1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * fs/f2fs/verity.c: fs-verity support for f2fs
4 *
5 * Copyright 2019 Google LLC
6 */
7
8 /*
9 * Implementation of fsverity_operations for f2fs.
10 *
11 * Like ext4, f2fs stores the verity metadata (Merkle tree and
12 * fsverity_descriptor) past the end of the file, starting at the first 64K
13 * boundary beyond i_size. This approach works because (a) verity files are
14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but
15 * can be read/written internally by f2fs with only some relatively small
16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits
17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be
18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't
19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is
20 * because it contains hashes of the plaintext data.
21 *
22 * Using a 64K boundary rather than a 4K one keeps things ready for
23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk
24 * since there can be a hole between i_size and the start of the Merkle tree.
25 */
26
27 #include <linux/f2fs_fs.h>
28
29 #include "f2fs.h"
30 #include "xattr.h"
31
f2fs_verity_metadata_pos(const struct inode * inode)32 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode)
33 {
34 return round_up(inode->i_size, 65536);
35 }
36
37 /*
38 * Read some verity metadata from the inode. __vfs_read() can't be used because
39 * we need to read beyond i_size.
40 */
pagecache_read(struct inode * inode,void * buf,size_t count,loff_t pos)41 static int pagecache_read(struct inode *inode, void *buf, size_t count,
42 loff_t pos)
43 {
44 while (count) {
45 size_t n = min_t(size_t, count,
46 PAGE_SIZE - offset_in_page(pos));
47 struct page *page;
48 void *addr;
49
50 page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT,
51 NULL);
52 if (IS_ERR(page))
53 return PTR_ERR(page);
54
55 addr = kmap_atomic(page);
56 memcpy(buf, addr + offset_in_page(pos), n);
57 kunmap_atomic(addr);
58
59 put_page(page);
60
61 buf += n;
62 pos += n;
63 count -= n;
64 }
65 return 0;
66 }
67
68 /*
69 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY.
70 * kernel_write() can't be used because the file descriptor is readonly.
71 */
pagecache_write(struct inode * inode,const void * buf,size_t count,loff_t pos)72 static int pagecache_write(struct inode *inode, const void *buf, size_t count,
73 loff_t pos)
74 {
75 if (pos + count > inode->i_sb->s_maxbytes)
76 return -EFBIG;
77
78 while (count) {
79 size_t n = min_t(size_t, count,
80 PAGE_SIZE - offset_in_page(pos));
81 struct page *page;
82 void *fsdata;
83 void *addr;
84 int res;
85
86 res = pagecache_write_begin(NULL, inode->i_mapping, pos, n, 0,
87 &page, &fsdata);
88 if (res)
89 return res;
90
91 addr = kmap_atomic(page);
92 memcpy(addr + offset_in_page(pos), buf, n);
93 kunmap_atomic(addr);
94
95 res = pagecache_write_end(NULL, inode->i_mapping, pos, n, n,
96 page, fsdata);
97 if (res < 0)
98 return res;
99 if (res != n)
100 return -EIO;
101
102 buf += n;
103 pos += n;
104 count -= n;
105 }
106 return 0;
107 }
108
109 /*
110 * Format of f2fs verity xattr. This points to the location of the verity
111 * descriptor within the file data rather than containing it directly because
112 * the verity descriptor *must* be encrypted when f2fs encryption is used. But,
113 * f2fs encryption does not encrypt xattrs.
114 */
115 struct fsverity_descriptor_location {
116 __le32 version;
117 __le32 size;
118 __le64 pos;
119 };
120
f2fs_begin_enable_verity(struct file * filp)121 static int f2fs_begin_enable_verity(struct file *filp)
122 {
123 struct inode *inode = file_inode(filp);
124 int err;
125
126 if (f2fs_verity_in_progress(inode))
127 return -EBUSY;
128
129 if (f2fs_is_atomic_file(inode) || f2fs_is_volatile_file(inode))
130 return -EOPNOTSUPP;
131
132 /*
133 * Since the file was opened readonly, we have to initialize the quotas
134 * here and not rely on ->open() doing it. This must be done before
135 * evicting the inline data.
136 */
137 err = dquot_initialize(inode);
138 if (err)
139 return err;
140
141 err = f2fs_convert_inline_inode(inode);
142 if (err)
143 return err;
144
145 set_inode_flag(inode, FI_VERITY_IN_PROGRESS);
146 return 0;
147 }
148
f2fs_end_enable_verity(struct file * filp,const void * desc,size_t desc_size,u64 merkle_tree_size)149 static int f2fs_end_enable_verity(struct file *filp, const void *desc,
150 size_t desc_size, u64 merkle_tree_size)
151 {
152 struct inode *inode = file_inode(filp);
153 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size;
154 struct fsverity_descriptor_location dloc = {
155 .version = cpu_to_le32(1),
156 .size = cpu_to_le32(desc_size),
157 .pos = cpu_to_le64(desc_pos),
158 };
159 int err = 0;
160
161 if (desc != NULL) {
162 /* Succeeded; write the verity descriptor. */
163 err = pagecache_write(inode, desc, desc_size, desc_pos);
164
165 /* Write all pages before clearing FI_VERITY_IN_PROGRESS. */
166 if (!err)
167 err = filemap_write_and_wait(inode->i_mapping);
168 }
169
170 /* If we failed, truncate anything we wrote past i_size. */
171 if (desc == NULL || err)
172 f2fs_truncate(inode);
173
174 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);
175
176 if (desc != NULL && !err) {
177 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY,
178 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc),
179 NULL, XATTR_CREATE);
180 if (!err) {
181 file_set_verity(inode);
182 f2fs_set_inode_flags(inode);
183 f2fs_mark_inode_dirty_sync(inode, true);
184 }
185 }
186 return err;
187 }
188
f2fs_get_verity_descriptor(struct inode * inode,void * buf,size_t buf_size)189 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf,
190 size_t buf_size)
191 {
192 struct fsverity_descriptor_location dloc;
193 int res;
194 u32 size;
195 u64 pos;
196
197 /* Get the descriptor location */
198 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY,
199 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL);
200 if (res < 0 && res != -ERANGE)
201 return res;
202 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(1)) {
203 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format");
204 return -EINVAL;
205 }
206 size = le32_to_cpu(dloc.size);
207 pos = le64_to_cpu(dloc.pos);
208
209 /* Get the descriptor */
210 if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes ||
211 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) {
212 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr");
213 return -EFSCORRUPTED;
214 }
215 if (buf_size) {
216 if (size > buf_size)
217 return -ERANGE;
218 res = pagecache_read(inode, buf, size, pos);
219 if (res)
220 return res;
221 }
222 return size;
223 }
224
f2fs_read_merkle_tree_page(struct inode * inode,pgoff_t index)225 static struct page *f2fs_read_merkle_tree_page(struct inode *inode,
226 pgoff_t index)
227 {
228 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT;
229
230 return read_mapping_page(inode->i_mapping, index, NULL);
231 }
232
f2fs_write_merkle_tree_block(struct inode * inode,const void * buf,u64 index,int log_blocksize)233 static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf,
234 u64 index, int log_blocksize)
235 {
236 loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize);
237
238 return pagecache_write(inode, buf, 1 << log_blocksize, pos);
239 }
240
241 const struct fsverity_operations f2fs_verityops = {
242 .begin_enable_verity = f2fs_begin_enable_verity,
243 .end_enable_verity = f2fs_end_enable_verity,
244 .get_verity_descriptor = f2fs_get_verity_descriptor,
245 .read_merkle_tree_page = f2fs_read_merkle_tree_page,
246 .write_merkle_tree_block = f2fs_write_merkle_tree_block,
247 };
248