1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * fs/f2fs/verity.c: fs-verity support for f2fs
4 *
5 * Copyright 2019 Google LLC
6 */
7
8 /*
9 * Implementation of fsverity_operations for f2fs.
10 *
11 * Like ext4, f2fs stores the verity metadata (Merkle tree and
12 * fsverity_descriptor) past the end of the file, starting at the first 64K
13 * boundary beyond i_size. This approach works because (a) verity files are
14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but
15 * can be read/written internally by f2fs with only some relatively small
16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits
17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be
18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't
19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is
20 * because it contains hashes of the plaintext data.
21 *
22 * Using a 64K boundary rather than a 4K one keeps things ready for
23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk
24 * since there can be a hole between i_size and the start of the Merkle tree.
25 */
26
27 #include <linux/f2fs_fs.h>
28
29 #include "f2fs.h"
30 #include "xattr.h"
31
f2fs_verity_metadata_pos(const struct inode * inode)32 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode)
33 {
34 return round_up(inode->i_size, 65536);
35 }
36
37 /*
38 * Read some verity metadata from the inode. __vfs_read() can't be used because
39 * we need to read beyond i_size.
40 */
pagecache_read(struct inode * inode,void * buf,size_t count,loff_t pos)41 static int pagecache_read(struct inode *inode, void *buf, size_t count,
42 loff_t pos)
43 {
44 while (count) {
45 size_t n = min_t(size_t, count,
46 PAGE_SIZE - offset_in_page(pos));
47 struct page *page;
48
49 page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT,
50 NULL);
51 if (IS_ERR(page))
52 return PTR_ERR(page);
53
54 memcpy_from_page(buf, page, offset_in_page(pos), n);
55
56 put_page(page);
57
58 buf += n;
59 pos += n;
60 count -= n;
61 }
62 return 0;
63 }
64
65 /*
66 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY.
67 * kernel_write() can't be used because the file descriptor is readonly.
68 */
pagecache_write(struct inode * inode,const void * buf,size_t count,loff_t pos)69 static int pagecache_write(struct inode *inode, const void *buf, size_t count,
70 loff_t pos)
71 {
72 if (pos + count > inode->i_sb->s_maxbytes)
73 return -EFBIG;
74
75 while (count) {
76 size_t n = min_t(size_t, count,
77 PAGE_SIZE - offset_in_page(pos));
78 struct page *page;
79 void *fsdata = NULL;
80 int res;
81
82 res = pagecache_write_begin(NULL, inode->i_mapping, pos, n, 0,
83 &page, &fsdata);
84 if (res)
85 return res;
86
87 memcpy_to_page(page, offset_in_page(pos), buf, n);
88
89 res = pagecache_write_end(NULL, inode->i_mapping, pos, n, n,
90 page, fsdata);
91 if (res < 0)
92 return res;
93 if (res != n)
94 return -EIO;
95
96 buf += n;
97 pos += n;
98 count -= n;
99 }
100 return 0;
101 }
102
103 /*
104 * Format of f2fs verity xattr. This points to the location of the verity
105 * descriptor within the file data rather than containing it directly because
106 * the verity descriptor *must* be encrypted when f2fs encryption is used. But,
107 * f2fs encryption does not encrypt xattrs.
108 */
109 struct fsverity_descriptor_location {
110 __le32 version;
111 __le32 size;
112 __le64 pos;
113 };
114
f2fs_begin_enable_verity(struct file * filp)115 static int f2fs_begin_enable_verity(struct file *filp)
116 {
117 struct inode *inode = file_inode(filp);
118 int err;
119
120 if (f2fs_verity_in_progress(inode))
121 return -EBUSY;
122
123 if (f2fs_is_atomic_file(inode) || f2fs_is_volatile_file(inode))
124 return -EOPNOTSUPP;
125
126 /*
127 * Since the file was opened readonly, we have to initialize the quotas
128 * here and not rely on ->open() doing it. This must be done before
129 * evicting the inline data.
130 */
131 err = dquot_initialize(inode);
132 if (err)
133 return err;
134
135 err = f2fs_convert_inline_inode(inode);
136 if (err)
137 return err;
138
139 set_inode_flag(inode, FI_VERITY_IN_PROGRESS);
140 return 0;
141 }
142
f2fs_end_enable_verity(struct file * filp,const void * desc,size_t desc_size,u64 merkle_tree_size)143 static int f2fs_end_enable_verity(struct file *filp, const void *desc,
144 size_t desc_size, u64 merkle_tree_size)
145 {
146 struct inode *inode = file_inode(filp);
147 struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
148 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size;
149 struct fsverity_descriptor_location dloc = {
150 .version = cpu_to_le32(1),
151 .size = cpu_to_le32(desc_size),
152 .pos = cpu_to_le64(desc_pos),
153 };
154 int err = 0, err2 = 0;
155
156 /*
157 * If an error already occurred (which fs/verity/ signals by passing
158 * desc == NULL), then only clean-up is needed.
159 */
160 if (desc == NULL)
161 goto cleanup;
162
163 /* Append the verity descriptor. */
164 err = pagecache_write(inode, desc, desc_size, desc_pos);
165 if (err)
166 goto cleanup;
167
168 /*
169 * Write all pages (both data and verity metadata). Note that this must
170 * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond
171 * i_size won't be written properly. For crash consistency, this also
172 * must happen before the verity inode flag gets persisted.
173 */
174 err = filemap_write_and_wait(inode->i_mapping);
175 if (err)
176 goto cleanup;
177
178 /* Set the verity xattr. */
179 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY,
180 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc),
181 NULL, XATTR_CREATE);
182 if (err)
183 goto cleanup;
184
185 /* Finally, set the verity inode flag. */
186 file_set_verity(inode);
187 f2fs_set_inode_flags(inode);
188 f2fs_mark_inode_dirty_sync(inode, true);
189
190 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);
191 return 0;
192
193 cleanup:
194 /*
195 * Verity failed to be enabled, so clean up by truncating any verity
196 * metadata that was written beyond i_size (both from cache and from
197 * disk) and clearing FI_VERITY_IN_PROGRESS.
198 *
199 * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection
200 * from re-instantiating cached pages we are truncating (since unlike
201 * normal file accesses, garbage collection isn't limited by i_size).
202 */
203 down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
204 truncate_inode_pages(inode->i_mapping, inode->i_size);
205 err2 = f2fs_truncate(inode);
206 if (err2) {
207 f2fs_err(sbi, "Truncating verity metadata failed (errno=%d)",
208 err2);
209 set_sbi_flag(sbi, SBI_NEED_FSCK);
210 }
211 up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
212 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);
213 return err ?: err2;
214 }
215
f2fs_get_verity_descriptor(struct inode * inode,void * buf,size_t buf_size)216 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf,
217 size_t buf_size)
218 {
219 struct fsverity_descriptor_location dloc;
220 int res;
221 u32 size;
222 u64 pos;
223
224 /* Get the descriptor location */
225 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY,
226 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL);
227 if (res < 0 && res != -ERANGE)
228 return res;
229 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(1)) {
230 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format");
231 return -EINVAL;
232 }
233 size = le32_to_cpu(dloc.size);
234 pos = le64_to_cpu(dloc.pos);
235
236 /* Get the descriptor */
237 if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes ||
238 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) {
239 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr");
240 return -EFSCORRUPTED;
241 }
242 if (buf_size) {
243 if (size > buf_size)
244 return -ERANGE;
245 res = pagecache_read(inode, buf, size, pos);
246 if (res)
247 return res;
248 }
249 return size;
250 }
251
252 /*
253 * Prefetch some pages from the file's Merkle tree.
254 *
255 * This is basically a stripped-down version of __do_page_cache_readahead()
256 * which works on pages past i_size.
257 */
f2fs_merkle_tree_readahead(struct address_space * mapping,pgoff_t start_index,unsigned long count)258 static void f2fs_merkle_tree_readahead(struct address_space *mapping,
259 pgoff_t start_index, unsigned long count)
260 {
261 LIST_HEAD(pages);
262 unsigned int nr_pages = 0;
263 struct page *page;
264 pgoff_t index;
265 struct blk_plug plug;
266
267 for (index = start_index; index < start_index + count; index++) {
268 page = xa_load(&mapping->i_pages, index);
269 if (!page || xa_is_value(page)) {
270 page = __page_cache_alloc(readahead_gfp_mask(mapping));
271 if (!page)
272 break;
273 page->index = index;
274 list_add(&page->lru, &pages);
275 nr_pages++;
276 }
277 }
278 blk_start_plug(&plug);
279 f2fs_mpage_readpages(mapping, &pages, NULL, nr_pages, true);
280 blk_finish_plug(&plug);
281 }
282
f2fs_read_merkle_tree_page(struct inode * inode,pgoff_t index,unsigned long num_ra_pages)283 static struct page *f2fs_read_merkle_tree_page(struct inode *inode,
284 pgoff_t index,
285 unsigned long num_ra_pages)
286 {
287 struct page *page;
288
289 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT;
290
291 page = find_get_page_flags(inode->i_mapping, index, FGP_ACCESSED);
292 if (!page || !PageUptodate(page)) {
293 if (page)
294 put_page(page);
295 else if (num_ra_pages > 1)
296 f2fs_merkle_tree_readahead(inode->i_mapping, index,
297 num_ra_pages);
298 page = read_mapping_page(inode->i_mapping, index, NULL);
299 }
300 return page;
301 }
302
f2fs_write_merkle_tree_block(struct inode * inode,const void * buf,u64 index,int log_blocksize)303 static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf,
304 u64 index, int log_blocksize)
305 {
306 loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize);
307
308 return pagecache_write(inode, buf, 1 << log_blocksize, pos);
309 }
310
311 const struct fsverity_operations f2fs_verityops = {
312 .begin_enable_verity = f2fs_begin_enable_verity,
313 .end_enable_verity = f2fs_end_enable_verity,
314 .get_verity_descriptor = f2fs_get_verity_descriptor,
315 .read_merkle_tree_page = f2fs_read_merkle_tree_page,
316 .write_merkle_tree_block = f2fs_write_merkle_tree_block,
317 };
318