1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * fs/f2fs/verity.c: fs-verity support for f2fs 4 * 5 * Copyright 2019 Google LLC 6 */ 7 8 /* 9 * Implementation of fsverity_operations for f2fs. 10 * 11 * Like ext4, f2fs stores the verity metadata (Merkle tree and 12 * fsverity_descriptor) past the end of the file, starting at the first 64K 13 * boundary beyond i_size. This approach works because (a) verity files are 14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but 15 * can be read/written internally by f2fs with only some relatively small 16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits 17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be 18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't 19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is 20 * because it contains hashes of the plaintext data. 21 * 22 * Using a 64K boundary rather than a 4K one keeps things ready for 23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk 24 * since there can be a hole between i_size and the start of the Merkle tree. 25 */ 26 27 #include <linux/f2fs_fs.h> 28 29 #include "f2fs.h" 30 #include "xattr.h" 31 32 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode) 33 { 34 return round_up(inode->i_size, 65536); 35 } 36 37 /* 38 * Read some verity metadata from the inode. __vfs_read() can't be used because 39 * we need to read beyond i_size. 40 */ 41 static int pagecache_read(struct inode *inode, void *buf, size_t count, 42 loff_t pos) 43 { 44 while (count) { 45 size_t n = min_t(size_t, count, 46 PAGE_SIZE - offset_in_page(pos)); 47 struct page *page; 48 void *addr; 49 50 page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT, 51 NULL); 52 if (IS_ERR(page)) 53 return PTR_ERR(page); 54 55 addr = kmap_atomic(page); 56 memcpy(buf, addr + offset_in_page(pos), n); 57 kunmap_atomic(addr); 58 59 put_page(page); 60 61 buf += n; 62 pos += n; 63 count -= n; 64 } 65 return 0; 66 } 67 68 /* 69 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY. 70 * kernel_write() can't be used because the file descriptor is readonly. 71 */ 72 static int pagecache_write(struct inode *inode, const void *buf, size_t count, 73 loff_t pos) 74 { 75 if (pos + count > inode->i_sb->s_maxbytes) 76 return -EFBIG; 77 78 while (count) { 79 size_t n = min_t(size_t, count, 80 PAGE_SIZE - offset_in_page(pos)); 81 struct page *page; 82 void *fsdata; 83 void *addr; 84 int res; 85 86 res = pagecache_write_begin(NULL, inode->i_mapping, pos, n, 0, 87 &page, &fsdata); 88 if (res) 89 return res; 90 91 addr = kmap_atomic(page); 92 memcpy(addr + offset_in_page(pos), buf, n); 93 kunmap_atomic(addr); 94 95 res = pagecache_write_end(NULL, inode->i_mapping, pos, n, n, 96 page, fsdata); 97 if (res < 0) 98 return res; 99 if (res != n) 100 return -EIO; 101 102 buf += n; 103 pos += n; 104 count -= n; 105 } 106 return 0; 107 } 108 109 /* 110 * Format of f2fs verity xattr. This points to the location of the verity 111 * descriptor within the file data rather than containing it directly because 112 * the verity descriptor *must* be encrypted when f2fs encryption is used. But, 113 * f2fs encryption does not encrypt xattrs. 114 */ 115 struct fsverity_descriptor_location { 116 __le32 version; 117 __le32 size; 118 __le64 pos; 119 }; 120 121 static int f2fs_begin_enable_verity(struct file *filp) 122 { 123 struct inode *inode = file_inode(filp); 124 int err; 125 126 if (f2fs_verity_in_progress(inode)) 127 return -EBUSY; 128 129 if (f2fs_is_atomic_file(inode) || f2fs_is_volatile_file(inode)) 130 return -EOPNOTSUPP; 131 132 /* 133 * Since the file was opened readonly, we have to initialize the quotas 134 * here and not rely on ->open() doing it. This must be done before 135 * evicting the inline data. 136 */ 137 err = dquot_initialize(inode); 138 if (err) 139 return err; 140 141 err = f2fs_convert_inline_inode(inode); 142 if (err) 143 return err; 144 145 set_inode_flag(inode, FI_VERITY_IN_PROGRESS); 146 return 0; 147 } 148 149 static int f2fs_end_enable_verity(struct file *filp, const void *desc, 150 size_t desc_size, u64 merkle_tree_size) 151 { 152 struct inode *inode = file_inode(filp); 153 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size; 154 struct fsverity_descriptor_location dloc = { 155 .version = cpu_to_le32(1), 156 .size = cpu_to_le32(desc_size), 157 .pos = cpu_to_le64(desc_pos), 158 }; 159 int err = 0; 160 161 if (desc != NULL) { 162 /* Succeeded; write the verity descriptor. */ 163 err = pagecache_write(inode, desc, desc_size, desc_pos); 164 165 /* Write all pages before clearing FI_VERITY_IN_PROGRESS. */ 166 if (!err) 167 err = filemap_write_and_wait(inode->i_mapping); 168 } 169 170 /* If we failed, truncate anything we wrote past i_size. */ 171 if (desc == NULL || err) 172 f2fs_truncate(inode); 173 174 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 175 176 if (desc != NULL && !err) { 177 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY, 178 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), 179 NULL, XATTR_CREATE); 180 if (!err) { 181 file_set_verity(inode); 182 f2fs_set_inode_flags(inode); 183 f2fs_mark_inode_dirty_sync(inode, true); 184 } 185 } 186 return err; 187 } 188 189 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf, 190 size_t buf_size) 191 { 192 struct fsverity_descriptor_location dloc; 193 int res; 194 u32 size; 195 u64 pos; 196 197 /* Get the descriptor location */ 198 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY, 199 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL); 200 if (res < 0 && res != -ERANGE) 201 return res; 202 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(1)) { 203 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format"); 204 return -EINVAL; 205 } 206 size = le32_to_cpu(dloc.size); 207 pos = le64_to_cpu(dloc.pos); 208 209 /* Get the descriptor */ 210 if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes || 211 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) { 212 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr"); 213 return -EFSCORRUPTED; 214 } 215 if (buf_size) { 216 if (size > buf_size) 217 return -ERANGE; 218 res = pagecache_read(inode, buf, size, pos); 219 if (res) 220 return res; 221 } 222 return size; 223 } 224 225 static struct page *f2fs_read_merkle_tree_page(struct inode *inode, 226 pgoff_t index, 227 unsigned long num_ra_pages) 228 { 229 struct page *page; 230 231 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; 232 233 page = find_get_page_flags(inode->i_mapping, index, FGP_ACCESSED); 234 if (!page || !PageUptodate(page)) { 235 if (page) 236 put_page(page); 237 else if (num_ra_pages > 1) 238 page_cache_readahead_unbounded(inode->i_mapping, NULL, 239 index, num_ra_pages, 0); 240 page = read_mapping_page(inode->i_mapping, index, NULL); 241 } 242 return page; 243 } 244 245 static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf, 246 u64 index, int log_blocksize) 247 { 248 loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize); 249 250 return pagecache_write(inode, buf, 1 << log_blocksize, pos); 251 } 252 253 const struct fsverity_operations f2fs_verityops = { 254 .begin_enable_verity = f2fs_begin_enable_verity, 255 .end_enable_verity = f2fs_end_enable_verity, 256 .get_verity_descriptor = f2fs_get_verity_descriptor, 257 .read_merkle_tree_page = f2fs_read_merkle_tree_page, 258 .write_merkle_tree_block = f2fs_write_merkle_tree_block, 259 }; 260