1. 17 Jul, 2019 1 commit
    • Kirk McKusick's avatar
      The error reported in FS-14-UFS-3 can only happen on UFS/FFS · fdf34aa3
      Kirk McKusick authored
      filesystems that have block pointers that are out-of-range for their
      filesystem. These out-of-range block pointers are corrected by
      fsck(8) so are only encountered when an unchecked filesystem is
      mounted.
      
      A new "untrusted" flag has been added to the generic mount interface
      that can be set when mounting media of unknown provenance or integrity.
      For example, a daemon that automounts a filesystem on a flash drive
      when it is plugged into a system.
      
      This commit adds a test to UFS/FFS that validates all block numbers
      before using them. Because checking for out-of-range blocks adds
      unnecessary overhead to normal operation, the tests are only done
      when the filesystem is mounted as an "untrusted" filesystem.
      
      Reported by:  Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert of Fraunhofer FKIE
      Reported as:  FS-14-UFS-3: Out of bounds read in write-2 (ffs_alloccg)
      Reviewed by:  kib
      Sponsored by: Netflix
      fdf34aa3
  2. 17 Jun, 2019 1 commit
  3. 15 Dec, 2018 3 commits
    • Kirk McKusick's avatar
      Ensure that the inode check-hash is not left zeroed out in the case where · c8f55fc4
      Kirk McKusick authored
      the check-hash fails. Prior to the fix in -r342133 the inode with the
      zeroed out check-hash was written back to disk causing further confusion.
      
      Reported by:  Gary Jennejohn (gj)
      Sponsored by: Netflix
      c8f55fc4
    • Kirk McKusick's avatar
      Reorder ffs_verify_dinode_ckhash() so that it checks the inode check-hash · 72d28f97
      Kirk McKusick authored
      before copying in the inode so that the mode and link-count are not set
      if the check-hash fails. This change ensures that the vnode will be properly
      unwound and recycled rather than being held in the cache.
      
      Initialize the file mode is zero so that if the loading of the inode
      fails (for example because of a check-hash failure), the vnode will be
      properly unwound and recycled.
      
      Reported by:  Gary Jennejohn (gj)
      Sponsored by: Netflix
      72d28f97
    • Kirk McKusick's avatar
      Must set ip->i_effnlink = ip->i_nlink to avoid a soft updates · 6fa9bc99
      Kirk McKusick authored
      "panic: softdep_update_inodeblock: bad link count" when releasing
      a partially initialized vnode after an inode check-hash failure.
      
      Reported by:  Gary Jennejohn <gljennjohn@gmail.com>
      Reported by:  Peter Holm (pho)
      Sponsored by: Netflix
      6fa9bc99
  4. 11 Dec, 2018 1 commit
    • Kirk McKusick's avatar
      Continuing efforts to provide hardening of FFS. This change adds a · 8f829a5c
      Kirk McKusick authored
      check hash to the filesystem inodes. Access attempts to files
      associated with an inode with an invalid check hash will fail with
      EINVAL (Invalid argument). Access is reestablished after an fsck
      is run to find and validate the inodes with invalid check-hashes.
      This check avoids a class of filesystem panics related to corrupted
      inodes. The hash is done using crc32c.
      
      Note this check-hash is for the inode itself and not any of its
      indirect blocks. Check-hash validation may be extended to also
      cover indirect block pointers, but that will be a separate (and
      more costly) feature.
      
      Check hashes are added only to UFS2 and not to UFS1 as UFS1 is
      primarily used in embedded systems with small memories and low-powered
      processors which need as light-weight a filesystem as possible.
      
      Reviewed by:  kib
      Tested by:    Peter Holm
      Sponsored by: Netflix
      8f829a5c
  5. 06 Dec, 2018 1 commit
    • Kirk McKusick's avatar
      Normally when an attempt is made to mount a UFS/FFS filesystem whose · fb14e73c
      Kirk McKusick authored
      superblock has a check-hash error, an error message noting the
      superblock check-hash failure is printed and the mount fails. The
      administrator then runs fsck to repair the filesystem and when
      successful, the filesystem can once again be mounted.
      
      This approach fails if the filesystem in question is a root filesystem
      from which you are trying to boot. Here, the loader fails when trying
      to access the filesystem to get the kernel to boot. So it is necessary
      to allow the loader to ignore the superblock check-hash error and make
      a best effort to read the kernel. The filesystem may be suffiently
      corrupted that the read attempt fails, but there is no harm in trying
      since the loader makes no attempt to write to the filesystem.
      
      Once the kernel is loaded and starts to run, it attempts to mount its
      root filesystem. Once again, failure means that it breaks to its prompt
      to ask where to get its root filesystem. Unless you have an alternate
      root filesystem, you are stuck.
      
      Since the root filesystem is initially mounted read-only, it is
      safe to make an attempt to mount the root filesystem with the failed
      superblock check-hash. Thus, when asked to mount a root filesystem
      with a failed superblock check-hash, the kernel prints a warning
      message that the root filesystem superblock check-hash needs repair,
      but notes that it is ignoring the error and proceeding. It does
      mark the filesystem as needing an fsck which prevents it from being
      enabled for writing until fsck has been run on it. The net effect
      is that the reboot fails to single user, but at least at that point
      the administrator has the tools at hand to fix the problem.
      
      Reported by:    Rick Macklem (rmacklem@)
      Discussed with: Warner Losh (imp@)
      Sponsored by:   Netflix
      fb14e73c
  6. 26 Nov, 2018 1 commit
  7. 25 Nov, 2018 1 commit
  8. 13 Nov, 2018 1 commit
    • Kirk McKusick's avatar
      In preparation for adding inode check-hashes, clean up and · 9fc5d538
      Kirk McKusick authored
      document the libufs interface for fetching and storing inodes.
      The undocumented getino / putino interface has been replaced
      with a new getinode / putinode interface.
      
      Convert the utilities that had been using the undocumented
      interface to use the new documented interface.
      
      No functional change (as for now the libufs library does not
      do inode check-hashes).
      
      Reviewed by:  kib
      Tested by:    Peter Holm
      Sponsored by: Netflix
      9fc5d538
  9. 23 Oct, 2018 1 commit
    • Kirk McKusick's avatar
      Continuing efforts to provide hardening of FFS, this change adds a · ec888383
      Kirk McKusick authored
      check hash to the superblock. If a check hash fails when an attempt
      is made to mount a filesystem, the mount fails with EINVAL (Invalid
      argument). This avoids a class of filesystem panics related to
      corrupted superblocks. The hash is done using crc32c.
      
      Check hases are added only to UFS2 and not to UFS1 as UFS1 is primarily
      used in embedded systems with small memories and low-powered processors
      which need as light-weight a filesystem as possible.
      
      Reviewed by:  kib
      Tested by:    Peter Holm
      Sponsored by: Netflix
      ec888383
  10. 07 Jul, 2018 1 commit
    • Kirk McKusick's avatar
      Import commit from NetBSD with checkin message: · e1c27cf7
      Kirk McKusick authored
          Avoid Undefined Behavior in ffs_clusteracct()
      
          Change the type of 'bit' variable from int to unsigned int and use unsigned
          values consistently.
      
          sys/ufs/ffs/ffs_subr.c:336:10, shift exponent -1 is negative
      
          Detected with Kernel Undefined Behavior Sanitizer.
      
          Reported by <Harry Pantazis>
      
      Submitted by: Pedro Giffuni
      e1c27cf7
  11. 02 Mar, 2018 1 commit
    • Kirk McKusick's avatar
      This change is some refactoring of Mark Johnston's changes in r329375 · efbf3964
      Kirk McKusick authored
      to fix the memory leak that I introduced in r328426. Instead of
      trying to clear up the possible memory leak in all the clients, I
      ensure that it gets cleaned up in the source (e.g., ffs_sbget ensures
      that memory is always freed if it returns an error).
      
      The original change in r328426 was a bit sparse in its description.
      So I am expanding on its description here (thanks cem@ and rgrimes@
      for your encouragement for my longer commit messages).
      
      In preparation for adding check hashing to superblocks, r328426 is
      a refactoring of the code to get the reading/writing of the superblock
      into one place. Unlike the cylinder group reading/writing which
      ends up in two places (ffs_getcg/ffs_geom_strategy in the kernel
      and cgget/cgput in libufs), I have the core superblock functions
      just in the kernel (ffs_sbfetch/ffs_sbput in ffs_subr.c which is
      already imported into utilities like fsck_ffs as well as libufs to
      implement sbget/sbput). The ffs_sbfetch and ffs_sbput functions
      take a function pointer to do the actual I/O for which there are
      four variants:
      
          ffs_use_bread / ffs_use_bwrite for the in-kernel filesystem
      
          g_use_g_read_data / g_use_g_write_data for kernel geom clients
      
          ufs_use_sa_read for the standalone code (stand/libsa/ufs.c
      	but not stand/libsa/ufsread.c which is size constrained)
      
          use_pread / use_pwrite for libufs
      
      Uses of these interfaces are in the UFS filesystem, geoms journal &
      label, libsa changes, and libufs. They also permeate out into the
      filesystem utilities fsck_ffs, newfs, growfs, clri, dump, quotacheck,
      fsirand, fstyp, and quot. Some of these utilities should probably be
      converted to directly use libufs (like dumpfs was for example), but
      there does not seem to be much win in doing so.
      
      Tested by: Peter Holm (pho@)
      efbf3964
  12. 26 Feb, 2018 1 commit
  13. 24 Feb, 2018 1 commit
  14. 21 Feb, 2018 1 commit
  15. 19 Feb, 2018 1 commit
  16. 16 Feb, 2018 1 commit
    • Mark Johnston's avatar
      Fix a memory leak introduced in r328426. · 16759360
      Mark Johnston authored
      ffs_sbget() may return a superblock buffer even if it fails, so the
      caller must be prepared to free it in this case. Moreover, when tasting
      alternate superblock locations in a loop, ffs_sbget()'s readfunc
      callback must free the previously allocated buffer.
      
      Reported and tested by:	pho
      Reviewed by:		kib (previous version)
      Differential Revision:	https://reviews.freebsd.org/D14390
      16759360
  17. 26 Jan, 2018 1 commit
    • Kirk McKusick's avatar
      Refactoring of reading and writing of the UFS/FFS superblock. · dffce215
      Kirk McKusick authored
      Specifically reading is done if ffs_sbget() and writing is done
      in ffs_sbput(). These functions are exported to libufs via the
      sbget() and sbput() functions which then used in the various
      filesystem utilities. This work is in preparation for adding
      subperblock check hashes.
      
      No functional change intended.
      
      Reviewed by: kib
      dffce215
  18. 20 Nov, 2017 1 commit
    • Pedro F. Giffuni's avatar
      sys: further adoption of SPDX licensing ID tags. · 51369649
      Pedro F. Giffuni authored
      Mainly focus on files that use BSD 3-Clause license.
      
      The Software Package Data Exchange (SPDX) group provides a specification
      to make it easier for automated tools to detect and summarize well known
      opensource licenses. We are gradually adopting the specification, noting
      that the tags are considered only advisory and do not, in any way,
      superceed or replace the license texts.
      
      Special thanks to Wind River for providing access to "The Duke of
      Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
      starting point.
      51369649
  19. 31 Oct, 2016 1 commit
  20. 17 Sep, 2016 1 commit
    • Konstantin Belousov's avatar
      Reduce size of ufs inode. · e1db6897
      Konstantin Belousov authored
      Remove redunand i_dev and i_fs pointers, which are available as
      ip->i_ump->um_dev and ip->i_ump->um_fs, and reorder members by size to
      reduce padding.  To compensate added derefences, the most often i_ump
      access to differentiate between UFS1 and UFS2 dinode layout is
      removed, by addition of the new i_flag IN_UFS2.  Overall, this
      actually reduces the amount of memory dereferences.
      
      On 64bit machine, original struct inode size is 176, reduced to 152
      bytes with the change.
      
      Tested by:	pho (previous version)
      Reviewed by:	mckusick
      Sponsored by:	The FreeBSD Foundation
      MFC after:	2 weeks
      e1db6897
  21. 29 Jul, 2015 1 commit
    • Jeff Roberson's avatar
      - Make 'struct buf *buf' private to vfs_bio.c. Having a global variable · 98082691
      Jeff Roberson authored
         'buf' is inconvenient and has lead me to some irritating to discover
         bugs over the years.  It also makes it more challenging to refactor
         the buf allocation system.
       - Move swbuf and declare it as an extern in vfs_bio.c.  This is still
         not perfect but better than it was before.
       - Eliminate the unused ffs function that relied on knowledge of the buf
         array.
       - Move the shutdown code that iterates over the buf array into vfs_bio.c.
      
      Reviewed by:	kib
      Sponsored by:	EMC / Isilon Storage Division
      98082691
  22. 19 Oct, 2010 1 commit
  23. 24 Apr, 2010 1 commit
  24. 18 Dec, 2008 1 commit
    • Sam Leffler's avatar
      Apply the big hammer: · a6b691a8
      Sam Leffler authored
      o remove all of compat except for pwcache and strstuftoll; these might
        end up in libutil or similar so keep them in the subdir
      o mv getid.c up to the top level; this looks like something that'll be
        makefs-specific
      o eliminate private versions of .h files in sys; use system files instead
      o eliminate private ffs_tables.c; use the system version directly (might
        want to adopt const'ification at some point but that's the only diff I
        can see)
      o mv remaining code from sys to ffs and strip out unused bits; this now
        becomes part of makefs
      o add compat defs and shims to makefs.h
      o strip all vestiges of nbtool_config.h, compat_defs.h, etc.
      o fixup includes after file shuffling
      o rename system #defines that do implicit byte swapping to have an _swap
        suffix; e.g. DIRSIZ -> DIRSIZ_SWAP, cg_inosused -> cg_inosused_swap; if
        we ever add endian-agnostic support to the kernel these can go back to
        their original names
      o strip some netbsd'isms that aren't worth shim'ing (e.g. _DIAGASSERT)
      
      Code compiles w/o complaints but is untested.
      a6b691a8
  25. 23 Nov, 2008 1 commit
  26. 19 Oct, 2008 1 commit
  27. 07 Jan, 2005 1 commit
  28. 10 Jul, 2004 1 commit
  29. 07 Apr, 2004 1 commit
  30. 11 Jun, 2003 1 commit
  31. 18 Mar, 2003 1 commit
  32. 27 Dec, 2002 1 commit
  33. 31 Jul, 2002 1 commit
  34. 30 Jul, 2002 1 commit
  35. 23 Jun, 2002 1 commit
  36. 21 Jun, 2002 1 commit
    • Kirk McKusick's avatar
      This commit adds basic support for the UFS2 filesystem. The UFS2 · 1c85e6a3
      Kirk McKusick authored
      filesystem expands the inode to 256 bytes to make space for 64-bit
      block pointers. It also adds a file-creation time field, an ability
      to use jumbo blocks per inode to allow extent like pointer density,
      and space for extended attributes (up to twice the filesystem block
      size worth of attributes, e.g., on a 16K filesystem, there is space
      for 32K of attributes). UFS2 fully supports and runs existing UFS1
      filesystems. New filesystems built using newfs can be built in either
      UFS1 or UFS2 format using the -O option. In this commit UFS1 is
      the default format, so if you want to build UFS2 format filesystems,
      you must specify -O 2. This default will be changed to UFS2 when
      UFS2 proves itself to be stable. In this commit the boot code for
      reading UFS2 filesystems is not compiled (see /sys/boot/common/ufsread.c)
      as there is insufficient space in the boot block. Once the size of the
      boot block is increased, this code can be defined.
      
      Things to note: the definition of SBSIZE has changed to SBLOCKSIZE.
      The header file <ufs/ufs/dinode.h> must be included before
      <ufs/ffs/fs.h> so as to get the definitions of ufs2_daddr_t and
      ufs_lbn_t.
      
      Still TODO:
      Verify that the first level bootstraps work for all the architectures.
      Convert the utility ffsinfo to understand UFS2 and test growfs.
      Add support for the extended attribute storage. Update soft updates
      to ensure integrity of extended attribute storage. Switch the
      current extended attribute interfaces to use the extended attribute
      storage. Add the extent like functionality (framework is there,
      but is currently never used).
      
      Sponsored by: DARPA & NAI Labs.
      Reviewed by:	Poul-Henning Kamp <phk@freebsd.org>
      1c85e6a3
  37. 13 May, 2002 1 commit
  38. 19 Mar, 2002 1 commit