blob: 17a2b52b753b0c5ac855abeed9cc5a2934685bd0 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * mm/mprotect.c
3 *
4 * (C) Copyright 1994 Linus Torvalds
5 * (C) Copyright 2002 Christoph Hellwig
6 *
7 * Address space accounting code <alan@redhat.com>
8 * (C) Copyright 2002 Red Hat Inc, All Rights Reserved
9 */
10
11#include <linux/mm.h>
12#include <linux/hugetlb.h>
13#include <linux/slab.h>
14#include <linux/shm.h>
15#include <linux/mman.h>
16#include <linux/fs.h>
17#include <linux/highmem.h>
18#include <linux/security.h>
19#include <linux/mempolicy.h>
20#include <linux/personality.h>
21#include <linux/syscalls.h>
22
23#include <asm/uaccess.h>
24#include <asm/pgtable.h>
25#include <asm/cacheflush.h>
26#include <asm/tlbflush.h>
27
28static void change_pte_range(struct mm_struct *mm, pmd_t *pmd,
29 unsigned long addr, unsigned long end, pgprot_t newprot)
30{
31 pte_t *pte;
Hugh Dickins705e87c2005-10-29 18:16:27 -070032 spinlock_t *ptl;
Linus Torvalds1da177e2005-04-16 15:20:36 -070033
Hugh Dickins705e87c2005-10-29 18:16:27 -070034 pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -070035 do {
36 if (pte_present(*pte)) {
37 pte_t ptent;
38
39 /* Avoid an SMP race with hardware updated dirty/clean
40 * bits by wiping the pte and then setting the new pte
41 * into place.
42 */
43 ptent = pte_modify(ptep_get_and_clear(mm, addr, pte), newprot);
44 set_pte_at(mm, addr, pte, ptent);
45 lazy_mmu_prot_update(ptent);
46 }
47 } while (pte++, addr += PAGE_SIZE, addr != end);
Hugh Dickins705e87c2005-10-29 18:16:27 -070048 pte_unmap_unlock(pte - 1, ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -070049}
50
51static inline void change_pmd_range(struct mm_struct *mm, pud_t *pud,
52 unsigned long addr, unsigned long end, pgprot_t newprot)
53{
54 pmd_t *pmd;
55 unsigned long next;
56
57 pmd = pmd_offset(pud, addr);
58 do {
59 next = pmd_addr_end(addr, end);
60 if (pmd_none_or_clear_bad(pmd))
61 continue;
62 change_pte_range(mm, pmd, addr, next, newprot);
63 } while (pmd++, addr = next, addr != end);
64}
65
66static inline void change_pud_range(struct mm_struct *mm, pgd_t *pgd,
67 unsigned long addr, unsigned long end, pgprot_t newprot)
68{
69 pud_t *pud;
70 unsigned long next;
71
72 pud = pud_offset(pgd, addr);
73 do {
74 next = pud_addr_end(addr, end);
75 if (pud_none_or_clear_bad(pud))
76 continue;
77 change_pmd_range(mm, pud, addr, next, newprot);
78 } while (pud++, addr = next, addr != end);
79}
80
81static void change_protection(struct vm_area_struct *vma,
82 unsigned long addr, unsigned long end, pgprot_t newprot)
83{
84 struct mm_struct *mm = vma->vm_mm;
85 pgd_t *pgd;
86 unsigned long next;
87 unsigned long start = addr;
88
89 BUG_ON(addr >= end);
90 pgd = pgd_offset(mm, addr);
91 flush_cache_range(vma, addr, end);
Linus Torvalds1da177e2005-04-16 15:20:36 -070092 do {
93 next = pgd_addr_end(addr, end);
94 if (pgd_none_or_clear_bad(pgd))
95 continue;
96 change_pud_range(mm, pgd, addr, next, newprot);
97 } while (pgd++, addr = next, addr != end);
98 flush_tlb_range(vma, start, end);
Linus Torvalds1da177e2005-04-16 15:20:36 -070099}
100
101static int
102mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
103 unsigned long start, unsigned long end, unsigned long newflags)
104{
105 struct mm_struct *mm = vma->vm_mm;
106 unsigned long oldflags = vma->vm_flags;
107 long nrpages = (end - start) >> PAGE_SHIFT;
108 unsigned long charged = 0;
109 pgprot_t newprot;
110 pgoff_t pgoff;
111 int error;
112
113 if (newflags == oldflags) {
114 *pprev = vma;
115 return 0;
116 }
117
118 /*
119 * If we make a private mapping writable we increase our commit;
120 * but (without finer accounting) cannot reduce our commit if we
121 * make it unwritable again.
122 *
123 * FIXME? We haven't defined a VM_NORESERVE flag, so mprotecting
124 * a MAP_NORESERVE private mapping to writable will now reserve.
125 */
126 if (newflags & VM_WRITE) {
Nick Pigginb5810032005-10-29 18:16:12 -0700127 if (oldflags & VM_RESERVED) {
128 BUG_ON(oldflags & VM_WRITE);
129 printk(KERN_WARNING "program %s is using MAP_PRIVATE, "
130 "PROT_WRITE mprotect of VM_RESERVED memory, "
131 "which is deprecated. Please report this to "
132 "linux-kernel@vger.kernel.org\n",current->comm);
133 return -EACCES;
134 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700135 if (!(oldflags & (VM_ACCOUNT|VM_WRITE|VM_SHARED|VM_HUGETLB))) {
136 charged = nrpages;
137 if (security_vm_enough_memory(charged))
138 return -ENOMEM;
139 newflags |= VM_ACCOUNT;
140 }
141 }
142
143 newprot = protection_map[newflags & 0xf];
144
145 /*
146 * First try to merge with previous and/or next vma.
147 */
148 pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT);
149 *pprev = vma_merge(mm, *pprev, start, end, newflags,
150 vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma));
151 if (*pprev) {
152 vma = *pprev;
153 goto success;
154 }
155
156 *pprev = vma;
157
158 if (start != vma->vm_start) {
159 error = split_vma(mm, vma, start, 1);
160 if (error)
161 goto fail;
162 }
163
164 if (end != vma->vm_end) {
165 error = split_vma(mm, vma, end, 0);
166 if (error)
167 goto fail;
168 }
169
170success:
171 /*
172 * vm_flags and vm_page_prot are protected by the mmap_sem
173 * held in write mode.
174 */
175 vma->vm_flags = newflags;
176 vma->vm_page_prot = newprot;
177 change_protection(vma, start, end, newprot);
Hugh Dickinsab50b8e2005-10-29 18:15:56 -0700178 vm_stat_account(mm, oldflags, vma->vm_file, -nrpages);
179 vm_stat_account(mm, newflags, vma->vm_file, nrpages);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700180 return 0;
181
182fail:
183 vm_unacct_memory(charged);
184 return error;
185}
186
187asmlinkage long
188sys_mprotect(unsigned long start, size_t len, unsigned long prot)
189{
190 unsigned long vm_flags, nstart, end, tmp, reqprot;
191 struct vm_area_struct *vma, *prev;
192 int error = -EINVAL;
193 const int grows = prot & (PROT_GROWSDOWN|PROT_GROWSUP);
194 prot &= ~(PROT_GROWSDOWN|PROT_GROWSUP);
195 if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
196 return -EINVAL;
197
198 if (start & ~PAGE_MASK)
199 return -EINVAL;
200 if (!len)
201 return 0;
202 len = PAGE_ALIGN(len);
203 end = start + len;
204 if (end <= start)
205 return -ENOMEM;
206 if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM))
207 return -EINVAL;
208
209 reqprot = prot;
210 /*
211 * Does the application expect PROT_READ to imply PROT_EXEC:
212 */
213 if (unlikely((prot & PROT_READ) &&
214 (current->personality & READ_IMPLIES_EXEC)))
215 prot |= PROT_EXEC;
216
217 vm_flags = calc_vm_prot_bits(prot);
218
219 down_write(&current->mm->mmap_sem);
220
221 vma = find_vma_prev(current->mm, start, &prev);
222 error = -ENOMEM;
223 if (!vma)
224 goto out;
225 if (unlikely(grows & PROT_GROWSDOWN)) {
226 if (vma->vm_start >= end)
227 goto out;
228 start = vma->vm_start;
229 error = -EINVAL;
230 if (!(vma->vm_flags & VM_GROWSDOWN))
231 goto out;
232 }
233 else {
234 if (vma->vm_start > start)
235 goto out;
236 if (unlikely(grows & PROT_GROWSUP)) {
237 end = vma->vm_end;
238 error = -EINVAL;
239 if (!(vma->vm_flags & VM_GROWSUP))
240 goto out;
241 }
242 }
243 if (start > vma->vm_start)
244 prev = vma;
245
246 for (nstart = start ; ; ) {
247 unsigned long newflags;
248
249 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
250
251 if (is_vm_hugetlb_page(vma)) {
252 error = -EACCES;
253 goto out;
254 }
255
256 newflags = vm_flags | (vma->vm_flags & ~(VM_READ | VM_WRITE | VM_EXEC));
257
Paolo 'Blaisorblade' Giarrusso7e2cff42005-09-21 09:55:39 -0700258 /* newflags >> 4 shift VM_MAY% in place of VM_% */
259 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 error = -EACCES;
261 goto out;
262 }
263
264 error = security_file_mprotect(vma, reqprot, prot);
265 if (error)
266 goto out;
267
268 tmp = vma->vm_end;
269 if (tmp > end)
270 tmp = end;
271 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
272 if (error)
273 goto out;
274 nstart = tmp;
275
276 if (nstart < prev->vm_end)
277 nstart = prev->vm_end;
278 if (nstart >= end)
279 goto out;
280
281 vma = prev->vm_next;
282 if (!vma || vma->vm_start != nstart) {
283 error = -ENOMEM;
284 goto out;
285 }
286 }
287out:
288 up_write(&current->mm->mmap_sem);
289 return error;
290}