1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/kernel.h>
3 #include <linux/init.h>
4 #include <linux/errno.h>
5 #include <linux/mm.h>
6 #include <linux/mman.h>
7 #include <linux/slab.h>
8 #include <linux/vmalloc.h>
9 #include <linux/io_uring.h>
10 #include <linux/io_uring_types.h>
11 #include <asm/shmparam.h>
12
13 #include "memmap.h"
14 #include "kbuf.h"
15 #include "rsrc.h"
16
io_mem_alloc_compound(struct page ** pages,int nr_pages,size_t size,gfp_t gfp)17 static void *io_mem_alloc_compound(struct page **pages, int nr_pages,
18 size_t size, gfp_t gfp)
19 {
20 struct page *page;
21 int i, order;
22
23 order = get_order(size);
24 if (order > MAX_PAGE_ORDER)
25 return ERR_PTR(-ENOMEM);
26 else if (order)
27 gfp |= __GFP_COMP;
28
29 page = alloc_pages(gfp, order);
30 if (!page)
31 return ERR_PTR(-ENOMEM);
32
33 for (i = 0; i < nr_pages; i++)
34 pages[i] = page + i;
35
36 return page_address(page);
37 }
38
io_mem_alloc_single(struct page ** pages,int nr_pages,size_t size,gfp_t gfp)39 static void *io_mem_alloc_single(struct page **pages, int nr_pages, size_t size,
40 gfp_t gfp)
41 {
42 void *ret;
43 int i;
44
45 for (i = 0; i < nr_pages; i++) {
46 pages[i] = alloc_page(gfp);
47 if (!pages[i])
48 goto err;
49 }
50
51 ret = vmap(pages, nr_pages, VM_MAP, PAGE_KERNEL);
52 if (ret)
53 return ret;
54 err:
55 while (i--)
56 put_page(pages[i]);
57 return ERR_PTR(-ENOMEM);
58 }
59
io_pages_map(struct page *** out_pages,unsigned short * npages,size_t size)60 void *io_pages_map(struct page ***out_pages, unsigned short *npages,
61 size_t size)
62 {
63 gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN;
64 struct page **pages;
65 int nr_pages;
66 void *ret;
67
68 nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
69 pages = kvmalloc_array(nr_pages, sizeof(struct page *), gfp);
70 if (!pages)
71 return ERR_PTR(-ENOMEM);
72
73 ret = io_mem_alloc_compound(pages, nr_pages, size, gfp);
74 if (!IS_ERR(ret))
75 goto done;
76 if (nr_pages == 1)
77 goto fail;
78
79 ret = io_mem_alloc_single(pages, nr_pages, size, gfp);
80 if (!IS_ERR(ret)) {
81 done:
82 *out_pages = pages;
83 *npages = nr_pages;
84 return ret;
85 }
86 fail:
87 kvfree(pages);
88 *out_pages = NULL;
89 *npages = 0;
90 return ret;
91 }
92
io_pages_unmap(void * ptr,struct page *** pages,unsigned short * npages,bool put_pages)93 void io_pages_unmap(void *ptr, struct page ***pages, unsigned short *npages,
94 bool put_pages)
95 {
96 bool do_vunmap = false;
97
98 if (!ptr)
99 return;
100
101 if (put_pages && *npages) {
102 struct page **to_free = *pages;
103 int i;
104
105 /*
106 * Only did vmap for the non-compound multiple page case.
107 * For the compound page, we just need to put the head.
108 */
109 if (PageCompound(to_free[0]))
110 *npages = 1;
111 else if (*npages > 1)
112 do_vunmap = true;
113 for (i = 0; i < *npages; i++)
114 put_page(to_free[i]);
115 }
116 if (do_vunmap)
117 vunmap(ptr);
118 kvfree(*pages);
119 *pages = NULL;
120 *npages = 0;
121 }
122
io_pages_free(struct page *** pages,int npages)123 void io_pages_free(struct page ***pages, int npages)
124 {
125 struct page **page_array = *pages;
126
127 if (!page_array)
128 return;
129
130 unpin_user_pages(page_array, npages);
131 kvfree(page_array);
132 *pages = NULL;
133 }
134
io_pin_pages(unsigned long uaddr,unsigned long len,int * npages)135 struct page **io_pin_pages(unsigned long uaddr, unsigned long len, int *npages)
136 {
137 unsigned long start, end, nr_pages;
138 struct page **pages;
139 int ret;
140
141 if (check_add_overflow(uaddr, len, &end))
142 return ERR_PTR(-EOVERFLOW);
143 if (check_add_overflow(end, PAGE_SIZE - 1, &end))
144 return ERR_PTR(-EOVERFLOW);
145
146 end = end >> PAGE_SHIFT;
147 start = uaddr >> PAGE_SHIFT;
148 nr_pages = end - start;
149 if (WARN_ON_ONCE(!nr_pages))
150 return ERR_PTR(-EINVAL);
151 if (WARN_ON_ONCE(nr_pages > INT_MAX))
152 return ERR_PTR(-EOVERFLOW);
153
154 pages = kvmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL);
155 if (!pages)
156 return ERR_PTR(-ENOMEM);
157
158 ret = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM,
159 pages);
160 /* success, mapped all pages */
161 if (ret == nr_pages) {
162 *npages = nr_pages;
163 return pages;
164 }
165
166 /* partial map, or didn't map anything */
167 if (ret >= 0) {
168 /* if we did partial map, release any pages we did get */
169 if (ret)
170 unpin_user_pages(pages, ret);
171 ret = -EFAULT;
172 }
173 kvfree(pages);
174 return ERR_PTR(ret);
175 }
176
__io_uaddr_map(struct page *** pages,unsigned short * npages,unsigned long uaddr,size_t size)177 void *__io_uaddr_map(struct page ***pages, unsigned short *npages,
178 unsigned long uaddr, size_t size)
179 {
180 struct page **page_array;
181 unsigned int nr_pages;
182 void *page_addr;
183
184 *npages = 0;
185
186 if (uaddr & (PAGE_SIZE - 1) || !size)
187 return ERR_PTR(-EINVAL);
188
189 nr_pages = 0;
190 page_array = io_pin_pages(uaddr, size, &nr_pages);
191 if (IS_ERR(page_array))
192 return page_array;
193
194 page_addr = vmap(page_array, nr_pages, VM_MAP, PAGE_KERNEL);
195 if (page_addr) {
196 *pages = page_array;
197 *npages = nr_pages;
198 return page_addr;
199 }
200
201 io_pages_free(&page_array, nr_pages);
202 return ERR_PTR(-ENOMEM);
203 }
204
io_free_region(struct io_ring_ctx * ctx,struct io_mapped_region * mr)205 void io_free_region(struct io_ring_ctx *ctx, struct io_mapped_region *mr)
206 {
207 if (mr->pages) {
208 unpin_user_pages(mr->pages, mr->nr_pages);
209 kvfree(mr->pages);
210 }
211 if (mr->vmap_ptr)
212 vunmap(mr->vmap_ptr);
213 if (mr->nr_pages && ctx->user)
214 __io_unaccount_mem(ctx->user, mr->nr_pages);
215
216 memset(mr, 0, sizeof(*mr));
217 }
218
io_create_region(struct io_ring_ctx * ctx,struct io_mapped_region * mr,struct io_uring_region_desc * reg)219 int io_create_region(struct io_ring_ctx *ctx, struct io_mapped_region *mr,
220 struct io_uring_region_desc *reg)
221 {
222 int pages_accounted = 0;
223 struct page **pages;
224 int nr_pages, ret;
225 void *vptr;
226 u64 end;
227
228 if (WARN_ON_ONCE(mr->pages || mr->vmap_ptr || mr->nr_pages))
229 return -EFAULT;
230 if (memchr_inv(®->__resv, 0, sizeof(reg->__resv)))
231 return -EINVAL;
232 if (reg->flags != IORING_MEM_REGION_TYPE_USER)
233 return -EINVAL;
234 if (!reg->user_addr)
235 return -EFAULT;
236 if (!reg->size || reg->mmap_offset || reg->id)
237 return -EINVAL;
238 if ((reg->size >> PAGE_SHIFT) > INT_MAX)
239 return -E2BIG;
240 if ((reg->user_addr | reg->size) & ~PAGE_MASK)
241 return -EINVAL;
242 if (check_add_overflow(reg->user_addr, reg->size, &end))
243 return -EOVERFLOW;
244
245 pages = io_pin_pages(reg->user_addr, reg->size, &nr_pages);
246 if (IS_ERR(pages))
247 return PTR_ERR(pages);
248
249 if (ctx->user) {
250 ret = __io_account_mem(ctx->user, nr_pages);
251 if (ret)
252 goto out_free;
253 pages_accounted = nr_pages;
254 }
255
256 vptr = vmap(pages, nr_pages, VM_MAP, PAGE_KERNEL);
257 if (!vptr) {
258 ret = -ENOMEM;
259 goto out_free;
260 }
261
262 mr->pages = pages;
263 mr->vmap_ptr = vptr;
264 mr->nr_pages = nr_pages;
265 return 0;
266 out_free:
267 if (pages_accounted)
268 __io_unaccount_mem(ctx->user, pages_accounted);
269 io_pages_free(&pages, nr_pages);
270 return ret;
271 }
272
io_uring_validate_mmap_request(struct file * file,loff_t pgoff,size_t sz)273 static void *io_uring_validate_mmap_request(struct file *file, loff_t pgoff,
274 size_t sz)
275 {
276 struct io_ring_ctx *ctx = file->private_data;
277 loff_t offset = pgoff << PAGE_SHIFT;
278
279 switch ((pgoff << PAGE_SHIFT) & IORING_OFF_MMAP_MASK) {
280 case IORING_OFF_SQ_RING:
281 case IORING_OFF_CQ_RING:
282 /* Don't allow mmap if the ring was setup without it */
283 if (ctx->flags & IORING_SETUP_NO_MMAP)
284 return ERR_PTR(-EINVAL);
285 if (!ctx->rings)
286 return ERR_PTR(-EFAULT);
287 return ctx->rings;
288 case IORING_OFF_SQES:
289 /* Don't allow mmap if the ring was setup without it */
290 if (ctx->flags & IORING_SETUP_NO_MMAP)
291 return ERR_PTR(-EINVAL);
292 if (!ctx->sq_sqes)
293 return ERR_PTR(-EFAULT);
294 return ctx->sq_sqes;
295 case IORING_OFF_PBUF_RING: {
296 struct io_buffer_list *bl;
297 unsigned int bgid;
298 void *ptr;
299
300 bgid = (offset & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_PBUF_SHIFT;
301 bl = io_pbuf_get_bl(ctx, bgid);
302 if (IS_ERR(bl))
303 return bl;
304 ptr = bl->buf_ring;
305 io_put_bl(ctx, bl);
306 return ptr;
307 }
308 }
309
310 return ERR_PTR(-EINVAL);
311 }
312
io_uring_mmap_pages(struct io_ring_ctx * ctx,struct vm_area_struct * vma,struct page ** pages,int npages)313 int io_uring_mmap_pages(struct io_ring_ctx *ctx, struct vm_area_struct *vma,
314 struct page **pages, int npages)
315 {
316 unsigned long nr_pages = npages;
317
318 vm_flags_set(vma, VM_DONTEXPAND);
319 return vm_insert_pages(vma, vma->vm_start, pages, &nr_pages);
320 }
321
322 #ifdef CONFIG_MMU
323
io_uring_mmap(struct file * file,struct vm_area_struct * vma)324 __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma)
325 {
326 struct io_ring_ctx *ctx = file->private_data;
327 size_t sz = vma->vm_end - vma->vm_start;
328 long offset = vma->vm_pgoff << PAGE_SHIFT;
329 unsigned int npages;
330 void *ptr;
331
332 guard(mutex)(&ctx->resize_lock);
333
334 ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff, sz);
335 if (IS_ERR(ptr))
336 return PTR_ERR(ptr);
337
338 switch (offset & IORING_OFF_MMAP_MASK) {
339 case IORING_OFF_SQ_RING:
340 case IORING_OFF_CQ_RING:
341 npages = min(ctx->n_ring_pages, (sz + PAGE_SIZE - 1) >> PAGE_SHIFT);
342 return io_uring_mmap_pages(ctx, vma, ctx->ring_pages, npages);
343 case IORING_OFF_SQES:
344 return io_uring_mmap_pages(ctx, vma, ctx->sqe_pages,
345 ctx->n_sqe_pages);
346 case IORING_OFF_PBUF_RING:
347 return io_pbuf_mmap(file, vma);
348 }
349
350 return -EINVAL;
351 }
352
io_uring_get_unmapped_area(struct file * filp,unsigned long addr,unsigned long len,unsigned long pgoff,unsigned long flags)353 unsigned long io_uring_get_unmapped_area(struct file *filp, unsigned long addr,
354 unsigned long len, unsigned long pgoff,
355 unsigned long flags)
356 {
357 struct io_ring_ctx *ctx = filp->private_data;
358 void *ptr;
359
360 /*
361 * Do not allow to map to user-provided address to avoid breaking the
362 * aliasing rules. Userspace is not able to guess the offset address of
363 * kernel kmalloc()ed memory area.
364 */
365 if (addr)
366 return -EINVAL;
367
368 guard(mutex)(&ctx->resize_lock);
369
370 ptr = io_uring_validate_mmap_request(filp, pgoff, len);
371 if (IS_ERR(ptr))
372 return -ENOMEM;
373
374 /*
375 * Some architectures have strong cache aliasing requirements.
376 * For such architectures we need a coherent mapping which aliases
377 * kernel memory *and* userspace memory. To achieve that:
378 * - use a NULL file pointer to reference physical memory, and
379 * - use the kernel virtual address of the shared io_uring context
380 * (instead of the userspace-provided address, which has to be 0UL
381 * anyway).
382 * - use the same pgoff which the get_unmapped_area() uses to
383 * calculate the page colouring.
384 * For architectures without such aliasing requirements, the
385 * architecture will return any suitable mapping because addr is 0.
386 */
387 filp = NULL;
388 flags |= MAP_SHARED;
389 pgoff = 0; /* has been translated to ptr above */
390 #ifdef SHM_COLOUR
391 addr = (uintptr_t) ptr;
392 pgoff = addr >> PAGE_SHIFT;
393 #else
394 addr = 0UL;
395 #endif
396 return mm_get_unmapped_area(current->mm, filp, addr, len, pgoff, flags);
397 }
398
399 #else /* !CONFIG_MMU */
400
io_uring_mmap(struct file * file,struct vm_area_struct * vma)401 int io_uring_mmap(struct file *file, struct vm_area_struct *vma)
402 {
403 return is_nommu_shared_mapping(vma->vm_flags) ? 0 : -EINVAL;
404 }
405
io_uring_nommu_mmap_capabilities(struct file * file)406 unsigned int io_uring_nommu_mmap_capabilities(struct file *file)
407 {
408 return NOMMU_MAP_DIRECT | NOMMU_MAP_READ | NOMMU_MAP_WRITE;
409 }
410
io_uring_get_unmapped_area(struct file * file,unsigned long addr,unsigned long len,unsigned long pgoff,unsigned long flags)411 unsigned long io_uring_get_unmapped_area(struct file *file, unsigned long addr,
412 unsigned long len, unsigned long pgoff,
413 unsigned long flags)
414 {
415 struct io_ring_ctx *ctx = file->private_data;
416 void *ptr;
417
418 guard(mutex)(&ctx->resize_lock);
419
420 ptr = io_uring_validate_mmap_request(file, pgoff, len);
421 if (IS_ERR(ptr))
422 return PTR_ERR(ptr);
423
424 return (unsigned long) ptr;
425 }
426
427 #endif /* !CONFIG_MMU */
428