verity.c

  1// SPDX-License-Identifier: GPL-2.0
  2
  3#include <linux/init.h>
  4#include <linux/fs.h>
  5#include <linux/slab.h>
  6#include <linux/rwsem.h>
  7#include <linux/xattr.h>
  8#include <linux/security.h>
  9#include <linux/posix_acl_xattr.h>
 10#include <linux/iversion.h>
 11#include <linux/fsverity.h>
 12#include <linux/sched/mm.h>
 13#include "messages.h"
 14#include "ctree.h"
 15#include "btrfs_inode.h"
 16#include "transaction.h"
 17#include "locking.h"
 18#include "fs.h"
 19#include "accessors.h"
 20#include "ioctl.h"
 21#include "verity.h"
 22#include "orphan.h"
 23
 24/*
 25 * Implementation of the interface defined in struct fsverity_operations.
 26 *
 27 * The main question is how and where to store the verity descriptor and the
 28 * Merkle tree. We store both in dedicated btree items in the filesystem tree,
 29 * together with the rest of the inode metadata. This means we'll need to do
 30 * extra work to encrypt them once encryption is supported in btrfs, but btrfs
 31 * has a lot of careful code around i_size and it seems better to make a new key
 32 * type than try and adjust all of our expectations for i_size.
 33 *
 34 * Note that this differs from the implementation in ext4 and f2fs, where
 35 * this data is stored as if it were in the file, but past EOF. However, btrfs
 36 * does not have a widespread mechanism for caching opaque metadata pages, so we
 37 * do pretend that the Merkle tree pages themselves are past EOF for the
 38 * purposes of caching them (as opposed to creating a virtual inode).
 39 *
 40 * fs verity items are stored under two different key types on disk.
 41 * The descriptor items:
 42 * [ inode objectid, BTRFS_VERITY_DESC_ITEM_KEY, offset ]
 43 *
 44 * At offset 0, we store a btrfs_verity_descriptor_item which tracks the
 45 * size of the descriptor item and some extra data for encryption.
 46 * Starting at offset 1, these hold the generic fs verity descriptor.
 47 * The latter are opaque to btrfs, we just read and write them as a blob for
 48 * the higher level verity code.  The most common descriptor size is 256 bytes.
 49 *
 50 * The merkle tree items:
 51 * [ inode objectid, BTRFS_VERITY_MERKLE_ITEM_KEY, offset ]
 52 *
 53 * These also start at offset 0, and correspond to the merkle tree bytes.
 54 * So when fsverity asks for page 0 of the merkle tree, we pull up one page
 55 * starting at offset 0 for this key type.  These are also opaque to btrfs,
 56 * we're blindly storing whatever fsverity sends down.
 57 *
 58 * Another important consideration is the fact that the Merkle tree data scales
 59 * linearly with the size of the file (with 4K pages/blocks and SHA-256, it's
 60 * ~1/127th the size) so for large files, writing the tree can be a lengthy
 61 * operation. For that reason, we guard the whole enable verity operation
 62 * (between begin_enable_verity and end_enable_verity) with an orphan item.
 63 * Again, because the data can be pretty large, it's quite possible that we
 64 * could run out of space writing it, so we try our best to handle errors by
 65 * stopping and rolling back rather than aborting the victim transaction.
 66 */
 67
 68#define MERKLE_START_ALIGN			65536
 69
 70/*
 71 * Compute the logical file offset where we cache the Merkle tree.
 72 *
 73 * @inode:  inode of the verity file
 74 *
 75 * For the purposes of caching the Merkle tree pages, as required by
 76 * fs-verity, it is convenient to do size computations in terms of a file
 77 * offset, rather than in terms of page indices.
 78 *
 79 * Use 64K to be sure it's past the last page in the file, even with 64K pages.
 80 * That rounding operation itself can overflow loff_t, so we do it in u64 and
 81 * check.
 82 *
 83 * Returns the file offset on success, negative error code on failure.
 84 */
 85static loff_t merkle_file_pos(const struct inode *inode)
 86{
 87	u64 sz = inode->i_size;
 88	u64 rounded = round_up(sz, MERKLE_START_ALIGN);
 89
 90	if (rounded > inode->i_sb->s_maxbytes)
 91		return -EFBIG;
 92
 93	return rounded;
 94}
 95
 96/*
 97 * Drop all the items for this inode with this key_type.
 98 *
 99 * @inode:     inode to drop items for
100 * @key_type:  type of items to drop (BTRFS_VERITY_DESC_ITEM or
101 *             BTRFS_VERITY_MERKLE_ITEM)
102 *
103 * Before doing a verity enable we cleanup any existing verity items.
104 * This is also used to clean up if a verity enable failed half way through.
105 *
106 * Returns number of dropped items on success, negative error code on failure.
107 */
108static int drop_verity_items(struct btrfs_inode *inode, u8 key_type)
109{
110	struct btrfs_trans_handle *trans;
111	struct btrfs_root *root = inode->root;
112	BTRFS_PATH_AUTO_FREE(path);
113	struct btrfs_key key;
114	int count = 0;
115	int ret;
116
117	path = btrfs_alloc_path();
118	if (!path)
119		return -ENOMEM;
120
121	while (1) {
122		/* 1 for the item being dropped */
123		trans = btrfs_start_transaction(root, 1);
124		if (IS_ERR(trans))
125			return PTR_ERR(trans);
126
127		/*
128		 * Walk backwards through all the items until we find one that
129		 * isn't from our key type or objectid
130		 */
131		key.objectid = btrfs_ino(inode);
132		key.type = key_type;
133		key.offset = (u64)-1;
134
135		ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
136		if (ret > 0) {
137			ret = 0;
138			/* No more keys of this type, we're done */
139			if (path->slots[0] == 0)
140				break;
141			path->slots[0]--;
142		} else if (ret < 0) {
143			btrfs_end_transaction(trans);
144			return ret;
145		}
146
147		btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
148
149		/* No more keys of this type, we're done */
150		if (key.objectid != btrfs_ino(inode) || key.type != key_type)
151			break;
152
153		/*
154		 * This shouldn't be a performance sensitive function because
155		 * it's not used as part of truncate.  If it ever becomes
156		 * perf sensitive, change this to walk forward and bulk delete
157		 * items
158		 */
159		ret = btrfs_del_items(trans, root, path, path->slots[0], 1);
160		if (ret) {
161			btrfs_end_transaction(trans);
162			return ret;
163		}
164		count++;
165		btrfs_release_path(path);
166		btrfs_end_transaction(trans);
167	}
168	btrfs_end_transaction(trans);
169	return count;
170}
171
172/*
173 * Drop all verity items
174 *
175 * @inode:  inode to drop verity items for
176 *
177 * In most contexts where we are dropping verity items, we want to do it for all
178 * the types of verity items, not a particular one.
179 *
180 * Returns: 0 on success, negative error code on failure.
181 */
182int btrfs_drop_verity_items(struct btrfs_inode *inode)
183{
184	int ret;
185
186	ret = drop_verity_items(inode, BTRFS_VERITY_DESC_ITEM_KEY);
187	if (ret < 0)
188		return ret;
189	ret = drop_verity_items(inode, BTRFS_VERITY_MERKLE_ITEM_KEY);
190	if (ret < 0)
191		return ret;
192
193	return 0;
194}
195
196/*
197 * Insert and write inode items with a given key type and offset.
198 *
199 * @inode:     inode to insert for
200 * @key_type:  key type to insert
201 * @offset:    item offset to insert at
202 * @src:       source data to write
203 * @len:       length of source data to write
204 *
205 * Write len bytes from src into items of up to 2K length.
206 * The inserted items will have key (ino, key_type, offset + off) where off is
207 * consecutively increasing from 0 up to the last item ending at offset + len.
208 *
209 * Returns 0 on success and a negative error code on failure.
210 */
211static int write_key_bytes(struct btrfs_inode *inode, u8 key_type, u64 offset,
212			   const char *src, u64 len)
213{
214	struct btrfs_trans_handle *trans;
215	BTRFS_PATH_AUTO_FREE(path);
216	struct btrfs_root *root = inode->root;
217	struct extent_buffer *leaf;
218	struct btrfs_key key;
219	unsigned long copy_bytes;
220	unsigned long src_offset = 0;
221	void *data;
222	int ret = 0;
223
224	path = btrfs_alloc_path();
225	if (!path)
226		return -ENOMEM;
227
228	while (len > 0) {
229		/* 1 for the new item being inserted */
230		trans = btrfs_start_transaction(root, 1);
231		if (IS_ERR(trans))
232			return PTR_ERR(trans);
233
234		key.objectid = btrfs_ino(inode);
235		key.type = key_type;
236		key.offset = offset;
237
238		/*
239		 * Insert 2K at a time mostly to be friendly for smaller leaf
240		 * size filesystems
241		 */
242		copy_bytes = min_t(u64, len, 2048);
243
244		ret = btrfs_insert_empty_item(trans, root, path, &key, copy_bytes);
245		if (ret) {
246			btrfs_end_transaction(trans);
247			break;
248		}
249
250		leaf = path->nodes[0];
251
252		data = btrfs_item_ptr(leaf, path->slots[0], void);
253		write_extent_buffer(leaf, src + src_offset,
254				    (unsigned long)data, copy_bytes);
255		offset += copy_bytes;
256		src_offset += copy_bytes;
257		len -= copy_bytes;
258
259		btrfs_release_path(path);
260		btrfs_end_transaction(trans);
261	}
262
263	return ret;
264}
265
266/*
267 * Read inode items of the given key type and offset from the btree.
268 *
269 * @inode:      inode to read items of
270 * @key_type:   key type to read
271 * @offset:     item offset to read from
272 * @dest:       Buffer to read into. This parameter has slightly tricky
273 *              semantics.  If it is NULL, the function will not do any copying
274 *              and will just return the size of all the items up to len bytes.
275 *              If dest_page is passed, then the function will kmap_local the
276 *              page and ignore dest, but it must still be non-NULL to avoid the
277 *              counting-only behavior.
278 * @len:        length in bytes to read
279 * @dest_folio: copy into this folio instead of the dest buffer
280 *
281 * Helper function to read items from the btree.  This returns the number of
282 * bytes read or < 0 for errors.  We can return short reads if the items don't
283 * exist on disk or aren't big enough to fill the desired length.  Supports
284 * reading into a provided buffer (dest) or into the page cache
285 *
286 * Returns number of bytes read or a negative error code on failure.
287 */
288static int read_key_bytes(struct btrfs_inode *inode, u8 key_type, u64 offset,
289			  char *dest, u64 len, struct folio *dest_folio)
290{
291	BTRFS_PATH_AUTO_FREE(path);
292	struct btrfs_root *root = inode->root;
293	struct extent_buffer *leaf;
294	struct btrfs_key key;
295	u64 item_end;
296	u64 copy_end;
297	int copied = 0;
298	u32 copy_offset;
299	unsigned long copy_bytes;
300	unsigned long dest_offset = 0;
301	void *data;
302	char *kaddr = dest;
303	int ret;
304
305	path = btrfs_alloc_path();
306	if (!path)
307		return -ENOMEM;
308
309	if (dest_folio)
310		path->reada = READA_FORWARD;
311
312	key.objectid = btrfs_ino(inode);
313	key.type = key_type;
314	key.offset = offset;
315
316	ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
317	if (ret < 0) {
318		goto out;
319	} else if (ret > 0) {
320		ret = 0;
321		if (path->slots[0] == 0)
322			goto out;
323		path->slots[0]--;
324	}
325
326	while (len > 0) {
327		leaf = path->nodes[0];
328		btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
329
330		if (key.objectid != btrfs_ino(inode) || key.type != key_type)
331			break;
332
333		item_end = btrfs_item_size(leaf, path->slots[0]) + key.offset;
334
335		if (copied > 0) {
336			/*
337			 * Once we've copied something, we want all of the items
338			 * to be sequential
339			 */
340			if (key.offset != offset)
341				break;
342		} else {
343			/*
344			 * Our initial offset might be in the middle of an
345			 * item.  Make sure it all makes sense.
346			 */
347			if (key.offset > offset)
348				break;
349			if (item_end <= offset)
350				break;
351		}
352
353		/* desc = NULL to just sum all the item lengths */
354		if (!dest)
355			copy_end = item_end;
356		else
357			copy_end = min(offset + len, item_end);
358
359		/* Number of bytes in this item we want to copy */
360		copy_bytes = copy_end - offset;
361
362		/* Offset from the start of item for copying */
363		copy_offset = offset - key.offset;
364
365		if (dest) {
366			if (dest_folio)
367				kaddr = kmap_local_folio(dest_folio, 0);
368
369			data = btrfs_item_ptr(leaf, path->slots[0], void);
370			read_extent_buffer(leaf, kaddr + dest_offset,
371					   (unsigned long)data + copy_offset,
372					   copy_bytes);
373
374			if (dest_folio)
375				kunmap_local(kaddr);
376		}
377
378		offset += copy_bytes;
379		dest_offset += copy_bytes;
380		len -= copy_bytes;
381		copied += copy_bytes;
382
383		path->slots[0]++;
384		if (path->slots[0] >= btrfs_header_nritems(path->nodes[0])) {
385			/*
386			 * We've reached the last slot in this leaf and we need
387			 * to go to the next leaf.
388			 */
389			ret = btrfs_next_leaf(root, path);
390			if (ret < 0) {
391				break;
392			} else if (ret > 0) {
393				ret = 0;
394				break;
395			}
396		}
397	}
398out:
399	if (!ret)
400		ret = copied;
401	return ret;
402}
403
404/*
405 * Delete an fsverity orphan
406 *
407 * @trans:  transaction to do the delete in
408 * @inode:  inode to orphan
409 *
410 * Capture verity orphan specific logic that is repeated in the couple places
411 * we delete verity orphans. Specifically, handling ENOENT and ignoring inodes
412 * with 0 links.
413 *
414 * Returns zero on success or a negative error code on failure.
415 */
416static int del_orphan(struct btrfs_trans_handle *trans, struct btrfs_inode *inode)
417{
418	struct btrfs_root *root = inode->root;
419	int ret;
420
421	/*
422	 * If the inode has no links, it is either already unlinked, or was
423	 * created with O_TMPFILE. In either case, it should have an orphan from
424	 * that other operation. Rather than reference count the orphans, we
425	 * simply ignore them here, because we only invoke the verity path in
426	 * the orphan logic when i_nlink is 1.
427	 */
428	if (!inode->vfs_inode.i_nlink)
429		return 0;
430
431	ret = btrfs_del_orphan_item(trans, root, btrfs_ino(inode));
432	if (ret == -ENOENT)
433		ret = 0;
434	return ret;
435}
436
437/*
438 * Rollback in-progress verity if we encounter an error.
439 *
440 * @inode:  inode verity had an error for
441 *
442 * We try to handle recoverable errors while enabling verity by rolling it back
443 * and just failing the operation, rather than having an fs level error no
444 * matter what. However, any error in rollback is unrecoverable.
445 *
446 * Returns 0 on success, negative error code on failure.
447 */
448static int rollback_verity(struct btrfs_inode *inode)
449{
450	struct btrfs_trans_handle *trans = NULL;
451	struct btrfs_root *root = inode->root;
452	int ret;
453
454	btrfs_assert_inode_locked(inode);
455	truncate_inode_pages(inode->vfs_inode.i_mapping, inode->vfs_inode.i_size);
456	clear_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
457	ret = btrfs_drop_verity_items(inode);
458	if (ret) {
459		btrfs_handle_fs_error(root->fs_info, ret,
460				"failed to drop verity items in rollback %llu",
461				(u64)inode->vfs_inode.i_ino);
462		goto out;
463	}
464
465	/*
466	 * 1 for updating the inode flag
467	 * 1 for deleting the orphan
468	 */
469	trans = btrfs_start_transaction(root, 2);
470	if (IS_ERR(trans)) {
471		ret = PTR_ERR(trans);
472		trans = NULL;
473		btrfs_handle_fs_error(root->fs_info, ret,
474			"failed to start transaction in verity rollback %llu",
475			(u64)inode->vfs_inode.i_ino);
476		goto out;
477	}
478	inode->ro_flags &= ~BTRFS_INODE_RO_VERITY;
479	btrfs_sync_inode_flags_to_i_flags(inode);
480	ret = btrfs_update_inode(trans, inode);
481	if (unlikely(ret)) {
482		btrfs_abort_transaction(trans, ret);
483		goto out;
484	}
485	ret = del_orphan(trans, inode);
486	if (unlikely(ret)) {
487		btrfs_abort_transaction(trans, ret);
488		goto out;
489	}
490out:
491	if (trans)
492		btrfs_end_transaction(trans);
493	return ret;
494}
495
496/*
497 * Finalize making the file a valid verity file
498 *
499 * @inode:      inode to be marked as verity
500 * @desc:       contents of the verity descriptor to write (not NULL)
501 * @desc_size:  size of the verity descriptor
502 *
503 * Do the actual work of finalizing verity after successfully writing the Merkle
504 * tree:
505 *
506 * - write out the descriptor items
507 * - mark the inode with the verity flag
508 * - delete the orphan item
509 * - mark the ro compat bit
510 * - clear the in progress bit
511 *
512 * Returns 0 on success, negative error code on failure.
513 */
514static int finish_verity(struct btrfs_inode *inode, const void *desc,
515			 size_t desc_size)
516{
517	struct btrfs_trans_handle *trans = NULL;
518	struct btrfs_root *root = inode->root;
519	struct btrfs_verity_descriptor_item item;
520	int ret;
521
522	/* Write out the descriptor item */
523	memset(&item, 0, sizeof(item));
524	btrfs_set_stack_verity_descriptor_size(&item, desc_size);
525	ret = write_key_bytes(inode, BTRFS_VERITY_DESC_ITEM_KEY, 0,
526			      (const char *)&item, sizeof(item));
527	if (ret)
528		goto out;
529
530	/* Write out the descriptor itself */
531	ret = write_key_bytes(inode, BTRFS_VERITY_DESC_ITEM_KEY, 1,
532			      desc, desc_size);
533	if (ret)
534		goto out;
535
536	/*
537	 * 1 for updating the inode flag
538	 * 1 for deleting the orphan
539	 */
540	trans = btrfs_start_transaction(root, 2);
541	if (IS_ERR(trans)) {
542		ret = PTR_ERR(trans);
543		goto out;
544	}
545	inode->ro_flags |= BTRFS_INODE_RO_VERITY;
546	btrfs_sync_inode_flags_to_i_flags(inode);
547	ret = btrfs_update_inode(trans, inode);
548	if (ret)
549		goto end_trans;
550	ret = del_orphan(trans, inode);
551	if (ret)
552		goto end_trans;
553	clear_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
554	btrfs_set_fs_compat_ro(root->fs_info, VERITY);
555end_trans:
556	btrfs_end_transaction(trans);
557out:
558	return ret;
559
560}
561
562/*
563 * fsverity op that begins enabling verity.
564 *
565 * @filp:  file to enable verity on
566 *
567 * Begin enabling fsverity for the file. We drop any existing verity items, add
568 * an orphan and set the in progress bit.
569 *
570 * Returns 0 on success, negative error code on failure.
571 */
572static int btrfs_begin_enable_verity(struct file *filp)
573{
574	struct btrfs_inode *inode = BTRFS_I(file_inode(filp));
575	struct btrfs_root *root = inode->root;
576	struct btrfs_trans_handle *trans;
577	int ret;
578
579	btrfs_assert_inode_locked(inode);
580
581	if (IS_ENCRYPTED(&inode->vfs_inode))
582		return -EOPNOTSUPP;
583
584	if (test_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags))
585		return -EBUSY;
586
587	/*
588	 * This should almost never do anything, but theoretically, it's
589	 * possible that we failed to enable verity on a file, then were
590	 * interrupted or failed while rolling back, failed to cleanup the
591	 * orphan, and finally attempt to enable verity again.
592	 */
593	ret = btrfs_drop_verity_items(inode);
594	if (ret)
595		return ret;
596
597	/* 1 for the orphan item */
598	trans = btrfs_start_transaction(root, 1);
599	if (IS_ERR(trans))
600		return PTR_ERR(trans);
601
602	ret = btrfs_orphan_add(trans, inode);
603	if (!ret)
604		set_bit(BTRFS_INODE_VERITY_IN_PROGRESS, &inode->runtime_flags);
605	btrfs_end_transaction(trans);
606
607	return 0;
608}
609
610/*
611 * fsverity op that ends enabling verity.
612 *
613 * @filp:              file we are finishing enabling verity on
614 * @desc:              verity descriptor to write out (NULL in error conditions)
615 * @desc_size:         size of the verity descriptor (variable with signatures)
616 * @merkle_tree_size:  size of the merkle tree in bytes
617 *
618 * If desc is null, then VFS is signaling an error occurred during verity
619 * enable, and we should try to rollback. Otherwise, attempt to finish verity.
620 *
621 * Returns 0 on success, negative error code on error.
622 */
623static int btrfs_end_enable_verity(struct file *filp, const void *desc,
624				   size_t desc_size, u64 merkle_tree_size)
625{
626	struct btrfs_inode *inode = BTRFS_I(file_inode(filp));
627	int ret = 0;
628	int rollback_ret;
629
630	btrfs_assert_inode_locked(inode);
631
632	if (desc == NULL)
633		goto rollback;
634
635	ret = finish_verity(inode, desc, desc_size);
636	if (ret)
637		goto rollback;
638	return ret;
639
640rollback:
641	rollback_ret = rollback_verity(inode);
642	if (rollback_ret)
643		btrfs_err(inode->root->fs_info,
644			  "failed to rollback verity items: %d", rollback_ret);
645	return ret;
646}
647
648/*
649 * fsverity op that gets the struct fsverity_descriptor.
650 *
651 * @inode:     inode to get the descriptor of
652 * @buf:       output buffer for the descriptor contents
653 * @buf_size:  size of the output buffer. 0 to query the size
654 *
655 * fsverity does a two pass setup for reading the descriptor, in the first pass
656 * it calls with buf_size = 0 to query the size of the descriptor, and then in
657 * the second pass it actually reads the descriptor off disk.
658 *
659 * Returns the size on success or a negative error code on failure.
660 */
661int btrfs_get_verity_descriptor(struct inode *inode, void *buf, size_t buf_size)
662{
663	u64 true_size;
664	int ret = 0;
665	struct btrfs_verity_descriptor_item item;
666
667	memset(&item, 0, sizeof(item));
668	ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_DESC_ITEM_KEY, 0,
669			     (char *)&item, sizeof(item), NULL);
670	if (ret < 0)
671		return ret;
672
673	if (unlikely(item.reserved[0] != 0 || item.reserved[1] != 0))
674		return -EUCLEAN;
675
676	true_size = btrfs_stack_verity_descriptor_size(&item);
677	if (unlikely(true_size > INT_MAX))
678		return -EUCLEAN;
679
680	if (buf_size == 0)
681		return true_size;
682	if (buf_size < true_size)
683		return -ERANGE;
684
685	ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_DESC_ITEM_KEY, 1,
686			     buf, buf_size, NULL);
687	if (ret < 0)
688		return ret;
689	if (ret != true_size)
690		return -EIO;
691
692	return true_size;
693}
694
695/*
696 * fsverity op that reads and caches a merkle tree page.
697 *
698 * @inode:         inode to read a merkle tree page for
699 * @index:         page index relative to the start of the merkle tree
700 * @num_ra_pages:  number of pages to readahead. Optional, we ignore it
701 *
702 * The Merkle tree is stored in the filesystem btree, but its pages are cached
703 * with a logical position past EOF in the inode's mapping.
704 *
705 * Returns the page we read, or an ERR_PTR on error.
706 */
707static struct page *btrfs_read_merkle_tree_page(struct inode *inode,
708						pgoff_t index,
709						unsigned long num_ra_pages)
710{
711	struct folio *folio;
712	u64 off = (u64)index << PAGE_SHIFT;
713	loff_t merkle_pos = merkle_file_pos(inode);
714	int ret;
715
716	if (merkle_pos < 0)
717		return ERR_PTR(merkle_pos);
718	if (merkle_pos > inode->i_sb->s_maxbytes - off - PAGE_SIZE)
719		return ERR_PTR(-EFBIG);
720	index += merkle_pos >> PAGE_SHIFT;
721again:
722	folio = __filemap_get_folio(inode->i_mapping, index, FGP_ACCESSED, 0);
723	if (!IS_ERR(folio)) {
724		if (folio_test_uptodate(folio))
725			goto out;
726
727		folio_lock(folio);
728		/* If it's not uptodate after we have the lock, we got a read error. */
729		if (!folio_test_uptodate(folio)) {
730			folio_unlock(folio);
731			folio_put(folio);
732			return ERR_PTR(-EIO);
733		}
734		folio_unlock(folio);
735		goto out;
736	}
737
738	folio = filemap_alloc_folio(mapping_gfp_constraint(inode->i_mapping, ~__GFP_FS),
739				    0, NULL);
740	if (!folio)
741		return ERR_PTR(-ENOMEM);
742
743	ret = filemap_add_folio(inode->i_mapping, folio, index, GFP_NOFS);
744	if (ret) {
745		folio_put(folio);
746		/* Did someone else insert a folio here? */
747		if (ret == -EEXIST)
748			goto again;
749		return ERR_PTR(ret);
750	}
751
752	/*
753	 * Merkle item keys are indexed from byte 0 in the merkle tree.
754	 * They have the form:
755	 *
756	 * [ inode objectid, BTRFS_MERKLE_ITEM_KEY, offset in bytes ]
757	 */
758	ret = read_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY, off,
759			     folio_address(folio), PAGE_SIZE, folio);
760	if (ret < 0) {
761		folio_put(folio);
762		return ERR_PTR(ret);
763	}
764	if (ret < PAGE_SIZE)
765		folio_zero_segment(folio, ret, PAGE_SIZE);
766
767	folio_mark_uptodate(folio);
768	folio_unlock(folio);
769
770out:
771	return folio_file_page(folio, index);
772}
773
774/*
775 * fsverity op that writes a Merkle tree block into the btree.
776 *
777 * @inode:	inode to write a Merkle tree block for
778 * @buf:	Merkle tree block to write
779 * @pos:	the position of the block in the Merkle tree (in bytes)
780 * @size:	the Merkle tree block size (in bytes)
781 *
782 * Returns 0 on success or negative error code on failure
783 */
784static int btrfs_write_merkle_tree_block(struct inode *inode, const void *buf,
785					 u64 pos, unsigned int size)
786{
787	loff_t merkle_pos = merkle_file_pos(inode);
788
789	if (merkle_pos < 0)
790		return merkle_pos;
791	if (merkle_pos > inode->i_sb->s_maxbytes - pos - size)
792		return -EFBIG;
793
794	return write_key_bytes(BTRFS_I(inode), BTRFS_VERITY_MERKLE_ITEM_KEY,
795			       pos, buf, size);
796}
797
798const struct fsverity_operations btrfs_verityops = {
799	.inode_info_offs         = (int)offsetof(struct btrfs_inode, i_verity_info) -
800				   (int)offsetof(struct btrfs_inode, vfs_inode),
801	.begin_enable_verity     = btrfs_begin_enable_verity,
802	.end_enable_verity       = btrfs_end_enable_verity,
803	.get_verity_descriptor   = btrfs_get_verity_descriptor,
804	.read_merkle_tree_page   = btrfs_read_merkle_tree_page,
805	.write_merkle_tree_block = btrfs_write_merkle_tree_block,
806};