1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 *
   4 * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved.
   5 *
   6 */
   7
   8#include <linux/blkdev.h>
   9#include <linux/fs.h>
  10#include <linux/random.h>
  11#include <linux/slab.h>
  12
  13#include "debug.h"
  14#include "ntfs.h"
  15#include "ntfs_fs.h"
  16
  17/*
  18 * LOG FILE structs
  19 */
  20
  21// clang-format off
  22
  23#define MaxLogFileSize     0x100000000ull
  24#define DefaultLogPageSize 4096
  25#define MinLogRecordPages  0x30
  26
  27struct RESTART_HDR {
  28	struct NTFS_RECORD_HEADER rhdr; // 'RSTR'
  29	__le32 sys_page_size; // 0x10: Page size of the system which initialized the log.
  30	__le32 page_size;     // 0x14: Log page size used for this log file.
  31	__le16 ra_off;        // 0x18:
  32	__le16 minor_ver;     // 0x1A:
  33	__le16 major_ver;     // 0x1C:
  34	__le16 fixups[];
  35};
  36
  37#define LFS_NO_CLIENT 0xffff
  38#define LFS_NO_CLIENT_LE cpu_to_le16(0xffff)
  39
  40struct CLIENT_REC {
  41	__le64 oldest_lsn;
  42	__le64 restart_lsn; // 0x08:
  43	__le16 prev_client; // 0x10:
  44	__le16 next_client; // 0x12:
  45	__le16 seq_num;     // 0x14:
  46	u8 align[6];        // 0x16:
  47	__le32 name_bytes;  // 0x1C: In bytes.
  48	__le16 name[32];    // 0x20: Name of client.
  49};
  50
  51static_assert(sizeof(struct CLIENT_REC) == 0x60);
  52
  53/* Two copies of these will exist at the beginning of the log file */
  54struct RESTART_AREA {
  55	__le64 current_lsn;    // 0x00: Current logical end of log file.
  56	__le16 log_clients;    // 0x08: Maximum number of clients.
  57	__le16 client_idx[2];  // 0x0A: Free/use index into the client record arrays.
  58	__le16 flags;          // 0x0E: See RESTART_SINGLE_PAGE_IO.
  59	__le32 seq_num_bits;   // 0x10: The number of bits in sequence number.
  60	__le16 ra_len;         // 0x14:
  61	__le16 client_off;     // 0x16:
  62	__le64 l_size;         // 0x18: Usable log file size.
  63	__le32 last_lsn_data_len; // 0x20:
  64	__le16 rec_hdr_len;    // 0x24: Log page data offset.
  65	__le16 data_off;       // 0x26: Log page data length.
  66	__le32 open_log_count; // 0x28:
  67	__le32 align[5];       // 0x2C:
  68	struct CLIENT_REC clients[]; // 0x40:
  69};
  70
  71struct LOG_REC_HDR {
  72	__le16 redo_op;      // 0x00:  NTFS_LOG_OPERATION
  73	__le16 undo_op;      // 0x02:  NTFS_LOG_OPERATION
  74	__le16 redo_off;     // 0x04:  Offset to Redo record.
  75	__le16 redo_len;     // 0x06:  Redo length.
  76	__le16 undo_off;     // 0x08:  Offset to Undo record.
  77	__le16 undo_len;     // 0x0A:  Undo length.
  78	__le16 target_attr;  // 0x0C:
  79	__le16 lcns_follow;  // 0x0E:
  80	__le16 record_off;   // 0x10:
  81	__le16 attr_off;     // 0x12:
  82	__le16 cluster_off;  // 0x14:
  83	__le16 reserved;     // 0x16:
  84	__le64 target_vcn;   // 0x18:
  85	__le64 page_lcns[];  // 0x20:
  86};
  87
  88static_assert(sizeof(struct LOG_REC_HDR) == 0x20);
  89
  90#define RESTART_ENTRY_ALLOCATED    0xFFFFFFFF
  91#define RESTART_ENTRY_ALLOCATED_LE cpu_to_le32(0xFFFFFFFF)
  92
  93struct RESTART_TABLE {
  94	__le16 size;       // 0x00: In bytes
  95	__le16 used;       // 0x02: Entries
  96	__le16 total;      // 0x04: Entries
  97	__le16 res[3];     // 0x06:
  98	__le32 free_goal;  // 0x0C:
  99	__le32 first_free; // 0x10:
 100	__le32 last_free;  // 0x14:
 101
 102};
 103
 104static_assert(sizeof(struct RESTART_TABLE) == 0x18);
 105
 106struct ATTR_NAME_ENTRY {
 107	__le16 off; // Offset in the Open attribute Table.
 108	__le16 name_bytes;
 109	__le16 name[];
 110};
 111
 112struct OPEN_ATTR_ENRTY {
 113	__le32 next;            // 0x00: RESTART_ENTRY_ALLOCATED if allocated
 114	__le32 bytes_per_index; // 0x04:
 115	enum ATTR_TYPE type;    // 0x08:
 116	u8 is_dirty_pages;      // 0x0C:
 117	u8 is_attr_name;        // 0x0B: Faked field to manage 'ptr'
 118	u8 name_len;            // 0x0C: Faked field to manage 'ptr'
 119	u8 res;
 120	struct MFT_REF ref;     // 0x10: File Reference of file containing attribute
 121	__le64 open_record_lsn; // 0x18:
 122	void *ptr;              // 0x20:
 123};
 124
 125/* 32 bit version of 'struct OPEN_ATTR_ENRTY' */
 126struct OPEN_ATTR_ENRTY_32 {
 127	__le32 next;            // 0x00: RESTART_ENTRY_ALLOCATED if allocated
 128	__le32 ptr;             // 0x04:
 129	struct MFT_REF ref;     // 0x08:
 130	__le64 open_record_lsn; // 0x10:
 131	u8 is_dirty_pages;      // 0x18:
 132	u8 is_attr_name;        // 0x19:
 133	u8 res1[2];
 134	enum ATTR_TYPE type;    // 0x1C:
 135	u8 name_len;            // 0x20: In wchar
 136	u8 res2[3];
 137	__le32 AttributeName;   // 0x24:
 138	__le32 bytes_per_index; // 0x28:
 139};
 140
 141#define SIZEOF_OPENATTRIBUTEENTRY0 0x2c
 142// static_assert( 0x2C == sizeof(struct OPEN_ATTR_ENRTY_32) );
 143static_assert(sizeof(struct OPEN_ATTR_ENRTY) < SIZEOF_OPENATTRIBUTEENTRY0);
 144
 145/*
 146 * One entry exists in the Dirty Pages Table for each page which is dirty at
 147 * the time the Restart Area is written.
 148 */
 149struct DIR_PAGE_ENTRY {
 150	__le32 next;         // 0x00: RESTART_ENTRY_ALLOCATED if allocated
 151	__le32 target_attr;  // 0x04: Index into the Open attribute Table
 152	__le32 transfer_len; // 0x08:
 153	__le32 lcns_follow;  // 0x0C:
 154	__le64 vcn;          // 0x10: Vcn of dirty page
 155	__le64 oldest_lsn;   // 0x18:
 156	__le64 page_lcns[];  // 0x20:
 157};
 158
 159static_assert(sizeof(struct DIR_PAGE_ENTRY) == 0x20);
 160
 161/* 32 bit version of 'struct DIR_PAGE_ENTRY' */
 162struct DIR_PAGE_ENTRY_32 {
 163	__le32 next;		// 0x00: RESTART_ENTRY_ALLOCATED if allocated
 164	__le32 target_attr;	// 0x04: Index into the Open attribute Table
 165	__le32 transfer_len;	// 0x08:
 166	__le32 lcns_follow;	// 0x0C:
 167	__le32 reserved;	// 0x10:
 168	__le32 vcn_low;		// 0x14: Vcn of dirty page
 169	__le32 vcn_hi;		// 0x18: Vcn of dirty page
 170	__le32 oldest_lsn_low;	// 0x1C:
 171	__le32 oldest_lsn_hi;	// 0x1C:
 172	__le32 page_lcns_low;	// 0x24:
 173	__le32 page_lcns_hi;	// 0x24:
 174};
 175
 176static_assert(offsetof(struct DIR_PAGE_ENTRY_32, vcn_low) == 0x14);
 177static_assert(sizeof(struct DIR_PAGE_ENTRY_32) == 0x2c);
 178
 179enum transact_state {
 180	TransactionUninitialized = 0,
 181	TransactionActive,
 182	TransactionPrepared,
 183	TransactionCommitted
 184};
 185
 186struct TRANSACTION_ENTRY {
 187	__le32 next;          // 0x00: RESTART_ENTRY_ALLOCATED if allocated
 188	u8 transact_state;    // 0x04:
 189	u8 reserved[3];       // 0x05:
 190	__le64 first_lsn;     // 0x08:
 191	__le64 prev_lsn;      // 0x10:
 192	__le64 undo_next_lsn; // 0x18:
 193	__le32 undo_records;  // 0x20: Number of undo log records pending abort
 194	__le32 undo_len;      // 0x24: Total undo size
 195};
 196
 197static_assert(sizeof(struct TRANSACTION_ENTRY) == 0x28);
 198
 199struct NTFS_RESTART {
 200	__le32 major_ver;             // 0x00:
 201	__le32 minor_ver;             // 0x04:
 202	__le64 check_point_start;     // 0x08:
 203	__le64 open_attr_table_lsn;   // 0x10:
 204	__le64 attr_names_lsn;        // 0x18:
 205	__le64 dirty_pages_table_lsn; // 0x20:
 206	__le64 transact_table_lsn;    // 0x28:
 207	__le32 open_attr_len;         // 0x30: In bytes
 208	__le32 attr_names_len;        // 0x34: In bytes
 209	__le32 dirty_pages_len;       // 0x38: In bytes
 210	__le32 transact_table_len;    // 0x3C: In bytes
 211};
 212
 213static_assert(sizeof(struct NTFS_RESTART) == 0x40);
 214
 215struct NEW_ATTRIBUTE_SIZES {
 216	__le64 alloc_size;
 217	__le64 valid_size;
 218	__le64 data_size;
 219	__le64 total_size;
 220};
 221
 222struct BITMAP_RANGE {
 223	__le32 bitmap_off;
 224	__le32 bits;
 225};
 226
 227struct LCN_RANGE {
 228	__le64 lcn;
 229	__le64 len;
 230};
 231
 232/* The following type defines the different log record types. */
 233#define LfsClientRecord  cpu_to_le32(1)
 234#define LfsClientRestart cpu_to_le32(2)
 235
 236/* This is used to uniquely identify a client for a particular log file. */
 237struct CLIENT_ID {
 238	__le16 seq_num;
 239	__le16 client_idx;
 240};
 241
 242/* This is the header that begins every Log Record in the log file. */
 243struct LFS_RECORD_HDR {
 244	__le64 this_lsn;		// 0x00:
 245	__le64 client_prev_lsn;		// 0x08:
 246	__le64 client_undo_next_lsn;	// 0x10:
 247	__le32 client_data_len;		// 0x18:
 248	struct CLIENT_ID client;	// 0x1C: Owner of this log record.
 249	__le32 record_type;		// 0x20: LfsClientRecord or LfsClientRestart.
 250	__le32 transact_id;		// 0x24:
 251	__le16 flags;			// 0x28: LOG_RECORD_MULTI_PAGE
 252	u8 align[6];			// 0x2A:
 253};
 254
 255#define LOG_RECORD_MULTI_PAGE cpu_to_le16(1)
 256
 257static_assert(sizeof(struct LFS_RECORD_HDR) == 0x30);
 258
 259struct LFS_RECORD {
 260	__le16 next_record_off;	// 0x00: Offset of the free space in the page,
 261	u8 align[6];		// 0x02:
 262	__le64 last_end_lsn;	// 0x08: lsn for the last log record which ends on the page,
 263};
 264
 265static_assert(sizeof(struct LFS_RECORD) == 0x10);
 266
 267struct RECORD_PAGE_HDR {
 268	struct NTFS_RECORD_HEADER rhdr;	// 'RCRD'
 269	__le32 rflags;			// 0x10: See LOG_PAGE_LOG_RECORD_END
 270	__le16 page_count;		// 0x14:
 271	__le16 page_pos;		// 0x16:
 272	struct LFS_RECORD record_hdr;	// 0x18:
 273	__le16 fixups[10];		// 0x28:
 274	__le32 file_off;		// 0x3c: Used when major version >= 2
 275};
 276
 277// clang-format on
 278
 279// Page contains the end of a log record.
 280#define LOG_PAGE_LOG_RECORD_END cpu_to_le32(0x00000001)
 281
 282static inline bool is_log_record_end(const struct RECORD_PAGE_HDR *hdr)
 283{
 284	return hdr->rflags & LOG_PAGE_LOG_RECORD_END;
 285}
 286
 287static_assert(offsetof(struct RECORD_PAGE_HDR, file_off) == 0x3c);
 288
 289/*
 290 * END of NTFS LOG structures
 291 */
 292
 293/* Define some tuning parameters to keep the restart tables a reasonable size. */
 294#define INITIAL_NUMBER_TRANSACTIONS 5
 295
 296enum NTFS_LOG_OPERATION {
 297
 298	Noop = 0x00,
 299	CompensationLogRecord = 0x01,
 300	InitializeFileRecordSegment = 0x02,
 301	DeallocateFileRecordSegment = 0x03,
 302	WriteEndOfFileRecordSegment = 0x04,
 303	CreateAttribute = 0x05,
 304	DeleteAttribute = 0x06,
 305	UpdateResidentValue = 0x07,
 306	UpdateNonresidentValue = 0x08,
 307	UpdateMappingPairs = 0x09,
 308	DeleteDirtyClusters = 0x0A,
 309	SetNewAttributeSizes = 0x0B,
 310	AddIndexEntryRoot = 0x0C,
 311	DeleteIndexEntryRoot = 0x0D,
 312	AddIndexEntryAllocation = 0x0E,
 313	DeleteIndexEntryAllocation = 0x0F,
 314	WriteEndOfIndexBuffer = 0x10,
 315	SetIndexEntryVcnRoot = 0x11,
 316	SetIndexEntryVcnAllocation = 0x12,
 317	UpdateFileNameRoot = 0x13,
 318	UpdateFileNameAllocation = 0x14,
 319	SetBitsInNonresidentBitMap = 0x15,
 320	ClearBitsInNonresidentBitMap = 0x16,
 321	HotFix = 0x17,
 322	EndTopLevelAction = 0x18,
 323	PrepareTransaction = 0x19,
 324	CommitTransaction = 0x1A,
 325	ForgetTransaction = 0x1B,
 326	OpenNonresidentAttribute = 0x1C,
 327	OpenAttributeTableDump = 0x1D,
 328	AttributeNamesDump = 0x1E,
 329	DirtyPageTableDump = 0x1F,
 330	TransactionTableDump = 0x20,
 331	UpdateRecordDataRoot = 0x21,
 332	UpdateRecordDataAllocation = 0x22,
 333
 334	UpdateRelativeDataInIndex =
 335		0x23, // NtOfsRestartUpdateRelativeDataInIndex
 336	UpdateRelativeDataInIndex2 = 0x24,
 337	ZeroEndOfFileRecord = 0x25,
 338};
 339
 340/*
 341 * Array for log records which require a target attribute.
 342 * A true indicates that the corresponding restart operation
 343 * requires a target attribute.
 344 */
 345static const u8 AttributeRequired[] = {
 346	0xFC, 0xFB, 0xFF, 0x10, 0x06,
 347};
 348
 349static inline bool is_target_required(u16 op)
 350{
 351	bool ret = op <= UpdateRecordDataAllocation &&
 352		   (AttributeRequired[op >> 3] >> (op & 7) & 1);
 353	return ret;
 354}
 355
 356static inline bool can_skip_action(enum NTFS_LOG_OPERATION op)
 357{
 358	switch (op) {
 359	case Noop:
 360	case DeleteDirtyClusters:
 361	case HotFix:
 362	case EndTopLevelAction:
 363	case PrepareTransaction:
 364	case CommitTransaction:
 365	case ForgetTransaction:
 366	case CompensationLogRecord:
 367	case OpenNonresidentAttribute:
 368	case OpenAttributeTableDump:
 369	case AttributeNamesDump:
 370	case DirtyPageTableDump:
 371	case TransactionTableDump:
 372		return true;
 373	default:
 374		return false;
 375	}
 376}
 377
 378enum { lcb_ctx_undo_next, lcb_ctx_prev, lcb_ctx_next };
 379
 380/* Bytes per restart table. */
 381static inline u32 bytes_per_rt(const struct RESTART_TABLE *rt)
 382{
 383	return le16_to_cpu(rt->used) * le16_to_cpu(rt->size) +
 384	       sizeof(struct RESTART_TABLE);
 385}
 386
 387/* Log record length. */
 388static inline u32 lrh_length(const struct LOG_REC_HDR *lr)
 389{
 390	u16 t16 = le16_to_cpu(lr->lcns_follow);
 391
 392	return struct_size(lr, page_lcns, max_t(u16, 1, t16));
 393}
 394
 395struct lcb {
 396	struct LFS_RECORD_HDR *lrh; // Log record header of the current lsn.
 397	struct LOG_REC_HDR *log_rec;
 398	u32 ctx_mode; // lcb_ctx_undo_next/lcb_ctx_prev/lcb_ctx_next
 399	struct CLIENT_ID client;
 400	bool alloc; // If true the we should deallocate 'log_rec'.
 401};
 402
 403static void lcb_put(struct lcb *lcb)
 404{
 405	if (lcb->alloc)
 406		kfree(lcb->log_rec);
 407	kfree(lcb->lrh);
 408	kfree(lcb);
 409}
 410
 411/* Find the oldest lsn from active clients. */
 412static inline void oldest_client_lsn(const struct CLIENT_REC *ca,
 413				     __le16 next_client, u64 *oldest_lsn)
 414{
 415	while (next_client != LFS_NO_CLIENT_LE) {
 416		const struct CLIENT_REC *cr = ca + le16_to_cpu(next_client);
 417		u64 lsn = le64_to_cpu(cr->oldest_lsn);
 418
 419		/* Ignore this block if it's oldest lsn is 0. */
 420		if (lsn && lsn < *oldest_lsn)
 421			*oldest_lsn = lsn;
 422
 423		next_client = cr->next_client;
 424	}
 425}
 426
 427static inline bool is_rst_page_hdr_valid(u32 file_off,
 428					 const struct RESTART_HDR *rhdr)
 429{
 430	u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
 431	u32 page_size = le32_to_cpu(rhdr->page_size);
 432	u32 end_usa;
 433	u16 ro;
 434
 435	if (sys_page < SECTOR_SIZE || page_size < SECTOR_SIZE ||
 436	    sys_page & (sys_page - 1) || page_size & (page_size - 1)) {
 437		return false;
 438	}
 439
 440	/* Check that if the file offset isn't 0, it is the system page size. */
 441	if (file_off && file_off != sys_page)
 442		return false;
 443
 444	/* Check support version 1.1+. */
 445	if (le16_to_cpu(rhdr->major_ver) <= 1 && !rhdr->minor_ver)
 446		return false;
 447
 448	if (le16_to_cpu(rhdr->major_ver) > 2)
 449		return false;
 450
 451	ro = le16_to_cpu(rhdr->ra_off);
 452	if (!IS_ALIGNED(ro, 8) || ro > sys_page)
 453		return false;
 454
 455	end_usa = ((sys_page >> SECTOR_SHIFT) + 1) * sizeof(short);
 456	end_usa += le16_to_cpu(rhdr->rhdr.fix_off);
 457
 458	if (ro < end_usa)
 459		return false;
 460
 461	return true;
 462}
 463
 464static inline bool is_rst_area_valid(const struct RESTART_HDR *rhdr)
 465{
 466	const struct RESTART_AREA *ra;
 467	u16 cl, fl, ul;
 468	u32 off, l_size, seq_bits;
 469	u16 ro = le16_to_cpu(rhdr->ra_off);
 470	u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
 471
 472	if (ro + offsetof(struct RESTART_AREA, l_size) >
 473	    SECTOR_SIZE - sizeof(short))
 474		return false;
 475
 476	ra = Add2Ptr(rhdr, ro);
 477	cl = le16_to_cpu(ra->log_clients);
 478
 479	if (cl > 1)
 480		return false;
 481
 482	off = le16_to_cpu(ra->client_off);
 483
 484	if (!IS_ALIGNED(off, 8) || ro + off > SECTOR_SIZE - sizeof(short))
 485		return false;
 486
 487	off += cl * sizeof(struct CLIENT_REC);
 488
 489	if (off > sys_page)
 490		return false;
 491
 492	/*
 493	 * Check the restart length field and whether the entire
 494	 * restart area is contained that length.
 495	 */
 496	if (le16_to_cpu(rhdr->ra_off) + le16_to_cpu(ra->ra_len) > sys_page ||
 497	    off > le16_to_cpu(ra->ra_len)) {
 498		return false;
 499	}
 500
 501	/*
 502	 * As a final check make sure that the use list and the free list
 503	 * are either empty or point to a valid client.
 504	 */
 505	fl = le16_to_cpu(ra->client_idx[0]);
 506	ul = le16_to_cpu(ra->client_idx[1]);
 507	if ((fl != LFS_NO_CLIENT && fl >= cl) ||
 508	    (ul != LFS_NO_CLIENT && ul >= cl))
 509		return false;
 510
 511	/* Make sure the sequence number bits match the log file size. */
 512	l_size = le64_to_cpu(ra->l_size);
 513
 514	seq_bits = sizeof(u64) * 8 + 3;
 515	while (l_size) {
 516		l_size >>= 1;
 517		seq_bits -= 1;
 518	}
 519
 520	if (seq_bits != le32_to_cpu(ra->seq_num_bits))
 521		return false;
 522
 523	/* The log page data offset and record header length must be quad-aligned. */
 524	if (!IS_ALIGNED(le16_to_cpu(ra->data_off), 8) ||
 525	    !IS_ALIGNED(le16_to_cpu(ra->rec_hdr_len), 8))
 526		return false;
 527
 528	return true;
 529}
 530
 531static inline bool is_client_area_valid(const struct RESTART_HDR *rhdr,
 532					bool usa_error)
 533{
 534	u16 ro = le16_to_cpu(rhdr->ra_off);
 535	const struct RESTART_AREA *ra = Add2Ptr(rhdr, ro);
 536	u16 ra_len = le16_to_cpu(ra->ra_len);
 537	const struct CLIENT_REC *ca;
 538	u32 i;
 539
 540	if (usa_error && ra_len + ro > SECTOR_SIZE - sizeof(short))
 541		return false;
 542
 543	/* Find the start of the client array. */
 544	ca = Add2Ptr(ra, le16_to_cpu(ra->client_off));
 545
 546	/*
 547	 * Start with the free list.
 548	 * Check that all the clients are valid and that there isn't a cycle.
 549	 * Do the in-use list on the second pass.
 550	 */
 551	for (i = 0; i < 2; i++) {
 552		u16 client_idx = le16_to_cpu(ra->client_idx[i]);
 553		bool first_client = true;
 554		u16 clients = le16_to_cpu(ra->log_clients);
 555
 556		while (client_idx != LFS_NO_CLIENT) {
 557			const struct CLIENT_REC *cr;
 558
 559			if (!clients ||
 560			    client_idx >= le16_to_cpu(ra->log_clients))
 561				return false;
 562
 563			clients -= 1;
 564			cr = ca + client_idx;
 565
 566			client_idx = le16_to_cpu(cr->next_client);
 567
 568			if (first_client) {
 569				first_client = false;
 570				if (cr->prev_client != LFS_NO_CLIENT_LE)
 571					return false;
 572			}
 573		}
 574	}
 575
 576	return true;
 577}
 578
 579/*
 580 * remove_client
 581 *
 582 * Remove a client record from a client record list an restart area.
 583 */
 584static inline void remove_client(struct CLIENT_REC *ca,
 585				 const struct CLIENT_REC *cr, __le16 *head)
 586{
 587	if (cr->prev_client == LFS_NO_CLIENT_LE)
 588		*head = cr->next_client;
 589	else
 590		ca[le16_to_cpu(cr->prev_client)].next_client = cr->next_client;
 591
 592	if (cr->next_client != LFS_NO_CLIENT_LE)
 593		ca[le16_to_cpu(cr->next_client)].prev_client = cr->prev_client;
 594}
 595
 596/*
 597 * add_client - Add a client record to the start of a list.
 598 */
 599static inline void add_client(struct CLIENT_REC *ca, u16 index, __le16 *head)
 600{
 601	struct CLIENT_REC *cr = ca + index;
 602
 603	cr->prev_client = LFS_NO_CLIENT_LE;
 604	cr->next_client = *head;
 605
 606	if (*head != LFS_NO_CLIENT_LE)
 607		ca[le16_to_cpu(*head)].prev_client = cpu_to_le16(index);
 608
 609	*head = cpu_to_le16(index);
 610}
 611
 612/*
 613 * Enumerate restart table.
 614 *
 615 * @t - table to enumerate.
 616 * @c - current enumerated element.
 617 *
 618 * enumeration starts with @c == NULL
 619 * returns next element or NULL
 620 */
 621static inline void *enum_rstbl(struct RESTART_TABLE *t, void *c)
 622{
 623	__le32 *e;
 624	u32 bprt;
 625	u16 rsize;
 626
 627	if (!t)
 628		return NULL;
 629
 630	rsize = le16_to_cpu(t->size);
 631
 632	if (!c) {
 633		/* start enumeration. */
 634		if (!t->total)
 635			return NULL;
 636		e = Add2Ptr(t, sizeof(struct RESTART_TABLE));
 637	} else {
 638		e = Add2Ptr(c, rsize);
 639	}
 640
 641	/* Loop until we hit the first one allocated, or the end of the list. */
 642	for (bprt = bytes_per_rt(t); PtrOffset(t, e) < bprt;
 643	     e = Add2Ptr(e, rsize)) {
 644		if (*e == RESTART_ENTRY_ALLOCATED_LE)
 645			return e;
 646	}
 647	return NULL;
 648}
 649
 650/*
 651 * find_dp - Search for a @vcn in Dirty Page Table.
 652 */
 653static inline struct DIR_PAGE_ENTRY *find_dp(struct RESTART_TABLE *dptbl,
 654					     u32 target_attr, u64 vcn)
 655{
 656	__le32 ta = cpu_to_le32(target_attr);
 657	struct DIR_PAGE_ENTRY *dp = NULL;
 658
 659	while ((dp = enum_rstbl(dptbl, dp))) {
 660		u64 dp_vcn = le64_to_cpu(dp->vcn);
 661
 662		if (dp->target_attr == ta && vcn >= dp_vcn &&
 663		    vcn < dp_vcn + le32_to_cpu(dp->lcns_follow)) {
 664			return dp;
 665		}
 666	}
 667	return NULL;
 668}
 669
 670static inline u32 norm_file_page(u32 page_size, u32 *l_size, bool use_default)
 671{
 672	if (use_default)
 673		page_size = DefaultLogPageSize;
 674
 675	/* Round the file size down to a system page boundary. */
 676	*l_size &= ~(page_size - 1);
 677
 678	/* File should contain at least 2 restart pages and MinLogRecordPages pages. */
 679	if (*l_size < (MinLogRecordPages + 2) * page_size)
 680		return 0;
 681
 682	return page_size;
 683}
 684
 685static bool check_log_rec(const struct LOG_REC_HDR *lr, u32 bytes, u32 tr,
 686			  u32 bytes_per_attr_entry)
 687{
 688	u16 t16;
 689
 690	if (bytes < sizeof(struct LOG_REC_HDR))
 691		return false;
 692	if (!tr)
 693		return false;
 694
 695	if ((tr - sizeof(struct RESTART_TABLE)) %
 696	    sizeof(struct TRANSACTION_ENTRY))
 697		return false;
 698
 699	if (le16_to_cpu(lr->redo_off) & 7)
 700		return false;
 701
 702	if (le16_to_cpu(lr->undo_off) & 7)
 703		return false;
 704
 705	if (lr->target_attr)
 706		goto check_lcns;
 707
 708	if (is_target_required(le16_to_cpu(lr->redo_op)))
 709		return false;
 710
 711	if (is_target_required(le16_to_cpu(lr->undo_op)))
 712		return false;
 713
 714check_lcns:
 715	if (!lr->lcns_follow)
 716		goto check_length;
 717
 718	t16 = le16_to_cpu(lr->target_attr);
 719	if ((t16 - sizeof(struct RESTART_TABLE)) % bytes_per_attr_entry)
 720		return false;
 721
 722check_length:
 723	if (bytes < lrh_length(lr))
 724		return false;
 725
 726	return true;
 727}
 728
 729static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes)
 730{
 731	u32 ts;
 732	u32 i, off;
 733	u16 rsize = le16_to_cpu(rt->size);
 734	u16 ne = le16_to_cpu(rt->used);
 735	u32 ff = le32_to_cpu(rt->first_free);
 736	u32 lf = le32_to_cpu(rt->last_free);
 737
 738	ts = rsize * ne + sizeof(struct RESTART_TABLE);
 739
 740	if (!rsize || rsize > bytes ||
 741	    rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts ||
 742	    le16_to_cpu(rt->total) > ne || ff > ts - sizeof(__le32) ||
 743	    lf > ts - sizeof(__le32) ||
 744	    (ff && ff < sizeof(struct RESTART_TABLE)) ||
 745	    (lf && lf < sizeof(struct RESTART_TABLE))) {
 746		return false;
 747	}
 748
 749	/*
 750	 * Verify each entry is either allocated or points
 751	 * to a valid offset the table.
 752	 */
 753	for (i = 0; i < ne; i++) {
 754		off = le32_to_cpu(*(__le32 *)Add2Ptr(
 755			rt, i * rsize + sizeof(struct RESTART_TABLE)));
 756
 757		if (off != RESTART_ENTRY_ALLOCATED && off &&
 758		    (off < sizeof(struct RESTART_TABLE) ||
 759		     ((off - sizeof(struct RESTART_TABLE)) % rsize))) {
 760			return false;
 761		}
 762	}
 763
 764	/*
 765	 * Walk through the list headed by the first entry to make
 766	 * sure none of the entries are currently being used.
 767	 */
 768	for (off = ff; off;) {
 769		if (off == RESTART_ENTRY_ALLOCATED)
 770			return false;
 771
 772		off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
 773
 774		if (off > ts - sizeof(__le32))
 775			return false;
 776	}
 777
 778	return true;
 779}
 780
 781/*
 782 * free_rsttbl_idx - Free a previously allocated index a Restart Table.
 783 */
 784static inline void free_rsttbl_idx(struct RESTART_TABLE *rt, u32 off)
 785{
 786	__le32 *e;
 787	u32 lf = le32_to_cpu(rt->last_free);
 788	__le32 off_le = cpu_to_le32(off);
 789
 790	e = Add2Ptr(rt, off);
 791
 792	if (off < le32_to_cpu(rt->free_goal)) {
 793		*e = rt->first_free;
 794		rt->first_free = off_le;
 795		if (!lf)
 796			rt->last_free = off_le;
 797	} else {
 798		if (lf)
 799			*(__le32 *)Add2Ptr(rt, lf) = off_le;
 800		else
 801			rt->first_free = off_le;
 802
 803		rt->last_free = off_le;
 804		*e = 0;
 805	}
 806
 807	le16_sub_cpu(&rt->total, 1);
 808}
 809
 810static inline struct RESTART_TABLE *init_rsttbl(u16 esize, u16 used)
 811{
 812	__le32 *e, *last_free;
 813	u32 off;
 814	u32 bytes = esize * used + sizeof(struct RESTART_TABLE);
 815	u32 lf = sizeof(struct RESTART_TABLE) + (used - 1) * esize;
 816	struct RESTART_TABLE *t = kzalloc(bytes, GFP_NOFS);
 817
 818	if (!t)
 819		return NULL;
 820
 821	t->size = cpu_to_le16(esize);
 822	t->used = cpu_to_le16(used);
 823	t->free_goal = cpu_to_le32(~0u);
 824	t->first_free = cpu_to_le32(sizeof(struct RESTART_TABLE));
 825	t->last_free = cpu_to_le32(lf);
 826
 827	e = (__le32 *)(t + 1);
 828	last_free = Add2Ptr(t, lf);
 829
 830	for (off = sizeof(struct RESTART_TABLE) + esize; e < last_free;
 831	     e = Add2Ptr(e, esize), off += esize) {
 832		*e = cpu_to_le32(off);
 833	}
 834	return t;
 835}
 836
 837static inline struct RESTART_TABLE *extend_rsttbl(struct RESTART_TABLE *tbl,
 838						  u32 add, u32 free_goal)
 839{
 840	u16 esize = le16_to_cpu(tbl->size);
 841	__le32 osize = cpu_to_le32(bytes_per_rt(tbl));
 842	u32 used = le16_to_cpu(tbl->used);
 843	struct RESTART_TABLE *rt;
 844
 845	rt = init_rsttbl(esize, used + add);
 846	if (!rt)
 847		return NULL;
 848
 849	memcpy(rt + 1, tbl + 1, esize * used);
 850
 851	rt->free_goal = free_goal == ~0u ?
 852				cpu_to_le32(~0u) :
 853				cpu_to_le32(sizeof(struct RESTART_TABLE) +
 854					    free_goal * esize);
 855
 856	if (tbl->first_free) {
 857		rt->first_free = tbl->first_free;
 858		*(__le32 *)Add2Ptr(rt, le32_to_cpu(tbl->last_free)) = osize;
 859	} else {
 860		rt->first_free = osize;
 861	}
 862
 863	rt->total = tbl->total;
 864
 865	kfree(tbl);
 866	return rt;
 867}
 868
 869/*
 870 * alloc_rsttbl_idx
 871 *
 872 * Allocate an index from within a previously initialized Restart Table.
 873 */
 874static inline void *alloc_rsttbl_idx(struct RESTART_TABLE **tbl)
 875{
 876	u32 off;
 877	__le32 *e;
 878	struct RESTART_TABLE *t = *tbl;
 879
 880	if (!t->first_free) {
 881		*tbl = t = extend_rsttbl(t, 16, ~0u);
 882		if (!t)
 883			return NULL;
 884	}
 885
 886	off = le32_to_cpu(t->first_free);
 887
 888	/* Dequeue this entry and zero it. */
 889	e = Add2Ptr(t, off);
 890
 891	t->first_free = *e;
 892
 893	memset(e, 0, le16_to_cpu(t->size));
 894
 895	*e = RESTART_ENTRY_ALLOCATED_LE;
 896
 897	/* If list is going empty, then we fix the last_free as well. */
 898	if (!t->first_free)
 899		t->last_free = 0;
 900
 901	le16_add_cpu(&t->total, 1);
 902
 903	return Add2Ptr(t, off);
 904}
 905
 906/*
 907 * alloc_rsttbl_from_idx
 908 *
 909 * Allocate a specific index from within a previously initialized Restart Table.
 910 */
 911static inline void *alloc_rsttbl_from_idx(struct RESTART_TABLE **tbl, u32 vbo)
 912{
 913	u32 off;
 914	__le32 *e;
 915	struct RESTART_TABLE *rt = *tbl;
 916	u32 bytes = bytes_per_rt(rt);
 917	u16 esize = le16_to_cpu(rt->size);
 918
 919	/* If the entry is not the table, we will have to extend the table. */
 920	if (vbo >= bytes) {
 921		/*
 922		 * Extend the size by computing the number of entries between
 923		 * the existing size and the desired index and adding 1 to that.
 924		 */
 925		u32 bytes2idx = vbo - bytes;
 926
 927		/*
 928		 * There should always be an integral number of entries
 929		 * being added. Now extend the table.
 930		 */
 931		*tbl = rt = extend_rsttbl(rt, bytes2idx / esize + 1, bytes);
 932		if (!rt)
 933			return NULL;
 934	}
 935
 936	/* See if the entry is already allocated, and just return if it is. */
 937	e = Add2Ptr(rt, vbo);
 938
 939	if (*e == RESTART_ENTRY_ALLOCATED_LE)
 940		return e;
 941
 942	/*
 943	 * Walk through the table, looking for the entry we're
 944	 * interested and the previous entry.
 945	 */
 946	off = le32_to_cpu(rt->first_free);
 947	e = Add2Ptr(rt, off);
 948
 949	if (off == vbo) {
 950		/* this is a match */
 951		rt->first_free = *e;
 952		goto skip_looking;
 953	}
 954
 955	/*
 956	 * Need to walk through the list looking for the predecessor
 957	 * of our entry.
 958	 */
 959	for (;;) {
 960		/* Remember the entry just found */
 961		u32 last_off = off;
 962		__le32 *last_e = e;
 963
 964		/* Should never run of entries. */
 965
 966		/* Lookup up the next entry the list. */
 967		off = le32_to_cpu(*last_e);
 968		e = Add2Ptr(rt, off);
 969
 970		/* If this is our match we are done. */
 971		if (off == vbo) {
 972			*last_e = *e;
 973
 974			/*
 975			 * If this was the last entry, we update that
 976			 * table as well.
 977			 */
 978			if (le32_to_cpu(rt->last_free) == off)
 979				rt->last_free = cpu_to_le32(last_off);
 980			break;
 981		}
 982	}
 983
 984skip_looking:
 985	/* If the list is now empty, we fix the last_free as well. */
 986	if (!rt->first_free)
 987		rt->last_free = 0;
 988
 989	/* Zero this entry. */
 990	memset(e, 0, esize);
 991	*e = RESTART_ENTRY_ALLOCATED_LE;
 992
 993	le16_add_cpu(&rt->total, 1);
 994
 995	return e;
 996}
 997
 998struct restart_info {
 999	u64 last_lsn;
1000	struct RESTART_HDR *r_page;
1001	u32 vbo;
1002	bool chkdsk_was_run;
1003	bool valid_page;
1004	bool initialized;
1005	bool restart;
1006};
1007
1008#define RESTART_SINGLE_PAGE_IO cpu_to_le16(0x0001)
1009
1010#define NTFSLOG_WRAPPED 0x00000001
1011#define NTFSLOG_MULTIPLE_PAGE_IO 0x00000002
1012#define NTFSLOG_NO_LAST_LSN 0x00000004
1013#define NTFSLOG_REUSE_TAIL 0x00000010
1014#define NTFSLOG_NO_OLDEST_LSN 0x00000020
1015
1016/* Helper struct to work with NTFS $LogFile. */
1017struct ntfs_log {
1018	struct ntfs_inode *ni;
1019
1020	u32 l_size;
1021	u32 orig_file_size;
1022	u32 sys_page_size;
1023	u32 sys_page_mask;
1024	u32 page_size;
1025	u32 page_mask; // page_size - 1
1026	u8 page_bits;
1027	struct RECORD_PAGE_HDR *one_page_buf;
1028
1029	struct RESTART_TABLE *open_attr_tbl;
1030	u32 transaction_id;
1031	u32 clst_per_page;
1032
1033	u32 first_page;
1034	u32 next_page;
1035	u32 ra_off;
1036	u32 data_off;
1037	u32 restart_size;
1038	u32 data_size;
1039	u16 record_header_len;
1040	u64 seq_num;
1041	u32 seq_num_bits;
1042	u32 file_data_bits;
1043	u32 seq_num_mask; /* (1 << file_data_bits) - 1 */
1044
1045	struct RESTART_AREA *ra; /* In-memory image of the next restart area. */
1046	u32 ra_size; /* The usable size of the restart area. */
1047
1048	/*
1049	 * If true, then the in-memory restart area is to be written
1050	 * to the first position on the disk.
1051	 */
1052	bool init_ra;
1053	bool set_dirty; /* True if we need to set dirty flag. */
1054
1055	u64 oldest_lsn;
1056
1057	u32 oldest_lsn_off;
1058	u64 last_lsn;
1059
1060	u32 total_avail;
1061	u32 total_avail_pages;
1062	u32 total_undo_commit;
1063	u32 max_current_avail;
1064	u32 current_avail;
1065	u32 reserved;
1066
1067	short major_ver;
1068	short minor_ver;
1069
1070	u32 l_flags; /* See NTFSLOG_XXX */
1071	u32 current_openlog_count; /* On-disk value for open_log_count. */
1072
1073	struct CLIENT_ID client_id;
1074	u32 client_undo_commit;
1075
1076	struct restart_info rst_info, rst_info2;
1077};
1078
1079static inline u32 lsn_to_vbo(struct ntfs_log *log, const u64 lsn)
1080{
1081	u32 vbo = (lsn << log->seq_num_bits) >> (log->seq_num_bits - 3);
1082
1083	return vbo;
1084}
1085
1086/* Compute the offset in the log file of the next log page. */
1087static inline u32 next_page_off(struct ntfs_log *log, u32 off)
1088{
1089	off = (off & ~log->sys_page_mask) + log->page_size;
1090	return off >= log->l_size ? log->first_page : off;
1091}
1092
1093static inline u32 lsn_to_page_off(struct ntfs_log *log, u64 lsn)
1094{
1095	return (((u32)lsn) << 3) & log->page_mask;
1096}
1097
1098static inline u64 vbo_to_lsn(struct ntfs_log *log, u32 off, u64 Seq)
1099{
1100	return (off >> 3) + (Seq << log->file_data_bits);
1101}
1102
1103static inline bool is_lsn_in_file(struct ntfs_log *log, u64 lsn)
1104{
1105	return lsn >= log->oldest_lsn &&
1106	       lsn <= le64_to_cpu(log->ra->current_lsn);
1107}
1108
1109static inline u32 hdr_file_off(struct ntfs_log *log,
1110			       struct RECORD_PAGE_HDR *hdr)
1111{
1112	if (log->major_ver < 2)
1113		return le64_to_cpu(hdr->rhdr.lsn);
1114
1115	return le32_to_cpu(hdr->file_off);
1116}
1117
1118static inline u64 base_lsn(struct ntfs_log *log,
1119			   const struct RECORD_PAGE_HDR *hdr, u64 lsn)
1120{
1121	u64 h_lsn = le64_to_cpu(hdr->rhdr.lsn);
1122	u64 ret = (((h_lsn >> log->file_data_bits) +
1123		    (lsn < (lsn_to_vbo(log, h_lsn) & ~log->page_mask) ? 1 : 0))
1124		   << log->file_data_bits) +
1125		  ((((is_log_record_end(hdr) &&
1126		      h_lsn <= le64_to_cpu(hdr->record_hdr.last_end_lsn)) ?
1127			     le16_to_cpu(hdr->record_hdr.next_record_off) :
1128			     log->page_size) +
1129		    lsn) >>
1130		   3);
1131
1132	return ret;
1133}
1134
1135static inline bool verify_client_lsn(struct ntfs_log *log,
1136				     const struct CLIENT_REC *client, u64 lsn)
1137{
1138	return lsn >= le64_to_cpu(client->oldest_lsn) &&
1139	       lsn <= le64_to_cpu(log->ra->current_lsn) && lsn;
1140}
1141
1142static int read_log_page(struct ntfs_log *log, u32 vbo,
1143			 struct RECORD_PAGE_HDR **buffer, bool *usa_error)
1144{
1145	int err = 0;
1146	u32 page_idx = vbo >> log->page_bits;
1147	u32 page_off = vbo & log->page_mask;
1148	u32 bytes = log->page_size - page_off;
1149	void *to_free = NULL;
1150	u32 page_vbo = page_idx << log->page_bits;
1151	struct RECORD_PAGE_HDR *page_buf;
1152	struct ntfs_inode *ni = log->ni;
1153	bool bBAAD;
1154
1155	if (vbo >= log->l_size)
1156		return -EINVAL;
1157
1158	if (!*buffer) {
1159		to_free = kmalloc(log->page_size, GFP_NOFS);
1160		if (!to_free)
1161			return -ENOMEM;
1162		*buffer = to_free;
1163	}
1164
1165	page_buf = page_off ? log->one_page_buf : *buffer;
1166
1167	err = ntfs_read_run_nb(ni->mi.sbi, &ni->file.run, page_vbo, page_buf,
1168			       log->page_size, NULL);
1169	if (err)
1170		goto out;
1171
1172	if (page_buf->rhdr.sign != NTFS_FFFF_SIGNATURE)
1173		ntfs_fix_post_read(&page_buf->rhdr, PAGE_SIZE, false);
1174
1175	if (page_buf != *buffer)
1176		memcpy(*buffer, Add2Ptr(page_buf, page_off), bytes);
1177
1178	bBAAD = page_buf->rhdr.sign == NTFS_BAAD_SIGNATURE;
1179
1180	if (usa_error)
1181		*usa_error = bBAAD;
1182	/* Check that the update sequence array for this page is valid */
1183	/* If we don't allow errors, raise an error status */
1184	else if (bBAAD)
1185		err = -EINVAL;
1186
1187out:
1188	if (err && to_free) {
1189		kfree(to_free);
1190		*buffer = NULL;
1191	}
1192
1193	return err;
1194}
1195
1196/*
1197 * log_read_rst
1198 *
1199 * It walks through 512 blocks of the file looking for a valid
1200 * restart page header. It will stop the first time we find a
1201 * valid page header.
1202 */
1203static int log_read_rst(struct ntfs_log *log, bool first,
1204			struct restart_info *info)
1205{
1206	u32 skip;
1207	u64 vbo;
1208	struct RESTART_HDR *r_page = NULL;
1209
1210	/* Determine which restart area we are looking for. */
1211	if (first) {
1212		vbo = 0;
1213		skip = 512;
1214	} else {
1215		vbo = 512;
1216		skip = 0;
1217	}
1218
1219	/* Loop continuously until we succeed. */
1220	for (; vbo < log->l_size; vbo = 2 * vbo + skip, skip = 0) {
1221		bool usa_error;
1222		bool brst, bchk;
1223		struct RESTART_AREA *ra;
1224
1225		/* Read a page header at the current offset. */
1226		if (read_log_page(log, vbo, (struct RECORD_PAGE_HDR **)&r_page,
1227				  &usa_error)) {
1228			/* Ignore any errors. */
1229			continue;
1230		}
1231
1232		/* Exit if the signature is a log record page. */
1233		if (r_page->rhdr.sign == NTFS_RCRD_SIGNATURE) {
1234			info->initialized = true;
1235			break;
1236		}
1237
1238		brst = r_page->rhdr.sign == NTFS_RSTR_SIGNATURE;
1239		bchk = r_page->rhdr.sign == NTFS_CHKD_SIGNATURE;
1240
1241		if (!bchk && !brst) {
1242			if (r_page->rhdr.sign != NTFS_FFFF_SIGNATURE) {
1243				/*
1244				 * Remember if the signature does not
1245				 * indicate uninitialized file.
1246				 */
1247				info->initialized = true;
1248			}
1249			continue;
1250		}
1251
1252		ra = NULL;
1253		info->valid_page = false;
1254		info->initialized = true;
1255		info->vbo = vbo;
1256
1257		/* Let's check the restart area if this is a valid page. */
1258		if (!is_rst_page_hdr_valid(vbo, r_page))
1259			goto check_result;
1260		ra = Add2Ptr(r_page, le16_to_cpu(r_page->ra_off));
1261
1262		if (!is_rst_area_valid(r_page))
1263			goto check_result;
1264
1265		/*
1266		 * We have a valid restart page header and restart area.
1267		 * If chkdsk was run or we have no clients then we have
1268		 * no more checking to do.
1269		 */
1270		if (bchk || ra->client_idx[1] == LFS_NO_CLIENT_LE) {
1271			info->valid_page = true;
1272			goto check_result;
1273		}
1274
1275		if (is_client_area_valid(r_page, usa_error)) {
1276			info->valid_page = true;
1277			ra = Add2Ptr(r_page, le16_to_cpu(r_page->ra_off));
1278		}
1279
1280check_result:
1281		/*
1282		 * If chkdsk was run then update the caller's
1283		 * values and return.
1284		 */
1285		if (r_page->rhdr.sign == NTFS_CHKD_SIGNATURE) {
1286			info->chkdsk_was_run = true;
1287			info->last_lsn = le64_to_cpu(r_page->rhdr.lsn);
1288			info->restart = true;
1289			info->r_page = r_page;
1290			return 0;
1291		}
1292
1293		/*
1294		 * If we have a valid page then copy the values
1295		 * we need from it.
1296		 */
1297		if (info->valid_page) {
1298			info->last_lsn = le64_to_cpu(ra->current_lsn);
1299			info->restart = true;
1300			info->r_page = r_page;
1301			return 0;
1302		}
1303	}
1304
1305	kfree(r_page);
1306
1307	return 0;
1308}
1309
1310/*
1311 * Ilog_init_pg_hdr - Init @log from restart page header.
1312 */
1313static void log_init_pg_hdr(struct ntfs_log *log, u16 major_ver, u16 minor_ver)
1314{
1315	log->sys_page_size = log->page_size;
1316	log->sys_page_mask = log->page_mask;
1317
1318	log->clst_per_page = log->page_size >> log->ni->mi.sbi->cluster_bits;
1319	if (!log->clst_per_page)
1320		log->clst_per_page = 1;
1321
1322	log->first_page = major_ver >= 2 ? 0x22 * log->page_size :
1323					   4 * log->page_size;
1324	log->major_ver = major_ver;
1325	log->minor_ver = minor_ver;
1326}
1327
1328/*
1329 * log_create - Init @log in cases when we don't have a restart area to use.
1330 */
1331static void log_create(struct ntfs_log *log, const u64 last_lsn,
1332		       u32 open_log_count, bool wrapped, bool use_multi_page)
1333{
1334	/* All file offsets must be quadword aligned. */
1335	log->file_data_bits = blksize_bits(log->l_size) - 3;
1336	log->seq_num_mask = (8 << log->file_data_bits) - 1;
1337	log->seq_num_bits = sizeof(u64) * 8 - log->file_data_bits;
1338	log->seq_num = (last_lsn >> log->file_data_bits) + 2;
1339	log->next_page = log->first_page;
1340	log->oldest_lsn = log->seq_num << log->file_data_bits;
1341	log->oldest_lsn_off = 0;
1342	log->last_lsn = log->oldest_lsn;
1343
1344	log->l_flags |= NTFSLOG_NO_LAST_LSN | NTFSLOG_NO_OLDEST_LSN;
1345
1346	/* Set the correct flags for the I/O and indicate if we have wrapped. */
1347	if (wrapped)
1348		log->l_flags |= NTFSLOG_WRAPPED;
1349
1350	if (use_multi_page)
1351		log->l_flags |= NTFSLOG_MULTIPLE_PAGE_IO;
1352
1353	/* Compute the log page values. */
1354	log->data_off = ALIGN(
1355		offsetof(struct RECORD_PAGE_HDR, fixups) +
1356			sizeof(short) * ((log->page_size >> SECTOR_SHIFT) + 1),
1357		8);
1358	log->data_size = log->page_size - log->data_off;
1359	log->record_header_len = sizeof(struct LFS_RECORD_HDR);
1360
1361	/* Remember the different page sizes for reservation. */
1362	log->reserved = log->data_size - log->record_header_len;
1363
1364	/* Compute the restart page values. */
1365	log->ra_off = ALIGN(
1366		offsetof(struct RESTART_HDR, fixups) +
1367			sizeof(short) *
1368				((log->sys_page_size >> SECTOR_SHIFT) + 1),
1369		8);
1370	log->restart_size = log->sys_page_size - log->ra_off;
1371	log->ra_size = struct_size(log->ra, clients, 1);
1372	log->current_openlog_count = open_log_count;
1373
1374	/*
1375	 * The total available log file space is the number of
1376	 * log file pages times the space available on each page.
1377	 */
1378	log->total_avail_pages = log->l_size - log->first_page;
1379	log->total_avail = log->total_avail_pages >> log->page_bits;
1380
1381	/*
1382	 * We assume that we can't use the end of the page less than
1383	 * the file record size.
1384	 * Then we won't need to reserve more than the caller asks for.
1385	 */
1386	log->max_current_avail = log->total_avail * log->reserved;
1387	log->total_avail = log->total_avail * log->data_size;
1388	log->current_avail = log->max_current_avail;
1389}
1390
1391/*
1392 * log_create_ra - Fill a restart area from the values stored in @log.
1393 */
1394static struct RESTART_AREA *log_create_ra(struct ntfs_log *log)
1395{
1396	struct CLIENT_REC *cr;
1397	struct RESTART_AREA *ra = kzalloc(log->restart_size, GFP_NOFS);
1398
1399	if (!ra)
1400		return NULL;
1401
1402	ra->current_lsn = cpu_to_le64(log->last_lsn);
1403	ra->log_clients = cpu_to_le16(1);
1404	ra->client_idx[1] = LFS_NO_CLIENT_LE;
1405	if (log->l_flags & NTFSLOG_MULTIPLE_PAGE_IO)
1406		ra->flags = RESTART_SINGLE_PAGE_IO;
1407	ra->seq_num_bits = cpu_to_le32(log->seq_num_bits);
1408	ra->ra_len = cpu_to_le16(log->ra_size);
1409	ra->client_off = cpu_to_le16(offsetof(struct RESTART_AREA, clients));
1410	ra->l_size = cpu_to_le64(log->l_size);
1411	ra->rec_hdr_len = cpu_to_le16(log->record_header_len);
1412	ra->data_off = cpu_to_le16(log->data_off);
1413	ra->open_log_count = cpu_to_le32(log->current_openlog_count + 1);
1414
1415	cr = ra->clients;
1416
1417	cr->prev_client = LFS_NO_CLIENT_LE;
1418	cr->next_client = LFS_NO_CLIENT_LE;
1419
1420	return ra;
1421}
1422
1423static u32 final_log_off(struct ntfs_log *log, u64 lsn, u32 data_len)
1424{
1425	u32 base_vbo = lsn << 3;
1426	u32 final_log_off = (base_vbo & log->seq_num_mask) & ~log->page_mask;
1427	u32 page_off = base_vbo & log->page_mask;
1428	u32 tail = log->page_size - page_off;
1429
1430	page_off -= 1;
1431
1432	/* Add the length of the header. */
1433	data_len += log->record_header_len;
1434
1435	/*
1436	 * If this lsn is contained this log page we are done.
1437	 * Otherwise we need to walk through several log pages.
1438	 */
1439	if (data_len > tail) {
1440		data_len -= tail;
1441		tail = log->data_size;
1442		page_off = log->data_off - 1;
1443
1444		for (;;) {
1445			final_log_off = next_page_off(log, final_log_off);
1446
1447			/*
1448			 * We are done if the remaining bytes
1449			 * fit on this page.
1450			 */
1451			if (data_len <= tail)
1452				break;
1453			data_len -= tail;
1454		}
1455	}
1456
1457	/*
1458	 * We add the remaining bytes to our starting position on this page
1459	 * and then add that value to the file offset of this log page.
1460	 */
1461	return final_log_off + data_len + page_off;
1462}
1463
1464static int next_log_lsn(struct ntfs_log *log, const struct LFS_RECORD_HDR *rh,
1465			u64 *lsn)
1466{
1467	int err;
1468	u64 this_lsn = le64_to_cpu(rh->this_lsn);
1469	u32 vbo = lsn_to_vbo(log, this_lsn);
1470	u32 end =
1471		final_log_off(log, this_lsn, le32_to_cpu(rh->client_data_len));
1472	u32 hdr_off = end & ~log->sys_page_mask;
1473	u64 seq = this_lsn >> log->file_data_bits;
1474	struct RECORD_PAGE_HDR *page = NULL;
1475
1476	/* Remember if we wrapped. */
1477	if (end <= vbo)
1478		seq += 1;
1479
1480	/* Log page header for this page. */
1481	err = read_log_page(log, hdr_off, &page, NULL);
1482	if (err)
1483		return err;
1484
1485	/*
1486	 * If the lsn we were given was not the last lsn on this page,
1487	 * then the starting offset for the next lsn is on a quad word
1488	 * boundary following the last file offset for the current lsn.
1489	 * Otherwise the file offset is the start of the data on the next page.
1490	 */
1491	if (this_lsn == le64_to_cpu(page->rhdr.lsn)) {
1492		/* If we wrapped, we need to increment the sequence number. */
1493		hdr_off = next_page_off(log, hdr_off);
1494		if (hdr_off == log->first_page)
1495			seq += 1;
1496
1497		vbo = hdr_off + log->data_off;
1498	} else {
1499		vbo = ALIGN(end, 8);
1500	}
1501
1502	/* Compute the lsn based on the file offset and the sequence count. */
1503	*lsn = vbo_to_lsn(log, vbo, seq);
1504
1505	/*
1506	 * If this lsn is within the legal range for the file, we return true.
1507	 * Otherwise false indicates that there are no more lsn's.
1508	 */
1509	if (!is_lsn_in_file(log, *lsn))
1510		*lsn = 0;
1511
1512	kfree(page);
1513
1514	return 0;
1515}
1516
1517/*
1518 * current_log_avail - Calculate the number of bytes available for log records.
1519 */
1520static u32 current_log_avail(struct ntfs_log *log)
1521{
1522	u32 oldest_off, next_free_off, free_bytes;
1523
1524	if (log->l_flags & NTFSLOG_NO_LAST_LSN) {
1525		/* The entire file is available. */
1526		return log->max_current_avail;
1527	}
1528
1529	/*
1530	 * If there is a last lsn the restart area then we know that we will
1531	 * have to compute the free range.
1532	 * If there is no oldest lsn then start at the first page of the file.
1533	 */
1534	oldest_off = (log->l_flags & NTFSLOG_NO_OLDEST_LSN) ?
1535			     log->first_page :
1536			     (log->oldest_lsn_off & ~log->sys_page_mask);
1537
1538	/*
1539	 * We will use the next log page offset to compute the next free page.
1540	 * If we are going to reuse this page go to the next page.
1541	 * If we are at the first page then use the end of the file.
1542	 */
1543	next_free_off = (log->l_flags & NTFSLOG_REUSE_TAIL) ?
1544				log->next_page + log->page_size :
1545			log->next_page == log->first_page ? log->l_size :
1546							    log->next_page;
1547
1548	/* If the two offsets are the same then there is no available space. */
1549	if (oldest_off == next_free_off)
1550		return 0;
1551	/*
1552	 * If the free offset follows the oldest offset then subtract
1553	 * this range from the total available pages.
1554	 */
1555	free_bytes =
1556		oldest_off < next_free_off ?
1557			log->total_avail_pages - (next_free_off - oldest_off) :
1558			oldest_off - next_free_off;
1559
1560	free_bytes >>= log->page_bits;
1561	return free_bytes * log->reserved;
1562}
1563
1564static bool check_subseq_log_page(struct ntfs_log *log,
1565				  const struct RECORD_PAGE_HDR *rp, u32 vbo,
1566				  u64 seq)
1567{
1568	u64 lsn_seq;
1569	const struct NTFS_RECORD_HEADER *rhdr = &rp->rhdr;
1570	u64 lsn = le64_to_cpu(rhdr->lsn);
1571
1572	if (rhdr->sign == NTFS_FFFF_SIGNATURE || !rhdr->sign)
1573		return false;
1574
1575	/*
1576	 * If the last lsn on the page occurs was written after the page
1577	 * that caused the original error then we have a fatal error.
1578	 */
1579	lsn_seq = lsn >> log->file_data_bits;
1580
1581	/*
1582	 * If the sequence number for the lsn the page is equal or greater
1583	 * than lsn we expect, then this is a subsequent write.
1584	 */
1585	return lsn_seq >= seq ||
1586	       (lsn_seq == seq - 1 && log->first_page == vbo &&
1587		vbo != (lsn_to_vbo(log, lsn) & ~log->page_mask));
1588}
1589
1590/*
1591 * last_log_lsn
1592 *
1593 * Walks through the log pages for a file, searching for the
1594 * last log page written to the file.
1595 */
1596static int last_log_lsn(struct ntfs_log *log)
1597{
1598	int err;
1599	bool usa_error = false;
1600	bool replace_page = false;
1601	bool reuse_page = log->l_flags & NTFSLOG_REUSE_TAIL;
1602	bool wrapped_file, wrapped;
1603
1604	u32 page_cnt = 1, page_pos = 1;
1605	u32 page_off = 0, page_off1 = 0, saved_off = 0;
1606	u32 final_off, second_off, final_off_prev = 0, second_off_prev = 0;
1607	u32 first_file_off = 0, second_file_off = 0;
1608	u32 part_io_count = 0;
1609	u32 tails = 0;
1610	u32 this_off, curpage_off, nextpage_off, remain_pages;
1611
1612	u64 expected_seq, seq_base = 0, lsn_base = 0;
1613	u64 best_lsn, best_lsn1, best_lsn2;
1614	u64 lsn_cur, lsn1, lsn2;
1615	u64 last_ok_lsn = reuse_page ? log->last_lsn : 0;
1616
1617	u16 cur_pos, best_page_pos;
1618
1619	struct RECORD_PAGE_HDR *page = NULL;
1620	struct RECORD_PAGE_HDR *tst_page = NULL;
1621	struct RECORD_PAGE_HDR *first_tail = NULL;
1622	struct RECORD_PAGE_HDR *second_tail = NULL;
1623	struct RECORD_PAGE_HDR *tail_page = NULL;
1624	struct RECORD_PAGE_HDR *second_tail_prev = NULL;
1625	struct RECORD_PAGE_HDR *first_tail_prev = NULL;
1626	struct RECORD_PAGE_HDR *page_bufs = NULL;
1627	struct RECORD_PAGE_HDR *best_page;
1628
1629	if (log->major_ver >= 2) {
1630		final_off = 0x02 * log->page_size;
1631		second_off = 0x12 * log->page_size;
1632
1633		// 0x10 == 0x12 - 0x2
1634		page_bufs = kmalloc(log->page_size * 0x10, GFP_NOFS);
1635		if (!page_bufs)
1636			return -ENOMEM;
1637	} else {
1638		second_off = log->first_page - log->page_size;
1639		final_off = second_off - log->page_size;
1640	}
1641
1642next_tail:
1643	/* Read second tail page (at pos 3/0x12000). */
1644	if (read_log_page(log, second_off, &second_tail, &usa_error) ||
1645	    usa_error || second_tail->rhdr.sign != NTFS_RCRD_SIGNATURE) {
1646		kfree(second_tail);
1647		second_tail = NULL;
1648		second_file_off = 0;
1649		lsn2 = 0;
1650	} else {
1651		second_file_off = hdr_file_off(log, second_tail);
1652		lsn2 = le64_to_cpu(second_tail->record_hdr.last_end_lsn);
1653	}
1654
1655	/* Read first tail page (at pos 2/0x2000). */
1656	if (read_log_page(log, final_off, &first_tail, &usa_error) ||
1657	    usa_error || first_tail->rhdr.sign != NTFS_RCRD_SIGNATURE) {
1658		kfree(first_tail);
1659		first_tail = NULL;
1660		first_file_off = 0;
1661		lsn1 = 0;
1662	} else {
1663		first_file_off = hdr_file_off(log, first_tail);
1664		lsn1 = le64_to_cpu(first_tail->record_hdr.last_end_lsn);
1665	}
1666
1667	if (log->major_ver < 2) {
1668		int best_page;
1669
1670		first_tail_prev = first_tail;
1671		final_off_prev = first_file_off;
1672		second_tail_prev = second_tail;
1673		second_off_prev = second_file_off;
1674		tails = 1;
1675
1676		if (!first_tail && !second_tail)
1677			goto tail_read;
1678
1679		if (first_tail && second_tail)
1680			best_page = lsn1 < lsn2 ? 1 : 0;
1681		else if (first_tail)
1682			best_page = 0;
1683		else
1684			best_page = 1;
1685
1686		page_off = best_page ? second_file_off : first_file_off;
1687		seq_base = (best_page ? lsn2 : lsn1) >> log->file_data_bits;
1688		goto tail_read;
1689	}
1690
1691	best_lsn1 = first_tail ? base_lsn(log, first_tail, first_file_off) : 0;
1692	best_lsn2 = second_tail ? base_lsn(log, second_tail, second_file_off) :
1693				  0;
1694
1695	if (first_tail && second_tail) {
1696		if (best_lsn1 > best_lsn2) {
1697			best_lsn = best_lsn1;
1698			best_page = first_tail;
1699			this_off = first_file_off;
1700		} else {
1701			best_lsn = best_lsn2;
1702			best_page = second_tail;
1703			this_off = second_file_off;
1704		}
1705	} else if (first_tail) {
1706		best_lsn = best_lsn1;
1707		best_page = first_tail;
1708		this_off = first_file_off;
1709	} else if (second_tail) {
1710		best_lsn = best_lsn2;
1711		best_page = second_tail;
1712		this_off = second_file_off;
1713	} else {
1714		goto tail_read;
1715	}
1716
1717	best_page_pos = le16_to_cpu(best_page->page_pos);
1718
1719	if (!tails) {
1720		if (best_page_pos == page_pos) {
1721			seq_base = best_lsn >> log->file_data_bits;
1722			saved_off = page_off = le32_to_cpu(best_page->file_off);
1723			lsn_base = best_lsn;
1724
1725			memmove(page_bufs, best_page, log->page_size);
1726
1727			page_cnt = le16_to_cpu(best_page->page_count);
1728			if (page_cnt > 1)
1729				page_pos += 1;
1730
1731			tails = 1;
1732		}
1733	} else if (seq_base == (best_lsn >> log->file_data_bits) &&
1734		   saved_off + log->page_size == this_off &&
1735		   lsn_base < best_lsn &&
1736		   (page_pos != page_cnt || best_page_pos == page_pos ||
1737		    best_page_pos == 1) &&
1738		   (page_pos >= page_cnt || best_page_pos == page_pos)) {
1739		u16 bppc = le16_to_cpu(best_page->page_count);
1740
1741		saved_off += log->page_size;
1742		lsn_base = best_lsn;
1743
1744		memmove(Add2Ptr(page_bufs, tails * log->page_size), best_page,
1745			log->page_size);
1746
1747		tails += 1;
1748
1749		if (best_page_pos != bppc) {
1750			page_cnt = bppc;
1751			page_pos = best_page_pos;
1752
1753			if (page_cnt > 1)
1754				page_pos += 1;
1755		} else {
1756			page_pos = page_cnt = 1;
1757		}
1758	} else {
1759		kfree(first_tail);
1760		kfree(second_tail);
1761		goto tail_read;
1762	}
1763
1764	kfree(first_tail_prev);
1765	first_tail_prev = first_tail;
1766	final_off_prev = first_file_off;
1767	first_tail = NULL;
1768
1769	kfree(second_tail_prev);
1770	second_tail_prev = second_tail;
1771	second_off_prev = second_file_off;
1772	second_tail = NULL;
1773
1774	final_off += log->page_size;
1775	second_off += log->page_size;
1776
1777	if (tails < 0x10)
1778		goto next_tail;
1779tail_read:
1780	first_tail = first_tail_prev;
1781	final_off = final_off_prev;
1782
1783	second_tail = second_tail_prev;
1784	second_off = second_off_prev;
1785
1786	page_cnt = page_pos = 1;
1787
1788	curpage_off = seq_base == log->seq_num ? min(log->next_page, page_off) :
1789						 log->next_page;
1790
1791	wrapped_file =
1792		curpage_off == log->first_page &&
1793		!(log->l_flags & (NTFSLOG_NO_LAST_LSN | NTFSLOG_REUSE_TAIL));
1794
1795	expected_seq = wrapped_file ? (log->seq_num + 1) : log->seq_num;
1796
1797	nextpage_off = curpage_off;
1798
1799next_page:
1800	tail_page = NULL;
1801	/* Read the next log page. */
1802	err = read_log_page(log, curpage_off, &page, &usa_error);
1803
1804	/* Compute the next log page offset the file. */
1805	nextpage_off = next_page_off(log, curpage_off);
1806	wrapped = nextpage_off == log->first_page;
1807
1808	if (tails > 1) {
1809		struct RECORD_PAGE_HDR *cur_page =
1810			Add2Ptr(page_bufs, curpage_off - page_off);
1811
1812		if (curpage_off == saved_off) {
1813			tail_page = cur_page;
1814			goto use_tail_page;
1815		}
1816
1817		if (page_off > curpage_off || curpage_off >= saved_off)
1818			goto use_tail_page;
1819
1820		if (page_off1)
1821			goto use_cur_page;
1822
1823		if (!err && !usa_error &&
1824		    page->rhdr.sign == NTFS_RCRD_SIGNATURE &&
1825		    cur_page->rhdr.lsn == page->rhdr.lsn &&
1826		    cur_page->record_hdr.next_record_off ==
1827			    page->record_hdr.next_record_off &&
1828		    ((page_pos == page_cnt &&
1829		      le16_to_cpu(page->page_pos) == 1) ||
1830		     (page_pos != page_cnt &&
1831		      le16_to_cpu(page->page_pos) == page_pos + 1 &&
1832		      le16_to_cpu(page->page_count) == page_cnt))) {
1833			cur_page = NULL;
1834			goto use_tail_page;
1835		}
1836
1837		page_off1 = page_off;
1838
1839use_cur_page:
1840
1841		lsn_cur = le64_to_cpu(cur_page->rhdr.lsn);
1842
1843		if (last_ok_lsn !=
1844			    le64_to_cpu(cur_page->record_hdr.last_end_lsn) &&
1845		    ((lsn_cur >> log->file_data_bits) +
1846		     ((curpage_off <
1847		       (lsn_to_vbo(log, lsn_cur) & ~log->page_mask)) ?
1848			      1 :
1849			      0)) != expected_seq) {
1850			goto check_tail;
1851		}
1852
1853		if (!is_log_record_end(cur_page)) {
1854			tail_page = NULL;
1855			last_ok_lsn = lsn_cur;
1856			goto next_page_1;
1857		}
1858
1859		log->seq_num = expected_seq;
1860		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
1861		log->last_lsn = le64_to_cpu(cur_page->record_hdr.last_end_lsn);
1862		log->ra->current_lsn = cur_page->record_hdr.last_end_lsn;
1863
1864		if (log->record_header_len <=
1865		    log->page_size -
1866			    le16_to_cpu(cur_page->record_hdr.next_record_off)) {
1867			log->l_flags |= NTFSLOG_REUSE_TAIL;
1868			log->next_page = curpage_off;
1869		} else {
1870			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
1871			log->next_page = nextpage_off;
1872		}
1873
1874		if (wrapped_file)
1875			log->l_flags |= NTFSLOG_WRAPPED;
1876
1877		last_ok_lsn = le64_to_cpu(cur_page->record_hdr.last_end_lsn);
1878		goto next_page_1;
1879	}
1880
1881	/*
1882	 * If we are at the expected first page of a transfer check to see
1883	 * if either tail copy is at this offset.
1884	 * If this page is the last page of a transfer, check if we wrote
1885	 * a subsequent tail copy.
1886	 */
1887	if (page_cnt == page_pos || page_cnt == page_pos + 1) {
1888		/*
1889		 * Check if the offset matches either the first or second
1890		 * tail copy. It is possible it will match both.
1891		 */
1892		if (curpage_off == final_off)
1893			tail_page = first_tail;
1894
1895		/*
1896		 * If we already matched on the first page then
1897		 * check the ending lsn's.
1898		 */
1899		if (curpage_off == second_off) {
1900			if (!tail_page ||
1901			    (second_tail &&
1902			     le64_to_cpu(second_tail->record_hdr.last_end_lsn) >
1903				     le64_to_cpu(first_tail->record_hdr
1904							 .last_end_lsn))) {
1905				tail_page = second_tail;
1906			}
1907		}
1908	}
1909
1910use_tail_page:
1911	if (tail_page) {
1912		/* We have a candidate for a tail copy. */
1913		lsn_cur = le64_to_cpu(tail_page->record_hdr.last_end_lsn);
1914
1915		if (last_ok_lsn < lsn_cur) {
1916			/*
1917			 * If the sequence number is not expected,
1918			 * then don't use the tail copy.
1919			 */
1920			if (expected_seq != (lsn_cur >> log->file_data_bits))
1921				tail_page = NULL;
1922		} else if (last_ok_lsn > lsn_cur) {
1923			/*
1924			 * If the last lsn is greater than the one on
1925			 * this page then forget this tail.
1926			 */
1927			tail_page = NULL;
1928		}
1929	}
1930
1931	/*
1932	 *If we have an error on the current page,
1933	 * we will break of this loop.
1934	 */
1935	if (err || usa_error)
1936		goto check_tail;
1937
1938	/*
1939	 * Done if the last lsn on this page doesn't match the previous known
1940	 * last lsn or the sequence number is not expected.
1941	 */
1942	lsn_cur = le64_to_cpu(page->rhdr.lsn);
1943	if (last_ok_lsn != lsn_cur &&
1944	    expected_seq != (lsn_cur >> log->file_data_bits)) {
1945		goto check_tail;
1946	}
1947
1948	/*
1949	 * Check that the page position and page count values are correct.
1950	 * If this is the first page of a transfer the position must be 1
1951	 * and the count will be unknown.
1952	 */
1953	if (page_cnt == page_pos) {
1954		if (page->page_pos != cpu_to_le16(1) &&
1955		    (!reuse_page || page->page_pos != page->page_count)) {
1956			/*
1957			 * If the current page is the first page we are
1958			 * looking at and we are reusing this page then
1959			 * it can be either the first or last page of a
1960			 * transfer. Otherwise it can only be the first.
1961			 */
1962			goto check_tail;
1963		}
1964	} else if (le16_to_cpu(page->page_count) != page_cnt ||
1965		   le16_to_cpu(page->page_pos) != page_pos + 1) {
1966		/*
1967		 * The page position better be 1 more than the last page
1968		 * position and the page count better match.
1969		 */
1970		goto check_tail;
1971	}
1972
1973	/*
1974	 * We have a valid page the file and may have a valid page
1975	 * the tail copy area.
1976	 * If the tail page was written after the page the file then
1977	 * break of the loop.
1978	 */
1979	if (tail_page &&
1980	    le64_to_cpu(tail_page->record_hdr.last_end_lsn) > lsn_cur) {
1981		/* Remember if we will replace the page. */
1982		replace_page = true;
1983		goto check_tail;
1984	}
1985
1986	tail_page = NULL;
1987
1988	if (is_log_record_end(page)) {
1989		/*
1990		 * Since we have read this page we know the sequence number
1991		 * is the same as our expected value.
1992		 */
1993		log->seq_num = expected_seq;
1994		log->last_lsn = le64_to_cpu(page->record_hdr.last_end_lsn);
1995		log->ra->current_lsn = page->record_hdr.last_end_lsn;
1996		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
1997
1998		/*
1999		 * If there is room on this page for another header then
2000		 * remember we want to reuse the page.
2001		 */
2002		if (log->record_header_len <=
2003		    log->page_size -
2004			    le16_to_cpu(page->record_hdr.next_record_off)) {
2005			log->l_flags |= NTFSLOG_REUSE_TAIL;
2006			log->next_page = curpage_off;
2007		} else {
2008			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
2009			log->next_page = nextpage_off;
2010		}
2011
2012		/* Remember if we wrapped the log file. */
2013		if (wrapped_file)
2014			log->l_flags |= NTFSLOG_WRAPPED;
2015	}
2016
2017	/*
2018	 * Remember the last page count and position.
2019	 * Also remember the last known lsn.
2020	 */
2021	page_cnt = le16_to_cpu(page->page_count);
2022	page_pos = le16_to_cpu(page->page_pos);
2023	last_ok_lsn = le64_to_cpu(page->rhdr.lsn);
2024
2025next_page_1:
2026
2027	if (wrapped) {
2028		expected_seq += 1;
2029		wrapped_file = 1;
2030	}
2031
2032	curpage_off = nextpage_off;
2033	kfree(page);
2034	page = NULL;
2035	reuse_page = 0;
2036	goto next_page;
2037
2038check_tail:
2039	if (tail_page) {
2040		log->seq_num = expected_seq;
2041		log->last_lsn = le64_to_cpu(tail_page->record_hdr.last_end_lsn);
2042		log->ra->current_lsn = tail_page->record_hdr.last_end_lsn;
2043		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
2044
2045		if (log->page_size -
2046			    le16_to_cpu(
2047				    tail_page->record_hdr.next_record_off) >=
2048		    log->record_header_len) {
2049			log->l_flags |= NTFSLOG_REUSE_TAIL;
2050			log->next_page = curpage_off;
2051		} else {
2052			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
2053			log->next_page = nextpage_off;
2054		}
2055
2056		if (wrapped)
2057			log->l_flags |= NTFSLOG_WRAPPED;
2058	}
2059
2060	/* Remember that the partial IO will start at the next page. */
2061	second_off = nextpage_off;
2062
2063	/*
2064	 * If the next page is the first page of the file then update
2065	 * the sequence number for log records which begon the next page.
2066	 */
2067	if (wrapped)
2068		expected_seq += 1;
2069
2070	/*
2071	 * If we have a tail copy or are performing single page I/O we can
2072	 * immediately look at the next page.
2073	 */
2074	if (replace_page || (log->ra->flags & RESTART_SINGLE_PAGE_IO)) {
2075		page_cnt = 2;
2076		page_pos = 1;
2077		goto check_valid;
2078	}
2079
2080	if (page_pos != page_cnt)
2081		goto check_valid;
2082	/*
2083	 * If the next page causes us to wrap to the beginning of the log
2084	 * file then we know which page to check next.
2085	 */
2086	if (wrapped) {
2087		page_cnt = 2;
2088		page_pos = 1;
2089		goto check_valid;
2090	}
2091
2092	cur_pos = 2;
2093
2094next_test_page:
2095	kfree(tst_page);
2096	tst_page = NULL;
2097
2098	/* Walk through the file, reading log pages. */
2099	err = read_log_page(log, nextpage_off, &tst_page, &usa_error);
2100
2101	/*
2102	 * If we get a USA error then assume that we correctly found
2103	 * the end of the original transfer.
2104	 */
2105	if (usa_error)
2106		goto file_is_valid;
2107
2108	/*
2109	 * If we were able to read the page, we examine it to see if it
2110	 * is the same or different Io block.
2111	 */
2112	if (err)
2113		goto next_test_page_1;
2114
2115	if (le16_to_cpu(tst_page->page_pos) == cur_pos &&
2116	    check_subseq_log_page(log, tst_page, nextpage_off, expected_seq)) {
2117		page_cnt = le16_to_cpu(tst_page->page_count) + 1;
2118		page_pos = le16_to_cpu(tst_page->page_pos);
2119		goto check_valid;
2120	} else {
2121		goto file_is_valid;
2122	}
2123
2124next_test_page_1:
2125
2126	nextpage_off = next_page_off(log, curpage_off);
2127	wrapped = nextpage_off == log->first_page;
2128
2129	if (wrapped) {
2130		expected_seq += 1;
2131		page_cnt = 2;
2132		page_pos = 1;
2133	}
2134
2135	cur_pos += 1;
2136	part_io_count += 1;
2137	if (!wrapped)
2138		goto next_test_page;
2139
2140check_valid:
2141	/* Skip over the remaining pages this transfer. */
2142	remain_pages = page_cnt - page_pos - 1;
2143	part_io_count += remain_pages;
2144
2145	while (remain_pages--) {
2146		nextpage_off = next_page_off(log, curpage_off);
2147		wrapped = nextpage_off == log->first_page;
2148
2149		if (wrapped)
2150			expected_seq += 1;
2151	}
2152
2153	/* Call our routine to check this log page. */
2154	kfree(tst_page);
2155	tst_page = NULL;
2156
2157	err = read_log_page(log, nextpage_off, &tst_page, &usa_error);
2158	if (!err && !usa_error &&
2159	    check_subseq_log_page(log, tst_page, nextpage_off, expected_seq)) {
2160		err = -EINVAL;
2161		goto out;
2162	}
2163
2164file_is_valid:
2165
2166	/* We have a valid file. */
2167	if (page_off1 || tail_page) {
2168		struct RECORD_PAGE_HDR *tmp_page;
2169
2170		if (sb_rdonly(log->ni->mi.sbi->sb)) {
2171			err = -EROFS;
2172			goto out;
2173		}
2174
2175		if (page_off1) {
2176			tmp_page = Add2Ptr(page_bufs, page_off1 - page_off);
2177			tails -= (page_off1 - page_off) / log->page_size;
2178			if (!tail_page)
2179				tails -= 1;
2180		} else {
2181			tmp_page = tail_page;
2182			tails = 1;
2183		}
2184
2185		while (tails--) {
2186			u64 off = hdr_file_off(log, tmp_page);
2187
2188			if (!page) {
2189				page = kmalloc(log->page_size, GFP_NOFS);
2190				if (!page) {
2191					err = -ENOMEM;
2192					goto out;
2193				}
2194			}
2195
2196			/*
2197			 * Correct page and copy the data from this page
2198			 * into it and flush it to disk.
2199			 */
2200			memcpy(page, tmp_page, log->page_size);
2201
2202			/* Fill last flushed lsn value flush the page. */
2203			if (log->major_ver < 2)
2204				page->rhdr.lsn = page->record_hdr.last_end_lsn;
2205			else
2206				page->file_off = 0;
2207
2208			page->page_pos = page->page_count = cpu_to_le16(1);
2209
2210			ntfs_fix_pre_write(&page->rhdr, log->page_size);
2211
2212			err = ntfs_sb_write_run(log->ni->mi.sbi,
2213						&log->ni->file.run, off, page,
2214						log->page_size, 0);
2215
2216			if (err)
2217				goto out;
2218
2219			if (part_io_count && second_off == off) {
2220				second_off += log->page_size;
2221				part_io_count -= 1;
2222			}
2223
2224			tmp_page = Add2Ptr(tmp_page, log->page_size);
2225		}
2226	}
2227
2228	if (part_io_count) {
2229		if (sb_rdonly(log->ni->mi.sbi->sb)) {
2230			err = -EROFS;
2231			goto out;
2232		}
2233	}
2234
2235out:
2236	kfree(second_tail);
2237	kfree(first_tail);
2238	kfree(page);
2239	kfree(tst_page);
2240	kfree(page_bufs);
2241
2242	return err;
2243}
2244
2245/*
2246 * read_log_rec_buf - Copy a log record from the file to a buffer.
2247 *
2248 * The log record may span several log pages and may even wrap the file.
2249 */
2250static int read_log_rec_buf(struct ntfs_log *log,
2251			    const struct LFS_RECORD_HDR *rh, void *buffer)
2252{
2253	int err;
2254	struct RECORD_PAGE_HDR *ph = NULL;
2255	u64 lsn = le64_to_cpu(rh->this_lsn);
2256	u32 vbo = lsn_to_vbo(log, lsn) & ~log->page_mask;
2257	u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;
2258	u32 data_len = le32_to_cpu(rh->client_data_len);
2259
2260	/*
2261	 * While there are more bytes to transfer,
2262	 * we continue to attempt to perform the read.
2263	 */
2264	for (;;) {
2265		bool usa_error;
2266		u32 tail = log->page_size - off;
2267
2268		if (tail >= data_len)
2269			tail = data_len;
2270
2271		data_len -= tail;
2272
2273		err = read_log_page(log, vbo, &ph, &usa_error);
2274		if (err)
2275			goto out;
2276
2277		/*
2278		 * The last lsn on this page better be greater or equal
2279		 * to the lsn we are copying.
2280		 */
2281		if (lsn > le64_to_cpu(ph->rhdr.lsn)) {
2282			err = -EINVAL;
2283			goto out;
2284		}
2285
2286		memcpy(buffer, Add2Ptr(ph, off), tail);
2287
2288		/* If there are no more bytes to transfer, we exit the loop. */
2289		if (!data_len) {
2290			if (!is_log_record_end(ph) ||
2291			    lsn > le64_to_cpu(ph->record_hdr.last_end_lsn)) {
2292				err = -EINVAL;
2293				goto out;
2294			}
2295			break;
2296		}
2297
2298		if (ph->rhdr.lsn == ph->record_hdr.last_end_lsn ||
2299		    lsn > le64_to_cpu(ph->rhdr.lsn)) {
2300			err = -EINVAL;
2301			goto out;
2302		}
2303
2304		vbo = next_page_off(log, vbo);
2305		off = log->data_off;
2306
2307		/*
2308		 * Adjust our pointer the user's buffer to transfer
2309		 * the next block to.
2310		 */
2311		buffer = Add2Ptr(buffer, tail);
2312	}
2313
2314out:
2315	kfree(ph);
2316	return err;
2317}
2318
2319static int read_rst_area(struct ntfs_log *log, struct NTFS_RESTART **rst_,
2320			 u64 *lsn)
2321{
2322	int err;
2323	struct LFS_RECORD_HDR *rh = NULL;
2324	const struct CLIENT_REC *cr =
2325		Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off));
2326	u64 lsnr, lsnc = le64_to_cpu(cr->restart_lsn);
2327	u32 len;
2328	struct NTFS_RESTART *rst;
2329
2330	*lsn = 0;
2331	*rst_ = NULL;
2332
2333	/* If the client doesn't have a restart area, go ahead and exit now. */
2334	if (!lsnc)
2335		return 0;
2336
2337	err = read_log_page(log, lsn_to_vbo(log, lsnc),
2338			    (struct RECORD_PAGE_HDR **)&rh, NULL);
2339	if (err)
2340		return err;
2341
2342	rst = NULL;
2343	lsnr = le64_to_cpu(rh->this_lsn);
2344
2345	if (lsnc != lsnr) {
2346		/* If the lsn values don't match, then the disk is corrupt. */
2347		err = -EINVAL;
2348		goto out;
2349	}
2350
2351	*lsn = lsnr;
2352	len = le32_to_cpu(rh->client_data_len);
2353
2354	if (!len) {
2355		err = 0;
2356		goto out;
2357	}
2358
2359	if (len < sizeof(struct NTFS_RESTART)) {
2360		err = -EINVAL;
2361		goto out;
2362	}
2363
2364	rst = kmalloc(len, GFP_NOFS);
2365	if (!rst) {
2366		err = -ENOMEM;
2367		goto out;
2368	}
2369
2370	/* Copy the data into the 'rst' buffer. */
2371	err = read_log_rec_buf(log, rh, rst);
2372	if (err)
2373		goto out;
2374
2375	*rst_ = rst;
2376	rst = NULL;
2377
2378out:
2379	kfree(rh);
2380	kfree(rst);
2381
2382	return err;
2383}
2384
2385static int find_log_rec(struct ntfs_log *log, u64 lsn, struct lcb *lcb)
2386{
2387	int err;
2388	struct LFS_RECORD_HDR *rh = lcb->lrh;
2389	u32 rec_len, len;
2390
2391	/* Read the record header for this lsn. */
2392	if (!rh) {
2393		err = read_log_page(log, lsn_to_vbo(log, lsn),
2394				    (struct RECORD_PAGE_HDR **)&rh, NULL);
2395
2396		lcb->lrh = rh;
2397		if (err)
2398			return err;
2399	}
2400
2401	/*
2402	 * If the lsn the log record doesn't match the desired
2403	 * lsn then the disk is corrupt.
2404	 */
2405	if (lsn != le64_to_cpu(rh->this_lsn))
2406		return -EINVAL;
2407
2408	len = le32_to_cpu(rh->client_data_len);
2409
2410	/*
2411	 * Check that the length field isn't greater than the total
2412	 * available space the log file.
2413	 */
2414	rec_len = len + log->record_header_len;
2415	if (rec_len >= log->total_avail)
2416		return -EINVAL;
2417
2418	/*
2419	 * If the entire log record is on this log page,
2420	 * put a pointer to the log record the context block.
2421	 */
2422	if (rh->flags & LOG_RECORD_MULTI_PAGE) {
2423		void *lr = kmalloc(len, GFP_NOFS);
2424
2425		if (!lr)
2426			return -ENOMEM;
2427
2428		lcb->log_rec = lr;
2429		lcb->alloc = true;
2430
2431		/* Copy the data into the buffer returned. */
2432		err = read_log_rec_buf(log, rh, lr);
2433		if (err)
2434			return err;
2435	} else {
2436		/* If beyond the end of the current page -> an error. */
2437		u32 page_off = lsn_to_page_off(log, lsn);
2438
2439		if (page_off + len + log->record_header_len > log->page_size)
2440			return -EINVAL;
2441
2442		lcb->log_rec = Add2Ptr(rh, sizeof(struct LFS_RECORD_HDR));
2443		lcb->alloc = false;
2444	}
2445
2446	return 0;
2447}
2448
2449/*
2450 * read_log_rec_lcb - Init the query operation.
2451 */
2452static int read_log_rec_lcb(struct ntfs_log *log, u64 lsn, u32 ctx_mode,
2453			    struct lcb **lcb_)
2454{
2455	int err;
2456	const struct CLIENT_REC *cr;
2457	struct lcb *lcb;
2458
2459	switch (ctx_mode) {
2460	case lcb_ctx_undo_next:
2461	case lcb_ctx_prev:
2462	case lcb_ctx_next:
2463		break;
2464	default:
2465		return -EINVAL;
2466	}
2467
2468	/* Check that the given lsn is the legal range for this client. */
2469	cr = Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off));
2470
2471	if (!verify_client_lsn(log, cr, lsn))
2472		return -EINVAL;
2473
2474	lcb = kzalloc(sizeof(struct lcb), GFP_NOFS);
2475	if (!lcb)
2476		return -ENOMEM;
2477	lcb->client = log->client_id;
2478	lcb->ctx_mode = ctx_mode;
2479
2480	/* Find the log record indicated by the given lsn. */
2481	err = find_log_rec(log, lsn, lcb);
2482	if (err)
2483		goto out;
2484
2485	*lcb_ = lcb;
2486	return 0;
2487
2488out:
2489	lcb_put(lcb);
2490	*lcb_ = NULL;
2491	return err;
2492}
2493
2494/*
2495 * find_client_next_lsn
2496 *
2497 * Attempt to find the next lsn to return to a client based on the context mode.
2498 */
2499static int find_client_next_lsn(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
2500{
2501	int err;
2502	u64 next_lsn;
2503	struct LFS_RECORD_HDR *hdr;
2504
2505	hdr = lcb->lrh;
2506	*lsn = 0;
2507
2508	if (lcb_ctx_next != lcb->ctx_mode)
2509		goto check_undo_next;
2510
2511	/* Loop as long as another lsn can be found. */
2512	for (;;) {
2513		u64 current_lsn;
2514
2515		err = next_log_lsn(log, hdr, &current_lsn);
2516		if (err)
2517			goto out;
2518
2519		if (!current_lsn)
2520			break;
2521
2522		if (hdr != lcb->lrh)
2523			kfree(hdr);
2524
2525		hdr = NULL;
2526		err = read_log_page(log, lsn_to_vbo(log, current_lsn),
2527				    (struct RECORD_PAGE_HDR **)&hdr, NULL);
2528		if (err)
2529			goto out;
2530
2531		if (memcmp(&hdr->client, &lcb->client,
2532			   sizeof(struct CLIENT_ID))) {
2533			/*err = -EINVAL; */
2534		} else if (LfsClientRecord == hdr->record_type) {
2535			kfree(lcb->lrh);
2536			lcb->lrh = hdr;
2537			*lsn = current_lsn;
2538			return 0;
2539		}
2540	}
2541
2542out:
2543	if (hdr != lcb->lrh)
2544		kfree(hdr);
2545	return err;
2546
2547check_undo_next:
2548	if (lcb_ctx_undo_next == lcb->ctx_mode)
2549		next_lsn = le64_to_cpu(hdr->client_undo_next_lsn);
2550	else if (lcb_ctx_prev == lcb->ctx_mode)
2551		next_lsn = le64_to_cpu(hdr->client_prev_lsn);
2552	else
2553		return 0;
2554
2555	if (!next_lsn)
2556		return 0;
2557
2558	if (!verify_client_lsn(
2559		    log, Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off)),
2560		    next_lsn))
2561		return 0;
2562
2563	hdr = NULL;
2564	err = read_log_page(log, lsn_to_vbo(log, next_lsn),
2565			    (struct RECORD_PAGE_HDR **)&hdr, NULL);
2566	if (err)
2567		return err;
2568	kfree(lcb->lrh);
2569	lcb->lrh = hdr;
2570
2571	*lsn = next_lsn;
2572
2573	return 0;
2574}
2575
2576static int read_next_log_rec(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
2577{
2578	int err;
2579
2580	err = find_client_next_lsn(log, lcb, lsn);
2581	if (err)
2582		return err;
2583
2584	if (!*lsn)
2585		return 0;
2586
2587	if (lcb->alloc)
2588		kfree(lcb->log_rec);
2589
2590	lcb->log_rec = NULL;
2591	lcb->alloc = false;
2592	kfree(lcb->lrh);
2593	lcb->lrh = NULL;
2594
2595	return find_log_rec(log, *lsn, lcb);
2596}
2597
2598bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes)
2599{
2600	__le16 mask;
2601	u32 min_de, de_off, used, total;
2602	const struct NTFS_DE *e;
2603
2604	if (hdr_has_subnode(hdr)) {
2605		min_de = sizeof(struct NTFS_DE) + sizeof(u64);
2606		mask = NTFS_IE_HAS_SUBNODES;
2607	} else {
2608		min_de = sizeof(struct NTFS_DE);
2609		mask = 0;
2610	}
2611
2612	de_off = le32_to_cpu(hdr->de_off);
2613	used = le32_to_cpu(hdr->used);
2614	total = le32_to_cpu(hdr->total);
2615
2616	if (de_off > bytes - min_de || used > bytes || total > bytes ||
2617	    de_off + min_de > used || used > total) {
2618		return false;
2619	}
2620
2621	e = Add2Ptr(hdr, de_off);
2622	for (;;) {
2623		u16 esize = le16_to_cpu(e->size);
2624		struct NTFS_DE *next = Add2Ptr(e, esize);
2625
2626		if (esize < min_de || PtrOffset(hdr, next) > used ||
2627		    (e->flags & NTFS_IE_HAS_SUBNODES) != mask) {
2628			return false;
2629		}
2630
2631		if (de_is_last(e))
2632			break;
2633
2634		e = next;
2635	}
2636
2637	return true;
2638}
2639
2640static inline bool check_index_buffer(const struct INDEX_BUFFER *ib, u32 bytes)
2641{
2642	u16 fo;
2643	const struct NTFS_RECORD_HEADER *r = &ib->rhdr;
2644
2645	if (r->sign != NTFS_INDX_SIGNATURE)
2646		return false;
2647
2648	fo = (SECTOR_SIZE - ((bytes >> SECTOR_SHIFT) + 1) * sizeof(short));
2649
2650	if (le16_to_cpu(r->fix_off) > fo)
2651		return false;
2652
2653	if ((le16_to_cpu(r->fix_num) - 1) * SECTOR_SIZE != bytes)
2654		return false;
2655
2656	return check_index_header(&ib->ihdr,
2657				  bytes - offsetof(struct INDEX_BUFFER, ihdr));
2658}
2659
2660static inline bool check_index_root(const struct ATTRIB *attr,
2661				    struct ntfs_sb_info *sbi)
2662{
2663	bool ret;
2664	const struct INDEX_ROOT *root = resident_data(attr);
2665	u8 index_bits = le32_to_cpu(root->index_block_size) >=
2666					sbi->cluster_size ?
2667				sbi->cluster_bits :
2668				SECTOR_SHIFT;
2669	u8 block_clst = root->index_block_clst;
2670
2671	if (le32_to_cpu(attr->res.data_size) < sizeof(struct INDEX_ROOT) ||
2672	    (root->type != ATTR_NAME && root->type != ATTR_ZERO) ||
2673	    (root->type == ATTR_NAME &&
2674	     root->rule != NTFS_COLLATION_TYPE_FILENAME) ||
2675	    (le32_to_cpu(root->index_block_size) !=
2676	     (block_clst << index_bits)) ||
2677	    (block_clst != 1 && block_clst != 2 && block_clst != 4 &&
2678	     block_clst != 8 && block_clst != 0x10 && block_clst != 0x20 &&
2679	     block_clst != 0x40 && block_clst != 0x80)) {
2680		return false;
2681	}
2682
2683	ret = check_index_header(&root->ihdr,
2684				 le32_to_cpu(attr->res.data_size) -
2685					 offsetof(struct INDEX_ROOT, ihdr));
2686	return ret;
2687}
2688
2689static inline bool check_attr(const struct MFT_REC *rec,
2690			      const struct ATTRIB *attr,
2691			      struct ntfs_sb_info *sbi)
2692{
2693	u32 asize = le32_to_cpu(attr->size);
2694	u32 rsize = 0;
2695	u64 dsize, svcn, evcn;
2696	u16 run_off;
2697
2698	/* Check the fixed part of the attribute record header. */
2699	if (asize >= sbi->record_size ||
2700	    asize + PtrOffset(rec, attr) >= sbi->record_size ||
2701	    (attr->name_len &&
2702	     le16_to_cpu(attr->name_off) + attr->name_len * sizeof(short) >
2703		     asize)) {
2704		return false;
2705	}
2706
2707	/* Check the attribute fields. */
2708	switch (attr->non_res) {
2709	case 0:
2710		rsize = le32_to_cpu(attr->res.data_size);
2711		if (rsize >= asize ||
2712		    le16_to_cpu(attr->res.data_off) + rsize > asize) {
2713			return false;
2714		}
2715		break;
2716
2717	case 1:
2718		dsize = le64_to_cpu(attr->nres.data_size);
2719		svcn = le64_to_cpu(attr->nres.svcn);
2720		evcn = le64_to_cpu(attr->nres.evcn);
2721		run_off = le16_to_cpu(attr->nres.run_off);
2722
2723		if (svcn > evcn + 1 || run_off >= asize ||
2724		    le64_to_cpu(attr->nres.valid_size) > dsize ||
2725		    dsize > le64_to_cpu(attr->nres.alloc_size)) {
2726			return false;
2727		}
2728
2729		if (run_off > asize)
2730			return false;
2731
2732		if (run_unpack(NULL, sbi, 0, svcn, evcn, svcn,
2733			       Add2Ptr(attr, run_off), asize - run_off) < 0) {
2734			return false;
2735		}
2736
2737		return true;
2738
2739	default:
2740		return false;
2741	}
2742
2743	switch (attr->type) {
2744	case ATTR_NAME:
2745		if (fname_full_size(Add2Ptr(
2746			    attr, le16_to_cpu(attr->res.data_off))) > asize) {
2747			return false;
2748		}
2749		break;
2750
2751	case ATTR_ROOT:
2752		return check_index_root(attr, sbi);
2753
2754	case ATTR_STD:
2755		if (rsize < sizeof(struct ATTR_STD_INFO5) &&
2756		    rsize != sizeof(struct ATTR_STD_INFO)) {
2757			return false;
2758		}
2759		break;
2760
2761	case ATTR_LIST:
2762	case ATTR_ID:
2763	case ATTR_SECURE:
2764	case ATTR_LABEL:
2765	case ATTR_VOL_INFO:
2766	case ATTR_DATA:
2767	case ATTR_ALLOC:
2768	case ATTR_BITMAP:
2769	case ATTR_REPARSE:
2770	case ATTR_EA_INFO:
2771	case ATTR_EA:
2772	case ATTR_PROPERTYSET:
2773	case ATTR_LOGGED_UTILITY_STREAM:
2774		break;
2775
2776	default:
2777		return false;
2778	}
2779
2780	return true;
2781}
2782
2783static inline bool check_file_record(const struct MFT_REC *rec,
2784				     const struct MFT_REC *rec2,
2785				     struct ntfs_sb_info *sbi)
2786{
2787	const struct ATTRIB *attr;
2788	u16 fo = le16_to_cpu(rec->rhdr.fix_off);
2789	u16 fn = le16_to_cpu(rec->rhdr.fix_num);
2790	u16 ao = le16_to_cpu(rec->attr_off);
2791	u32 rs = sbi->record_size;
2792
2793	/* Check the file record header for consistency. */
2794	if (rec->rhdr.sign != NTFS_FILE_SIGNATURE ||
2795	    fo > (SECTOR_SIZE - ((rs >> SECTOR_SHIFT) + 1) * sizeof(short)) ||
2796	    (fn - 1) * SECTOR_SIZE != rs || ao < MFTRECORD_FIXUP_OFFSET_1 ||
2797	    ao > sbi->record_size - SIZEOF_RESIDENT || !is_rec_inuse(rec) ||
2798	    le32_to_cpu(rec->total) != rs) {
2799		return false;
2800	}
2801
2802	/* Loop to check all of the attributes. */
2803	for (attr = Add2Ptr(rec, ao); attr->type != ATTR_END;
2804	     attr = Add2Ptr(attr, le32_to_cpu(attr->size))) {
2805		if (check_attr(rec, attr, sbi))
2806			continue;
2807		return false;
2808	}
2809
2810	return true;
2811}
2812
2813static inline int check_lsn(const struct NTFS_RECORD_HEADER *hdr,
2814			    const u64 *rlsn)
2815{
2816	u64 lsn;
2817
2818	if (!rlsn)
2819		return true;
2820
2821	lsn = le64_to_cpu(hdr->lsn);
2822
2823	if (hdr->sign == NTFS_HOLE_SIGNATURE)
2824		return false;
2825
2826	if (*rlsn > lsn)
2827		return true;
2828
2829	return false;
2830}
2831
2832static inline bool check_if_attr(const struct MFT_REC *rec,
2833				 const struct LOG_REC_HDR *lrh)
2834{
2835	u16 ro = le16_to_cpu(lrh->record_off);
2836	u16 o = le16_to_cpu(rec->attr_off);
2837	const struct ATTRIB *attr = Add2Ptr(rec, o);
2838
2839	while (o < ro) {
2840		u32 asize;
2841
2842		if (attr->type == ATTR_END)
2843			break;
2844
2845		asize = le32_to_cpu(attr->size);
2846		if (!asize)
2847			break;
2848
2849		o += asize;
2850		attr = Add2Ptr(attr, asize);
2851	}
2852
2853	return o == ro;
2854}
2855
2856static inline bool check_if_index_root(const struct MFT_REC *rec,
2857				       const struct LOG_REC_HDR *lrh)
2858{
2859	u16 ro = le16_to_cpu(lrh->record_off);
2860	u16 o = le16_to_cpu(rec->attr_off);
2861	const struct ATTRIB *attr = Add2Ptr(rec, o);
2862
2863	while (o < ro) {
2864		u32 asize;
2865
2866		if (attr->type == ATTR_END)
2867			break;
2868
2869		asize = le32_to_cpu(attr->size);
2870		if (!asize)
2871			break;
2872
2873		o += asize;
2874		attr = Add2Ptr(attr, asize);
2875	}
2876
2877	return o == ro && attr->type == ATTR_ROOT;
2878}
2879
2880static inline bool check_if_root_index(const struct ATTRIB *attr,
2881				       const struct INDEX_HDR *hdr,
2882				       const struct LOG_REC_HDR *lrh)
2883{
2884	u16 ao = le16_to_cpu(lrh->attr_off);
2885	u32 de_off = le32_to_cpu(hdr->de_off);
2886	u32 o = PtrOffset(attr, hdr) + de_off;
2887	const struct NTFS_DE *e = Add2Ptr(hdr, de_off);
2888	u32 asize = le32_to_cpu(attr->size);
2889
2890	while (o < ao) {
2891		u16 esize;
2892
2893		if (o >= asize)
2894			break;
2895
2896		esize = le16_to_cpu(e->size);
2897		if (!esize)
2898			break;
2899
2900		o += esize;
2901		e = Add2Ptr(e, esize);
2902	}
2903
2904	return o == ao;
2905}
2906
2907static inline bool check_if_alloc_index(const struct INDEX_HDR *hdr,
2908					u32 attr_off)
2909{
2910	u32 de_off = le32_to_cpu(hdr->de_off);
2911	u32 o = offsetof(struct INDEX_BUFFER, ihdr) + de_off;
2912	const struct NTFS_DE *e = Add2Ptr(hdr, de_off);
2913	u32 used = le32_to_cpu(hdr->used);
2914
2915	while (o < attr_off) {
2916		u16 esize;
2917
2918		if (de_off >= used)
2919			break;
2920
2921		esize = le16_to_cpu(e->size);
2922		if (!esize)
2923			break;
2924
2925		o += esize;
2926		de_off += esize;
2927		e = Add2Ptr(e, esize);
2928	}
2929
2930	return o == attr_off;
2931}
2932
2933static inline void change_attr_size(struct MFT_REC *rec, struct ATTRIB *attr,
2934				    u32 nsize)
2935{
2936	u32 asize = le32_to_cpu(attr->size);
2937	int dsize = nsize - asize;
2938	u8 *next = Add2Ptr(attr, asize);
2939	u32 used = le32_to_cpu(rec->used);
2940
2941	memmove(Add2Ptr(attr, nsize), next, used - PtrOffset(rec, next));
2942
2943	rec->used = cpu_to_le32(used + dsize);
2944	attr->size = cpu_to_le32(nsize);
2945}
2946
2947struct OpenAttr {
2948	struct ATTRIB *attr;
2949	struct runs_tree *run1;
2950	struct runs_tree run0;
2951	struct ntfs_inode *ni;
2952	// CLST rno;
2953};
2954
2955/*
2956 * cmp_type_and_name
2957 *
2958 * Return: 0 if 'attr' has the same type and name.
2959 */
2960static inline int cmp_type_and_name(const struct ATTRIB *a1,
2961				    const struct ATTRIB *a2)
2962{
2963	return a1->type != a2->type || a1->name_len != a2->name_len ||
2964	       (a1->name_len && memcmp(attr_name(a1), attr_name(a2),
2965				       a1->name_len * sizeof(short)));
2966}
2967
2968static struct OpenAttr *find_loaded_attr(struct ntfs_log *log,
2969					 const struct ATTRIB *attr, CLST rno)
2970{
2971	struct OPEN_ATTR_ENRTY *oe = NULL;
2972
2973	while ((oe = enum_rstbl(log->open_attr_tbl, oe))) {
2974		struct OpenAttr *op_attr;
2975
2976		if (ino_get(&oe->ref) != rno)
2977			continue;
2978
2979		op_attr = (struct OpenAttr *)oe->ptr;
2980		if (!cmp_type_and_name(op_attr->attr, attr))
2981			return op_attr;
2982	}
2983	return NULL;
2984}
2985
2986static struct ATTRIB *attr_create_nonres_log(struct ntfs_sb_info *sbi,
2987					     enum ATTR_TYPE type, u64 size,
2988					     const u16 *name, size_t name_len,
2989					     __le16 flags)
2990{
2991	struct ATTRIB *attr;
2992	u32 name_size = ALIGN(name_len * sizeof(short), 8);
2993	bool is_ext = flags & (ATTR_FLAG_COMPRESSED | ATTR_FLAG_SPARSED);
2994	u32 asize = name_size +
2995		    (is_ext ? SIZEOF_NONRESIDENT_EX : SIZEOF_NONRESIDENT);
2996
2997	attr = kzalloc(asize, GFP_NOFS);
2998	if (!attr)
2999		return NULL;
3000
3001	attr->type = type;
3002	attr->size = cpu_to_le32(asize);
3003	attr->flags = flags;
3004	attr->non_res = 1;
3005	attr->name_len = name_len;
3006
3007	attr->nres.evcn = cpu_to_le64((u64)bytes_to_cluster(sbi, size) - 1);
3008	attr->nres.alloc_size = cpu_to_le64(ntfs_up_cluster(sbi, size));
3009	attr->nres.data_size = cpu_to_le64(size);
3010	attr->nres.valid_size = attr->nres.data_size;
3011	if (is_ext) {
3012		attr->name_off = SIZEOF_NONRESIDENT_EX_LE;
3013		if (is_attr_compressed(attr))
3014			attr->nres.c_unit = NTFS_LZNT_CUNIT;
3015
3016		attr->nres.run_off =
3017			cpu_to_le16(SIZEOF_NONRESIDENT_EX + name_size);
3018		memcpy(Add2Ptr(attr, SIZEOF_NONRESIDENT_EX), name,
3019		       name_len * sizeof(short));
3020	} else {
3021		attr->name_off = SIZEOF_NONRESIDENT_LE;
3022		attr->nres.run_off =
3023			cpu_to_le16(SIZEOF_NONRESIDENT + name_size);
3024		memcpy(Add2Ptr(attr, SIZEOF_NONRESIDENT), name,
3025		       name_len * sizeof(short));
3026	}
3027
3028	return attr;
3029}
3030
3031/*
3032 * do_action - Common routine for the Redo and Undo Passes.
3033 * @rlsn: If it is NULL then undo.
3034 */
3035static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
3036		     const struct LOG_REC_HDR *lrh, u32 op, void *data,
3037		     u32 dlen, u32 rec_len, const u64 *rlsn)
3038{
3039	int err = 0;
3040	struct ntfs_sb_info *sbi = log->ni->mi.sbi;
3041	struct inode *inode = NULL, *inode_parent;
3042	struct mft_inode *mi = NULL, *mi2_child = NULL;
3043	CLST rno = 0, rno_base = 0;
3044	struct INDEX_BUFFER *ib = NULL;
3045	struct MFT_REC *rec = NULL;
3046	struct ATTRIB *attr = NULL, *attr2;
3047	struct INDEX_HDR *hdr;
3048	struct INDEX_ROOT *root;
3049	struct NTFS_DE *e, *e1, *e2;
3050	struct NEW_ATTRIBUTE_SIZES *new_sz;
3051	struct ATTR_FILE_NAME *fname;
3052	struct OpenAttr *oa, *oa2;
3053	u32 nsize, t32, asize, used, esize, off, bits;
3054	u16 id, id2;
3055	u32 record_size = sbi->record_size;
3056	u64 t64;
3057	u16 roff = le16_to_cpu(lrh->record_off);
3058	u16 aoff = le16_to_cpu(lrh->attr_off);
3059	u64 lco = 0;
3060	u64 cbo = (u64)le16_to_cpu(lrh->cluster_off) << SECTOR_SHIFT;
3061	u64 tvo = le64_to_cpu(lrh->target_vcn) << sbi->cluster_bits;
3062	u64 vbo = cbo + tvo;
3063	void *buffer_le = NULL;
3064	u32 bytes = 0;
3065	bool a_dirty = false;
3066	u16 data_off;
3067
3068	oa = oe->ptr;
3069
3070	/* Big switch to prepare. */
3071	switch (op) {
3072	/* ============================================================
3073	 * Process MFT records, as described by the current log record.
3074	 * ============================================================
3075	 */
3076	case InitializeFileRecordSegment:
3077	case DeallocateFileRecordSegment:
3078	case WriteEndOfFileRecordSegment:
3079	case CreateAttribute:
3080	case DeleteAttribute:
3081	case UpdateResidentValue:
3082	case UpdateMappingPairs:
3083	case SetNewAttributeSizes:
3084	case AddIndexEntryRoot:
3085	case DeleteIndexEntryRoot:
3086	case SetIndexEntryVcnRoot:
3087	case UpdateFileNameRoot:
3088	case UpdateRecordDataRoot:
3089	case ZeroEndOfFileRecord:
3090		rno = vbo >> sbi->record_bits;
3091		inode = ilookup(sbi->sb, rno);
3092		if (inode) {
3093			mi = &ntfs_i(inode)->mi;
3094		} else if (op == InitializeFileRecordSegment) {
3095			mi = kzalloc(sizeof(struct mft_inode), GFP_NOFS);
3096			if (!mi)
3097				return -ENOMEM;
3098			err = mi_format_new(mi, sbi, rno, 0, false);
3099			if (err)
3100				goto out;
3101		} else {
3102			/* Read from disk. */
3103			err = mi_get(sbi, rno, &mi);
3104			if (err)
3105				return err;
3106		}
3107		rec = mi->mrec;
3108
3109		if (op == DeallocateFileRecordSegment)
3110			goto skip_load_parent;
3111
3112		if (InitializeFileRecordSegment != op) {
3113			if (rec->rhdr.sign == NTFS_BAAD_SIGNATURE)
3114				goto dirty_vol;
3115			if (!check_lsn(&rec->rhdr, rlsn))
3116				goto out;
3117			if (!check_file_record(rec, NULL, sbi))
3118				goto dirty_vol;
3119			attr = Add2Ptr(rec, roff);
3120		}
3121
3122		if (is_rec_base(rec) || InitializeFileRecordSegment == op) {
3123			rno_base = rno;
3124			goto skip_load_parent;
3125		}
3126
3127		rno_base = ino_get(&rec->parent_ref);
3128		inode_parent = ntfs_iget5(sbi->sb, &rec->parent_ref, NULL);
3129		if (IS_ERR(inode_parent))
3130			goto skip_load_parent;
3131
3132		if (is_bad_inode(inode_parent)) {
3133			iput(inode_parent);
3134			goto skip_load_parent;
3135		}
3136
3137		if (ni_load_mi_ex(ntfs_i(inode_parent), rno, &mi2_child)) {
3138			iput(inode_parent);
3139		} else {
3140			if (mi2_child->mrec != mi->mrec)
3141				memcpy(mi2_child->mrec, mi->mrec,
3142				       sbi->record_size);
3143
3144			if (inode)
3145				iput(inode);
3146			else if (mi)
3147				mi_put(mi);
3148
3149			inode = inode_parent;
3150			mi = mi2_child;
3151			rec = mi2_child->mrec;
3152			attr = Add2Ptr(rec, roff);
3153		}
3154
3155skip_load_parent:
3156		inode_parent = NULL;
3157		break;
3158
3159	/*
3160	 * Process attributes, as described by the current log record.
3161	 */
3162	case UpdateNonresidentValue:
3163	case AddIndexEntryAllocation:
3164	case DeleteIndexEntryAllocation:
3165	case WriteEndOfIndexBuffer:
3166	case SetIndexEntryVcnAllocation:
3167	case UpdateFileNameAllocation:
3168	case SetBitsInNonresidentBitMap:
3169	case ClearBitsInNonresidentBitMap:
3170	case UpdateRecordDataAllocation:
3171		attr = oa->attr;
3172		bytes = UpdateNonresidentValue == op ? dlen : 0;
3173		lco = (u64)le16_to_cpu(lrh->lcns_follow) << sbi->cluster_bits;
3174
3175		if (attr->type == ATTR_ALLOC) {
3176			t32 = le32_to_cpu(oe->bytes_per_index);
3177			if (bytes < t32)
3178				bytes = t32;
3179		}
3180
3181		if (!bytes)
3182			bytes = lco - cbo;
3183
3184		bytes += roff;
3185		if (attr->type == ATTR_ALLOC)
3186			bytes = (bytes + 511) & ~511; // align
3187
3188		buffer_le = kmalloc(bytes, GFP_NOFS);
3189		if (!buffer_le)
3190			return -ENOMEM;
3191
3192		err = ntfs_read_run_nb(sbi, oa->run1, vbo, buffer_le, bytes,
3193				       NULL);
3194		if (err)
3195			goto out;
3196
3197		if (attr->type == ATTR_ALLOC && *(int *)buffer_le)
3198			ntfs_fix_post_read(buffer_le, bytes, false);
3199		break;
3200
3201	default:
3202		WARN_ON(1);
3203	}
3204
3205	/* Big switch to do operation. */
3206	switch (op) {
3207	case InitializeFileRecordSegment:
3208		if (roff + dlen > record_size)
3209			goto dirty_vol;
3210
3211		memcpy(Add2Ptr(rec, roff), data, dlen);
3212		mi->dirty = true;
3213		break;
3214
3215	case DeallocateFileRecordSegment:
3216		clear_rec_inuse(rec);
3217		le16_add_cpu(&rec->seq, 1);
3218		mi->dirty = true;
3219		break;
3220
3221	case WriteEndOfFileRecordSegment:
3222		attr2 = (struct ATTRIB *)data;
3223		if (!check_if_attr(rec, lrh) || roff + dlen > record_size)
3224			goto dirty_vol;
3225
3226		memmove(attr, attr2, dlen);
3227		rec->used = cpu_to_le32(ALIGN(roff + dlen, 8));
3228
3229		mi->dirty = true;
3230		break;
3231
3232	case CreateAttribute:
3233		attr2 = (struct ATTRIB *)data;
3234		asize = le32_to_cpu(attr2->size);
3235		used = le32_to_cpu(rec->used);
3236
3237		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
3238		    !IS_ALIGNED(asize, 8) ||
3239		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
3240		    dlen > record_size - used) {
3241			goto dirty_vol;
3242		}
3243
3244		memmove(Add2Ptr(attr, asize), attr, used - roff);
3245		memcpy(attr, attr2, asize);
3246
3247		rec->used = cpu_to_le32(used + asize);
3248		id = le16_to_cpu(rec->next_attr_id);
3249		id2 = le16_to_cpu(attr2->id);
3250		if (id <= id2)
3251			rec->next_attr_id = cpu_to_le16(id2 + 1);
3252		if (is_attr_indexed(attr))
3253			le16_add_cpu(&rec->hard_links, 1);
3254
3255		oa2 = find_loaded_attr(log, attr, rno_base);
3256		if (oa2) {
3257			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3258					   GFP_NOFS);
3259			if (p2) {
3260				// run_close(oa2->run1);
3261				kfree(oa2->attr);
3262				oa2->attr = p2;
3263			}
3264		}
3265
3266		mi->dirty = true;
3267		break;
3268
3269	case DeleteAttribute:
3270		asize = le32_to_cpu(attr->size);
3271		used = le32_to_cpu(rec->used);
3272
3273		if (!check_if_attr(rec, lrh))
3274			goto dirty_vol;
3275
3276		rec->used = cpu_to_le32(used - asize);
3277		if (is_attr_indexed(attr))
3278			le16_add_cpu(&rec->hard_links, -1);
3279
3280		memmove(attr, Add2Ptr(attr, asize), used - asize - roff);
3281
3282		mi->dirty = true;
3283		break;
3284
3285	case UpdateResidentValue:
3286		nsize = aoff + dlen;
3287
3288		if (!check_if_attr(rec, lrh))
3289			goto dirty_vol;
3290
3291		asize = le32_to_cpu(attr->size);
3292		used = le32_to_cpu(rec->used);
3293
3294		if (lrh->redo_len == lrh->undo_len) {
3295			if (nsize > asize)
3296				goto dirty_vol;
3297			goto move_data;
3298		}
3299
3300		if (nsize > asize && nsize - asize > record_size - used)
3301			goto dirty_vol;
3302
3303		nsize = ALIGN(nsize, 8);
3304		data_off = le16_to_cpu(attr->res.data_off);
3305
3306		if (nsize < asize) {
3307			memmove(Add2Ptr(attr, aoff), data, dlen);
3308			data = NULL; // To skip below memmove().
3309		}
3310
3311		memmove(Add2Ptr(attr, nsize), Add2Ptr(attr, asize),
3312			used - le16_to_cpu(lrh->record_off) - asize);
3313
3314		rec->used = cpu_to_le32(used + nsize - asize);
3315		attr->size = cpu_to_le32(nsize);
3316		attr->res.data_size = cpu_to_le32(aoff + dlen - data_off);
3317
3318move_data:
3319		if (data)
3320			memmove(Add2Ptr(attr, aoff), data, dlen);
3321
3322		oa2 = find_loaded_attr(log, attr, rno_base);
3323		if (oa2) {
3324			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3325					   GFP_NOFS);
3326			if (p2) {
3327				// run_close(&oa2->run0);
3328				oa2->run1 = &oa2->run0;
3329				kfree(oa2->attr);
3330				oa2->attr = p2;
3331			}
3332		}
3333
3334		mi->dirty = true;
3335		break;
3336
3337	case UpdateMappingPairs:
3338		nsize = aoff + dlen;
3339		asize = le32_to_cpu(attr->size);
3340		used = le32_to_cpu(rec->used);
3341
3342		if (!check_if_attr(rec, lrh) || !attr->non_res ||
3343		    aoff < le16_to_cpu(attr->nres.run_off) || aoff > asize ||
3344		    (nsize > asize && nsize - asize > record_size - used)) {
3345			goto dirty_vol;
3346		}
3347
3348		nsize = ALIGN(nsize, 8);
3349
3350		memmove(Add2Ptr(attr, nsize), Add2Ptr(attr, asize),
3351			used - le16_to_cpu(lrh->record_off) - asize);
3352		rec->used = cpu_to_le32(used + nsize - asize);
3353		attr->size = cpu_to_le32(nsize);
3354		memmove(Add2Ptr(attr, aoff), data, dlen);
3355
3356		if (run_get_highest_vcn(le64_to_cpu(attr->nres.svcn),
3357					attr_run(attr), &t64)) {
3358			goto dirty_vol;
3359		}
3360
3361		attr->nres.evcn = cpu_to_le64(t64);
3362		oa2 = find_loaded_attr(log, attr, rno_base);
3363		if (oa2 && oa2->attr->non_res)
3364			oa2->attr->nres.evcn = attr->nres.evcn;
3365
3366		mi->dirty = true;
3367		break;
3368
3369	case SetNewAttributeSizes:
3370		new_sz = data;
3371		if (!check_if_attr(rec, lrh) || !attr->non_res)
3372			goto dirty_vol;
3373
3374		attr->nres.alloc_size = new_sz->alloc_size;
3375		attr->nres.data_size = new_sz->data_size;
3376		attr->nres.valid_size = new_sz->valid_size;
3377
3378		if (dlen >= sizeof(struct NEW_ATTRIBUTE_SIZES))
3379			attr->nres.total_size = new_sz->total_size;
3380
3381		oa2 = find_loaded_attr(log, attr, rno_base);
3382		if (oa2) {
3383			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3384					   GFP_NOFS);
3385			if (p2) {
3386				kfree(oa2->attr);
3387				oa2->attr = p2;
3388			}
3389		}
3390		mi->dirty = true;
3391		break;
3392
3393	case AddIndexEntryRoot:
3394		e = (struct NTFS_DE *)data;
3395		esize = le16_to_cpu(e->size);
3396		root = resident_data(attr);
3397		hdr = &root->ihdr;
3398		used = le32_to_cpu(hdr->used);
3399
3400		if (!check_if_index_root(rec, lrh) ||
3401		    !check_if_root_index(attr, hdr, lrh) ||
3402		    Add2Ptr(data, esize) > Add2Ptr(lrh, rec_len) ||
3403		    esize > le32_to_cpu(rec->total) - le32_to_cpu(rec->used)) {
3404			goto dirty_vol;
3405		}
3406
3407		e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3408
3409		change_attr_size(rec, attr, le32_to_cpu(attr->size) + esize);
3410
3411		memmove(Add2Ptr(e1, esize), e1,
3412			PtrOffset(e1, Add2Ptr(hdr, used)));
3413		memmove(e1, e, esize);
3414
3415		le32_add_cpu(&attr->res.data_size, esize);
3416		hdr->used = cpu_to_le32(used + esize);
3417		le32_add_cpu(&hdr->total, esize);
3418
3419		mi->dirty = true;
3420		break;
3421
3422	case DeleteIndexEntryRoot:
3423		root = resident_data(attr);
3424		hdr = &root->ihdr;
3425		used = le32_to_cpu(hdr->used);
3426
3427		if (!check_if_index_root(rec, lrh) ||
3428		    !check_if_root_index(attr, hdr, lrh)) {
3429			goto dirty_vol;
3430		}
3431
3432		e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3433		esize = le16_to_cpu(e1->size);
3434		e2 = Add2Ptr(e1, esize);
3435
3436		memmove(e1, e2, PtrOffset(e2, Add2Ptr(hdr, used)));
3437
3438		le32_sub_cpu(&attr->res.data_size, esize);
3439		hdr->used = cpu_to_le32(used - esize);
3440		le32_sub_cpu(&hdr->total, esize);
3441
3442		change_attr_size(rec, attr, le32_to_cpu(attr->size) - esize);
3443
3444		mi->dirty = true;
3445		break;
3446
3447	case SetIndexEntryVcnRoot:
3448		root = resident_data(attr);
3449		hdr = &root->ihdr;
3450
3451		if (!check_if_index_root(rec, lrh) ||
3452		    !check_if_root_index(attr, hdr, lrh)) {
3453			goto dirty_vol;
3454		}
3455
3456		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3457
3458		de_set_vbn_le(e, *(__le64 *)data);
3459		mi->dirty = true;
3460		break;
3461
3462	case UpdateFileNameRoot:
3463		root = resident_data(attr);
3464		hdr = &root->ihdr;
3465
3466		if (!check_if_index_root(rec, lrh) ||
3467		    !check_if_root_index(attr, hdr, lrh)) {
3468			goto dirty_vol;
3469		}
3470
3471		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3472		fname = (struct ATTR_FILE_NAME *)(e + 1);
3473		memmove(&fname->dup, data, sizeof(fname->dup)); //
3474		mi->dirty = true;
3475		break;
3476
3477	case UpdateRecordDataRoot:
3478		root = resident_data(attr);
3479		hdr = &root->ihdr;
3480
3481		if (!check_if_index_root(rec, lrh) ||
3482		    !check_if_root_index(attr, hdr, lrh)) {
3483			goto dirty_vol;
3484		}
3485
3486		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3487
3488		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
3489
3490		mi->dirty = true;
3491		break;
3492
3493	case ZeroEndOfFileRecord:
3494		if (roff + dlen > record_size)
3495			goto dirty_vol;
3496
3497		memset(attr, 0, dlen);
3498		mi->dirty = true;
3499		break;
3500
3501	case UpdateNonresidentValue:
3502		if (lco < cbo + roff + dlen)
3503			goto dirty_vol;
3504
3505		memcpy(Add2Ptr(buffer_le, roff), data, dlen);
3506
3507		a_dirty = true;
3508		if (attr->type == ATTR_ALLOC)
3509			ntfs_fix_pre_write(buffer_le, bytes);
3510		break;
3511
3512	case AddIndexEntryAllocation:
3513		ib = Add2Ptr(buffer_le, roff);
3514		hdr = &ib->ihdr;
3515		e = data;
3516		esize = le16_to_cpu(e->size);
3517		e1 = Add2Ptr(ib, aoff);
3518
3519		if (is_baad(&ib->rhdr))
3520			goto dirty_vol;
3521		if (!check_lsn(&ib->rhdr, rlsn))
3522			goto out;
3523
3524		used = le32_to_cpu(hdr->used);
3525
3526		if (!check_index_buffer(ib, bytes) ||
3527		    !check_if_alloc_index(hdr, aoff) ||
3528		    Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||
3529		    used + esize > le32_to_cpu(hdr->total)) {
3530			goto dirty_vol;
3531		}
3532
3533		memmove(Add2Ptr(e1, esize), e1,
3534			PtrOffset(e1, Add2Ptr(hdr, used)));
3535		memcpy(e1, e, esize);
3536
3537		hdr->used = cpu_to_le32(used + esize);
3538
3539		a_dirty = true;
3540
3541		ntfs_fix_pre_write(&ib->rhdr, bytes);
3542		break;
3543
3544	case DeleteIndexEntryAllocation:
3545		ib = Add2Ptr(buffer_le, roff);
3546		hdr = &ib->ihdr;
3547		e = Add2Ptr(ib, aoff);
3548		esize = le16_to_cpu(e->size);
3549
3550		if (is_baad(&ib->rhdr))
3551			goto dirty_vol;
3552		if (!check_lsn(&ib->rhdr, rlsn))
3553			goto out;
3554
3555		if (!check_index_buffer(ib, bytes) ||
3556		    !check_if_alloc_index(hdr, aoff)) {
3557			goto dirty_vol;
3558		}
3559
3560		e1 = Add2Ptr(e, esize);
3561		nsize = esize;
3562		used = le32_to_cpu(hdr->used);
3563
3564		memmove(e, e1, PtrOffset(e1, Add2Ptr(hdr, used)));
3565
3566		hdr->used = cpu_to_le32(used - nsize);
3567
3568		a_dirty = true;
3569
3570		ntfs_fix_pre_write(&ib->rhdr, bytes);
3571		break;
3572
3573	case WriteEndOfIndexBuffer:
3574		ib = Add2Ptr(buffer_le, roff);
3575		hdr = &ib->ihdr;
3576		e = Add2Ptr(ib, aoff);
3577
3578		if (is_baad(&ib->rhdr))
3579			goto dirty_vol;
3580		if (!check_lsn(&ib->rhdr, rlsn))
3581			goto out;
3582		if (!check_index_buffer(ib, bytes) ||
3583		    !check_if_alloc_index(hdr, aoff) ||
3584		    aoff + dlen > offsetof(struct INDEX_BUFFER, ihdr) +
3585					  le32_to_cpu(hdr->total)) {
3586			goto dirty_vol;
3587		}
3588
3589		hdr->used = cpu_to_le32(dlen + PtrOffset(hdr, e));
3590		memmove(e, data, dlen);
3591
3592		a_dirty = true;
3593		ntfs_fix_pre_write(&ib->rhdr, bytes);
3594		break;
3595
3596	case SetIndexEntryVcnAllocation:
3597		ib = Add2Ptr(buffer_le, roff);
3598		hdr = &ib->ihdr;
3599		e = Add2Ptr(ib, aoff);
3600
3601		if (is_baad(&ib->rhdr))
3602			goto dirty_vol;
3603
3604		if (!check_lsn(&ib->rhdr, rlsn))
3605			goto out;
3606		if (!check_index_buffer(ib, bytes) ||
3607		    !check_if_alloc_index(hdr, aoff)) {
3608			goto dirty_vol;
3609		}
3610
3611		de_set_vbn_le(e, *(__le64 *)data);
3612
3613		a_dirty = true;
3614		ntfs_fix_pre_write(&ib->rhdr, bytes);
3615		break;
3616
3617	case UpdateFileNameAllocation:
3618		ib = Add2Ptr(buffer_le, roff);
3619		hdr = &ib->ihdr;
3620		e = Add2Ptr(ib, aoff);
3621
3622		if (is_baad(&ib->rhdr))
3623			goto dirty_vol;
3624
3625		if (!check_lsn(&ib->rhdr, rlsn))
3626			goto out;
3627		if (!check_index_buffer(ib, bytes) ||
3628		    !check_if_alloc_index(hdr, aoff)) {
3629			goto dirty_vol;
3630		}
3631
3632		fname = (struct ATTR_FILE_NAME *)(e + 1);
3633		memmove(&fname->dup, data, sizeof(fname->dup));
3634
3635		a_dirty = true;
3636		ntfs_fix_pre_write(&ib->rhdr, bytes);
3637		break;
3638
3639	case SetBitsInNonresidentBitMap:
3640		off = le32_to_cpu(((struct BITMAP_RANGE *)data)->bitmap_off);
3641		bits = le32_to_cpu(((struct BITMAP_RANGE *)data)->bits);
3642
3643		if (cbo + (off + 7) / 8 > lco ||
3644		    cbo + ((off + bits + 7) / 8) > lco) {
3645			goto dirty_vol;
3646		}
3647
3648		ntfs_bitmap_set_le(Add2Ptr(buffer_le, roff), off, bits);
3649		a_dirty = true;
3650		break;
3651
3652	case ClearBitsInNonresidentBitMap:
3653		off = le32_to_cpu(((struct BITMAP_RANGE *)data)->bitmap_off);
3654		bits = le32_to_cpu(((struct BITMAP_RANGE *)data)->bits);
3655
3656		if (cbo + (off + 7) / 8 > lco ||
3657		    cbo + ((off + bits + 7) / 8) > lco) {
3658			goto dirty_vol;
3659		}
3660
3661		ntfs_bitmap_clear_le(Add2Ptr(buffer_le, roff), off, bits);
3662		a_dirty = true;
3663		break;
3664
3665	case UpdateRecordDataAllocation:
3666		ib = Add2Ptr(buffer_le, roff);
3667		hdr = &ib->ihdr;
3668		e = Add2Ptr(ib, aoff);
3669
3670		if (is_baad(&ib->rhdr))
3671			goto dirty_vol;
3672
3673		if (!check_lsn(&ib->rhdr, rlsn))
3674			goto out;
3675		if (!check_index_buffer(ib, bytes) ||
3676		    !check_if_alloc_index(hdr, aoff)) {
3677			goto dirty_vol;
3678		}
3679
3680		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
3681
3682		a_dirty = true;
3683		ntfs_fix_pre_write(&ib->rhdr, bytes);
3684		break;
3685
3686	default:
3687		WARN_ON(1);
3688	}
3689
3690	if (rlsn) {
3691		__le64 t64 = cpu_to_le64(*rlsn);
3692
3693		if (rec)
3694			rec->rhdr.lsn = t64;
3695		if (ib)
3696			ib->rhdr.lsn = t64;
3697	}
3698
3699	if (mi && mi->dirty) {
3700		err = mi_write(mi, 0);
3701		if (err)
3702			goto out;
3703	}
3704
3705	if (a_dirty) {
3706		attr = oa->attr;
3707		err = ntfs_sb_write_run(sbi, oa->run1, vbo, buffer_le, bytes,
3708					0);
3709		if (err)
3710			goto out;
3711	}
3712
3713out:
3714
3715	if (inode)
3716		iput(inode);
3717	else if (mi != mi2_child)
3718		mi_put(mi);
3719
3720	kfree(buffer_le);
3721
3722	return err;
3723
3724dirty_vol:
3725	log->set_dirty = true;
3726	goto out;
3727}
3728
3729/*
3730 * log_replay - Replays log and empties it.
3731 *
3732 * This function is called during mount operation.
3733 * It replays log and empties it.
3734 * Initialized is set false if logfile contains '-1'.
3735 */
3736int log_replay(struct ntfs_inode *ni, bool *initialized)
3737{
3738	int err;
3739	struct ntfs_sb_info *sbi = ni->mi.sbi;
3740	struct ntfs_log *log;
3741
3742	u64 rec_lsn, checkpt_lsn = 0, rlsn = 0;
3743	struct ATTR_NAME_ENTRY *attr_names = NULL;
3744	u32 attr_names_bytes = 0;
3745	u32 oatbl_bytes = 0;
3746	struct RESTART_TABLE *dptbl = NULL;
3747	struct RESTART_TABLE *trtbl = NULL;
3748	const struct RESTART_TABLE *rt;
3749	struct RESTART_TABLE *oatbl = NULL;
3750	struct inode *inode;
3751	struct OpenAttr *oa;
3752	struct ntfs_inode *ni_oe;
3753	struct ATTRIB *attr = NULL;
3754	u64 size, vcn, undo_next_lsn;
3755	CLST rno, lcn, lcn0, len0, clen;
3756	void *data;
3757	struct NTFS_RESTART *rst = NULL;
3758	struct lcb *lcb = NULL;
3759	struct OPEN_ATTR_ENRTY *oe;
3760	struct ATTR_NAME_ENTRY *ane;
3761	struct TRANSACTION_ENTRY *tr;
3762	struct DIR_PAGE_ENTRY *dp;
3763	u32 i, bytes_per_attr_entry;
3764	u32 vbo, tail, off, dlen;
3765	u32 saved_len, rec_len, transact_id;
3766	bool use_second_page;
3767	struct RESTART_AREA *ra2, *ra = NULL;
3768	struct CLIENT_REC *ca, *cr;
3769	__le16 client;
3770	struct RESTART_HDR *rh;
3771	const struct LFS_RECORD_HDR *frh;
3772	const struct LOG_REC_HDR *lrh;
3773	bool is_mapped;
3774	bool is_ro = sb_rdonly(sbi->sb);
3775	u64 t64;
3776	u16 t16;
3777	u32 t32;
3778
3779	log = kzalloc(sizeof(struct ntfs_log), GFP_NOFS);
3780	if (!log)
3781		return -ENOMEM;
3782
3783	log->ni = ni;
3784	log->l_size = log->orig_file_size = ni->vfs_inode.i_size;
3785
3786	/* Get the size of page. NOTE: To replay we can use default page. */
3787#if PAGE_SIZE >= DefaultLogPageSize && PAGE_SIZE <= DefaultLogPageSize * 2
3788	log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, true);
3789#else
3790	log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, false);
3791#endif
3792	if (!log->page_size) {
3793		err = -EINVAL;
3794		goto out;
3795	}
3796
3797	log->one_page_buf = kmalloc(log->page_size, GFP_NOFS);
3798	if (!log->one_page_buf) {
3799		err = -ENOMEM;
3800		goto out;
3801	}
3802
3803	log->page_mask = log->page_size - 1;
3804	log->page_bits = blksize_bits(log->page_size);
3805
3806	/* Look for a restart area on the disk. */
3807	err = log_read_rst(log, true, &log->rst_info);
3808	if (err)
3809		goto out;
3810
3811	/* remember 'initialized' */
3812	*initialized = log->rst_info.initialized;
3813
3814	if (!log->rst_info.restart) {
3815		if (log->rst_info.initialized) {
3816			/* No restart area but the file is not initialized. */
3817			err = -EINVAL;
3818			goto out;
3819		}
3820
3821		log_init_pg_hdr(log, 1, 1);
3822		log_create(log, 0, get_random_u32(), false, false);
3823
3824		ra = log_create_ra(log);
3825		if (!ra) {
3826			err = -ENOMEM;
3827			goto out;
3828		}
3829		log->ra = ra;
3830		log->init_ra = true;
3831
3832		goto process_log;
3833	}
3834
3835	/*
3836	 * If the restart offset above wasn't zero then we won't
3837	 * look for a second restart.
3838	 */
3839	if (log->rst_info.vbo)
3840		goto check_restart_area;
3841
3842	err = log_read_rst(log, false, &log->rst_info2);
3843	if (err)
3844		goto out;
3845
3846	/* Determine which restart area to use. */
3847	if (!log->rst_info2.restart ||
3848	    log->rst_info2.last_lsn <= log->rst_info.last_lsn)
3849		goto use_first_page;
3850
3851	use_second_page = true;
3852
3853	if (log->rst_info.chkdsk_was_run &&
3854	    log->page_size != log->rst_info.vbo) {
3855		struct RECORD_PAGE_HDR *sp = NULL;
3856		bool usa_error;
3857
3858		if (!read_log_page(log, log->page_size, &sp, &usa_error) &&
3859		    sp->rhdr.sign == NTFS_CHKD_SIGNATURE) {
3860			use_second_page = false;
3861		}
3862		kfree(sp);
3863	}
3864
3865	if (use_second_page) {
3866		kfree(log->rst_info.r_page);
3867		memcpy(&log->rst_info, &log->rst_info2,
3868		       sizeof(struct restart_info));
3869		log->rst_info2.r_page = NULL;
3870	}
3871
3872use_first_page:
3873	kfree(log->rst_info2.r_page);
3874
3875check_restart_area:
3876	/*
3877	 * If the restart area is at offset 0, we want
3878	 * to write the second restart area first.
3879	 */
3880	log->init_ra = !!log->rst_info.vbo;
3881
3882	/* If we have a valid page then grab a pointer to the restart area. */
3883	ra2 = log->rst_info.valid_page ?
3884		      Add2Ptr(log->rst_info.r_page,
3885			      le16_to_cpu(log->rst_info.r_page->ra_off)) :
3886		      NULL;
3887
3888	if (log->rst_info.chkdsk_was_run ||
3889	    (ra2 && ra2->client_idx[1] == LFS_NO_CLIENT_LE)) {
3890		bool wrapped = false;
3891		bool use_multi_page = false;
3892		u32 open_log_count;
3893
3894		/* Do some checks based on whether we have a valid log page. */
3895		open_log_count = log->rst_info.valid_page ?
3896					 le32_to_cpu(ra2->open_log_count) :
3897					 get_random_u32();
3898
3899		log_init_pg_hdr(log, 1, 1);
3900
3901		log_create(log, log->rst_info.last_lsn, open_log_count, wrapped,
3902			   use_multi_page);
3903
3904		ra = log_create_ra(log);
3905		if (!ra) {
3906			err = -ENOMEM;
3907			goto out;
3908		}
3909		log->ra = ra;
3910
3911		/* Put the restart areas and initialize
3912		 * the log file as required.
3913		 */
3914		goto process_log;
3915	}
3916
3917	if (!ra2) {
3918		err = -EINVAL;
3919		goto out;
3920	}
3921
3922	/*
3923	 * If the log page or the system page sizes have changed, we can't
3924	 * use the log file. We must use the system page size instead of the
3925	 * default size if there is not a clean shutdown.
3926	 */
3927	t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);
3928	if (log->page_size != t32) {
3929		log->l_size = log->orig_file_size;
3930		log->page_size = norm_file_page(t32, &log->l_size,
3931						t32 == DefaultLogPageSize);
3932	}
3933
3934	if (log->page_size != t32 ||
3935	    log->page_size != le32_to_cpu(log->rst_info.r_page->page_size)) {
3936		err = -EINVAL;
3937		goto out;
3938	}
3939
3940	log->page_mask = log->page_size - 1;
3941	log->page_bits = blksize_bits(log->page_size);
3942
3943	/* If the file size has shrunk then we won't mount it. */
3944	if (log->l_size < le64_to_cpu(ra2->l_size)) {
3945		err = -EINVAL;
3946		goto out;
3947	}
3948
3949	log_init_pg_hdr(log, le16_to_cpu(log->rst_info.r_page->major_ver),
3950			le16_to_cpu(log->rst_info.r_page->minor_ver));
3951
3952	log->l_size = le64_to_cpu(ra2->l_size);
3953	log->seq_num_bits = le32_to_cpu(ra2->seq_num_bits);
3954	log->file_data_bits = sizeof(u64) * 8 - log->seq_num_bits;
3955	log->seq_num_mask = (8 << log->file_data_bits) - 1;
3956	log->last_lsn = le64_to_cpu(ra2->current_lsn);
3957	log->seq_num = log->last_lsn >> log->file_data_bits;
3958	log->ra_off = le16_to_cpu(log->rst_info.r_page->ra_off);
3959	log->restart_size = log->sys_page_size - log->ra_off;
3960	log->record_header_len = le16_to_cpu(ra2->rec_hdr_len);
3961	log->ra_size = le16_to_cpu(ra2->ra_len);
3962	log->data_off = le16_to_cpu(ra2->data_off);
3963	log->data_size = log->page_size - log->data_off;
3964	log->reserved = log->data_size - log->record_header_len;
3965
3966	vbo = lsn_to_vbo(log, log->last_lsn);
3967
3968	if (vbo < log->first_page) {
3969		/* This is a pseudo lsn. */
3970		log->l_flags |= NTFSLOG_NO_LAST_LSN;
3971		log->next_page = log->first_page;
3972		goto find_oldest;
3973	}
3974
3975	/* Find the end of this log record. */
3976	off = final_log_off(log, log->last_lsn,
3977			    le32_to_cpu(ra2->last_lsn_data_len));
3978
3979	/* If we wrapped the file then increment the sequence number. */
3980	if (off <= vbo) {
3981		log->seq_num += 1;
3982		log->l_flags |= NTFSLOG_WRAPPED;
3983	}
3984
3985	/* Now compute the next log page to use. */
3986	vbo &= ~log->sys_page_mask;
3987	tail = log->page_size - (off & log->page_mask) - 1;
3988
3989	/*
3990	 *If we can fit another log record on the page,
3991	 * move back a page the log file.
3992	 */
3993	if (tail >= log->record_header_len) {
3994		log->l_flags |= NTFSLOG_REUSE_TAIL;
3995		log->next_page = vbo;
3996	} else {
3997		log->next_page = next_page_off(log, vbo);
3998	}
3999
4000find_oldest:
4001	/*
4002	 * Find the oldest client lsn. Use the last
4003	 * flushed lsn as a starting point.
4004	 */
4005	log->oldest_lsn = log->last_lsn;
4006	oldest_client_lsn(Add2Ptr(ra2, le16_to_cpu(ra2->client_off)),
4007			  ra2->client_idx[1], &log->oldest_lsn);
4008	log->oldest_lsn_off = lsn_to_vbo(log, log->oldest_lsn);
4009
4010	if (log->oldest_lsn_off < log->first_page)
4011		log->l_flags |= NTFSLOG_NO_OLDEST_LSN;
4012
4013	if (!(ra2->flags & RESTART_SINGLE_PAGE_IO))
4014		log->l_flags |= NTFSLOG_WRAPPED | NTFSLOG_MULTIPLE_PAGE_IO;
4015
4016	log->current_openlog_count = le32_to_cpu(ra2->open_log_count);
4017	log->total_avail_pages = log->l_size - log->first_page;
4018	log->total_avail = log->total_avail_pages >> log->page_bits;
4019	log->max_current_avail = log->total_avail * log->reserved;
4020	log->total_avail = log->total_avail * log->data_size;
4021
4022	log->current_avail = current_log_avail(log);
4023
4024	ra = kzalloc(log->restart_size, GFP_NOFS);
4025	if (!ra) {
4026		err = -ENOMEM;
4027		goto out;
4028	}
4029	log->ra = ra;
4030
4031	t16 = le16_to_cpu(ra2->client_off);
4032	if (t16 == offsetof(struct RESTART_AREA, clients)) {
4033		memcpy(ra, ra2, log->ra_size);
4034	} else {
4035		memcpy(ra, ra2, offsetof(struct RESTART_AREA, clients));
4036		memcpy(ra->clients, Add2Ptr(ra2, t16),
4037		       le16_to_cpu(ra2->ra_len) - t16);
4038
4039		log->current_openlog_count = get_random_u32();
4040		ra->open_log_count = cpu_to_le32(log->current_openlog_count);
4041		log->ra_size = offsetof(struct RESTART_AREA, clients) +
4042			       sizeof(struct CLIENT_REC);
4043		ra->client_off =
4044			cpu_to_le16(offsetof(struct RESTART_AREA, clients));
4045		ra->ra_len = cpu_to_le16(log->ra_size);
4046	}
4047
4048	le32_add_cpu(&ra->open_log_count, 1);
4049
4050	/* Now we need to walk through looking for the last lsn. */
4051	err = last_log_lsn(log);
4052	if (err)
4053		goto out;
4054
4055	log->current_avail = current_log_avail(log);
4056
4057	/* Remember which restart area to write first. */
4058	log->init_ra = log->rst_info.vbo;
4059
4060process_log:
4061	/* 1.0, 1.1, 2.0 log->major_ver/minor_ver - short values. */
4062	switch ((log->major_ver << 16) + log->minor_ver) {
4063	case 0x10000:
4064	case 0x10001:
4065	case 0x20000:
4066		break;
4067	default:
4068		ntfs_warn(sbi->sb, "\x24LogFile version %d.%d is not supported",
4069			  log->major_ver, log->minor_ver);
4070		err = -EOPNOTSUPP;
4071		log->set_dirty = true;
4072		goto out;
4073	}
4074
4075	/* One client "NTFS" per logfile. */
4076	ca = Add2Ptr(ra, le16_to_cpu(ra->client_off));
4077
4078	for (client = ra->client_idx[1];; client = cr->next_client) {
4079		if (client == LFS_NO_CLIENT_LE) {
4080			/* Insert "NTFS" client LogFile. */
4081			client = ra->client_idx[0];
4082			if (client == LFS_NO_CLIENT_LE) {
4083				err = -EINVAL;
4084				goto out;
4085			}
4086
4087			t16 = le16_to_cpu(client);
4088			cr = ca + t16;
4089
4090			remove_client(ca, cr, &ra->client_idx[0]);
4091
4092			cr->restart_lsn = 0;
4093			cr->oldest_lsn = cpu_to_le64(log->oldest_lsn);
4094			cr->name_bytes = cpu_to_le32(8);
4095			cr->name[0] = cpu_to_le16('N');
4096			cr->name[1] = cpu_to_le16('T');
4097			cr->name[2] = cpu_to_le16('F');
4098			cr->name[3] = cpu_to_le16('S');
4099
4100			add_client(ca, t16, &ra->client_idx[1]);
4101			break;
4102		}
4103
4104		cr = ca + le16_to_cpu(client);
4105
4106		if (cpu_to_le32(8) == cr->name_bytes &&
4107		    cpu_to_le16('N') == cr->name[0] &&
4108		    cpu_to_le16('T') == cr->name[1] &&
4109		    cpu_to_le16('F') == cr->name[2] &&
4110		    cpu_to_le16('S') == cr->name[3])
4111			break;
4112	}
4113
4114	/* Update the client handle with the client block information. */
4115	log->client_id.seq_num = cr->seq_num;
4116	log->client_id.client_idx = client;
4117
4118	err = read_rst_area(log, &rst, &checkpt_lsn);
4119	if (err)
4120		goto out;
4121
4122	if (!rst)
4123		goto out;
4124
4125	bytes_per_attr_entry = !rst->major_ver ? 0x2C : 0x28;
4126
4127	if (rst->check_point_start)
4128		checkpt_lsn = le64_to_cpu(rst->check_point_start);
4129
4130	/* Allocate and Read the Transaction Table. */
4131	if (!rst->transact_table_len)
4132		goto check_dirty_page_table; /* reduce tab pressure. */
4133
4134	t64 = le64_to_cpu(rst->transact_table_lsn);
4135	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4136	if (err)
4137		goto out;
4138
4139	lrh = lcb->log_rec;
4140	frh = lcb->lrh;
4141	rec_len = le32_to_cpu(frh->client_data_len);
4142
4143	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4144			   bytes_per_attr_entry)) {
4145		err = -EINVAL;
4146		goto out;
4147	}
4148
4149	t16 = le16_to_cpu(lrh->redo_off);
4150
4151	rt = Add2Ptr(lrh, t16);
4152	t32 = rec_len - t16;
4153
4154	/* Now check that this is a valid restart table. */
4155	if (!check_rstbl(rt, t32)) {
4156		err = -EINVAL;
4157		goto out;
4158	}
4159
4160	trtbl = kmemdup(rt, t32, GFP_NOFS);
4161	if (!trtbl) {
4162		err = -ENOMEM;
4163		goto out;
4164	}
4165
4166	lcb_put(lcb);
4167	lcb = NULL;
4168
4169check_dirty_page_table:
4170	/* The next record back should be the Dirty Pages Table. */
4171	if (!rst->dirty_pages_len)
4172		goto check_attribute_names; /* reduce tab pressure. */
4173
4174	t64 = le64_to_cpu(rst->dirty_pages_table_lsn);
4175	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4176	if (err)
4177		goto out;
4178
4179	lrh = lcb->log_rec;
4180	frh = lcb->lrh;
4181	rec_len = le32_to_cpu(frh->client_data_len);
4182
4183	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4184			   bytes_per_attr_entry)) {
4185		err = -EINVAL;
4186		goto out;
4187	}
4188
4189	t16 = le16_to_cpu(lrh->redo_off);
4190
4191	rt = Add2Ptr(lrh, t16);
4192	t32 = rec_len - t16;
4193
4194	/* Now check that this is a valid restart table. */
4195	if (!check_rstbl(rt, t32)) {
4196		err = -EINVAL;
4197		goto out;
4198	}
4199
4200	dptbl = kmemdup(rt, t32, GFP_NOFS);
4201	if (!dptbl) {
4202		err = -ENOMEM;
4203		goto out;
4204	}
4205
4206	/* Convert Ra version '0' into version '1'. */
4207	if (rst->major_ver)
4208		goto end_conv_1; /* reduce tab pressure. */
4209
4210	dp = NULL;
4211	while ((dp = enum_rstbl(dptbl, dp))) {
4212		struct DIR_PAGE_ENTRY_32 *dp0 = (struct DIR_PAGE_ENTRY_32 *)dp;
4213		// NOTE: Danger. Check for of boundary.
4214		memmove(&dp->vcn, &dp0->vcn_low,
4215			2 * sizeof(u64) +
4216				le32_to_cpu(dp->lcns_follow) * sizeof(u64));
4217	}
4218
4219end_conv_1:
4220	lcb_put(lcb);
4221	lcb = NULL;
4222
4223	/*
4224	 * Go through the table and remove the duplicates,
4225	 * remembering the oldest lsn values.
4226	 */
4227	if (sbi->cluster_size <= log->page_size)
4228		goto trace_dp_table; /* reduce tab pressure. */
4229	dp = NULL;
4230	while ((dp = enum_rstbl(dptbl, dp))) {
4231		struct DIR_PAGE_ENTRY *next = dp;
4232
4233		while ((next = enum_rstbl(dptbl, next))) {
4234			if (next->target_attr == dp->target_attr &&
4235			    next->vcn == dp->vcn) {
4236				if (le64_to_cpu(next->oldest_lsn) <
4237				    le64_to_cpu(dp->oldest_lsn)) {
4238					dp->oldest_lsn = next->oldest_lsn;
4239				}
4240
4241				free_rsttbl_idx(dptbl, PtrOffset(dptbl, next));
4242			}
4243		}
4244	}
4245trace_dp_table:
4246check_attribute_names:
4247	/* The next record should be the Attribute Names. */
4248	if (!rst->attr_names_len)
4249		goto check_attr_table; /* reduce tab pressure. */
4250
4251	t64 = le64_to_cpu(rst->attr_names_lsn);
4252	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4253	if (err)
4254		goto out;
4255
4256	lrh = lcb->log_rec;
4257	frh = lcb->lrh;
4258	rec_len = le32_to_cpu(frh->client_data_len);
4259
4260	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4261			   bytes_per_attr_entry)) {
4262		err = -EINVAL;
4263		goto out;
4264	}
4265
4266	t32 = lrh_length(lrh);
4267	attr_names_bytes = rec_len - t32;
4268
4269	attr_names = kmemdup(Add2Ptr(lrh, t32), attr_names_bytes, GFP_NOFS);
4270	if (!attr_names) {
4271		err = -ENOMEM;
4272		goto out;
4273	}
4274
4275	lcb_put(lcb);
4276	lcb = NULL;
4277
4278check_attr_table:
4279	/* The next record should be the attribute Table. */
4280	if (!rst->open_attr_len)
4281		goto check_attribute_names2; /* reduce tab pressure. */
4282
4283	t64 = le64_to_cpu(rst->open_attr_table_lsn);
4284	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4285	if (err)
4286		goto out;
4287
4288	lrh = lcb->log_rec;
4289	frh = lcb->lrh;
4290	rec_len = le32_to_cpu(frh->client_data_len);
4291
4292	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4293			   bytes_per_attr_entry)) {
4294		err = -EINVAL;
4295		goto out;
4296	}
4297
4298	t16 = le16_to_cpu(lrh->redo_off);
4299
4300	rt = Add2Ptr(lrh, t16);
4301	oatbl_bytes = rec_len - t16;
4302
4303	if (!check_rstbl(rt, oatbl_bytes)) {
4304		err = -EINVAL;
4305		goto out;
4306	}
4307
4308	oatbl = kmemdup(rt, oatbl_bytes, GFP_NOFS);
4309	if (!oatbl) {
4310		err = -ENOMEM;
4311		goto out;
4312	}
4313
4314	log->open_attr_tbl = oatbl;
4315
4316	/* Clear all of the Attr pointers. */
4317	oe = NULL;
4318	while ((oe = enum_rstbl(oatbl, oe))) {
4319		if (!rst->major_ver) {
4320			struct OPEN_ATTR_ENRTY_32 oe0;
4321
4322			/* Really 'oe' points to OPEN_ATTR_ENRTY_32. */
4323			memcpy(&oe0, oe, SIZEOF_OPENATTRIBUTEENTRY0);
4324
4325			oe->bytes_per_index = oe0.bytes_per_index;
4326			oe->type = oe0.type;
4327			oe->is_dirty_pages = oe0.is_dirty_pages;
4328			oe->name_len = 0;
4329			oe->ref = oe0.ref;
4330			oe->open_record_lsn = oe0.open_record_lsn;
4331		}
4332
4333		oe->is_attr_name = 0;
4334		oe->ptr = NULL;
4335	}
4336
4337	lcb_put(lcb);
4338	lcb = NULL;
4339
4340check_attribute_names2:
4341	if (attr_names && oatbl) {
4342		off = 0;
4343		for (;;) {
4344			/* Check we can use attribute name entry 'ane'. */
4345			static_assert(sizeof(*ane) == 4);
4346			if (off + sizeof(*ane) > attr_names_bytes) {
4347				/* just ignore the rest. */
4348				break;
4349			}
4350
4351			ane = Add2Ptr(attr_names, off);
4352			t16 = le16_to_cpu(ane->off);
4353			if (!t16) {
4354				/* this is the only valid exit. */
4355				break;
4356			}
4357
4358			/* Check we can use open attribute entry 'oe'. */
4359			if (t16 + sizeof(*oe) > oatbl_bytes) {
4360				/* just ignore the rest. */
4361				break;
4362			}
4363
4364			/* TODO: Clear table on exit! */
4365			oe = Add2Ptr(oatbl, t16);
4366			t16 = le16_to_cpu(ane->name_bytes);
4367			off += t16 + sizeof(*ane);
4368			if (off > attr_names_bytes) {
4369				/* just ignore the rest. */
4370				break;
4371			}
4372			oe->name_len = t16 / sizeof(short);
4373			oe->ptr = ane->name;
4374			oe->is_attr_name = 2;
4375		}
4376	}
4377
4378	/*
4379	 * If the checkpt_lsn is zero, then this is a freshly
4380	 * formatted disk and we have no work to do.
4381	 */
4382	if (!checkpt_lsn) {
4383		err = 0;
4384		goto out;
4385	}
4386
4387	if (!oatbl) {
4388		oatbl = init_rsttbl(bytes_per_attr_entry, 8);
4389		if (!oatbl) {
4390			err = -ENOMEM;
4391			goto out;
4392		}
4393	}
4394
4395	log->open_attr_tbl = oatbl;
4396
4397	/* Start the analysis pass from the Checkpoint lsn. */
4398	rec_lsn = checkpt_lsn;
4399
4400	/* Read the first lsn. */
4401	err = read_log_rec_lcb(log, checkpt_lsn, lcb_ctx_next, &lcb);
4402	if (err)
4403		goto out;
4404
4405	/* Loop to read all subsequent records to the end of the log file. */
4406next_log_record_analyze:
4407	err = read_next_log_rec(log, lcb, &rec_lsn);
4408	if (err)
4409		goto out;
4410
4411	if (!rec_lsn)
4412		goto end_log_records_enumerate;
4413
4414	frh = lcb->lrh;
4415	transact_id = le32_to_cpu(frh->transact_id);
4416	rec_len = le32_to_cpu(frh->client_data_len);
4417	lrh = lcb->log_rec;
4418
4419	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
4420		err = -EINVAL;
4421		goto out;
4422	}
4423
4424	/*
4425	 * The first lsn after the previous lsn remembered
4426	 * the checkpoint is the first candidate for the rlsn.
4427	 */
4428	if (!rlsn)
4429		rlsn = rec_lsn;
4430
4431	if (LfsClientRecord != frh->record_type)
4432		goto next_log_record_analyze;
4433
4434	/*
4435	 * Now update the Transaction Table for this transaction. If there
4436	 * is no entry present or it is unallocated we allocate the entry.
4437	 */
4438	if (!trtbl) {
4439		trtbl = init_rsttbl(sizeof(struct TRANSACTION_ENTRY),
4440				    INITIAL_NUMBER_TRANSACTIONS);
4441		if (!trtbl) {
4442			err = -ENOMEM;
4443			goto out;
4444		}
4445	}
4446
4447	tr = Add2Ptr(trtbl, transact_id);
4448
4449	if (transact_id >= bytes_per_rt(trtbl) ||
4450	    tr->next != RESTART_ENTRY_ALLOCATED_LE) {
4451		tr = alloc_rsttbl_from_idx(&trtbl, transact_id);
4452		if (!tr) {
4453			err = -ENOMEM;
4454			goto out;
4455		}
4456		tr->transact_state = TransactionActive;
4457		tr->first_lsn = cpu_to_le64(rec_lsn);
4458	}
4459
4460	tr->prev_lsn = tr->undo_next_lsn = cpu_to_le64(rec_lsn);
4461
4462	/*
4463	 * If this is a compensation log record, then change
4464	 * the undo_next_lsn to be the undo_next_lsn of this record.
4465	 */
4466	if (lrh->undo_op == cpu_to_le16(CompensationLogRecord))
4467		tr->undo_next_lsn = frh->client_undo_next_lsn;
4468
4469	/* Dispatch to handle log record depending on type. */
4470	switch (le16_to_cpu(lrh->redo_op)) {
4471	case InitializeFileRecordSegment:
4472	case DeallocateFileRecordSegment:
4473	case WriteEndOfFileRecordSegment:
4474	case CreateAttribute:
4475	case DeleteAttribute:
4476	case UpdateResidentValue:
4477	case UpdateNonresidentValue:
4478	case UpdateMappingPairs:
4479	case SetNewAttributeSizes:
4480	case AddIndexEntryRoot:
4481	case DeleteIndexEntryRoot:
4482	case AddIndexEntryAllocation:
4483	case DeleteIndexEntryAllocation:
4484	case WriteEndOfIndexBuffer:
4485	case SetIndexEntryVcnRoot:
4486	case SetIndexEntryVcnAllocation:
4487	case UpdateFileNameRoot:
4488	case UpdateFileNameAllocation:
4489	case SetBitsInNonresidentBitMap:
4490	case ClearBitsInNonresidentBitMap:
4491	case UpdateRecordDataRoot:
4492	case UpdateRecordDataAllocation:
4493	case ZeroEndOfFileRecord:
4494		t16 = le16_to_cpu(lrh->target_attr);
4495		t64 = le64_to_cpu(lrh->target_vcn);
4496		dp = find_dp(dptbl, t16, t64);
4497
4498		if (dp)
4499			goto copy_lcns;
4500
4501		/*
4502		 * Calculate the number of clusters per page the system
4503		 * which wrote the checkpoint, possibly creating the table.
4504		 */
4505		if (dptbl) {
4506			t32 = (le16_to_cpu(dptbl->size) -
4507			       sizeof(struct DIR_PAGE_ENTRY)) /
4508			      sizeof(u64);
4509		} else {
4510			t32 = log->clst_per_page;
4511			kfree(dptbl);
4512			dptbl = init_rsttbl(struct_size(dp, page_lcns, t32),
4513					    32);
4514			if (!dptbl) {
4515				err = -ENOMEM;
4516				goto out;
4517			}
4518		}
4519
4520		dp = alloc_rsttbl_idx(&dptbl);
4521		if (!dp) {
4522			err = -ENOMEM;
4523			goto out;
4524		}
4525		dp->target_attr = cpu_to_le32(t16);
4526		dp->transfer_len = cpu_to_le32(t32 << sbi->cluster_bits);
4527		dp->lcns_follow = cpu_to_le32(t32);
4528		dp->vcn = cpu_to_le64(t64 & ~((u64)t32 - 1));
4529		dp->oldest_lsn = cpu_to_le64(rec_lsn);
4530
4531copy_lcns:
4532		/*
4533		 * Copy the Lcns from the log record into the Dirty Page Entry.
4534		 * TODO: For different page size support, must somehow make
4535		 * whole routine a loop, case Lcns do not fit below.
4536		 */
4537		t16 = le16_to_cpu(lrh->lcns_follow);
4538		for (i = 0; i < t16; i++) {
4539			size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
4540					    le64_to_cpu(dp->vcn));
4541			dp->page_lcns[j + i] = lrh->page_lcns[i];
4542		}
4543
4544		goto next_log_record_analyze;
4545
4546	case DeleteDirtyClusters: {
4547		u32 range_count =
4548			le16_to_cpu(lrh->redo_len) / sizeof(struct LCN_RANGE);
4549		const struct LCN_RANGE *r =
4550			Add2Ptr(lrh, le16_to_cpu(lrh->redo_off));
4551
4552		/* Loop through all of the Lcn ranges this log record. */
4553		for (i = 0; i < range_count; i++, r++) {
4554			u64 lcn0 = le64_to_cpu(r->lcn);
4555			u64 lcn_e = lcn0 + le64_to_cpu(r->len) - 1;
4556
4557			dp = NULL;
4558			while ((dp = enum_rstbl(dptbl, dp))) {
4559				u32 j;
4560
4561				t32 = le32_to_cpu(dp->lcns_follow);
4562				for (j = 0; j < t32; j++) {
4563					t64 = le64_to_cpu(dp->page_lcns[j]);
4564					if (t64 >= lcn0 && t64 <= lcn_e)
4565						dp->page_lcns[j] = 0;
4566				}
4567			}
4568		}
4569		goto next_log_record_analyze;
4570	}
4571
4572	case OpenNonresidentAttribute:
4573		t16 = le16_to_cpu(lrh->target_attr);
4574		if (t16 >= bytes_per_rt(oatbl)) {
4575			/*
4576			 * Compute how big the table needs to be.
4577			 * Add 10 extra entries for some cushion.
4578			 */
4579			u32 new_e = t16 / le16_to_cpu(oatbl->size);
4580
4581			new_e += 10 - le16_to_cpu(oatbl->used);
4582
4583			oatbl = extend_rsttbl(oatbl, new_e, ~0u);
4584			log->open_attr_tbl = oatbl;
4585			if (!oatbl) {
4586				err = -ENOMEM;
4587				goto out;
4588			}
4589		}
4590
4591		/* Point to the entry being opened. */
4592		oe = alloc_rsttbl_from_idx(&oatbl, t16);
4593		log->open_attr_tbl = oatbl;
4594		if (!oe) {
4595			err = -ENOMEM;
4596			goto out;
4597		}
4598
4599		/* Initialize this entry from the log record. */
4600		t16 = le16_to_cpu(lrh->redo_off);
4601		if (!rst->major_ver) {
4602			/* Convert version '0' into version '1'. */
4603			struct OPEN_ATTR_ENRTY_32 *oe0 = Add2Ptr(lrh, t16);
4604
4605			oe->bytes_per_index = oe0->bytes_per_index;
4606			oe->type = oe0->type;
4607			oe->is_dirty_pages = oe0->is_dirty_pages;
4608			oe->name_len = 0; //oe0.name_len;
4609			oe->ref = oe0->ref;
4610			oe->open_record_lsn = oe0->open_record_lsn;
4611		} else {
4612			memcpy(oe, Add2Ptr(lrh, t16), bytes_per_attr_entry);
4613		}
4614
4615		t16 = le16_to_cpu(lrh->undo_len);
4616		if (t16) {
4617			oe->ptr = kmalloc(t16, GFP_NOFS);
4618			if (!oe->ptr) {
4619				err = -ENOMEM;
4620				goto out;
4621			}
4622			oe->name_len = t16 / sizeof(short);
4623			memcpy(oe->ptr,
4624			       Add2Ptr(lrh, le16_to_cpu(lrh->undo_off)), t16);
4625			oe->is_attr_name = 1;
4626		} else {
4627			oe->ptr = NULL;
4628			oe->is_attr_name = 0;
4629		}
4630
4631		goto next_log_record_analyze;
4632
4633	case HotFix:
4634		t16 = le16_to_cpu(lrh->target_attr);
4635		t64 = le64_to_cpu(lrh->target_vcn);
4636		dp = find_dp(dptbl, t16, t64);
4637		if (dp) {
4638			size_t j = le64_to_cpu(lrh->target_vcn) -
4639				   le64_to_cpu(dp->vcn);
4640			if (dp->page_lcns[j])
4641				dp->page_lcns[j] = lrh->page_lcns[0];
4642		}
4643		goto next_log_record_analyze;
4644
4645	case EndTopLevelAction:
4646		tr = Add2Ptr(trtbl, transact_id);
4647		tr->prev_lsn = cpu_to_le64(rec_lsn);
4648		tr->undo_next_lsn = frh->client_undo_next_lsn;
4649		goto next_log_record_analyze;
4650
4651	case PrepareTransaction:
4652		tr = Add2Ptr(trtbl, transact_id);
4653		tr->transact_state = TransactionPrepared;
4654		goto next_log_record_analyze;
4655
4656	case CommitTransaction:
4657		tr = Add2Ptr(trtbl, transact_id);
4658		tr->transact_state = TransactionCommitted;
4659		goto next_log_record_analyze;
4660
4661	case ForgetTransaction:
4662		free_rsttbl_idx(trtbl, transact_id);
4663		goto next_log_record_analyze;
4664
4665	case Noop:
4666	case OpenAttributeTableDump:
4667	case AttributeNamesDump:
4668	case DirtyPageTableDump:
4669	case TransactionTableDump:
4670		/* The following cases require no action the Analysis Pass. */
4671		goto next_log_record_analyze;
4672
4673	default:
4674		/*
4675		 * All codes will be explicitly handled.
4676		 * If we see a code we do not expect, then we are trouble.
4677		 */
4678		goto next_log_record_analyze;
4679	}
4680
4681end_log_records_enumerate:
4682	lcb_put(lcb);
4683	lcb = NULL;
4684
4685	/*
4686	 * Scan the Dirty Page Table and Transaction Table for
4687	 * the lowest lsn, and return it as the Redo lsn.
4688	 */
4689	dp = NULL;
4690	while ((dp = enum_rstbl(dptbl, dp))) {
4691		t64 = le64_to_cpu(dp->oldest_lsn);
4692		if (t64 && t64 < rlsn)
4693			rlsn = t64;
4694	}
4695
4696	tr = NULL;
4697	while ((tr = enum_rstbl(trtbl, tr))) {
4698		t64 = le64_to_cpu(tr->first_lsn);
4699		if (t64 && t64 < rlsn)
4700			rlsn = t64;
4701	}
4702
4703	/*
4704	 * Only proceed if the Dirty Page Table or Transaction
4705	 * table are not empty.
4706	 */
4707	if ((!dptbl || !dptbl->total) && (!trtbl || !trtbl->total))
4708		goto end_replay;
4709
4710	sbi->flags |= NTFS_FLAGS_NEED_REPLAY;
4711	if (is_ro)
4712		goto out;
4713
4714	/* Reopen all of the attributes with dirty pages. */
4715	oe = NULL;
4716next_open_attribute:
4717
4718	oe = enum_rstbl(oatbl, oe);
4719	if (!oe) {
4720		err = 0;
4721		dp = NULL;
4722		goto next_dirty_page;
4723	}
4724
4725	oa = kzalloc(sizeof(struct OpenAttr), GFP_NOFS);
4726	if (!oa) {
4727		err = -ENOMEM;
4728		goto out;
4729	}
4730
4731	inode = ntfs_iget5(sbi->sb, &oe->ref, NULL);
4732	if (IS_ERR(inode))
4733		goto fake_attr;
4734
4735	if (is_bad_inode(inode)) {
4736		iput(inode);
4737fake_attr:
4738		if (oa->ni) {
4739			iput(&oa->ni->vfs_inode);
4740			oa->ni = NULL;
4741		}
4742
4743		attr = attr_create_nonres_log(sbi, oe->type, 0, oe->ptr,
4744					      oe->name_len, 0);
4745		if (!attr) {
4746			kfree(oa);
4747			err = -ENOMEM;
4748			goto out;
4749		}
4750		oa->attr = attr;
4751		oa->run1 = &oa->run0;
4752		goto final_oe;
4753	}
4754
4755	ni_oe = ntfs_i(inode);
4756	oa->ni = ni_oe;
4757
4758	attr = ni_find_attr(ni_oe, NULL, NULL, oe->type, oe->ptr, oe->name_len,
4759			    NULL, NULL);
4760
4761	if (!attr)
4762		goto fake_attr;
4763
4764	t32 = le32_to_cpu(attr->size);
4765	oa->attr = kmemdup(attr, t32, GFP_NOFS);
4766	if (!oa->attr)
4767		goto fake_attr;
4768
4769	if (!S_ISDIR(inode->i_mode)) {
4770		if (attr->type == ATTR_DATA && !attr->name_len) {
4771			oa->run1 = &ni_oe->file.run;
4772			goto final_oe;
4773		}
4774	} else {
4775		if (attr->type == ATTR_ALLOC &&
4776		    attr->name_len == ARRAY_SIZE(I30_NAME) &&
4777		    !memcmp(attr_name(attr), I30_NAME, sizeof(I30_NAME))) {
4778			oa->run1 = &ni_oe->dir.alloc_run;
4779			goto final_oe;
4780		}
4781	}
4782
4783	if (attr->non_res) {
4784		u16 roff = le16_to_cpu(attr->nres.run_off);
4785		CLST svcn = le64_to_cpu(attr->nres.svcn);
4786
4787		if (roff > t32) {
4788			kfree(oa->attr);
4789			oa->attr = NULL;
4790			goto fake_attr;
4791		}
4792
4793		err = run_unpack(&oa->run0, sbi, inode->i_ino, svcn,
4794				 le64_to_cpu(attr->nres.evcn), svcn,
4795				 Add2Ptr(attr, roff), t32 - roff);
4796		if (err < 0) {
4797			kfree(oa->attr);
4798			oa->attr = NULL;
4799			goto fake_attr;
4800		}
4801		err = 0;
4802	}
4803	oa->run1 = &oa->run0;
4804	attr = oa->attr;
4805
4806final_oe:
4807	if (oe->is_attr_name == 1)
4808		kfree(oe->ptr);
4809	oe->is_attr_name = 0;
4810	oe->ptr = oa;
4811	oe->name_len = attr->name_len;
4812
4813	goto next_open_attribute;
4814
4815	/*
4816	 * Now loop through the dirty page table to extract all of the Vcn/Lcn.
4817	 * Mapping that we have, and insert it into the appropriate run.
4818	 */
4819next_dirty_page:
4820	dp = enum_rstbl(dptbl, dp);
4821	if (!dp)
4822		goto do_redo_1;
4823
4824	oe = Add2Ptr(oatbl, le32_to_cpu(dp->target_attr));
4825
4826	if (oe->next != RESTART_ENTRY_ALLOCATED_LE)
4827		goto next_dirty_page;
4828
4829	oa = oe->ptr;
4830	if (!oa)
4831		goto next_dirty_page;
4832
4833	i = -1;
4834next_dirty_page_vcn:
4835	i += 1;
4836	if (i >= le32_to_cpu(dp->lcns_follow))
4837		goto next_dirty_page;
4838
4839	vcn = le64_to_cpu(dp->vcn) + i;
4840	size = (vcn + 1) << sbi->cluster_bits;
4841
4842	if (!dp->page_lcns[i])
4843		goto next_dirty_page_vcn;
4844
4845	rno = ino_get(&oe->ref);
4846	if (rno <= MFT_REC_MIRR &&
4847	    size < (MFT_REC_VOL + 1) * sbi->record_size &&
4848	    oe->type == ATTR_DATA) {
4849		goto next_dirty_page_vcn;
4850	}
4851
4852	lcn = le64_to_cpu(dp->page_lcns[i]);
4853
4854	if ((!run_lookup_entry(oa->run1, vcn, &lcn0, &len0, NULL) ||
4855	     lcn0 != lcn) &&
4856	    !run_add_entry(oa->run1, vcn, lcn, 1, false)) {
4857		err = -ENOMEM;
4858		goto out;
4859	}
4860	attr = oa->attr;
4861	if (size > le64_to_cpu(attr->nres.alloc_size)) {
4862		attr->nres.valid_size = attr->nres.data_size =
4863			attr->nres.alloc_size = cpu_to_le64(size);
4864	}
4865	goto next_dirty_page_vcn;
4866
4867do_redo_1:
4868	/*
4869	 * Perform the Redo Pass, to restore all of the dirty pages to the same
4870	 * contents that they had immediately before the crash. If the dirty
4871	 * page table is empty, then we can skip the entire Redo Pass.
4872	 */
4873	if (!dptbl || !dptbl->total)
4874		goto do_undo_action;
4875
4876	rec_lsn = rlsn;
4877
4878	/*
4879	 * Read the record at the Redo lsn, before falling
4880	 * into common code to handle each record.
4881	 */
4882	err = read_log_rec_lcb(log, rlsn, lcb_ctx_next, &lcb);
4883	if (err)
4884		goto out;
4885
4886	/*
4887	 * Now loop to read all of our log records forwards, until
4888	 * we hit the end of the file, cleaning up at the end.
4889	 */
4890do_action_next:
4891	frh = lcb->lrh;
4892
4893	if (LfsClientRecord != frh->record_type)
4894		goto read_next_log_do_action;
4895
4896	transact_id = le32_to_cpu(frh->transact_id);
4897	rec_len = le32_to_cpu(frh->client_data_len);
4898	lrh = lcb->log_rec;
4899
4900	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
4901		err = -EINVAL;
4902		goto out;
4903	}
4904
4905	/* Ignore log records that do not update pages. */
4906	if (lrh->lcns_follow)
4907		goto find_dirty_page;
4908
4909	goto read_next_log_do_action;
4910
4911find_dirty_page:
4912	t16 = le16_to_cpu(lrh->target_attr);
4913	t64 = le64_to_cpu(lrh->target_vcn);
4914	dp = find_dp(dptbl, t16, t64);
4915
4916	if (!dp)
4917		goto read_next_log_do_action;
4918
4919	if (rec_lsn < le64_to_cpu(dp->oldest_lsn))
4920		goto read_next_log_do_action;
4921
4922	t16 = le16_to_cpu(lrh->target_attr);
4923	if (t16 >= bytes_per_rt(oatbl)) {
4924		err = -EINVAL;
4925		goto out;
4926	}
4927
4928	oe = Add2Ptr(oatbl, t16);
4929
4930	if (oe->next != RESTART_ENTRY_ALLOCATED_LE) {
4931		err = -EINVAL;
4932		goto out;
4933	}
4934
4935	oa = oe->ptr;
4936
4937	if (!oa) {
4938		err = -EINVAL;
4939		goto out;
4940	}
4941	attr = oa->attr;
4942
4943	vcn = le64_to_cpu(lrh->target_vcn);
4944
4945	if (!run_lookup_entry(oa->run1, vcn, &lcn, NULL, NULL) ||
4946	    lcn == SPARSE_LCN) {
4947		goto read_next_log_do_action;
4948	}
4949
4950	/* Point to the Redo data and get its length. */
4951	data = Add2Ptr(lrh, le16_to_cpu(lrh->redo_off));
4952	dlen = le16_to_cpu(lrh->redo_len);
4953
4954	/* Shorten length by any Lcns which were deleted. */
4955	saved_len = dlen;
4956
4957	for (i = le16_to_cpu(lrh->lcns_follow); i; i--) {
4958		size_t j;
4959		u32 alen, voff;
4960
4961		voff = le16_to_cpu(lrh->record_off) +
4962		       le16_to_cpu(lrh->attr_off);
4963		voff += le16_to_cpu(lrh->cluster_off) << SECTOR_SHIFT;
4964
4965		/* If the Vcn question is allocated, we can just get out. */
4966		j = le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn);
4967		if (dp->page_lcns[j + i - 1])
4968			break;
4969
4970		if (!saved_len)
4971			saved_len = 1;
4972
4973		/*
4974		 * Calculate the allocated space left relative to the
4975		 * log record Vcn, after removing this unallocated Vcn.
4976		 */
4977		alen = (i - 1) << sbi->cluster_bits;
4978
4979		/*
4980		 * If the update described this log record goes beyond
4981		 * the allocated space, then we will have to reduce the length.
4982		 */
4983		if (voff >= alen)
4984			dlen = 0;
4985		else if (voff + dlen > alen)
4986			dlen = alen - voff;
4987	}
4988
4989	/*
4990	 * If the resulting dlen from above is now zero,
4991	 * we can skip this log record.
4992	 */
4993	if (!dlen && saved_len)
4994		goto read_next_log_do_action;
4995
4996	t16 = le16_to_cpu(lrh->redo_op);
4997	if (can_skip_action(t16))
4998		goto read_next_log_do_action;
4999
5000	/* Apply the Redo operation a common routine. */
5001	err = do_action(log, oe, lrh, t16, data, dlen, rec_len, &rec_lsn);
5002	if (err)
5003		goto out;
5004
5005	/* Keep reading and looping back until end of file. */
5006read_next_log_do_action:
5007	err = read_next_log_rec(log, lcb, &rec_lsn);
5008	if (!err && rec_lsn)
5009		goto do_action_next;
5010
5011	lcb_put(lcb);
5012	lcb = NULL;
5013
5014do_undo_action:
5015	/* Scan Transaction Table. */
5016	tr = NULL;
5017transaction_table_next:
5018	tr = enum_rstbl(trtbl, tr);
5019	if (!tr)
5020		goto undo_action_done;
5021
5022	if (TransactionActive != tr->transact_state || !tr->undo_next_lsn) {
5023		free_rsttbl_idx(trtbl, PtrOffset(trtbl, tr));
5024		goto transaction_table_next;
5025	}
5026
5027	log->transaction_id = PtrOffset(trtbl, tr);
5028	undo_next_lsn = le64_to_cpu(tr->undo_next_lsn);
5029
5030	/*
5031	 * We only have to do anything if the transaction has
5032	 * something its undo_next_lsn field.
5033	 */
5034	if (!undo_next_lsn)
5035		goto commit_undo;
5036
5037	/* Read the first record to be undone by this transaction. */
5038	err = read_log_rec_lcb(log, undo_next_lsn, lcb_ctx_undo_next, &lcb);
5039	if (err)
5040		goto out;
5041
5042	/*
5043	 * Now loop to read all of our log records forwards,
5044	 * until we hit the end of the file, cleaning up at the end.
5045	 */
5046undo_action_next:
5047
5048	lrh = lcb->log_rec;
5049	frh = lcb->lrh;
5050	transact_id = le32_to_cpu(frh->transact_id);
5051	rec_len = le32_to_cpu(frh->client_data_len);
5052
5053	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
5054		err = -EINVAL;
5055		goto out;
5056	}
5057
5058	if (lrh->undo_op == cpu_to_le16(Noop))
5059		goto read_next_log_undo_action;
5060
5061	oe = Add2Ptr(oatbl, le16_to_cpu(lrh->target_attr));
5062	oa = oe->ptr;
5063
5064	t16 = le16_to_cpu(lrh->lcns_follow);
5065	if (!t16)
5066		goto add_allocated_vcns;
5067
5068	is_mapped = run_lookup_entry(oa->run1, le64_to_cpu(lrh->target_vcn),
5069				     &lcn, &clen, NULL);
5070
5071	/*
5072	 * If the mapping isn't already the table or the  mapping
5073	 * corresponds to a hole the mapping, we need to make sure
5074	 * there is no partial page already memory.
5075	 */
5076	if (is_mapped && lcn != SPARSE_LCN && clen >= t16)
5077		goto add_allocated_vcns;
5078
5079	vcn = le64_to_cpu(lrh->target_vcn);
5080	vcn &= ~(u64)(log->clst_per_page - 1);
5081
5082add_allocated_vcns:
5083	for (i = 0, vcn = le64_to_cpu(lrh->target_vcn),
5084	    size = (vcn + 1) << sbi->cluster_bits;
5085	     i < t16; i++, vcn += 1, size += sbi->cluster_size) {
5086		attr = oa->attr;
5087		if (!attr->non_res) {
5088			if (size > le32_to_cpu(attr->res.data_size))
5089				attr->res.data_size = cpu_to_le32(size);
5090		} else {
5091			if (size > le64_to_cpu(attr->nres.data_size))
5092				attr->nres.valid_size = attr->nres.data_size =
5093					attr->nres.alloc_size =
5094						cpu_to_le64(size);
5095		}
5096	}
5097
5098	t16 = le16_to_cpu(lrh->undo_op);
5099	if (can_skip_action(t16))
5100		goto read_next_log_undo_action;
5101
5102	/* Point to the Redo data and get its length. */
5103	data = Add2Ptr(lrh, le16_to_cpu(lrh->undo_off));
5104	dlen = le16_to_cpu(lrh->undo_len);
5105
5106	/* It is time to apply the undo action. */
5107	err = do_action(log, oe, lrh, t16, data, dlen, rec_len, NULL);
5108
5109read_next_log_undo_action:
5110	/*
5111	 * Keep reading and looping back until we have read the
5112	 * last record for this transaction.
5113	 */
5114	err = read_next_log_rec(log, lcb, &rec_lsn);
5115	if (err)
5116		goto out;
5117
5118	if (rec_lsn)
5119		goto undo_action_next;
5120
5121	lcb_put(lcb);
5122	lcb = NULL;
5123
5124commit_undo:
5125	free_rsttbl_idx(trtbl, log->transaction_id);
5126
5127	log->transaction_id = 0;
5128
5129	goto transaction_table_next;
5130
5131undo_action_done:
5132
5133	ntfs_update_mftmirr(sbi, 0);
5134
5135	sbi->flags &= ~NTFS_FLAGS_NEED_REPLAY;
5136
5137end_replay:
5138
5139	err = 0;
5140	if (is_ro)
5141		goto out;
5142
5143	rh = kzalloc(log->page_size, GFP_NOFS);
5144	if (!rh) {
5145		err = -ENOMEM;
5146		goto out;
5147	}
5148
5149	rh->rhdr.sign = NTFS_RSTR_SIGNATURE;
5150	rh->rhdr.fix_off = cpu_to_le16(offsetof(struct RESTART_HDR, fixups));
5151	t16 = (log->page_size >> SECTOR_SHIFT) + 1;
5152	rh->rhdr.fix_num = cpu_to_le16(t16);
5153	rh->sys_page_size = cpu_to_le32(log->page_size);
5154	rh->page_size = cpu_to_le32(log->page_size);
5155
5156	t16 = ALIGN(offsetof(struct RESTART_HDR, fixups) + sizeof(short) * t16,
5157		    8);
5158	rh->ra_off = cpu_to_le16(t16);
5159	rh->minor_ver = cpu_to_le16(1); // 0x1A:
5160	rh->major_ver = cpu_to_le16(1); // 0x1C:
5161
5162	ra2 = Add2Ptr(rh, t16);
5163	memcpy(ra2, ra, sizeof(struct RESTART_AREA));
5164
5165	ra2->client_idx[0] = 0;
5166	ra2->client_idx[1] = LFS_NO_CLIENT_LE;
5167	ra2->flags = cpu_to_le16(2);
5168
5169	le32_add_cpu(&ra2->open_log_count, 1);
5170
5171	ntfs_fix_pre_write(&rh->rhdr, log->page_size);
5172
5173	err = ntfs_sb_write_run(sbi, &ni->file.run, 0, rh, log->page_size, 0);
5174	if (!err)
5175		err = ntfs_sb_write_run(sbi, &log->ni->file.run, log->page_size,
5176					rh, log->page_size, 0);
5177
5178	kfree(rh);
5179	if (err)
5180		goto out;
5181
5182out:
5183	kfree(rst);
5184	if (lcb)
5185		lcb_put(lcb);
5186
5187	/*
5188	 * Scan the Open Attribute Table to close all of
5189	 * the open attributes.
5190	 */
5191	oe = NULL;
5192	while ((oe = enum_rstbl(oatbl, oe))) {
5193		rno = ino_get(&oe->ref);
5194
5195		if (oe->is_attr_name == 1) {
5196			kfree(oe->ptr);
5197			oe->ptr = NULL;
5198			continue;
5199		}
5200
5201		if (oe->is_attr_name)
5202			continue;
5203
5204		oa = oe->ptr;
5205		if (!oa)
5206			continue;
5207
5208		run_close(&oa->run0);
5209		kfree(oa->attr);
5210		if (oa->ni)
5211			iput(&oa->ni->vfs_inode);
5212		kfree(oa);
5213	}
5214
5215	kfree(trtbl);
5216	kfree(oatbl);
5217	kfree(dptbl);
5218	kfree(attr_names);
5219	kfree(log->rst_info.r_page);
5220
5221	kfree(ra);
5222	kfree(log->one_page_buf);
5223
5224	if (err)
5225		sbi->flags |= NTFS_FLAGS_NEED_REPLAY;
5226
5227	if (err == -EROFS)
5228		err = 0;
5229	else if (log->set_dirty)
5230		ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
5231
5232	kfree(log);
5233
5234	return err;
5235}