mirror of
https://github.com/torvalds/linux
synced 2024-09-06 09:51:23 +00:00
fsverity: simplify fsverity_get_digest()
Instead of looking up the algorithm by name in hash_algo_name[] to get its hash_algo ID, just store the hash_algo ID in the fsverity_hash_alg struct. Verify at boot time that every fsverity_hash_alg has a valid hash_algo ID with matching digest size. Remove an unnecessary memset() of the whole digest array to 0 before the digest is copied into it. Finally, remove the pr_debug statement. There is already a pr_debug for the fsverity digest when the file is opened. Signed-off-by: Eric Biggers <ebiggers@google.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Link: https://lore.kernel.org/r/20221129045139.69803-1-ebiggers@kernel.org
This commit is contained in:
parent
98dc08bae6
commit
a4bbf53d88
|
@ -32,6 +32,11 @@ struct fsverity_hash_alg {
|
|||
unsigned int digest_size; /* digest size in bytes, e.g. 32 for SHA-256 */
|
||||
unsigned int block_size; /* block size in bytes, e.g. 64 for SHA-256 */
|
||||
mempool_t req_pool; /* mempool with a preallocated hash request */
|
||||
/*
|
||||
* The HASH_ALGO_* constant for this algorithm. This is different from
|
||||
* FS_VERITY_HASH_ALG_*, which uses a different numbering scheme.
|
||||
*/
|
||||
enum hash_algo algo_id;
|
||||
};
|
||||
|
||||
/* Merkle tree parameters: hash algorithm, initial hash state, and topology */
|
||||
|
|
|
@ -16,11 +16,13 @@ struct fsverity_hash_alg fsverity_hash_algs[] = {
|
|||
.name = "sha256",
|
||||
.digest_size = SHA256_DIGEST_SIZE,
|
||||
.block_size = SHA256_BLOCK_SIZE,
|
||||
.algo_id = HASH_ALGO_SHA256,
|
||||
},
|
||||
[FS_VERITY_HASH_ALG_SHA512] = {
|
||||
.name = "sha512",
|
||||
.digest_size = SHA512_DIGEST_SIZE,
|
||||
.block_size = SHA512_BLOCK_SIZE,
|
||||
.algo_id = HASH_ALGO_SHA512,
|
||||
},
|
||||
};
|
||||
|
||||
|
@ -324,5 +326,9 @@ void __init fsverity_check_hash_algs(void)
|
|||
*/
|
||||
BUG_ON(!is_power_of_2(alg->digest_size));
|
||||
BUG_ON(!is_power_of_2(alg->block_size));
|
||||
|
||||
/* Verify that there is a valid mapping to HASH_ALGO_*. */
|
||||
BUG_ON(alg->algo_id == 0);
|
||||
BUG_ON(alg->digest_size != hash_digest_size[alg->algo_id]);
|
||||
}
|
||||
}
|
||||
|
|
|
@ -65,8 +65,7 @@ EXPORT_SYMBOL_GPL(fsverity_ioctl_measure);
|
|||
* @alg: (out) pointer to the hash algorithm enumeration
|
||||
*
|
||||
* Return the file hash algorithm and digest of an fsverity protected file.
|
||||
* Assumption: before calling fsverity_get_digest(), the file must have been
|
||||
* opened.
|
||||
* Assumption: before calling this, the file must have been opened.
|
||||
*
|
||||
* Return: 0 on success, -errno on failure
|
||||
*/
|
||||
|
@ -76,27 +75,13 @@ int fsverity_get_digest(struct inode *inode,
|
|||
{
|
||||
const struct fsverity_info *vi;
|
||||
const struct fsverity_hash_alg *hash_alg;
|
||||
int i;
|
||||
|
||||
vi = fsverity_get_info(inode);
|
||||
if (!vi)
|
||||
return -ENODATA; /* not a verity file */
|
||||
|
||||
hash_alg = vi->tree_params.hash_alg;
|
||||
memset(digest, 0, FS_VERITY_MAX_DIGEST_SIZE);
|
||||
|
||||
/* convert the verity hash algorithm name to a hash_algo_name enum */
|
||||
i = match_string(hash_algo_name, HASH_ALGO__LAST, hash_alg->name);
|
||||
if (i < 0)
|
||||
return -EINVAL;
|
||||
*alg = i;
|
||||
|
||||
if (WARN_ON_ONCE(hash_alg->digest_size != hash_digest_size[*alg]))
|
||||
return -EINVAL;
|
||||
memcpy(digest, vi->file_digest, hash_alg->digest_size);
|
||||
|
||||
pr_debug("file digest %s:%*phN\n", hash_algo_name[*alg],
|
||||
hash_digest_size[*alg], digest);
|
||||
|
||||
*alg = hash_alg->algo_id;
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue