fix a >2 year old stack overflow in the mtd rootfs split patch which only caused...
[librecmc/librecmc.git] / target / linux / generic-2.6 / patches-2.6.28 / 065-rootfs_split.patch
1 --- a/drivers/mtd/Kconfig
2 +++ b/drivers/mtd/Kconfig
3 @@ -45,6 +45,16 @@ config MTD_PARTITIONS
4           devices. Partitioning on NFTL 'devices' is a different - that's the
5           'normal' form of partitioning used on a block device.
6  
7 +config MTD_ROOTFS_ROOT_DEV
8 +       bool "Automatically set 'rootfs' partition to be root filesystem"
9 +       depends on MTD_PARTITIONS
10 +       default y
11 +
12 +config MTD_ROOTFS_SPLIT
13 +       bool "Automatically split 'rootfs' partition for squashfs"
14 +       depends on MTD_PARTITIONS
15 +       default y
16 +
17  config MTD_REDBOOT_PARTS
18         tristate "RedBoot partition table parsing"
19         depends on MTD_PARTITIONS
20 --- a/drivers/mtd/mtdpart.c
21 +++ b/drivers/mtd/mtdpart.c
22 @@ -18,6 +18,8 @@
23  #include <linux/mtd/mtd.h>
24  #include <linux/mtd/partitions.h>
25  #include <linux/mtd/compatmac.h>
26 +#include <linux/squashfs_fs.h>
27 +#include <linux/root_dev.h>
28  
29  /* Our partition linked list */
30  static LIST_HEAD(mtd_partitions);
31 @@ -37,7 +39,7 @@ struct mtd_part {
32   * the pointer to that structure with this macro.
33   */
34  #define PART(x)  ((struct mtd_part *)(x))
35 -
36 +#define IS_PART(mtd) (mtd->read == part_read)
37  
38  /*
39   * MTD methods which simply translate the effective address and pass through
40 @@ -489,6 +491,147 @@ out_register:
41         return slave;
42  }
43  
44 +#ifdef CONFIG_MTD_ROOTFS_SPLIT
45 +#define ROOTFS_SPLIT_NAME "rootfs_data"
46 +#define ROOTFS_REMOVED_NAME "<removed>"
47 +static int split_squashfs(struct mtd_info *master, int offset, int *split_offset)
48 +{
49 +       struct squashfs_super_block sb;
50 +       int len, ret;
51 +
52 +       ret = master->read(master, offset, sizeof(sb), &len, (void *) &sb);
53 +       if (ret || (len != sizeof(sb))) {
54 +               printk(KERN_ALERT "split_squashfs: error occured while reading "
55 +                       "from \"%s\"\n", master->name);
56 +               return -EINVAL;
57 +       }
58 +
59 +       if (sb.s_magic != SQUASHFS_MAGIC) {
60 +               printk(KERN_ALERT "split_squashfs: no squashfs found in \"%s\"\n",
61 +                       master->name);
62 +               *split_offset = 0;
63 +               return 0;
64 +       }
65 +
66 +       if (sb.bytes_used <= 0) {
67 +               printk(KERN_ALERT "split_squashfs: squashfs is empty in \"%s\"\n",
68 +                       master->name);
69 +               *split_offset = 0;
70 +               return 0;
71 +       }
72 +
73 +       len = (u32) sb.bytes_used;
74 +       len += (offset & 0x000fffff);
75 +       len +=  (master->erasesize - 1);
76 +       len &= ~(master->erasesize - 1);
77 +       len -= (offset & 0x000fffff);
78 +       *split_offset = offset + len;
79 +
80 +       return 0;
81 +}
82 +
83 +static int split_rootfs_data(struct mtd_info *master, struct mtd_info *rpart, const struct mtd_partition *part,
84 +               int index)
85 +{
86 +       struct mtd_partition *dpart;
87 +       struct mtd_part *slave = NULL;
88 +       int split_offset = 0;
89 +       int ret;
90 +
91 +       ret = split_squashfs(master, part->offset, &split_offset);
92 +       if (ret)
93 +               return ret;
94 +
95 +       if (split_offset <= 0)
96 +               return 0;
97 +
98 +       dpart = kmalloc(sizeof(*part)+sizeof(ROOTFS_SPLIT_NAME)+1, GFP_KERNEL);
99 +       if (dpart == NULL) {
100 +               printk(KERN_INFO "split_squashfs: no memory for partition \"%s\"\n",
101 +                       ROOTFS_SPLIT_NAME);
102 +               return -ENOMEM;
103 +       }
104 +
105 +       memcpy(dpart, part, sizeof(*part));
106 +       dpart->name = (unsigned char *)&dpart[1];
107 +       strcpy(dpart->name, ROOTFS_SPLIT_NAME);
108 +
109 +       dpart->size -= split_offset - dpart->offset;
110 +       dpart->offset = split_offset;
111 +
112 +       if (dpart == NULL)
113 +               return 1;
114 +
115 +       printk(KERN_INFO "mtd: partition \"%s\" created automatically, ofs=%X, len=%X \n",
116 +               ROOTFS_SPLIT_NAME, dpart->offset, dpart->size);
117 +
118 +       slave = add_one_partition(master, dpart, index, split_offset);
119 +       if (!slave) {
120 +               kfree(dpart);
121 +               return -ENOMEM;
122 +       }
123 +       rpart->split = &slave->mtd;
124 +
125 +       return 0;
126 +}
127 +
128 +static int refresh_rootfs_split(struct mtd_info *mtd)
129 +{
130 +       struct mtd_partition tpart;
131 +       struct mtd_part *part;
132 +       char *name;
133 +       int index = 0;
134 +       int offset, size;
135 +       int ret;
136 +
137 +       part = PART(mtd);
138 +
139 +       /* check for the new squashfs offset first */
140 +       ret = split_squashfs(part->master, part->offset, &offset);
141 +       if (ret)
142 +               return ret;
143 +
144 +       if ((offset > 0) && !mtd->split) {
145 +               printk(KERN_INFO "%s: creating new split partition for \"%s\"\n", __func__, mtd->name);
146 +               /* if we don't have a rootfs split partition, create a new one */
147 +               tpart.name = (char *) mtd->name;
148 +               tpart.size = mtd->size;
149 +               tpart.offset = part->offset;
150 +
151 +               /* find the index of the last partition */
152 +               if (!list_empty(&mtd_partitions))
153 +                       index = list_first_entry(&mtd_partitions, struct mtd_part, list)->index + 1;
154 +
155 +               return split_rootfs_data(part->master, &part->mtd, &tpart, index);
156 +       } else if ((offset > 0) && mtd->split) {
157 +               /* update the offsets of the existing partition */
158 +               size = mtd->size + part->offset - offset;
159 +
160 +               part = PART(mtd->split);
161 +               part->offset = offset;
162 +               part->mtd.size = size;
163 +               printk(KERN_INFO "%s: %s partition \"" ROOTFS_SPLIT_NAME "\", offset: 0x%06x (0x%06x)\n",
164 +                       __func__, (!strcmp(part->mtd.name, ROOTFS_SPLIT_NAME) ? "updating" : "creating"),
165 +                       part->offset, part->mtd.size);
166 +               name = kmalloc(sizeof(ROOTFS_SPLIT_NAME) + 1, GFP_KERNEL);
167 +               strcpy(name, ROOTFS_SPLIT_NAME);
168 +               part->mtd.name = name;
169 +       } else if ((offset <= 0) && mtd->split) {
170 +               printk(KERN_INFO "%s: removing partition \"%s\"\n", __func__, mtd->split->name);
171 +
172 +               /* mark existing partition as removed */
173 +               part = PART(mtd->split);
174 +               name = kmalloc(sizeof(ROOTFS_SPLIT_NAME) + 1, GFP_KERNEL);
175 +               strcpy(name, ROOTFS_REMOVED_NAME);
176 +               part->mtd.name = name;
177 +               part->offset = 0;
178 +               part->mtd.size = 0;
179 +       }
180 +
181 +       return 0;
182 +}
183 +#endif /* CONFIG_MTD_ROOTFS_SPLIT */
184 +
185  /*
186   * This function, given a master MTD object and a partition table, creates
187   * and registers slave MTD objects which are bound to the master according to
188 @@ -502,14 +645,29 @@ int add_mtd_partitions(struct mtd_info *
189  {
190         struct mtd_part *slave;
191         u_int32_t cur_offset = 0;
192 -       int i;
193 +       int i, j, ret;
194  
195         printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
196  
197 -       for (i = 0; i < nbparts; i++) {
198 -               slave = add_one_partition(master, parts + i, i, cur_offset);
199 +       for (i = 0, j = 0; i < nbparts; i++) {
200 +               slave = add_one_partition(master, parts + i, j++, cur_offset);
201                 if (!slave)
202                         return -ENOMEM;
203 +
204 +               if (!strcmp(parts[i].name, "rootfs") && slave->registered) {
205 +#ifdef CONFIG_MTD_ROOTFS_ROOT_DEV
206 +                       if (ROOT_DEV == 0) {
207 +                               printk(KERN_NOTICE "mtd: partition \"rootfs\" "
208 +                                       "set to be root filesystem\n");
209 +                               ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, slave->mtd.index);
210 +                       }
211 +#endif
212 +#ifdef CONFIG_MTD_ROOTFS_SPLIT
213 +                       ret = split_rootfs_data(master, &slave->mtd, &parts[i], j);
214 +                       if (ret == 0)
215 +                               j++;
216 +#endif
217 +               }
218                 cur_offset = slave->offset + slave->mtd.size;
219         }
220  
221 @@ -517,6 +675,32 @@ int add_mtd_partitions(struct mtd_info *
222  }
223  EXPORT_SYMBOL(add_mtd_partitions);
224  
225 +int refresh_mtd_partitions(struct mtd_info *mtd)
226 +{
227 +       int ret = 0;
228 +
229 +       if (IS_PART(mtd)) {
230 +               struct mtd_part *part;
231 +               struct mtd_info *master;
232 +
233 +               part = PART(mtd);
234 +               master = part->master;
235 +               if (master->refresh_device)
236 +                       ret = master->refresh_device(master);
237 +       }
238 +
239 +       if (!ret && mtd->refresh_device)
240 +               ret = mtd->refresh_device(mtd);
241 +
242 +#ifdef CONFIG_MTD_ROOTFS_SPLIT
243 +       if (!ret && IS_PART(mtd) && !strcmp(mtd->name, "rootfs"))
244 +               refresh_rootfs_split(mtd);
245 +#endif
246 +
247 +       return 0;
248 +}
249 +EXPORT_SYMBOL_GPL(refresh_mtd_partitions);
250 +
251  static DEFINE_SPINLOCK(part_parser_lock);
252  static LIST_HEAD(part_parsers);
253  
254 --- a/drivers/mtd/devices/block2mtd.c
255 +++ b/drivers/mtd/devices/block2mtd.c
256 @@ -29,6 +29,8 @@ struct block2mtd_dev {
257         struct block_device *blkdev;
258         struct mtd_info mtd;
259         struct mutex write_mutex;
260 +       rwlock_t bdev_mutex;
261 +       char devname[0];
262  };
263  
264  
265 @@ -81,6 +83,12 @@ static int block2mtd_erase(struct mtd_in
266         size_t len = instr->len;
267         int err;
268  
269 +       read_lock(&dev->bdev_mutex);
270 +       if (!dev->blkdev) {
271 +               err = -EINVAL;
272 +               goto done;
273 +       }
274 +
275         instr->state = MTD_ERASING;
276         mutex_lock(&dev->write_mutex);
277         err = _block2mtd_erase(dev, from, len);
278 @@ -93,6 +101,10 @@ static int block2mtd_erase(struct mtd_in
279  
280         instr->state = MTD_ERASE_DONE;
281         mtd_erase_callback(instr);
282 +
283 +done:
284 +       read_unlock(&dev->bdev_mutex);
285 +
286         return err;
287  }
288  
289 @@ -104,10 +116,14 @@ static int block2mtd_read(struct mtd_inf
290         struct page *page;
291         int index = from >> PAGE_SHIFT;
292         int offset = from & (PAGE_SIZE-1);
293 -       int cpylen;
294 +       int cpylen, err = 0;
295 +
296 +       read_lock(&dev->bdev_mutex);
297 +       if (!dev->blkdev || (from > mtd->size)) {
298 +               err = -EINVAL;
299 +               goto done;
300 +       }
301  
302 -       if (from > mtd->size)
303 -               return -EINVAL;
304         if (from + len > mtd->size)
305                 len = mtd->size - from;
306  
307 @@ -122,10 +138,14 @@ static int block2mtd_read(struct mtd_inf
308                 len = len - cpylen;
309  
310                 page = page_read(dev->blkdev->bd_inode->i_mapping, index);
311 -               if (!page)
312 -                       return -ENOMEM;
313 -               if (IS_ERR(page))
314 -                       return PTR_ERR(page);
315 +               if (!page) {
316 +                       err = -ENOMEM;
317 +                       goto done;
318 +               }
319 +               if (IS_ERR(page)) {
320 +                       err = PTR_ERR(page);
321 +                       goto done;
322 +               }
323  
324                 memcpy(buf, page_address(page) + offset, cpylen);
325                 page_cache_release(page);
326 @@ -136,7 +156,10 @@ static int block2mtd_read(struct mtd_inf
327                 offset = 0;
328                 index++;
329         }
330 -       return 0;
331 +
332 +done:
333 +       read_unlock(&dev->bdev_mutex);
334 +       return err;
335  }
336  
337  
338 @@ -188,12 +211,22 @@ static int block2mtd_write(struct mtd_in
339                 size_t *retlen, const u_char *buf)
340  {
341         struct block2mtd_dev *dev = mtd->priv;
342 -       int err;
343 +       int err = 0;
344 +
345 +       read_lock(&dev->bdev_mutex);
346 +       if (!dev->blkdev) {
347 +               err = -EINVAL;
348 +               goto done;
349 +       }
350  
351         if (!len)
352 -               return 0;
353 -       if (to >= mtd->size)
354 -               return -ENOSPC;
355 +               goto done;
356 +
357 +       if (to >= mtd->size) {
358 +               err = -ENOSPC;
359 +               goto done;
360 +       }
361 +
362         if (to + len > mtd->size)
363                 len = mtd->size - to;
364  
365 @@ -202,6 +235,9 @@ static int block2mtd_write(struct mtd_in
366         mutex_unlock(&dev->write_mutex);
367         if (err > 0)
368                 err = 0;
369 +
370 +done:
371 +       read_unlock(&dev->bdev_mutex);
372         return err;
373  }
374  
375 @@ -210,52 +246,29 @@ static int block2mtd_write(struct mtd_in
376  static void block2mtd_sync(struct mtd_info *mtd)
377  {
378         struct block2mtd_dev *dev = mtd->priv;
379 -       sync_blockdev(dev->blkdev);
380 -       return;
381 -}
382 -
383 -
384 -static void block2mtd_free_device(struct block2mtd_dev *dev)
385 -{
386 -       if (!dev)
387 -               return;
388 -
389 -       kfree(dev->mtd.name);
390  
391 -       if (dev->blkdev) {
392 -               invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping,
393 -                                       0, -1);
394 -               close_bdev_exclusive(dev->blkdev, FMODE_READ|FMODE_WRITE);
395 -       }
396 +       read_lock(&dev->bdev_mutex);
397 +       if (dev->blkdev)
398 +               sync_blockdev(dev->blkdev);
399 +       read_unlock(&dev->bdev_mutex);
400  
401 -       kfree(dev);
402 +       return;
403  }
404  
405  
406 -/* FIXME: ensure that mtd->size % erase_size == 0 */
407 -static struct block2mtd_dev *add_device(char *devname, int erase_size, const char *mtdname)
408 +static int _open_bdev(struct block2mtd_dev *dev)
409  {
410         struct block_device *bdev;
411 -       struct block2mtd_dev *dev;
412 -       struct mtd_partition *part;
413 -       char *name;
414 -
415 -       if (!devname)
416 -               return NULL;
417 -
418 -       dev = kzalloc(sizeof(struct block2mtd_dev), GFP_KERNEL);
419 -       if (!dev)
420 -               return NULL;
421  
422         /* Get a handle on the device */
423 -       bdev = open_bdev_exclusive(devname, FMODE_READ|FMODE_WRITE, NULL);
424 +       bdev = open_bdev_exclusive(dev->devname, FMODE_READ|FMODE_WRITE, NULL);
425  #ifndef MODULE
426         if (IS_ERR(bdev)) {
427  
428                 /* We might not have rootfs mounted at this point. Try
429                    to resolve the device name by other means. */
430  
431 -               dev_t devt = name_to_dev_t(devname);
432 +               dev_t devt = name_to_dev_t(dev->devname);
433                 if (devt) {
434                         bdev = open_by_devnum(devt, FMODE_WRITE | FMODE_READ);
435                 }
436 @@ -263,17 +276,97 @@ static struct block2mtd_dev *add_device(
437  #endif
438  
439         if (IS_ERR(bdev)) {
440 -               ERROR("error: cannot open device %s", devname);
441 -               goto devinit_err;
442 +               ERROR("error: cannot open device %s", dev->devname);
443 +               return 1;
444         }
445         dev->blkdev = bdev;
446  
447         if (MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) {
448                 ERROR("attempting to use an MTD device as a block device");
449 -               goto devinit_err;
450 +               return 1;
451         }
452  
453 +       return 0;
454 +}
455 +
456 +static void _close_bdev(struct block2mtd_dev *dev)
457 +{
458 +       struct block_device *bdev;
459 +
460 +       if (!dev->blkdev)
461 +               return;
462 +
463 +       bdev = dev->blkdev;
464 +       invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping, 0, -1);
465 +       close_bdev_exclusive(dev->blkdev, FMODE_READ|FMODE_WRITE);
466 +       dev->blkdev = NULL;
467 +}
468 +
469 +static void block2mtd_free_device(struct block2mtd_dev *dev)
470 +{
471 +       if (!dev)
472 +               return;
473 +
474 +       kfree(dev->mtd.name);
475 +       _close_bdev(dev);
476 +       kfree(dev);
477 +}
478 +
479 +
480 +static int block2mtd_refresh(struct mtd_info *mtd)
481 +{
482 +       struct block2mtd_dev *dev = mtd->priv;
483 +       struct block_device *bdev;
484 +       dev_t devt;
485 +       int err = 0;
486 +
487 +       /* no other mtd function can run at this point */
488 +       write_lock(&dev->bdev_mutex);
489 +
490 +       /* get the device number for the whole disk */
491 +       devt = MKDEV(MAJOR(dev->blkdev->bd_dev), 0);
492 +
493 +       /* close the old block device */
494 +       _close_bdev(dev);
495 +
496 +       /* open the whole disk, issue a partition rescan, then */
497 +       bdev = open_by_devnum(devt, FMODE_WRITE | FMODE_READ);
498 +       if (!bdev || !bdev->bd_disk)
499 +               err = -EINVAL;
500 +       else {
501 +               err = rescan_partitions(bdev->bd_disk, bdev);
502 +       }
503 +       if (bdev)
504 +               close_bdev_exclusive(bdev, FMODE_READ|FMODE_WRITE);
505 +
506 +       /* try to open the partition block device again */
507 +       _open_bdev(dev);
508 +       write_unlock(&dev->bdev_mutex);
509 +
510 +       return err;
511 +}
512 +
513 +/* FIXME: ensure that mtd->size % erase_size == 0 */
514 +static struct block2mtd_dev *add_device(char *devname, int erase_size, char *mtdname)
515 +{
516 +       struct block2mtd_dev *dev;
517 +       struct mtd_partition *part;
518 +       char *name;
519 +
520 +       if (!devname)
521 +               return NULL;
522 +
523 +       dev = kzalloc(sizeof(struct block2mtd_dev) + strlen(devname) + 1, GFP_KERNEL);
524 +       if (!dev)
525 +               return NULL;
526 +
527 +       strcpy(dev->devname, devname);
528 +
529 +       if (_open_bdev(dev))
530 +               goto devinit_err;
531 +
532         mutex_init(&dev->write_mutex);
533 +       rwlock_init(&dev->bdev_mutex);
534  
535         if (!mtdname)
536                 mtdname = devname;
537 @@ -297,6 +390,7 @@ static struct block2mtd_dev *add_device(
538         dev->mtd.read = block2mtd_read;
539         dev->mtd.priv = dev;
540         dev->mtd.owner = THIS_MODULE;
541 +       dev->mtd.refresh_device = block2mtd_refresh;
542  
543         part = kzalloc(sizeof(struct mtd_partition), GFP_KERNEL);
544         part->name = dev->mtd.name;
545 --- a/drivers/mtd/mtdchar.c
546 +++ b/drivers/mtd/mtdchar.c
547 @@ -16,6 +16,7 @@
548  
549  #include <linux/mtd/mtd.h>
550  #include <linux/mtd/compatmac.h>
551 +#include <linux/mtd/partitions.h>
552  
553  #include <asm/uaccess.h>
554  
555 @@ -769,6 +770,13 @@ static int mtd_ioctl(struct inode *inode
556                 file->f_pos = 0;
557                 break;
558         }
559 +#ifdef CONFIG_MTD_PARTITIONS
560 +       case MTDREFRESH:
561 +       {
562 +               ret = refresh_mtd_partitions(mtd);
563 +               break;
564 +       }
565 +#endif
566  
567         default:
568                 ret = -ENOTTY;
569 --- a/include/linux/mtd/mtd.h
570 +++ b/include/linux/mtd/mtd.h
571 @@ -98,6 +98,7 @@ struct mtd_oob_ops {
572         uint8_t         *oobbuf;
573  };
574  
575 +struct mtd_info;
576  struct mtd_info {
577         u_char type;
578         u_int32_t flags;
579 @@ -213,6 +214,9 @@ struct mtd_info {
580         struct module *owner;
581         int usecount;
582  
583 +       int (*refresh_device)(struct mtd_info *mtd);
584 +       struct mtd_info *split;
585 +
586         /* If the driver is something smart, like UBI, it may need to maintain
587          * its own reference counting. The below functions are only for driver.
588          * The driver may register its callbacks. These callbacks are not
589 --- a/include/linux/mtd/partitions.h
590 +++ b/include/linux/mtd/partitions.h
591 @@ -34,6 +34,7 @@
592   * erasesize aligned (e.g. use MTDPART_OFS_NEXTBLK).
593   */
594  
595 +struct mtd_partition;
596  struct mtd_partition {
597         char *name;                     /* identifier string */
598         u_int32_t size;                 /* partition size */
599 @@ -41,6 +42,7 @@ struct mtd_partition {
600         u_int32_t mask_flags;           /* master MTD flags to mask out for this partition */
601         struct nand_ecclayout *ecclayout;       /* out of band layout for this partition (NAND only)*/
602         struct mtd_info **mtdp;         /* pointer to store the MTD object */
603 +       int (*refresh_partition)(struct mtd_info *);
604  };
605  
606  #define MTDPART_OFS_NXTBLK     (-2)
607 @@ -50,6 +52,7 @@ struct mtd_partition {
608  
609  int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
610  int del_mtd_partitions(struct mtd_info *);
611 +int refresh_mtd_partitions(struct mtd_info *);
612  
613  /*
614   * Functions dealing with the various ways of partitioning the space
615 --- a/include/mtd/mtd-abi.h
616 +++ b/include/mtd/mtd-abi.h
617 @@ -93,6 +93,7 @@ struct otp_info {
618  #define ECCGETLAYOUT           _IOR('M', 17, struct nand_ecclayout)
619  #define ECCGETSTATS            _IOR('M', 18, struct mtd_ecc_stats)
620  #define MTDFILEMODE            _IO('M', 19)
621 +#define MTDREFRESH             _IO('M', 23)
622  
623  /*
624   * Obsolete legacy interface. Keep it in order not to break userspace