summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2019-03-09 13:54:24 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2019-03-09 13:54:24 -0500
commitd1cae94871330cb9f5fdcea34529abf7917e682e (patch)
tree727bdda6b15bc1252c61eff0d77395e8c02d56c1
parent99b25a7fc6150d613be8eab71a47e6c0fcc8d7c5 (diff)
parent129ca2d2a83f44551e73a408fa5e75a7b5169abb (diff)
Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt
Pull fscrypt updates from Eric Biggers: "First: Ted, Jaegeuk, and I have decided to add me as a co-maintainer for fscrypt, and we're now using a shared git tree. So we've updated MAINTAINERS accordingly, and I'm doing the pull request this time. The actual changes for v5.1 are: - Remove the fs-specific kconfig options like CONFIG_EXT4_ENCRYPTION and make fscrypt support for all fscrypt-capable filesystems be controlled by CONFIG_FS_ENCRYPTION, similar to how CONFIG_QUOTA works. - Improve error code for rename() and link() into encrypted directories. - Various cleanups" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt: MAINTAINERS: add Eric Biggers as an fscrypt maintainer fscrypt: return -EXDEV for incompatible rename or link into encrypted dir fscrypt: remove filesystem specific build config option f2fs: use IS_ENCRYPTED() to check encryption status ext4: use IS_ENCRYPTED() to check encryption status fscrypt: remove CRYPTO_CTR dependency
Diffstat
-rw-r--r--Documentation/filesystems/fscrypt.rst16
-rw-r--r--MAINTAINERS3
-rw-r--r--arch/mips/configs/generic_defconfig2
-rw-r--r--arch/nds32/configs/defconfig2
-rw-r--r--arch/s390/configs/debug_defconfig2
-rw-r--r--arch/s390/configs/performance_defconfig2
-rw-r--r--fs/crypto/Kconfig6
-rw-r--r--fs/crypto/fscrypt_private.h1
-rw-r--r--fs/crypto/hooks.c6
-rw-r--r--fs/crypto/policy.c3
-rw-r--r--fs/ext4/Kconfig15
-rw-r--r--fs/ext4/dir.c10
-rw-r--r--fs/ext4/ext4.h12
-rw-r--r--fs/ext4/ext4_jbd2.h2
-rw-r--r--fs/ext4/extents.c4
-rw-r--r--fs/ext4/ialloc.c2
-rw-r--r--fs/ext4/inode.c24
-rw-r--r--fs/ext4/ioctl.c4
-rw-r--r--fs/ext4/move_extent.c3
-rw-r--r--fs/ext4/namei.c18
-rw-r--r--fs/ext4/page-io.c9
-rw-r--r--fs/ext4/readpage.c5
-rw-r--r--fs/ext4/super.c6
-rw-r--r--fs/ext4/sysfs.c4
-rw-r--r--fs/f2fs/Kconfig12
-rw-r--r--fs/f2fs/data.c4
-rw-r--r--fs/f2fs/dir.c10
-rw-r--r--fs/f2fs/f2fs.h14
-rw-r--r--fs/f2fs/file.c10
-rw-r--r--fs/f2fs/inode.c4
-rw-r--r--fs/f2fs/namei.c6
-rw-r--r--fs/f2fs/super.c8
-rw-r--r--fs/f2fs/sysfs.c4
-rw-r--r--fs/ubifs/Kconfig12
-rw-r--r--fs/ubifs/Makefile2
-rw-r--r--fs/ubifs/ioctl.c4
-rw-r--r--fs/ubifs/sb.c2
-rw-r--r--fs/ubifs/super.c2
-rw-r--r--fs/ubifs/ubifs.h5
-rw-r--r--include/linux/fs.h4
-rw-r--r--include/linux/fscrypt.h420
-rw-r--r--include/linux/fscrypt_notsupp.h231
-rw-r--r--include/linux/fscrypt_supp.h204
43 files changed, 518 insertions, 601 deletions
diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst
index 3a7b60521b94..08c23b60e016 100644
--- a/Documentation/filesystems/fscrypt.rst
+++ b/Documentation/filesystems/fscrypt.rst
@@ -343,9 +343,9 @@ FS_IOC_SET_ENCRYPTION_POLICY can fail with the following errors:
343- ``ENOTEMPTY``: the file is unencrypted and is a nonempty directory 343- ``ENOTEMPTY``: the file is unencrypted and is a nonempty directory
344- ``ENOTTY``: this type of filesystem does not implement encryption 344- ``ENOTTY``: this type of filesystem does not implement encryption
345- ``EOPNOTSUPP``: the kernel was not configured with encryption 345- ``EOPNOTSUPP``: the kernel was not configured with encryption
346 support for this filesystem, or the filesystem superblock has not 346 support for filesystems, or the filesystem superblock has not
347 had encryption enabled on it. (For example, to use encryption on an 347 had encryption enabled on it. (For example, to use encryption on an
348 ext4 filesystem, CONFIG_EXT4_ENCRYPTION must be enabled in the 348 ext4 filesystem, CONFIG_FS_ENCRYPTION must be enabled in the
349 kernel config, and the superblock must have had the "encrypt" 349 kernel config, and the superblock must have had the "encrypt"
350 feature flag enabled using ``tune2fs -O encrypt`` or ``mkfs.ext4 -O 350 feature flag enabled using ``tune2fs -O encrypt`` or ``mkfs.ext4 -O
351 encrypt``.) 351 encrypt``.)
@@ -451,10 +451,18 @@ astute users may notice some differences in behavior:
451- Unencrypted files, or files encrypted with a different encryption 451- Unencrypted files, or files encrypted with a different encryption
452 policy (i.e. different key, modes, or flags), cannot be renamed or 452 policy (i.e. different key, modes, or flags), cannot be renamed or
453 linked into an encrypted directory; see `Encryption policy 453 linked into an encrypted directory; see `Encryption policy
454 enforcement`_. Attempts to do so will fail with EPERM. However, 454 enforcement`_. Attempts to do so will fail with EXDEV. However,
455 encrypted files can be renamed within an encrypted directory, or 455 encrypted files can be renamed within an encrypted directory, or
456 into an unencrypted directory. 456 into an unencrypted directory.
457 457
458 Note: "moving" an unencrypted file into an encrypted directory, e.g.
459 with the `mv` program, is implemented in userspace by a copy
460 followed by a delete. Be aware that the original unencrypted data
461 may remain recoverable from free space on the disk; prefer to keep
462 all files encrypted from the very beginning. The `shred` program
463 may be used to overwrite the source files but isn't guaranteed to be
464 effective on all filesystems and storage devices.
465
458- Direct I/O is not supported on encrypted files. Attempts to use 466- Direct I/O is not supported on encrypted files. Attempts to use
459 direct I/O on such files will fall back to buffered I/O. 467 direct I/O on such files will fall back to buffered I/O.
460 468
@@ -541,7 +549,7 @@ not be encrypted.
541Except for those special files, it is forbidden to have unencrypted 549Except for those special files, it is forbidden to have unencrypted
542files, or files encrypted with a different encryption policy, in an 550files, or files encrypted with a different encryption policy, in an
543encrypted directory tree. Attempts to link or rename such a file into 551encrypted directory tree. Attempts to link or rename such a file into
544an encrypted directory will fail with EPERM. This is also enforced 552an encrypted directory will fail with EXDEV. This is also enforced
545during ->lookup() to provide limited protection against offline 553during ->lookup() to provide limited protection against offline
546attacks that try to disable or downgrade encryption in known locations 554attacks that try to disable or downgrade encryption in known locations
547where applications may later write sensitive data. It is recommended 555where applications may later write sensitive data. It is recommended
diff --git a/MAINTAINERS b/MAINTAINERS
index c4fc97a9797a..a62416c51418 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6337,9 +6337,10 @@ F: include/linux/fscache*.h
6337FSCRYPT: FILE SYSTEM LEVEL ENCRYPTION SUPPORT 6337FSCRYPT: FILE SYSTEM LEVEL ENCRYPTION SUPPORT
6338M: Theodore Y. Ts'o <tytso@mit.edu> 6338M: Theodore Y. Ts'o <tytso@mit.edu>
6339M: Jaegeuk Kim <jaegeuk@kernel.org> 6339M: Jaegeuk Kim <jaegeuk@kernel.org>
6340M: Eric Biggers <ebiggers@kernel.org>
6340L: linux-fscrypt@vger.kernel.org 6341L: linux-fscrypt@vger.kernel.org
6341Q: https://patchwork.kernel.org/project/linux-fscrypt/list/ 6342Q: https://patchwork.kernel.org/project/linux-fscrypt/list/
6342T: git git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt.git 6343T: git git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt.git
6343S: Supported 6344S: Supported
6344F: fs/crypto/ 6345F: fs/crypto/
6345F: include/linux/fscrypt*.h 6346F: include/linux/fscrypt*.h
diff --git a/arch/mips/configs/generic_defconfig b/arch/mips/configs/generic_defconfig
index 7c138dab87df..5d80521e5d5a 100644
--- a/arch/mips/configs/generic_defconfig
+++ b/arch/mips/configs/generic_defconfig
@@ -59,7 +59,7 @@ CONFIG_HID_MONTEREY=y
59CONFIG_EXT4_FS=y 59CONFIG_EXT4_FS=y
60CONFIG_EXT4_FS_POSIX_ACL=y 60CONFIG_EXT4_FS_POSIX_ACL=y
61CONFIG_EXT4_FS_SECURITY=y 61CONFIG_EXT4_FS_SECURITY=y
62CONFIG_EXT4_ENCRYPTION=y 62CONFIG_FS_ENCRYPTION=y
63CONFIG_FANOTIFY=y 63CONFIG_FANOTIFY=y
64CONFIG_FUSE_FS=y 64CONFIG_FUSE_FS=y
65CONFIG_CUSE=y 65CONFIG_CUSE=y
diff --git a/arch/nds32/configs/defconfig b/arch/nds32/configs/defconfig
index 2546d8770785..65ce9259081b 100644
--- a/arch/nds32/configs/defconfig
+++ b/arch/nds32/configs/defconfig
@@ -74,7 +74,7 @@ CONFIG_GENERIC_PHY=y
74CONFIG_EXT4_FS=y 74CONFIG_EXT4_FS=y
75CONFIG_EXT4_FS_POSIX_ACL=y 75CONFIG_EXT4_FS_POSIX_ACL=y
76CONFIG_EXT4_FS_SECURITY=y 76CONFIG_EXT4_FS_SECURITY=y
77CONFIG_EXT4_ENCRYPTION=y 77CONFIG_FS_ENCRYPTION=y
78CONFIG_FUSE_FS=y 78CONFIG_FUSE_FS=y
79CONFIG_MSDOS_FS=y 79CONFIG_MSDOS_FS=y
80CONFIG_VFAT_FS=y 80CONFIG_VFAT_FS=y
diff --git a/arch/s390/configs/debug_defconfig b/arch/s390/configs/debug_defconfig
index c69cb04b7a59..9824c7bad9d4 100644
--- a/arch/s390/configs/debug_defconfig
+++ b/arch/s390/configs/debug_defconfig
@@ -500,7 +500,6 @@ CONFIG_S390_AP_IOMMU=y
500CONFIG_EXT4_FS=y 500CONFIG_EXT4_FS=y
501CONFIG_EXT4_FS_POSIX_ACL=y 501CONFIG_EXT4_FS_POSIX_ACL=y
502CONFIG_EXT4_FS_SECURITY=y 502CONFIG_EXT4_FS_SECURITY=y
503CONFIG_EXT4_ENCRYPTION=y
504CONFIG_JBD2_DEBUG=y 503CONFIG_JBD2_DEBUG=y
505CONFIG_JFS_FS=m 504CONFIG_JFS_FS=m
506CONFIG_JFS_POSIX_ACL=y 505CONFIG_JFS_POSIX_ACL=y
@@ -520,6 +519,7 @@ CONFIG_BTRFS_DEBUG=y
520CONFIG_NILFS2_FS=m 519CONFIG_NILFS2_FS=m
521CONFIG_FS_DAX=y 520CONFIG_FS_DAX=y
522CONFIG_EXPORTFS_BLOCK_OPS=y 521CONFIG_EXPORTFS_BLOCK_OPS=y
522CONFIG_FS_ENCRYPTION=y
523CONFIG_FANOTIFY=y 523CONFIG_FANOTIFY=y
524CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y 524CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
525CONFIG_QUOTA_NETLINK_INTERFACE=y 525CONFIG_QUOTA_NETLINK_INTERFACE=y
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 32f539dc9c19..4fcbe5792744 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -497,7 +497,6 @@ CONFIG_S390_AP_IOMMU=y
497CONFIG_EXT4_FS=y 497CONFIG_EXT4_FS=y
498CONFIG_EXT4_FS_POSIX_ACL=y 498CONFIG_EXT4_FS_POSIX_ACL=y
499CONFIG_EXT4_FS_SECURITY=y 499CONFIG_EXT4_FS_SECURITY=y
500CONFIG_EXT4_ENCRYPTION=y
501CONFIG_JBD2_DEBUG=y 500CONFIG_JBD2_DEBUG=y
502CONFIG_JFS_FS=m 501CONFIG_JFS_FS=m
503CONFIG_JFS_POSIX_ACL=y 502CONFIG_JFS_POSIX_ACL=y
@@ -515,6 +514,7 @@ CONFIG_BTRFS_FS_POSIX_ACL=y
515CONFIG_NILFS2_FS=m 514CONFIG_NILFS2_FS=m
516CONFIG_FS_DAX=y 515CONFIG_FS_DAX=y
517CONFIG_EXPORTFS_BLOCK_OPS=y 516CONFIG_EXPORTFS_BLOCK_OPS=y
517CONFIG_FS_ENCRYPTION=y
518CONFIG_FANOTIFY=y 518CONFIG_FANOTIFY=y
519CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y 519CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
520CONFIG_QUOTA_NETLINK_INTERFACE=y 520CONFIG_QUOTA_NETLINK_INTERFACE=y
diff --git a/fs/crypto/Kconfig b/fs/crypto/Kconfig
index 02b7d91c9231..f0de238000c0 100644
--- a/fs/crypto/Kconfig
+++ b/fs/crypto/Kconfig
@@ -1,16 +1,16 @@
1config FS_ENCRYPTION 1config FS_ENCRYPTION
2 tristate "FS Encryption (Per-file encryption)" 2 bool "FS Encryption (Per-file encryption)"
3 select CRYPTO 3 select CRYPTO
4 select CRYPTO_AES 4 select CRYPTO_AES
5 select CRYPTO_CBC 5 select CRYPTO_CBC
6 select CRYPTO_ECB 6 select CRYPTO_ECB
7 select CRYPTO_XTS 7 select CRYPTO_XTS
8 select CRYPTO_CTS 8 select CRYPTO_CTS
9 select CRYPTO_CTR
10 select CRYPTO_SHA256 9 select CRYPTO_SHA256
11 select KEYS 10 select KEYS
12 help 11 help
13 Enable encryption of files and directories. This 12 Enable encryption of files and directories. This
14 feature is similar to ecryptfs, but it is more memory 13 feature is similar to ecryptfs, but it is more memory
15 efficient since it avoids caching the encrypted and 14 efficient since it avoids caching the encrypted and
16 decrypted pages in the page cache. 15 decrypted pages in the page cache. Currently Ext4,
16 F2FS and UBIFS make use of this feature.
diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
index 7424f851eb5c..7da276159593 100644
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -12,7 +12,6 @@
12#ifndef _FSCRYPT_PRIVATE_H 12#ifndef _FSCRYPT_PRIVATE_H
13#define _FSCRYPT_PRIVATE_H 13#define _FSCRYPT_PRIVATE_H
14 14
15#define __FS_HAS_ENCRYPTION 1
16#include <linux/fscrypt.h> 15#include <linux/fscrypt.h>
17#include <crypto/hash.h> 16#include <crypto/hash.h>
18 17
diff --git a/fs/crypto/hooks.c b/fs/crypto/hooks.c
index 926e5df20ec3..56debb1fcf5e 100644
--- a/fs/crypto/hooks.c
+++ b/fs/crypto/hooks.c
@@ -58,7 +58,7 @@ int __fscrypt_prepare_link(struct inode *inode, struct inode *dir)
58 return err; 58 return err;
59 59
60 if (!fscrypt_has_permitted_context(dir, inode)) 60 if (!fscrypt_has_permitted_context(dir, inode))
61 return -EPERM; 61 return -EXDEV;
62 62
63 return 0; 63 return 0;
64} 64}
@@ -82,13 +82,13 @@ int __fscrypt_prepare_rename(struct inode *old_dir, struct dentry *old_dentry,
82 if (IS_ENCRYPTED(new_dir) && 82 if (IS_ENCRYPTED(new_dir) &&
83 !fscrypt_has_permitted_context(new_dir, 83 !fscrypt_has_permitted_context(new_dir,
84 d_inode(old_dentry))) 84 d_inode(old_dentry)))
85 return -EPERM; 85 return -EXDEV;
86 86
87 if ((flags & RENAME_EXCHANGE) && 87 if ((flags & RENAME_EXCHANGE) &&
88 IS_ENCRYPTED(old_dir) && 88 IS_ENCRYPTED(old_dir) &&
89 !fscrypt_has_permitted_context(old_dir, 89 !fscrypt_has_permitted_context(old_dir,
90 d_inode(new_dentry))) 90 d_inode(new_dentry)))
91 return -EPERM; 91 return -EXDEV;
92 } 92 }
93 return 0; 93 return 0;
94} 94}
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index f490de921ce8..bd7eaf9b3f00 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -151,8 +151,7 @@ EXPORT_SYMBOL(fscrypt_ioctl_get_policy);
151 * malicious offline violations of this constraint, while the link and rename 151 * malicious offline violations of this constraint, while the link and rename
152 * checks are needed to prevent online violations of this constraint. 152 * checks are needed to prevent online violations of this constraint.
153 * 153 *
154 * Return: 1 if permitted, 0 if forbidden. If forbidden, the caller must fail 154 * Return: 1 if permitted, 0 if forbidden.
155 * the filesystem operation with EPERM.
156 */ 155 */
157int fscrypt_has_permitted_context(struct inode *parent, struct inode *child) 156int fscrypt_has_permitted_context(struct inode *parent, struct inode *child)
158{ 157{
diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
index a453cc87082b..031e5a82d556 100644
--- a/fs/ext4/Kconfig
+++ b/fs/ext4/Kconfig
@@ -96,21 +96,6 @@ config EXT4_FS_SECURITY
96 If you are not using a security module that requires using 96 If you are not using a security module that requires using
97 extended attributes for file security labels, say N. 97 extended attributes for file security labels, say N.
98 98
99config EXT4_ENCRYPTION
100 bool "Ext4 Encryption"
101 depends on EXT4_FS
102 select FS_ENCRYPTION
103 help
104 Enable encryption of ext4 files and directories. This
105 feature is similar to ecryptfs, but it is more memory
106 efficient since it avoids caching the encrypted and
107 decrypted pages in the page cache.
108
109config EXT4_FS_ENCRYPTION
110 bool
111 default y
112 depends on EXT4_ENCRYPTION
113
114config EXT4_DEBUG 99config EXT4_DEBUG
115 bool "EXT4 debugging support" 100 bool "EXT4 debugging support"
116 depends on EXT4_FS 101 depends on EXT4_FS
diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
index f93f9881ec18..0ccd51f72048 100644
--- a/fs/ext4/dir.c
+++ b/fs/ext4/dir.c
@@ -111,7 +111,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
111 int dir_has_error = 0; 111 int dir_has_error = 0;
112 struct fscrypt_str fstr = FSTR_INIT(NULL, 0); 112 struct fscrypt_str fstr = FSTR_INIT(NULL, 0);
113 113
114 if (ext4_encrypted_inode(inode)) { 114 if (IS_ENCRYPTED(inode)) {
115 err = fscrypt_get_encryption_info(inode); 115 err = fscrypt_get_encryption_info(inode);
116 if (err && err != -ENOKEY) 116 if (err && err != -ENOKEY)
117 return err; 117 return err;
@@ -138,7 +138,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
138 return err; 138 return err;
139 } 139 }
140 140
141 if (ext4_encrypted_inode(inode)) { 141 if (IS_ENCRYPTED(inode)) {
142 err = fscrypt_fname_alloc_buffer(inode, EXT4_NAME_LEN, &fstr); 142 err = fscrypt_fname_alloc_buffer(inode, EXT4_NAME_LEN, &fstr);
143 if (err < 0) 143 if (err < 0)
144 return err; 144 return err;
@@ -245,7 +245,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
245 offset += ext4_rec_len_from_disk(de->rec_len, 245 offset += ext4_rec_len_from_disk(de->rec_len,
246 sb->s_blocksize); 246 sb->s_blocksize);
247 if (le32_to_cpu(de->inode)) { 247 if (le32_to_cpu(de->inode)) {
248 if (!ext4_encrypted_inode(inode)) { 248 if (!IS_ENCRYPTED(inode)) {
249 if (!dir_emit(ctx, de->name, 249 if (!dir_emit(ctx, de->name,
250 de->name_len, 250 de->name_len,
251 le32_to_cpu(de->inode), 251 le32_to_cpu(de->inode),
@@ -283,9 +283,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
283done: 283done:
284 err = 0; 284 err = 0;
285errout: 285errout:
286#ifdef CONFIG_EXT4_FS_ENCRYPTION
287 fscrypt_fname_free_buffer(&fstr); 286 fscrypt_fname_free_buffer(&fstr);
288#endif
289 brelse(bh); 287 brelse(bh);
290 return err; 288 return err;
291} 289}
@@ -613,7 +611,7 @@ finished:
613 611
614static int ext4_dir_open(struct inode * inode, struct file * filp) 612static int ext4_dir_open(struct inode * inode, struct file * filp)
615{ 613{
616 if (ext4_encrypted_inode(inode)) 614 if (IS_ENCRYPTED(inode))
617 return fscrypt_get_encryption_info(inode) ? -EACCES : 0; 615 return fscrypt_get_encryption_info(inode) ? -EACCES : 0;
618 return 0; 616 return 0;
619} 617}
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 185a05d3257e..5012ddb6daf9 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -40,7 +40,6 @@
40#include <linux/compat.h> 40#include <linux/compat.h>
41#endif 41#endif
42 42
43#define __FS_HAS_ENCRYPTION IS_ENABLED(CONFIG_EXT4_FS_ENCRYPTION)
44#include <linux/fscrypt.h> 43#include <linux/fscrypt.h>
45 44
46#include <linux/compiler.h> 45#include <linux/compiler.h>
@@ -1326,7 +1325,7 @@ struct ext4_super_block {
1326#define EXT4_MF_FS_ABORTED 0x0002 /* Fatal error detected */ 1325#define EXT4_MF_FS_ABORTED 0x0002 /* Fatal error detected */
1327#define EXT4_MF_TEST_DUMMY_ENCRYPTION 0x0004 1326#define EXT4_MF_TEST_DUMMY_ENCRYPTION 0x0004
1328 1327
1329#ifdef CONFIG_EXT4_FS_ENCRYPTION 1328#ifdef CONFIG_FS_ENCRYPTION
1330#define DUMMY_ENCRYPTION_ENABLED(sbi) (unlikely((sbi)->s_mount_flags & \ 1329#define DUMMY_ENCRYPTION_ENABLED(sbi) (unlikely((sbi)->s_mount_flags & \
1331 EXT4_MF_TEST_DUMMY_ENCRYPTION)) 1330 EXT4_MF_TEST_DUMMY_ENCRYPTION))
1332#else 1331#else
@@ -2051,7 +2050,7 @@ struct ext4_filename {
2051 const struct qstr *usr_fname; 2050 const struct qstr *usr_fname;
2052 struct fscrypt_str disk_name; 2051 struct fscrypt_str disk_name;
2053 struct dx_hash_info hinfo; 2052 struct dx_hash_info hinfo;
2054#ifdef CONFIG_EXT4_FS_ENCRYPTION 2053#ifdef CONFIG_FS_ENCRYPTION
2055 struct fscrypt_str crypto_buf; 2054 struct fscrypt_str crypto_buf;
2056#endif 2055#endif
2057}; 2056};
@@ -2279,12 +2278,7 @@ extern unsigned ext4_free_clusters_after_init(struct super_block *sb,
2279 struct ext4_group_desc *gdp); 2278 struct ext4_group_desc *gdp);
2280ext4_fsblk_t ext4_inode_to_goal_block(struct inode *); 2279ext4_fsblk_t ext4_inode_to_goal_block(struct inode *);
2281 2280
2282static inline bool ext4_encrypted_inode(struct inode *inode) 2281#ifdef CONFIG_FS_ENCRYPTION
2283{
2284 return ext4_test_inode_flag(inode, EXT4_INODE_ENCRYPT);
2285}
2286
2287#ifdef CONFIG_EXT4_FS_ENCRYPTION
2288static inline int ext4_fname_setup_filename(struct inode *dir, 2282static inline int ext4_fname_setup_filename(struct inode *dir,
2289 const struct qstr *iname, 2283 const struct qstr *iname,
2290 int lookup, struct ext4_filename *fname) 2284 int lookup, struct ext4_filename *fname)
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index 15b6dd733780..a1ac7e9245ec 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -411,7 +411,7 @@ static inline int ext4_inode_journal_mode(struct inode *inode)
411 (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA) && 411 (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA) &&
412 !test_opt(inode->i_sb, DELALLOC))) { 412 !test_opt(inode->i_sb, DELALLOC))) {
413 /* We do not support data journalling for encrypted data */ 413 /* We do not support data journalling for encrypted data */
414 if (S_ISREG(inode->i_mode) && ext4_encrypted_inode(inode)) 414 if (S_ISREG(inode->i_mode) && IS_ENCRYPTED(inode))
415 return EXT4_INODE_ORDERED_DATA_MODE; /* ordered */ 415 return EXT4_INODE_ORDERED_DATA_MODE; /* ordered */
416 return EXT4_INODE_JOURNAL_DATA_MODE; /* journal data */ 416 return EXT4_INODE_JOURNAL_DATA_MODE; /* journal data */
417 } 417 }
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 240b6dea5441..79d986dbf5af 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3631,7 +3631,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
3631 max_zeroout = sbi->s_extent_max_zeroout_kb >> 3631 max_zeroout = sbi->s_extent_max_zeroout_kb >>
3632 (inode->i_sb->s_blocksize_bits - 10); 3632 (inode->i_sb->s_blocksize_bits - 10);
3633 3633
3634 if (ext4_encrypted_inode(inode)) 3634 if (IS_ENCRYPTED(inode))
3635 max_zeroout = 0; 3635 max_zeroout = 0;
3636 3636
3637 /* 3637 /*
@@ -4818,7 +4818,7 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
4818 * leave it disabled for encrypted inodes for now. This is a 4818 * leave it disabled for encrypted inodes for now. This is a
4819 * bug we should fix.... 4819 * bug we should fix....
4820 */ 4820 */
4821 if (ext4_encrypted_inode(inode) && 4821 if (IS_ENCRYPTED(inode) &&
4822 (mode & (FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_INSERT_RANGE | 4822 (mode & (FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_INSERT_RANGE |
4823 FALLOC_FL_ZERO_RANGE))) 4823 FALLOC_FL_ZERO_RANGE)))
4824 return -EOPNOTSUPP; 4824 return -EOPNOTSUPP;
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 7ff14a1adba3..f3e17a8c84b4 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -771,7 +771,7 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir,
771 if (unlikely(ext4_forced_shutdown(sbi))) 771 if (unlikely(ext4_forced_shutdown(sbi)))
772 return ERR_PTR(-EIO); 772 return ERR_PTR(-EIO);
773 773
774 if ((ext4_encrypted_inode(dir) || DUMMY_ENCRYPTION_ENABLED(sbi)) && 774 if ((IS_ENCRYPTED(dir) || DUMMY_ENCRYPTION_ENABLED(sbi)) &&
775 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) && 775 (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) &&
776 !(i_flags & EXT4_EA_INODE_FL)) { 776 !(i_flags & EXT4_EA_INODE_FL)) {
777 err = fscrypt_get_encryption_info(dir); 777 err = fscrypt_get_encryption_info(dir);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 34d7e0703cc6..4356ef6d728e 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -415,7 +415,7 @@ int ext4_issue_zeroout(struct inode *inode, ext4_lblk_t lblk, ext4_fsblk_t pblk,
415{ 415{
416 int ret; 416 int ret;
417 417
418 if (ext4_encrypted_inode(inode)) 418 if (IS_ENCRYPTED(inode))
419 return fscrypt_zeroout_range(inode, lblk, pblk, len); 419 return fscrypt_zeroout_range(inode, lblk, pblk, len);
420 420
421 ret = sb_issue_zeroout(inode->i_sb, pblk, len, GFP_NOFS); 421 ret = sb_issue_zeroout(inode->i_sb, pblk, len, GFP_NOFS);
@@ -1150,7 +1150,7 @@ int do_journal_get_write_access(handle_t *handle,
1150 return ret; 1150 return ret;
1151} 1151}
1152 1152
1153#ifdef CONFIG_EXT4_FS_ENCRYPTION 1153#ifdef CONFIG_FS_ENCRYPTION
1154static int ext4_block_write_begin(struct page *page, loff_t pos, unsigned len, 1154static int ext4_block_write_begin(struct page *page, loff_t pos, unsigned len,
1155 get_block_t *get_block) 1155 get_block_t *get_block)
1156{ 1156{
@@ -1217,8 +1217,7 @@ static int ext4_block_write_begin(struct page *page, loff_t pos, unsigned len,
1217 (block_start < from || block_end > to)) { 1217 (block_start < from || block_end > to)) {
1218 ll_rw_block(REQ_OP_READ, 0, 1, &bh); 1218 ll_rw_block(REQ_OP_READ, 0, 1, &bh);
1219 *wait_bh++ = bh; 1219 *wait_bh++ = bh;
1220 decrypt = ext4_encrypted_inode(inode) && 1220 decrypt = IS_ENCRYPTED(inode) && S_ISREG(inode->i_mode);
1221 S_ISREG(inode->i_mode);
1222 } 1221 }
1223 } 1222 }
1224 /* 1223 /*
@@ -1303,7 +1302,7 @@ retry_journal:
1303 /* In case writeback began while the page was unlocked */ 1302 /* In case writeback began while the page was unlocked */
1304 wait_for_stable_page(page); 1303 wait_for_stable_page(page);
1305 1304
1306#ifdef CONFIG_EXT4_FS_ENCRYPTION 1305#ifdef CONFIG_FS_ENCRYPTION
1307 if (ext4_should_dioread_nolock(inode)) 1306 if (ext4_should_dioread_nolock(inode))
1308 ret = ext4_block_write_begin(page, pos, len, 1307 ret = ext4_block_write_begin(page, pos, len,
1309 ext4_get_block_unwritten); 1308 ext4_get_block_unwritten);
@@ -3105,7 +3104,7 @@ retry_journal:
3105 /* In case writeback began while the page was unlocked */ 3104 /* In case writeback began while the page was unlocked */
3106 wait_for_stable_page(page); 3105 wait_for_stable_page(page);
3107 3106
3108#ifdef CONFIG_EXT4_FS_ENCRYPTION 3107#ifdef CONFIG_FS_ENCRYPTION
3109 ret = ext4_block_write_begin(page, pos, len, 3108 ret = ext4_block_write_begin(page, pos, len,
3110 ext4_da_get_block_prep); 3109 ext4_da_get_block_prep);
3111#else 3110#else
@@ -3880,8 +3879,8 @@ static ssize_t ext4_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
3880 loff_t offset = iocb->ki_pos; 3879 loff_t offset = iocb->ki_pos;
3881 ssize_t ret; 3880 ssize_t ret;
3882 3881
3883#ifdef CONFIG_EXT4_FS_ENCRYPTION 3882#ifdef CONFIG_FS_ENCRYPTION
3884 if (ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode)) 3883 if (IS_ENCRYPTED(inode) && S_ISREG(inode->i_mode))
3885 return 0; 3884 return 0;
3886#endif 3885#endif
3887 3886
@@ -4065,8 +4064,7 @@ static int __ext4_block_zero_page_range(handle_t *handle,
4065 /* Uhhuh. Read error. Complain and punt. */ 4064 /* Uhhuh. Read error. Complain and punt. */
4066 if (!buffer_uptodate(bh)) 4065 if (!buffer_uptodate(bh))
4067 goto unlock; 4066 goto unlock;
4068 if (S_ISREG(inode->i_mode) && 4067 if (S_ISREG(inode->i_mode) && IS_ENCRYPTED(inode)) {
4069 ext4_encrypted_inode(inode)) {
4070 /* We expect the key to be set. */ 4068 /* We expect the key to be set. */
4071 BUG_ON(!fscrypt_has_encryption_key(inode)); 4069 BUG_ON(!fscrypt_has_encryption_key(inode));
4072 BUG_ON(blocksize != PAGE_SIZE); 4070 BUG_ON(blocksize != PAGE_SIZE);
@@ -4142,7 +4140,7 @@ static int ext4_block_truncate_page(handle_t *handle,
4142 struct inode *inode = mapping->host; 4140 struct inode *inode = mapping->host;
4143 4141
4144 /* If we are processing an encrypted inode during orphan list handling */ 4142 /* If we are processing an encrypted inode during orphan list handling */
4145 if (ext4_encrypted_inode(inode) && !fscrypt_has_encryption_key(inode)) 4143 if (IS_ENCRYPTED(inode) && !fscrypt_has_encryption_key(inode))
4146 return 0; 4144 return 0;
4147 4145
4148 blocksize = inode->i_sb->s_blocksize; 4146 blocksize = inode->i_sb->s_blocksize;
@@ -4722,7 +4720,7 @@ static bool ext4_should_use_dax(struct inode *inode)
4722 return false; 4720 return false;
4723 if (ext4_has_inline_data(inode)) 4721 if (ext4_has_inline_data(inode))
4724 return false; 4722 return false;
4725 if (ext4_encrypted_inode(inode)) 4723 if (ext4_test_inode_flag(inode, EXT4_INODE_ENCRYPT))
4726 return false; 4724 return false;
4727 return true; 4725 return true;
4728} 4726}
@@ -5072,7 +5070,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
5072 ret = -EFSCORRUPTED; 5070 ret = -EFSCORRUPTED;
5073 goto bad_inode; 5071 goto bad_inode;
5074 } 5072 }
5075 if (ext4_encrypted_inode(inode)) { 5073 if (IS_ENCRYPTED(inode)) {
5076 inode->i_op = &ext4_encrypted_symlink_inode_operations; 5074 inode->i_op = &ext4_encrypted_symlink_inode_operations;
5077 ext4_set_aops(inode); 5075 ext4_set_aops(inode);
5078 } else if (ext4_inode_is_fast_symlink(inode)) { 5076 } else if (ext4_inode_is_fast_symlink(inode)) {
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index d37dafa1d133..d26bcac291bb 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -210,7 +210,7 @@ journal_err_out:
210 return err; 210 return err;
211} 211}
212 212
213#ifdef CONFIG_EXT4_FS_ENCRYPTION 213#ifdef CONFIG_FS_ENCRYPTION
214static int uuid_is_zero(__u8 u[16]) 214static int uuid_is_zero(__u8 u[16])
215{ 215{
216 int i; 216 int i;
@@ -978,7 +978,7 @@ resizefs_out:
978 return fscrypt_ioctl_set_policy(filp, (const void __user *)arg); 978 return fscrypt_ioctl_set_policy(filp, (const void __user *)arg);
979 979
980 case EXT4_IOC_GET_ENCRYPTION_PWSALT: { 980 case EXT4_IOC_GET_ENCRYPTION_PWSALT: {
981#ifdef CONFIG_EXT4_FS_ENCRYPTION 981#ifdef CONFIG_FS_ENCRYPTION
982 int err, err2; 982 int err, err2;
983 struct ext4_sb_info *sbi = EXT4_SB(sb); 983 struct ext4_sb_info *sbi = EXT4_SB(sb);
984 handle_t *handle; 984 handle_t *handle;
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 2f5be02fc6f6..1083a9f3f16a 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -592,8 +592,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
592 return -EOPNOTSUPP; 592 return -EOPNOTSUPP;
593 } 593 }
594 594
595 if (ext4_encrypted_inode(orig_inode) || 595 if (IS_ENCRYPTED(orig_inode) || IS_ENCRYPTED(donor_inode)) {
596 ext4_encrypted_inode(donor_inode)) {
597 ext4_msg(orig_inode->i_sb, KERN_ERR, 596 ext4_msg(orig_inode->i_sb, KERN_ERR,
598 "Online defrag not supported for encrypted files"); 597 "Online defrag not supported for encrypted files");
599 return -EOPNOTSUPP; 598 return -EOPNOTSUPP;
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 2b928eb07fa2..980166a8122a 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -612,7 +612,7 @@ static struct stats dx_show_leaf(struct inode *dir,
612 { 612 {
613 if (show_names) 613 if (show_names)
614 { 614 {
615#ifdef CONFIG_EXT4_FS_ENCRYPTION 615#ifdef CONFIG_FS_ENCRYPTION
616 int len; 616 int len;
617 char *name; 617 char *name;
618 struct fscrypt_str fname_crypto_str = 618 struct fscrypt_str fname_crypto_str =
@@ -621,7 +621,7 @@ static struct stats dx_show_leaf(struct inode *dir,
621 621
622 name = de->name; 622 name = de->name;
623 len = de->name_len; 623 len = de->name_len;
624 if (ext4_encrypted_inode(dir)) 624 if (IS_ENCRYPTED(dir))
625 res = fscrypt_get_encryption_info(dir); 625 res = fscrypt_get_encryption_info(dir);
626 if (res) { 626 if (res) {
627 printk(KERN_WARNING "Error setting up" 627 printk(KERN_WARNING "Error setting up"
@@ -984,9 +984,9 @@ static int htree_dirblock_to_tree(struct file *dir_file,
984 top = (struct ext4_dir_entry_2 *) ((char *) de + 984 top = (struct ext4_dir_entry_2 *) ((char *) de +
985 dir->i_sb->s_blocksize - 985 dir->i_sb->s_blocksize -
986 EXT4_DIR_REC_LEN(0)); 986 EXT4_DIR_REC_LEN(0));
987#ifdef CONFIG_EXT4_FS_ENCRYPTION 987#ifdef CONFIG_FS_ENCRYPTION
988 /* Check if the directory is encrypted */ 988 /* Check if the directory is encrypted */
989 if (ext4_encrypted_inode(dir)) { 989 if (IS_ENCRYPTED(dir)) {
990 err = fscrypt_get_encryption_info(dir); 990 err = fscrypt_get_encryption_info(dir);
991 if (err < 0) { 991 if (err < 0) {
992 brelse(bh); 992 brelse(bh);
@@ -1015,7 +1015,7 @@ static int htree_dirblock_to_tree(struct file *dir_file,
1015 continue; 1015 continue;
1016 if (de->inode == 0) 1016 if (de->inode == 0)
1017 continue; 1017 continue;
1018 if (!ext4_encrypted_inode(dir)) { 1018 if (!IS_ENCRYPTED(dir)) {
1019 tmp_str.name = de->name; 1019 tmp_str.name = de->name;
1020 tmp_str.len = de->name_len; 1020 tmp_str.len = de->name_len;
1021 err = ext4_htree_store_dirent(dir_file, 1021 err = ext4_htree_store_dirent(dir_file,
@@ -1047,7 +1047,7 @@ static int htree_dirblock_to_tree(struct file *dir_file,
1047 } 1047 }
1048errout: 1048errout:
1049 brelse(bh); 1049 brelse(bh);
1050#ifdef CONFIG_EXT4_FS_ENCRYPTION 1050#ifdef CONFIG_FS_ENCRYPTION
1051 fscrypt_fname_free_buffer(&fname_crypto_str); 1051 fscrypt_fname_free_buffer(&fname_crypto_str);
1052#endif 1052#endif
1053 return count; 1053 return count;
@@ -1267,7 +1267,7 @@ static inline bool ext4_match(const struct ext4_filename *fname,
1267 1267
1268 f.usr_fname = fname->usr_fname; 1268 f.usr_fname = fname->usr_fname;
1269 f.disk_name = fname->disk_name; 1269 f.disk_name = fname->disk_name;
1270#ifdef CONFIG_EXT4_FS_ENCRYPTION 1270#ifdef CONFIG_FS_ENCRYPTION
1271 f.crypto_buf = fname->crypto_buf; 1271 f.crypto_buf = fname->crypto_buf;
1272#endif 1272#endif
1273 return fscrypt_match_name(&f, de->name, de->name_len); 1273 return fscrypt_match_name(&f, de->name, de->name_len);
@@ -1498,7 +1498,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
1498 ext4_lblk_t block; 1498 ext4_lblk_t block;
1499 int retval; 1499 int retval;
1500 1500
1501#ifdef CONFIG_EXT4_FS_ENCRYPTION 1501#ifdef CONFIG_FS_ENCRYPTION
1502 *res_dir = NULL; 1502 *res_dir = NULL;
1503#endif 1503#endif
1504 frame = dx_probe(fname, dir, NULL, frames); 1504 frame = dx_probe(fname, dir, NULL, frames);
@@ -1578,7 +1578,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
1578 ino); 1578 ino);
1579 return ERR_PTR(-EFSCORRUPTED); 1579 return ERR_PTR(-EFSCORRUPTED);
1580 } 1580 }
1581 if (!IS_ERR(inode) && ext4_encrypted_inode(dir) && 1581 if (!IS_ERR(inode) && IS_ENCRYPTED(dir) &&
1582 (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) && 1582 (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) &&
1583 !fscrypt_has_permitted_context(dir, inode)) { 1583 !fscrypt_has_permitted_context(dir, inode)) {
1584 ext4_warning(inode->i_sb, 1584 ext4_warning(inode->i_sb,
diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index cff4c4aa7a9c..6f5305e9a6ac 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -67,7 +67,7 @@ static void ext4_finish_bio(struct bio *bio)
67 67
68 bio_for_each_segment_all(bvec, bio, i, iter_all) { 68 bio_for_each_segment_all(bvec, bio, i, iter_all) {
69 struct page *page = bvec->bv_page; 69 struct page *page = bvec->bv_page;
70#ifdef CONFIG_EXT4_FS_ENCRYPTION 70#ifdef CONFIG_FS_ENCRYPTION
71 struct page *data_page = NULL; 71 struct page *data_page = NULL;
72#endif 72#endif
73 struct buffer_head *bh, *head; 73 struct buffer_head *bh, *head;
@@ -79,7 +79,7 @@ static void ext4_finish_bio(struct bio *bio)
79 if (!page) 79 if (!page)
80 continue; 80 continue;
81 81
82#ifdef CONFIG_EXT4_FS_ENCRYPTION 82#ifdef CONFIG_FS_ENCRYPTION
83 if (!page->mapping) { 83 if (!page->mapping) {
84 /* The bounce data pages are unmapped. */ 84 /* The bounce data pages are unmapped. */
85 data_page = page; 85 data_page = page;
@@ -112,7 +112,7 @@ static void ext4_finish_bio(struct bio *bio)
112 bit_spin_unlock(BH_Uptodate_Lock, &head->b_state); 112 bit_spin_unlock(BH_Uptodate_Lock, &head->b_state);
113 local_irq_restore(flags); 113 local_irq_restore(flags);
114 if (!under_io) { 114 if (!under_io) {
115#ifdef CONFIG_EXT4_FS_ENCRYPTION 115#ifdef CONFIG_FS_ENCRYPTION
116 if (data_page) 116 if (data_page)
117 fscrypt_restore_control_page(data_page); 117 fscrypt_restore_control_page(data_page);
118#endif 118#endif
@@ -478,8 +478,7 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
478 478
479 bh = head = page_buffers(page); 479 bh = head = page_buffers(page);
480 480
481 if (ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode) && 481 if (IS_ENCRYPTED(inode) && S_ISREG(inode->i_mode) && nr_to_submit) {
482 nr_to_submit) {
483 gfp_t gfp_flags = GFP_NOFS; 482 gfp_t gfp_flags = GFP_NOFS;
484 483
485 retry_encrypt: 484 retry_encrypt:
diff --git a/fs/ext4/readpage.c b/fs/ext4/readpage.c
index e53639784892..3adadf461825 100644
--- a/fs/ext4/readpage.c
+++ b/fs/ext4/readpage.c
@@ -49,7 +49,7 @@
49 49
50static inline bool ext4_bio_encrypted(struct bio *bio) 50static inline bool ext4_bio_encrypted(struct bio *bio)
51{ 51{
52#ifdef CONFIG_EXT4_FS_ENCRYPTION 52#ifdef CONFIG_FS_ENCRYPTION
53 return unlikely(bio->bi_private != NULL); 53 return unlikely(bio->bi_private != NULL);
54#else 54#else
55 return false; 55 return false;
@@ -243,8 +243,7 @@ int ext4_mpage_readpages(struct address_space *mapping,
243 if (bio == NULL) { 243 if (bio == NULL) {
244 struct fscrypt_ctx *ctx = NULL; 244 struct fscrypt_ctx *ctx = NULL;
245 245
246 if (ext4_encrypted_inode(inode) && 246 if (IS_ENCRYPTED(inode) && S_ISREG(inode->i_mode)) {
247 S_ISREG(inode->i_mode)) {
248 ctx = fscrypt_get_ctx(inode, GFP_NOFS); 247 ctx = fscrypt_get_ctx(inode, GFP_NOFS);
249 if (IS_ERR(ctx)) 248 if (IS_ERR(ctx))
250 goto set_error_page; 249 goto set_error_page;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index fb12d3c17c1b..60da0a6e4d86 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1232,7 +1232,7 @@ static int bdev_try_to_free_page(struct super_block *sb, struct page *page,
1232 return try_to_free_buffers(page); 1232 return try_to_free_buffers(page);
1233} 1233}
1234 1234
1235#ifdef CONFIG_EXT4_FS_ENCRYPTION 1235#ifdef CONFIG_FS_ENCRYPTION
1236static int ext4_get_context(struct inode *inode, void *ctx, size_t len) 1236static int ext4_get_context(struct inode *inode, void *ctx, size_t len)
1237{ 1237{
1238 return ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION, 1238 return ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION,
@@ -1922,7 +1922,7 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
1922 *journal_ioprio = 1922 *journal_ioprio =
1923 IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, arg); 1923 IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, arg);
1924 } else if (token == Opt_test_dummy_encryption) { 1924 } else if (token == Opt_test_dummy_encryption) {
1925#ifdef CONFIG_EXT4_FS_ENCRYPTION 1925#ifdef CONFIG_FS_ENCRYPTION
1926 sbi->s_mount_flags |= EXT4_MF_TEST_DUMMY_ENCRYPTION; 1926 sbi->s_mount_flags |= EXT4_MF_TEST_DUMMY_ENCRYPTION;
1927 ext4_msg(sb, KERN_WARNING, 1927 ext4_msg(sb, KERN_WARNING,
1928 "Test dummy encryption mode enabled"); 1928 "Test dummy encryption mode enabled");
@@ -4167,7 +4167,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
4167 sb->s_op = &ext4_sops; 4167 sb->s_op = &ext4_sops;
4168 sb->s_export_op = &ext4_export_ops; 4168 sb->s_export_op = &ext4_export_ops;
4169 sb->s_xattr = ext4_xattr_handlers; 4169 sb->s_xattr = ext4_xattr_handlers;
4170#ifdef CONFIG_EXT4_FS_ENCRYPTION 4170#ifdef CONFIG_FS_ENCRYPTION
4171 sb->s_cop = &ext4_cryptops; 4171 sb->s_cop = &ext4_cryptops;
4172#endif 4172#endif
4173#ifdef CONFIG_QUOTA 4173#ifdef CONFIG_QUOTA
diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
index 9212a026a1f1..5e4e78fc0b3a 100644
--- a/fs/ext4/sysfs.c
+++ b/fs/ext4/sysfs.c
@@ -224,7 +224,7 @@ static struct attribute *ext4_attrs[] = {
224EXT4_ATTR_FEATURE(lazy_itable_init); 224EXT4_ATTR_FEATURE(lazy_itable_init);
225EXT4_ATTR_FEATURE(batched_discard); 225EXT4_ATTR_FEATURE(batched_discard);
226EXT4_ATTR_FEATURE(meta_bg_resize); 226EXT4_ATTR_FEATURE(meta_bg_resize);
227#ifdef CONFIG_EXT4_FS_ENCRYPTION 227#ifdef CONFIG_FS_ENCRYPTION
228EXT4_ATTR_FEATURE(encryption); 228EXT4_ATTR_FEATURE(encryption);
229#endif 229#endif
230EXT4_ATTR_FEATURE(metadata_csum_seed); 230EXT4_ATTR_FEATURE(metadata_csum_seed);
@@ -233,7 +233,7 @@ static struct attribute *ext4_feat_attrs[] = {
233 ATTR_LIST(lazy_itable_init), 233 ATTR_LIST(lazy_itable_init),
234 ATTR_LIST(batched_discard), 234 ATTR_LIST(batched_discard),
235 ATTR_LIST(meta_bg_resize), 235 ATTR_LIST(meta_bg_resize),
236#ifdef CONFIG_EXT4_FS_ENCRYPTION 236#ifdef CONFIG_FS_ENCRYPTION
237 ATTR_LIST(encryption), 237 ATTR_LIST(encryption),
238#endif 238#endif
239 ATTR_LIST(metadata_csum_seed), 239 ATTR_LIST(metadata_csum_seed),
diff --git a/fs/f2fs/Kconfig b/fs/f2fs/Kconfig
index 9a20ef42fadd..e57cc754d543 100644
--- a/fs/f2fs/Kconfig
+++ b/fs/f2fs/Kconfig
@@ -3,6 +3,7 @@ config F2FS_FS
3 depends on BLOCK 3 depends on BLOCK
4 select CRYPTO 4 select CRYPTO
5 select CRYPTO_CRC32 5 select CRYPTO_CRC32
6 select F2FS_FS_XATTR if FS_ENCRYPTION
6 help 7 help
7 F2FS is based on Log-structured File System (LFS), which supports 8 F2FS is based on Log-structured File System (LFS), which supports
8 versatile "flash-friendly" features. The design has been focused on 9 versatile "flash-friendly" features. The design has been focused on
@@ -70,17 +71,6 @@ config F2FS_CHECK_FS
70 71
71 If you want to improve the performance, say N. 72 If you want to improve the performance, say N.
72 73
73config F2FS_FS_ENCRYPTION
74 bool "F2FS Encryption"
75 depends on F2FS_FS
76 depends on F2FS_FS_XATTR
77 select FS_ENCRYPTION
78 help
79 Enable encryption of f2fs files and directories. This
80 feature is similar to ecryptfs, but it is more memory
81 efficient since it avoids caching the encrypted and
82 decrypted pages in the page cache.
83
84config F2FS_IO_TRACE 74config F2FS_IO_TRACE
85 bool "F2FS IO tracer" 75 bool "F2FS IO tracer"
86 depends on F2FS_FS 76 depends on F2FS_FS
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index da060b77f64d..568e1d09eb48 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1468,7 +1468,7 @@ next:
1468 } 1468 }
1469 1469
1470 if (size) { 1470 if (size) {
1471 if (f2fs_encrypted_inode(inode)) 1471 if (IS_ENCRYPTED(inode))
1472 flags |= FIEMAP_EXTENT_DATA_ENCRYPTED; 1472 flags |= FIEMAP_EXTENT_DATA_ENCRYPTED;
1473 1473
1474 ret = fiemap_fill_next_extent(fieinfo, logical, 1474 ret = fiemap_fill_next_extent(fieinfo, logical,
@@ -1739,7 +1739,7 @@ static inline bool check_inplace_update_policy(struct inode *inode,
1739 if (policy & (0x1 << F2FS_IPU_ASYNC) && 1739 if (policy & (0x1 << F2FS_IPU_ASYNC) &&
1740 fio && fio->op == REQ_OP_WRITE && 1740 fio && fio->op == REQ_OP_WRITE &&
1741 !(fio->op_flags & REQ_SYNC) && 1741 !(fio->op_flags & REQ_SYNC) &&
1742 !f2fs_encrypted_inode(inode)) 1742 !IS_ENCRYPTED(inode))
1743 return true; 1743 return true;
1744 1744
1745 /* this is only set during fdatasync */ 1745 /* this is only set during fdatasync */
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 50d0d36280fa..713b36a10a79 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -385,7 +385,7 @@ struct page *f2fs_init_inode_metadata(struct inode *inode, struct inode *dir,
385 if (err) 385 if (err)
386 goto put_error; 386 goto put_error;
387 387
388 if ((f2fs_encrypted_inode(dir) || dummy_encrypt) && 388 if ((IS_ENCRYPTED(dir) || dummy_encrypt) &&
389 f2fs_may_encrypt(inode)) { 389 f2fs_may_encrypt(inode)) {
390 err = fscrypt_inherit_context(dir, inode, page, false); 390 err = fscrypt_inherit_context(dir, inode, page, false);
391 if (err) 391 if (err)
@@ -399,7 +399,7 @@ struct page *f2fs_init_inode_metadata(struct inode *inode, struct inode *dir,
399 399
400 if (new_name) { 400 if (new_name) {
401 init_dent_inode(new_name, page); 401 init_dent_inode(new_name, page);
402 if (f2fs_encrypted_inode(dir)) 402 if (IS_ENCRYPTED(dir))
403 file_set_enc_name(inode); 403 file_set_enc_name(inode);
404 } 404 }
405 405
@@ -819,7 +819,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
819 goto out; 819 goto out;
820 } 820 }
821 821
822 if (f2fs_encrypted_inode(d->inode)) { 822 if (IS_ENCRYPTED(d->inode)) {
823 int save_len = fstr->len; 823 int save_len = fstr->len;
824 824
825 err = fscrypt_fname_disk_to_usr(d->inode, 825 err = fscrypt_fname_disk_to_usr(d->inode,
@@ -862,7 +862,7 @@ static int f2fs_readdir(struct file *file, struct dir_context *ctx)
862 struct fscrypt_str fstr = FSTR_INIT(NULL, 0); 862 struct fscrypt_str fstr = FSTR_INIT(NULL, 0);
863 int err = 0; 863 int err = 0;
864 864
865 if (f2fs_encrypted_inode(inode)) { 865 if (IS_ENCRYPTED(inode)) {
866 err = fscrypt_get_encryption_info(inode); 866 err = fscrypt_get_encryption_info(inode);
867 if (err && err != -ENOKEY) 867 if (err && err != -ENOKEY)
868 goto out; 868 goto out;
@@ -924,7 +924,7 @@ out:
924 924
925static int f2fs_dir_open(struct inode *inode, struct file *filp) 925static int f2fs_dir_open(struct inode *inode, struct file *filp)
926{ 926{
927 if (f2fs_encrypted_inode(inode)) 927 if (IS_ENCRYPTED(inode))
928 return fscrypt_get_encryption_info(inode) ? -EACCES : 0; 928 return fscrypt_get_encryption_info(inode) ? -EACCES : 0;
929 return 0; 929 return 0;
930} 930}
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 8f23ee6e8eb9..7ea5c9cede37 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -24,7 +24,6 @@
24#include <linux/quotaops.h> 24#include <linux/quotaops.h>
25#include <crypto/hash.h> 25#include <crypto/hash.h>
26 26
27#define __FS_HAS_ENCRYPTION IS_ENABLED(CONFIG_F2FS_FS_ENCRYPTION)
28#include <linux/fscrypt.h> 27#include <linux/fscrypt.h>
29 28
30#ifdef CONFIG_F2FS_CHECK_FS 29#ifdef CONFIG_F2FS_CHECK_FS
@@ -1137,7 +1136,7 @@ enum fsync_mode {
1137 FSYNC_MODE_NOBARRIER, /* fsync behaves nobarrier based on posix */ 1136 FSYNC_MODE_NOBARRIER, /* fsync behaves nobarrier based on posix */
1138}; 1137};
1139 1138
1140#ifdef CONFIG_F2FS_FS_ENCRYPTION 1139#ifdef CONFIG_FS_ENCRYPTION
1141#define DUMMY_ENCRYPTION_ENABLED(sbi) \ 1140#define DUMMY_ENCRYPTION_ENABLED(sbi) \
1142 (unlikely(F2FS_OPTION(sbi).test_dummy_encryption)) 1141 (unlikely(F2FS_OPTION(sbi).test_dummy_encryption))
1143#else 1142#else
@@ -3463,19 +3462,14 @@ void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi);
3463/* 3462/*
3464 * crypto support 3463 * crypto support
3465 */ 3464 */
3466static inline bool f2fs_encrypted_inode(struct inode *inode)
3467{
3468 return file_is_encrypt(inode);
3469}
3470
3471static inline bool f2fs_encrypted_file(struct inode *inode) 3465static inline bool f2fs_encrypted_file(struct inode *inode)
3472{ 3466{
3473 return f2fs_encrypted_inode(inode) && S_ISREG(inode->i_mode); 3467 return IS_ENCRYPTED(inode) && S_ISREG(inode->i_mode);
3474} 3468}
3475 3469
3476static inline void f2fs_set_encrypted_inode(struct inode *inode) 3470static inline void f2fs_set_encrypted_inode(struct inode *inode)
3477{ 3471{
3478#ifdef CONFIG_F2FS_FS_ENCRYPTION 3472#ifdef CONFIG_FS_ENCRYPTION
3479 file_set_encrypt(inode); 3473 file_set_encrypt(inode);
3480 f2fs_set_inode_flags(inode); 3474 f2fs_set_inode_flags(inode);
3481#endif 3475#endif
@@ -3554,7 +3548,7 @@ static inline void set_opt_mode(struct f2fs_sb_info *sbi, unsigned int mt)
3554 3548
3555static inline bool f2fs_may_encrypt(struct inode *inode) 3549static inline bool f2fs_may_encrypt(struct inode *inode)
3556{ 3550{
3557#ifdef CONFIG_F2FS_FS_ENCRYPTION 3551#ifdef CONFIG_FS_ENCRYPTION
3558 umode_t mode = inode->i_mode; 3552 umode_t mode = inode->i_mode;
3559 3553
3560 return (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)); 3554 return (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode));
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index bba56b39dcc5..ba5954f41e14 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -582,7 +582,7 @@ truncate_out:
582 zero_user(page, offset, PAGE_SIZE - offset); 582 zero_user(page, offset, PAGE_SIZE - offset);
583 583
584 /* An encrypted inode should have a key and truncate the last page. */ 584 /* An encrypted inode should have a key and truncate the last page. */
585 f2fs_bug_on(F2FS_I_SB(inode), cache_only && f2fs_encrypted_inode(inode)); 585 f2fs_bug_on(F2FS_I_SB(inode), cache_only && IS_ENCRYPTED(inode));
586 if (!cache_only) 586 if (!cache_only)
587 set_page_dirty(page); 587 set_page_dirty(page);
588 f2fs_put_page(page, 1); 588 f2fs_put_page(page, 1);
@@ -711,7 +711,7 @@ int f2fs_getattr(const struct path *path, struct kstat *stat,
711 stat->attributes |= STATX_ATTR_APPEND; 711 stat->attributes |= STATX_ATTR_APPEND;
712 if (flags & F2FS_COMPR_FL) 712 if (flags & F2FS_COMPR_FL)
713 stat->attributes |= STATX_ATTR_COMPRESSED; 713 stat->attributes |= STATX_ATTR_COMPRESSED;
714 if (f2fs_encrypted_inode(inode)) 714 if (IS_ENCRYPTED(inode))
715 stat->attributes |= STATX_ATTR_ENCRYPTED; 715 stat->attributes |= STATX_ATTR_ENCRYPTED;
716 if (flags & F2FS_IMMUTABLE_FL) 716 if (flags & F2FS_IMMUTABLE_FL)
717 stat->attributes |= STATX_ATTR_IMMUTABLE; 717 stat->attributes |= STATX_ATTR_IMMUTABLE;
@@ -1563,7 +1563,7 @@ static long f2fs_fallocate(struct file *file, int mode,
1563 if (!S_ISREG(inode->i_mode)) 1563 if (!S_ISREG(inode->i_mode))
1564 return -EINVAL; 1564 return -EINVAL;
1565 1565
1566 if (f2fs_encrypted_inode(inode) && 1566 if (IS_ENCRYPTED(inode) &&
1567 (mode & (FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_INSERT_RANGE))) 1567 (mode & (FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_INSERT_RANGE)))
1568 return -EOPNOTSUPP; 1568 return -EOPNOTSUPP;
1569 1569
@@ -1647,7 +1647,7 @@ static int f2fs_ioc_getflags(struct file *filp, unsigned long arg)
1647 struct f2fs_inode_info *fi = F2FS_I(inode); 1647 struct f2fs_inode_info *fi = F2FS_I(inode);
1648 unsigned int flags = fi->i_flags; 1648 unsigned int flags = fi->i_flags;
1649 1649
1650 if (f2fs_encrypted_inode(inode)) 1650 if (IS_ENCRYPTED(inode))
1651 flags |= F2FS_ENCRYPT_FL; 1651 flags |= F2FS_ENCRYPT_FL;
1652 if (f2fs_has_inline_data(inode) || f2fs_has_inline_dentry(inode)) 1652 if (f2fs_has_inline_data(inode) || f2fs_has_inline_dentry(inode))
1653 flags |= F2FS_INLINE_DATA_FL; 1653 flags |= F2FS_INLINE_DATA_FL;
@@ -2414,7 +2414,7 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
2414 if (!S_ISREG(src->i_mode) || !S_ISREG(dst->i_mode)) 2414 if (!S_ISREG(src->i_mode) || !S_ISREG(dst->i_mode))
2415 return -EINVAL; 2415 return -EINVAL;
2416 2416
2417 if (f2fs_encrypted_inode(src) || f2fs_encrypted_inode(dst)) 2417 if (IS_ENCRYPTED(src) || IS_ENCRYPTED(dst))
2418 return -EOPNOTSUPP; 2418 return -EOPNOTSUPP;
2419 2419
2420 if (src == dst) { 2420 if (src == dst) {
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index bec52961630b..d910a820ae67 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -43,7 +43,7 @@ void f2fs_set_inode_flags(struct inode *inode)
43 new_fl |= S_NOATIME; 43 new_fl |= S_NOATIME;
44 if (flags & F2FS_DIRSYNC_FL) 44 if (flags & F2FS_DIRSYNC_FL)
45 new_fl |= S_DIRSYNC; 45 new_fl |= S_DIRSYNC;
46 if (f2fs_encrypted_inode(inode)) 46 if (file_is_encrypt(inode))
47 new_fl |= S_ENCRYPTED; 47 new_fl |= S_ENCRYPTED;
48 inode_set_flags(inode, new_fl, 48 inode_set_flags(inode, new_fl,
49 S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC| 49 S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC|
@@ -453,7 +453,7 @@ make_now:
453 inode->i_mapping->a_ops = &f2fs_dblock_aops; 453 inode->i_mapping->a_ops = &f2fs_dblock_aops;
454 inode_nohighmem(inode); 454 inode_nohighmem(inode);
455 } else if (S_ISLNK(inode->i_mode)) { 455 } else if (S_ISLNK(inode->i_mode)) {
456 if (f2fs_encrypted_inode(inode)) 456 if (file_is_encrypt(inode))
457 inode->i_op = &f2fs_encrypted_symlink_inode_operations; 457 inode->i_op = &f2fs_encrypted_symlink_inode_operations;
458 else 458 else
459 inode->i_op = &f2fs_symlink_inode_operations; 459 inode->i_op = &f2fs_symlink_inode_operations;
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 62d9829f3a6a..e967d27c1a89 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -75,7 +75,7 @@ static struct inode *f2fs_new_inode(struct inode *dir, umode_t mode)
75 set_inode_flag(inode, FI_NEW_INODE); 75 set_inode_flag(inode, FI_NEW_INODE);
76 76
77 /* If the directory encrypted, then we should encrypt the inode. */ 77 /* If the directory encrypted, then we should encrypt the inode. */
78 if ((f2fs_encrypted_inode(dir) || DUMMY_ENCRYPTION_ENABLED(sbi)) && 78 if ((IS_ENCRYPTED(dir) || DUMMY_ENCRYPTION_ENABLED(sbi)) &&
79 f2fs_may_encrypt(inode)) 79 f2fs_may_encrypt(inode))
80 f2fs_set_encrypted_inode(inode); 80 f2fs_set_encrypted_inode(inode);
81 81
@@ -476,7 +476,7 @@ static struct dentry *f2fs_lookup(struct inode *dir, struct dentry *dentry,
476 if (err) 476 if (err)
477 goto out_iput; 477 goto out_iput;
478 } 478 }
479 if (f2fs_encrypted_inode(dir) && 479 if (IS_ENCRYPTED(dir) &&
480 (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) && 480 (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) &&
481 !fscrypt_has_permitted_context(dir, inode)) { 481 !fscrypt_has_permitted_context(dir, inode)) {
482 f2fs_msg(inode->i_sb, KERN_WARNING, 482 f2fs_msg(inode->i_sb, KERN_WARNING,
@@ -803,7 +803,7 @@ static int f2fs_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode)
803 if (unlikely(f2fs_cp_error(sbi))) 803 if (unlikely(f2fs_cp_error(sbi)))
804 return -EIO; 804 return -EIO;
805 805
806 if (f2fs_encrypted_inode(dir) || DUMMY_ENCRYPTION_ENABLED(sbi)) { 806 if (IS_ENCRYPTED(dir) || DUMMY_ENCRYPTION_ENABLED(sbi)) {
807 int err = fscrypt_get_encryption_info(dir); 807 int err = fscrypt_get_encryption_info(dir);
808 if (err) 808 if (err)
809 return err; 809 return err;
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 3d3ce9eb6d13..d1ccc52afc93 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -757,7 +757,7 @@ static int parse_options(struct super_block *sb, char *options)
757 kvfree(name); 757 kvfree(name);
758 break; 758 break;
759 case Opt_test_dummy_encryption: 759 case Opt_test_dummy_encryption:
760#ifdef CONFIG_F2FS_FS_ENCRYPTION 760#ifdef CONFIG_FS_ENCRYPTION
761 if (!f2fs_sb_has_encrypt(sbi)) { 761 if (!f2fs_sb_has_encrypt(sbi)) {
762 f2fs_msg(sb, KERN_ERR, "Encrypt feature is off"); 762 f2fs_msg(sb, KERN_ERR, "Encrypt feature is off");
763 return -EINVAL; 763 return -EINVAL;
@@ -1390,7 +1390,7 @@ static int f2fs_show_options(struct seq_file *seq, struct dentry *root)
1390 seq_printf(seq, ",whint_mode=%s", "user-based"); 1390 seq_printf(seq, ",whint_mode=%s", "user-based");
1391 else if (F2FS_OPTION(sbi).whint_mode == WHINT_MODE_FS) 1391 else if (F2FS_OPTION(sbi).whint_mode == WHINT_MODE_FS)
1392 seq_printf(seq, ",whint_mode=%s", "fs-based"); 1392 seq_printf(seq, ",whint_mode=%s", "fs-based");
1393#ifdef CONFIG_F2FS_FS_ENCRYPTION 1393#ifdef CONFIG_FS_ENCRYPTION
1394 if (F2FS_OPTION(sbi).test_dummy_encryption) 1394 if (F2FS_OPTION(sbi).test_dummy_encryption)
1395 seq_puts(seq, ",test_dummy_encryption"); 1395 seq_puts(seq, ",test_dummy_encryption");
1396#endif 1396#endif
@@ -2154,7 +2154,7 @@ static const struct super_operations f2fs_sops = {
2154 .remount_fs = f2fs_remount, 2154 .remount_fs = f2fs_remount,
2155}; 2155};
2156 2156
2157#ifdef CONFIG_F2FS_FS_ENCRYPTION 2157#ifdef CONFIG_FS_ENCRYPTION
2158static int f2fs_get_context(struct inode *inode, void *ctx, size_t len) 2158static int f2fs_get_context(struct inode *inode, void *ctx, size_t len)
2159{ 2159{
2160 return f2fs_getxattr(inode, F2FS_XATTR_INDEX_ENCRYPTION, 2160 return f2fs_getxattr(inode, F2FS_XATTR_INDEX_ENCRYPTION,
@@ -3116,7 +3116,7 @@ try_onemore:
3116#endif 3116#endif
3117 3117
3118 sb->s_op = &f2fs_sops; 3118 sb->s_op = &f2fs_sops;
3119#ifdef CONFIG_F2FS_FS_ENCRYPTION 3119#ifdef CONFIG_FS_ENCRYPTION
3120 sb->s_cop = &f2fs_cryptops; 3120 sb->s_cop = &f2fs_cryptops;
3121#endif 3121#endif
3122 sb->s_xattr = f2fs_xattr_handlers; 3122 sb->s_xattr = f2fs_xattr_handlers;
diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index 0575edbe3ed6..70da6801c86f 100644
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -431,7 +431,7 @@ F2FS_GENERAL_RO_ATTR(lifetime_write_kbytes);
431F2FS_GENERAL_RO_ATTR(features); 431F2FS_GENERAL_RO_ATTR(features);
432F2FS_GENERAL_RO_ATTR(current_reserved_blocks); 432F2FS_GENERAL_RO_ATTR(current_reserved_blocks);
433 433
434#ifdef CONFIG_F2FS_FS_ENCRYPTION 434#ifdef CONFIG_FS_ENCRYPTION
435F2FS_FEATURE_RO_ATTR(encryption, FEAT_CRYPTO); 435F2FS_FEATURE_RO_ATTR(encryption, FEAT_CRYPTO);
436#endif 436#endif
437#ifdef CONFIG_BLK_DEV_ZONED 437#ifdef CONFIG_BLK_DEV_ZONED
@@ -492,7 +492,7 @@ static struct attribute *f2fs_attrs[] = {
492}; 492};
493 493
494static struct attribute *f2fs_feat_attrs[] = { 494static struct attribute *f2fs_feat_attrs[] = {
495#ifdef CONFIG_F2FS_FS_ENCRYPTION 495#ifdef CONFIG_FS_ENCRYPTION
496 ATTR_LIST(encryption), 496 ATTR_LIST(encryption),
497#endif 497#endif
498#ifdef CONFIG_BLK_DEV_ZONED 498#ifdef CONFIG_BLK_DEV_ZONED
diff --git a/fs/ubifs/Kconfig b/fs/ubifs/Kconfig
index bc1e082d921d..9da2f135121b 100644
--- a/fs/ubifs/Kconfig
+++ b/fs/ubifs/Kconfig
@@ -8,6 +8,7 @@ config UBIFS_FS
8 select CRYPTO_LZO if UBIFS_FS_LZO 8 select CRYPTO_LZO if UBIFS_FS_LZO
9 select CRYPTO_DEFLATE if UBIFS_FS_ZLIB 9 select CRYPTO_DEFLATE if UBIFS_FS_ZLIB
10 select CRYPTO_HASH_INFO 10 select CRYPTO_HASH_INFO
11 select UBIFS_FS_XATTR if FS_ENCRYPTION
11 depends on MTD_UBI 12 depends on MTD_UBI
12 help 13 help
13 UBIFS is a file system for flash devices which works on top of UBI. 14 UBIFS is a file system for flash devices which works on top of UBI.
@@ -60,17 +61,6 @@ config UBIFS_FS_XATTR
60 61
61 If unsure, say Y. 62 If unsure, say Y.
62 63
63config UBIFS_FS_ENCRYPTION
64 bool "UBIFS Encryption"
65 depends on UBIFS_FS_XATTR && BLOCK
66 select FS_ENCRYPTION
67 default n
68 help
69 Enable encryption of UBIFS files and directories. This
70 feature is similar to ecryptfs, but it is more memory
71 efficient since it avoids caching the encrypted and
72 decrypted pages in the page cache.
73
74config UBIFS_FS_SECURITY 64config UBIFS_FS_SECURITY
75 bool "UBIFS Security Labels" 65 bool "UBIFS Security Labels"
76 depends on UBIFS_FS_XATTR 66 depends on UBIFS_FS_XATTR
diff --git a/fs/ubifs/Makefile b/fs/ubifs/Makefile
index 5f838319c8d5..5c4b845754a7 100644
--- a/fs/ubifs/Makefile
+++ b/fs/ubifs/Makefile
@@ -6,6 +6,6 @@ ubifs-y += tnc.o master.o scan.o replay.o log.o commit.o gc.o orphan.o
6ubifs-y += budget.o find.o tnc_commit.o compress.o lpt.o lprops.o 6ubifs-y += budget.o find.o tnc_commit.o compress.o lpt.o lprops.o
7ubifs-y += recovery.o ioctl.o lpt_commit.o tnc_misc.o debug.o 7ubifs-y += recovery.o ioctl.o lpt_commit.o tnc_misc.o debug.o
8ubifs-y += misc.o 8ubifs-y += misc.o
9ubifs-$(CONFIG_UBIFS_FS_ENCRYPTION) += crypto.o 9ubifs-$(CONFIG_FS_ENCRYPTION) += crypto.o
10ubifs-$(CONFIG_UBIFS_FS_XATTR) += xattr.o 10ubifs-$(CONFIG_UBIFS_FS_XATTR) += xattr.o
11ubifs-$(CONFIG_UBIFS_FS_AUTHENTICATION) += auth.o 11ubifs-$(CONFIG_UBIFS_FS_AUTHENTICATION) += auth.o
diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c
index 0164bcc827f8..0f9c362a3402 100644
--- a/fs/ubifs/ioctl.c
+++ b/fs/ubifs/ioctl.c
@@ -185,7 +185,7 @@ long ubifs_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
185 return err; 185 return err;
186 } 186 }
187 case FS_IOC_SET_ENCRYPTION_POLICY: { 187 case FS_IOC_SET_ENCRYPTION_POLICY: {
188#ifdef CONFIG_UBIFS_FS_ENCRYPTION 188#ifdef CONFIG_FS_ENCRYPTION
189 struct ubifs_info *c = inode->i_sb->s_fs_info; 189 struct ubifs_info *c = inode->i_sb->s_fs_info;
190 190
191 err = ubifs_enable_encryption(c); 191 err = ubifs_enable_encryption(c);
@@ -198,7 +198,7 @@ long ubifs_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
198#endif 198#endif
199 } 199 }
200 case FS_IOC_GET_ENCRYPTION_POLICY: { 200 case FS_IOC_GET_ENCRYPTION_POLICY: {
201#ifdef CONFIG_UBIFS_FS_ENCRYPTION 201#ifdef CONFIG_FS_ENCRYPTION
202 return fscrypt_ioctl_get_policy(file, (void __user *)arg); 202 return fscrypt_ioctl_get_policy(file, (void __user *)arg);
203#else 203#else
204 return -EOPNOTSUPP; 204 return -EOPNOTSUPP;
diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
index 3da90c951c23..67fac1e8adfb 100644
--- a/fs/ubifs/sb.c
+++ b/fs/ubifs/sb.c
@@ -748,7 +748,7 @@ int ubifs_read_superblock(struct ubifs_info *c)
748 goto out; 748 goto out;
749 } 749 }
750 750
751#ifndef CONFIG_UBIFS_FS_ENCRYPTION 751#ifndef CONFIG_FS_ENCRYPTION
752 if (c->encrypted) { 752 if (c->encrypted) {
753 ubifs_err(c, "file system contains encrypted files but UBIFS" 753 ubifs_err(c, "file system contains encrypted files but UBIFS"
754 " was built without crypto support."); 754 " was built without crypto support.");
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 1fac1133dadd..8dc2818fdd84 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -2146,7 +2146,7 @@ static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
2146#ifdef CONFIG_UBIFS_FS_XATTR 2146#ifdef CONFIG_UBIFS_FS_XATTR
2147 sb->s_xattr = ubifs_xattr_handlers; 2147 sb->s_xattr = ubifs_xattr_handlers;
2148#endif 2148#endif
2149#ifdef CONFIG_UBIFS_FS_ENCRYPTION 2149#ifdef CONFIG_FS_ENCRYPTION
2150 sb->s_cop = &ubifs_crypt_operations; 2150 sb->s_cop = &ubifs_crypt_operations;
2151#endif 2151#endif
2152 2152
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index 38401adaa00d..1ae12900e01d 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -43,7 +43,6 @@
43#include <crypto/hash.h> 43#include <crypto/hash.h>
44#include <crypto/algapi.h> 44#include <crypto/algapi.h>
45 45
46#define __FS_HAS_ENCRYPTION IS_ENABLED(CONFIG_UBIFS_FS_ENCRYPTION)
47#include <linux/fscrypt.h> 46#include <linux/fscrypt.h>
48 47
49#include "ubifs-media.h" 48#include "ubifs-media.h"
@@ -142,7 +141,7 @@
142 */ 141 */
143#define WORST_COMPR_FACTOR 2 142#define WORST_COMPR_FACTOR 2
144 143
145#ifdef CONFIG_UBIFS_FS_ENCRYPTION 144#ifdef CONFIG_FS_ENCRYPTION
146#define UBIFS_CIPHER_BLOCK_SIZE FS_CRYPTO_BLOCK_SIZE 145#define UBIFS_CIPHER_BLOCK_SIZE FS_CRYPTO_BLOCK_SIZE
147#else 146#else
148#define UBIFS_CIPHER_BLOCK_SIZE 0 147#define UBIFS_CIPHER_BLOCK_SIZE 0
@@ -2072,7 +2071,7 @@ int ubifs_decompress(const struct ubifs_info *c, const void *buf, int len,
2072#include "misc.h" 2071#include "misc.h"
2073#include "key.h" 2072#include "key.h"
2074 2073
2075#ifndef CONFIG_UBIFS_FS_ENCRYPTION 2074#ifndef CONFIG_FS_ENCRYPTION
2076static inline int ubifs_encrypt(const struct inode *inode, 2075static inline int ubifs_encrypt(const struct inode *inode,
2077 struct ubifs_data_node *dn, 2076 struct ubifs_data_node *dn,
2078 unsigned int in_len, unsigned int *out_len, 2077 unsigned int in_len, unsigned int *out_len,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 0a257d89208e..80c6a4093b46 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -708,7 +708,7 @@ struct inode {
708 struct fsnotify_mark_connector __rcu *i_fsnotify_marks; 708 struct fsnotify_mark_connector __rcu *i_fsnotify_marks;
709#endif 709#endif
710 710
711#if IS_ENABLED(CONFIG_FS_ENCRYPTION) 711#ifdef CONFIG_FS_ENCRYPTION
712 struct fscrypt_info *i_crypt_info; 712 struct fscrypt_info *i_crypt_info;
713#endif 713#endif
714 714
@@ -1415,7 +1415,7 @@ struct super_block {
1415 void *s_security; 1415 void *s_security;
1416#endif 1416#endif
1417 const struct xattr_handler **s_xattr; 1417 const struct xattr_handler **s_xattr;
1418#if IS_ENABLED(CONFIG_FS_ENCRYPTION) 1418#ifdef CONFIG_FS_ENCRYPTION
1419 const struct fscrypt_operations *s_cop; 1419 const struct fscrypt_operations *s_cop;
1420#endif 1420#endif
1421 struct hlist_bl_head s_roots; /* alternate root dentries for NFS */ 1421 struct hlist_bl_head s_roots; /* alternate root dentries for NFS */
diff --git a/include/linux/fscrypt.h b/include/linux/fscrypt.h
index 952ab97af325..e5194fc3983e 100644
--- a/include/linux/fscrypt.h
+++ b/include/linux/fscrypt.h
@@ -2,9 +2,8 @@
2/* 2/*
3 * fscrypt.h: declarations for per-file encryption 3 * fscrypt.h: declarations for per-file encryption
4 * 4 *
5 * Filesystems that implement per-file encryption include this header 5 * Filesystems that implement per-file encryption must include this header
6 * file with the __FS_HAS_ENCRYPTION set according to whether that filesystem 6 * file.
7 * is being built with encryption support or not.
8 * 7 *
9 * Copyright (C) 2015, Google, Inc. 8 * Copyright (C) 2015, Google, Inc.
10 * 9 *
@@ -15,6 +14,8 @@
15#define _LINUX_FSCRYPT_H 14#define _LINUX_FSCRYPT_H
16 15
17#include <linux/fs.h> 16#include <linux/fs.h>
17#include <linux/mm.h>
18#include <linux/slab.h>
18 19
19#define FS_CRYPTO_BLOCK_SIZE 16 20#define FS_CRYPTO_BLOCK_SIZE 16
20 21
@@ -42,11 +43,410 @@ struct fscrypt_name {
42/* Maximum value for the third parameter of fscrypt_operations.set_context(). */ 43/* Maximum value for the third parameter of fscrypt_operations.set_context(). */
43#define FSCRYPT_SET_CONTEXT_MAX_SIZE 28 44#define FSCRYPT_SET_CONTEXT_MAX_SIZE 28
44 45
45#if __FS_HAS_ENCRYPTION 46#ifdef CONFIG_FS_ENCRYPTION
46#include <linux/fscrypt_supp.h> 47/*
47#else 48 * fscrypt superblock flags
48#include <linux/fscrypt_notsupp.h> 49 */
49#endif 50#define FS_CFLG_OWN_PAGES (1U << 1)
51
52/*
53 * crypto operations for filesystems
54 */
55struct fscrypt_operations {
56 unsigned int flags;
57 const char *key_prefix;
58 int (*get_context)(struct inode *, void *, size_t);
59 int (*set_context)(struct inode *, const void *, size_t, void *);
60 bool (*dummy_context)(struct inode *);
61 bool (*empty_dir)(struct inode *);
62 unsigned int max_namelen;
63};
64
65struct fscrypt_ctx {
66 union {
67 struct {
68 struct page *bounce_page; /* Ciphertext page */
69 struct page *control_page; /* Original page */
70 } w;
71 struct {
72 struct bio *bio;
73 struct work_struct work;
74 } r;
75 struct list_head free_list; /* Free list */
76 };
77 u8 flags; /* Flags */
78};
79
80static inline bool fscrypt_has_encryption_key(const struct inode *inode)
81{
82 return (inode->i_crypt_info != NULL);
83}
84
85static inline bool fscrypt_dummy_context_enabled(struct inode *inode)
86{
87 return inode->i_sb->s_cop->dummy_context &&
88 inode->i_sb->s_cop->dummy_context(inode);
89}
90
91/* crypto.c */
92extern void fscrypt_enqueue_decrypt_work(struct work_struct *);
93extern struct fscrypt_ctx *fscrypt_get_ctx(const struct inode *, gfp_t);
94extern void fscrypt_release_ctx(struct fscrypt_ctx *);
95extern struct page *fscrypt_encrypt_page(const struct inode *, struct page *,
96 unsigned int, unsigned int,
97 u64, gfp_t);
98extern int fscrypt_decrypt_page(const struct inode *, struct page *, unsigned int,
99 unsigned int, u64);
100
101static inline struct page *fscrypt_control_page(struct page *page)
102{
103 return ((struct fscrypt_ctx *)page_private(page))->w.control_page;
104}
105
106extern void fscrypt_restore_control_page(struct page *);
107
108/* policy.c */
109extern int fscrypt_ioctl_set_policy(struct file *, const void __user *);
110extern int fscrypt_ioctl_get_policy(struct file *, void __user *);
111extern int fscrypt_has_permitted_context(struct inode *, struct inode *);
112extern int fscrypt_inherit_context(struct inode *, struct inode *,
113 void *, bool);
114/* keyinfo.c */
115extern int fscrypt_get_encryption_info(struct inode *);
116extern void fscrypt_put_encryption_info(struct inode *);
117
118/* fname.c */
119extern int fscrypt_setup_filename(struct inode *, const struct qstr *,
120 int lookup, struct fscrypt_name *);
121
122static inline void fscrypt_free_filename(struct fscrypt_name *fname)
123{
124 kfree(fname->crypto_buf.name);
125}
126
127extern int fscrypt_fname_alloc_buffer(const struct inode *, u32,
128 struct fscrypt_str *);
129extern void fscrypt_fname_free_buffer(struct fscrypt_str *);
130extern int fscrypt_fname_disk_to_usr(struct inode *, u32, u32,
131 const struct fscrypt_str *, struct fscrypt_str *);
132
133#define FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE 32
134
135/* Extracts the second-to-last ciphertext block; see explanation below */
136#define FSCRYPT_FNAME_DIGEST(name, len) \
137 ((name) + round_down((len) - FS_CRYPTO_BLOCK_SIZE - 1, \
138 FS_CRYPTO_BLOCK_SIZE))
139
140#define FSCRYPT_FNAME_DIGEST_SIZE FS_CRYPTO_BLOCK_SIZE
141
142/**
143 * fscrypt_digested_name - alternate identifier for an on-disk filename
144 *
145 * When userspace lists an encrypted directory without access to the key,
146 * filenames whose ciphertext is longer than FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE
147 * bytes are shown in this abbreviated form (base64-encoded) rather than as the
148 * full ciphertext (base64-encoded). This is necessary to allow supporting
149 * filenames up to NAME_MAX bytes, since base64 encoding expands the length.
150 *
151 * To make it possible for filesystems to still find the correct directory entry
152 * despite not knowing the full on-disk name, we encode any filesystem-specific
153 * 'hash' and/or 'minor_hash' which the filesystem may need for its lookups,
154 * followed by the second-to-last ciphertext block of the filename. Due to the
155 * use of the CBC-CTS encryption mode, the second-to-last ciphertext block
156 * depends on the full plaintext. (Note that ciphertext stealing causes the
157 * last two blocks to appear "flipped".) This makes accidental collisions very
158 * unlikely: just a 1 in 2^128 chance for two filenames to collide even if they
159 * share the same filesystem-specific hashes.
160 *
161 * However, this scheme isn't immune to intentional collisions, which can be
162 * created by anyone able to create arbitrary plaintext filenames and view them
163 * without the key. Making the "digest" be a real cryptographic hash like
164 * SHA-256 over the full ciphertext would prevent this, although it would be
165 * less efficient and harder to implement, especially since the filesystem would
166 * need to calculate it for each directory entry examined during a search.
167 */
168struct fscrypt_digested_name {
169 u32 hash;
170 u32 minor_hash;
171 u8 digest[FSCRYPT_FNAME_DIGEST_SIZE];
172};
173
174/**
175 * fscrypt_match_name() - test whether the given name matches a directory entry
176 * @fname: the name being searched for
177 * @de_name: the name from the directory entry
178 * @de_name_len: the length of @de_name in bytes
179 *
180 * Normally @fname->disk_name will be set, and in that case we simply compare
181 * that to the name stored in the directory entry. The only exception is that
182 * if we don't have the key for an encrypted directory and a filename in it is
183 * very long, then we won't have the full disk_name and we'll instead need to
184 * match against the fscrypt_digested_name.
185 *
186 * Return: %true if the name matches, otherwise %false.
187 */
188static inline bool fscrypt_match_name(const struct fscrypt_name *fname,
189 const u8 *de_name, u32 de_name_len)
190{
191 if (unlikely(!fname->disk_name.name)) {
192 const struct fscrypt_digested_name *n =
193 (const void *)fname->crypto_buf.name;
194 if (WARN_ON_ONCE(fname->usr_fname->name[0] != '_'))
195 return false;
196 if (de_name_len <= FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE)
197 return false;
198 return !memcmp(FSCRYPT_FNAME_DIGEST(de_name, de_name_len),
199 n->digest, FSCRYPT_FNAME_DIGEST_SIZE);
200 }
201
202 if (de_name_len != fname->disk_name.len)
203 return false;
204 return !memcmp(de_name, fname->disk_name.name, fname->disk_name.len);
205}
206
207/* bio.c */
208extern void fscrypt_decrypt_bio(struct bio *);
209extern void fscrypt_enqueue_decrypt_bio(struct fscrypt_ctx *ctx,
210 struct bio *bio);
211extern void fscrypt_pullback_bio_page(struct page **, bool);
212extern int fscrypt_zeroout_range(const struct inode *, pgoff_t, sector_t,
213 unsigned int);
214
215/* hooks.c */
216extern int fscrypt_file_open(struct inode *inode, struct file *filp);
217extern int __fscrypt_prepare_link(struct inode *inode, struct inode *dir);
218extern int __fscrypt_prepare_rename(struct inode *old_dir,
219 struct dentry *old_dentry,
220 struct inode *new_dir,
221 struct dentry *new_dentry,
222 unsigned int flags);
223extern int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry);
224extern int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,
225 unsigned int max_len,
226 struct fscrypt_str *disk_link);
227extern int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,
228 unsigned int len,
229 struct fscrypt_str *disk_link);
230extern const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,
231 unsigned int max_size,
232 struct delayed_call *done);
233#else /* !CONFIG_FS_ENCRYPTION */
234
235static inline bool fscrypt_has_encryption_key(const struct inode *inode)
236{
237 return false;
238}
239
240static inline bool fscrypt_dummy_context_enabled(struct inode *inode)
241{
242 return false;
243}
244
245/* crypto.c */
246static inline void fscrypt_enqueue_decrypt_work(struct work_struct *work)
247{
248}
249
250static inline struct fscrypt_ctx *fscrypt_get_ctx(const struct inode *inode,
251 gfp_t gfp_flags)
252{
253 return ERR_PTR(-EOPNOTSUPP);
254}
255
256static inline void fscrypt_release_ctx(struct fscrypt_ctx *ctx)
257{
258 return;
259}
260
261static inline struct page *fscrypt_encrypt_page(const struct inode *inode,
262 struct page *page,
263 unsigned int len,
264 unsigned int offs,
265 u64 lblk_num, gfp_t gfp_flags)
266{
267 return ERR_PTR(-EOPNOTSUPP);
268}
269
270static inline int fscrypt_decrypt_page(const struct inode *inode,
271 struct page *page,
272 unsigned int len, unsigned int offs,
273 u64 lblk_num)
274{
275 return -EOPNOTSUPP;
276}
277
278static inline struct page *fscrypt_control_page(struct page *page)
279{
280 WARN_ON_ONCE(1);
281 return ERR_PTR(-EINVAL);
282}
283
284static inline void fscrypt_restore_control_page(struct page *page)
285{
286 return;
287}
288
289/* policy.c */
290static inline int fscrypt_ioctl_set_policy(struct file *filp,
291 const void __user *arg)
292{
293 return -EOPNOTSUPP;
294}
295
296static inline int fscrypt_ioctl_get_policy(struct file *filp, void __user *arg)
297{
298 return -EOPNOTSUPP;
299}
300
301static inline int fscrypt_has_permitted_context(struct inode *parent,
302 struct inode *child)
303{
304 return 0;
305}
306
307static inline int fscrypt_inherit_context(struct inode *parent,
308 struct inode *child,
309 void *fs_data, bool preload)
310{
311 return -EOPNOTSUPP;
312}
313
314/* keyinfo.c */
315static inline int fscrypt_get_encryption_info(struct inode *inode)
316{
317 return -EOPNOTSUPP;
318}
319
320static inline void fscrypt_put_encryption_info(struct inode *inode)
321{
322 return;
323}
324
325 /* fname.c */
326static inline int fscrypt_setup_filename(struct inode *dir,
327 const struct qstr *iname,
328 int lookup, struct fscrypt_name *fname)
329{
330 if (IS_ENCRYPTED(dir))
331 return -EOPNOTSUPP;
332
333 memset(fname, 0, sizeof(struct fscrypt_name));
334 fname->usr_fname = iname;
335 fname->disk_name.name = (unsigned char *)iname->name;
336 fname->disk_name.len = iname->len;
337 return 0;
338}
339
340static inline void fscrypt_free_filename(struct fscrypt_name *fname)
341{
342 return;
343}
344
345static inline int fscrypt_fname_alloc_buffer(const struct inode *inode,
346 u32 max_encrypted_len,
347 struct fscrypt_str *crypto_str)
348{
349 return -EOPNOTSUPP;
350}
351
352static inline void fscrypt_fname_free_buffer(struct fscrypt_str *crypto_str)
353{
354 return;
355}
356
357static inline int fscrypt_fname_disk_to_usr(struct inode *inode,
358 u32 hash, u32 minor_hash,
359 const struct fscrypt_str *iname,
360 struct fscrypt_str *oname)
361{
362 return -EOPNOTSUPP;
363}
364
365static inline bool fscrypt_match_name(const struct fscrypt_name *fname,
366 const u8 *de_name, u32 de_name_len)
367{
368 /* Encryption support disabled; use standard comparison */
369 if (de_name_len != fname->disk_name.len)
370 return false;
371 return !memcmp(de_name, fname->disk_name.name, fname->disk_name.len);
372}
373
374/* bio.c */
375static inline void fscrypt_decrypt_bio(struct bio *bio)
376{
377}
378
379static inline void fscrypt_enqueue_decrypt_bio(struct fscrypt_ctx *ctx,
380 struct bio *bio)
381{
382}
383
384static inline void fscrypt_pullback_bio_page(struct page **page, bool restore)
385{
386 return;
387}
388
389static inline int fscrypt_zeroout_range(const struct inode *inode, pgoff_t lblk,
390 sector_t pblk, unsigned int len)
391{
392 return -EOPNOTSUPP;
393}
394
395/* hooks.c */
396
397static inline int fscrypt_file_open(struct inode *inode, struct file *filp)
398{
399 if (IS_ENCRYPTED(inode))
400 return -EOPNOTSUPP;
401 return 0;
402}
403
404static inline int __fscrypt_prepare_link(struct inode *inode,
405 struct inode *dir)
406{
407 return -EOPNOTSUPP;
408}
409
410static inline int __fscrypt_prepare_rename(struct inode *old_dir,
411 struct dentry *old_dentry,
412 struct inode *new_dir,
413 struct dentry *new_dentry,
414 unsigned int flags)
415{
416 return -EOPNOTSUPP;
417}
418
419static inline int __fscrypt_prepare_lookup(struct inode *dir,
420 struct dentry *dentry)
421{
422 return -EOPNOTSUPP;
423}
424
425static inline int __fscrypt_prepare_symlink(struct inode *dir,
426 unsigned int len,
427 unsigned int max_len,
428 struct fscrypt_str *disk_link)
429{
430 return -EOPNOTSUPP;
431}
432
433
434static inline int __fscrypt_encrypt_symlink(struct inode *inode,
435 const char *target,
436 unsigned int len,
437 struct fscrypt_str *disk_link)
438{
439 return -EOPNOTSUPP;
440}
441
442static inline const char *fscrypt_get_symlink(struct inode *inode,
443 const void *caddr,
444 unsigned int max_size,
445 struct delayed_call *done)
446{
447 return ERR_PTR(-EOPNOTSUPP);
448}
449#endif /* !CONFIG_FS_ENCRYPTION */
50 450
51/** 451/**
52 * fscrypt_require_key - require an inode's encryption key 452 * fscrypt_require_key - require an inode's encryption key
@@ -89,7 +489,7 @@ static inline int fscrypt_require_key(struct inode *inode)
89 * in an encrypted directory tree use the same encryption policy. 489 * in an encrypted directory tree use the same encryption policy.
90 * 490 *
91 * Return: 0 on success, -ENOKEY if the directory's encryption key is missing, 491 * Return: 0 on success, -ENOKEY if the directory's encryption key is missing,
92 * -EPERM if the link would result in an inconsistent encryption policy, or 492 * -EXDEV if the link would result in an inconsistent encryption policy, or
93 * another -errno code. 493 * another -errno code.
94 */ 494 */
95static inline int fscrypt_prepare_link(struct dentry *old_dentry, 495static inline int fscrypt_prepare_link(struct dentry *old_dentry,
@@ -119,7 +519,7 @@ static inline int fscrypt_prepare_link(struct dentry *old_dentry,
119 * We also verify that the rename will not violate the constraint that all files 519 * We also verify that the rename will not violate the constraint that all files
120 * in an encrypted directory tree use the same encryption policy. 520 * in an encrypted directory tree use the same encryption policy.
121 * 521 *
122 * Return: 0 on success, -ENOKEY if an encryption key is missing, -EPERM if the 522 * Return: 0 on success, -ENOKEY if an encryption key is missing, -EXDEV if the
123 * rename would cause inconsistent encryption policies, or another -errno code. 523 * rename would cause inconsistent encryption policies, or another -errno code.
124 */ 524 */
125static inline int fscrypt_prepare_rename(struct inode *old_dir, 525static inline int fscrypt_prepare_rename(struct inode *old_dir,
diff --git a/include/linux/fscrypt_notsupp.h b/include/linux/fscrypt_notsupp.h
deleted file mode 100644
index ee8b43e4c15a..000000000000
--- a/include/linux/fscrypt_notsupp.h
+++ /dev/null
@@ -1,231 +0,0 @@
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * fscrypt_notsupp.h
4 *
5 * This stubs out the fscrypt functions for filesystems configured without
6 * encryption support.
7 *
8 * Do not include this file directly. Use fscrypt.h instead!
9 */
10#ifndef _LINUX_FSCRYPT_H
11#error "Incorrect include of linux/fscrypt_notsupp.h!"
12#endif
13
14#ifndef _LINUX_FSCRYPT_NOTSUPP_H
15#define _LINUX_FSCRYPT_NOTSUPP_H
16
17static inline bool fscrypt_has_encryption_key(const struct inode *inode)
18{
19 return false;
20}
21
22static inline bool fscrypt_dummy_context_enabled(struct inode *inode)
23{
24 return false;
25}
26
27/* crypto.c */
28static inline void fscrypt_enqueue_decrypt_work(struct work_struct *work)
29{
30}
31
32static inline struct fscrypt_ctx *fscrypt_get_ctx(const struct inode *inode,
33 gfp_t gfp_flags)
34{
35 return ERR_PTR(-EOPNOTSUPP);
36}
37
38static inline void fscrypt_release_ctx(struct fscrypt_ctx *ctx)
39{
40 return;
41}
42
43static inline struct page *fscrypt_encrypt_page(const struct inode *inode,
44 struct page *page,
45 unsigned int len,
46 unsigned int offs,
47 u64 lblk_num, gfp_t gfp_flags)
48{
49 return ERR_PTR(-EOPNOTSUPP);
50}
51
52static inline int fscrypt_decrypt_page(const struct inode *inode,
53 struct page *page,
54 unsigned int len, unsigned int offs,
55 u64 lblk_num)
56{
57 return -EOPNOTSUPP;
58}
59
60static inline struct page *fscrypt_control_page(struct page *page)
61{
62 WARN_ON_ONCE(1);
63 return ERR_PTR(-EINVAL);
64}
65
66static inline void fscrypt_restore_control_page(struct page *page)
67{
68 return;
69}
70
71/* policy.c */
72static inline int fscrypt_ioctl_set_policy(struct file *filp,
73 const void __user *arg)
74{
75 return -EOPNOTSUPP;
76}
77
78static inline int fscrypt_ioctl_get_policy(struct file *filp, void __user *arg)
79{
80 return -EOPNOTSUPP;
81}
82
83static inline int fscrypt_has_permitted_context(struct inode *parent,
84 struct inode *child)
85{
86 return 0;
87}
88
89static inline int fscrypt_inherit_context(struct inode *parent,
90 struct inode *child,
91 void *fs_data, bool preload)
92{
93 return -EOPNOTSUPP;
94}
95
96/* keyinfo.c */
97static inline int fscrypt_get_encryption_info(struct inode *inode)
98{
99 return -EOPNOTSUPP;
100}
101
102static inline void fscrypt_put_encryption_info(struct inode *inode)
103{
104 return;
105}
106
107 /* fname.c */
108static inline int fscrypt_setup_filename(struct inode *dir,
109 const struct qstr *iname,
110 int lookup, struct fscrypt_name *fname)
111{
112 if (IS_ENCRYPTED(dir))
113 return -EOPNOTSUPP;
114
115 memset(fname, 0, sizeof(struct fscrypt_name));
116 fname->usr_fname = iname;
117 fname->disk_name.name = (unsigned char *)iname->name;
118 fname->disk_name.len = iname->len;
119 return 0;
120}
121
122static inline void fscrypt_free_filename(struct fscrypt_name *fname)
123{
124 return;
125}
126
127static inline int fscrypt_fname_alloc_buffer(const struct inode *inode,
128 u32 max_encrypted_len,
129 struct fscrypt_str *crypto_str)
130{
131 return -EOPNOTSUPP;
132}
133
134static inline void fscrypt_fname_free_buffer(struct fscrypt_str *crypto_str)
135{
136 return;
137}
138
139static inline int fscrypt_fname_disk_to_usr(struct inode *inode,
140 u32 hash, u32 minor_hash,
141 const struct fscrypt_str *iname,
142 struct fscrypt_str *oname)
143{
144 return -EOPNOTSUPP;
145}
146
147static inline bool fscrypt_match_name(const struct fscrypt_name *fname,
148 const u8 *de_name, u32 de_name_len)
149{
150 /* Encryption support disabled; use standard comparison */
151 if (de_name_len != fname->disk_name.len)
152 return false;
153 return !memcmp(de_name, fname->disk_name.name, fname->disk_name.len);
154}
155
156/* bio.c */
157static inline void fscrypt_decrypt_bio(struct bio *bio)
158{
159}
160
161static inline void fscrypt_enqueue_decrypt_bio(struct fscrypt_ctx *ctx,
162 struct bio *bio)
163{
164}
165
166static inline void fscrypt_pullback_bio_page(struct page **page, bool restore)
167{
168 return;
169}
170
171static inline int fscrypt_zeroout_range(const struct inode *inode, pgoff_t lblk,
172 sector_t pblk, unsigned int len)
173{
174 return -EOPNOTSUPP;
175}
176
177/* hooks.c */
178
179static inline int fscrypt_file_open(struct inode *inode, struct file *filp)
180{
181 if (IS_ENCRYPTED(inode))
182 return -EOPNOTSUPP;
183 return 0;
184}
185
186static inline int __fscrypt_prepare_link(struct inode *inode,
187 struct inode *dir)
188{
189 return -EOPNOTSUPP;
190}
191
192static inline int __fscrypt_prepare_rename(struct inode *old_dir,
193 struct dentry *old_dentry,
194 struct inode *new_dir,
195 struct dentry *new_dentry,
196 unsigned int flags)
197{
198 return -EOPNOTSUPP;
199}
200
201static inline int __fscrypt_prepare_lookup(struct inode *dir,
202 struct dentry *dentry)
203{
204 return -EOPNOTSUPP;
205}
206
207static inline int __fscrypt_prepare_symlink(struct inode *dir,
208 unsigned int len,
209 unsigned int max_len,
210 struct fscrypt_str *disk_link)
211{
212 return -EOPNOTSUPP;
213}
214
215static inline int __fscrypt_encrypt_symlink(struct inode *inode,
216 const char *target,
217 unsigned int len,
218 struct fscrypt_str *disk_link)
219{
220 return -EOPNOTSUPP;
221}
222
223static inline const char *fscrypt_get_symlink(struct inode *inode,
224 const void *caddr,
225 unsigned int max_size,
226 struct delayed_call *done)
227{
228 return ERR_PTR(-EOPNOTSUPP);
229}
230
231#endif /* _LINUX_FSCRYPT_NOTSUPP_H */
diff --git a/include/linux/fscrypt_supp.h b/include/linux/fscrypt_supp.h
deleted file mode 100644
index 6456c6b2005f..000000000000
--- a/include/linux/fscrypt_supp.h
+++ /dev/null
@@ -1,204 +0,0 @@
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * fscrypt_supp.h
4 *
5 * Do not include this file directly. Use fscrypt.h instead!
6 */
7#ifndef _LINUX_FSCRYPT_H
8#error "Incorrect include of linux/fscrypt_supp.h!"
9#endif
10
11#ifndef _LINUX_FSCRYPT_SUPP_H
12#define _LINUX_FSCRYPT_SUPP_H
13
14#include <linux/mm.h>
15#include <linux/slab.h>
16
17/*
18 * fscrypt superblock flags
19 */
20#define FS_CFLG_OWN_PAGES (1U << 1)
21
22/*
23 * crypto operations for filesystems
24 */
25struct fscrypt_operations {
26 unsigned int flags;
27 const char *key_prefix;
28 int (*get_context)(struct inode *, void *, size_t);
29 int (*set_context)(struct inode *, const void *, size_t, void *);
30 bool (*dummy_context)(struct inode *);
31 bool (*empty_dir)(struct inode *);
32 unsigned int max_namelen;
33};
34
35struct fscrypt_ctx {
36 union {
37 struct {
38 struct page *bounce_page; /* Ciphertext page */
39 struct page *control_page; /* Original page */
40 } w;
41 struct {
42 struct bio *bio;
43 struct work_struct work;
44 } r;
45 struct list_head free_list; /* Free list */
46 };
47 u8 flags; /* Flags */
48};
49
50static inline bool fscrypt_has_encryption_key(const struct inode *inode)
51{
52 return (inode->i_crypt_info != NULL);
53}
54
55static inline bool fscrypt_dummy_context_enabled(struct inode *inode)
56{
57 return inode->i_sb->s_cop->dummy_context &&
58 inode->i_sb->s_cop->dummy_context(inode);
59}
60
61/* crypto.c */
62extern void fscrypt_enqueue_decrypt_work(struct work_struct *);
63extern struct fscrypt_ctx *fscrypt_get_ctx(const struct inode *, gfp_t);
64extern void fscrypt_release_ctx(struct fscrypt_ctx *);
65extern struct page *fscrypt_encrypt_page(const struct inode *, struct page *,
66 unsigned int, unsigned int,
67 u64, gfp_t);
68extern int fscrypt_decrypt_page(const struct inode *, struct page *, unsigned int,
69 unsigned int, u64);
70
71static inline struct page *fscrypt_control_page(struct page *page)
72{
73 return ((struct fscrypt_ctx *)page_private(page))->w.control_page;
74}
75
76extern void fscrypt_restore_control_page(struct page *);
77
78/* policy.c */
79extern int fscrypt_ioctl_set_policy(struct file *, const void __user *);
80extern int fscrypt_ioctl_get_policy(struct file *, void __user *);
81extern int fscrypt_has_permitted_context(struct inode *, struct inode *);
82extern int fscrypt_inherit_context(struct inode *, struct inode *,
83 void *, bool);
84/* keyinfo.c */
85extern int fscrypt_get_encryption_info(struct inode *);
86extern void fscrypt_put_encryption_info(struct inode *);
87
88/* fname.c */
89extern int fscrypt_setup_filename(struct inode *, const struct qstr *,
90 int lookup, struct fscrypt_name *);
91
92static inline void fscrypt_free_filename(struct fscrypt_name *fname)
93{
94 kfree(fname->crypto_buf.name);
95}
96
97extern int fscrypt_fname_alloc_buffer(const struct inode *, u32,
98 struct fscrypt_str *);
99extern void fscrypt_fname_free_buffer(struct fscrypt_str *);
100extern int fscrypt_fname_disk_to_usr(struct inode *, u32, u32,
101 const struct fscrypt_str *, struct fscrypt_str *);
102
103#define FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE 32
104
105/* Extracts the second-to-last ciphertext block; see explanation below */
106#define FSCRYPT_FNAME_DIGEST(name, len) \
107 ((name) + round_down((len) - FS_CRYPTO_BLOCK_SIZE - 1, \
108 FS_CRYPTO_BLOCK_SIZE))
109
110#define FSCRYPT_FNAME_DIGEST_SIZE FS_CRYPTO_BLOCK_SIZE
111
112/**
113 * fscrypt_digested_name - alternate identifier for an on-disk filename
114 *
115 * When userspace lists an encrypted directory without access to the key,
116 * filenames whose ciphertext is longer than FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE
117 * bytes are shown in this abbreviated form (base64-encoded) rather than as the
118 * full ciphertext (base64-encoded). This is necessary to allow supporting
119 * filenames up to NAME_MAX bytes, since base64 encoding expands the length.
120 *
121 * To make it possible for filesystems to still find the correct directory entry
122 * despite not knowing the full on-disk name, we encode any filesystem-specific
123 * 'hash' and/or 'minor_hash' which the filesystem may need for its lookups,
124 * followed by the second-to-last ciphertext block of the filename. Due to the
125 * use of the CBC-CTS encryption mode, the second-to-last ciphertext block
126 * depends on the full plaintext. (Note that ciphertext stealing causes the
127 * last two blocks to appear "flipped".) This makes accidental collisions very
128 * unlikely: just a 1 in 2^128 chance for two filenames to collide even if they
129 * share the same filesystem-specific hashes.
130 *
131 * However, this scheme isn't immune to intentional collisions, which can be
132 * created by anyone able to create arbitrary plaintext filenames and view them
133 * without the key. Making the "digest" be a real cryptographic hash like
134 * SHA-256 over the full ciphertext would prevent this, although it would be
135 * less efficient and harder to implement, especially since the filesystem would
136 * need to calculate it for each directory entry examined during a search.
137 */
138struct fscrypt_digested_name {
139 u32 hash;
140 u32 minor_hash;
141 u8 digest[FSCRYPT_FNAME_DIGEST_SIZE];
142};
143
144/**
145 * fscrypt_match_name() - test whether the given name matches a directory entry
146 * @fname: the name being searched for
147 * @de_name: the name from the directory entry
148 * @de_name_len: the length of @de_name in bytes
149 *
150 * Normally @fname->disk_name will be set, and in that case we simply compare
151 * that to the name stored in the directory entry. The only exception is that
152 * if we don't have the key for an encrypted directory and a filename in it is
153 * very long, then we won't have the full disk_name and we'll instead need to
154 * match against the fscrypt_digested_name.
155 *
156 * Return: %true if the name matches, otherwise %false.
157 */
158static inline bool fscrypt_match_name(const struct fscrypt_name *fname,
159 const u8 *de_name, u32 de_name_len)
160{
161 if (unlikely(!fname->disk_name.name)) {
162 const struct fscrypt_digested_name *n =
163 (const void *)fname->crypto_buf.name;
164 if (WARN_ON_ONCE(fname->usr_fname->name[0] != '_'))
165 return false;
166 if (de_name_len <= FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE)
167 return false;
168 return !memcmp(FSCRYPT_FNAME_DIGEST(de_name, de_name_len),
169 n->digest, FSCRYPT_FNAME_DIGEST_SIZE);
170 }
171
172 if (de_name_len != fname->disk_name.len)
173 return false;
174 return !memcmp(de_name, fname->disk_name.name, fname->disk_name.len);
175}
176
177/* bio.c */
178extern void fscrypt_decrypt_bio(struct bio *);
179extern void fscrypt_enqueue_decrypt_bio(struct fscrypt_ctx *ctx,
180 struct bio *bio);
181extern void fscrypt_pullback_bio_page(struct page **, bool);
182extern int fscrypt_zeroout_range(const struct inode *, pgoff_t, sector_t,
183 unsigned int);
184
185/* hooks.c */
186extern int fscrypt_file_open(struct inode *inode, struct file *filp);
187extern int __fscrypt_prepare_link(struct inode *inode, struct inode *dir);
188extern int __fscrypt_prepare_rename(struct inode *old_dir,
189 struct dentry *old_dentry,
190 struct inode *new_dir,
191 struct dentry *new_dentry,
192 unsigned int flags);
193extern int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry);
194extern int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,
195 unsigned int max_len,
196 struct fscrypt_str *disk_link);
197extern int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,
198 unsigned int len,
199 struct fscrypt_str *disk_link);
200extern const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,
201 unsigned int max_size,
202 struct delayed_call *done);
203
204#endif /* _LINUX_FSCRYPT_SUPP_H */
generated by cgit v1.2.2 (git 2.25.0) at 2025-09-13 02:15:51 -0400