| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20180703170700.9306-18-krisman@collabora.co.uk>
Date: Tue, 3 Jul 2018 13:06:57 -0400
From: Gabriel Krisman Bertazi <krisman@...labora.co.uk>
To: tytso@....edu
Cc: linux-ext4@...r.kernel.org, darrick.wong@...cle.com,
kernel@...labora.com,
Gabriel Krisman Bertazi <krisman@...labora.co.uk>
Subject: [PATCH 17/20] ext4: Include encoding information in the superblock
Support for encoding is considered an incompatible feature, since it has
potential to create collisions of file names in existing filesystems.
If the feature flag is not enabled, the entire filesystem will operate
on opaque byte sequences, respecting the original behavior.
The charset data is encoded in a new field in the superblock using a
magic number specific to ext4. This is the easiest way I found to avoid
writing the name of the charset in the superblock. The magic number is
mapped to the exact NLS table, but the mapping is specific to ext4.
Since we don't have any commitment to support old encodings, the only
encodings I am supporting right now is utf8n-10.0.0 and ascii, both
using the NLS abstraction.
A mount option that forces the use of an encoding is also provided.
This allows the user to override the superblock information and force
the mount using a specific encoding. There is little point in doing
that, except for debugging.
The current implementation prevents the user from enabling encoding and
per-directory encryption on the same filesystem at the same time. The
incompatibility between these features lies in how we do efficient
directory searches when we cannot be sure the encryption of the user
provided fname will match the actual hash stored in the disk without
decrypting every directory entry, because of normalization cases. My
quickest solution is to simply block the concurrent use of these
features for now, and enable it later, once we have a better solution.
Signed-off-by: Gabriel Krisman Bertazi <krisman@...labora.co.uk>
---
fs/ext4/ext4.h | 7 ++-
fs/ext4/super.c | 119 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 125 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 0b127853c584..fb0b70d6eb68 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1298,7 +1298,8 @@ struct ext4_super_block {
__le32 s_lpf_ino; /* Location of the lost+found inode */
__le32 s_prj_quota_inum; /* inode for tracking project quota */
__le32 s_checksum_seed; /* crc32c(uuid) if csum_seed set */
- __le32 s_reserved[98]; /* Padding to the end of the block */
+ __le32 s_ioencoding; /* charset encoding */
+ __le32 s_reserved[97]; /* Padding to the end of the block */
__le32 s_checksum; /* crc32c(superblock) */
};
@@ -1372,6 +1373,7 @@ struct ext4_sb_info {
struct kobject s_kobj;
struct completion s_kobj_unregister;
struct super_block *s_sb;
+ struct nls_table *encoding;
/* Journaling */
struct journal_s *s_journal;
@@ -1652,6 +1654,7 @@ static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)
#define EXT4_FEATURE_INCOMPAT_LARGEDIR 0x4000 /* >2GB or 3-lvl htree */
#define EXT4_FEATURE_INCOMPAT_INLINE_DATA 0x8000 /* data in inode */
#define EXT4_FEATURE_INCOMPAT_ENCRYPT 0x10000
+#define EXT4_FEATURE_INCOMPAT_IOENCODING 0x20000
#define EXT4_FEATURE_COMPAT_FUNCS(name, flagname) \
static inline bool ext4_has_feature_##name(struct super_block *sb) \
@@ -1740,6 +1743,7 @@ EXT4_FEATURE_INCOMPAT_FUNCS(csum_seed, CSUM_SEED)
EXT4_FEATURE_INCOMPAT_FUNCS(largedir, LARGEDIR)
EXT4_FEATURE_INCOMPAT_FUNCS(inline_data, INLINE_DATA)
EXT4_FEATURE_INCOMPAT_FUNCS(encrypt, ENCRYPT)
+EXT4_FEATURE_INCOMPAT_FUNCS(ioencoding, IOENCODING)
#define EXT2_FEATURE_COMPAT_SUPP EXT4_FEATURE_COMPAT_EXT_ATTR
#define EXT2_FEATURE_INCOMPAT_SUPP (EXT4_FEATURE_INCOMPAT_FILETYPE| \
@@ -1767,6 +1771,7 @@ EXT4_FEATURE_INCOMPAT_FUNCS(encrypt, ENCRYPT)
EXT4_FEATURE_INCOMPAT_MMP | \
EXT4_FEATURE_INCOMPAT_INLINE_DATA | \
EXT4_FEATURE_INCOMPAT_ENCRYPT | \
+ EXT4_FEATURE_INCOMPAT_IOENCODING | \
EXT4_FEATURE_INCOMPAT_CSUM_SEED | \
EXT4_FEATURE_INCOMPAT_LARGEDIR)
#define EXT4_FEATURE_RO_COMPAT_SUPP (EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 0c4c2201b3aa..53db9b6c7e33 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -42,6 +42,7 @@
#include <linux/cleancache.h>
#include <linux/uaccess.h>
#include <linux/iversion.h>
+#include <linux/nls.h>
#include <linux/kthread.h>
#include <linux/freezer.h>
@@ -985,6 +986,7 @@ static void ext4_put_super(struct super_block *sb)
crypto_free_shash(sbi->s_chksum_driver);
kfree(sbi->s_blockgroup_lock);
fs_put_dax(sbi->s_daxdev);
+ unload_nls(sbi->encoding);
kfree(sbi);
}
@@ -1378,6 +1380,7 @@ enum {
Opt_dioread_nolock, Opt_dioread_lock,
Opt_discard, Opt_nodiscard, Opt_init_itable, Opt_noinit_itable,
Opt_max_dir_size_kb, Opt_nojournal_checksum, Opt_nombcache,
+ Opt_encoding,
};
static const match_table_t tokens = {
@@ -1460,6 +1463,7 @@ static const match_table_t tokens = {
{Opt_noinit_itable, "noinit_itable"},
{Opt_max_dir_size_kb, "max_dir_size_kb=%u"},
{Opt_test_dummy_encryption, "test_dummy_encryption"},
+ {Opt_encoding, "encoding=%s"},
{Opt_nombcache, "nombcache"},
{Opt_nombcache, "no_mbcache"}, /* for backward compatibility */
{Opt_removed, "check=none"}, /* mount option from ext2/3 */
@@ -1670,9 +1674,58 @@ static const struct mount_opts {
{Opt_max_dir_size_kb, 0, MOPT_GTE0},
{Opt_test_dummy_encryption, 0, MOPT_GTE0},
{Opt_nombcache, EXT4_MOUNT_NO_MBCACHE, MOPT_SET},
+ {Opt_encoding, 0, MOPT_EXT4_ONLY | MOPT_STRING},
{Opt_err, 0, 0}
};
+static const struct ext4_sb_encodings {
+ char *name;
+ char *version;
+} ext4_sb_encoding_map[] = {
+ /* 0x0 */ {"ascii", NULL},
+ /* 0x1 */ {"utf8n", "10.0.0"},
+};
+
+static const struct ext4_sb_encodings *
+ext4_sb_read_encoding(struct ext4_super_block *es)
+{
+ unsigned int magic = le32_to_cpu(es->s_ioencoding);
+
+ if (magic >= ARRAY_SIZE(ext4_sb_encoding_map))
+ return NULL;
+
+ return &ext4_sb_encoding_map[magic];
+}
+
+static const struct ext4_sb_encodings *ext4_parse_encoding_opt(const char *arg)
+{
+ int i, nlen;
+ const struct ext4_sb_encodings *e = NULL;
+ const char version_separator = '-';
+
+ for (i = 0; i < ARRAY_SIZE(ext4_sb_encoding_map); i++) {
+ e = &ext4_sb_encoding_map[i];
+ nlen = strlen(e->name);
+
+ if (strncmp(arg, e->name, nlen))
+ continue;
+
+ /* Encoding doesn't require version */
+ if (!e->version && !arg[nlen])
+ return e;
+
+ if (arg[nlen] != version_separator)
+ continue;
+
+ /* Eat out the separator */
+ nlen += 1;
+
+ if (!strcmp(&arg[nlen], e->version))
+ return e;
+ }
+ return NULL;
+}
+
static int handle_mount_opt(struct super_block *sb, char *opt, int token,
substring_t *args, unsigned long *journal_devnum,
unsigned int *journal_ioprio, int is_remount)
@@ -1905,6 +1958,40 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
sbi->s_mount_opt |= m->mount_opt;
} else if (token == Opt_data_err_ignore) {
sbi->s_mount_opt &= ~m->mount_opt;
+ } else if (token == Opt_encoding) {
+ const struct ext4_sb_encodings *encoding_info;
+ char *encoding = match_strdup(&args[0]);
+
+ if (!encoding)
+ return -ENOMEM;
+
+ if (ext4_has_feature_encrypt(sb)) {
+ ext4_msg(sb, KERN_ERR,
+ "Can't mount with both encoding and encryption");
+ goto encoding_fail;
+ }
+
+ encoding_info = ext4_parse_encoding_opt(encoding);
+ if (!encoding_info) {
+ ext4_msg(sb, KERN_ERR,
+ "Encoding %s not supported by ext4", encoding);
+ goto encoding_fail;
+ }
+
+ sbi->encoding = load_nls_version(encoding_info->name,
+ encoding_info->version);
+ if (IS_ERR(sbi->encoding)) {
+ ext4_msg(sb, KERN_ERR, "Cannot load encoding: %s",
+ encoding);
+ goto encoding_fail;
+ }
+
+ kfree(encoding);
+ return 0;
+encoding_fail:
+ sbi->encoding = NULL;
+ kfree(encoding);
+ return -1;
} else {
if (!args->from)
arg = 1;
@@ -3453,6 +3540,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
int err = 0;
unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO;
ext4_group_t first_not_zeroed;
+ struct nls_table *encoding;
+ const struct ext4_sb_encodings *encoding_info;
if ((data && !orig_data) || !sbi)
goto out_free_base;
@@ -3625,6 +3714,35 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
&journal_ioprio, 0))
goto failed_mount;
+ if (ext4_has_feature_ioencoding(sb) && !sbi->encoding) {
+ if (ext4_has_feature_encrypt(sb)) {
+ ext4_msg(sb, KERN_ERR,
+ "Can't mount with both encoding and encryption");
+ goto failed_mount;
+ }
+
+ encoding_info = ext4_sb_read_encoding(es);
+ if (!encoding_info) {
+ ext4_msg(sb, KERN_ERR,
+ "Encoding requested by superblock is unknown");
+ goto failed_mount;
+ }
+
+ encoding = load_nls_version(encoding_info->name,
+ encoding_info->version);
+ if (IS_ERR(encoding)) {
+ ext4_msg(sb, KERN_ERR, "can't mount with superblock charset:"
+ "%s-%s not supported by the kernel",
+ encoding_info->name, encoding_info->version);
+ goto failed_mount;
+ }
+ ext4_msg(sb, KERN_INFO,
+ "Using encoding defined by superblock: %s %s",
+ encoding_info->name, encoding_info->version);
+
+ sbi->encoding = encoding;
+ }
+
if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
printk_once(KERN_WARNING "EXT4-fs: Warning: mounting "
"with data=journal disables delayed "
@@ -4442,6 +4560,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
brelse(sbi->s_group_desc[i]);
kvfree(sbi->s_group_desc);
failed_mount:
+ unload_nls(sbi->encoding);
if (sbi->s_chksum_driver)
crypto_free_shash(sbi->s_chksum_driver);
#ifdef CONFIG_QUOTA
--
2.18.0
Powered by blists - more mailing lists