1 files changed, 122 insertions, 4 deletions

diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index c1a03354a22..0131e436253 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -174,6 +174,25 @@ static int jread(struct buffer_head **bhp, journal_t *journal,
         return 0;
 }
 
+static int jbd2_descr_block_csum_verify(journal_t *j,
+                                        void *buf)
+{
+        struct jbd2_journal_block_tail *tail;
+        __u32 provided, calculated;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        tail = (struct jbd2_journal_block_tail *)(buf + j->j_blocksize -
+                        sizeof(struct jbd2_journal_block_tail));
+        provided = tail->t_checksum;
+        tail->t_checksum = 0;
+        calculated = jbd2_chksum(j, j->j_csum_seed, buf, j->j_blocksize);
+        tail->t_checksum = provided;
+
+        provided = be32_to_cpu(provided);
+        return provided == calculated;
+}
 
 /*
  * Count the number of in-use tags in a journal descriptor block.
@@ -186,6 +205,9 @@ static int count_tags(journal_t *journal, struct buffer_head *bh)
         int                     nr = 0, size = journal->j_blocksize;
         int                     tag_bytes = journal_tag_bytes(journal);
 
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                size -= sizeof(struct jbd2_journal_block_tail);
+
         tagp = &bh->b_data[sizeof(journal_header_t)];
 
         while ((tagp - bh->b_data + tag_bytes) <= size) {
@@ -193,10 +215,10 @@ static int count_tags(journal_t *journal, struct buffer_head *bh)
 
                 nr++;
                 tagp += tag_bytes;
-                if (!(tag->t_flags & cpu_to_be32(JBD2_FLAG_SAME_UUID)))
+                if (!(tag->t_flags & cpu_to_be16(JBD2_FLAG_SAME_UUID)))
                         tagp += 16;
 
-                if (tag->t_flags & cpu_to_be32(JBD2_FLAG_LAST_TAG))
+                if (tag->t_flags & cpu_to_be16(JBD2_FLAG_LAST_TAG))
                         break;
         }
 
@@ -353,6 +375,41 @@ static int calc_chksums(journal_t *journal, struct buffer_head *bh,
         return 0;
 }
 
+static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
+{
+        struct commit_header *h;
+        __u32 provided, calculated;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        h = buf;
+        provided = h->h_chksum[0];
+        h->h_chksum[0] = 0;
+        calculated = jbd2_chksum(j, j->j_csum_seed, buf, j->j_blocksize);
+        h->h_chksum[0] = provided;
+
+        provided = be32_to_cpu(provided);
+        return provided == calculated;
+}
+
+static int jbd2_block_tag_csum_verify(journal_t *j, journal_block_tag_t *tag,
+                                      void *buf, __u32 sequence)
+{
+        __u32 provided, calculated;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        sequence = cpu_to_be32(sequence);
+        calculated = jbd2_chksum(j, j->j_csum_seed, (__u8 *)&sequence,
+                                 sizeof(sequence));
+        calculated = jbd2_chksum(j, calculated, buf, j->j_blocksize);
+        provided = be32_to_cpu(tag->t_checksum);
+
+        return provided == cpu_to_be32(calculated);
+}
+
 static int do_one_pass(journal_t *journal,
                         struct recovery_info *info, enum passtype pass)
 {
@@ -366,6 +423,7 @@ static int do_one_pass(journal_t *journal,
         int                     blocktype;
         int                     tag_bytes = journal_tag_bytes(journal);
         __u32                   crc32_sum = ~0; /* Transactional Checksums */
+        int                     descr_csum_size = 0;
 
         /*
          * First thing is to establish what we expect to find in the log
@@ -451,6 +509,18 @@ static int do_one_pass(journal_t *journal,
 
                 switch(blocktype) {
                 case JBD2_DESCRIPTOR_BLOCK:
+                        /* Verify checksum first */
+                        if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+                                        JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                                descr_csum_size =
+                                        sizeof(struct jbd2_journal_block_tail);
+                        if (descr_csum_size > 0 &&
+                            !jbd2_descr_block_csum_verify(journal,
+                                                          bh->b_data)) {
+                                err = -EIO;
+                                goto failed;
+                        }
+
                         /* If it is a valid descriptor block, replay it
                          * in pass REPLAY; if journal_checksums enabled, then
                          * calculate checksums in PASS_SCAN, otherwise,
@@ -481,11 +551,11 @@ static int do_one_pass(journal_t *journal,
 
                         tagp = &bh->b_data[sizeof(journal_header_t)];
                         while ((tagp - bh->b_data + tag_bytes)
-                               <= journal->j_blocksize) {
+                               <= journal->j_blocksize - descr_csum_size) {
                                 unsigned long io_block;
 
                                 tag = (journal_block_tag_t *) tagp;
-                                flags = be32_to_cpu(tag->t_flags);
+                                flags = be16_to_cpu(tag->t_flags);
 
                                 io_block = next_log_block++;
                                 wrap(journal, next_log_block);
@@ -516,6 +586,19 @@ static int do_one_pass(journal_t *journal,
                                                 goto skip_write;
                                         }
 
+                                        /* Look for block corruption */
+                                        if (!jbd2_block_tag_csum_verify(
+                                                journal, tag, obh->b_data,
+                                                be32_to_cpu(tmp->h_sequence))) {
+                                                brelse(obh);
+                                                success = -EIO;
+                                                printk(KERN_ERR "JBD: Invalid "
+                                                       "checksum recovering "
+                                                       "block %llu in log\n",
+                                                       blocknr);
+                                                continue;
+                                        }
+
                                         /* Find a buffer for the new
                                          * data being restored */
                                         nbh = __getblk(journal->j_fs_dev,
@@ -650,6 +733,19 @@ static int do_one_pass(journal_t *journal,
                                 }
                                 crc32_sum = ~0;
                         }
+                        if (pass == PASS_SCAN &&
+                            !jbd2_commit_block_csum_verify(journal,
+                                                           bh->b_data)) {
+                                info->end_transaction = next_commit_ID;
+
+                                if (!JBD2_HAS_INCOMPAT_FEATURE(journal,
+                                     JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)) {
+                                        journal->j_failed_commit =
+                                                next_commit_ID;
+                                        brelse(bh);
+                                        break;
+                                }
+                        }
                         brelse(bh);
                         next_commit_ID++;
                         continue;
@@ -706,6 +802,25 @@ static int do_one_pass(journal_t *journal,
         return err;
 }
 
+static int jbd2_revoke_block_csum_verify(journal_t *j,
+                                         void *buf)
+{
+        struct jbd2_journal_revoke_tail *tail;
+        __u32 provided, calculated;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        tail = (struct jbd2_journal_revoke_tail *)(buf + j->j_blocksize -
+                        sizeof(struct jbd2_journal_revoke_tail));
+        provided = tail->r_checksum;
+        tail->r_checksum = 0;
+        calculated = jbd2_chksum(j, j->j_csum_seed, buf, j->j_blocksize);
+        tail->r_checksum = provided;
+
+        provided = be32_to_cpu(provided);
+        return provided == calculated;
+}
 
 /* Scan a revoke record, marking all blocks mentioned as revoked. */
 
@@ -720,6 +835,9 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
         offset = sizeof(jbd2_journal_revoke_header_t);
         max = be32_to_cpu(header->r_count);
 
+        if (!jbd2_revoke_block_csum_verify(journal, header))
+                return -EINVAL;
+
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
                 record_len = 8;