114605409SBoris Burkov // SPDX-License-Identifier: GPL-2.0
214605409SBoris Burkov
314605409SBoris Burkov #include <linux/init.h>
414605409SBoris Burkov #include <linux/fs.h>
514605409SBoris Burkov #include <linux/slab.h>
614605409SBoris Burkov #include <linux/rwsem.h>
714605409SBoris Burkov #include <linux/xattr.h>
814605409SBoris Burkov #include <linux/security.h>
914605409SBoris Burkov #include <linux/posix_acl_xattr.h>
1014605409SBoris Burkov #include <linux/iversion.h>
1114605409SBoris Burkov #include <linux/fsverity.h>
1214605409SBoris Burkov #include <linux/sched/mm.h>
139b569ea0SJosef Bacik #include "messages.h"
1414605409SBoris Burkov #include "ctree.h"
1514605409SBoris Burkov #include "btrfs_inode.h"
1614605409SBoris Burkov #include "transaction.h"
1714605409SBoris Burkov #include "locking.h"
18c7f13d42SJosef Bacik #include "fs.h"
1907e81dc9SJosef Bacik #include "accessors.h"
207572dec8SJosef Bacik #include "ioctl.h"
215c11adccSJosef Bacik #include "verity.h"
22aa5d3003SJosef Bacik #include "orphan.h"
2314605409SBoris Burkov
2414605409SBoris Burkov /*
2514605409SBoris Burkov * Implementation of the interface defined in struct fsverity_operations.
2614605409SBoris Burkov *
2714605409SBoris Burkov * The main question is how and where to store the verity descriptor and the
2814605409SBoris Burkov * Merkle tree. We store both in dedicated btree items in the filesystem tree,
2914605409SBoris Burkov * together with the rest of the inode metadata. This means we'll need to do
3014605409SBoris Burkov * extra work to encrypt them once encryption is supported in btrfs, but btrfs
3114605409SBoris Burkov * has a lot of careful code around i_size and it seems better to make a new key
3214605409SBoris Burkov * type than try and adjust all of our expectations for i_size.
3314605409SBoris Burkov *
3414605409SBoris Burkov * Note that this differs from the implementation in ext4 and f2fs, where
3514605409SBoris Burkov * this data is stored as if it were in the file, but past EOF. However, btrfs
3614605409SBoris Burkov * does not have a widespread mechanism for caching opaque metadata pages, so we
3714605409SBoris Burkov * do pretend that the Merkle tree pages themselves are past EOF for the
3814605409SBoris Burkov * purposes of caching them (as opposed to creating a virtual inode).
3914605409SBoris Burkov *
4014605409SBoris Burkov * fs verity items are stored under two different key types on disk.
4114605409SBoris Burkov * The descriptor items:
4214605409SBoris Burkov * [ inode objectid, BTRFS_VERITY_DESC_ITEM_KEY, offset ]
4314605409SBoris Burkov *
4414605409SBoris Burkov * At offset 0, we store a btrfs_verity_descriptor_item which tracks the
4514605409SBoris Burkov * size of the descriptor item and some extra data for encryption.
4614605409SBoris Burkov * Starting at offset 1, these hold the generic fs verity descriptor.
4714605409SBoris Burkov * The latter are opaque to btrfs, we just read and write them as a blob for
4814605409SBoris Burkov * the higher level verity code. The most common descriptor size is 256 bytes.
4914605409SBoris Burkov *
5014605409SBoris Burkov * The merkle tree items:
5114605409SBoris Burkov * [ inode objectid, BTRFS_VERITY_MERKLE_ITEM_KEY, offset ]
5214605409SBoris Burkov *
5314605409SBoris Burkov * These also start at offset 0, and correspond to the merkle tree bytes.
5414605409SBoris Burkov * So when fsverity asks for page 0 of the merkle tree, we pull up one page
5514605409SBoris Burkov * starting at offset 0 for this key type. These are also opaque to btrfs,
5614605409SBoris Burkov * we're blindly storing whatever fsverity sends down.
5770524253SBoris Burkov *
5870524253SBoris Burkov * Another important consideration is the fact that the Merkle tree data scales
5970524253SBoris Burkov * linearly with the size of the file (with 4K pages/blocks and SHA-256, it's
6070524253SBoris Burkov * ~1/127th the size) so for large files, writing the tree can be a lengthy
6170524253SBoris Burkov * operation. For that reason, we guard the whole enable verity operation
6270524253SBoris Burkov * (between begin_enable_verity and end_enable_verity) with an orphan item.
6370524253SBoris Burkov * Again, because the data can be pretty large, it's quite possible that we
6470524253SBoris Burkov * could run out of space writing it, so we try our best to handle errors by
6570524253SBoris Burkov * stopping and rolling back rather than aborting the victim transaction.
6614605409SBoris Burkov */
6714605409SBoris Burkov
6814605409SBoris Burkov #define MERKLE_START_ALIGN 65536
6914605409SBoris Burkov
7014605409SBoris Burkov /*
7114605409SBoris Burkov * Compute the logical file offset where we cache the Merkle tree.
7214605409SBoris Burkov *
7314605409SBoris Burkov * @inode: inode of the verity file
7414605409SBoris Burkov *
7514605409SBoris Burkov * For the purposes of caching the Merkle tree pages, as required by
7614605409SBoris Burkov * fs-verity, it is convenient to do size computations in terms of a file
7714605409SBoris Burkov * offset, rather than in terms of page indices.
7814605409SBoris Burkov *
7914605409SBoris Burkov * Use 64K to be sure it's past the last page in the file, even with 64K pages.
8014605409SBoris Burkov * That rounding operation itself can overflow loff_t, so we do it in u64 and
8114605409SBoris Burkov * check.
8214605409SBoris Burkov *
8314605409SBoris Burkov * Returns the file offset on success, negative error code on failure.
8414605409SBoris Burkov */
merkle_file_pos(const struct inode * inode)8514605409SBoris Burkov static loff_t merkle_file_pos(const struct inode *inode)
8614605409SBoris Burkov {
8714605409SBoris Burkov u64 sz = inode->i_size;
8814605409SBoris Burkov u64 rounded = round_up(sz, MERKLE_START_ALIGN);
8914605409SBoris Burkov
9014605409SBoris Burkov if (rounded > inode->i_sb->s_maxbytes)
9114605409SBoris Burkov return -EFBIG;
9214605409SBoris Burkov
9314605409SBoris Burkov return rounded;
9414605409SBoris Burkov }
9514605409SBoris Burkov
9614605409SBoris Burkov /*
9714605409SBoris Burkov * Drop all the items for this inode with this key_type.
9814605409SBoris Burkov *
9914605409SBoris Burkov * @inode: inode to drop items for
10014605409SBoris Burkov * @key_type: type of items to drop (BTRFS_VERITY_DESC_ITEM or
10114605409SBoris Burkov * BTRFS_VERITY_MERKLE_ITEM)
10214605409SBoris Burkov *
10314605409SBoris Burkov * Before doing a verity enable we cleanup any existing verity items.
10414605409SBoris Burkov * This is also used to clean up if a verity enable failed half way through.
10514605409SBoris Burkov *
10614605409SBoris Burkov * Returns number of dropped items on success, negative error code on failure.
10714605409SBoris Burkov */
drop_verity_items(struct btrfs_inode * inode,u8 key_type)10814605409SBoris Burkov static int drop_verity_items(struct btrfs_inode *inode, u8 key_type)
10914605409SBoris Burkov {
11014605409SBoris Burkov struct btrfs_trans_handle *trans;
11114605409SBoris Burkov struct btrfs_root *root = inode->root;
11214605409SBoris Burkov struct btrfs_path *path;
11314605409SBoris Burkov struct btrfs_key key;
11414605409SBoris Burkov int count = 0;
11514605409SBoris Burkov int ret;
11614605409SBoris Burkov
11714605409SBoris Burkov path = btrfs_alloc_path();
11814605409SBoris Burkov if (!path)
11914605409SBoris Burkov return -ENOMEM;
12014605409SBoris Burkov
12114605409SBoris Burkov while (1) {
12214605409SBoris Burkov /* 1 for the item being dropped */
12314605409SBoris Burkov trans = btrfs_start_transaction(root, 1);
12414605409SBoris Burkov if (IS_ERR(trans)) {
12514605409SBoris Burkov ret = PTR_ERR(trans);
12614605409SBoris Burkov goto out;
12714605409SBoris Burkov }
12814605409SBoris Burkov
12914605409SBoris Burkov /*
13014605409SBoris Burkov * Walk backwards through all the items until we find one that
13114605409SBoris Burkov * isn't from our key type or objectid
13214605409SBoris Burkov */
13314605409SBoris Burkov key.objectid = btrfs_ino(inode);
13414605409SBoris Burkov key.type = key_type;
13514605409SBoris Burkov key.offset = (u64)-1;
13614605409SBoris Burkov
13714605409SBoris Burkov ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
13814605409SBoris Burkov if (ret > 0) {
13914605409SBoris Burkov ret = 0;
14014605409SBoris Burkov /* No more keys of this type, we're done */
14114605409SBoris Burkov if (path->slots[0] == 0)
14214605409SBoris Burkov break;
14314605409SBoris Burkov path->slots[0]--;
14414605409SBoris Burkov } else if (ret < 0) {
14514605409SBoris Burkov btrfs_end_transaction(trans);
14614605409SBoris Burkov goto out;
14714605409SBoris Burkov }
14814605409SBoris Burkov
14914605409SBoris Burkov btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
15014605409SBoris Burkov
15114605409SBoris Burkov /* No more keys of this type, we're done */
15214605409SBoris Burkov if (key.objectid != btrfs_ino(inode) || key.type != key_type)
15314605409SBoris Burkov break;
15414605409SBoris Burkov
15514605409SBoris Burkov /*
15614605409SBoris Burkov * This shouldn't be a performance sensitive function because
15714605409SBoris Burkov * it's not used as part of truncate. If it ever becomes
15814605409SBoris Burkov * perf sensitive, change this to walk forward and bulk delete
15914605409SBoris Burkov * items
16014605409SBoris Burkov */
16114605409SBoris Burkov ret = btrfs_del_items(trans, root, path, path->slots[0], 1);
16214605409SBoris Burkov if (ret) {
16314605409SBoris Burkov btrfs_end_transaction(trans);
16414605409SBoris Burkov goto out;
16514605409SBoris Burkov }
16614605409SBoris Burkov count++;
16714605409SBoris Burkov btrfs_release_path(path);
16814605409SBoris Burkov btrfs_end_transaction(trans);
16914605409SBoris Burkov }
17014605409SBoris Burkov ret = count;
17114605409SBoris Burkov btrfs_end_transaction(trans);
17214605409SBoris Burkov out:
17314605409SBoris Burkov btrfs_free_path(path);
17414605409SBoris Burkov return ret;
17514605409SBoris Burkov }
17614605409SBoris Burkov
17714605409SBoris Burkov /*
17814605409SBoris Burkov * Drop all verity items
17914605409SBoris Burkov *
18014605409SBoris Burkov * @inode: inode to drop verity items for
18114605409SBoris Burkov *
18214605409SBoris Burkov * In most contexts where we are dropping verity items, we want to do it for all
18314605409SBoris Burkov * the types of verity items, not a particular one.
18414605409SBoris Burkov *
18514605409SBoris Burkov * Returns: 0 on success, negative error code on failure.
18614605409SBoris Burkov */
btrfs_drop_verity_items(struct btrfs_inode * inode)18714605409SBoris Burkov int btrfs_drop_verity_items(struct btrfs_inode *inode)
18814605409SBoris Burkov {
18914605409SBoris Burkov int ret;
19014605409SBoris Burkov
19114605409SBoris Burkov ret = drop_verity_items(inode, BTRFS_VERITY_DESC_ITEM_KEY);
19214605409SBoris Burkov if (ret < 0)
19314605409SBoris Burkov return ret;
19414605409SBoris Burkov ret = drop_verity_items(inode, BTRFS_VERITY_MERKLE_ITEM_KEY);
19514605409SBoris Burkov if (ret < 0)
19614605409SBoris Burkov return ret;
19714605409SBoris Burkov
19814605409SBoris Burkov return 0;
19914605409SBoris Burkov }
20014605409SBoris Burkov
20114605409SBoris Burkov /*
20214605409SBoris Burkov * Insert and write inode items with a given key type and offset.
20314605409SBoris Burkov *
20414605409SBoris Burkov * @inode: inode to insert for
20514605409SBoris Burkov * @key_type: key type to insert
20614605409SBoris Burkov * @offset: item offset to insert at
20714605409SBoris Burkov * @src: source data to write
20814605409SBoris Burkov * @len: length of source data to write
20914605409SBoris Burkov *
21014605409SBoris Burkov * Write len bytes from src into items of up to 2K length.
21114605409SBoris Burkov * The inserted items will have key (ino, key_type, offset + off) where off is
21214605409SBoris Burkov * consecutively increasing from 0 up to the last item ending at offset + len.
21314605409SBoris Burkov *
21414605409SBoris Burkov * Returns 0 on success and a negative error code on failure.
21514605409SBoris Burkov */
write_key_bytes(struct btrfs_inode * inode,u8 key_type,u64 offset,const char * src,u64 len)21614605409SBoris Burkov static int write_key_bytes(struct btrfs_inode *inode, u8 key_type, u64 offset,
21714605409SBoris Burkov const char *src, u64 len)
21814605409SBoris Burkov {
21914605409SBoris Burkov struct btrfs_trans_handle *trans;
22014605409SBoris Burkov struct btrfs_path *path;
22114605409SBoris Burkov struct btrfs_root *root = inode->root;
22214605409SBoris Burkov struct extent_buffer *leaf;
22314605409SBoris Burkov struct btrfs_key key;
22414605409SBoris Burkov unsigned long copy_bytes;
22514605409SBoris Burkov unsigned long src_offset = 0;
22614605409SBoris Burkov void *data;
22714605409SBoris Burkov int ret = 0;
22814605409SBoris Burkov
22914605409SBoris Burkov path = btrfs_alloc_path();
23014605409SBoris Burkov if (!path)
23114605409SBoris Burkov return -ENOMEM;
23214605409SBoris Burkov
23314605409SBoris Burkov while (len > 0) {
23414605409SBoris Burkov /* 1 for the new item being inserted */
23514605409SBoris Burkov trans = btrfs_start_transaction(root, 1);
23614605409SBoris Burkov if (IS_ERR(trans)) {
23714605409SBoris Burkov ret = PTR_ERR(trans);
23814605409SBoris Burkov break;
23914605409SBoris Burkov }
24014605409SBoris Burkov
24114605409SBoris Burkov key.objectid = btrfs_ino(inode);
24214605409SBoris Burkov key.type = key_type;
24314605409SBoris Burkov key.offset = offset;
24414605409SBoris Burkov
24514605409SBoris Burkov /*
24614605409SBoris Burkov * Insert 2K at a time mostly to be friendly for smaller leaf
24714605409SBoris Burkov * size filesystems
24814605409SBoris Burkov */
24914605409SBoris Burkov copy_bytes = min_t(u64, len, 2048);
25014605409SBoris Burkov
25114605409SBoris Burkov ret = btrfs_insert_empty_item(trans, root, path, &key, copy_bytes);
25214605409SBoris Burkov if (ret) {
25314605409SBoris Burkov btrfs_end_transaction(trans);
25414605409SBoris Burkov break;
25514605409SBoris Burkov }
25614605409SBoris Burkov
25714605409SBoris Burkov leaf = path->nodes[0];
25814605409SBoris Burkov
25914605409SBoris Burkov data = btrfs_item_ptr(leaf, path->slots[0], void);
26014605409SBoris Burkov write_extent_buffer(leaf, src + src_offset,
26114605409SBoris Burkov (unsigned long)data, copy_bytes);
26214605409SBoris Burkov offset += copy_bytes;
26314605409SBoris Burkov src_offset += copy_bytes;
26414605409SBoris Burkov len -= copy_bytes;
26514605409SBoris Burkov
26614605409SBoris Burkov btrfs_release_path(path);
26714605409SBoris Burkov btrfs_end_transaction(trans);
26814605409SBoris Burkov }
26914605409SBoris Burkov
27014605409SBoris Burkov btrfs_free_path(path);
27114605409SBoris Burkov return ret;
27214605409SBoris Burkov }
27314605409SBoris Burkov
27414605409SBoris Burkov /*
27514605409SBoris Burkov * Read inode items of the given key type and offset from the btree.
27614605409SBoris Burkov *
27714605409SBoris Burkov * @inode: inode to read items of
27814605409SBoris Burkov * @key_type: key type to read
27914605409SBoris Burkov * @offset: item offset to read from
28014605409SBoris Burkov * @dest: Buffer to read into. This parameter has slightly tricky
28114605409SBoris Burkov * semantics. If it is NULL, the function will not do any copying
28214605409SBoris Burkov * and will just return the size of all the items up to len bytes.
28314605409SBoris Burkov * If dest_page is passed, then the function will kmap_local the
28414605409SBoris Burkov * page and ignore dest, but it must still be non-NULL to avoid the
28514605409SBoris Burkov * counting-only behavior.
28614605409SBoris Burkov * @len: length in bytes to read
28788493779SLi Zetao * @dest_folio: copy into this folio instead of the dest buffer
28814605409SBoris Burkov *
28914605409SBoris Burkov * Helper function to read items from the btree. This returns the number of
29014605409SBoris Burkov * bytes read or < 0 for errors. We can return short reads if the items don't
29114605409SBoris Burkov * exist on disk or aren't big enough to fill the desired length. Supports
29214605409SBoris Burkov * reading into a provided buffer (dest) or into the page cache
29314605409SBoris Burkov *
29414605409SBoris Burkov * Returns number of bytes read or a negative error code on failure.
29514605409SBoris Burkov */
read_key_bytes(struct btrfs_inode * inode,u8 key_type,u64 offset,char * dest,u64 len,struct folio * dest_folio)29614605409SBoris Burkov static int read_key_bytes(struct btrfs_inode *inode, u8 key_type, u64 offset,
29788493779SLi Zetao char *dest, u64 len, struct folio *dest_folio)
29814605409SBoris Burkov {
29914605409SBoris Burkov struct btrfs_path *path;
30014605409SBoris Burkov struct btrfs_root *root = inode->root;
30114605409SBoris Burkov struct extent_buffer *leaf;
30214605409SBoris Burkov struct btrfs_key key;
30314605409SBoris Burkov u64 item_end;
30414605409SBoris Burkov u64 copy_end;
30514605409SBoris Burkov int copied = 0;
30614605409SBoris Burkov u32 copy_offset;
30714605409SBoris Burkov unsigned long copy_bytes;
30814605409SBoris Burkov unsigned long dest_offset = 0;
30914605409SBoris Burkov void *data;
31014605409SBoris Burkov char *kaddr = dest;
31114605409SBoris Burkov int ret;
31214605409SBoris Burkov
31314605409SBoris Burkov path = btrfs_alloc_path();
31414605409SBoris Burkov if (!path)
31514605409SBoris Burkov return -ENOMEM;
31614605409SBoris Burkov
31788493779SLi Zetao if (dest_folio)
31814605409SBoris Burkov path->reada = READA_FORWARD;
31914605409SBoris Burkov
32014605409SBoris Burkov key.objectid = btrfs_ino(inode);
32114605409SBoris Burkov key.type = key_type;
32214605409SBoris Burkov key.offset = offset;
32314605409SBoris Burkov
32414605409SBoris Burkov ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
32514605409SBoris Burkov if (ret < 0) {
32614605409SBoris Burkov goto out;
32714605409SBoris Burkov } else if (ret > 0) {
32814605409SBoris Burkov ret = 0;
32914605409SBoris Burkov if (path->slots[0] == 0)
33014605409SBoris Burkov goto out;
33114605409SBoris Burkov path->slots[0]--;
33214605409SBoris Burkov }
33314605409SBoris Burkov
33414605409SBoris Burkov while (len > 0) {
33514605409SBoris Burkov leaf = path->nodes[0];
33614605409SBoris Burkov btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
33714605409SBoris Burkov
33814605409SBoris Burkov if (key.objectid != btrfs_ino(inode) || key.type != key_type)
33914605409SBoris Burkov break;
34014605409SBoris Burkov
3413212fa14SJosef Bacik item_end = btrfs_item_size(leaf, path->slots[0]) + key.offset;
34214605409SBoris Burkov
34314605409SBoris Burkov if (copied > 0) {
34414605409SBoris Burkov /*
34514605409SBoris Burkov * Once we've copied something, we want all of the items
34614605409SBoris Burkov * to be sequential
34714605409SBoris Burkov */
34814605409SBoris Burkov if (key.offset != offset)
34914605409SBoris Burkov break;
35014605409SBoris Burkov } else {
35114605409SBoris Burkov /*
35214605409SBoris Burkov * Our initial offset might be in the middle of an
35314605409SBoris Burkov * item. Make sure it all makes sense.
35414605409SBoris Burkov */
35514605409SBoris Burkov if (key.offset > offset)
35614605409SBoris Burkov break;
35714605409SBoris Burkov if (item_end <= offset)
35814605409SBoris Burkov break;
35914605409SBoris Burkov }
36014605409SBoris Burkov
36114605409SBoris Burkov /* desc = NULL to just sum all the item lengths */
36214605409SBoris Burkov if (!dest)
36314605409SBoris Burkov copy_end = item_end;
36414605409SBoris Burkov else
36514605409SBoris Burkov copy_end = min(offset + len, item_end);
36614605409SBoris Burkov
36714605409SBoris Burkov /* Number of bytes in this item we want to copy */
36814605409SBoris Burkov copy_bytes = copy_end - offset;
36914605409SBoris Burkov
37014605409SBoris Burkov /* Offset from the start of item for copying */
37114605409SBoris Burkov copy_offset = offset - key.offset;
37214605409SBoris Burkov
37314605409SBoris Burkov if (dest) {
37488493779SLi Zetao if (dest_folio)
37588493779SLi Zetao kaddr = kmap_local_folio(dest_folio, 0);
37614605409SBoris Burkov
37714605409SBoris Burkov data = btrfs_item_ptr(leaf, path->slots[0], void);
37814605409SBoris Burkov read_extent_buffer(leaf, kaddr + dest_offset,
37914605409SBoris Burkov (unsigned long)data + copy_offset,
38014605409SBoris Burkov copy_bytes);
38114605409SBoris Burkov
38288493779SLi Zetao if (dest_folio)
38314605409SBoris Burkov kunmap_local(kaddr);
38414605409SBoris Burkov }
38514605409SBoris Burkov
38614605409SBoris Burkov offset += copy_bytes;
38714605409SBoris Burkov dest_offset += copy_bytes;
38814605409SBoris Burkov len -= copy_bytes;
38914605409SBoris Burkov copied += copy_bytes;
39014605409SBoris Burkov
39114605409SBoris Burkov path->slots[0]++;
39214605409SBoris Burkov if (path->slots[0] >= btrfs_header_nritems(path->nodes[0])) {
39314605409SBoris Burkov /*
39414605409SBoris Burkov * We've reached the last slot in this leaf and we need
39514605409SBoris Burkov * to go to the next leaf.
39614605409SBoris Burkov */
39714605409SBoris Burkov ret = btrfs_next_leaf(root, path);
39814605409SBoris Burkov if (ret < 0) {
39914605409SBoris Burkov break;
40014605409SBoris Burkov } else if (ret > 0) {
40114605409SBoris Burkov ret = 0;
40214605409SBoris Burkov break;
40314605409SBoris Burkov }
40414605409SBoris Burkov }
40514605409SBoris Burkov }
40614605409SBoris Burkov out:
40714605409SBoris Burkov btrfs_free_path(path);
40814605409SBoris Burkov if (!ret)
40914605409SBoris Burkov ret = copied;
41014605409SBoris Burkov return ret;
41114605409SBoris Burkov }
41214605409SBoris Burkov
41314605409SBoris Burkov /*
41470524253SBoris Burkov * Delete an fsverity orphan
41570524253SBoris Burkov *
41670524253SBoris Burkov * @trans: transaction to do the delete in
41770524253SBoris Burkov * @inode: inode to orphan
41870524253SBoris Burkov *
41970524253SBoris Burkov * Capture verity orphan specific logic that is repeated in the couple places
42070524253SBoris Burkov * we delete verity orphans. Specifically, handling ENOENT and ignoring inodes
42170524253SBoris Burkov * with 0 links.
42270524253SBoris Burkov *
42370524253SBoris Burkov * Returns zero on success or a negative error code on failure.
42470524253SBoris Burkov */
del_orphan(struct btrfs_trans_handle * trans,struct btrfs_inode * inode)42570524253SBoris Burkov static int del_orphan(struct btrfs_trans_handle *trans, struct btrfs_inode *inode)
42670524253SBoris Burkov {
42770524253SBoris Burkov struct btrfs_root *root = inode->root;
42870524253SBoris Burkov int ret;
42970524253SBoris Burkov
43070524253SBoris Burkov /*
43170524253SBoris Burkov * If the inode has no links, it is either already unlinked, or was
43270524253SBoris Burkov * created with O_TMPFILE. In either case, it should have an orphan from
43370524253SBoris Burkov * that other operation. Rather than reference count the orphans, we
43470524253SBoris Burkov * simply ignore them here, because we only invoke the verity path in
43570524253SBoris Burkov * the orphan logic when i_nlink is 1.
43670524253SBoris Burkov */
43770524253SBoris Burkov if (!inode->vfs_inode.i_nlink)
43870524253SBoris Burkov return 0;
43970524253SBoris Burkov
44070524253SBoris Burkov ret = btrfs_del_orphan_item(trans, root, btrfs_ino(inode));
44170524253SBoris Burkov if (ret == -ENOENT)
44270524253SBoris Burkov ret = 0;
44370524253SBoris Burkov return ret;
44470524253SBoris Burkov }
44570524253SBoris Burkov
44670524253SBoris Burkov /*
44714605409SBoris Burkov * Rollback in-progress verity if we encounter an error.
44814605409SBoris Burkov *
44914605409SBoris Burkov * @inode: inode verity had an error for
45014605409SBoris Burkov *
45114605409SBoris Burkov * We try to handle recoverable errors while enabling verity by rolling it back
45214605409SBoris Burkov * and just failing the operation, rather than having an fs level error no
45314605409SBoris Burkov * matter what. However, any error in rollback is unrecoverable.
45414605409SBoris Burkov *
45514605409SBoris Burkov * Returns 0 on success, negative error code on failure.
45614605409SBoris Burkov */
rollback_verity(struct btrfs_inode * inode)45714605409SBoris Burkov static int rollback_verity(struct btrfs_inode *inode)
45814605409SBoris Burkov {
459acbee9afSFilipe Manana struct btrfs_trans_handle *trans = NULL;
46014605409SBoris Burkov struct btrfs_root *root = inode->root;
46114605409SBoris Burkov int ret;
46214605409SBoris Burkov
463*1b6e068aSFilipe Manana btrfs_assert_inode_locked(inode);
46414605409SBoris Burkov truncate_inode_pages(inode->vfs_inode.i_mapping, inode->vfs_inode.i_size);
46514605409SBoris Burkov clear_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
46614605409SBoris Burkov ret = btrfs_drop_verity_items(inode);
46714605409SBoris Burkov if (ret) {
46814605409SBoris Burkov btrfs_handle_fs_error(root->fs_info, ret,
46914605409SBoris Burkov "failed to drop verity items in rollback %llu",
47014605409SBoris Burkov (u64)inode->vfs_inode.i_ino);
47114605409SBoris Burkov goto out;
47214605409SBoris Burkov }
47314605409SBoris Burkov
47470524253SBoris Burkov /*
47570524253SBoris Burkov * 1 for updating the inode flag
47670524253SBoris Burkov * 1 for deleting the orphan
47770524253SBoris Burkov */
47870524253SBoris Burkov trans = btrfs_start_transaction(root, 2);
47914605409SBoris Burkov if (IS_ERR(trans)) {
48014605409SBoris Burkov ret = PTR_ERR(trans);
481acbee9afSFilipe Manana trans = NULL;
48214605409SBoris Burkov btrfs_handle_fs_error(root->fs_info, ret,
48314605409SBoris Burkov "failed to start transaction in verity rollback %llu",
48414605409SBoris Burkov (u64)inode->vfs_inode.i_ino);
48514605409SBoris Burkov goto out;
48614605409SBoris Burkov }
48714605409SBoris Burkov inode->ro_flags &= ~BTRFS_INODE_RO_VERITY;
48814605409SBoris Burkov btrfs_sync_inode_flags_to_i_flags(&inode->vfs_inode);
4898b9d0322SFilipe Manana ret = btrfs_update_inode(trans, inode);
49014605409SBoris Burkov if (ret) {
49114605409SBoris Burkov btrfs_abort_transaction(trans, ret);
49214605409SBoris Burkov goto out;
49314605409SBoris Burkov }
49470524253SBoris Burkov ret = del_orphan(trans, inode);
49570524253SBoris Burkov if (ret) {
49670524253SBoris Burkov btrfs_abort_transaction(trans, ret);
49770524253SBoris Burkov goto out;
49870524253SBoris Burkov }
49914605409SBoris Burkov out:
500acbee9afSFilipe Manana if (trans)
501acbee9afSFilipe Manana btrfs_end_transaction(trans);
50214605409SBoris Burkov return ret;
50314605409SBoris Burkov }
50414605409SBoris Burkov
50514605409SBoris Burkov /*
50614605409SBoris Burkov * Finalize making the file a valid verity file
50714605409SBoris Burkov *
50814605409SBoris Burkov * @inode: inode to be marked as verity
50914605409SBoris Burkov * @desc: contents of the verity descriptor to write (not NULL)
51014605409SBoris Burkov * @desc_size: size of the verity descriptor
51114605409SBoris Burkov *
51214605409SBoris Burkov * Do the actual work of finalizing verity after successfully writing the Merkle
51314605409SBoris Burkov * tree:
51414605409SBoris Burkov *
51514605409SBoris Burkov * - write out the descriptor items
51614605409SBoris Burkov * - mark the inode with the verity flag
51770524253SBoris Burkov * - delete the orphan item
51814605409SBoris Burkov * - mark the ro compat bit
51914605409SBoris Burkov * - clear the in progress bit
52014605409SBoris Burkov *
52114605409SBoris Burkov * Returns 0 on success, negative error code on failure.
52214605409SBoris Burkov */
finish_verity(struct btrfs_inode * inode,const void * desc,size_t desc_size)52314605409SBoris Burkov static int finish_verity(struct btrfs_inode *inode, const void *desc,
52414605409SBoris Burkov size_t desc_size)
52514605409SBoris Burkov {
52614605409SBoris Burkov struct btrfs_trans_handle *trans = NULL;
52714605409SBoris Burkov struct btrfs_root *root = inode->root;
52814605409SBoris Burkov struct btrfs_verity_descriptor_item item;
52914605409SBoris Burkov int ret;
53014605409SBoris Burkov
53114605409SBoris Burkov /* Write out the descriptor item */
53214605409SBoris Burkov memset(&item, 0, sizeof(item));
53314605409SBoris Burkov btrfs_set_stack_verity_descriptor_size(&item, desc_size);
53414605409SBoris Burkov ret = write_key_bytes(inode, BTRFS_VERITY_DESC_ITEM_KEY, 0,
53514605409SBoris Burkov (const char *)&item, sizeof(item));
53614605409SBoris Burkov if (ret)
53714605409SBoris Burkov goto out;
53814605409SBoris Burkov
53914605409SBoris Burkov /* Write out the descriptor itself */
54014605409SBoris Burkov ret = write_key_bytes(inode, BTRFS_VERITY_DESC_ITEM_KEY, 1,
54114605409SBoris Burkov desc, desc_size);
54214605409SBoris Burkov if (ret)
54314605409SBoris Burkov goto out;
54414605409SBoris Burkov
54570524253SBoris Burkov /*
54670524253SBoris Burkov * 1 for updating the inode flag
54770524253SBoris Burkov * 1 for deleting the orphan
54870524253SBoris Burkov */
54970524253SBoris Burkov trans = btrfs_start_transaction(root, 2);
55014605409SBoris Burkov if (IS_ERR(trans)) {
55114605409SBoris Burkov ret = PTR_ERR(trans);
55214605409SBoris Burkov goto out;
55314605409SBoris Burkov }
55414605409SBoris Burkov inode->ro_flags |= BTRFS_INODE_RO_VERITY;
55514605409SBoris Burkov btrfs_sync_inode_flags_to_i_flags(&inode->vfs_inode);
5568b9d0322SFilipe Manana ret = btrfs_update_inode(trans, inode);
55714605409SBoris Burkov if (ret)
55814605409SBoris Burkov goto end_trans;
55970524253SBoris Burkov ret = del_orphan(trans, inode);
56070524253SBoris Burkov if (ret)
56170524253SBoris Burkov goto end_trans;
56214605409SBoris Burkov clear_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
56314605409SBoris Burkov btrfs_set_fs_compat_ro(root->fs_info, VERITY);
56414605409SBoris Burkov end_trans:
56514605409SBoris Burkov btrfs_end_transaction(trans);
56614605409SBoris Burkov out:
56714605409SBoris Burkov return ret;
56814605409SBoris Burkov
56914605409SBoris Burkov }
57014605409SBoris Burkov
57114605409SBoris Burkov /*
57214605409SBoris Burkov * fsverity op that begins enabling verity.
57314605409SBoris Burkov *
57414605409SBoris Burkov * @filp: file to enable verity on
57514605409SBoris Burkov *
57670524253SBoris Burkov * Begin enabling fsverity for the file. We drop any existing verity items, add
57770524253SBoris Burkov * an orphan and set the in progress bit.
57814605409SBoris Burkov *
57914605409SBoris Burkov * Returns 0 on success, negative error code on failure.
58014605409SBoris Burkov */
btrfs_begin_enable_verity(struct file * filp)58114605409SBoris Burkov static int btrfs_begin_enable_verity(struct file *filp)
58214605409SBoris Burkov {
58314605409SBoris Burkov struct btrfs_inode *inode = BTRFS_I(file_inode(filp));
58470524253SBoris Burkov struct btrfs_root *root = inode->root;
58570524253SBoris Burkov struct btrfs_trans_handle *trans;
58614605409SBoris Burkov int ret;
58714605409SBoris Burkov
588*1b6e068aSFilipe Manana btrfs_assert_inode_locked(inode);
58914605409SBoris Burkov
59014605409SBoris Burkov if (test_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags))
59114605409SBoris Burkov return -EBUSY;
59214605409SBoris Burkov
59370524253SBoris Burkov /*
59470524253SBoris Burkov * This should almost never do anything, but theoretically, it's
59570524253SBoris Burkov * possible that we failed to enable verity on a file, then were
59670524253SBoris Burkov * interrupted or failed while rolling back, failed to cleanup the
59770524253SBoris Burkov * orphan, and finally attempt to enable verity again.
59870524253SBoris Burkov */
59914605409SBoris Burkov ret = btrfs_drop_verity_items(inode);
60014605409SBoris Burkov if (ret)
60114605409SBoris Burkov return ret;
60214605409SBoris Burkov
60370524253SBoris Burkov /* 1 for the orphan item */
60470524253SBoris Burkov trans = btrfs_start_transaction(root, 1);
60570524253SBoris Burkov if (IS_ERR(trans))
60670524253SBoris Burkov return PTR_ERR(trans);
60770524253SBoris Burkov
60870524253SBoris Burkov ret = btrfs_orphan_add(trans, inode);
60970524253SBoris Burkov if (!ret)
61014605409SBoris Burkov set_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
61170524253SBoris Burkov btrfs_end_transaction(trans);
61214605409SBoris Burkov
61314605409SBoris Burkov return 0;
61414605409SBoris Burkov }
61514605409SBoris Burkov
61614605409SBoris Burkov /*
61714605409SBoris Burkov * fsverity op that ends enabling verity.
61814605409SBoris Burkov *
61914605409SBoris Burkov * @filp: file we are finishing enabling verity on
62014605409SBoris Burkov * @desc: verity descriptor to write out (NULL in error conditions)
62114605409SBoris Burkov * @desc_size: size of the verity descriptor (variable with signatures)
62214605409SBoris Burkov * @merkle_tree_size: size of the merkle tree in bytes
62314605409SBoris Burkov *
62414605409SBoris Burkov * If desc is null, then VFS is signaling an error occurred during verity
62514605409SBoris Burkov * enable, and we should try to rollback. Otherwise, attempt to finish verity.
62614605409SBoris Burkov *
62714605409SBoris Burkov * Returns 0 on success, negative error code on error.
62814605409SBoris Burkov */
btrfs_end_enable_verity(struct file * filp,const void * desc,size_t desc_size,u64 merkle_tree_size)62914605409SBoris Burkov static int btrfs_end_enable_verity(struct file *filp, const void *desc,
63014605409SBoris Burkov size_t desc_size, u64 merkle_tree_size)
63114605409SBoris Burkov {
63214605409SBoris Burkov struct btrfs_inode *inode = BTRFS_I(file_inode(filp));
63314605409SBoris Burkov int ret = 0;
63414605409SBoris Burkov int rollback_ret;
63514605409SBoris Burkov
636*1b6e068aSFilipe Manana btrfs_assert_inode_locked(inode);
63714605409SBoris Burkov
63814605409SBoris Burkov if (desc == NULL)
63914605409SBoris Burkov goto rollback;
64014605409SBoris Burkov
64114605409SBoris Burkov ret = finish_verity(inode, desc, desc_size);
64214605409SBoris Burkov if (ret)
64314605409SBoris Burkov goto rollback;
64414605409SBoris Burkov return ret;
64514605409SBoris Burkov
64614605409SBoris Burkov rollback:
64714605409SBoris Burkov rollback_ret = rollback_verity(inode);
64814605409SBoris Burkov if (rollback_ret)
64914605409SBoris Burkov btrfs_err(inode->root->fs_info,
65014605409SBoris Burkov "failed to rollback verity items: %d", rollback_ret);
65114605409SBoris Burkov return ret;
65214605409SBoris Burkov }
65314605409SBoris Burkov
65414605409SBoris Burkov /*
65514605409SBoris Burkov * fsverity op that gets the struct fsverity_descriptor.
65614605409SBoris Burkov *
65714605409SBoris Burkov * @inode: inode to get the descriptor of
65814605409SBoris Burkov * @buf: output buffer for the descriptor contents
65914605409SBoris Burkov * @buf_size: size of the output buffer. 0 to query the size
66014605409SBoris Burkov *
66114605409SBoris Burkov * fsverity does a two pass setup for reading the descriptor, in the first pass
66214605409SBoris Burkov * it calls with buf_size = 0 to query the size of the descriptor, and then in
66314605409SBoris Burkov * the second pass it actually reads the descriptor off disk.
66414605409SBoris Burkov *
66514605409SBoris Burkov * Returns the size on success or a negative error code on failure.
66614605409SBoris Burkov */
btrfs_get_verity_descriptor(struct inode * inode,void * buf,size_t buf_size)66738622010SBoris Burkov int btrfs_get_verity_descriptor(struct inode *inode, void *buf, size_t buf_size)
66814605409SBoris Burkov {
66914605409SBoris Burkov u64 true_size;
67014605409SBoris Burkov int ret = 0;
67114605409SBoris Burkov struct btrfs_verity_descriptor_item item;
67214605409SBoris Burkov
67314605409SBoris Burkov memset(&item, 0, sizeof(item));
67414605409SBoris Burkov ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_DESC_ITEM_KEY, 0,
67514605409SBoris Burkov (char *)&item, sizeof(item), NULL);
67614605409SBoris Burkov if (ret < 0)
67714605409SBoris Burkov return ret;
67814605409SBoris Burkov
67914605409SBoris Burkov if (item.reserved[0] != 0 || item.reserved[1] != 0)
68014605409SBoris Burkov return -EUCLEAN;
68114605409SBoris Burkov
68214605409SBoris Burkov true_size = btrfs_stack_verity_descriptor_size(&item);
68314605409SBoris Burkov if (true_size > INT_MAX)
68414605409SBoris Burkov return -EUCLEAN;
68514605409SBoris Burkov
68614605409SBoris Burkov if (buf_size == 0)
68714605409SBoris Burkov return true_size;
68814605409SBoris Burkov if (buf_size < true_size)
68914605409SBoris Burkov return -ERANGE;
69014605409SBoris Burkov
69114605409SBoris Burkov ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_DESC_ITEM_KEY, 1,
69214605409SBoris Burkov buf, buf_size, NULL);
69314605409SBoris Burkov if (ret < 0)
69414605409SBoris Burkov return ret;
69514605409SBoris Burkov if (ret != true_size)
69614605409SBoris Burkov return -EIO;
69714605409SBoris Burkov
69814605409SBoris Burkov return true_size;
69914605409SBoris Burkov }
70014605409SBoris Burkov
70114605409SBoris Burkov /*
70214605409SBoris Burkov * fsverity op that reads and caches a merkle tree page.
70314605409SBoris Burkov *
70414605409SBoris Burkov * @inode: inode to read a merkle tree page for
70514605409SBoris Burkov * @index: page index relative to the start of the merkle tree
70614605409SBoris Burkov * @num_ra_pages: number of pages to readahead. Optional, we ignore it
70714605409SBoris Burkov *
70814605409SBoris Burkov * The Merkle tree is stored in the filesystem btree, but its pages are cached
70914605409SBoris Burkov * with a logical position past EOF in the inode's mapping.
71014605409SBoris Burkov *
71114605409SBoris Burkov * Returns the page we read, or an ERR_PTR on error.
71214605409SBoris Burkov */
btrfs_read_merkle_tree_page(struct inode * inode,pgoff_t index,unsigned long num_ra_pages)71314605409SBoris Burkov static struct page *btrfs_read_merkle_tree_page(struct inode *inode,
71414605409SBoris Burkov pgoff_t index,
71514605409SBoris Burkov unsigned long num_ra_pages)
71614605409SBoris Burkov {
71706ed0935SMatthew Wilcox (Oracle) struct folio *folio;
71814605409SBoris Burkov u64 off = (u64)index << PAGE_SHIFT;
71914605409SBoris Burkov loff_t merkle_pos = merkle_file_pos(inode);
72014605409SBoris Burkov int ret;
72114605409SBoris Burkov
72214605409SBoris Burkov if (merkle_pos < 0)
72314605409SBoris Burkov return ERR_PTR(merkle_pos);
72414605409SBoris Burkov if (merkle_pos > inode->i_sb->s_maxbytes - off - PAGE_SIZE)
72514605409SBoris Burkov return ERR_PTR(-EFBIG);
72614605409SBoris Burkov index += merkle_pos >> PAGE_SHIFT;
72714605409SBoris Burkov again:
72806ed0935SMatthew Wilcox (Oracle) folio = __filemap_get_folio(inode->i_mapping, index, FGP_ACCESSED, 0);
72906ed0935SMatthew Wilcox (Oracle) if (!IS_ERR(folio)) {
73006ed0935SMatthew Wilcox (Oracle) if (folio_test_uptodate(folio))
73106ed0935SMatthew Wilcox (Oracle) goto out;
73214605409SBoris Burkov
73306ed0935SMatthew Wilcox (Oracle) folio_lock(folio);
73406ed0935SMatthew Wilcox (Oracle) /* If it's not uptodate after we have the lock, we got a read error. */
73506ed0935SMatthew Wilcox (Oracle) if (!folio_test_uptodate(folio)) {
73606ed0935SMatthew Wilcox (Oracle) folio_unlock(folio);
73706ed0935SMatthew Wilcox (Oracle) folio_put(folio);
73814605409SBoris Burkov return ERR_PTR(-EIO);
73914605409SBoris Burkov }
74006ed0935SMatthew Wilcox (Oracle) folio_unlock(folio);
74106ed0935SMatthew Wilcox (Oracle) goto out;
74214605409SBoris Burkov }
74314605409SBoris Burkov
74406ed0935SMatthew Wilcox (Oracle) folio = filemap_alloc_folio(mapping_gfp_constraint(inode->i_mapping, ~__GFP_FS),
74506ed0935SMatthew Wilcox (Oracle) 0);
74606ed0935SMatthew Wilcox (Oracle) if (!folio)
74714605409SBoris Burkov return ERR_PTR(-ENOMEM);
74814605409SBoris Burkov
74906ed0935SMatthew Wilcox (Oracle) ret = filemap_add_folio(inode->i_mapping, folio, index, GFP_NOFS);
75006ed0935SMatthew Wilcox (Oracle) if (ret) {
75106ed0935SMatthew Wilcox (Oracle) folio_put(folio);
75206ed0935SMatthew Wilcox (Oracle) /* Did someone else insert a folio here? */
75306ed0935SMatthew Wilcox (Oracle) if (ret == -EEXIST)
75406ed0935SMatthew Wilcox (Oracle) goto again;
75506ed0935SMatthew Wilcox (Oracle) return ERR_PTR(ret);
75606ed0935SMatthew Wilcox (Oracle) }
75706ed0935SMatthew Wilcox (Oracle)
75814605409SBoris Burkov /*
75914605409SBoris Burkov * Merkle item keys are indexed from byte 0 in the merkle tree.
76014605409SBoris Burkov * They have the form:
76114605409SBoris Burkov *
76214605409SBoris Burkov * [ inode objectid, BTRFS_MERKLE_ITEM_KEY, offset in bytes ]
76314605409SBoris Burkov */
76414605409SBoris Burkov ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY, off,
76588493779SLi Zetao folio_address(folio), PAGE_SIZE, folio);
76614605409SBoris Burkov if (ret < 0) {
76706ed0935SMatthew Wilcox (Oracle) folio_put(folio);
76814605409SBoris Burkov return ERR_PTR(ret);
76914605409SBoris Burkov }
77014605409SBoris Burkov if (ret < PAGE_SIZE)
77106ed0935SMatthew Wilcox (Oracle) folio_zero_segment(folio, ret, PAGE_SIZE);
77214605409SBoris Burkov
77306ed0935SMatthew Wilcox (Oracle) folio_mark_uptodate(folio);
77406ed0935SMatthew Wilcox (Oracle) folio_unlock(folio);
77514605409SBoris Burkov
77606ed0935SMatthew Wilcox (Oracle) out:
77706ed0935SMatthew Wilcox (Oracle) return folio_file_page(folio, index);
77814605409SBoris Burkov }
77914605409SBoris Burkov
78014605409SBoris Burkov /*
78114605409SBoris Burkov * fsverity op that writes a Merkle tree block into the btree.
78214605409SBoris Burkov *
78314605409SBoris Burkov * @inode: inode to write a Merkle tree block for
78472ea15f0SEric Biggers * @buf: Merkle tree block to write
78572ea15f0SEric Biggers * @pos: the position of the block in the Merkle tree (in bytes)
78672ea15f0SEric Biggers * @size: the Merkle tree block size (in bytes)
78714605409SBoris Burkov *
78814605409SBoris Burkov * Returns 0 on success or negative error code on failure
78914605409SBoris Burkov */
btrfs_write_merkle_tree_block(struct inode * inode,const void * buf,u64 pos,unsigned int size)79014605409SBoris Burkov static int btrfs_write_merkle_tree_block(struct inode *inode, const void *buf,
79172ea15f0SEric Biggers u64 pos, unsigned int size)
79214605409SBoris Burkov {
79314605409SBoris Burkov loff_t merkle_pos = merkle_file_pos(inode);
79414605409SBoris Burkov
79514605409SBoris Burkov if (merkle_pos < 0)
79614605409SBoris Burkov return merkle_pos;
79772ea15f0SEric Biggers if (merkle_pos > inode->i_sb->s_maxbytes - pos - size)
79814605409SBoris Burkov return -EFBIG;
79914605409SBoris Burkov
80014605409SBoris Burkov return write_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY,
80172ea15f0SEric Biggers pos, buf, size);
80214605409SBoris Burkov }
80314605409SBoris Burkov
80414605409SBoris Burkov const struct fsverity_operations btrfs_verityops = {
80514605409SBoris Burkov .begin_enable_verity = btrfs_begin_enable_verity,
80614605409SBoris Burkov .end_enable_verity = btrfs_end_enable_verity,
80714605409SBoris Burkov .get_verity_descriptor = btrfs_get_verity_descriptor,
80814605409SBoris Burkov .read_merkle_tree_page = btrfs_read_merkle_tree_page,
80914605409SBoris Burkov .write_merkle_tree_block = btrfs_write_merkle_tree_block,
81014605409SBoris Burkov };
811