// SPDX-License-Identifier: GPL-2.0 /* * Copyright (C) 2002 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com) */ #include #include #include #include #include #include #include #include #include #include pte_t *virt_to_pte(struct mm_struct *mm, unsigned long addr) { pgd_t *pgd; p4d_t *p4d; pud_t *pud; pmd_t *pmd; if (mm == NULL) return NULL; pgd = pgd_offset(mm, addr); if (!pgd_present(*pgd)) return NULL; p4d = p4d_offset(pgd, addr); if (!p4d_present(*p4d)) return NULL; pud = pud_offset(p4d, addr); if (!pud_present(*pud)) return NULL; pmd = pmd_offset(pud, addr); if (!pmd_present(*pmd)) return NULL; return pte_offset_kernel(pmd, addr); } static pte_t *maybe_map(unsigned long virt, int is_write) { pte_t *pte = virt_to_pte(current->mm, virt); int err, dummy_code; if ((pte == NULL) || !pte_present(*pte) || (is_write && !pte_write(*pte))) { err = handle_page_fault(virt, 0, is_write, 1, &dummy_code); if (err) return NULL; pte = virt_to_pte(current->mm, virt); } if (!pte_present(*pte)) pte = NULL; return pte; } static int do_op_one_page(unsigned long addr, int len, int is_write, int (*op)(unsigned long addr, int len, void *arg), void *arg) { struct page *page; pte_t *pte; int n; pte = maybe_map(addr, is_write); if (pte == NULL) return -1; page = pte_page(*pte); #ifdef CONFIG_64BIT pagefault_disable(); addr = (unsigned long) page_address(page) + (addr & ~PAGE_MASK); #else addr = (unsigned long) kmap_atomic(page) + (addr & ~PAGE_MASK); #endif n = (*op)(addr, len, arg); #ifdef CONFIG_64BIT pagefault_enable(); #else kunmap_atomic((void *)addr); #endif return n; } static long buffer_op(unsigned long addr, int len, int is_write, int (*op)(unsigned long, int, void *), void *arg) { long size, remain, n; size = min(PAGE_ALIGN(addr) - addr, (unsigned long) len); remain = len; n = do_op_one_page(addr, size, is_write, op, arg); if (n != 0) { remain = (n < 0 ? remain : 0); goto out; } addr += size; remain -= size; if (remain == 0) goto out; while (addr < ((addr + remain) & PAGE_MASK)) { n = do_op_one_page(addr, PAGE_SIZE, is_write, op, arg); if (n != 0) { remain = (n < 0 ? remain : 0); goto out; } addr += PAGE_SIZE; remain -= PAGE_SIZE; } if (remain == 0) goto out; n = do_op_one_page(addr, remain, is_write, op, arg); if (n != 0) { remain = (n < 0 ? remain : 0); goto out; } return 0; out: return remain; } static int copy_chunk_from_user(unsigned long from, int len, void *arg) { unsigned long *to_ptr = arg, to = *to_ptr; memcpy((void *) to, (void *) from, len); *to_ptr += len; return 0; } unsigned long raw_copy_from_user(void *to, const void __user *from, unsigned long n) { return buffer_op((unsigned long) from, n, 0, copy_chunk_from_user, &to); } EXPORT_SYMBOL(raw_copy_from_user); static int copy_chunk_to_user(unsigned long to, int len, void *arg) { unsigned long *from_ptr = arg, from = *from_ptr; memcpy((void *) to, (void *) from, len); *from_ptr += len; return 0; } unsigned long raw_copy_to_user(void __user *to, const void *from, unsigned long n) { return buffer_op((unsigned long) to, n, 1, copy_chunk_to_user, &from); } EXPORT_SYMBOL(raw_copy_to_user); static int strncpy_chunk_from_user(unsigned long from, int len, void *arg) { char **to_ptr = arg, *to = *to_ptr; int n; n = strnlen((void *) from, len); memcpy_and_pad(to, len, (void *) from, n, 0); *to_ptr += n; if (n < len) return 1; return 0; } long strncpy_from_user(char *dst, const char __user *src, long count) { long n; char *ptr = dst; if (!access_ok(src, 1)) return -EFAULT; n = buffer_op((unsigned long) src, count, 0, strncpy_chunk_from_user, &ptr); if (n != 0) return -EFAULT; return strnlen(dst, count); } EXPORT_SYMBOL(strncpy_from_user); static int clear_chunk(unsigned long addr, int len, void *unused) { memset((void *) addr, 0, len); return 0; } unsigned long __clear_user(void __user *mem, unsigned long len) { return buffer_op((unsigned long) mem, len, 1, clear_chunk, NULL); } EXPORT_SYMBOL(__clear_user); static int strnlen_chunk(unsigned long str, int len, void *arg) { int *len_ptr = arg, n; n = strnlen((void *) str, len); *len_ptr += n; if (n < len) return 1; return 0; } long strnlen_user(const char __user *str, long len) { int count = 0, n; if (!access_ok(str, 1)) return -EFAULT; n = buffer_op((unsigned long) str, len, 0, strnlen_chunk, &count); if (n == 0) return count + 1; return 0; } EXPORT_SYMBOL(strnlen_user); int arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval, u32 __user *uaddr) { unsigned long addr = (unsigned long) uaddr; u32 *p, oldval, newval; struct page *page; pte_t *pte; if (!access_ok(uaddr, sizeof(*uaddr))) return -EFAULT; switch (op) { case FUTEX_OP_SET: case FUTEX_OP_ADD: case FUTEX_OP_OR: case FUTEX_OP_ANDN: case FUTEX_OP_XOR: break; default: return -ENOSYS; } preempt_disable(); pte = maybe_map(addr, 1); if (pte == NULL) { preempt_enable(); return -EFAULT; } page = pte_page(*pte); #ifdef CONFIG_64BIT pagefault_disable(); p = page_address(page) + (addr & ~PAGE_MASK); #else p = kmap_atomic(page) + (addr & ~PAGE_MASK); #endif do { oldval = READ_ONCE(*p); switch (op) { case FUTEX_OP_SET: newval = oparg; break; case FUTEX_OP_ADD: newval = oldval + oparg; break; case FUTEX_OP_OR: newval = oldval | oparg; break; case FUTEX_OP_ANDN: newval = oldval & ~oparg; break; case FUTEX_OP_XOR: newval = oldval ^ oparg; break; } } while (!try_cmpxchg(p, &oldval, newval)); *oval = oldval; #ifdef CONFIG_64BIT pagefault_enable(); #else kunmap_atomic((void *)addr); #endif preempt_enable(); return 0; } int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, u32 oldval, u32 newval) { struct page *page; pte_t *pte; if (!access_ok(uaddr, sizeof(*uaddr))) return -EFAULT; preempt_disable(); pte = maybe_map((unsigned long) uaddr, 1); if (pte == NULL) { preempt_enable(); return -EFAULT; } page = pte_page(*pte); #ifdef CONFIG_64BIT pagefault_disable(); uaddr = page_address(page) + (((unsigned long) uaddr) & ~PAGE_MASK); #else uaddr = kmap_atomic(page) + ((unsigned long) uaddr & ~PAGE_MASK); #endif *uval = cmpxchg(uaddr, oldval, newval); #ifdef CONFIG_64BIT pagefault_enable(); #else kunmap_atomic(uaddr); #endif preempt_enable(); return 0; }