]>
Commit | Line | Data |
---|---|---|
95ae251f EB |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* | |
3 | * fs/f2fs/verity.c: fs-verity support for f2fs | |
4 | * | |
5 | * Copyright 2019 Google LLC | |
6 | */ | |
7 | ||
8 | /* | |
9 | * Implementation of fsverity_operations for f2fs. | |
10 | * | |
11 | * Like ext4, f2fs stores the verity metadata (Merkle tree and | |
12 | * fsverity_descriptor) past the end of the file, starting at the first 64K | |
13 | * boundary beyond i_size. This approach works because (a) verity files are | |
14 | * readonly, and (b) pages fully beyond i_size aren't visible to userspace but | |
15 | * can be read/written internally by f2fs with only some relatively small | |
16 | * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits | |
17 | * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be | |
18 | * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't | |
19 | * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is | |
20 | * because it contains hashes of the plaintext data. | |
21 | * | |
22 | * Using a 64K boundary rather than a 4K one keeps things ready for | |
23 | * architectures with 64K pages, and it doesn't necessarily waste space on-disk | |
24 | * since there can be a hole between i_size and the start of the Merkle tree. | |
25 | */ | |
26 | ||
27 | #include <linux/f2fs_fs.h> | |
28 | ||
29 | #include "f2fs.h" | |
30 | #include "xattr.h" | |
31 | ||
8fa41016 JQ |
32 | #define F2FS_VERIFY_VER (1) |
33 | ||
95ae251f EB |
34 | static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode) |
35 | { | |
36 | return round_up(inode->i_size, 65536); | |
37 | } | |
38 | ||
39 | /* | |
40 | * Read some verity metadata from the inode. __vfs_read() can't be used because | |
41 | * we need to read beyond i_size. | |
42 | */ | |
43 | static int pagecache_read(struct inode *inode, void *buf, size_t count, | |
44 | loff_t pos) | |
45 | { | |
46 | while (count) { | |
47 | size_t n = min_t(size_t, count, | |
48 | PAGE_SIZE - offset_in_page(pos)); | |
49 | struct page *page; | |
50 | void *addr; | |
51 | ||
52 | page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT, | |
53 | NULL); | |
54 | if (IS_ERR(page)) | |
55 | return PTR_ERR(page); | |
56 | ||
57 | addr = kmap_atomic(page); | |
58 | memcpy(buf, addr + offset_in_page(pos), n); | |
59 | kunmap_atomic(addr); | |
60 | ||
61 | put_page(page); | |
62 | ||
63 | buf += n; | |
64 | pos += n; | |
65 | count -= n; | |
66 | } | |
67 | return 0; | |
68 | } | |
69 | ||
70 | /* | |
71 | * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY. | |
72 | * kernel_write() can't be used because the file descriptor is readonly. | |
73 | */ | |
74 | static int pagecache_write(struct inode *inode, const void *buf, size_t count, | |
75 | loff_t pos) | |
76 | { | |
77 | if (pos + count > inode->i_sb->s_maxbytes) | |
78 | return -EFBIG; | |
79 | ||
80 | while (count) { | |
81 | size_t n = min_t(size_t, count, | |
82 | PAGE_SIZE - offset_in_page(pos)); | |
83 | struct page *page; | |
84 | void *fsdata; | |
85 | void *addr; | |
86 | int res; | |
87 | ||
88 | res = pagecache_write_begin(NULL, inode->i_mapping, pos, n, 0, | |
89 | &page, &fsdata); | |
90 | if (res) | |
91 | return res; | |
92 | ||
93 | addr = kmap_atomic(page); | |
94 | memcpy(addr + offset_in_page(pos), buf, n); | |
95 | kunmap_atomic(addr); | |
96 | ||
97 | res = pagecache_write_end(NULL, inode->i_mapping, pos, n, n, | |
98 | page, fsdata); | |
99 | if (res < 0) | |
100 | return res; | |
101 | if (res != n) | |
102 | return -EIO; | |
103 | ||
104 | buf += n; | |
105 | pos += n; | |
106 | count -= n; | |
107 | } | |
108 | return 0; | |
109 | } | |
110 | ||
111 | /* | |
112 | * Format of f2fs verity xattr. This points to the location of the verity | |
113 | * descriptor within the file data rather than containing it directly because | |
114 | * the verity descriptor *must* be encrypted when f2fs encryption is used. But, | |
115 | * f2fs encryption does not encrypt xattrs. | |
116 | */ | |
117 | struct fsverity_descriptor_location { | |
118 | __le32 version; | |
119 | __le32 size; | |
120 | __le64 pos; | |
121 | }; | |
122 | ||
123 | static int f2fs_begin_enable_verity(struct file *filp) | |
124 | { | |
125 | struct inode *inode = file_inode(filp); | |
126 | int err; | |
127 | ||
128 | if (f2fs_verity_in_progress(inode)) | |
129 | return -EBUSY; | |
130 | ||
131 | if (f2fs_is_atomic_file(inode) || f2fs_is_volatile_file(inode)) | |
132 | return -EOPNOTSUPP; | |
133 | ||
134 | /* | |
135 | * Since the file was opened readonly, we have to initialize the quotas | |
136 | * here and not rely on ->open() doing it. This must be done before | |
137 | * evicting the inline data. | |
138 | */ | |
139 | err = dquot_initialize(inode); | |
140 | if (err) | |
141 | return err; | |
142 | ||
143 | err = f2fs_convert_inline_inode(inode); | |
144 | if (err) | |
145 | return err; | |
146 | ||
147 | set_inode_flag(inode, FI_VERITY_IN_PROGRESS); | |
148 | return 0; | |
149 | } | |
150 | ||
151 | static int f2fs_end_enable_verity(struct file *filp, const void *desc, | |
152 | size_t desc_size, u64 merkle_tree_size) | |
153 | { | |
154 | struct inode *inode = file_inode(filp); | |
155 | u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size; | |
156 | struct fsverity_descriptor_location dloc = { | |
8fa41016 | 157 | .version = cpu_to_le32(F2FS_VERIFY_VER), |
95ae251f EB |
158 | .size = cpu_to_le32(desc_size), |
159 | .pos = cpu_to_le64(desc_pos), | |
160 | }; | |
161 | int err = 0; | |
162 | ||
163 | if (desc != NULL) { | |
164 | /* Succeeded; write the verity descriptor. */ | |
165 | err = pagecache_write(inode, desc, desc_size, desc_pos); | |
166 | ||
167 | /* Write all pages before clearing FI_VERITY_IN_PROGRESS. */ | |
168 | if (!err) | |
169 | err = filemap_write_and_wait(inode->i_mapping); | |
170 | } | |
171 | ||
172 | /* If we failed, truncate anything we wrote past i_size. */ | |
173 | if (desc == NULL || err) | |
174 | f2fs_truncate(inode); | |
175 | ||
176 | clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); | |
177 | ||
178 | if (desc != NULL && !err) { | |
179 | err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY, | |
180 | F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), | |
181 | NULL, XATTR_CREATE); | |
182 | if (!err) { | |
183 | file_set_verity(inode); | |
184 | f2fs_set_inode_flags(inode); | |
185 | f2fs_mark_inode_dirty_sync(inode, true); | |
186 | } | |
187 | } | |
188 | return err; | |
189 | } | |
190 | ||
191 | static int f2fs_get_verity_descriptor(struct inode *inode, void *buf, | |
192 | size_t buf_size) | |
193 | { | |
194 | struct fsverity_descriptor_location dloc; | |
195 | int res; | |
196 | u32 size; | |
197 | u64 pos; | |
198 | ||
199 | /* Get the descriptor location */ | |
200 | res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY, | |
201 | F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL); | |
202 | if (res < 0 && res != -ERANGE) | |
203 | return res; | |
8fa41016 | 204 | if (res != sizeof(dloc) || dloc.version != cpu_to_le32(F2FS_VERIFY_VER)) { |
95ae251f EB |
205 | f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format"); |
206 | return -EINVAL; | |
207 | } | |
208 | size = le32_to_cpu(dloc.size); | |
209 | pos = le64_to_cpu(dloc.pos); | |
210 | ||
211 | /* Get the descriptor */ | |
212 | if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes || | |
213 | pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) { | |
214 | f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr"); | |
215 | return -EFSCORRUPTED; | |
216 | } | |
217 | if (buf_size) { | |
218 | if (size > buf_size) | |
219 | return -ERANGE; | |
220 | res = pagecache_read(inode, buf, size, pos); | |
221 | if (res) | |
222 | return res; | |
223 | } | |
224 | return size; | |
225 | } | |
226 | ||
227 | static struct page *f2fs_read_merkle_tree_page(struct inode *inode, | |
fd39073d EB |
228 | pgoff_t index, |
229 | unsigned long num_ra_pages) | |
95ae251f | 230 | { |
73bb49da | 231 | DEFINE_READAHEAD(ractl, NULL, inode->i_mapping, index); |
fd39073d EB |
232 | struct page *page; |
233 | ||
95ae251f EB |
234 | index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; |
235 | ||
fd39073d EB |
236 | page = find_get_page_flags(inode->i_mapping, index, FGP_ACCESSED); |
237 | if (!page || !PageUptodate(page)) { | |
238 | if (page) | |
239 | put_page(page); | |
240 | else if (num_ra_pages > 1) | |
73bb49da | 241 | page_cache_ra_unbounded(&ractl, num_ra_pages, 0); |
fd39073d EB |
242 | page = read_mapping_page(inode->i_mapping, index, NULL); |
243 | } | |
244 | return page; | |
95ae251f EB |
245 | } |
246 | ||
247 | static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf, | |
248 | u64 index, int log_blocksize) | |
249 | { | |
250 | loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize); | |
251 | ||
252 | return pagecache_write(inode, buf, 1 << log_blocksize, pos); | |
253 | } | |
254 | ||
255 | const struct fsverity_operations f2fs_verityops = { | |
256 | .begin_enable_verity = f2fs_begin_enable_verity, | |
257 | .end_enable_verity = f2fs_end_enable_verity, | |
258 | .get_verity_descriptor = f2fs_get_verity_descriptor, | |
259 | .read_merkle_tree_page = f2fs_read_merkle_tree_page, | |
260 | .write_merkle_tree_block = f2fs_write_merkle_tree_block, | |
261 | }; |