Bug Summary

File:ufs/ffs/ffs_inode.c
Warning:line 535, column 8
Array access (from variable 'bap2') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ffs_inode.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -D CONFIG_DRM_AMD_DC_DCN3_0 -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /usr/obj/sys/arch/amd64/compile/GENERIC.MP/scan-build/2022-01-12-131800-47421-1 -x c /usr/src/sys/ufs/ffs/ffs_inode.c
1/* $OpenBSD: ffs_inode.c,v 1.81 2021/12/12 09:14:59 visa Exp $ */
2/* $NetBSD: ffs_inode.c,v 1.10 1996/05/11 18:27:19 mycroft Exp $ */
3
4/*
5 * Copyright (c) 1982, 1986, 1989, 1993
6 * The Regents of the University of California. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the University nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 * @(#)ffs_inode.c 8.8 (Berkeley) 10/19/94
33 */
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/mount.h>
38#include <sys/proc.h>
39#include <sys/buf.h>
40#include <sys/vnode.h>
41#include <sys/kernel.h>
42#include <sys/malloc.h>
43#include <sys/resourcevar.h>
44
45#include <ufs/ufs/quota.h>
46#include <ufs/ufs/inode.h>
47#include <ufs/ufs/ufsmount.h>
48#include <ufs/ufs/ufs_extern.h>
49
50#include <ufs/ffs/fs.h>
51#include <ufs/ffs/ffs_extern.h>
52
53int ffs_indirtrunc(struct inode *, daddr_t, daddr_t, daddr_t, int, long *);
54
55/*
56 * Update the access, modified, and inode change times as specified by the
57 * IN_ACCESS, IN_UPDATE, and IN_CHANGE flags respectively. The IN_MODIFIED
58 * flag is used to specify that the inode needs to be updated but that the
59 * times have already been set. The IN_LAZYMOD flag is used to specify
60 * that the inode needs to be updated at some point, by reclaim if not
61 * in the course of other changes; this is used to defer writes just to
62 * update device timestamps. If waitfor is set, then wait for the disk
63 * write of the inode to complete.
64 */
65int
66ffs_update(struct inode *ip, int waitfor)
67{
68 struct vnode *vp;
69 struct fs *fs;
70 struct buf *bp;
71 int error;
72
73 vp = ITOV(ip)((ip)->i_vnode);
74 ufs_itimes(vp);
75
76 if ((ip->i_flag & IN_MODIFIED0x0008) == 0 && waitfor == 0)
77 return (0);
78
79 ip->i_flag &= ~(IN_MODIFIED0x0008 | IN_LAZYMOD0x0080);
80 fs = ip->i_fsinode_u.fs;
81
82 /*
83 * Ensure that uid and gid are correct. This is a temporary
84 * fix until fsck has been changed to do the update.
85 */
86 if (fs->fs_magic == FS_UFS1_MAGIC0x011954 && fs->fs_inodefmt < FS_44INODEFMT2) {
87 ip->i_din1dinode_u.ffs1_din->di_ouiddi_u.oldids[0] = ip->i_ffs1_uiddinode_u.ffs1_din->di_uid;
88 ip->i_din1dinode_u.ffs1_din->di_ogiddi_u.oldids[1] = ip->i_ffs1_giddinode_u.ffs1_din->di_gid;
89 }
90
91 error = bread(ip->i_devvpi_ump->um_devvp, fsbtodb(fs, ino_to_fsba(fs, ip->i_number))((((daddr_t)(((((daddr_t)(fs)->fs_fpg * (((ip->i_number
) / (fs)->fs_ipg))) + (fs)->fs_cgoffset * ((((ip->i_number
) / (fs)->fs_ipg)) & ~((fs)->fs_cgmask))) + (fs)->
fs_iblkno) + ((((((ip->i_number) % (fs)->fs_ipg) / ((fs
)->fs_inopb))) << ((fs))->fs_fragshift))))) <<
(fs)->fs_fsbtodb),
92 (int)fs->fs_bsize, &bp);
93 if (error) {
94 brelse(bp);
95 return (error);
96 }
97
98 if (DOINGSOFTDEP(vp)((vp)->v_mount->mnt_flag & 0x04000000))
99 softdep_update_inodeblock(ip, bp, waitfor);
100 else if (ip->i_effnlink != DIP(ip, nlink)(((ip)->i_ump->um_fstype == 1) ? (ip)->dinode_u.ffs1_din
->di_nlink : (ip)->dinode_u.ffs2_din->di_nlink))
101 panic("ffs_update: bad link cnt");
102
103#ifdef FFS21
104 if (ip->i_ump->um_fstype == UM_UFS22)
105 *((struct ufs2_dinode *)bp->b_data +
106 ino_to_fsbo(fs, ip->i_number)((ip->i_number) % ((fs)->fs_inopb))) = *ip->i_din2dinode_u.ffs2_din;
107 else
108#endif
109 *((struct ufs1_dinode *)bp->b_data +
110 ino_to_fsbo(fs, ip->i_number)((ip->i_number) % ((fs)->fs_inopb))) = *ip->i_din1dinode_u.ffs1_din;
111
112 if (waitfor && !DOINGASYNC(vp)((vp)->v_mount->mnt_flag & 0x00000040)) {
113 return (bwrite(bp));
114 } else {
115 bdwrite(bp);
116 return (0);
117 }
118}
119
120#define SINGLE0 0 /* index of single indirect block */
121#define DOUBLE1 1 /* index of double indirect block */
122#define TRIPLE2 2 /* index of triple indirect block */
123
124/*
125 * Truncate the inode oip to at most length size, freeing the
126 * disk blocks.
127 */
128int
129ffs_truncate(struct inode *oip, off_t length, int flags, struct ucred *cred)
130{
131 struct vnode *ovp;
132 daddr_t lastblock;
133 daddr_t bn, lbn, lastiblock[NIADDR3], indir_lbn[NIADDR3];
134 daddr_t oldblks[NDADDR12 + NIADDR3], newblks[NDADDR12 + NIADDR3];
135 struct fs *fs;
136 struct buf *bp;
137 int offset, size, level;
138 long count, nblocks, vflags, blocksreleased = 0;
139 int i, aflags, error, allerror;
140 off_t osize;
141
142 if (length < 0)
143 return (EINVAL22);
144 ovp = ITOV(oip)((oip)->i_vnode);
145
146 if (ovp->v_type != VREG &&
147 ovp->v_type != VDIR &&
148 ovp->v_type != VLNK)
149 return (0);
150
151 if (DIP(oip, size)(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_size : (oip)->dinode_u.ffs2_din->di_size) == length)
152 return (0);
153
154 if (ovp->v_type == VLNK &&
155 (DIP(oip, size)(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_size : (oip)->dinode_u.ffs2_din->di_size) < oip->i_ump->um_maxsymlinklen ||
156 (oip->i_ump->um_maxsymlinklen == 0 &&
157 oip->i_din1dinode_u.ffs1_din->di_blocks == 0))) {
158#ifdef DIAGNOSTIC1
159 if (length != 0)
160 panic("ffs_truncate: partial truncate of symlink");
161#endif
162 memset(SHORTLINK(oip), 0, (size_t) DIP(oip, size))__builtin_memset(((((oip)->i_ump->um_fstype == 1) ? (caddr_t
)(oip)->dinode_u.ffs1_din->di_db : (caddr_t)(oip)->dinode_u
.ffs2_din->di_db)), (0), ((size_t) (((oip)->i_ump->um_fstype
== 1) ? (oip)->dinode_u.ffs1_din->di_size : (oip)->
dinode_u.ffs2_din->di_size)));
163 DIP_ASSIGN(oip, size, 0)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_size = (0); else (oip)->dinode_u.ffs2_din
->di_size = (0); } while (0);
164 oip->i_flag |= IN_CHANGE0x0002 | IN_UPDATE0x0004;
165 return (UFS_UPDATE(oip, 1)((oip)->i_vtbl->iv_update)((oip), (1)));
166 }
167
168 if ((error = getinoquota(oip)) != 0)
169 return (error);
170
171 fs = oip->i_fsinode_u.fs;
172 if (length > fs->fs_maxfilesize)
173 return (EFBIG27);
174
175 uvm_vnp_setsize(ovp, length);
176 oip->i_ci.ci_lasta = oip->i_ci.ci_clen
177 = oip->i_ci.ci_cstart = oip->i_ci.ci_lastw = 0;
178
179 if (DOINGSOFTDEP(ovp)((ovp)->v_mount->mnt_flag & 0x04000000)) {
180 if (length > 0 || softdep_slowdown(ovp)) {
181 /*
182 * If a file is only partially truncated, then
183 * we have to clean up the data structures
184 * describing the allocation past the truncation
185 * point. Finding and deallocating those structures
186 * is a lot of work. Since partial truncation occurs
187 * rarely, we solve the problem by syncing the file
188 * so that it will have no data structures left.
189 */
190 if ((error = VOP_FSYNC(ovp, cred, MNT_WAIT1,
191 curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
(__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
__ci;})->ci_curproc)) != 0)
192 return (error);
193 } else {
194 (void)ufs_quota_free_blocks(oip, DIP(oip, blocks),ufs_quota_free_blocks2(oip, (((oip)->i_ump->um_fstype ==
1) ? (oip)->dinode_u.ffs1_din->di_blocks : (oip)->dinode_u
.ffs2_din->di_blocks), ((struct ucred *)-1), 0)
195 NOCRED)ufs_quota_free_blocks2(oip, (((oip)->i_ump->um_fstype ==
1) ? (oip)->dinode_u.ffs1_din->di_blocks : (oip)->dinode_u
.ffs2_din->di_blocks), ((struct ucred *)-1), 0);
196 softdep_setup_freeblocks(oip, length);
197 vinvalbuf(ovp, 0, cred, curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
(__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
__ci;})->ci_curproc, 0, INFSLP0xffffffffffffffffULL);
198 oip->i_flag |= IN_CHANGE0x0002 | IN_UPDATE0x0004;
199 return (UFS_UPDATE(oip, 0)((oip)->i_vtbl->iv_update)((oip), (0)));
200 }
201 }
202
203 osize = DIP(oip, size)(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_size : (oip)->dinode_u.ffs2_din->di_size);
204 /*
205 * Lengthen the size of the file. We must ensure that the
206 * last byte of the file is allocated. Since the smallest
207 * value of osize is 0, length will be at least 1.
208 */
209 if (osize < length) {
210 aflags = B_CLRBUF0x01;
211 if (flags & IO_SYNC0x04)
212 aflags |= B_SYNC0x02;
213 error = UFS_BUF_ALLOC(oip, length - 1, 1,((oip)->i_vtbl->iv_buf_alloc)((oip), (length - 1), (1),
(cred), (aflags), (&bp))
214 cred, aflags, &bp)((oip)->i_vtbl->iv_buf_alloc)((oip), (length - 1), (1),
(cred), (aflags), (&bp));
215 if (error)
216 return (error);
217 DIP_ASSIGN(oip, size, length)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_size = (length); else (oip)->dinode_u.ffs2_din
->di_size = (length); } while (0);
218 uvm_vnp_setsize(ovp, length);
219 (void) uvm_vnp_uncache(ovp);
220 if (aflags & B_SYNC0x02)
221 bwrite(bp);
222 else
223 bawrite(bp);
224 oip->i_flag |= IN_CHANGE0x0002 | IN_UPDATE0x0004;
225 return (UFS_UPDATE(oip, 1)((oip)->i_vtbl->iv_update)((oip), (1)));
226 }
227 uvm_vnp_setsize(ovp, length);
228
229 /*
230 * Shorten the size of the file. If the file is not being
231 * truncated to a block boundary, the contents of the
232 * partial block following the end of the file must be
233 * zero'ed in case it ever becomes accessible again because
234 * of subsequent file growth. Directories however are not
235 * zero'ed as they should grow back initialized to empty.
236 */
237 offset = blkoff(fs, length)((length) & (fs)->fs_qbmask);
238 if (offset == 0) {
239 DIP_ASSIGN(oip, size, length)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_size = (length); else (oip)->dinode_u.ffs2_din
->di_size = (length); } while (0);
240 } else {
241 lbn = lblkno(fs, length)((length) >> (fs)->fs_bshift);
242 aflags = B_CLRBUF0x01;
243 if (flags & IO_SYNC0x04)
244 aflags |= B_SYNC0x02;
245 error = UFS_BUF_ALLOC(oip, length - 1, 1,((oip)->i_vtbl->iv_buf_alloc)((oip), (length - 1), (1),
(cred), (aflags), (&bp))
246 cred, aflags, &bp)((oip)->i_vtbl->iv_buf_alloc)((oip), (length - 1), (1),
(cred), (aflags), (&bp));
247 if (error)
248 return (error);
249 /*
250 * When we are doing soft updates and the UFS_BALLOC
251 * above fills in a direct block hole with a full sized
252 * block that will be truncated down to a fragment below,
253 * we must flush out the block dependency with an FSYNC
254 * so that we do not get a soft updates inconsistency
255 * when we create the fragment below.
256 */
257 if (DOINGSOFTDEP(ovp)((ovp)->v_mount->mnt_flag & 0x04000000) && lbn < NDADDR12 &&
258 fragroundup(fs, blkoff(fs, length))(((((length) & (fs)->fs_qbmask)) + (fs)->fs_qfmask)
& (fs)->fs_fmask) < fs->fs_bsize &&
259 (error = VOP_FSYNC(ovp, cred, MNT_WAIT1, curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
(__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
__ci;})->ci_curproc)) != 0)
260 return (error);
261 DIP_ASSIGN(oip, size, length)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_size = (length); else (oip)->dinode_u.ffs2_din
->di_size = (length); } while (0);
262 size = blksize(fs, oip, lbn)(((lbn) >= 12 || ((((oip))->i_ump->um_fstype == 1) ?
((oip))->dinode_u.ffs1_din->di_size : ((oip))->dinode_u
.ffs2_din->di_size) >= ((lbn) + 1) << (fs)->fs_bshift
) ? (u_int64_t)(fs)->fs_bsize : ((((((((((oip))->i_ump->
um_fstype == 1) ? ((oip))->dinode_u.ffs1_din->di_size :
((oip))->dinode_u.ffs2_din->di_size)) & (fs)->fs_qbmask
)) + (fs)->fs_qfmask) & (fs)->fs_fmask)));
263 (void) uvm_vnp_uncache(ovp);
264 if (ovp->v_type != VDIR)
265 memset(bp->b_data + offset, 0, size - offset)__builtin_memset((bp->b_data + offset), (0), (size - offset
));
266 buf_adjcnt(bp, size);
267 if (aflags & B_SYNC0x02)
268 bwrite(bp);
269 else
270 bawrite(bp);
271 }
272 /*
273 * Calculate index into inode's block list of
274 * last direct and indirect blocks (if any)
275 * which we want to keep. Lastblock is -1 when
276 * the file is truncated to 0.
277 */
278 lastblock = lblkno(fs, length + fs->fs_bsize - 1)((length + fs->fs_bsize - 1) >> (fs)->fs_bshift) - 1;
279 lastiblock[SINGLE0] = lastblock - NDADDR12;
280 lastiblock[DOUBLE1] = lastiblock[SINGLE0] - NINDIR(fs)((fs)->fs_nindir);
281 lastiblock[TRIPLE2] = lastiblock[DOUBLE1] - NINDIR(fs)((fs)->fs_nindir) * NINDIR(fs)((fs)->fs_nindir);
282 nblocks = btodb(fs->fs_bsize)((fs->fs_bsize) >> 9);
283
284 /*
285 * Update file and block pointers on disk before we start freeing
286 * blocks. If we crash before free'ing blocks below, the blocks
287 * will be returned to the free list. lastiblock values are also
288 * normalized to -1 for calls to ffs_indirtrunc below.
289 */
290 for (level = TRIPLE2; level >= SINGLE0; level--) {
291 oldblks[NDADDR12 + level] = DIP(oip, ib[level])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_ib[level] : (oip)->dinode_u.ffs2_din->di_ib[level
]);
292 if (lastiblock[level] < 0) {
293 DIP_ASSIGN(oip, ib[level], 0)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_ib[level] = (0); else (oip)->dinode_u.ffs2_din
->di_ib[level] = (0); } while (0);
294 lastiblock[level] = -1;
295 }
296 }
297
298 for (i = 0; i < NDADDR12; i++) {
299 oldblks[i] = DIP(oip, db[i])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_db[i] : (oip)->dinode_u.ffs2_din->di_db[i]);
300 if (i > lastblock)
301 DIP_ASSIGN(oip, db[i], 0)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_db[i] = (0); else (oip)->dinode_u.ffs2_din
->di_db[i] = (0); } while (0);
302 }
303
304 oip->i_flag |= IN_CHANGE0x0002 | IN_UPDATE0x0004;
305 if ((error = UFS_UPDATE(oip, 1)((oip)->i_vtbl->iv_update)((oip), (1))) != 0)
306 allerror = error;
307
308 /*
309 * Having written the new inode to disk, save its new configuration
310 * and put back the old block pointers long enough to process them.
311 * Note that we save the new block configuration so we can check it
312 * when we are done.
313 */
314 for (i = 0; i < NDADDR12; i++) {
315 newblks[i] = DIP(oip, db[i])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_db[i] : (oip)->dinode_u.ffs2_din->di_db[i]);
316 DIP_ASSIGN(oip, db[i], oldblks[i])do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_db[i] = (oldblks[i]); else (oip)->dinode_u
.ffs2_din->di_db[i] = (oldblks[i]); } while (0);
317 }
318
319 for (i = 0; i < NIADDR3; i++) {
320 newblks[NDADDR12 + i] = DIP(oip, ib[i])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_ib[i] : (oip)->dinode_u.ffs2_din->di_ib[i]);
321 DIP_ASSIGN(oip, ib[i], oldblks[NDADDR + i])do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_ib[i] = (oldblks[12 + i]); else (oip)->dinode_u
.ffs2_din->di_ib[i] = (oldblks[12 + i]); } while (0);
322 }
323
324 DIP_ASSIGN(oip, size, osize)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_size = (osize); else (oip)->dinode_u.ffs2_din
->di_size = (osize); } while (0);
325 vflags = ((length > 0) ? V_SAVE0x0001 : 0) | V_SAVEMETA0x0002;
326 allerror = vinvalbuf(ovp, vflags, cred, curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
(__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
__ci;})->ci_curproc, 0, INFSLP0xffffffffffffffffULL);
327
328 /*
329 * Indirect blocks first.
330 */
331 indir_lbn[SINGLE0] = -NDADDR12;
332 indir_lbn[DOUBLE1] = indir_lbn[SINGLE0] - NINDIR(fs)((fs)->fs_nindir) - 1;
333 indir_lbn[TRIPLE2] = indir_lbn[DOUBLE1] - NINDIR(fs)((fs)->fs_nindir) * NINDIR(fs)((fs)->fs_nindir) - 1;
334 for (level = TRIPLE2; level >= SINGLE0; level--) {
335 bn = DIP(oip, ib[level])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_ib[level] : (oip)->dinode_u.ffs2_din->di_ib[level
]);
336 if (bn != 0) {
337 error = ffs_indirtrunc(oip, indir_lbn[level],
338 fsbtodb(fs, bn)((bn) << (fs)->fs_fsbtodb), lastiblock[level], level, &count);
339 if (error)
340 allerror = error;
341 blocksreleased += count;
342 if (lastiblock[level] < 0) {
343 DIP_ASSIGN(oip, ib[level], 0)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_ib[level] = (0); else (oip)->dinode_u.ffs2_din
->di_ib[level] = (0); } while (0);
344 ffs_blkfree(oip, bn, fs->fs_bsize);
345 blocksreleased += nblocks;
346 }
347 }
348 if (lastiblock[level] >= 0)
349 goto done;
350 }
351
352 /*
353 * All whole direct blocks or frags.
354 */
355 for (i = NDADDR12 - 1; i > lastblock; i--) {
356 long bsize;
357
358 bn = DIP(oip, db[i])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_db[i] : (oip)->dinode_u.ffs2_din->di_db[i]);
359 if (bn == 0)
360 continue;
361
362 DIP_ASSIGN(oip, db[i], 0)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_db[i] = (0); else (oip)->dinode_u.ffs2_din
->di_db[i] = (0); } while (0);
363 bsize = blksize(fs, oip, i)(((i) >= 12 || ((((oip))->i_ump->um_fstype == 1) ? (
(oip))->dinode_u.ffs1_din->di_size : ((oip))->dinode_u
.ffs2_din->di_size) >= ((i) + 1) << (fs)->fs_bshift
) ? (u_int64_t)(fs)->fs_bsize : ((((((((((oip))->i_ump->
um_fstype == 1) ? ((oip))->dinode_u.ffs1_din->di_size :
((oip))->dinode_u.ffs2_din->di_size)) & (fs)->fs_qbmask
)) + (fs)->fs_qfmask) & (fs)->fs_fmask)));
364 ffs_blkfree(oip, bn, bsize);
365 blocksreleased += btodb(bsize)((bsize) >> 9);
366 }
367 if (lastblock < 0)
368 goto done;
369
370 /*
371 * Finally, look for a change in size of the
372 * last direct block; release any frags.
373 */
374 bn = DIP(oip, db[lastblock])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_db[lastblock] : (oip)->dinode_u.ffs2_din->di_db
[lastblock]);
375 if (bn != 0) {
376 long oldspace, newspace;
377
378 /*
379 * Calculate amount of space we're giving
380 * back as old block size minus new block size.
381 */
382 oldspace = blksize(fs, oip, lastblock)(((lastblock) >= 12 || ((((oip))->i_ump->um_fstype ==
1) ? ((oip))->dinode_u.ffs1_din->di_size : ((oip))->
dinode_u.ffs2_din->di_size) >= ((lastblock) + 1) <<
(fs)->fs_bshift) ? (u_int64_t)(fs)->fs_bsize : (((((((
(((oip))->i_ump->um_fstype == 1) ? ((oip))->dinode_u
.ffs1_din->di_size : ((oip))->dinode_u.ffs2_din->di_size
)) & (fs)->fs_qbmask)) + (fs)->fs_qfmask) & (fs
)->fs_fmask)));
383 DIP_ASSIGN(oip, size, length)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_size = (length); else (oip)->dinode_u.ffs2_din
->di_size = (length); } while (0);
384 newspace = blksize(fs, oip, lastblock)(((lastblock) >= 12 || ((((oip))->i_ump->um_fstype ==
1) ? ((oip))->dinode_u.ffs1_din->di_size : ((oip))->
dinode_u.ffs2_din->di_size) >= ((lastblock) + 1) <<
(fs)->fs_bshift) ? (u_int64_t)(fs)->fs_bsize : (((((((
(((oip))->i_ump->um_fstype == 1) ? ((oip))->dinode_u
.ffs1_din->di_size : ((oip))->dinode_u.ffs2_din->di_size
)) & (fs)->fs_qbmask)) + (fs)->fs_qfmask) & (fs
)->fs_fmask)));
385 if (newspace == 0)
386 panic("ffs_truncate: newspace");
387 if (oldspace - newspace > 0) {
388 /*
389 * Block number of space to be free'd is
390 * the old block # plus the number of frags
391 * required for the storage we're keeping.
392 */
393 bn += numfrags(fs, newspace)((newspace) >> (fs)->fs_fshift);
394 ffs_blkfree(oip, bn, oldspace - newspace);
395 blocksreleased += btodb(oldspace - newspace)((oldspace - newspace) >> 9);
396 }
397 }
398done:
399#ifdef DIAGNOSTIC1
400 for (level = SINGLE0; level <= TRIPLE2; level++)
401 if (newblks[NDADDR12 + level] != DIP(oip, ib[level])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_ib[level] : (oip)->dinode_u.ffs2_din->di_ib[level
]))
402 panic("ffs_truncate1");
403 for (i = 0; i < NDADDR12; i++)
404 if (newblks[i] != DIP(oip, db[i])(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_db[i] : (oip)->dinode_u.ffs2_din->di_db[i]))
405 panic("ffs_truncate2");
406#endif /* DIAGNOSTIC */
407 /*
408 * Put back the real size.
409 */
410 DIP_ASSIGN(oip, size, length)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_size = (length); else (oip)->dinode_u.ffs2_din
->di_size = (length); } while (0);
411 if (DIP(oip, blocks)(((oip)->i_ump->um_fstype == 1) ? (oip)->dinode_u.ffs1_din
->di_blocks : (oip)->dinode_u.ffs2_din->di_blocks) >= blocksreleased)
412 DIP_ADD(oip, blocks, -blocksreleased)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_blocks += (-blocksreleased); else (oip)->
dinode_u.ffs2_din->di_blocks += (-blocksreleased); } while
(0);
413 else /* sanity */
414 DIP_ASSIGN(oip, blocks, 0)do { if ((oip)->i_ump->um_fstype == 1) (oip)->dinode_u
.ffs1_din->di_blocks = (0); else (oip)->dinode_u.ffs2_din
->di_blocks = (0); } while (0);
415 oip->i_flag |= IN_CHANGE0x0002;
416 (void)ufs_quota_free_blocks(oip, blocksreleased, NOCRED)ufs_quota_free_blocks2(oip, blocksreleased, ((struct ucred *)
-1), 0);
417 return (allerror);
418}
419
420#ifdef FFS21
421#define BAP(ip, i)(((ip)->i_ump->um_fstype == 2) ? bap2[i] : bap1[i]) (((ip)->i_ump->um_fstype == UM_UFS22) ? bap2[i] : bap1[i])
422#define BAP_ASSIGN(ip, i, value)do { if ((ip)->i_ump->um_fstype == 2) bap2[i] = (value)
; else bap1[i] = (value); } while (0) \
423 do { \
424 if ((ip)->i_ump->um_fstype == UM_UFS22) \
425 bap2[i] = (value); \
426 else \
427 bap1[i] = (value); \
428 } while (0)
429#else
430#define BAP(ip, i)(((ip)->i_ump->um_fstype == 2) ? bap2[i] : bap1[i]) bap1[i]
431#define BAP_ASSIGN(ip, i, value)do { if ((ip)->i_ump->um_fstype == 2) bap2[i] = (value)
; else bap1[i] = (value); } while (0) do { bap1[i] = (value); } while (0)
432#endif /* FFS2 */
433
434/*
435 * Release blocks associated with the inode ip and stored in the indirect
436 * block bn. Blocks are free'd in LIFO order up to (but not including)
437 * lastbn. If level is greater than SINGLE, the block is an indirect block
438 * and recursive calls to indirtrunc must be used to cleanse other indirect
439 * blocks.
440 *
441 * NB: triple indirect blocks are untested.
442 */
443int
444ffs_indirtrunc(struct inode *ip, daddr_t lbn, daddr_t dbn,
445 daddr_t lastbn, int level, long *countp)
446{
447 int i;
448 struct buf *bp;
449 struct fs *fs = ip->i_fsinode_u.fs;
450 struct vnode *vp;
451 void *copy = NULL((void *)0);
452 daddr_t nb, nlbn, last;
453 long blkcount, factor;
454 int nblocks, blocksreleased = 0;
455 int error = 0, allerror = 0;
456 int32_t *bap1 = NULL((void *)0);
457#ifdef FFS21
458 int64_t *bap2 = NULL((void *)0);
1
'bap2' initialized to a null pointer value
→
459#endif
460
461 /*
462 * Calculate index in current block of last
463 * block to be kept. -1 indicates the entire
464 * block so we need not calculate the index.
465 */
466 factor = 1;
467 for (i = SINGLE0; i < level; i++)
2
←
Assuming 'i' is >= 'level'
→
3
←
Loop condition is false. Execution continues on line 469
→
468 factor *= NINDIR(fs)((fs)->fs_nindir);
469 last = lastbn;
470 if (lastbn > 0)
4
←
Assuming 'lastbn' is <= 0
→
5
←
Taking false branch
→
471 last /= factor;
472 nblocks = btodb(fs->fs_bsize)((fs->fs_bsize) >> 9);
473 /*
474 * Get buffer of block pointers, zero those entries corresponding
475 * to blocks to be free'd, and update on disk copy first. Since
476 * double(triple) indirect before single(double) indirect, calls
477 * to bmap on these blocks will fail. However, we already have
478 * the on disk address, so we have to set the b_blkno field
479 * explicitly instead of letting bread do everything for us.
480 */
481 vp = ITOV(ip)((ip)->i_vnode);
482 bp = getblk(vp, lbn, (int)fs->fs_bsize, 0, INFSLP0xffffffffffffffffULL);
483 if (!(bp->b_flags & (B_DONE0x00000100 | B_DELWRI0x00000080))) {
6
←
Assuming the condition is false
→
7
←
Taking false branch
→
484 curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
(__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
__ci;})->ci_curproc->p_ru.ru_inblock++; /* pay for read */
485 bcstats.pendingreads++;
486 bcstats.numreads++;
487 bp->b_flags |= B_READ0x00008000;
488 if (bp->b_bcount > bp->b_bufsize)
489 panic("ffs_indirtrunc: bad buffer size");
490 bp->b_blkno = dbn;
491 VOP_STRATEGY(bp->b_vp, bp);
492 error = biowait(bp);
493 }
494 if (error
7.1
'error' is 0
) {
8
←
Taking false branch
→
495 brelse(bp);
496 *countp = 0;
497 return (error);
498 }
499
500#ifdef FFS21
501 if (ip->i_ump->um_fstype == UM_UFS22)
9
←
Assuming field 'um_fstype' is not equal to UM_UFS2
→
10
←
Taking false branch
→
502 bap2 = (int64_t *)bp->b_data;
503 else
504#endif
505 bap1 = (int32_t *)bp->b_data;
506
507 if (lastbn != -1) {
11
←
Assuming the condition is false
→
12
←
Taking false branch
→
508 copy = malloc(fs->fs_bsize, M_TEMP127, M_WAITOK0x0001);
509 memcpy(copy, bp->b_data, fs->fs_bsize)__builtin_memcpy((copy), (bp->b_data), (fs->fs_bsize));
510
511 for (i = last + 1; i < NINDIR(fs)((fs)->fs_nindir); i++)
512 BAP_ASSIGN(ip, i, 0)do { if ((ip)->i_ump->um_fstype == 2) bap2[i] = (0); else
bap1[i] = (0); } while (0);
513
514 if (!DOINGASYNC(vp)((vp)->v_mount->mnt_flag & 0x00000040)) {
515 error = bwrite(bp);
516 if (error)
517 allerror = error;
518 } else {
519 bawrite(bp);
520 }
521
522#ifdef FFS21
523 if (ip->i_ump->um_fstype == UM_UFS22)
524 bap2 = (int64_t *)copy;
525 else
526#endif
527 bap1 = (int32_t *)copy;
528 }
529
530 /*
531 * Recursively free totally unused blocks.
532 */
533 for (i = NINDIR(fs)((fs)->fs_nindir) - 1, nlbn = lbn + 1 - i * factor; i > last;
13
←
Assuming 'i' is > 'last'
→
14
←
Loop condition is true. Entering loop body
→
19
←
Assuming 'i' is > 'last'
→
20
←
Loop condition is true. Entering loop body
→
534 i--, nlbn += factor) {
535 nb = BAP(ip, i)(((ip)->i_ump->um_fstype == 2) ? bap2[i] : bap1[i]);
15
←
'?' condition is false
→
21
←
Assuming field 'um_fstype' is equal to 2
→
22
←
'?' condition is true
→
23
←
Array access (from variable 'bap2') results in a null pointer dereference
536 if (nb == 0)
16
←
Assuming 'nb' is not equal to 0
→
17
←
Taking false branch
→
537 continue;
538 if (level
17.1
'level' is <= SINGLE
 > SINGLE0) {
18
←
Taking false branch
→
539 error = ffs_indirtrunc(ip, nlbn, fsbtodb(fs, nb)((nb) << (fs)->fs_fsbtodb),
540 -1, level - 1, &blkcount);
541 if (error)
542 allerror = error;
543 blocksreleased += blkcount;
544 }
545 ffs_blkfree(ip, nb, fs->fs_bsize);
546 blocksreleased += nblocks;
547 }
548
549 /*
550 * Recursively free last partial block.
551 */
552 if (level > SINGLE0 && lastbn >= 0) {
553 last = lastbn % factor;
554 nb = BAP(ip, i)(((ip)->i_ump->um_fstype == 2) ? bap2[i] : bap1[i]);
555 if (nb != 0) {
556 error = ffs_indirtrunc(ip, nlbn, fsbtodb(fs, nb)((nb) << (fs)->fs_fsbtodb),
557 last, level - 1, &blkcount);
558 if (error)
559 allerror = error;
560 blocksreleased += blkcount;
561 }
562 }
563 if (copy != NULL((void *)0)) {
564 free(copy, M_TEMP127, fs->fs_bsize);
565 } else {
566 bp->b_flags |= B_INVAL0x00000800;
567 brelse(bp);
568 }
569
570 *countp = blocksreleased;
571 return (allerror);
572}