1671e67b4SEric Biggers // SPDX-License-Identifier: GPL-2.0
2671e67b4SEric Biggers /*
37bf765ddSEric Biggers * fs-verity hash algorithms
4671e67b4SEric Biggers *
5671e67b4SEric Biggers * Copyright 2019 Google LLC
6671e67b4SEric Biggers */
7671e67b4SEric Biggers
8671e67b4SEric Biggers #include "fsverity_private.h"
9671e67b4SEric Biggers
10671e67b4SEric Biggers #include <crypto/hash.h>
11671e67b4SEric Biggers
12671e67b4SEric Biggers /* The hash algorithms supported by fs-verity */
13671e67b4SEric Biggers struct fsverity_hash_alg fsverity_hash_algs[] = {
14671e67b4SEric Biggers [FS_VERITY_HASH_ALG_SHA256] = {
15671e67b4SEric Biggers .name = "sha256",
16671e67b4SEric Biggers .digest_size = SHA256_DIGEST_SIZE,
17671e67b4SEric Biggers .block_size = SHA256_BLOCK_SIZE,
18a4bbf53dSEric Biggers .algo_id = HASH_ALGO_SHA256,
19671e67b4SEric Biggers },
20add890c9SEric Biggers [FS_VERITY_HASH_ALG_SHA512] = {
21add890c9SEric Biggers .name = "sha512",
22add890c9SEric Biggers .digest_size = SHA512_DIGEST_SIZE,
23add890c9SEric Biggers .block_size = SHA512_BLOCK_SIZE,
24a4bbf53dSEric Biggers .algo_id = HASH_ALGO_SHA512,
25add890c9SEric Biggers },
26671e67b4SEric Biggers };
27671e67b4SEric Biggers
28439bea10SEric Biggers static DEFINE_MUTEX(fsverity_hash_alg_init_mutex);
29439bea10SEric Biggers
30671e67b4SEric Biggers /**
31671e67b4SEric Biggers * fsverity_get_hash_alg() - validate and prepare a hash algorithm
32671e67b4SEric Biggers * @inode: optional inode for logging purposes
33671e67b4SEric Biggers * @num: the hash algorithm number
34671e67b4SEric Biggers *
35671e67b4SEric Biggers * Get the struct fsverity_hash_alg for the given hash algorithm number, and
36671e67b4SEric Biggers * ensure it has a hash transform ready to go. The hash transforms are
37671e67b4SEric Biggers * allocated on-demand so that we don't waste resources unnecessarily, and
38671e67b4SEric Biggers * because the crypto modules may be initialized later than fs/verity/.
39671e67b4SEric Biggers *
40671e67b4SEric Biggers * Return: pointer to the hash alg on success, else an ERR_PTR()
41671e67b4SEric Biggers */
fsverity_get_hash_alg(const struct inode * inode,unsigned int num)4232ab3c5eSEric Biggers const struct fsverity_hash_alg *fsverity_get_hash_alg(const struct inode *inode,
43671e67b4SEric Biggers unsigned int num)
44671e67b4SEric Biggers {
45671e67b4SEric Biggers struct fsverity_hash_alg *alg;
468fcd94adSEric Biggers struct crypto_shash *tfm;
47671e67b4SEric Biggers int err;
48671e67b4SEric Biggers
49671e67b4SEric Biggers if (num >= ARRAY_SIZE(fsverity_hash_algs) ||
50671e67b4SEric Biggers !fsverity_hash_algs[num].name) {
51671e67b4SEric Biggers fsverity_warn(inode, "Unknown hash algorithm number: %u", num);
52671e67b4SEric Biggers return ERR_PTR(-EINVAL);
53671e67b4SEric Biggers }
54671e67b4SEric Biggers alg = &fsverity_hash_algs[num];
55671e67b4SEric Biggers
56439bea10SEric Biggers /* pairs with smp_store_release() below */
57439bea10SEric Biggers if (likely(smp_load_acquire(&alg->tfm) != NULL))
58671e67b4SEric Biggers return alg;
59439bea10SEric Biggers
60439bea10SEric Biggers mutex_lock(&fsverity_hash_alg_init_mutex);
61439bea10SEric Biggers
62439bea10SEric Biggers if (alg->tfm != NULL)
63439bea10SEric Biggers goto out_unlock;
64439bea10SEric Biggers
658fcd94adSEric Biggers tfm = crypto_alloc_shash(alg->name, 0, 0);
66671e67b4SEric Biggers if (IS_ERR(tfm)) {
67671e67b4SEric Biggers if (PTR_ERR(tfm) == -ENOENT) {
68671e67b4SEric Biggers fsverity_warn(inode,
69671e67b4SEric Biggers "Missing crypto API support for hash algorithm \"%s\"",
70671e67b4SEric Biggers alg->name);
71439bea10SEric Biggers alg = ERR_PTR(-ENOPKG);
72439bea10SEric Biggers goto out_unlock;
73671e67b4SEric Biggers }
74671e67b4SEric Biggers fsverity_err(inode,
75671e67b4SEric Biggers "Error allocating hash algorithm \"%s\": %ld",
76671e67b4SEric Biggers alg->name, PTR_ERR(tfm));
77439bea10SEric Biggers alg = ERR_CAST(tfm);
78439bea10SEric Biggers goto out_unlock;
79671e67b4SEric Biggers }
80671e67b4SEric Biggers
81671e67b4SEric Biggers err = -EINVAL;
828fcd94adSEric Biggers if (WARN_ON_ONCE(alg->digest_size != crypto_shash_digestsize(tfm)))
83671e67b4SEric Biggers goto err_free_tfm;
848fcd94adSEric Biggers if (WARN_ON_ONCE(alg->block_size != crypto_shash_blocksize(tfm)))
85439bea10SEric Biggers goto err_free_tfm;
86439bea10SEric Biggers
87671e67b4SEric Biggers pr_info("%s using implementation \"%s\"\n",
888fcd94adSEric Biggers alg->name, crypto_shash_driver_name(tfm));
89671e67b4SEric Biggers
90439bea10SEric Biggers /* pairs with smp_load_acquire() above */
91439bea10SEric Biggers smp_store_release(&alg->tfm, tfm);
92439bea10SEric Biggers goto out_unlock;
93671e67b4SEric Biggers
94671e67b4SEric Biggers err_free_tfm:
958fcd94adSEric Biggers crypto_free_shash(tfm);
96439bea10SEric Biggers alg = ERR_PTR(err);
97439bea10SEric Biggers out_unlock:
98439bea10SEric Biggers mutex_unlock(&fsverity_hash_alg_init_mutex);
99439bea10SEric Biggers return alg;
100439bea10SEric Biggers }
101439bea10SEric Biggers
102439bea10SEric Biggers /**
103671e67b4SEric Biggers * fsverity_prepare_hash_state() - precompute the initial hash state
104671e67b4SEric Biggers * @alg: hash algorithm
105671e67b4SEric Biggers * @salt: a salt which is to be prepended to all data to be hashed
106671e67b4SEric Biggers * @salt_size: salt size in bytes, possibly 0
107671e67b4SEric Biggers *
108671e67b4SEric Biggers * Return: NULL if the salt is empty, otherwise the kmalloc()'ed precomputed
109671e67b4SEric Biggers * initial hash state on success or an ERR_PTR() on failure.
110671e67b4SEric Biggers */
fsverity_prepare_hash_state(const struct fsverity_hash_alg * alg,const u8 * salt,size_t salt_size)11132ab3c5eSEric Biggers const u8 *fsverity_prepare_hash_state(const struct fsverity_hash_alg *alg,
112671e67b4SEric Biggers const u8 *salt, size_t salt_size)
113671e67b4SEric Biggers {
114671e67b4SEric Biggers u8 *hashstate = NULL;
1158fcd94adSEric Biggers SHASH_DESC_ON_STACK(desc, alg->tfm);
116671e67b4SEric Biggers u8 *padded_salt = NULL;
117671e67b4SEric Biggers size_t padded_salt_size;
118671e67b4SEric Biggers int err;
119671e67b4SEric Biggers
1208fcd94adSEric Biggers desc->tfm = alg->tfm;
1218fcd94adSEric Biggers
122671e67b4SEric Biggers if (salt_size == 0)
123671e67b4SEric Biggers return NULL;
124671e67b4SEric Biggers
1258fcd94adSEric Biggers hashstate = kmalloc(crypto_shash_statesize(alg->tfm), GFP_KERNEL);
126671e67b4SEric Biggers if (!hashstate)
127671e67b4SEric Biggers return ERR_PTR(-ENOMEM);
128671e67b4SEric Biggers
129671e67b4SEric Biggers /*
130671e67b4SEric Biggers * Zero-pad the salt to the next multiple of the input size of the hash
131671e67b4SEric Biggers * algorithm's compression function, e.g. 64 bytes for SHA-256 or 128
132671e67b4SEric Biggers * bytes for SHA-512. This ensures that the hash algorithm won't have
133671e67b4SEric Biggers * any bytes buffered internally after processing the salt, thus making
134671e67b4SEric Biggers * salted hashing just as fast as unsalted hashing.
135671e67b4SEric Biggers */
136671e67b4SEric Biggers padded_salt_size = round_up(salt_size, alg->block_size);
137671e67b4SEric Biggers padded_salt = kzalloc(padded_salt_size, GFP_KERNEL);
138671e67b4SEric Biggers if (!padded_salt) {
139671e67b4SEric Biggers err = -ENOMEM;
140671e67b4SEric Biggers goto err_free;
141671e67b4SEric Biggers }
142671e67b4SEric Biggers memcpy(padded_salt, salt, salt_size);
1438fcd94adSEric Biggers err = crypto_shash_init(desc);
144671e67b4SEric Biggers if (err)
145671e67b4SEric Biggers goto err_free;
146671e67b4SEric Biggers
1478fcd94adSEric Biggers err = crypto_shash_update(desc, padded_salt, padded_salt_size);
148671e67b4SEric Biggers if (err)
149671e67b4SEric Biggers goto err_free;
150671e67b4SEric Biggers
1518fcd94adSEric Biggers err = crypto_shash_export(desc, hashstate);
152671e67b4SEric Biggers if (err)
153671e67b4SEric Biggers goto err_free;
154671e67b4SEric Biggers out:
155671e67b4SEric Biggers kfree(padded_salt);
156671e67b4SEric Biggers return hashstate;
157671e67b4SEric Biggers
158671e67b4SEric Biggers err_free:
159671e67b4SEric Biggers kfree(hashstate);
160671e67b4SEric Biggers hashstate = ERR_PTR(err);
161671e67b4SEric Biggers goto out;
162671e67b4SEric Biggers }
163671e67b4SEric Biggers
164671e67b4SEric Biggers /**
165f45555bfSEric Biggers * fsverity_hash_block() - hash a single data or hash block
166671e67b4SEric Biggers * @params: the Merkle tree's parameters
167671e67b4SEric Biggers * @inode: inode for which the hashing is being done
1688fcd94adSEric Biggers * @data: virtual address of a buffer containing the block to hash
169671e67b4SEric Biggers * @out: output digest, size 'params->digest_size' bytes
170671e67b4SEric Biggers *
171f45555bfSEric Biggers * Hash a single data or hash block. The hash is salted if a salt is specified
172f45555bfSEric Biggers * in the Merkle tree parameters.
173671e67b4SEric Biggers *
174671e67b4SEric Biggers * Return: 0 on success, -errno on failure
175671e67b4SEric Biggers */
fsverity_hash_block(const struct merkle_tree_params * params,const struct inode * inode,const void * data,u8 * out)176f45555bfSEric Biggers int fsverity_hash_block(const struct merkle_tree_params *params,
1778fcd94adSEric Biggers const struct inode *inode, const void *data, u8 *out)
178671e67b4SEric Biggers {
1798fcd94adSEric Biggers SHASH_DESC_ON_STACK(desc, params->hash_alg->tfm);
180671e67b4SEric Biggers int err;
181671e67b4SEric Biggers
1828fcd94adSEric Biggers desc->tfm = params->hash_alg->tfm;
183671e67b4SEric Biggers
184671e67b4SEric Biggers if (params->hashstate) {
1858fcd94adSEric Biggers err = crypto_shash_import(desc, params->hashstate);
186671e67b4SEric Biggers if (err) {
187671e67b4SEric Biggers fsverity_err(inode,
188671e67b4SEric Biggers "Error %d importing hash state", err);
189671e67b4SEric Biggers return err;
190671e67b4SEric Biggers }
1918fcd94adSEric Biggers err = crypto_shash_finup(desc, data, params->block_size, out);
192671e67b4SEric Biggers } else {
1938fcd94adSEric Biggers err = crypto_shash_digest(desc, data, params->block_size, out);
194671e67b4SEric Biggers }
195671e67b4SEric Biggers if (err)
196f45555bfSEric Biggers fsverity_err(inode, "Error %d computing block hash", err);
197671e67b4SEric Biggers return err;
198671e67b4SEric Biggers }
199671e67b4SEric Biggers
200671e67b4SEric Biggers /**
201671e67b4SEric Biggers * fsverity_hash_buffer() - hash some data
202671e67b4SEric Biggers * @alg: the hash algorithm to use
203671e67b4SEric Biggers * @data: the data to hash
204671e67b4SEric Biggers * @size: size of data to hash, in bytes
205671e67b4SEric Biggers * @out: output digest, size 'alg->digest_size' bytes
206671e67b4SEric Biggers *
207671e67b4SEric Biggers * Return: 0 on success, -errno on failure
208671e67b4SEric Biggers */
fsverity_hash_buffer(const struct fsverity_hash_alg * alg,const void * data,size_t size,u8 * out)20932ab3c5eSEric Biggers int fsverity_hash_buffer(const struct fsverity_hash_alg *alg,
210671e67b4SEric Biggers const void *data, size_t size, u8 *out)
211671e67b4SEric Biggers {
2128fcd94adSEric Biggers return crypto_shash_tfm_digest(alg->tfm, data, size, out);
213671e67b4SEric Biggers }
214671e67b4SEric Biggers
fsverity_check_hash_algs(void)215671e67b4SEric Biggers void __init fsverity_check_hash_algs(void)
216671e67b4SEric Biggers {
217671e67b4SEric Biggers size_t i;
218671e67b4SEric Biggers
219671e67b4SEric Biggers /*
220671e67b4SEric Biggers * Sanity check the hash algorithms (could be a build-time check, but
221671e67b4SEric Biggers * they're in an array)
222671e67b4SEric Biggers */
223671e67b4SEric Biggers for (i = 0; i < ARRAY_SIZE(fsverity_hash_algs); i++) {
224671e67b4SEric Biggers const struct fsverity_hash_alg *alg = &fsverity_hash_algs[i];
225671e67b4SEric Biggers
226671e67b4SEric Biggers if (!alg->name)
227671e67b4SEric Biggers continue;
228671e67b4SEric Biggers
229*5d37a119SEric Biggers /*
230*5d37a119SEric Biggers * 0 must never be allocated as an FS_VERITY_HASH_ALG_* value,
231*5d37a119SEric Biggers * as it is reserved for users that use 0 to mean unspecified or
232*5d37a119SEric Biggers * a default value. fs/verity/ itself doesn't care and doesn't
233*5d37a119SEric Biggers * have a default algorithm, but some users make use of this.
234*5d37a119SEric Biggers */
235*5d37a119SEric Biggers BUG_ON(i == 0);
236*5d37a119SEric Biggers
237671e67b4SEric Biggers BUG_ON(alg->digest_size > FS_VERITY_MAX_DIGEST_SIZE);
238671e67b4SEric Biggers
239671e67b4SEric Biggers /*
240671e67b4SEric Biggers * For efficiency, the implementation currently assumes the
241671e67b4SEric Biggers * digest and block sizes are powers of 2. This limitation can
242671e67b4SEric Biggers * be lifted if the code is updated to handle other values.
243671e67b4SEric Biggers */
244671e67b4SEric Biggers BUG_ON(!is_power_of_2(alg->digest_size));
245671e67b4SEric Biggers BUG_ON(!is_power_of_2(alg->block_size));
246a4bbf53dSEric Biggers
247a4bbf53dSEric Biggers /* Verify that there is a valid mapping to HASH_ALGO_*. */
248a4bbf53dSEric Biggers BUG_ON(alg->algo_id == 0);
249a4bbf53dSEric Biggers BUG_ON(alg->digest_size != hash_digest_size[alg->algo_id]);
250671e67b4SEric Biggers }
251671e67b4SEric Biggers }
252