fs: verity: Added some more stuff trying to make it compilable. (93423729) · Commits · e / devices / android_kernel_sony_msm8994

fs/verity/fsverity_private.h

+50 −0

Original line number	Diff line number	Diff line
		@@ -20,6 +20,56 @@

		struct ahash_request;

		/* Missing stuff BEGIN */
		#include <linux/kasan-checks.h>
		#include <linux/kcsan-checks.h>

		#ifndef arch_cmpxchg_relaxed
		#define arch_cmpxchg_acquire arch_cmpxchg
		#define arch_cmpxchg_release arch_cmpxchg
		#define arch_cmpxchg_relaxed arch_cmpxchg
		#else /* arch_cmpxchg_relaxed */

		#ifndef arch_cmpxchg_acquire
		#define arch_cmpxchg_acquire(...) \
		__atomic_op_acquire(arch_cmpxchg, __VA_ARGS__)
		#endif

		#ifndef arch_cmpxchg_release
		#define arch_cmpxchg_release(...) \
		__atomic_op_release(arch_cmpxchg, __VA_ARGS__)
		#endif

		#ifndef arch_cmpxchg
		#define arch_cmpxchg(...) \
		__atomic_op_fence(arch_cmpxchg, __VA_ARGS__)
		#endif

		#endif /* arch_cmpxchg_relaxed */

		#define cmpxchg_release(ptr, ...) \
		({ \
		typeof(ptr) __ai_ptr = (ptr); \
		instrument_atomic_write(__ai_ptr, sizeof(*__ai_ptr)); \
		arch_cmpxchg_release(__ai_ptr, __VA_ARGS__); \
		})

		/**
		* instrument_atomic_write - instrument atomic write access
		*
		* Instrument an atomic write access. The instrumentation should be inserted
		* before the actual write happens.
		*
		* @ptr address of access
		* @size size of access
		*/
		static __always_inline void instrument_atomic_write(const volatile void *v, size_t size)
		{
		kasan_check_write(v, size);
		kcsan_check_atomic_write(v, size);
		}
		/* Missing stuff END */

		/*
		* Implementation limit: maximum depth of the Merkle tree. For now 8 is plenty;
		* it's enough for over U64_MAX bytes of data using SHA-256 and 4K blocks.

include/linux/dcache.h

+12 −0

Original line number	Diff line number	Diff line
		@@ -427,4 +427,16 @@ struct name_snapshot {
		void take_dentry_name_snapshot(struct name_snapshot , struct dentry );
		void release_dentry_name_snapshot(struct name_snapshot *);

		/**
		* d_inode - Get the actual inode of this dentry
		* @dentry: The dentry to query
		*
		* This is the helper normal filesystems should use to get at their own inodes
		* in their own dentries and ignore the layering superimposed upon them.
		*/
		static inline struct inode d_inode(const struct dentry dentry)
		{
		return dentry->d_inode;
		}

		#endif /* __LINUX_DCACHE_H */

include/linux/kasan-checks.h

0 → 100644

+50 −0

Original line number	Diff line number	Diff line
		/* SPDX-License-Identifier: GPL-2.0 */
		#ifndef _LINUX_KASAN_CHECKS_H
		#define _LINUX_KASAN_CHECKS_H

		#include <linux/types.h>

		/*
		* The annotations present in this file are only relevant for the software
		* KASAN modes that rely on compiler instrumentation, and will be optimized
		* away for the hardware tag-based KASAN mode. Use kasan_check_byte() instead.
		*/

		/*
		* __kasan_check_*: Always available when KASAN is enabled. This may be used
		* even in compilation units that selectively disable KASAN, but must use KASAN
		* to validate access to an address. Never use these in header files!
		*/
		#if defined(CONFIG_KASAN_GENERIC) \|\| defined(CONFIG_KASAN_SW_TAGS)
		bool __kasan_check_read(const volatile void *p, unsigned int size);
		bool __kasan_check_write(const volatile void *p, unsigned int size);
		#else
		static inline bool __kasan_check_read(const volatile void *p, unsigned int size)
		{
		return true;
		}
		static inline bool __kasan_check_write(const volatile void *p, unsigned int size)
		{
		return true;
		}
		#endif

		/*
		* kasan_check_*: Only available when the particular compilation unit has KASAN
		* instrumentation enabled. May be used in header files.
		*/
		#ifdef __SANITIZE_ADDRESS__
		#define kasan_check_read __kasan_check_read
		#define kasan_check_write __kasan_check_write
		#else
		static inline bool kasan_check_read(const volatile void *p, unsigned int size)
		{
		return true;
		}
		static inline bool kasan_check_write(const volatile void *p, unsigned int size)
		{
		return true;
		}
		#endif

		#endif

include/linux/kcsan-checks.h

0 → 100644

+452 −0

Original line number	Diff line number	Diff line
		/* SPDX-License-Identifier: GPL-2.0 */
		/*
		* KCSAN access checks and modifiers. These can be used to explicitly check
		* uninstrumented accesses, or change KCSAN checking behaviour of accesses.
		*
		* Copyright (C) 2019, Google LLC.
		*/

		#ifndef _LINUX_KCSAN_CHECKS_H
		#define _LINUX_KCSAN_CHECKS_H

		/* Note: Only include what is already included by compiler.h. */
		#include <linux/types.h>

		/* Access types -- if KCSAN_ACCESS_WRITE is not set, the access is a read. */
		#define KCSAN_ACCESS_WRITE (1 << 0) /* Access is a write. */
		#define KCSAN_ACCESS_COMPOUND (1 << 1) /* Compounded read-write instrumentation. */
		#define KCSAN_ACCESS_ATOMIC (1 << 2) /* Access is atomic. */
		/* The following are special, and never due to compiler instrumentation. */
		#define KCSAN_ACCESS_ASSERT (1 << 3) /* Access is an assertion. */
		#define KCSAN_ACCESS_SCOPED (1 << 4) /* Access is a scoped access. */

		/*
		* __kcsan_*: Always calls into the runtime when KCSAN is enabled. This may be used
		* even in compilation units that selectively disable KCSAN, but must use KCSAN
		* to validate access to an address. Never use these in header files!
		*/
		#ifdef CONFIG_KCSAN
		/**
		* __kcsan_check_access - check generic access for races
		*
		* @ptr: address of access
		* @size: size of access
		* @type: access type modifier
		*/
		void __kcsan_check_access(const volatile void *ptr, size_t size, int type);

		/**
		* kcsan_disable_current - disable KCSAN for the current context
		*
		* Supports nesting.
		*/
		void kcsan_disable_current(void);

		/**
		* kcsan_enable_current - re-enable KCSAN for the current context
		*
		* Supports nesting.
		*/
		void kcsan_enable_current(void);
		void kcsan_enable_current_nowarn(void); /* Safe in uaccess regions. */

		/**
		* kcsan_nestable_atomic_begin - begin nestable atomic region
		*
		* Accesses within the atomic region may appear to race with other accesses but
		* should be considered atomic.
		*/
		void kcsan_nestable_atomic_begin(void);

		/**
		* kcsan_nestable_atomic_end - end nestable atomic region
		*/
		void kcsan_nestable_atomic_end(void);

		/**
		* kcsan_flat_atomic_begin - begin flat atomic region
		*
		* Accesses within the atomic region may appear to race with other accesses but
		* should be considered atomic.
		*/
		void kcsan_flat_atomic_begin(void);

		/**
		* kcsan_flat_atomic_end - end flat atomic region
		*/
		void kcsan_flat_atomic_end(void);

		/**
		* kcsan_atomic_next - consider following accesses as atomic
		*
		* Force treating the next n memory accesses for the current context as atomic
		* operations.
		*
		* @n: number of following memory accesses to treat as atomic.
		*/
		void kcsan_atomic_next(int n);

		/**
		* kcsan_set_access_mask - set access mask
		*
		* Set the access mask for all accesses for the current context if non-zero.
		* Only value changes to bits set in the mask will be reported.
		*
		* @mask: bitmask
		*/
		void kcsan_set_access_mask(unsigned long mask);

		/* Scoped access information. */
		struct kcsan_scoped_access {
		struct list_head list;
		const volatile void *ptr;
		size_t size;
		int type;
		};
		/*
		* Automatically call kcsan_end_scoped_access() when kcsan_scoped_access goes
		* out of scope; relies on attribute "cleanup", which is supported by all
		* compilers that support KCSAN.
		*/
		#define __kcsan_cleanup_scoped \
		__maybe_unused __attribute__((__cleanup__(kcsan_end_scoped_access)))

		/**
		* kcsan_begin_scoped_access - begin scoped access
		*
		* Begin scoped access and initialize @sa, which will cause KCSAN to
		* continuously check the memory range in the current thread until
		* kcsan_end_scoped_access() is called for @sa.
		*
		* Scoped accesses are implemented by appending @sa to an internal list for the
		* current execution context, and then checked on every call into the KCSAN
		* runtime.
		*
		* @ptr: address of access
		* @size: size of access
		* @type: access type modifier
		* @sa: struct kcsan_scoped_access to use for the scope of the access
		*/
		struct kcsan_scoped_access *
		kcsan_begin_scoped_access(const volatile void *ptr, size_t size, int type,
		struct kcsan_scoped_access *sa);

		/**
		* kcsan_end_scoped_access - end scoped access
		*
		* End a scoped access, which will stop KCSAN checking the memory range.
		* Requires that kcsan_begin_scoped_access() was previously called once for @sa.
		*
		* @sa: a previously initialized struct kcsan_scoped_access
		*/
		void kcsan_end_scoped_access(struct kcsan_scoped_access *sa);


		#else /* CONFIG_KCSAN */

		static inline void __kcsan_check_access(const volatile void *ptr, size_t size,
		int type) { }

		static inline void kcsan_disable_current(void) { }
		static inline void kcsan_enable_current(void) { }
		static inline void kcsan_enable_current_nowarn(void) { }
		static inline void kcsan_nestable_atomic_begin(void) { }
		static inline void kcsan_nestable_atomic_end(void) { }
		static inline void kcsan_flat_atomic_begin(void) { }
		static inline void kcsan_flat_atomic_end(void) { }
		static inline void kcsan_atomic_next(int n) { }
		static inline void kcsan_set_access_mask(unsigned long mask) { }

		struct kcsan_scoped_access { };
		#define __kcsan_cleanup_scoped __maybe_unused
		static inline struct kcsan_scoped_access *
		kcsan_begin_scoped_access(const volatile void *ptr, size_t size, int type,
		struct kcsan_scoped_access *sa) { return sa; }
		static inline void kcsan_end_scoped_access(struct kcsan_scoped_access *sa) { }

		#endif /* CONFIG_KCSAN */

		#ifdef __SANITIZE_THREAD__
		/*
		* Only calls into the runtime when the particular compilation unit has KCSAN
		* instrumentation enabled. May be used in header files.
		*/
		#define kcsan_check_access __kcsan_check_access

		/*
		* Only use these to disable KCSAN for accesses in the current compilation unit;
		* calls into libraries may still perform KCSAN checks.
		*/
		#define __kcsan_disable_current kcsan_disable_current
		#define __kcsan_enable_current kcsan_enable_current_nowarn
		#else
		static inline void kcsan_check_access(const volatile void *ptr, size_t size,
		int type) { }
		static inline void __kcsan_enable_current(void) { }
		static inline void __kcsan_disable_current(void) { }
		#endif

		/**
		* __kcsan_check_read - check regular read access for races
		*
		* @ptr: address of access
		* @size: size of access
		*/
		#define __kcsan_check_read(ptr, size) __kcsan_check_access(ptr, size, 0)

		/**
		* __kcsan_check_write - check regular write access for races
		*
		* @ptr: address of access
		* @size: size of access
		*/
		#define __kcsan_check_write(ptr, size) \
		__kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)

		/**
		* __kcsan_check_read_write - check regular read-write access for races
		*
		* @ptr: address of access
		* @size: size of access
		*/
		#define __kcsan_check_read_write(ptr, size) \
		__kcsan_check_access(ptr, size, KCSAN_ACCESS_COMPOUND \| KCSAN_ACCESS_WRITE)

		/**
		* kcsan_check_read - check regular read access for races
		*
		* @ptr: address of access
		* @size: size of access
		*/
		#define kcsan_check_read(ptr, size) kcsan_check_access(ptr, size, 0)

		/**
		* kcsan_check_write - check regular write access for races
		*
		* @ptr: address of access
		* @size: size of access
		*/
		#define kcsan_check_write(ptr, size) \
		kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE)

		/**
		* kcsan_check_read_write - check regular read-write access for races
		*
		* @ptr: address of access
		* @size: size of access
		*/
		#define kcsan_check_read_write(ptr, size) \
		kcsan_check_access(ptr, size, KCSAN_ACCESS_COMPOUND \| KCSAN_ACCESS_WRITE)

		/*
		* Check for atomic accesses: if atomic accesses are not ignored, this simply
		* aliases to kcsan_check_access(), otherwise becomes a no-op.
		*/
		#ifdef CONFIG_KCSAN_IGNORE_ATOMICS
		#define kcsan_check_atomic_read(...) do { } while (0)
		#define kcsan_check_atomic_write(...) do { } while (0)
		#define kcsan_check_atomic_read_write(...) do { } while (0)
		#else
		#define kcsan_check_atomic_read(ptr, size) \
		kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC)
		#define kcsan_check_atomic_write(ptr, size) \
		kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC \| KCSAN_ACCESS_WRITE)
		#define kcsan_check_atomic_read_write(ptr, size) \
		kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC \| KCSAN_ACCESS_WRITE \| KCSAN_ACCESS_COMPOUND)
		#endif

		/**
		* ASSERT_EXCLUSIVE_WRITER - assert no concurrent writes to @var
		*
		* Assert that there are no concurrent writes to @var; other readers are
		* allowed. This assertion can be used to specify properties of concurrent code,
		* where violation cannot be detected as a normal data race.
		*
		* For example, if we only have a single writer, but multiple concurrent
		* readers, to avoid data races, all these accesses must be marked; even
		* concurrent marked writes racing with the single writer are bugs.
		* Unfortunately, due to being marked, they are no longer data races. For cases
		* like these, we can use the macro as follows:
		*
		* .. code-block:: c
		*
		* void writer(void) {
		* spin_lock(&update_foo_lock);
		* ASSERT_EXCLUSIVE_WRITER(shared_foo);
		* WRITE_ONCE(shared_foo, ...);
		* spin_unlock(&update_foo_lock);
		* }
		* void reader(void) {
		* // update_foo_lock does not need to be held!
		* ... = READ_ONCE(shared_foo);
		* }
		*
		* Note: ASSERT_EXCLUSIVE_WRITER_SCOPED(), if applicable, performs more thorough
		* checking if a clear scope where no concurrent writes are expected exists.
		*
		* @var: variable to assert on
		*/
		#define ASSERT_EXCLUSIVE_WRITER(var) \
		__kcsan_check_access(&(var), sizeof(var), KCSAN_ACCESS_ASSERT)

		/*
		* Helper macros for implementation of for ASSERT_EXCLUSIVE_*_SCOPED(). @id is
		* expected to be unique for the scope in which instances of kcsan_scoped_access
		* are declared.
		*/
		#define __kcsan_scoped_name(c, suffix) __kcsan_scoped_##c##suffix
		#define __ASSERT_EXCLUSIVE_SCOPED(var, type, id) \
		struct kcsan_scoped_access __kcsan_scoped_name(id, _) \
		__kcsan_cleanup_scoped; \
		struct kcsan_scoped_access *__kcsan_scoped_name(id, _dummy_p) \
		__maybe_unused = kcsan_begin_scoped_access( \
		&(var), sizeof(var), KCSAN_ACCESS_SCOPED \| (type), \
		&__kcsan_scoped_name(id, _))

		/**
		* ASSERT_EXCLUSIVE_WRITER_SCOPED - assert no concurrent writes to @var in scope
		*
		* Scoped variant of ASSERT_EXCLUSIVE_WRITER().
		*
		* Assert that there are no concurrent writes to @var for the duration of the
		* scope in which it is introduced. This provides a better way to fully cover
		* the enclosing scope, compared to multiple ASSERT_EXCLUSIVE_WRITER(), and
		* increases the likelihood for KCSAN to detect racing accesses.
		*
		* For example, it allows finding race-condition bugs that only occur due to
		* state changes within the scope itself:
		*
		* .. code-block:: c
		*
		* void writer(void) {
		* spin_lock(&update_foo_lock);
		* {
		* ASSERT_EXCLUSIVE_WRITER_SCOPED(shared_foo);
		* WRITE_ONCE(shared_foo, 42);
		* ...
		* // shared_foo should still be 42 here!
		* }
		* spin_unlock(&update_foo_lock);
		* }
		* void buggy(void) {
		* if (READ_ONCE(shared_foo) == 42)
		* WRITE_ONCE(shared_foo, 1); // bug!
		* }
		*
		* @var: variable to assert on
		*/
		#define ASSERT_EXCLUSIVE_WRITER_SCOPED(var) \
		__ASSERT_EXCLUSIVE_SCOPED(var, KCSAN_ACCESS_ASSERT, __COUNTER__)

		/**
		* ASSERT_EXCLUSIVE_ACCESS - assert no concurrent accesses to @var
		*
		* Assert that there are no concurrent accesses to @var (no readers nor
		* writers). This assertion can be used to specify properties of concurrent
		* code, where violation cannot be detected as a normal data race.
		*
		* For example, where exclusive access is expected after determining no other
		* users of an object are left, but the object is not actually freed. We can
		* check that this property actually holds as follows:
		*
		* .. code-block:: c
		*
		* if (refcount_dec_and_test(&obj->refcnt)) {
		* ASSERT_EXCLUSIVE_ACCESS(*obj);
		* do_some_cleanup(obj);
		* release_for_reuse(obj);
		* }
		*
		* Note:
		*
		* 1. ASSERT_EXCLUSIVE_ACCESS_SCOPED(), if applicable, performs more thorough
		* checking if a clear scope where no concurrent accesses are expected exists.
		*
		* 2. For cases where the object is freed, `KASAN <kasan.html>`_ is a better
		* fit to detect use-after-free bugs.
		*
		* @var: variable to assert on
		*/
		#define ASSERT_EXCLUSIVE_ACCESS(var) \
		__kcsan_check_access(&(var), sizeof(var), KCSAN_ACCESS_WRITE \| KCSAN_ACCESS_ASSERT)

		/**
		* ASSERT_EXCLUSIVE_ACCESS_SCOPED - assert no concurrent accesses to @var in scope
		*
		* Scoped variant of ASSERT_EXCLUSIVE_ACCESS().
		*
		* Assert that there are no concurrent accesses to @var (no readers nor writers)
		* for the entire duration of the scope in which it is introduced. This provides
		* a better way to fully cover the enclosing scope, compared to multiple
		* ASSERT_EXCLUSIVE_ACCESS(), and increases the likelihood for KCSAN to detect
		* racing accesses.
		*
		* @var: variable to assert on
		*/
		#define ASSERT_EXCLUSIVE_ACCESS_SCOPED(var) \
		__ASSERT_EXCLUSIVE_SCOPED(var, KCSAN_ACCESS_WRITE \| KCSAN_ACCESS_ASSERT, __COUNTER__)

		/**
		* ASSERT_EXCLUSIVE_BITS - assert no concurrent writes to subset of bits in @var
		*
		* Bit-granular variant of ASSERT_EXCLUSIVE_WRITER().
		*
		* Assert that there are no concurrent writes to a subset of bits in @var;
		* concurrent readers are permitted. This assertion captures more detailed
		* bit-level properties, compared to the other (word granularity) assertions.
		* Only the bits set in @mask are checked for concurrent modifications, while
		* ignoring the remaining bits, i.e. concurrent writes (or reads) to ~mask bits
		* are ignored.
		*
		* Use this for variables, where some bits must not be modified concurrently,
		* yet other bits are expected to be modified concurrently.
		*
		* For example, variables where, after initialization, some bits are read-only,
		* but other bits may still be modified concurrently. A reader may wish to
		* assert that this is true as follows:
		*
		* .. code-block:: c
		*
		* ASSERT_EXCLUSIVE_BITS(flags, READ_ONLY_MASK);
		* foo = (READ_ONCE(flags) & READ_ONLY_MASK) >> READ_ONLY_SHIFT;
		*
		* Note: The access that immediately follows ASSERT_EXCLUSIVE_BITS() is assumed
		* to access the masked bits only, and KCSAN optimistically assumes it is
		* therefore safe, even in the presence of data races, and marking it with
		* READ_ONCE() is optional from KCSAN's point-of-view. We caution, however, that
		* it may still be advisable to do so, since we cannot reason about all compiler
		* optimizations when it comes to bit manipulations (on the reader and writer
		* side). If you are sure nothing can go wrong, we can write the above simply
		* as:
		*
		* .. code-block:: c
		*
		* ASSERT_EXCLUSIVE_BITS(flags, READ_ONLY_MASK);
		* foo = (flags & READ_ONLY_MASK) >> READ_ONLY_SHIFT;
		*
		* Another example, where this may be used, is when certain bits of @var may
		* only be modified when holding the appropriate lock, but other bits may still
		* be modified concurrently. Writers, where other bits may change concurrently,
		* could use the assertion as follows:
		*
		* .. code-block:: c
		*
		* spin_lock(&foo_lock);
		* ASSERT_EXCLUSIVE_BITS(flags, FOO_MASK);
		* old_flags = flags;
		* new_flags = (old_flags & ~FOO_MASK) \| (new_foo << FOO_SHIFT);
		* if (cmpxchg(&flags, old_flags, new_flags) != old_flags) { ... }
		* spin_unlock(&foo_lock);
		*
		* @var: variable to assert on
		* @mask: only check for modifications to bits set in @mask
		*/
		#define ASSERT_EXCLUSIVE_BITS(var, mask) \
		do { \
		kcsan_set_access_mask(mask); \
		__kcsan_check_access(&(var), sizeof(var), KCSAN_ACCESS_ASSERT);\
		kcsan_set_access_mask(0); \
		kcsan_atomic_next(1); \
		} while (0)

		#endif /* _LINUX_KCSAN_CHECKS_H */

include/linux/slab.h

+16 −0

Original line number	Diff line number	Diff line
		@@ -108,6 +108,11 @@ struct kmem_cache kmem_cache_create(const char , size_t, size_t,
		struct kmem_cache *
		kmem_cache_create_memcg(struct mem_cgroup , const char , size_t, size_t,
		unsigned long, void ()(void ), struct kmem_cache *);
		struct kmem_cache kmem_cache_create_usercopy(const char name,
		unsigned int size, unsigned int align,
		slab_flags_t flags,
		unsigned int useroffset, unsigned int usersize,
		void (ctor)(void ));
		void kmem_cache_destroy(struct kmem_cache *);
		int kmem_cache_shrink(struct kmem_cache *);
		void kmem_cache_free(struct kmem_cache , void );
		@@ -124,6 +129,17 @@ void kmem_cache_free(struct kmem_cache , void );
		sizeof(struct __struct), __alignof__(struct __struct),\
		(__flags), NULL)

		/*
		* To whitelist a single field for copying to/from usercopy, use this
		* macro instead for KMEM_CACHE() above.
		*/
		#define KMEM_CACHE_USERCOPY(__struct, __flags, __field) \
		kmem_cache_create_usercopy(#__struct, \
		sizeof(struct __struct), \
		__alignof__(struct __struct), (__flags), \
		offsetof(struct __struct, __field), \
		sizeof_field(struct __struct, __field), NULL)

		/*
		* Common kmalloc functions provided by all allocators
		*/