blob: 5077afcd9e116b16b17c7b0ed51930d570f88701 [file] [log] [blame]
Christopher Yeohfcf63402011-10-31 17:06:39 -07001/*
2 * linux/mm/process_vm_access.c
3 *
4 * Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp.
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/mm.h>
13#include <linux/uio.h>
14#include <linux/sched.h>
15#include <linux/highmem.h>
16#include <linux/ptrace.h>
17#include <linux/slab.h>
18#include <linux/syscalls.h>
19
20#ifdef CONFIG_COMPAT
21#include <linux/compat.h>
22#endif
23
24/**
25 * process_vm_rw_pages - read/write pages from task specified
Al Viro4bafbec2014-02-05 13:25:32 -050026 * @pages: array of pointers to pages we want to copy
Christopher Yeohfcf63402011-10-31 17:06:39 -070027 * @start_offset: offset in page to start copying from/to
28 * @len: number of bytes to copy
Al Viro4bafbec2014-02-05 13:25:32 -050029 * @iter: where to copy to/from locally
Christopher Yeohfcf63402011-10-31 17:06:39 -070030 * @vm_write: 0 means copy from, 1 means copy to
Christopher Yeohfcf63402011-10-31 17:06:39 -070031 * Returns 0 on success, error code otherwise
32 */
Al Viro70eca122014-02-05 12:44:24 -050033static int process_vm_rw_pages(struct page **pages,
34 unsigned offset,
Al Viroe21345f2014-02-05 12:55:11 -050035 size_t len,
Al Viro9f78bdf2014-02-05 11:51:53 -050036 struct iov_iter *iter,
Al Viro9acc1a02014-02-05 13:15:28 -050037 int vm_write)
Christopher Yeohfcf63402011-10-31 17:06:39 -070038{
Christopher Yeohfcf63402011-10-31 17:06:39 -070039 /* Do the copy for each page */
Al Viro9acc1a02014-02-05 13:15:28 -050040 while (len && iov_iter_count(iter)) {
Al Viro70eca122014-02-05 12:44:24 -050041 struct page *page = *pages++;
Al Viroe21345f2014-02-05 12:55:11 -050042 size_t copy = PAGE_SIZE - offset;
Al Viro70eca122014-02-05 12:44:24 -050043 size_t copied;
Christopher Yeohfcf63402011-10-31 17:06:39 -070044
Al Viroe21345f2014-02-05 12:55:11 -050045 if (copy > len)
46 copy = len;
Christopher Yeohfcf63402011-10-31 17:06:39 -070047
Al Viro240f3902014-02-05 12:14:11 -050048 if (vm_write) {
Al Viroe7c24602014-04-10 20:54:51 -040049 copied = copy_page_from_iter(page, offset, copy, iter);
Al Viro240f3902014-02-05 12:14:11 -050050 set_page_dirty_lock(page);
Christopher Yeohfcf63402011-10-31 17:06:39 -070051 } else {
Al Viro70eca122014-02-05 12:44:24 -050052 copied = copy_page_to_iter(page, offset, copy, iter);
Christopher Yeohfcf63402011-10-31 17:06:39 -070053 }
Al Viro70eca122014-02-05 12:44:24 -050054 len -= copied;
55 if (copied < copy && iov_iter_count(iter))
56 return -EFAULT;
57 offset = 0;
Christopher Yeohfcf63402011-10-31 17:06:39 -070058 }
Al Viro70eca122014-02-05 12:44:24 -050059 return 0;
Christopher Yeohfcf63402011-10-31 17:06:39 -070060}
61
62/* Maximum number of pages kmalloc'd to hold struct page's during copy */
63#define PVM_MAX_KMALLOC_PAGES (PAGE_SIZE * 2)
64
65/**
66 * process_vm_rw_single_vec - read/write pages from task specified
67 * @addr: start memory address of target process
68 * @len: size of area to copy to/from
Al Viro4bafbec2014-02-05 13:25:32 -050069 * @iter: where to copy to/from locally
Christopher Yeohfcf63402011-10-31 17:06:39 -070070 * @process_pages: struct pages area that can store at least
71 * nr_pages_to_copy struct page pointers
72 * @mm: mm for task
73 * @task: task to read/write from
74 * @vm_write: 0 means copy from, 1 means copy to
Christopher Yeohfcf63402011-10-31 17:06:39 -070075 * Returns 0 on success or on failure error code
76 */
77static int process_vm_rw_single_vec(unsigned long addr,
78 unsigned long len,
Al Viro9f78bdf2014-02-05 11:51:53 -050079 struct iov_iter *iter,
Christopher Yeohfcf63402011-10-31 17:06:39 -070080 struct page **process_pages,
81 struct mm_struct *mm,
82 struct task_struct *task,
Al Viro9acc1a02014-02-05 13:15:28 -050083 int vm_write)
Christopher Yeohfcf63402011-10-31 17:06:39 -070084{
85 unsigned long pa = addr & PAGE_MASK;
86 unsigned long start_offset = addr - pa;
87 unsigned long nr_pages;
Christopher Yeohfcf63402011-10-31 17:06:39 -070088 ssize_t rc = 0;
Christopher Yeohfcf63402011-10-31 17:06:39 -070089 unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES
90 / sizeof(struct pages *);
91
Christopher Yeohfcf63402011-10-31 17:06:39 -070092 /* Work out address and page range required */
93 if (len == 0)
94 return 0;
95 nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1;
96
Al Viro4bafbec2014-02-05 13:25:32 -050097 while (!rc && nr_pages && iov_iter_count(iter)) {
98 int pages = min(nr_pages, max_pages_per_loop);
99 size_t bytes;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700100
Al Viro70eca122014-02-05 12:44:24 -0500101 /* Get the pages we're interested in */
102 down_read(&mm->mmap_sem);
Al Viro4bafbec2014-02-05 13:25:32 -0500103 pages = get_user_pages(task, mm, pa, pages,
104 vm_write, 0, process_pages, NULL);
Al Viro70eca122014-02-05 12:44:24 -0500105 up_read(&mm->mmap_sem);
106
Al Viro4bafbec2014-02-05 13:25:32 -0500107 if (pages <= 0)
Al Viro70eca122014-02-05 12:44:24 -0500108 return -EFAULT;
109
Al Viro4bafbec2014-02-05 13:25:32 -0500110 bytes = pages * PAGE_SIZE - start_offset;
111 if (bytes > len)
112 bytes = len;
Al Viroe21345f2014-02-05 12:55:11 -0500113
Al Viro70eca122014-02-05 12:44:24 -0500114 rc = process_vm_rw_pages(process_pages,
Al Viro4bafbec2014-02-05 13:25:32 -0500115 start_offset, bytes, iter,
Al Viro9acc1a02014-02-05 13:15:28 -0500116 vm_write);
Al Viro4bafbec2014-02-05 13:25:32 -0500117 len -= bytes;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700118 start_offset = 0;
Al Viro4bafbec2014-02-05 13:25:32 -0500119 nr_pages -= pages;
120 pa += pages * PAGE_SIZE;
121 while (pages)
122 put_page(process_pages[--pages]);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700123 }
124
125 return rc;
126}
127
128/* Maximum number of entries for process pages array
129 which lives on stack */
130#define PVM_MAX_PP_ARRAY_COUNT 16
131
132/**
133 * process_vm_rw_core - core of reading/writing pages from task specified
134 * @pid: PID of process to read/write from/to
Al Viro4bafbec2014-02-05 13:25:32 -0500135 * @iter: where to copy to/from locally
Christopher Yeohfcf63402011-10-31 17:06:39 -0700136 * @rvec: iovec array specifying where to copy to/from in the other process
137 * @riovcnt: size of rvec array
138 * @flags: currently unused
139 * @vm_write: 0 if reading from other process, 1 if writing to other process
140 * Returns the number of bytes read/written or error code. May
141 * return less bytes than expected if an error occurs during the copying
142 * process.
143 */
Al Viro9f78bdf2014-02-05 11:51:53 -0500144static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
Christopher Yeohfcf63402011-10-31 17:06:39 -0700145 const struct iovec *rvec,
146 unsigned long riovcnt,
147 unsigned long flags, int vm_write)
148{
149 struct task_struct *task;
150 struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT];
151 struct page **process_pages = pp_stack;
152 struct mm_struct *mm;
153 unsigned long i;
154 ssize_t rc = 0;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700155 unsigned long nr_pages = 0;
156 unsigned long nr_pages_iov;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700157 ssize_t iov_len;
Al Viro9acc1a02014-02-05 13:15:28 -0500158 size_t total_len = iov_iter_count(iter);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700159
160 /*
161 * Work out how many pages of struct pages we're going to need
162 * when eventually calling get_user_pages
163 */
164 for (i = 0; i < riovcnt; i++) {
165 iov_len = rvec[i].iov_len;
166 if (iov_len > 0) {
167 nr_pages_iov = ((unsigned long)rvec[i].iov_base
168 + iov_len)
169 / PAGE_SIZE - (unsigned long)rvec[i].iov_base
170 / PAGE_SIZE + 1;
171 nr_pages = max(nr_pages, nr_pages_iov);
172 }
173 }
174
175 if (nr_pages == 0)
176 return 0;
177
178 if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) {
179 /* For reliability don't try to kmalloc more than
180 2 pages worth */
181 process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES,
182 sizeof(struct pages *)*nr_pages),
183 GFP_KERNEL);
184
185 if (!process_pages)
186 return -ENOMEM;
187 }
188
189 /* Get process information */
190 rcu_read_lock();
191 task = find_task_by_vpid(pid);
192 if (task)
193 get_task_struct(task);
194 rcu_read_unlock();
195 if (!task) {
196 rc = -ESRCH;
197 goto free_proc_pages;
198 }
199
Christopher Yeoh8cdb8782012-02-02 11:34:09 +1030200 mm = mm_access(task, PTRACE_MODE_ATTACH);
201 if (!mm || IS_ERR(mm)) {
202 rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
203 /*
204 * Explicitly map EACCES to EPERM as EPERM is a more a
205 * appropriate error code for process_vw_readv/writev
206 */
207 if (rc == -EACCES)
208 rc = -EPERM;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700209 goto put_task_struct;
210 }
Christopher Yeohfcf63402011-10-31 17:06:39 -0700211
Al Viro9acc1a02014-02-05 13:15:28 -0500212 for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++)
Christopher Yeohfcf63402011-10-31 17:06:39 -0700213 rc = process_vm_rw_single_vec(
214 (unsigned long)rvec[i].iov_base, rvec[i].iov_len,
Al Viro9acc1a02014-02-05 13:15:28 -0500215 iter, process_pages, mm, task, vm_write);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700216
Al Viro9acc1a02014-02-05 13:15:28 -0500217 /* copied = space before - space after */
218 total_len -= iov_iter_count(iter);
219
220 /* If we have managed to copy any data at all then
221 we return the number of bytes copied. Otherwise
222 we return the error code */
223 if (total_len)
224 rc = total_len;
225
Christopher Yeohfcf63402011-10-31 17:06:39 -0700226 mmput(mm);
227
228put_task_struct:
229 put_task_struct(task);
230
231free_proc_pages:
232 if (process_pages != pp_stack)
233 kfree(process_pages);
234 return rc;
235}
236
237/**
238 * process_vm_rw - check iovecs before calling core routine
239 * @pid: PID of process to read/write from/to
240 * @lvec: iovec array specifying where to copy to/from locally
241 * @liovcnt: size of lvec array
242 * @rvec: iovec array specifying where to copy to/from in the other process
243 * @riovcnt: size of rvec array
244 * @flags: currently unused
245 * @vm_write: 0 if reading from other process, 1 if writing to other process
246 * Returns the number of bytes read/written or error code. May
247 * return less bytes than expected if an error occurs during the copying
248 * process.
249 */
250static ssize_t process_vm_rw(pid_t pid,
251 const struct iovec __user *lvec,
252 unsigned long liovcnt,
253 const struct iovec __user *rvec,
254 unsigned long riovcnt,
255 unsigned long flags, int vm_write)
256{
257 struct iovec iovstack_l[UIO_FASTIOV];
258 struct iovec iovstack_r[UIO_FASTIOV];
259 struct iovec *iov_l = iovstack_l;
260 struct iovec *iov_r = iovstack_r;
Al Viro9f78bdf2014-02-05 11:51:53 -0500261 struct iov_iter iter;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700262 ssize_t rc;
263
264 if (flags != 0)
265 return -EINVAL;
266
267 /* Check iovecs */
268 if (vm_write)
269 rc = rw_copy_check_uvector(WRITE, lvec, liovcnt, UIO_FASTIOV,
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700270 iovstack_l, &iov_l);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700271 else
272 rc = rw_copy_check_uvector(READ, lvec, liovcnt, UIO_FASTIOV,
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700273 iovstack_l, &iov_l);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700274 if (rc <= 0)
275 goto free_iovecs;
276
Al Viro71d8e532014-03-05 19:28:09 -0500277 iov_iter_init(&iter, vm_write ? WRITE : READ, iov_l, liovcnt, rc);
Al Viro9f78bdf2014-02-05 11:51:53 -0500278
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700279 rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV,
280 iovstack_r, &iov_r);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700281 if (rc <= 0)
282 goto free_iovecs;
283
Al Viro9f78bdf2014-02-05 11:51:53 -0500284 rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700285
286free_iovecs:
287 if (iov_r != iovstack_r)
288 kfree(iov_r);
289 if (iov_l != iovstack_l)
290 kfree(iov_l);
291
292 return rc;
293}
294
295SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec,
296 unsigned long, liovcnt, const struct iovec __user *, rvec,
297 unsigned long, riovcnt, unsigned long, flags)
298{
299 return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
300}
301
302SYSCALL_DEFINE6(process_vm_writev, pid_t, pid,
303 const struct iovec __user *, lvec,
304 unsigned long, liovcnt, const struct iovec __user *, rvec,
305 unsigned long, riovcnt, unsigned long, flags)
306{
307 return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
308}
309
310#ifdef CONFIG_COMPAT
311
Rashika Kheria2eb2e142014-04-03 14:48:04 -0700312static ssize_t
Christopher Yeohfcf63402011-10-31 17:06:39 -0700313compat_process_vm_rw(compat_pid_t pid,
314 const struct compat_iovec __user *lvec,
315 unsigned long liovcnt,
316 const struct compat_iovec __user *rvec,
317 unsigned long riovcnt,
318 unsigned long flags, int vm_write)
319{
320 struct iovec iovstack_l[UIO_FASTIOV];
321 struct iovec iovstack_r[UIO_FASTIOV];
322 struct iovec *iov_l = iovstack_l;
323 struct iovec *iov_r = iovstack_r;
Al Viro9f78bdf2014-02-05 11:51:53 -0500324 struct iov_iter iter;
Christopher Yeohfcf63402011-10-31 17:06:39 -0700325 ssize_t rc = -EFAULT;
326
327 if (flags != 0)
328 return -EINVAL;
329
Christopher Yeohfcf63402011-10-31 17:06:39 -0700330 if (vm_write)
331 rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt,
332 UIO_FASTIOV, iovstack_l,
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700333 &iov_l);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700334 else
335 rc = compat_rw_copy_check_uvector(READ, lvec, liovcnt,
336 UIO_FASTIOV, iovstack_l,
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700337 &iov_l);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700338 if (rc <= 0)
339 goto free_iovecs;
Al Viro71d8e532014-03-05 19:28:09 -0500340 iov_iter_init(&iter, vm_write ? WRITE : READ, iov_l, liovcnt, rc);
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700341 rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt,
Christopher Yeohfcf63402011-10-31 17:06:39 -0700342 UIO_FASTIOV, iovstack_r,
Christopher Yeohac34ebb2012-05-31 16:26:42 -0700343 &iov_r);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700344 if (rc <= 0)
345 goto free_iovecs;
346
Al Viro9f78bdf2014-02-05 11:51:53 -0500347 rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700348
349free_iovecs:
350 if (iov_r != iovstack_r)
351 kfree(iov_r);
352 if (iov_l != iovstack_l)
353 kfree(iov_l);
Christopher Yeohfcf63402011-10-31 17:06:39 -0700354 return rc;
355}
356
Heiko Carstens2f2728f2014-03-04 17:18:23 +0100357COMPAT_SYSCALL_DEFINE6(process_vm_readv, compat_pid_t, pid,
358 const struct compat_iovec __user *, lvec,
359 compat_ulong_t, liovcnt,
360 const struct compat_iovec __user *, rvec,
361 compat_ulong_t, riovcnt,
362 compat_ulong_t, flags)
Christopher Yeohfcf63402011-10-31 17:06:39 -0700363{
364 return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
365 riovcnt, flags, 0);
366}
367
Heiko Carstens2f2728f2014-03-04 17:18:23 +0100368COMPAT_SYSCALL_DEFINE6(process_vm_writev, compat_pid_t, pid,
369 const struct compat_iovec __user *, lvec,
370 compat_ulong_t, liovcnt,
371 const struct compat_iovec __user *, rvec,
372 compat_ulong_t, riovcnt,
373 compat_ulong_t, flags)
Christopher Yeohfcf63402011-10-31 17:06:39 -0700374{
375 return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
376 riovcnt, flags, 1);
377}
378
379#endif