Orange Pi5 kernel

^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   3)  * Ioctl to read verity metadata
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   4)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   5)  * Copyright 2021 Google LLC
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   6)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   7) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   8) #include "fsverity_private.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   9) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  10) #include <linux/backing-dev.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  11) #include <linux/highmem.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  12) #include <linux/sched/signal.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  13) #include <linux/uaccess.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  14) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  15) static int fsverity_read_merkle_tree(struct inode *inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  16) 				     const struct fsverity_info *vi,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  17) 				     void __user *buf, u64 offset, int length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  18) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  19) 	const struct fsverity_operations *vops = inode->i_sb->s_vop;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  20) 	u64 end_offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  21) 	unsigned int offs_in_page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  22) 	pgoff_t index, last_index;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  23) 	int retval = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  24) 	int err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  25) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  26) 	end_offset = min(offset + length, vi->tree_params.tree_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  27) 	if (offset >= end_offset)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  28) 		return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  29) 	offs_in_page = offset_in_page(offset);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  30) 	last_index = (end_offset - 1) >> PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  31) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  32) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  33) 	 * Iterate through each Merkle tree page in the requested range and copy
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  34) 	 * the requested portion to userspace.  Note that the Merkle tree block
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  35) 	 * size isn't important here, as we are returning a byte stream; i.e.,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  36) 	 * we can just work with pages even if the tree block size != PAGE_SIZE.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  37) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  38) 	for (index = offset >> PAGE_SHIFT; index <= last_index; index++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  39) 		unsigned long num_ra_pages =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  40) 			min_t(unsigned long, last_index - index + 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  41) 			      inode->i_sb->s_bdi->io_pages);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  42) 		unsigned int bytes_to_copy = min_t(u64, end_offset - offset,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  43) 						   PAGE_SIZE - offs_in_page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  44) 		struct page *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  45) 		const void *virt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  46) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  47) 		page = vops->read_merkle_tree_page(inode, index, num_ra_pages);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  48) 		if (IS_ERR(page)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  49) 			err = PTR_ERR(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  50) 			fsverity_err(inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  51) 				     "Error %d reading Merkle tree page %lu",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  52) 				     err, index);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  53) 			break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  54) 		}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  55) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  56) 		virt = kmap(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  57) 		if (copy_to_user(buf, virt + offs_in_page, bytes_to_copy)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  58) 			kunmap(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  59) 			put_page(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  60) 			err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  61) 			break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  62) 		}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  63) 		kunmap(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  64) 		put_page(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  65) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  66) 		retval += bytes_to_copy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  67) 		buf += bytes_to_copy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  68) 		offset += bytes_to_copy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  69) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  70) 		if (fatal_signal_pending(current))  {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  71) 			err = -EINTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  72) 			break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  73) 		}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  74) 		cond_resched();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  75) 		offs_in_page = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  76) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  77) 	return retval ? retval : err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  78) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  79) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  80) /* Copy the requested portion of the buffer to userspace. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  81) static int fsverity_read_buffer(void __user *dst, u64 offset, int length,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  82) 				const void *src, size_t src_length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  83) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  84) 	if (offset >= src_length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  85) 		return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  86) 	src += offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  87) 	src_length -= offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  88) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  89) 	length = min_t(size_t, length, src_length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  90) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  91) 	if (copy_to_user(dst, src, length))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  92) 		return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  93) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  94) 	return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  95) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  96) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  97) static int fsverity_read_descriptor(struct inode *inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  98) 				    void __user *buf, u64 offset, int length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  99) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) 	struct fsverity_descriptor *desc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) 	size_t desc_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) 	int res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) 	res = fsverity_get_descriptor(inode, &desc, &desc_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) 	if (res)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) 		return res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) 	/* don't include the signature */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) 	desc_size = offsetof(struct fsverity_descriptor, signature);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) 	desc->sig_size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) 	res = fsverity_read_buffer(buf, offset, length, desc, desc_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) 	kfree(desc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) 	return res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) static int fsverity_read_signature(struct inode *inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) 				   void __user *buf, u64 offset, int length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) 	struct fsverity_descriptor *desc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) 	size_t desc_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) 	int res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) 	res = fsverity_get_descriptor(inode, &desc, &desc_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) 	if (res)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) 		return res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) 	if (desc->sig_size == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) 		res = -ENODATA;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) 		goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) 	 * Include only the signature.  Note that fsverity_get_descriptor()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) 	 * already verified that sig_size is in-bounds.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) 	res = fsverity_read_buffer(buf, offset, length, desc->signature,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) 				   le32_to_cpu(desc->sig_size));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) 	kfree(desc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) 	return res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146)  * fsverity_ioctl_read_metadata() - read verity metadata from a file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147)  * @filp: file to read the metadata from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148)  * @uarg: user pointer to fsverity_read_metadata_arg
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150)  * Return: length read on success, 0 on EOF, -errno on failure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) int fsverity_ioctl_read_metadata(struct file *filp, const void __user *uarg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) 	struct inode *inode = file_inode(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) 	const struct fsverity_info *vi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) 	struct fsverity_read_metadata_arg arg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) 	int length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) 	void __user *buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) 	vi = fsverity_get_info(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) 	if (!vi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) 		return -ENODATA; /* not a verity file */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) 	 * Note that we don't have to explicitly check that the file is open for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) 	 * reading, since verity files can only be opened for reading.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) 	if (copy_from_user(&arg, uarg, sizeof(arg)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) 		return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) 	if (arg.__reserved)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) 		return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) 	/* offset + length must not overflow. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) 	if (arg.offset + arg.length < arg.offset)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) 		return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) 	/* Ensure that the return value will fit in INT_MAX. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) 	length = min_t(u64, arg.length, INT_MAX);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) 	buf = u64_to_user_ptr(arg.buf_ptr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) 	switch (arg.metadata_type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) 	case FS_VERITY_METADATA_TYPE_MERKLE_TREE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) 		return fsverity_read_merkle_tree(inode, vi, buf, arg.offset,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) 						 length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) 	case FS_VERITY_METADATA_TYPE_DESCRIPTOR:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) 		return fsverity_read_descriptor(inode, buf, arg.offset, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) 	case FS_VERITY_METADATA_TYPE_SIGNATURE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) 		return fsverity_read_signature(inode, buf, arg.offset, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) 	default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) 		return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) EXPORT_SYMBOL_GPL(fsverity_ioctl_read_metadata);