Commit 14605409 authored by Boris Burkov's avatar Boris Burkov Committed by David Sterba
Browse files

btrfs: initial fsverity support 



Add support for fsverity in btrfs. To support the generic interface in
fs/verity, we add two new item types in the fs tree for inodes with
verity enabled. One stores the per-file verity descriptor and btrfs
verity item and the other stores the Merkle tree data itself.

Verity checking is done in end_page_read just before a page is marked
uptodate. This naturally handles a variety of edge cases like holes,
preallocated extents, and inline extents. Some care needs to be taken to
not try to verity pages past the end of the file, which are accessed by
the generic buffered file reading code under some circumstances like
reading to the end of the last page and trying to read again. Direct IO
on a verity file falls back to buffered reads.

Verity relies on PageChecked for the Merkle tree data itself to avoid
re-walking up shared paths in the tree. For this reason, we need to
cache the Merkle tree data. Since the file is immutable after verity is
turned on, we can cache it at an index past EOF.

Use the new inode ro_flags to store verity on the inode item, so that we
can enable verity on a file, then rollback to an older kernel and still
mount the file system and read the file. Since we can't safely write the
file anymore without ruining the invariants of the Merkle tree, we mark
a ro_compat flag on the file system when a file has verity enabled.

Acked-by: default avatarEric Biggers <ebiggers@google.com>
Co-developed-by: default avatarChris Mason <clm@fb.com>
Signed-off-by: default avatarChris Mason <clm@fb.com>
Signed-off-by: default avatarBoris Burkov <boris@bur.io>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 77eea05e

fs/btrfs/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ btrfs-$(CONFIG_BTRFS_FS_POSIX_ACL) += acl.o 
btrfs-$(CONFIG_BTRFS_FS_CHECK_INTEGRITY) += check-integrity.o

btrfs-$(CONFIG_BTRFS_FS_REF_VERIFY) += ref-verify.o

btrfs-$(CONFIG_BLK_DEV_ZONED) += zoned.o

btrfs-$(CONFIG_FS_VERITY) += verity.o



btrfs-$(CONFIG_BTRFS_FS_RUN_SANITY_TESTS) += tests/free-space-tests.o \

	tests/extent-buffer-tests.o tests/btrfs-tests.o \

fs/btrfs/btrfs_inode.h

+7 −0
Original line number Diff line number Diff line
@@ -51,6 +51,13 @@ enum { 
	 * the file range, inode's io_tree).

	 */

	BTRFS_INODE_NO_DELALLOC_FLUSH,

	/*

	 * Set when we are working on enabling verity for a file. Computing and

	 * writing the whole Merkle tree can take a while so we want to prevent

	 * races where two separate tasks attempt to simultaneously start verity

	 * on the same file.

	 */

	BTRFS_INODE_VERITY_IN_PROGRESS,

};



/* in memory btrfs inode */

fs/btrfs/ctree.h

+29 −2
Original line number Diff line number Diff line
@@ -281,7 +281,8 @@ struct btrfs_super_block { 


#define BTRFS_FEATURE_COMPAT_RO_SUPP			\

	(BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE |	\

	 BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE_VALID)

	 BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE_VALID | \

	 BTRFS_FEATURE_COMPAT_RO_VERITY)



#define BTRFS_FEATURE_COMPAT_RO_SAFE_SET	0ULL

#define BTRFS_FEATURE_COMPAT_RO_SAFE_CLEAR	0ULL
@@ -1512,7 +1513,9 @@ do { \ 
	 BTRFS_INODE_COMPRESS |						\

	 BTRFS_INODE_ROOT_ITEM_INIT)



#define BTRFS_INODE_RO_FLAG_MASK					(0)

#define BTRFS_INODE_RO_VERITY		(1U << 0)



#define BTRFS_INODE_RO_FLAG_MASK	(BTRFS_INODE_RO_VERITY)



struct btrfs_map_token {

	struct extent_buffer *eb;
@@ -3791,6 +3794,30 @@ static inline int btrfs_defrag_cancelled(struct btrfs_fs_info *fs_info) 
	return signal_pending(current);

}



/* verity.c */

#ifdef CONFIG_FS_VERITY



extern const struct fsverity_operations btrfs_verityops;

int btrfs_drop_verity_items(struct btrfs_inode *inode);



BTRFS_SETGET_FUNCS(verity_descriptor_encryption, struct btrfs_verity_descriptor_item,

		   encryption, 8);

BTRFS_SETGET_FUNCS(verity_descriptor_size, struct btrfs_verity_descriptor_item,

		   size, 64);

BTRFS_SETGET_STACK_FUNCS(stack_verity_descriptor_encryption,

			 struct btrfs_verity_descriptor_item, encryption, 8);

BTRFS_SETGET_STACK_FUNCS(stack_verity_descriptor_size,

			 struct btrfs_verity_descriptor_item, size, 64);



#else



static inline int btrfs_drop_verity_items(struct btrfs_inode *inode)

{

	return 0;

}



#endif



/* Sanity test specific functions */

#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS

void btrfs_test_destroy_inode(struct inode *inode);

fs/btrfs/extent_io.c

+11 −15
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
#include <linux/pagevec.h>

#include <linux/prefetch.h>

#include <linux/cleancache.h>

#include <linux/fsverity.h>

#include "misc.h"

#include "extent_io.h"

#include "extent-io-tree.h"
@@ -2247,18 +2248,6 @@ int test_range_bit(struct extent_io_tree *tree, u64 start, u64 end, 
	return bitset;

}



/*

 * helper function to set a given page up to date if all the

 * extents in the tree for that page are up to date

 */

static void check_page_uptodate(struct extent_io_tree *tree, struct page *page)

{

	u64 start = page_offset(page);

	u64 end = start + PAGE_SIZE - 1;

	if (test_range_bit(tree, start, end, EXTENT_UPTODATE, 1, NULL))

		SetPageUptodate(page);

}



int free_io_failure(struct extent_io_tree *failure_tree,

		    struct extent_io_tree *io_tree,

		    struct io_failure_record *rec)
@@ -2690,7 +2679,15 @@ static void end_page_read(struct page *page, bool uptodate, u64 start, u32 len) 
	       start + len <= page_offset(page) + PAGE_SIZE);



	if (uptodate) {

		if (fsverity_active(page->mapping->host) &&

		    !PageError(page) &&

		    !PageUptodate(page) &&

		    start < i_size_read(page->mapping->host) &&

		    !fsverity_verify_page(page)) {

			btrfs_page_set_error(fs_info, page, start, len);

		} else {

			btrfs_page_set_uptodate(fs_info, page, start, len);

		}

	} else {

		btrfs_page_clear_uptodate(fs_info, page, start, len);

		btrfs_page_set_error(fs_info, page, start, len);
@@ -3105,7 +3102,7 @@ static void end_bio_extent_readpage(struct bio *bio) 
		/* Update page status and unlock */

		end_page_read(page, uptodate, start, len);

		endio_readpage_release_extent(&processed, BTRFS_I(inode),

					      start, end, uptodate);

					      start, end, PageUptodate(page));

	}

	/* Release the last extent */

	endio_readpage_release_extent(&processed, NULL, 0, 0, false);
@@ -3706,7 +3703,6 @@ int btrfs_do_readpage(struct page *page, struct extent_map **em_cached, 
		/* the get_extent function already copied into the page */

		if (test_range_bit(tree, cur, cur_end,

				   EXTENT_UPTODATE, 1, NULL)) {

			check_page_uptodate(tree, page);

			unlock_extent(tree, cur, cur + iosize - 1);

			end_page_read(page, true, cur, iosize);

			cur = cur + iosize;

fs/btrfs/file.c

+10 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 
#include <linux/btrfs.h>

#include <linux/uio.h>

#include <linux/iversion.h>

#include <linux/fsverity.h>

#include "ctree.h"

#include "disk-io.h"

#include "transaction.h"
@@ -3615,7 +3616,13 @@ static loff_t btrfs_file_llseek(struct file *file, loff_t offset, int whence) 


static int btrfs_file_open(struct inode *inode, struct file *filp)

{

	int ret;



	filp->f_mode |= FMODE_NOWAIT | FMODE_BUF_RASYNC;



	ret = fsverity_file_open(inode, filp);

	if (ret)

		return ret;

	return generic_file_open(inode, filp);

}
@@ -3644,6 +3651,9 @@ static ssize_t btrfs_direct_read(struct kiocb *iocb, struct iov_iter *to) 
	struct inode *inode = file_inode(iocb->ki_filp);

	ssize_t ret;



	if (fsverity_active(inode))

		return 0;



	if (check_direct_read(btrfs_sb(inode->i_sb), to, iocb->ki_pos))

		return 0;