1 #ifndef _ASM_X86_UACCESS_H
2 #define _ASM_X86_UACCESS_H
3 /*
4 * User space memory access functions
5 */
6 #include <linux/errno.h>
7 #include <linux/compiler.h>
8 #include <linux/thread_info.h>
9 #include <linux/string.h>
10 #include <asm/asm.h>
11 #include <asm/page.h>
12 #include <asm/smap.h>
13
14 #define VERIFY_READ 0
15 #define VERIFY_WRITE 1
16
17 /*
18 * The fs value determines whether argument validity checking should be
19 * performed or not. If get_fs() == USER_DS, checking is performed, with
20 * get_fs() == KERNEL_DS, checking is bypassed.
21 *
22 * For historical reasons, these macros are grossly misnamed.
23 */
24
25 #define MAKE_MM_SEG(s) ((mm_segment_t) { (s) })
26
27 #define KERNEL_DS MAKE_MM_SEG(-1UL)
28 #define USER_DS MAKE_MM_SEG(TASK_SIZE_MAX)
29
30 #define get_ds() (KERNEL_DS)
31 #define get_fs() (current_thread_info()->addr_limit)
32 #define set_fs(x) (current_thread_info()->addr_limit = (x))
33
34 #define segment_eq(a, b) ((a).seg == (b).seg)
35
36 #define user_addr_max() (current_thread_info()->addr_limit.seg)
37 #define __addr_ok(addr) \
38 ((unsigned long __force)(addr) < user_addr_max())
39
40 /*
41 * Test whether a block of memory is a valid user space address.
42 * Returns 0 if the range is valid, nonzero otherwise.
43 */
__chk_range_not_ok(unsigned long addr,unsigned long size,unsigned long limit)44 static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, unsigned long limit)
45 {
46 /*
47 * If we have used "sizeof()" for the size,
48 * we know it won't overflow the limit (but
49 * it might overflow the 'addr', so it's
50 * important to subtract the size from the
51 * limit, not add it to the address).
52 */
53 if (__builtin_constant_p(size))
54 return addr > limit - size;
55
56 /* Arbitrary sizes? Be careful about overflow */
57 addr += size;
58 if (addr < size)
59 return true;
60 return addr > limit;
61 }
62
63 #define __range_not_ok(addr, size, limit) \
64 ({ \
65 __chk_user_ptr(addr); \
66 __chk_range_not_ok((unsigned long __force)(addr), size, limit); \
67 })
68
69 /**
70 * access_ok: - Checks if a user space pointer is valid
71 * @type: Type of access: %VERIFY_READ or %VERIFY_WRITE. Note that
72 * %VERIFY_WRITE is a superset of %VERIFY_READ - if it is safe
73 * to write to a block, it is always safe to read from it.
74 * @addr: User space pointer to start of block to check
75 * @size: Size of block to check
76 *
77 * Context: User context only. This function may sleep.
78 *
79 * Checks if a pointer to a block of memory in user space is valid.
80 *
81 * Returns true (nonzero) if the memory block may be valid, false (zero)
82 * if it is definitely invalid.
83 *
84 * Note that, depending on architecture, this function probably just
85 * checks that the pointer is in the user space range - after calling
86 * this function, memory access functions may still return -EFAULT.
87 */
88 #define access_ok(type, addr, size) \
89 likely(!__range_not_ok(addr, size, user_addr_max()))
90
91 /*
92 * The exception table consists of pairs of addresses relative to the
93 * exception table enty itself: the first is the address of an
94 * instruction that is allowed to fault, and the second is the address
95 * at which the program should continue. No registers are modified,
96 * so it is entirely up to the continuation code to figure out what to
97 * do.
98 *
99 * All the routines below use bits of fixup code that are out of line
100 * with the main instruction path. This means when everything is well,
101 * we don't even have to jump over them. Further, they do not intrude
102 * on our cache or tlb entries.
103 */
104
105 struct exception_table_entry {
106 int insn, fixup;
107 };
108 /* This is not the generic standard exception_table_entry format */
109 #define ARCH_HAS_SORT_EXTABLE
110 #define ARCH_HAS_SEARCH_EXTABLE
111
112 extern int fixup_exception(struct pt_regs *regs);
113 extern int early_fixup_exception(unsigned long *ip);
114
115 /*
116 * These are the main single-value transfer routines. They automatically
117 * use the right size if we just have the right pointer type.
118 *
119 * This gets kind of ugly. We want to return _two_ values in "get_user()"
120 * and yet we don't want to do any pointers, because that is too much
121 * of a performance impact. Thus we have a few rather ugly macros here,
122 * and hide all the ugliness from the user.
123 *
124 * The "__xxx" versions of the user access functions are versions that
125 * do not verify the address space, that must have been done previously
126 * with a separate "access_ok()" call (this is used when we do multiple
127 * accesses to the same area of user memory).
128 */
129
130 extern int __get_user_1(void);
131 extern int __get_user_2(void);
132 extern int __get_user_4(void);
133 extern int __get_user_8(void);
134 extern int __get_user_bad(void);
135
136 #define __uaccess_begin() stac()
137 #define __uaccess_end() clac()
138
139 /*
140 * This is a type: either unsigned long, if the argument fits into
141 * that type, or otherwise unsigned long long.
142 */
143 #define __inttype(x) \
144 __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
145
146 /**
147 * get_user: - Get a simple variable from user space.
148 * @x: Variable to store result.
149 * @ptr: Source address, in user space.
150 *
151 * Context: User context only. This function may sleep.
152 *
153 * This macro copies a single simple variable from user space to kernel
154 * space. It supports simple types like char and int, but not larger
155 * data types like structures or arrays.
156 *
157 * @ptr must have pointer-to-simple-variable type, and the result of
158 * dereferencing @ptr must be assignable to @x without a cast.
159 *
160 * Returns zero on success, or -EFAULT on error.
161 * On error, the variable @x is set to zero.
162 */
163 /*
164 * Careful: we have to cast the result to the type of the pointer
165 * for sign reasons.
166 *
167 * The use of _ASM_DX as the register specifier is a bit of a
168 * simplification, as gcc only cares about it as the starting point
169 * and not size: for a 64-bit value it will use %ecx:%edx on 32 bits
170 * (%ecx being the next register in gcc's x86 register sequence), and
171 * %rdx on 64 bits.
172 *
173 * Clang/LLVM cares about the size of the register, but still wants
174 * the base register for something that ends up being a pair.
175 */
176 #define get_user(x, ptr) \
177 ({ \
178 int __ret_gu; \
179 register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX); \
180 __chk_user_ptr(ptr); \
181 might_fault(); \
182 asm volatile("call __get_user_%P3" \
183 : "=a" (__ret_gu), "=r" (__val_gu) \
184 : "0" (ptr), "i" (sizeof(*(ptr)))); \
185 (x) = (__force __typeof__(*(ptr))) __val_gu; \
186 __builtin_expect(__ret_gu, 0); \
187 })
188
189 #define __put_user_x(size, x, ptr, __ret_pu) \
190 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
191 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
192
193
194
195 #ifdef CONFIG_X86_32
196 #define __put_user_asm_u64(x, addr, err, errret) \
197 asm volatile("\n" \
198 "1: movl %%eax,0(%2)\n" \
199 "2: movl %%edx,4(%2)\n" \
200 "3:" \
201 ".section .fixup,\"ax\"\n" \
202 "4: movl %3,%0\n" \
203 " jmp 3b\n" \
204 ".previous\n" \
205 _ASM_EXTABLE(1b, 4b) \
206 _ASM_EXTABLE(2b, 4b) \
207 : "=r" (err) \
208 : "A" (x), "r" (addr), "i" (errret), "0" (err))
209
210 #define __put_user_asm_ex_u64(x, addr) \
211 asm volatile("\n" \
212 "1: movl %%eax,0(%1)\n" \
213 "2: movl %%edx,4(%1)\n" \
214 "3:" \
215 _ASM_EXTABLE_EX(1b, 2b) \
216 _ASM_EXTABLE_EX(2b, 3b) \
217 : : "A" (x), "r" (addr))
218
219 #define __put_user_x8(x, ptr, __ret_pu) \
220 asm volatile("call __put_user_8" : "=a" (__ret_pu) \
221 : "A" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
222 #else
223 #define __put_user_asm_u64(x, ptr, retval, errret) \
224 __put_user_asm(x, ptr, retval, "q", "", "er", errret)
225 #define __put_user_asm_ex_u64(x, addr) \
226 __put_user_asm_ex(x, addr, "q", "", "er")
227 #define __put_user_x8(x, ptr, __ret_pu) __put_user_x(8, x, ptr, __ret_pu)
228 #endif
229
230 extern void __put_user_bad(void);
231
232 /*
233 * Strange magic calling convention: pointer in %ecx,
234 * value in %eax(:%edx), return value in %eax. clobbers %rbx
235 */
236 extern void __put_user_1(void);
237 extern void __put_user_2(void);
238 extern void __put_user_4(void);
239 extern void __put_user_8(void);
240
241 /**
242 * put_user: - Write a simple value into user space.
243 * @x: Value to copy to user space.
244 * @ptr: Destination address, in user space.
245 *
246 * Context: User context only. This function may sleep.
247 *
248 * This macro copies a single simple value from kernel space to user
249 * space. It supports simple types like char and int, but not larger
250 * data types like structures or arrays.
251 *
252 * @ptr must have pointer-to-simple-variable type, and @x must be assignable
253 * to the result of dereferencing @ptr.
254 *
255 * Returns zero on success, or -EFAULT on error.
256 */
257 #define put_user(x, ptr) \
258 ({ \
259 int __ret_pu; \
260 __typeof__(*(ptr)) __pu_val; \
261 __chk_user_ptr(ptr); \
262 might_fault(); \
263 __pu_val = x; \
264 switch (sizeof(*(ptr))) { \
265 case 1: \
266 __put_user_x(1, __pu_val, ptr, __ret_pu); \
267 break; \
268 case 2: \
269 __put_user_x(2, __pu_val, ptr, __ret_pu); \
270 break; \
271 case 4: \
272 __put_user_x(4, __pu_val, ptr, __ret_pu); \
273 break; \
274 case 8: \
275 __put_user_x8(__pu_val, ptr, __ret_pu); \
276 break; \
277 default: \
278 __put_user_x(X, __pu_val, ptr, __ret_pu); \
279 break; \
280 } \
281 __builtin_expect(__ret_pu, 0); \
282 })
283
284 #define __put_user_size(x, ptr, size, retval, errret) \
285 do { \
286 retval = 0; \
287 __chk_user_ptr(ptr); \
288 switch (size) { \
289 case 1: \
290 __put_user_asm(x, ptr, retval, "b", "b", "iq", errret); \
291 break; \
292 case 2: \
293 __put_user_asm(x, ptr, retval, "w", "w", "ir", errret); \
294 break; \
295 case 4: \
296 __put_user_asm(x, ptr, retval, "l", "k", "ir", errret); \
297 break; \
298 case 8: \
299 __put_user_asm_u64((__typeof__(*ptr))(x), ptr, retval, \
300 errret); \
301 break; \
302 default: \
303 __put_user_bad(); \
304 } \
305 } while (0)
306
307 /*
308 * This doesn't do __uaccess_begin/end - the exception handling
309 * around it must do that.
310 */
311 #define __put_user_size_ex(x, ptr, size) \
312 do { \
313 __chk_user_ptr(ptr); \
314 switch (size) { \
315 case 1: \
316 __put_user_asm_ex(x, ptr, "b", "b", "iq"); \
317 break; \
318 case 2: \
319 __put_user_asm_ex(x, ptr, "w", "w", "ir"); \
320 break; \
321 case 4: \
322 __put_user_asm_ex(x, ptr, "l", "k", "ir"); \
323 break; \
324 case 8: \
325 __put_user_asm_ex_u64((__typeof__(*ptr))(x), ptr); \
326 break; \
327 default: \
328 __put_user_bad(); \
329 } \
330 } while (0)
331
332 #ifdef CONFIG_X86_32
333 #define __get_user_asm_u64(x, ptr, retval, errret) (x) = __get_user_bad()
334 #define __get_user_asm_ex_u64(x, ptr) (x) = __get_user_bad()
335 #else
336 #define __get_user_asm_u64(x, ptr, retval, errret) \
337 __get_user_asm(x, ptr, retval, "q", "", "=r", errret)
338 #define __get_user_asm_ex_u64(x, ptr) \
339 __get_user_asm_ex(x, ptr, "q", "", "=&r")
340 #endif
341
342 #define __get_user_size(x, ptr, size, retval, errret) \
343 do { \
344 retval = 0; \
345 __chk_user_ptr(ptr); \
346 switch (size) { \
347 case 1: \
348 __get_user_asm(x, ptr, retval, "b", "b", "=q", errret); \
349 break; \
350 case 2: \
351 __get_user_asm(x, ptr, retval, "w", "w", "=r", errret); \
352 break; \
353 case 4: \
354 __get_user_asm(x, ptr, retval, "l", "k", "=r", errret); \
355 break; \
356 case 8: \
357 __get_user_asm_u64(x, ptr, retval, errret); \
358 break; \
359 default: \
360 (x) = __get_user_bad(); \
361 } \
362 } while (0)
363
364 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
365 asm volatile("\n" \
366 "1: mov"itype" %2,%"rtype"1\n" \
367 "2:\n" \
368 ".section .fixup,\"ax\"\n" \
369 "3: mov %3,%0\n" \
370 " xor"itype" %"rtype"1,%"rtype"1\n" \
371 " jmp 2b\n" \
372 ".previous\n" \
373 _ASM_EXTABLE(1b, 3b) \
374 : "=r" (err), ltype(x) \
375 : "m" (__m(addr)), "i" (errret), "0" (err))
376
377 /*
378 * This doesn't do __uaccess_begin/end - the exception handling
379 * around it must do that.
380 */
381 #define __get_user_size_ex(x, ptr, size) \
382 do { \
383 __chk_user_ptr(ptr); \
384 switch (size) { \
385 case 1: \
386 __get_user_asm_ex(x, ptr, "b", "b", "=&q"); \
387 break; \
388 case 2: \
389 __get_user_asm_ex(x, ptr, "w", "w", "=&r"); \
390 break; \
391 case 4: \
392 __get_user_asm_ex(x, ptr, "l", "k", "=&r"); \
393 break; \
394 case 8: \
395 __get_user_asm_ex_u64(x, ptr); \
396 break; \
397 default: \
398 (x) = __get_user_bad(); \
399 } \
400 } while (0)
401
402 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
403 asm volatile("1: mov"itype" %1,%"rtype"0\n" \
404 "2:\n" \
405 ".section .fixup,\"ax\"\n" \
406 "3:xor"itype" %"rtype"0,%"rtype"0\n" \
407 " jmp 2b\n" \
408 ".previous\n" \
409 _ASM_EXTABLE_EX(1b, 3b) \
410 : ltype(x) : "m" (__m(addr)), "0" (0))
411
412 #define __put_user_nocheck(x, ptr, size) \
413 ({ \
414 int __pu_err; \
415 __uaccess_begin(); \
416 __put_user_size((x), (ptr), (size), __pu_err, -EFAULT); \
417 __uaccess_end(); \
418 __builtin_expect(__pu_err, 0); \
419 })
420
421 #define __get_user_nocheck(x, ptr, size) \
422 ({ \
423 int __gu_err; \
424 unsigned long __gu_val; \
425 __uaccess_begin(); \
426 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
427 __uaccess_end(); \
428 (x) = (__force __typeof__(*(ptr)))__gu_val; \
429 __builtin_expect(__gu_err, 0); \
430 })
431
432 /* FIXME: this hack is definitely wrong -AK */
433 struct __large_struct { unsigned long buf[100]; };
434 #define __m(x) (*(struct __large_struct __user *)(x))
435
436 /*
437 * Tell gcc we read from memory instead of writing: this is because
438 * we do not write to any memory gcc knows about, so there are no
439 * aliasing issues.
440 */
441 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
442 asm volatile("\n" \
443 "1: mov"itype" %"rtype"1,%2\n" \
444 "2:\n" \
445 ".section .fixup,\"ax\"\n" \
446 "3: mov %3,%0\n" \
447 " jmp 2b\n" \
448 ".previous\n" \
449 _ASM_EXTABLE(1b, 3b) \
450 : "=r"(err) \
451 : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
452
453 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
454 asm volatile("1: mov"itype" %"rtype"0,%1\n" \
455 "2:\n" \
456 _ASM_EXTABLE_EX(1b, 2b) \
457 : : ltype(x), "m" (__m(addr)))
458
459 /*
460 * uaccess_try and catch
461 */
462 #define uaccess_try do { \
463 current_thread_info()->uaccess_err = 0; \
464 __uaccess_begin(); \
465 barrier();
466
467 #define uaccess_catch(err) \
468 __uaccess_end(); \
469 (err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0); \
470 } while (0)
471
472 /**
473 * __get_user: - Get a simple variable from user space, with less checking.
474 * @x: Variable to store result.
475 * @ptr: Source address, in user space.
476 *
477 * Context: User context only. This function may sleep.
478 *
479 * This macro copies a single simple variable from user space to kernel
480 * space. It supports simple types like char and int, but not larger
481 * data types like structures or arrays.
482 *
483 * @ptr must have pointer-to-simple-variable type, and the result of
484 * dereferencing @ptr must be assignable to @x without a cast.
485 *
486 * Caller must check the pointer with access_ok() before calling this
487 * function.
488 *
489 * Returns zero on success, or -EFAULT on error.
490 * On error, the variable @x is set to zero.
491 */
492
493 #define __get_user(x, ptr) \
494 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
495
496 /**
497 * __put_user: - Write a simple value into user space, with less checking.
498 * @x: Value to copy to user space.
499 * @ptr: Destination address, in user space.
500 *
501 * Context: User context only. This function may sleep.
502 *
503 * This macro copies a single simple value from kernel space to user
504 * space. It supports simple types like char and int, but not larger
505 * data types like structures or arrays.
506 *
507 * @ptr must have pointer-to-simple-variable type, and @x must be assignable
508 * to the result of dereferencing @ptr.
509 *
510 * Caller must check the pointer with access_ok() before calling this
511 * function.
512 *
513 * Returns zero on success, or -EFAULT on error.
514 */
515
516 #define __put_user(x, ptr) \
517 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
518
519 #define __get_user_unaligned __get_user
520 #define __put_user_unaligned __put_user
521
522 /*
523 * {get|put}_user_try and catch
524 *
525 * get_user_try {
526 * get_user_ex(...);
527 * } get_user_catch(err)
528 */
529 #define get_user_try uaccess_try
530 #define get_user_catch(err) uaccess_catch(err)
531
532 #define get_user_ex(x, ptr) do { \
533 unsigned long __gue_val; \
534 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
535 (x) = (__force __typeof__(*(ptr)))__gue_val; \
536 } while (0)
537
538 #define put_user_try uaccess_try
539 #define put_user_catch(err) uaccess_catch(err)
540
541 #define put_user_ex(x, ptr) \
542 __put_user_size_ex((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
543
544 extern unsigned long
545 copy_from_user_nmi(void *to, const void __user *from, unsigned long n);
546 extern __must_check long
547 strncpy_from_user(char *dst, const char __user *src, long count);
548
549 extern __must_check long strlen_user(const char __user *str);
550 extern __must_check long strnlen_user(const char __user *str, long n);
551
552 unsigned long __must_check clear_user(void __user *mem, unsigned long len);
553 unsigned long __must_check __clear_user(void __user *mem, unsigned long len);
554
555 extern void __cmpxchg_wrong_size(void)
556 __compiletime_error("Bad argument size for cmpxchg");
557
558 #define __user_atomic_cmpxchg_inatomic(uval, ptr, old, new, size) \
559 ({ \
560 int __ret = 0; \
561 __typeof__(ptr) __uval = (uval); \
562 __typeof__(*(ptr)) __old = (old); \
563 __typeof__(*(ptr)) __new = (new); \
564 __uaccess_begin(); \
565 switch (size) { \
566 case 1: \
567 { \
568 asm volatile("\n" \
569 "1:\t" LOCK_PREFIX "cmpxchgb %4, %2\n" \
570 "2:\n" \
571 "\t.section .fixup, \"ax\"\n" \
572 "3:\tmov %3, %0\n" \
573 "\tjmp 2b\n" \
574 "\t.previous\n" \
575 _ASM_EXTABLE(1b, 3b) \
576 : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
577 : "i" (-EFAULT), "q" (__new), "1" (__old) \
578 : "memory" \
579 ); \
580 break; \
581 } \
582 case 2: \
583 { \
584 asm volatile("\n" \
585 "1:\t" LOCK_PREFIX "cmpxchgw %4, %2\n" \
586 "2:\n" \
587 "\t.section .fixup, \"ax\"\n" \
588 "3:\tmov %3, %0\n" \
589 "\tjmp 2b\n" \
590 "\t.previous\n" \
591 _ASM_EXTABLE(1b, 3b) \
592 : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
593 : "i" (-EFAULT), "r" (__new), "1" (__old) \
594 : "memory" \
595 ); \
596 break; \
597 } \
598 case 4: \
599 { \
600 asm volatile("\n" \
601 "1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n" \
602 "2:\n" \
603 "\t.section .fixup, \"ax\"\n" \
604 "3:\tmov %3, %0\n" \
605 "\tjmp 2b\n" \
606 "\t.previous\n" \
607 _ASM_EXTABLE(1b, 3b) \
608 : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
609 : "i" (-EFAULT), "r" (__new), "1" (__old) \
610 : "memory" \
611 ); \
612 break; \
613 } \
614 case 8: \
615 { \
616 if (!IS_ENABLED(CONFIG_X86_64)) \
617 __cmpxchg_wrong_size(); \
618 \
619 asm volatile("\n" \
620 "1:\t" LOCK_PREFIX "cmpxchgq %4, %2\n" \
621 "2:\n" \
622 "\t.section .fixup, \"ax\"\n" \
623 "3:\tmov %3, %0\n" \
624 "\tjmp 2b\n" \
625 "\t.previous\n" \
626 _ASM_EXTABLE(1b, 3b) \
627 : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
628 : "i" (-EFAULT), "r" (__new), "1" (__old) \
629 : "memory" \
630 ); \
631 break; \
632 } \
633 default: \
634 __cmpxchg_wrong_size(); \
635 } \
636 __uaccess_end(); \
637 *__uval = __old; \
638 __ret; \
639 })
640
641 #define user_atomic_cmpxchg_inatomic(uval, ptr, old, new) \
642 ({ \
643 access_ok(VERIFY_WRITE, (ptr), sizeof(*(ptr))) ? \
644 __user_atomic_cmpxchg_inatomic((uval), (ptr), \
645 (old), (new), sizeof(*(ptr))) : \
646 -EFAULT; \
647 })
648
649 /*
650 * movsl can be slow when source and dest are not both 8-byte aligned
651 */
652 #ifdef CONFIG_X86_INTEL_USERCOPY
653 extern struct movsl_mask {
654 int mask;
655 } ____cacheline_aligned_in_smp movsl_mask;
656 #endif
657
658 #define ARCH_HAS_NOCACHE_UACCESS 1
659
660 #ifdef CONFIG_X86_32
661 # include <asm/uaccess_32.h>
662 #else
663 # include <asm/uaccess_64.h>
664 #endif
665
666 unsigned long __must_check _copy_from_user(void *to, const void __user *from,
667 unsigned n);
668 unsigned long __must_check _copy_to_user(void __user *to, const void *from,
669 unsigned n);
670
671 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
672 # define copy_user_diag __compiletime_error
673 #else
674 # define copy_user_diag __compiletime_warning
675 #endif
676
677 extern void copy_user_diag("copy_from_user() buffer size is too small")
678 copy_from_user_overflow(void);
679 extern void copy_user_diag("copy_to_user() buffer size is too small")
680 copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
681
682 #undef copy_user_diag
683
684 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
685
686 extern void
687 __compiletime_warning("copy_from_user() buffer size is not provably correct")
688 __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
689 #define __copy_from_user_overflow(size, count) __copy_from_user_overflow()
690
691 extern void
692 __compiletime_warning("copy_to_user() buffer size is not provably correct")
693 __copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
694 #define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
695
696 #else
697
698 static inline void
__copy_from_user_overflow(int size,unsigned long count)699 __copy_from_user_overflow(int size, unsigned long count)
700 {
701 WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
702 }
703
704 #define __copy_to_user_overflow __copy_from_user_overflow
705
706 #endif
707
708 static __always_inline unsigned long __must_check
copy_from_user(void * to,const void __user * from,unsigned long n)709 copy_from_user(void *to, const void __user *from, unsigned long n)
710 {
711 int sz = __compiletime_object_size(to);
712
713 might_fault();
714
715 /*
716 * While we would like to have the compiler do the checking for us
717 * even in the non-constant size case, any false positives there are
718 * a problem (especially when DEBUG_STRICT_USER_COPY_CHECKS, but even
719 * without - the [hopefully] dangerous looking nature of the warning
720 * would make people go look at the respecitive call sites over and
721 * over again just to find that there's no problem).
722 *
723 * And there are cases where it's just not realistic for the compiler
724 * to prove the count to be in range. For example when multiple call
725 * sites of a helper function - perhaps in different source files -
726 * all doing proper range checking, yet the helper function not doing
727 * so again.
728 *
729 * Therefore limit the compile time checking to the constant size
730 * case, and do only runtime checking for non-constant sizes.
731 */
732
733 if (likely(sz < 0 || sz >= n)) {
734 check_object_size(to, n, false);
735 n = _copy_from_user(to, from, n);
736 } else if (__builtin_constant_p(n))
737 copy_from_user_overflow();
738 else
739 __copy_from_user_overflow(sz, n);
740
741 return n;
742 }
743
744 static __always_inline unsigned long __must_check
copy_to_user(void __user * to,const void * from,unsigned long n)745 copy_to_user(void __user *to, const void *from, unsigned long n)
746 {
747 int sz = __compiletime_object_size(from);
748
749 might_fault();
750
751 /* See the comment in copy_from_user() above. */
752 if (likely(sz < 0 || sz >= n)) {
753 check_object_size(from, n, true);
754 n = _copy_to_user(to, from, n);
755 } else if (__builtin_constant_p(n))
756 copy_to_user_overflow();
757 else
758 __copy_to_user_overflow(sz, n);
759
760 return n;
761 }
762
763 #undef __copy_from_user_overflow
764 #undef __copy_to_user_overflow
765
766 /*
767 * The "unsafe" user accesses aren't really "unsafe", but the naming
768 * is a big fat warning: you have to not only do the access_ok()
769 * checking before using them, but you have to surround them with the
770 * user_access_begin/end() pair.
771 */
772 #define user_access_begin() __uaccess_begin()
773 #define user_access_end() __uaccess_end()
774
775 #define unsafe_put_user(x, ptr, err_label) \
776 do { \
777 int __pu_err; \
778 __put_user_size((x), (ptr), sizeof(*(ptr)), __pu_err, -EFAULT); \
779 if (unlikely(__pu_err)) goto err_label; \
780 } while (0)
781
782 #define unsafe_get_user(x, ptr, err_label) \
783 do { \
784 int __gu_err; \
785 unsigned long __gu_val; \
786 __get_user_size(__gu_val, (ptr), sizeof(*(ptr)), __gu_err, -EFAULT); \
787 (x) = (__force __typeof__(*(ptr)))__gu_val; \
788 if (unlikely(__gu_err)) goto err_label; \
789 } while (0)
790
791 #endif /* _ASM_X86_UACCESS_H */
792
793