350 
3351 		mi->dirty = true;
3352 		break;
3353 
3354 	case SetNewAttributeSizes:
3355 		new_sz = data;
3356 		if (!check_if_attr(rec, lrh) || !attr->non_res)
3357 			goto dirty_vol;
3358 
3359 		attr->nres.alloc_size = new_sz->alloc_size;
3360 		attr->nres.data_size = new_sz->data_size;
3361 		attr->nres.valid_size = new_sz->valid_size;
3362 
3363 		if (dlen >= sizeof(struct NEW_ATTRIBUTE_SIZES))
3364 			attr->nres.total_size = new_sz->total_size;
3365 
3366 		oa2 = find_loaded_attr(log, attr, rno_base);
3367 		if (oa2) {
3368 			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3369 					   GFP_NOFS);
3370 			if (p2) {
3371 				kfree(oa2->attr);
3372 				oa2->attr = p2;
3373 			}
3374 		}
3375 		mi->dirty = true;
3376 		break;
3377 
3378 	case AddIndexEntryRoot:
3379 		e = (struct NTFS_DE *)data;
3380 		esize = le16_to_cpu(e->size);
3381 		root = resident_data(attr);
3382 		hdr = &root->ihdr;
3383 		used = le32_to_cpu(hdr->used);
3384 
3385 		if (!check_if_index_root(rec, lrh) ||
3386 		    !check_if_root_index(attr, hdr, lrh) ||
3387 		    Add2Ptr(data, esize) > Add2Ptr(lrh, rec_len) ||
3388 		    esize > le32_to_cpu(rec->total) - le32_to_cpu(rec->used)) {
3389 			goto dirty_vol;
3390 		}
3391 
3392 		e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3393 
3394 		change_attr_size(rec, attr, le32_to_cpu(attr->size) + esize);
3395 
3396 		memmove(Add2Ptr(e1, esize), e1,
3397 			PtrOffset(e1, Add2Ptr(hdr, used)));
3398 		memmove(e1, e, esize);
3399 
3400 		le32_add_cpu(&attr->res.data_size, esize);
3401 		hdr->used = cpu_to_le32(used + esize);
3402 		le32_add_cpu(&hdr->total, esize);
3403 
3404 		mi->dirty = true;
3405 		break;
3406 
3407 	case DeleteIndexEntryRoot:
3408 		root = resident_data(attr);
3409 		hdr = &root->ihdr;
3410 		used = le32_to_cpu(hdr->used);
3411 
3412 		if (!check_if_index_root(rec, lrh) ||
3413 		    !check_if_root_index(attr, hdr, lrh)) {
3414 			goto dirty_vol;
3415 		}
3416 
3417 		e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3418 		esize = le16_to_cpu(e1->size);
3419 		e2 = Add2Ptr(e1, esize);
3420 
3421 		memmove(e1, e2, PtrOffset(e2, Add2Ptr(hdr, used)));
3422 
3423 		le32_sub_cpu(&attr->res.data_size, esize);
3424 		hdr->used = cpu_to_le32(used - esize);
3425 		le32_sub_cpu(&hdr->total, esize);
3426 
3427 		change_attr_size(rec, attr, le32_to_cpu(attr->size) - esize);
3428 
3429 		mi->dirty = true;
3430 		break;
3431 
3432 	case SetIndexEntryVcnRoot:
3433 		root = resident_data(attr);
3434 		hdr = &root->ihdr;
3435 
3436 		if (!check_if_index_root(rec, lrh) ||
3437 		    !check_if_root_index(attr, hdr, lrh)) {
3438 			goto dirty_vol;
3439 		}
3440 
3441 		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3442 
3443 		de_set_vbn_le(e, *(__le64 *)data);
3444 		mi->dirty = true;
3445 		break;
3446 
3447 	case UpdateFileNameRoot:
3448 		root = resident_data(attr);
3449 		hdr = &root->ihdr;
3450 
3451 		if (!check_if_index_root(rec, lrh) ||
3452 		    !check_if_root_index(attr, hdr, lrh)) {
3453 			goto dirty_vol;
3454 		}
3455 
3456 		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3457 		fname = (struct ATTR_FILE_NAME *)(e + 1);
3458 		memmove(&fname->dup, data, sizeof(fname->dup)); //
3459 		mi->dirty = true;
3460 		break;
3461 
3462 	case UpdateRecordDataRoot:
3463 		root = resident_data(attr);
3464 		hdr = &root->ihdr;
3465 
3466 		if (!check_if_index_root(rec, lrh) ||
3467 		    !check_if_root_index(attr, hdr, lrh)) {
3468 			goto dirty_vol;
3469 		}
3470 
3471 		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3472 
3473 		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
3474 
3475 		mi->dirty = true;
3476 		break;
3477 
3478 	case ZeroEndOfFileRecord:
3479 		if (roff + dlen > record_size)
3480 			goto dirty_vol;
3481 
3482 		memset(attr, 0, dlen);
3483 		mi->dirty = true;
3484 		break;
3485 
3486 	case UpdateNonresidentValue:
3487 		if (lco < cbo + roff + dlen)
3488 			goto dirty_vol;
3489 
3490 		memcpy(Add2Ptr(buffer_le, roff), data, dlen);
3491 
3492 		a_dirty = true;
3493 		if (attr->type == ATTR_ALLOC)
3494 			ntfs_fix_pre_write(buffer_le, bytes);
3495 		break;
3496 
3497 	case AddIndexEntryAllocation:
3498 		ib = Add2Ptr(buffer_le, roff);
3499 		hdr = &ib->ihdr;
3500 		e = data;
3501 		esize = le16_to_cpu(e->size);
3502 		e1 = Add2Ptr(ib, aoff);
3503 
3504 		if (is_baad(&ib->rhdr))
3505 			goto dirty_vol;
3506 		if (!check_lsn(&ib->rhdr, rlsn))
3507 			goto out;
3508 
3509 		used = le32_to_cpu(hdr->used);
3510 
3511 		if (!check_index_buffer(ib, bytes) ||
3512 		    !check_if_alloc_index(hdr, aoff) ||
3513 		    Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||
3514 		    used + esize > le32_to_cpu(hdr->total)) {
3515 			goto dirty_vol;
3516 		}
3517 
3518 		memmove(Add2Ptr(e1, esize), e1,
3519 			PtrOffset(e1, Add2Ptr(hdr, used)));
3520 		memcpy(e1, e, esize);
3521 
3522 		hdr->used = cpu_to_le32(used + esize);
3523 
3524 		a_dirty = true;
3525 
3526 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3527 		break;
3528 
3529 	case DeleteIndexEntryAllocation:
3530 		ib = Add2Ptr(buffer_le, roff);
3531 		hdr = &ib->ihdr;
3532 		e = Add2Ptr(ib, aoff);
3533 		esize = le16_to_cpu(e->size);
3534 
3535 		if (is_baad(&ib->rhdr))
3536 			goto dirty_vol;
3537 		if (!check_lsn(&ib->rhdr, rlsn))
3538 			goto out;
3539 
3540 		if (!check_index_buffer(ib, bytes) ||
3541 		    !check_if_alloc_index(hdr, aoff)) {
3542 			goto dirty_vol;
3543 		}
3544 
3545 		e1 = Add2Ptr(e, esize);
3546 		nsize = esize;
3547 		used = le32_to_cpu(hdr->used);
3548 
3549 		memmove(e, e1, PtrOffset(e1, Add2Ptr(hdr, used)));
3550 
3551 		hdr->used = cpu_to_le32(used - nsize);
3552 
3553 		a_dirty = true;
3554 
3555 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3556 		break;
3557 
3558 	case WriteEndOfIndexBuffer:
3559 		ib = Add2Ptr(buffer_le, roff);
3560 		hdr = &ib->ihdr;
3561 		e = Add2Ptr(ib, aoff);
3562 
3563 		if (is_baad(&ib->rhdr))
3564 			goto dirty_vol;
3565 		if (!check_lsn(&ib->rhdr, rlsn))
3566 			goto out;
3567 		if (!check_index_buffer(ib, bytes) ||
3568 		    !check_if_alloc_index(hdr, aoff) ||
3569 		    aoff + dlen > offsetof(struct INDEX_BUFFER, ihdr) +
3570 					  le32_to_cpu(hdr->total)) {
3571 			goto dirty_vol;
3572 		}
3573 
3574 		hdr->used = cpu_to_le32(dlen + PtrOffset(hdr, e));
3575 		memmove(e, data, dlen);
3576 
3577 		a_dirty = true;
3578 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3579 		break;
3580 
3581 	case SetIndexEntryVcnAllocation:
3582 		ib = Add2Ptr(buffer_le, roff);
3583 		hdr = &ib->ihdr;
3584 		e = Add2Ptr(ib, aoff);
3585 
3586 		if (is_baad(&ib->rhdr))
3587 			goto dirty_vol;
3588 
3589 		if (!check_lsn(&ib->rhdr, rlsn))
3590 			goto out;
3591 		if (!check_index_buffer(ib, bytes) ||
3592 		    !check_if_alloc_index(hdr, aoff)) {
3593 			goto dirty_vol;
3594 		}
3595 
3596 		de_set_vbn_le(e, *(__le64 *)data);
3597 
3598 		a_dirty = true;
3599 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3600 		break;
3601 
3602 	case UpdateFileNameAllocation:
3603 		ib = Add2Ptr(buffer_le, roff);
3604 		hdr = &ib->ihdr;
3605 		e = Add2Ptr(ib, aoff);
3606 
3607 		if (is_baad(&ib->rhdr))
3608 			goto dirty_vol;
3609 
3610 		if (!check_lsn(&ib->rhdr, rlsn))
3611 			goto out;
3612 		if (!check_index_buffer(ib, bytes) ||
3613 		    !check_if_alloc_index(hdr, aoff)) {
3614 			goto dirty_vol;
3615 		}
3616 
3617 		fname = (struct ATTR_FILE_NAME *)(e + 1);
3618 		memmove(&fname->dup, data, sizeof(fname->dup));
3619 
3620 		a_dirty = true;
3621 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3622 		break;
3623 
3624 	case SetBitsInNonresidentBitMap:
3625 		off = le32_to_cpu(((struct BITMAP_RANGE *)data)->bitmap_off);
3626 		bits = le32_to_cpu(((struct BITMAP_RANGE *)data)->bits);
3627 
3628 		if (cbo + (off + 7) / 8 > lco ||
3629 		    cbo + ((off + bits + 7) / 8) > lco) {
3630 			goto dirty_vol;
3631 		}
3632 
3633 		ntfs_bitmap_set_le(Add2Ptr(buffer_le, roff), off, bits);
3634 		a_dirty = true;
3635 		break;
3636 
3637 	case ClearBitsInNonresidentBitMap:
3638 		off = le32_to_cpu(((struct BITMAP_RANGE *)data)->bitmap_off);
3639 		bits = le32_to_cpu(((struct BITMAP_RANGE *)data)->bits);
3640 
3641 		if (cbo + (off + 7) / 8 > lco ||
3642 		    cbo + ((off + bits + 7) / 8) > lco) {
3643 			goto dirty_vol;
3644 		}
3645 
3646 		ntfs_bitmap_clear_le(Add2Ptr(buffer_le, roff), off, bits);
3647 		a_dirty = true;
3648 		break;
3649 
3650 	case UpdateRecordDataAllocation:
3651 		ib = Add2Ptr(buffer_le, roff);
3652 		hdr = &ib->ihdr;
3653 		e = Add2Ptr(ib, aoff);
3654 
3655 		if (is_baad(&ib->rhdr))
3656 			goto dirty_vol;
3657 
3658 		if (!check_lsn(&ib->rhdr, rlsn))
3659 			goto out;
3660 		if (!check_index_buffer(ib, bytes) ||
3661 		    !check_if_alloc_index(hdr, aoff)) {
3662 			goto dirty_vol;
3663 		}
3664 
3665 		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
3666 
3667 		a_dirty = true;
3668 		ntfs_fix_pre_write(&ib->rhdr, bytes);
3669 		break;
3670 
3671 	default:
3672 		WARN_ON(1);
3673 	}
3674 
3675 	if (rlsn) {
3676 		__le64 t64 = cpu_to_le64(*rlsn);
3677 
3678 		if (rec)
3679 			rec->rhdr.lsn = t64;
3680 		if (ib)
3681 			ib->rhdr.lsn = t64;
3682 	}
3683 
3684 	if (mi && mi->dirty) {
3685 		err = mi_write(mi, 0);
3686 		if (err)
3687 			goto out;
3688 	}
3689 
3690 	if (a_dirty) {
3691 		attr = oa->attr;
3692 		err = ntfs_sb_write_run(sbi, oa->run1, vbo, buffer_le, bytes,
3693 					0);
3694 		if (err)
3695 			goto out;
3696 	}
3697 
3698 out:
3699 
3700 	if (inode)
3701 		iput(inode);
3702 	else if (mi != mi2_child)
3703 		mi_put(mi);
3704 
3705 	kfree(buffer_le);
3706 
3707 	return err;
3708 
3709 dirty_vol:
3710 	log->set_dirty = true;
3711 	goto out;
3712 }
3713 
3714 /*
3715  * log_replay - Replays log and empties it.
3716  *
3717  * This function is called during mount operation.
3718  * It replays log and empties it.
3719  * Initialized is set false if logfile contains '-1'.
3720  */
log_replay(struct ntfs_inode * ni,bool * initialized)3721 int log_replay(struct ntfs_inode *ni, bool *initialized)
3722 {
3723 	int err;
3724 	struct ntfs_sb_info *sbi = ni->mi.sbi;
3725 	struct ntfs_log *log;
3726 
3727 	u64 rec_lsn, checkpt_lsn = 0, rlsn = 0;
3728 	struct ATTR_NAME_ENTRY *attr_names = NULL;
3729 	u32 attr_names_bytes = 0;
3730 	u32 oatbl_bytes = 0;
3731 	struct RESTART_TABLE *dptbl = NULL;
3732 	struct RESTART_TABLE *trtbl = NULL;
3733 	const struct RESTART_TABLE *rt;
3734 	struct RESTART_TABLE *oatbl = NULL;
3735 	struct inode *inode;
3736 	struct OpenAttr *oa;
3737 	struct ntfs_inode *ni_oe;
3738 	struct ATTRIB *attr = NULL;
3739 	u64 size, vcn, undo_next_lsn;
3740 	CLST rno, lcn, lcn0, len0, clen;
3741 	void *data;
3742 	struct NTFS_RESTART *rst = NULL;
3743 	struct lcb *lcb = NULL;
3744 	struct OPEN_ATTR_ENRTY *oe;
3745 	struct ATTR_NAME_ENTRY *ane;
3746 	struct TRANSACTION_ENTRY *tr;
3747 	struct DIR_PAGE_ENTRY *dp;
3748 	u32 i, bytes_per_attr_entry;
3749 	u32 vbo, tail, off, dlen;
3750 	u32 saved_len, rec_len, transact_id;
3751 	bool use_second_page;
3752 	struct RESTART_AREA *ra2, *ra = NULL;
3753 	struct CLIENT_REC *ca, *cr;
3754 	__le16 client;
3755 	struct RESTART_HDR *rh;
3756 	const struct LFS_RECORD_HDR *frh;
3757 	const struct LOG_REC_HDR *lrh;
3758 	bool is_mapped;
3759 	bool is_ro = sb_rdonly(sbi->sb);
3760 	u64 t64;
3761 	u16 t16;
3762 	u32 t32;
3763 
3764 	log = kzalloc(sizeof(struct ntfs_log), GFP_NOFS);
3765 	if (!log)
3766 		return -ENOMEM;
3767 
3768 	log->ni = ni;
3769 	log->l_size = log->orig_file_size = ni->vfs_inode.i_size;
3770 
3771 	/* Get the size of page. NOTE: To replay we can use default page. */
3772 #if PAGE_SIZE >= DefaultLogPageSize && PAGE_SIZE <= DefaultLogPageSize * 2
3773 	log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, true);
3774 #else
3775 	log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, false);
3776 #endif
3777 	if (!log->page_size) {
3778 		err = -EINVAL;
3779 		goto out;
3780 	}
3781 
3782 	log->one_page_buf = kmalloc(log->page_size, GFP_NOFS);
3783 	if (!log->one_page_buf) {
3784 		err = -ENOMEM;
3785 		goto out;
3786 	}
3787 
3788 	log->page_mask = log->page_size - 1;
3789 	log->page_bits = blksize_bits(log->page_size);
3790 
3791 	/* Look for a restart area on the disk. */
3792 	err = log_read_rst(log, true, &log->rst_info);
3793 	if (err)
3794 		goto out;
3795 
3796 	/* remember 'initialized' */
3797 	*initialized = log->rst_info.initialized;
3798 
3799 	if (!log->rst_info.restart) {
3800 		if (log->rst_info.initialized) {
3801 			/* No restart area but the file is not initialized. */
3802 			err = -EINVAL;
3803 			goto out;
3804 		}
3805 
3806 		log_init_pg_hdr(log, 1, 1);
3807 		log_create(log, 0, get_random_u32(), false, false);
3808 
3809 		ra = log_create_ra(log);
3810 		if (!ra) {
3811 			err = -ENOMEM;
3812 			goto out;
3813 		}
3814 		log->ra = ra;
3815 		log->init_ra = true;
3816 
3817 		goto process_log;
3818 	}
3819 
3820 	/*
3821 	 * If the restart offset above wasn't zero then we won't
3822 	 * look for a second restart.
3823 	 */
3824 	if (log->rst_info.vbo)
3825 		goto check_restart_area;
3826 
3827 	err = log_read_rst(log, false, &log->rst_info2);
3828 	if (err)
3829 		goto out;
3830 
3831 	/* Determine which restart area to use. */
3832 	if (!log->rst_info2.restart ||
3833 	    log->rst_info2.last_lsn <= log->rst_info.last_lsn)
3834 		goto use_first_page;
3835 
3836 	use_second_page = true;
3837 
3838 	if (log->rst_info.chkdsk_was_run &&
3839 	    log->page_size != log->rst_info.vbo) {
3840 		struct RECORD_PAGE_HDR *sp = NULL;
3841 		bool usa_error;
3842 
3843 		if (!read_log_page(log, log->page_size, &sp, &usa_error) &&
3844 		    sp->rhdr.sign == NTFS_CHKD_SIGNATURE) {
3845 			use_second_page = false;
3846 		}
3847 		kfree(sp);
3848 	}
3849 
3850 	if (use_second_page) {
3851 		kfree(log->rst_info.r_page);
3852 		memcpy(&log->rst_info, &log->rst_info2,
3853 		       sizeof(struct restart_info));
3854 		log->rst_info2.r_page = NULL;
3855 	}
3856 
3857 use_first_page:
3858 	kfree(log->rst_info2.r_page);
3859 
3860 check_restart_area:
3861 	/*
3862 	 * If the restart area is at offset 0, we want
3863 	 * to write the second restart area first.
3864 	 */
3865 	log->init_ra = !!log->rst_info.vbo;
3866 
3867 	/* If we have a valid page then grab a pointer to the restart area. */
3868 	ra2 = log->rst_info.valid_page ?
3869 		      Add2Ptr(log->rst_info.r_page,
3870 			      le16_to_cpu(log->rst_info.r_page->ra_off)) :
3871 		      NULL;
3872 
3873 	if (log->rst_info.chkdsk_was_run ||
3874 	    (ra2 && ra2->client_idx[1] == LFS_NO_CLIENT_LE)) {
3875 		bool wrapped = false;
3876 		bool use_multi_page = false;
3877 		u32 open_log_count;
3878 
3879 		/* Do some checks based on whether we have a valid log page. */
3880 		open_log_count = log->rst_info.valid_page ?
3881 					 le32_to_cpu(ra2->open_log_count) :
3882 					 get_random_u32();
3883 
3884 		log_init_pg_hdr(log, 1, 1);
3885 
3886 		log_create(log, log->rst_info.last_lsn, open_log_count, wrapped,
3887 			   use_multi_page);
3888 
3889 		ra = log_create_ra(log);
3890 		if (!ra) {
3891 			err = -ENOMEM;
3892 			goto out;
3893 		}
3894 		log->ra = ra;
3895 
3896 		/* Put the restart areas and initialize
3897 		 * the log file as required.
3898 		 */
3899 		goto process_log;
3900 	}
3901 
3902 	if (!ra2) {
3903 		err = -EINVAL;
3904 		goto out;
3905 	}
3906 
3907 	/*
3908 	 * If the log page or the system page sizes have changed, we can't
3909 	 * use the log file. We must use the system page size instead of the
3910 	 * default size if there is not a clean shutdown.
3911 	 */
3912 	t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);
3913 	if (log->page_size != t32) {
3914 		log->l_size = log->orig_file_size;
3915 		log->page_size = norm_file_page(t32, &log->l_size,
3916 						t32 == DefaultLogPageSize);
3917 	}
3918 
3919 	if (log->page_size != t32 ||
3920 	    log->page_size != le32_to_cpu(log->rst_info.r_page->page_size)) {
3921 		err = -EINVAL;
3922 		goto out;
3923 	}
3924 
3925 	log->page_mask = log->page_size - 1;
3926 	log->page_bits = blksize_bits(log->page_size);
3927 
3928 	/* If the file size has shrunk then we won't mount it. */
3929 	if (log->l_size < le64_to_cpu(ra2->l_size)) {
3930 		err = -EINVAL;
3931 		goto out;
3932 	}
3933 
3934 	log_init_pg_hdr(log, le16_to_cpu(log->rst_info.r_page->major_ver),
3935 			le16_to_cpu(log->rst_info.r_page->minor_ver));
3936 
3937 	log->l_size = le64_to_cpu(ra2->l_size);
3938 	log->seq_num_bits = le32_to_cpu(ra2->seq_num_bits);
3939 	log->file_data_bits = sizeof(u64) * 8 - log->seq_num_bits;
3940 	log->seq_num_mask = (8 << log->file_data_bits) - 1;
3941 	log->last_lsn = le64_to_cpu(ra2->current_lsn);
3942 	log->seq_num = log->last_lsn >> log->file_data_bits;
3943 	log->ra_off = le16_to_cpu(log->rst_info.r_page->ra_off);
3944 	log->restart_size = log->sys_page_size - log->ra_off;
3945 	log->record_header_len = le16_to_cpu(ra2->rec_hdr_len);
3946 	log->ra_size = le16_to_cpu(ra2->ra_len);
3947 	log->data_off = le16_to_cpu(ra2->data_off);
3948 	log->data_size = log->page_size - log->data_off;
3949 	log->reserved = log->data_size - log->record_header_len;
3950 
3951 	vbo = lsn_to_vbo(log, log->last_lsn);
3952 
3953 	if (vbo < log->first_page) {
3954 		/* This is a pseudo lsn. */
3955 		log->l_flags |= NTFSLOG_NO_LAST_LSN;
3956 		log->next_page = log->first_page;
3957 		goto find_oldest;
3958 	}
3959 
3960 	/* Find the end of this log record. */
3961 	off = final_log_off(log, log->last_lsn,
3962 			    le32_to_cpu(ra2->last_lsn_data_len));
3963 
3964 	/* If we wrapped the file then increment the sequence number. */
3965 	if (off <= vbo) {
3966 		log->seq_num += 1;
3967 		log->l_flags |= NTFSLOG_WRAPPED;
3968 	}
3969 
3970 	/* Now compute the next log page to use. */
3971 	vbo &= ~log->sys_page_mask;
3972 	tail = log->page_size - (off & log->page_mask) - 1;
3973 
3974 	/*
3975 	 *If we can fit another log record on the page,
3976 	 * move back a page the log file.
3977 	 */
3978 	if (tail >= log->record_header_len) {
3979 		log->l_flags |= NTFSLOG_REUSE_TAIL;
3980 		log->next_page = vbo;
3981 	} else {
3982 		log->next_page = next_page_off(log, vbo);
3983 	}
3984 
3985 find_oldest:
3986 	/*
3987 	 * Find the oldest client lsn. Use the last
3988 	 * flushed lsn as a starting point.
3989 	 */
3990 	log->oldest_lsn = log->last_lsn;
3991 	oldest_client_lsn(Add2Ptr(ra2, le16_to_cpu(ra2->client_off)),
3992 			  ra2->client_idx[1], &log->oldest_lsn);
3993 	log->oldest_lsn_off = lsn_to_vbo(log, log->oldest_lsn);
3994 
3995 	if (log->oldest_lsn_off < log->first_page)
3996 		log->l_flags |= NTFSLOG_NO_OLDEST_LSN;
3997 
3998 	if (!(ra2->flags & RESTART_SINGLE_PAGE_IO))
3999 		log->l_flags |= NTFSLOG_WRAPPED | NTFSLOG_MULTIPLE_PAGE_IO;
4000 
4001 	log->current_openlog_count = le32_to_cpu(ra2->open_log_count);
4002 	log->total_avail_pages = log->l_size - log->first_page;
4003 	log->total_avail = log->total_avail_pages >> log->page_bits;
4004 	log->max_current_avail = log->total_avail * log->reserved;
4005 	log->total_avail = log->total_avail * log->data_size;
4006 
4007 	log->current_avail = current_log_avail(log);
4008 
4009 	ra = kzalloc(log->restart_size, GFP_NOFS);
4010 	if (!ra) {
4011 		err = -ENOMEM;
4012 		goto out;
4013 	}
4014 	log->ra = ra;
4015 
4016 	t16 = le16_to_cpu(ra2->client_off);
4017 	if (t16 == offsetof(struct RESTART_AREA, clients)) {
4018 		memcpy(ra, ra2, log->ra_size);
4019 	} else {
4020 		memcpy(ra, ra2, offsetof(struct RESTART_AREA, clients));
4021 		memcpy(ra->clients, Add2Ptr(ra2, t16),
4022 		       le16_to_cpu(ra2->ra_len) - t16);
4023 
4024 		log->current_openlog_count = get_random_u32();
4025 		ra->open_log_count = cpu_to_le32(log->current_openlog_count);
4026 		log->ra_size = offsetof(struct RESTART_AREA, clients) +
4027 			       sizeof(struct CLIENT_REC);
4028 		ra->client_off =
4029 			cpu_to_le16(offsetof(struct RESTART_AREA, clients));
4030 		ra->ra_len = cpu_to_le16(log->ra_size);
4031 	}
4032 
4033 	le32_add_cpu(&ra->open_log_count, 1);
4034 
4035 	/* Now we need to walk through looking for the last lsn. */
4036 	err = last_log_lsn(log);
4037 	if (err)
4038 		goto out;
4039 
4040 	log->current_avail = current_log_avail(log);
4041 
4042 	/* Remember which restart area to write first. */
4043 	log->init_ra = log->rst_info.vbo;
4044 
4045 process_log:
4046 	/* 1.0, 1.1, 2.0 log->major_ver/minor_ver - short values. */
4047 	switch ((log->major_ver << 16) + log->minor_ver) {
4048 	case 0x10000:
4049 	case 0x10001:
4050 	case 0x20000:
4051 		break;
4052 	default:
4053 		ntfs_warn(sbi->sb, "\x24LogFile version %d.%d is not supported",
4054 			  log->major_ver, log->minor_ver);
4055 		err = -EOPNOTSUPP;
4056 		log->set_dirty = true;
4057 		goto out;
4058 	}
4059 
4060 	/* One client "NTFS" per logfile. */
4061 	ca = Add2Ptr(ra, le16_to_cpu(ra->client_off));
4062 
4063 	for (client = ra->client_idx[1];; client = cr->next_client) {
4064 		if (client == LFS_NO_CLIENT_LE) {
4065 			/* Insert "NTFS" client LogFile. */
4066 			client = ra->client_idx[0];
4067 			if (client == LFS_NO_CLIENT_LE) {
4068 				err = -EINVAL;
4069 				goto out;
4070 			}
4071 
4072 			t16 = le16_to_cpu(client);
4073 			cr = ca + t16;
4074 
4075 			remove_client(ca, cr, &ra->client_idx[0]);
4076 
4077 			cr->restart_lsn = 0;
4078 			cr->oldest_lsn = cpu_to_le64(log->oldest_lsn);
4079 			cr->name_bytes = cpu_to_le32(8);
4080 			cr->name[0] = cpu_to_le16('N');
4081 			cr->name[1] = cpu_to_le16('T');
4082 			cr->name[2] = cpu_to_le16('F');
4083 			cr->name[3] = cpu_to_le16('S');
4084 
4085 			add_client(ca, t16, &ra->client_idx[1]);
4086 			break;
4087 		}
4088 
4089 		cr = ca + le16_to_cpu(client);
4090 
4091 		if (cpu_to_le32(8) == cr->name_bytes &&
4092 		    cpu_to_le16('N') == cr->name[0] &&
4093 		    cpu_to_le16('T') == cr->name[1] &&
4094 		    cpu_to_le16('F') == cr->name[2] &&
4095 		    cpu_to_le16('S') == cr->name[3])
4096 			break;
4097 	}
4098 
4099 	/* Update the client handle with the client block information. */
4100 	log->client_id.seq_num = cr->seq_num;
4101 	log->client_id.client_idx = client;
4102 
4103 	err = read_rst_area(log, &rst, &checkpt_lsn);
4104 	if (err)
4105 		goto out;
4106 
4107 	if (!rst)
4108 		goto out;
4109 
4110 	bytes_per_attr_entry = !rst->major_ver ? 0x2C : 0x28;
4111 
4112 	if (rst->check_point_start)
4113 		checkpt_lsn = le64_to_cpu(rst->check_point_start);
4114 
4115 	/* Allocate and Read the Transaction Table. */
4116 	if (!rst->transact_table_len)
4117 		goto check_dirty_page_table;
4118 
4119 	t64 = le64_to_cpu(rst->transact_table_lsn);
4120 	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4121 	if (err)
4122 		goto out;
4123 
4124 	lrh = lcb->log_rec;
4125 	frh = lcb->lrh;
4126 	rec_len = le32_to_cpu(frh->client_data_len);
4127 
4128 	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4129 			   bytes_per_attr_entry)) {
4130 		err = -EINVAL;
4131 		goto out;
4132 	}
4133 
4134 	t16 = le16_to_cpu(lrh->redo_off);
4135 
4136 	rt = Add2Ptr(lrh, t16);
4137 	t32 = rec_len - t16;
4138 
4139 	/* Now check that this is a valid restart table. */
4140 	if (!check_rstbl(rt, t32)) {
4141 		err = -EINVAL;
4142 		goto out;
4143 	}
4144 
4145 	trtbl = kmemdup(rt, t32, GFP_NOFS);
4146 	if (!trtbl) {
4147 		err = -ENOMEM;
4148 		goto out;
4149 	}
4150 
4151 	lcb_put(lcb);
4152 	lcb = NULL;
4153 
4154 check_dirty_page_table:
4155 	/* The next record back should be the Dirty Pages Table. */
4156 	if (!rst->dirty_pages_len)
4157 		goto check_attribute_names;
4158 
4159 	t64 = le64_to_cpu(rst->dirty_pages_table_lsn);
4160 	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4161 	if (err)
4162 		goto out;
4163 
4164 	lrh = lcb->log_rec;
4165 	frh = lcb->lrh;
4166 	rec_len = le32_to_cpu(frh->client_data_len);
4167 
4168 	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4169 			   bytes_per_attr_entry)) {
4170 		err = -EINVAL;
4171 		goto out;
4172 	}
4173 
4174 	t16 = le16_to_cpu(lrh->redo_off);
4175 
4176 	rt = Add2Ptr(lrh, t16);
4177 	t32 = rec_len - t16;
4178 
4179 	/* Now check that this is a valid restart table. */
4180 	if (!check_rstbl(rt, t32)) {
4181 		err = -EINVAL;
4182 		goto out;
4183 	}
4184 
4185 	dptbl = kmemdup(rt, t32, GFP_NOFS);
4186 	if (!dptbl) {
4187 		err = -ENOMEM;
4188 		goto out;
4189 	}
4190 
4191 	/* Convert Ra version '0' into version '1'. */
4192 	if (rst->major_ver)
4193 		goto end_conv_1;
4194 
4195 	dp = NULL;
4196 	while ((dp = enum_rstbl(dptbl, dp))) {
4197 		struct DIR_PAGE_ENTRY_32 *dp0 = (struct DIR_PAGE_ENTRY_32 *)dp;
4198 		// NOTE: Danger. Check for of boundary.
4199 		memmove(&dp->vcn, &dp0->vcn_low,
4200 			2 * sizeof(u64) +
4201 				le32_to_cpu(dp->lcns_follow) * sizeof(u64));
4202 	}
4203 
4204 end_conv_1:
4205 	lcb_put(lcb);
4206 	lcb = NULL;
4207 
4208 	/*
4209 	 * Go through the table and remove the duplicates,
4210 	 * remembering the oldest lsn values.
4211 	 */
4212 	if (sbi->cluster_size <= log->page_size)
4213 		goto trace_dp_table;
4214 
4215 	dp = NULL;
4216 	while ((dp = enum_rstbl(dptbl, dp))) {
4217 		struct DIR_PAGE_ENTRY *next = dp;
4218 
4219 		while ((next = enum_rstbl(dptbl, next))) {
4220 			if (next->target_attr == dp->target_attr &&
4221 			    next->vcn == dp->vcn) {
4222 				if (le64_to_cpu(next->oldest_lsn) <
4223 				    le64_to_cpu(dp->oldest_lsn)) {
4224 					dp->oldest_lsn = next->oldest_lsn;
4225 				}
4226 
4227 				free_rsttbl_idx(dptbl, PtrOffset(dptbl, next));
4228 			}
4229 		}
4230 	}
4231 trace_dp_table:
4232 check_attribute_names:
4233 	/* The next record should be the Attribute Names. */
4234 	if (!rst->attr_names_len)
4235 		goto check_attr_table;
4236 
4237 	t64 = le64_to_cpu(rst->attr_names_lsn);
4238 	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4239 	if (err)
4240 		goto out;
4241 
4242 	lrh = lcb->log_rec;
4243 	frh = lcb->lrh;
4244 	rec_len = le32_to_cpu(frh->client_data_len);
4245 
4246 	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4247 			   bytes_per_attr_entry)) {
4248 		err = -EINVAL;
4249 		goto out;
4250 	}
4251 
4252 	t32 = lrh_length(lrh);
4253 	rec_len -= t32;
4254 
4255 	attr_names = kmemdup(Add2Ptr(lrh, t32), rec_len, GFP_NOFS);
4256 	if (!attr_names) {
4257 		err = -ENOMEM;
4258 		goto out;
4259 	}
4260 
4261 	lcb_put(lcb);
4262 	lcb = NULL;
4263 
4264 check_attr_table:
4265 	/* The next record should be the attribute Table. */
4266 	if (!rst->open_attr_len)
4267 		goto check_attribute_names2;
4268 
4269 	t64 = le64_to_cpu(rst->open_attr_table_lsn);
4270 	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4271 	if (err)
4272 		goto out;
4273 
4274 	lrh = lcb->log_rec;
4275 	frh = lcb->lrh;
4276 	rec_len = le32_to_cpu(frh->client_data_len);
4277 
4278 	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4279 			   bytes_per_attr_entry)) {
4280 		err = -EINVAL;
4281 		goto out;
4282 	}
4283 
4284 	t16 = le16_to_cpu(lrh->redo_off);
4285 
4286 	rt = Add2Ptr(lrh, t16);
4287 	t32 = rec_len - t16;
4288 
4289 	if (!check_rstbl(rt, t32)) {
4290 		err = -EINVAL;
4291 		goto out;
4292 	}
4293 
4294 	oatbl = kmemdup(rt, t32, GFP_NOFS);
4295 	if (!oatbl) {
4296 		err = -ENOMEM;
4297 		goto out;
4298 	}
4299 
4300 	log->open_attr_tbl = oatbl;
4301 
4302 	/* Clear all of the Attr pointers. */
4303 	oe = NULL;
4304 	while ((oe = enum_rstbl(oatbl, oe))) {
4305 		if (!rst->major_ver) {
4306 			struct OPEN_ATTR_ENRTY_32 oe0;
4307 
4308 			/* Really 'oe' points to OPEN_ATTR_ENRTY_32. */
4309 			memcpy(&oe0, oe, SIZEOF_OPENATTRIBUTEENTRY0);
4310 
4311 			oe->bytes_per_index = oe0.bytes_per_index;
4312 			oe->type = oe0.type;
4313 			oe->is_dirty_pages = oe0.is_dirty_pages;
4314 			oe->name_len = 0;
4315 			oe->ref = oe0.ref;
4316 			oe->open_record_lsn = oe0.open_record_lsn;
4317 		}
4318 
4319 		oe->is_attr_name = 0;
4320 		oe->ptr = NULL;
4321 	}
4322 
4323 	lcb_put(lcb);
4324 	lcb = NULL;
4325 
4326 check_attribute_names2:
4327 	if (attr_names && oatbl) {
4328 		off = 0;
4329 		for (;;) {
4330 			/* Check we can use attribute name entry 'ane'. */
4331 			static_assert(sizeof(*ane) == 4);
4332 			if (off + sizeof(*ane) > attr_names_bytes) {
4333 				/* just ignore the rest. */
4334 				break;
4335 			}
4336 
4337 			ane = Add2Ptr(attr_names, off);
4338 			t16 = le16_to_cpu(ane->off);
4339 			if (!t16) {
4340 				/* this is the only valid exit. */
4341 				break;
4342 			}
4343 
4344 			/* Check we can use open attribute entry 'oe'. */
4345 			if (t16 + sizeof(*oe) > oatbl_bytes) {
4346 				/* just ignore the rest. */
4347 				break;
4348 			}
4349 
4350 			/* TODO: Clear table on exit! */
4351 			oe = Add2Ptr(oatbl, t16);
4352 			t16 = le16_to_cpu(ane->name_bytes);
4353 			off += t16 + sizeof(*ane);
4354 			if (off > attr_names_bytes) {
4355 				/* just ignore the rest. */
4356 				break;
4357 			}
4358 			oe->name_len = t16 / sizeof(short);
4359 			oe->ptr = ane->name;
4360 			oe->is_attr_name = 2;
4361 		}
4362 	}
4363 
4364 	/*
4365 	 * If the checkpt_lsn is zero, then this is a freshly
4366 	 * formatted disk and we have no work to do.
4367 	 */
4368 	if (!checkpt_lsn) {
4369 		err = 0;
4370 		goto out;
4371 	}
4372 
4373 	if (!oatbl) {
4374 		oatbl = init_rsttbl(bytes_per_attr_entry, 8);
4375 		if (!oatbl) {
4376 			err = -ENOMEM;
4377 			goto out;
4378 		}
4379 	}
4380 
4381 	log->open_attr_tbl = oatbl;
4382 
4383 	/* Start the analysis pass from the Checkpoint lsn. */
4384 	rec_lsn = checkpt_lsn;
4385 
4386 	/* Read the first lsn. */
4387 	err = read_log_rec_lcb(log, checkpt_lsn, lcb_ctx_next, &lcb);
4388 	if (err)
4389 		goto out;
4390 
4391 	/* Loop to read all subsequent records to the end of the log file. */
4392 next_log_record_analyze:
4393 	err = read_next_log_rec(log, lcb, &rec_lsn);
4394 	if (err)
4395 		goto out;
4396 
4397 	if (!rec_lsn)
4398 		goto end_log_records_enumerate;
4399 
4400 	frh = lcb->lrh;
4401 	transact_id = le32_to_cpu(frh->transact_id);
4402 	rec_len = le32_to_cpu(frh->client_data_len);
4403 	lrh = lcb->log_rec;
4404 
4405 	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
4406 		err = -EINVAL;
4407 		goto out;
4408 	}
4409 
4410 	/*
4411 	 * The first lsn after the previous lsn remembered
4412 	 * the checkpoint is the first candidate for the rlsn.
4413 	 */
4414 	if (!rlsn)
4415 		rlsn = rec_lsn;
4416 
4417 	if (LfsClientRecord != frh->record_type)
4418 		goto next_log_record_analyze;
4419 
4420 	/*
4421 	 * Now update the Transaction Table for this transaction. If there
4422 	 * is no entry present or it is unallocated we allocate the entry.
4423 	 */
4424 	if (!trtbl) {
4425 		trtbl = init_rsttbl(sizeof(struct TRANSACTION_ENTRY),
4426 				    INITIAL_NUMBER_TRANSACTIONS);
4427 		if (!trtbl) {
4428 			err = -ENOMEM;
4429 			goto out;
4430 		}
4431 	}
4432 
4433 	tr = Add2Ptr(trtbl, transact_id);
4434 
4435 	if (transact_id >= bytes_per_rt(trtbl) ||
4436 	    tr->next != RESTART_ENTRY_ALLOCATED_LE) {
4437 		tr = alloc_rsttbl_from_idx(&trtbl, transact_id);
4438 		if (!tr) {
4439 			err = -ENOMEM;
4440 			goto out;
4441 		}
4442 		tr->transact_state = TransactionActive;
4443 		tr->first_lsn = cpu_to_le64(rec_lsn);
4444 	}
4445 
4446 	tr->prev_lsn = tr->undo_next_lsn = cpu_to_le64(rec_lsn);
4447 
4448 	/*
4449 	 * If this is a compensation log record, then change
4450 	 * the undo_next_lsn to be the undo_next_lsn of this record.
4451 	 */
4452 	if (lrh->undo_op == cpu_to_le16(CompensationLogRecord))
4453 		tr->undo_next_lsn = frh->client_undo_next_lsn;
4454 
4455 	/* Dispatch to handle log record depending on type. */
4456 	switch (le16_to_cpu(lrh->redo_op)) {
4457 	case InitializeFileRecordSegment:
4458 	case DeallocateFileRecordSegment:
4459 	case WriteEndOfFileRecordSegment:
4460 	case CreateAttribute:
4461 	case DeleteAttribute:
4462 	case UpdateResidentValue:
4463 	case UpdateNonresidentValue:
4464 	case UpdateMappingPairs:
4465 	case SetNewAttributeSizes:
4466 	case AddIndexEntryRoot:
4467 	case DeleteIndexEntryRoot:
4468 	case AddIndexEntryAllocation:
4469 	case DeleteIndexEntryAllocation:
4470 	case WriteEndOfIndexBuffer:
4471 	case SetIndexEntryVcnRoot:
4472 	case SetIndexEntryVcnAllocation:
4473 	case UpdateFileNameRoot:
4474 	case UpdateFileNameAllocation:
4475 	case SetBitsInNonresidentBitMap:
4476 	case ClearBitsInNonresidentBitMap:
4477 	case UpdateRecordDataRoot:
4478 	case UpdateRecordDataAllocation:
4479 	case ZeroEndOfFileRecord:
4480 		t16 = le16_to_cpu(lrh->target_attr);
4481 		t64 = le64_to_cpu(lrh->target_vcn);
4482 		dp = find_dp(dptbl, t16, t64);
4483 
4484 		if (dp)
4485 			goto copy_lcns;
4486 
4487 		/*
4488 		 * Calculate the number of clusters per page the system
4489 		 * which wrote the checkpoint, possibly creating the table.
4490 		 */
4491 		if (dptbl) {
4492 			t32 = (le16_to_cpu(dptbl->size) -
4493 			       sizeof(struct DIR_PAGE_ENTRY)) /
4494 			      sizeof(u64);
4495 		} else {
4496 			t32 = log->clst_per_page;
4497 			kfree(dptbl);
4498 			dptbl = init_rsttbl(struct_size(dp, page_lcns, t32),
4499 					    32);
4500 			if (!dptbl) {
4501 				err = -ENOMEM;
4502 				goto out;
4503 			}
4504 		}
4505 
4506 		dp = alloc_rsttbl_idx(&dptbl);
4507 		if (!dp) {
4508 			err = -ENOMEM;
4509 			goto out;
4510 		}
4511 		dp->target_attr = cpu_to_le32(t16);
4512 		dp->transfer_len = cpu_to_le32(t32 << sbi->cluster_bits);
4513 		dp->lcns_follow = cpu_to_le32(t32);
4514 		dp->vcn = cpu_to_le64(t64 & ~((u64)t32 - 1));
4515 		dp->oldest_lsn = cpu_to_le64(rec_lsn);
4516 
4517 copy_lcns:
4518 		/*
4519 		 * Copy the Lcns from the log record into the Dirty Page Entry.
4520 		 * TODO: For different page size support, must somehow make
4521 		 * whole routine a loop, case Lcns do not fit below.
4522 		 */
4523 		t16 = le16_to_cpu(lrh->lcns_follow);
4524 		for (i = 0; i < t16; i++) {
4525 			size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
4526 					    le64_to_cpu(dp->vcn));
4527 			dp->page_lcns[j + i] = lrh->page_lcns[i];
4528 		}
4529 
4530 		goto next_log_record_analyze;
4531 
4532 	case DeleteDirtyClusters: {
4533 		u32 range_count =
4534 			le16_to_cpu(lrh->redo_len) / sizeof(struct LCN_RANGE);
4535 		const struct LCN_RANGE *r =
4536 			Add2Ptr(lrh, le16_to_cpu(lrh->redo_off));
4537 
4538 		/* Loop through all of the Lcn ranges this log record. */
4539 		for (i = 0; i < range_count; i++, r++) {
4540 			u64 lcn0 = le64_to_cpu(r->lcn);
4541 			u64 lcn_e = lcn0 + le64_to_cpu(r->len) - 1;
4542 
4543 			dp = NULL;
4544 			while ((dp = enum_rstbl(dptbl, dp))) {
4545 				u32 j;
4546 
4547 				t32 = le32_to_cpu(dp->lcns_follow);
4548 				for (j = 0; j < t32; j++) {
4549 					t64 = le64_to_cpu(dp->page_lcns[j]);
4550 					if (t64 >= lcn0 && t64 <= lcn_e)
4551 						dp->page_lcns[j] = 0;
4552 				}
4553 			}
4554 		}
4555 		goto next_log_record_analyze;
4556 		;
4557 	}
4558 
4559 	case OpenNonresidentAttribute:
4560 		t16 = le16_to_cpu(lrh->target_attr);
4561 		if (t16 >= bytes_per_rt(oatbl)) {
4562 			/*
4563 			 * Compute how big the table needs to be.
4564 			 * Add 10 extra entries for some cushion.
4565 			 */
4566 			u32 new_e = t16 / le16_to_cpu(oatbl->size);
4567 
4568 			new_e += 10 - le16_to_cpu(oatbl->used);
4569 
4570 			oatbl = extend_rsttbl(oatbl, new_e, ~0u);
4571 			log->open_attr_tbl = oatbl;
4572 			if (!oatbl) {
4573 				err = -ENOMEM;
4574 				goto out;
4575 			}
4576 		}
4577 
4578 		/* Point to the entry being opened. */
4579 		oe = alloc_rsttbl_from_idx(&oatbl, t16);
4580 		log->open_attr_tbl = oatbl;
4581 		if (!oe) {
4582 			err = -ENOMEM;
4583 			goto out;
4584 		}
4585 
4586 		/* Initialize this entry from the log record. */
4587 		t16 = le16_to_cpu(lrh->redo_off);
4588 		if (!rst->major_ver) {
4589 			/* Convert version '0' into version '1'. */
4590 			struct OPEN_ATTR_ENRTY_32 *oe0 = Add2Ptr(lrh, t16);
4591 
4592 			oe->bytes_per_index = oe0->bytes_per_index;
4593 			oe->type = oe0->type;
4594 			oe->is_dirty_pages = oe0->is_dirty_pages;
4595 			oe->name_len = 0; //oe0.name_len;
4596 			oe->ref = oe0->ref;
4597 			oe->open_record_lsn = oe0->open_record_lsn;
4598 		} else {
4599 			memcpy(oe, Add2Ptr(lrh, t16), bytes_per_attr_entry);
4600 		}
4601 
4602 		t16 = le16_to_cpu(lrh->undo_len);
4603 		if (t16) {
4604 			oe->ptr = kmalloc(t16, GFP_NOFS);
4605 			if (!oe->ptr) {
4606 				err = -ENOMEM;
4607 				goto out;
4608 			}
4609 			oe->name_len = t16 / sizeof(short);
4610 			memcpy(oe->ptr,
4611 			       Add2Ptr(lrh, le16_to_cpu(lrh->undo_off)), t16);
4612 			oe->is_attr_name = 1;
4613 		} else {
4614 			oe->ptr = NULL;
4615 			oe->is_attr_name = 0;
4616 		}
4617 
4618 		goto next_log_record_analyze;
4619 
4620 	case HotFix:
4621 		t16 = le16_to_cpu(lrh->target_attr);
4622 		t64 = le64_to_cpu(lrh->target_vcn);
4623 		dp = find_dp(dptbl, t16, t64);
4624 		if (dp) {
4625 			size_t j = le64_to_cpu(lrh->target_vcn) -
4626 				   le64_to_cpu(dp->vcn);
4627 			if (dp->page_lcns[j])
4628 				dp->page_lcns[j] = lrh->page_lcns[0];
4629 		}
4630 		goto next_log_record_analyze;
4631 
4632 	case EndTopLevelAction:
4633 		tr = Add2Ptr(trtbl, transact_id);
4634 		tr->prev_lsn = cpu_to_le64(rec_lsn);
4635 		tr->undo_next_lsn = frh->client_undo_next_lsn;
4636 		goto next_log_record_analyze;
4637 
4638 	case PrepareTransaction:
4639 		tr = Add2Ptr(trtbl, transact_id);
4640 		tr->transact_state = TransactionPrepared;
4641 		goto next_log_record_analyze;
4642 
4643 	case CommitTransaction:
4644 		tr = Add2Ptr(trtbl, transact_id);
4645 		tr->transact_state = TransactionCommitted;
4646 		goto next_log_record_analyze;
4647 
4648 	case ForgetTransaction:
4649 		free_rsttbl_idx(trtbl, transact_id);
4650 		goto next_log_record_analyze;
4651 
4652 	case Noop:
4653 	case OpenAttributeTableDump:
4654 	case AttributeNamesDump:
4655 	case DirtyPageTableDump:
4656 	case TransactionTableDump:
4657 		/* The following cases require no action the Analysis Pass. */
4658 		goto next_log_record_analyze;
4659 
4660 	default:
4661 		/*
4662 		 * All codes will be explicitly handled.
4663 		 * If we see a code we do not expect, then we are trouble.
4664 		 */
4665 		goto next_log_record_analyze;
4666 	}
4667 
4668 end_log_records_enumerate:
4669 	lcb_put(lcb);
4670 	lcb = NULL;
4671 
4672 	/*
4673 	 * Scan the Dirty Page Table and Transaction Table for
4674 	 * the lowest lsn, and return it as the Redo lsn.
4675 	 */
4676 	dp = NULL;
4677 	while ((dp = enum_rstbl(dptbl, dp))) {
4678 		t64 = le64_to_cpu(dp->oldest_lsn);
4679 		if (t64 && t64 < rlsn)
4680 			rlsn = t64;
4681 	}
4682 
4683 	tr = NULL;
4684 	while ((tr = enum_rstbl(trtbl, tr))) {
4685 		t64 = le64_to_cpu(tr->first_lsn);
4686 		if (t64 && t64 < rlsn)
4687 			rlsn = t64;
4688 	}
4689 
4690 	/*
4691 	 * Only proceed if the Dirty Page Table or Transaction
4692 	 * table are not empty.
4693 	 */
4694 	if ((!dptbl || !dptbl->total) && (!trtbl || !trtbl->total))
4695 		goto end_reply;
4696 
4697 	sbi->flags |= NTFS_FLAGS_NEED_REPLAY;
4698 	if (is_ro)
4699 		goto out;
4700 
4701 	/* Reopen all of the attributes with dirty pages. */
4702 	oe = NULL;
4703 next_open_attribute:
4704 
4705 	oe = enum_rstbl(oatbl, oe);
4706 	if (!oe) {
4707 		err = 0;
4708 		dp = NULL;
4709 		goto next_dirty_page;
4710 	}
4711 
4712 	oa = kzalloc(sizeof(struct OpenAttr), GFP_NOFS);
4713 	if (!oa) {
4714 		err = -ENOMEM;
4715 		goto out;
4716 	}
4717 
4718 	inode = ntfs_iget5(sbi->sb, &oe->ref, NULL);
4719 	if (IS_ERR(inode))
4720 		goto fake_attr;
4721 
4722 	if (is_bad_inode(inode)) {
4723 		iput(inode);
4724 fake_attr:
4725 		if (oa->ni) {
4726 			iput(&oa->ni->vfs_inode);
4727 			oa->ni = NULL;
4728 		}
4729 
4730 		attr = attr_create_nonres_log(sbi, oe->type, 0, oe->ptr,
4731 					      oe->name_len, 0);
4732 		if (!attr) {
4733 			kfree(oa);
4734 			err = -ENOMEM;
4735 			goto out;
4736 		}
4737 		oa->attr = attr;
4738 		oa->run1 = &oa->run0;
4739 		goto final_oe;
4740 	}
4741 
4742 	ni_oe = ntfs_i(inode);
4743 	oa->ni = ni_oe;
4744 
4745 	attr = ni_find_attr(ni_oe, NULL, NULL, oe->type, oe->ptr, oe->name_len,
4746 			    NULL, NULL);
4747 
4748 	if (!attr)
4749 		goto fake_attr;
4750 
4751 	t32 = le32_to_cpu(attr->size);
4752 	oa->attr = kmemdup(attr, t32, GFP_NOFS);
4753 	if (!oa->attr)
4754 		goto fake_attr;
4755 
4756 	if (!S_ISDIR(inode->i_mode)) {
4757 		if (attr->type == ATTR_DATA && !attr->name_len) {
4758 			oa->run1 = &ni_oe->file.run;
4759 			goto final_oe;
4760 		}
4761 	} else {
4762 		if (attr->type == ATTR_ALLOC &&
4763 		    attr->name_len == ARRAY_SIZE(I30_NAME) &&
4764 		    !memcmp(attr_name(attr), I30_NAME, sizeof(I30_NAME))) {
4765 			oa->run1 = &ni_oe->dir.alloc_run;
4766 			goto final_oe;
4767 		}
4768 	}
4769 
4770 	if (attr->non_res) {
4771 		u16 roff = le16_to_cpu(attr->nres.run_off);
4772 		CLST svcn = le64_to_cpu(attr->nres.svcn);
4773 
4774 		if (roff > t32) {
4775 			kfree(oa->attr);
4776 			oa->attr = NULL;
4777 			goto fake_attr;
4778 		}
4779 
4780 		err = run_unpack(&oa->run0, sbi, inode->i_ino, svcn,
4781 				 le64_to_cpu(attr->nres.evcn), svcn,
4782 				 Add2Ptr(attr, roff), t32 - roff);
4783 		if (err < 0) {
4784 			kfree(oa->attr);
4785 			oa->attr = NULL;
4786 			goto fake_attr;
4787 		}
4788 		err = 0;
4789 	}
4790 	oa->run1 = &oa->run0;
4791 	attr = oa->attr;
4792 
4793 final_oe:
4794 	if (oe->is_attr_name == 1)
4795 		kfree(oe->ptr);
4796 	oe->is_attr_name = 0;
4797 	oe->ptr = oa;
4798 	oe->name_len = attr->name_len;
4799 
4800 	goto next_open_attribute;
4801 
4802 	/*
4803 	 * Now loop through the dirty page table to extract all of the Vcn/Lcn.
4804 	 * Mapping that we have, and insert it into the appropriate run.
4805 	 */
4806 next_dirty_page:
4807 	dp = enum_rstbl(dptbl, dp);
4808 	if (!dp)
4809 		goto do_redo_1;
4810 
4811 	oe = Add2Ptr(oatbl, le32_to_cpu(dp->target_attr));
4812 
4813 	if (oe->next != RESTART_ENTRY_ALLOCATED_LE)
4814 		goto next_dirty_page;
4815 
4816 	oa = oe->ptr;
4817 	if (!oa)
4818 		goto next_dirty_page;
4819 
4820 	i = -1;
4821 next_dirty_page_vcn:
4822 	i += 1;
4823 	if (i >= le32_to_cpu(dp->lcns_follow))
4824 		goto next_dirty_page;
4825 
4826 	vcn = le64_to_cpu(dp->vcn) + i;
4827 	size = (vcn + 1) << sbi->cluster_bits;
4828 
4829 	if (!dp->page_lcns[i])
4830 		goto next_dirty_page_vcn;
4831 
4832 	rno = ino_get(&oe->ref);
4833 	if (rno <= MFT_REC_MIRR &&
4834 	    size < (MFT_REC_VOL + 1) * sbi->record_size &&
4835 	    oe->type == ATTR_DATA) {
4836 		goto next_dirty_page_vcn;
4837 	}
4838 
4839 	lcn = le64_to_cpu(dp->page_lcns[i]);
4840 
4841 	if ((!run_lookup_entry(oa->run1, vcn, &lcn0, &len0, NULL) ||
4842 	     lcn0 != lcn) &&
4843 	    !run_add_entry(oa->run1, vcn, lcn, 1, false)) {
4844 		err = -ENOMEM;
4845 		goto out;
4846 	}
4847 	attr = oa->attr;
4848 	if (size > le64_to_cpu(attr->nres.alloc_size)) {
4849 		attr->nres.valid_size = attr->nres.data_size =
4850 			attr->nres.alloc_size = cpu_to_le64(size);
4851 	}
4852 	goto next_dirty_page_vcn;
4853 
4854 do_redo_1:
4855 	/*
4856 	 * Perform the Redo Pass, to restore all of the dirty pages to the same
4857 	 * contents that they had immediately before the crash. If the dirty
4858 	 * page table is empty, then we can skip the entire Redo Pass.
4859 	 */
4860 	if (!dptbl || !dptbl->total)
4861 		goto do_undo_action;
4862 
4863 	rec_lsn = rlsn;
4864 
4865 	/*
4866 	 * Read the record at the Redo lsn, before falling
4867 	 * into common code to handle each record.
4868 	 */
4869 	err = read_log_rec_lcb(log, rlsn, lcb_ctx_next, &lcb);
4870 	if (err)
4871 		goto out;
4872 
4873 	/*
4874 	 * Now loop to read all of our log records forwards, until
4875 	 * we hit the end of the file, cleaning up at the end.
4876 	 */
4877 do_action_next:
4878 	frh = lcb->lrh;
4879 
4880 	if (LfsClientRecord != frh->record_type)
4881 		goto read_next_log_do_action;
4882 
4883 	transact_id = le32_to_cpu(frh->transact_id);
4884 	rec_len = le32_to_cpu(frh->client_data_len);
4885 	lrh = lcb->log_rec;
4886 
4887 	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
4888 		err = -EINVAL;
4889 		goto out;
4890 	}
4891 
4892 	/* Ignore log records that do not update pages. */
4893 	if (lrh->lcns_follow)
4894 		goto find_dirty_page;
4895 
4896 	goto read_next_log_do_action;
4897 
4898 find_dirty_page:
4899 	t16 = le16_to_cpu(lrh->target_attr);
4900 	t64 = le64_to_cpu(lrh->target_vcn);
4901 	dp = find_dp(dptbl, t16, t64);
4902 
4903 	if (!dp)
4904 		goto read_next_log_do_action;
4905 
4906 	if (rec_lsn < le64_to_cpu(dp->oldest_lsn))
4907 		goto read_next_log_do_action;
4908 
4909 	t16 = le16_to_cpu(lrh->target_attr);
4910 	if (t16 >= bytes_per_rt(oatbl)) {
4911 		err = -EINVAL;
4912 		goto out;
4913 	}
4914 
4915 	oe = Add2Ptr(oatbl, t16);
4916 
4917 	if (oe->next != RESTART_ENTRY_ALLOCATED_LE) {
4918 		err = -EINVAL;
4919 		goto out;
4920 	}
4921 
4922 	oa = oe->ptr;
4923 
4924 	if (!oa) {
4925 		err = -EINVAL;
4926 		goto out;
4927 	}
4928 	attr = oa->attr;
4929 
4930 	vcn = le64_to_cpu(lrh->target_vcn);
4931 
4932 	if (!run_lookup_entry(oa->run1, vcn, &lcn, NULL, NULL) ||
4933 	    lcn == SPARSE_LCN) {
4934 		goto read_next_log_do_action;
4935 	}
4936 
4937 	/* Point to the Redo data and get its length. */
4938 	data = Add2Ptr(lrh, le16_to_cpu(lrh->redo_off));
4939 	dlen = le16_to_cpu(lrh->redo_len);
4940 
4941 	/* Shorten length by any Lcns which were deleted. */
4942 	saved_len = dlen;
4943 
4944 	for (i = le16_to_cpu(lrh->lcns_follow); i; i--) {
4945 		size_t j;
4946 		u32 alen, voff;
4947 
4948 		voff = le16_to_cpu(lrh->record_off) +
4949 		       le16_to_cpu(lrh->attr_off);
4950 		voff += le16_to_cpu(lrh->cluster_off) << SECTOR_SHIFT;
4951 
4952 		/* If the Vcn question is allocated, we can just get out. */
4953 		j = le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn);
4954 		if (dp->page_lcns[j + i - 1])
4955 			break;
4956 
4957 		if (!saved_len)
4958 			saved_len = 1;
4959 
4960 		/*
4961 		 * Calculate the allocated space left relative to the
4962 		 * log record Vcn, after removing this unallocated Vcn.
4963 		 */
4964 		alen = (i - 1) << sbi->cluster_bits;
4965 
4966 		/*
4967 		 * If the update described this log record goes beyond
4968 		 * the allocated space, then we will have to reduce the length.
4969 		 */
4970 		if (voff >= alen)
4971 			dlen = 0;
4972 		else if (voff + dlen > alen)
4973 			dlen = alen - voff;
4974 	}
4975 
4976 	/*
4977 	 * If the resulting dlen from above is now zero,
4978 	 * we can skip this log record.
4979 	 */
4980 	if (!dlen && saved_len)
4981 		goto read_next_log_do_action;
4982 
4983 	t16 = le16_to_cpu(lrh->redo_op);
4984 	if (can_skip_action(t16))
4985 		goto read_next_log_do_action;
4986 
4987 	/* Apply the Redo operation a common routine. */
4988 	err = do_action(log, oe, lrh, t16, data, dlen, rec_len, &rec_lsn);
4989 	if (err)
4990 		goto out;
4991 
4992 	/* Keep reading and looping back until end of file. */
4993 read_next_log_do_action:
4994 	err = read_next_log_rec(log, lcb, &rec_lsn);
4995 	if (!err && rec_lsn)
4996 		goto do_action_next;
4997 
4998 	lcb_put(lcb);
4999 	lcb = NULL;
5000 
5001 do_undo_action:
5002 	/* Scan Transaction Table. */
5003 	tr = NULL;
5004 transaction_table_next:
5005 	tr = enum_rstbl(trtbl, tr);
5006 	if (!tr)
5007 		goto undo_action_done;
5008 
5009 	if (TransactionActive != tr->transact_state || !tr->undo_next_lsn) {
5010 		free_rsttbl_idx(trtbl, PtrOffset(trtbl, tr));
5011 		goto transaction_table_next;
5012 	}
5013 
5014 	log->transaction_id = PtrOffset(trtbl, tr);
5015 	undo_next_lsn = le64_to_cpu(tr->undo_next_lsn);
5016 
5017 	/*
5018 	 * We only have to do anything if the transaction has
5019 	 * something its undo_next_lsn field.
5020 	 */
5021 	if (!undo_next_lsn)
5022 		goto commit_undo;
5023 
5024 	/* Read the first record to be undone by this transaction. */
5025 	err = read_log_rec_lcb(log, undo_next_lsn, lcb_ctx_undo_next, &lcb);
5026 	if (err)
5027 		goto out;
5028 
5029 	/*
5030 	 * Now loop to read all of our log records forwards,
5031 	 * until we hit the end of the file, cleaning up at the end.
5032 	 */
5033 undo_action_next:
5034 
5035 	lrh = lcb->log_rec;
5036 	frh = lcb->lrh;
5037 	transact_id = le32_to_cpu(frh->transact_id);
5038 	rec_len = le32_to_cpu(frh->client_data_len);
5039 
5040 	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
5041 		err = -EINVAL;
5042 		goto out;
5043 	}
5044 
5045 	if (lrh->undo_op == cpu_to_le16(Noop))
5046 		goto read_next_log_undo_action;
5047 
5048 	oe = Add2Ptr(oatbl, le16_to_cpu(lrh->target_attr));
5049 	oa = oe->ptr;
5050 
5051 	t16 = le16_to_cpu(lrh->lcns_follow);
5052 	if (!t16)
5053 		goto add_allocated_vcns;
5054 
5055 	is_mapped = run_lookup_entry(oa->run1, le64_to_cpu(lrh->target_vcn),
5056 				     &lcn, &clen, NULL);
5057 
5058 	/*
5059 	 * If the mapping isn't already the table or the  mapping
5060 	 * corresponds to a hole the mapping, we need to make sure
5061 	 * there is no partial page already memory.
5062 	 */
5063 	if (is_mapped && lcn != SPARSE_LCN && clen >= t16)
5064 		goto add_allocated_vcns;
5065 
5066 	vcn = le64_to_cpu(lrh->target_vcn);
5067 	vcn &= ~(u64)(log->clst_per_page - 1);
5068 
5069 add_allocated_vcns:
5070 	for (i = 0, vcn = le64_to_cpu(lrh->target_vcn),
5071 	    size = (vcn + 1) << sbi->cluster_bits;
5072 	     i < t16; i++, vcn += 1, size += sbi->cluster_size) {
5073 		attr = oa->attr;
5074 		if (!attr->non_res) {
5075 			if (size > le32_to_cpu(attr->res.data_size))
5076 				attr->res.data_size = cpu_to_le32(size);
5077 		} else {
5078 			if (size > le64_to_cpu(attr->nres.data_size))
5079 				attr->nres.valid_size = attr->nres.data_size =
5080 					attr->nres.alloc_size =
5081 						cpu_to_le64(size);
5082 		}
5083 	}
5084 
5085 	t16 = le16_to_cpu(lrh->undo_op);
5086 	if (can_skip_action(t16))
5087 		goto read_next_log_undo_action;
5088 
5089 	/* Point to the Redo data and get its length. */
5090 	data = Add2Ptr(lrh, le16_to_cpu(lrh->undo_off));
5091 	dlen = le16_to_cpu(lrh->undo_len);
5092 
5093 	/* It is time to apply the undo action. */
5094 	err = do_action(log, oe, lrh, t16, data, dlen, rec_len, NULL);
5095 
5096 read_next_log_undo_action:
5097 	/*
5098 	 * Keep reading and looping back until we have read the
5099 	 * last record for this transaction.
5100 	 */
5101 	err = read_next_log_rec(log, lcb, &rec_lsn);
5102 	if (err)
5103 		goto out;
5104 
5105 	if (rec_lsn)
5106 		goto undo_action_next;
5107 
5108 	lcb_put(lcb);
5109 	lcb = NULL;
5110 
5111 commit_undo:
5112 	free_rsttbl_idx(trtbl, log->transaction_id);
5113 
5114 	log->transaction_id = 0;
5115 
5116 	goto transaction_table_next;
5117 
5118 undo_action_done:
5119 
5120 	ntfs_update_mftmirr(sbi, 0);
5121 
5122 	sbi->flags &= ~NTFS_FLAGS_NEED_REPLAY;
5123 
5124 end_reply:
5125 
5126 	err = 0;
5127 	if (is_ro)
5128 		goto out;
5129 
5130 	rh = kzalloc(log->page_size, GFP_NOFS);
5131 	if (!rh) {
5132 		err = -ENOMEM;
5133 		goto out;
5134 	}
5135 
5136 	rh->rhdr.sign = NTFS_RSTR_SIGNATURE;
5137 	rh->rhdr.fix_off = cpu_to_le16(offsetof(struct RESTART_HDR, fixups));
5138 	t16 = (log->page_size >> SECTOR_SHIFT) + 1;
5139 	rh->rhdr.fix_num = cpu_to_le16(t16);
5140 	rh->sys_page_size = cpu_to_le32(log->page_size);
5141 	rh->page_size = cpu_to_le32(log->page_size);
5142 
5143 	t16 = ALIGN(offsetof(struct RESTART_HDR, fixups) + sizeof(short) * t16,
5144 		    8);
5145 	rh->ra_off = cpu_to_le16(t16);
5146 	rh->minor_ver = cpu_to_le16(1); // 0x1A:
5147 	rh->major_ver = cpu_to_le16(1); // 0x1C:
5148 
5149 	ra2 = Add2Ptr(rh, t16);
5150 	memcpy(ra2, ra, sizeof(struct RESTART_AREA));
5151 
5152 	ra2->client_idx[0] = 0;
5153 	ra2->client_idx[1] = LFS_NO_CLIENT_LE;
5154 	ra2->flags = cpu_to_le16(2);
5155 
5156 	le32_add_cpu(&ra2->open_log_count, 1);
5157 
5158 	ntfs_fix_pre_write(&rh->rhdr, log->page_size);
5159 
5160 	err = ntfs_sb_write_run(sbi, &ni->file.run, 0, rh, log->page_size, 0);
5161 	if (!err)
5162 		err = ntfs_sb_write_run(sbi, &log->ni->file.run, log->page_size,
5163 					rh, log->page_size, 0);
5164 
5165 	kfree(rh);
5166 	if (err)
5167 		goto out;
5168 
5169 out:
5170 	kfree(rst);
5171 	if (lcb)
5172 		lcb_put(lcb);
5173 
5174 	/*
5175 	 * Scan the Open Attribute Table to close all of
5176 	 * the open attributes.
5177 	 */
5178 	oe = NULL;
5179 	while ((oe = enum_rstbl(oatbl, oe))) {
5180 		rno = ino_get(&oe->ref);
5181 
5182 		if (oe->is_attr_name == 1) {
5183 			kfree(oe->ptr);
5184 			oe->ptr = NULL;
5185 			continue;
5186 		}
5187 
5188 		if (oe->is_attr_name)
5189 			continue;
5190 
5191 		oa = oe->ptr;
5192 		if (!oa)
5193 			continue;
5194 
5195 		run_close(&oa->run0);
5196 		kfree(oa->attr);
5197 		if (oa->ni)
5198 			iput(&oa->ni->vfs_inode);
5199 		kfree(oa);
5200 	}
5201 
5202 	kfree(trtbl);
5203 	kfree(oatbl);
5204 	kfree(dptbl);
5205 	kfree(attr_names);
5206 	kfree(log->rst_info.r_page);
5207 
5208 	kfree(ra);
5209 	kfree(log->one_page_buf);
5210 
5211 	if (err)
5212 		sbi->flags |= NTFS_FLAGS_NEED_REPLAY;
5213 
5214 	if (err == -EROFS)
5215 		err = 0;
5216 	else if (log->set_dirty)
5217 		ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
5218 
5219 	kfree(log);
5220 
5221 	return err;
5222 }
5223