Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7799953b authored by Richard Weinberger's avatar Richard Weinberger
Browse files

ubifs: Implement encrypt/decrypt for all IO 



Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Signed-off-by: default avatarDavid Gstir <david@sigma-star.at>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent 1ee77870

fs/ubifs/crypto.c

+51 −0
Original line number Diff line number Diff line
@@ -35,6 +35,57 @@ static int ubifs_key_prefix(struct inode *inode, u8 **key) 
	return sizeof(prefix) - 1;

}



int ubifs_encrypt(const struct inode *inode, struct ubifs_data_node *dn,

		  unsigned int in_len, unsigned int *out_len, int block)

{

	struct ubifs_info *c = inode->i_sb->s_fs_info;

	void *p = &dn->data;

	struct page *ret;

	unsigned int pad_len = round_up(in_len, UBIFS_CIPHER_BLOCK_SIZE);



	ubifs_assert(pad_len <= *out_len);

	dn->compr_size = cpu_to_le16(in_len);



	/* pad to full block cipher length */

	if (pad_len != in_len)

		memset(p + in_len, 0, pad_len - in_len);



	ret = fscrypt_encrypt_page(inode, virt_to_page(&dn->data), pad_len,

			offset_in_page(&dn->data), block, GFP_NOFS);

	if (IS_ERR(ret)) {

		ubifs_err(c, "fscrypt_encrypt_page failed: %ld", PTR_ERR(ret));

		return PTR_ERR(ret);

	}

	*out_len = pad_len;



	return 0;

}



int ubifs_decrypt(const struct inode *inode, struct ubifs_data_node *dn,

		  unsigned int *out_len, int block)

{

	struct ubifs_info *c = inode->i_sb->s_fs_info;

	int err;

	unsigned int clen = le16_to_cpu(dn->compr_size);

	unsigned int dlen = *out_len;



	if (clen <= 0 || clen > UBIFS_BLOCK_SIZE || clen > dlen) {

		ubifs_err(c, "bad compr_size: %i", clen);

		return -EINVAL;

	}



	ubifs_assert(dlen <= UBIFS_BLOCK_SIZE);

	err = fscrypt_decrypt_page(inode, virt_to_page(&dn->data), dlen,

			offset_in_page(&dn->data), block);

	if (err) {

		ubifs_err(c, "fscrypt_decrypt_page failed: %i", err);

		return err;

	}

	*out_len = clen;



	return 0;

}



struct fscrypt_operations ubifs_crypt_operations = {

	.flags			= FS_CFLG_INPLACE_ENCRYPTION,

	.get_context		= ubifs_crypt_get_context,

fs/ubifs/file.c

+14 −0
Original line number Diff line number Diff line
@@ -78,6 +78,13 @@ static int read_block(struct inode *inode, void *addr, unsigned int block, 
		goto dump;



	dlen = le32_to_cpu(dn->ch.len) - UBIFS_DATA_NODE_SZ;



	if (ubifs_crypt_is_encrypted(inode)) {

		err = ubifs_decrypt(inode, dn, &dlen, block);

		if (err)

			goto dump;

	}



	out_len = UBIFS_BLOCK_SIZE;

	err = ubifs_decompress(c, &dn->data, dlen, addr, &out_len,

			       le16_to_cpu(dn->compr_type));
@@ -650,6 +657,13 @@ static int populate_page(struct ubifs_info *c, struct page *page, 


			dlen = le32_to_cpu(dn->ch.len) - UBIFS_DATA_NODE_SZ;

			out_len = UBIFS_BLOCK_SIZE;



			if (ubifs_crypt_is_encrypted(inode)) {

				err = ubifs_decrypt(inode, dn, &dlen, page_block);

				if (err)

					goto out_err;

			}



			err = ubifs_decompress(c, &dn->data, dlen, addr, &out_len,

					       le16_to_cpu(dn->compr_type));

			if (err || len != out_len)

fs/ubifs/journal.c

+54 −24
Original line number Diff line number Diff line
@@ -688,14 +688,18 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode, 
			 const union ubifs_key *key, const void *buf, int len)

{

	struct ubifs_data_node *data;

	int err, lnum, offs, compr_type, out_len;

	int err, lnum, offs, compr_type, out_len, compr_len;

	int dlen = COMPRESSED_DATA_NODE_BUF_SZ, allocated = 1;

	struct ubifs_inode *ui = ubifs_inode(inode);

	bool encrypted = ubifs_crypt_is_encrypted(inode);



	dbg_jnlk(key, "ino %lu, blk %u, len %d, key ",

		(unsigned long)key_inum(c, key), key_block(c, key), len);

	ubifs_assert(len <= UBIFS_BLOCK_SIZE);



	if (encrypted)

		dlen += UBIFS_CIPHER_BLOCK_SIZE;



	data = kmalloc(dlen, GFP_NOFS | __GFP_NOWARN);

	if (!data) {

		/*
@@ -720,9 +724,18 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode, 
	else

		compr_type = ui->compr_type;



	out_len = dlen - UBIFS_DATA_NODE_SZ;

	ubifs_compress(c, buf, len, &data->data, &out_len, &compr_type);

	ubifs_assert(out_len <= UBIFS_BLOCK_SIZE);

	out_len = compr_len = dlen - UBIFS_DATA_NODE_SZ;

	ubifs_compress(c, buf, len, &data->data, &compr_len, &compr_type);

	ubifs_assert(compr_len <= UBIFS_BLOCK_SIZE);



	if (encrypted) {

		err = ubifs_encrypt(inode, data, compr_len, &out_len, key_block(c, key));

		if (err)

			goto out_free;



	} else {

		data->compr_size = 0;

	}



	dlen = UBIFS_DATA_NODE_SZ + out_len;

	data->compr_type = cpu_to_le16(compr_type);
@@ -1241,31 +1254,55 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, 
}



/**

 * recomp_data_node - re-compress a truncated data node.

 * truncate_data_node - re-compress/encrypt a truncated data node.

 * @c: UBIFS file-system description object

 * @inode: inode which referes to the data node

 * @block: data block number

 * @dn: data node to re-compress

 * @new_len: new length

 *

 * This function is used when an inode is truncated and the last data node of

 * the inode has to be re-compressed and re-written.

 * the inode has to be re-compressed/encrypted and re-written.

 */

static int recomp_data_node(const struct ubifs_info *c,

			    struct ubifs_data_node *dn, int *new_len)

static int truncate_data_node(const struct ubifs_info *c, const struct inode *inode,

			      unsigned int block, struct ubifs_data_node *dn,

			      int *new_len)

{

	void *buf;

	int err, len, compr_type, out_len;

	int err, dlen, compr_type, out_len, old_dlen;



	out_len = le32_to_cpu(dn->size);

	buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);

	if (!buf)

		return -ENOMEM;



	len = le32_to_cpu(dn->ch.len) - UBIFS_DATA_NODE_SZ;

	dlen = old_dlen = le32_to_cpu(dn->ch.len) - UBIFS_DATA_NODE_SZ;

	compr_type = le16_to_cpu(dn->compr_type);

	err = ubifs_decompress(c, &dn->data, len, buf, &out_len, compr_type);



	if (ubifs_crypt_is_encrypted(inode)) {

		err = ubifs_decrypt(inode, dn, &dlen, block);

		if (err)

			goto out;

	}



	if (compr_type != UBIFS_COMPR_NONE) {

		err = ubifs_decompress(c, &dn->data, dlen, buf, &out_len, compr_type);

		if (err)

			goto out;



		ubifs_compress(c, buf, *new_len, &dn->data, &out_len, &compr_type);

	}



	if (ubifs_crypt_is_encrypted(inode)) {

		err = ubifs_encrypt(inode, dn, out_len, &old_dlen, block);

		if (err)

			goto out;



		out_len = old_dlen;

	} else {

		dn->compr_size = 0;

	}



	ubifs_assert(out_len <= UBIFS_BLOCK_SIZE);

	dn->compr_type = cpu_to_le16(compr_type);

	dn->size = cpu_to_le32(*new_len);
@@ -1337,16 +1374,9 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode, 
			if (le32_to_cpu(dn->size) <= dlen)

				dlen = 0; /* Nothing to do */

			else {

				int compr_type = le16_to_cpu(dn->compr_type);



				if (compr_type != UBIFS_COMPR_NONE) {

					err = recomp_data_node(c, dn, &dlen);

				err = truncate_data_node(c, inode, blk, dn, &dlen);

				if (err)

					goto out_free;

				} else {

					dn->size = cpu_to_le32(dlen);

					dlen += UBIFS_DATA_NODE_SZ;

				}

			}

		}

	}

fs/ubifs/super.c

+4 −2
Original line number Diff line number Diff line
@@ -1210,7 +1210,8 @@ static int mount_ubifs(struct ubifs_info *c) 
		bu_init(c);



	if (!c->ro_mount) {

		c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ,

		c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ + \

					       UBIFS_CIPHER_BLOCK_SIZE,

					       GFP_KERNEL);

		if (!c->write_reserve_buf)

			goto out_free;
@@ -1623,7 +1624,8 @@ static int ubifs_remount_rw(struct ubifs_info *c) 
		goto out;

	}



	c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ, GFP_KERNEL);

	c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ + \

				       UBIFS_CIPHER_BLOCK_SIZE, GFP_KERNEL);

	if (!c->write_reserve_buf) {

		err = -ENOMEM;

		goto out;

fs/ubifs/ubifs.h

+29 −2
Original line number Diff line number Diff line
@@ -135,6 +135,12 @@ 
 */

#define WORST_COMPR_FACTOR 2



#ifdef CONFIG_UBIFS_FS_ENCRYPTION

#define UBIFS_CIPHER_BLOCK_SIZE FS_CRYPTO_BLOCK_SIZE

#else

#define UBIFS_CIPHER_BLOCK_SIZE 0

#endif



/*

 * How much memory is needed for a buffer where we compress a data node.

 */
@@ -1774,8 +1780,6 @@ void ubifs_compress(const struct ubifs_info *c, const void *in_buf, int in_len, 
int ubifs_decompress(const struct ubifs_info *c, const void *buf, int len,

		     void *out, int *out_len, int compr_type);



extern struct fscrypt_operations ubifs_crypt_operations;



#include "debug.h"

#include "misc.h"

#include "key.h"
@@ -1803,8 +1807,31 @@ extern struct fscrypt_operations ubifs_crypt_operations; 
#define fscrypt_fname_free_buffer       fscrypt_notsupp_fname_free_buffer

#define fscrypt_fname_disk_to_usr       fscrypt_notsupp_fname_disk_to_usr

#define fscrypt_fname_usr_to_disk       fscrypt_notsupp_fname_usr_to_disk

static inline int ubifs_encrypt(const struct inode *inode,

				struct ubifs_data_node *dn,

				unsigned int in_len, unsigned int *out_len,

				int block)

{

	ubifs_assert(0);

	return -EOPNOTSUPP;

}

static inline int ubifs_decrypt(const struct inode *inode,

				struct ubifs_data_node *dn,

				unsigned int *out_len, int block)

{

	ubifs_assert(0);

	return -EOPNOTSUPP;

}

#else

/* crypto.c */

int ubifs_encrypt(const struct inode *inode, struct ubifs_data_node *dn,

		  unsigned int in_len, unsigned int *out_len, int block);

int ubifs_decrypt(const struct inode *inode, struct ubifs_data_node *dn,

		  unsigned int *out_len, int block);

#endif



extern struct fscrypt_operations ubifs_crypt_operations;



static inline bool __ubifs_crypt_is_encrypted(struct inode *inode)

{

	struct ubifs_inode *ui = ubifs_inode(inode);