root/mm/process_vm_access.c

DEFINITIONS

1. process_vm_rw_pages
2. process_vm_rw_single_vec
3. process_vm_rw_core
4. process_vm_rw
5. SYSCALL_DEFINE6
6. SYSCALL_DEFINE6
7. compat_process_vm_rw
8. COMPAT_SYSCALL_DEFINE6
9. COMPAT_SYSCALL_DEFINE6

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * linux/mm/process_vm_access.c
   4  *
   5  * Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp.
   6  */
   7 
   8 #include <linux/mm.h>
   9 #include <linux/uio.h>
  10 #include <linux/sched.h>
  11 #include <linux/sched/mm.h>
  12 #include <linux/highmem.h>
  13 #include <linux/ptrace.h>
  14 #include <linux/slab.h>
  15 #include <linux/syscalls.h>
  16 
  17 #ifdef CONFIG_COMPAT
  18 #include <linux/compat.h>
  19 #endif
  20 
  21 /**
  22  * process_vm_rw_pages - read/write pages from task specified
  23  * @pages: array of pointers to pages we want to copy
  24  * @offset: offset in page to start copying from/to
  25  * @len: number of bytes to copy
  26  * @iter: where to copy to/from locally
  27  * @vm_write: 0 means copy from, 1 means copy to
  28  * Returns 0 on success, error code otherwise
  29  */
  30 static int process_vm_rw_pages(struct page **pages,
  31                                unsigned offset,
  32                                size_t len,
  33                                struct iov_iter *iter,
  34                                int vm_write)
  35 {
  36         /* Do the copy for each page */
  37         while (len && iov_iter_count(iter)) {
  38                 struct page *page = *pages++;
  39                 size_t copy = PAGE_SIZE - offset;
  40                 size_t copied;
  41 
  42                 if (copy > len)
  43                         copy = len;
  44 
  45                 if (vm_write) {
  46                         copied = copy_page_from_iter(page, offset, copy, iter);
  47                         set_page_dirty_lock(page);
  48                 } else {
  49                         copied = copy_page_to_iter(page, offset, copy, iter);
  50                 }
  51                 len -= copied;
  52                 if (copied < copy && iov_iter_count(iter))
  53                         return -EFAULT;
  54                 offset = 0;
  55         }
  56         return 0;
  57 }
  58 
  59 /* Maximum number of pages kmalloc'd to hold struct page's during copy */
  60 #define PVM_MAX_KMALLOC_PAGES (PAGE_SIZE * 2)
  61 
  62 /**
  63  * process_vm_rw_single_vec - read/write pages from task specified
  64  * @addr: start memory address of target process
  65  * @len: size of area to copy to/from
  66  * @iter: where to copy to/from locally
  67  * @process_pages: struct pages area that can store at least
  68  *  nr_pages_to_copy struct page pointers
  69  * @mm: mm for task
  70  * @task: task to read/write from
  71  * @vm_write: 0 means copy from, 1 means copy to
  72  * Returns 0 on success or on failure error code
  73  */
  74 static int process_vm_rw_single_vec(unsigned long addr,
  75                                     unsigned long len,
  76                                     struct iov_iter *iter,
  77                                     struct page **process_pages,
  78                                     struct mm_struct *mm,
  79                                     struct task_struct *task,
  80                                     int vm_write)
  81 {
  82         unsigned long pa = addr & PAGE_MASK;
  83         unsigned long start_offset = addr - pa;
  84         unsigned long nr_pages;
  85         ssize_t rc = 0;
  86         unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES
  87                 / sizeof(struct pages *);
  88         unsigned int flags = 0;
  89 
  90         /* Work out address and page range required */
  91         if (len == 0)
  92                 return 0;
  93         nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1;
  94 
  95         if (vm_write)
  96                 flags |= FOLL_WRITE;
  97 
  98         while (!rc && nr_pages && iov_iter_count(iter)) {
  99                 int pages = min(nr_pages, max_pages_per_loop);
 100                 int locked = 1;
 101                 size_t bytes;
 102 
 103                 /*
 104                  * Get the pages we're interested in.  We must
 105                  * access remotely because task/mm might not
 106                  * current/current->mm
 107                  */
 108                 down_read(&mm->mmap_sem);
 109                 pages = get_user_pages_remote(task, mm, pa, pages, flags,
 110                                               process_pages, NULL, &locked);
 111                 if (locked)
 112                         up_read(&mm->mmap_sem);
 113                 if (pages <= 0)
 114                         return -EFAULT;
 115 
 116                 bytes = pages * PAGE_SIZE - start_offset;
 117                 if (bytes > len)
 118                         bytes = len;
 119 
 120                 rc = process_vm_rw_pages(process_pages,
 121                                          start_offset, bytes, iter,
 122                                          vm_write);
 123                 len -= bytes;
 124                 start_offset = 0;
 125                 nr_pages -= pages;
 126                 pa += pages * PAGE_SIZE;
 127                 while (pages)
 128                         put_page(process_pages[--pages]);
 129         }
 130 
 131         return rc;
 132 }
 133 
 134 /* Maximum number of entries for process pages array
 135    which lives on stack */
 136 #define PVM_MAX_PP_ARRAY_COUNT 16
 137 
 138 /**
 139  * process_vm_rw_core - core of reading/writing pages from task specified
 140  * @pid: PID of process to read/write from/to
 141  * @iter: where to copy to/from locally
 142  * @rvec: iovec array specifying where to copy to/from in the other process
 143  * @riovcnt: size of rvec array
 144  * @flags: currently unused
 145  * @vm_write: 0 if reading from other process, 1 if writing to other process
 146  *
 147  * Returns the number of bytes read/written or error code. May
 148  *  return less bytes than expected if an error occurs during the copying
 149  *  process.
 150  */
 151 static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
 152                                   const struct iovec *rvec,
 153                                   unsigned long riovcnt,
 154                                   unsigned long flags, int vm_write)
 155 {
 156         struct task_struct *task;
 157         struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT];
 158         struct page **process_pages = pp_stack;
 159         struct mm_struct *mm;
 160         unsigned long i;
 161         ssize_t rc = 0;
 162         unsigned long nr_pages = 0;
 163         unsigned long nr_pages_iov;
 164         ssize_t iov_len;
 165         size_t total_len = iov_iter_count(iter);
 166 
 167         /*
 168          * Work out how many pages of struct pages we're going to need
 169          * when eventually calling get_user_pages
 170          */
 171         for (i = 0; i < riovcnt; i++) {
 172                 iov_len = rvec[i].iov_len;
 173                 if (iov_len > 0) {
 174                         nr_pages_iov = ((unsigned long)rvec[i].iov_base
 175                                         + iov_len)
 176                                 / PAGE_SIZE - (unsigned long)rvec[i].iov_base
 177                                 / PAGE_SIZE + 1;
 178                         nr_pages = max(nr_pages, nr_pages_iov);
 179                 }
 180         }
 181 
 182         if (nr_pages == 0)
 183                 return 0;
 184 
 185         if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) {
 186                 /* For reliability don't try to kmalloc more than
 187                    2 pages worth */
 188                 process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES,
 189                                               sizeof(struct pages *)*nr_pages),
 190                                         GFP_KERNEL);
 191 
 192                 if (!process_pages)
 193                         return -ENOMEM;
 194         }
 195 
 196         /* Get process information */
 197         task = find_get_task_by_vpid(pid);
 198         if (!task) {
 199                 rc = -ESRCH;
 200                 goto free_proc_pages;
 201         }
 202 
 203         mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS);
 204         if (!mm || IS_ERR(mm)) {
 205                 rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
 206                 /*
 207                  * Explicitly map EACCES to EPERM as EPERM is a more a
 208                  * appropriate error code for process_vw_readv/writev
 209                  */
 210                 if (rc == -EACCES)
 211                         rc = -EPERM;
 212                 goto put_task_struct;
 213         }
 214 
 215         for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++)
 216                 rc = process_vm_rw_single_vec(
 217                         (unsigned long)rvec[i].iov_base, rvec[i].iov_len,
 218                         iter, process_pages, mm, task, vm_write);
 219 
 220         /* copied = space before - space after */
 221         total_len -= iov_iter_count(iter);
 222 
 223         /* If we have managed to copy any data at all then
 224            we return the number of bytes copied. Otherwise
 225            we return the error code */
 226         if (total_len)
 227                 rc = total_len;
 228 
 229         mmput(mm);
 230 
 231 put_task_struct:
 232         put_task_struct(task);
 233 
 234 free_proc_pages:
 235         if (process_pages != pp_stack)
 236                 kfree(process_pages);
 237         return rc;
 238 }
 239 
 240 /**
 241  * process_vm_rw - check iovecs before calling core routine
 242  * @pid: PID of process to read/write from/to
 243  * @lvec: iovec array specifying where to copy to/from locally
 244  * @liovcnt: size of lvec array
 245  * @rvec: iovec array specifying where to copy to/from in the other process
 246  * @riovcnt: size of rvec array
 247  * @flags: currently unused
 248  * @vm_write: 0 if reading from other process, 1 if writing to other process
 249  *
 250  * Returns the number of bytes read/written or error code. May
 251  *  return less bytes than expected if an error occurs during the copying
 252  *  process.
 253  */
 254 static ssize_t process_vm_rw(pid_t pid,
 255                              const struct iovec __user *lvec,
 256                              unsigned long liovcnt,
 257                              const struct iovec __user *rvec,
 258                              unsigned long riovcnt,
 259                              unsigned long flags, int vm_write)
 260 {
 261         struct iovec iovstack_l[UIO_FASTIOV];
 262         struct iovec iovstack_r[UIO_FASTIOV];
 263         struct iovec *iov_l = iovstack_l;
 264         struct iovec *iov_r = iovstack_r;
 265         struct iov_iter iter;
 266         ssize_t rc;
 267         int dir = vm_write ? WRITE : READ;
 268 
 269         if (flags != 0)
 270                 return -EINVAL;
 271 
 272         /* Check iovecs */
 273         rc = import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
 274         if (rc < 0)
 275                 return rc;
 276         if (!iov_iter_count(&iter))
 277                 goto free_iovecs;
 278 
 279         rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV,
 280                                    iovstack_r, &iov_r);
 281         if (rc <= 0)
 282                 goto free_iovecs;
 283 
 284         rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
 285 
 286 free_iovecs:
 287         if (iov_r != iovstack_r)
 288                 kfree(iov_r);
 289         kfree(iov_l);
 290 
 291         return rc;
 292 }
 293 
 294 SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec,
 295                 unsigned long, liovcnt, const struct iovec __user *, rvec,
 296                 unsigned long, riovcnt, unsigned long, flags)
 297 {
 298         return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
 299 }
 300 
 301 SYSCALL_DEFINE6(process_vm_writev, pid_t, pid,
 302                 const struct iovec __user *, lvec,
 303                 unsigned long, liovcnt, const struct iovec __user *, rvec,
 304                 unsigned long, riovcnt, unsigned long, flags)
 305 {
 306         return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
 307 }
 308 
 309 #ifdef CONFIG_COMPAT
 310 
 311 static ssize_t
 312 compat_process_vm_rw(compat_pid_t pid,
 313                      const struct compat_iovec __user *lvec,
 314                      unsigned long liovcnt,
 315                      const struct compat_iovec __user *rvec,
 316                      unsigned long riovcnt,
 317                      unsigned long flags, int vm_write)
 318 {
 319         struct iovec iovstack_l[UIO_FASTIOV];
 320         struct iovec iovstack_r[UIO_FASTIOV];
 321         struct iovec *iov_l = iovstack_l;
 322         struct iovec *iov_r = iovstack_r;
 323         struct iov_iter iter;
 324         ssize_t rc = -EFAULT;
 325         int dir = vm_write ? WRITE : READ;
 326 
 327         if (flags != 0)
 328                 return -EINVAL;
 329 
 330         rc = compat_import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
 331         if (rc < 0)
 332                 return rc;
 333         if (!iov_iter_count(&iter))
 334                 goto free_iovecs;
 335         rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt,
 336                                           UIO_FASTIOV, iovstack_r,
 337                                           &iov_r);
 338         if (rc <= 0)
 339                 goto free_iovecs;
 340 
 341         rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
 342 
 343 free_iovecs:
 344         if (iov_r != iovstack_r)
 345                 kfree(iov_r);
 346         kfree(iov_l);
 347         return rc;
 348 }
 349 
 350 COMPAT_SYSCALL_DEFINE6(process_vm_readv, compat_pid_t, pid,
 351                        const struct compat_iovec __user *, lvec,
 352                        compat_ulong_t, liovcnt,
 353                        const struct compat_iovec __user *, rvec,
 354                        compat_ulong_t, riovcnt,
 355                        compat_ulong_t, flags)
 356 {
 357         return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
 358                                     riovcnt, flags, 0);
 359 }
 360 
 361 COMPAT_SYSCALL_DEFINE6(process_vm_writev, compat_pid_t, pid,
 362                        const struct compat_iovec __user *, lvec,
 363                        compat_ulong_t, liovcnt,
 364                        const struct compat_iovec __user *, rvec,
 365                        compat_ulong_t, riovcnt,
 366                        compat_ulong_t, flags)
 367 {
 368         return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
 369                                     riovcnt, flags, 1);
 370 }
 371 
 372 #endif