1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * fs/f2fs/verity.c: fs-verity support for f2fs 4 * 5 * Copyright 2019 Google LLC 6 */ 7 8 /* 9 * Implementation of fsverity_operations for f2fs. 10 * 11 * Like ext4, f2fs stores the verity metadata (Merkle tree and 12 * fsverity_descriptor) past the end of the file, starting at the first 64K 13 * boundary beyond i_size. This approach works because (a) verity files are 14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but 15 * can be read/written internally by f2fs with only some relatively small 16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits 17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be 18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't 19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is 20 * because it contains hashes of the plaintext data. 21 * 22 * Using a 64K boundary rather than a 4K one keeps things ready for 23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk 24 * since there can be a hole between i_size and the start of the Merkle tree. 25 */ 26 27 #include <linux/f2fs_fs.h> 28 #include <linux/fserror.h> 29 30 #include "f2fs.h" 31 #include "xattr.h" 32 33 #define F2FS_VERIFY_VER (1) 34 35 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode) 36 { 37 return round_up(inode->i_size, 65536); 38 } 39 40 /* 41 * Read some verity metadata from the inode. __vfs_read() can't be used because 42 * we need to read beyond i_size. 43 */ 44 static int pagecache_read(struct inode *inode, void *buf, size_t count, 45 loff_t pos) 46 { 47 while (count) { 48 size_t n = min_t(size_t, count, 49 PAGE_SIZE - offset_in_page(pos)); 50 struct page *page; 51 52 page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT, 53 NULL); 54 if (IS_ERR(page)) 55 return PTR_ERR(page); 56 57 memcpy_from_page(buf, page, offset_in_page(pos), n); 58 59 put_page(page); 60 61 buf += n; 62 pos += n; 63 count -= n; 64 } 65 return 0; 66 } 67 68 /* 69 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY. 70 * kernel_write() can't be used because the file descriptor is readonly. 71 */ 72 static int pagecache_write(struct inode *inode, const void *buf, size_t count, 73 loff_t pos) 74 { 75 struct address_space *mapping = inode->i_mapping; 76 const struct address_space_operations *aops = mapping->a_ops; 77 78 if (pos + count > F2FS_BLK_TO_BYTES(max_file_blocks(inode))) 79 return -EFBIG; 80 81 while (count) { 82 size_t n = min_t(size_t, count, 83 PAGE_SIZE - offset_in_page(pos)); 84 struct folio *folio; 85 void *fsdata = NULL; 86 int res; 87 88 res = aops->write_begin(NULL, mapping, pos, n, &folio, &fsdata); 89 if (res) 90 return res; 91 92 memcpy_to_folio(folio, offset_in_folio(folio, pos), buf, n); 93 94 res = aops->write_end(NULL, mapping, pos, n, n, folio, fsdata); 95 if (res < 0) 96 return res; 97 if (res != n) 98 return -EIO; 99 100 buf += n; 101 pos += n; 102 count -= n; 103 } 104 return 0; 105 } 106 107 /* 108 * Format of f2fs verity xattr. This points to the location of the verity 109 * descriptor within the file data rather than containing it directly because 110 * the verity descriptor *must* be encrypted when f2fs encryption is used. But, 111 * f2fs encryption does not encrypt xattrs. 112 */ 113 struct fsverity_descriptor_location { 114 __le32 version; 115 __le32 size; 116 __le64 pos; 117 }; 118 119 static int f2fs_begin_enable_verity(struct file *filp) 120 { 121 struct inode *inode = file_inode(filp); 122 int err; 123 124 if (f2fs_verity_in_progress(inode)) 125 return -EBUSY; 126 127 if (f2fs_is_atomic_file(inode)) 128 return -EOPNOTSUPP; 129 130 /* 131 * Since the file was opened readonly, we have to initialize the quotas 132 * here and not rely on ->open() doing it. This must be done before 133 * evicting the inline data. 134 */ 135 err = f2fs_dquot_initialize(inode); 136 if (err) 137 return err; 138 139 err = f2fs_convert_inline_inode(inode); 140 if (err) 141 return err; 142 143 set_inode_flag(inode, FI_VERITY_IN_PROGRESS); 144 return 0; 145 } 146 147 static int f2fs_end_enable_verity(struct file *filp, const void *desc, 148 size_t desc_size, u64 merkle_tree_size) 149 { 150 struct inode *inode = file_inode(filp); 151 struct f2fs_sb_info *sbi = F2FS_I_SB(inode); 152 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size; 153 struct fsverity_descriptor_location dloc = { 154 .version = cpu_to_le32(F2FS_VERIFY_VER), 155 .size = cpu_to_le32(desc_size), 156 .pos = cpu_to_le64(desc_pos), 157 }; 158 int err = 0, err2 = 0; 159 160 /* 161 * If an error already occurred (which fs/verity/ signals by passing 162 * desc == NULL), then only clean-up is needed. 163 */ 164 if (desc == NULL) 165 goto cleanup; 166 167 /* Append the verity descriptor. */ 168 err = pagecache_write(inode, desc, desc_size, desc_pos); 169 if (err) 170 goto cleanup; 171 172 /* 173 * Write all pages (both data and verity metadata). Note that this must 174 * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond 175 * i_size won't be written properly. For crash consistency, this also 176 * must happen before the verity inode flag gets persisted. 177 */ 178 err = filemap_write_and_wait(inode->i_mapping); 179 if (err) 180 goto cleanup; 181 182 /* Set the verity xattr. */ 183 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY, 184 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), 185 NULL, XATTR_CREATE); 186 if (err) 187 goto cleanup; 188 189 /* Finally, set the verity inode flag. */ 190 file_set_verity(inode); 191 f2fs_set_inode_flags(inode); 192 f2fs_mark_inode_dirty_sync(inode, true); 193 194 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 195 return 0; 196 197 cleanup: 198 /* 199 * Verity failed to be enabled, so clean up by truncating any verity 200 * metadata that was written beyond i_size (both from cache and from 201 * disk) and clearing FI_VERITY_IN_PROGRESS. 202 * 203 * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection 204 * from re-instantiating cached pages we are truncating (since unlike 205 * normal file accesses, garbage collection isn't limited by i_size). 206 */ 207 f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); 208 truncate_inode_pages(inode->i_mapping, inode->i_size); 209 err2 = f2fs_truncate(inode); 210 if (err2) { 211 f2fs_err(sbi, "Truncating verity metadata failed (errno=%d)", 212 err2); 213 set_sbi_flag(sbi, SBI_NEED_FSCK); 214 } 215 f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); 216 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 217 return err ?: err2; 218 } 219 220 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf, 221 size_t buf_size) 222 { 223 struct fsverity_descriptor_location dloc; 224 int res; 225 u32 size; 226 u64 pos; 227 228 /* Get the descriptor location */ 229 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY, 230 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL); 231 if (res < 0 && res != -ERANGE) 232 return res; 233 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(F2FS_VERIFY_VER)) { 234 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format"); 235 return -EINVAL; 236 } 237 size = le32_to_cpu(dloc.size); 238 pos = le64_to_cpu(dloc.pos); 239 240 /* Get the descriptor */ 241 if (pos + size < pos || 242 pos + size > F2FS_BLK_TO_BYTES(max_file_blocks(inode)) || 243 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) { 244 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr"); 245 f2fs_handle_error(F2FS_I_SB(inode), 246 ERROR_CORRUPTED_VERITY_XATTR); 247 fserror_report_file_metadata(inode, -EFSCORRUPTED, GFP_NOFS); 248 return -EFSCORRUPTED; 249 } 250 if (buf_size) { 251 if (size > buf_size) 252 return -ERANGE; 253 res = pagecache_read(inode, buf, size, pos); 254 if (res) 255 return res; 256 } 257 return size; 258 } 259 260 static struct page *f2fs_read_merkle_tree_page(struct inode *inode, 261 pgoff_t index) 262 { 263 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; 264 return generic_read_merkle_tree_page(inode, index); 265 } 266 267 static void f2fs_readahead_merkle_tree(struct inode *inode, pgoff_t index, 268 unsigned long nr_pages) 269 { 270 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; 271 generic_readahead_merkle_tree(inode, index, nr_pages); 272 } 273 274 static int f2fs_write_merkle_tree_block(struct file *file, const void *buf, 275 u64 pos, unsigned int size) 276 { 277 pos += f2fs_verity_metadata_pos(file_inode(file)); 278 279 return pagecache_write(file_inode(file), buf, size, pos); 280 } 281 282 const struct fsverity_operations f2fs_verityops = { 283 .begin_enable_verity = f2fs_begin_enable_verity, 284 .end_enable_verity = f2fs_end_enable_verity, 285 .get_verity_descriptor = f2fs_get_verity_descriptor, 286 .read_merkle_tree_page = f2fs_read_merkle_tree_page, 287 .readahead_merkle_tree = f2fs_readahead_merkle_tree, 288 .write_merkle_tree_block = f2fs_write_merkle_tree_block, 289 }; 290