1  // SPDX-License-Identifier: GPL-2.0-or-later
2  /*
3   * linux/mm/process_vm_access.c
4   *
5   * Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp.
6   */
7  
8  #include <linux/compat.h>
9  #include <linux/mm.h>
10  #include <linux/uio.h>
11  #include <linux/sched.h>
12  #include <linux/sched/mm.h>
13  #include <linux/highmem.h>
14  #include <linux/ptrace.h>
15  #include <linux/slab.h>
16  #include <linux/syscalls.h>
17  
18  /**
19   * process_vm_rw_pages - read/write pages from task specified
20   * @pages: array of pointers to pages we want to copy
21   * @offset: offset in page to start copying from/to
22   * @len: number of bytes to copy
23   * @iter: where to copy to/from locally
24   * @vm_write: 0 means copy from, 1 means copy to
25   * Returns 0 on success, error code otherwise
26   */
process_vm_rw_pages(struct page ** pages,unsigned offset,size_t len,struct iov_iter * iter,int vm_write)27  static int process_vm_rw_pages(struct page **pages,
28  			       unsigned offset,
29  			       size_t len,
30  			       struct iov_iter *iter,
31  			       int vm_write)
32  {
33  	/* Do the copy for each page */
34  	while (len && iov_iter_count(iter)) {
35  		struct page *page = *pages++;
36  		size_t copy = PAGE_SIZE - offset;
37  		size_t copied;
38  
39  		if (copy > len)
40  			copy = len;
41  
42  		if (vm_write)
43  			copied = copy_page_from_iter(page, offset, copy, iter);
44  		else
45  			copied = copy_page_to_iter(page, offset, copy, iter);
46  
47  		len -= copied;
48  		if (copied < copy && iov_iter_count(iter))
49  			return -EFAULT;
50  		offset = 0;
51  	}
52  	return 0;
53  }
54  
55  /* Maximum number of pages kmalloc'd to hold struct page's during copy */
56  #define PVM_MAX_KMALLOC_PAGES 2
57  
58  /* Maximum number of pages that can be stored at a time */
59  #define PVM_MAX_USER_PAGES (PVM_MAX_KMALLOC_PAGES * PAGE_SIZE / sizeof(struct page *))
60  
61  /**
62   * process_vm_rw_single_vec - read/write pages from task specified
63   * @addr: start memory address of target process
64   * @len: size of area to copy to/from
65   * @iter: where to copy to/from locally
66   * @process_pages: struct pages area that can store at least
67   *  nr_pages_to_copy struct page pointers
68   * @mm: mm for task
69   * @task: task to read/write from
70   * @vm_write: 0 means copy from, 1 means copy to
71   * Returns 0 on success or on failure error code
72   */
process_vm_rw_single_vec(unsigned long addr,unsigned long len,struct iov_iter * iter,struct page ** process_pages,struct mm_struct * mm,struct task_struct * task,int vm_write)73  static int process_vm_rw_single_vec(unsigned long addr,
74  				    unsigned long len,
75  				    struct iov_iter *iter,
76  				    struct page **process_pages,
77  				    struct mm_struct *mm,
78  				    struct task_struct *task,
79  				    int vm_write)
80  {
81  	unsigned long pa = addr & PAGE_MASK;
82  	unsigned long start_offset = addr - pa;
83  	unsigned long nr_pages;
84  	ssize_t rc = 0;
85  	unsigned int flags = 0;
86  
87  	/* Work out address and page range required */
88  	if (len == 0)
89  		return 0;
90  	nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1;
91  
92  	if (vm_write)
93  		flags |= FOLL_WRITE;
94  
95  	while (!rc && nr_pages && iov_iter_count(iter)) {
96  		int pinned_pages = min_t(unsigned long, nr_pages, PVM_MAX_USER_PAGES);
97  		int locked = 1;
98  		size_t bytes;
99  
100  		/*
101  		 * Get the pages we're interested in.  We must
102  		 * access remotely because task/mm might not
103  		 * current/current->mm
104  		 */
105  		mmap_read_lock(mm);
106  		pinned_pages = pin_user_pages_remote(mm, pa, pinned_pages,
107  						     flags, process_pages,
108  						     &locked);
109  		if (locked)
110  			mmap_read_unlock(mm);
111  		if (pinned_pages <= 0)
112  			return -EFAULT;
113  
114  		bytes = pinned_pages * PAGE_SIZE - start_offset;
115  		if (bytes > len)
116  			bytes = len;
117  
118  		rc = process_vm_rw_pages(process_pages,
119  					 start_offset, bytes, iter,
120  					 vm_write);
121  		len -= bytes;
122  		start_offset = 0;
123  		nr_pages -= pinned_pages;
124  		pa += pinned_pages * PAGE_SIZE;
125  
126  		/* If vm_write is set, the pages need to be made dirty: */
127  		unpin_user_pages_dirty_lock(process_pages, pinned_pages,
128  					    vm_write);
129  	}
130  
131  	return rc;
132  }
133  
134  /* Maximum number of entries for process pages array
135     which lives on stack */
136  #define PVM_MAX_PP_ARRAY_COUNT 16
137  
138  /**
139   * process_vm_rw_core - core of reading/writing pages from task specified
140   * @pid: PID of process to read/write from/to
141   * @iter: where to copy to/from locally
142   * @rvec: iovec array specifying where to copy to/from in the other process
143   * @riovcnt: size of rvec array
144   * @flags: currently unused
145   * @vm_write: 0 if reading from other process, 1 if writing to other process
146   *
147   * Returns the number of bytes read/written or error code. May
148   *  return less bytes than expected if an error occurs during the copying
149   *  process.
150   */
process_vm_rw_core(pid_t pid,struct iov_iter * iter,const struct iovec * rvec,unsigned long riovcnt,unsigned long flags,int vm_write)151  static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter,
152  				  const struct iovec *rvec,
153  				  unsigned long riovcnt,
154  				  unsigned long flags, int vm_write)
155  {
156  	struct task_struct *task;
157  	struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT];
158  	struct page **process_pages = pp_stack;
159  	struct mm_struct *mm;
160  	unsigned long i;
161  	ssize_t rc = 0;
162  	unsigned long nr_pages = 0;
163  	unsigned long nr_pages_iov;
164  	ssize_t iov_len;
165  	size_t total_len = iov_iter_count(iter);
166  
167  	/*
168  	 * Work out how many pages of struct pages we're going to need
169  	 * when eventually calling get_user_pages
170  	 */
171  	for (i = 0; i < riovcnt; i++) {
172  		iov_len = rvec[i].iov_len;
173  		if (iov_len > 0) {
174  			nr_pages_iov = ((unsigned long)rvec[i].iov_base
175  					+ iov_len - 1)
176  				/ PAGE_SIZE - (unsigned long)rvec[i].iov_base
177  				/ PAGE_SIZE + 1;
178  			nr_pages = max(nr_pages, nr_pages_iov);
179  		}
180  	}
181  
182  	if (nr_pages == 0)
183  		return 0;
184  
185  	if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) {
186  		/* For reliability don't try to kmalloc more than
187  		   2 pages worth */
188  		process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES * PAGE_SIZE,
189  					      sizeof(struct page *)*nr_pages),
190  					GFP_KERNEL);
191  
192  		if (!process_pages)
193  			return -ENOMEM;
194  	}
195  
196  	/* Get process information */
197  	task = find_get_task_by_vpid(pid);
198  	if (!task) {
199  		rc = -ESRCH;
200  		goto free_proc_pages;
201  	}
202  
203  	mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS);
204  	if (!mm || IS_ERR(mm)) {
205  		rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
206  		/*
207  		 * Explicitly map EACCES to EPERM as EPERM is a more
208  		 * appropriate error code for process_vw_readv/writev
209  		 */
210  		if (rc == -EACCES)
211  			rc = -EPERM;
212  		goto put_task_struct;
213  	}
214  
215  	for (i = 0; i < riovcnt && iov_iter_count(iter) && !rc; i++)
216  		rc = process_vm_rw_single_vec(
217  			(unsigned long)rvec[i].iov_base, rvec[i].iov_len,
218  			iter, process_pages, mm, task, vm_write);
219  
220  	/* copied = space before - space after */
221  	total_len -= iov_iter_count(iter);
222  
223  	/* If we have managed to copy any data at all then
224  	   we return the number of bytes copied. Otherwise
225  	   we return the error code */
226  	if (total_len)
227  		rc = total_len;
228  
229  	mmput(mm);
230  
231  put_task_struct:
232  	put_task_struct(task);
233  
234  free_proc_pages:
235  	if (process_pages != pp_stack)
236  		kfree(process_pages);
237  	return rc;
238  }
239  
240  /**
241   * process_vm_rw - check iovecs before calling core routine
242   * @pid: PID of process to read/write from/to
243   * @lvec: iovec array specifying where to copy to/from locally
244   * @liovcnt: size of lvec array
245   * @rvec: iovec array specifying where to copy to/from in the other process
246   * @riovcnt: size of rvec array
247   * @flags: currently unused
248   * @vm_write: 0 if reading from other process, 1 if writing to other process
249   *
250   * Returns the number of bytes read/written or error code. May
251   *  return less bytes than expected if an error occurs during the copying
252   *  process.
253   */
process_vm_rw(pid_t pid,const struct iovec __user * lvec,unsigned long liovcnt,const struct iovec __user * rvec,unsigned long riovcnt,unsigned long flags,int vm_write)254  static ssize_t process_vm_rw(pid_t pid,
255  			     const struct iovec __user *lvec,
256  			     unsigned long liovcnt,
257  			     const struct iovec __user *rvec,
258  			     unsigned long riovcnt,
259  			     unsigned long flags, int vm_write)
260  {
261  	struct iovec iovstack_l[UIO_FASTIOV];
262  	struct iovec iovstack_r[UIO_FASTIOV];
263  	struct iovec *iov_l = iovstack_l;
264  	struct iovec *iov_r;
265  	struct iov_iter iter;
266  	ssize_t rc;
267  	int dir = vm_write ? ITER_SOURCE : ITER_DEST;
268  
269  	if (flags != 0)
270  		return -EINVAL;
271  
272  	/* Check iovecs */
273  	rc = import_iovec(dir, lvec, liovcnt, UIO_FASTIOV, &iov_l, &iter);
274  	if (rc < 0)
275  		return rc;
276  	if (!iov_iter_count(&iter))
277  		goto free_iov_l;
278  	iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r,
279  				in_compat_syscall());
280  	if (IS_ERR(iov_r)) {
281  		rc = PTR_ERR(iov_r);
282  		goto free_iov_l;
283  	}
284  	rc = process_vm_rw_core(pid, &iter, iov_r, riovcnt, flags, vm_write);
285  	if (iov_r != iovstack_r)
286  		kfree(iov_r);
287  free_iov_l:
288  	kfree(iov_l);
289  	return rc;
290  }
291  
SYSCALL_DEFINE6(process_vm_readv,pid_t,pid,const struct iovec __user *,lvec,unsigned long,liovcnt,const struct iovec __user *,rvec,unsigned long,riovcnt,unsigned long,flags)292  SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec,
293  		unsigned long, liovcnt, const struct iovec __user *, rvec,
294  		unsigned long, riovcnt,	unsigned long, flags)
295  {
296  	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0);
297  }
298  
SYSCALL_DEFINE6(process_vm_writev,pid_t,pid,const struct iovec __user *,lvec,unsigned long,liovcnt,const struct iovec __user *,rvec,unsigned long,riovcnt,unsigned long,flags)299  SYSCALL_DEFINE6(process_vm_writev, pid_t, pid,
300  		const struct iovec __user *, lvec,
301  		unsigned long, liovcnt, const struct iovec __user *, rvec,
302  		unsigned long, riovcnt,	unsigned long, flags)
303  {
304  	return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1);
305  }
306