1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 1992 Krishna Balasubramanian and Linus Torvalds 4 * Copyright (C) 1999 Ingo Molnar <mingo@redhat.com> 5 * Copyright (C) 2002 Andi Kleen 6 * 7 * This handles calls from both 32bit and 64bit mode. 8 * 9 * Lock order: 10 * contex.ldt_usr_sem 11 * mmap_sem 12 * context.lock 13 */ 14 15 #include <linux/errno.h> 16 #include <linux/gfp.h> 17 #include <linux/sched.h> 18 #include <linux/string.h> 19 #include <linux/mm.h> 20 #include <linux/smp.h> 21 #include <linux/syscalls.h> 22 #include <linux/slab.h> 23 #include <linux/vmalloc.h> 24 #include <linux/uaccess.h> 25 26 #include <asm/ldt.h> 27 #include <asm/desc.h> 28 #include <asm/mmu_context.h> 29 #include <asm/syscalls.h> 30 31 static void refresh_ldt_segments(void) 32 { 33 #ifdef CONFIG_X86_64 34 unsigned short sel; 35 36 /* 37 * Make sure that the cached DS and ES descriptors match the updated 38 * LDT. 39 */ 40 savesegment(ds, sel); 41 if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) 42 loadsegment(ds, sel); 43 44 savesegment(es, sel); 45 if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) 46 loadsegment(es, sel); 47 #endif 48 } 49 50 /* context.lock is held by the task which issued the smp function call */ 51 static void flush_ldt(void *__mm) 52 { 53 struct mm_struct *mm = __mm; 54 mm_context_t *pc; 55 56 if (this_cpu_read(cpu_tlbstate.loaded_mm) != mm) 57 return; 58 59 pc = &mm->context; 60 set_ldt(pc->ldt->entries, pc->ldt->nr_entries); 61 62 refresh_ldt_segments(); 63 } 64 65 /* The caller must call finalize_ldt_struct on the result. LDT starts zeroed. */ 66 static struct ldt_struct *alloc_ldt_struct(unsigned int num_entries) 67 { 68 struct ldt_struct *new_ldt; 69 unsigned int alloc_size; 70 71 if (num_entries > LDT_ENTRIES) 72 return NULL; 73 74 new_ldt = kmalloc(sizeof(struct ldt_struct), GFP_KERNEL); 75 if (!new_ldt) 76 return NULL; 77 78 BUILD_BUG_ON(LDT_ENTRY_SIZE != sizeof(struct desc_struct)); 79 alloc_size = num_entries * LDT_ENTRY_SIZE; 80 81 /* 82 * Xen is very picky: it requires a page-aligned LDT that has no 83 * trailing nonzero bytes in any page that contains LDT descriptors. 84 * Keep it simple: zero the whole allocation and never allocate less 85 * than PAGE_SIZE. 86 */ 87 if (alloc_size > PAGE_SIZE) 88 new_ldt->entries = vzalloc(alloc_size); 89 else 90 new_ldt->entries = (void *)get_zeroed_page(GFP_KERNEL); 91 92 if (!new_ldt->entries) { 93 kfree(new_ldt); 94 return NULL; 95 } 96 97 new_ldt->nr_entries = num_entries; 98 return new_ldt; 99 } 100 101 /* After calling this, the LDT is immutable. */ 102 static void finalize_ldt_struct(struct ldt_struct *ldt) 103 { 104 paravirt_alloc_ldt(ldt->entries, ldt->nr_entries); 105 } 106 107 static void install_ldt(struct mm_struct *mm, struct ldt_struct *ldt) 108 { 109 mutex_lock(&mm->context.lock); 110 111 /* Synchronizes with READ_ONCE in load_mm_ldt. */ 112 smp_store_release(&mm->context.ldt, ldt); 113 114 /* Activate the LDT for all CPUs using currents mm. */ 115 on_each_cpu_mask(mm_cpumask(mm), flush_ldt, mm, true); 116 117 mutex_unlock(&mm->context.lock); 118 } 119 120 static void free_ldt_struct(struct ldt_struct *ldt) 121 { 122 if (likely(!ldt)) 123 return; 124 125 paravirt_free_ldt(ldt->entries, ldt->nr_entries); 126 if (ldt->nr_entries * LDT_ENTRY_SIZE > PAGE_SIZE) 127 vfree_atomic(ldt->entries); 128 else 129 free_page((unsigned long)ldt->entries); 130 kfree(ldt); 131 } 132 133 /* 134 * Called on fork from arch_dup_mmap(). Just copy the current LDT state, 135 * the new task is not running, so nothing can be installed. 136 */ 137 int ldt_dup_context(struct mm_struct *old_mm, struct mm_struct *mm) 138 { 139 struct ldt_struct *new_ldt; 140 int retval = 0; 141 142 if (!old_mm) 143 return 0; 144 145 mutex_lock(&old_mm->context.lock); 146 if (!old_mm->context.ldt) 147 goto out_unlock; 148 149 new_ldt = alloc_ldt_struct(old_mm->context.ldt->nr_entries); 150 if (!new_ldt) { 151 retval = -ENOMEM; 152 goto out_unlock; 153 } 154 155 memcpy(new_ldt->entries, old_mm->context.ldt->entries, 156 new_ldt->nr_entries * LDT_ENTRY_SIZE); 157 finalize_ldt_struct(new_ldt); 158 159 mm->context.ldt = new_ldt; 160 161 out_unlock: 162 mutex_unlock(&old_mm->context.lock); 163 return retval; 164 } 165 166 /* 167 * No need to lock the MM as we are the last user 168 * 169 * 64bit: Don't touch the LDT register - we're already in the next thread. 170 */ 171 void destroy_context_ldt(struct mm_struct *mm) 172 { 173 free_ldt_struct(mm->context.ldt); 174 mm->context.ldt = NULL; 175 } 176 177 static int read_ldt(void __user *ptr, unsigned long bytecount) 178 { 179 struct mm_struct *mm = current->mm; 180 unsigned long entries_size; 181 int retval; 182 183 down_read(&mm->context.ldt_usr_sem); 184 185 if (!mm->context.ldt) { 186 retval = 0; 187 goto out_unlock; 188 } 189 190 if (bytecount > LDT_ENTRY_SIZE * LDT_ENTRIES) 191 bytecount = LDT_ENTRY_SIZE * LDT_ENTRIES; 192 193 entries_size = mm->context.ldt->nr_entries * LDT_ENTRY_SIZE; 194 if (entries_size > bytecount) 195 entries_size = bytecount; 196 197 if (copy_to_user(ptr, mm->context.ldt->entries, entries_size)) { 198 retval = -EFAULT; 199 goto out_unlock; 200 } 201 202 if (entries_size != bytecount) { 203 /* Zero-fill the rest and pretend we read bytecount bytes. */ 204 if (clear_user(ptr + entries_size, bytecount - entries_size)) { 205 retval = -EFAULT; 206 goto out_unlock; 207 } 208 } 209 retval = bytecount; 210 211 out_unlock: 212 up_read(&mm->context.ldt_usr_sem); 213 return retval; 214 } 215 216 static int read_default_ldt(void __user *ptr, unsigned long bytecount) 217 { 218 /* CHECKME: Can we use _one_ random number ? */ 219 #ifdef CONFIG_X86_32 220 unsigned long size = 5 * sizeof(struct desc_struct); 221 #else 222 unsigned long size = 128; 223 #endif 224 if (bytecount > size) 225 bytecount = size; 226 if (clear_user(ptr, bytecount)) 227 return -EFAULT; 228 return bytecount; 229 } 230 231 static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode) 232 { 233 struct mm_struct *mm = current->mm; 234 struct ldt_struct *new_ldt, *old_ldt; 235 unsigned int old_nr_entries, new_nr_entries; 236 struct user_desc ldt_info; 237 struct desc_struct ldt; 238 int error; 239 240 error = -EINVAL; 241 if (bytecount != sizeof(ldt_info)) 242 goto out; 243 error = -EFAULT; 244 if (copy_from_user(&ldt_info, ptr, sizeof(ldt_info))) 245 goto out; 246 247 error = -EINVAL; 248 if (ldt_info.entry_number >= LDT_ENTRIES) 249 goto out; 250 if (ldt_info.contents == 3) { 251 if (oldmode) 252 goto out; 253 if (ldt_info.seg_not_present == 0) 254 goto out; 255 } 256 257 if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) || 258 LDT_empty(&ldt_info)) { 259 /* The user wants to clear the entry. */ 260 memset(&ldt, 0, sizeof(ldt)); 261 } else { 262 if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) { 263 error = -EINVAL; 264 goto out; 265 } 266 267 fill_ldt(&ldt, &ldt_info); 268 if (oldmode) 269 ldt.avl = 0; 270 } 271 272 if (down_write_killable(&mm->context.ldt_usr_sem)) 273 return -EINTR; 274 275 old_ldt = mm->context.ldt; 276 old_nr_entries = old_ldt ? old_ldt->nr_entries : 0; 277 new_nr_entries = max(ldt_info.entry_number + 1, old_nr_entries); 278 279 error = -ENOMEM; 280 new_ldt = alloc_ldt_struct(new_nr_entries); 281 if (!new_ldt) 282 goto out_unlock; 283 284 if (old_ldt) 285 memcpy(new_ldt->entries, old_ldt->entries, old_nr_entries * LDT_ENTRY_SIZE); 286 287 new_ldt->entries[ldt_info.entry_number] = ldt; 288 finalize_ldt_struct(new_ldt); 289 290 install_ldt(mm, new_ldt); 291 free_ldt_struct(old_ldt); 292 error = 0; 293 294 out_unlock: 295 up_write(&mm->context.ldt_usr_sem); 296 out: 297 return error; 298 } 299 300 SYSCALL_DEFINE3(modify_ldt, int , func , void __user * , ptr , 301 unsigned long , bytecount) 302 { 303 int ret = -ENOSYS; 304 305 switch (func) { 306 case 0: 307 ret = read_ldt(ptr, bytecount); 308 break; 309 case 1: 310 ret = write_ldt(ptr, bytecount, 1); 311 break; 312 case 2: 313 ret = read_default_ldt(ptr, bytecount); 314 break; 315 case 0x11: 316 ret = write_ldt(ptr, bytecount, 0); 317 break; 318 } 319 /* 320 * The SYSCALL_DEFINE() macros give us an 'unsigned long' 321 * return type, but tht ABI for sys_modify_ldt() expects 322 * 'int'. This cast gives us an int-sized value in %rax 323 * for the return code. The 'unsigned' is necessary so 324 * the compiler does not try to sign-extend the negative 325 * return codes into the high half of the register when 326 * taking the value from int->long. 327 */ 328 return (unsigned int)ret; 329 } 330