1 /* 2 * linux/mm/process_vm_access.c 3 * 4 * Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp. 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/mm.h> 13 #include <linux/uio.h> 14 #include <linux/sched.h> 15 #include <linux/highmem.h> 16 #include <linux/ptrace.h> 17 #include <linux/slab.h> 18 #include <linux/syscalls.h> 19 20 #ifdef CONFIG_COMPAT 21 #include <linux/compat.h> 22 #endif 23 24 /** 25 * process_vm_rw_pages - read/write pages from task specified 26 * @pages: array of pointers to pages we want to copy 27 * @start_offset: offset in page to start copying from/to 28 * @len: number of bytes to copy 29 * @iter: where to copy to/from locally 30 * @vm_write: 0 means copy from, 1 means copy to 31 * Returns 0 on success, error code otherwise 32 */ 33 static int process_vm_rw_pages(struct page **pages, 34 unsigned offset, 35 size_t len, 36 struct iov_iter *iter, 37 int vm_write) 38 { 39 /* Do the copy for each page */ 40 while (len && iov_iter_count(iter)) { 41 struct page *page = *pages++; 42 size_t copy = PAGE_SIZE - offset; 43 size_t copied; 44 45 if (copy > len) 46 copy = len; 47 48 if (vm_write) { 49 copied = copy_page_from_iter(page, offset, copy, iter); 50 set_page_dirty_lock(page); 51 } else { 52 copied = copy_page_to_iter(page, offset, copy, iter); 53 } 54 len -= copied; 55 if (copied < copy && iov_iter_count(iter)) 56 return -EFAULT; 57 offset = 0; 58 } 59 return 0; 60 } 61 62 /* Maximum number of pages kmalloc'd to hold struct page's during copy */ 63 #define PVM_MAX_KMALLOC_PAGES (PAGE_SIZE * 2) 64 65 /** 66 * process_vm_rw_single_vec - read/write pages from task specified 67 * @addr: start memory address of target process 68 * @len: size of area to copy to/from 69 * @iter: where to copy to/from locally 70 * @process_pages: struct pages area that can store at least 71 * nr_pages_to_copy struct page pointers 72 * @mm: mm for task 73 * @task: task to read/write from 74 * @vm_write: 0 means copy from, 1 means copy to 75 * Returns 0 on success or on failure error code 76 */ 77 static int process_vm_rw_single_vec(unsigned long addr, 78 unsigned long len, 79 struct iov_iter *iter, 80 struct page **process_pages, 81 struct mm_struct *mm, 82 struct task_struct *task, 83 int vm_write) 84 { 85 unsigned long pa = addr & PAGE_MASK; 86 unsigned long start_offset = addr - pa; 87 unsigned long nr_pages; 88 ssize_t rc = 0; 89 unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES 90 / sizeof(struct pages *); 91 92 /* Work out address and page range required */ 93 if (len == 0) 94 return 0; 95 nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1; 96 97 while (!rc && nr_pages && iov_iter_count(iter)) { 98 int pages = min(nr_pages, max_pages_per_loop); 99 size_t bytes; 100 101 /* Get the pages we're interested in */ 102 down_read(&mm->mmap_sem); 103 pages = get_user_pages(task, mm, pa, pages, 104 vm_write, 0, process_pages, NULL); 105 up_read(&mm->mmap_sem); 106 107 if (pages <= 0) 108 return -EFAULT; 109 110 bytes = pages * PAGE_SIZE - start_offset; 111 if (bytes > len) 112 bytes = len; 113 114 rc = process_vm_rw_pages(process_pages, 115 start_offset, bytes, iter, 116 vm_write); 117 len -= bytes; 118 start_offset = 0; 119 nr_pages -= pages; 120 pa += pages * PAGE_SIZE; 121 while (pages) 122 put_page(process_pages[--pages]); 123 } 124 125 return rc; 126 } 127 128 /* Maximum number of entries for process pages array 129 which lives on stack */ 130 #define PVM_MAX_PP_ARRAY_COUNT 16 131 132 /** 133 * process_vm_rw_core - core of reading/writing pages from task specified 134 * @pid: PID of process to read/write from/to 135 * @iter: where to copy to/from locally 136 * @rvec: iovec array specifying where to copy to/from in the other process 137 * @riovcnt: size of rvec array 138 * @flags: currently unused 139 * @vm_write: 0 if reading from other process, 1 if writing to other process 140 * Returns the number of bytes read/written or error code. May 141 * return less bytes than expected if an error occurs during the copying 142 * process. 143 */ 144 static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter, 145 const struct iovec *rvec, 146 unsigned long riovcnt, 147 unsigned long flags, int vm_write) 148 { 149 struct task_struct *task; 150 struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT]; 151 struct page **process_pages = pp_stack; 152 struct mm_struct *mm; 153 unsigned long i; 154 ssize_t rc = 0; 155 unsigned long nr_pages = 0; 156 unsigned long nr_pages_iov; 157 ssize_t iov_len; 158 size_t total_len = iov_iter_count(iter); 159 160 /* 161 * Work out how many pages of struct pages we're going to need 162 * when eventually calling get_user_pages 163 */ 164 for (i = 0; i < riovcnt; i++) { 165 iov_len = rvec[i].iov_len; 166 if (iov_len > 0) { 167 nr_pages_iov = ((unsigned long)rvec[i].iov_base 168 + iov_len) 169 / PAGE_SIZE - (unsigned long)rvec[i].iov_base 170 / PAGE_SIZE + 1; 171 nr_pages = max(nr_pages, nr_pages_iov); 172 } 173 } 174 175 if (nr_pages == 0) 176 return 0; 177 178 if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) { 179 /* For reliability don't try to kmalloc more than 180 2 pages worth */ 181 process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES, 182 sizeof(struct pages *)*nr_pages), 183 GFP_KERNEL); 184 185 if (!process_pages) 186 return -ENOMEM; 187 } 188 189 /* Get process information */ 190 rcu_read_lock(); 191 task = find_task_by_vpid(pid); 192 if (task) 193 get_task_struct(task); 194 rcu_read_unlock(); 195 if (!task) { 196 rc = -ESRCH; 197 goto free_proc_pages; 198 } 199 200 mm = mm_access(task, PTRACE_MODE_ATTACH); 201 if (!mm || IS_ERR(mm)) { 202 rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; 203 /* 204 * Explicitly map EACCES to EPERM as EPERM is a more a 205 * appropriate error code for process_vw_readv/writev 206 */ 207 if (rc == -EACCES) 208 rc = -EPERM; 209 goto put_task_struct; 210 } 211 212 for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++) 213 rc = process_vm_rw_single_vec( 214 (unsigned long)rvec[i].iov_base, rvec[i].iov_len, 215 iter, process_pages, mm, task, vm_write); 216 217 /* copied = space before - space after */ 218 total_len -= iov_iter_count(iter); 219 220 /* If we have managed to copy any data at all then 221 we return the number of bytes copied. Otherwise 222 we return the error code */ 223 if (total_len) 224 rc = total_len; 225 226 mmput(mm); 227 228 put_task_struct: 229 put_task_struct(task); 230 231 free_proc_pages: 232 if (process_pages != pp_stack) 233 kfree(process_pages); 234 return rc; 235 } 236 237 /** 238 * process_vm_rw - check iovecs before calling core routine 239 * @pid: PID of process to read/write from/to 240 * @lvec: iovec array specifying where to copy to/from locally 241 * @liovcnt: size of lvec array 242 * @rvec: iovec array specifying where to copy to/from in the other process 243 * @riovcnt: size of rvec array 244 * @flags: currently unused 245 * @vm_write: 0 if reading from other process, 1 if writing to other process 246 * Returns the number of bytes read/written or error code. May 247 * return less bytes than expected if an error occurs during the copying 248 * process. 249 */ 250 static ssize_t process_vm_rw(pid_t pid, 251 const struct iovec __user *lvec, 252 unsigned long liovcnt, 253 const struct iovec __user *rvec, 254 unsigned long riovcnt, 255 unsigned long flags, int vm_write) 256 { 257 struct iovec iovstack_l[UIO_FASTIOV]; 258 struct iovec iovstack_r[UIO_FASTIOV]; 259 struct iovec *iov_l = iovstack_l; 260 struct iovec *iov_r = iovstack_r; 261 struct iov_iter iter; 262 ssize_t rc; 263 264 if (flags != 0) 265 return -EINVAL; 266 267 /* Check iovecs */ 268 if (vm_write) 269 rc = rw_copy_check_uvector(WRITE, lvec, liovcnt, UIO_FASTIOV, 270 iovstack_l, &iov_l); 271 else 272 rc = rw_copy_check_uvector(READ, lvec, liovcnt, UIO_FASTIOV, 273 iovstack_l, &iov_l); 274 if (rc <= 0) 275 goto free_iovecs; 276 277 iov_iter_init(&iter, vm_write ? WRITE : READ, iov_l, liovcnt, rc); 278 279 rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV, 280 iovstack_r, &iov_r); 281 if (rc <= 0) 282 goto free_iovecs; 283 284 rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write); 285 286 free_iovecs: 287 if (iov_r != iovstack_r) 288 kfree(iov_r); 289 if (iov_l != iovstack_l) 290 kfree(iov_l); 291 292 return rc; 293 } 294 295 SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec, 296 unsigned long, liovcnt, const struct iovec __user *, rvec, 297 unsigned long, riovcnt, unsigned long, flags) 298 { 299 return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0); 300 } 301 302 SYSCALL_DEFINE6(process_vm_writev, pid_t, pid, 303 const struct iovec __user *, lvec, 304 unsigned long, liovcnt, const struct iovec __user *, rvec, 305 unsigned long, riovcnt, unsigned long, flags) 306 { 307 return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1); 308 } 309 310 #ifdef CONFIG_COMPAT 311 312 static ssize_t 313 compat_process_vm_rw(compat_pid_t pid, 314 const struct compat_iovec __user *lvec, 315 unsigned long liovcnt, 316 const struct compat_iovec __user *rvec, 317 unsigned long riovcnt, 318 unsigned long flags, int vm_write) 319 { 320 struct iovec iovstack_l[UIO_FASTIOV]; 321 struct iovec iovstack_r[UIO_FASTIOV]; 322 struct iovec *iov_l = iovstack_l; 323 struct iovec *iov_r = iovstack_r; 324 struct iov_iter iter; 325 ssize_t rc = -EFAULT; 326 327 if (flags != 0) 328 return -EINVAL; 329 330 if (vm_write) 331 rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt, 332 UIO_FASTIOV, iovstack_l, 333 &iov_l); 334 else 335 rc = compat_rw_copy_check_uvector(READ, lvec, liovcnt, 336 UIO_FASTIOV, iovstack_l, 337 &iov_l); 338 if (rc <= 0) 339 goto free_iovecs; 340 iov_iter_init(&iter, vm_write ? WRITE : READ, iov_l, liovcnt, rc); 341 rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, 342 UIO_FASTIOV, iovstack_r, 343 &iov_r); 344 if (rc <= 0) 345 goto free_iovecs; 346 347 rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write); 348 349 free_iovecs: 350 if (iov_r != iovstack_r) 351 kfree(iov_r); 352 if (iov_l != iovstack_l) 353 kfree(iov_l); 354 return rc; 355 } 356 357 COMPAT_SYSCALL_DEFINE6(process_vm_readv, compat_pid_t, pid, 358 const struct compat_iovec __user *, lvec, 359 compat_ulong_t, liovcnt, 360 const struct compat_iovec __user *, rvec, 361 compat_ulong_t, riovcnt, 362 compat_ulong_t, flags) 363 { 364 return compat_process_vm_rw(pid, lvec, liovcnt, rvec, 365 riovcnt, flags, 0); 366 } 367 368 COMPAT_SYSCALL_DEFINE6(process_vm_writev, compat_pid_t, pid, 369 const struct compat_iovec __user *, lvec, 370 compat_ulong_t, liovcnt, 371 const struct compat_iovec __user *, rvec, 372 compat_ulong_t, riovcnt, 373 compat_ulong_t, flags) 374 { 375 return compat_process_vm_rw(pid, lvec, liovcnt, rvec, 376 riovcnt, flags, 1); 377 } 378 379 #endif 380