1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2000 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com) 4 */ 5 6 #include <linux/mm.h> 7 #include <linux/sched/signal.h> 8 #include <linux/hardirq.h> 9 #include <linux/module.h> 10 #include <linux/uaccess.h> 11 #include <linux/sched/debug.h> 12 #include <asm/current.h> 13 #include <asm/tlbflush.h> 14 #include <arch.h> 15 #include <as-layout.h> 16 #include <kern_util.h> 17 #include <os.h> 18 #include <skas.h> 19 #include <arch.h> 20 21 /* 22 * Note this is constrained to return 0, -EFAULT, -EACCES, -ENOMEM by 23 * segv(). 24 */ 25 int handle_page_fault(unsigned long address, unsigned long ip, 26 int is_write, int is_user, int *code_out) 27 { 28 struct mm_struct *mm = current->mm; 29 struct vm_area_struct *vma; 30 pmd_t *pmd; 31 pte_t *pte; 32 int err = -EFAULT; 33 unsigned int flags = FAULT_FLAG_DEFAULT; 34 35 *code_out = SEGV_MAPERR; 36 37 /* 38 * If the fault was with pagefaults disabled, don't take the fault, just 39 * fail. 40 */ 41 if (faulthandler_disabled()) 42 goto out_nosemaphore; 43 44 if (is_user) 45 flags |= FAULT_FLAG_USER; 46 retry: 47 mmap_read_lock(mm); 48 vma = find_vma(mm, address); 49 if (!vma) 50 goto out; 51 if (vma->vm_start <= address) 52 goto good_area; 53 if (!(vma->vm_flags & VM_GROWSDOWN)) 54 goto out; 55 if (is_user && !ARCH_IS_STACKGROW(address)) 56 goto out; 57 vma = expand_stack(mm, address); 58 if (!vma) 59 goto out_nosemaphore; 60 61 good_area: 62 *code_out = SEGV_ACCERR; 63 if (is_write) { 64 if (!(vma->vm_flags & VM_WRITE)) 65 goto out; 66 flags |= FAULT_FLAG_WRITE; 67 } else { 68 /* Don't require VM_READ|VM_EXEC for write faults! */ 69 if (!(vma->vm_flags & (VM_READ | VM_EXEC))) 70 goto out; 71 } 72 73 do { 74 vm_fault_t fault; 75 76 fault = handle_mm_fault(vma, address, flags, NULL); 77 78 if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) 79 goto out_nosemaphore; 80 81 /* The fault is fully completed (including releasing mmap lock) */ 82 if (fault & VM_FAULT_COMPLETED) 83 return 0; 84 85 if (unlikely(fault & VM_FAULT_ERROR)) { 86 if (fault & VM_FAULT_OOM) { 87 goto out_of_memory; 88 } else if (fault & VM_FAULT_SIGSEGV) { 89 goto out; 90 } else if (fault & VM_FAULT_SIGBUS) { 91 err = -EACCES; 92 goto out; 93 } 94 BUG(); 95 } 96 if (fault & VM_FAULT_RETRY) { 97 flags |= FAULT_FLAG_TRIED; 98 99 goto retry; 100 } 101 102 pmd = pmd_off(mm, address); 103 pte = pte_offset_kernel(pmd, address); 104 } while (!pte_present(*pte)); 105 err = 0; 106 /* 107 * The below warning was added in place of 108 * pte_mkyoung(); if (is_write) pte_mkdirty(); 109 * If it's triggered, we'd see normally a hang here (a clean pte is 110 * marked read-only to emulate the dirty bit). 111 * However, the generic code can mark a PTE writable but clean on a 112 * concurrent read fault, triggering this harmlessly. So comment it out. 113 */ 114 #if 0 115 WARN_ON(!pte_young(*pte) || (is_write && !pte_dirty(*pte))); 116 #endif 117 118 out: 119 mmap_read_unlock(mm); 120 out_nosemaphore: 121 return err; 122 123 out_of_memory: 124 /* 125 * We ran out of memory, call the OOM killer, and return the userspace 126 * (which will retry the fault, or kill us if we got oom-killed). 127 */ 128 mmap_read_unlock(mm); 129 if (!is_user) 130 goto out_nosemaphore; 131 pagefault_out_of_memory(); 132 return 0; 133 } 134 135 static void show_segv_info(struct uml_pt_regs *regs) 136 { 137 struct task_struct *tsk = current; 138 struct faultinfo *fi = UPT_FAULTINFO(regs); 139 140 if (!unhandled_signal(tsk, SIGSEGV)) 141 return; 142 143 if (!printk_ratelimit()) 144 return; 145 146 printk("%s%s[%d]: segfault at %lx ip %px sp %px error %x", 147 task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG, 148 tsk->comm, task_pid_nr(tsk), FAULT_ADDRESS(*fi), 149 (void *)UPT_IP(regs), (void *)UPT_SP(regs), 150 fi->error_code); 151 152 print_vma_addr(KERN_CONT " in ", UPT_IP(regs)); 153 printk(KERN_CONT "\n"); 154 } 155 156 static void bad_segv(struct faultinfo fi, unsigned long ip) 157 { 158 current->thread.arch.faultinfo = fi; 159 force_sig_fault(SIGSEGV, SEGV_ACCERR, (void __user *) FAULT_ADDRESS(fi)); 160 } 161 162 void fatal_sigsegv(void) 163 { 164 force_fatal_sig(SIGSEGV); 165 do_signal(¤t->thread.regs); 166 /* 167 * This is to tell gcc that we're not returning - do_signal 168 * can, in general, return, but in this case, it's not, since 169 * we just got a fatal SIGSEGV queued. 170 */ 171 os_dump_core(); 172 } 173 174 /** 175 * segv_handler() - the SIGSEGV handler 176 * @sig: the signal number 177 * @unused_si: the signal info struct; unused in this handler 178 * @regs: the ptrace register information 179 * @mc: the mcontext of the signal 180 * 181 * The handler first extracts the faultinfo from the UML ptrace regs struct. 182 * If the userfault did not happen in an UML userspace process, bad_segv is called. 183 * Otherwise the signal did happen in a cloned userspace process, handle it. 184 */ 185 void segv_handler(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs, 186 void *mc) 187 { 188 struct faultinfo * fi = UPT_FAULTINFO(regs); 189 190 if (UPT_IS_USER(regs) && !SEGV_IS_FIXABLE(fi)) { 191 show_segv_info(regs); 192 bad_segv(*fi, UPT_IP(regs)); 193 return; 194 } 195 segv(*fi, UPT_IP(regs), UPT_IS_USER(regs), regs, mc); 196 } 197 198 /* 199 * We give a *copy* of the faultinfo in the regs to segv. 200 * This must be done, since nesting SEGVs could overwrite 201 * the info in the regs. A pointer to the info then would 202 * give us bad data! 203 */ 204 unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, 205 struct uml_pt_regs *regs, void *mc) 206 { 207 int si_code; 208 int err; 209 int is_write = FAULT_WRITE(fi); 210 unsigned long address = FAULT_ADDRESS(fi); 211 212 if (!is_user && regs) 213 current->thread.segv_regs = container_of(regs, struct pt_regs, regs); 214 215 if (!is_user && init_mm.context.sync_tlb_range_to) { 216 /* 217 * Kernel has pending updates from set_ptes that were not 218 * flushed yet. Syncing them should fix the pagefault (if not 219 * we'll get here again and panic). 220 */ 221 err = um_tlb_sync(&init_mm); 222 if (err == -ENOMEM) 223 report_enomem(); 224 if (err) 225 panic("Failed to sync kernel TLBs: %d", err); 226 goto out; 227 } 228 else if (current->pagefault_disabled) { 229 if (!mc) { 230 show_regs(container_of(regs, struct pt_regs, regs)); 231 panic("Segfault with pagefaults disabled but no mcontext"); 232 } 233 if (!current->thread.segv_continue) { 234 show_regs(container_of(regs, struct pt_regs, regs)); 235 panic("Segfault without recovery target"); 236 } 237 mc_set_rip(mc, current->thread.segv_continue); 238 current->thread.segv_continue = NULL; 239 goto out; 240 } 241 else if (current->mm == NULL) { 242 show_regs(container_of(regs, struct pt_regs, regs)); 243 panic("Segfault with no mm"); 244 } 245 else if (!is_user && address > PAGE_SIZE && address < TASK_SIZE) { 246 show_regs(container_of(regs, struct pt_regs, regs)); 247 panic("Kernel tried to access user memory at addr 0x%lx, ip 0x%lx", 248 address, ip); 249 } 250 251 if (SEGV_IS_FIXABLE(&fi)) 252 err = handle_page_fault(address, ip, is_write, is_user, 253 &si_code); 254 else { 255 err = -EFAULT; 256 /* 257 * A thread accessed NULL, we get a fault, but CR2 is invalid. 258 * This code is used in __do_copy_from_user() of TT mode. 259 * XXX tt mode is gone, so maybe this isn't needed any more 260 */ 261 address = 0; 262 } 263 264 if (!err) 265 goto out; 266 else if (!is_user && arch_fixup(ip, regs)) 267 goto out; 268 269 if (!is_user) { 270 show_regs(container_of(regs, struct pt_regs, regs)); 271 panic("Kernel mode fault at addr 0x%lx, ip 0x%lx", 272 address, ip); 273 } 274 275 show_segv_info(regs); 276 277 if (err == -EACCES) { 278 current->thread.arch.faultinfo = fi; 279 force_sig_fault(SIGBUS, BUS_ADRERR, (void __user *)address); 280 } else { 281 BUG_ON(err != -EFAULT); 282 current->thread.arch.faultinfo = fi; 283 force_sig_fault(SIGSEGV, si_code, (void __user *) address); 284 } 285 286 out: 287 if (regs) 288 current->thread.segv_regs = NULL; 289 290 return 0; 291 } 292 293 void relay_signal(int sig, struct siginfo *si, struct uml_pt_regs *regs, 294 void *mc) 295 { 296 int code, err; 297 if (!UPT_IS_USER(regs)) { 298 if (sig == SIGBUS) 299 printk(KERN_ERR "Bus error - the host /dev/shm or /tmp " 300 "mount likely just ran out of space\n"); 301 panic("Kernel mode signal %d", sig); 302 } 303 304 arch_examine_signal(sig, regs); 305 306 /* Is the signal layout for the signal known? 307 * Signal data must be scrubbed to prevent information leaks. 308 */ 309 code = si->si_code; 310 err = si->si_errno; 311 if ((err == 0) && (siginfo_layout(sig, code) == SIL_FAULT)) { 312 struct faultinfo *fi = UPT_FAULTINFO(regs); 313 current->thread.arch.faultinfo = *fi; 314 force_sig_fault(sig, code, (void __user *)FAULT_ADDRESS(*fi)); 315 } else { 316 printk(KERN_ERR "Attempted to relay unknown signal %d (si_code = %d) with errno %d\n", 317 sig, code, err); 318 force_sig(sig); 319 } 320 } 321 322 void winch(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs, 323 void *mc) 324 { 325 do_IRQ(WINCH_IRQ, regs); 326 } 327