~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/mm/process_vm_access.c

Version: ~ [ linux-5.15-rc5 ] ~ [ linux-5.14.11 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.72 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.152 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.210 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.250 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.286 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.288 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-or-later
  2 /*
  3  * linux/mm/process_vm_access.c
  4  *
  5  * Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp.
  6  */
  7 
  8 #include <linux/mm.h>
  9 #include <linux/uio.h>
 10 #include <linux/sched.h>
 11 #include <linux/sched/mm.h>
 12 #include <linux/highmem.h>
 13 #include <linux/ptrace.h>
 14 #include <linux/slab.h>
 15 #include <linux/syscalls.h>
 16 
 17 #ifdef CONFIG_COMPAT
 18 #include <linux/compat.h>
 19 #endif
 20 
 21 /**
 22  * process_vm_rw_pages - read/write pages from task specified
 23  * @pages: array of pointers to pages we want to copy
 24  * @offset: offset in page to start copying from/to
 25  * @len: number of bytes to copy
 26  * @iter: where to copy to/from locally
 27  * @vm_write: 0 means copy from, 1 means copy to
 28  * Returns 0 on success, error code otherwise
 29  */
 30 static int process_vm_rw_pages(struct page **pages,
 31                                unsigned offset,
 32                                size_t len,
 33                                struct iov_iter *iter,
 34                                int vm_write)
 35 {
 36         /* Do the copy for each page */
 37         while (len && iov_iter_count(iter)) {
 38                 struct page *page = *pages++;
 39                 size_t copy = PAGE_SIZE - offset;
 40                 size_t copied;
 41 
 42                 if (copy > len)
 43                         copy = len;
 44 
 45                 if (vm_write) {
 46                         copied = copy_page_from_iter(page, offset, copy, iter);
 47                         set_page_dirty_lock(page);
 48                 } else {
 49                         copied = copy_page_to_iter(page, offset, copy, iter);
 50                 }
 51                 len -= copied;
 52                 if (copied < copy && iov_iter_count(iter))
 53                         return -EFAULT;
 54                 offset = 0;
 55         }
 56         return 0;
 57 }
 58 
 59 /* Maximum number of pages kmalloc'd to hold struct page's during copy */
 60 #define PVM_MAX_KMALLOC_PAGES (PAGE_SIZE * 2)
 61 
 62 /**
 63  * process_vm_rw_single_vec - read/write pages from task specified
 64  * @addr: start memory address of target process
 65  * @len: size of area to copy to/from
 66  * @iter: where to copy to/from locally
 67  * @process_pages: struct pages area that can store at least
 68  *  nr_pages_to_copy struct page pointers
 69  * @mm: mm for task
 70  * @task: task to read/write from
 71  * @vm_write: 0 means copy from, 1 means copy to
 72  * Returns 0 on success or on failure error code
 73  */
 74 static int process_vm_rw_single_vec(unsigned long addr,
 75                                     unsigned long len,
 76                                     struct iov_iter *iter,
 77                                     struct page **process_pages,
 78                                     struct mm_struct *mm,
 79                                     struct task_struct *task,
 80                                     int vm_write)
 81 {
 82         unsigned long pa = addr & PAGE_MASK;
 83         unsigned long start_offset = addr - pa;
 84         unsigned long nr_pages;
 85         ssize_t rc = 0;
 86         unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES
 87                 / sizeof(struct pages *);
 88         unsigned int flags = 0;
 89 
 90         /* Work out address and page range required */
 91         if (len == 0)
 92                 return 0;
 93         nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1;
 94 
 95         if (vm_write)
 96                 flags |= FOLL_WRITE;
 97 
 98         while (!rc && nr_pages && iov_iter_count(iter)) {
 99                 int pages = min(nr_pages, max_pages_per_loop);
100                 int locked = 1;
101                 size_t bytes;
102 
103                 /*
104                  * Get the pages we're interested in.  We must
105                  * access remotely because task/mm might not
106                  * current/current->mm
107                  */
108                 down_read(&mm->mmap_sem);
109                 pages = get_user_pages_remote(task, mm, pa, pages, flags,
110                                               process_pages, NULL, &locked);
111                 if (locked)
112                         up_read(&mm->mmap_sem);
113                 if (pages <= 0)
114                         return -EFAULT;
115 
116                 bytes = pages * PAGE_SIZE - start_offset;
117                 if (bytes > len)
118                         bytes = len;
119 
120                 rc = process_vm_rw_pages(process_pages,
121                                          start_offset, bytes, iter,
122                                          vm_write);
123                 len -= bytes;
124                 start_offset = 0;
125                 nr_pages -= pages;
126                 pa += pages * PAGE_SIZE;
127                 while (pages)
128                         put_page(process_pages[--pages]);
129         }
130 
131         return rc;
132 }
133 
134 /* Maximum number of entries for process pages array
135    which lives on stack */
136 #define PVM_MAX_PP_ARRAY_COUNT 16
137 
138 /**
139  * process_vm_rw_core - core of reading/writing pages from task specified
140  * @pid: PID of process to read/write from/to
141  * @iter: where to copy to/from locally
142  * @rvec: iovec array specifying where to copy to/from in the other process
143  * @riovcnt: size of rvec array
144  * @flags: currently unused
145  * @vm_write: 0 if reading from other process, 1 if writing to other process
146  *
147  * Returns the number of bytes read/written or error code. May
148  *  return less bytes than expected if an error occurs during the copying
149  *  process.
150  */
151 static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
152                                   const struct iovec *rvec,
153                                   unsigned long riovcnt,
154                                   unsigned long flags, int vm_write)
155 {
156         struct task_struct *task;
157         struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT];
158         struct page **process_pages = pp_stack;
159         struct mm_struct *mm;
160         unsigned long i;
161         ssize_t rc = 0;
162         unsigned long nr_pages = 0;
163         unsigned long nr_pages_iov;
164         ssize_t iov_len;
165         size_t total_len = iov_iter_count(iter);
166 
167         /*
168          * Work out how many pages of struct pages we're going to need
169          * when eventually calling get_user_pages
170          */
171         for (i = 0; i < riovcnt; i++) {
172                 iov_len = rvec[i].iov_len;
173                 if (iov_len > 0) {
174                         nr_pages_iov = ((unsigned long)rvec[i].iov_base
175                                         + iov_len)
176                                 / PAGE_SIZE - (unsigned long)rvec[i].iov_base
177                                 / PAGE_SIZE + 1;
178                         nr_pages = max(nr_pages, nr_pages_iov);
179                 }
180         }
181 
182         if (nr_pages == 0)
183                 return 0;
184 
185         if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) {
186                 /* For reliability don't try to kmalloc more than
187                    2 pages worth */
188                 process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES,
189                                               sizeof(struct pages *)*nr_pages),
190                                         GFP_KERNEL);
191 
192                 if (!process_pages)
193                         return -ENOMEM;
194         }
195 
196         /* Get process information */
197         task = find_get_task_by_vpid(pid);
198         if (!task) {
199                 rc = -ESRCH;
200                 goto free_proc_pages;
201         }
202 
203         mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS);
204         if (!mm || IS_ERR(mm)) {
205                 rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
206                 /*
207                  * Explicitly map EACCES to EPERM as EPERM is a more a
208                  * appropriate error code for process_vw_readv/writev
209                  */
210                 if (rc == -EACCES)
211                         rc = -EPERM;
212                 goto put_task_struct;
213         }
214 
215         for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++)
216                 rc = process_vm_rw_single_vec(
217                         (unsigned long)rvec[i].iov_base, rvec[i].iov_len,
218                         iter, process_pages, mm, task, vm_write);
219 
220         /* copied = space before - space after */
221         total_len -= iov_iter_count(iter);
222 
223         /* If we have managed to copy any data at all then
224            we return the number of bytes copied. Otherwise
225            we return the error code */
226         if (total_len)
227                 rc = total_len;
228 
229         mmput(mm);
230 
231 put_task_struct:
232         put_task_struct(task);
233 
234 free_proc_pages:
235         if (process_pages != pp_stack)
236                 kfree(process_pages);
237         return rc;
238 }
239 
240 /**
241  * process_vm_rw - check iovecs before calling core routine
242  * @pid: PID of process to read/write from/to
243  * @lvec: iovec array specifying where to copy to/from locally
244  * @liovcnt: size of lvec array
245  * @rvec: iovec array specifying where to copy to/from in the other process
246  * @riovcnt: size of rvec array
247  * @flags: currently unused
248  * @vm_write: 0 if reading from other process, 1 if writing to other process
249  *
250  * Returns the number of bytes read/written or error code. May
251  *  return less bytes than expected if an error occurs during the copying
252  *  process.
253  */
254 static ssize_t process_vm_rw(pid_t pid,
255                              const struct iovec __user *lvec,
256                              unsigned long liovcnt,
257                              const struct iovec __user *rvec,
258                              unsigned long riovcnt,
259                              unsigned long flags, int vm_write)
260 {
261         struct iovec iovstack_l[UIO_FASTIOV];
262         struct iovec iovstack_r[UIO_FASTIOV];
263         struct iovec *iov_l = iovstack_l;
264         struct iovec *iov_r = iovstack_r;
265         struct iov_iter iter;
266         ssize_t rc;
267         int dir = vm_write ? WRITE : READ;
268 
269         if (flags != 0)
270                 return -EINVAL;
271 
272         /* Check iovecs */
273         rc = import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
274         if (rc < 0)
275                 return rc;
276         if (!iov_iter_count(&iter))
277                 goto free_iovecs;
278 
279         rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV,
280                                    iovstack_r, &iov_r);
281         if (rc <= 0)
282                 goto free_iovecs;
283 
284         rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
285 
286 free_iovecs:
287         if (iov_r != iovstack_r)
288                 kfree(iov_r);
289         kfree(iov_l);
290 
291         return rc;
292 }
293 
294 SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec,
295                 unsigned long, liovcnt, const struct iovec __user *, rvec,
296                 unsigned long, riovcnt, unsigned long, flags)
297 {
298         return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
299 }
300 
301 SYSCALL_DEFINE6(process_vm_writev, pid_t, pid,
302                 const struct iovec __user *, lvec,
303                 unsigned long, liovcnt, const struct iovec __user *, rvec,
304                 unsigned long, riovcnt, unsigned long, flags)
305 {
306         return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
307 }
308 
309 #ifdef CONFIG_COMPAT
310 
311 static ssize_t
312 compat_process_vm_rw(compat_pid_t pid,
313                      const struct compat_iovec __user *lvec,
314                      unsigned long liovcnt,
315                      const struct compat_iovec __user *rvec,
316                      unsigned long riovcnt,
317                      unsigned long flags, int vm_write)
318 {
319         struct iovec iovstack_l[UIO_FASTIOV];
320         struct iovec iovstack_r[UIO_FASTIOV];
321         struct iovec *iov_l = iovstack_l;
322         struct iovec *iov_r = iovstack_r;
323         struct iov_iter iter;
324         ssize_t rc = -EFAULT;
325         int dir = vm_write ? WRITE : READ;
326 
327         if (flags != 0)
328                 return -EINVAL;
329 
330         rc = compat_import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
331         if (rc < 0)
332                 return rc;
333         if (!iov_iter_count(&iter))
334                 goto free_iovecs;
335         rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt,
336                                           UIO_FASTIOV, iovstack_r,
337                                           &iov_r);
338         if (rc <= 0)
339                 goto free_iovecs;
340 
341         rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
342 
343 free_iovecs:
344         if (iov_r != iovstack_r)
345                 kfree(iov_r);
346         kfree(iov_l);
347         return rc;
348 }
349 
350 COMPAT_SYSCALL_DEFINE6(process_vm_readv, compat_pid_t, pid,
351                        const struct compat_iovec __user *, lvec,
352                        compat_ulong_t, liovcnt,
353                        const struct compat_iovec __user *, rvec,
354                        compat_ulong_t, riovcnt,
355                        compat_ulong_t, flags)
356 {
357         return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
358                                     riovcnt, flags, 0);
359 }
360 
361 COMPAT_SYSCALL_DEFINE6(process_vm_writev, compat_pid_t, pid,
362                        const struct compat_iovec __user *, lvec,
363                        compat_ulong_t, liovcnt,
364                        const struct compat_iovec __user *, rvec,
365                        compat_ulong_t, riovcnt,
366                        compat_ulong_t, flags)
367 {
368         return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
369                                     riovcnt, flags, 1);
370 }
371 
372 #endif
373 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp