On Fri, Jun 25, 2021 at 09:58:14AM -0400, Jeff Layton wrote: > Most filesystems just call fscrypt_set_context on new inodes, which > usually causes a setxattr. That's a bit late for ceph, which can send > along a full set of attributes with the create request. > > Doing so allows it to avoid race windows that where the new inode could > be seen by other clients without the crypto context attached. It also > avoids the separate round trip to the server. > > Refactor the fscrypt code a bit to allow us to create a new crypto > context, attach it to the inode, and write it to the buffer, but without > calling set_context on it. ceph can later use this to marshal the > context into the attributes we send along with the create request. > > Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx> > --- > fs/crypto/policy.c | 34 ++++++++++++++++++++++++++++------ > include/linux/fscrypt.h | 1 + > 2 files changed, 29 insertions(+), 6 deletions(-) > > diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c > index ed3d623724cd..6a895a31560f 100644 > --- a/fs/crypto/policy.c > +++ b/fs/crypto/policy.c > @@ -664,6 +664,31 @@ const union fscrypt_policy *fscrypt_policy_to_inherit(struct inode *dir) > return fscrypt_get_dummy_policy(dir->i_sb); > } > > +/** > + * fscrypt_context_for_new_inode() - create an encryption context for a new inode > + * @ctx: where context should be written > + * @inode: inode from which to fetch policy and nonce > + * > + * Given an in-core "prepared" (via fscrypt_prepare_new_inode) inode, > + * generate a new context and write it to ctx. ctx _must_ be at least > + * FSCRYPT_SET_CONTEXT_MAX_SIZE bytes. > + * > + * Returns size of the resulting context or a negative error code. > + */ > +int fscrypt_context_for_new_inode(void *ctx, struct inode *inode) This generates a kerneldoc warning because "Returns" should be "Return:". - Eric
