1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * This file is part of UBIFS.
4  *
5  * Copyright (C) 2006-2008 Nokia Corporation.
6  *
7  * Authors: Adrian Hunter
8  *          Artem Bityutskiy (Битюцкий Артём)
9  */
10 
11 /*
12  * This file implements TNC (Tree Node Cache) which caches indexing nodes of
13  * the UBIFS B-tree.
14  *
15  * At the moment the locking rules of the TNC tree are quite simple and
16  * straightforward. We just have a mutex and lock it when we traverse the
17  * tree. If a znode is not in memory, we read it from flash while still having
18  * the mutex locked.
19  */
20 
21 #ifndef __UBOOT__
22 #include <linux/crc32.h>
23 #include <linux/slab.h>
24 #else
25 #include <linux/compat.h>
26 #include <linux/err.h>
27 #include <linux/stat.h>
28 #endif
29 #include "ubifs.h"
30 
31 /*
32  * Returned codes of 'matches_name()' and 'fallible_matches_name()' functions.
33  * @NAME_LESS: name corresponding to the first argument is less than second
34  * @NAME_MATCHES: names match
35  * @NAME_GREATER: name corresponding to the second argument is greater than
36  *                first
37  * @NOT_ON_MEDIA: node referred by zbranch does not exist on the media
38  *
39  * These constants were introduce to improve readability.
40  */
41 enum {
42 	NAME_LESS    = 0,
43 	NAME_MATCHES = 1,
44 	NAME_GREATER = 2,
45 	NOT_ON_MEDIA = 3,
46 };
47 
48 /**
49  * insert_old_idx - record an index node obsoleted since the last commit start.
50  * @c: UBIFS file-system description object
51  * @lnum: LEB number of obsoleted index node
52  * @offs: offset of obsoleted index node
53  *
54  * Returns %0 on success, and a negative error code on failure.
55  *
56  * For recovery, there must always be a complete intact version of the index on
57  * flash at all times. That is called the "old index". It is the index as at the
58  * time of the last successful commit. Many of the index nodes in the old index
59  * may be dirty, but they must not be erased until the next successful commit
60  * (at which point that index becomes the old index).
61  *
62  * That means that the garbage collection and the in-the-gaps method of
63  * committing must be able to determine if an index node is in the old index.
64  * Most of the old index nodes can be found by looking up the TNC using the
65  * 'lookup_znode()' function. However, some of the old index nodes may have
66  * been deleted from the current index or may have been changed so much that
67  * they cannot be easily found. In those cases, an entry is added to an RB-tree.
68  * That is what this function does. The RB-tree is ordered by LEB number and
69  * offset because they uniquely identify the old index node.
70  */
insert_old_idx(struct ubifs_info * c,int lnum,int offs)71 static int insert_old_idx(struct ubifs_info *c, int lnum, int offs)
72 {
73 	struct ubifs_old_idx *old_idx, *o;
74 	struct rb_node **p, *parent = NULL;
75 
76 	old_idx = kmalloc(sizeof(struct ubifs_old_idx), GFP_NOFS);
77 	if (unlikely(!old_idx))
78 		return -ENOMEM;
79 	old_idx->lnum = lnum;
80 	old_idx->offs = offs;
81 
82 	p = &c->old_idx.rb_node;
83 	while (*p) {
84 		parent = *p;
85 		o = rb_entry(parent, struct ubifs_old_idx, rb);
86 		if (lnum < o->lnum)
87 			p = &(*p)->rb_left;
88 		else if (lnum > o->lnum)
89 			p = &(*p)->rb_right;
90 		else if (offs < o->offs)
91 			p = &(*p)->rb_left;
92 		else if (offs > o->offs)
93 			p = &(*p)->rb_right;
94 		else {
95 			ubifs_err(c, "old idx added twice!");
96 			kfree(old_idx);
97 			return 0;
98 		}
99 	}
100 	rb_link_node(&old_idx->rb, parent, p);
101 	rb_insert_color(&old_idx->rb, &c->old_idx);
102 	return 0;
103 }
104 
105 /**
106  * insert_old_idx_znode - record a znode obsoleted since last commit start.
107  * @c: UBIFS file-system description object
108  * @znode: znode of obsoleted index node
109  *
110  * Returns %0 on success, and a negative error code on failure.
111  */
insert_old_idx_znode(struct ubifs_info * c,struct ubifs_znode * znode)112 int insert_old_idx_znode(struct ubifs_info *c, struct ubifs_znode *znode)
113 {
114 	if (znode->parent) {
115 		struct ubifs_zbranch *zbr;
116 
117 		zbr = &znode->parent->zbranch[znode->iip];
118 		if (zbr->len)
119 			return insert_old_idx(c, zbr->lnum, zbr->offs);
120 	} else
121 		if (c->zroot.len)
122 			return insert_old_idx(c, c->zroot.lnum,
123 					      c->zroot.offs);
124 	return 0;
125 }
126 
127 /**
128  * ins_clr_old_idx_znode - record a znode obsoleted since last commit start.
129  * @c: UBIFS file-system description object
130  * @znode: znode of obsoleted index node
131  *
132  * Returns %0 on success, and a negative error code on failure.
133  */
ins_clr_old_idx_znode(struct ubifs_info * c,struct ubifs_znode * znode)134 static int ins_clr_old_idx_znode(struct ubifs_info *c,
135 				 struct ubifs_znode *znode)
136 {
137 	int err;
138 
139 	if (znode->parent) {
140 		struct ubifs_zbranch *zbr;
141 
142 		zbr = &znode->parent->zbranch[znode->iip];
143 		if (zbr->len) {
144 			err = insert_old_idx(c, zbr->lnum, zbr->offs);
145 			if (err)
146 				return err;
147 			zbr->lnum = 0;
148 			zbr->offs = 0;
149 			zbr->len = 0;
150 		}
151 	} else
152 		if (c->zroot.len) {
153 			err = insert_old_idx(c, c->zroot.lnum, c->zroot.offs);
154 			if (err)
155 				return err;
156 			c->zroot.lnum = 0;
157 			c->zroot.offs = 0;
158 			c->zroot.len = 0;
159 		}
160 	return 0;
161 }
162 
163 /**
164  * destroy_old_idx - destroy the old_idx RB-tree.
165  * @c: UBIFS file-system description object
166  *
167  * During start commit, the old_idx RB-tree is used to avoid overwriting index
168  * nodes that were in the index last commit but have since been deleted.  This
169  * is necessary for recovery i.e. the old index must be kept intact until the
170  * new index is successfully written.  The old-idx RB-tree is used for the
171  * in-the-gaps method of writing index nodes and is destroyed every commit.
172  */
destroy_old_idx(struct ubifs_info * c)173 void destroy_old_idx(struct ubifs_info *c)
174 {
175 	struct ubifs_old_idx *old_idx, *n;
176 
177 	rbtree_postorder_for_each_entry_safe(old_idx, n, &c->old_idx, rb)
178 		kfree(old_idx);
179 
180 	c->old_idx = RB_ROOT;
181 }
182 
183 /**
184  * copy_znode - copy a dirty znode.
185  * @c: UBIFS file-system description object
186  * @znode: znode to copy
187  *
188  * A dirty znode being committed may not be changed, so it is copied.
189  */
copy_znode(struct ubifs_info * c,struct ubifs_znode * znode)190 static struct ubifs_znode *copy_znode(struct ubifs_info *c,
191 				      struct ubifs_znode *znode)
192 {
193 	struct ubifs_znode *zn;
194 
195 	zn = kmalloc(c->max_znode_sz, GFP_NOFS);
196 	if (unlikely(!zn))
197 		return ERR_PTR(-ENOMEM);
198 
199 	memcpy(zn, znode, c->max_znode_sz);
200 	zn->cnext = NULL;
201 	__set_bit(DIRTY_ZNODE, &zn->flags);
202 	__clear_bit(COW_ZNODE, &zn->flags);
203 
204 	ubifs_assert(!ubifs_zn_obsolete(znode));
205 	__set_bit(OBSOLETE_ZNODE, &znode->flags);
206 
207 	if (znode->level != 0) {
208 		int i;
209 		const int n = zn->child_cnt;
210 
211 		/* The children now have new parent */
212 		for (i = 0; i < n; i++) {
213 			struct ubifs_zbranch *zbr = &zn->zbranch[i];
214 
215 			if (zbr->znode)
216 				zbr->znode->parent = zn;
217 		}
218 	}
219 
220 	atomic_long_inc(&c->dirty_zn_cnt);
221 	return zn;
222 }
223 
224 /**
225  * add_idx_dirt - add dirt due to a dirty znode.
226  * @c: UBIFS file-system description object
227  * @lnum: LEB number of index node
228  * @dirt: size of index node
229  *
230  * This function updates lprops dirty space and the new size of the index.
231  */
add_idx_dirt(struct ubifs_info * c,int lnum,int dirt)232 static int add_idx_dirt(struct ubifs_info *c, int lnum, int dirt)
233 {
234 	c->calc_idx_sz -= ALIGN(dirt, 8);
235 	return ubifs_add_dirt(c, lnum, dirt);
236 }
237 
238 /**
239  * dirty_cow_znode - ensure a znode is not being committed.
240  * @c: UBIFS file-system description object
241  * @zbr: branch of znode to check
242  *
243  * Returns dirtied znode on success or negative error code on failure.
244  */
dirty_cow_znode(struct ubifs_info * c,struct ubifs_zbranch * zbr)245 static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c,
246 					   struct ubifs_zbranch *zbr)
247 {
248 	struct ubifs_znode *znode = zbr->znode;
249 	struct ubifs_znode *zn;
250 	int err;
251 
252 	if (!ubifs_zn_cow(znode)) {
253 		/* znode is not being committed */
254 		if (!test_and_set_bit(DIRTY_ZNODE, &znode->flags)) {
255 			atomic_long_inc(&c->dirty_zn_cnt);
256 			atomic_long_dec(&c->clean_zn_cnt);
257 			atomic_long_dec(&ubifs_clean_zn_cnt);
258 			err = add_idx_dirt(c, zbr->lnum, zbr->len);
259 			if (unlikely(err))
260 				return ERR_PTR(err);
261 		}
262 		return znode;
263 	}
264 
265 	zn = copy_znode(c, znode);
266 	if (IS_ERR(zn))
267 		return zn;
268 
269 	if (zbr->len) {
270 		err = insert_old_idx(c, zbr->lnum, zbr->offs);
271 		if (unlikely(err))
272 			return ERR_PTR(err);
273 		err = add_idx_dirt(c, zbr->lnum, zbr->len);
274 	} else
275 		err = 0;
276 
277 	zbr->znode = zn;
278 	zbr->lnum = 0;
279 	zbr->offs = 0;
280 	zbr->len = 0;
281 
282 	if (unlikely(err))
283 		return ERR_PTR(err);
284 	return zn;
285 }
286 
287 /**
288  * lnc_add - add a leaf node to the leaf node cache.
289  * @c: UBIFS file-system description object
290  * @zbr: zbranch of leaf node
291  * @node: leaf node
292  *
293  * Leaf nodes are non-index nodes directory entry nodes or data nodes. The
294  * purpose of the leaf node cache is to save re-reading the same leaf node over
295  * and over again. Most things are cached by VFS, however the file system must
296  * cache directory entries for readdir and for resolving hash collisions. The
297  * present implementation of the leaf node cache is extremely simple, and
298  * allows for error returns that are not used but that may be needed if a more
299  * complex implementation is created.
300  *
301  * Note, this function does not add the @node object to LNC directly, but
302  * allocates a copy of the object and adds the copy to LNC. The reason for this
303  * is that @node has been allocated outside of the TNC subsystem and will be
304  * used with @c->tnc_mutex unlock upon return from the TNC subsystem. But LNC
305  * may be changed at any time, e.g. freed by the shrinker.
306  */
lnc_add(struct ubifs_info * c,struct ubifs_zbranch * zbr,const void * node)307 static int lnc_add(struct ubifs_info *c, struct ubifs_zbranch *zbr,
308 		   const void *node)
309 {
310 	int err;
311 	void *lnc_node;
312 	const struct ubifs_dent_node *dent = node;
313 
314 	ubifs_assert(!zbr->leaf);
315 	ubifs_assert(zbr->len != 0);
316 	ubifs_assert(is_hash_key(c, &zbr->key));
317 
318 	err = ubifs_validate_entry(c, dent);
319 	if (err) {
320 		dump_stack();
321 		ubifs_dump_node(c, dent);
322 		return err;
323 	}
324 
325 	lnc_node = kmemdup(node, zbr->len, GFP_NOFS);
326 	if (!lnc_node)
327 		/* We don't have to have the cache, so no error */
328 		return 0;
329 
330 	zbr->leaf = lnc_node;
331 	return 0;
332 }
333 
334  /**
335  * lnc_add_directly - add a leaf node to the leaf-node-cache.
336  * @c: UBIFS file-system description object
337  * @zbr: zbranch of leaf node
338  * @node: leaf node
339  *
340  * This function is similar to 'lnc_add()', but it does not create a copy of
341  * @node but inserts @node to TNC directly.
342  */
lnc_add_directly(struct ubifs_info * c,struct ubifs_zbranch * zbr,void * node)343 static int lnc_add_directly(struct ubifs_info *c, struct ubifs_zbranch *zbr,
344 			    void *node)
345 {
346 	int err;
347 
348 	ubifs_assert(!zbr->leaf);
349 	ubifs_assert(zbr->len != 0);
350 
351 	err = ubifs_validate_entry(c, node);
352 	if (err) {
353 		dump_stack();
354 		ubifs_dump_node(c, node);
355 		return err;
356 	}
357 
358 	zbr->leaf = node;
359 	return 0;
360 }
361 
362 /**
363  * lnc_free - remove a leaf node from the leaf node cache.
364  * @zbr: zbranch of leaf node
365  * @node: leaf node
366  */
lnc_free(struct ubifs_zbranch * zbr)367 static void lnc_free(struct ubifs_zbranch *zbr)
368 {
369 	if (!zbr->leaf)
370 		return;
371 	kfree(zbr->leaf);
372 	zbr->leaf = NULL;
373 }
374 
375 /**
376  * tnc_read_node_nm - read a "hashed" leaf node.
377  * @c: UBIFS file-system description object
378  * @zbr: key and position of the node
379  * @node: node is returned here
380  *
381  * This function reads a "hashed" node defined by @zbr from the leaf node cache
382  * (in it is there) or from the hash media, in which case the node is also
383  * added to LNC. Returns zero in case of success or a negative negative error
384  * code in case of failure.
385  */
tnc_read_node_nm(struct ubifs_info * c,struct ubifs_zbranch * zbr,void * node)386 static int tnc_read_node_nm(struct ubifs_info *c, struct ubifs_zbranch *zbr,
387 			    void *node)
388 {
389 	int err;
390 
391 	ubifs_assert(is_hash_key(c, &zbr->key));
392 
393 	if (zbr->leaf) {
394 		/* Read from the leaf node cache */
395 		ubifs_assert(zbr->len != 0);
396 		memcpy(node, zbr->leaf, zbr->len);
397 		return 0;
398 	}
399 
400 	err = ubifs_tnc_read_node(c, zbr, node);
401 	if (err)
402 		return err;
403 
404 	/* Add the node to the leaf node cache */
405 	err = lnc_add(c, zbr, node);
406 	return err;
407 }
408 
409 /**
410  * try_read_node - read a node if it is a node.
411  * @c: UBIFS file-system description object
412  * @buf: buffer to read to
413  * @type: node type
414  * @len: node length (not aligned)
415  * @lnum: LEB number of node to read
416  * @offs: offset of node to read
417  *
418  * This function tries to read a node of known type and length, checks it and
419  * stores it in @buf. This function returns %1 if a node is present and %0 if
420  * a node is not present. A negative error code is returned for I/O errors.
421  * This function performs that same function as ubifs_read_node except that
422  * it does not require that there is actually a node present and instead
423  * the return code indicates if a node was read.
424  *
425  * Note, this function does not check CRC of data nodes if @c->no_chk_data_crc
426  * is true (it is controlled by corresponding mount option). However, if
427  * @c->mounting or @c->remounting_rw is true (we are mounting or re-mounting to
428  * R/W mode), @c->no_chk_data_crc is ignored and CRC is checked. This is
429  * because during mounting or re-mounting from R/O mode to R/W mode we may read
430  * journal nodes (when replying the journal or doing the recovery) and the
431  * journal nodes may potentially be corrupted, so checking is required.
432  */
try_read_node(const struct ubifs_info * c,void * buf,int type,int len,int lnum,int offs)433 static int try_read_node(const struct ubifs_info *c, void *buf, int type,
434 			 int len, int lnum, int offs)
435 {
436 	int err, node_len;
437 	struct ubifs_ch *ch = buf;
438 	uint32_t crc, node_crc;
439 
440 	dbg_io("LEB %d:%d, %s, length %d", lnum, offs, dbg_ntype(type), len);
441 
442 	err = ubifs_leb_read(c, lnum, buf, offs, len, 1);
443 	if (err) {
444 		ubifs_err(c, "cannot read node type %d from LEB %d:%d, error %d",
445 			  type, lnum, offs, err);
446 		return err;
447 	}
448 
449 	if (le32_to_cpu(ch->magic) != UBIFS_NODE_MAGIC)
450 		return 0;
451 
452 	if (ch->node_type != type)
453 		return 0;
454 
455 	node_len = le32_to_cpu(ch->len);
456 	if (node_len != len)
457 		return 0;
458 
459 	if (type == UBIFS_DATA_NODE && c->no_chk_data_crc && !c->mounting &&
460 	    !c->remounting_rw)
461 		return 1;
462 
463 	crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
464 	node_crc = le32_to_cpu(ch->crc);
465 	if (crc != node_crc)
466 		return 0;
467 
468 	return 1;
469 }
470 
471 /**
472  * fallible_read_node - try to read a leaf node.
473  * @c: UBIFS file-system description object
474  * @key:  key of node to read
475  * @zbr:  position of node
476  * @node: node returned
477  *
478  * This function tries to read a node and returns %1 if the node is read, %0
479  * if the node is not present, and a negative error code in the case of error.
480  */
fallible_read_node(struct ubifs_info * c,const union ubifs_key * key,struct ubifs_zbranch * zbr,void * node)481 static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
482 			      struct ubifs_zbranch *zbr, void *node)
483 {
484 	int ret;
485 
486 	dbg_tnck(key, "LEB %d:%d, key ", zbr->lnum, zbr->offs);
487 
488 	ret = try_read_node(c, node, key_type(c, key), zbr->len, zbr->lnum,
489 			    zbr->offs);
490 	if (ret == 1) {
491 		union ubifs_key node_key;
492 		struct ubifs_dent_node *dent = node;
493 
494 		/* All nodes have key in the same place */
495 		key_read(c, &dent->key, &node_key);
496 		if (keys_cmp(c, key, &node_key) != 0)
497 			ret = 0;
498 	}
499 	if (ret == 0 && c->replaying)
500 		dbg_mntk(key, "dangling branch LEB %d:%d len %d, key ",
501 			zbr->lnum, zbr->offs, zbr->len);
502 	return ret;
503 }
504 
505 /**
506  * matches_name - determine if a direntry or xattr entry matches a given name.
507  * @c: UBIFS file-system description object
508  * @zbr: zbranch of dent
509  * @nm: name to match
510  *
511  * This function checks if xentry/direntry referred by zbranch @zbr matches name
512  * @nm. Returns %NAME_MATCHES if it does, %NAME_LESS if the name referred by
513  * @zbr is less than @nm, and %NAME_GREATER if it is greater than @nm. In case
514  * of failure, a negative error code is returned.
515  */
matches_name(struct ubifs_info * c,struct ubifs_zbranch * zbr,const struct qstr * nm)516 static int matches_name(struct ubifs_info *c, struct ubifs_zbranch *zbr,
517 			const struct qstr *nm)
518 {
519 	struct ubifs_dent_node *dent;
520 	int nlen, err;
521 
522 	/* If possible, match against the dent in the leaf node cache */
523 	if (!zbr->leaf) {
524 		dent = kmalloc(zbr->len, GFP_NOFS);
525 		if (!dent)
526 			return -ENOMEM;
527 
528 		err = ubifs_tnc_read_node(c, zbr, dent);
529 		if (err)
530 			goto out_free;
531 
532 		/* Add the node to the leaf node cache */
533 		err = lnc_add_directly(c, zbr, dent);
534 		if (err)
535 			goto out_free;
536 	} else
537 		dent = zbr->leaf;
538 
539 	nlen = le16_to_cpu(dent->nlen);
540 	err = memcmp(dent->name, nm->name, min_t(int, nlen, nm->len));
541 	if (err == 0) {
542 		if (nlen == nm->len)
543 			return NAME_MATCHES;
544 		else if (nlen < nm->len)
545 			return NAME_LESS;
546 		else
547 			return NAME_GREATER;
548 	} else if (err < 0)
549 		return NAME_LESS;
550 	else
551 		return NAME_GREATER;
552 
553 out_free:
554 	kfree(dent);
555 	return err;
556 }
557 
558 /**
559  * get_znode - get a TNC znode that may not be loaded yet.
560  * @c: UBIFS file-system description object
561  * @znode: parent znode
562  * @n: znode branch slot number
563  *
564  * This function returns the znode or a negative error code.
565  */
get_znode(struct ubifs_info * c,struct ubifs_znode * znode,int n)566 static struct ubifs_znode *get_znode(struct ubifs_info *c,
567 				     struct ubifs_znode *znode, int n)
568 {
569 	struct ubifs_zbranch *zbr;
570 
571 	zbr = &znode->zbranch[n];
572 	if (zbr->znode)
573 		znode = zbr->znode;
574 	else
575 		znode = ubifs_load_znode(c, zbr, znode, n);
576 	return znode;
577 }
578 
579 /**
580  * tnc_next - find next TNC entry.
581  * @c: UBIFS file-system description object
582  * @zn: znode is passed and returned here
583  * @n: znode branch slot number is passed and returned here
584  *
585  * This function returns %0 if the next TNC entry is found, %-ENOENT if there is
586  * no next entry, or a negative error code otherwise.
587  */
tnc_next(struct ubifs_info * c,struct ubifs_znode ** zn,int * n)588 static int tnc_next(struct ubifs_info *c, struct ubifs_znode **zn, int *n)
589 {
590 	struct ubifs_znode *znode = *zn;
591 	int nn = *n;
592 
593 	nn += 1;
594 	if (nn < znode->child_cnt) {
595 		*n = nn;
596 		return 0;
597 	}
598 	while (1) {
599 		struct ubifs_znode *zp;
600 
601 		zp = znode->parent;
602 		if (!zp)
603 			return -ENOENT;
604 		nn = znode->iip + 1;
605 		znode = zp;
606 		if (nn < znode->child_cnt) {
607 			znode = get_znode(c, znode, nn);
608 			if (IS_ERR(znode))
609 				return PTR_ERR(znode);
610 			while (znode->level != 0) {
611 				znode = get_znode(c, znode, 0);
612 				if (IS_ERR(znode))
613 					return PTR_ERR(znode);
614 			}
615 			nn = 0;
616 			break;
617 		}
618 	}
619 	*zn = znode;
620 	*n = nn;
621 	return 0;
622 }
623 
624 /**
625  * tnc_prev - find previous TNC entry.
626  * @c: UBIFS file-system description object
627  * @zn: znode is returned here
628  * @n: znode branch slot number is passed and returned here
629  *
630  * This function returns %0 if the previous TNC entry is found, %-ENOENT if
631  * there is no next entry, or a negative error code otherwise.
632  */
tnc_prev(struct ubifs_info * c,struct ubifs_znode ** zn,int * n)633 static int tnc_prev(struct ubifs_info *c, struct ubifs_znode **zn, int *n)
634 {
635 	struct ubifs_znode *znode = *zn;
636 	int nn = *n;
637 
638 	if (nn > 0) {
639 		*n = nn - 1;
640 		return 0;
641 	}
642 	while (1) {
643 		struct ubifs_znode *zp;
644 
645 		zp = znode->parent;
646 		if (!zp)
647 			return -ENOENT;
648 		nn = znode->iip - 1;
649 		znode = zp;
650 		if (nn >= 0) {
651 			znode = get_znode(c, znode, nn);
652 			if (IS_ERR(znode))
653 				return PTR_ERR(znode);
654 			while (znode->level != 0) {
655 				nn = znode->child_cnt - 1;
656 				znode = get_znode(c, znode, nn);
657 				if (IS_ERR(znode))
658 					return PTR_ERR(znode);
659 			}
660 			nn = znode->child_cnt - 1;
661 			break;
662 		}
663 	}
664 	*zn = znode;
665 	*n = nn;
666 	return 0;
667 }
668 
669 /**
670  * resolve_collision - resolve a collision.
671  * @c: UBIFS file-system description object
672  * @key: key of a directory or extended attribute entry
673  * @zn: znode is returned here
674  * @n: zbranch number is passed and returned here
675  * @nm: name of the entry
676  *
677  * This function is called for "hashed" keys to make sure that the found key
678  * really corresponds to the looked up node (directory or extended attribute
679  * entry). It returns %1 and sets @zn and @n if the collision is resolved.
680  * %0 is returned if @nm is not found and @zn and @n are set to the previous
681  * entry, i.e. to the entry after which @nm could follow if it were in TNC.
682  * This means that @n may be set to %-1 if the leftmost key in @zn is the
683  * previous one. A negative error code is returned on failures.
684  */
resolve_collision(struct ubifs_info * c,const union ubifs_key * key,struct ubifs_znode ** zn,int * n,const struct qstr * nm)685 static int resolve_collision(struct ubifs_info *c, const union ubifs_key *key,
686 			     struct ubifs_znode **zn, int *n,
687 			     const struct qstr *nm)
688 {
689 	int err;
690 
691 	err = matches_name(c, &(*zn)->zbranch[*n], nm);
692 	if (unlikely(err < 0))
693 		return err;
694 	if (err == NAME_MATCHES)
695 		return 1;
696 
697 	if (err == NAME_GREATER) {
698 		/* Look left */
699 		while (1) {
700 			err = tnc_prev(c, zn, n);
701 			if (err == -ENOENT) {
702 				ubifs_assert(*n == 0);
703 				*n = -1;
704 				return 0;
705 			}
706 			if (err < 0)
707 				return err;
708 			if (keys_cmp(c, &(*zn)->zbranch[*n].key, key)) {
709 				/*
710 				 * We have found the branch after which we would
711 				 * like to insert, but inserting in this znode
712 				 * may still be wrong. Consider the following 3
713 				 * znodes, in the case where we are resolving a
714 				 * collision with Key2.
715 				 *
716 				 *                  znode zp
717 				 *            ----------------------
718 				 * level 1     |  Key0  |  Key1  |
719 				 *            -----------------------
720 				 *                 |            |
721 				 *       znode za  |            |  znode zb
722 				 *          ------------      ------------
723 				 * level 0  |  Key0  |        |  Key2  |
724 				 *          ------------      ------------
725 				 *
726 				 * The lookup finds Key2 in znode zb. Lets say
727 				 * there is no match and the name is greater so
728 				 * we look left. When we find Key0, we end up
729 				 * here. If we return now, we will insert into
730 				 * znode za at slot n = 1.  But that is invalid
731 				 * according to the parent's keys.  Key2 must
732 				 * be inserted into znode zb.
733 				 *
734 				 * Note, this problem is not relevant for the
735 				 * case when we go right, because
736 				 * 'tnc_insert()' would correct the parent key.
737 				 */
738 				if (*n == (*zn)->child_cnt - 1) {
739 					err = tnc_next(c, zn, n);
740 					if (err) {
741 						/* Should be impossible */
742 						ubifs_assert(0);
743 						if (err == -ENOENT)
744 							err = -EINVAL;
745 						return err;
746 					}
747 					ubifs_assert(*n == 0);
748 					*n = -1;
749 				}
750 				return 0;
751 			}
752 			err = matches_name(c, &(*zn)->zbranch[*n], nm);
753 			if (err < 0)
754 				return err;
755 			if (err == NAME_LESS)
756 				return 0;
757 			if (err == NAME_MATCHES)
758 				return 1;
759 			ubifs_assert(err == NAME_GREATER);
760 		}
761 	} else {
762 		int nn = *n;
763 		struct ubifs_znode *znode = *zn;
764 
765 		/* Look right */
766 		while (1) {
767 			err = tnc_next(c, &znode, &nn);
768 			if (err == -ENOENT)
769 				return 0;
770 			if (err < 0)
771 				return err;
772 			if (keys_cmp(c, &znode->zbranch[nn].key, key))
773 				return 0;
774 			err = matches_name(c, &znode->zbranch[nn], nm);
775 			if (err < 0)
776 				return err;
777 			if (err == NAME_GREATER)
778 				return 0;
779 			*zn = znode;
780 			*n = nn;
781 			if (err == NAME_MATCHES)
782 				return 1;
783 			ubifs_assert(err == NAME_LESS);
784 		}
785 	}
786 }
787 
788 /**
789  * fallible_matches_name - determine if a dent matches a given name.
790  * @c: UBIFS file-system description object
791  * @zbr: zbranch of dent
792  * @nm: name to match
793  *
794  * This is a "fallible" version of 'matches_name()' function which does not
795  * panic if the direntry/xentry referred by @zbr does not exist on the media.
796  *
797  * This function checks if xentry/direntry referred by zbranch @zbr matches name
798  * @nm. Returns %NAME_MATCHES it does, %NAME_LESS if the name referred by @zbr
799  * is less than @nm, %NAME_GREATER if it is greater than @nm, and @NOT_ON_MEDIA
800  * if xentry/direntry referred by @zbr does not exist on the media. A negative
801  * error code is returned in case of failure.
802  */
fallible_matches_name(struct ubifs_info * c,struct ubifs_zbranch * zbr,const struct qstr * nm)803 static int fallible_matches_name(struct ubifs_info *c,
804 				 struct ubifs_zbranch *zbr,
805 				 const struct qstr *nm)
806 {
807 	struct ubifs_dent_node *dent;
808 	int nlen, err;
809 
810 	/* If possible, match against the dent in the leaf node cache */
811 	if (!zbr->leaf) {
812 		dent = kmalloc(zbr->len, GFP_NOFS);
813 		if (!dent)
814 			return -ENOMEM;
815 
816 		err = fallible_read_node(c, &zbr->key, zbr, dent);
817 		if (err < 0)
818 			goto out_free;
819 		if (err == 0) {
820 			/* The node was not present */
821 			err = NOT_ON_MEDIA;
822 			goto out_free;
823 		}
824 		ubifs_assert(err == 1);
825 
826 		err = lnc_add_directly(c, zbr, dent);
827 		if (err)
828 			goto out_free;
829 	} else
830 		dent = zbr->leaf;
831 
832 	nlen = le16_to_cpu(dent->nlen);
833 	err = memcmp(dent->name, nm->name, min_t(int, nlen, nm->len));
834 	if (err == 0) {
835 		if (nlen == nm->len)
836 			return NAME_MATCHES;
837 		else if (nlen < nm->len)
838 			return NAME_LESS;
839 		else
840 			return NAME_GREATER;
841 	} else if (err < 0)
842 		return NAME_LESS;
843 	else
844 		return NAME_GREATER;
845 
846 out_free:
847 	kfree(dent);
848 	return err;
849 }
850 
851 /**
852  * fallible_resolve_collision - resolve a collision even if nodes are missing.
853  * @c: UBIFS file-system description object
854  * @key: key
855  * @zn: znode is returned here
856  * @n: branch number is passed and returned here
857  * @nm: name of directory entry
858  * @adding: indicates caller is adding a key to the TNC
859  *
860  * This is a "fallible" version of the 'resolve_collision()' function which
861  * does not panic if one of the nodes referred to by TNC does not exist on the
862  * media. This may happen when replaying the journal if a deleted node was
863  * Garbage-collected and the commit was not done. A branch that refers to a node
864  * that is not present is called a dangling branch. The following are the return
865  * codes for this function:
866  *  o if @nm was found, %1 is returned and @zn and @n are set to the found
867  *    branch;
868  *  o if we are @adding and @nm was not found, %0 is returned;
869  *  o if we are not @adding and @nm was not found, but a dangling branch was
870  *    found, then %1 is returned and @zn and @n are set to the dangling branch;
871  *  o a negative error code is returned in case of failure.
872  */
fallible_resolve_collision(struct ubifs_info * c,const union ubifs_key * key,struct ubifs_znode ** zn,int * n,const struct qstr * nm,int adding)873 static int fallible_resolve_collision(struct ubifs_info *c,
874 				      const union ubifs_key *key,
875 				      struct ubifs_znode **zn, int *n,
876 				      const struct qstr *nm, int adding)
877 {
878 	struct ubifs_znode *o_znode = NULL, *znode = *zn;
879 	int uninitialized_var(o_n), err, cmp, unsure = 0, nn = *n;
880 
881 	cmp = fallible_matches_name(c, &znode->zbranch[nn], nm);
882 	if (unlikely(cmp < 0))
883 		return cmp;
884 	if (cmp == NAME_MATCHES)
885 		return 1;
886 	if (cmp == NOT_ON_MEDIA) {
887 		o_znode = znode;
888 		o_n = nn;
889 		/*
890 		 * We are unlucky and hit a dangling branch straight away.
891 		 * Now we do not really know where to go to find the needed
892 		 * branch - to the left or to the right. Well, let's try left.
893 		 */
894 		unsure = 1;
895 	} else if (!adding)
896 		unsure = 1; /* Remove a dangling branch wherever it is */
897 
898 	if (cmp == NAME_GREATER || unsure) {
899 		/* Look left */
900 		while (1) {
901 			err = tnc_prev(c, zn, n);
902 			if (err == -ENOENT) {
903 				ubifs_assert(*n == 0);
904 				*n = -1;
905 				break;
906 			}
907 			if (err < 0)
908 				return err;
909 			if (keys_cmp(c, &(*zn)->zbranch[*n].key, key)) {
910 				/* See comments in 'resolve_collision()' */
911 				if (*n == (*zn)->child_cnt - 1) {
912 					err = tnc_next(c, zn, n);
913 					if (err) {
914 						/* Should be impossible */
915 						ubifs_assert(0);
916 						if (err == -ENOENT)
917 							err = -EINVAL;
918 						return err;
919 					}
920 					ubifs_assert(*n == 0);
921 					*n = -1;
922 				}
923 				break;
924 			}
925 			err = fallible_matches_name(c, &(*zn)->zbranch[*n], nm);
926 			if (err < 0)
927 				return err;
928 			if (err == NAME_MATCHES)
929 				return 1;
930 			if (err == NOT_ON_MEDIA) {
931 				o_znode = *zn;
932 				o_n = *n;
933 				continue;
934 			}
935 			if (!adding)
936 				continue;
937 			if (err == NAME_LESS)
938 				break;
939 			else
940 				unsure = 0;
941 		}
942 	}
943 
944 	if (cmp == NAME_LESS || unsure) {
945 		/* Look right */
946 		*zn = znode;
947 		*n = nn;
948 		while (1) {
949 			err = tnc_next(c, &znode, &nn);
950 			if (err == -ENOENT)
951 				break;
952 			if (err < 0)
953 				return err;
954 			if (keys_cmp(c, &znode->zbranch[nn].key, key))
955 				break;
956 			err = fallible_matches_name(c, &znode->zbranch[nn], nm);
957 			if (err < 0)
958 				return err;
959 			if (err == NAME_GREATER)
960 				break;
961 			*zn = znode;
962 			*n = nn;
963 			if (err == NAME_MATCHES)
964 				return 1;
965 			if (err == NOT_ON_MEDIA) {
966 				o_znode = znode;
967 				o_n = nn;
968 			}
969 		}
970 	}
971 
972 	/* Never match a dangling branch when adding */
973 	if (adding || !o_znode)
974 		return 0;
975 
976 	dbg_mntk(key, "dangling match LEB %d:%d len %d key ",
977 		o_znode->zbranch[o_n].lnum, o_znode->zbranch[o_n].offs,
978 		o_znode->zbranch[o_n].len);
979 	*zn = o_znode;
980 	*n = o_n;
981 	return 1;
982 }
983 
984 /**
985  * matches_position - determine if a zbranch matches a given position.
986  * @zbr: zbranch of dent
987  * @lnum: LEB number of dent to match
988  * @offs: offset of dent to match
989  *
990  * This function returns %1 if @lnum:@offs matches, and %0 otherwise.
991  */
matches_position(struct ubifs_zbranch * zbr,int lnum,int offs)992 static int matches_position(struct ubifs_zbranch *zbr, int lnum, int offs)
993 {
994 	if (zbr->lnum == lnum && zbr->offs == offs)
995 		return 1;
996 	else
997 		return 0;
998 }
999 
1000 /**
1001  * resolve_collision_directly - resolve a collision directly.
1002  * @c: UBIFS file-system description object
1003  * @key: key of directory entry
1004  * @zn: znode is passed and returned here
1005  * @n: zbranch number is passed and returned here
1006  * @lnum: LEB number of dent node to match
1007  * @offs: offset of dent node to match
1008  *
1009  * This function is used for "hashed" keys to make sure the found directory or
1010  * extended attribute entry node is what was looked for. It is used when the
1011  * flash address of the right node is known (@lnum:@offs) which makes it much
1012  * easier to resolve collisions (no need to read entries and match full
1013  * names). This function returns %1 and sets @zn and @n if the collision is
1014  * resolved, %0 if @lnum:@offs is not found and @zn and @n are set to the
1015  * previous directory entry. Otherwise a negative error code is returned.
1016  */
resolve_collision_directly(struct ubifs_info * c,const union ubifs_key * key,struct ubifs_znode ** zn,int * n,int lnum,int offs)1017 static int resolve_collision_directly(struct ubifs_info *c,
1018 				      const union ubifs_key *key,
1019 				      struct ubifs_znode **zn, int *n,
1020 				      int lnum, int offs)
1021 {
1022 	struct ubifs_znode *znode;
1023 	int nn, err;
1024 
1025 	znode = *zn;
1026 	nn = *n;
1027 	if (matches_position(&znode->zbranch[nn], lnum, offs))
1028 		return 1;
1029 
1030 	/* Look left */
1031 	while (1) {
1032 		err = tnc_prev(c, &znode, &nn);
1033 		if (err == -ENOENT)
1034 			break;
1035 		if (err < 0)
1036 			return err;
1037 		if (keys_cmp(c, &znode->zbranch[nn].key, key))
1038 			break;
1039 		if (matches_position(&znode->zbranch[nn], lnum, offs)) {
1040 			*zn = znode;
1041 			*n = nn;
1042 			return 1;
1043 		}
1044 	}
1045 
1046 	/* Look right */
1047 	znode = *zn;
1048 	nn = *n;
1049 	while (1) {
1050 		err = tnc_next(c, &znode, &nn);
1051 		if (err == -ENOENT)
1052 			return 0;
1053 		if (err < 0)
1054 			return err;
1055 		if (keys_cmp(c, &znode->zbranch[nn].key, key))
1056 			return 0;
1057 		*zn = znode;
1058 		*n = nn;
1059 		if (matches_position(&znode->zbranch[nn], lnum, offs))
1060 			return 1;
1061 	}
1062 }
1063 
1064 /**
1065  * dirty_cow_bottom_up - dirty a znode and its ancestors.
1066  * @c: UBIFS file-system description object
1067  * @znode: znode to dirty
1068  *
1069  * If we do not have a unique key that resides in a znode, then we cannot
1070  * dirty that znode from the top down (i.e. by using lookup_level0_dirty)
1071  * This function records the path back to the last dirty ancestor, and then
1072  * dirties the znodes on that path.
1073  */
dirty_cow_bottom_up(struct ubifs_info * c,struct ubifs_znode * znode)1074 static struct ubifs_znode *dirty_cow_bottom_up(struct ubifs_info *c,
1075 					       struct ubifs_znode *znode)
1076 {
1077 	struct ubifs_znode *zp;
1078 	int *path = c->bottom_up_buf, p = 0;
1079 
1080 	ubifs_assert(c->zroot.znode);
1081 	ubifs_assert(znode);
1082 	if (c->zroot.znode->level > BOTTOM_UP_HEIGHT) {
1083 		kfree(c->bottom_up_buf);
1084 		c->bottom_up_buf = kmalloc(c->zroot.znode->level * sizeof(int),
1085 					   GFP_NOFS);
1086 		if (!c->bottom_up_buf)
1087 			return ERR_PTR(-ENOMEM);
1088 		path = c->bottom_up_buf;
1089 	}
1090 	if (c->zroot.znode->level) {
1091 		/* Go up until parent is dirty */
1092 		while (1) {
1093 			int n;
1094 
1095 			zp = znode->parent;
1096 			if (!zp)
1097 				break;
1098 			n = znode->iip;
1099 			ubifs_assert(p < c->zroot.znode->level);
1100 			path[p++] = n;
1101 			if (!zp->cnext && ubifs_zn_dirty(znode))
1102 				break;
1103 			znode = zp;
1104 		}
1105 	}
1106 
1107 	/* Come back down, dirtying as we go */
1108 	while (1) {
1109 		struct ubifs_zbranch *zbr;
1110 
1111 		zp = znode->parent;
1112 		if (zp) {
1113 			ubifs_assert(path[p - 1] >= 0);
1114 			ubifs_assert(path[p - 1] < zp->child_cnt);
1115 			zbr = &zp->zbranch[path[--p]];
1116 			znode = dirty_cow_znode(c, zbr);
1117 		} else {
1118 			ubifs_assert(znode == c->zroot.znode);
1119 			znode = dirty_cow_znode(c, &c->zroot);
1120 		}
1121 		if (IS_ERR(znode) || !p)
1122 			break;
1123 		ubifs_assert(path[p - 1] >= 0);
1124 		ubifs_assert(path[p - 1] < znode->child_cnt);
1125 		znode = znode->zbranch[path[p - 1]].znode;
1126 	}
1127 
1128 	return znode;
1129 }
1130 
1131 /**
1132  * ubifs_lookup_level0 - search for zero-level znode.
1133  * @c: UBIFS file-system description object
1134  * @key:  key to lookup
1135  * @zn: znode is returned here
1136  * @n: znode branch slot number is returned here
1137  *
1138  * This function looks up the TNC tree and search for zero-level znode which
1139  * refers key @key. The found zero-level znode is returned in @zn. There are 3
1140  * cases:
1141  *   o exact match, i.e. the found zero-level znode contains key @key, then %1
1142  *     is returned and slot number of the matched branch is stored in @n;
1143  *   o not exact match, which means that zero-level znode does not contain
1144  *     @key, then %0 is returned and slot number of the closest branch is stored
1145  *     in @n;
1146  *   o @key is so small that it is even less than the lowest key of the
1147  *     leftmost zero-level node, then %0 is returned and %0 is stored in @n.
1148  *
1149  * Note, when the TNC tree is traversed, some znodes may be absent, then this
1150  * function reads corresponding indexing nodes and inserts them to TNC. In
1151  * case of failure, a negative error code is returned.
1152  */
ubifs_lookup_level0(struct ubifs_info * c,const union ubifs_key * key,struct ubifs_znode ** zn,int * n)1153 int ubifs_lookup_level0(struct ubifs_info *c, const union ubifs_key *key,
1154 			struct ubifs_znode **zn, int *n)
1155 {
1156 	int err, exact;
1157 	struct ubifs_znode *znode;
1158 	unsigned long time = get_seconds();
1159 
1160 	dbg_tnck(key, "search key ");
1161 	ubifs_assert(key_type(c, key) < UBIFS_INVALID_KEY);
1162 
1163 	znode = c->zroot.znode;
1164 	if (unlikely(!znode)) {
1165 		znode = ubifs_load_znode(c, &c->zroot, NULL, 0);
1166 		if (IS_ERR(znode))
1167 			return PTR_ERR(znode);
1168 	}
1169 
1170 	znode->time = time;
1171 
1172 	while (1) {
1173 		struct ubifs_zbranch *zbr;
1174 
1175 		exact = ubifs_search_zbranch(c, znode, key, n);
1176 
1177 		if (znode->level == 0)
1178 			break;
1179 
1180 		if (*n < 0)
1181 			*n = 0;
1182 		zbr = &znode->zbranch[*n];
1183 
1184 		if (zbr->znode) {
1185 			znode->time = time;
1186 			znode = zbr->znode;
1187 			continue;
1188 		}
1189 
1190 		/* znode is not in TNC cache, load it from the media */
1191 		znode = ubifs_load_znode(c, zbr, znode, *n);
1192 		if (IS_ERR(znode))
1193 			return PTR_ERR(znode);
1194 	}
1195 
1196 	*zn = znode;
1197 	if (exact || !is_hash_key(c, key) || *n != -1) {
1198 		dbg_tnc("found %d, lvl %d, n %d", exact, znode->level, *n);
1199 		return exact;
1200 	}
1201 
1202 	/*
1203 	 * Here is a tricky place. We have not found the key and this is a
1204 	 * "hashed" key, which may collide. The rest of the code deals with
1205 	 * situations like this:
1206 	 *
1207 	 *                  | 3 | 5 |
1208 	 *                  /       \
1209 	 *          | 3 | 5 |      | 6 | 7 | (x)
1210 	 *
1211 	 * Or more a complex example:
1212 	 *
1213 	 *                | 1 | 5 |
1214 	 *                /       \
1215 	 *       | 1 | 3 |         | 5 | 8 |
1216 	 *              \           /
1217 	 *          | 5 | 5 |   | 6 | 7 | (x)
1218 	 *
1219 	 * In the examples, if we are looking for key "5", we may reach nodes
1220 	 * marked with "(x)". In this case what we have do is to look at the
1221 	 * left and see if there is "5" key there. If there is, we have to
1222 	 * return it.
1223 	 *
1224 	 * Note, this whole situation is possible because we allow to have
1225 	 * elements which are equivalent to the next key in the parent in the
1226 	 * children of current znode. For example, this happens if we split a
1227 	 * znode like this: | 3 | 5 | 5 | 6 | 7 |, which results in something
1228 	 * like this:
1229 	 *                      | 3 | 5 |
1230 	 *                       /     \
1231 	 *                | 3 | 5 |   | 5 | 6 | 7 |
1232 	 *                              ^
1233 	 * And this becomes what is at the first "picture" after key "5" marked
1234 	 * with "^" is removed. What could be done is we could prohibit
1235 	 * splitting in the middle of the colliding sequence. Also, when
1236 	 * removing the leftmost key, we would have to correct the key of the
1237 	 * parent node, which would introduce additional complications. Namely,
1238 	 * if we changed the leftmost key of the parent znode, the garbage
1239 	 * collector would be unable to find it (GC is doing this when GC'ing
1240 	 * indexing LEBs). Although we already have an additional RB-tree where
1241 	 * we save such changed znodes (see 'ins_clr_old_idx_znode()') until
1242 	 * after the commit. But anyway, this does not look easy to implement
1243 	 * so we did not try this.
1244 	 */
1245 	err = tnc_prev(c, &znode, n);
1246 	if (err == -ENOENT) {
1247 		dbg_tnc("found 0, lvl %d, n -1", znode->level);
1248 		*n = -1;
1249 		return 0;
1250 	}
1251 	if (unlikely(err < 0))
1252 		return err;
1253 	if (keys_cmp(c, key, &znode->zbranch[*n].key)) {
1254 		dbg_tnc("found 0, lvl %d, n -1", znode->level);
1255 		*n = -1;
1256 		return 0;
1257 	}
1258 
1259 	dbg_tnc("found 1, lvl %d, n %d", znode->level, *n);
1260 	*zn = znode;
1261 	return 1;
1262 }
1263 
1264 /**
1265  * lookup_level0_dirty - search for zero-level znode dirtying.
1266  * @c: UBIFS file-system description object
1267  * @key:  key to lookup
1268  * @zn: znode is returned here
1269  * @n: znode branch slot number is returned here
1270  *
1271  * This function looks up the TNC tree and search for zero-level znode which
1272  * refers key @key. The found zero-level znode is returned in @zn. There are 3
1273  * cases:
1274  *   o exact match, i.e. the found zero-level znode contains key @key, then %1
1275  *     is returned and slot number of the matched branch is stored in @n;
1276  *   o not exact match, which means that zero-level znode does not contain @key
1277  *     then %0 is returned and slot number of the closed branch is stored in
1278  *     @n;
1279  *   o @key is so small that it is even less than the lowest key of the
1280  *     leftmost zero-level node, then %0 is returned and %-1 is stored in @n.
1281  *
1282  * Additionally all znodes in the path from the root to the located zero-level
1283  * znode are marked as dirty.
1284  *
1285  * Note, when the TNC tree is traversed, some znodes may be absent, then this
1286  * function reads corresponding indexing nodes and inserts them to TNC. In
1287  * case of failure, a negative error code is returned.
1288  */
lookup_level0_dirty(struct ubifs_info * c,const union ubifs_key * key,struct ubifs_znode ** zn,int * n)1289 static int lookup_level0_dirty(struct ubifs_info *c, const union ubifs_key *key,
1290 			       struct ubifs_znode **zn, int *n)
1291 {
1292 	int err, exact;
1293 	struct ubifs_znode *znode;
1294 	unsigned long time = get_seconds();
1295 
1296 	dbg_tnck(key, "search and dirty key ");
1297 
1298 	znode = c->zroot.znode;
1299 	if (unlikely(!znode)) {
1300 		znode = ubifs_load_znode(c, &c->zroot, NULL, 0);
1301 		if (IS_ERR(znode))
1302 			return PTR_ERR(znode);
1303 	}
1304 
1305 	znode = dirty_cow_znode(c, &c->zroot);
1306 	if (IS_ERR(znode))
1307 		return PTR_ERR(znode);
1308 
1309 	znode->time = time;
1310 
1311 	while (1) {
1312 		struct ubifs_zbranch *zbr;
1313 
1314 		exact = ubifs_search_zbranch(c, znode, key, n);
1315 
1316 		if (znode->level == 0)
1317 			break;
1318 
1319 		if (*n < 0)
1320 			*n = 0;
1321 		zbr = &znode->zbranch[*n];
1322 
1323 		if (zbr->znode) {
1324 			znode->time = time;
1325 			znode = dirty_cow_znode(c, zbr);
1326 			if (IS_ERR(znode))
1327 				return PTR_ERR(znode);
1328 			continue;
1329 		}
1330 
1331 		/* znode is not in TNC cache, load it from the media */
1332 		znode = ubifs_load_znode(c, zbr, znode, *n);
1333 		if (IS_ERR(znode))
1334 			return PTR_ERR(znode);
1335 		znode = dirty_cow_znode(c, zbr);
1336 		if (IS_ERR(znode))
1337 			return PTR_ERR(znode);
1338 	}
1339 
1340 	*zn = znode;
1341 	if (exact || !is_hash_key(c, key) || *n != -1) {
1342 		dbg_tnc("found %d, lvl %d, n %d", exact, znode->level, *n);
1343 		return exact;
1344 	}
1345 
1346 	/*
1347 	 * See huge comment at 'lookup_level0_dirty()' what is the rest of the
1348 	 * code.
1349 	 */
1350 	err = tnc_prev(c, &znode, n);
1351 	if (err == -ENOENT) {
1352 		*n = -1;
1353 		dbg_tnc("found 0, lvl %d, n -1", znode->level);
1354 		return 0;
1355 	}
1356 	if (unlikely(err < 0))
1357 		return err;
1358 	if (keys_cmp(c, key, &znode->zbranch[*n].key)) {
1359 		*n = -1;
1360 		dbg_tnc("found 0, lvl %d, n -1", znode->level);
1361 		return 0;
1362 	}
1363 
1364 	if (znode->cnext || !ubifs_zn_dirty(znode)) {
1365 		znode = dirty_cow_bottom_up(c, znode);
1366 		if (IS_ERR(znode))
1367 			return PTR_ERR(znode);
1368 	}
1369 
1370 	dbg_tnc("found 1, lvl %d, n %d", znode->level, *n);
1371 	*zn = znode;
1372 	return 1;
1373 }
1374 
1375 /**
1376  * maybe_leb_gced - determine if a LEB may have been garbage collected.
1377  * @c: UBIFS file-system description object
1378  * @lnum: LEB number
1379  * @gc_seq1: garbage collection sequence number
1380  *
1381  * This function determines if @lnum may have been garbage collected since
1382  * sequence number @gc_seq1. If it may have been then %1 is returned, otherwise
1383  * %0 is returned.
1384  */
maybe_leb_gced(struct ubifs_info * c,int lnum,int gc_seq1)1385 static int maybe_leb_gced(struct ubifs_info *c, int lnum, int gc_seq1)
1386 {
1387 #ifndef __UBOOT__
1388 	int gc_seq2, gced_lnum;
1389 
1390 	gced_lnum = c->gced_lnum;
1391 	smp_rmb();
1392 	gc_seq2 = c->gc_seq;
1393 	/* Same seq means no GC */
1394 	if (gc_seq1 == gc_seq2)
1395 		return 0;
1396 	/* Different by more than 1 means we don't know */
1397 	if (gc_seq1 + 1 != gc_seq2)
1398 		return 1;
1399 	/*
1400 	 * We have seen the sequence number has increased by 1. Now we need to
1401 	 * be sure we read the right LEB number, so read it again.
1402 	 */
1403 	smp_rmb();
1404 	if (gced_lnum != c->gced_lnum)
1405 		return 1;
1406 	/* Finally we can check lnum */
1407 	if (gced_lnum == lnum)
1408 		return 1;
1409 #else
1410 	/* No garbage collection in the read-only U-Boot implementation */
1411 #endif
1412 	return 0;
1413 }
1414 
1415 /**
1416  * ubifs_tnc_locate - look up a file-system node and return it and its location.
1417  * @c: UBIFS file-system description object
1418  * @key: node key to lookup
1419  * @node: the node is returned here
1420  * @lnum: LEB number is returned here
1421  * @offs: offset is returned here
1422  *
1423  * This function looks up and reads node with key @key. The caller has to make
1424  * sure the @node buffer is large enough to fit the node. Returns zero in case
1425  * of success, %-ENOENT if the node was not found, and a negative error code in
1426  * case of failure. The node location can be returned in @lnum and @offs.
1427  */
ubifs_tnc_locate(struct ubifs_info * c,const union ubifs_key * key,void * node,int * lnum,int * offs)1428 int ubifs_tnc_locate(struct ubifs_info *c, const union ubifs_key *key,
1429 		     void *node, int *lnum, int *offs)
1430 {
1431 	int found, n, err, safely = 0, gc_seq1;
1432 	struct ubifs_znode *znode;
1433 	struct ubifs_zbranch zbr, *zt;
1434 
1435 again:
1436 	mutex_lock(&c->tnc_mutex);
1437 	found = ubifs_lookup_level0(c, key, &znode, &n);
1438 	if (!found) {
1439 		err = -ENOENT;
1440 		goto out;
1441 	} else if (found < 0) {
1442 		err = found;
1443 		goto out;
1444 	}
1445 	zt = &znode->zbranch[n];
1446 	if (lnum) {
1447 		*lnum = zt->lnum;
1448 		*offs = zt->offs;
1449 	}
1450 	if (is_hash_key(c, key)) {
1451 		/*
1452 		 * In this case the leaf node cache gets used, so we pass the
1453 		 * address of the zbranch and keep the mutex locked
1454 		 */
1455 		err = tnc_read_node_nm(c, zt, node);
1456 		goto out;
1457 	}
1458 	if (safely) {
1459 		err = ubifs_tnc_read_node(c, zt, node);
1460 		goto out;
1461 	}
1462 	/* Drop the TNC mutex prematurely and race with garbage collection */
1463 	zbr = znode->zbranch[n];
1464 	gc_seq1 = c->gc_seq;
1465 	mutex_unlock(&c->tnc_mutex);
1466 
1467 	if (ubifs_get_wbuf(c, zbr.lnum)) {
1468 		/* We do not GC journal heads */
1469 		err = ubifs_tnc_read_node(c, &zbr, node);
1470 		return err;
1471 	}
1472 
1473 	err = fallible_read_node(c, key, &zbr, node);
1474 	if (err <= 0 || maybe_leb_gced(c, zbr.lnum, gc_seq1)) {
1475 		/*
1476 		 * The node may have been GC'ed out from under us so try again
1477 		 * while keeping the TNC mutex locked.
1478 		 */
1479 		safely = 1;
1480 		goto again;
1481 	}
1482 	return 0;
1483 
1484 out:
1485 	mutex_unlock(&c->tnc_mutex);
1486 	return err;
1487 }
1488 
1489 /**
1490  * ubifs_tnc_get_bu_keys - lookup keys for bulk-read.
1491  * @c: UBIFS file-system description object
1492  * @bu: bulk-read parameters and results
1493  *
1494  * Lookup consecutive data node keys for the same inode that reside
1495  * consecutively in the same LEB. This function returns zero in case of success
1496  * and a negative error code in case of failure.
1497  *
1498  * Note, if the bulk-read buffer length (@bu->buf_len) is known, this function
1499  * makes sure bulk-read nodes fit the buffer. Otherwise, this function prepares
1500  * maximum possible amount of nodes for bulk-read.
1501  */
ubifs_tnc_get_bu_keys(struct ubifs_info * c,struct bu_info * bu)1502 int ubifs_tnc_get_bu_keys(struct ubifs_info *c, struct bu_info *bu)
1503 {
1504 	int n, err = 0, lnum = -1, uninitialized_var(offs);
1505 	int uninitialized_var(len);
1506 	unsigned int block = key_block(c, &bu->key);
1507 	struct ubifs_znode *znode;
1508 
1509 	bu->cnt = 0;
1510 	bu->blk_cnt = 0;
1511 	bu->eof = 0;
1512 
1513 	mutex_lock(&c->tnc_mutex);
1514 	/* Find first key */
1515 	err = ubifs_lookup_level0(c, &bu->key, &znode, &n);
1516 	if (err < 0)
1517 		goto out;
1518 	if (err) {
1519 		/* Key found */
1520 		len = znode->zbranch[n].len;
1521 		/* The buffer must be big enough for at least 1 node */
1522 		if (len > bu->buf_len) {
1523 			err = -EINVAL;
1524 			goto out;
1525 		}
1526 		/* Add this key */
1527 		bu->zbranch[bu->cnt++] = znode->zbranch[n];
1528 		bu->blk_cnt += 1;
1529 		lnum = znode->zbranch[n].lnum;
1530 		offs = ALIGN(znode->zbranch[n].offs + len, 8);
1531 	}
1532 	while (1) {
1533 		struct ubifs_zbranch *zbr;
1534 		union ubifs_key *key;
1535 		unsigned int next_block;
1536 
1537 		/* Find next key */
1538 		err = tnc_next(c, &znode, &n);
1539 		if (err)
1540 			goto out;
1541 		zbr = &znode->zbranch[n];
1542 		key = &zbr->key;
1543 		/* See if there is another data key for this file */
1544 		if (key_inum(c, key) != key_inum(c, &bu->key) ||
1545 		    key_type(c, key) != UBIFS_DATA_KEY) {
1546 			err = -ENOENT;
1547 			goto out;
1548 		}
1549 		if (lnum < 0) {
1550 			/* First key found */
1551 			lnum = zbr->lnum;
1552 			offs = ALIGN(zbr->offs + zbr->len, 8);
1553 			len = zbr->len;
1554 			if (len > bu->buf_len) {
1555 				err = -EINVAL;
1556 				goto out;
1557 			}
1558 		} else {
1559 			/*
1560 			 * The data nodes must be in consecutive positions in
1561 			 * the same LEB.
1562 			 */
1563 			if (zbr->lnum != lnum || zbr->offs != offs)
1564 				goto out;
1565 			offs += ALIGN(zbr->len, 8);
1566 			len = ALIGN(len, 8) + zbr->len;
1567 			/* Must not exceed buffer length */
1568 			if (len > bu->buf_len)
1569 				goto out;
1570 		}
1571 		/* Allow for holes */
1572 		next_block = key_block(c, key);
1573 		bu->blk_cnt += (next_block - block - 1);
1574 		if (bu->blk_cnt >= UBIFS_MAX_BULK_READ)
1575 			goto out;
1576 		block = next_block;
1577 		/* Add this key */
1578 		bu->zbranch[bu->cnt++] = *zbr;
1579 		bu->blk_cnt += 1;
1580 		/* See if we have room for more */
1581 		if (bu->cnt >= UBIFS_MAX_BULK_READ)
1582 			goto out;
1583 		if (bu->blk_cnt >= UBIFS_MAX_BULK_READ)
1584 			goto out;
1585 	}
1586 out:
1587 	if (err == -ENOENT) {
1588 		bu->eof = 1;
1589 		err = 0;
1590 	}
1591 	bu->gc_seq = c->gc_seq;
1592 	mutex_unlock(&c->tnc_mutex);
1593 	if (err)
1594 		return err;
1595 	/*
1596 	 * An enormous hole could cause bulk-read to encompass too many
1597 	 * page cache pages, so limit the number here.
1598 	 */
1599 	if (bu->blk_cnt > UBIFS_MAX_BULK_READ)
1600 		bu->blk_cnt = UBIFS_MAX_BULK_READ;
1601 	/*
1602 	 * Ensure that bulk-read covers a whole number of page cache
1603 	 * pages.
1604 	 */
1605 	if (UBIFS_BLOCKS_PER_PAGE == 1 ||
1606 	    !(bu->blk_cnt & (UBIFS_BLOCKS_PER_PAGE - 1)))
1607 		return 0;
1608 	if (bu->eof) {
1609 		/* At the end of file we can round up */
1610 		bu->blk_cnt += UBIFS_BLOCKS_PER_PAGE - 1;
1611 		return 0;
1612 	}
1613 	/* Exclude data nodes that do not make up a whole page cache page */
1614 	block = key_block(c, &bu->key) + bu->blk_cnt;
1615 	block &= ~(UBIFS_BLOCKS_PER_PAGE - 1);
1616 	while (bu->cnt) {
1617 		if (key_block(c, &bu->zbranch[bu->cnt - 1].key) < block)
1618 			break;
1619 		bu->cnt -= 1;
1620 	}
1621 	return 0;
1622 }
1623 
1624 /**
1625  * read_wbuf - bulk-read from a LEB with a wbuf.
1626  * @wbuf: wbuf that may overlap the read
1627  * @buf: buffer into which to read
1628  * @len: read length
1629  * @lnum: LEB number from which to read
1630  * @offs: offset from which to read
1631  *
1632  * This functions returns %0 on success or a negative error code on failure.
1633  */
read_wbuf(struct ubifs_wbuf * wbuf,void * buf,int len,int lnum,int offs)1634 static int read_wbuf(struct ubifs_wbuf *wbuf, void *buf, int len, int lnum,
1635 		     int offs)
1636 {
1637 	const struct ubifs_info *c = wbuf->c;
1638 	int rlen, overlap;
1639 
1640 	dbg_io("LEB %d:%d, length %d", lnum, offs, len);
1641 	ubifs_assert(wbuf && lnum >= 0 && lnum < c->leb_cnt && offs >= 0);
1642 	ubifs_assert(!(offs & 7) && offs < c->leb_size);
1643 	ubifs_assert(offs + len <= c->leb_size);
1644 
1645 	spin_lock(&wbuf->lock);
1646 	overlap = (lnum == wbuf->lnum && offs + len > wbuf->offs);
1647 	if (!overlap) {
1648 		/* We may safely unlock the write-buffer and read the data */
1649 		spin_unlock(&wbuf->lock);
1650 		return ubifs_leb_read(c, lnum, buf, offs, len, 0);
1651 	}
1652 
1653 	/* Don't read under wbuf */
1654 	rlen = wbuf->offs - offs;
1655 	if (rlen < 0)
1656 		rlen = 0;
1657 
1658 	/* Copy the rest from the write-buffer */
1659 	memcpy(buf + rlen, wbuf->buf + offs + rlen - wbuf->offs, len - rlen);
1660 	spin_unlock(&wbuf->lock);
1661 
1662 	if (rlen > 0)
1663 		/* Read everything that goes before write-buffer */
1664 		return ubifs_leb_read(c, lnum, buf, offs, rlen, 0);
1665 
1666 	return 0;
1667 }
1668 
1669 /**
1670  * validate_data_node - validate data nodes for bulk-read.
1671  * @c: UBIFS file-system description object
1672  * @buf: buffer containing data node to validate
1673  * @zbr: zbranch of data node to validate
1674  *
1675  * This functions returns %0 on success or a negative error code on failure.
1676  */
validate_data_node(struct ubifs_info * c,void * buf,struct ubifs_zbranch * zbr)1677 static int validate_data_node(struct ubifs_info *c, void *buf,
1678 			      struct ubifs_zbranch *zbr)
1679 {
1680 	union ubifs_key key1;
1681 	struct ubifs_ch *ch = buf;
1682 	int err, len;
1683 
1684 	if (ch->node_type != UBIFS_DATA_NODE) {
1685 		ubifs_err(c, "bad node type (%d but expected %d)",
1686 			  ch->node_type, UBIFS_DATA_NODE);
1687 		goto out_err;
1688 	}
1689 
1690 	err = ubifs_check_node(c, buf, zbr->lnum, zbr->offs, 0, 0);
1691 	if (err) {
1692 		ubifs_err(c, "expected node type %d", UBIFS_DATA_NODE);
1693 		goto out;
1694 	}
1695 
1696 	len = le32_to_cpu(ch->len);
1697 	if (len != zbr->len) {
1698 		ubifs_err(c, "bad node length %d, expected %d", len, zbr->len);
1699 		goto out_err;
1700 	}
1701 
1702 	/* Make sure the key of the read node is correct */
1703 	key_read(c, buf + UBIFS_KEY_OFFSET, &key1);
1704 	if (!keys_eq(c, &zbr->key, &key1)) {
1705 		ubifs_err(c, "bad key in node at LEB %d:%d",
1706 			  zbr->lnum, zbr->offs);
1707 		dbg_tnck(&zbr->key, "looked for key ");
1708 		dbg_tnck(&key1, "found node's key ");
1709 		goto out_err;
1710 	}
1711 
1712 	return 0;
1713 
1714 out_err:
1715 	err = -EINVAL;
1716 out:
1717 	ubifs_err(c, "bad node at LEB %d:%d", zbr->lnum, zbr->offs);
1718 	ubifs_dump_node(c, buf);
1719 	dump_stack();
1720 	return err;
1721 }
1722 
1723 /**
1724  * ubifs_tnc_bulk_read - read a number of data nodes in one go.
1725  * @c: UBIFS file-system description object
1726  * @bu: bulk-read parameters and results
1727  *
1728  * This functions reads and validates the data nodes that were identified by the
1729  * 'ubifs_tnc_get_bu_keys()' function. This functions returns %0 on success,
1730  * -EAGAIN to indicate a race with GC, or another negative error code on
1731  * failure.
1732  */
ubifs_tnc_bulk_read(struct ubifs_info * c,struct bu_info * bu)1733 int ubifs_tnc_bulk_read(struct ubifs_info *c, struct bu_info *bu)
1734 {
1735 	int lnum = bu->zbranch[0].lnum, offs = bu->zbranch[0].offs, len, err, i;
1736 	struct ubifs_wbuf *wbuf;
1737 	void *buf;
1738 
1739 	len = bu->zbranch[bu->cnt - 1].offs;
1740 	len += bu->zbranch[bu->cnt - 1].len - offs;
1741 	if (len > bu->buf_len) {
1742 		ubifs_err(c, "buffer too small %d vs %d", bu->buf_len, len);
1743 		return -EINVAL;
1744 	}
1745 
1746 	/* Do the read */
1747 	wbuf = ubifs_get_wbuf(c, lnum);
1748 	if (wbuf)
1749 		err = read_wbuf(wbuf, bu->buf, len, lnum, offs);
1750 	else
1751 		err = ubifs_leb_read(c, lnum, bu->buf, offs, len, 0);
1752 
1753 	/* Check for a race with GC */
1754 	if (maybe_leb_gced(c, lnum, bu->gc_seq))
1755 		return -EAGAIN;
1756 
1757 	if (err && err != -EBADMSG) {
1758 		ubifs_err(c, "failed to read from LEB %d:%d, error %d",
1759 			  lnum, offs, err);
1760 		dump_stack();
1761 		dbg_tnck(&bu->key, "key ");
1762 		return err;
1763 	}
1764 
1765 	/* Validate the nodes read */
1766 	buf = bu->buf;
1767 	for (i = 0; i < bu->cnt; i++) {
1768 		err = validate_data_node(c, buf, &bu->zbranch[i]);
1769 		if (err)
1770 			return err;
1771 		buf = buf + ALIGN(bu->zbranch[i].len, 8);
1772 	}
1773 
1774 	return 0;
1775 }
1776 
1777 /**
1778  * do_lookup_nm- look up a "hashed" node.
1779  * @c: UBIFS file-system description object
1780  * @key: node key to lookup
1781  * @node: the node is returned here
1782  * @nm: node name
1783  *
1784  * This function look up and reads a node which contains name hash in the key.
1785  * Since the hash may have collisions, there may be many nodes with the same
1786  * key, so we have to sequentially look to all of them until the needed one is
1787  * found. This function returns zero in case of success, %-ENOENT if the node
1788  * was not found, and a negative error code in case of failure.
1789  */
do_lookup_nm(struct ubifs_info * c,const union ubifs_key * key,void * node,const struct qstr * nm)1790 static int do_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
1791 			void *node, const struct qstr *nm)
1792 {
1793 	int found, n, err;
1794 	struct ubifs_znode *znode;
1795 
1796 	dbg_tnck(key, "name '%.*s' key ", nm->len, nm->name);
1797 	mutex_lock(&c->tnc_mutex);
1798 	found = ubifs_lookup_level0(c, key, &znode, &n);
1799 	if (!found) {
1800 		err = -ENOENT;
1801 		goto out_unlock;
1802 	} else if (found < 0) {
1803 		err = found;
1804 		goto out_unlock;
1805 	}
1806 
1807 	ubifs_assert(n >= 0);
1808 
1809 	err = resolve_collision(c, key, &znode, &n, nm);
1810 	dbg_tnc("rc returned %d, znode %p, n %d", err, znode, n);
1811 	if (unlikely(err < 0))
1812 		goto out_unlock;
1813 	if (err == 0) {
1814 		err = -ENOENT;
1815 		goto out_unlock;
1816 	}
1817 
1818 	err = tnc_read_node_nm(c, &znode->zbranch[n], node);
1819 
1820 out_unlock:
1821 	mutex_unlock(&c->tnc_mutex);
1822 	return err;
1823 }
1824 
1825 /**
1826  * ubifs_tnc_lookup_nm - look up a "hashed" node.
1827  * @c: UBIFS file-system description object
1828  * @key: node key to lookup
1829  * @node: the node is returned here
1830  * @nm: node name
1831  *
1832  * This function look up and reads a node which contains name hash in the key.
1833  * Since the hash may have collisions, there may be many nodes with the same
1834  * key, so we have to sequentially look to all of them until the needed one is
1835  * found. This function returns zero in case of success, %-ENOENT if the node
1836  * was not found, and a negative error code in case of failure.
1837  */
ubifs_tnc_lookup_nm(struct ubifs_info * c,const union ubifs_key * key,void * node,const struct qstr * nm)1838 int ubifs_tnc_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
1839 			void *node, const struct qstr *nm)
1840 {
1841 	int err, len;
1842 	const struct ubifs_dent_node *dent = node;
1843 
1844 	/*
1845 	 * We assume that in most of the cases there are no name collisions and
1846 	 * 'ubifs_tnc_lookup()' returns us the right direntry.
1847 	 */
1848 	err = ubifs_tnc_lookup(c, key, node);
1849 	if (err)
1850 		return err;
1851 
1852 	len = le16_to_cpu(dent->nlen);
1853 	if (nm->len == len && !memcmp(dent->name, nm->name, len))
1854 		return 0;
1855 
1856 	/*
1857 	 * Unluckily, there are hash collisions and we have to iterate over
1858 	 * them look at each direntry with colliding name hash sequentially.
1859 	 */
1860 	return do_lookup_nm(c, key, node, nm);
1861 }
1862 
1863 /**
1864  * correct_parent_keys - correct parent znodes' keys.
1865  * @c: UBIFS file-system description object
1866  * @znode: znode to correct parent znodes for
1867  *
1868  * This is a helper function for 'tnc_insert()'. When the key of the leftmost
1869  * zbranch changes, keys of parent znodes have to be corrected. This helper
1870  * function is called in such situations and corrects the keys if needed.
1871  */
correct_parent_keys(const struct ubifs_info * c,struct ubifs_znode * znode)1872 static void correct_parent_keys(const struct ubifs_info *c,
1873 				struct ubifs_znode *znode)
1874 {
1875 	union ubifs_key *key, *key1;
1876 
1877 	ubifs_assert(znode->parent);
1878 	ubifs_assert(znode->iip == 0);
1879 
1880 	key = &znode->zbranch[0].key;
1881 	key1 = &znode->parent->zbranch[0].key;
1882 
1883 	while (keys_cmp(c, key, key1) < 0) {
1884 		key_copy(c, key, key1);
1885 		znode = znode->parent;
1886 		znode->alt = 1;
1887 		if (!znode->parent || znode->iip)
1888 			break;
1889 		key1 = &znode->parent->zbranch[0].key;
1890 	}
1891 }
1892 
1893 /**
1894  * insert_zbranch - insert a zbranch into a znode.
1895  * @znode: znode into which to insert
1896  * @zbr: zbranch to insert
1897  * @n: slot number to insert to
1898  *
1899  * This is a helper function for 'tnc_insert()'. UBIFS does not allow "gaps" in
1900  * znode's array of zbranches and keeps zbranches consolidated, so when a new
1901  * zbranch has to be inserted to the @znode->zbranches[]' array at the @n-th
1902  * slot, zbranches starting from @n have to be moved right.
1903  */
insert_zbranch(struct ubifs_znode * znode,const struct ubifs_zbranch * zbr,int n)1904 static void insert_zbranch(struct ubifs_znode *znode,
1905 			   const struct ubifs_zbranch *zbr, int n)
1906 {
1907 	int i;
1908 
1909 	ubifs_assert(ubifs_zn_dirty(znode));
1910 
1911 	if (znode->level) {
1912 		for (i = znode->child_cnt; i > n; i--) {
1913 			znode->zbranch[i] = znode->zbranch[i - 1];
1914 			if (znode->zbranch[i].znode)
1915 				znode->zbranch[i].znode->iip = i;
1916 		}
1917 		if (zbr->znode)
1918 			zbr->znode->iip = n;
1919 	} else
1920 		for (i = znode->child_cnt; i > n; i--)
1921 			znode->zbranch[i] = znode->zbranch[i - 1];
1922 
1923 	znode->zbranch[n] = *zbr;
1924 	znode->child_cnt += 1;
1925 
1926 	/*
1927 	 * After inserting at slot zero, the lower bound of the key range of
1928 	 * this znode may have changed. If this znode is subsequently split
1929 	 * then the upper bound of the key range may change, and furthermore
1930 	 * it could change to be lower than the original lower bound. If that
1931 	 * happens, then it will no longer be possible to find this znode in the
1932 	 * TNC using the key from the index node on flash. That is bad because
1933 	 * if it is not found, we will assume it is obsolete and may overwrite
1934 	 * it. Then if there is an unclean unmount, we will start using the
1935 	 * old index which will be broken.
1936 	 *
1937 	 * So we first mark znodes that have insertions at slot zero, and then
1938 	 * if they are split we add their lnum/offs to the old_idx tree.
1939 	 */
1940 	if (n == 0)
1941 		znode->alt = 1;
1942 }
1943 
1944 /**
1945  * tnc_insert - insert a node into TNC.
1946  * @c: UBIFS file-system description object
1947  * @znode: znode to insert into
1948  * @zbr: branch to insert
1949  * @n: slot number to insert new zbranch to
1950  *
1951  * This function inserts a new node described by @zbr into znode @znode. If
1952  * znode does not have a free slot for new zbranch, it is split. Parent znodes
1953  * are splat as well if needed. Returns zero in case of success or a negative
1954  * error code in case of failure.
1955  */
tnc_insert(struct ubifs_info * c,struct ubifs_znode * znode,struct ubifs_zbranch * zbr,int n)1956 static int tnc_insert(struct ubifs_info *c, struct ubifs_znode *znode,
1957 		      struct ubifs_zbranch *zbr, int n)
1958 {
1959 	struct ubifs_znode *zn, *zi, *zp;
1960 	int i, keep, move, appending = 0;
1961 	union ubifs_key *key = &zbr->key, *key1;
1962 
1963 	ubifs_assert(n >= 0 && n <= c->fanout);
1964 
1965 	/* Implement naive insert for now */
1966 again:
1967 	zp = znode->parent;
1968 	if (znode->child_cnt < c->fanout) {
1969 		ubifs_assert(n != c->fanout);
1970 		dbg_tnck(key, "inserted at %d level %d, key ", n, znode->level);
1971 
1972 		insert_zbranch(znode, zbr, n);
1973 
1974 		/* Ensure parent's key is correct */
1975 		if (n == 0 && zp && znode->iip == 0)
1976 			correct_parent_keys(c, znode);
1977 
1978 		return 0;
1979 	}
1980 
1981 	/*
1982 	 * Unfortunately, @znode does not have more empty slots and we have to
1983 	 * split it.
1984 	 */
1985 	dbg_tnck(key, "splitting level %d, key ", znode->level);
1986 
1987 	if (znode->alt)
1988 		/*
1989 		 * We can no longer be sure of finding this znode by key, so we
1990 		 * record it in the old_idx tree.
1991 		 */
1992 		ins_clr_old_idx_znode(c, znode);
1993 
1994 	zn = kzalloc(c->max_znode_sz, GFP_NOFS);
1995 	if (!zn)
1996 		return -ENOMEM;
1997 	zn->parent = zp;
1998 	zn->level = znode->level;
1999 
2000 	/* Decide where to split */
2001 	if (znode->level == 0 && key_type(c, key) == UBIFS_DATA_KEY) {
2002 		/* Try not to split consecutive data keys */
2003 		if (n == c->fanout) {
2004 			key1 = &znode->zbranch[n - 1].key;
2005 			if (key_inum(c, key1) == key_inum(c, key) &&
2006 			    key_type(c, key1) == UBIFS_DATA_KEY)
2007 				appending = 1;
2008 		} else
2009 			goto check_split;
2010 	} else if (appending && n != c->fanout) {
2011 		/* Try not to split consecutive data keys */
2012 		appending = 0;
2013 check_split:
2014 		if (n >= (c->fanout + 1) / 2) {
2015 			key1 = &znode->zbranch[0].key;
2016 			if (key_inum(c, key1) == key_inum(c, key) &&
2017 			    key_type(c, key1) == UBIFS_DATA_KEY) {
2018 				key1 = &znode->zbranch[n].key;
2019 				if (key_inum(c, key1) != key_inum(c, key) ||
2020 				    key_type(c, key1) != UBIFS_DATA_KEY) {
2021 					keep = n;
2022 					move = c->fanout - keep;
2023 					zi = znode;
2024 					goto do_split;
2025 				}
2026 			}
2027 		}
2028 	}
2029 
2030 	if (appending) {
2031 		keep = c->fanout;
2032 		move = 0;
2033 	} else {
2034 		keep = (c->fanout + 1) / 2;
2035 		move = c->fanout - keep;
2036 	}
2037 
2038 	/*
2039 	 * Although we don't at present, we could look at the neighbors and see
2040 	 * if we can move some zbranches there.
2041 	 */
2042 
2043 	if (n < keep) {
2044 		/* Insert into existing znode */
2045 		zi = znode;
2046 		move += 1;
2047 		keep -= 1;
2048 	} else {
2049 		/* Insert into new znode */
2050 		zi = zn;
2051 		n -= keep;
2052 		/* Re-parent */
2053 		if (zn->level != 0)
2054 			zbr->znode->parent = zn;
2055 	}
2056 
2057 do_split:
2058 
2059 	__set_bit(DIRTY_ZNODE, &zn->flags);
2060 	atomic_long_inc(&c->dirty_zn_cnt);
2061 
2062 	zn->child_cnt = move;
2063 	znode->child_cnt = keep;
2064 
2065 	dbg_tnc("moving %d, keeping %d", move, keep);
2066 
2067 	/* Move zbranch */
2068 	for (i = 0; i < move; i++) {
2069 		zn->zbranch[i] = znode->zbranch[keep + i];
2070 		/* Re-parent */
2071 		if (zn->level != 0)
2072 			if (zn->zbranch[i].znode) {
2073 				zn->zbranch[i].znode->parent = zn;
2074 				zn->zbranch[i].znode->iip = i;
2075 			}
2076 	}
2077 
2078 	/* Insert new key and branch */
2079 	dbg_tnck(key, "inserting at %d level %d, key ", n, zn->level);
2080 
2081 	insert_zbranch(zi, zbr, n);
2082 
2083 	/* Insert new znode (produced by spitting) into the parent */
2084 	if (zp) {
2085 		if (n == 0 && zi == znode && znode->iip == 0)
2086 			correct_parent_keys(c, znode);
2087 
2088 		/* Locate insertion point */
2089 		n = znode->iip + 1;
2090 
2091 		/* Tail recursion */
2092 		zbr->key = zn->zbranch[0].key;
2093 		zbr->znode = zn;
2094 		zbr->lnum = 0;
2095 		zbr->offs = 0;
2096 		zbr->len = 0;
2097 		znode = zp;
2098 
2099 		goto again;
2100 	}
2101 
2102 	/* We have to split root znode */
2103 	dbg_tnc("creating new zroot at level %d", znode->level + 1);
2104 
2105 	zi = kzalloc(c->max_znode_sz, GFP_NOFS);
2106 	if (!zi)
2107 		return -ENOMEM;
2108 
2109 	zi->child_cnt = 2;
2110 	zi->level = znode->level + 1;
2111 
2112 	__set_bit(DIRTY_ZNODE, &zi->flags);
2113 	atomic_long_inc(&c->dirty_zn_cnt);
2114 
2115 	zi->zbranch[0].key = znode->zbranch[0].key;
2116 	zi->zbranch[0].znode = znode;
2117 	zi->zbranch[0].lnum = c->zroot.lnum;
2118 	zi->zbranch[0].offs = c->zroot.offs;
2119 	zi->zbranch[0].len = c->zroot.len;
2120 	zi->zbranch[1].key = zn->zbranch[0].key;
2121 	zi->zbranch[1].znode = zn;
2122 
2123 	c->zroot.lnum = 0;
2124 	c->zroot.offs = 0;
2125 	c->zroot.len = 0;
2126 	c->zroot.znode = zi;
2127 
2128 	zn->parent = zi;
2129 	zn->iip = 1;
2130 	znode->parent = zi;
2131 	znode->iip = 0;
2132 
2133 	return 0;
2134 }
2135 
2136 /**
2137  * ubifs_tnc_add - add a node to TNC.
2138  * @c: UBIFS file-system description object
2139  * @key: key to add
2140  * @lnum: LEB number of node
2141  * @offs: node offset
2142  * @len: node length
2143  *
2144  * This function adds a node with key @key to TNC. The node may be new or it may
2145  * obsolete some existing one. Returns %0 on success or negative error code on
2146  * failure.
2147  */
ubifs_tnc_add(struct ubifs_info * c,const union ubifs_key * key,int lnum,int offs,int len)2148 int ubifs_tnc_add(struct ubifs_info *c, const union ubifs_key *key, int lnum,
2149 		  int offs, int len)
2150 {
2151 	int found, n, err = 0;
2152 	struct ubifs_znode *znode;
2153 
2154 	mutex_lock(&c->tnc_mutex);
2155 	dbg_tnck(key, "%d:%d, len %d, key ", lnum, offs, len);
2156 	found = lookup_level0_dirty(c, key, &znode, &n);
2157 	if (!found) {
2158 		struct ubifs_zbranch zbr;
2159 
2160 		zbr.znode = NULL;
2161 		zbr.lnum = lnum;
2162 		zbr.offs = offs;
2163 		zbr.len = len;
2164 		key_copy(c, key, &zbr.key);
2165 		err = tnc_insert(c, znode, &zbr, n + 1);
2166 	} else if (found == 1) {
2167 		struct ubifs_zbranch *zbr = &znode->zbranch[n];
2168 
2169 		lnc_free(zbr);
2170 		err = ubifs_add_dirt(c, zbr->lnum, zbr->len);
2171 		zbr->lnum = lnum;
2172 		zbr->offs = offs;
2173 		zbr->len = len;
2174 	} else
2175 		err = found;
2176 	if (!err)
2177 		err = dbg_check_tnc(c, 0);
2178 	mutex_unlock(&c->tnc_mutex);
2179 
2180 	return err;
2181 }
2182 
2183 /**
2184  * ubifs_tnc_replace - replace a node in the TNC only if the old node is found.
2185  * @c: UBIFS file-system description object
2186  * @key: key to add
2187  * @old_lnum: LEB number of old node
2188  * @old_offs: old node offset
2189  * @lnum: LEB number of node
2190  * @offs: node offset
2191  * @len: node length
2192  *
2193  * This function replaces a node with key @key in the TNC only if the old node
2194  * is found.  This function is called by garbage collection when node are moved.
2195  * Returns %0 on success or negative error code on failure.
2196  */
ubifs_tnc_replace(struct ubifs_info * c,const union ubifs_key * key,int old_lnum,int old_offs,int lnum,int offs,int len)2197 int ubifs_tnc_replace(struct ubifs_info *c, const union ubifs_key *key,
2198 		      int old_lnum, int old_offs, int lnum, int offs, int len)
2199 {
2200 	int found, n, err = 0;
2201 	struct ubifs_znode *znode;
2202 
2203 	mutex_lock(&c->tnc_mutex);
2204 	dbg_tnck(key, "old LEB %d:%d, new LEB %d:%d, len %d, key ", old_lnum,
2205 		 old_offs, lnum, offs, len);
2206 	found = lookup_level0_dirty(c, key, &znode, &n);
2207 	if (found < 0) {
2208 		err = found;
2209 		goto out_unlock;
2210 	}
2211 
2212 	if (found == 1) {
2213 		struct ubifs_zbranch *zbr = &znode->zbranch[n];
2214 
2215 		found = 0;
2216 		if (zbr->lnum == old_lnum && zbr->offs == old_offs) {
2217 			lnc_free(zbr);
2218 			err = ubifs_add_dirt(c, zbr->lnum, zbr->len);
2219 			if (err)
2220 				goto out_unlock;
2221 			zbr->lnum = lnum;
2222 			zbr->offs = offs;
2223 			zbr->len = len;
2224 			found = 1;
2225 		} else if (is_hash_key(c, key)) {
2226 			found = resolve_collision_directly(c, key, &znode, &n,
2227 							   old_lnum, old_offs);
2228 			dbg_tnc("rc returned %d, znode %p, n %d, LEB %d:%d",
2229 				found, znode, n, old_lnum, old_offs);
2230 			if (found < 0) {
2231 				err = found;
2232 				goto out_unlock;
2233 			}
2234 
2235 			if (found) {
2236 				/* Ensure the znode is dirtied */
2237 				if (znode->cnext || !ubifs_zn_dirty(znode)) {
2238 					znode = dirty_cow_bottom_up(c, znode);
2239 					if (IS_ERR(znode)) {
2240 						err = PTR_ERR(znode);
2241 						goto out_unlock;
2242 					}
2243 				}
2244 				zbr = &znode->zbranch[n];
2245 				lnc_free(zbr);
2246 				err = ubifs_add_dirt(c, zbr->lnum,
2247 						     zbr->len);
2248 				if (err)
2249 					goto out_unlock;
2250 				zbr->lnum = lnum;
2251 				zbr->offs = offs;
2252 				zbr->len = len;
2253 			}
2254 		}
2255 	}
2256 
2257 	if (!found)
2258 		err = ubifs_add_dirt(c, lnum, len);
2259 
2260 	if (!err)
2261 		err = dbg_check_tnc(c, 0);
2262 
2263 out_unlock:
2264 	mutex_unlock(&c->tnc_mutex);
2265 	return err;
2266 }
2267 
2268 /**
2269  * ubifs_tnc_add_nm - add a "hashed" node to TNC.
2270  * @c: UBIFS file-system description object
2271  * @key: key to add
2272  * @lnum: LEB number of node
2273  * @offs: node offset
2274  * @len: node length
2275  * @nm: node name
2276  *
2277  * This is the same as 'ubifs_tnc_add()' but it should be used with keys which
2278  * may have collisions, like directory entry keys.
2279  */
ubifs_tnc_add_nm(struct ubifs_info * c,const union ubifs_key * key,int lnum,int offs,int len,const struct qstr * nm)2280 int ubifs_tnc_add_nm(struct ubifs_info *c, const union ubifs_key *key,
2281 		     int lnum, int offs, int len, const struct qstr *nm)
2282 {
2283 	int found, n, err = 0;
2284 	struct ubifs_znode *znode;
2285 
2286 	mutex_lock(&c->tnc_mutex);
2287 	dbg_tnck(key, "LEB %d:%d, name '%.*s', key ",
2288 		 lnum, offs, nm->len, nm->name);
2289 	found = lookup_level0_dirty(c, key, &znode, &n);
2290 	if (found < 0) {
2291 		err = found;
2292 		goto out_unlock;
2293 	}
2294 
2295 	if (found == 1) {
2296 		if (c->replaying)
2297 			found = fallible_resolve_collision(c, key, &znode, &n,
2298 							   nm, 1);
2299 		else
2300 			found = resolve_collision(c, key, &znode, &n, nm);
2301 		dbg_tnc("rc returned %d, znode %p, n %d", found, znode, n);
2302 		if (found < 0) {
2303 			err = found;
2304 			goto out_unlock;
2305 		}
2306 
2307 		/* Ensure the znode is dirtied */
2308 		if (znode->cnext || !ubifs_zn_dirty(znode)) {
2309 			znode = dirty_cow_bottom_up(c, znode);
2310 			if (IS_ERR(znode)) {
2311 				err = PTR_ERR(znode);
2312 				goto out_unlock;
2313 			}
2314 		}
2315 
2316 		if (found == 1) {
2317 			struct ubifs_zbranch *zbr = &znode->zbranch[n];
2318 
2319 			lnc_free(zbr);
2320 			err = ubifs_add_dirt(c, zbr->lnum, zbr->len);
2321 			zbr->lnum = lnum;
2322 			zbr->offs = offs;
2323 			zbr->len = len;
2324 			goto out_unlock;
2325 		}
2326 	}
2327 
2328 	if (!found) {
2329 		struct ubifs_zbranch zbr;
2330 
2331 		zbr.znode = NULL;
2332 		zbr.lnum = lnum;
2333 		zbr.offs = offs;
2334 		zbr.len = len;
2335 		key_copy(c, key, &zbr.key);
2336 		err = tnc_insert(c, znode, &zbr, n + 1);
2337 		if (err)
2338 			goto out_unlock;
2339 		if (c->replaying) {
2340 			/*
2341 			 * We did not find it in the index so there may be a
2342 			 * dangling branch still in the index. So we remove it
2343 			 * by passing 'ubifs_tnc_remove_nm()' the same key but
2344 			 * an unmatchable name.
2345 			 */
2346 			struct qstr noname = { .name = "" };
2347 
2348 			err = dbg_check_tnc(c, 0);
2349 			mutex_unlock(&c->tnc_mutex);
2350 			if (err)
2351 				return err;
2352 			return ubifs_tnc_remove_nm(c, key, &noname);
2353 		}
2354 	}
2355 
2356 out_unlock:
2357 	if (!err)
2358 		err = dbg_check_tnc(c, 0);
2359 	mutex_unlock(&c->tnc_mutex);
2360 	return err;
2361 }
2362 
2363 /**
2364  * tnc_delete - delete a znode form TNC.
2365  * @c: UBIFS file-system description object
2366  * @znode: znode to delete from
2367  * @n: zbranch slot number to delete
2368  *
2369  * This function deletes a leaf node from @n-th slot of @znode. Returns zero in
2370  * case of success and a negative error code in case of failure.
2371  */
tnc_delete(struct ubifs_info * c,struct ubifs_znode * znode,int n)2372 static int tnc_delete(struct ubifs_info *c, struct ubifs_znode *znode, int n)
2373 {
2374 	struct ubifs_zbranch *zbr;
2375 	struct ubifs_znode *zp;
2376 	int i, err;
2377 
2378 	/* Delete without merge for now */
2379 	ubifs_assert(znode->level == 0);
2380 	ubifs_assert(n >= 0 && n < c->fanout);
2381 	dbg_tnck(&znode->zbranch[n].key, "deleting key ");
2382 
2383 	zbr = &znode->zbranch[n];
2384 	lnc_free(zbr);
2385 
2386 	err = ubifs_add_dirt(c, zbr->lnum, zbr->len);
2387 	if (err) {
2388 		ubifs_dump_znode(c, znode);
2389 		return err;
2390 	}
2391 
2392 	/* We do not "gap" zbranch slots */
2393 	for (i = n; i < znode->child_cnt - 1; i++)
2394 		znode->zbranch[i] = znode->zbranch[i + 1];
2395 	znode->child_cnt -= 1;
2396 
2397 	if (znode->child_cnt > 0)
2398 		return 0;
2399 
2400 	/*
2401 	 * This was the last zbranch, we have to delete this znode from the
2402 	 * parent.
2403 	 */
2404 
2405 	do {
2406 		ubifs_assert(!ubifs_zn_obsolete(znode));
2407 		ubifs_assert(ubifs_zn_dirty(znode));
2408 
2409 		zp = znode->parent;
2410 		n = znode->iip;
2411 
2412 		atomic_long_dec(&c->dirty_zn_cnt);
2413 
2414 		err = insert_old_idx_znode(c, znode);
2415 		if (err)
2416 			return err;
2417 
2418 		if (znode->cnext) {
2419 			__set_bit(OBSOLETE_ZNODE, &znode->flags);
2420 			atomic_long_inc(&c->clean_zn_cnt);
2421 			atomic_long_inc(&ubifs_clean_zn_cnt);
2422 		} else
2423 			kfree(znode);
2424 		znode = zp;
2425 	} while (znode->child_cnt == 1); /* while removing last child */
2426 
2427 	/* Remove from znode, entry n - 1 */
2428 	znode->child_cnt -= 1;
2429 	ubifs_assert(znode->level != 0);
2430 	for (i = n; i < znode->child_cnt; i++) {
2431 		znode->zbranch[i] = znode->zbranch[i + 1];
2432 		if (znode->zbranch[i].znode)
2433 			znode->zbranch[i].znode->iip = i;
2434 	}
2435 
2436 	/*
2437 	 * If this is the root and it has only 1 child then
2438 	 * collapse the tree.
2439 	 */
2440 	if (!znode->parent) {
2441 		while (znode->child_cnt == 1 && znode->level != 0) {
2442 			zp = znode;
2443 			zbr = &znode->zbranch[0];
2444 			znode = get_znode(c, znode, 0);
2445 			if (IS_ERR(znode))
2446 				return PTR_ERR(znode);
2447 			znode = dirty_cow_znode(c, zbr);
2448 			if (IS_ERR(znode))
2449 				return PTR_ERR(znode);
2450 			znode->parent = NULL;
2451 			znode->iip = 0;
2452 			if (c->zroot.len) {
2453 				err = insert_old_idx(c, c->zroot.lnum,
2454 						     c->zroot.offs);
2455 				if (err)
2456 					return err;
2457 			}
2458 			c->zroot.lnum = zbr->lnum;
2459 			c->zroot.offs = zbr->offs;
2460 			c->zroot.len = zbr->len;
2461 			c->zroot.znode = znode;
2462 			ubifs_assert(!ubifs_zn_obsolete(zp));
2463 			ubifs_assert(ubifs_zn_dirty(zp));
2464 			atomic_long_dec(&c->dirty_zn_cnt);
2465 
2466 			if (zp->cnext) {
2467 				__set_bit(OBSOLETE_ZNODE, &zp->flags);
2468 				atomic_long_inc(&c->clean_zn_cnt);
2469 				atomic_long_inc(&ubifs_clean_zn_cnt);
2470 			} else
2471 				kfree(zp);
2472 		}
2473 	}
2474 
2475 	return 0;
2476 }
2477 
2478 /**
2479  * ubifs_tnc_remove - remove an index entry of a node.
2480  * @c: UBIFS file-system description object
2481  * @key: key of node
2482  *
2483  * Returns %0 on success or negative error code on failure.
2484  */
ubifs_tnc_remove(struct ubifs_info * c,const union ubifs_key * key)2485 int ubifs_tnc_remove(struct ubifs_info *c, const union ubifs_key *key)
2486 {
2487 	int found, n, err = 0;
2488 	struct ubifs_znode *znode;
2489 
2490 	mutex_lock(&c->tnc_mutex);
2491 	dbg_tnck(key, "key ");
2492 	found = lookup_level0_dirty(c, key, &znode, &n);
2493 	if (found < 0) {
2494 		err = found;
2495 		goto out_unlock;
2496 	}
2497 	if (found == 1)
2498 		err = tnc_delete(c, znode, n);
2499 	if (!err)
2500 		err = dbg_check_tnc(c, 0);
2501 
2502 out_unlock:
2503 	mutex_unlock(&c->tnc_mutex);
2504 	return err;
2505 }
2506 
2507 /**
2508  * ubifs_tnc_remove_nm - remove an index entry for a "hashed" node.
2509  * @c: UBIFS file-system description object
2510  * @key: key of node
2511  * @nm: directory entry name
2512  *
2513  * Returns %0 on success or negative error code on failure.
2514  */
ubifs_tnc_remove_nm(struct ubifs_info * c,const union ubifs_key * key,const struct qstr * nm)2515 int ubifs_tnc_remove_nm(struct ubifs_info *c, const union ubifs_key *key,
2516 			const struct qstr *nm)
2517 {
2518 	int n, err;
2519 	struct ubifs_znode *znode;
2520 
2521 	mutex_lock(&c->tnc_mutex);
2522 	dbg_tnck(key, "%.*s, key ", nm->len, nm->name);
2523 	err = lookup_level0_dirty(c, key, &znode, &n);
2524 	if (err < 0)
2525 		goto out_unlock;
2526 
2527 	if (err) {
2528 		if (c->replaying)
2529 			err = fallible_resolve_collision(c, key, &znode, &n,
2530 							 nm, 0);
2531 		else
2532 			err = resolve_collision(c, key, &znode, &n, nm);
2533 		dbg_tnc("rc returned %d, znode %p, n %d", err, znode, n);
2534 		if (err < 0)
2535 			goto out_unlock;
2536 		if (err) {
2537 			/* Ensure the znode is dirtied */
2538 			if (znode->cnext || !ubifs_zn_dirty(znode)) {
2539 				znode = dirty_cow_bottom_up(c, znode);
2540 				if (IS_ERR(znode)) {
2541 					err = PTR_ERR(znode);
2542 					goto out_unlock;
2543 				}
2544 			}
2545 			err = tnc_delete(c, znode, n);
2546 		}
2547 	}
2548 
2549 out_unlock:
2550 	if (!err)
2551 		err = dbg_check_tnc(c, 0);
2552 	mutex_unlock(&c->tnc_mutex);
2553 	return err;
2554 }
2555 
2556 /**
2557  * key_in_range - determine if a key falls within a range of keys.
2558  * @c: UBIFS file-system description object
2559  * @key: key to check
2560  * @from_key: lowest key in range
2561  * @to_key: highest key in range
2562  *
2563  * This function returns %1 if the key is in range and %0 otherwise.
2564  */
key_in_range(struct ubifs_info * c,union ubifs_key * key,union ubifs_key * from_key,union ubifs_key * to_key)2565 static int key_in_range(struct ubifs_info *c, union ubifs_key *key,
2566 			union ubifs_key *from_key, union ubifs_key *to_key)
2567 {
2568 	if (keys_cmp(c, key, from_key) < 0)
2569 		return 0;
2570 	if (keys_cmp(c, key, to_key) > 0)
2571 		return 0;
2572 	return 1;
2573 }
2574 
2575 /**
2576  * ubifs_tnc_remove_range - remove index entries in range.
2577  * @c: UBIFS file-system description object
2578  * @from_key: lowest key to remove
2579  * @to_key: highest key to remove
2580  *
2581  * This function removes index entries starting at @from_key and ending at
2582  * @to_key.  This function returns zero in case of success and a negative error
2583  * code in case of failure.
2584  */
ubifs_tnc_remove_range(struct ubifs_info * c,union ubifs_key * from_key,union ubifs_key * to_key)2585 int ubifs_tnc_remove_range(struct ubifs_info *c, union ubifs_key *from_key,
2586 			   union ubifs_key *to_key)
2587 {
2588 	int i, n, k, err = 0;
2589 	struct ubifs_znode *znode;
2590 	union ubifs_key *key;
2591 
2592 	mutex_lock(&c->tnc_mutex);
2593 	while (1) {
2594 		/* Find first level 0 znode that contains keys to remove */
2595 		err = ubifs_lookup_level0(c, from_key, &znode, &n);
2596 		if (err < 0)
2597 			goto out_unlock;
2598 
2599 		if (err)
2600 			key = from_key;
2601 		else {
2602 			err = tnc_next(c, &znode, &n);
2603 			if (err == -ENOENT) {
2604 				err = 0;
2605 				goto out_unlock;
2606 			}
2607 			if (err < 0)
2608 				goto out_unlock;
2609 			key = &znode->zbranch[n].key;
2610 			if (!key_in_range(c, key, from_key, to_key)) {
2611 				err = 0;
2612 				goto out_unlock;
2613 			}
2614 		}
2615 
2616 		/* Ensure the znode is dirtied */
2617 		if (znode->cnext || !ubifs_zn_dirty(znode)) {
2618 			znode = dirty_cow_bottom_up(c, znode);
2619 			if (IS_ERR(znode)) {
2620 				err = PTR_ERR(znode);
2621 				goto out_unlock;
2622 			}
2623 		}
2624 
2625 		/* Remove all keys in range except the first */
2626 		for (i = n + 1, k = 0; i < znode->child_cnt; i++, k++) {
2627 			key = &znode->zbranch[i].key;
2628 			if (!key_in_range(c, key, from_key, to_key))
2629 				break;
2630 			lnc_free(&znode->zbranch[i]);
2631 			err = ubifs_add_dirt(c, znode->zbranch[i].lnum,
2632 					     znode->zbranch[i].len);
2633 			if (err) {
2634 				ubifs_dump_znode(c, znode);
2635 				goto out_unlock;
2636 			}
2637 			dbg_tnck(key, "removing key ");
2638 		}
2639 		if (k) {
2640 			for (i = n + 1 + k; i < znode->child_cnt; i++)
2641 				znode->zbranch[i - k] = znode->zbranch[i];
2642 			znode->child_cnt -= k;
2643 		}
2644 
2645 		/* Now delete the first */
2646 		err = tnc_delete(c, znode, n);
2647 		if (err)
2648 			goto out_unlock;
2649 	}
2650 
2651 out_unlock:
2652 	if (!err)
2653 		err = dbg_check_tnc(c, 0);
2654 	mutex_unlock(&c->tnc_mutex);
2655 	return err;
2656 }
2657 
2658 /**
2659  * ubifs_tnc_remove_ino - remove an inode from TNC.
2660  * @c: UBIFS file-system description object
2661  * @inum: inode number to remove
2662  *
2663  * This function remove inode @inum and all the extended attributes associated
2664  * with the anode from TNC and returns zero in case of success or a negative
2665  * error code in case of failure.
2666  */
ubifs_tnc_remove_ino(struct ubifs_info * c,ino_t inum)2667 int ubifs_tnc_remove_ino(struct ubifs_info *c, ino_t inum)
2668 {
2669 	union ubifs_key key1, key2;
2670 	struct ubifs_dent_node *xent, *pxent = NULL;
2671 	struct qstr nm = { .name = NULL };
2672 
2673 	dbg_tnc("ino %lu", (unsigned long)inum);
2674 
2675 	/*
2676 	 * Walk all extended attribute entries and remove them together with
2677 	 * corresponding extended attribute inodes.
2678 	 */
2679 	lowest_xent_key(c, &key1, inum);
2680 	while (1) {
2681 		ino_t xattr_inum;
2682 		int err;
2683 
2684 		xent = ubifs_tnc_next_ent(c, &key1, &nm);
2685 		if (IS_ERR(xent)) {
2686 			err = PTR_ERR(xent);
2687 			if (err == -ENOENT)
2688 				break;
2689 			return err;
2690 		}
2691 
2692 		xattr_inum = le64_to_cpu(xent->inum);
2693 		dbg_tnc("xent '%s', ino %lu", xent->name,
2694 			(unsigned long)xattr_inum);
2695 
2696 		nm.name = xent->name;
2697 		nm.len = le16_to_cpu(xent->nlen);
2698 		err = ubifs_tnc_remove_nm(c, &key1, &nm);
2699 		if (err) {
2700 			kfree(xent);
2701 			return err;
2702 		}
2703 
2704 		lowest_ino_key(c, &key1, xattr_inum);
2705 		highest_ino_key(c, &key2, xattr_inum);
2706 		err = ubifs_tnc_remove_range(c, &key1, &key2);
2707 		if (err) {
2708 			kfree(xent);
2709 			return err;
2710 		}
2711 
2712 		kfree(pxent);
2713 		pxent = xent;
2714 		key_read(c, &xent->key, &key1);
2715 	}
2716 
2717 	kfree(pxent);
2718 	lowest_ino_key(c, &key1, inum);
2719 	highest_ino_key(c, &key2, inum);
2720 
2721 	return ubifs_tnc_remove_range(c, &key1, &key2);
2722 }
2723 
2724 /**
2725  * ubifs_tnc_next_ent - walk directory or extended attribute entries.
2726  * @c: UBIFS file-system description object
2727  * @key: key of last entry
2728  * @nm: name of last entry found or %NULL
2729  *
2730  * This function finds and reads the next directory or extended attribute entry
2731  * after the given key (@key) if there is one. @nm is used to resolve
2732  * collisions.
2733  *
2734  * If the name of the current entry is not known and only the key is known,
2735  * @nm->name has to be %NULL. In this case the semantics of this function is a
2736  * little bit different and it returns the entry corresponding to this key, not
2737  * the next one. If the key was not found, the closest "right" entry is
2738  * returned.
2739  *
2740  * If the fist entry has to be found, @key has to contain the lowest possible
2741  * key value for this inode and @name has to be %NULL.
2742  *
2743  * This function returns the found directory or extended attribute entry node
2744  * in case of success, %-ENOENT is returned if no entry was found, and a
2745  * negative error code is returned in case of failure.
2746  */
ubifs_tnc_next_ent(struct ubifs_info * c,union ubifs_key * key,const struct qstr * nm)2747 struct ubifs_dent_node *ubifs_tnc_next_ent(struct ubifs_info *c,
2748 					   union ubifs_key *key,
2749 					   const struct qstr *nm)
2750 {
2751 	int n, err, type = key_type(c, key);
2752 	struct ubifs_znode *znode;
2753 	struct ubifs_dent_node *dent;
2754 	struct ubifs_zbranch *zbr;
2755 	union ubifs_key *dkey;
2756 
2757 	dbg_tnck(key, "%s ", nm->name ? (char *)nm->name : "(lowest)");
2758 	ubifs_assert(is_hash_key(c, key));
2759 
2760 	mutex_lock(&c->tnc_mutex);
2761 	err = ubifs_lookup_level0(c, key, &znode, &n);
2762 	if (unlikely(err < 0))
2763 		goto out_unlock;
2764 
2765 	if (nm->name) {
2766 		if (err) {
2767 			/* Handle collisions */
2768 			err = resolve_collision(c, key, &znode, &n, nm);
2769 			dbg_tnc("rc returned %d, znode %p, n %d",
2770 				err, znode, n);
2771 			if (unlikely(err < 0))
2772 				goto out_unlock;
2773 		}
2774 
2775 		/* Now find next entry */
2776 		err = tnc_next(c, &znode, &n);
2777 		if (unlikely(err))
2778 			goto out_unlock;
2779 	} else {
2780 		/*
2781 		 * The full name of the entry was not given, in which case the
2782 		 * behavior of this function is a little different and it
2783 		 * returns current entry, not the next one.
2784 		 */
2785 		if (!err) {
2786 			/*
2787 			 * However, the given key does not exist in the TNC
2788 			 * tree and @znode/@n variables contain the closest
2789 			 * "preceding" element. Switch to the next one.
2790 			 */
2791 			err = tnc_next(c, &znode, &n);
2792 			if (err)
2793 				goto out_unlock;
2794 		}
2795 	}
2796 
2797 	zbr = &znode->zbranch[n];
2798 	dent = kmalloc(zbr->len, GFP_NOFS);
2799 	if (unlikely(!dent)) {
2800 		err = -ENOMEM;
2801 		goto out_unlock;
2802 	}
2803 
2804 	/*
2805 	 * The above 'tnc_next()' call could lead us to the next inode, check
2806 	 * this.
2807 	 */
2808 	dkey = &zbr->key;
2809 	if (key_inum(c, dkey) != key_inum(c, key) ||
2810 	    key_type(c, dkey) != type) {
2811 		err = -ENOENT;
2812 		goto out_free;
2813 	}
2814 
2815 	err = tnc_read_node_nm(c, zbr, dent);
2816 	if (unlikely(err))
2817 		goto out_free;
2818 
2819 	mutex_unlock(&c->tnc_mutex);
2820 	return dent;
2821 
2822 out_free:
2823 	kfree(dent);
2824 out_unlock:
2825 	mutex_unlock(&c->tnc_mutex);
2826 	return ERR_PTR(err);
2827 }
2828 
2829 /**
2830  * tnc_destroy_cnext - destroy left-over obsolete znodes from a failed commit.
2831  * @c: UBIFS file-system description object
2832  *
2833  * Destroy left-over obsolete znodes from a failed commit.
2834  */
tnc_destroy_cnext(struct ubifs_info * c)2835 static void tnc_destroy_cnext(struct ubifs_info *c)
2836 {
2837 	struct ubifs_znode *cnext;
2838 
2839 	if (!c->cnext)
2840 		return;
2841 	ubifs_assert(c->cmt_state == COMMIT_BROKEN);
2842 	cnext = c->cnext;
2843 	do {
2844 		struct ubifs_znode *znode = cnext;
2845 
2846 		cnext = cnext->cnext;
2847 		if (ubifs_zn_obsolete(znode))
2848 			kfree(znode);
2849 	} while (cnext && cnext != c->cnext);
2850 }
2851 
2852 /**
2853  * ubifs_tnc_close - close TNC subsystem and free all related resources.
2854  * @c: UBIFS file-system description object
2855  */
ubifs_tnc_close(struct ubifs_info * c)2856 void ubifs_tnc_close(struct ubifs_info *c)
2857 {
2858 	tnc_destroy_cnext(c);
2859 	if (c->zroot.znode) {
2860 		long n, freed;
2861 
2862 		n = atomic_long_read(&c->clean_zn_cnt);
2863 		freed = ubifs_destroy_tnc_subtree(c->zroot.znode);
2864 		ubifs_assert(freed == n);
2865 		atomic_long_sub(n, &ubifs_clean_zn_cnt);
2866 	}
2867 	kfree(c->gap_lebs);
2868 	kfree(c->ilebs);
2869 	destroy_old_idx(c);
2870 }
2871 
2872 /**
2873  * left_znode - get the znode to the left.
2874  * @c: UBIFS file-system description object
2875  * @znode: znode
2876  *
2877  * This function returns a pointer to the znode to the left of @znode or NULL if
2878  * there is not one. A negative error code is returned on failure.
2879  */
left_znode(struct ubifs_info * c,struct ubifs_znode * znode)2880 static struct ubifs_znode *left_znode(struct ubifs_info *c,
2881 				      struct ubifs_znode *znode)
2882 {
2883 	int level = znode->level;
2884 
2885 	while (1) {
2886 		int n = znode->iip - 1;
2887 
2888 		/* Go up until we can go left */
2889 		znode = znode->parent;
2890 		if (!znode)
2891 			return NULL;
2892 		if (n >= 0) {
2893 			/* Now go down the rightmost branch to 'level' */
2894 			znode = get_znode(c, znode, n);
2895 			if (IS_ERR(znode))
2896 				return znode;
2897 			while (znode->level != level) {
2898 				n = znode->child_cnt - 1;
2899 				znode = get_znode(c, znode, n);
2900 				if (IS_ERR(znode))
2901 					return znode;
2902 			}
2903 			break;
2904 		}
2905 	}
2906 	return znode;
2907 }
2908 
2909 /**
2910  * right_znode - get the znode to the right.
2911  * @c: UBIFS file-system description object
2912  * @znode: znode
2913  *
2914  * This function returns a pointer to the znode to the right of @znode or NULL
2915  * if there is not one. A negative error code is returned on failure.
2916  */
right_znode(struct ubifs_info * c,struct ubifs_znode * znode)2917 static struct ubifs_znode *right_znode(struct ubifs_info *c,
2918 				       struct ubifs_znode *znode)
2919 {
2920 	int level = znode->level;
2921 
2922 	while (1) {
2923 		int n = znode->iip + 1;
2924 
2925 		/* Go up until we can go right */
2926 		znode = znode->parent;
2927 		if (!znode)
2928 			return NULL;
2929 		if (n < znode->child_cnt) {
2930 			/* Now go down the leftmost branch to 'level' */
2931 			znode = get_znode(c, znode, n);
2932 			if (IS_ERR(znode))
2933 				return znode;
2934 			while (znode->level != level) {
2935 				znode = get_znode(c, znode, 0);
2936 				if (IS_ERR(znode))
2937 					return znode;
2938 			}
2939 			break;
2940 		}
2941 	}
2942 	return znode;
2943 }
2944 
2945 /**
2946  * lookup_znode - find a particular indexing node from TNC.
2947  * @c: UBIFS file-system description object
2948  * @key: index node key to lookup
2949  * @level: index node level
2950  * @lnum: index node LEB number
2951  * @offs: index node offset
2952  *
2953  * This function searches an indexing node by its first key @key and its
2954  * address @lnum:@offs. It looks up the indexing tree by pulling all indexing
2955  * nodes it traverses to TNC. This function is called for indexing nodes which
2956  * were found on the media by scanning, for example when garbage-collecting or
2957  * when doing in-the-gaps commit. This means that the indexing node which is
2958  * looked for does not have to have exactly the same leftmost key @key, because
2959  * the leftmost key may have been changed, in which case TNC will contain a
2960  * dirty znode which still refers the same @lnum:@offs. This function is clever
2961  * enough to recognize such indexing nodes.
2962  *
2963  * Note, if a znode was deleted or changed too much, then this function will
2964  * not find it. For situations like this UBIFS has the old index RB-tree
2965  * (indexed by @lnum:@offs).
2966  *
2967  * This function returns a pointer to the znode found or %NULL if it is not
2968  * found. A negative error code is returned on failure.
2969  */
lookup_znode(struct ubifs_info * c,union ubifs_key * key,int level,int lnum,int offs)2970 static struct ubifs_znode *lookup_znode(struct ubifs_info *c,
2971 					union ubifs_key *key, int level,
2972 					int lnum, int offs)
2973 {
2974 	struct ubifs_znode *znode, *zn;
2975 	int n, nn;
2976 
2977 	ubifs_assert(key_type(c, key) < UBIFS_INVALID_KEY);
2978 
2979 	/*
2980 	 * The arguments have probably been read off flash, so don't assume
2981 	 * they are valid.
2982 	 */
2983 	if (level < 0)
2984 		return ERR_PTR(-EINVAL);
2985 
2986 	/* Get the root znode */
2987 	znode = c->zroot.znode;
2988 	if (!znode) {
2989 		znode = ubifs_load_znode(c, &c->zroot, NULL, 0);
2990 		if (IS_ERR(znode))
2991 			return znode;
2992 	}
2993 	/* Check if it is the one we are looking for */
2994 	if (c->zroot.lnum == lnum && c->zroot.offs == offs)
2995 		return znode;
2996 	/* Descend to the parent level i.e. (level + 1) */
2997 	if (level >= znode->level)
2998 		return NULL;
2999 	while (1) {
3000 		ubifs_search_zbranch(c, znode, key, &n);
3001 		if (n < 0) {
3002 			/*
3003 			 * We reached a znode where the leftmost key is greater
3004 			 * than the key we are searching for. This is the same
3005 			 * situation as the one described in a huge comment at
3006 			 * the end of the 'ubifs_lookup_level0()' function. And
3007 			 * for exactly the same reasons we have to try to look
3008 			 * left before giving up.
3009 			 */
3010 			znode = left_znode(c, znode);
3011 			if (!znode)
3012 				return NULL;
3013 			if (IS_ERR(znode))
3014 				return znode;
3015 			ubifs_search_zbranch(c, znode, key, &n);
3016 			ubifs_assert(n >= 0);
3017 		}
3018 		if (znode->level == level + 1)
3019 			break;
3020 		znode = get_znode(c, znode, n);
3021 		if (IS_ERR(znode))
3022 			return znode;
3023 	}
3024 	/* Check if the child is the one we are looking for */
3025 	if (znode->zbranch[n].lnum == lnum && znode->zbranch[n].offs == offs)
3026 		return get_znode(c, znode, n);
3027 	/* If the key is unique, there is nowhere else to look */
3028 	if (!is_hash_key(c, key))
3029 		return NULL;
3030 	/*
3031 	 * The key is not unique and so may be also in the znodes to either
3032 	 * side.
3033 	 */
3034 	zn = znode;
3035 	nn = n;
3036 	/* Look left */
3037 	while (1) {
3038 		/* Move one branch to the left */
3039 		if (n)
3040 			n -= 1;
3041 		else {
3042 			znode = left_znode(c, znode);
3043 			if (!znode)
3044 				break;
3045 			if (IS_ERR(znode))
3046 				return znode;
3047 			n = znode->child_cnt - 1;
3048 		}
3049 		/* Check it */
3050 		if (znode->zbranch[n].lnum == lnum &&
3051 		    znode->zbranch[n].offs == offs)
3052 			return get_znode(c, znode, n);
3053 		/* Stop if the key is less than the one we are looking for */
3054 		if (keys_cmp(c, &znode->zbranch[n].key, key) < 0)
3055 			break;
3056 	}
3057 	/* Back to the middle */
3058 	znode = zn;
3059 	n = nn;
3060 	/* Look right */
3061 	while (1) {
3062 		/* Move one branch to the right */
3063 		if (++n >= znode->child_cnt) {
3064 			znode = right_znode(c, znode);
3065 			if (!znode)
3066 				break;
3067 			if (IS_ERR(znode))
3068 				return znode;
3069 			n = 0;
3070 		}
3071 		/* Check it */
3072 		if (znode->zbranch[n].lnum == lnum &&
3073 		    znode->zbranch[n].offs == offs)
3074 			return get_znode(c, znode, n);
3075 		/* Stop if the key is greater than the one we are looking for */
3076 		if (keys_cmp(c, &znode->zbranch[n].key, key) > 0)
3077 			break;
3078 	}
3079 	return NULL;
3080 }
3081 
3082 /**
3083  * is_idx_node_in_tnc - determine if an index node is in the TNC.
3084  * @c: UBIFS file-system description object
3085  * @key: key of index node
3086  * @level: index node level
3087  * @lnum: LEB number of index node
3088  * @offs: offset of index node
3089  *
3090  * This function returns %0 if the index node is not referred to in the TNC, %1
3091  * if the index node is referred to in the TNC and the corresponding znode is
3092  * dirty, %2 if an index node is referred to in the TNC and the corresponding
3093  * znode is clean, and a negative error code in case of failure.
3094  *
3095  * Note, the @key argument has to be the key of the first child. Also note,
3096  * this function relies on the fact that 0:0 is never a valid LEB number and
3097  * offset for a main-area node.
3098  */
is_idx_node_in_tnc(struct ubifs_info * c,union ubifs_key * key,int level,int lnum,int offs)3099 int is_idx_node_in_tnc(struct ubifs_info *c, union ubifs_key *key, int level,
3100 		       int lnum, int offs)
3101 {
3102 	struct ubifs_znode *znode;
3103 
3104 	znode = lookup_znode(c, key, level, lnum, offs);
3105 	if (!znode)
3106 		return 0;
3107 	if (IS_ERR(znode))
3108 		return PTR_ERR(znode);
3109 
3110 	return ubifs_zn_dirty(znode) ? 1 : 2;
3111 }
3112 
3113 /**
3114  * is_leaf_node_in_tnc - determine if a non-indexing not is in the TNC.
3115  * @c: UBIFS file-system description object
3116  * @key: node key
3117  * @lnum: node LEB number
3118  * @offs: node offset
3119  *
3120  * This function returns %1 if the node is referred to in the TNC, %0 if it is
3121  * not, and a negative error code in case of failure.
3122  *
3123  * Note, this function relies on the fact that 0:0 is never a valid LEB number
3124  * and offset for a main-area node.
3125  */
is_leaf_node_in_tnc(struct ubifs_info * c,union ubifs_key * key,int lnum,int offs)3126 static int is_leaf_node_in_tnc(struct ubifs_info *c, union ubifs_key *key,
3127 			       int lnum, int offs)
3128 {
3129 	struct ubifs_zbranch *zbr;
3130 	struct ubifs_znode *znode, *zn;
3131 	int n, found, err, nn;
3132 	const int unique = !is_hash_key(c, key);
3133 
3134 	found = ubifs_lookup_level0(c, key, &znode, &n);
3135 	if (found < 0)
3136 		return found; /* Error code */
3137 	if (!found)
3138 		return 0;
3139 	zbr = &znode->zbranch[n];
3140 	if (lnum == zbr->lnum && offs == zbr->offs)
3141 		return 1; /* Found it */
3142 	if (unique)
3143 		return 0;
3144 	/*
3145 	 * Because the key is not unique, we have to look left
3146 	 * and right as well
3147 	 */
3148 	zn = znode;
3149 	nn = n;
3150 	/* Look left */
3151 	while (1) {
3152 		err = tnc_prev(c, &znode, &n);
3153 		if (err == -ENOENT)
3154 			break;
3155 		if (err)
3156 			return err;
3157 		if (keys_cmp(c, key, &znode->zbranch[n].key))
3158 			break;
3159 		zbr = &znode->zbranch[n];
3160 		if (lnum == zbr->lnum && offs == zbr->offs)
3161 			return 1; /* Found it */
3162 	}
3163 	/* Look right */
3164 	znode = zn;
3165 	n = nn;
3166 	while (1) {
3167 		err = tnc_next(c, &znode, &n);
3168 		if (err) {
3169 			if (err == -ENOENT)
3170 				return 0;
3171 			return err;
3172 		}
3173 		if (keys_cmp(c, key, &znode->zbranch[n].key))
3174 			break;
3175 		zbr = &znode->zbranch[n];
3176 		if (lnum == zbr->lnum && offs == zbr->offs)
3177 			return 1; /* Found it */
3178 	}
3179 	return 0;
3180 }
3181 
3182 /**
3183  * ubifs_tnc_has_node - determine whether a node is in the TNC.
3184  * @c: UBIFS file-system description object
3185  * @key: node key
3186  * @level: index node level (if it is an index node)
3187  * @lnum: node LEB number
3188  * @offs: node offset
3189  * @is_idx: non-zero if the node is an index node
3190  *
3191  * This function returns %1 if the node is in the TNC, %0 if it is not, and a
3192  * negative error code in case of failure. For index nodes, @key has to be the
3193  * key of the first child. An index node is considered to be in the TNC only if
3194  * the corresponding znode is clean or has not been loaded.
3195  */
ubifs_tnc_has_node(struct ubifs_info * c,union ubifs_key * key,int level,int lnum,int offs,int is_idx)3196 int ubifs_tnc_has_node(struct ubifs_info *c, union ubifs_key *key, int level,
3197 		       int lnum, int offs, int is_idx)
3198 {
3199 	int err;
3200 
3201 	mutex_lock(&c->tnc_mutex);
3202 	if (is_idx) {
3203 		err = is_idx_node_in_tnc(c, key, level, lnum, offs);
3204 		if (err < 0)
3205 			goto out_unlock;
3206 		if (err == 1)
3207 			/* The index node was found but it was dirty */
3208 			err = 0;
3209 		else if (err == 2)
3210 			/* The index node was found and it was clean */
3211 			err = 1;
3212 		else
3213 			BUG_ON(err != 0);
3214 	} else
3215 		err = is_leaf_node_in_tnc(c, key, lnum, offs);
3216 
3217 out_unlock:
3218 	mutex_unlock(&c->tnc_mutex);
3219 	return err;
3220 }
3221 
3222 /**
3223  * ubifs_dirty_idx_node - dirty an index node.
3224  * @c: UBIFS file-system description object
3225  * @key: index node key
3226  * @level: index node level
3227  * @lnum: index node LEB number
3228  * @offs: index node offset
3229  *
3230  * This function loads and dirties an index node so that it can be garbage
3231  * collected. The @key argument has to be the key of the first child. This
3232  * function relies on the fact that 0:0 is never a valid LEB number and offset
3233  * for a main-area node. Returns %0 on success and a negative error code on
3234  * failure.
3235  */
ubifs_dirty_idx_node(struct ubifs_info * c,union ubifs_key * key,int level,int lnum,int offs)3236 int ubifs_dirty_idx_node(struct ubifs_info *c, union ubifs_key *key, int level,
3237 			 int lnum, int offs)
3238 {
3239 	struct ubifs_znode *znode;
3240 	int err = 0;
3241 
3242 	mutex_lock(&c->tnc_mutex);
3243 	znode = lookup_znode(c, key, level, lnum, offs);
3244 	if (!znode)
3245 		goto out_unlock;
3246 	if (IS_ERR(znode)) {
3247 		err = PTR_ERR(znode);
3248 		goto out_unlock;
3249 	}
3250 	znode = dirty_cow_bottom_up(c, znode);
3251 	if (IS_ERR(znode)) {
3252 		err = PTR_ERR(znode);
3253 		goto out_unlock;
3254 	}
3255 
3256 out_unlock:
3257 	mutex_unlock(&c->tnc_mutex);
3258 	return err;
3259 }
3260 
3261 /**
3262  * dbg_check_inode_size - check if inode size is correct.
3263  * @c: UBIFS file-system description object
3264  * @inum: inode number
3265  * @size: inode size
3266  *
3267  * This function makes sure that the inode size (@size) is correct and it does
3268  * not have any pages beyond @size. Returns zero if the inode is OK, %-EINVAL
3269  * if it has a data page beyond @size, and other negative error code in case of
3270  * other errors.
3271  */
dbg_check_inode_size(struct ubifs_info * c,const struct inode * inode,loff_t size)3272 int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
3273 			 loff_t size)
3274 {
3275 	int err, n;
3276 	union ubifs_key from_key, to_key, *key;
3277 	struct ubifs_znode *znode;
3278 	unsigned int block;
3279 
3280 	if (!S_ISREG(inode->i_mode))
3281 		return 0;
3282 	if (!dbg_is_chk_gen(c))
3283 		return 0;
3284 
3285 	block = (size + UBIFS_BLOCK_SIZE - 1) >> UBIFS_BLOCK_SHIFT;
3286 	data_key_init(c, &from_key, inode->i_ino, block);
3287 	highest_data_key(c, &to_key, inode->i_ino);
3288 
3289 	mutex_lock(&c->tnc_mutex);
3290 	err = ubifs_lookup_level0(c, &from_key, &znode, &n);
3291 	if (err < 0)
3292 		goto out_unlock;
3293 
3294 	if (err) {
3295 		key = &from_key;
3296 		goto out_dump;
3297 	}
3298 
3299 	err = tnc_next(c, &znode, &n);
3300 	if (err == -ENOENT) {
3301 		err = 0;
3302 		goto out_unlock;
3303 	}
3304 	if (err < 0)
3305 		goto out_unlock;
3306 
3307 	ubifs_assert(err == 0);
3308 	key = &znode->zbranch[n].key;
3309 	if (!key_in_range(c, key, &from_key, &to_key))
3310 		goto out_unlock;
3311 
3312 out_dump:
3313 	block = key_block(c, key);
3314 	ubifs_err(c, "inode %lu has size %lld, but there are data at offset %lld",
3315 		  (unsigned long)inode->i_ino, size,
3316 		  ((loff_t)block) << UBIFS_BLOCK_SHIFT);
3317 	mutex_unlock(&c->tnc_mutex);
3318 	ubifs_dump_inode(c, inode);
3319 	dump_stack();
3320 	return -EINVAL;
3321 
3322 out_unlock:
3323 	mutex_unlock(&c->tnc_mutex);
3324 	return err;
3325 }
3326