blob: be8dc8d1edb95b34d8c6b7fbf34321e597e981e1 [file] [log] [blame]
Christopher Yeohfcf63402011-10-31 17:06:39 -07001/*
2 * linux/mm/process_vm_access.c
3 *
4 * Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp.
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/mm.h>
13#include <linux/uio.h>
14#include <linux/sched.h>
15#include <linux/highmem.h>
16#include <linux/ptrace.h>
17#include <linux/slab.h>
18#include <linux/syscalls.h>
19
20#ifdef CONFIG_COMPAT
21#include <linux/compat.h>
22#endif
23
24/**
25 * process_vm_rw_pages - read/write pages from task specified
Al Viro4bafbec2014-02-05 13:25:32 -050026 * @pages: array of pointers to pages we want to copy
Christopher Yeohfcf63402011-10-31 17:06:39 -070027 * @start_offset: offset in page to start copying from/to
28 * @len: number of bytes to copy
Al Viro4bafbec2014-02-05 13:25:32 -050029 * @iter: where to copy to/from locally
Christopher Yeohfcf63402011-10-31 17:06:39 -070030 * @vm_write: 0 means copy from, 1 means copy to
Christopher Yeohfcf63402011-10-31 17:06:39 -070031 * Returns 0 on success, error code otherwise
32 */
Al Viro70eca122014-02-05 12:44:24 -050033static int process_vm_rw_pages(struct page **pages,
34 unsigned offset,
Al Viroe21345f2014-02-05 12:55:11 -050035 size_t len,
Al Viro9f78bdf2014-02-05 11:51:53 -050036 struct iov_iter *iter,
Al Viro9acc1a02014-02-05 13:15:28 -050037 int vm_write)
Christopher Yeohfcf63402011-10-31 17:06:39 -070038{
Christopher Yeohfcf63402011-10-31 17:06:39 -070039 /* Do the copy for each page */
Al Viro9acc1a02014-02-05 13:15:28 -050040 while (len && iov_iter_count(iter)) {
Al Viro70eca122014-02-05 12:44:24 -050041 struct page *page = *pages++;
Al Viroe21345f2014-02-05 12:55:11 -050042 size_t copy = PAGE_SIZE - offset;
Al Viro70eca122014-02-05 12:44:24 -050043 size_t copied;
Christopher Yeohfcf63402011-10-31 17:06:39 -070044
Al Viroe21345f2014-02-05 12:55:11 -050045 if (copy > len)
46 copy = len;
Christopher Yeohfcf63402011-10-31 17:06:39 -070047
Al Viro240f3902014-02-05 12:14:11 -050048 if (vm_write) {
Al Viroe7c24602014-04-10 20:54:51 -040049 copied = copy_page_from_iter(page, offset, copy, iter);
Al Viro240f3902014-02-05 12:14:11 -050050 set_page_dirty_lock(page);
Christopher Yeohfcf63402011-10-31 17:06:39 -070051 } else {
Al Viro70eca122014-02-05 12:44:24 -050052 copied = copy_page_to_iter(page, offset, copy, iter);
Christopher Yeohfcf63402011-10-31 17:06:39 -070053 }
Al Viro70eca122014-02-05 12:44:24 -050054 len -= copied;
55 if (copied < copy && iov_iter_count(iter))
56 return -EFAULT;
57 offset = 0;
Christopher Yeohfcf63402011-10-31 17:06:39 -070058 }
Al Viro70eca122014-02-05 12:44:24 -050059 return 0;
Christopher Yeohfcf63402011-10-31 17:06:39 -070060}
61
62/* Maximum number of pages kmalloc'd to hold struct page's during copy */
63#define PVM_MAX_KMALLOC_PAGES (PAGE_SIZE * 2)
64
65/**
66 * process_vm_rw_single_vec - read/write pages from task specified
67 * @addr: start memory address of target process
68 * @len: size of area to copy to/from
Al Viro4bafbec2014-02-05 13:25:32 -050069 * @iter: where to copy to/from locally
Christopher Yeohfcf63402011-10-31 17:06:39 -070070 * @process_pages: struct pages area that can store at least
71 * nr_pages_to_copy struct page pointers
72 * @mm: mm for task
73 * @task: task to read/write from
74 * @vm_write: 0 means copy from, 1 means copy to
Christopher Yeohfcf63402011-10-31 17:06:39 -070075 * Returns 0 on success or on failure error code
76 */
77static int process_vm_rw_single_vec(unsigned long addr,
78 unsigned long len,
Al Viro9f78bdf2014-02-05 11:51:53 -050079 struct iov_iter *iter,
Christopher Yeohfcf63402011-10-31 17:06:39 -070080 struct page **process_pages,
81 struct mm_struct *mm,
82 struct task_struct *task,
Al Viro9acc1a02014-02-05 13:15:28 -050083 int vm_write)
Christopher Yeohfcf63402011-10-31 17:06:39 -070084{
85 unsigned long pa = addr & PAGE_MASK;
86 unsigned long start_offset = addr - pa;
87 unsigned long nr_pages;
Christopher Yeohfcf63402011-10-31 17:06:39 -070088 ssize_t rc = 0;
Christopher Yeohfcf63402011-10-31 17:06:39 -070089 unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES
90 / sizeof(struct pages *);
Lorenzo Stoakesd4944b02016-10-13 01:20:12 +010091 unsigned int flags = FOLL_REMOTE;
Christopher Yeohfcf63402011-10-31 17:06:39 -070092
Christopher Yeohfcf63402011-10-31 17:06:39 -070093 /* Work out address and page range required */
94 if (len == 0)
95 return 0;
96 nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1;
97
Lorenzo Stoakesd4944b02016-10-13 01:20:12 +010098 if (vm_write)
99 flags |= FOLL_WRITE;
100
Al Viro4bafbec2014-02-05 13:25:32 -0500101 while (!rc && nr_pages && iov_iter_count(iter)) {
102 int pages = min(nr_pages, max_pages_per_loop);
103 size_t bytes;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700104
Dave Hansen1e987792016-02-12 13:01:54 -0800105 /*
106 * Get the pages we're interested in. We must
107 * add FOLL_REMOTE because task/mm might not
108 * current/current->mm
109 */
110 pages = __get_user_pages_unlocked(task, mm, pa, pages,
Lorenzo Stoakesd4944b02016-10-13 01:20:12 +0100111 process_pages, flags);
Al Viro4bafbec2014-02-05 13:25:32 -0500112 if (pages <= 0)
Al Viro70eca122014-02-05 12:44:24 -0500113 return -EFAULT;
114
Al Viro4bafbec2014-02-05 13:25:32 -0500115 bytes = pages * PAGE_SIZE - start_offset;
116 if (bytes > len)
117 bytes = len;
Al Viroe21345f2014-02-05 12:55:11 -0500118
Al Viro70eca122014-02-05 12:44:24 -0500119 rc = process_vm_rw_pages(process_pages,
Al Viro4bafbec2014-02-05 13:25:32 -0500120 start_offset, bytes, iter,
Al Viro9acc1a02014-02-05 13:15:28 -0500121 vm_write);
Al Viro4bafbec2014-02-05 13:25:32 -0500122 len -= bytes;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700123 start_offset = 0;
Al Viro4bafbec2014-02-05 13:25:32 -0500124 nr_pages -= pages;
125 pa += pages * PAGE_SIZE;
126 while (pages)
127 put_page(process_pages[--pages]);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700128 }
129
130 return rc;
131}
132
133/* Maximum number of entries for process pages array
134 which lives on stack */
135#define PVM_MAX_PP_ARRAY_COUNT 16
136
137/**
138 * process_vm_rw_core - core of reading/writing pages from task specified
139 * @pid: PID of process to read/write from/to
Al Viro4bafbec2014-02-05 13:25:32 -0500140 * @iter: where to copy to/from locally
Christopher Yeohfcf63402011-10-31 17:06:39 -0700141 * @rvec: iovec array specifying where to copy to/from in the other process
142 * @riovcnt: size of rvec array
143 * @flags: currently unused
144 * @vm_write: 0 if reading from other process, 1 if writing to other process
145 * Returns the number of bytes read/written or error code. May
146 * return less bytes than expected if an error occurs during the copying
147 * process.
148 */
Al Viro9f78bdf2014-02-05 11:51:53 -0500149static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
Christopher Yeohfcf63402011-10-31 17:06:39 -0700150 const struct iovec *rvec,
151 unsigned long riovcnt,
152 unsigned long flags, int vm_write)
153{
154 struct task_struct *task;
155 struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT];
156 struct page **process_pages = pp_stack;
157 struct mm_struct *mm;
158 unsigned long i;
159 ssize_t rc = 0;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700160 unsigned long nr_pages = 0;
161 unsigned long nr_pages_iov;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700162 ssize_t iov_len;
Al Viro9acc1a02014-02-05 13:15:28 -0500163 size_t total_len = iov_iter_count(iter);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700164
165 /*
166 * Work out how many pages of struct pages we're going to need
167 * when eventually calling get_user_pages
168 */
169 for (i = 0; i < riovcnt; i++) {
170 iov_len = rvec[i].iov_len;
171 if (iov_len > 0) {
172 nr_pages_iov = ((unsigned long)rvec[i].iov_base
173 + iov_len)
174 / PAGE_SIZE - (unsigned long)rvec[i].iov_base
175 / PAGE_SIZE + 1;
176 nr_pages = max(nr_pages, nr_pages_iov);
177 }
178 }
179
180 if (nr_pages == 0)
181 return 0;
182
183 if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) {
184 /* For reliability don't try to kmalloc more than
185 2 pages worth */
186 process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES,
187 sizeof(struct pages *)*nr_pages),
188 GFP_KERNEL);
189
190 if (!process_pages)
191 return -ENOMEM;
192 }
193
194 /* Get process information */
195 rcu_read_lock();
196 task = find_task_by_vpid(pid);
197 if (task)
198 get_task_struct(task);
199 rcu_read_unlock();
200 if (!task) {
201 rc = -ESRCH;
202 goto free_proc_pages;
203 }
204
Jann Horncaaee622016-01-20 15:00:04 -0800205 mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS);
Christopher Yeoh8cdb8782012-02-02 11:34:09 +1030206 if (!mm || IS_ERR(mm)) {
207 rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
208 /*
209 * Explicitly map EACCES to EPERM as EPERM is a more a
210 * appropriate error code for process_vw_readv/writev
211 */
212 if (rc == -EACCES)
213 rc = -EPERM;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700214 goto put_task_struct;
215 }
Christopher Yeohfcf63402011-10-31 17:06:39 -0700216
Al Viro9acc1a02014-02-05 13:15:28 -0500217 for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++)
Christopher Yeohfcf63402011-10-31 17:06:39 -0700218 rc = process_vm_rw_single_vec(
219 (unsigned long)rvec[i].iov_base, rvec[i].iov_len,
Al Viro9acc1a02014-02-05 13:15:28 -0500220 iter, process_pages, mm, task, vm_write);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700221
Al Viro9acc1a02014-02-05 13:15:28 -0500222 /* copied = space before - space after */
223 total_len -= iov_iter_count(iter);
224
225 /* If we have managed to copy any data at all then
226 we return the number of bytes copied. Otherwise
227 we return the error code */
228 if (total_len)
229 rc = total_len;
230
Christopher Yeohfcf63402011-10-31 17:06:39 -0700231 mmput(mm);
232
233put_task_struct:
234 put_task_struct(task);
235
236free_proc_pages:
237 if (process_pages != pp_stack)
238 kfree(process_pages);
239 return rc;
240}
241
242/**
243 * process_vm_rw - check iovecs before calling core routine
244 * @pid: PID of process to read/write from/to
245 * @lvec: iovec array specifying where to copy to/from locally
246 * @liovcnt: size of lvec array
247 * @rvec: iovec array specifying where to copy to/from in the other process
248 * @riovcnt: size of rvec array
249 * @flags: currently unused
250 * @vm_write: 0 if reading from other process, 1 if writing to other process
251 * Returns the number of bytes read/written or error code. May
252 * return less bytes than expected if an error occurs during the copying
253 * process.
254 */
255static ssize_t process_vm_rw(pid_t pid,
256 const struct iovec __user *lvec,
257 unsigned long liovcnt,
258 const struct iovec __user *rvec,
259 unsigned long riovcnt,
260 unsigned long flags, int vm_write)
261{
262 struct iovec iovstack_l[UIO_FASTIOV];
263 struct iovec iovstack_r[UIO_FASTIOV];
264 struct iovec *iov_l = iovstack_l;
265 struct iovec *iov_r = iovstack_r;
Al Viro9f78bdf2014-02-05 11:51:53 -0500266 struct iov_iter iter;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700267 ssize_t rc;
Al Viro17d17e72015-03-21 14:47:11 -0400268 int dir = vm_write ? WRITE : READ;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700269
270 if (flags != 0)
271 return -EINVAL;
272
273 /* Check iovecs */
Al Viro17d17e72015-03-21 14:47:11 -0400274 rc = import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
275 if (rc < 0)
276 return rc;
277 if (!iov_iter_count(&iter))
Christopher Yeohfcf63402011-10-31 17:06:39 -0700278 goto free_iovecs;
279
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700280 rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV,
281 iovstack_r, &iov_r);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700282 if (rc <= 0)
283 goto free_iovecs;
284
Al Viro9f78bdf2014-02-05 11:51:53 -0500285 rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700286
287free_iovecs:
288 if (iov_r != iovstack_r)
289 kfree(iov_r);
Al Viro17d17e72015-03-21 14:47:11 -0400290 kfree(iov_l);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700291
292 return rc;
293}
294
295SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec,
296 unsigned long, liovcnt, const struct iovec __user *, rvec,
297 unsigned long, riovcnt, unsigned long, flags)
298{
299 return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
300}
301
302SYSCALL_DEFINE6(process_vm_writev, pid_t, pid,
303 const struct iovec __user *, lvec,
304 unsigned long, liovcnt, const struct iovec __user *, rvec,
305 unsigned long, riovcnt, unsigned long, flags)
306{
307 return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
308}
309
310#ifdef CONFIG_COMPAT
311
Rashika Kheria2eb2e142014-04-03 14:48:04 -0700312static ssize_t
Christopher Yeohfcf63402011-10-31 17:06:39 -0700313compat_process_vm_rw(compat_pid_t pid,
314 const struct compat_iovec __user *lvec,
315 unsigned long liovcnt,
316 const struct compat_iovec __user *rvec,
317 unsigned long riovcnt,
318 unsigned long flags, int vm_write)
319{
320 struct iovec iovstack_l[UIO_FASTIOV];
321 struct iovec iovstack_r[UIO_FASTIOV];
322 struct iovec *iov_l = iovstack_l;
323 struct iovec *iov_r = iovstack_r;
Al Viro9f78bdf2014-02-05 11:51:53 -0500324 struct iov_iter iter;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700325 ssize_t rc = -EFAULT;
Al Viro17d17e72015-03-21 14:47:11 -0400326 int dir = vm_write ? WRITE : READ;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700327
328 if (flags != 0)
329 return -EINVAL;
330
Al Viro17d17e72015-03-21 14:47:11 -0400331 rc = compat_import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
332 if (rc < 0)
333 return rc;
334 if (!iov_iter_count(&iter))
Christopher Yeohfcf63402011-10-31 17:06:39 -0700335 goto free_iovecs;
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700336 rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt,
Christopher Yeohfcf63402011-10-31 17:06:39 -0700337 UIO_FASTIOV, iovstack_r,
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700338 &iov_r);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700339 if (rc <= 0)
340 goto free_iovecs;
341
Al Viro9f78bdf2014-02-05 11:51:53 -0500342 rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700343
344free_iovecs:
345 if (iov_r != iovstack_r)
346 kfree(iov_r);
Al Viro17d17e72015-03-21 14:47:11 -0400347 kfree(iov_l);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700348 return rc;
349}
350
Heiko Carstens2f2728f2014-03-04 17:18:23 +0100351COMPAT_SYSCALL_DEFINE6(process_vm_readv, compat_pid_t, pid,
352 const struct compat_iovec __user *, lvec,
353 compat_ulong_t, liovcnt,
354 const struct compat_iovec __user *, rvec,
355 compat_ulong_t, riovcnt,
356 compat_ulong_t, flags)
Christopher Yeohfcf63402011-10-31 17:06:39 -0700357{
358 return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
359 riovcnt, flags, 0);
360}
361
Heiko Carstens2f2728f2014-03-04 17:18:23 +0100362COMPAT_SYSCALL_DEFINE6(process_vm_writev, compat_pid_t, pid,
363 const struct compat_iovec __user *, lvec,
364 compat_ulong_t, liovcnt,
365 const struct compat_iovec __user *, rvec,
366 compat_ulong_t, riovcnt,
367 compat_ulong_t, flags)
Christopher Yeohfcf63402011-10-31 17:06:39 -0700368{
369 return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
370 riovcnt, flags, 1);
371}
372
373#endif