1 // SPDX-License-Identifier: GPL-2.0
2
3 #include <linux/init.h>
4 #include <linux/fs.h>
5 #include <linux/slab.h>
6 #include <linux/rwsem.h>
7 #include <linux/xattr.h>
8 #include <linux/security.h>
9 #include <linux/posix_acl_xattr.h>
10 #include <linux/iversion.h>
11 #include <linux/fsverity.h>
12 #include <linux/sched/mm.h>
13 #include "messages.h"
14 #include "ctree.h"
15 #include "btrfs_inode.h"
16 #include "transaction.h"
17 #include "locking.h"
18 #include "fs.h"
19 #include "accessors.h"
20 #include "ioctl.h"
21 #include "verity.h"
22 #include "orphan.h"
23
24 /*
25 * Implementation of the interface defined in struct fsverity_operations.
26 *
27 * The main question is how and where to store the verity descriptor and the
28 * Merkle tree. We store both in dedicated btree items in the filesystem tree,
29 * together with the rest of the inode metadata. This means we'll need to do
30 * extra work to encrypt them once encryption is supported in btrfs, but btrfs
31 * has a lot of careful code around i_size and it seems better to make a new key
32 * type than try and adjust all of our expectations for i_size.
33 *
34 * Note that this differs from the implementation in ext4 and f2fs, where
35 * this data is stored as if it were in the file, but past EOF. However, btrfs
36 * does not have a widespread mechanism for caching opaque metadata pages, so we
37 * do pretend that the Merkle tree pages themselves are past EOF for the
38 * purposes of caching them (as opposed to creating a virtual inode).
39 *
40 * fs verity items are stored under two different key types on disk.
41 * The descriptor items:
42 * [ inode objectid, BTRFS_VERITY_DESC_ITEM_KEY, offset ]
43 *
44 * At offset 0, we store a btrfs_verity_descriptor_item which tracks the
45 * size of the descriptor item and some extra data for encryption.
46 * Starting at offset 1, these hold the generic fs verity descriptor.
47 * The latter are opaque to btrfs, we just read and write them as a blob for
48 * the higher level verity code. The most common descriptor size is 256 bytes.
49 *
50 * The merkle tree items:
51 * [ inode objectid, BTRFS_VERITY_MERKLE_ITEM_KEY, offset ]
52 *
53 * These also start at offset 0, and correspond to the merkle tree bytes.
54 * So when fsverity asks for page 0 of the merkle tree, we pull up one page
55 * starting at offset 0 for this key type. These are also opaque to btrfs,
56 * we're blindly storing whatever fsverity sends down.
57 *
58 * Another important consideration is the fact that the Merkle tree data scales
59 * linearly with the size of the file (with 4K pages/blocks and SHA-256, it's
60 * ~1/127th the size) so for large files, writing the tree can be a lengthy
61 * operation. For that reason, we guard the whole enable verity operation
62 * (between begin_enable_verity and end_enable_verity) with an orphan item.
63 * Again, because the data can be pretty large, it's quite possible that we
64 * could run out of space writing it, so we try our best to handle errors by
65 * stopping and rolling back rather than aborting the victim transaction.
66 */
67
68 #define MERKLE_START_ALIGN 65536
69
70 /*
71 * Compute the logical file offset where we cache the Merkle tree.
72 *
73 * @inode: inode of the verity file
74 *
75 * For the purposes of caching the Merkle tree pages, as required by
76 * fs-verity, it is convenient to do size computations in terms of a file
77 * offset, rather than in terms of page indices.
78 *
79 * Use 64K to be sure it's past the last page in the file, even with 64K pages.
80 * That rounding operation itself can overflow loff_t, so we do it in u64 and
81 * check.
82 *
83 * Returns the file offset on success, negative error code on failure.
84 */
merkle_file_pos(const struct inode * inode)85 static loff_t merkle_file_pos(const struct inode *inode)
86 {
87 u64 sz = inode->i_size;
88 u64 rounded = round_up(sz, MERKLE_START_ALIGN);
89
90 if (rounded > inode->i_sb->s_maxbytes)
91 return -EFBIG;
92
93 return rounded;
94 }
95
96 /*
97 * Drop all the items for this inode with this key_type.
98 *
99 * @inode: inode to drop items for
100 * @key_type: type of items to drop (BTRFS_VERITY_DESC_ITEM or
101 * BTRFS_VERITY_MERKLE_ITEM)
102 *
103 * Before doing a verity enable we cleanup any existing verity items.
104 * This is also used to clean up if a verity enable failed half way through.
105 *
106 * Returns number of dropped items on success, negative error code on failure.
107 */
drop_verity_items(struct btrfs_inode * inode,u8 key_type)108 static int drop_verity_items(struct btrfs_inode *inode, u8 key_type)
109 {
110 struct btrfs_trans_handle *trans;
111 struct btrfs_root *root = inode->root;
112 BTRFS_PATH_AUTO_FREE(path);
113 struct btrfs_key key;
114 int count = 0;
115 int ret;
116
117 path = btrfs_alloc_path();
118 if (!path)
119 return -ENOMEM;
120
121 while (1) {
122 /* 1 for the item being dropped */
123 trans = btrfs_start_transaction(root, 1);
124 if (IS_ERR(trans))
125 return PTR_ERR(trans);
126
127 /*
128 * Walk backwards through all the items until we find one that
129 * isn't from our key type or objectid
130 */
131 key.objectid = btrfs_ino(inode);
132 key.type = key_type;
133 key.offset = (u64)-1;
134
135 ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
136 if (ret > 0) {
137 ret = 0;
138 /* No more keys of this type, we're done */
139 if (path->slots[0] == 0)
140 break;
141 path->slots[0]--;
142 } else if (ret < 0) {
143 btrfs_end_transaction(trans);
144 return ret;
145 }
146
147 btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
148
149 /* No more keys of this type, we're done */
150 if (key.objectid != btrfs_ino(inode) || key.type != key_type)
151 break;
152
153 /*
154 * This shouldn't be a performance sensitive function because
155 * it's not used as part of truncate. If it ever becomes
156 * perf sensitive, change this to walk forward and bulk delete
157 * items
158 */
159 ret = btrfs_del_items(trans, root, path, path->slots[0], 1);
160 if (ret) {
161 btrfs_end_transaction(trans);
162 return ret;
163 }
164 count++;
165 btrfs_release_path(path);
166 btrfs_end_transaction(trans);
167 }
168 btrfs_end_transaction(trans);
169 return count;
170 }
171
172 /*
173 * Drop all verity items
174 *
175 * @inode: inode to drop verity items for
176 *
177 * In most contexts where we are dropping verity items, we want to do it for all
178 * the types of verity items, not a particular one.
179 *
180 * Returns: 0 on success, negative error code on failure.
181 */
btrfs_drop_verity_items(struct btrfs_inode * inode)182 int btrfs_drop_verity_items(struct btrfs_inode *inode)
183 {
184 int ret;
185
186 ret = drop_verity_items(inode, BTRFS_VERITY_DESC_ITEM_KEY);
187 if (ret < 0)
188 return ret;
189 ret = drop_verity_items(inode, BTRFS_VERITY_MERKLE_ITEM_KEY);
190 if (ret < 0)
191 return ret;
192
193 return 0;
194 }
195
196 /*
197 * Insert and write inode items with a given key type and offset.
198 *
199 * @inode: inode to insert for
200 * @key_type: key type to insert
201 * @offset: item offset to insert at
202 * @src: source data to write
203 * @len: length of source data to write
204 *
205 * Write len bytes from src into items of up to 2K length.
206 * The inserted items will have key (ino, key_type, offset + off) where off is
207 * consecutively increasing from 0 up to the last item ending at offset + len.
208 *
209 * Returns 0 on success and a negative error code on failure.
210 */
write_key_bytes(struct btrfs_inode * inode,u8 key_type,u64 offset,const char * src,u64 len)211 static int write_key_bytes(struct btrfs_inode *inode, u8 key_type, u64 offset,
212 const char *src, u64 len)
213 {
214 struct btrfs_trans_handle *trans;
215 BTRFS_PATH_AUTO_FREE(path);
216 struct btrfs_root *root = inode->root;
217 struct extent_buffer *leaf;
218 struct btrfs_key key;
219 unsigned long copy_bytes;
220 unsigned long src_offset = 0;
221 void *data;
222 int ret = 0;
223
224 path = btrfs_alloc_path();
225 if (!path)
226 return -ENOMEM;
227
228 while (len > 0) {
229 /* 1 for the new item being inserted */
230 trans = btrfs_start_transaction(root, 1);
231 if (IS_ERR(trans))
232 return PTR_ERR(trans);
233
234 key.objectid = btrfs_ino(inode);
235 key.type = key_type;
236 key.offset = offset;
237
238 /*
239 * Insert 2K at a time mostly to be friendly for smaller leaf
240 * size filesystems
241 */
242 copy_bytes = min_t(u64, len, 2048);
243
244 ret = btrfs_insert_empty_item(trans, root, path, &key, copy_bytes);
245 if (ret) {
246 btrfs_end_transaction(trans);
247 break;
248 }
249
250 leaf = path->nodes[0];
251
252 data = btrfs_item_ptr(leaf, path->slots[0], void);
253 write_extent_buffer(leaf, src + src_offset,
254 (unsigned long)data, copy_bytes);
255 offset += copy_bytes;
256 src_offset += copy_bytes;
257 len -= copy_bytes;
258
259 btrfs_release_path(path);
260 btrfs_end_transaction(trans);
261 }
262
263 return ret;
264 }
265
266 /*
267 * Read inode items of the given key type and offset from the btree.
268 *
269 * @inode: inode to read items of
270 * @key_type: key type to read
271 * @offset: item offset to read from
272 * @dest: Buffer to read into. This parameter has slightly tricky
273 * semantics. If it is NULL, the function will not do any copying
274 * and will just return the size of all the items up to len bytes.
275 * If dest_page is passed, then the function will kmap_local the
276 * page and ignore dest, but it must still be non-NULL to avoid the
277 * counting-only behavior.
278 * @len: length in bytes to read
279 * @dest_folio: copy into this folio instead of the dest buffer
280 *
281 * Helper function to read items from the btree. This returns the number of
282 * bytes read or < 0 for errors. We can return short reads if the items don't
283 * exist on disk or aren't big enough to fill the desired length. Supports
284 * reading into a provided buffer (dest) or into the page cache
285 *
286 * Returns number of bytes read or a negative error code on failure.
287 */
read_key_bytes(struct btrfs_inode * inode,u8 key_type,u64 offset,char * dest,u64 len,struct folio * dest_folio)288 static int read_key_bytes(struct btrfs_inode *inode, u8 key_type, u64 offset,
289 char *dest, u64 len, struct folio *dest_folio)
290 {
291 BTRFS_PATH_AUTO_FREE(path);
292 struct btrfs_root *root = inode->root;
293 struct extent_buffer *leaf;
294 struct btrfs_key key;
295 u64 item_end;
296 u64 copy_end;
297 int copied = 0;
298 u32 copy_offset;
299 unsigned long copy_bytes;
300 unsigned long dest_offset = 0;
301 void *data;
302 char *kaddr = dest;
303 int ret;
304
305 path = btrfs_alloc_path();
306 if (!path)
307 return -ENOMEM;
308
309 if (dest_folio)
310 path->reada = READA_FORWARD;
311
312 key.objectid = btrfs_ino(inode);
313 key.type = key_type;
314 key.offset = offset;
315
316 ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
317 if (ret < 0) {
318 goto out;
319 } else if (ret > 0) {
320 ret = 0;
321 if (path->slots[0] == 0)
322 goto out;
323 path->slots[0]--;
324 }
325
326 while (len > 0) {
327 leaf = path->nodes[0];
328 btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
329
330 if (key.objectid != btrfs_ino(inode) || key.type != key_type)
331 break;
332
333 item_end = btrfs_item_size(leaf, path->slots[0]) + key.offset;
334
335 if (copied > 0) {
336 /*
337 * Once we've copied something, we want all of the items
338 * to be sequential
339 */
340 if (key.offset != offset)
341 break;
342 } else {
343 /*
344 * Our initial offset might be in the middle of an
345 * item. Make sure it all makes sense.
346 */
347 if (key.offset > offset)
348 break;
349 if (item_end <= offset)
350 break;
351 }
352
353 /* desc = NULL to just sum all the item lengths */
354 if (!dest)
355 copy_end = item_end;
356 else
357 copy_end = min(offset + len, item_end);
358
359 /* Number of bytes in this item we want to copy */
360 copy_bytes = copy_end - offset;
361
362 /* Offset from the start of item for copying */
363 copy_offset = offset - key.offset;
364
365 if (dest) {
366 if (dest_folio)
367 kaddr = kmap_local_folio(dest_folio, 0);
368
369 data = btrfs_item_ptr(leaf, path->slots[0], void);
370 read_extent_buffer(leaf, kaddr + dest_offset,
371 (unsigned long)data + copy_offset,
372 copy_bytes);
373
374 if (dest_folio)
375 kunmap_local(kaddr);
376 }
377
378 offset += copy_bytes;
379 dest_offset += copy_bytes;
380 len -= copy_bytes;
381 copied += copy_bytes;
382
383 path->slots[0]++;
384 if (path->slots[0] >= btrfs_header_nritems(path->nodes[0])) {
385 /*
386 * We've reached the last slot in this leaf and we need
387 * to go to the next leaf.
388 */
389 ret = btrfs_next_leaf(root, path);
390 if (ret < 0) {
391 break;
392 } else if (ret > 0) {
393 ret = 0;
394 break;
395 }
396 }
397 }
398 out:
399 if (!ret)
400 ret = copied;
401 return ret;
402 }
403
404 /*
405 * Delete an fsverity orphan
406 *
407 * @trans: transaction to do the delete in
408 * @inode: inode to orphan
409 *
410 * Capture verity orphan specific logic that is repeated in the couple places
411 * we delete verity orphans. Specifically, handling ENOENT and ignoring inodes
412 * with 0 links.
413 *
414 * Returns zero on success or a negative error code on failure.
415 */
del_orphan(struct btrfs_trans_handle * trans,struct btrfs_inode * inode)416 static int del_orphan(struct btrfs_trans_handle *trans, struct btrfs_inode *inode)
417 {
418 struct btrfs_root *root = inode->root;
419 int ret;
420
421 /*
422 * If the inode has no links, it is either already unlinked, or was
423 * created with O_TMPFILE. In either case, it should have an orphan from
424 * that other operation. Rather than reference count the orphans, we
425 * simply ignore them here, because we only invoke the verity path in
426 * the orphan logic when i_nlink is 1.
427 */
428 if (!inode->vfs_inode.i_nlink)
429 return 0;
430
431 ret = btrfs_del_orphan_item(trans, root, btrfs_ino(inode));
432 if (ret == -ENOENT)
433 ret = 0;
434 return ret;
435 }
436
437 /*
438 * Rollback in-progress verity if we encounter an error.
439 *
440 * @inode: inode verity had an error for
441 *
442 * We try to handle recoverable errors while enabling verity by rolling it back
443 * and just failing the operation, rather than having an fs level error no
444 * matter what. However, any error in rollback is unrecoverable.
445 *
446 * Returns 0 on success, negative error code on failure.
447 */
rollback_verity(struct btrfs_inode * inode)448 static int rollback_verity(struct btrfs_inode *inode)
449 {
450 struct btrfs_trans_handle *trans = NULL;
451 struct btrfs_root *root = inode->root;
452 int ret;
453
454 btrfs_assert_inode_locked(inode);
455 truncate_inode_pages(inode->vfs_inode.i_mapping, inode->vfs_inode.i_size);
456 clear_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
457 ret = btrfs_drop_verity_items(inode);
458 if (ret) {
459 btrfs_handle_fs_error(root->fs_info, ret,
460 "failed to drop verity items in rollback %llu",
461 (u64)inode->vfs_inode.i_ino);
462 goto out;
463 }
464
465 /*
466 * 1 for updating the inode flag
467 * 1 for deleting the orphan
468 */
469 trans = btrfs_start_transaction(root, 2);
470 if (IS_ERR(trans)) {
471 ret = PTR_ERR(trans);
472 trans = NULL;
473 btrfs_handle_fs_error(root->fs_info, ret,
474 "failed to start transaction in verity rollback %llu",
475 (u64)inode->vfs_inode.i_ino);
476 goto out;
477 }
478 inode->ro_flags &= ~BTRFS_INODE_RO_VERITY;
479 btrfs_sync_inode_flags_to_i_flags(inode);
480 ret = btrfs_update_inode(trans, inode);
481 if (unlikely(ret)) {
482 btrfs_abort_transaction(trans, ret);
483 goto out;
484 }
485 ret = del_orphan(trans, inode);
486 if (unlikely(ret)) {
487 btrfs_abort_transaction(trans, ret);
488 goto out;
489 }
490 out:
491 if (trans)
492 btrfs_end_transaction(trans);
493 return ret;
494 }
495
496 /*
497 * Finalize making the file a valid verity file
498 *
499 * @inode: inode to be marked as verity
500 * @desc: contents of the verity descriptor to write (not NULL)
501 * @desc_size: size of the verity descriptor
502 *
503 * Do the actual work of finalizing verity after successfully writing the Merkle
504 * tree:
505 *
506 * - write out the descriptor items
507 * - mark the inode with the verity flag
508 * - delete the orphan item
509 * - mark the ro compat bit
510 * - clear the in progress bit
511 *
512 * Returns 0 on success, negative error code on failure.
513 */
finish_verity(struct btrfs_inode * inode,const void * desc,size_t desc_size)514 static int finish_verity(struct btrfs_inode *inode, const void *desc,
515 size_t desc_size)
516 {
517 struct btrfs_trans_handle *trans = NULL;
518 struct btrfs_root *root = inode->root;
519 struct btrfs_verity_descriptor_item item;
520 int ret;
521
522 /* Write out the descriptor item */
523 memset(&item, 0, sizeof(item));
524 btrfs_set_stack_verity_descriptor_size(&item, desc_size);
525 ret = write_key_bytes(inode, BTRFS_VERITY_DESC_ITEM_KEY, 0,
526 (const char *)&item, sizeof(item));
527 if (ret)
528 goto out;
529
530 /* Write out the descriptor itself */
531 ret = write_key_bytes(inode, BTRFS_VERITY_DESC_ITEM_KEY, 1,
532 desc, desc_size);
533 if (ret)
534 goto out;
535
536 /*
537 * 1 for updating the inode flag
538 * 1 for deleting the orphan
539 */
540 trans = btrfs_start_transaction(root, 2);
541 if (IS_ERR(trans)) {
542 ret = PTR_ERR(trans);
543 goto out;
544 }
545 inode->ro_flags |= BTRFS_INODE_RO_VERITY;
546 btrfs_sync_inode_flags_to_i_flags(inode);
547 ret = btrfs_update_inode(trans, inode);
548 if (ret)
549 goto end_trans;
550 ret = del_orphan(trans, inode);
551 if (ret)
552 goto end_trans;
553 clear_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
554 btrfs_set_fs_compat_ro(root->fs_info, VERITY);
555 end_trans:
556 btrfs_end_transaction(trans);
557 out:
558 return ret;
559
560 }
561
562 /*
563 * fsverity op that begins enabling verity.
564 *
565 * @filp: file to enable verity on
566 *
567 * Begin enabling fsverity for the file. We drop any existing verity items, add
568 * an orphan and set the in progress bit.
569 *
570 * Returns 0 on success, negative error code on failure.
571 */
btrfs_begin_enable_verity(struct file * filp)572 static int btrfs_begin_enable_verity(struct file *filp)
573 {
574 struct btrfs_inode *inode = BTRFS_I(file_inode(filp));
575 struct btrfs_root *root = inode->root;
576 struct btrfs_trans_handle *trans;
577 int ret;
578
579 btrfs_assert_inode_locked(inode);
580
581 if (IS_ENCRYPTED(&inode->vfs_inode))
582 return -EOPNOTSUPP;
583
584 if (test_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags))
585 return -EBUSY;
586
587 /*
588 * This should almost never do anything, but theoretically, it's
589 * possible that we failed to enable verity on a file, then were
590 * interrupted or failed while rolling back, failed to cleanup the
591 * orphan, and finally attempt to enable verity again.
592 */
593 ret = btrfs_drop_verity_items(inode);
594 if (ret)
595 return ret;
596
597 /* 1 for the orphan item */
598 trans = btrfs_start_transaction(root, 1);
599 if (IS_ERR(trans))
600 return PTR_ERR(trans);
601
602 ret = btrfs_orphan_add(trans, inode);
603 if (!ret)
604 set_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
605 btrfs_end_transaction(trans);
606
607 return 0;
608 }
609
610 /*
611 * fsverity op that ends enabling verity.
612 *
613 * @filp: file we are finishing enabling verity on
614 * @desc: verity descriptor to write out (NULL in error conditions)
615 * @desc_size: size of the verity descriptor (variable with signatures)
616 * @merkle_tree_size: size of the merkle tree in bytes
617 *
618 * If desc is null, then VFS is signaling an error occurred during verity
619 * enable, and we should try to rollback. Otherwise, attempt to finish verity.
620 *
621 * Returns 0 on success, negative error code on error.
622 */
btrfs_end_enable_verity(struct file * filp,const void * desc,size_t desc_size,u64 merkle_tree_size)623 static int btrfs_end_enable_verity(struct file *filp, const void *desc,
624 size_t desc_size, u64 merkle_tree_size)
625 {
626 struct btrfs_inode *inode = BTRFS_I(file_inode(filp));
627 int ret = 0;
628 int rollback_ret;
629
630 btrfs_assert_inode_locked(inode);
631
632 if (desc == NULL)
633 goto rollback;
634
635 ret = finish_verity(inode, desc, desc_size);
636 if (ret)
637 goto rollback;
638 return ret;
639
640 rollback:
641 rollback_ret = rollback_verity(inode);
642 if (rollback_ret)
643 btrfs_err(inode->root->fs_info,
644 "failed to rollback verity items: %d", rollback_ret);
645 return ret;
646 }
647
648 /*
649 * fsverity op that gets the struct fsverity_descriptor.
650 *
651 * @inode: inode to get the descriptor of
652 * @buf: output buffer for the descriptor contents
653 * @buf_size: size of the output buffer. 0 to query the size
654 *
655 * fsverity does a two pass setup for reading the descriptor, in the first pass
656 * it calls with buf_size = 0 to query the size of the descriptor, and then in
657 * the second pass it actually reads the descriptor off disk.
658 *
659 * Returns the size on success or a negative error code on failure.
660 */
btrfs_get_verity_descriptor(struct inode * inode,void * buf,size_t buf_size)661 int btrfs_get_verity_descriptor(struct inode *inode, void *buf, size_t buf_size)
662 {
663 u64 true_size;
664 int ret = 0;
665 struct btrfs_verity_descriptor_item item;
666
667 memset(&item, 0, sizeof(item));
668 ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_DESC_ITEM_KEY, 0,
669 (char *)&item, sizeof(item), NULL);
670 if (ret < 0)
671 return ret;
672
673 if (unlikely(item.reserved[0] != 0 || item.reserved[1] != 0))
674 return -EUCLEAN;
675
676 true_size = btrfs_stack_verity_descriptor_size(&item);
677 if (unlikely(true_size > INT_MAX))
678 return -EUCLEAN;
679
680 if (buf_size == 0)
681 return true_size;
682 if (buf_size < true_size)
683 return -ERANGE;
684
685 ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_DESC_ITEM_KEY, 1,
686 buf, buf_size, NULL);
687 if (ret < 0)
688 return ret;
689 if (ret != true_size)
690 return -EIO;
691
692 return true_size;
693 }
694
695 /*
696 * fsverity op that reads and caches a merkle tree page.
697 *
698 * @inode: inode to read a merkle tree page for
699 * @index: page index relative to the start of the merkle tree
700 * @num_ra_pages: number of pages to readahead. Optional, we ignore it
701 *
702 * The Merkle tree is stored in the filesystem btree, but its pages are cached
703 * with a logical position past EOF in the inode's mapping.
704 *
705 * Returns the page we read, or an ERR_PTR on error.
706 */
btrfs_read_merkle_tree_page(struct inode * inode,pgoff_t index,unsigned long num_ra_pages)707 static struct page *btrfs_read_merkle_tree_page(struct inode *inode,
708 pgoff_t index,
709 unsigned long num_ra_pages)
710 {
711 struct folio *folio;
712 u64 off = (u64)index << PAGE_SHIFT;
713 loff_t merkle_pos = merkle_file_pos(inode);
714 int ret;
715
716 if (merkle_pos < 0)
717 return ERR_PTR(merkle_pos);
718 if (merkle_pos > inode->i_sb->s_maxbytes - off - PAGE_SIZE)
719 return ERR_PTR(-EFBIG);
720 index += merkle_pos >> PAGE_SHIFT;
721 again:
722 folio = __filemap_get_folio(inode->i_mapping, index, FGP_ACCESSED, 0);
723 if (!IS_ERR(folio)) {
724 if (folio_test_uptodate(folio))
725 goto out;
726
727 folio_lock(folio);
728 /* If it's not uptodate after we have the lock, we got a read error. */
729 if (!folio_test_uptodate(folio)) {
730 folio_unlock(folio);
731 folio_put(folio);
732 return ERR_PTR(-EIO);
733 }
734 folio_unlock(folio);
735 goto out;
736 }
737
738 folio = filemap_alloc_folio(mapping_gfp_constraint(inode->i_mapping, ~__GFP_FS),
739 0, NULL);
740 if (!folio)
741 return ERR_PTR(-ENOMEM);
742
743 ret = filemap_add_folio(inode->i_mapping, folio, index, GFP_NOFS);
744 if (ret) {
745 folio_put(folio);
746 /* Did someone else insert a folio here? */
747 if (ret == -EEXIST)
748 goto again;
749 return ERR_PTR(ret);
750 }
751
752 /*
753 * Merkle item keys are indexed from byte 0 in the merkle tree.
754 * They have the form:
755 *
756 * [ inode objectid, BTRFS_MERKLE_ITEM_KEY, offset in bytes ]
757 */
758 ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY, off,
759 folio_address(folio), PAGE_SIZE, folio);
760 if (ret < 0) {
761 folio_put(folio);
762 return ERR_PTR(ret);
763 }
764 if (ret < PAGE_SIZE)
765 folio_zero_segment(folio, ret, PAGE_SIZE);
766
767 folio_mark_uptodate(folio);
768 folio_unlock(folio);
769
770 out:
771 return folio_file_page(folio, index);
772 }
773
774 /*
775 * fsverity op that writes a Merkle tree block into the btree.
776 *
777 * @inode: inode to write a Merkle tree block for
778 * @buf: Merkle tree block to write
779 * @pos: the position of the block in the Merkle tree (in bytes)
780 * @size: the Merkle tree block size (in bytes)
781 *
782 * Returns 0 on success or negative error code on failure
783 */
btrfs_write_merkle_tree_block(struct inode * inode,const void * buf,u64 pos,unsigned int size)784 static int btrfs_write_merkle_tree_block(struct inode *inode, const void *buf,
785 u64 pos, unsigned int size)
786 {
787 loff_t merkle_pos = merkle_file_pos(inode);
788
789 if (merkle_pos < 0)
790 return merkle_pos;
791 if (merkle_pos > inode->i_sb->s_maxbytes - pos - size)
792 return -EFBIG;
793
794 return write_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY,
795 pos, buf, size);
796 }
797
798 const struct fsverity_operations btrfs_verityops = {
799 .inode_info_offs = (int)offsetof(struct btrfs_inode, i_verity_info) -
800 (int)offsetof(struct btrfs_inode, vfs_inode),
801 .begin_enable_verity = btrfs_begin_enable_verity,
802 .end_enable_verity = btrfs_end_enable_verity,
803 .get_verity_descriptor = btrfs_get_verity_descriptor,
804 .read_merkle_tree_page = btrfs_read_merkle_tree_page,
805 .write_merkle_tree_block = btrfs_write_merkle_tree_block,
806 };
807