path: root/mm/process_vm_access.c (plain)
blob: be8dc8d1edb95b34d8c6b7fbf34321e597e981e1

1	/*
2	* linux/mm/process_vm_access.c
3	*
4	* Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp.
5	*
6	* This program is free software; you can redistribute it and/or
7	* modify it under the terms of the GNU General Public License
8	* as published by the Free Software Foundation; either version
9	* 2 of the License, or (at your option) any later version.
10	*/
11
12	#include <linux/mm.h>
13	#include <linux/uio.h>
14	#include <linux/sched.h>
15	#include <linux/highmem.h>
16	#include <linux/ptrace.h>
17	#include <linux/slab.h>
18	#include <linux/syscalls.h>
19
20	#ifdef CONFIG_COMPAT
21	#include <linux/compat.h>
22	#endif
23
24	/**
25	* process_vm_rw_pages - read/write pages from task specified
26	* @pages: array of pointers to pages we want to copy
27	* @start_offset: offset in page to start copying from/to
28	* @len: number of bytes to copy
29	* @iter: where to copy to/from locally
30	* @vm_write: 0 means copy from, 1 means copy to
31	* Returns 0 on success, error code otherwise
32	*/
33	static int process_vm_rw_pages(struct page **pages,
34	unsigned offset,
35	size_t len,
36	struct iov_iter *iter,
37	int vm_write)
38	{
39	/* Do the copy for each page */
40	while (len && iov_iter_count(iter)) {
41	struct page *page = *pages++;
42	size_t copy = PAGE_SIZE - offset;
43	size_t copied;
44
45	if (copy > len)
46	copy = len;
47
48	if (vm_write) {
49	copied = copy_page_from_iter(page, offset, copy, iter);
50	set_page_dirty_lock(page);
51	} else {
52	copied = copy_page_to_iter(page, offset, copy, iter);
53	}
54	len -= copied;
55	if (copied < copy && iov_iter_count(iter))
56	return -EFAULT;
57	offset = 0;
58	}
59	return 0;
60	}
61
62	/* Maximum number of pages kmalloc'd to hold struct page's during copy */
63	#define PVM_MAX_KMALLOC_PAGES (PAGE_SIZE * 2)
64
65	/**
66	* process_vm_rw_single_vec - read/write pages from task specified
67	* @addr: start memory address of target process
68	* @len: size of area to copy to/from
69	* @iter: where to copy to/from locally
70	* @process_pages: struct pages area that can store at least
71	* nr_pages_to_copy struct page pointers
72	* @mm: mm for task
73	* @task: task to read/write from
74	* @vm_write: 0 means copy from, 1 means copy to
75	* Returns 0 on success or on failure error code
76	*/
77	static int process_vm_rw_single_vec(unsigned long addr,
78	unsigned long len,
79	struct iov_iter *iter,
80	struct page **process_pages,
81	struct mm_struct *mm,
82	struct task_struct *task,
83	int vm_write)
84	{
85	unsigned long pa = addr & PAGE_MASK;
86	unsigned long start_offset = addr - pa;
87	unsigned long nr_pages;
88	ssize_t rc = 0;
89	unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES
90	/ sizeof(struct pages *);
91	unsigned int flags = FOLL_REMOTE;
92
93	/* Work out address and page range required */
94	if (len == 0)
95	return 0;
96	nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1;
97
98	if (vm_write)
99	flags |= FOLL_WRITE;
100
101	while (!rc && nr_pages && iov_iter_count(iter)) {
102	int pages = min(nr_pages, max_pages_per_loop);
103	size_t bytes;
104
105	/*
106	* Get the pages we're interested in. We must
107	* add FOLL_REMOTE because task/mm might not
108	* current/current->mm
109	*/
110	pages = __get_user_pages_unlocked(task, mm, pa, pages,
111	process_pages, flags);
112	if (pages <= 0)
113	return -EFAULT;
114
115	bytes = pages * PAGE_SIZE - start_offset;
116	if (bytes > len)
117	bytes = len;
118
119	rc = process_vm_rw_pages(process_pages,
120	start_offset, bytes, iter,
121	vm_write);
122	len -= bytes;
123	start_offset = 0;
124	nr_pages -= pages;
125	pa += pages * PAGE_SIZE;
126	while (pages)
127	put_page(process_pages[--pages]);
128	}
129
130	return rc;
131	}
132
133	/* Maximum number of entries for process pages array
134	which lives on stack */
135	#define PVM_MAX_PP_ARRAY_COUNT 16
136
137	/**
138	* process_vm_rw_core - core of reading/writing pages from task specified
139	* @pid: PID of process to read/write from/to
140	* @iter: where to copy to/from locally
141	* @rvec: iovec array specifying where to copy to/from in the other process
142	* @riovcnt: size of rvec array
143	* @flags: currently unused
144	* @vm_write: 0 if reading from other process, 1 if writing to other process
145	* Returns the number of bytes read/written or error code. May
146	* return less bytes than expected if an error occurs during the copying
147	* process.
148	*/
149	static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
150	const struct iovec *rvec,
151	unsigned long riovcnt,
152	unsigned long flags, int vm_write)
153	{
154	struct task_struct *task;
155	struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT];
156	struct page **process_pages = pp_stack;
157	struct mm_struct *mm;
158	unsigned long i;
159	ssize_t rc = 0;
160	unsigned long nr_pages = 0;
161	unsigned long nr_pages_iov;
162	ssize_t iov_len;
163	size_t total_len = iov_iter_count(iter);
164
165	/*
166	* Work out how many pages of struct pages we're going to need
167	* when eventually calling get_user_pages
168	*/
169	for (i = 0; i < riovcnt; i++) {
170	iov_len = rvec[i].iov_len;
171	if (iov_len > 0) {
172	nr_pages_iov = ((unsigned long)rvec[i].iov_base
173	+ iov_len)
174	/ PAGE_SIZE - (unsigned long)rvec[i].iov_base
175	/ PAGE_SIZE + 1;
176	nr_pages = max(nr_pages, nr_pages_iov);
177	}
178	}
179
180	if (nr_pages == 0)
181	return 0;
182
183	if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) {
184	/* For reliability don't try to kmalloc more than
185	2 pages worth */
186	process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES,
187	sizeof(struct pages *)*nr_pages),
188	GFP_KERNEL);
189
190	if (!process_pages)
191	return -ENOMEM;
192	}
193
194	/* Get process information */
195	rcu_read_lock();
196	task = find_task_by_vpid(pid);
197	if (task)
198	get_task_struct(task);
199	rcu_read_unlock();
200	if (!task) {
201	rc = -ESRCH;
202	goto free_proc_pages;
203	}
204
205	mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS);
206	if (!mm || IS_ERR(mm)) {
207	rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
208	/*
209	* Explicitly map EACCES to EPERM as EPERM is a more a
210	* appropriate error code for process_vw_readv/writev
211	*/
212	if (rc == -EACCES)
213	rc = -EPERM;
214	goto put_task_struct;
215	}
216
217	for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++)
218	rc = process_vm_rw_single_vec(
219	(unsigned long)rvec[i].iov_base, rvec[i].iov_len,
220	iter, process_pages, mm, task, vm_write);
221
222	/* copied = space before - space after */
223	total_len -= iov_iter_count(iter);
224
225	/* If we have managed to copy any data at all then
226	we return the number of bytes copied. Otherwise
227	we return the error code */
228	if (total_len)
229	rc = total_len;
230
231	mmput(mm);
232
233	put_task_struct:
234	put_task_struct(task);
235
236	free_proc_pages:
237	if (process_pages != pp_stack)
238	kfree(process_pages);
239	return rc;
240	}
241
242	/**
243	* process_vm_rw - check iovecs before calling core routine
244	* @pid: PID of process to read/write from/to
245	* @lvec: iovec array specifying where to copy to/from locally
246	* @liovcnt: size of lvec array
247	* @rvec: iovec array specifying where to copy to/from in the other process
248	* @riovcnt: size of rvec array
249	* @flags: currently unused
250	* @vm_write: 0 if reading from other process, 1 if writing to other process
251	* Returns the number of bytes read/written or error code. May
252	* return less bytes than expected if an error occurs during the copying
253	* process.
254	*/
255	static ssize_t process_vm_rw(pid_t pid,
256	const struct iovec __user *lvec,
257	unsigned long liovcnt,
258	const struct iovec __user *rvec,
259	unsigned long riovcnt,
260	unsigned long flags, int vm_write)
261	{
262	struct iovec iovstack_l[UIO_FASTIOV];
263	struct iovec iovstack_r[UIO_FASTIOV];
264	struct iovec *iov_l = iovstack_l;
265	struct iovec *iov_r = iovstack_r;
266	struct iov_iter iter;
267	ssize_t rc;
268	int dir = vm_write ? WRITE : READ;
269
270	if (flags != 0)
271	return -EINVAL;
272
273	/* Check iovecs */
274	rc = import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
275	if (rc < 0)
276	return rc;
277	if (!iov_iter_count(&iter))
278	goto free_iovecs;
279
280	rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV,
281	iovstack_r, &iov_r);
282	if (rc <= 0)
283	goto free_iovecs;
284
285	rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
286
287	free_iovecs:
288	if (iov_r != iovstack_r)
289	kfree(iov_r);
290	kfree(iov_l);
291
292	return rc;
293	}
294
295	SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec,
296	unsigned long, liovcnt, const struct iovec __user *, rvec,
297	unsigned long, riovcnt, unsigned long, flags)
298	{
299	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
300	}
301
302	SYSCALL_DEFINE6(process_vm_writev, pid_t, pid,
303	const struct iovec __user *, lvec,
304	unsigned long, liovcnt, const struct iovec __user *, rvec,
305	unsigned long, riovcnt, unsigned long, flags)
306	{
307	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
308	}
309
310	#ifdef CONFIG_COMPAT
311
312	static ssize_t
313	compat_process_vm_rw(compat_pid_t pid,
314	const struct compat_iovec __user *lvec,
315	unsigned long liovcnt,
316	const struct compat_iovec __user *rvec,
317	unsigned long riovcnt,
318	unsigned long flags, int vm_write)
319	{
320	struct iovec iovstack_l[UIO_FASTIOV];
321	struct iovec iovstack_r[UIO_FASTIOV];
322	struct iovec *iov_l = iovstack_l;
323	struct iovec *iov_r = iovstack_r;
324	struct iov_iter iter;
325	ssize_t rc = -EFAULT;
326	int dir = vm_write ? WRITE : READ;
327
328	if (flags != 0)
329	return -EINVAL;
330
331	rc = compat_import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
332	if (rc < 0)
333	return rc;
334	if (!iov_iter_count(&iter))
335	goto free_iovecs;
336	rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt,
337	UIO_FASTIOV, iovstack_r,
338	&iov_r);
339	if (rc <= 0)
340	goto free_iovecs;
341
342	rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
343
344	free_iovecs:
345	if (iov_r != iovstack_r)
346	kfree(iov_r);
347	kfree(iov_l);
348	return rc;
349	}
350
351	COMPAT_SYSCALL_DEFINE6(process_vm_readv, compat_pid_t, pid,
352	const struct compat_iovec __user *, lvec,
353	compat_ulong_t, liovcnt,
354	const struct compat_iovec __user *, rvec,
355	compat_ulong_t, riovcnt,
356	compat_ulong_t, flags)
357	{
358	return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
359	riovcnt, flags, 0);
360	}
361
362	COMPAT_SYSCALL_DEFINE6(process_vm_writev, compat_pid_t, pid,
363	const struct compat_iovec __user *, lvec,
364	compat_ulong_t, liovcnt,
365	const struct compat_iovec __user *, rvec,
366	compat_ulong_t, riovcnt,
367	compat_ulong_t, flags)
368	{
369	return compat_process_vm_rw(pid, lvec, liovcnt, rvec,
370	riovcnt, flags, 1);
371	}
372
373	#endif
374