971 lines · 23.9 KB · C
RawDownload
// SPDX-License-Identifier: GPL-2.0-only#include <linux/mm.h>#include <linux/slab.h>#include <linux/string.h>#include <linux/compiler.h>#include <linux/export.h>#include <linux/err.h>#include <linux/sched.h>#include <linux/sched/mm.h>#include <linux/sched/signal.h>#include <linux/sched/task_stack.h>#include <linux/security.h>#include <linux/swap.h>#include <linux/swapops.h>#include <linux/mman.h>#include <linux/hugetlb.h>#include <linux/vmalloc.h>#include <linux/userfaultfd_k.h>#include <linux/elf.h>#include <linux/elf-randomize.h>#include <linux/personality.h>#include <linux/random.h>#include <linux/processor.h>#include <linux/sizes.h>#include <linux/compat.h> #include <linux/uaccess.h> #include "internal.h" /** * kfree_const - conditionally free memory * @x: pointer to the memory * * Function calls kfree only if @x is not in .rodata section. */void kfree_const(const void *x){	if (!is_kernel_rodata((unsigned long)x))		kfree(x);}EXPORT_SYMBOL(kfree_const); /** * kstrdup - allocate space for and copy an existing string * @s: the string to duplicate * @gfp: the GFP mask used in the kmalloc() call when allocating memory * * Return: newly allocated copy of @s or %NULL in case of error */char *kstrdup(const char *s, gfp_t gfp){	size_t len;	char *buf; 	if (!s)		return NULL; 	len = strlen(s) + 1;	buf = kmalloc_track_caller(len, gfp);	if (buf)		memcpy(buf, s, len);	return buf;}EXPORT_SYMBOL(kstrdup); /** * kstrdup_const - conditionally duplicate an existing const string * @s: the string to duplicate * @gfp: the GFP mask used in the kmalloc() call when allocating memory * * Note: Strings allocated by kstrdup_const should be freed by kfree_const. * * Return: source string if it is in .rodata section otherwise * fallback to kstrdup. */const char *kstrdup_const(const char *s, gfp_t gfp){	if (is_kernel_rodata((unsigned long)s))		return s; 	return kstrdup(s, gfp);}EXPORT_SYMBOL(kstrdup_const); /** * kstrndup - allocate space for and copy an existing string * @s: the string to duplicate * @max: read at most @max chars from @s * @gfp: the GFP mask used in the kmalloc() call when allocating memory * * Note: Use kmemdup_nul() instead if the size is known exactly. * * Return: newly allocated copy of @s or %NULL in case of error */char *kstrndup(const char *s, size_t max, gfp_t gfp){	size_t len;	char *buf; 	if (!s)		return NULL; 	len = strnlen(s, max);	buf = kmalloc_track_caller(len+1, gfp);	if (buf) {		memcpy(buf, s, len);		buf[len] = '\0';	}	return buf;}EXPORT_SYMBOL(kstrndup); /** * kmemdup - duplicate region of memory * * @src: memory region to duplicate * @len: memory region length * @gfp: GFP mask to use * * Return: newly allocated copy of @src or %NULL in case of error */void *kmemdup(const void *src, size_t len, gfp_t gfp){	void *p; 	p = kmalloc_track_caller(len, gfp);	if (p)		memcpy(p, src, len);	return p;}EXPORT_SYMBOL(kmemdup); /** * kmemdup_nul - Create a NUL-terminated string from unterminated data * @s: The data to stringify * @len: The size of the data * @gfp: the GFP mask used in the kmalloc() call when allocating memory * * Return: newly allocated copy of @s with NUL-termination or %NULL in * case of error */char *kmemdup_nul(const char *s, size_t len, gfp_t gfp){	char *buf; 	if (!s)		return NULL; 	buf = kmalloc_track_caller(len + 1, gfp);	if (buf) {		memcpy(buf, s, len);		buf[len] = '\0';	}	return buf;}EXPORT_SYMBOL(kmemdup_nul); /** * memdup_user - duplicate memory region from user space * * @src: source address in user space * @len: number of bytes to copy * * Return: an ERR_PTR() on failure.  Result is physically * contiguous, to be freed by kfree(). */void *memdup_user(const void __user *src, size_t len){	void *p; 	p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN);	if (!p)		return ERR_PTR(-ENOMEM); 	if (copy_from_user(p, src, len)) {		kfree(p);		return ERR_PTR(-EFAULT);	} 	return p;}EXPORT_SYMBOL(memdup_user); /** * vmemdup_user - duplicate memory region from user space * * @src: source address in user space * @len: number of bytes to copy * * Return: an ERR_PTR() on failure.  Result may be not * physically contiguous.  Use kvfree() to free. */void *vmemdup_user(const void __user *src, size_t len){	void *p; 	p = kvmalloc(len, GFP_USER);	if (!p)		return ERR_PTR(-ENOMEM); 	if (copy_from_user(p, src, len)) {		kvfree(p);		return ERR_PTR(-EFAULT);	} 	return p;}EXPORT_SYMBOL(vmemdup_user); /** * strndup_user - duplicate an existing string from user space * @s: The string to duplicate * @n: Maximum number of bytes to copy, including the trailing NUL. * * Return: newly allocated copy of @s or an ERR_PTR() in case of error */char *strndup_user(const char __user *s, long n){	char *p;	long length; 	length = strnlen_user(s, n); 	if (!length)		return ERR_PTR(-EFAULT); 	if (length > n)		return ERR_PTR(-EINVAL); 	p = memdup_user(s, length); 	if (IS_ERR(p))		return p; 	p[length - 1] = '\0'; 	return p;}EXPORT_SYMBOL(strndup_user); /** * memdup_user_nul - duplicate memory region from user space and NUL-terminate * * @src: source address in user space * @len: number of bytes to copy * * Return: an ERR_PTR() on failure. */void *memdup_user_nul(const void __user *src, size_t len){	char *p; 	/*	 * Always use GFP_KERNEL, since copy_from_user() can sleep and	 * cause pagefault, which makes it pointless to use GFP_NOFS	 * or GFP_ATOMIC.	 */	p = kmalloc_track_caller(len + 1, GFP_KERNEL);	if (!p)		return ERR_PTR(-ENOMEM); 	if (copy_from_user(p, src, len)) {		kfree(p);		return ERR_PTR(-EFAULT);	}	p[len] = '\0'; 	return p;}EXPORT_SYMBOL(memdup_user_nul); void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,		struct vm_area_struct *prev){	struct vm_area_struct *next; 	vma->vm_prev = prev;	if (prev) {		next = prev->vm_next;		prev->vm_next = vma;	} else {		next = mm->mmap;		mm->mmap = vma;	}	vma->vm_next = next;	if (next)		next->vm_prev = vma;} void __vma_unlink_list(struct mm_struct *mm, struct vm_area_struct *vma){	struct vm_area_struct *prev, *next; 	next = vma->vm_next;	prev = vma->vm_prev;	if (prev)		prev->vm_next = next;	else		mm->mmap = next;	if (next)		next->vm_prev = prev;} /* Check if the vma is being used as a stack by this task */int vma_is_stack_for_current(struct vm_area_struct *vma){	struct task_struct * __maybe_unused t = current; 	return (vma->vm_start <= KSTK_ESP(t) && vma->vm_end >= KSTK_ESP(t));} #ifndef STACK_RND_MASK#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */#endif unsigned long randomize_stack_top(unsigned long stack_top){	unsigned long random_variable = 0; 	if (current->flags & PF_RANDOMIZE) {		random_variable = get_random_long();		random_variable &= STACK_RND_MASK;		random_variable <<= PAGE_SHIFT;	}#ifdef CONFIG_STACK_GROWSUP	return PAGE_ALIGN(stack_top) + random_variable;#else	return PAGE_ALIGN(stack_top) - random_variable;#endif} #ifdef CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUTunsigned long arch_randomize_brk(struct mm_struct *mm){	/* Is the current task 32bit ? */	if (!IS_ENABLED(CONFIG_64BIT) || is_compat_task())		return randomize_page(mm->brk, SZ_32M); 	return randomize_page(mm->brk, SZ_1G);} unsigned long arch_mmap_rnd(void){	unsigned long rnd; #ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS	if (is_compat_task())		rnd = get_random_long() & ((1UL << mmap_rnd_compat_bits) - 1);	else#endif /* CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS */		rnd = get_random_long() & ((1UL << mmap_rnd_bits) - 1); 	return rnd << PAGE_SHIFT;} static int mmap_is_legacy(struct rlimit *rlim_stack){	if (current->personality & ADDR_COMPAT_LAYOUT)		return 1; 	if (rlim_stack->rlim_cur == RLIM_INFINITY)		return 1; 	return sysctl_legacy_va_layout;} /* * Leave enough space between the mmap area and the stack to honour ulimit in * the face of randomisation. */#define MIN_GAP		(SZ_128M)#define MAX_GAP		(STACK_TOP / 6 * 5) static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack){	unsigned long gap = rlim_stack->rlim_cur;	unsigned long pad = stack_guard_gap; 	/* Account for stack randomization if necessary */	if (current->flags & PF_RANDOMIZE)		pad += (STACK_RND_MASK << PAGE_SHIFT); 	/* Values close to RLIM_INFINITY can overflow. */	if (gap + pad > gap)		gap += pad; 	if (gap < MIN_GAP)		gap = MIN_GAP;	else if (gap > MAX_GAP)		gap = MAX_GAP; 	return PAGE_ALIGN(STACK_TOP - gap - rnd);} void arch_pick_mmap_layout(struct mm_struct *mm, struct rlimit *rlim_stack){	unsigned long random_factor = 0UL; 	if (current->flags & PF_RANDOMIZE)		random_factor = arch_mmap_rnd(); 	if (mmap_is_legacy(rlim_stack)) {		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;		mm->get_unmapped_area = arch_get_unmapped_area;	} else {		mm->mmap_base = mmap_base(random_factor, rlim_stack);		mm->get_unmapped_area = arch_get_unmapped_area_topdown;	}}#elif defined(CONFIG_MMU) && !defined(HAVE_ARCH_PICK_MMAP_LAYOUT)void arch_pick_mmap_layout(struct mm_struct *mm, struct rlimit *rlim_stack){	mm->mmap_base = TASK_UNMAPPED_BASE;	mm->get_unmapped_area = arch_get_unmapped_area;}#endif /** * __account_locked_vm - account locked pages to an mm's locked_vm * @mm:          mm to account against * @pages:       number of pages to account * @inc:         %true if @pages should be considered positive, %false if not * @task:        task used to check RLIMIT_MEMLOCK * @bypass_rlim: %true if checking RLIMIT_MEMLOCK should be skipped * * Assumes @task and @mm are valid (i.e. at least one reference on each), and * that mmap_lock is held as writer. * * Return: * * 0       on success * * -ENOMEM if RLIMIT_MEMLOCK would be exceeded. */int __account_locked_vm(struct mm_struct *mm, unsigned long pages, bool inc,			struct task_struct *task, bool bypass_rlim){	unsigned long locked_vm, limit;	int ret = 0; 	mmap_assert_write_locked(mm); 	locked_vm = mm->locked_vm;	if (inc) {		if (!bypass_rlim) {			limit = task_rlimit(task, RLIMIT_MEMLOCK) >> PAGE_SHIFT;			if (locked_vm + pages > limit)				ret = -ENOMEM;		}		if (!ret)			mm->locked_vm = locked_vm + pages;	} else {		WARN_ON_ONCE(pages > locked_vm);		mm->locked_vm = locked_vm - pages;	} 	pr_debug("%s: [%d] caller %ps %c%lu %lu/%lu%s\n", __func__, task->pid,		 (void *)_RET_IP_, (inc) ? '+' : '-', pages << PAGE_SHIFT,		 locked_vm << PAGE_SHIFT, task_rlimit(task, RLIMIT_MEMLOCK),		 ret ? " - exceeded" : ""); 	return ret;}EXPORT_SYMBOL_GPL(__account_locked_vm); /** * account_locked_vm - account locked pages to an mm's locked_vm * @mm:          mm to account against, may be NULL * @pages:       number of pages to account * @inc:         %true if @pages should be considered positive, %false if not * * Assumes a non-NULL @mm is valid (i.e. at least one reference on it). * * Return: * * 0       on success, or if mm is NULL * * -ENOMEM if RLIMIT_MEMLOCK would be exceeded. */int account_locked_vm(struct mm_struct *mm, unsigned long pages, bool inc){	int ret; 	if (pages == 0 || !mm)		return 0; 	mmap_write_lock(mm);	ret = __account_locked_vm(mm, pages, inc, current,				  capable(CAP_IPC_LOCK));	mmap_write_unlock(mm); 	return ret;}EXPORT_SYMBOL_GPL(account_locked_vm); unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr,	unsigned long len, unsigned long prot,	unsigned long flag, unsigned long pgoff){	unsigned long ret;	struct mm_struct *mm = current->mm;	unsigned long populate;	LIST_HEAD(uf);

Lines 1–500 of 971.