[PATCH v5 13/13] fsverity: check IS_VERITY() in fsverity_cleanup_inode()
From: Eric Biggers <ebiggers@kernel.org>
Date: 2025-08-10 08:00:13
Also in:
ceph-devel, linux-btrfs, linux-f2fs-devel, linux-fscrypt, linux-fsdevel
Subsystem:
fsverity: read-only file-based authenticity protection, the rest · Maintainers:
Eric Biggers, Theodore Y. Ts'o, Linus Torvalds
Since getting the address of the fsverity_info has gotten a bit more expensive, make fsverity_cleanup_inode() check for IS_VERITY() instead. This avoids adding more overhead to non-verity files. This assumes that verity info is never set when !IS_VERITY(), which is currently true, but add a VFS_WARN_ON_ONCE() that asserts that. (This of course defeats the optimization, but only when CONFIG_VFS_DEBUG=y.) Signed-off-by: Eric Biggers <ebiggers@kernel.org> --- include/linux/fsverity.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h
index 844f7b8b56bbc..5bc7280425a71 100644
--- a/include/linux/fsverity.h
+++ b/include/linux/fsverity.h@@ -188,12 +188,19 @@ void __fsverity_cleanup_inode(struct inode *inode); * * Filesystems must call this on inode eviction to free the inode's verity info. */ static inline void fsverity_cleanup_inode(struct inode *inode) { - if (*fsverity_info_addr(inode)) + /* + * Only IS_VERITY() inodes can have verity info, so start by checking + * for IS_VERITY() (which is faster than retrieving the pointer to the + * verity info). This minimizes overhead for non-verity inodes. + */ + if (IS_VERITY(inode)) __fsverity_cleanup_inode(inode); + else + VFS_WARN_ON_ONCE(*fsverity_info_addr(inode) != NULL); } /* read_metadata.c */ int fsverity_ioctl_read_metadata(struct file *filp, const void __user *uarg);
--
2.50.1