| blob | a63cdbaf215a6a674a1cfbd94ab00eac19d0bc76 |
1 ext4 crypto: migrate into vfs's crypto engine
3 To: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, tytso@mit.edu,
5 This patch removes the most parts of internal crypto codes.
6 And then, it modifies and adds some ext4-specific crypt codes to use the generic
7 facility.
9 Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
10 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
11 ---
12 fs/ext4/Kconfig | 12 +-
13 fs/ext4/Makefile | 2 -
14 fs/ext4/crypto.c | 536 ------------------------------------------------
15 fs/ext4/crypto_fname.c | 468 ------------------------------------------
16 fs/ext4/crypto_key.c | 274 -------------------------
17 fs/ext4/crypto_policy.c | 229 ---------------------
18 fs/ext4/dir.c | 26 +--
19 fs/ext4/ext4.h | 197 ++++++------------
20 fs/ext4/ext4_crypto.h | 159 --------------
21 fs/ext4/file.c | 10 +-
22 fs/ext4/ialloc.c | 7 +-
23 fs/ext4/inline.c | 14 +-
24 fs/ext4/inode.c | 8 +-
25 fs/ext4/ioctl.c | 20 +-
26 fs/ext4/namei.c | 120 +++++------
27 fs/ext4/page-io.c | 13 +-
28 fs/ext4/readpage.c | 45 +---
29 fs/ext4/super.c | 85 +++++++-
30 fs/ext4/symlink.c | 33 ++-
31 19 files changed, 271 insertions(+), 1987 deletions(-)
32 delete mode 100644 fs/ext4/crypto.c
33 delete mode 100644 fs/ext4/crypto_fname.c
34 delete mode 100644 fs/ext4/crypto_key.c
35 delete mode 100644 fs/ext4/crypto_policy.c
36 delete mode 100644 fs/ext4/ext4_crypto.h
38 diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
39 index b46e9fc..e38039f 100644
40 --- a/fs/ext4/Kconfig
41 +++ b/fs/ext4/Kconfig
42 @@ -99,17 +99,9 @@ config EXT4_FS_SECURITY
43 extended attributes for file security labels, say N.
45 config EXT4_ENCRYPTION
46 - tristate "Ext4 Encryption"
47 + bool "Ext4 Encryption"
48 depends on EXT4_FS
49 - select CRYPTO_AES
50 - select CRYPTO_CBC
51 - select CRYPTO_ECB
52 - select CRYPTO_XTS
53 - select CRYPTO_CTS
54 - select CRYPTO_CTR
55 - select CRYPTO_SHA256
56 - select KEYS
57 - select ENCRYPTED_KEYS
58 + select FS_ENCRYPTION
59 help
60 Enable encryption of ext4 files and directories. This
61 feature is similar to ecryptfs, but it is more memory
62 diff --git a/fs/ext4/Makefile b/fs/ext4/Makefile
63 index f52cf54..354103f 100644
64 --- a/fs/ext4/Makefile
65 +++ b/fs/ext4/Makefile
66 @@ -12,5 +12,3 @@ ext4-y := balloc.o bitmap.o dir.o file.o fsync.o ialloc.o inode.o page-io.o \
68 ext4-$(CONFIG_EXT4_FS_POSIX_ACL) += acl.o
69 ext4-$(CONFIG_EXT4_FS_SECURITY) += xattr_security.o
70 -ext4-$(CONFIG_EXT4_FS_ENCRYPTION) += crypto_policy.o crypto.o \
71 - crypto_key.o crypto_fname.o
72 diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c
73 deleted file mode 100644
74 index 6a6c273..0000000
75 --- a/fs/ext4/crypto.c
76 +++ /dev/null
77 @@ -1,536 +0,0 @@
78 -/*
79 - * linux/fs/ext4/crypto.c
80 - *
81 - * Copyright (C) 2015, Google, Inc.
82 - *
83 - * This contains encryption functions for ext4
84 - *
85 - * Written by Michael Halcrow, 2014.
86 - *
87 - * Filename encryption additions
88 - * Uday Savagaonkar, 2014
89 - * Encryption policy handling additions
90 - * Ildar Muslukhov, 2014
91 - *
92 - * This has not yet undergone a rigorous security audit.
93 - *
94 - * The usage of AES-XTS should conform to recommendations in NIST
95 - * Special Publication 800-38E and IEEE P1619/D16.
96 - */
97 -
98 -#include <crypto/skcipher.h>
99 -#include <keys/user-type.h>
100 -#include <keys/encrypted-type.h>
101 -#include <linux/ecryptfs.h>
102 -#include <linux/gfp.h>
103 -#include <linux/kernel.h>
104 -#include <linux/key.h>
105 -#include <linux/list.h>
106 -#include <linux/mempool.h>
107 -#include <linux/module.h>
108 -#include <linux/mutex.h>
109 -#include <linux/random.h>
110 -#include <linux/scatterlist.h>
111 -#include <linux/spinlock_types.h>
112 -#include <linux/namei.h>
113 -
114 -#include "ext4_extents.h"
115 -#include "xattr.h"
116 -
117 -/* Encryption added and removed here! (L: */
118 -
119 -static unsigned int num_prealloc_crypto_pages = 32;
120 -static unsigned int num_prealloc_crypto_ctxs = 128;
121 -
122 -module_param(num_prealloc_crypto_pages, uint, 0444);
123 -MODULE_PARM_DESC(num_prealloc_crypto_pages,
124 - "Number of crypto pages to preallocate");
125 -module_param(num_prealloc_crypto_ctxs, uint, 0444);
126 -MODULE_PARM_DESC(num_prealloc_crypto_ctxs,
127 - "Number of crypto contexts to preallocate");
128 -
129 -static mempool_t *ext4_bounce_page_pool;
130 -
131 -static LIST_HEAD(ext4_free_crypto_ctxs);
132 -static DEFINE_SPINLOCK(ext4_crypto_ctx_lock);
133 -
134 -static struct kmem_cache *ext4_crypto_ctx_cachep;
135 -struct kmem_cache *ext4_crypt_info_cachep;
136 -
137 -/**
138 - * ext4_release_crypto_ctx() - Releases an encryption context
139 - * @ctx: The encryption context to release.
140 - *
141 - * If the encryption context was allocated from the pre-allocated pool, returns
142 - * it to that pool. Else, frees it.
143 - *
144 - * If there's a bounce page in the context, this frees that.
145 - */
146 -void ext4_release_crypto_ctx(struct ext4_crypto_ctx *ctx)
147 -{
148 - unsigned long flags;
149 -
150 - if (ctx->flags & EXT4_WRITE_PATH_FL && ctx->w.bounce_page)
151 - mempool_free(ctx->w.bounce_page, ext4_bounce_page_pool);
152 - ctx->w.bounce_page = NULL;
153 - ctx->w.control_page = NULL;
154 - if (ctx->flags & EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL) {
155 - kmem_cache_free(ext4_crypto_ctx_cachep, ctx);
156 - } else {
157 - spin_lock_irqsave(&ext4_crypto_ctx_lock, flags);
158 - list_add(&ctx->free_list, &ext4_free_crypto_ctxs);
159 - spin_unlock_irqrestore(&ext4_crypto_ctx_lock, flags);
160 - }
161 -}
162 -
163 -/**
164 - * ext4_get_crypto_ctx() - Gets an encryption context
165 - * @inode: The inode for which we are doing the crypto
166 - *
167 - * Allocates and initializes an encryption context.
168 - *
169 - * Return: An allocated and initialized encryption context on success; error
170 - * value or NULL otherwise.
171 - */
172 -struct ext4_crypto_ctx *ext4_get_crypto_ctx(struct inode *inode,
173 - gfp_t gfp_flags)
174 -{
175 - struct ext4_crypto_ctx *ctx = NULL;
176 - int res = 0;
177 - unsigned long flags;
178 - struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info;
179 -
180 - if (ci == NULL)
181 - return ERR_PTR(-ENOKEY);
182 -
183 - /*
184 - * We first try getting the ctx from a free list because in
185 - * the common case the ctx will have an allocated and
186 - * initialized crypto tfm, so it's probably a worthwhile
187 - * optimization. For the bounce page, we first try getting it
188 - * from the kernel allocator because that's just about as fast
189 - * as getting it from a list and because a cache of free pages
190 - * should generally be a "last resort" option for a filesystem
191 - * to be able to do its job.
192 - */
193 - spin_lock_irqsave(&ext4_crypto_ctx_lock, flags);
194 - ctx = list_first_entry_or_null(&ext4_free_crypto_ctxs,
195 - struct ext4_crypto_ctx, free_list);
196 - if (ctx)
197 - list_del(&ctx->free_list);
198 - spin_unlock_irqrestore(&ext4_crypto_ctx_lock, flags);
199 - if (!ctx) {
200 - ctx = kmem_cache_zalloc(ext4_crypto_ctx_cachep, gfp_flags);
201 - if (!ctx) {
202 - res = -ENOMEM;
203 - goto out;
204 - }
205 - ctx->flags |= EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL;
206 - } else {
207 - ctx->flags &= ~EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL;
208 - }
209 - ctx->flags &= ~EXT4_WRITE_PATH_FL;
210 -
211 -out:
212 - if (res) {
213 - if (!IS_ERR_OR_NULL(ctx))
214 - ext4_release_crypto_ctx(ctx);
215 - ctx = ERR_PTR(res);
216 - }
217 - return ctx;
218 -}
219 -
220 -struct workqueue_struct *ext4_read_workqueue;
221 -static DEFINE_MUTEX(crypto_init);
222 -
223 -/**
224 - * ext4_exit_crypto() - Shutdown the ext4 encryption system
225 - */
226 -void ext4_exit_crypto(void)
227 -{
228 - struct ext4_crypto_ctx *pos, *n;
229 -
230 - list_for_each_entry_safe(pos, n, &ext4_free_crypto_ctxs, free_list)
231 - kmem_cache_free(ext4_crypto_ctx_cachep, pos);
232 - INIT_LIST_HEAD(&ext4_free_crypto_ctxs);
233 - if (ext4_bounce_page_pool)
234 - mempool_destroy(ext4_bounce_page_pool);
235 - ext4_bounce_page_pool = NULL;
236 - if (ext4_read_workqueue)
237 - destroy_workqueue(ext4_read_workqueue);
238 - ext4_read_workqueue = NULL;
239 - if (ext4_crypto_ctx_cachep)
240 - kmem_cache_destroy(ext4_crypto_ctx_cachep);
241 - ext4_crypto_ctx_cachep = NULL;
242 - if (ext4_crypt_info_cachep)
243 - kmem_cache_destroy(ext4_crypt_info_cachep);
244 - ext4_crypt_info_cachep = NULL;
245 -}
246 -
247 -/**
248 - * ext4_init_crypto() - Set up for ext4 encryption.
249 - *
250 - * We only call this when we start accessing encrypted files, since it
251 - * results in memory getting allocated that wouldn't otherwise be used.
252 - *
253 - * Return: Zero on success, non-zero otherwise.
254 - */
255 -int ext4_init_crypto(void)
256 -{
257 - int i, res = -ENOMEM;
258 -
259 - mutex_lock(&crypto_init);
260 - if (ext4_read_workqueue)
261 - goto already_initialized;
262 - ext4_read_workqueue = alloc_workqueue("ext4_crypto", WQ_HIGHPRI, 0);
263 - if (!ext4_read_workqueue)
264 - goto fail;
265 -
266 - ext4_crypto_ctx_cachep = KMEM_CACHE(ext4_crypto_ctx,
267 - SLAB_RECLAIM_ACCOUNT);
268 - if (!ext4_crypto_ctx_cachep)
269 - goto fail;
270 -
271 - ext4_crypt_info_cachep = KMEM_CACHE(ext4_crypt_info,
272 - SLAB_RECLAIM_ACCOUNT);
273 - if (!ext4_crypt_info_cachep)
274 - goto fail;
275 -
276 - for (i = 0; i < num_prealloc_crypto_ctxs; i++) {
277 - struct ext4_crypto_ctx *ctx;
278 -
279 - ctx = kmem_cache_zalloc(ext4_crypto_ctx_cachep, GFP_NOFS);
280 - if (!ctx) {
281 - res = -ENOMEM;
282 - goto fail;
283 - }
284 - list_add(&ctx->free_list, &ext4_free_crypto_ctxs);
285 - }
286 -
287 - ext4_bounce_page_pool =
288 - mempool_create_page_pool(num_prealloc_crypto_pages, 0);
289 - if (!ext4_bounce_page_pool) {
290 - res = -ENOMEM;
291 - goto fail;
292 - }
293 -already_initialized:
294 - mutex_unlock(&crypto_init);
295 - return 0;
296 -fail:
297 - ext4_exit_crypto();
298 - mutex_unlock(&crypto_init);
299 - return res;
300 -}
301 -
302 -void ext4_restore_control_page(struct page *data_page)
303 -{
304 - struct ext4_crypto_ctx *ctx =
305 - (struct ext4_crypto_ctx *)page_private(data_page);
306 -
307 - set_page_private(data_page, (unsigned long)NULL);
308 - ClearPagePrivate(data_page);
309 - unlock_page(data_page);
310 - ext4_release_crypto_ctx(ctx);
311 -}
312 -
313 -/**
314 - * ext4_crypt_complete() - The completion callback for page encryption
315 - * @req: The asynchronous encryption request context
316 - * @res: The result of the encryption operation
317 - */
318 -static void ext4_crypt_complete(struct crypto_async_request *req, int res)
319 -{
320 - struct ext4_completion_result *ecr = req->data;
321 -
322 - if (res == -EINPROGRESS)
323 - return;
324 - ecr->res = res;
325 - complete(&ecr->completion);
326 -}
327 -
328 -typedef enum {
329 - EXT4_DECRYPT = 0,
330 - EXT4_ENCRYPT,
331 -} ext4_direction_t;
332 -
333 -static int ext4_page_crypto(struct inode *inode,
334 - ext4_direction_t rw,
335 - pgoff_t index,
336 - struct page *src_page,
337 - struct page *dest_page,
338 - gfp_t gfp_flags)
339 -
340 -{
341 - u8 xts_tweak[EXT4_XTS_TWEAK_SIZE];
342 - struct skcipher_request *req = NULL;
343 - DECLARE_EXT4_COMPLETION_RESULT(ecr);
344 - struct scatterlist dst, src;
345 - struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info;
346 - struct crypto_skcipher *tfm = ci->ci_ctfm;
347 - int res = 0;
348 -
349 - req = skcipher_request_alloc(tfm, gfp_flags);
350 - if (!req) {
351 - printk_ratelimited(KERN_ERR
352 - "%s: crypto_request_alloc() failed\n",
353 - __func__);
354 - return -ENOMEM;
355 - }
356 - skcipher_request_set_callback(
357 - req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
358 - ext4_crypt_complete, &ecr);
359 -
360 - BUILD_BUG_ON(EXT4_XTS_TWEAK_SIZE < sizeof(index));
361 - memcpy(xts_tweak, &index, sizeof(index));
362 - memset(&xts_tweak[sizeof(index)], 0,
363 - EXT4_XTS_TWEAK_SIZE - sizeof(index));
364 -
365 - sg_init_table(&dst, 1);
366 - sg_set_page(&dst, dest_page, PAGE_SIZE, 0);
367 - sg_init_table(&src, 1);
368 - sg_set_page(&src, src_page, PAGE_SIZE, 0);
369 - skcipher_request_set_crypt(req, &src, &dst, PAGE_SIZE,
370 - xts_tweak);
371 - if (rw == EXT4_DECRYPT)
372 - res = crypto_skcipher_decrypt(req);
373 - else
374 - res = crypto_skcipher_encrypt(req);
375 - if (res == -EINPROGRESS || res == -EBUSY) {
376 - wait_for_completion(&ecr.completion);
377 - res = ecr.res;
378 - }
379 - skcipher_request_free(req);
380 - if (res) {
381 - printk_ratelimited(
382 - KERN_ERR
383 - "%s: crypto_skcipher_encrypt() returned %d\n",
384 - __func__, res);
385 - return res;
386 - }
387 - return 0;
388 -}
389 -
390 -static struct page *alloc_bounce_page(struct ext4_crypto_ctx *ctx,
391 - gfp_t gfp_flags)
392 -{
393 - ctx->w.bounce_page = mempool_alloc(ext4_bounce_page_pool, gfp_flags);
394 - if (ctx->w.bounce_page == NULL)
395 - return ERR_PTR(-ENOMEM);
396 - ctx->flags |= EXT4_WRITE_PATH_FL;
397 - return ctx->w.bounce_page;
398 -}
399 -
400 -/**
401 - * ext4_encrypt() - Encrypts a page
402 - * @inode: The inode for which the encryption should take place
403 - * @plaintext_page: The page to encrypt. Must be locked.
404 - *
405 - * Allocates a ciphertext page and encrypts plaintext_page into it using the ctx
406 - * encryption context.
407 - *
408 - * Called on the page write path. The caller must call
409 - * ext4_restore_control_page() on the returned ciphertext page to
410 - * release the bounce buffer and the encryption context.
411 - *
412 - * Return: An allocated page with the encrypted content on success. Else, an
413 - * error value or NULL.
414 - */
415 -struct page *ext4_encrypt(struct inode *inode,
416 - struct page *plaintext_page,
417 - gfp_t gfp_flags)
418 -{
419 - struct ext4_crypto_ctx *ctx;
420 - struct page *ciphertext_page = NULL;
421 - int err;
422 -
423 - BUG_ON(!PageLocked(plaintext_page));
424 -
425 - ctx = ext4_get_crypto_ctx(inode, gfp_flags);
426 - if (IS_ERR(ctx))
427 - return (struct page *) ctx;
428 -
429 - /* The encryption operation will require a bounce page. */
430 - ciphertext_page = alloc_bounce_page(ctx, gfp_flags);
431 - if (IS_ERR(ciphertext_page))
432 - goto errout;
433 - ctx->w.control_page = plaintext_page;
434 - err = ext4_page_crypto(inode, EXT4_ENCRYPT, plaintext_page->index,
435 - plaintext_page, ciphertext_page, gfp_flags);
436 - if (err) {
437 - ciphertext_page = ERR_PTR(err);
438 - errout:
439 - ext4_release_crypto_ctx(ctx);
440 - return ciphertext_page;
441 - }
442 - SetPagePrivate(ciphertext_page);
443 - set_page_private(ciphertext_page, (unsigned long)ctx);
444 - lock_page(ciphertext_page);
445 - return ciphertext_page;
446 -}
447 -
448 -/**
449 - * ext4_decrypt() - Decrypts a page in-place
450 - * @ctx: The encryption context.
451 - * @page: The page to decrypt. Must be locked.
452 - *
453 - * Decrypts page in-place using the ctx encryption context.
454 - *
455 - * Called from the read completion callback.
456 - *
457 - * Return: Zero on success, non-zero otherwise.
458 - */
459 -int ext4_decrypt(struct page *page)
460 -{
461 - BUG_ON(!PageLocked(page));
462 -
463 - return ext4_page_crypto(page->mapping->host, EXT4_DECRYPT,
464 - page->index, page, page, GFP_NOFS);
465 -}
466 -
467 -int ext4_encrypted_zeroout(struct inode *inode, ext4_lblk_t lblk,
468 - ext4_fsblk_t pblk, ext4_lblk_t len)
469 -{
470 - struct ext4_crypto_ctx *ctx;
471 - struct page *ciphertext_page = NULL;
472 - struct bio *bio;
473 - int ret, err = 0;
474 -
475 -#if 0
476 - ext4_msg(inode->i_sb, KERN_CRIT,
477 - "ext4_encrypted_zeroout ino %lu lblk %u len %u",
478 - (unsigned long) inode->i_ino, lblk, len);
479 -#endif
480 -
481 - BUG_ON(inode->i_sb->s_blocksize != PAGE_SIZE);
482 -
483 - ctx = ext4_get_crypto_ctx(inode, GFP_NOFS);
484 - if (IS_ERR(ctx))
485 - return PTR_ERR(ctx);
486 -
487 - ciphertext_page = alloc_bounce_page(ctx, GFP_NOWAIT);
488 - if (IS_ERR(ciphertext_page)) {
489 - err = PTR_ERR(ciphertext_page);
490 - goto errout;
491 - }
492 -
493 - while (len--) {
494 - err = ext4_page_crypto(inode, EXT4_ENCRYPT, lblk,
495 - ZERO_PAGE(0), ciphertext_page,
496 - GFP_NOFS);
497 - if (err)
498 - goto errout;
499 -
500 - bio = bio_alloc(GFP_NOWAIT, 1);
501 - if (!bio) {
502 - err = -ENOMEM;
503 - goto errout;
504 - }
505 - bio->bi_bdev = inode->i_sb->s_bdev;
506 - bio->bi_iter.bi_sector =
507 - pblk << (inode->i_sb->s_blocksize_bits - 9);
508 - ret = bio_add_page(bio, ciphertext_page,
509 - inode->i_sb->s_blocksize, 0);
510 - if (ret != inode->i_sb->s_blocksize) {
511 - /* should never happen! */
512 - ext4_msg(inode->i_sb, KERN_ERR,
513 - "bio_add_page failed: %d", ret);
514 - WARN_ON(1);
515 - bio_put(bio);
516 - err = -EIO;
517 - goto errout;
518 - }
519 - err = submit_bio_wait(WRITE, bio);
520 - if ((err == 0) && bio->bi_error)
521 - err = -EIO;
522 - bio_put(bio);
523 - if (err)
524 - goto errout;
525 - lblk++; pblk++;
526 - }
527 - err = 0;
528 -errout:
529 - ext4_release_crypto_ctx(ctx);
530 - return err;
531 -}
532 -
533 -bool ext4_valid_contents_enc_mode(uint32_t mode)
534 -{
535 - return (mode == EXT4_ENCRYPTION_MODE_AES_256_XTS);
536 -}
537 -
538 -/**
539 - * ext4_validate_encryption_key_size() - Validate the encryption key size
540 - * @mode: The key mode.
541 - * @size: The key size to validate.
542 - *
543 - * Return: The validated key size for @mode. Zero if invalid.
544 - */
545 -uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size)
546 -{
547 - if (size == ext4_encryption_key_size(mode))
548 - return size;
549 - return 0;
550 -}
551 -
552 -/*
553 - * Validate dentries for encrypted directories to make sure we aren't
554 - * potentially caching stale data after a key has been added or
555 - * removed.
556 - */
557 -static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags)
558 -{
559 - struct dentry *dir;
560 - struct ext4_crypt_info *ci;
561 - int dir_has_key, cached_with_key;
562 -
563 - if (flags & LOOKUP_RCU)
564 - return -ECHILD;
565 -
566 - dir = dget_parent(dentry);
567 - if (!ext4_encrypted_inode(d_inode(dir))) {
568 - dput(dir);
569 - return 0;
570 - }
571 - ci = EXT4_I(d_inode(dir))->i_crypt_info;
572 - if (ci && ci->ci_keyring_key &&
573 - (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
574 - (1 << KEY_FLAG_REVOKED) |
575 - (1 << KEY_FLAG_DEAD))))
576 - ci = NULL;
577 -
578 - /* this should eventually be an flag in d_flags */
579 - cached_with_key = dentry->d_fsdata != NULL;
580 - dir_has_key = (ci != NULL);
581 - dput(dir);
582 -
583 - /*
584 - * If the dentry was cached without the key, and it is a
585 - * negative dentry, it might be a valid name. We can't check
586 - * if the key has since been made available due to locking
587 - * reasons, so we fail the validation so ext4_lookup() can do
588 - * this check.
589 - *
590 - * We also fail the validation if the dentry was created with
591 - * the key present, but we no longer have the key, or vice versa.
592 - */
593 - if ((!cached_with_key && d_is_negative(dentry)) ||
594 - (!cached_with_key && dir_has_key) ||
595 - (cached_with_key && !dir_has_key)) {
596 -#if 0 /* Revalidation debug */
597 - char buf[80];
598 - char *cp = simple_dname(dentry, buf, sizeof(buf));
599 -
600 - if (IS_ERR(cp))
601 - cp = (char *) "???";
602 - pr_err("revalidate: %s %p %d %d %d\n", cp, dentry->d_fsdata,
603 - cached_with_key, d_is_negative(dentry),
604 - dir_has_key);
605 -#endif
606 - return 0;
607 - }
608 - return 1;
609 -}
610 -
611 -const struct dentry_operations ext4_encrypted_d_ops = {
612 - .d_revalidate = ext4_d_revalidate,
613 -};
614 diff --git a/fs/ext4/crypto_fname.c b/fs/ext4/crypto_fname.c
615 deleted file mode 100644
616 index 1a2f360..0000000
617 --- a/fs/ext4/crypto_fname.c
618 +++ /dev/null
619 @@ -1,468 +0,0 @@
620 -/*
621 - * linux/fs/ext4/crypto_fname.c
622 - *
623 - * Copyright (C) 2015, Google, Inc.
624 - *
625 - * This contains functions for filename crypto management in ext4
626 - *
627 - * Written by Uday Savagaonkar, 2014.
628 - *
629 - * This has not yet undergone a rigorous security audit.
630 - *
631 - */
632 -
633 -#include <crypto/skcipher.h>
634 -#include <keys/encrypted-type.h>
635 -#include <keys/user-type.h>
636 -#include <linux/gfp.h>
637 -#include <linux/kernel.h>
638 -#include <linux/key.h>
639 -#include <linux/list.h>
640 -#include <linux/mempool.h>
641 -#include <linux/random.h>
642 -#include <linux/scatterlist.h>
643 -#include <linux/spinlock_types.h>
644 -
645 -#include "ext4.h"
646 -#include "ext4_crypto.h"
647 -#include "xattr.h"
648 -
649 -/**
650 - * ext4_dir_crypt_complete() -
651 - */
652 -static void ext4_dir_crypt_complete(struct crypto_async_request *req, int res)
653 -{
654 - struct ext4_completion_result *ecr = req->data;
655 -
656 - if (res == -EINPROGRESS)
657 - return;
658 - ecr->res = res;
659 - complete(&ecr->completion);
660 -}
661 -
662 -bool ext4_valid_filenames_enc_mode(uint32_t mode)
663 -{
664 - return (mode == EXT4_ENCRYPTION_MODE_AES_256_CTS);
665 -}
666 -
667 -static unsigned max_name_len(struct inode *inode)
668 -{
669 - return S_ISLNK(inode->i_mode) ? inode->i_sb->s_blocksize :
670 - EXT4_NAME_LEN;
671 -}
672 -
673 -/**
674 - * ext4_fname_encrypt() -
675 - *
676 - * This function encrypts the input filename, and returns the length of the
677 - * ciphertext. Errors are returned as negative numbers. We trust the caller to
678 - * allocate sufficient memory to oname string.
679 - */
680 -static int ext4_fname_encrypt(struct inode *inode,
681 - const struct qstr *iname,
682 - struct ext4_str *oname)
683 -{
684 - u32 ciphertext_len;
685 - struct skcipher_request *req = NULL;
686 - DECLARE_EXT4_COMPLETION_RESULT(ecr);
687 - struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info;
688 - struct crypto_skcipher *tfm = ci->ci_ctfm;
689 - int res = 0;
690 - char iv[EXT4_CRYPTO_BLOCK_SIZE];
691 - struct scatterlist src_sg, dst_sg;
692 - int padding = 4 << (ci->ci_flags & EXT4_POLICY_FLAGS_PAD_MASK);
693 - char *workbuf, buf[32], *alloc_buf = NULL;
694 - unsigned lim = max_name_len(inode);
695 -
696 - if (iname->len <= 0 || iname->len > lim)
697 - return -EIO;
698 -
699 - ciphertext_len = (iname->len < EXT4_CRYPTO_BLOCK_SIZE) ?
700 - EXT4_CRYPTO_BLOCK_SIZE : iname->len;
701 - ciphertext_len = ext4_fname_crypto_round_up(ciphertext_len, padding);
702 - ciphertext_len = (ciphertext_len > lim)
703 - ? lim : ciphertext_len;
704 -
705 - if (ciphertext_len <= sizeof(buf)) {
706 - workbuf = buf;
707 - } else {
708 - alloc_buf = kmalloc(ciphertext_len, GFP_NOFS);
709 - if (!alloc_buf)
710 - return -ENOMEM;
711 - workbuf = alloc_buf;
712 - }
713 -
714 - /* Allocate request */
715 - req = skcipher_request_alloc(tfm, GFP_NOFS);
716 - if (!req) {
717 - printk_ratelimited(
718 - KERN_ERR "%s: crypto_request_alloc() failed\n", __func__);
719 - kfree(alloc_buf);
720 - return -ENOMEM;
721 - }
722 - skcipher_request_set_callback(req,
723 - CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
724 - ext4_dir_crypt_complete, &ecr);
725 -
726 - /* Copy the input */
727 - memcpy(workbuf, iname->name, iname->len);
728 - if (iname->len < ciphertext_len)
729 - memset(workbuf + iname->len, 0, ciphertext_len - iname->len);
730 -
731 - /* Initialize IV */
732 - memset(iv, 0, EXT4_CRYPTO_BLOCK_SIZE);
733 -
734 - /* Create encryption request */
735 - sg_init_one(&src_sg, workbuf, ciphertext_len);
736 - sg_init_one(&dst_sg, oname->name, ciphertext_len);
737 - skcipher_request_set_crypt(req, &src_sg, &dst_sg, ciphertext_len, iv);
738 - res = crypto_skcipher_encrypt(req);
739 - if (res == -EINPROGRESS || res == -EBUSY) {
740 - wait_for_completion(&ecr.completion);
741 - res = ecr.res;
742 - }
743 - kfree(alloc_buf);
744 - skcipher_request_free(req);
745 - if (res < 0) {
746 - printk_ratelimited(
747 - KERN_ERR "%s: Error (error code %d)\n", __func__, res);
748 - }
749 - oname->len = ciphertext_len;
750 - return res;
751 -}
752 -
753 -/*
754 - * ext4_fname_decrypt()
755 - * This function decrypts the input filename, and returns
756 - * the length of the plaintext.
757 - * Errors are returned as negative numbers.
758 - * We trust the caller to allocate sufficient memory to oname string.
759 - */
760 -static int ext4_fname_decrypt(struct inode *inode,
761 - const struct ext4_str *iname,
762 - struct ext4_str *oname)
763 -{
764 - struct ext4_str tmp_in[2], tmp_out[1];
765 - struct skcipher_request *req = NULL;
766 - DECLARE_EXT4_COMPLETION_RESULT(ecr);
767 - struct scatterlist src_sg, dst_sg;
768 - struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info;
769 - struct crypto_skcipher *tfm = ci->ci_ctfm;
770 - int res = 0;
771 - char iv[EXT4_CRYPTO_BLOCK_SIZE];
772 - unsigned lim = max_name_len(inode);
773 -
774 - if (iname->len <= 0 || iname->len > lim)
775 - return -EIO;
776 -
777 - tmp_in[0].name = iname->name;
778 - tmp_in[0].len = iname->len;
779 - tmp_out[0].name = oname->name;
780 -
781 - /* Allocate request */
782 - req = skcipher_request_alloc(tfm, GFP_NOFS);
783 - if (!req) {
784 - printk_ratelimited(
785 - KERN_ERR "%s: crypto_request_alloc() failed\n", __func__);
786 - return -ENOMEM;
787 - }
788 - skcipher_request_set_callback(req,
789 - CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
790 - ext4_dir_crypt_complete, &ecr);
791 -
792 - /* Initialize IV */
793 - memset(iv, 0, EXT4_CRYPTO_BLOCK_SIZE);
794 -
795 - /* Create encryption request */
796 - sg_init_one(&src_sg, iname->name, iname->len);
797 - sg_init_one(&dst_sg, oname->name, oname->len);
798 - skcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, iv);
799 - res = crypto_skcipher_decrypt(req);
800 - if (res == -EINPROGRESS || res == -EBUSY) {
801 - wait_for_completion(&ecr.completion);
802 - res = ecr.res;
803 - }
804 - skcipher_request_free(req);
805 - if (res < 0) {
806 - printk_ratelimited(
807 - KERN_ERR "%s: Error in ext4_fname_encrypt (error code %d)\n",
808 - __func__, res);
809 - return res;
810 - }
811 -
812 - oname->len = strnlen(oname->name, iname->len);
813 - return oname->len;
814 -}
815 -
816 -static const char *lookup_table =
817 - "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+,";
818 -
819 -/**
820 - * ext4_fname_encode_digest() -
821 - *
822 - * Encodes the input digest using characters from the set [a-zA-Z0-9_+].
823 - * The encoded string is roughly 4/3 times the size of the input string.
824 - */
825 -static int digest_encode(const char *src, int len, char *dst)
826 -{
827 - int i = 0, bits = 0, ac = 0;
828 - char *cp = dst;
829 -
830 - while (i < len) {
831 - ac += (((unsigned char) src[i]) << bits);
832 - bits += 8;
833 - do {
834 - *cp++ = lookup_table[ac & 0x3f];
835 - ac >>= 6;
836 - bits -= 6;
837 - } while (bits >= 6);
838 - i++;
839 - }
840 - if (bits)
841 - *cp++ = lookup_table[ac & 0x3f];
842 - return cp - dst;
843 -}
844 -
845 -static int digest_decode(const char *src, int len, char *dst)
846 -{
847 - int i = 0, bits = 0, ac = 0;
848 - const char *p;
849 - char *cp = dst;
850 -
851 - while (i < len) {
852 - p = strchr(lookup_table, src[i]);
853 - if (p == NULL || src[i] == 0)
854 - return -2;
855 - ac += (p - lookup_table) << bits;
856 - bits += 6;
857 - if (bits >= 8) {
858 - *cp++ = ac & 0xff;
859 - ac >>= 8;
860 - bits -= 8;
861 - }
862 - i++;
863 - }
864 - if (ac)
865 - return -1;
866 - return cp - dst;
867 -}
868 -
869 -/**
870 - * ext4_fname_crypto_round_up() -
871 - *
872 - * Return: The next multiple of block size
873 - */
874 -u32 ext4_fname_crypto_round_up(u32 size, u32 blksize)
875 -{
876 - return ((size+blksize-1)/blksize)*blksize;
877 -}
878 -
879 -unsigned ext4_fname_encrypted_size(struct inode *inode, u32 ilen)
880 -{
881 - struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info;
882 - int padding = 32;
883 -
884 - if (ci)
885 - padding = 4 << (ci->ci_flags & EXT4_POLICY_FLAGS_PAD_MASK);
886 - if (ilen < EXT4_CRYPTO_BLOCK_SIZE)
887 - ilen = EXT4_CRYPTO_BLOCK_SIZE;
888 - return ext4_fname_crypto_round_up(ilen, padding);
889 -}
890 -
891 -/*
892 - * ext4_fname_crypto_alloc_buffer() -
893 - *
894 - * Allocates an output buffer that is sufficient for the crypto operation
895 - * specified by the context and the direction.
896 - */
897 -int ext4_fname_crypto_alloc_buffer(struct inode *inode,
898 - u32 ilen, struct ext4_str *crypto_str)
899 -{
900 - unsigned int olen = ext4_fname_encrypted_size(inode, ilen);
901 -
902 - crypto_str->len = olen;
903 - if (olen < EXT4_FNAME_CRYPTO_DIGEST_SIZE*2)
904 - olen = EXT4_FNAME_CRYPTO_DIGEST_SIZE*2;
905 - /* Allocated buffer can hold one more character to null-terminate the
906 - * string */
907 - crypto_str->name = kmalloc(olen+1, GFP_NOFS);
908 - if (!(crypto_str->name))
909 - return -ENOMEM;
910 - return 0;
911 -}
912 -
913 -/**
914 - * ext4_fname_crypto_free_buffer() -
915 - *
916 - * Frees the buffer allocated for crypto operation.
917 - */
918 -void ext4_fname_crypto_free_buffer(struct ext4_str *crypto_str)
919 -{
920 - if (!crypto_str)
921 - return;
922 - kfree(crypto_str->name);
923 - crypto_str->name = NULL;
924 -}
925 -
926 -/**
927 - * ext4_fname_disk_to_usr() - converts a filename from disk space to user space
928 - */
929 -int _ext4_fname_disk_to_usr(struct inode *inode,
930 - struct dx_hash_info *hinfo,
931 - const struct ext4_str *iname,
932 - struct ext4_str *oname)
933 -{
934 - char buf[24];
935 - int ret;
936 -
937 - if (iname->len < 3) {
938 - /*Check for . and .. */
939 - if (iname->name[0] == '.' && iname->name[iname->len-1] == '.') {
940 - oname->name[0] = '.';
941 - oname->name[iname->len-1] = '.';
942 - oname->len = iname->len;
943 - return oname->len;
944 - }
945 - }
946 - if (iname->len < EXT4_CRYPTO_BLOCK_SIZE) {
947 - EXT4_ERROR_INODE(inode, "encrypted inode too small");
948 - return -EUCLEAN;
949 - }
950 - if (EXT4_I(inode)->i_crypt_info)
951 - return ext4_fname_decrypt(inode, iname, oname);
952 -
953 - if (iname->len <= EXT4_FNAME_CRYPTO_DIGEST_SIZE) {
954 - ret = digest_encode(iname->name, iname->len, oname->name);
955 - oname->len = ret;
956 - return ret;
957 - }
958 - if (hinfo) {
959 - memcpy(buf, &hinfo->hash, 4);
960 - memcpy(buf+4, &hinfo->minor_hash, 4);
961 - } else
962 - memset(buf, 0, 8);
963 - memcpy(buf + 8, iname->name + iname->len - 16, 16);
964 - oname->name[0] = '_';
965 - ret = digest_encode(buf, 24, oname->name+1);
966 - oname->len = ret + 1;
967 - return ret + 1;
968 -}
969 -
970 -int ext4_fname_disk_to_usr(struct inode *inode,
971 - struct dx_hash_info *hinfo,
972 - const struct ext4_dir_entry_2 *de,
973 - struct ext4_str *oname)
974 -{
975 - struct ext4_str iname = {.name = (unsigned char *) de->name,
976 - .len = de->name_len };
977 -
978 - return _ext4_fname_disk_to_usr(inode, hinfo, &iname, oname);
979 -}
980 -
981 -
982 -/**
983 - * ext4_fname_usr_to_disk() - converts a filename from user space to disk space
984 - */
985 -int ext4_fname_usr_to_disk(struct inode *inode,
986 - const struct qstr *iname,
987 - struct ext4_str *oname)
988 -{
989 - int res;
990 - struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info;
991 -
992 - if (iname->len < 3) {
993 - /*Check for . and .. */
994 - if (iname->name[0] == '.' &&
995 - iname->name[iname->len-1] == '.') {
996 - oname->name[0] = '.';
997 - oname->name[iname->len-1] = '.';
998 - oname->len = iname->len;
999 - return oname->len;
1000 - }
1001 - }
1002 - if (ci) {
1003 - res = ext4_fname_encrypt(inode, iname, oname);
1004 - return res;
1005 - }
1006 - /* Without a proper key, a user is not allowed to modify the filenames
1007 - * in a directory. Consequently, a user space name cannot be mapped to
1008 - * a disk-space name */
1009 - return -EACCES;
1010 -}
1011 -
1012 -int ext4_fname_setup_filename(struct inode *dir, const struct qstr *iname,
1013 - int lookup, struct ext4_filename *fname)
1014 -{
1015 - struct ext4_crypt_info *ci;
1016 - int ret = 0, bigname = 0;
1017 -
1018 - memset(fname, 0, sizeof(struct ext4_filename));
1019 - fname->usr_fname = iname;
1020 -
1021 - if (!ext4_encrypted_inode(dir) ||
1022 - ((iname->name[0] == '.') &&
1023 - ((iname->len == 1) ||
1024 - ((iname->name[1] == '.') && (iname->len == 2))))) {
1025 - fname->disk_name.name = (unsigned char *) iname->name;
1026 - fname->disk_name.len = iname->len;
1027 - return 0;
1028 - }
1029 - ret = ext4_get_encryption_info(dir);
1030 - if (ret)
1031 - return ret;
1032 - ci = EXT4_I(dir)->i_crypt_info;
1033 - if (ci) {
1034 - ret = ext4_fname_crypto_alloc_buffer(dir, iname->len,
1035 - &fname->crypto_buf);
1036 - if (ret < 0)
1037 - return ret;
1038 - ret = ext4_fname_encrypt(dir, iname, &fname->crypto_buf);
1039 - if (ret < 0)
1040 - goto errout;
1041 - fname->disk_name.name = fname->crypto_buf.name;
1042 - fname->disk_name.len = fname->crypto_buf.len;
1043 - return 0;
1044 - }
1045 - if (!lookup)
1046 - return -EACCES;
1047 -
1048 - /* We don't have the key and we are doing a lookup; decode the
1049 - * user-supplied name
1050 - */
1051 - if (iname->name[0] == '_')
1052 - bigname = 1;
1053 - if ((bigname && (iname->len != 33)) ||
1054 - (!bigname && (iname->len > 43)))
1055 - return -ENOENT;
1056 -
1057 - fname->crypto_buf.name = kmalloc(32, GFP_KERNEL);
1058 - if (fname->crypto_buf.name == NULL)
1059 - return -ENOMEM;
1060 - ret = digest_decode(iname->name + bigname, iname->len - bigname,
1061 - fname->crypto_buf.name);
1062 - if (ret < 0) {
1063 - ret = -ENOENT;
1064 - goto errout;
1065 - }
1066 - fname->crypto_buf.len = ret;
1067 - if (bigname) {
1068 - memcpy(&fname->hinfo.hash, fname->crypto_buf.name, 4);
1069 - memcpy(&fname->hinfo.minor_hash, fname->crypto_buf.name + 4, 4);
1070 - } else {
1071 - fname->disk_name.name = fname->crypto_buf.name;
1072 - fname->disk_name.len = fname->crypto_buf.len;
1073 - }
1074 - return 0;
1075 -errout:
1076 - kfree(fname->crypto_buf.name);
1077 - fname->crypto_buf.name = NULL;
1078 - return ret;
1079 -}
1080 -
1081 -void ext4_fname_free_filename(struct ext4_filename *fname)
1082 -{
1083 - kfree(fname->crypto_buf.name);
1084 - fname->crypto_buf.name = NULL;
1085 - fname->usr_fname = NULL;
1086 - fname->disk_name.name = NULL;
1087 -}
1088 diff --git a/fs/ext4/crypto_key.c b/fs/ext4/crypto_key.c
1089 deleted file mode 100644
1090 index 0129d68..0000000
1091 --- a/fs/ext4/crypto_key.c
1092 +++ /dev/null
1093 @@ -1,274 +0,0 @@
1094 -/*
1095 - * linux/fs/ext4/crypto_key.c
1096 - *
1097 - * Copyright (C) 2015, Google, Inc.
1098 - *
1099 - * This contains encryption key functions for ext4
1100 - *
1101 - * Written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar, 2015.
1102 - */
1103 -
1104 -#include <crypto/skcipher.h>
1105 -#include <keys/encrypted-type.h>
1106 -#include <keys/user-type.h>
1107 -#include <linux/random.h>
1108 -#include <linux/scatterlist.h>
1109 -#include <uapi/linux/keyctl.h>
1110 -
1111 -#include "ext4.h"
1112 -#include "xattr.h"
1113 -
1114 -static void derive_crypt_complete(struct crypto_async_request *req, int rc)
1115 -{
1116 - struct ext4_completion_result *ecr = req->data;
1117 -
1118 - if (rc == -EINPROGRESS)
1119 - return;
1120 -
1121 - ecr->res = rc;
1122 - complete(&ecr->completion);
1123 -}
1124 -
1125 -/**
1126 - * ext4_derive_key_aes() - Derive a key using AES-128-ECB
1127 - * @deriving_key: Encryption key used for derivation.
1128 - * @source_key: Source key to which to apply derivation.
1129 - * @derived_key: Derived key.
1130 - *
1131 - * Return: Zero on success; non-zero otherwise.
1132 - */
1133 -static int ext4_derive_key_aes(char deriving_key[EXT4_AES_128_ECB_KEY_SIZE],
1134 - char source_key[EXT4_AES_256_XTS_KEY_SIZE],
1135 - char derived_key[EXT4_AES_256_XTS_KEY_SIZE])
1136 -{
1137 - int res = 0;
1138 - struct skcipher_request *req = NULL;
1139 - DECLARE_EXT4_COMPLETION_RESULT(ecr);
1140 - struct scatterlist src_sg, dst_sg;
1141 - struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0);
1142 -
1143 - if (IS_ERR(tfm)) {
1144 - res = PTR_ERR(tfm);
1145 - tfm = NULL;
1146 - goto out;
1147 - }
1148 - crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_WEAK_KEY);
1149 - req = skcipher_request_alloc(tfm, GFP_NOFS);
1150 - if (!req) {
1151 - res = -ENOMEM;
1152 - goto out;
1153 - }
1154 - skcipher_request_set_callback(req,
1155 - CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
1156 - derive_crypt_complete, &ecr);
1157 - res = crypto_skcipher_setkey(tfm, deriving_key,
1158 - EXT4_AES_128_ECB_KEY_SIZE);
1159 - if (res < 0)
1160 - goto out;
1161 - sg_init_one(&src_sg, source_key, EXT4_AES_256_XTS_KEY_SIZE);
1162 - sg_init_one(&dst_sg, derived_key, EXT4_AES_256_XTS_KEY_SIZE);
1163 - skcipher_request_set_crypt(req, &src_sg, &dst_sg,
1164 - EXT4_AES_256_XTS_KEY_SIZE, NULL);
1165 - res = crypto_skcipher_encrypt(req);
1166 - if (res == -EINPROGRESS || res == -EBUSY) {
1167 - wait_for_completion(&ecr.completion);
1168 - res = ecr.res;
1169 - }
1170 -
1171 -out:
1172 - skcipher_request_free(req);
1173 - crypto_free_skcipher(tfm);
1174 - return res;
1175 -}
1176 -
1177 -void ext4_free_crypt_info(struct ext4_crypt_info *ci)
1178 -{
1179 - if (!ci)
1180 - return;
1181 -
1182 - if (ci->ci_keyring_key)
1183 - key_put(ci->ci_keyring_key);
1184 - crypto_free_skcipher(ci->ci_ctfm);
1185 - kmem_cache_free(ext4_crypt_info_cachep, ci);
1186 -}
1187 -
1188 -void ext4_free_encryption_info(struct inode *inode,
1189 - struct ext4_crypt_info *ci)
1190 -{
1191 - struct ext4_inode_info *ei = EXT4_I(inode);
1192 - struct ext4_crypt_info *prev;
1193 -
1194 - if (ci == NULL)
1195 - ci = ACCESS_ONCE(ei->i_crypt_info);
1196 - if (ci == NULL)
1197 - return;
1198 - prev = cmpxchg(&ei->i_crypt_info, ci, NULL);
1199 - if (prev != ci)
1200 - return;
1201 -
1202 - ext4_free_crypt_info(ci);
1203 -}
1204 -
1205 -int _ext4_get_encryption_info(struct inode *inode)
1206 -{
1207 - struct ext4_inode_info *ei = EXT4_I(inode);
1208 - struct ext4_crypt_info *crypt_info;
1209 - char full_key_descriptor[EXT4_KEY_DESC_PREFIX_SIZE +
1210 - (EXT4_KEY_DESCRIPTOR_SIZE * 2) + 1];
1211 - struct key *keyring_key = NULL;
1212 - struct ext4_encryption_key *master_key;
1213 - struct ext4_encryption_context ctx;
1214 - const struct user_key_payload *ukp;
1215 - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
1216 - struct crypto_skcipher *ctfm;
1217 - const char *cipher_str;
1218 - char raw_key[EXT4_MAX_KEY_SIZE];
1219 - char mode;
1220 - int res;
1221 -
1222 - if (!ext4_read_workqueue) {
1223 - res = ext4_init_crypto();
1224 - if (res)
1225 - return res;
1226 - }
1227 -
1228 -retry:
1229 - crypt_info = ACCESS_ONCE(ei->i_crypt_info);
1230 - if (crypt_info) {
1231 - if (!crypt_info->ci_keyring_key ||
1232 - key_validate(crypt_info->ci_keyring_key) == 0)
1233 - return 0;
1234 - ext4_free_encryption_info(inode, crypt_info);
1235 - goto retry;
1236 - }
1237 -
1238 - res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION,
1239 - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT,
1240 - &ctx, sizeof(ctx));
1241 - if (res < 0) {
1242 - if (!DUMMY_ENCRYPTION_ENABLED(sbi))
1243 - return res;
1244 - ctx.contents_encryption_mode = EXT4_ENCRYPTION_MODE_AES_256_XTS;
1245 - ctx.filenames_encryption_mode =
1246 - EXT4_ENCRYPTION_MODE_AES_256_CTS;
1247 - ctx.flags = 0;
1248 - } else if (res != sizeof(ctx))
1249 - return -EINVAL;
1250 - res = 0;
1251 -
1252 - crypt_info = kmem_cache_alloc(ext4_crypt_info_cachep, GFP_KERNEL);
1253 - if (!crypt_info)
1254 - return -ENOMEM;
1255 -
1256 - crypt_info->ci_flags = ctx.flags;
1257 - crypt_info->ci_data_mode = ctx.contents_encryption_mode;
1258 - crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
1259 - crypt_info->ci_ctfm = NULL;
1260 - crypt_info->ci_keyring_key = NULL;
1261 - memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
1262 - sizeof(crypt_info->ci_master_key));
1263 - if (S_ISREG(inode->i_mode))
1264 - mode = crypt_info->ci_data_mode;
1265 - else if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))
1266 - mode = crypt_info->ci_filename_mode;
1267 - else
1268 - BUG();
1269 - switch (mode) {
1270 - case EXT4_ENCRYPTION_MODE_AES_256_XTS:
1271 - cipher_str = "xts(aes)";
1272 - break;
1273 - case EXT4_ENCRYPTION_MODE_AES_256_CTS:
1274 - cipher_str = "cts(cbc(aes))";
1275 - break;
1276 - default:
1277 - printk_once(KERN_WARNING
1278 - "ext4: unsupported key mode %d (ino %u)\n",
1279 - mode, (unsigned) inode->i_ino);
1280 - res = -ENOKEY;
1281 - goto out;
1282 - }
1283 - if (DUMMY_ENCRYPTION_ENABLED(sbi)) {
1284 - memset(raw_key, 0x42, EXT4_AES_256_XTS_KEY_SIZE);
1285 - goto got_key;
1286 - }
1287 - memcpy(full_key_descriptor, EXT4_KEY_DESC_PREFIX,
1288 - EXT4_KEY_DESC_PREFIX_SIZE);
1289 - sprintf(full_key_descriptor + EXT4_KEY_DESC_PREFIX_SIZE,
1290 - "%*phN", EXT4_KEY_DESCRIPTOR_SIZE,
1291 - ctx.master_key_descriptor);
1292 - full_key_descriptor[EXT4_KEY_DESC_PREFIX_SIZE +
1293 - (2 * EXT4_KEY_DESCRIPTOR_SIZE)] = '\0';
1294 - keyring_key = request_key(&key_type_logon, full_key_descriptor, NULL);
1295 - if (IS_ERR(keyring_key)) {
1296 - res = PTR_ERR(keyring_key);
1297 - keyring_key = NULL;
1298 - goto out;
1299 - }
1300 - crypt_info->ci_keyring_key = keyring_key;
1301 - if (keyring_key->type != &key_type_logon) {
1302 - printk_once(KERN_WARNING
1303 - "ext4: key type must be logon\n");
1304 - res = -ENOKEY;
1305 - goto out;
1306 - }
1307 - down_read(&keyring_key->sem);
1308 - ukp = user_key_payload(keyring_key);
1309 - if (ukp->datalen != sizeof(struct ext4_encryption_key)) {
1310 - res = -EINVAL;
1311 - up_read(&keyring_key->sem);
1312 - goto out;
1313 - }
1314 - master_key = (struct ext4_encryption_key *)ukp->data;
1315 - BUILD_BUG_ON(EXT4_AES_128_ECB_KEY_SIZE !=
1316 - EXT4_KEY_DERIVATION_NONCE_SIZE);
1317 - if (master_key->size != EXT4_AES_256_XTS_KEY_SIZE) {
1318 - printk_once(KERN_WARNING
1319 - "ext4: key size incorrect: %d\n",
1320 - master_key->size);
1321 - res = -ENOKEY;
1322 - up_read(&keyring_key->sem);
1323 - goto out;
1324 - }
1325 - res = ext4_derive_key_aes(ctx.nonce, master_key->raw,
1326 - raw_key);
1327 - up_read(&keyring_key->sem);
1328 - if (res)
1329 - goto out;
1330 -got_key:
1331 - ctfm = crypto_alloc_skcipher(cipher_str, 0, 0);
1332 - if (!ctfm || IS_ERR(ctfm)) {
1333 - res = ctfm ? PTR_ERR(ctfm) : -ENOMEM;
1334 - printk(KERN_DEBUG
1335 - "%s: error %d (inode %u) allocating crypto tfm\n",
1336 - __func__, res, (unsigned) inode->i_ino);
1337 - goto out;
1338 - }
1339 - crypt_info->ci_ctfm = ctfm;
1340 - crypto_skcipher_clear_flags(ctfm, ~0);
1341 - crypto_tfm_set_flags(crypto_skcipher_tfm(ctfm),
1342 - CRYPTO_TFM_REQ_WEAK_KEY);
1343 - res = crypto_skcipher_setkey(ctfm, raw_key,
1344 - ext4_encryption_key_size(mode));
1345 - if (res)
1346 - goto out;
1347 - memzero_explicit(raw_key, sizeof(raw_key));
1348 - if (cmpxchg(&ei->i_crypt_info, NULL, crypt_info) != NULL) {
1349 - ext4_free_crypt_info(crypt_info);
1350 - goto retry;
1351 - }
1352 - return 0;
1353 -
1354 -out:
1355 - if (res == -ENOKEY)
1356 - res = 0;
1357 - ext4_free_crypt_info(crypt_info);
1358 - memzero_explicit(raw_key, sizeof(raw_key));
1359 - return res;
1360 -}
1361 -
1362 -int ext4_has_encryption_key(struct inode *inode)
1363 -{
1364 - struct ext4_inode_info *ei = EXT4_I(inode);
1365 -
1366 - return (ei->i_crypt_info != NULL);
1367 -}
1368 diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
1369 deleted file mode 100644
1370 index ad05069..0000000
1371 --- a/fs/ext4/crypto_policy.c
1372 +++ /dev/null
1373 @@ -1,229 +0,0 @@
1374 -/*
1375 - * linux/fs/ext4/crypto_policy.c
1376 - *
1377 - * Copyright (C) 2015, Google, Inc.
1378 - *
1379 - * This contains encryption policy functions for ext4
1380 - *
1381 - * Written by Michael Halcrow, 2015.
1382 - */
1383 -
1384 -#include <linux/random.h>
1385 -#include <linux/string.h>
1386 -#include <linux/types.h>
1387 -
1388 -#include "ext4_jbd2.h"
1389 -#include "ext4.h"
1390 -#include "xattr.h"
1391 -
1392 -static int ext4_inode_has_encryption_context(struct inode *inode)
1393 -{
1394 - int res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION,
1395 - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, NULL, 0);
1396 - return (res > 0);
1397 -}
1398 -
1399 -/*
1400 - * check whether the policy is consistent with the encryption context
1401 - * for the inode
1402 - */
1403 -static int ext4_is_encryption_context_consistent_with_policy(
1404 - struct inode *inode, const struct ext4_encryption_policy *policy)
1405 -{
1406 - struct ext4_encryption_context ctx;
1407 - int res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION,
1408 - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, &ctx,
1409 - sizeof(ctx));
1410 - if (res != sizeof(ctx))
1411 - return 0;
1412 - return (memcmp(ctx.master_key_descriptor, policy->master_key_descriptor,
1413 - EXT4_KEY_DESCRIPTOR_SIZE) == 0 &&
1414 - (ctx.flags ==
1415 - policy->flags) &&
1416 - (ctx.contents_encryption_mode ==
1417 - policy->contents_encryption_mode) &&
1418 - (ctx.filenames_encryption_mode ==
1419 - policy->filenames_encryption_mode));
1420 -}
1421 -
1422 -static int ext4_create_encryption_context_from_policy(
1423 - struct inode *inode, const struct ext4_encryption_policy *policy)
1424 -{
1425 - struct ext4_encryption_context ctx;
1426 - handle_t *handle;
1427 - int res, res2;
1428 -
1429 - res = ext4_convert_inline_data(inode);
1430 - if (res)
1431 - return res;
1432 -
1433 - ctx.format = EXT4_ENCRYPTION_CONTEXT_FORMAT_V1;
1434 - memcpy(ctx.master_key_descriptor, policy->master_key_descriptor,
1435 - EXT4_KEY_DESCRIPTOR_SIZE);
1436 - if (!ext4_valid_contents_enc_mode(policy->contents_encryption_mode)) {
1437 - printk(KERN_WARNING
1438 - "%s: Invalid contents encryption mode %d\n", __func__,
1439 - policy->contents_encryption_mode);
1440 - return -EINVAL;
1441 - }
1442 - if (!ext4_valid_filenames_enc_mode(policy->filenames_encryption_mode)) {
1443 - printk(KERN_WARNING
1444 - "%s: Invalid filenames encryption mode %d\n", __func__,
1445 - policy->filenames_encryption_mode);
1446 - return -EINVAL;
1447 - }
1448 - if (policy->flags & ~EXT4_POLICY_FLAGS_VALID)
1449 - return -EINVAL;
1450 - ctx.contents_encryption_mode = policy->contents_encryption_mode;
1451 - ctx.filenames_encryption_mode = policy->filenames_encryption_mode;
1452 - ctx.flags = policy->flags;
1453 - BUILD_BUG_ON(sizeof(ctx.nonce) != EXT4_KEY_DERIVATION_NONCE_SIZE);
1454 - get_random_bytes(ctx.nonce, EXT4_KEY_DERIVATION_NONCE_SIZE);
1455 -
1456 - handle = ext4_journal_start(inode, EXT4_HT_MISC,
1457 - ext4_jbd2_credits_xattr(inode));
1458 - if (IS_ERR(handle))
1459 - return PTR_ERR(handle);
1460 - res = ext4_xattr_set(inode, EXT4_XATTR_INDEX_ENCRYPTION,
1461 - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, &ctx,
1462 - sizeof(ctx), 0);
1463 - if (!res) {
1464 - ext4_set_inode_flag(inode, EXT4_INODE_ENCRYPT);
1465 - res = ext4_mark_inode_dirty(handle, inode);
1466 - if (res)
1467 - EXT4_ERROR_INODE(inode, "Failed to mark inode dirty");
1468 - }
1469 - res2 = ext4_journal_stop(handle);
1470 - if (!res)
1471 - res = res2;
1472 - return res;
1473 -}
1474 -
1475 -int ext4_process_policy(const struct ext4_encryption_policy *policy,
1476 - struct inode *inode)
1477 -{
1478 - if (policy->version != 0)
1479 - return -EINVAL;
1480 -
1481 - if (!ext4_inode_has_encryption_context(inode)) {
1482 - if (!S_ISDIR(inode->i_mode))
1483 - return -EINVAL;
1484 - if (!ext4_empty_dir(inode))
1485 - return -ENOTEMPTY;
1486 - return ext4_create_encryption_context_from_policy(inode,
1487 - policy);
1488 - }
1489 -
1490 - if (ext4_is_encryption_context_consistent_with_policy(inode, policy))
1491 - return 0;
1492 -
1493 - printk(KERN_WARNING "%s: Policy inconsistent with encryption context\n",
1494 - __func__);
1495 - return -EINVAL;
1496 -}
1497 -
1498 -int ext4_get_policy(struct inode *inode, struct ext4_encryption_policy *policy)
1499 -{
1500 - struct ext4_encryption_context ctx;
1501 -
1502 - int res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION,
1503 - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT,
1504 - &ctx, sizeof(ctx));
1505 - if (res != sizeof(ctx))
1506 - return -ENOENT;
1507 - if (ctx.format != EXT4_ENCRYPTION_CONTEXT_FORMAT_V1)
1508 - return -EINVAL;
1509 - policy->version = 0;
1510 - policy->contents_encryption_mode = ctx.contents_encryption_mode;
1511 - policy->filenames_encryption_mode = ctx.filenames_encryption_mode;
1512 - policy->flags = ctx.flags;
1513 - memcpy(&policy->master_key_descriptor, ctx.master_key_descriptor,
1514 - EXT4_KEY_DESCRIPTOR_SIZE);
1515 - return 0;
1516 -}
1517 -
1518 -int ext4_is_child_context_consistent_with_parent(struct inode *parent,
1519 - struct inode *child)
1520 -{
1521 - struct ext4_crypt_info *parent_ci, *child_ci;
1522 - int res;
1523 -
1524 - if ((parent == NULL) || (child == NULL)) {
1525 - pr_err("parent %p child %p\n", parent, child);
1526 - WARN_ON(1); /* Should never happen */
1527 - return 0;
1528 - }
1529 - /* no restrictions if the parent directory is not encrypted */
1530 - if (!ext4_encrypted_inode(parent))
1531 - return 1;
1532 - /* if the child directory is not encrypted, this is always a problem */
1533 - if (!ext4_encrypted_inode(child))
1534 - return 0;
1535 - res = ext4_get_encryption_info(parent);
1536 - if (res)
1537 - return 0;
1538 - res = ext4_get_encryption_info(child);
1539 - if (res)
1540 - return 0;
1541 - parent_ci = EXT4_I(parent)->i_crypt_info;
1542 - child_ci = EXT4_I(child)->i_crypt_info;
1543 - if (!parent_ci && !child_ci)
1544 - return 1;
1545 - if (!parent_ci || !child_ci)
1546 - return 0;
1547 -
1548 - return (memcmp(parent_ci->ci_master_key,
1549 - child_ci->ci_master_key,
1550 - EXT4_KEY_DESCRIPTOR_SIZE) == 0 &&
1551 - (parent_ci->ci_data_mode == child_ci->ci_data_mode) &&
1552 - (parent_ci->ci_filename_mode == child_ci->ci_filename_mode) &&
1553 - (parent_ci->ci_flags == child_ci->ci_flags));
1554 -}
1555 -
1556 -/**
1557 - * ext4_inherit_context() - Sets a child context from its parent
1558 - * @parent: Parent inode from which the context is inherited.
1559 - * @child: Child inode that inherits the context from @parent.
1560 - *
1561 - * Return: Zero on success, non-zero otherwise
1562 - */
1563 -int ext4_inherit_context(struct inode *parent, struct inode *child)
1564 -{
1565 - struct ext4_encryption_context ctx;
1566 - struct ext4_crypt_info *ci;
1567 - int res;
1568 -
1569 - res = ext4_get_encryption_info(parent);
1570 - if (res < 0)
1571 - return res;
1572 - ci = EXT4_I(parent)->i_crypt_info;
1573 - if (ci == NULL)
1574 - return -ENOKEY;
1575 -
1576 - ctx.format = EXT4_ENCRYPTION_CONTEXT_FORMAT_V1;
1577 - if (DUMMY_ENCRYPTION_ENABLED(EXT4_SB(parent->i_sb))) {
1578 - ctx.contents_encryption_mode = EXT4_ENCRYPTION_MODE_AES_256_XTS;
1579 - ctx.filenames_encryption_mode =
1580 - EXT4_ENCRYPTION_MODE_AES_256_CTS;
1581 - ctx.flags = 0;
1582 - memset(ctx.master_key_descriptor, 0x42,
1583 - EXT4_KEY_DESCRIPTOR_SIZE);
1584 - res = 0;
1585 - } else {
1586 - ctx.contents_encryption_mode = ci->ci_data_mode;
1587 - ctx.filenames_encryption_mode = ci->ci_filename_mode;
1588 - ctx.flags = ci->ci_flags;
1589 - memcpy(ctx.master_key_descriptor, ci->ci_master_key,
1590 - EXT4_KEY_DESCRIPTOR_SIZE);
1591 - }
1592 - get_random_bytes(ctx.nonce, EXT4_KEY_DERIVATION_NONCE_SIZE);
1593 - res = ext4_xattr_set(child, EXT4_XATTR_INDEX_ENCRYPTION,
1594 - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, &ctx,
1595 - sizeof(ctx), 0);
1596 - if (!res) {
1597 - ext4_set_inode_flag(child, EXT4_INODE_ENCRYPT);
1598 - ext4_clear_inode_state(child, EXT4_STATE_MAY_INLINE_DATA);
1599 - res = ext4_get_encryption_info(child);
1600 - }
1601 - return res;
1602 -}
1603 diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
1604 index 561d730..301f189 100644
1605 --- a/fs/ext4/dir.c
1606 +++ b/fs/ext4/dir.c
1607 @@ -109,10 +109,10 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
1608 struct super_block *sb = inode->i_sb;
1609 struct buffer_head *bh = NULL;
1610 int dir_has_error = 0;
1611 - struct ext4_str fname_crypto_str = {.name = NULL, .len = 0};
1612 + struct fscrypt_str fstr = FSTR_INIT(NULL, 0);
1614 if (ext4_encrypted_inode(inode)) {
1615 - err = ext4_get_encryption_info(inode);
1616 + err = fscrypt_get_encryption_info(inode);
1617 if (err && err != -ENOKEY)
1618 return err;
1619 }
1620 @@ -139,8 +139,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
1621 }
1623 if (ext4_encrypted_inode(inode)) {
1624 - err = ext4_fname_crypto_alloc_buffer(inode, EXT4_NAME_LEN,
1625 - &fname_crypto_str);
1626 + err = fscrypt_fname_alloc_buffer(inode, EXT4_NAME_LEN, &fstr);
1627 if (err < 0)
1628 return err;
1629 }
1630 @@ -248,16 +247,19 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
1631 get_dtype(sb, de->file_type)))
1632 goto done;
1633 } else {
1634 - int save_len = fname_crypto_str.len;
1635 + int save_len = fstr.len;
1636 + struct fscrypt_str de_name =
1637 + FSTR_INIT(de->name,
1638 + de->name_len);
1640 /* Directory is encrypted */
1641 - err = ext4_fname_disk_to_usr(inode,
1642 - NULL, de, &fname_crypto_str);
1643 - fname_crypto_str.len = save_len;
1644 + err = fscrypt_fname_disk_to_usr(inode,
1645 + 0, 0, &de_name, &fstr);
1646 + fstr.len = save_len;
1647 if (err < 0)
1648 goto errout;
1649 if (!dir_emit(ctx,
1650 - fname_crypto_str.name, err,
1651 + fstr.name, err,
1652 le32_to_cpu(de->inode),
1653 get_dtype(sb, de->file_type)))
1654 goto done;
1655 @@ -276,7 +278,7 @@ done:
1656 err = 0;
1657 errout:
1658 #ifdef CONFIG_EXT4_FS_ENCRYPTION
1659 - ext4_fname_crypto_free_buffer(&fname_crypto_str);
1660 + fscrypt_fname_free_buffer(&fstr);
1661 #endif
1662 brelse(bh);
1663 return err;
1664 @@ -427,7 +429,7 @@ void ext4_htree_free_dir_info(struct dir_private_info *p)
1665 int ext4_htree_store_dirent(struct file *dir_file, __u32 hash,
1666 __u32 minor_hash,
1667 struct ext4_dir_entry_2 *dirent,
1668 - struct ext4_str *ent_name)
1669 + struct fscrypt_str *ent_name)
1670 {
1671 struct rb_node **p, *parent = NULL;
1672 struct fname *fname, *new_fn;
1673 @@ -604,7 +606,7 @@ finished:
1674 static int ext4_dir_open(struct inode * inode, struct file * filp)
1675 {
1676 if (ext4_encrypted_inode(inode))
1677 - return ext4_get_encryption_info(inode) ? -EACCES : 0;
1678 + return fscrypt_get_encryption_info(inode) ? -EACCES : 0;
1679 return 0;
1680 }
1682 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
1683 index 349afeb..3b92225 100644
1684 --- a/fs/ext4/ext4.h
1685 +++ b/fs/ext4/ext4.h
1686 @@ -32,6 +32,7 @@
1687 #include <linux/percpu_counter.h>
1688 #include <linux/ratelimit.h>
1689 #include <crypto/hash.h>
1690 +#include <linux/fscrypto.h>
1691 #include <linux/falloc.h>
1692 #ifdef __KERNEL__
1693 #include <linux/compat.h>
1694 @@ -604,15 +605,6 @@ enum {
1695 #define EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER 0x0010
1696 #define EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER 0x0020
1698 -/* Encryption algorithms */
1699 -#define EXT4_ENCRYPTION_MODE_INVALID 0
1700 -#define EXT4_ENCRYPTION_MODE_AES_256_XTS 1
1701 -#define EXT4_ENCRYPTION_MODE_AES_256_GCM 2
1702 -#define EXT4_ENCRYPTION_MODE_AES_256_CBC 3
1703 -#define EXT4_ENCRYPTION_MODE_AES_256_CTS 4
1704 -
1705 -#include "ext4_crypto.h"
1706 -
1707 /*
1708 * ioctl commands
1709 */
1710 @@ -634,9 +626,9 @@ enum {
1711 #define EXT4_IOC_RESIZE_FS _IOW('f', 16, __u64)
1712 #define EXT4_IOC_SWAP_BOOT _IO('f', 17)
1713 #define EXT4_IOC_PRECACHE_EXTENTS _IO('f', 18)
1714 -#define EXT4_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct ext4_encryption_policy)
1715 -#define EXT4_IOC_GET_ENCRYPTION_PWSALT _IOW('f', 20, __u8[16])
1716 -#define EXT4_IOC_GET_ENCRYPTION_POLICY _IOW('f', 21, struct ext4_encryption_policy)
1717 +#define EXT4_IOC_SET_ENCRYPTION_POLICY FS_IOC_SET_ENCRYPTION_POLICY
1718 +#define EXT4_IOC_GET_ENCRYPTION_PWSALT FS_IOC_GET_ENCRYPTION_PWSALT
1719 +#define EXT4_IOC_GET_ENCRYPTION_POLICY FS_IOC_GET_ENCRYPTION_POLICY
1721 #ifndef FS_IOC_FSGETXATTR
1722 /* Until the uapi changes get merged for project quota... */
1723 @@ -1078,10 +1070,6 @@ struct ext4_inode_info {
1724 /* Precomputed uuid+inum+igen checksum for seeding inode checksums */
1725 __u32 i_csum_seed;
1727 -#ifdef CONFIG_EXT4_FS_ENCRYPTION
1728 - /* Encryption params */
1729 - struct ext4_crypt_info *i_crypt_info;
1730 -#endif
1731 kprojid_t i_projid;
1732 };
1734 @@ -1604,15 +1592,6 @@ static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)
1735 /*
1736 * Returns true if the inode is inode is encrypted
1737 */
1738 -static inline int ext4_encrypted_inode(struct inode *inode)
1739 -{
1740 -#ifdef CONFIG_EXT4_FS_ENCRYPTION
1741 - return ext4_test_inode_flag(inode, EXT4_INODE_ENCRYPT);
1742 -#else
1743 - return 0;
1744 -#endif
1745 -}
1746 -
1747 #define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime
1749 /*
1750 @@ -2076,10 +2055,10 @@ struct dx_hash_info
1752 struct ext4_filename {
1753 const struct qstr *usr_fname;
1754 - struct ext4_str disk_name;
1755 + struct fscrypt_str disk_name;
1756 struct dx_hash_info hinfo;
1757 #ifdef CONFIG_EXT4_FS_ENCRYPTION
1758 - struct ext4_str crypto_buf;
1759 + struct fscrypt_str crypto_buf;
1760 #endif
1761 };
1763 @@ -2290,132 +2269,82 @@ extern unsigned ext4_free_clusters_after_init(struct super_block *sb,
1764 struct ext4_group_desc *gdp);
1765 ext4_fsblk_t ext4_inode_to_goal_block(struct inode *);
1767 -/* crypto_policy.c */
1768 -int ext4_is_child_context_consistent_with_parent(struct inode *parent,
1769 - struct inode *child);
1770 -int ext4_inherit_context(struct inode *parent, struct inode *child);
1771 -void ext4_to_hex(char *dst, char *src, size_t src_size);
1772 -int ext4_process_policy(const struct ext4_encryption_policy *policy,
1773 - struct inode *inode);
1774 -int ext4_get_policy(struct inode *inode,
1775 - struct ext4_encryption_policy *policy);
1776 -
1777 -/* crypto.c */
1778 -extern struct kmem_cache *ext4_crypt_info_cachep;
1779 -bool ext4_valid_contents_enc_mode(uint32_t mode);
1780 -uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size);
1781 -extern struct workqueue_struct *ext4_read_workqueue;
1782 -struct ext4_crypto_ctx *ext4_get_crypto_ctx(struct inode *inode,
1783 - gfp_t gfp_flags);
1784 -void ext4_release_crypto_ctx(struct ext4_crypto_ctx *ctx);
1785 -void ext4_restore_control_page(struct page *data_page);
1786 -struct page *ext4_encrypt(struct inode *inode,
1787 - struct page *plaintext_page,
1788 - gfp_t gfp_flags);
1789 -int ext4_decrypt(struct page *page);
1790 -int ext4_encrypted_zeroout(struct inode *inode, ext4_lblk_t lblk,
1791 - ext4_fsblk_t pblk, ext4_lblk_t len);
1792 -extern const struct dentry_operations ext4_encrypted_d_ops;
1793 -
1794 -#ifdef CONFIG_EXT4_FS_ENCRYPTION
1795 -int ext4_init_crypto(void);
1796 -void ext4_exit_crypto(void);
1797 static inline int ext4_sb_has_crypto(struct super_block *sb)
1798 {
1799 return ext4_has_feature_encrypt(sb);
1800 }
1801 -#else
1802 -static inline int ext4_init_crypto(void) { return 0; }
1803 -static inline void ext4_exit_crypto(void) { }
1804 -static inline int ext4_sb_has_crypto(struct super_block *sb)
1805 +
1806 +static inline bool ext4_encrypted_inode(struct inode *inode)
1807 {
1808 - return 0;
1809 + return ext4_test_inode_flag(inode, EXT4_INODE_ENCRYPT);
1810 }
1811 -#endif
1813 -/* crypto_fname.c */
1814 -bool ext4_valid_filenames_enc_mode(uint32_t mode);
1815 -u32 ext4_fname_crypto_round_up(u32 size, u32 blksize);
1816 -unsigned ext4_fname_encrypted_size(struct inode *inode, u32 ilen);
1817 -int ext4_fname_crypto_alloc_buffer(struct inode *inode,
1818 - u32 ilen, struct ext4_str *crypto_str);
1819 -int _ext4_fname_disk_to_usr(struct inode *inode,
1820 - struct dx_hash_info *hinfo,
1821 - const struct ext4_str *iname,
1822 - struct ext4_str *oname);
1823 -int ext4_fname_disk_to_usr(struct inode *inode,
1824 - struct dx_hash_info *hinfo,
1825 - const struct ext4_dir_entry_2 *de,
1826 - struct ext4_str *oname);
1827 -int ext4_fname_usr_to_disk(struct inode *inode,
1828 - const struct qstr *iname,
1829 - struct ext4_str *oname);
1830 #ifdef CONFIG_EXT4_FS_ENCRYPTION
1831 -void ext4_fname_crypto_free_buffer(struct ext4_str *crypto_str);
1832 -int ext4_fname_setup_filename(struct inode *dir, const struct qstr *iname,
1833 - int lookup, struct ext4_filename *fname);
1834 -void ext4_fname_free_filename(struct ext4_filename *fname);
1835 -#else
1836 -static inline
1837 -int ext4_setup_fname_crypto(struct inode *inode)
1838 -{
1839 - return 0;
1840 -}
1841 -static inline void ext4_fname_crypto_free_buffer(struct ext4_str *p) { }
1842 static inline int ext4_fname_setup_filename(struct inode *dir,
1843 - const struct qstr *iname,
1844 - int lookup, struct ext4_filename *fname)
1845 + const struct qstr *iname,
1846 + int lookup, struct ext4_filename *fname)
1847 {
1848 - fname->usr_fname = iname;
1849 - fname->disk_name.name = (unsigned char *) iname->name;
1850 - fname->disk_name.len = iname->len;
1851 - return 0;
1852 -}
1853 -static inline void ext4_fname_free_filename(struct ext4_filename *fname) { }
1854 -#endif
1855 -
1856 + struct fscrypt_name name;
1857 + int err;
1859 -/* crypto_key.c */
1860 -void ext4_free_crypt_info(struct ext4_crypt_info *ci);
1861 -void ext4_free_encryption_info(struct inode *inode, struct ext4_crypt_info *ci);
1862 -int _ext4_get_encryption_info(struct inode *inode);
1863 + memset(fname, 0, sizeof(struct ext4_filename));
1865 -#ifdef CONFIG_EXT4_FS_ENCRYPTION
1866 -int ext4_has_encryption_key(struct inode *inode);
1867 + err = fscrypt_setup_filename(dir, iname, lookup, &name);
1869 -static inline int ext4_get_encryption_info(struct inode *inode)
1870 -{
1871 - struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info;
1872 -
1873 - if (!ci ||
1874 - (ci->ci_keyring_key &&
1875 - (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
1876 - (1 << KEY_FLAG_REVOKED) |
1877 - (1 << KEY_FLAG_DEAD)))))
1878 - return _ext4_get_encryption_info(inode);
1879 - return 0;
1880 + fname->usr_fname = name.usr_fname;
1881 + fname->disk_name = name.disk_name;
1882 + fname->hinfo.hash = name.hash;
1883 + fname->hinfo.minor_hash = name.minor_hash;
1884 + fname->crypto_buf = name.crypto_buf;
1885 + return err;
1886 }
1888 -static inline struct ext4_crypt_info *ext4_encryption_info(struct inode *inode)
1889 +static inline void ext4_fname_free_filename(struct ext4_filename *fname)
1890 {
1891 - return EXT4_I(inode)->i_crypt_info;
1892 -}
1893 + struct fscrypt_name name;
1895 -#else
1896 -static inline int ext4_has_encryption_key(struct inode *inode)
1897 -{
1898 - return 0;
1899 + name.crypto_buf = fname->crypto_buf;
1900 + fscrypt_free_filename(&name);
1901 +
1902 + fname->crypto_buf.name = NULL;
1903 + fname->usr_fname = NULL;
1904 + fname->disk_name.name = NULL;
1905 }
1906 -static inline int ext4_get_encryption_info(struct inode *inode)
1907 +#else
1908 +static inline int ext4_fname_setup_filename(struct inode *dir,
1909 + const struct qstr *iname,
1910 + int lookup, struct ext4_filename *fname)
1911 {
1912 + fname->usr_fname = iname;
1913 + fname->disk_name.name = (unsigned char *) iname->name;
1914 + fname->disk_name.len = iname->len;
1915 return 0;
1916 }
1917 -static inline struct ext4_crypt_info *ext4_encryption_info(struct inode *inode)
1918 -{
1919 - return NULL;
1920 -}
1921 -#endif
1922 +static inline void ext4_fname_free_filename(struct ext4_filename *fname) { }
1924 +#define fscrypt_set_d_op(i)
1925 +#define fscrypt_get_ctx fscrypt_notsupp_get_ctx
1926 +#define fscrypt_release_ctx fscrypt_notsupp_release_ctx
1927 +#define fscrypt_encrypt_page fscrypt_notsupp_encrypt_page
1928 +#define fscrypt_decrypt_page fscrypt_notsupp_decrypt_page
1929 +#define fscrypt_decrypt_bio_pages fscrypt_notsupp_decrypt_bio_pages
1930 +#define fscrypt_pullback_bio_page fscrypt_notsupp_pullback_bio_page
1931 +#define fscrypt_restore_control_page fscrypt_notsupp_restore_control_page
1932 +#define fscrypt_zeroout_range fscrypt_notsupp_zeroout_range
1933 +#define fscrypt_process_policy fscrypt_notsupp_process_policy
1934 +#define fscrypt_get_policy fscrypt_notsupp_get_policy
1935 +#define fscrypt_has_permitted_context fscrypt_notsupp_has_permitted_context
1936 +#define fscrypt_inherit_context fscrypt_notsupp_inherit_context
1937 +#define fscrypt_get_encryption_info fscrypt_notsupp_get_encryption_info
1938 +#define fscrypt_put_encryption_info fscrypt_notsupp_put_encryption_info
1939 +#define fscrypt_setup_filename fscrypt_notsupp_setup_filename
1940 +#define fscrypt_free_filename fscrypt_notsupp_free_filename
1941 +#define fscrypt_fname_encrypted_size fscrypt_notsupp_fname_encrypted_size
1942 +#define fscrypt_fname_alloc_buffer fscrypt_notsupp_fname_alloc_buffer
1943 +#define fscrypt_fname_free_buffer fscrypt_notsupp_fname_free_buffer
1944 +#define fscrypt_fname_disk_to_usr fscrypt_notsupp_fname_disk_to_usr
1945 +#define fscrypt_fname_usr_to_disk fscrypt_notsupp_fname_usr_to_disk
1946 +#endif
1948 /* dir.c */
1949 extern int __ext4_check_dir_entry(const char *, unsigned int, struct inode *,
1950 @@ -2429,7 +2358,7 @@ extern int __ext4_check_dir_entry(const char *, unsigned int, struct inode *,
1951 extern int ext4_htree_store_dirent(struct file *dir_file, __u32 hash,
1952 __u32 minor_hash,
1953 struct ext4_dir_entry_2 *dirent,
1954 - struct ext4_str *ent_name);
1955 + struct fscrypt_str *ent_name);
1956 extern void ext4_htree_free_dir_info(struct dir_private_info *p);
1957 extern int ext4_find_dest_de(struct inode *dir, struct inode *inode,
1958 struct buffer_head *bh,
1959 @@ -2619,7 +2548,7 @@ extern int ext4_generic_delete_entry(handle_t *handle,
1960 void *entry_buf,
1961 int buf_size,
1962 int csum_size);
1963 -extern int ext4_empty_dir(struct inode *inode);
1964 +extern bool ext4_empty_dir(struct inode *inode);
1966 /* resize.c */
1967 extern int ext4_group_add(struct super_block *sb,
1968 @@ -3101,7 +3030,7 @@ extern int ext4_delete_inline_entry(handle_t *handle,
1969 struct ext4_dir_entry_2 *de_del,
1970 struct buffer_head *bh,
1971 int *has_inline_data);
1972 -extern int empty_inline_dir(struct inode *dir, int *has_inline_data);
1973 +extern bool empty_inline_dir(struct inode *dir, int *has_inline_data);
1974 extern struct buffer_head *ext4_get_first_inline_block(struct inode *inode,
1975 struct ext4_dir_entry_2 **parent_de,
1976 int *retval);
1977 diff --git a/fs/ext4/ext4_crypto.h b/fs/ext4/ext4_crypto.h
1978 deleted file mode 100644
1979 index 1f73c29..0000000
1980 --- a/fs/ext4/ext4_crypto.h
1981 +++ /dev/null
1982 @@ -1,159 +0,0 @@
1983 -/*
1984 - * linux/fs/ext4/ext4_crypto.h
1985 - *
1986 - * Copyright (C) 2015, Google, Inc.
1987 - *
1988 - * This contains encryption header content for ext4
1989 - *
1990 - * Written by Michael Halcrow, 2015.
1991 - */
1992 -
1993 -#ifndef _EXT4_CRYPTO_H
1994 -#define _EXT4_CRYPTO_H
1995 -
1996 -#include <linux/fs.h>
1997 -
1998 -#define EXT4_KEY_DESCRIPTOR_SIZE 8
1999 -
2000 -/* Policy provided via an ioctl on the topmost directory */
2001 -struct ext4_encryption_policy {
2002 - char version;
2003 - char contents_encryption_mode;
2004 - char filenames_encryption_mode;
2005 - char flags;
2006 - char master_key_descriptor[EXT4_KEY_DESCRIPTOR_SIZE];
2007 -} __attribute__((__packed__));
2008 -
2009 -#define EXT4_ENCRYPTION_CONTEXT_FORMAT_V1 1
2010 -#define EXT4_KEY_DERIVATION_NONCE_SIZE 16
2011 -
2012 -#define EXT4_POLICY_FLAGS_PAD_4 0x00
2013 -#define EXT4_POLICY_FLAGS_PAD_8 0x01
2014 -#define EXT4_POLICY_FLAGS_PAD_16 0x02
2015 -#define EXT4_POLICY_FLAGS_PAD_32 0x03
2016 -#define EXT4_POLICY_FLAGS_PAD_MASK 0x03
2017 -#define EXT4_POLICY_FLAGS_VALID 0x03
2018 -
2019 -/**
2020 - * Encryption context for inode
2021 - *
2022 - * Protector format:
2023 - * 1 byte: Protector format (1 = this version)
2024 - * 1 byte: File contents encryption mode
2025 - * 1 byte: File names encryption mode
2026 - * 1 byte: Reserved
2027 - * 8 bytes: Master Key descriptor
2028 - * 16 bytes: Encryption Key derivation nonce
2029 - */
2030 -struct ext4_encryption_context {
2031 - char format;
2032 - char contents_encryption_mode;
2033 - char filenames_encryption_mode;
2034 - char flags;
2035 - char master_key_descriptor[EXT4_KEY_DESCRIPTOR_SIZE];
2036 - char nonce[EXT4_KEY_DERIVATION_NONCE_SIZE];
2037 -} __attribute__((__packed__));
2038 -
2039 -/* Encryption parameters */
2040 -#define EXT4_XTS_TWEAK_SIZE 16
2041 -#define EXT4_AES_128_ECB_KEY_SIZE 16
2042 -#define EXT4_AES_256_GCM_KEY_SIZE 32
2043 -#define EXT4_AES_256_CBC_KEY_SIZE 32
2044 -#define EXT4_AES_256_CTS_KEY_SIZE 32
2045 -#define EXT4_AES_256_XTS_KEY_SIZE 64
2046 -#define EXT4_MAX_KEY_SIZE 64
2047 -
2048 -#define EXT4_KEY_DESC_PREFIX "ext4:"
2049 -#define EXT4_KEY_DESC_PREFIX_SIZE 5
2050 -
2051 -/* This is passed in from userspace into the kernel keyring */
2052 -struct ext4_encryption_key {
2053 - __u32 mode;
2054 - char raw[EXT4_MAX_KEY_SIZE];
2055 - __u32 size;
2056 -} __attribute__((__packed__));
2057 -
2058 -struct ext4_crypt_info {
2059 - char ci_data_mode;
2060 - char ci_filename_mode;
2061 - char ci_flags;
2062 - struct crypto_skcipher *ci_ctfm;
2063 - struct key *ci_keyring_key;
2064 - char ci_master_key[EXT4_KEY_DESCRIPTOR_SIZE];
2065 -};
2066 -
2067 -#define EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL 0x00000001
2068 -#define EXT4_WRITE_PATH_FL 0x00000002
2069 -
2070 -struct ext4_crypto_ctx {
2071 - union {
2072 - struct {
2073 - struct page *bounce_page; /* Ciphertext page */
2074 - struct page *control_page; /* Original page */
2075 - } w;
2076 - struct {
2077 - struct bio *bio;
2078 - struct work_struct work;
2079 - } r;
2080 - struct list_head free_list; /* Free list */
2081 - };
2082 - char flags; /* Flags */
2083 - char mode; /* Encryption mode for tfm */
2084 -};
2085 -
2086 -struct ext4_completion_result {
2087 - struct completion completion;
2088 - int res;
2089 -};
2090 -
2091 -#define DECLARE_EXT4_COMPLETION_RESULT(ecr) \
2092 - struct ext4_completion_result ecr = { \
2093 - COMPLETION_INITIALIZER((ecr).completion), 0 }
2094 -
2095 -static inline int ext4_encryption_key_size(int mode)
2096 -{
2097 - switch (mode) {
2098 - case EXT4_ENCRYPTION_MODE_AES_256_XTS:
2099 - return EXT4_AES_256_XTS_KEY_SIZE;
2100 - case EXT4_ENCRYPTION_MODE_AES_256_GCM:
2101 - return EXT4_AES_256_GCM_KEY_SIZE;
2102 - case EXT4_ENCRYPTION_MODE_AES_256_CBC:
2103 - return EXT4_AES_256_CBC_KEY_SIZE;
2104 - case EXT4_ENCRYPTION_MODE_AES_256_CTS:
2105 - return EXT4_AES_256_CTS_KEY_SIZE;
2106 - default:
2107 - BUG();
2108 - }
2109 - return 0;
2110 -}
2111 -
2112 -#define EXT4_FNAME_NUM_SCATTER_ENTRIES 4
2113 -#define EXT4_CRYPTO_BLOCK_SIZE 16
2114 -#define EXT4_FNAME_CRYPTO_DIGEST_SIZE 32
2115 -
2116 -struct ext4_str {
2117 - unsigned char *name;
2118 - u32 len;
2119 -};
2120 -
2121 -/**
2122 - * For encrypted symlinks, the ciphertext length is stored at the beginning
2123 - * of the string in little-endian format.
2124 - */
2125 -struct ext4_encrypted_symlink_data {
2126 - __le16 len;
2127 - char encrypted_path[1];
2128 -} __attribute__((__packed__));
2129 -
2130 -/**
2131 - * This function is used to calculate the disk space required to
2132 - * store a filename of length l in encrypted symlink format.
2133 - */
2134 -static inline u32 encrypted_symlink_data_len(u32 l)
2135 -{
2136 - if (l < EXT4_CRYPTO_BLOCK_SIZE)
2137 - l = EXT4_CRYPTO_BLOCK_SIZE;
2138 - return (l + sizeof(struct ext4_encrypted_symlink_data) - 1);
2139 -}
2140 -
2141 -#endif /* _EXT4_CRYPTO_H */
2142 diff --git a/fs/ext4/file.c b/fs/ext4/file.c
2143 index fa2208b..9d262b4 100644
2144 --- a/fs/ext4/file.c
2145 +++ b/fs/ext4/file.c
2146 @@ -308,10 +308,10 @@ static int ext4_file_mmap(struct file *file, struct vm_area_struct *vma)
2147 struct inode *inode = file->f_mapping->host;
2149 if (ext4_encrypted_inode(inode)) {
2150 - int err = ext4_get_encryption_info(inode);
2151 + int err = fscrypt_get_encryption_info(inode);
2152 if (err)
2153 return 0;
2154 - if (ext4_encryption_info(inode) == NULL)
2155 + if (!fscrypt_has_encryption_key(inode))
2156 return -ENOKEY;
2157 }
2158 file_accessed(file);
2159 @@ -367,16 +367,16 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
2160 }
2161 }
2162 if (ext4_encrypted_inode(inode)) {
2163 - ret = ext4_get_encryption_info(inode);
2164 + ret = fscrypt_get_encryption_info(inode);
2165 if (ret)
2166 return -EACCES;
2167 - if (ext4_encryption_info(inode) == NULL)
2168 + if (!fscrypt_has_encryption_key(inode))
2169 return -ENOKEY;
2170 }
2172 dir = dget_parent(file_dentry(filp));
2173 if (ext4_encrypted_inode(d_inode(dir)) &&
2174 - !ext4_is_child_context_consistent_with_parent(d_inode(dir), inode)) {
2175 + !fscrypt_has_permitted_context(d_inode(dir), inode)) {
2176 ext4_warning(inode->i_sb,
2177 "Inconsistent encryption contexts: %lu/%lu\n",
2178 (unsigned long) d_inode(dir)->i_ino,
2179 diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
2180 index 237b877..69bb343 100644
2181 --- a/fs/ext4/ialloc.c
2182 +++ b/fs/ext4/ialloc.c
2183 @@ -767,10 +767,10 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir,
2184 if ((ext4_encrypted_inode(dir) ||
2185 DUMMY_ENCRYPTION_ENABLED(EXT4_SB(dir->i_sb))) &&
2186 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) {
2187 - err = ext4_get_encryption_info(dir);
2188 + err = fscrypt_get_encryption_info(dir);
2189 if (err)
2190 return ERR_PTR(err);
2191 - if (ext4_encryption_info(dir) == NULL)
2192 + if (!fscrypt_has_encryption_key(dir))
2193 return ERR_PTR(-EPERM);
2194 if (!handle)
2195 nblocks += EXT4_DATA_TRANS_BLOCKS(dir->i_sb);
2196 @@ -1115,7 +1115,8 @@ got:
2197 }
2199 if (encrypt) {
2200 - err = ext4_inherit_context(dir, inode);
2201 + /* give pointer to avoid set_context with journal ops. */
2202 + err = fscrypt_inherit_context(dir, inode, &encrypt, true);
2203 if (err)
2204 goto fail_free_drop;
2205 }
2206 diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
2207 index 7bc6c85..5ea6337 100644
2208 --- a/fs/ext4/inline.c
2209 +++ b/fs/ext4/inline.c
2210 @@ -1326,7 +1326,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
2211 struct ext4_iloc iloc;
2212 void *dir_buf = NULL;
2213 struct ext4_dir_entry_2 fake;
2214 - struct ext4_str tmp_str;
2215 + struct fscrypt_str tmp_str;
2217 ret = ext4_get_inode_loc(inode, &iloc);
2218 if (ret)
2219 @@ -1739,20 +1739,20 @@ ext4_get_inline_entry(struct inode *inode,
2220 return (struct ext4_dir_entry_2 *)(inline_pos + offset);
2221 }
2223 -int empty_inline_dir(struct inode *dir, int *has_inline_data)
2224 +bool empty_inline_dir(struct inode *dir, int *has_inline_data)
2225 {
2226 int err, inline_size;
2227 struct ext4_iloc iloc;
2228 void *inline_pos;
2229 unsigned int offset;
2230 struct ext4_dir_entry_2 *de;
2231 - int ret = 1;
2232 + bool ret = true;
2234 err = ext4_get_inode_loc(dir, &iloc);
2235 if (err) {
2236 EXT4_ERROR_INODE(dir, "error %d getting inode %lu block",
2237 err, dir->i_ino);
2238 - return 1;
2239 + return true;
2240 }
2242 down_read(&EXT4_I(dir)->xattr_sem);
2243 @@ -1766,7 +1766,7 @@ int empty_inline_dir(struct inode *dir, int *has_inline_data)
2244 ext4_warning(dir->i_sb,
2245 "bad inline directory (dir #%lu) - no `..'",
2246 dir->i_ino);
2247 - ret = 1;
2248 + ret = true;
2249 goto out;
2250 }
2252 @@ -1784,11 +1784,11 @@ int empty_inline_dir(struct inode *dir, int *has_inline_data)
2253 dir->i_ino, le32_to_cpu(de->inode),
2254 le16_to_cpu(de->rec_len), de->name_len,
2255 inline_size);
2256 - ret = 1;
2257 + ret = true;
2258 goto out;
2259 }
2260 if (le32_to_cpu(de->inode)) {
2261 - ret = 0;
2262 + ret = false;
2263 goto out;
2264 }
2265 offset += ext4_rec_len_from_disk(de->rec_len, inline_size);
2266 diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
2267 index 981a1fc..8f44605 100644
2268 --- a/fs/ext4/inode.c
2269 +++ b/fs/ext4/inode.c
2270 @@ -386,7 +386,7 @@ int ext4_issue_zeroout(struct inode *inode, ext4_lblk_t lblk, ext4_fsblk_t pblk,
2271 int ret;
2273 if (ext4_encrypted_inode(inode))
2274 - return ext4_encrypted_zeroout(inode, lblk, pblk, len);
2275 + return fscrypt_zeroout_range(inode, lblk, pblk, len);
2277 ret = sb_issue_zeroout(inode->i_sb, pblk, len, GFP_NOFS);
2278 if (ret > 0)
2279 @@ -1134,7 +1134,7 @@ static int ext4_block_write_begin(struct page *page, loff_t pos, unsigned len,
2280 if (unlikely(err))
2281 page_zero_new_buffers(page, from, to);
2282 else if (decrypt)
2283 - err = ext4_decrypt(page);
2284 + err = fscrypt_decrypt_page(page);
2285 return err;
2286 }
2287 #endif
2288 @@ -3611,9 +3611,9 @@ static int __ext4_block_zero_page_range(handle_t *handle,
2289 if (S_ISREG(inode->i_mode) &&
2290 ext4_encrypted_inode(inode)) {
2291 /* We expect the key to be set. */
2292 - BUG_ON(!ext4_has_encryption_key(inode));
2293 + BUG_ON(!fscrypt_has_encryption_key(inode));
2294 BUG_ON(blocksize != PAGE_SIZE);
2295 - WARN_ON_ONCE(ext4_decrypt(page));
2296 + WARN_ON_ONCE(fscrypt_decrypt_page(page));
2297 }
2298 }
2299 if (ext4_should_journal_data(inode)) {
2300 diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
2301 index eae5917..1c4f52f 100644
2302 --- a/fs/ext4/ioctl.c
2303 +++ b/fs/ext4/ioctl.c
2304 @@ -772,19 +772,13 @@ resizefs_out:
2305 return ext4_ext_precache(inode);
2306 case EXT4_IOC_SET_ENCRYPTION_POLICY: {
2307 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2308 - struct ext4_encryption_policy policy;
2309 - int err = 0;
2310 + struct fscrypt_policy policy;
2312 if (copy_from_user(&policy,
2313 - (struct ext4_encryption_policy __user *)arg,
2314 - sizeof(policy))) {
2315 - err = -EFAULT;
2316 - goto encryption_policy_out;
2317 - }
2318 -
2319 - err = ext4_process_policy(&policy, inode);
2320 -encryption_policy_out:
2321 - return err;
2322 + (struct fscrypt_policy __user *)arg,
2323 + sizeof(policy)))
2324 + return -EFAULT;
2325 + return fscrypt_process_policy(inode, &policy);
2326 #else
2327 return -EOPNOTSUPP;
2328 #endif
2329 @@ -827,12 +821,12 @@ encryption_policy_out:
2330 }
2331 case EXT4_IOC_GET_ENCRYPTION_POLICY: {
2332 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2333 - struct ext4_encryption_policy policy;
2334 + struct fscrypt_policy policy;
2335 int err = 0;
2337 if (!ext4_encrypted_inode(inode))
2338 return -ENOENT;
2339 - err = ext4_get_policy(inode, &policy);
2340 + err = fscrypt_get_policy(inode, &policy);
2341 if (err)
2342 return err;
2343 if (copy_to_user((void __user *)arg, &policy, sizeof(policy)))
2344 diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
2345 index 48e4b89..9cab638 100644
2346 --- a/fs/ext4/namei.c
2347 +++ b/fs/ext4/namei.c
2348 @@ -612,19 +612,21 @@ static struct stats dx_show_leaf(struct inode *dir,
2349 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2350 int len;
2351 char *name;
2352 - struct ext4_str fname_crypto_str
2353 - = {.name = NULL, .len = 0};
2354 + struct fscrypt_str fname_crypto_str =
2355 + FSTR_INIT(NULL, 0);
2356 + struct qstr istr =
2357 + QSTR_INIT(de->name, de->name_len);
2358 int res = 0;
2360 name = de->name;
2361 len = de->name_len;
2362 if (ext4_encrypted_inode(inode))
2363 - res = ext4_get_encryption_info(dir);
2364 + res = fscrypt_get_encryption_info(dir);
2365 if (res) {
2366 printk(KERN_WARNING "Error setting up"
2367 " fname crypto: %d\n", res);
2368 }
2369 - if (ctx == NULL) {
2370 + if (!fscrypt_has_encryption_key(inode)) {
2371 /* Directory is not encrypted */
2372 ext4fs_dirhash(de->name,
2373 de->name_len, &h);
2374 @@ -633,9 +635,12 @@ static struct stats dx_show_leaf(struct inode *dir,
2375 (unsigned) ((char *) de
2376 - base));
2377 } else {
2378 + struct fscrypt_str de_name =
2379 + FSTR_INIT(name, len);
2380 +
2381 /* Directory is encrypted */
2382 - res = ext4_fname_crypto_alloc_buffer(
2383 - ctx, de->name_len,
2384 + res = fscrypt_fname_alloc_buffer(
2385 + inode, len,
2386 &fname_crypto_str);
2387 if (res < 0) {
2388 printk(KERN_WARNING "Error "
2389 @@ -644,8 +649,9 @@ static struct stats dx_show_leaf(struct inode *dir,
2390 "crypto\n");
2391 ctx = NULL;
2392 }
2393 - res = ext4_fname_disk_to_usr(ctx, NULL, de,
2394 - &fname_crypto_str);
2395 + res = fscrypt_fname_disk_to_usr(inode,
2396 + 0, 0, &de_name,
2397 + &fname_crypto_str);
2398 if (res < 0) {
2399 printk(KERN_WARNING "Error "
2400 "converting filename "
2401 @@ -662,8 +668,8 @@ static struct stats dx_show_leaf(struct inode *dir,
2402 printk("%*.s:(E)%x.%u ", len, name,
2403 h.hash, (unsigned) ((char *) de
2404 - base));
2405 - ext4_fname_crypto_free_buffer(
2406 - &fname_crypto_str);
2407 + fscrypt_fname_free_buffer(
2408 + &fname_crypto_str);
2409 }
2410 #else
2411 int len = de->name_len;
2412 @@ -952,7 +958,7 @@ static int htree_dirblock_to_tree(struct file *dir_file,
2413 struct buffer_head *bh;
2414 struct ext4_dir_entry_2 *de, *top;
2415 int err = 0, count = 0;
2416 - struct ext4_str fname_crypto_str = {.name = NULL, .len = 0}, tmp_str;
2417 + struct fscrypt_str fname_crypto_str = FSTR_INIT(NULL, 0), tmp_str;
2419 dxtrace(printk(KERN_INFO "In htree dirblock_to_tree: block %lu\n",
2420 (unsigned long)block));
2421 @@ -967,12 +973,12 @@ static int htree_dirblock_to_tree(struct file *dir_file,
2422 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2423 /* Check if the directory is encrypted */
2424 if (ext4_encrypted_inode(dir)) {
2425 - err = ext4_get_encryption_info(dir);
2426 + err = fscrypt_get_encryption_info(dir);
2427 if (err < 0) {
2428 brelse(bh);
2429 return err;
2430 }
2431 - err = ext4_fname_crypto_alloc_buffer(dir, EXT4_NAME_LEN,
2432 + err = fscrypt_fname_alloc_buffer(dir, EXT4_NAME_LEN,
2433 &fname_crypto_str);
2434 if (err < 0) {
2435 brelse(bh);
2436 @@ -1003,10 +1009,13 @@ static int htree_dirblock_to_tree(struct file *dir_file,
2437 &tmp_str);
2438 } else {
2439 int save_len = fname_crypto_str.len;
2440 + struct fscrypt_str de_name = FSTR_INIT(de->name,
2441 + de->name_len);
2443 /* Directory is encrypted */
2444 - err = ext4_fname_disk_to_usr(dir, hinfo, de,
2445 - &fname_crypto_str);
2446 + err = fscrypt_fname_disk_to_usr(dir, hinfo->hash,
2447 + hinfo->minor_hash, &de_name,
2448 + &fname_crypto_str);
2449 if (err < 0) {
2450 count = err;
2451 goto errout;
2452 @@ -1025,7 +1034,7 @@ static int htree_dirblock_to_tree(struct file *dir_file,
2453 errout:
2454 brelse(bh);
2455 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2456 - ext4_fname_crypto_free_buffer(&fname_crypto_str);
2457 + fscrypt_fname_free_buffer(&fname_crypto_str);
2458 #endif
2459 return count;
2460 }
2461 @@ -1050,7 +1059,7 @@ int ext4_htree_fill_tree(struct file *dir_file, __u32 start_hash,
2462 int count = 0;
2463 int ret, err;
2464 __u32 hashval;
2465 - struct ext4_str tmp_str;
2466 + struct fscrypt_str tmp_str;
2468 dxtrace(printk(KERN_DEBUG "In htree_fill_tree, start hash: %x:%x\n",
2469 start_hash, start_minor_hash));
2470 @@ -1558,26 +1567,23 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
2471 struct ext4_dir_entry_2 *de;
2472 struct buffer_head *bh;
2474 - if (ext4_encrypted_inode(dir)) {
2475 - int res = ext4_get_encryption_info(dir);
2476 + if (ext4_encrypted_inode(dir)) {
2477 + int res = fscrypt_get_encryption_info(dir);
2479 /*
2480 - * This should be a properly defined flag for
2481 - * dentry->d_flags when we uplift this to the VFS.
2482 - * d_fsdata is set to (void *) 1 if if the dentry is
2483 + * DCACHE_ENCRYPTED_WITH_KEY is set if the dentry is
2484 * created while the directory was encrypted and we
2485 * don't have access to the key.
2486 */
2487 - dentry->d_fsdata = NULL;
2488 - if (ext4_encryption_info(dir))
2489 - dentry->d_fsdata = (void *) 1;
2490 - d_set_d_op(dentry, &ext4_encrypted_d_ops);
2491 - if (res && res != -ENOKEY)
2492 - return ERR_PTR(res);
2493 - }
2494 + if (fscrypt_has_encryption_key(dir))
2495 + fscrypt_set_encrypted_dentry(dentry);
2496 + fscrypt_set_d_op(dentry);
2497 + if (res && res != -ENOKEY)
2498 + return ERR_PTR(res);
2499 + }
2501 - if (dentry->d_name.len > EXT4_NAME_LEN)
2502 - return ERR_PTR(-ENAMETOOLONG);
2503 + if (dentry->d_name.len > EXT4_NAME_LEN)
2504 + return ERR_PTR(-ENAMETOOLONG);
2506 bh = ext4_find_entry(dir, &dentry->d_name, &de, NULL);
2507 if (IS_ERR(bh))
2508 @@ -1604,11 +1610,9 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
2509 }
2510 if (!IS_ERR(inode) && ext4_encrypted_inode(dir) &&
2511 (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) &&
2512 - !ext4_is_child_context_consistent_with_parent(dir,
2513 - inode)) {
2514 + !fscrypt_has_permitted_context(dir, inode)) {
2515 int nokey = ext4_encrypted_inode(inode) &&
2516 - !ext4_encryption_info(inode);
2517 -
2518 + !fscrypt_has_encryption_key(inode);
2519 iput(inode);
2520 if (nokey)
2521 return ERR_PTR(-ENOKEY);
2522 @@ -2685,13 +2689,13 @@ out_stop:
2523 /*
2524 * routine to check that the specified directory is empty (for rmdir)
2525 */
2526 -int ext4_empty_dir(struct inode *inode)
2527 +bool ext4_empty_dir(struct inode *inode)
2528 {
2529 unsigned int offset;
2530 struct buffer_head *bh;
2531 struct ext4_dir_entry_2 *de, *de1;
2532 struct super_block *sb;
2533 - int err = 0;
2534 + bool err = false;
2536 if (ext4_has_inline_data(inode)) {
2537 int has_inline_data = 1;
2538 @@ -2704,11 +2708,11 @@ int ext4_empty_dir(struct inode *inode)
2539 sb = inode->i_sb;
2540 if (inode->i_size < EXT4_DIR_REC_LEN(1) + EXT4_DIR_REC_LEN(2)) {
2541 EXT4_ERROR_INODE(inode, "invalid size");
2542 - return 1;
2543 + return true;
2544 }
2545 bh = ext4_read_dirblock(inode, 0, EITHER);
2546 if (IS_ERR(bh))
2547 - return 1;
2548 + return true;
2550 de = (struct ext4_dir_entry_2 *) bh->b_data;
2551 de1 = ext4_next_entry(de, sb->s_blocksize);
2552 @@ -2717,7 +2721,7 @@ int ext4_empty_dir(struct inode *inode)
2553 strcmp(".", de->name) || strcmp("..", de1->name)) {
2554 ext4_warning_inode(inode, "directory missing '.' and/or '..'");
2555 brelse(bh);
2556 - return 1;
2557 + return true;
2558 }
2559 offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) +
2560 ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize);
2561 @@ -2730,7 +2734,7 @@ int ext4_empty_dir(struct inode *inode)
2562 lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb);
2563 bh = ext4_read_dirblock(inode, lblock, EITHER);
2564 if (IS_ERR(bh))
2565 - return 1;
2566 + return true;
2567 de = (struct ext4_dir_entry_2 *) bh->b_data;
2568 }
2569 if (ext4_check_dir_entry(inode, NULL, de, bh,
2570 @@ -2742,13 +2746,13 @@ int ext4_empty_dir(struct inode *inode)
2571 }
2572 if (le32_to_cpu(de->inode)) {
2573 brelse(bh);
2574 - return 0;
2575 + return false;
2576 }
2577 offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize);
2578 de = ext4_next_entry(de, sb->s_blocksize);
2579 }
2580 brelse(bh);
2581 - return 1;
2582 + return true;
2583 }
2585 /*
2586 @@ -3071,8 +3075,8 @@ static int ext4_symlink(struct inode *dir,
2587 int err, len = strlen(symname);
2588 int credits;
2589 bool encryption_required;
2590 - struct ext4_str disk_link;
2591 - struct ext4_encrypted_symlink_data *sd = NULL;
2592 + struct fscrypt_str disk_link;
2593 + struct fscrypt_symlink_data *sd = NULL;
2595 disk_link.len = len + 1;
2596 disk_link.name = (char *) symname;
2597 @@ -3080,13 +3084,13 @@ static int ext4_symlink(struct inode *dir,
2598 encryption_required = (ext4_encrypted_inode(dir) ||
2599 DUMMY_ENCRYPTION_ENABLED(EXT4_SB(dir->i_sb)));
2600 if (encryption_required) {
2601 - err = ext4_get_encryption_info(dir);
2602 + err = fscrypt_get_encryption_info(dir);
2603 if (err)
2604 return err;
2605 - if (ext4_encryption_info(dir) == NULL)
2606 + if (!fscrypt_has_encryption_key(dir))
2607 return -EPERM;
2608 - disk_link.len = (ext4_fname_encrypted_size(dir, len) +
2609 - sizeof(struct ext4_encrypted_symlink_data));
2610 + disk_link.len = (fscrypt_fname_encrypted_size(dir, len) +
2611 + sizeof(struct fscrypt_symlink_data));
2612 sd = kzalloc(disk_link.len, GFP_KERNEL);
2613 if (!sd)
2614 return -ENOMEM;
2615 @@ -3134,13 +3138,12 @@ static int ext4_symlink(struct inode *dir,
2617 if (encryption_required) {
2618 struct qstr istr;
2619 - struct ext4_str ostr;
2620 + struct fscrypt_str ostr =
2621 + FSTR_INIT(sd->encrypted_path, disk_link.len);
2623 istr.name = (const unsigned char *) symname;
2624 istr.len = len;
2625 - ostr.name = sd->encrypted_path;
2626 - ostr.len = disk_link.len;
2627 - err = ext4_fname_usr_to_disk(inode, &istr, &ostr);
2628 + err = fscrypt_fname_usr_to_disk(inode, &istr, &ostr);
2629 if (err < 0)
2630 goto err_drop_inode;
2631 sd->len = cpu_to_le16(ostr.len);
2632 @@ -3229,7 +3232,7 @@ static int ext4_link(struct dentry *old_dentry,
2633 if (inode->i_nlink >= EXT4_LINK_MAX)
2634 return -EMLINK;
2635 if (ext4_encrypted_inode(dir) &&
2636 - !ext4_is_child_context_consistent_with_parent(dir, inode))
2637 + !fscrypt_has_permitted_context(dir, inode))
2638 return -EPERM;
2640 if ((ext4_test_inode_flag(dir, EXT4_INODE_PROJINHERIT)) &&
2641 @@ -3552,8 +3555,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
2643 if ((old.dir != new.dir) &&
2644 ext4_encrypted_inode(new.dir) &&
2645 - !ext4_is_child_context_consistent_with_parent(new.dir,
2646 - old.inode)) {
2647 + !fscrypt_has_permitted_context(new.dir, old.inode)) {
2648 retval = -EPERM;
2649 goto end_rename;
2650 }
2651 @@ -3725,10 +3727,8 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
2652 if ((ext4_encrypted_inode(old_dir) ||
2653 ext4_encrypted_inode(new_dir)) &&
2654 (old_dir != new_dir) &&
2655 - (!ext4_is_child_context_consistent_with_parent(new_dir,
2656 - old.inode) ||
2657 - !ext4_is_child_context_consistent_with_parent(old_dir,
2658 - new.inode)))
2659 + (!fscrypt_has_permitted_context(new_dir, old.inode) ||
2660 + !fscrypt_has_permitted_context(old_dir, new.inode)))
2661 return -EPERM;
2663 if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT) &&
2664 diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
2665 index e4fc8ea..f124b24 100644
2666 --- a/fs/ext4/page-io.c
2667 +++ b/fs/ext4/page-io.c
2668 @@ -24,6 +24,7 @@
2669 #include <linux/slab.h>
2670 #include <linux/mm.h>
2671 #include <linux/backing-dev.h>
2672 +#include <linux/fscrypto.h>
2674 #include "ext4_jbd2.h"
2675 #include "xattr.h"
2676 @@ -67,7 +68,6 @@ static void ext4_finish_bio(struct bio *bio)
2677 struct page *page = bvec->bv_page;
2678 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2679 struct page *data_page = NULL;
2680 - struct ext4_crypto_ctx *ctx = NULL;
2681 #endif
2682 struct buffer_head *bh, *head;
2683 unsigned bio_start = bvec->bv_offset;
2684 @@ -82,8 +82,7 @@ static void ext4_finish_bio(struct bio *bio)
2685 if (!page->mapping) {
2686 /* The bounce data pages are unmapped. */
2687 data_page = page;
2688 - ctx = (struct ext4_crypto_ctx *)page_private(data_page);
2689 - page = ctx->w.control_page;
2690 + fscrypt_pullback_bio_page(&page, false);
2691 }
2692 #endif
2694 @@ -113,8 +112,8 @@ static void ext4_finish_bio(struct bio *bio)
2695 local_irq_restore(flags);
2696 if (!under_io) {
2697 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2698 - if (ctx)
2699 - ext4_restore_control_page(data_page);
2700 + if (data_page)
2701 + fscrypt_restore_control_page(data_page);
2702 #endif
2703 end_page_writeback(page);
2704 }
2705 @@ -474,7 +473,7 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
2706 gfp_t gfp_flags = GFP_NOFS;
2708 retry_encrypt:
2709 - data_page = ext4_encrypt(inode, page, gfp_flags);
2710 + data_page = fscrypt_encrypt_page(inode, page, gfp_flags);
2711 if (IS_ERR(data_page)) {
2712 ret = PTR_ERR(data_page);
2713 if (ret == -ENOMEM && wbc->sync_mode == WB_SYNC_ALL) {
2714 @@ -512,7 +511,7 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
2715 if (ret) {
2716 out:
2717 if (data_page)
2718 - ext4_restore_control_page(data_page);
2719 + fscrypt_restore_control_page(data_page);
2720 printk_ratelimited(KERN_ERR "%s: ret = %d\n", __func__, ret);
2721 redirty_page_for_writepage(wbc, page);
2722 do {
2723 diff --git a/fs/ext4/readpage.c b/fs/ext4/readpage.c
2724 index dc54a4b..13f3476 100644
2725 --- a/fs/ext4/readpage.c
2726 +++ b/fs/ext4/readpage.c
2727 @@ -46,37 +46,6 @@
2729 #include "ext4.h"
2731 -/*
2732 - * Call ext4_decrypt on every single page, reusing the encryption
2733 - * context.
2734 - */
2735 -static void completion_pages(struct work_struct *work)
2736 -{
2737 -#ifdef CONFIG_EXT4_FS_ENCRYPTION
2738 - struct ext4_crypto_ctx *ctx =
2739 - container_of(work, struct ext4_crypto_ctx, r.work);
2740 - struct bio *bio = ctx->r.bio;
2741 - struct bio_vec *bv;
2742 - int i;
2743 -
2744 - bio_for_each_segment_all(bv, bio, i) {
2745 - struct page *page = bv->bv_page;
2746 -
2747 - int ret = ext4_decrypt(page);
2748 - if (ret) {
2749 - WARN_ON_ONCE(1);
2750 - SetPageError(page);
2751 - } else
2752 - SetPageUptodate(page);
2753 - unlock_page(page);
2754 - }
2755 - ext4_release_crypto_ctx(ctx);
2756 - bio_put(bio);
2757 -#else
2758 - BUG();
2759 -#endif
2760 -}
2761 -
2762 static inline bool ext4_bio_encrypted(struct bio *bio)
2763 {
2764 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2765 @@ -104,14 +73,10 @@ static void mpage_end_io(struct bio *bio)
2766 int i;
2768 if (ext4_bio_encrypted(bio)) {
2769 - struct ext4_crypto_ctx *ctx = bio->bi_private;
2770 -
2771 if (bio->bi_error) {
2772 - ext4_release_crypto_ctx(ctx);
2773 + fscrypt_release_ctx(bio->bi_private);
2774 } else {
2775 - INIT_WORK(&ctx->r.work, completion_pages);
2776 - ctx->r.bio = bio;
2777 - queue_work(ext4_read_workqueue, &ctx->r.work);
2778 + fscrypt_decrypt_bio_pages(bio->bi_private, bio);
2779 return;
2780 }
2781 }
2782 @@ -275,11 +240,11 @@ int ext4_mpage_readpages(struct address_space *mapping,
2783 bio = NULL;
2784 }
2785 if (bio == NULL) {
2786 - struct ext4_crypto_ctx *ctx = NULL;
2787 + struct fscrypt_ctx *ctx = NULL;
2789 if (ext4_encrypted_inode(inode) &&
2790 S_ISREG(inode->i_mode)) {
2791 - ctx = ext4_get_crypto_ctx(inode, GFP_NOFS);
2792 + ctx = fscrypt_get_ctx(inode, GFP_NOFS);
2793 if (IS_ERR(ctx))
2794 goto set_error_page;
2795 }
2796 @@ -287,7 +252,7 @@ int ext4_mpage_readpages(struct address_space *mapping,
2797 min_t(int, nr_pages, BIO_MAX_PAGES));
2798 if (!bio) {
2799 if (ctx)
2800 - ext4_release_crypto_ctx(ctx);
2801 + fscrypt_release_ctx(ctx);
2802 goto set_error_page;
2803 }
2804 bio->bi_bdev = bdev;
2805 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
2806 index 304c712..80ee248 100644
2807 --- a/fs/ext4/super.c
2808 +++ b/fs/ext4/super.c
2809 @@ -944,9 +944,6 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
2810 ei->i_datasync_tid = 0;
2811 atomic_set(&ei->i_unwritten, 0);
2812 INIT_WORK(&ei->i_rsv_conversion_work, ext4_end_io_rsv_work);
2813 -#ifdef CONFIG_EXT4_FS_ENCRYPTION
2814 - ei->i_crypt_info = NULL;
2815 -#endif
2816 return &ei->vfs_inode;
2817 }
2819 @@ -1025,8 +1022,7 @@ void ext4_clear_inode(struct inode *inode)
2820 EXT4_I(inode)->jinode = NULL;
2821 }
2822 #ifdef CONFIG_EXT4_FS_ENCRYPTION
2823 - if (EXT4_I(inode)->i_crypt_info)
2824 - ext4_free_encryption_info(inode, EXT4_I(inode)->i_crypt_info);
2825 + fscrypt_put_encryption_info(inode, NULL);
2826 #endif
2827 }
2829 @@ -1093,6 +1089,83 @@ static int bdev_try_to_free_page(struct super_block *sb, struct page *page,
2830 return try_to_free_buffers(page);
2831 }
2833 +#ifdef CONFIG_EXT4_FS_ENCRYPTION
2834 +static int ext4_get_context(struct inode *inode, void *ctx, size_t len)
2835 +{
2836 + return ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION,
2837 + EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, ctx, len);
2838 +}
2839 +
2840 +static int ext4_prepare_context(struct inode *inode)
2841 +{
2842 + return ext4_convert_inline_data(inode);
2843 +}
2844 +
2845 +static int ext4_set_context(struct inode *inode, const void *ctx, size_t len,
2846 + void *fs_data)
2847 +{
2848 + handle_t *handle;
2849 + int res, res2;
2850 +
2851 + /* fs_data is null when internally used. */
2852 + if (fs_data) {
2853 + res = ext4_xattr_set(inode, EXT4_XATTR_INDEX_ENCRYPTION,
2854 + EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, ctx,
2855 + len, 0);
2856 + if (!res) {
2857 + ext4_set_inode_flag(inode, EXT4_INODE_ENCRYPT);
2858 + ext4_clear_inode_state(inode,
2859 + EXT4_STATE_MAY_INLINE_DATA);
2860 + }
2861 + return res;
2862 + }
2863 +
2864 + handle = ext4_journal_start(inode, EXT4_HT_MISC,
2865 + ext4_jbd2_credits_xattr(inode));
2866 + if (IS_ERR(handle))
2867 + return PTR_ERR(handle);
2868 +
2869 + res = ext4_xattr_set(inode, EXT4_XATTR_INDEX_ENCRYPTION,
2870 + EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, ctx,
2871 + len, 0);
2872 + if (!res) {
2873 + ext4_set_inode_flag(inode, EXT4_INODE_ENCRYPT);
2874 + res = ext4_mark_inode_dirty(handle, inode);
2875 + if (res)
2876 + EXT4_ERROR_INODE(inode, "Failed to mark inode dirty");
2877 + }
2878 + res2 = ext4_journal_stop(handle);
2879 + if (!res)
2880 + res = res2;
2881 + return res;
2882 +}
2883 +
2884 +static int ext4_dummy_context(struct inode *inode)
2885 +{
2886 + return DUMMY_ENCRYPTION_ENABLED(EXT4_SB(inode->i_sb));
2887 +}
2888 +
2889 +static unsigned ext4_max_namelen(struct inode *inode)
2890 +{
2891 + return S_ISLNK(inode->i_mode) ? inode->i_sb->s_blocksize :
2892 + EXT4_NAME_LEN;
2893 +}
2894 +
2895 +static struct fscrypt_operations ext4_cryptops = {
2896 + .get_context = ext4_get_context,
2897 + .prepare_context = ext4_prepare_context,
2898 + .set_context = ext4_set_context,
2899 + .dummy_context = ext4_dummy_context,
2900 + .is_encrypted = ext4_encrypted_inode,
2901 + .empty_dir = ext4_empty_dir,
2902 + .max_namelen = ext4_max_namelen,
2903 +};
2904 +#else
2905 +static struct fscrypt_operations ext4_cryptops = {
2906 + .is_encrypted = ext4_encrypted_inode,
2907 +};
2908 +#endif
2909 +
2910 #ifdef CONFIG_QUOTA
2911 static char *quotatypes[] = INITQFNAMES;
2912 #define QTYPE2NAME(t) (quotatypes[t])
2913 @@ -3692,6 +3765,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
2914 sb->s_op = &ext4_sops;
2915 sb->s_export_op = &ext4_export_ops;
2916 sb->s_xattr = ext4_xattr_handlers;
2917 + sb->s_cop = &ext4_cryptops;
2918 #ifdef CONFIG_QUOTA
2919 sb->dq_op = &ext4_quota_operations;
2920 if (ext4_has_feature_quota(sb))
2921 @@ -5425,7 +5499,6 @@ out5:
2923 static void __exit ext4_exit_fs(void)
2924 {
2925 - ext4_exit_crypto();
2926 ext4_destroy_lazyinit_thread();
2927 unregister_as_ext2();
2928 unregister_as_ext3();
2929 diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
2930 index 75ed5c2..1f4b19f 100644
2931 --- a/fs/ext4/symlink.c
2932 +++ b/fs/ext4/symlink.c
2933 @@ -22,23 +22,22 @@
2934 #include "ext4.h"
2935 #include "xattr.h"
2937 -#ifdef CONFIG_EXT4_FS_ENCRYPTION
2938 static const char *ext4_encrypted_get_link(struct dentry *dentry,
2939 struct inode *inode,
2940 struct delayed_call *done)
2941 {
2942 struct page *cpage = NULL;
2943 char *caddr, *paddr = NULL;
2944 - struct ext4_str cstr, pstr;
2945 - struct ext4_encrypted_symlink_data *sd;
2946 + struct fscrypt_str cstr, pstr;
2947 + struct fscrypt_symlink_data *sd;
2948 loff_t size = min_t(loff_t, i_size_read(inode), PAGE_SIZE - 1);
2949 int res;
2950 - u32 plen, max_size = inode->i_sb->s_blocksize;
2951 + u32 max_size = inode->i_sb->s_blocksize;
2953 if (!dentry)
2954 return ERR_PTR(-ECHILD);
2956 - res = ext4_get_encryption_info(inode);
2957 + res = fscrypt_get_encryption_info(inode);
2958 if (res)
2959 return ERR_PTR(res);
2961 @@ -54,30 +53,29 @@ static const char *ext4_encrypted_get_link(struct dentry *dentry,
2962 }
2964 /* Symlink is encrypted */
2965 - sd = (struct ext4_encrypted_symlink_data *)caddr;
2966 + sd = (struct fscrypt_symlink_data *)caddr;
2967 cstr.name = sd->encrypted_path;
2968 cstr.len = le16_to_cpu(sd->len);
2969 if ((cstr.len +
2970 - sizeof(struct ext4_encrypted_symlink_data) - 1) >
2971 + sizeof(struct fscrypt_symlink_data) - 1) >
2972 max_size) {
2973 /* Symlink data on the disk is corrupted */
2974 res = -EFSCORRUPTED;
2975 goto errout;
2976 }
2977 - plen = (cstr.len < EXT4_FNAME_CRYPTO_DIGEST_SIZE*2) ?
2978 - EXT4_FNAME_CRYPTO_DIGEST_SIZE*2 : cstr.len;
2979 - paddr = kmalloc(plen + 1, GFP_NOFS);
2980 - if (!paddr) {
2981 - res = -ENOMEM;
2982 +
2983 + res = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
2984 + if (res)
2985 goto errout;
2986 - }
2987 - pstr.name = paddr;
2988 - pstr.len = plen;
2989 - res = _ext4_fname_disk_to_usr(inode, NULL, &cstr, &pstr);
2990 +
2991 + res = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
2992 if (res < 0)
2993 goto errout;
2994 +
2995 + paddr = pstr.name;
2996 +
2997 /* Null-terminate the name */
2998 - if (res <= plen)
2999 + if (res <= pstr.len)
3000 paddr[res] = '\0';
3001 if (cpage)
3002 put_page(cpage);
3003 @@ -99,7 +97,6 @@ const struct inode_operations ext4_encrypted_symlink_inode_operations = {
3004 .listxattr = ext4_listxattr,
3005 .removexattr = generic_removexattr,
3006 };
3007 -#endif
3009 const struct inode_operations ext4_symlink_inode_operations = {
3010 .readlink = generic_readlink,
3011 --
3012 2.6.3