1 /* 2 * Flexible mmap layout support 3 * 4 * Based on code by Ingo Molnar and Andi Kleen, copyrighted 5 * as follows: 6 * 7 * Copyright 2003-2009 Red Hat Inc. 8 * All Rights Reserved. 9 * Copyright 2005 Andi Kleen, SUSE Labs. 10 * Copyright 2007 Jiri Kosina, SUSE Labs. 11 * 12 * This program is free software; you can redistribute it and/or modify 13 * it under the terms of the GNU General Public License as published by 14 * the Free Software Foundation; either version 2 of the License, or 15 * (at your option) any later version. 16 * 17 * This program is distributed in the hope that it will be useful, 18 * but WITHOUT ANY WARRANTY; without even the implied warranty of 19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 20 * GNU General Public License for more details. 21 * 22 * You should have received a copy of the GNU General Public License 23 * along with this program; if not, write to the Free Software 24 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 25 */ 26 27 #include <linux/personality.h> 28 #include <linux/mm.h> 29 #include <linux/random.h> 30 #include <linux/limits.h> 31 #include <linux/sched/signal.h> 32 #include <linux/sched/mm.h> 33 #include <linux/compat.h> 34 #include <asm/elf.h> 35 36 #include "physaddr.h" 37 38 struct va_alignment __read_mostly va_align = { 39 .flags = -1, 40 }; 41 42 unsigned long task_size_32bit(void) 43 { 44 return IA32_PAGE_OFFSET; 45 } 46 47 unsigned long task_size_64bit(int full_addr_space) 48 { 49 return full_addr_space ? TASK_SIZE_MAX : DEFAULT_MAP_WINDOW; 50 } 51 52 static unsigned long stack_maxrandom_size(unsigned long task_size) 53 { 54 unsigned long max = 0; 55 if (current->flags & PF_RANDOMIZE) { 56 max = (-1UL) & __STACK_RND_MASK(task_size == task_size_32bit()); 57 max <<= PAGE_SHIFT; 58 } 59 60 return max; 61 } 62 63 #ifdef CONFIG_COMPAT 64 # define mmap32_rnd_bits mmap_rnd_compat_bits 65 # define mmap64_rnd_bits mmap_rnd_bits 66 #else 67 # define mmap32_rnd_bits mmap_rnd_bits 68 # define mmap64_rnd_bits mmap_rnd_bits 69 #endif 70 71 #define SIZE_128M (128 * 1024 * 1024UL) 72 73 static int mmap_is_legacy(void) 74 { 75 if (current->personality & ADDR_COMPAT_LAYOUT) 76 return 1; 77 78 return sysctl_legacy_va_layout; 79 } 80 81 static unsigned long arch_rnd(unsigned int rndbits) 82 { 83 if (!(current->flags & PF_RANDOMIZE)) 84 return 0; 85 return (get_random_long() & ((1UL << rndbits) - 1)) << PAGE_SHIFT; 86 } 87 88 unsigned long arch_mmap_rnd(void) 89 { 90 return arch_rnd(mmap_is_ia32() ? mmap32_rnd_bits : mmap64_rnd_bits); 91 } 92 93 static unsigned long mmap_base(unsigned long rnd, unsigned long task_size) 94 { 95 unsigned long gap = rlimit(RLIMIT_STACK); 96 unsigned long pad = stack_maxrandom_size(task_size) + stack_guard_gap; 97 unsigned long gap_min, gap_max; 98 99 /* Values close to RLIM_INFINITY can overflow. */ 100 if (gap + pad > gap) 101 gap += pad; 102 103 /* 104 * Top of mmap area (just below the process stack). 105 * Leave an at least ~128 MB hole with possible stack randomization. 106 */ 107 gap_min = SIZE_128M; 108 gap_max = (task_size / 6) * 5; 109 110 if (gap < gap_min) 111 gap = gap_min; 112 else if (gap > gap_max) 113 gap = gap_max; 114 115 return PAGE_ALIGN(task_size - gap - rnd); 116 } 117 118 static unsigned long mmap_legacy_base(unsigned long rnd, 119 unsigned long task_size) 120 { 121 return __TASK_UNMAPPED_BASE(task_size) + rnd; 122 } 123 124 /* 125 * This function, called very early during the creation of a new 126 * process VM image, sets up which VM layout function to use: 127 */ 128 static void arch_pick_mmap_base(unsigned long *base, unsigned long *legacy_base, 129 unsigned long random_factor, unsigned long task_size) 130 { 131 *legacy_base = mmap_legacy_base(random_factor, task_size); 132 if (mmap_is_legacy()) 133 *base = *legacy_base; 134 else 135 *base = mmap_base(random_factor, task_size); 136 } 137 138 void arch_pick_mmap_layout(struct mm_struct *mm) 139 { 140 if (mmap_is_legacy()) 141 mm->get_unmapped_area = arch_get_unmapped_area; 142 else 143 mm->get_unmapped_area = arch_get_unmapped_area_topdown; 144 145 arch_pick_mmap_base(&mm->mmap_base, &mm->mmap_legacy_base, 146 arch_rnd(mmap64_rnd_bits), task_size_64bit(0)); 147 148 #ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES 149 /* 150 * The mmap syscall mapping base decision depends solely on the 151 * syscall type (64-bit or compat). This applies for 64bit 152 * applications and 32bit applications. The 64bit syscall uses 153 * mmap_base, the compat syscall uses mmap_compat_base. 154 */ 155 arch_pick_mmap_base(&mm->mmap_compat_base, &mm->mmap_compat_legacy_base, 156 arch_rnd(mmap32_rnd_bits), task_size_32bit()); 157 #endif 158 } 159 160 unsigned long get_mmap_base(int is_legacy) 161 { 162 struct mm_struct *mm = current->mm; 163 164 #ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES 165 if (in_compat_syscall()) { 166 return is_legacy ? mm->mmap_compat_legacy_base 167 : mm->mmap_compat_base; 168 } 169 #endif 170 return is_legacy ? mm->mmap_legacy_base : mm->mmap_base; 171 } 172 173 const char *arch_vma_name(struct vm_area_struct *vma) 174 { 175 if (vma->vm_flags & VM_MPX) 176 return "[mpx]"; 177 return NULL; 178 } 179 180 /** 181 * mmap_address_hint_valid - Validate the address hint of mmap 182 * @addr: Address hint 183 * @len: Mapping length 184 * 185 * Check whether @addr and @addr + @len result in a valid mapping. 186 * 187 * On 32bit this only checks whether @addr + @len is <= TASK_SIZE. 188 * 189 * On 64bit with 5-level page tables another sanity check is required 190 * because mappings requested by mmap(@addr, 0) which cross the 47-bit 191 * virtual address boundary can cause the following theoretical issue: 192 * 193 * An application calls mmap(addr, 0), i.e. without MAP_FIXED, where @addr 194 * is below the border of the 47-bit address space and @addr + @len is 195 * above the border. 196 * 197 * With 4-level paging this request succeeds, but the resulting mapping 198 * address will always be within the 47-bit virtual address space, because 199 * the hint address does not result in a valid mapping and is 200 * ignored. Hence applications which are not prepared to handle virtual 201 * addresses above 47-bit work correctly. 202 * 203 * With 5-level paging this request would be granted and result in a 204 * mapping which crosses the border of the 47-bit virtual address 205 * space. If the application cannot handle addresses above 47-bit this 206 * will lead to misbehaviour and hard to diagnose failures. 207 * 208 * Therefore ignore address hints which would result in a mapping crossing 209 * the 47-bit virtual address boundary. 210 * 211 * Note, that in the same scenario with MAP_FIXED the behaviour is 212 * different. The request with @addr < 47-bit and @addr + @len > 47-bit 213 * fails on a 4-level paging machine but succeeds on a 5-level paging 214 * machine. It is reasonable to expect that an application does not rely on 215 * the failure of such a fixed mapping request, so the restriction is not 216 * applied. 217 */ 218 bool mmap_address_hint_valid(unsigned long addr, unsigned long len) 219 { 220 if (TASK_SIZE - len < addr) 221 return false; 222 223 return (addr > DEFAULT_MAP_WINDOW) == (addr + len > DEFAULT_MAP_WINDOW); 224 } 225 226 /* Can we access it for direct reading/writing? Must be RAM: */ 227 int valid_phys_addr_range(phys_addr_t addr, size_t count) 228 { 229 return addr + count <= __pa(high_memory); 230 } 231 232 /* Can we access it through mmap? Must be a valid physical address: */ 233 int valid_mmap_phys_addr_range(unsigned long pfn, size_t count) 234 { 235 phys_addr_t addr = (phys_addr_t)pfn << PAGE_SHIFT; 236 237 return phys_addr_valid(addr + count - 1); 238 } 239