• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * fs/f2fs/verity.c: fs-verity support for f2fs
4  *
5  * Copyright 2019 Google LLC
6  */
7 
8 /*
9  * Implementation of fsverity_operations for f2fs.
10  *
11  * Like ext4, f2fs stores the verity metadata (Merkle tree and
12  * fsverity_descriptor) past the end of the file, starting at the first 64K
13  * boundary beyond i_size.  This approach works because (a) verity files are
14  * readonly, and (b) pages fully beyond i_size aren't visible to userspace but
15  * can be read/written internally by f2fs with only some relatively small
16  * changes to f2fs.  Extended attributes cannot be used because (a) f2fs limits
17  * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be
18  * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't
19  * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is
20  * because it contains hashes of the plaintext data.
21  *
22  * Using a 64K boundary rather than a 4K one keeps things ready for
23  * architectures with 64K pages, and it doesn't necessarily waste space on-disk
24  * since there can be a hole between i_size and the start of the Merkle tree.
25  */
26 
27 #include <linux/f2fs_fs.h>
28 
29 #include "f2fs.h"
30 #include "xattr.h"
31 
f2fs_verity_metadata_pos(const struct inode * inode)32 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode)
33 {
34 	return round_up(inode->i_size, 65536);
35 }
36 
37 /*
38  * Read some verity metadata from the inode.  __vfs_read() can't be used because
39  * we need to read beyond i_size.
40  */
pagecache_read(struct inode * inode,void * buf,size_t count,loff_t pos)41 static int pagecache_read(struct inode *inode, void *buf, size_t count,
42 			  loff_t pos)
43 {
44 	while (count) {
45 		size_t n = min_t(size_t, count,
46 				 PAGE_SIZE - offset_in_page(pos));
47 		struct page *page;
48 
49 		page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT,
50 					 NULL);
51 		if (IS_ERR(page))
52 			return PTR_ERR(page);
53 
54 		memcpy_from_page(buf, page, offset_in_page(pos), n);
55 
56 		put_page(page);
57 
58 		buf += n;
59 		pos += n;
60 		count -= n;
61 	}
62 	return 0;
63 }
64 
65 /*
66  * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY.
67  * kernel_write() can't be used because the file descriptor is readonly.
68  */
pagecache_write(struct inode * inode,const void * buf,size_t count,loff_t pos)69 static int pagecache_write(struct inode *inode, const void *buf, size_t count,
70 			   loff_t pos)
71 {
72 	if (pos + count > inode->i_sb->s_maxbytes)
73 		return -EFBIG;
74 
75 	while (count) {
76 		size_t n = min_t(size_t, count,
77 				 PAGE_SIZE - offset_in_page(pos));
78 		struct page *page;
79 		void *fsdata = NULL;
80 		int res;
81 
82 		res = pagecache_write_begin(NULL, inode->i_mapping, pos, n, 0,
83 					    &page, &fsdata);
84 		if (res)
85 			return res;
86 
87 		memcpy_to_page(page, offset_in_page(pos), buf, n);
88 
89 		res = pagecache_write_end(NULL, inode->i_mapping, pos, n, n,
90 					  page, fsdata);
91 		if (res < 0)
92 			return res;
93 		if (res != n)
94 			return -EIO;
95 
96 		buf += n;
97 		pos += n;
98 		count -= n;
99 	}
100 	return 0;
101 }
102 
103 /*
104  * Format of f2fs verity xattr.  This points to the location of the verity
105  * descriptor within the file data rather than containing it directly because
106  * the verity descriptor *must* be encrypted when f2fs encryption is used.  But,
107  * f2fs encryption does not encrypt xattrs.
108  */
109 struct fsverity_descriptor_location {
110 	__le32 version;
111 	__le32 size;
112 	__le64 pos;
113 };
114 
f2fs_begin_enable_verity(struct file * filp)115 static int f2fs_begin_enable_verity(struct file *filp)
116 {
117 	struct inode *inode = file_inode(filp);
118 	int err;
119 
120 	if (f2fs_verity_in_progress(inode))
121 		return -EBUSY;
122 
123 	if (f2fs_is_atomic_file(inode) || f2fs_is_volatile_file(inode))
124 		return -EOPNOTSUPP;
125 
126 	/*
127 	 * Since the file was opened readonly, we have to initialize the quotas
128 	 * here and not rely on ->open() doing it.  This must be done before
129 	 * evicting the inline data.
130 	 */
131 	err = dquot_initialize(inode);
132 	if (err)
133 		return err;
134 
135 	err = f2fs_convert_inline_inode(inode);
136 	if (err)
137 		return err;
138 
139 	set_inode_flag(inode, FI_VERITY_IN_PROGRESS);
140 	return 0;
141 }
142 
f2fs_end_enable_verity(struct file * filp,const void * desc,size_t desc_size,u64 merkle_tree_size)143 static int f2fs_end_enable_verity(struct file *filp, const void *desc,
144 				  size_t desc_size, u64 merkle_tree_size)
145 {
146 	struct inode *inode = file_inode(filp);
147 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
148 	u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size;
149 	struct fsverity_descriptor_location dloc = {
150 		.version = cpu_to_le32(1),
151 		.size = cpu_to_le32(desc_size),
152 		.pos = cpu_to_le64(desc_pos),
153 	};
154 	int err = 0, err2 = 0;
155 
156 	/*
157 	 * If an error already occurred (which fs/verity/ signals by passing
158 	 * desc == NULL), then only clean-up is needed.
159 	 */
160 	if (desc == NULL)
161 		goto cleanup;
162 
163 	/* Append the verity descriptor. */
164 	err = pagecache_write(inode, desc, desc_size, desc_pos);
165 	if (err)
166 		goto cleanup;
167 
168 	/*
169 	 * Write all pages (both data and verity metadata).  Note that this must
170 	 * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond
171 	 * i_size won't be written properly.  For crash consistency, this also
172 	 * must happen before the verity inode flag gets persisted.
173 	 */
174 	err = filemap_write_and_wait(inode->i_mapping);
175 	if (err)
176 		goto cleanup;
177 
178 	/* Set the verity xattr. */
179 	err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY,
180 			    F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc),
181 			    NULL, XATTR_CREATE);
182 	if (err)
183 		goto cleanup;
184 
185 	/* Finally, set the verity inode flag. */
186 	file_set_verity(inode);
187 	f2fs_set_inode_flags(inode);
188 	f2fs_mark_inode_dirty_sync(inode, true);
189 
190 	clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);
191 	return 0;
192 
193 cleanup:
194 	/*
195 	 * Verity failed to be enabled, so clean up by truncating any verity
196 	 * metadata that was written beyond i_size (both from cache and from
197 	 * disk) and clearing FI_VERITY_IN_PROGRESS.
198 	 *
199 	 * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection
200 	 * from re-instantiating cached pages we are truncating (since unlike
201 	 * normal file accesses, garbage collection isn't limited by i_size).
202 	 */
203 	down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
204 	truncate_inode_pages(inode->i_mapping, inode->i_size);
205 	err2 = f2fs_truncate(inode);
206 	if (err2) {
207 		f2fs_err(sbi, "Truncating verity metadata failed (errno=%d)",
208 			 err2);
209 		set_sbi_flag(sbi, SBI_NEED_FSCK);
210 	}
211 	up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
212 	clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);
213 	return err ?: err2;
214 }
215 
f2fs_get_verity_descriptor(struct inode * inode,void * buf,size_t buf_size)216 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf,
217 				      size_t buf_size)
218 {
219 	struct fsverity_descriptor_location dloc;
220 	int res;
221 	u32 size;
222 	u64 pos;
223 
224 	/* Get the descriptor location */
225 	res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY,
226 			    F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL);
227 	if (res < 0 && res != -ERANGE)
228 		return res;
229 	if (res != sizeof(dloc) || dloc.version != cpu_to_le32(1)) {
230 		f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format");
231 		return -EINVAL;
232 	}
233 	size = le32_to_cpu(dloc.size);
234 	pos = le64_to_cpu(dloc.pos);
235 
236 	/* Get the descriptor */
237 	if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes ||
238 	    pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) {
239 		f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr");
240 		return -EFSCORRUPTED;
241 	}
242 	if (buf_size) {
243 		if (size > buf_size)
244 			return -ERANGE;
245 		res = pagecache_read(inode, buf, size, pos);
246 		if (res)
247 			return res;
248 	}
249 	return size;
250 }
251 
252 /*
253  * Prefetch some pages from the file's Merkle tree.
254  *
255  * This is basically a stripped-down version of __do_page_cache_readahead()
256  * which works on pages past i_size.
257  */
f2fs_merkle_tree_readahead(struct address_space * mapping,pgoff_t start_index,unsigned long count)258 static void f2fs_merkle_tree_readahead(struct address_space *mapping,
259 				       pgoff_t start_index, unsigned long count)
260 {
261 	LIST_HEAD(pages);
262 	unsigned int nr_pages = 0;
263 	struct page *page;
264 	pgoff_t index;
265 	struct blk_plug plug;
266 
267 	for (index = start_index; index < start_index + count; index++) {
268 		page = xa_load(&mapping->i_pages, index);
269 		if (!page || xa_is_value(page)) {
270 			page = __page_cache_alloc(readahead_gfp_mask(mapping));
271 			if (!page)
272 				break;
273 			page->index = index;
274 			list_add(&page->lru, &pages);
275 			nr_pages++;
276 		}
277 	}
278 	blk_start_plug(&plug);
279 	f2fs_mpage_readpages(mapping, &pages, NULL, nr_pages, true);
280 	blk_finish_plug(&plug);
281 }
282 
f2fs_read_merkle_tree_page(struct inode * inode,pgoff_t index,unsigned long num_ra_pages)283 static struct page *f2fs_read_merkle_tree_page(struct inode *inode,
284 					       pgoff_t index,
285 					       unsigned long num_ra_pages)
286 {
287 	struct page *page;
288 
289 	index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT;
290 
291 	page = find_get_page_flags(inode->i_mapping, index, FGP_ACCESSED);
292 	if (!page || !PageUptodate(page)) {
293 		if (page)
294 			put_page(page);
295 		else if (num_ra_pages > 1)
296 			f2fs_merkle_tree_readahead(inode->i_mapping, index,
297 						   num_ra_pages);
298 		page = read_mapping_page(inode->i_mapping, index, NULL);
299 	}
300 	return page;
301 }
302 
f2fs_write_merkle_tree_block(struct inode * inode,const void * buf,u64 index,int log_blocksize)303 static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf,
304 					u64 index, int log_blocksize)
305 {
306 	loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize);
307 
308 	return pagecache_write(inode, buf, 1 << log_blocksize, pos);
309 }
310 
311 const struct fsverity_operations f2fs_verityops = {
312 	.begin_enable_verity	= f2fs_begin_enable_verity,
313 	.end_enable_verity	= f2fs_end_enable_verity,
314 	.get_verity_descriptor	= f2fs_get_verity_descriptor,
315 	.read_merkle_tree_page	= f2fs_read_merkle_tree_page,
316 	.write_merkle_tree_block = f2fs_write_merkle_tree_block,
317 };
318