mirror of
https://github.com/torvalds/linux.git
synced 2024-12-26 21:02:19 +00:00
14694888db
kmalloc_array() manages count*sizeof overflow. Signed-off-by: Fabian Frederick <fabf@skynet.be> Cc: Phillip Lougher <phillip@squashfs.org.uk> Cc: Joe Perches <joe@perches.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
177 lines
4.4 KiB
C
177 lines
4.4 KiB
C
/*
|
|
* Copyright (c) 2013
|
|
* Phillip Lougher <phillip@squashfs.org.uk>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2. See
|
|
* the COPYING file in the top-level directory.
|
|
*/
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/vfs.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/string.h>
|
|
#include <linux/pagemap.h>
|
|
#include <linux/mutex.h>
|
|
|
|
#include "squashfs_fs.h"
|
|
#include "squashfs_fs_sb.h"
|
|
#include "squashfs_fs_i.h"
|
|
#include "squashfs.h"
|
|
#include "page_actor.h"
|
|
|
|
static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
|
|
int pages, struct page **page);
|
|
|
|
/* Read separately compressed datablock directly into page cache */
|
|
int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
|
|
|
|
{
|
|
struct inode *inode = target_page->mapping->host;
|
|
struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
|
|
|
|
int file_end = (i_size_read(inode) - 1) >> PAGE_CACHE_SHIFT;
|
|
int mask = (1 << (msblk->block_log - PAGE_CACHE_SHIFT)) - 1;
|
|
int start_index = target_page->index & ~mask;
|
|
int end_index = start_index | mask;
|
|
int i, n, pages, missing_pages, bytes, res = -ENOMEM;
|
|
struct page **page;
|
|
struct squashfs_page_actor *actor;
|
|
void *pageaddr;
|
|
|
|
if (end_index > file_end)
|
|
end_index = file_end;
|
|
|
|
pages = end_index - start_index + 1;
|
|
|
|
page = kmalloc_array(pages, sizeof(void *), GFP_KERNEL);
|
|
if (page == NULL)
|
|
return res;
|
|
|
|
/*
|
|
* Create a "page actor" which will kmap and kunmap the
|
|
* page cache pages appropriately within the decompressor
|
|
*/
|
|
actor = squashfs_page_actor_init_special(page, pages, 0);
|
|
if (actor == NULL)
|
|
goto out;
|
|
|
|
/* Try to grab all the pages covered by the Squashfs block */
|
|
for (missing_pages = 0, i = 0, n = start_index; i < pages; i++, n++) {
|
|
page[i] = (n == target_page->index) ? target_page :
|
|
grab_cache_page_nowait(target_page->mapping, n);
|
|
|
|
if (page[i] == NULL) {
|
|
missing_pages++;
|
|
continue;
|
|
}
|
|
|
|
if (PageUptodate(page[i])) {
|
|
unlock_page(page[i]);
|
|
page_cache_release(page[i]);
|
|
page[i] = NULL;
|
|
missing_pages++;
|
|
}
|
|
}
|
|
|
|
if (missing_pages) {
|
|
/*
|
|
* Couldn't get one or more pages, this page has either
|
|
* been VM reclaimed, but others are still in the page cache
|
|
* and uptodate, or we're racing with another thread in
|
|
* squashfs_readpage also trying to grab them. Fall back to
|
|
* using an intermediate buffer.
|
|
*/
|
|
res = squashfs_read_cache(target_page, block, bsize, pages,
|
|
page);
|
|
if (res < 0)
|
|
goto mark_errored;
|
|
|
|
goto out;
|
|
}
|
|
|
|
/* Decompress directly into the page cache buffers */
|
|
res = squashfs_read_data(inode->i_sb, block, bsize, NULL, actor);
|
|
if (res < 0)
|
|
goto mark_errored;
|
|
|
|
/* Last page may have trailing bytes not filled */
|
|
bytes = res % PAGE_CACHE_SIZE;
|
|
if (bytes) {
|
|
pageaddr = kmap_atomic(page[pages - 1]);
|
|
memset(pageaddr + bytes, 0, PAGE_CACHE_SIZE - bytes);
|
|
kunmap_atomic(pageaddr);
|
|
}
|
|
|
|
/* Mark pages as uptodate, unlock and release */
|
|
for (i = 0; i < pages; i++) {
|
|
flush_dcache_page(page[i]);
|
|
SetPageUptodate(page[i]);
|
|
unlock_page(page[i]);
|
|
if (page[i] != target_page)
|
|
page_cache_release(page[i]);
|
|
}
|
|
|
|
kfree(actor);
|
|
kfree(page);
|
|
|
|
return 0;
|
|
|
|
mark_errored:
|
|
/* Decompression failed, mark pages as errored. Target_page is
|
|
* dealt with by the caller
|
|
*/
|
|
for (i = 0; i < pages; i++) {
|
|
if (page[i] == NULL || page[i] == target_page)
|
|
continue;
|
|
flush_dcache_page(page[i]);
|
|
SetPageError(page[i]);
|
|
unlock_page(page[i]);
|
|
page_cache_release(page[i]);
|
|
}
|
|
|
|
out:
|
|
kfree(actor);
|
|
kfree(page);
|
|
return res;
|
|
}
|
|
|
|
|
|
static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
|
|
int pages, struct page **page)
|
|
{
|
|
struct inode *i = target_page->mapping->host;
|
|
struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
|
|
block, bsize);
|
|
int bytes = buffer->length, res = buffer->error, n, offset = 0;
|
|
void *pageaddr;
|
|
|
|
if (res) {
|
|
ERROR("Unable to read page, block %llx, size %x\n", block,
|
|
bsize);
|
|
goto out;
|
|
}
|
|
|
|
for (n = 0; n < pages && bytes > 0; n++,
|
|
bytes -= PAGE_CACHE_SIZE, offset += PAGE_CACHE_SIZE) {
|
|
int avail = min_t(int, bytes, PAGE_CACHE_SIZE);
|
|
|
|
if (page[n] == NULL)
|
|
continue;
|
|
|
|
pageaddr = kmap_atomic(page[n]);
|
|
squashfs_copy_data(pageaddr, buffer, offset, avail);
|
|
memset(pageaddr + avail, 0, PAGE_CACHE_SIZE - avail);
|
|
kunmap_atomic(pageaddr);
|
|
flush_dcache_page(page[n]);
|
|
SetPageUptodate(page[n]);
|
|
unlock_page(page[n]);
|
|
if (page[n] != target_page)
|
|
page_cache_release(page[n]);
|
|
}
|
|
|
|
out:
|
|
squashfs_cache_put(buffer);
|
|
return res;
|
|
}
|