1 /*
2  * Copyright (c) 2017, Mellanox Technologies inc.  All rights reserved.
3  *
4  * This software is available to you under a choice of one of two
5  * licenses.  You may choose to be licensed under the terms of the GNU
6  * General Public License (GPL) Version 2, available from the file
7  * COPYING in the main directory of this source tree, or the
8  * OpenIB.org BSD license below:
9  *
10  *     Redistribution and use in source and binary forms, with or
11  *     without modification, are permitted provided that the following
12  *     conditions are met:
13  *
14  *      - Redistributions of source code must retain the above
15  *        copyright notice, this list of conditions and the following
16  *        disclaimer.
17  *
18  *      - Redistributions in binary form must reproduce the above
19  *        copyright notice, this list of conditions and the following
20  *        disclaimer in the documentation and/or other materials
21  *        provided with the distribution.
22  *
23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30  * SOFTWARE.
31  */
32 
33 #include <rdma/rdma_user_ioctl.h>
34 #include <rdma/uverbs_ioctl.h>
35 #include "rdma_core.h"
36 #include "uverbs.h"
37 
38 static int uverbs_process_attr(struct ib_device *ibdev,
39 			       struct ib_ucontext *ucontext,
40 			       const struct ib_uverbs_attr *uattr,
41 			       u16 attr_id,
42 			       const struct uverbs_attr_spec_hash *attr_spec_bucket,
43 			       struct uverbs_attr_bundle_hash *attr_bundle_h,
44 			       struct ib_uverbs_attr __user *uattr_ptr)
45 {
46 	const struct uverbs_attr_spec *spec;
47 	struct uverbs_attr *e;
48 	const struct uverbs_object_spec *object;
49 	struct uverbs_obj_attr *o_attr;
50 	struct uverbs_attr *elements = attr_bundle_h->attrs;
51 
52 	if (uattr->reserved)
53 		return -EINVAL;
54 
55 	if (attr_id >= attr_spec_bucket->num_attrs) {
56 		if (uattr->flags & UVERBS_ATTR_F_MANDATORY)
57 			return -EINVAL;
58 		else
59 			return 0;
60 	}
61 
62 	if (test_bit(attr_id, attr_bundle_h->valid_bitmap))
63 		return -EINVAL;
64 
65 	spec = &attr_spec_bucket->attrs[attr_id];
66 	e = &elements[attr_id];
67 	e->uattr = uattr_ptr;
68 
69 	switch (spec->type) {
70 	case UVERBS_ATTR_TYPE_PTR_IN:
71 	case UVERBS_ATTR_TYPE_PTR_OUT:
72 		if (uattr->len < spec->len ||
73 		    (!(spec->flags & UVERBS_ATTR_SPEC_F_MIN_SZ) &&
74 		     uattr->len > spec->len))
75 			return -EINVAL;
76 
77 		e->ptr_attr.data = uattr->data;
78 		e->ptr_attr.len = uattr->len;
79 		e->ptr_attr.flags = uattr->flags;
80 		break;
81 
82 	case UVERBS_ATTR_TYPE_IDR:
83 		if (uattr->data >> 32)
84 			return -EINVAL;
85 	/* fall through */
86 	case UVERBS_ATTR_TYPE_FD:
87 		if (uattr->len != 0 || !ucontext || uattr->data > INT_MAX)
88 			return -EINVAL;
89 
90 		o_attr = &e->obj_attr;
91 		object = uverbs_get_object(ibdev, spec->obj.obj_type);
92 		if (!object)
93 			return -EINVAL;
94 		o_attr->type = object->type_attrs;
95 
96 		o_attr->id = (int)uattr->data;
97 		o_attr->uobject = uverbs_get_uobject_from_context(
98 					o_attr->type,
99 					ucontext,
100 					spec->obj.access,
101 					o_attr->id);
102 
103 		if (IS_ERR(o_attr->uobject))
104 			return PTR_ERR(o_attr->uobject);
105 
106 		if (spec->obj.access == UVERBS_ACCESS_NEW) {
107 			u64 id = o_attr->uobject->id;
108 
109 			/* Copy the allocated id to the user-space */
110 			if (put_user(id, &e->uattr->data)) {
111 				uverbs_finalize_object(o_attr->uobject,
112 						       UVERBS_ACCESS_NEW,
113 						       false);
114 				return -EFAULT;
115 			}
116 		}
117 
118 		break;
119 	default:
120 		return -EOPNOTSUPP;
121 	}
122 
123 	set_bit(attr_id, attr_bundle_h->valid_bitmap);
124 	return 0;
125 }
126 
127 static int uverbs_uattrs_process(struct ib_device *ibdev,
128 				 struct ib_ucontext *ucontext,
129 				 const struct ib_uverbs_attr *uattrs,
130 				 size_t num_uattrs,
131 				 const struct uverbs_method_spec *method,
132 				 struct uverbs_attr_bundle *attr_bundle,
133 				 struct ib_uverbs_attr __user *uattr_ptr)
134 {
135 	size_t i;
136 	int ret = 0;
137 	int num_given_buckets = 0;
138 
139 	for (i = 0; i < num_uattrs; i++) {
140 		const struct ib_uverbs_attr *uattr = &uattrs[i];
141 		u16 attr_id = uattr->attr_id;
142 		struct uverbs_attr_spec_hash *attr_spec_bucket;
143 
144 		ret = uverbs_ns_idx(&attr_id, method->num_buckets);
145 		if (ret < 0) {
146 			if (uattr->flags & UVERBS_ATTR_F_MANDATORY) {
147 				uverbs_finalize_objects(attr_bundle,
148 							method->attr_buckets,
149 							num_given_buckets,
150 							false);
151 				return ret;
152 			}
153 			continue;
154 		}
155 
156 		/*
157 		 * ret is the found ns, so increase num_given_buckets if
158 		 * necessary.
159 		 */
160 		if (ret >= num_given_buckets)
161 			num_given_buckets = ret + 1;
162 
163 		attr_spec_bucket = method->attr_buckets[ret];
164 		ret = uverbs_process_attr(ibdev, ucontext, uattr, attr_id,
165 					  attr_spec_bucket, &attr_bundle->hash[ret],
166 					  uattr_ptr++);
167 		if (ret) {
168 			uverbs_finalize_objects(attr_bundle,
169 						method->attr_buckets,
170 						num_given_buckets,
171 						false);
172 			return ret;
173 		}
174 	}
175 
176 	return num_given_buckets;
177 }
178 
179 static int uverbs_validate_kernel_mandatory(const struct uverbs_method_spec *method_spec,
180 					    struct uverbs_attr_bundle *attr_bundle)
181 {
182 	unsigned int i;
183 
184 	for (i = 0; i < attr_bundle->num_buckets; i++) {
185 		struct uverbs_attr_spec_hash *attr_spec_bucket =
186 			method_spec->attr_buckets[i];
187 
188 		if (!bitmap_subset(attr_spec_bucket->mandatory_attrs_bitmask,
189 				   attr_bundle->hash[i].valid_bitmap,
190 				   attr_spec_bucket->num_attrs))
191 			return -EINVAL;
192 	}
193 
194 	return 0;
195 }
196 
197 static int uverbs_handle_method(struct ib_uverbs_attr __user *uattr_ptr,
198 				const struct ib_uverbs_attr *uattrs,
199 				size_t num_uattrs,
200 				struct ib_device *ibdev,
201 				struct ib_uverbs_file *ufile,
202 				const struct uverbs_method_spec *method_spec,
203 				struct uverbs_attr_bundle *attr_bundle)
204 {
205 	int ret;
206 	int finalize_ret;
207 	int num_given_buckets;
208 
209 	num_given_buckets = uverbs_uattrs_process(ibdev, ufile->ucontext, uattrs,
210 						  num_uattrs, method_spec,
211 						  attr_bundle, uattr_ptr);
212 	if (num_given_buckets <= 0)
213 		return -EINVAL;
214 
215 	attr_bundle->num_buckets = num_given_buckets;
216 	ret = uverbs_validate_kernel_mandatory(method_spec, attr_bundle);
217 	if (ret)
218 		goto cleanup;
219 
220 	ret = method_spec->handler(ibdev, ufile, attr_bundle);
221 cleanup:
222 	finalize_ret = uverbs_finalize_objects(attr_bundle,
223 					       method_spec->attr_buckets,
224 					       attr_bundle->num_buckets,
225 					       !ret);
226 
227 	return ret ? ret : finalize_ret;
228 }
229 
230 #define UVERBS_OPTIMIZE_USING_STACK_SZ  256
231 static long ib_uverbs_cmd_verbs(struct ib_device *ib_dev,
232 				struct ib_uverbs_file *file,
233 				struct ib_uverbs_ioctl_hdr *hdr,
234 				void __user *buf)
235 {
236 	const struct uverbs_object_spec *object_spec;
237 	const struct uverbs_method_spec *method_spec;
238 	long err = 0;
239 	unsigned int i;
240 	struct {
241 		struct ib_uverbs_attr		*uattrs;
242 		struct uverbs_attr_bundle	*uverbs_attr_bundle;
243 	} *ctx = NULL;
244 	struct uverbs_attr *curr_attr;
245 	unsigned long *curr_bitmap;
246 	size_t ctx_size;
247 	uintptr_t data[UVERBS_OPTIMIZE_USING_STACK_SZ / sizeof(uintptr_t)];
248 
249 	object_spec = uverbs_get_object(ib_dev, hdr->object_id);
250 	if (!object_spec)
251 		return -EPROTONOSUPPORT;
252 
253 	method_spec = uverbs_get_method(object_spec, hdr->method_id);
254 	if (!method_spec)
255 		return -EPROTONOSUPPORT;
256 
257 	if ((method_spec->flags & UVERBS_ACTION_FLAG_CREATE_ROOT) ^ !file->ucontext)
258 		return -EINVAL;
259 
260 	ctx_size = sizeof(*ctx) +
261 		   sizeof(struct uverbs_attr_bundle) +
262 		   sizeof(struct uverbs_attr_bundle_hash) * method_spec->num_buckets +
263 		   sizeof(*ctx->uattrs) * hdr->num_attrs +
264 		   sizeof(*ctx->uverbs_attr_bundle->hash[0].attrs) *
265 		   method_spec->num_child_attrs +
266 		   sizeof(*ctx->uverbs_attr_bundle->hash[0].valid_bitmap) *
267 			(method_spec->num_child_attrs / BITS_PER_LONG +
268 			 method_spec->num_buckets);
269 
270 	if (ctx_size <= UVERBS_OPTIMIZE_USING_STACK_SZ)
271 		ctx = (void *)data;
272 	if (!ctx)
273 		ctx = kmalloc(ctx_size, GFP_KERNEL);
274 	if (!ctx)
275 		return -ENOMEM;
276 
277 	ctx->uverbs_attr_bundle = (void *)ctx + sizeof(*ctx);
278 	ctx->uattrs = (void *)(ctx->uverbs_attr_bundle + 1) +
279 			      (sizeof(ctx->uverbs_attr_bundle->hash[0]) *
280 			       method_spec->num_buckets);
281 	curr_attr = (void *)(ctx->uattrs + hdr->num_attrs);
282 	curr_bitmap = (void *)(curr_attr + method_spec->num_child_attrs);
283 
284 	/*
285 	 * We just fill the pointers and num_attrs here. The data itself will be
286 	 * filled at a later stage (uverbs_process_attr)
287 	 */
288 	for (i = 0; i < method_spec->num_buckets; i++) {
289 		unsigned int curr_num_attrs = method_spec->attr_buckets[i]->num_attrs;
290 
291 		ctx->uverbs_attr_bundle->hash[i].attrs = curr_attr;
292 		curr_attr += curr_num_attrs;
293 		ctx->uverbs_attr_bundle->hash[i].num_attrs = curr_num_attrs;
294 		ctx->uverbs_attr_bundle->hash[i].valid_bitmap = curr_bitmap;
295 		bitmap_zero(curr_bitmap, curr_num_attrs);
296 		curr_bitmap += BITS_TO_LONGS(curr_num_attrs);
297 	}
298 
299 	err = copy_from_user(ctx->uattrs, buf,
300 			     sizeof(*ctx->uattrs) * hdr->num_attrs);
301 	if (err) {
302 		err = -EFAULT;
303 		goto out;
304 	}
305 
306 	err = uverbs_handle_method(buf, ctx->uattrs, hdr->num_attrs, ib_dev,
307 				   file, method_spec, ctx->uverbs_attr_bundle);
308 
309 	/*
310 	 * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can
311 	 * not invoke the method because the request is not supported.  No
312 	 * other cases should return this code.
313 	*/
314 	if (unlikely(err == -EPROTONOSUPPORT)) {
315 		WARN_ON_ONCE(err == -EPROTONOSUPPORT);
316 		err = -EINVAL;
317 	}
318 out:
319 	if (ctx != (void *)data)
320 		kfree(ctx);
321 	return err;
322 }
323 
324 #define IB_UVERBS_MAX_CMD_SZ 4096
325 
326 long ib_uverbs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
327 {
328 	struct ib_uverbs_file *file = filp->private_data;
329 	struct ib_uverbs_ioctl_hdr __user *user_hdr =
330 		(struct ib_uverbs_ioctl_hdr __user *)arg;
331 	struct ib_uverbs_ioctl_hdr hdr;
332 	struct ib_device *ib_dev;
333 	int srcu_key;
334 	long err;
335 
336 	srcu_key = srcu_read_lock(&file->device->disassociate_srcu);
337 	ib_dev = srcu_dereference(file->device->ib_dev,
338 				  &file->device->disassociate_srcu);
339 	if (!ib_dev) {
340 		err = -EIO;
341 		goto out;
342 	}
343 
344 	if (cmd == RDMA_VERBS_IOCTL) {
345 		err = copy_from_user(&hdr, user_hdr, sizeof(hdr));
346 
347 		if (err || hdr.length > IB_UVERBS_MAX_CMD_SZ ||
348 		    hdr.length != sizeof(hdr) + hdr.num_attrs * sizeof(struct ib_uverbs_attr)) {
349 			err = -EINVAL;
350 			goto out;
351 		}
352 
353 		if (hdr.reserved) {
354 			err = -EPROTONOSUPPORT;
355 			goto out;
356 		}
357 
358 		err = ib_uverbs_cmd_verbs(ib_dev, file, &hdr,
359 					  (__user void *)arg + sizeof(hdr));
360 	} else {
361 		err = -ENOIOCTLCMD;
362 	}
363 out:
364 	srcu_read_unlock(&file->device->disassociate_srcu, srcu_key);
365 
366 	return err;
367 }
368