| /* |
| * linux/mm/process_vm_access.c |
| * |
| * Copyright (C) 2010-2011 Christopher Yeoh <cyeoh@au1.ibm.com>, IBM Corp. |
| * |
| * This program is free software; you can redistribute it and/or |
| * modify it under the terms of the GNU General Public License |
| * as published by the Free Software Foundation; either version |
| * 2 of the License, or (at your option) any later version. |
| */ |
| |
| #include <linux/mm.h> |
| #include <linux/uio.h> |
| #include <linux/sched.h> |
| #include <linux/highmem.h> |
| #include <linux/ptrace.h> |
| #include <linux/slab.h> |
| #include <linux/syscalls.h> |
| |
| #ifdef CONFIG_COMPAT |
| #include <linux/compat.h> |
| #endif |
| |
| /** |
| * process_vm_rw_pages - read/write pages from task specified |
| * @task: task to read/write from |
| * @mm: mm for task |
| * @process_pages: struct pages area that can store at least |
| * nr_pages_to_copy struct page pointers |
| * @pa: address of page in task to start copying from/to |
| * @start_offset: offset in page to start copying from/to |
| * @len: number of bytes to copy |
| * @lvec: iovec array specifying where to copy to/from |
| * @lvec_cnt: number of elements in iovec array |
| * @lvec_current: index in iovec array we are up to |
| * @lvec_offset: offset in bytes from current iovec iov_base we are up to |
| * @vm_write: 0 means copy from, 1 means copy to |
| * @nr_pages_to_copy: number of pages to copy |
| * @bytes_copied: returns number of bytes successfully copied |
| * Returns 0 on success, error code otherwise |
| */ |
| static int process_vm_rw_pages(struct task_struct *task, |
| struct mm_struct *mm, |
| struct page **process_pages, |
| unsigned long pa, |
| unsigned long start_offset, |
| unsigned long len, |
| const struct iovec **iovp, |
| unsigned long *left, |
| size_t *lvec_offset, |
| int vm_write, |
| unsigned int nr_pages_to_copy, |
| ssize_t *bytes_copied) |
| { |
| int pages_pinned; |
| void *target_kaddr; |
| int pgs_copied = 0; |
| int j; |
| int ret; |
| ssize_t bytes_to_copy; |
| ssize_t rc = 0; |
| const struct iovec *iov = *iovp; |
| |
| *bytes_copied = 0; |
| |
| /* Get the pages we're interested in */ |
| down_read(&mm->mmap_sem); |
| pages_pinned = get_user_pages(task, mm, pa, |
| nr_pages_to_copy, |
| vm_write, 0, process_pages, NULL); |
| up_read(&mm->mmap_sem); |
| |
| if (pages_pinned != nr_pages_to_copy) { |
| rc = -EFAULT; |
| goto end; |
| } |
| |
| /* Do the copy for each page */ |
| for (pgs_copied = 0; |
| (pgs_copied < nr_pages_to_copy) && *left; |
| pgs_copied++) { |
| /* Make sure we have a non zero length iovec */ |
| while (*left && iov->iov_len == 0) { |
| iov++; |
| (*left)--; |
| } |
| if (!*left) |
| break; |
| |
| /* |
| * Will copy smallest of: |
| * - bytes remaining in page |
| * - bytes remaining in destination iovec |
| */ |
| bytes_to_copy = min_t(ssize_t, PAGE_SIZE - start_offset, |
| len - *bytes_copied); |
| bytes_to_copy = min_t(ssize_t, bytes_to_copy, |
| iov->iov_len |
| - *lvec_offset); |
| |
| target_kaddr = kmap(process_pages[pgs_copied]) + start_offset; |
| |
| if (vm_write) |
| ret = copy_from_user(target_kaddr, |
| iov->iov_base |
| + *lvec_offset, |
| bytes_to_copy); |
| else |
| ret = copy_to_user(iov->iov_base |
| + *lvec_offset, |
| target_kaddr, bytes_to_copy); |
| kunmap(process_pages[pgs_copied]); |
| if (ret) { |
| *bytes_copied += bytes_to_copy - ret; |
| pgs_copied++; |
| rc = -EFAULT; |
| goto end; |
| } |
| *bytes_copied += bytes_to_copy; |
| *lvec_offset += bytes_to_copy; |
| if (*lvec_offset == iov->iov_len) { |
| /* |
| * Need to copy remaining part of page into the |
| * next iovec if there are any bytes left in page |
| */ |
| (*left)--; |
| iov++; |
| *lvec_offset = 0; |
| start_offset = (start_offset + bytes_to_copy) |
| % PAGE_SIZE; |
| if (start_offset) |
| pgs_copied--; |
| } else { |
| start_offset = 0; |
| } |
| } |
| |
| end: |
| if (vm_write) { |
| for (j = 0; j < pages_pinned; j++) { |
| if (j < pgs_copied) |
| set_page_dirty_lock(process_pages[j]); |
| put_page(process_pages[j]); |
| } |
| } else { |
| for (j = 0; j < pages_pinned; j++) |
| put_page(process_pages[j]); |
| } |
| |
| *iovp = iov; |
| return rc; |
| } |
| |
| /* Maximum number of pages kmalloc'd to hold struct page's during copy */ |
| #define PVM_MAX_KMALLOC_PAGES (PAGE_SIZE * 2) |
| |
| /** |
| * process_vm_rw_single_vec - read/write pages from task specified |
| * @addr: start memory address of target process |
| * @len: size of area to copy to/from |
| * @lvec: iovec array specifying where to copy to/from locally |
| * @lvec_cnt: number of elements in iovec array |
| * @lvec_current: index in iovec array we are up to |
| * @lvec_offset: offset in bytes from current iovec iov_base we are up to |
| * @process_pages: struct pages area that can store at least |
| * nr_pages_to_copy struct page pointers |
| * @mm: mm for task |
| * @task: task to read/write from |
| * @vm_write: 0 means copy from, 1 means copy to |
| * @bytes_copied: returns number of bytes successfully copied |
| * Returns 0 on success or on failure error code |
| */ |
| static int process_vm_rw_single_vec(unsigned long addr, |
| unsigned long len, |
| const struct iovec **iovp, |
| unsigned long *left, |
| size_t *lvec_offset, |
| struct page **process_pages, |
| struct mm_struct *mm, |
| struct task_struct *task, |
| int vm_write, |
| ssize_t *bytes_copied) |
| { |
| unsigned long pa = addr & PAGE_MASK; |
| unsigned long start_offset = addr - pa; |
| unsigned long nr_pages; |
| ssize_t bytes_copied_loop; |
| ssize_t rc = 0; |
| unsigned long nr_pages_copied = 0; |
| unsigned long nr_pages_to_copy; |
| unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES |
| / sizeof(struct pages *); |
| |
| *bytes_copied = 0; |
| |
| /* Work out address and page range required */ |
| if (len == 0) |
| return 0; |
| nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1; |
| |
| while ((nr_pages_copied < nr_pages) && *left) { |
| nr_pages_to_copy = min(nr_pages - nr_pages_copied, |
| max_pages_per_loop); |
| |
| rc = process_vm_rw_pages(task, mm, process_pages, pa, |
| start_offset, len, |
| iovp, left, |
| lvec_offset, |
| vm_write, nr_pages_to_copy, |
| &bytes_copied_loop); |
| start_offset = 0; |
| *bytes_copied += bytes_copied_loop; |
| |
| if (rc < 0) { |
| return rc; |
| } else { |
| len -= bytes_copied_loop; |
| nr_pages_copied += nr_pages_to_copy; |
| pa += nr_pages_to_copy * PAGE_SIZE; |
| } |
| } |
| |
| return rc; |
| } |
| |
| /* Maximum number of entries for process pages array |
| which lives on stack */ |
| #define PVM_MAX_PP_ARRAY_COUNT 16 |
| |
| /** |
| * process_vm_rw_core - core of reading/writing pages from task specified |
| * @pid: PID of process to read/write from/to |
| * @lvec: iovec array specifying where to copy to/from locally |
| * @liovcnt: size of lvec array |
| * @rvec: iovec array specifying where to copy to/from in the other process |
| * @riovcnt: size of rvec array |
| * @flags: currently unused |
| * @vm_write: 0 if reading from other process, 1 if writing to other process |
| * Returns the number of bytes read/written or error code. May |
| * return less bytes than expected if an error occurs during the copying |
| * process. |
| */ |
| static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec, |
| unsigned long liovcnt, |
| const struct iovec *rvec, |
| unsigned long riovcnt, |
| unsigned long flags, int vm_write) |
| { |
| struct task_struct *task; |
| struct page *pp_stack[PVM_MAX_PP_ARRAY_COUNT]; |
| struct page **process_pages = pp_stack; |
| struct mm_struct *mm; |
| unsigned long i; |
| ssize_t rc = 0; |
| ssize_t bytes_copied_loop; |
| ssize_t bytes_copied = 0; |
| unsigned long nr_pages = 0; |
| unsigned long nr_pages_iov; |
| unsigned long left = liovcnt; |
| size_t iov_l_curr_offset = 0; |
| ssize_t iov_len; |
| |
| /* |
| * Work out how many pages of struct pages we're going to need |
| * when eventually calling get_user_pages |
| */ |
| for (i = 0; i < riovcnt; i++) { |
| iov_len = rvec[i].iov_len; |
| if (iov_len > 0) { |
| nr_pages_iov = ((unsigned long)rvec[i].iov_base |
| + iov_len) |
| / PAGE_SIZE - (unsigned long)rvec[i].iov_base |
| / PAGE_SIZE + 1; |
| nr_pages = max(nr_pages, nr_pages_iov); |
| } |
| } |
| |
| if (nr_pages == 0) |
| return 0; |
| |
| if (nr_pages > PVM_MAX_PP_ARRAY_COUNT) { |
| /* For reliability don't try to kmalloc more than |
| 2 pages worth */ |
| process_pages = kmalloc(min_t(size_t, PVM_MAX_KMALLOC_PAGES, |
| sizeof(struct pages *)*nr_pages), |
| GFP_KERNEL); |
| |
| if (!process_pages) |
| return -ENOMEM; |
| } |
| |
| /* Get process information */ |
| rcu_read_lock(); |
| task = find_task_by_vpid(pid); |
| if (task) |
| get_task_struct(task); |
| rcu_read_unlock(); |
| if (!task) { |
| rc = -ESRCH; |
| goto free_proc_pages; |
| } |
| |
| mm = mm_access(task, PTRACE_MODE_ATTACH); |
| if (!mm || IS_ERR(mm)) { |
| rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; |
| /* |
| * Explicitly map EACCES to EPERM as EPERM is a more a |
| * appropriate error code for process_vw_readv/writev |
| */ |
| if (rc == -EACCES) |
| rc = -EPERM; |
| goto put_task_struct; |
| } |
| |
| for (i = 0; i < riovcnt && left; i++) { |
| rc = process_vm_rw_single_vec( |
| (unsigned long)rvec[i].iov_base, rvec[i].iov_len, |
| &lvec, &left, &iov_l_curr_offset, |
| process_pages, mm, task, vm_write, &bytes_copied_loop); |
| bytes_copied += bytes_copied_loop; |
| if (rc != 0) { |
| /* If we have managed to copy any data at all then |
| we return the number of bytes copied. Otherwise |
| we return the error code */ |
| if (bytes_copied) |
| rc = bytes_copied; |
| goto put_mm; |
| } |
| } |
| |
| rc = bytes_copied; |
| put_mm: |
| mmput(mm); |
| |
| put_task_struct: |
| put_task_struct(task); |
| |
| free_proc_pages: |
| if (process_pages != pp_stack) |
| kfree(process_pages); |
| return rc; |
| } |
| |
| /** |
| * process_vm_rw - check iovecs before calling core routine |
| * @pid: PID of process to read/write from/to |
| * @lvec: iovec array specifying where to copy to/from locally |
| * @liovcnt: size of lvec array |
| * @rvec: iovec array specifying where to copy to/from in the other process |
| * @riovcnt: size of rvec array |
| * @flags: currently unused |
| * @vm_write: 0 if reading from other process, 1 if writing to other process |
| * Returns the number of bytes read/written or error code. May |
| * return less bytes than expected if an error occurs during the copying |
| * process. |
| */ |
| static ssize_t process_vm_rw(pid_t pid, |
| const struct iovec __user *lvec, |
| unsigned long liovcnt, |
| const struct iovec __user *rvec, |
| unsigned long riovcnt, |
| unsigned long flags, int vm_write) |
| { |
| struct iovec iovstack_l[UIO_FASTIOV]; |
| struct iovec iovstack_r[UIO_FASTIOV]; |
| struct iovec *iov_l = iovstack_l; |
| struct iovec *iov_r = iovstack_r; |
| ssize_t rc; |
| |
| if (flags != 0) |
| return -EINVAL; |
| |
| /* Check iovecs */ |
| if (vm_write) |
| rc = rw_copy_check_uvector(WRITE, lvec, liovcnt, UIO_FASTIOV, |
| iovstack_l, &iov_l); |
| else |
| rc = rw_copy_check_uvector(READ, lvec, liovcnt, UIO_FASTIOV, |
| iovstack_l, &iov_l); |
| if (rc <= 0) |
| goto free_iovecs; |
| |
| rc = rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, UIO_FASTIOV, |
| iovstack_r, &iov_r); |
| if (rc <= 0) |
| goto free_iovecs; |
| |
| rc = process_vm_rw_core(pid, iov_l, liovcnt, iov_r, riovcnt, flags, |
| vm_write); |
| |
| free_iovecs: |
| if (iov_r != iovstack_r) |
| kfree(iov_r); |
| if (iov_l != iovstack_l) |
| kfree(iov_l); |
| |
| return rc; |
| } |
| |
| SYSCALL_DEFINE6(process_vm_readv, pid_t, pid, const struct iovec __user *, lvec, |
| unsigned long, liovcnt, const struct iovec __user *, rvec, |
| unsigned long, riovcnt, unsigned long, flags) |
| { |
| return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 0); |
| } |
| |
| SYSCALL_DEFINE6(process_vm_writev, pid_t, pid, |
| const struct iovec __user *, lvec, |
| unsigned long, liovcnt, const struct iovec __user *, rvec, |
| unsigned long, riovcnt, unsigned long, flags) |
| { |
| return process_vm_rw(pid, lvec, liovcnt, rvec, riovcnt, flags, 1); |
| } |
| |
| #ifdef CONFIG_COMPAT |
| |
| asmlinkage ssize_t |
| compat_process_vm_rw(compat_pid_t pid, |
| const struct compat_iovec __user *lvec, |
| unsigned long liovcnt, |
| const struct compat_iovec __user *rvec, |
| unsigned long riovcnt, |
| unsigned long flags, int vm_write) |
| { |
| struct iovec iovstack_l[UIO_FASTIOV]; |
| struct iovec iovstack_r[UIO_FASTIOV]; |
| struct iovec *iov_l = iovstack_l; |
| struct iovec *iov_r = iovstack_r; |
| ssize_t rc = -EFAULT; |
| |
| if (flags != 0) |
| return -EINVAL; |
| |
| if (vm_write) |
| rc = compat_rw_copy_check_uvector(WRITE, lvec, liovcnt, |
| UIO_FASTIOV, iovstack_l, |
| &iov_l); |
| else |
| rc = compat_rw_copy_check_uvector(READ, lvec, liovcnt, |
| UIO_FASTIOV, iovstack_l, |
| &iov_l); |
| if (rc <= 0) |
| goto free_iovecs; |
| rc = compat_rw_copy_check_uvector(CHECK_IOVEC_ONLY, rvec, riovcnt, |
| UIO_FASTIOV, iovstack_r, |
| &iov_r); |
| if (rc <= 0) |
| goto free_iovecs; |
| |
| rc = process_vm_rw_core(pid, iov_l, liovcnt, iov_r, riovcnt, flags, |
| vm_write); |
| |
| free_iovecs: |
| if (iov_r != iovstack_r) |
| kfree(iov_r); |
| if (iov_l != iovstack_l) |
| kfree(iov_l); |
| return rc; |
| } |
| |
| asmlinkage ssize_t |
| compat_sys_process_vm_readv(compat_pid_t pid, |
| const struct compat_iovec __user *lvec, |
| unsigned long liovcnt, |
| const struct compat_iovec __user *rvec, |
| unsigned long riovcnt, |
| unsigned long flags) |
| { |
| return compat_process_vm_rw(pid, lvec, liovcnt, rvec, |
| riovcnt, flags, 0); |
| } |
| |
| asmlinkage ssize_t |
| compat_sys_process_vm_writev(compat_pid_t pid, |
| const struct compat_iovec __user *lvec, |
| unsigned long liovcnt, |
| const struct compat_iovec __user *rvec, |
| unsigned long riovcnt, |
| unsigned long flags) |
| { |
| return compat_process_vm_rw(pid, lvec, liovcnt, rvec, |
| riovcnt, flags, 1); |
| } |
| |
| #endif |