1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * fs/f2fs/verity.c: fs-verity support for f2fs 4 * 5 * Copyright 2019 Google LLC 6 */ 7 8 /* 9 * Implementation of fsverity_operations for f2fs. 10 * 11 * Like ext4, f2fs stores the verity metadata (Merkle tree and 12 * fsverity_descriptor) past the end of the file, starting at the first 64K 13 * boundary beyond i_size. This approach works because (a) verity files are 14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but 15 * can be read/written internally by f2fs with only some relatively small 16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits 17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be 18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't 19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is 20 * because it contains hashes of the plaintext data. 21 * 22 * Using a 64K boundary rather than a 4K one keeps things ready for 23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk 24 * since there can be a hole between i_size and the start of the Merkle tree. 25 */ 26 27 #include <linux/f2fs_fs.h> 28 29 #include "f2fs.h" 30 #include "xattr.h" 31 32 #define F2FS_VERIFY_VER (1) 33 34 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode) 35 { 36 return round_up(inode->i_size, 65536); 37 } 38 39 /* 40 * Read some verity metadata from the inode. __vfs_read() can't be used because 41 * we need to read beyond i_size. 42 */ 43 static int pagecache_read(struct inode *inode, void *buf, size_t count, 44 loff_t pos) 45 { 46 while (count) { 47 size_t n = min_t(size_t, count, 48 PAGE_SIZE - offset_in_page(pos)); 49 struct page *page; 50 void *addr; 51 52 page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT, 53 NULL); 54 if (IS_ERR(page)) 55 return PTR_ERR(page); 56 57 addr = kmap_atomic(page); 58 memcpy(buf, addr + offset_in_page(pos), n); 59 kunmap_atomic(addr); 60 61 put_page(page); 62 63 buf += n; 64 pos += n; 65 count -= n; 66 } 67 return 0; 68 } 69 70 /* 71 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY. 72 * kernel_write() can't be used because the file descriptor is readonly. 73 */ 74 static int pagecache_write(struct inode *inode, const void *buf, size_t count, 75 loff_t pos) 76 { 77 if (pos + count > inode->i_sb->s_maxbytes) 78 return -EFBIG; 79 80 while (count) { 81 size_t n = min_t(size_t, count, 82 PAGE_SIZE - offset_in_page(pos)); 83 struct page *page; 84 void *fsdata; 85 void *addr; 86 int res; 87 88 res = pagecache_write_begin(NULL, inode->i_mapping, pos, n, 0, 89 &page, &fsdata); 90 if (res) 91 return res; 92 93 addr = kmap_atomic(page); 94 memcpy(addr + offset_in_page(pos), buf, n); 95 kunmap_atomic(addr); 96 97 res = pagecache_write_end(NULL, inode->i_mapping, pos, n, n, 98 page, fsdata); 99 if (res < 0) 100 return res; 101 if (res != n) 102 return -EIO; 103 104 buf += n; 105 pos += n; 106 count -= n; 107 } 108 return 0; 109 } 110 111 /* 112 * Format of f2fs verity xattr. This points to the location of the verity 113 * descriptor within the file data rather than containing it directly because 114 * the verity descriptor *must* be encrypted when f2fs encryption is used. But, 115 * f2fs encryption does not encrypt xattrs. 116 */ 117 struct fsverity_descriptor_location { 118 __le32 version; 119 __le32 size; 120 __le64 pos; 121 }; 122 123 static int f2fs_begin_enable_verity(struct file *filp) 124 { 125 struct inode *inode = file_inode(filp); 126 int err; 127 128 if (f2fs_verity_in_progress(inode)) 129 return -EBUSY; 130 131 if (f2fs_is_atomic_file(inode) || f2fs_is_volatile_file(inode)) 132 return -EOPNOTSUPP; 133 134 /* 135 * Since the file was opened readonly, we have to initialize the quotas 136 * here and not rely on ->open() doing it. This must be done before 137 * evicting the inline data. 138 */ 139 err = f2fs_dquot_initialize(inode); 140 if (err) 141 return err; 142 143 err = f2fs_convert_inline_inode(inode); 144 if (err) 145 return err; 146 147 set_inode_flag(inode, FI_VERITY_IN_PROGRESS); 148 return 0; 149 } 150 151 static int f2fs_end_enable_verity(struct file *filp, const void *desc, 152 size_t desc_size, u64 merkle_tree_size) 153 { 154 struct inode *inode = file_inode(filp); 155 struct f2fs_sb_info *sbi = F2FS_I_SB(inode); 156 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size; 157 struct fsverity_descriptor_location dloc = { 158 .version = cpu_to_le32(F2FS_VERIFY_VER), 159 .size = cpu_to_le32(desc_size), 160 .pos = cpu_to_le64(desc_pos), 161 }; 162 int err = 0, err2 = 0; 163 164 /* 165 * If an error already occurred (which fs/verity/ signals by passing 166 * desc == NULL), then only clean-up is needed. 167 */ 168 if (desc == NULL) 169 goto cleanup; 170 171 /* Append the verity descriptor. */ 172 err = pagecache_write(inode, desc, desc_size, desc_pos); 173 if (err) 174 goto cleanup; 175 176 /* 177 * Write all pages (both data and verity metadata). Note that this must 178 * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond 179 * i_size won't be written properly. For crash consistency, this also 180 * must happen before the verity inode flag gets persisted. 181 */ 182 err = filemap_write_and_wait(inode->i_mapping); 183 if (err) 184 goto cleanup; 185 186 /* Set the verity xattr. */ 187 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY, 188 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), 189 NULL, XATTR_CREATE); 190 if (err) 191 goto cleanup; 192 193 /* Finally, set the verity inode flag. */ 194 file_set_verity(inode); 195 f2fs_set_inode_flags(inode); 196 f2fs_mark_inode_dirty_sync(inode, true); 197 198 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 199 return 0; 200 201 cleanup: 202 /* 203 * Verity failed to be enabled, so clean up by truncating any verity 204 * metadata that was written beyond i_size (both from cache and from 205 * disk) and clearing FI_VERITY_IN_PROGRESS. 206 * 207 * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection 208 * from re-instantiating cached pages we are truncating (since unlike 209 * normal file accesses, garbage collection isn't limited by i_size). 210 */ 211 down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); 212 truncate_inode_pages(inode->i_mapping, inode->i_size); 213 err2 = f2fs_truncate(inode); 214 if (err2) { 215 f2fs_err(sbi, "Truncating verity metadata failed (errno=%d)", 216 err2); 217 set_sbi_flag(sbi, SBI_NEED_FSCK); 218 } 219 up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); 220 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 221 return err ?: err2; 222 } 223 224 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf, 225 size_t buf_size) 226 { 227 struct fsverity_descriptor_location dloc; 228 int res; 229 u32 size; 230 u64 pos; 231 232 /* Get the descriptor location */ 233 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY, 234 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL); 235 if (res < 0 && res != -ERANGE) 236 return res; 237 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(F2FS_VERIFY_VER)) { 238 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format"); 239 return -EINVAL; 240 } 241 size = le32_to_cpu(dloc.size); 242 pos = le64_to_cpu(dloc.pos); 243 244 /* Get the descriptor */ 245 if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes || 246 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) { 247 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr"); 248 return -EFSCORRUPTED; 249 } 250 if (buf_size) { 251 if (size > buf_size) 252 return -ERANGE; 253 res = pagecache_read(inode, buf, size, pos); 254 if (res) 255 return res; 256 } 257 return size; 258 } 259 260 static struct page *f2fs_read_merkle_tree_page(struct inode *inode, 261 pgoff_t index, 262 unsigned long num_ra_pages) 263 { 264 DEFINE_READAHEAD(ractl, NULL, NULL, inode->i_mapping, index); 265 struct page *page; 266 267 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; 268 269 page = find_get_page_flags(inode->i_mapping, index, FGP_ACCESSED); 270 if (!page || !PageUptodate(page)) { 271 if (page) 272 put_page(page); 273 else if (num_ra_pages > 1) 274 page_cache_ra_unbounded(&ractl, num_ra_pages, 0); 275 page = read_mapping_page(inode->i_mapping, index, NULL); 276 } 277 return page; 278 } 279 280 static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf, 281 u64 index, int log_blocksize) 282 { 283 loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize); 284 285 return pagecache_write(inode, buf, 1 << log_blocksize, pos); 286 } 287 288 const struct fsverity_operations f2fs_verityops = { 289 .begin_enable_verity = f2fs_begin_enable_verity, 290 .end_enable_verity = f2fs_end_enable_verity, 291 .get_verity_descriptor = f2fs_get_verity_descriptor, 292 .read_merkle_tree_page = f2fs_read_merkle_tree_page, 293 .write_merkle_tree_block = f2fs_write_merkle_tree_block, 294 }; 295