mmap.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586
  1. /**
  2. * eCryptfs: Linux filesystem encryption layer
  3. * This is where eCryptfs coordinates the symmetric encryption and
  4. * decryption of the file data as it passes between the lower
  5. * encrypted file and the upper decrypted file.
  6. *
  7. * Copyright (C) 1997-2003 Erez Zadok
  8. * Copyright (C) 2001-2003 Stony Brook University
  9. * Copyright (C) 2004-2007 International Business Machines Corp.
  10. * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
  11. *
  12. * This program is free software; you can redistribute it and/or
  13. * modify it under the terms of the GNU General Public License as
  14. * published by the Free Software Foundation; either version 2 of the
  15. * License, or (at your option) any later version.
  16. *
  17. * This program is distributed in the hope that it will be useful, but
  18. * WITHOUT ANY WARRANTY; without even the implied warranty of
  19. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  20. * General Public License for more details.
  21. *
  22. * You should have received a copy of the GNU General Public License
  23. * along with this program; if not, write to the Free Software
  24. * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  25. * 02111-1307, USA.
  26. */
  27. #include <linux/pagemap.h>
  28. #include <linux/writeback.h>
  29. #include <linux/page-flags.h>
  30. #include <linux/mount.h>
  31. #include <linux/file.h>
  32. #include <linux/crypto.h>
  33. #include <linux/scatterlist.h>
  34. #include <linux/slab.h>
  35. #include <asm/unaligned.h>
  36. #include "ecryptfs_kernel.h"
  37. /**
  38. * ecryptfs_get_locked_page
  39. *
  40. * Get one page from cache or lower f/s, return error otherwise.
  41. *
  42. * Returns locked and up-to-date page (if ok), with increased
  43. * refcnt.
  44. */
  45. struct page *ecryptfs_get_locked_page(struct inode *inode, loff_t index)
  46. {
  47. struct page *page = read_mapping_page(inode->i_mapping, index, NULL);
  48. if (!IS_ERR(page))
  49. lock_page(page);
  50. return page;
  51. }
  52. /**
  53. * ecryptfs_writepage
  54. * @page: Page that is locked before this call is made
  55. *
  56. * Returns zero on success; non-zero otherwise
  57. *
  58. * This is where we encrypt the data and pass the encrypted data to
  59. * the lower filesystem. In OpenPGP-compatible mode, we operate on
  60. * entire underlying packets.
  61. */
  62. static int ecryptfs_writepage(struct page *page, struct writeback_control *wbc)
  63. {
  64. int rc;
  65. // WTL_EDM_START
  66. /* MDM 3.1 START */
  67. struct inode *inode;
  68. struct ecryptfs_crypt_stat *crypt_stat;
  69. inode = page->mapping->host;
  70. crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
  71. if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
  72. size_t size;
  73. loff_t file_size = i_size_read(inode);
  74. pgoff_t end_page_index = file_size >> PAGE_CACHE_SHIFT;
  75. if (end_page_index < page->index)
  76. size = 0;
  77. else if (end_page_index == page->index)
  78. size = file_size & ~PAGE_CACHE_MASK;
  79. else
  80. size = PAGE_CACHE_SIZE;
  81. rc = ecryptfs_write_lower_page_segment(inode, page, 0, size);
  82. if (unlikely(rc)) {
  83. ecryptfs_printk(KERN_WARNING, "Error write ""page (upper index [0x%.16lx])\n", page->index);
  84. ClearPageUptodate(page);
  85. } else
  86. SetPageUptodate(page);
  87. goto out;
  88. }
  89. /* MDM 3.1 END */
  90. // WTL_EDM_END
  91. rc = ecryptfs_encrypt_page(page);
  92. if (rc) {
  93. ecryptfs_printk(KERN_WARNING, "Error encrypting "
  94. "page (upper index [0x%.16lx])\n", page->index);
  95. ClearPageUptodate(page);
  96. goto out;
  97. }
  98. SetPageUptodate(page);
  99. out:
  100. unlock_page(page);
  101. return rc;
  102. }
  103. static void strip_xattr_flag(char *page_virt,
  104. struct ecryptfs_crypt_stat *crypt_stat)
  105. {
  106. if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
  107. size_t written;
  108. crypt_stat->flags &= ~ECRYPTFS_METADATA_IN_XATTR;
  109. ecryptfs_write_crypt_stat_flags(page_virt, crypt_stat,
  110. &written);
  111. crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
  112. }
  113. }
  114. /**
  115. * Header Extent:
  116. * Octets 0-7: Unencrypted file size (big-endian)
  117. * Octets 8-15: eCryptfs special marker
  118. * Octets 16-19: Flags
  119. * Octet 16: File format version number (between 0 and 255)
  120. * Octets 17-18: Reserved
  121. * Octet 19: Bit 1 (lsb): Reserved
  122. * Bit 2: Encrypted?
  123. * Bits 3-8: Reserved
  124. * Octets 20-23: Header extent size (big-endian)
  125. * Octets 24-25: Number of header extents at front of file
  126. * (big-endian)
  127. * Octet 26: Begin RFC 2440 authentication token packet set
  128. */
  129. /**
  130. * ecryptfs_copy_up_encrypted_with_header
  131. * @page: Sort of a ``virtual'' representation of the encrypted lower
  132. * file. The actual lower file does not have the metadata in
  133. * the header. This is locked.
  134. * @crypt_stat: The eCryptfs inode's cryptographic context
  135. *
  136. * The ``view'' is the version of the file that userspace winds up
  137. * seeing, with the header information inserted.
  138. */
  139. static int
  140. ecryptfs_copy_up_encrypted_with_header(struct page *page,
  141. struct ecryptfs_crypt_stat *crypt_stat)
  142. {
  143. loff_t extent_num_in_page = 0;
  144. loff_t num_extents_per_page = (PAGE_CACHE_SIZE
  145. / crypt_stat->extent_size);
  146. int rc = 0;
  147. while (extent_num_in_page < num_extents_per_page) {
  148. loff_t view_extent_num = ((((loff_t)page->index)
  149. * num_extents_per_page)
  150. + extent_num_in_page);
  151. size_t num_header_extents_at_front =
  152. (crypt_stat->metadata_size / crypt_stat->extent_size);
  153. if (view_extent_num < num_header_extents_at_front) {
  154. /* This is a header extent */
  155. char *page_virt;
  156. page_virt = kmap_atomic(page);
  157. memset(page_virt, 0, PAGE_CACHE_SIZE);
  158. /* TODO: Support more than one header extent */
  159. if (view_extent_num == 0) {
  160. size_t written;
  161. rc = ecryptfs_read_xattr_region(
  162. page_virt, page->mapping->host);
  163. strip_xattr_flag(page_virt + 16, crypt_stat);
  164. ecryptfs_write_header_metadata(page_virt + 20,
  165. crypt_stat,
  166. &written);
  167. }
  168. kunmap_atomic(page_virt);
  169. flush_dcache_page(page);
  170. if (rc) {
  171. printk(KERN_ERR "%s: Error reading xattr "
  172. "region; rc = [%d]\n", __func__, rc);
  173. goto out;
  174. }
  175. } else {
  176. /* This is an encrypted data extent */
  177. loff_t lower_offset =
  178. ((view_extent_num * crypt_stat->extent_size)
  179. - crypt_stat->metadata_size);
  180. rc = ecryptfs_read_lower_page_segment(
  181. page, (lower_offset >> PAGE_CACHE_SHIFT),
  182. (lower_offset & ~PAGE_CACHE_MASK),
  183. crypt_stat->extent_size, page->mapping->host);
  184. if (rc) {
  185. printk(KERN_ERR "%s: Error attempting to read "
  186. "extent at offset [%lld] in the lower "
  187. "file; rc = [%d]\n", __func__,
  188. lower_offset, rc);
  189. goto out;
  190. }
  191. }
  192. extent_num_in_page++;
  193. }
  194. out:
  195. return rc;
  196. }
  197. /**
  198. * ecryptfs_readpage
  199. * @file: An eCryptfs file
  200. * @page: Page from eCryptfs inode mapping into which to stick the read data
  201. *
  202. * Read in a page, decrypting if necessary.
  203. *
  204. * Returns zero on success; non-zero on error.
  205. */
  206. static int ecryptfs_readpage(struct file *file, struct page *page)
  207. {
  208. struct ecryptfs_crypt_stat *crypt_stat =
  209. &ecryptfs_inode_to_private(page->mapping->host)->crypt_stat;
  210. int rc = 0;
  211. if (!crypt_stat || !(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
  212. rc = ecryptfs_read_lower_page_segment(page, page->index, 0,
  213. PAGE_CACHE_SIZE,
  214. page->mapping->host);
  215. } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
  216. if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
  217. rc = ecryptfs_copy_up_encrypted_with_header(page,
  218. crypt_stat);
  219. if (rc) {
  220. printk(KERN_ERR "%s: Error attempting to copy "
  221. "the encrypted content from the lower "
  222. "file whilst inserting the metadata "
  223. "from the xattr into the header; rc = "
  224. "[%d]\n", __func__, rc);
  225. goto out;
  226. }
  227. } else {
  228. rc = ecryptfs_read_lower_page_segment(
  229. page, page->index, 0, PAGE_CACHE_SIZE,
  230. page->mapping->host);
  231. if (rc) {
  232. printk(KERN_ERR "Error reading page; rc = "
  233. "[%d]\n", rc);
  234. goto out;
  235. }
  236. }
  237. } else {
  238. rc = ecryptfs_decrypt_page(page);
  239. if (rc) {
  240. ecryptfs_printk(KERN_ERR, "Error decrypting page; "
  241. "rc = [%d]\n", rc);
  242. goto out;
  243. }
  244. }
  245. out:
  246. if (rc)
  247. ClearPageUptodate(page);
  248. else {
  249. SetPageUptodate(page);
  250. }
  251. ecryptfs_printk(KERN_DEBUG, "Unlocking page with index = [0x%.16lx]\n",
  252. page->index);
  253. unlock_page(page);
  254. return rc;
  255. }
  256. /**
  257. * Called with lower inode mutex held.
  258. */
  259. static int fill_zeros_to_end_of_page(struct page *page, unsigned int to)
  260. {
  261. struct inode *inode = page->mapping->host;
  262. int end_byte_in_page;
  263. if ((i_size_read(inode) / PAGE_CACHE_SIZE) != page->index)
  264. goto out;
  265. end_byte_in_page = i_size_read(inode) % PAGE_CACHE_SIZE;
  266. if (to > end_byte_in_page)
  267. end_byte_in_page = to;
  268. zero_user_segment(page, end_byte_in_page, PAGE_CACHE_SIZE);
  269. out:
  270. return 0;
  271. }
  272. /**
  273. * ecryptfs_write_begin
  274. * @file: The eCryptfs file
  275. * @mapping: The eCryptfs object
  276. * @pos: The file offset at which to start writing
  277. * @len: Length of the write
  278. * @flags: Various flags
  279. * @pagep: Pointer to return the page
  280. * @fsdata: Pointer to return fs data (unused)
  281. *
  282. * This function must zero any hole we create
  283. *
  284. * Returns zero on success; non-zero otherwise
  285. */
  286. static int ecryptfs_write_begin(struct file *file,
  287. struct address_space *mapping,
  288. loff_t pos, unsigned len, unsigned flags,
  289. struct page **pagep, void **fsdata)
  290. {
  291. pgoff_t index = pos >> PAGE_CACHE_SHIFT;
  292. struct page *page;
  293. loff_t prev_page_end_size;
  294. int rc = 0;
  295. page = grab_cache_page_write_begin(mapping, index, flags);
  296. if (!page)
  297. return -ENOMEM;
  298. *pagep = page;
  299. prev_page_end_size = ((loff_t)index << PAGE_CACHE_SHIFT);
  300. if (!PageUptodate(page)) {
  301. struct ecryptfs_crypt_stat *crypt_stat =
  302. &ecryptfs_inode_to_private(mapping->host)->crypt_stat;
  303. if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
  304. rc = ecryptfs_read_lower_page_segment(
  305. page, index, 0, PAGE_CACHE_SIZE, mapping->host);
  306. if (rc) {
  307. printk(KERN_ERR "%s: Error attemping to read "
  308. "lower page segment; rc = [%d]\n",
  309. __func__, rc);
  310. ClearPageUptodate(page);
  311. goto out;
  312. } else
  313. SetPageUptodate(page);
  314. } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
  315. if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
  316. rc = ecryptfs_copy_up_encrypted_with_header(
  317. page, crypt_stat);
  318. if (rc) {
  319. printk(KERN_ERR "%s: Error attempting "
  320. "to copy the encrypted content "
  321. "from the lower file whilst "
  322. "inserting the metadata from "
  323. "the xattr into the header; rc "
  324. "= [%d]\n", __func__, rc);
  325. ClearPageUptodate(page);
  326. goto out;
  327. }
  328. SetPageUptodate(page);
  329. } else {
  330. rc = ecryptfs_read_lower_page_segment(
  331. page, index, 0, PAGE_CACHE_SIZE,
  332. mapping->host);
  333. if (rc) {
  334. printk(KERN_ERR "%s: Error reading "
  335. "page; rc = [%d]\n",
  336. __func__, rc);
  337. ClearPageUptodate(page);
  338. goto out;
  339. }
  340. SetPageUptodate(page);
  341. }
  342. } else {
  343. if (prev_page_end_size
  344. >= i_size_read(page->mapping->host)) {
  345. zero_user(page, 0, PAGE_CACHE_SIZE);
  346. } else {
  347. rc = ecryptfs_decrypt_page(page);
  348. if (rc) {
  349. printk(KERN_ERR "%s: Error decrypting "
  350. "page at index [%ld]; "
  351. "rc = [%d]\n",
  352. __func__, page->index, rc);
  353. ClearPageUptodate(page);
  354. goto out;
  355. }
  356. }
  357. SetPageUptodate(page);
  358. }
  359. }
  360. /* If creating a page or more of holes, zero them out via truncate.
  361. * Note, this will increase i_size. */
  362. if (index != 0) {
  363. if (prev_page_end_size > i_size_read(page->mapping->host)) {
  364. rc = ecryptfs_truncate(file->f_path.dentry,
  365. prev_page_end_size);
  366. if (rc) {
  367. printk(KERN_ERR "%s: Error on attempt to "
  368. "truncate to (higher) offset [%lld];"
  369. " rc = [%d]\n", __func__,
  370. prev_page_end_size, rc);
  371. goto out;
  372. }
  373. }
  374. }
  375. /* Writing to a new page, and creating a small hole from start
  376. * of page? Zero it out. */
  377. if ((i_size_read(mapping->host) == prev_page_end_size)
  378. && (pos != 0))
  379. zero_user(page, 0, PAGE_CACHE_SIZE);
  380. out:
  381. if (unlikely(rc)) {
  382. unlock_page(page);
  383. page_cache_release(page);
  384. *pagep = NULL;
  385. }
  386. return rc;
  387. }
  388. /**
  389. * ecryptfs_write_inode_size_to_header
  390. *
  391. * Writes the lower file size to the first 8 bytes of the header.
  392. *
  393. * Returns zero on success; non-zero on error.
  394. */
  395. static int ecryptfs_write_inode_size_to_header(struct inode *ecryptfs_inode)
  396. {
  397. char *file_size_virt;
  398. int rc;
  399. file_size_virt = kmalloc(sizeof(u64), GFP_KERNEL);
  400. if (!file_size_virt) {
  401. rc = -ENOMEM;
  402. goto out;
  403. }
  404. put_unaligned_be64(i_size_read(ecryptfs_inode), file_size_virt);
  405. rc = ecryptfs_write_lower(ecryptfs_inode, file_size_virt, 0,
  406. sizeof(u64));
  407. kfree(file_size_virt);
  408. if (rc < 0)
  409. printk(KERN_ERR "%s: Error writing file size to header; "
  410. "rc = [%d]\n", __func__, rc);
  411. else
  412. rc = 0;
  413. out:
  414. return rc;
  415. }
  416. struct kmem_cache *ecryptfs_xattr_cache;
  417. static int ecryptfs_write_inode_size_to_xattr(struct inode *ecryptfs_inode)
  418. {
  419. ssize_t size;
  420. void *xattr_virt;
  421. struct dentry *lower_dentry =
  422. ecryptfs_inode_to_private(ecryptfs_inode)->lower_file->f_dentry;
  423. struct inode *lower_inode = lower_dentry->d_inode;
  424. int rc;
  425. if (!lower_inode->i_op->getxattr || !lower_inode->i_op->setxattr) {
  426. printk(KERN_WARNING
  427. "No support for setting xattr in lower filesystem\n");
  428. rc = -ENOSYS;
  429. goto out;
  430. }
  431. xattr_virt = kmem_cache_alloc(ecryptfs_xattr_cache, GFP_KERNEL);
  432. if (!xattr_virt) {
  433. printk(KERN_ERR "Out of memory whilst attempting to write "
  434. "inode size to xattr\n");
  435. rc = -ENOMEM;
  436. goto out;
  437. }
  438. mutex_lock(&lower_inode->i_mutex);
  439. size = lower_inode->i_op->getxattr(lower_dentry, ECRYPTFS_XATTR_NAME,
  440. xattr_virt, PAGE_CACHE_SIZE);
  441. if (size < 0)
  442. size = 8;
  443. put_unaligned_be64(i_size_read(ecryptfs_inode), xattr_virt);
  444. rc = lower_inode->i_op->setxattr(lower_dentry, ECRYPTFS_XATTR_NAME,
  445. xattr_virt, size, 0);
  446. mutex_unlock(&lower_inode->i_mutex);
  447. if (rc)
  448. printk(KERN_ERR "Error whilst attempting to write inode size "
  449. "to lower file xattr; rc = [%d]\n", rc);
  450. kmem_cache_free(ecryptfs_xattr_cache, xattr_virt);
  451. out:
  452. return rc;
  453. }
  454. int ecryptfs_write_inode_size_to_metadata(struct inode *ecryptfs_inode)
  455. {
  456. struct ecryptfs_crypt_stat *crypt_stat;
  457. crypt_stat = &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
  458. BUG_ON(!(crypt_stat->flags & ECRYPTFS_ENCRYPTED));
  459. if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
  460. return ecryptfs_write_inode_size_to_xattr(ecryptfs_inode);
  461. else
  462. return ecryptfs_write_inode_size_to_header(ecryptfs_inode);
  463. }
  464. /**
  465. * ecryptfs_write_end
  466. * @file: The eCryptfs file object
  467. * @mapping: The eCryptfs object
  468. * @pos: The file position
  469. * @len: The length of the data (unused)
  470. * @copied: The amount of data copied
  471. * @page: The eCryptfs page
  472. * @fsdata: The fsdata (unused)
  473. */
  474. static int ecryptfs_write_end(struct file *file,
  475. struct address_space *mapping,
  476. loff_t pos, unsigned len, unsigned copied,
  477. struct page *page, void *fsdata)
  478. {
  479. pgoff_t index = pos >> PAGE_CACHE_SHIFT;
  480. unsigned from = pos & (PAGE_CACHE_SIZE - 1);
  481. unsigned to = from + copied;
  482. struct inode *ecryptfs_inode = mapping->host;
  483. struct ecryptfs_crypt_stat *crypt_stat =
  484. &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
  485. int rc;
  486. ecryptfs_printk(KERN_DEBUG, "Calling fill_zeros_to_end_of_page"
  487. "(page w/ index = [0x%.16lx], to = [%d])\n", index, to);
  488. if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
  489. rc = ecryptfs_write_lower_page_segment(ecryptfs_inode, page, 0,
  490. to);
  491. if (!rc) {
  492. rc = copied;
  493. fsstack_copy_inode_size(ecryptfs_inode,
  494. ecryptfs_inode_to_lower(ecryptfs_inode));
  495. }
  496. goto out;
  497. }
  498. /* Fills in zeros if 'to' goes beyond inode size */
  499. rc = fill_zeros_to_end_of_page(page, to);
  500. if (rc) {
  501. ecryptfs_printk(KERN_WARNING, "Error attempting to fill "
  502. "zeros in page with index = [0x%.16lx]\n", index);
  503. goto out;
  504. }
  505. rc = ecryptfs_encrypt_page(page);
  506. if (rc) {
  507. ecryptfs_printk(KERN_WARNING, "Error encrypting page (upper "
  508. "index [0x%.16lx])\n", index);
  509. goto out;
  510. }
  511. if (pos + copied > i_size_read(ecryptfs_inode)) {
  512. i_size_write(ecryptfs_inode, pos + copied);
  513. ecryptfs_printk(KERN_DEBUG, "Expanded file size to "
  514. "[0x%.16llx]\n",
  515. (unsigned long long)i_size_read(ecryptfs_inode));
  516. }
  517. rc = ecryptfs_write_inode_size_to_metadata(ecryptfs_inode);
  518. if (rc)
  519. printk(KERN_ERR "Error writing inode size to metadata; "
  520. "rc = [%d]\n", rc);
  521. else
  522. rc = copied;
  523. out:
  524. unlock_page(page);
  525. page_cache_release(page);
  526. return rc;
  527. }
  528. static sector_t ecryptfs_bmap(struct address_space *mapping, sector_t block)
  529. {
  530. int rc = 0;
  531. struct inode *inode;
  532. struct inode *lower_inode;
  533. inode = (struct inode *)mapping->host;
  534. lower_inode = ecryptfs_inode_to_lower(inode);
  535. if (lower_inode->i_mapping->a_ops->bmap)
  536. rc = lower_inode->i_mapping->a_ops->bmap(lower_inode->i_mapping,
  537. block);
  538. return rc;
  539. }
  540. const struct address_space_operations ecryptfs_aops = {
  541. .writepage = ecryptfs_writepage,
  542. .readpage = ecryptfs_readpage,
  543. .write_begin = ecryptfs_write_begin,
  544. .write_end = ecryptfs_write_end,
  545. .bmap = ecryptfs_bmap,
  546. };