1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * fs/f2fs/verity.c: fs-verity support for f2fs 4 * 5 * Copyright 2019 Google LLC 6 */ 7 8 /* 9 * Implementation of fsverity_operations for f2fs. 10 * 11 * Like ext4, f2fs stores the verity metadata (Merkle tree and 12 * fsverity_descriptor) past the end of the file, starting at the first 64K 13 * boundary beyond i_size. This approach works because (a) verity files are 14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but 15 * can be read/written internally by f2fs with only some relatively small 16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits 17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be 18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't 19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is 20 * because it contains hashes of the plaintext data. 21 * 22 * Using a 64K boundary rather than a 4K one keeps things ready for 23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk 24 * since there can be a hole between i_size and the start of the Merkle tree. 25 */ 26 27 #include <linux/f2fs_fs.h> 28 29 #include "f2fs.h" 30 #include "xattr.h" 31 32 #define F2FS_VERIFY_VER (1) 33 34 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode) 35 { 36 return round_up(inode->i_size, 65536); 37 } 38 39 /* 40 * Read some verity metadata from the inode. __vfs_read() can't be used because 41 * we need to read beyond i_size. 42 */ 43 static int pagecache_read(struct inode *inode, void *buf, size_t count, 44 loff_t pos) 45 { 46 while (count) { 47 size_t n = min_t(size_t, count, 48 PAGE_SIZE - offset_in_page(pos)); 49 struct page *page; 50 void *addr; 51 52 page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT, 53 NULL); 54 if (IS_ERR(page)) 55 return PTR_ERR(page); 56 57 addr = kmap_atomic(page); 58 memcpy(buf, addr + offset_in_page(pos), n); 59 kunmap_atomic(addr); 60 61 put_page(page); 62 63 buf += n; 64 pos += n; 65 count -= n; 66 } 67 return 0; 68 } 69 70 /* 71 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY. 72 * kernel_write() can't be used because the file descriptor is readonly. 73 */ 74 static int pagecache_write(struct inode *inode, const void *buf, size_t count, 75 loff_t pos) 76 { 77 struct address_space *mapping = inode->i_mapping; 78 const struct address_space_operations *aops = mapping->a_ops; 79 80 if (pos + count > inode->i_sb->s_maxbytes) 81 return -EFBIG; 82 83 while (count) { 84 size_t n = min_t(size_t, count, 85 PAGE_SIZE - offset_in_page(pos)); 86 struct page *page; 87 void *fsdata; 88 void *addr; 89 int res; 90 91 res = aops->write_begin(NULL, mapping, pos, n, &page, &fsdata); 92 if (res) 93 return res; 94 95 addr = kmap_atomic(page); 96 memcpy(addr + offset_in_page(pos), buf, n); 97 kunmap_atomic(addr); 98 99 res = aops->write_end(NULL, mapping, pos, n, n, page, fsdata); 100 if (res < 0) 101 return res; 102 if (res != n) 103 return -EIO; 104 105 buf += n; 106 pos += n; 107 count -= n; 108 } 109 return 0; 110 } 111 112 /* 113 * Format of f2fs verity xattr. This points to the location of the verity 114 * descriptor within the file data rather than containing it directly because 115 * the verity descriptor *must* be encrypted when f2fs encryption is used. But, 116 * f2fs encryption does not encrypt xattrs. 117 */ 118 struct fsverity_descriptor_location { 119 __le32 version; 120 __le32 size; 121 __le64 pos; 122 }; 123 124 static int f2fs_begin_enable_verity(struct file *filp) 125 { 126 struct inode *inode = file_inode(filp); 127 int err; 128 129 if (f2fs_verity_in_progress(inode)) 130 return -EBUSY; 131 132 if (f2fs_is_atomic_file(inode)) 133 return -EOPNOTSUPP; 134 135 /* 136 * Since the file was opened readonly, we have to initialize the quotas 137 * here and not rely on ->open() doing it. This must be done before 138 * evicting the inline data. 139 */ 140 err = f2fs_dquot_initialize(inode); 141 if (err) 142 return err; 143 144 err = f2fs_convert_inline_inode(inode); 145 if (err) 146 return err; 147 148 set_inode_flag(inode, FI_VERITY_IN_PROGRESS); 149 return 0; 150 } 151 152 static int f2fs_end_enable_verity(struct file *filp, const void *desc, 153 size_t desc_size, u64 merkle_tree_size) 154 { 155 struct inode *inode = file_inode(filp); 156 struct f2fs_sb_info *sbi = F2FS_I_SB(inode); 157 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size; 158 struct fsverity_descriptor_location dloc = { 159 .version = cpu_to_le32(F2FS_VERIFY_VER), 160 .size = cpu_to_le32(desc_size), 161 .pos = cpu_to_le64(desc_pos), 162 }; 163 int err = 0, err2 = 0; 164 165 /* 166 * If an error already occurred (which fs/verity/ signals by passing 167 * desc == NULL), then only clean-up is needed. 168 */ 169 if (desc == NULL) 170 goto cleanup; 171 172 /* Append the verity descriptor. */ 173 err = pagecache_write(inode, desc, desc_size, desc_pos); 174 if (err) 175 goto cleanup; 176 177 /* 178 * Write all pages (both data and verity metadata). Note that this must 179 * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond 180 * i_size won't be written properly. For crash consistency, this also 181 * must happen before the verity inode flag gets persisted. 182 */ 183 err = filemap_write_and_wait(inode->i_mapping); 184 if (err) 185 goto cleanup; 186 187 /* Set the verity xattr. */ 188 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY, 189 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), 190 NULL, XATTR_CREATE); 191 if (err) 192 goto cleanup; 193 194 /* Finally, set the verity inode flag. */ 195 file_set_verity(inode); 196 f2fs_set_inode_flags(inode); 197 f2fs_mark_inode_dirty_sync(inode, true); 198 199 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 200 return 0; 201 202 cleanup: 203 /* 204 * Verity failed to be enabled, so clean up by truncating any verity 205 * metadata that was written beyond i_size (both from cache and from 206 * disk) and clearing FI_VERITY_IN_PROGRESS. 207 * 208 * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection 209 * from re-instantiating cached pages we are truncating (since unlike 210 * normal file accesses, garbage collection isn't limited by i_size). 211 */ 212 f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); 213 truncate_inode_pages(inode->i_mapping, inode->i_size); 214 err2 = f2fs_truncate(inode); 215 if (err2) { 216 f2fs_err(sbi, "Truncating verity metadata failed (errno=%d)", 217 err2); 218 set_sbi_flag(sbi, SBI_NEED_FSCK); 219 } 220 f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); 221 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 222 return err ?: err2; 223 } 224 225 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf, 226 size_t buf_size) 227 { 228 struct fsverity_descriptor_location dloc; 229 int res; 230 u32 size; 231 u64 pos; 232 233 /* Get the descriptor location */ 234 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY, 235 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL); 236 if (res < 0 && res != -ERANGE) 237 return res; 238 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(F2FS_VERIFY_VER)) { 239 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format"); 240 return -EINVAL; 241 } 242 size = le32_to_cpu(dloc.size); 243 pos = le64_to_cpu(dloc.pos); 244 245 /* Get the descriptor */ 246 if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes || 247 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) { 248 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr"); 249 return -EFSCORRUPTED; 250 } 251 if (buf_size) { 252 if (size > buf_size) 253 return -ERANGE; 254 res = pagecache_read(inode, buf, size, pos); 255 if (res) 256 return res; 257 } 258 return size; 259 } 260 261 static struct page *f2fs_read_merkle_tree_page(struct inode *inode, 262 pgoff_t index, 263 unsigned long num_ra_pages) 264 { 265 DEFINE_READAHEAD(ractl, NULL, NULL, inode->i_mapping, index); 266 struct page *page; 267 268 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; 269 270 page = find_get_page_flags(inode->i_mapping, index, FGP_ACCESSED); 271 if (!page || !PageUptodate(page)) { 272 if (page) 273 put_page(page); 274 else if (num_ra_pages > 1) 275 page_cache_ra_unbounded(&ractl, num_ra_pages, 0); 276 page = read_mapping_page(inode->i_mapping, index, NULL); 277 } 278 return page; 279 } 280 281 static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf, 282 u64 index, int log_blocksize) 283 { 284 loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize); 285 286 return pagecache_write(inode, buf, 1 << log_blocksize, pos); 287 } 288 289 const struct fsverity_operations f2fs_verityops = { 290 .begin_enable_verity = f2fs_begin_enable_verity, 291 .end_enable_verity = f2fs_end_enable_verity, 292 .get_verity_descriptor = f2fs_get_verity_descriptor, 293 .read_merkle_tree_page = f2fs_read_merkle_tree_page, 294 .write_merkle_tree_block = f2fs_write_merkle_tree_block, 295 }; 296