fscrypt: remove kernel-internal constants from UAPI header

BugLink: https://bugs.launchpad.net/bugs/1910109
commit 3ceb6543e9cf6ed87cc1fbc6f23ca2db903564cd upstream.

There isn't really any valid reason to use __FSCRYPT_MODE_MAX or
FSCRYPT_POLICY_FLAGS_VALID in a userspace program.  These constants are
only meant to be used by the kernel internally, and they are defined in
the UAPI header next to the mode numbers and flags only so that kernel
developers don't forget to update them when adding new modes or flags.

In https://lkml.kernel.org/r/20201005074133.1958633-2-satyat@google.com
there was an example of someone wanting to use __FSCRYPT_MODE_MAX in a
user program, and it was wrong because the program would have broken if
__FSCRYPT_MODE_MAX were ever increased.  So having this definition
available is harmful.  FSCRYPT_POLICY_FLAGS_VALID has the same problem.

So, remove these definitions from the UAPI header.  Replace
FSCRYPT_POLICY_FLAGS_VALID with just listing the valid flags explicitly
in the one kernel function that needs it.  Move __FSCRYPT_MODE_MAX to
fscrypt_private.h, remove the double underscores (which were only
present to discourage use by userspace), and add a BUILD_BUG_ON() and
comments to (hopefully) ensure it is kept in sync.

Keep the old name FS_POLICY_FLAGS_VALID, since it's been around for
longer and there's a greater chance that removing it would break source
compatibility with some program.  Indeed, mtd-utils is using it in
an #ifdef, and removing it would introduce compiler warnings (about
FS_POLICY_FLAGS_PAD_* being redefined) into the mtd-utils build.
However, reduce its value to 0x07 so that it only includes the flags
with old names (the ones present before Linux 5.4), and try to make it
clear that it's now "frozen" and no new flags should be added to it.

Fixes: 2336d0deb2d4 ("fscrypt: use FSCRYPT_ prefix for uapi constants")
Cc: <stable@vger.kernel.org> # v5.4+
Link: https://lore.kernel.org/r/20201024005132.495952-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>

diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
index 4f5806a3b73d78d59ec0f0a62c5f7a8ae3309509..322ecae9a75809fb92641ce51c49abf40035a0c0 100644 (file)
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -25,6 +25,9 @@
 #define FSCRYPT_CONTEXT_V1     1
 #define FSCRYPT_CONTEXT_V2     2
 
+/* Keep this in sync with include/uapi/linux/fscrypt.h */
+#define FSCRYPT_MODE_MAX       FSCRYPT_MODE_ADIANTUM
+
 struct fscrypt_context_v1 {
        u8 version; /* FSCRYPT_CONTEXT_V1 */
        u8 contents_encryption_mode;
@@ -491,9 +494,9 @@ struct fscrypt_master_key {
         * Per-mode encryption keys for the various types of encryption policies
         * that use them.  Allocated and derived on-demand.
         */
-       struct fscrypt_prepared_key mk_direct_keys[__FSCRYPT_MODE_MAX + 1];
-       struct fscrypt_prepared_key mk_iv_ino_lblk_64_keys[__FSCRYPT_MODE_MAX + 1];
-       struct fscrypt_prepared_key mk_iv_ino_lblk_32_keys[__FSCRYPT_MODE_MAX + 1];
+       struct fscrypt_prepared_key mk_direct_keys[FSCRYPT_MODE_MAX + 1];
+       struct fscrypt_prepared_key mk_iv_ino_lblk_64_keys[FSCRYPT_MODE_MAX + 1];
+       struct fscrypt_prepared_key mk_iv_ino_lblk_32_keys[FSCRYPT_MODE_MAX + 1];
 
        /* Hash key for inode numbers.  Initialized only when needed. */
        siphash_key_t           mk_ino_hash_key;

diff --git a/fs/crypto/keyring.c b/fs/crypto/keyring.c
index 53cc552a7b8fd31107e18ea346afc327350d9a96..d7ec52cb3d9af80a946ff36332d2fa1eef2ef24a 100644 (file)
--- a/fs/crypto/keyring.c
+++ b/fs/crypto/keyring.c
@@ -44,7 +44,7 @@ static void free_master_key(struct fscrypt_master_key *mk)
 
        wipe_master_key_secret(&mk->mk_secret);
 
-       for (i = 0; i <= __FSCRYPT_MODE_MAX; i++) {
+       for (i = 0; i <= FSCRYPT_MODE_MAX; i++) {
                fscrypt_destroy_prepared_key(&mk->mk_direct_keys[i]);
                fscrypt_destroy_prepared_key(&mk->mk_iv_ino_lblk_64_keys[i]);
                fscrypt_destroy_prepared_key(&mk->mk_iv_ino_lblk_32_keys[i]);

diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c
index d595abb8ef90da8e747ffd141c4ec090872cb41d..31fb08d94f8741da06550af79f67d55355cbda31 100644 (file)
--- a/fs/crypto/keysetup.c
+++ b/fs/crypto/keysetup.c
@@ -56,6 +56,8 @@ static struct fscrypt_mode *
 select_encryption_mode(const union fscrypt_policy *policy,
                       const struct inode *inode)
 {
+       BUILD_BUG_ON(ARRAY_SIZE(fscrypt_modes) != FSCRYPT_MODE_MAX + 1);
+
        if (S_ISREG(inode->i_mode))
                return &fscrypt_modes[fscrypt_policy_contents_mode(policy)];
 
@@ -168,7 +170,7 @@ static int setup_per_mode_enc_key(struct fscrypt_info *ci,
        unsigned int hkdf_infolen = 0;
        int err;
 
-       if (WARN_ON(mode_num > __FSCRYPT_MODE_MAX))
+       if (WARN_ON(mode_num > FSCRYPT_MODE_MAX))
                return -EINVAL;
 
        prep_key = &keys[mode_num];

diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 4441d9944b9effe67d2b1c58e2ebf8b85a699b3a..faa0f21daa684263c06145c24e7a8118fae9885b 100644 (file)
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -175,7 +175,10 @@ static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy,
                return false;
        }
 
-       if (policy->flags & ~FSCRYPT_POLICY_FLAGS_VALID) {
+       if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
+                             FSCRYPT_POLICY_FLAG_DIRECT_KEY |
+                             FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 |
+                             FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)) {
                fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)",
                             policy->flags);
                return false;

diff --git a/include/uapi/linux/fscrypt.h b/include/uapi/linux/fscrypt.h
index e5de60336938121f0584e0b43e9fc01fcb3d356c..9f4428be3e36266808bf0185df775bb49e963771 100644 (file)
--- a/include/uapi/linux/fscrypt.h
+++ b/include/uapi/linux/fscrypt.h
@@ -20,7 +20,6 @@
 #define FSCRYPT_POLICY_FLAG_DIRECT_KEY         0x04
 #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64     0x08
 #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32     0x10
-#define FSCRYPT_POLICY_FLAGS_VALID             0x1F
 
 /* Encryption algorithms */
 #define FSCRYPT_MODE_AES_256_XTS               1
@@ -28,7 +27,7 @@
 #define FSCRYPT_MODE_AES_128_CBC               5
 #define FSCRYPT_MODE_AES_128_CTS               6
 #define FSCRYPT_MODE_ADIANTUM                  9
-#define __FSCRYPT_MODE_MAX                     9
+/* If adding a mode number > 9, update FSCRYPT_MODE_MAX in fscrypt_private.h */
 
 /*
  * Legacy policy version; ad-hoc KDF and no key verification.
@@ -177,7 +176,7 @@ struct fscrypt_get_key_status_arg {
 #define FS_POLICY_FLAGS_PAD_32         FSCRYPT_POLICY_FLAGS_PAD_32
 #define FS_POLICY_FLAGS_PAD_MASK       FSCRYPT_POLICY_FLAGS_PAD_MASK
 #define FS_POLICY_FLAG_DIRECT_KEY      FSCRYPT_POLICY_FLAG_DIRECT_KEY
-#define FS_POLICY_FLAGS_VALID          FSCRYPT_POLICY_FLAGS_VALID
+#define FS_POLICY_FLAGS_VALID          0x07    /* contains old flags only */
 #define FS_ENCRYPTION_MODE_INVALID     0       /* never used */
 #define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS
 #define FS_ENCRYPTION_MODE_AES_256_GCM 2       /* never used */