linux-ext4 - [GIT PULL] fsverity updates for 6.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 19 Feb 2023 12:48:29 -0800
From:   Eric Biggers <ebiggers@...nel.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     fsverity@...ts.linux.dev, linux-fsdevel@...r.kernel.org,
        linux-ext4@...r.kernel.org, linux-f2fs-devel@...ts.sourceforge.net,
        linux-btrfs@...r.kernel.org, linux-fscrypt@...r.kernel.org,
        linux-kernel@...r.kernel.org, Theodore Ts'o <tytso@....edu>
Subject: [GIT PULL] fsverity updates for 6.3

The following changes since commit 88603b6dc419445847923fcb7fe5080067a30f98:

  Linux 6.2-rc2 (2023-01-01 13:53:16 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/fs/fsverity/linux.git tags/fsverity-for-linus

for you to fetch changes up to 51e4e3153ebc32d3280d5d17418ae6f1a44f1ec1:

  fscrypt: support decrypting data from large folios (2023-01-28 15:10:12 -0800)

----------------------------------------------------------------

Fix the longstanding implementation limitation that fsverity was only
supported when the Merkle tree block size, filesystem block size, and
PAGE_SIZE were all equal.  Specifically, add support for Merkle tree
block sizes less than PAGE_SIZE, and make ext4 support fsverity on
filesystems where the filesystem block size is less than PAGE_SIZE.

Effectively, this means that fsverity can now be used on systems with
non-4K pages, at least on ext4.  These changes have been tested using
the verity group of xfstests, newly updated to cover the new code paths.

Also update fs/verity/ to support verifying data from large folios.
There's also a similar patch for fs/crypto/, to support decrypting data
from large folios, which I'm including in this pull request to avoid a
merge conflict between the fscrypt and fsverity branches.

There will be a merge conflict in fs/buffer.c with some of the foliation
work in the mm tree.  Please use the merge resolution from linux-next.

----------------------------------------------------------------
Eric Biggers (19):
      fsverity: optimize fsverity_file_open() on non-verity files
      fsverity: optimize fsverity_prepare_setattr() on non-verity files
      fsverity: optimize fsverity_cleanup_inode() on non-verity files
      fsverity: pass pos and size to ->write_merkle_tree_block
      fsverity: remove debug messages and CONFIG_FS_VERITY_DEBUG
      fsverity: use unsigned long for level_start
      fsverity: simplify Merkle tree readahead size calculation
      fsverity: store log2(digest_size) precomputed
      fsverity: use EFBIG for file too large to enable verity
      fsverity: replace fsverity_hash_page() with fsverity_hash_block()
      fsverity: support verification with tree block size < PAGE_SIZE
      fsverity: support enabling with tree block size < PAGE_SIZE
      ext4: simplify ext4_readpage_limit()
      f2fs: simplify f2fs_readpage_limit()
      fs/buffer.c: support fsverity in block_read_full_folio()
      ext4: allow verity with fs block size < PAGE_SIZE
      fsverity.rst: update git repo URL for fsverity-utils
      fsverity: support verifying data from large folios
      fscrypt: support decrypting data from large folios

 Documentation/filesystems/fscrypt.rst  |   4 +-
 Documentation/filesystems/fsverity.rst |  96 +++++----
 fs/btrfs/verity.c                      |  19 +-
 fs/buffer.c                            |  72 +++++--
 fs/crypto/bio.c                        |  10 +-
 fs/crypto/crypto.c                     |  28 +--
 fs/ext4/inode.c                        |   6 +-
 fs/ext4/readpage.c                     |   3 +-
 fs/ext4/super.c                        |   5 -
 fs/ext4/verity.c                       |   6 +-
 fs/f2fs/data.c                         |   3 +-
 fs/f2fs/verity.c                       |   6 +-
 fs/verity/Kconfig                      |   8 -
 fs/verity/enable.c                     | 271 ++++++++++++--------------
 fs/verity/fsverity_private.h           |  24 +--
 fs/verity/hash_algs.c                  |  24 ++-
 fs/verity/init.c                       |   1 -
 fs/verity/open.c                       | 163 +++++++++-------
 fs/verity/signature.c                  |   2 -
 fs/verity/verify.c                     | 346 ++++++++++++++++++++++-----------
 include/linux/fscrypt.h                |   9 +-
 include/linux/fsverity.h               |  93 +++++++--
 22 files changed, 699 insertions(+), 500 deletions(-)