1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * fs/f2fs/verity.c: fs-verity support for f2fs 4 * 5 * Copyright 2019 Google LLC 6 */ 7 8 /* 9 * Implementation of fsverity_operations for f2fs. 10 * 11 * Like ext4, f2fs stores the verity metadata (Merkle tree and 12 * fsverity_descriptor) past the end of the file, starting at the first 64K 13 * boundary beyond i_size. This approach works because (a) verity files are 14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but 15 * can be read/written internally by f2fs with only some relatively small 16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits 17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be 18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't 19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is 20 * because it contains hashes of the plaintext data. 21 * 22 * Using a 64K boundary rather than a 4K one keeps things ready for 23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk 24 * since there can be a hole between i_size and the start of the Merkle tree. 25 */ 26 27 #include <linux/f2fs_fs.h> 28 29 #include "f2fs.h" 30 #include "xattr.h" 31 32 #define F2FS_VERIFY_VER (1) 33 34 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode) 35 { 36 return round_up(inode->i_size, 65536); 37 } 38 39 /* 40 * Read some verity metadata from the inode. __vfs_read() can't be used because 41 * we need to read beyond i_size. 42 */ 43 static int pagecache_read(struct inode *inode, void *buf, size_t count, 44 loff_t pos) 45 { 46 while (count) { 47 size_t n = min_t(size_t, count, 48 PAGE_SIZE - offset_in_page(pos)); 49 struct page *page; 50 void *addr; 51 52 page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT, 53 NULL); 54 if (IS_ERR(page)) 55 return PTR_ERR(page); 56 57 addr = kmap_atomic(page); 58 memcpy(buf, addr + offset_in_page(pos), n); 59 kunmap_atomic(addr); 60 61 put_page(page); 62 63 buf += n; 64 pos += n; 65 count -= n; 66 } 67 return 0; 68 } 69 70 /* 71 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY. 72 * kernel_write() can't be used because the file descriptor is readonly. 73 */ 74 static int pagecache_write(struct inode *inode, const void *buf, size_t count, 75 loff_t pos) 76 { 77 if (pos + count > inode->i_sb->s_maxbytes) 78 return -EFBIG; 79 80 while (count) { 81 size_t n = min_t(size_t, count, 82 PAGE_SIZE - offset_in_page(pos)); 83 struct page *page; 84 void *fsdata; 85 void *addr; 86 int res; 87 88 res = pagecache_write_begin(NULL, inode->i_mapping, pos, n, 0, 89 &page, &fsdata); 90 if (res) 91 return res; 92 93 addr = kmap_atomic(page); 94 memcpy(addr + offset_in_page(pos), buf, n); 95 kunmap_atomic(addr); 96 97 res = pagecache_write_end(NULL, inode->i_mapping, pos, n, n, 98 page, fsdata); 99 if (res < 0) 100 return res; 101 if (res != n) 102 return -EIO; 103 104 buf += n; 105 pos += n; 106 count -= n; 107 } 108 return 0; 109 } 110 111 /* 112 * Format of f2fs verity xattr. This points to the location of the verity 113 * descriptor within the file data rather than containing it directly because 114 * the verity descriptor *must* be encrypted when f2fs encryption is used. But, 115 * f2fs encryption does not encrypt xattrs. 116 */ 117 struct fsverity_descriptor_location { 118 __le32 version; 119 __le32 size; 120 __le64 pos; 121 }; 122 123 static int f2fs_begin_enable_verity(struct file *filp) 124 { 125 struct inode *inode = file_inode(filp); 126 int err; 127 128 if (f2fs_verity_in_progress(inode)) 129 return -EBUSY; 130 131 if (f2fs_is_atomic_file(inode) || f2fs_is_volatile_file(inode)) 132 return -EOPNOTSUPP; 133 134 /* 135 * Since the file was opened readonly, we have to initialize the quotas 136 * here and not rely on ->open() doing it. This must be done before 137 * evicting the inline data. 138 */ 139 err = dquot_initialize(inode); 140 if (err) 141 return err; 142 143 err = f2fs_convert_inline_inode(inode); 144 if (err) 145 return err; 146 147 set_inode_flag(inode, FI_VERITY_IN_PROGRESS); 148 return 0; 149 } 150 151 static int f2fs_end_enable_verity(struct file *filp, const void *desc, 152 size_t desc_size, u64 merkle_tree_size) 153 { 154 struct inode *inode = file_inode(filp); 155 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size; 156 struct fsverity_descriptor_location dloc = { 157 .version = cpu_to_le32(F2FS_VERIFY_VER), 158 .size = cpu_to_le32(desc_size), 159 .pos = cpu_to_le64(desc_pos), 160 }; 161 int err = 0; 162 163 if (desc != NULL) { 164 /* Succeeded; write the verity descriptor. */ 165 err = pagecache_write(inode, desc, desc_size, desc_pos); 166 167 /* Write all pages before clearing FI_VERITY_IN_PROGRESS. */ 168 if (!err) 169 err = filemap_write_and_wait(inode->i_mapping); 170 } 171 172 /* If we failed, truncate anything we wrote past i_size. */ 173 if (desc == NULL || err) 174 f2fs_truncate(inode); 175 176 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 177 178 if (desc != NULL && !err) { 179 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY, 180 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), 181 NULL, XATTR_CREATE); 182 if (!err) { 183 file_set_verity(inode); 184 f2fs_set_inode_flags(inode); 185 f2fs_mark_inode_dirty_sync(inode, true); 186 } 187 } 188 return err; 189 } 190 191 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf, 192 size_t buf_size) 193 { 194 struct fsverity_descriptor_location dloc; 195 int res; 196 u32 size; 197 u64 pos; 198 199 /* Get the descriptor location */ 200 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY, 201 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL); 202 if (res < 0 && res != -ERANGE) 203 return res; 204 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(F2FS_VERIFY_VER)) { 205 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format"); 206 return -EINVAL; 207 } 208 size = le32_to_cpu(dloc.size); 209 pos = le64_to_cpu(dloc.pos); 210 211 /* Get the descriptor */ 212 if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes || 213 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) { 214 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr"); 215 return -EFSCORRUPTED; 216 } 217 if (buf_size) { 218 if (size > buf_size) 219 return -ERANGE; 220 res = pagecache_read(inode, buf, size, pos); 221 if (res) 222 return res; 223 } 224 return size; 225 } 226 227 static struct page *f2fs_read_merkle_tree_page(struct inode *inode, 228 pgoff_t index, 229 unsigned long num_ra_pages) 230 { 231 struct page *page; 232 233 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; 234 235 page = find_get_page_flags(inode->i_mapping, index, FGP_ACCESSED); 236 if (!page || !PageUptodate(page)) { 237 if (page) 238 put_page(page); 239 else if (num_ra_pages > 1) 240 page_cache_readahead_unbounded(inode->i_mapping, NULL, 241 index, num_ra_pages, 0); 242 page = read_mapping_page(inode->i_mapping, index, NULL); 243 } 244 return page; 245 } 246 247 static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf, 248 u64 index, int log_blocksize) 249 { 250 loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize); 251 252 return pagecache_write(inode, buf, 1 << log_blocksize, pos); 253 } 254 255 const struct fsverity_operations f2fs_verityops = { 256 .begin_enable_verity = f2fs_begin_enable_verity, 257 .end_enable_verity = f2fs_end_enable_verity, 258 .get_verity_descriptor = f2fs_get_verity_descriptor, 259 .read_merkle_tree_page = f2fs_read_merkle_tree_page, 260 .write_merkle_tree_block = f2fs_write_merkle_tree_block, 261 }; 262