mmap.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /**
  3. * eCryptfs: Linux filesystem encryption layer
  4. * This is where eCryptfs coordinates the symmetric encryption and
  5. * decryption of the file data as it passes between the lower
  6. * encrypted file and the upper decrypted file.
  7. *
  8. * Copyright (C) 1997-2003 Erez Zadok
  9. * Copyright (C) 2001-2003 Stony Brook University
  10. * Copyright (C) 2004-2007 International Business Machines Corp.
  11. * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
  12. */
  13. #include <linux/pagemap.h>
  14. #include <linux/writeback.h>
  15. #include <linux/page-flags.h>
  16. #include <linux/mount.h>
  17. #include <linux/file.h>
  18. #include <linux/scatterlist.h>
  19. #include <linux/slab.h>
  20. #include <linux/xattr.h>
  21. #include <asm/unaligned.h>
  22. #include "ecryptfs_kernel.h"
  23. /**
  24. * ecryptfs_get_locked_page
  25. *
  26. * Get one page from cache or lower f/s, return error otherwise.
  27. *
  28. * Returns locked and up-to-date page (if ok), with increased
  29. * refcnt.
  30. */
  31. struct page *ecryptfs_get_locked_page(struct inode *inode, loff_t index)
  32. {
  33. struct page *page = read_mapping_page(inode->i_mapping, index, NULL);
  34. if (!IS_ERR(page))
  35. lock_page(page);
  36. return page;
  37. }
  38. /**
  39. * ecryptfs_writepage
  40. * @page: Page that is locked before this call is made
  41. *
  42. * Returns zero on success; non-zero otherwise
  43. *
  44. * This is where we encrypt the data and pass the encrypted data to
  45. * the lower filesystem. In OpenPGP-compatible mode, we operate on
  46. * entire underlying packets.
  47. */
  48. static int ecryptfs_writepage(struct page *page, struct writeback_control *wbc)
  49. {
  50. int rc;
  51. rc = ecryptfs_encrypt_page(page);
  52. if (rc) {
  53. ecryptfs_printk(KERN_WARNING, "Error encrypting "
  54. "page (upper index [0x%.16lx])\n", page->index);
  55. ClearPageUptodate(page);
  56. goto out;
  57. }
  58. SetPageUptodate(page);
  59. out:
  60. unlock_page(page);
  61. return rc;
  62. }
  63. static void strip_xattr_flag(char *page_virt,
  64. struct ecryptfs_crypt_stat *crypt_stat)
  65. {
  66. if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
  67. size_t written;
  68. crypt_stat->flags &= ~ECRYPTFS_METADATA_IN_XATTR;
  69. ecryptfs_write_crypt_stat_flags(page_virt, crypt_stat,
  70. &written);
  71. crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
  72. }
  73. }
  74. /**
  75. * Header Extent:
  76. * Octets 0-7: Unencrypted file size (big-endian)
  77. * Octets 8-15: eCryptfs special marker
  78. * Octets 16-19: Flags
  79. * Octet 16: File format version number (between 0 and 255)
  80. * Octets 17-18: Reserved
  81. * Octet 19: Bit 1 (lsb): Reserved
  82. * Bit 2: Encrypted?
  83. * Bits 3-8: Reserved
  84. * Octets 20-23: Header extent size (big-endian)
  85. * Octets 24-25: Number of header extents at front of file
  86. * (big-endian)
  87. * Octet 26: Begin RFC 2440 authentication token packet set
  88. */
  89. /**
  90. * ecryptfs_copy_up_encrypted_with_header
  91. * @page: Sort of a ``virtual'' representation of the encrypted lower
  92. * file. The actual lower file does not have the metadata in
  93. * the header. This is locked.
  94. * @crypt_stat: The eCryptfs inode's cryptographic context
  95. *
  96. * The ``view'' is the version of the file that userspace winds up
  97. * seeing, with the header information inserted.
  98. */
  99. static int
  100. ecryptfs_copy_up_encrypted_with_header(struct page *page,
  101. struct ecryptfs_crypt_stat *crypt_stat)
  102. {
  103. loff_t extent_num_in_page = 0;
  104. loff_t num_extents_per_page = (PAGE_SIZE
  105. / crypt_stat->extent_size);
  106. int rc = 0;
  107. while (extent_num_in_page < num_extents_per_page) {
  108. loff_t view_extent_num = ((((loff_t)page->index)
  109. * num_extents_per_page)
  110. + extent_num_in_page);
  111. size_t num_header_extents_at_front =
  112. (crypt_stat->metadata_size / crypt_stat->extent_size);
  113. if (view_extent_num < num_header_extents_at_front) {
  114. /* This is a header extent */
  115. char *page_virt;
  116. page_virt = kmap_atomic(page);
  117. memset(page_virt, 0, PAGE_SIZE);
  118. /* TODO: Support more than one header extent */
  119. if (view_extent_num == 0) {
  120. size_t written;
  121. rc = ecryptfs_read_xattr_region(
  122. page_virt, page->mapping->host);
  123. strip_xattr_flag(page_virt + 16, crypt_stat);
  124. ecryptfs_write_header_metadata(page_virt + 20,
  125. crypt_stat,
  126. &written);
  127. }
  128. kunmap_atomic(page_virt);
  129. flush_dcache_page(page);
  130. if (rc) {
  131. printk(KERN_ERR "%s: Error reading xattr "
  132. "region; rc = [%d]\n", __func__, rc);
  133. goto out;
  134. }
  135. } else {
  136. /* This is an encrypted data extent */
  137. loff_t lower_offset =
  138. ((view_extent_num * crypt_stat->extent_size)
  139. - crypt_stat->metadata_size);
  140. rc = ecryptfs_read_lower_page_segment(
  141. page, (lower_offset >> PAGE_SHIFT),
  142. (lower_offset & ~PAGE_MASK),
  143. crypt_stat->extent_size, page->mapping->host);
  144. if (rc) {
  145. printk(KERN_ERR "%s: Error attempting to read "
  146. "extent at offset [%lld] in the lower "
  147. "file; rc = [%d]\n", __func__,
  148. lower_offset, rc);
  149. goto out;
  150. }
  151. }
  152. extent_num_in_page++;
  153. }
  154. out:
  155. return rc;
  156. }
  157. /**
  158. * ecryptfs_readpage
  159. * @file: An eCryptfs file
  160. * @page: Page from eCryptfs inode mapping into which to stick the read data
  161. *
  162. * Read in a page, decrypting if necessary.
  163. *
  164. * Returns zero on success; non-zero on error.
  165. */
  166. static int ecryptfs_readpage(struct file *file, struct page *page)
  167. {
  168. struct ecryptfs_crypt_stat *crypt_stat =
  169. &ecryptfs_inode_to_private(page->mapping->host)->crypt_stat;
  170. int rc = 0;
  171. if (!crypt_stat || !(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
  172. rc = ecryptfs_read_lower_page_segment(page, page->index, 0,
  173. PAGE_SIZE,
  174. page->mapping->host);
  175. } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
  176. if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
  177. rc = ecryptfs_copy_up_encrypted_with_header(page,
  178. crypt_stat);
  179. if (rc) {
  180. printk(KERN_ERR "%s: Error attempting to copy "
  181. "the encrypted content from the lower "
  182. "file whilst inserting the metadata "
  183. "from the xattr into the header; rc = "
  184. "[%d]\n", __func__, rc);
  185. goto out;
  186. }
  187. } else {
  188. rc = ecryptfs_read_lower_page_segment(
  189. page, page->index, 0, PAGE_SIZE,
  190. page->mapping->host);
  191. if (rc) {
  192. printk(KERN_ERR "Error reading page; rc = "
  193. "[%d]\n", rc);
  194. goto out;
  195. }
  196. }
  197. } else {
  198. rc = ecryptfs_decrypt_page(page);
  199. if (rc) {
  200. ecryptfs_printk(KERN_ERR, "Error decrypting page; "
  201. "rc = [%d]\n", rc);
  202. goto out;
  203. }
  204. }
  205. out:
  206. if (rc)
  207. ClearPageUptodate(page);
  208. else
  209. SetPageUptodate(page);
  210. ecryptfs_printk(KERN_DEBUG, "Unlocking page with index = [0x%.16lx]\n",
  211. page->index);
  212. unlock_page(page);
  213. return rc;
  214. }
  215. /**
  216. * Called with lower inode mutex held.
  217. */
  218. static int fill_zeros_to_end_of_page(struct page *page, unsigned int to)
  219. {
  220. struct inode *inode = page->mapping->host;
  221. int end_byte_in_page;
  222. if ((i_size_read(inode) / PAGE_SIZE) != page->index)
  223. goto out;
  224. end_byte_in_page = i_size_read(inode) % PAGE_SIZE;
  225. if (to > end_byte_in_page)
  226. end_byte_in_page = to;
  227. zero_user_segment(page, end_byte_in_page, PAGE_SIZE);
  228. out:
  229. return 0;
  230. }
  231. /**
  232. * ecryptfs_write_begin
  233. * @file: The eCryptfs file
  234. * @mapping: The eCryptfs object
  235. * @pos: The file offset at which to start writing
  236. * @len: Length of the write
  237. * @flags: Various flags
  238. * @pagep: Pointer to return the page
  239. * @fsdata: Pointer to return fs data (unused)
  240. *
  241. * This function must zero any hole we create
  242. *
  243. * Returns zero on success; non-zero otherwise
  244. */
  245. static int ecryptfs_write_begin(struct file *file,
  246. struct address_space *mapping,
  247. loff_t pos, unsigned len, unsigned flags,
  248. struct page **pagep, void **fsdata)
  249. {
  250. pgoff_t index = pos >> PAGE_SHIFT;
  251. struct page *page;
  252. loff_t prev_page_end_size;
  253. int rc = 0;
  254. page = grab_cache_page_write_begin(mapping, index, flags);
  255. if (!page)
  256. return -ENOMEM;
  257. *pagep = page;
  258. prev_page_end_size = ((loff_t)index << PAGE_SHIFT);
  259. if (!PageUptodate(page)) {
  260. struct ecryptfs_crypt_stat *crypt_stat =
  261. &ecryptfs_inode_to_private(mapping->host)->crypt_stat;
  262. if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
  263. rc = ecryptfs_read_lower_page_segment(
  264. page, index, 0, PAGE_SIZE, mapping->host);
  265. if (rc) {
  266. printk(KERN_ERR "%s: Error attempting to read "
  267. "lower page segment; rc = [%d]\n",
  268. __func__, rc);
  269. ClearPageUptodate(page);
  270. goto out;
  271. } else
  272. SetPageUptodate(page);
  273. } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
  274. if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
  275. rc = ecryptfs_copy_up_encrypted_with_header(
  276. page, crypt_stat);
  277. if (rc) {
  278. printk(KERN_ERR "%s: Error attempting "
  279. "to copy the encrypted content "
  280. "from the lower file whilst "
  281. "inserting the metadata from "
  282. "the xattr into the header; rc "
  283. "= [%d]\n", __func__, rc);
  284. ClearPageUptodate(page);
  285. goto out;
  286. }
  287. SetPageUptodate(page);
  288. } else {
  289. rc = ecryptfs_read_lower_page_segment(
  290. page, index, 0, PAGE_SIZE,
  291. mapping->host);
  292. if (rc) {
  293. printk(KERN_ERR "%s: Error reading "
  294. "page; rc = [%d]\n",
  295. __func__, rc);
  296. ClearPageUptodate(page);
  297. goto out;
  298. }
  299. SetPageUptodate(page);
  300. }
  301. } else {
  302. if (prev_page_end_size
  303. >= i_size_read(page->mapping->host)) {
  304. zero_user(page, 0, PAGE_SIZE);
  305. SetPageUptodate(page);
  306. } else if (len < PAGE_SIZE) {
  307. rc = ecryptfs_decrypt_page(page);
  308. if (rc) {
  309. printk(KERN_ERR "%s: Error decrypting "
  310. "page at index [%ld]; "
  311. "rc = [%d]\n",
  312. __func__, page->index, rc);
  313. ClearPageUptodate(page);
  314. goto out;
  315. }
  316. SetPageUptodate(page);
  317. }
  318. }
  319. }
  320. /* If creating a page or more of holes, zero them out via truncate.
  321. * Note, this will increase i_size. */
  322. if (index != 0) {
  323. if (prev_page_end_size > i_size_read(page->mapping->host)) {
  324. rc = ecryptfs_truncate(file->f_path.dentry,
  325. prev_page_end_size);
  326. if (rc) {
  327. printk(KERN_ERR "%s: Error on attempt to "
  328. "truncate to (higher) offset [%lld];"
  329. " rc = [%d]\n", __func__,
  330. prev_page_end_size, rc);
  331. goto out;
  332. }
  333. }
  334. }
  335. /* Writing to a new page, and creating a small hole from start
  336. * of page? Zero it out. */
  337. if ((i_size_read(mapping->host) == prev_page_end_size)
  338. && (pos != 0))
  339. zero_user(page, 0, PAGE_SIZE);
  340. out:
  341. if (unlikely(rc)) {
  342. unlock_page(page);
  343. put_page(page);
  344. *pagep = NULL;
  345. }
  346. return rc;
  347. }
  348. /**
  349. * ecryptfs_write_inode_size_to_header
  350. *
  351. * Writes the lower file size to the first 8 bytes of the header.
  352. *
  353. * Returns zero on success; non-zero on error.
  354. */
  355. static int ecryptfs_write_inode_size_to_header(struct inode *ecryptfs_inode)
  356. {
  357. char *file_size_virt;
  358. int rc;
  359. file_size_virt = kmalloc(sizeof(u64), GFP_KERNEL);
  360. if (!file_size_virt) {
  361. rc = -ENOMEM;
  362. goto out;
  363. }
  364. put_unaligned_be64(i_size_read(ecryptfs_inode), file_size_virt);
  365. rc = ecryptfs_write_lower(ecryptfs_inode, file_size_virt, 0,
  366. sizeof(u64));
  367. kfree(file_size_virt);
  368. if (rc < 0)
  369. printk(KERN_ERR "%s: Error writing file size to header; "
  370. "rc = [%d]\n", __func__, rc);
  371. else
  372. rc = 0;
  373. out:
  374. return rc;
  375. }
  376. struct kmem_cache *ecryptfs_xattr_cache;
  377. static int ecryptfs_write_inode_size_to_xattr(struct inode *ecryptfs_inode)
  378. {
  379. ssize_t size;
  380. void *xattr_virt;
  381. struct dentry *lower_dentry =
  382. ecryptfs_inode_to_private(ecryptfs_inode)->lower_file->f_path.dentry;
  383. struct inode *lower_inode = d_inode(lower_dentry);
  384. int rc;
  385. if (!(lower_inode->i_opflags & IOP_XATTR)) {
  386. printk(KERN_WARNING
  387. "No support for setting xattr in lower filesystem\n");
  388. rc = -ENOSYS;
  389. goto out;
  390. }
  391. xattr_virt = kmem_cache_alloc(ecryptfs_xattr_cache, GFP_KERNEL);
  392. if (!xattr_virt) {
  393. rc = -ENOMEM;
  394. goto out;
  395. }
  396. inode_lock(lower_inode);
  397. size = __vfs_getxattr(lower_dentry, lower_inode, ECRYPTFS_XATTR_NAME,
  398. xattr_virt, PAGE_SIZE, XATTR_NOSECURITY);
  399. if (size < 0)
  400. size = 8;
  401. put_unaligned_be64(i_size_read(ecryptfs_inode), xattr_virt);
  402. rc = __vfs_setxattr(lower_dentry, lower_inode, ECRYPTFS_XATTR_NAME,
  403. xattr_virt, size, 0);
  404. inode_unlock(lower_inode);
  405. if (rc)
  406. printk(KERN_ERR "Error whilst attempting to write inode size "
  407. "to lower file xattr; rc = [%d]\n", rc);
  408. kmem_cache_free(ecryptfs_xattr_cache, xattr_virt);
  409. out:
  410. return rc;
  411. }
  412. int ecryptfs_write_inode_size_to_metadata(struct inode *ecryptfs_inode)
  413. {
  414. struct ecryptfs_crypt_stat *crypt_stat;
  415. crypt_stat = &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
  416. BUG_ON(!(crypt_stat->flags & ECRYPTFS_ENCRYPTED));
  417. if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
  418. return ecryptfs_write_inode_size_to_xattr(ecryptfs_inode);
  419. else
  420. return ecryptfs_write_inode_size_to_header(ecryptfs_inode);
  421. }
  422. /**
  423. * ecryptfs_write_end
  424. * @file: The eCryptfs file object
  425. * @mapping: The eCryptfs object
  426. * @pos: The file position
  427. * @len: The length of the data (unused)
  428. * @copied: The amount of data copied
  429. * @page: The eCryptfs page
  430. * @fsdata: The fsdata (unused)
  431. */
  432. static int ecryptfs_write_end(struct file *file,
  433. struct address_space *mapping,
  434. loff_t pos, unsigned len, unsigned copied,
  435. struct page *page, void *fsdata)
  436. {
  437. pgoff_t index = pos >> PAGE_SHIFT;
  438. unsigned from = pos & (PAGE_SIZE - 1);
  439. unsigned to = from + copied;
  440. struct inode *ecryptfs_inode = mapping->host;
  441. struct ecryptfs_crypt_stat *crypt_stat =
  442. &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
  443. int rc;
  444. ecryptfs_printk(KERN_DEBUG, "Calling fill_zeros_to_end_of_page"
  445. "(page w/ index = [0x%.16lx], to = [%d])\n", index, to);
  446. if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
  447. rc = ecryptfs_write_lower_page_segment(ecryptfs_inode, page, 0,
  448. to);
  449. if (!rc) {
  450. rc = copied;
  451. fsstack_copy_inode_size(ecryptfs_inode,
  452. ecryptfs_inode_to_lower(ecryptfs_inode));
  453. }
  454. goto out;
  455. }
  456. if (!PageUptodate(page)) {
  457. if (copied < PAGE_SIZE) {
  458. rc = 0;
  459. goto out;
  460. }
  461. SetPageUptodate(page);
  462. }
  463. /* Fills in zeros if 'to' goes beyond inode size */
  464. rc = fill_zeros_to_end_of_page(page, to);
  465. if (rc) {
  466. ecryptfs_printk(KERN_WARNING, "Error attempting to fill "
  467. "zeros in page with index = [0x%.16lx]\n", index);
  468. goto out;
  469. }
  470. rc = ecryptfs_encrypt_page(page);
  471. if (rc) {
  472. ecryptfs_printk(KERN_WARNING, "Error encrypting page (upper "
  473. "index [0x%.16lx])\n", index);
  474. goto out;
  475. }
  476. if (pos + copied > i_size_read(ecryptfs_inode)) {
  477. i_size_write(ecryptfs_inode, pos + copied);
  478. ecryptfs_printk(KERN_DEBUG, "Expanded file size to "
  479. "[0x%.16llx]\n",
  480. (unsigned long long)i_size_read(ecryptfs_inode));
  481. }
  482. rc = ecryptfs_write_inode_size_to_metadata(ecryptfs_inode);
  483. if (rc)
  484. printk(KERN_ERR "Error writing inode size to metadata; "
  485. "rc = [%d]\n", rc);
  486. else
  487. rc = copied;
  488. out:
  489. unlock_page(page);
  490. put_page(page);
  491. return rc;
  492. }
  493. static sector_t ecryptfs_bmap(struct address_space *mapping, sector_t block)
  494. {
  495. struct inode *lower_inode = ecryptfs_inode_to_lower(mapping->host);
  496. int ret = bmap(lower_inode, &block);
  497. if (ret)
  498. return 0;
  499. return block;
  500. }
  501. const struct address_space_operations ecryptfs_aops = {
  502. .writepage = ecryptfs_writepage,
  503. .readpage = ecryptfs_readpage,
  504. .write_begin = ecryptfs_write_begin,
  505. .write_end = ecryptfs_write_end,
  506. .bmap = ecryptfs_bmap,
  507. };