1 /*
2 * linux/mm/process_vm_access.c
3 *
4 * Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp.
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12 #include <linux/mm.h>
13 #include <linux/uio.h>
14 #include <linux/sched.h>
15 #include <linux/highmem.h>
16 #include <linux/ptrace.h>
17 #include <linux/slab.h>
18 #include <linux/syscalls.h>
19
20 #ifdef CONFIG_COMPAT
21 #include <linux/compat.h>
22 #endif
23
24 /**
25 * process_vm_rw_pages - read/write pages from task specified
26 * @pages: array of pointers to pages we want to copy
27 * @start_offset: offset in page to start copying from/to
28 * @len: number of bytes to copy
29 * @iter: where to copy to/from locally
30 * @vm_write: 0 means copy from, 1 means copy to
31 * Returns 0 on success, error code otherwise
32 */
process_vm_rw_pages(struct page ** pages,unsigned offset,size_t len,struct iov_iter * iter,int vm_write)33 static int process_vm_rw_pages(struct page **pages,
34 unsigned offset,
35 size_t len,
36 struct iov_iter *iter,
37 int vm_write)
38 {
39 /* Do the copy for each page */
40 while (len && iov_iter_count(iter)) {
41 struct page *page = *pages++;
42 size_t copy = PAGE_SIZE - offset;
43 size_t copied;
44
45 if (copy > len)
46 copy = len;
47
48 if (vm_write) {
49 copied = copy_page_from_iter(page, offset, copy, iter);
50 set_page_dirty_lock(page);
51 } else {
52 copied = copy_page_to_iter(page, offset, copy, iter);
53 }
54 len -= copied;
55 if (copied < copy && iov_iter_count(iter))
56 return -EFAULT;
57 offset = 0;
58 }
59 return 0;
60 }
61
62 /* Maximum number of pages kmalloc'd to hold struct page's during copy */
63 #define PVM_MAX_KMALLOC_PAGES (PAGE_SIZE * 2)
64
65 /**
66 * process_vm_rw_single_vec - read/write pages from task specified
67 * @addr: start memory address of target process
68 * @len: size of area to copy to/from
69 * @iter: where to copy to/from locally
70 * @process_pages: struct pages area that can store at least
71 * nr_pages_to_copy struct page pointers
72 * @mm: mm for task
73 * @task: task to read/write from
74 * @vm_write: 0 means copy from, 1 means copy to
75 * Returns 0 on success or on failure error code
76 */
process_vm_rw_single_vec(unsigned long addr,unsigned long len,struct iov_iter * iter,struct page ** process_pages,struct mm_struct * mm,struct task_struct * task,int vm_write)77 static int process_vm_rw_single_vec(unsigned long addr,
78 unsigned long len,
79 struct iov_iter *iter,
80 struct page **process_pages,
81 struct mm_struct *mm,
82 struct task_struct *task,
83 int vm_write)
84 {
85 unsigned long pa = addr & PAGE_MASK;
86 unsigned long start_offset = addr - pa;
87 unsigned long nr_pages;
88 ssize_t rc = 0;
89 unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES
90 / sizeof(struct pages *);
91
92 /* Work out address and page range required */
93 if (len == 0)
94 return 0;
95 nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1;
96
97 while (!rc && nr_pages && iov_iter_count(iter)) {
98 int pages = min(nr_pages, max_pages_per_loop);
99 size_t bytes;
100
101 /* Get the pages we're interested in */
102 down_read(&mm->mmap_sem);
103 pages = get_user_pages(task, mm, pa, pages,
104 vm_write, 0, process_pages, NULL);
105 up_read(&mm->mmap_sem);
106
107 if (pages <= 0)
108 return -EFAULT;
109
110 bytes = pages * PAGE_SIZE - start_offset;
111 if (bytes > len)
112 bytes = len;
113
114 rc = process_vm_rw_pages(process_pages,
115 start_offset, bytes, iter,
116 vm_write);
117 len -= bytes;
118 start_offset = 0;
119 nr_pages -= pages;
120 pa += pages * PAGE_SIZE;
121 while (pages)
122 put_page(process_pages[--pages]);
123 }
124
125 return rc;
126 }
127
128 /* Maximum number of entries for process pages array
129 which lives on stack */
130 #define PVM_MAX_PP_ARRAY_COUNT 16
131
132 /**
133 * process_vm_rw_core - core of reading/writing pages from task specified
134 * @pid: PID of process to read/write from/to
135 * @iter: where to copy to/from locally
136 * @rvec: iovec array specifying where to copy to/from in the other process
137 * @riovcnt: size of rvec array
138 * @flags: currently unused
139 * @vm_write: 0 if reading from other process, 1 if writing to other process
140 * Returns the number of bytes read/written or error code. May
141 * return less bytes than expected if an error occurs during the copying
142 * process.
143 */
process_vm_rw_core(pid_t pid,struct iov_iter * iter,const struct iovec * rvec,unsigned long riovcnt,unsigned long flags,int vm_write)144 static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
145 const struct iovec *rvec,
146 unsigned long riovcnt,
147 unsigned long flags, int vm_write)
148 {
149 struct task_struct *task;
150 struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT];
151 struct page **process_pages = pp_stack;
152 struct mm_struct *mm;
153 unsigned long i;
154 ssize_t rc = 0;
155 unsigned long nr_pages = 0;
156 unsigned long nr_pages_iov;
157 ssize_t iov_len;
158 size_t total_len = iov_iter_count(iter);
159
160 /*
161 * Work out how many pages of struct pages we're going to need
162 * when eventually calling get_user_pages
163 */
164 for (i = 0; i < riovcnt; i++) {
165 iov_len = rvec[i].iov_len;
166 if (iov_len > 0) {
167 nr_pages_iov = ((unsigned long)rvec[i].iov_base
168 + iov_len)
169 / PAGE_SIZE - (unsigned long)rvec[i].iov_base
170 / PAGE_SIZE + 1;
171 nr_pages = max(nr_pages, nr_pages_iov);
172 }
173 }
174
175 if (nr_pages == 0)
176 return 0;
177
178 if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) {
179 /* For reliability don't try to kmalloc more than
180 2 pages worth */
181 process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES,
182 sizeof(struct pages *)*nr_pages),
183 GFP_KERNEL);
184
185 if (!process_pages)
186 return -ENOMEM;
187 }
188
189 /* Get process information */
190 rcu_read_lock();
191 task = find_task_by_vpid(pid);
192 if (task)
193 get_task_struct(task);
194 rcu_read_unlock();
195 if (!task) {
196 rc = -ESRCH;
197 goto free_proc_pages;
198 }
199
200 mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS);
201 if (!mm || IS_ERR(mm)) {
202 rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
203 /*
204 * Explicitly map EACCES to EPERM as EPERM is a more a
205 * appropriate error code for process_vw_readv/writev
206 */
207 if (rc == -EACCES)
208 rc = -EPERM;
209 goto put_task_struct;
210 }
211
212 for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++)
213 rc = process_vm_rw_single_vec(
214 (unsigned long)rvec[i].iov_base, rvec[i].iov_len,
215 iter, process_pages, mm, task, vm_write);
216
217 /* copied = space before - space after */
218 total_len -= iov_iter_count(iter);
219
220 /* If we have managed to copy any data at all then
221 we return the number of bytes copied. Otherwise
222 we return the error code */
223 if (total_len)
224 rc = total_len;
225
226 mmput(mm);
227
228 put_task_struct:
229 put_task_struct(task);
230
231 free_proc_pages:
232 if (process_pages != pp_stack)
233 kfree(process_pages);
234 return rc;
235 }
236
237 /**
238 * process_vm_rw - check iovecs before calling core routine
239 * @pid: PID of process to read/write from/to
240 * @lvec: iovec array specifying where to copy to/from locally
241 * @liovcnt: size of lvec array
242 * @rvec: iovec array specifying where to copy to/from in the other process
243 * @riovcnt: size of rvec array
244 * @flags: currently unused
245 * @vm_write: 0 if reading from other process, 1 if writing to other process
246 * Returns the number of bytes read/written or error code. May
247 * return less bytes than expected if an error occurs during the copying
248 * process.
249 */
process_vm_rw(pid_t pid,const struct iovec __user * lvec,unsigned long liovcnt,const struct iovec __user * rvec,unsigned long riovcnt,unsigned long flags,int vm_write)250 static ssize_t process_vm_rw(pid_t pid,
251 const struct iovec __user *lvec,
252 unsigned long liovcnt,
253 const struct iovec __user *rvec,
254 unsigned long riovcnt,
255 unsigned long flags, int vm_write)
256 {
257 struct iovec iovstack_l[UIO_FASTIOV];
258 struct iovec iovstack_r[UIO_FASTIOV];
259 struct iovec *iov_l = iovstack_l;
260 struct iovec *iov_r = iovstack_r;
261 struct iov_iter iter;
262 ssize_t rc;
263
264 if (flags != 0)
265 return -EINVAL;
266
267 /* Check iovecs */
268 if (vm_write)
269 rc = rw_copy_check_uvector(WRITE, lvec, liovcnt, UIO_FASTIOV,
270 iovstack_l, &iov_l);
271 else
272 rc = rw_copy_check_uvector(READ, lvec, liovcnt, UIO_FASTIOV,
273 iovstack_l, &iov_l);
274 if (rc <= 0)
275 goto free_iovecs;
276
277 iov_iter_init(&iter, vm_write ? WRITE : READ, iov_l, liovcnt, rc);
278
279 rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV,
280 iovstack_r, &iov_r);
281 if (rc <= 0)
282 goto free_iovecs;
283
284 rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
285
286 free_iovecs:
287 if (iov_r != iovstack_r)
288 kfree(iov_r);
289 if (iov_l != iovstack_l)
290 kfree(iov_l);
291
292 return rc;
293 }
294
SYSCALL_DEFINE6(process_vm_readv,pid_t,pid,const struct iovec __user *,lvec,unsigned long,liovcnt,const struct iovec __user *,rvec,unsigned long,riovcnt,unsigned long,flags)295 SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec,
296 unsigned long, liovcnt, const struct iovec __user *, rvec,
297 unsigned long, riovcnt, unsigned long, flags)
298 {
299 return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
300 }
301
SYSCALL_DEFINE6(process_vm_writev,pid_t,pid,const struct iovec __user *,lvec,unsigned long,liovcnt,const struct iovec __user *,rvec,unsigned long,riovcnt,unsigned long,flags)302 SYSCALL_DEFINE6(process_vm_writev, pid_t, pid,
303 const struct iovec __user *, lvec,
304 unsigned long, liovcnt, const struct iovec __user *, rvec,
305 unsigned long, riovcnt, unsigned long, flags)
306 {
307 return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
308 }
309
310 #ifdef CONFIG_COMPAT
311
312 static ssize_t
compat_process_vm_rw(compat_pid_t pid,const struct compat_iovec __user * lvec,unsigned long liovcnt,const struct compat_iovec __user * rvec,unsigned long riovcnt,unsigned long flags,int vm_write)313 compat_process_vm_rw(compat_pid_t pid,
314 const struct compat_iovec __user *lvec,
315 unsigned long liovcnt,
316 const struct compat_iovec __user *rvec,
317 unsigned long riovcnt,
318 unsigned long flags, int vm_write)
319 {
320 struct iovec iovstack_l[UIO_FASTIOV];
321 struct iovec iovstack_r[UIO_FASTIOV];
322 struct iovec *iov_l = iovstack_l;
323 struct iovec *iov_r = iovstack_r;
324 struct iov_iter iter;
325 ssize_t rc = -EFAULT;
326
327 if (flags != 0)
328 return -EINVAL;
329
330 if (vm_write)
331 rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt,
332 UIO_FASTIOV, iovstack_l,
333 &iov_l);
334 else
335 rc = compat_rw_copy_check_uvector(READ, lvec, liovcnt,
336 UIO_FASTIOV, iovstack_l,
337 &iov_l);
338 if (rc <= 0)
339 goto free_iovecs;
340 iov_iter_init(&iter, vm_write ? WRITE : READ, iov_l, liovcnt, rc);
341 rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt,
342 UIO_FASTIOV, iovstack_r,
343 &iov_r);
344 if (rc <= 0)
345 goto free_iovecs;
346
347 rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
348
349 free_iovecs:
350 if (iov_r != iovstack_r)
351 kfree(iov_r);
352 if (iov_l != iovstack_l)
353 kfree(iov_l);
354 return rc;
355 }
356
COMPAT_SYSCALL_DEFINE6(process_vm_readv,compat_pid_t,pid,const struct compat_iovec __user *,lvec,compat_ulong_t,liovcnt,const struct compat_iovec __user *,rvec,compat_ulong_t,riovcnt,compat_ulong_t,flags)357 COMPAT_SYSCALL_DEFINE6(process_vm_readv, compat_pid_t, pid,
358 const struct compat_iovec __user *, lvec,
359 compat_ulong_t, liovcnt,
360 const struct compat_iovec __user *, rvec,
361 compat_ulong_t, riovcnt,
362 compat_ulong_t, flags)
363 {
364 return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
365 riovcnt, flags, 0);
366 }
367
COMPAT_SYSCALL_DEFINE6(process_vm_writev,compat_pid_t,pid,const struct compat_iovec __user *,lvec,compat_ulong_t,liovcnt,const struct compat_iovec __user *,rvec,compat_ulong_t,riovcnt,compat_ulong_t,flags)368 COMPAT_SYSCALL_DEFINE6(process_vm_writev, compat_pid_t, pid,
369 const struct compat_iovec __user *, lvec,
370 compat_ulong_t, liovcnt,
371 const struct compat_iovec __user *, rvec,
372 compat_ulong_t, riovcnt,
373 compat_ulong_t, flags)
374 {
375 return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
376 riovcnt, flags, 1);
377 }
378
379 #endif
380