296 lines · c
1// SPDX-License-Identifier: GPL-2.02/*3 * fs/f2fs/verity.c: fs-verity support for f2fs4 *5 * Copyright 2019 Google LLC6 */7 8/*9 * Implementation of fsverity_operations for f2fs.10 *11 * Like ext4, f2fs stores the verity metadata (Merkle tree and12 * fsverity_descriptor) past the end of the file, starting at the first 64K13 * boundary beyond i_size. This approach works because (a) verity files are14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but15 * can be read/written internally by f2fs with only some relatively small16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is20 * because it contains hashes of the plaintext data.21 *22 * Using a 64K boundary rather than a 4K one keeps things ready for23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk24 * since there can be a hole between i_size and the start of the Merkle tree.25 */26 27#include <linux/f2fs_fs.h>28 29#include "f2fs.h"30#include "xattr.h"31 32#define F2FS_VERIFY_VER (1)33 34static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode)35{36 return round_up(inode->i_size, 65536);37}38 39/*40 * Read some verity metadata from the inode. __vfs_read() can't be used because41 * we need to read beyond i_size.42 */43static int pagecache_read(struct inode *inode, void *buf, size_t count,44 loff_t pos)45{46 while (count) {47 size_t n = min_t(size_t, count,48 PAGE_SIZE - offset_in_page(pos));49 struct page *page;50 51 page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT,52 NULL);53 if (IS_ERR(page))54 return PTR_ERR(page);55 56 memcpy_from_page(buf, page, offset_in_page(pos), n);57 58 put_page(page);59 60 buf += n;61 pos += n;62 count -= n;63 }64 return 0;65}66 67/*68 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY.69 * kernel_write() can't be used because the file descriptor is readonly.70 */71static int pagecache_write(struct inode *inode, const void *buf, size_t count,72 loff_t pos)73{74 struct address_space *mapping = inode->i_mapping;75 const struct address_space_operations *aops = mapping->a_ops;76 77 if (pos + count > F2FS_BLK_TO_BYTES(max_file_blocks(inode)))78 return -EFBIG;79 80 while (count) {81 size_t n = min_t(size_t, count,82 PAGE_SIZE - offset_in_page(pos));83 struct folio *folio;84 void *fsdata = NULL;85 int res;86 87 res = aops->write_begin(NULL, mapping, pos, n, &folio, &fsdata);88 if (res)89 return res;90 91 memcpy_to_folio(folio, offset_in_folio(folio, pos), buf, n);92 93 res = aops->write_end(NULL, mapping, pos, n, n, folio, fsdata);94 if (res < 0)95 return res;96 if (res != n)97 return -EIO;98 99 buf += n;100 pos += n;101 count -= n;102 }103 return 0;104}105 106/*107 * Format of f2fs verity xattr. This points to the location of the verity108 * descriptor within the file data rather than containing it directly because109 * the verity descriptor *must* be encrypted when f2fs encryption is used. But,110 * f2fs encryption does not encrypt xattrs.111 */112struct fsverity_descriptor_location {113 __le32 version;114 __le32 size;115 __le64 pos;116};117 118static int f2fs_begin_enable_verity(struct file *filp)119{120 struct inode *inode = file_inode(filp);121 int err;122 123 if (f2fs_verity_in_progress(inode))124 return -EBUSY;125 126 if (f2fs_is_atomic_file(inode))127 return -EOPNOTSUPP;128 129 /*130 * Since the file was opened readonly, we have to initialize the quotas131 * here and not rely on ->open() doing it. This must be done before132 * evicting the inline data.133 */134 err = f2fs_dquot_initialize(inode);135 if (err)136 return err;137 138 err = f2fs_convert_inline_inode(inode);139 if (err)140 return err;141 142 set_inode_flag(inode, FI_VERITY_IN_PROGRESS);143 return 0;144}145 146static int f2fs_end_enable_verity(struct file *filp, const void *desc,147 size_t desc_size, u64 merkle_tree_size)148{149 struct inode *inode = file_inode(filp);150 struct f2fs_sb_info *sbi = F2FS_I_SB(inode);151 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size;152 struct fsverity_descriptor_location dloc = {153 .version = cpu_to_le32(F2FS_VERIFY_VER),154 .size = cpu_to_le32(desc_size),155 .pos = cpu_to_le64(desc_pos),156 };157 int err = 0, err2 = 0;158 159 /*160 * If an error already occurred (which fs/verity/ signals by passing161 * desc == NULL), then only clean-up is needed.162 */163 if (desc == NULL)164 goto cleanup;165 166 /* Append the verity descriptor. */167 err = pagecache_write(inode, desc, desc_size, desc_pos);168 if (err)169 goto cleanup;170 171 /*172 * Write all pages (both data and verity metadata). Note that this must173 * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond174 * i_size won't be written properly. For crash consistency, this also175 * must happen before the verity inode flag gets persisted.176 */177 err = filemap_write_and_wait(inode->i_mapping);178 if (err)179 goto cleanup;180 181 /* Set the verity xattr. */182 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY,183 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc),184 NULL, XATTR_CREATE);185 if (err)186 goto cleanup;187 188 /* Finally, set the verity inode flag. */189 file_set_verity(inode);190 f2fs_set_inode_flags(inode);191 f2fs_mark_inode_dirty_sync(inode, true);192 193 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);194 return 0;195 196cleanup:197 /*198 * Verity failed to be enabled, so clean up by truncating any verity199 * metadata that was written beyond i_size (both from cache and from200 * disk) and clearing FI_VERITY_IN_PROGRESS.201 *202 * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection203 * from re-instantiating cached pages we are truncating (since unlike204 * normal file accesses, garbage collection isn't limited by i_size).205 */206 f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);207 truncate_inode_pages(inode->i_mapping, inode->i_size);208 err2 = f2fs_truncate(inode);209 if (err2) {210 f2fs_err(sbi, "Truncating verity metadata failed (errno=%d)",211 err2);212 set_sbi_flag(sbi, SBI_NEED_FSCK);213 }214 f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);215 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);216 return err ?: err2;217}218 219static int f2fs_get_verity_descriptor(struct inode *inode, void *buf,220 size_t buf_size)221{222 struct fsverity_descriptor_location dloc;223 int res;224 u32 size;225 u64 pos;226 227 /* Get the descriptor location */228 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY,229 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL);230 if (res < 0 && res != -ERANGE)231 return res;232 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(F2FS_VERIFY_VER)) {233 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format");234 return -EINVAL;235 }236 size = le32_to_cpu(dloc.size);237 pos = le64_to_cpu(dloc.pos);238 239 /* Get the descriptor */240 if (pos + size < pos ||241 pos + size > F2FS_BLK_TO_BYTES(max_file_blocks(inode)) ||242 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) {243 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr");244 f2fs_handle_error(F2FS_I_SB(inode),245 ERROR_CORRUPTED_VERITY_XATTR);246 return -EFSCORRUPTED;247 }248 if (buf_size) {249 if (size > buf_size)250 return -ERANGE;251 res = pagecache_read(inode, buf, size, pos);252 if (res)253 return res;254 }255 return size;256}257 258static struct page *f2fs_read_merkle_tree_page(struct inode *inode,259 pgoff_t index,260 unsigned long num_ra_pages)261{262 struct folio *folio;263 264 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT;265 266 folio = __filemap_get_folio(inode->i_mapping, index, FGP_ACCESSED, 0);267 if (IS_ERR(folio) || !folio_test_uptodate(folio)) {268 DEFINE_READAHEAD(ractl, NULL, NULL, inode->i_mapping, index);269 270 if (!IS_ERR(folio))271 folio_put(folio);272 else if (num_ra_pages > 1)273 page_cache_ra_unbounded(&ractl, num_ra_pages, 0);274 folio = read_mapping_folio(inode->i_mapping, index, NULL);275 if (IS_ERR(folio))276 return ERR_CAST(folio);277 }278 return folio_file_page(folio, index);279}280 281static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf,282 u64 pos, unsigned int size)283{284 pos += f2fs_verity_metadata_pos(inode);285 286 return pagecache_write(inode, buf, size, pos);287}288 289const struct fsverity_operations f2fs_verityops = {290 .begin_enable_verity = f2fs_begin_enable_verity,291 .end_enable_verity = f2fs_end_enable_verity,292 .get_verity_descriptor = f2fs_get_verity_descriptor,293 .read_merkle_tree_page = f2fs_read_merkle_tree_page,294 .write_merkle_tree_block = f2fs_write_merkle_tree_block,295};296