fs/f2fs/verity.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * fs/f2fs/verity.c: fs-verity support for f2fs
0004  *
0005  * Copyright 2019 Google LLC
0006  */
0007
0008 /*
0009  * Implementation of fsverity_operations for f2fs.
0010  *
0011  * Like ext4, f2fs stores the verity metadata (Merkle tree and
0012  * fsverity_descriptor) past the end of the file, starting at the first 64K
0013  * boundary beyond i_size.  This approach works because (a) verity files are
0014  * readonly, and (b) pages fully beyond i_size aren't visible to userspace but
0015  * can be read/written internally by f2fs with only some relatively small
0016  * changes to f2fs.  Extended attributes cannot be used because (a) f2fs limits
0017  * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be
0018  * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't
0019  * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is
0020  * because it contains hashes of the plaintext data.
0021  *
0022  * Using a 64K boundary rather than a 4K one keeps things ready for
0023  * architectures with 64K pages, and it doesn't necessarily waste space on-disk
0024  * since there can be a hole between i_size and the start of the Merkle tree.
0025  */
0026
0027 #include <linux/f2fs_fs.h>
0028
0029 #include "f2fs.h"
0030 #include "xattr.h"
0031
0032 #define F2FS_VERIFY_VER (1)
0033
0034 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode)
0035 {
0036     return round_up(inode->i_size, 65536);
0037 }
0038
0039 /*
0040  * Read some verity metadata from the inode.  __vfs_read() can't be used because
0041  * we need to read beyond i_size.
0042  */
0043 static int pagecache_read(struct inode *inode, void *buf, size_t count,
0044               loff_t pos)
0045 {
0046     while (count) {
0047         size_t n = min_t(size_t, count,
0048                  PAGE_SIZE - offset_in_page(pos));
0049         struct page *page;
0050         void *addr;
0051
0052         page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT,
0053                      NULL);
0054         if (IS_ERR(page))
0055             return PTR_ERR(page);
0056
0057         addr = kmap_atomic(page);
0058         memcpy(buf, addr + offset_in_page(pos), n);
0059         kunmap_atomic(addr);
0060
0061         put_page(page);
0062
0063         buf += n;
0064         pos += n;
0065         count -= n;
0066     }
0067     return 0;
0068 }
0069
0070 /*
0071  * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY.
0072  * kernel_write() can't be used because the file descriptor is readonly.
0073  */
0074 static int pagecache_write(struct inode *inode, const void *buf, size_t count,
0075                loff_t pos)
0076 {
0077     struct address_space *mapping = inode->i_mapping;
0078     const struct address_space_operations *aops = mapping->a_ops;
0079
0080     if (pos + count > inode->i_sb->s_maxbytes)
0081         return -EFBIG;
0082
0083     while (count) {
0084         size_t n = min_t(size_t, count,
0085                  PAGE_SIZE - offset_in_page(pos));
0086         struct page *page;
0087         void *fsdata;
0088         void *addr;
0089         int res;
0090
0091         res = aops->write_begin(NULL, mapping, pos, n, &page, &fsdata);
0092         if (res)
0093             return res;
0094
0095         addr = kmap_atomic(page);
0096         memcpy(addr + offset_in_page(pos), buf, n);
0097         kunmap_atomic(addr);
0098
0099         res = aops->write_end(NULL, mapping, pos, n, n, page, fsdata);
0100         if (res < 0)
0101             return res;
0102         if (res != n)
0103             return -EIO;
0104
0105         buf += n;
0106         pos += n;
0107         count -= n;
0108     }
0109     return 0;
0110 }
0111
0112 /*
0113  * Format of f2fs verity xattr.  This points to the location of the verity
0114  * descriptor within the file data rather than containing it directly because
0115  * the verity descriptor *must* be encrypted when f2fs encryption is used.  But,
0116  * f2fs encryption does not encrypt xattrs.
0117  */
0118 struct fsverity_descriptor_location {
0119     __le32 version;
0120     __le32 size;
0121     __le64 pos;
0122 };
0123
0124 static int f2fs_begin_enable_verity(struct file *filp)
0125 {
0126     struct inode *inode = file_inode(filp);
0127     int err;
0128
0129     if (f2fs_verity_in_progress(inode))
0130         return -EBUSY;
0131
0132     if (f2fs_is_atomic_file(inode))
0133         return -EOPNOTSUPP;
0134
0135     /*
0136      * Since the file was opened readonly, we have to initialize the quotas
0137      * here and not rely on ->open() doing it.  This must be done before
0138      * evicting the inline data.
0139      */
0140     err = f2fs_dquot_initialize(inode);
0141     if (err)
0142         return err;
0143
0144     err = f2fs_convert_inline_inode(inode);
0145     if (err)
0146         return err;
0147
0148     set_inode_flag(inode, FI_VERITY_IN_PROGRESS);
0149     return 0;
0150 }
0151
0152 static int f2fs_end_enable_verity(struct file *filp, const void *desc,
0153                   size_t desc_size, u64 merkle_tree_size)
0154 {
0155     struct inode *inode = file_inode(filp);
0156     struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
0157     u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size;
0158     struct fsverity_descriptor_location dloc = {
0159         .version = cpu_to_le32(F2FS_VERIFY_VER),
0160         .size = cpu_to_le32(desc_size),
0161         .pos = cpu_to_le64(desc_pos),
0162     };
0163     int err = 0, err2 = 0;
0164
0165     /*
0166      * If an error already occurred (which fs/verity/ signals by passing
0167      * desc == NULL), then only clean-up is needed.
0168      */
0169     if (desc == NULL)
0170         goto cleanup;
0171
0172     /* Append the verity descriptor. */
0173     err = pagecache_write(inode, desc, desc_size, desc_pos);
0174     if (err)
0175         goto cleanup;
0176
0177     /*
0178      * Write all pages (both data and verity metadata).  Note that this must
0179      * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond
0180      * i_size won't be written properly.  For crash consistency, this also
0181      * must happen before the verity inode flag gets persisted.
0182      */
0183     err = filemap_write_and_wait(inode->i_mapping);
0184     if (err)
0185         goto cleanup;
0186
0187     /* Set the verity xattr. */
0188     err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY,
0189                 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc),
0190                 NULL, XATTR_CREATE);
0191     if (err)
0192         goto cleanup;
0193
0194     /* Finally, set the verity inode flag. */
0195     file_set_verity(inode);
0196     f2fs_set_inode_flags(inode);
0197     f2fs_mark_inode_dirty_sync(inode, true);
0198
0199     clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);
0200     return 0;
0201
0202 cleanup:
0203     /*
0204      * Verity failed to be enabled, so clean up by truncating any verity
0205      * metadata that was written beyond i_size (both from cache and from
0206      * disk) and clearing FI_VERITY_IN_PROGRESS.
0207      *
0208      * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection
0209      * from re-instantiating cached pages we are truncating (since unlike
0210      * normal file accesses, garbage collection isn't limited by i_size).
0211      */
0212     f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
0213     truncate_inode_pages(inode->i_mapping, inode->i_size);
0214     err2 = f2fs_truncate(inode);
0215     if (err2) {
0216         f2fs_err(sbi, "Truncating verity metadata failed (errno=%d)",
0217              err2);
0218         set_sbi_flag(sbi, SBI_NEED_FSCK);
0219     }
0220     f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
0221     clear_inode_flag(inode, FI_VERITY_IN_PROGRESS);
0222     return err ?: err2;
0223 }
0224
0225 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf,
0226                       size_t buf_size)
0227 {
0228     struct fsverity_descriptor_location dloc;
0229     int res;
0230     u32 size;
0231     u64 pos;
0232
0233     /* Get the descriptor location */
0234     res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY,
0235                 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL);
0236     if (res < 0 && res != -ERANGE)
0237         return res;
0238     if (res != sizeof(dloc) || dloc.version != cpu_to_le32(F2FS_VERIFY_VER)) {
0239         f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format");
0240         return -EINVAL;
0241     }
0242     size = le32_to_cpu(dloc.size);
0243     pos = le64_to_cpu(dloc.pos);
0244
0245     /* Get the descriptor */
0246     if (pos + size < pos || pos + size > inode->i_sb->s_maxbytes ||
0247         pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) {
0248         f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr");
0249         return -EFSCORRUPTED;
0250     }
0251     if (buf_size) {
0252         if (size > buf_size)
0253             return -ERANGE;
0254         res = pagecache_read(inode, buf, size, pos);
0255         if (res)
0256             return res;
0257     }
0258     return size;
0259 }
0260
0261 static struct page *f2fs_read_merkle_tree_page(struct inode *inode,
0262                            pgoff_t index,
0263                            unsigned long num_ra_pages)
0264 {
0265     DEFINE_READAHEAD(ractl, NULL, NULL, inode->i_mapping, index);
0266     struct page *page;
0267
0268     index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT;
0269
0270     page = find_get_page_flags(inode->i_mapping, index, FGP_ACCESSED);
0271     if (!page || !PageUptodate(page)) {
0272         if (page)
0273             put_page(page);
0274         else if (num_ra_pages > 1)
0275             page_cache_ra_unbounded(&ractl, num_ra_pages, 0);
0276         page = read_mapping_page(inode->i_mapping, index, NULL);
0277     }
0278     return page;
0279 }
0280
0281 static int f2fs_write_merkle_tree_block(struct inode *inode, const void *buf,
0282                     u64 index, int log_blocksize)
0283 {
0284     loff_t pos = f2fs_verity_metadata_pos(inode) + (index << log_blocksize);
0285
0286     return pagecache_write(inode, buf, 1 << log_blocksize, pos);
0287 }
0288
0289 const struct fsverity_operations f2fs_verityops = {
0290     .begin_enable_verity    = f2fs_begin_enable_verity,
0291     .end_enable_verity  = f2fs_end_enable_verity,
0292     .get_verity_descriptor  = f2fs_get_verity_descriptor,
0293     .read_merkle_tree_page  = f2fs_read_merkle_tree_page,
0294     .write_merkle_tree_block = f2fs_write_merkle_tree_block,
0295 };