Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Ioctl to enable verity on a file
4 *
5 * Copyright 2019 Google LLC
6 */
7
8#include "fsverity_private.h"
9
10#include <crypto/hash.h>
11#include <linux/mount.h>
12#include <linux/sched/signal.h>
13#include <linux/uaccess.h>
14
15struct block_buffer {
16 u32 filled;
17 bool is_root_hash;
18 u8 *data;
19};
20
21/* Hash a block, writing the result to the next level's pending block buffer. */
22static int hash_one_block(struct inode *inode,
23 const struct merkle_tree_params *params,
24 struct block_buffer *cur)
25{
26 struct block_buffer *next = cur + 1;
27 int err;
28
29 /*
30 * Safety check to prevent a buffer overflow in case of a filesystem bug
31 * that allows the file size to change despite deny_write_access(), or a
32 * bug in the Merkle tree logic itself
33 */
34 if (WARN_ON_ONCE(next->is_root_hash && next->filled != 0))
35 return -EINVAL;
36
37 /* Zero-pad the block if it's shorter than the block size. */
38 memset(&cur->data[cur->filled], 0, params->block_size - cur->filled);
39
40 err = fsverity_hash_block(params, inode, cur->data,
41 &next->data[next->filled]);
42 if (err)
43 return err;
44 next->filled += params->digest_size;
45 cur->filled = 0;
46 return 0;
47}
48
49static int write_merkle_tree_block(struct inode *inode, const u8 *buf,
50 unsigned long index,
51 const struct merkle_tree_params *params)
52{
53 u64 pos = (u64)index << params->log_blocksize;
54 int err;
55
56 err = inode->i_sb->s_vop->write_merkle_tree_block(inode, buf, pos,
57 params->block_size);
58 if (err)
59 fsverity_err(inode, "Error %d writing Merkle tree block %lu",
60 err, index);
61 return err;
62}
63
64/*
65 * Build the Merkle tree for the given file using the given parameters, and
66 * return the root hash in @root_hash.
67 *
68 * The tree is written to a filesystem-specific location as determined by the
69 * ->write_merkle_tree_block() method. However, the blocks that comprise the
70 * tree are the same for all filesystems.
71 */
72static int build_merkle_tree(struct file *filp,
73 const struct merkle_tree_params *params,
74 u8 *root_hash)
75{
76 struct inode *inode = file_inode(filp);
77 const u64 data_size = inode->i_size;
78 const int num_levels = params->num_levels;
79 struct block_buffer _buffers[1 + FS_VERITY_MAX_LEVELS + 1] = {};
80 struct block_buffer *buffers = &_buffers[1];
81 unsigned long level_offset[FS_VERITY_MAX_LEVELS];
82 int level;
83 u64 offset;
84 int err;
85
86 if (data_size == 0) {
87 /* Empty file is a special case; root hash is all 0's */
88 memset(root_hash, 0, params->digest_size);
89 return 0;
90 }
91
92 /*
93 * Allocate the block buffers. Buffer "-1" is for data blocks.
94 * Buffers 0 <= level < num_levels are for the actual tree levels.
95 * Buffer 'num_levels' is for the root hash.
96 */
97 for (level = -1; level < num_levels; level++) {
98 buffers[level].data = kzalloc(params->block_size, GFP_KERNEL);
99 if (!buffers[level].data) {
100 err = -ENOMEM;
101 goto out;
102 }
103 }
104 buffers[num_levels].data = root_hash;
105 buffers[num_levels].is_root_hash = true;
106
107 BUILD_BUG_ON(sizeof(level_offset) != sizeof(params->level_start));
108 memcpy(level_offset, params->level_start, sizeof(level_offset));
109
110 /* Hash each data block, also hashing the tree blocks as they fill up */
111 for (offset = 0; offset < data_size; offset += params->block_size) {
112 ssize_t bytes_read;
113 loff_t pos = offset;
114
115 buffers[-1].filled = min_t(u64, params->block_size,
116 data_size - offset);
117 bytes_read = __kernel_read(filp, buffers[-1].data,
118 buffers[-1].filled, &pos);
119 if (bytes_read < 0) {
120 err = bytes_read;
121 fsverity_err(inode, "Error %d reading file data", err);
122 goto out;
123 }
124 if (bytes_read != buffers[-1].filled) {
125 err = -EINVAL;
126 fsverity_err(inode, "Short read of file data");
127 goto out;
128 }
129 err = hash_one_block(inode, params, &buffers[-1]);
130 if (err)
131 goto out;
132 for (level = 0; level < num_levels; level++) {
133 if (buffers[level].filled + params->digest_size <=
134 params->block_size) {
135 /* Next block at @level isn't full yet */
136 break;
137 }
138 /* Next block at @level is full */
139
140 err = hash_one_block(inode, params, &buffers[level]);
141 if (err)
142 goto out;
143 err = write_merkle_tree_block(inode,
144 buffers[level].data,
145 level_offset[level],
146 params);
147 if (err)
148 goto out;
149 level_offset[level]++;
150 }
151 if (fatal_signal_pending(current)) {
152 err = -EINTR;
153 goto out;
154 }
155 cond_resched();
156 }
157 /* Finish all nonempty pending tree blocks. */
158 for (level = 0; level < num_levels; level++) {
159 if (buffers[level].filled != 0) {
160 err = hash_one_block(inode, params, &buffers[level]);
161 if (err)
162 goto out;
163 err = write_merkle_tree_block(inode,
164 buffers[level].data,
165 level_offset[level],
166 params);
167 if (err)
168 goto out;
169 }
170 }
171 /* The root hash was filled by the last call to hash_one_block(). */
172 if (WARN_ON_ONCE(buffers[num_levels].filled != params->digest_size)) {
173 err = -EINVAL;
174 goto out;
175 }
176 err = 0;
177out:
178 for (level = -1; level < num_levels; level++)
179 kfree(buffers[level].data);
180 return err;
181}
182
183static int enable_verity(struct file *filp,
184 const struct fsverity_enable_arg *arg)
185{
186 struct inode *inode = file_inode(filp);
187 const struct fsverity_operations *vops = inode->i_sb->s_vop;
188 struct merkle_tree_params params = { };
189 struct fsverity_descriptor *desc;
190 size_t desc_size = struct_size(desc, signature, arg->sig_size);
191 struct fsverity_info *vi;
192 int err;
193
194 /* Start initializing the fsverity_descriptor */
195 desc = kzalloc(desc_size, GFP_KERNEL);
196 if (!desc)
197 return -ENOMEM;
198 desc->version = 1;
199 desc->hash_algorithm = arg->hash_algorithm;
200 desc->log_blocksize = ilog2(arg->block_size);
201
202 /* Get the salt if the user provided one */
203 if (arg->salt_size &&
204 copy_from_user(desc->salt, u64_to_user_ptr(arg->salt_ptr),
205 arg->salt_size)) {
206 err = -EFAULT;
207 goto out;
208 }
209 desc->salt_size = arg->salt_size;
210
211 /* Get the builtin signature if the user provided one */
212 if (arg->sig_size &&
213 copy_from_user(desc->signature, u64_to_user_ptr(arg->sig_ptr),
214 arg->sig_size)) {
215 err = -EFAULT;
216 goto out;
217 }
218 desc->sig_size = cpu_to_le32(arg->sig_size);
219
220 desc->data_size = cpu_to_le64(inode->i_size);
221
222 /* Prepare the Merkle tree parameters */
223 err = fsverity_init_merkle_tree_params(¶ms, inode,
224 arg->hash_algorithm,
225 desc->log_blocksize,
226 desc->salt, desc->salt_size);
227 if (err)
228 goto out;
229
230 /*
231 * Start enabling verity on this file, serialized by the inode lock.
232 * Fail if verity is already enabled or is already being enabled.
233 */
234 inode_lock(inode);
235 if (IS_VERITY(inode))
236 err = -EEXIST;
237 else
238 err = vops->begin_enable_verity(filp);
239 inode_unlock(inode);
240 if (err)
241 goto out;
242
243 /*
244 * Build the Merkle tree. Don't hold the inode lock during this, since
245 * on huge files this may take a very long time and we don't want to
246 * force unrelated syscalls like chown() to block forever. We don't
247 * need the inode lock here because deny_write_access() already prevents
248 * the file from being written to or truncated, and we still serialize
249 * ->begin_enable_verity() and ->end_enable_verity() using the inode
250 * lock and only allow one process to be here at a time on a given file.
251 */
252 BUILD_BUG_ON(sizeof(desc->root_hash) < FS_VERITY_MAX_DIGEST_SIZE);
253 err = build_merkle_tree(filp, ¶ms, desc->root_hash);
254 if (err) {
255 fsverity_err(inode, "Error %d building Merkle tree", err);
256 goto rollback;
257 }
258
259 /*
260 * Create the fsverity_info. Don't bother trying to save work by
261 * reusing the merkle_tree_params from above. Instead, just create the
262 * fsverity_info from the fsverity_descriptor as if it were just loaded
263 * from disk. This is simpler, and it serves as an extra check that the
264 * metadata we're writing is valid before actually enabling verity.
265 */
266 vi = fsverity_create_info(inode, desc);
267 if (IS_ERR(vi)) {
268 err = PTR_ERR(vi);
269 goto rollback;
270 }
271
272 /*
273 * Tell the filesystem to finish enabling verity on the file.
274 * Serialized with ->begin_enable_verity() by the inode lock.
275 */
276 inode_lock(inode);
277 err = vops->end_enable_verity(filp, desc, desc_size, params.tree_size);
278 inode_unlock(inode);
279 if (err) {
280 fsverity_err(inode, "%ps() failed with err %d",
281 vops->end_enable_verity, err);
282 fsverity_free_info(vi);
283 } else if (WARN_ON_ONCE(!IS_VERITY(inode))) {
284 err = -EINVAL;
285 fsverity_free_info(vi);
286 } else {
287 /* Successfully enabled verity */
288
289 /*
290 * Readers can start using ->i_verity_info immediately, so it
291 * can't be rolled back once set. So don't set it until just
292 * after the filesystem has successfully enabled verity.
293 */
294 fsverity_set_info(inode, vi);
295 }
296out:
297 kfree(params.hashstate);
298 kfree(desc);
299 return err;
300
301rollback:
302 inode_lock(inode);
303 (void)vops->end_enable_verity(filp, NULL, 0, params.tree_size);
304 inode_unlock(inode);
305 goto out;
306}
307
308/**
309 * fsverity_ioctl_enable() - enable verity on a file
310 * @filp: file to enable verity on
311 * @uarg: user pointer to fsverity_enable_arg
312 *
313 * Enable fs-verity on a file. See the "FS_IOC_ENABLE_VERITY" section of
314 * Documentation/filesystems/fsverity.rst for the documentation.
315 *
316 * Return: 0 on success, -errno on failure
317 */
318int fsverity_ioctl_enable(struct file *filp, const void __user *uarg)
319{
320 struct inode *inode = file_inode(filp);
321 struct fsverity_enable_arg arg;
322 int err;
323
324 if (copy_from_user(&arg, uarg, sizeof(arg)))
325 return -EFAULT;
326
327 if (arg.version != 1)
328 return -EINVAL;
329
330 if (arg.__reserved1 ||
331 memchr_inv(arg.__reserved2, 0, sizeof(arg.__reserved2)))
332 return -EINVAL;
333
334 if (!is_power_of_2(arg.block_size))
335 return -EINVAL;
336
337 if (arg.salt_size > sizeof_field(struct fsverity_descriptor, salt))
338 return -EMSGSIZE;
339
340 if (arg.sig_size > FS_VERITY_MAX_SIGNATURE_SIZE)
341 return -EMSGSIZE;
342
343 /*
344 * Require a regular file with write access. But the actual fd must
345 * still be readonly so that we can lock out all writers. This is
346 * needed to guarantee that no writable fds exist to the file once it
347 * has verity enabled, and to stabilize the data being hashed.
348 */
349
350 err = file_permission(filp, MAY_WRITE);
351 if (err)
352 return err;
353 /*
354 * __kernel_read() is used while building the Merkle tree. So, we can't
355 * allow file descriptors that were opened for ioctl access only, using
356 * the special nonstandard access mode 3. O_RDONLY only, please!
357 */
358 if (!(filp->f_mode & FMODE_READ))
359 return -EBADF;
360
361 if (IS_APPEND(inode))
362 return -EPERM;
363
364 if (S_ISDIR(inode->i_mode))
365 return -EISDIR;
366
367 if (!S_ISREG(inode->i_mode))
368 return -EINVAL;
369
370 err = mnt_want_write_file(filp);
371 if (err) /* -EROFS */
372 return err;
373
374 err = deny_write_access(filp);
375 if (err) /* -ETXTBSY */
376 goto out_drop_write;
377
378 err = enable_verity(filp, &arg);
379
380 /*
381 * We no longer drop the inode's pagecache after enabling verity. This
382 * used to be done to try to avoid a race condition where pages could be
383 * evicted after being used in the Merkle tree construction, then
384 * re-instantiated by a concurrent read. Such pages are unverified, and
385 * the backing storage could have filled them with different content, so
386 * they shouldn't be used to fulfill reads once verity is enabled.
387 *
388 * But, dropping the pagecache has a big performance impact, and it
389 * doesn't fully solve the race condition anyway. So for those reasons,
390 * and also because this race condition isn't very important relatively
391 * speaking (especially for small-ish files, where the chance of a page
392 * being used, evicted, *and* re-instantiated all while enabling verity
393 * is quite small), we no longer drop the inode's pagecache.
394 */
395
396 /*
397 * allow_write_access() is needed to pair with deny_write_access().
398 * Regardless, the filesystem won't allow writing to verity files.
399 */
400 allow_write_access(filp);
401out_drop_write:
402 mnt_drop_write_file(filp);
403 return err;
404}
405EXPORT_SYMBOL_GPL(fsverity_ioctl_enable);
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Ioctl to enable verity on a file
4 *
5 * Copyright 2019 Google LLC
6 */
7
8#include "fsverity_private.h"
9
10#include <crypto/hash.h>
11#include <linux/backing-dev.h>
12#include <linux/mount.h>
13#include <linux/pagemap.h>
14#include <linux/sched/signal.h>
15#include <linux/uaccess.h>
16
17/*
18 * Read a file data page for Merkle tree construction. Do aggressive readahead,
19 * since we're sequentially reading the entire file.
20 */
21static struct page *read_file_data_page(struct file *file, pgoff_t index,
22 struct file_ra_state *ra,
23 unsigned long remaining_pages)
24{
25 DEFINE_READAHEAD(ractl, file, ra, file->f_mapping, index);
26 struct folio *folio;
27
28 folio = __filemap_get_folio(ractl.mapping, index, FGP_ACCESSED, 0);
29 if (!folio || !folio_test_uptodate(folio)) {
30 if (folio)
31 folio_put(folio);
32 else
33 page_cache_sync_ra(&ractl, remaining_pages);
34 folio = read_cache_folio(ractl.mapping, index, NULL, file);
35 if (IS_ERR(folio))
36 return &folio->page;
37 }
38 if (folio_test_readahead(folio))
39 page_cache_async_ra(&ractl, folio, remaining_pages);
40 return folio_file_page(folio, index);
41}
42
43static int build_merkle_tree_level(struct file *filp, unsigned int level,
44 u64 num_blocks_to_hash,
45 const struct merkle_tree_params *params,
46 u8 *pending_hashes,
47 struct ahash_request *req)
48{
49 struct inode *inode = file_inode(filp);
50 const struct fsverity_operations *vops = inode->i_sb->s_vop;
51 struct file_ra_state ra = { 0 };
52 unsigned int pending_size = 0;
53 u64 dst_block_num;
54 u64 i;
55 int err;
56
57 if (WARN_ON(params->block_size != PAGE_SIZE)) /* checked earlier too */
58 return -EINVAL;
59
60 if (level < params->num_levels) {
61 dst_block_num = params->level_start[level];
62 } else {
63 if (WARN_ON(num_blocks_to_hash != 1))
64 return -EINVAL;
65 dst_block_num = 0; /* unused */
66 }
67
68 file_ra_state_init(&ra, filp->f_mapping);
69
70 for (i = 0; i < num_blocks_to_hash; i++) {
71 struct page *src_page;
72
73 if ((pgoff_t)i % 10000 == 0 || i + 1 == num_blocks_to_hash)
74 pr_debug("Hashing block %llu of %llu for level %u\n",
75 i + 1, num_blocks_to_hash, level);
76
77 if (level == 0) {
78 /* Leaf: hashing a data block */
79 src_page = read_file_data_page(filp, i, &ra,
80 num_blocks_to_hash - i);
81 if (IS_ERR(src_page)) {
82 err = PTR_ERR(src_page);
83 fsverity_err(inode,
84 "Error %d reading data page %llu",
85 err, i);
86 return err;
87 }
88 } else {
89 unsigned long num_ra_pages =
90 min_t(unsigned long, num_blocks_to_hash - i,
91 inode->i_sb->s_bdi->io_pages);
92
93 /* Non-leaf: hashing hash block from level below */
94 src_page = vops->read_merkle_tree_page(inode,
95 params->level_start[level - 1] + i,
96 num_ra_pages);
97 if (IS_ERR(src_page)) {
98 err = PTR_ERR(src_page);
99 fsverity_err(inode,
100 "Error %d reading Merkle tree page %llu",
101 err, params->level_start[level - 1] + i);
102 return err;
103 }
104 }
105
106 err = fsverity_hash_page(params, inode, req, src_page,
107 &pending_hashes[pending_size]);
108 put_page(src_page);
109 if (err)
110 return err;
111 pending_size += params->digest_size;
112
113 if (level == params->num_levels) /* Root hash? */
114 return 0;
115
116 if (pending_size + params->digest_size > params->block_size ||
117 i + 1 == num_blocks_to_hash) {
118 /* Flush the pending hash block */
119 memset(&pending_hashes[pending_size], 0,
120 params->block_size - pending_size);
121 err = vops->write_merkle_tree_block(inode,
122 pending_hashes,
123 dst_block_num,
124 params->log_blocksize);
125 if (err) {
126 fsverity_err(inode,
127 "Error %d writing Merkle tree block %llu",
128 err, dst_block_num);
129 return err;
130 }
131 dst_block_num++;
132 pending_size = 0;
133 }
134
135 if (fatal_signal_pending(current))
136 return -EINTR;
137 cond_resched();
138 }
139 return 0;
140}
141
142/*
143 * Build the Merkle tree for the given file using the given parameters, and
144 * return the root hash in @root_hash.
145 *
146 * The tree is written to a filesystem-specific location as determined by the
147 * ->write_merkle_tree_block() method. However, the blocks that comprise the
148 * tree are the same for all filesystems.
149 */
150static int build_merkle_tree(struct file *filp,
151 const struct merkle_tree_params *params,
152 u8 *root_hash)
153{
154 struct inode *inode = file_inode(filp);
155 u8 *pending_hashes;
156 struct ahash_request *req;
157 u64 blocks;
158 unsigned int level;
159 int err = -ENOMEM;
160
161 if (inode->i_size == 0) {
162 /* Empty file is a special case; root hash is all 0's */
163 memset(root_hash, 0, params->digest_size);
164 return 0;
165 }
166
167 /* This allocation never fails, since it's mempool-backed. */
168 req = fsverity_alloc_hash_request(params->hash_alg, GFP_KERNEL);
169
170 pending_hashes = kmalloc(params->block_size, GFP_KERNEL);
171 if (!pending_hashes)
172 goto out;
173
174 /*
175 * Build each level of the Merkle tree, starting at the leaf level
176 * (level 0) and ascending to the root node (level 'num_levels - 1').
177 * Then at the end (level 'num_levels'), calculate the root hash.
178 */
179 blocks = ((u64)inode->i_size + params->block_size - 1) >>
180 params->log_blocksize;
181 for (level = 0; level <= params->num_levels; level++) {
182 err = build_merkle_tree_level(filp, level, blocks, params,
183 pending_hashes, req);
184 if (err)
185 goto out;
186 blocks = (blocks + params->hashes_per_block - 1) >>
187 params->log_arity;
188 }
189 memcpy(root_hash, pending_hashes, params->digest_size);
190 err = 0;
191out:
192 kfree(pending_hashes);
193 fsverity_free_hash_request(params->hash_alg, req);
194 return err;
195}
196
197static int enable_verity(struct file *filp,
198 const struct fsverity_enable_arg *arg)
199{
200 struct inode *inode = file_inode(filp);
201 const struct fsverity_operations *vops = inode->i_sb->s_vop;
202 struct merkle_tree_params params = { };
203 struct fsverity_descriptor *desc;
204 size_t desc_size = struct_size(desc, signature, arg->sig_size);
205 struct fsverity_info *vi;
206 int err;
207
208 /* Start initializing the fsverity_descriptor */
209 desc = kzalloc(desc_size, GFP_KERNEL);
210 if (!desc)
211 return -ENOMEM;
212 desc->version = 1;
213 desc->hash_algorithm = arg->hash_algorithm;
214 desc->log_blocksize = ilog2(arg->block_size);
215
216 /* Get the salt if the user provided one */
217 if (arg->salt_size &&
218 copy_from_user(desc->salt, u64_to_user_ptr(arg->salt_ptr),
219 arg->salt_size)) {
220 err = -EFAULT;
221 goto out;
222 }
223 desc->salt_size = arg->salt_size;
224
225 /* Get the signature if the user provided one */
226 if (arg->sig_size &&
227 copy_from_user(desc->signature, u64_to_user_ptr(arg->sig_ptr),
228 arg->sig_size)) {
229 err = -EFAULT;
230 goto out;
231 }
232 desc->sig_size = cpu_to_le32(arg->sig_size);
233
234 desc->data_size = cpu_to_le64(inode->i_size);
235
236 /* Prepare the Merkle tree parameters */
237 err = fsverity_init_merkle_tree_params(¶ms, inode,
238 arg->hash_algorithm,
239 desc->log_blocksize,
240 desc->salt, desc->salt_size);
241 if (err)
242 goto out;
243
244 /*
245 * Start enabling verity on this file, serialized by the inode lock.
246 * Fail if verity is already enabled or is already being enabled.
247 */
248 inode_lock(inode);
249 if (IS_VERITY(inode))
250 err = -EEXIST;
251 else
252 err = vops->begin_enable_verity(filp);
253 inode_unlock(inode);
254 if (err)
255 goto out;
256
257 /*
258 * Build the Merkle tree. Don't hold the inode lock during this, since
259 * on huge files this may take a very long time and we don't want to
260 * force unrelated syscalls like chown() to block forever. We don't
261 * need the inode lock here because deny_write_access() already prevents
262 * the file from being written to or truncated, and we still serialize
263 * ->begin_enable_verity() and ->end_enable_verity() using the inode
264 * lock and only allow one process to be here at a time on a given file.
265 */
266 pr_debug("Building Merkle tree...\n");
267 BUILD_BUG_ON(sizeof(desc->root_hash) < FS_VERITY_MAX_DIGEST_SIZE);
268 err = build_merkle_tree(filp, ¶ms, desc->root_hash);
269 if (err) {
270 fsverity_err(inode, "Error %d building Merkle tree", err);
271 goto rollback;
272 }
273 pr_debug("Done building Merkle tree. Root hash is %s:%*phN\n",
274 params.hash_alg->name, params.digest_size, desc->root_hash);
275
276 /*
277 * Create the fsverity_info. Don't bother trying to save work by
278 * reusing the merkle_tree_params from above. Instead, just create the
279 * fsverity_info from the fsverity_descriptor as if it were just loaded
280 * from disk. This is simpler, and it serves as an extra check that the
281 * metadata we're writing is valid before actually enabling verity.
282 */
283 vi = fsverity_create_info(inode, desc);
284 if (IS_ERR(vi)) {
285 err = PTR_ERR(vi);
286 goto rollback;
287 }
288
289 if (arg->sig_size)
290 pr_debug("Storing a %u-byte PKCS#7 signature alongside the file\n",
291 arg->sig_size);
292
293 /*
294 * Tell the filesystem to finish enabling verity on the file.
295 * Serialized with ->begin_enable_verity() by the inode lock.
296 */
297 inode_lock(inode);
298 err = vops->end_enable_verity(filp, desc, desc_size, params.tree_size);
299 inode_unlock(inode);
300 if (err) {
301 fsverity_err(inode, "%ps() failed with err %d",
302 vops->end_enable_verity, err);
303 fsverity_free_info(vi);
304 } else if (WARN_ON(!IS_VERITY(inode))) {
305 err = -EINVAL;
306 fsverity_free_info(vi);
307 } else {
308 /* Successfully enabled verity */
309
310 /*
311 * Readers can start using ->i_verity_info immediately, so it
312 * can't be rolled back once set. So don't set it until just
313 * after the filesystem has successfully enabled verity.
314 */
315 fsverity_set_info(inode, vi);
316 }
317out:
318 kfree(params.hashstate);
319 kfree(desc);
320 return err;
321
322rollback:
323 inode_lock(inode);
324 (void)vops->end_enable_verity(filp, NULL, 0, params.tree_size);
325 inode_unlock(inode);
326 goto out;
327}
328
329/**
330 * fsverity_ioctl_enable() - enable verity on a file
331 * @filp: file to enable verity on
332 * @uarg: user pointer to fsverity_enable_arg
333 *
334 * Enable fs-verity on a file. See the "FS_IOC_ENABLE_VERITY" section of
335 * Documentation/filesystems/fsverity.rst for the documentation.
336 *
337 * Return: 0 on success, -errno on failure
338 */
339int fsverity_ioctl_enable(struct file *filp, const void __user *uarg)
340{
341 struct inode *inode = file_inode(filp);
342 struct fsverity_enable_arg arg;
343 int err;
344
345 if (copy_from_user(&arg, uarg, sizeof(arg)))
346 return -EFAULT;
347
348 if (arg.version != 1)
349 return -EINVAL;
350
351 if (arg.__reserved1 ||
352 memchr_inv(arg.__reserved2, 0, sizeof(arg.__reserved2)))
353 return -EINVAL;
354
355 if (arg.block_size != PAGE_SIZE)
356 return -EINVAL;
357
358 if (arg.salt_size > sizeof_field(struct fsverity_descriptor, salt))
359 return -EMSGSIZE;
360
361 if (arg.sig_size > FS_VERITY_MAX_SIGNATURE_SIZE)
362 return -EMSGSIZE;
363
364 /*
365 * Require a regular file with write access. But the actual fd must
366 * still be readonly so that we can lock out all writers. This is
367 * needed to guarantee that no writable fds exist to the file once it
368 * has verity enabled, and to stabilize the data being hashed.
369 */
370
371 err = file_permission(filp, MAY_WRITE);
372 if (err)
373 return err;
374
375 if (IS_APPEND(inode))
376 return -EPERM;
377
378 if (S_ISDIR(inode->i_mode))
379 return -EISDIR;
380
381 if (!S_ISREG(inode->i_mode))
382 return -EINVAL;
383
384 err = mnt_want_write_file(filp);
385 if (err) /* -EROFS */
386 return err;
387
388 err = deny_write_access(filp);
389 if (err) /* -ETXTBSY */
390 goto out_drop_write;
391
392 err = enable_verity(filp, &arg);
393 if (err)
394 goto out_allow_write_access;
395
396 /*
397 * Some pages of the file may have been evicted from pagecache after
398 * being used in the Merkle tree construction, then read into pagecache
399 * again by another process reading from the file concurrently. Since
400 * these pages didn't undergo verification against the file digest which
401 * fs-verity now claims to be enforcing, we have to wipe the pagecache
402 * to ensure that all future reads are verified.
403 */
404 filemap_write_and_wait(inode->i_mapping);
405 invalidate_inode_pages2(inode->i_mapping);
406
407 /*
408 * allow_write_access() is needed to pair with deny_write_access().
409 * Regardless, the filesystem won't allow writing to verity files.
410 */
411out_allow_write_access:
412 allow_write_access(filp);
413out_drop_write:
414 mnt_drop_write_file(filp);
415 return err;
416}
417EXPORT_SYMBOL_GPL(fsverity_ioctl_enable);