1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * fs/f2fs/verity.c: fs-verity support for f2fs 4 * 5 * Copyright 2019 Google LLC 6 */ 7 8 /* 9 * Implementation of fsverity_operations for f2fs. 10 * 11 * Like ext4, f2fs stores the verity metadata (Merkle tree and 12 * fsverity_descriptor) past the end of the file, starting at the first 64K 13 * boundary beyond i_size. This approach works because (a) verity files are 14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but 15 * can be read/written internally by f2fs with only some relatively small 16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits 17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be 18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't 19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is 20 * because it contains hashes of the plaintext data. 21 * 22 * Using a 64K boundary rather than a 4K one keeps things ready for 23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk 24 * since there can be a hole between i_size and the start of the Merkle tree. 25 */ 26 27 #include <linux/f2fs_fs.h> 28 #include <linux/fserror.h> 29 30 #include "f2fs.h" 31 #include "xattr.h" 32 33 #define F2FS_VERIFY_VER (1) 34 35 static inline loff_t f2fs_verity_metadata_pos(const struct inode *inode) 36 { 37 return round_up(inode->i_size, 65536); 38 } 39 40 /* 41 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY. 42 * kernel_write() can't be used because the file descriptor is readonly. 43 */ 44 static int pagecache_write(struct inode *inode, const void *buf, size_t count, 45 loff_t pos) 46 { 47 struct address_space *mapping = inode->i_mapping; 48 const struct address_space_operations *aops = mapping->a_ops; 49 50 if (pos + count > F2FS_BLK_TO_BYTES(max_file_blocks(inode))) 51 return -EFBIG; 52 53 while (count) { 54 size_t n = min_t(size_t, count, 55 PAGE_SIZE - offset_in_page(pos)); 56 struct folio *folio; 57 void *fsdata = NULL; 58 int res; 59 60 res = aops->write_begin(NULL, mapping, pos, n, &folio, &fsdata); 61 if (res) 62 return res; 63 64 memcpy_to_folio(folio, offset_in_folio(folio, pos), buf, n); 65 66 res = aops->write_end(NULL, mapping, pos, n, n, folio, fsdata); 67 if (res < 0) 68 return res; 69 if (res != n) 70 return -EIO; 71 72 buf += n; 73 pos += n; 74 count -= n; 75 } 76 return 0; 77 } 78 79 /* 80 * Format of f2fs verity xattr. This points to the location of the verity 81 * descriptor within the file data rather than containing it directly because 82 * the verity descriptor *must* be encrypted when f2fs encryption is used. But, 83 * f2fs encryption does not encrypt xattrs. 84 */ 85 struct fsverity_descriptor_location { 86 __le32 version; 87 __le32 size; 88 __le64 pos; 89 }; 90 91 static int f2fs_begin_enable_verity(struct file *filp) 92 { 93 struct inode *inode = file_inode(filp); 94 int err; 95 96 if (f2fs_verity_in_progress(inode)) 97 return -EBUSY; 98 99 if (f2fs_is_atomic_file(inode)) 100 return -EOPNOTSUPP; 101 102 /* 103 * Since the file was opened readonly, we have to initialize the quotas 104 * here and not rely on ->open() doing it. This must be done before 105 * evicting the inline data. 106 */ 107 err = f2fs_dquot_initialize(inode); 108 if (err) 109 return err; 110 111 err = f2fs_convert_inline_inode(inode); 112 if (err) 113 return err; 114 115 set_inode_flag(inode, FI_VERITY_IN_PROGRESS); 116 return 0; 117 } 118 119 static int f2fs_end_enable_verity(struct file *filp, const void *desc, 120 size_t desc_size, u64 merkle_tree_size) 121 { 122 struct inode *inode = file_inode(filp); 123 struct f2fs_sb_info *sbi = F2FS_I_SB(inode); 124 u64 desc_pos = f2fs_verity_metadata_pos(inode) + merkle_tree_size; 125 struct fsverity_descriptor_location dloc = { 126 .version = cpu_to_le32(F2FS_VERIFY_VER), 127 .size = cpu_to_le32(desc_size), 128 .pos = cpu_to_le64(desc_pos), 129 }; 130 int err = 0, err2 = 0; 131 132 /* 133 * If an error already occurred (which fs/verity/ signals by passing 134 * desc == NULL), then only clean-up is needed. 135 */ 136 if (desc == NULL) 137 goto cleanup; 138 139 /* Append the verity descriptor. */ 140 err = pagecache_write(inode, desc, desc_size, desc_pos); 141 if (err) 142 goto cleanup; 143 144 /* 145 * Write all pages (both data and verity metadata). Note that this must 146 * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond 147 * i_size won't be written properly. For crash consistency, this also 148 * must happen before the verity inode flag gets persisted. 149 */ 150 err = filemap_write_and_wait(inode->i_mapping); 151 if (err) 152 goto cleanup; 153 154 /* Set the verity xattr. */ 155 err = f2fs_setxattr(inode, F2FS_XATTR_INDEX_VERITY, 156 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), 157 NULL, XATTR_CREATE); 158 if (err) 159 goto cleanup; 160 161 /* Finally, set the verity inode flag. */ 162 file_set_verity(inode); 163 f2fs_set_inode_flags(inode); 164 f2fs_mark_inode_dirty_sync(inode, true); 165 166 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 167 return 0; 168 169 cleanup: 170 /* 171 * Verity failed to be enabled, so clean up by truncating any verity 172 * metadata that was written beyond i_size (both from cache and from 173 * disk) and clearing FI_VERITY_IN_PROGRESS. 174 * 175 * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection 176 * from re-instantiating cached pages we are truncating (since unlike 177 * normal file accesses, garbage collection isn't limited by i_size). 178 */ 179 f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); 180 truncate_inode_pages(inode->i_mapping, inode->i_size); 181 err2 = f2fs_truncate(inode); 182 if (err2) { 183 f2fs_err(sbi, "Truncating verity metadata failed (errno=%d)", 184 err2); 185 set_sbi_flag(sbi, SBI_NEED_FSCK); 186 } 187 f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); 188 clear_inode_flag(inode, FI_VERITY_IN_PROGRESS); 189 return err ?: err2; 190 } 191 192 static int f2fs_get_verity_descriptor(struct inode *inode, void *buf, 193 size_t buf_size) 194 { 195 struct fsverity_descriptor_location dloc; 196 int res; 197 u32 size; 198 u64 pos; 199 200 /* Get the descriptor location */ 201 res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_VERITY, 202 F2FS_XATTR_NAME_VERITY, &dloc, sizeof(dloc), NULL); 203 if (res < 0 && res != -ERANGE) 204 return res; 205 if (res != sizeof(dloc) || dloc.version != cpu_to_le32(F2FS_VERIFY_VER)) { 206 f2fs_warn(F2FS_I_SB(inode), "unknown verity xattr format"); 207 return -EINVAL; 208 } 209 size = le32_to_cpu(dloc.size); 210 pos = le64_to_cpu(dloc.pos); 211 212 /* Get the descriptor */ 213 if (pos + size < pos || 214 pos + size > F2FS_BLK_TO_BYTES(max_file_blocks(inode)) || 215 pos < f2fs_verity_metadata_pos(inode) || size > INT_MAX) { 216 f2fs_warn(F2FS_I_SB(inode), "invalid verity xattr"); 217 f2fs_handle_error(F2FS_I_SB(inode), 218 ERROR_CORRUPTED_VERITY_XATTR); 219 fserror_report_file_metadata(inode, -EFSCORRUPTED, GFP_NOFS); 220 return -EFSCORRUPTED; 221 } 222 if (buf_size) { 223 if (size > buf_size) 224 return -ERANGE; 225 res = fsverity_pagecache_read(inode, buf, size, pos); 226 if (res) 227 return res; 228 } 229 return size; 230 } 231 232 static struct page *f2fs_read_merkle_tree_page(struct inode *inode, 233 pgoff_t index) 234 { 235 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; 236 return generic_read_merkle_tree_page(inode, index); 237 } 238 239 static void f2fs_readahead_merkle_tree(struct inode *inode, pgoff_t index, 240 unsigned long nr_pages) 241 { 242 index += f2fs_verity_metadata_pos(inode) >> PAGE_SHIFT; 243 generic_readahead_merkle_tree(inode, index, nr_pages); 244 } 245 246 static int f2fs_write_merkle_tree_block(struct file *file, const void *buf, 247 u64 pos, unsigned int size, 248 const u8 *zero_digest, 249 unsigned int digest_size) 250 { 251 pos += f2fs_verity_metadata_pos(file_inode(file)); 252 253 return pagecache_write(file_inode(file), buf, size, pos); 254 } 255 256 const struct fsverity_operations f2fs_verityops = { 257 .begin_enable_verity = f2fs_begin_enable_verity, 258 .end_enable_verity = f2fs_end_enable_verity, 259 .get_verity_descriptor = f2fs_get_verity_descriptor, 260 .read_merkle_tree_page = f2fs_read_merkle_tree_page, 261 .readahead_merkle_tree = f2fs_readahead_merkle_tree, 262 .write_merkle_tree_block = f2fs_write_merkle_tree_block, 263 }; 264