Commit | Line | Data |
---|---|---|
95ae251f EB |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* | |
3 | * fs/f2fs/verity.c: fs-verity support for f2fs | |
4 | * | |
5 | * Copyright 2019 Google LLC | |
6 | */ | |
7 | ||
8 | /* | |
9 | * Implementation of fsverity_operations for f2fs. | |
10 | * | |
11 | * Like ext4, f2fs stores the verity metadata (Merkle tree and | |
12 | * fsverity_descriptor) past the end of the file, starting at the first 64K | |
13 | * boundary beyond i_size. This approach works because (a) verity files are | |
14 | * readonly, and (b) pages fully beyond i_size aren't visible to userspace but | |
15 | * can be read/written internally by f2fs with only some relatively small | |
16 | * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits | |
17 | * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be | |
18 | * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't | |
19 | * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is | |
20 | * because it contains hashes of the plaintext data. | |
21 | * | |
22 | * Using a 64K boundary rather than a 4K one keeps things ready for | |
23 | * architectures with 64K pages, and it doesn't necessarily waste space on-disk | |
24 | * since there can be a hole between i_size and the start of the Merkle tree. | |
25 | */ | |
26 | ||
27 | #include <linux/f2fs_fs.h> | |
28 | ||
29 | #include "f2fs.h" | |
30 | #include "xattr.h" | |
31 | ||
32 | static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode) | |
33 | { | |
34 | return round_up(inode->i_size, 65536); | |
35 | } | |
36 | ||
37 | /* | |
38 | * Read some verity metadata from the inode. __vfs_read() can't be used because | |
39 | * we need to read beyond i_size. | |
40 | */ | |
41 | static int pagecache_read(struct inode *inode, void *buf, size_t count, | |
42 | loff_t pos) | |
43 | { | |
44 | while (count) { | |
45 | size_t n = min_t(size_t, count, | |
46 | PAGE_SIZE - offset_in_page(pos)); | |
47 | struct page *page; | |
48 | void *addr; | |
49 | ||
50 | page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT, | |
51 | NULL); | |
52 | if (IS_ERR(page)) | |
53 | return PTR_ERR(page); | |
54 | ||
55 | addr = kmap_atomic(page); | |
56 | memcpy(buf, addr + offset_in_page(pos), n); | |
57 | kunmap_atomic(addr); | |
58 | ||
59 | put_page(page); | |
60 | ||
61 | buf += n; | |
62 | pos += n; | |
63 | count -= n; | |
64 | } | |
65 | return 0; | |
66 | } | |
67 | ||
68 | /* | |
69 | * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY. | |
70 | * kernel_write() can't be used because the file descriptor is readonly. | |
71 | */ | |
72 | static int pagecache_write(struct inode *inode, const void *buf, size_t count, | |
73 | loff_t pos) | |
74 | { | |
75 | if (pos + count > inode->i_sb->s_maxbytes) | |
76 | return -EFBIG; | |
77 | ||
78 | while (count) { | |
79 | size_t n = min_t(size_t, count, | |
80 | PAGE_SIZE - offset_in_page(pos)); | |
81 | struct page *page; | |
82 | void *fsdata; | |
83 | void *addr; | |
84 | int res; | |
85 | ||
86 | res = pagecache_write_begin(NULL, inode->i_mapping, pos, n, 0, | |
87 | &page, &fsdata); | |
88 | if (res) | |
89 | return res; | |
90 | ||
91 | addr = kmap_atomic(page); | |
92 | memcpy(addr + offset_in_page(pos), buf, n); | |
93 | kunmap_atomic(addr); | |
94 | ||
95 | res = pagecache_write_end(NULL, inode->i_mapping, pos, n, n, | |
96 | page, fsdata); | |
97 | if (res < 0) | |
98 | return res; | |
99 | if (res != n) | |
100 | return -EIO; | |
101 | ||
102 | buf += n; | |
103 | pos += n; | |
104 | count -= n; | |
105 | } | |
106 | return 0; | |
107 | } | |
108 | ||
109 | /* | |
110 | * Format of f2fs verity xattr. This points to the location of the verity | |
111 | * descriptor within the file data rather than containing it directly because | |
112 | * the verity descriptor *must* be encrypted when f2fs encryption is used. But, | |
113 | * f2fs encryption does not encrypt xattrs. | |
114 | */ | |
115 | struct fsverity_descriptor_location { | |
116 | __le32 version; | |
117 | __le32 size; | |
118 | __le64 pos; | |
119 | }; | |
120 | ||
121 | static int f2fs_begin_enable_verity(struct file *filp) | |
122 | { | |
123 | struct inode *inode = file_inode(filp); | |
124 | int err; | |
125 | ||
126 | if (f2fs_verity_in_progress(inode)) | |
127 | return -EBUSY; | |
128 | ||
129 | if (f2fs_is_atomic_file(inode) || f2fs_is_volatile_file(inode)) | |
130 | return -EOPNOTSUPP; | |
131 | ||
132 | /* | |
133 | * Since the file was opened readonly, we have to initialize the quotas | |
134 | * here and not rely on ->open() doing it. This must be done before | |
135 | * evicting the inline data. | |
136 | */ | |
137 | err = dquot_initialize(inode); | |
138 | if (err) | |
139 | return err; | |
140 | ||
141 | err = f2fs_convert_inline_inode(inode); | |
142 | if (err) | |
143 | return err; | |
144 | ||
145 | set_inode_flag(inode, FI_VERITY_IN_PROGRESS); | |
146 | return 0; | |
147 | } | |
148 | ||
149 | static int f2fs_end_enable_verity(struct file *filp, const void *desc, | |
150 | size_t desc_size, u64 merkle_tree_size) | |
151 | { | |
152 | struct inode *inode = file_inode(filp); | |
153 | u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size; | |
154 | struct fsverity_descriptor_location dloc = { | |
155 | .version = cpu_to_le32(1), | |
156 | .size = cpu_to_le32(desc_size), | |
157 | .pos = cpu_to_le64(desc_pos), | |
158 | }; | |
159 | int err = 0; | |
160 | ||
161 | if (desc != NULL) { | |
162 | /* Succeeded; write the verity descriptor. */ | |
163 | err = pagecache_write(inode, desc, desc_size, desc_pos); | |
164 | ||
165 | /* Write all pages before clearing FI_VERITY_IN_PROGRESS. */ | |
166 | if (!err) | |
167 | err = filemap_write_and_wait(inode->i_mapping); | |
168 | } | |
169 | ||
170 | /* If we failed, truncate anything we wrote past i_size. */ | |
171 | if (desc == NULL || err) | |
172 | f2fs_truncate(inode); | |
173 | ||
174 | clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); | |
175 | ||
176 | if (desc != NULL && !err) { | |
177 | err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY, | |
178 | F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), | |
179 | NULL, XATTR_CREATE); | |
180 | if (!err) { | |
181 | file_set_verity(inode); | |
182 | f2fs_set_inode_flags(inode); | |
183 | f2fs_mark_inode_dirty_sync(inode, true); | |
184 | } | |
185 | } | |
186 | return err; | |
187 | } | |
188 | ||
189 | static int f2fs_get_verity_descriptor(struct inode *inode, void *buf, | |
190 | size_t buf_size) | |
191 | { | |
192 | struct fsverity_descriptor_location dloc; | |
193 | int res; | |
194 | u32 size; | |
195 | u64 pos; | |
196 | ||
197 | /* Get the descriptor location */ | |
198 | res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY, | |
199 | F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL); | |
200 | if (res < 0 && res != -ERANGE) | |
201 | return res; | |
202 | if (res != sizeof(dloc) || dloc.version != cpu_to_le32(1)) { | |
203 | f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format"); | |
204 | return -EINVAL; | |
205 | } | |
206 | size = le32_to_cpu(dloc.size); | |
207 | pos = le64_to_cpu(dloc.pos); | |
208 | ||
209 | /* Get the descriptor */ | |
210 | if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes || | |
211 | pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) { | |
212 | f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr"); | |
213 | return -EFSCORRUPTED; | |
214 | } | |
215 | if (buf_size) { | |
216 | if (size > buf_size) | |
217 | return -ERANGE; | |
218 | res = pagecache_read(inode, buf, size, pos); | |
219 | if (res) | |
220 | return res; | |
221 | } | |
222 | return size; | |
223 | } | |
224 | ||
225 | static struct page *f2fs_read_merkle_tree_page(struct inode *inode, | |
226 | pgoff_t index) | |
227 | { | |
228 | index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; | |
229 | ||
230 | return read_mapping_page(inode->i_mapping, index, NULL); | |
231 | } | |
232 | ||
233 | static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf, | |
234 | u64 index, int log_blocksize) | |
235 | { | |
236 | loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize); | |
237 | ||
238 | return pagecache_write(inode, buf, 1 << log_blocksize, pos); | |
239 | } | |
240 | ||
241 | const struct fsverity_operations f2fs_verityops = { | |
242 | .begin_enable_verity = f2fs_begin_enable_verity, | |
243 | .end_enable_verity = f2fs_end_enable_verity, | |
244 | .get_verity_descriptor = f2fs_get_verity_descriptor, | |
245 | .read_merkle_tree_page = f2fs_read_merkle_tree_page, | |
246 | .write_merkle_tree_block = f2fs_write_merkle_tree_block, | |
247 | }; |