1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/kernel.h> 3 #include <linux/init.h> 4 #include <linux/errno.h> 5 #include <linux/mm.h> 6 #include <linux/mman.h> 7 #include <linux/slab.h> 8 #include <linux/vmalloc.h> 9 #include <linux/io_uring.h> 10 #include <linux/io_uring_types.h> 11 #include <asm/shmparam.h> 12 13 #include "memmap.h" 14 #include "kbuf.h" 15 #include "rsrc.h" 16 #include "zcrx.h" 17 18 static bool io_mem_alloc_compound(struct page **pages, int nr_pages, 19 size_t size, gfp_t gfp, 20 struct user_struct *user) 21 { 22 unsigned long nr_compound, extra; 23 struct page *page; 24 int i, order; 25 26 order = get_order(size); 27 if (order > MAX_PAGE_ORDER) 28 return false; 29 else if (order) 30 gfp |= __GFP_COMP; 31 32 /* 33 * get_order() rounds a non power of two size up, so the allocation 34 * can hold more pages than the region exposes. Account those too, 35 * and leave the compound allocation alone if they do not fit. 36 */ 37 nr_compound = 1UL << order; 38 extra = nr_compound - nr_pages; 39 if (extra && user && __io_account_mem(user, extra)) 40 return false; 41 42 page = alloc_pages(gfp, order); 43 if (!page) { 44 if (extra && user) 45 __io_unaccount_mem(user, extra); 46 return false; 47 } 48 49 for (i = 0; i < nr_pages; i++) 50 pages[i] = page + i; 51 52 return true; 53 } 54 55 struct page **io_pin_pages(unsigned long uaddr, unsigned long len, int *npages) 56 { 57 unsigned long start, end, nr_pages; 58 struct page **pages; 59 int ret; 60 61 if (check_add_overflow(uaddr, len, &end)) 62 return ERR_PTR(-EOVERFLOW); 63 if (check_add_overflow(end, PAGE_SIZE - 1, &end)) 64 return ERR_PTR(-EOVERFLOW); 65 66 end = end >> PAGE_SHIFT; 67 start = uaddr >> PAGE_SHIFT; 68 nr_pages = end - start; 69 if (WARN_ON_ONCE(!nr_pages)) 70 return ERR_PTR(-EINVAL); 71 if (nr_pages > INT_MAX / sizeof(struct page *)) 72 return ERR_PTR(-EOVERFLOW); 73 74 pages = kvmalloc_objs(struct page *, nr_pages, GFP_KERNEL_ACCOUNT); 75 if (!pages) 76 return ERR_PTR(-ENOMEM); 77 78 ret = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM, 79 pages); 80 /* success, mapped all pages */ 81 if (ret == nr_pages) { 82 *npages = nr_pages; 83 return pages; 84 } 85 86 /* partial map, or didn't map anything */ 87 if (ret >= 0) { 88 /* if we did partial map, release any pages we did get */ 89 if (ret) 90 unpin_user_pages(pages, ret); 91 ret = -EFAULT; 92 } 93 kvfree(pages); 94 return ERR_PTR(ret); 95 } 96 97 enum { 98 /* memory was vmap'ed for the kernel, freeing the region vunmap's it */ 99 IO_REGION_F_VMAP = 1, 100 /* memory is provided by user and pinned by the kernel */ 101 IO_REGION_F_USER_PROVIDED = 2, 102 /* only the first page in the array is ref'ed */ 103 IO_REGION_F_SINGLE_REF = 4, 104 }; 105 106 void io_free_region(struct user_struct *user, struct io_mapped_region *mr) 107 { 108 if (mr->pages) { 109 long nr_refs = mr->nr_pages; 110 111 if (mr->flags & IO_REGION_F_SINGLE_REF) 112 nr_refs = 1; 113 114 if (mr->flags & IO_REGION_F_USER_PROVIDED) 115 unpin_user_pages(mr->pages, nr_refs); 116 else 117 release_pages(mr->pages, nr_refs); 118 119 kvfree(mr->pages); 120 } 121 if ((mr->flags & IO_REGION_F_VMAP) && mr->ptr) 122 vunmap(mr->ptr); 123 if (mr->nr_pages && user) { 124 unsigned long nr_accounted = mr->nr_pages; 125 126 /* a compound region was accounted for the whole allocation */ 127 if (mr->flags & IO_REGION_F_SINGLE_REF) 128 nr_accounted = 1UL << get_order(io_region_size(mr)); 129 130 __io_unaccount_mem(user, nr_accounted); 131 } 132 133 memset(mr, 0, sizeof(*mr)); 134 } 135 136 static int io_region_init_ptr(struct io_mapped_region *mr) 137 { 138 struct io_imu_folio_data ifd; 139 void *ptr; 140 141 if (io_check_coalesce_buffer(mr->pages, mr->nr_pages, &ifd)) { 142 if (ifd.nr_folios == 1 && !PageHighMem(mr->pages[0])) { 143 mr->ptr = page_address(mr->pages[0]); 144 return 0; 145 } 146 } 147 ptr = vmap(mr->pages, mr->nr_pages, VM_MAP, PAGE_KERNEL); 148 if (!ptr) 149 return -ENOMEM; 150 151 mr->ptr = ptr; 152 mr->flags |= IO_REGION_F_VMAP; 153 return 0; 154 } 155 156 static int io_region_pin_pages(struct io_mapped_region *mr, 157 struct io_uring_region_desc *reg) 158 { 159 size_t size = io_region_size(mr); 160 struct page **pages; 161 int nr_pages; 162 163 pages = io_pin_pages(reg->user_addr, size, &nr_pages); 164 if (IS_ERR(pages)) 165 return PTR_ERR(pages); 166 if (WARN_ON_ONCE(nr_pages != mr->nr_pages)) 167 return -EFAULT; 168 169 mr->pages = pages; 170 mr->flags |= IO_REGION_F_USER_PROVIDED; 171 return 0; 172 } 173 174 static int io_region_allocate_pages(struct io_mapped_region *mr, 175 struct io_uring_region_desc *reg, 176 unsigned long mmap_offset, 177 struct user_struct *user) 178 { 179 gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN; 180 size_t size = io_region_size(mr); 181 unsigned long nr_allocated; 182 struct page **pages; 183 struct page *page; 184 185 pages = kvmalloc_objs(*pages, mr->nr_pages, gfp); 186 if (!pages) 187 return -ENOMEM; 188 189 if (io_mem_alloc_compound(pages, mr->nr_pages, size, gfp, user)) { 190 mr->flags |= IO_REGION_F_SINGLE_REF; 191 goto done; 192 } 193 194 nr_allocated = alloc_pages_bulk_node(gfp, NUMA_NO_NODE, 195 mr->nr_pages, pages); 196 while (nr_allocated < mr->nr_pages) { 197 page = alloc_page(gfp); 198 if (!page) 199 break; 200 201 pages[nr_allocated++] = page; 202 } 203 if (nr_allocated != mr->nr_pages) { 204 if (nr_allocated) 205 release_pages(pages, nr_allocated); 206 kvfree(pages); 207 return -ENOMEM; 208 } 209 done: 210 reg->mmap_offset = mmap_offset; 211 mr->pages = pages; 212 return 0; 213 } 214 215 int io_create_region(struct user_struct *user, struct io_mapped_region *mr, 216 struct io_uring_region_desc *reg, 217 unsigned long mmap_offset) 218 { 219 int nr_pages, ret; 220 u64 end; 221 222 if (WARN_ON_ONCE(mr->pages || mr->ptr || mr->nr_pages)) 223 return -EFAULT; 224 if (memchr_inv(®->__resv, 0, sizeof(reg->__resv))) 225 return -EINVAL; 226 if (reg->flags & ~IORING_MEM_REGION_TYPE_USER) 227 return -EINVAL; 228 /* user_addr should be set IFF it's a user memory backed region */ 229 if ((reg->flags & IORING_MEM_REGION_TYPE_USER) != !!reg->user_addr) 230 return -EFAULT; 231 if (!reg->size || reg->mmap_offset || reg->id) 232 return -EINVAL; 233 if ((reg->size >> PAGE_SHIFT) > INT_MAX) 234 return -E2BIG; 235 if ((reg->user_addr | reg->size) & ~PAGE_MASK) 236 return -EINVAL; 237 if (check_add_overflow(reg->user_addr, reg->size, &end)) 238 return -EOVERFLOW; 239 240 nr_pages = reg->size >> PAGE_SHIFT; 241 if (user) { 242 ret = __io_account_mem(user, nr_pages); 243 if (ret) 244 return ret; 245 } 246 mr->nr_pages = nr_pages; 247 248 if (reg->flags & IORING_MEM_REGION_TYPE_USER) 249 ret = io_region_pin_pages(mr, reg); 250 else 251 ret = io_region_allocate_pages(mr, reg, mmap_offset, user); 252 if (ret) 253 goto out_free; 254 255 ret = io_region_init_ptr(mr); 256 if (ret) 257 goto out_free; 258 return 0; 259 out_free: 260 io_free_region(user, mr); 261 return ret; 262 } 263 264 static struct io_mapped_region *io_mmap_get_region(struct io_ring_ctx *ctx, 265 loff_t pgoff) 266 { 267 loff_t offset = pgoff << PAGE_SHIFT; 268 unsigned int id; 269 270 271 switch (offset & IORING_OFF_MMAP_MASK) { 272 case IORING_OFF_SQ_RING: 273 case IORING_OFF_CQ_RING: 274 return &ctx->ring_region; 275 case IORING_OFF_SQES: 276 return &ctx->sq_region; 277 case IORING_OFF_PBUF_RING: 278 id = (offset & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_PBUF_SHIFT; 279 return io_pbuf_get_region(ctx, id); 280 case IORING_MAP_OFF_PARAM_REGION: 281 return &ctx->param_region; 282 case IORING_MAP_OFF_ZCRX_REGION: 283 id = (offset & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_ZCRX_SHIFT; 284 return io_zcrx_get_region(ctx, id); 285 } 286 return NULL; 287 } 288 289 static void *io_region_validate_mmap(struct io_ring_ctx *ctx, 290 struct io_mapped_region *mr) 291 { 292 lockdep_assert_held(&ctx->mmap_lock); 293 294 if (!io_region_is_set(mr)) 295 return ERR_PTR(-EINVAL); 296 if (mr->flags & IO_REGION_F_USER_PROVIDED) 297 return ERR_PTR(-EINVAL); 298 299 return io_region_get_ptr(mr); 300 } 301 302 static void *io_uring_validate_mmap_request(struct file *file, loff_t pgoff) 303 { 304 struct io_ring_ctx *ctx = file->private_data; 305 struct io_mapped_region *region; 306 307 region = io_mmap_get_region(ctx, pgoff); 308 if (!region) 309 return ERR_PTR(-EINVAL); 310 return io_region_validate_mmap(ctx, region); 311 } 312 313 #ifdef CONFIG_MMU 314 315 static int io_region_mmap(struct io_ring_ctx *ctx, 316 struct io_mapped_region *mr, 317 struct vm_area_struct *vma, 318 unsigned max_pages) 319 { 320 unsigned long nr_pages = min(mr->nr_pages, max_pages); 321 322 vm_flags_set(vma, VM_DONTEXPAND); 323 return vm_insert_pages(vma, vma->vm_start, mr->pages, &nr_pages); 324 } 325 326 __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 327 { 328 struct io_ring_ctx *ctx = file->private_data; 329 size_t sz = vma->vm_end - vma->vm_start; 330 long offset = vma->vm_pgoff << PAGE_SHIFT; 331 unsigned int page_limit = UINT_MAX; 332 struct io_mapped_region *region; 333 void *ptr; 334 335 guard(mutex)(&ctx->mmap_lock); 336 337 ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff); 338 if (IS_ERR(ptr)) 339 return PTR_ERR(ptr); 340 341 switch (offset & IORING_OFF_MMAP_MASK) { 342 case IORING_OFF_SQ_RING: 343 case IORING_OFF_CQ_RING: 344 page_limit = (sz + PAGE_SIZE - 1) >> PAGE_SHIFT; 345 break; 346 } 347 348 region = io_mmap_get_region(ctx, vma->vm_pgoff); 349 return io_region_mmap(ctx, region, vma, page_limit); 350 } 351 352 unsigned long io_uring_get_unmapped_area(struct file *filp, unsigned long addr, 353 unsigned long len, unsigned long pgoff, 354 unsigned long flags) 355 { 356 struct io_ring_ctx *ctx = filp->private_data; 357 void *ptr; 358 359 /* 360 * Do not allow to map to user-provided address to avoid breaking the 361 * aliasing rules. Userspace is not able to guess the offset address of 362 * kernel kmalloc()ed memory area. 363 */ 364 if (addr) 365 return -EINVAL; 366 367 guard(mutex)(&ctx->mmap_lock); 368 369 ptr = io_uring_validate_mmap_request(filp, pgoff); 370 if (IS_ERR(ptr)) 371 return PTR_ERR(ptr); 372 373 /* 374 * Some architectures have strong cache aliasing requirements. 375 * For such architectures we need a coherent mapping which aliases 376 * kernel memory *and* userspace memory. To achieve that: 377 * - use a NULL file pointer to reference physical memory, and 378 * - use the kernel virtual address of the shared io_uring context 379 * (instead of the userspace-provided address, which has to be 0UL 380 * anyway). 381 * - use the same pgoff which the get_unmapped_area() uses to 382 * calculate the page colouring. 383 * For architectures without such aliasing requirements, the 384 * architecture will return any suitable mapping because addr is 0. 385 */ 386 filp = NULL; 387 flags |= MAP_SHARED; 388 pgoff = 0; /* has been translated to ptr above */ 389 #ifdef SHM_COLOUR 390 addr = (uintptr_t) ptr; 391 pgoff = addr >> PAGE_SHIFT; 392 #else 393 addr = 0UL; 394 #endif 395 return mm_get_unmapped_area(filp, addr, len, pgoff, flags); 396 } 397 398 #else /* !CONFIG_MMU */ 399 400 /* 401 * Drop the pages that were initially referenced and added in 402 * io_uring_mmap(). We cannot have had a mremap() as that isn't supported, 403 * hence the vma should be identical to the one we initially referenced and 404 * mapped, and partial unmaps and splitting isn't possible on a file backed 405 * mapping. 406 */ 407 static void io_uring_nommu_vm_close(struct vm_area_struct *vma) 408 { 409 unsigned long index; 410 411 for (index = vma->vm_start; index < vma->vm_end; index += PAGE_SIZE) 412 put_page(virt_to_page((void *) index)); 413 } 414 415 static const struct vm_operations_struct io_uring_nommu_vm_ops = { 416 .close = io_uring_nommu_vm_close, 417 }; 418 419 int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 420 { 421 struct io_ring_ctx *ctx = file->private_data; 422 struct io_mapped_region *region; 423 unsigned long i; 424 425 if (!is_nommu_shared_mapping(vma->vm_flags)) 426 return -EINVAL; 427 428 guard(mutex)(&ctx->mmap_lock); 429 region = io_mmap_get_region(ctx, vma->vm_pgoff); 430 if (!region || !io_region_is_set(region)) 431 return -EINVAL; 432 433 if ((vma->vm_end - vma->vm_start) != 434 (unsigned long) region->nr_pages << PAGE_SHIFT) 435 return -EINVAL; 436 437 /* 438 * Pin the pages so io_free_region()'s release_pages() does not 439 * drop the last reference while this VMA exists. delete_vma() 440 * in mm/nommu.c calls vma_close() which runs ->close above. 441 */ 442 for (i = 0; i < region->nr_pages; i++) 443 get_page(region->pages[i]); 444 445 vma->vm_ops = &io_uring_nommu_vm_ops; 446 return 0; 447 } 448 449 unsigned int io_uring_nommu_mmap_capabilities(struct file *file) 450 { 451 return NOMMU_MAP_DIRECT | NOMMU_MAP_READ | NOMMU_MAP_WRITE; 452 } 453 454 unsigned long io_uring_get_unmapped_area(struct file *file, unsigned long addr, 455 unsigned long len, unsigned long pgoff, 456 unsigned long flags) 457 { 458 struct io_ring_ctx *ctx = file->private_data; 459 void *ptr; 460 461 guard(mutex)(&ctx->mmap_lock); 462 463 ptr = io_uring_validate_mmap_request(file, pgoff); 464 if (IS_ERR(ptr)) 465 return PTR_ERR(ptr); 466 467 return (unsigned long) ptr; 468 } 469 470 #endif /* !CONFIG_MMU */ 471