1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/kernel.h> 3 #include <linux/init.h> 4 #include <linux/errno.h> 5 #include <linux/mm.h> 6 #include <linux/mman.h> 7 #include <linux/slab.h> 8 #include <linux/vmalloc.h> 9 #include <linux/io_uring.h> 10 #include <linux/io_uring_types.h> 11 #include <asm/shmparam.h> 12 13 #include "memmap.h" 14 #include "kbuf.h" 15 #include "rsrc.h" 16 17 static void *io_mem_alloc_compound(struct page **pages, int nr_pages, 18 size_t size, gfp_t gfp) 19 { 20 struct page *page; 21 int i, order; 22 23 order = get_order(size); 24 if (order > MAX_PAGE_ORDER) 25 return ERR_PTR(-ENOMEM); 26 else if (order) 27 gfp |= __GFP_COMP; 28 29 page = alloc_pages(gfp, order); 30 if (!page) 31 return ERR_PTR(-ENOMEM); 32 33 for (i = 0; i < nr_pages; i++) 34 pages[i] = page + i; 35 36 return page_address(page); 37 } 38 39 static void *io_mem_alloc_single(struct page **pages, int nr_pages, size_t size, 40 gfp_t gfp) 41 { 42 void *ret; 43 int i; 44 45 for (i = 0; i < nr_pages; i++) { 46 pages[i] = alloc_page(gfp); 47 if (!pages[i]) 48 goto err; 49 } 50 51 ret = vmap(pages, nr_pages, VM_MAP, PAGE_KERNEL); 52 if (ret) 53 return ret; 54 err: 55 while (i--) 56 put_page(pages[i]); 57 return ERR_PTR(-ENOMEM); 58 } 59 60 void *io_pages_map(struct page ***out_pages, unsigned short *npages, 61 size_t size) 62 { 63 gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN; 64 struct page **pages; 65 int nr_pages; 66 void *ret; 67 68 nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; 69 pages = kvmalloc_array(nr_pages, sizeof(struct page *), gfp); 70 if (!pages) 71 return ERR_PTR(-ENOMEM); 72 73 ret = io_mem_alloc_compound(pages, nr_pages, size, gfp); 74 if (!IS_ERR(ret)) 75 goto done; 76 if (nr_pages == 1) 77 goto fail; 78 79 ret = io_mem_alloc_single(pages, nr_pages, size, gfp); 80 if (!IS_ERR(ret)) { 81 done: 82 *out_pages = pages; 83 *npages = nr_pages; 84 return ret; 85 } 86 fail: 87 kvfree(pages); 88 *out_pages = NULL; 89 *npages = 0; 90 return ret; 91 } 92 93 void io_pages_unmap(void *ptr, struct page ***pages, unsigned short *npages, 94 bool put_pages) 95 { 96 bool do_vunmap = false; 97 98 if (!ptr) 99 return; 100 101 if (put_pages && *npages) { 102 struct page **to_free = *pages; 103 int i; 104 105 /* 106 * Only did vmap for the non-compound multiple page case. 107 * For the compound page, we just need to put the head. 108 */ 109 if (PageCompound(to_free[0])) 110 *npages = 1; 111 else if (*npages > 1) 112 do_vunmap = true; 113 for (i = 0; i < *npages; i++) 114 put_page(to_free[i]); 115 } 116 if (do_vunmap) 117 vunmap(ptr); 118 kvfree(*pages); 119 *pages = NULL; 120 *npages = 0; 121 } 122 123 void io_pages_free(struct page ***pages, int npages) 124 { 125 struct page **page_array = *pages; 126 127 if (!page_array) 128 return; 129 130 unpin_user_pages(page_array, npages); 131 kvfree(page_array); 132 *pages = NULL; 133 } 134 135 struct page **io_pin_pages(unsigned long uaddr, unsigned long len, int *npages) 136 { 137 unsigned long start, end, nr_pages; 138 struct page **pages; 139 int ret; 140 141 if (check_add_overflow(uaddr, len, &end)) 142 return ERR_PTR(-EOVERFLOW); 143 if (check_add_overflow(end, PAGE_SIZE - 1, &end)) 144 return ERR_PTR(-EOVERFLOW); 145 146 end = end >> PAGE_SHIFT; 147 start = uaddr >> PAGE_SHIFT; 148 nr_pages = end - start; 149 if (WARN_ON_ONCE(!nr_pages)) 150 return ERR_PTR(-EINVAL); 151 if (WARN_ON_ONCE(nr_pages > INT_MAX)) 152 return ERR_PTR(-EOVERFLOW); 153 154 pages = kvmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL); 155 if (!pages) 156 return ERR_PTR(-ENOMEM); 157 158 ret = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM, 159 pages); 160 /* success, mapped all pages */ 161 if (ret == nr_pages) { 162 *npages = nr_pages; 163 return pages; 164 } 165 166 /* partial map, or didn't map anything */ 167 if (ret >= 0) { 168 /* if we did partial map, release any pages we did get */ 169 if (ret) 170 unpin_user_pages(pages, ret); 171 ret = -EFAULT; 172 } 173 kvfree(pages); 174 return ERR_PTR(ret); 175 } 176 177 void *__io_uaddr_map(struct page ***pages, unsigned short *npages, 178 unsigned long uaddr, size_t size) 179 { 180 struct page **page_array; 181 unsigned int nr_pages; 182 void *page_addr; 183 184 *npages = 0; 185 186 if (uaddr & (PAGE_SIZE - 1) || !size) 187 return ERR_PTR(-EINVAL); 188 189 nr_pages = 0; 190 page_array = io_pin_pages(uaddr, size, &nr_pages); 191 if (IS_ERR(page_array)) 192 return page_array; 193 194 page_addr = vmap(page_array, nr_pages, VM_MAP, PAGE_KERNEL); 195 if (page_addr) { 196 *pages = page_array; 197 *npages = nr_pages; 198 return page_addr; 199 } 200 201 io_pages_free(&page_array, nr_pages); 202 return ERR_PTR(-ENOMEM); 203 } 204 205 void io_free_region(struct io_ring_ctx *ctx, struct io_mapped_region *mr) 206 { 207 if (mr->pages) { 208 unpin_user_pages(mr->pages, mr->nr_pages); 209 kvfree(mr->pages); 210 } 211 if (mr->vmap_ptr) 212 vunmap(mr->vmap_ptr); 213 if (mr->nr_pages && ctx->user) 214 __io_unaccount_mem(ctx->user, mr->nr_pages); 215 216 memset(mr, 0, sizeof(*mr)); 217 } 218 219 int io_create_region(struct io_ring_ctx *ctx, struct io_mapped_region *mr, 220 struct io_uring_region_desc *reg) 221 { 222 int pages_accounted = 0; 223 struct page **pages; 224 int nr_pages, ret; 225 void *vptr; 226 u64 end; 227 228 if (WARN_ON_ONCE(mr->pages || mr->vmap_ptr || mr->nr_pages)) 229 return -EFAULT; 230 if (memchr_inv(®->__resv, 0, sizeof(reg->__resv))) 231 return -EINVAL; 232 if (reg->flags != IORING_MEM_REGION_TYPE_USER) 233 return -EINVAL; 234 if (!reg->user_addr) 235 return -EFAULT; 236 if (!reg->size || reg->mmap_offset || reg->id) 237 return -EINVAL; 238 if ((reg->size >> PAGE_SHIFT) > INT_MAX) 239 return -E2BIG; 240 if ((reg->user_addr | reg->size) & ~PAGE_MASK) 241 return -EINVAL; 242 if (check_add_overflow(reg->user_addr, reg->size, &end)) 243 return -EOVERFLOW; 244 245 pages = io_pin_pages(reg->user_addr, reg->size, &nr_pages); 246 if (IS_ERR(pages)) 247 return PTR_ERR(pages); 248 249 if (ctx->user) { 250 ret = __io_account_mem(ctx->user, nr_pages); 251 if (ret) 252 goto out_free; 253 pages_accounted = nr_pages; 254 } 255 256 vptr = vmap(pages, nr_pages, VM_MAP, PAGE_KERNEL); 257 if (!vptr) { 258 ret = -ENOMEM; 259 goto out_free; 260 } 261 262 mr->pages = pages; 263 mr->vmap_ptr = vptr; 264 mr->nr_pages = nr_pages; 265 return 0; 266 out_free: 267 if (pages_accounted) 268 __io_unaccount_mem(ctx->user, pages_accounted); 269 io_pages_free(&pages, nr_pages); 270 return ret; 271 } 272 273 static void *io_uring_validate_mmap_request(struct file *file, loff_t pgoff, 274 size_t sz) 275 { 276 struct io_ring_ctx *ctx = file->private_data; 277 loff_t offset = pgoff << PAGE_SHIFT; 278 279 switch ((pgoff << PAGE_SHIFT) & IORING_OFF_MMAP_MASK) { 280 case IORING_OFF_SQ_RING: 281 case IORING_OFF_CQ_RING: 282 /* Don't allow mmap if the ring was setup without it */ 283 if (ctx->flags & IORING_SETUP_NO_MMAP) 284 return ERR_PTR(-EINVAL); 285 if (!ctx->rings) 286 return ERR_PTR(-EFAULT); 287 return ctx->rings; 288 case IORING_OFF_SQES: 289 /* Don't allow mmap if the ring was setup without it */ 290 if (ctx->flags & IORING_SETUP_NO_MMAP) 291 return ERR_PTR(-EINVAL); 292 if (!ctx->sq_sqes) 293 return ERR_PTR(-EFAULT); 294 return ctx->sq_sqes; 295 case IORING_OFF_PBUF_RING: { 296 struct io_buffer_list *bl; 297 unsigned int bgid; 298 void *ptr; 299 300 bgid = (offset & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_PBUF_SHIFT; 301 bl = io_pbuf_get_bl(ctx, bgid); 302 if (IS_ERR(bl)) 303 return bl; 304 ptr = bl->buf_ring; 305 io_put_bl(ctx, bl); 306 return ptr; 307 } 308 } 309 310 return ERR_PTR(-EINVAL); 311 } 312 313 int io_uring_mmap_pages(struct io_ring_ctx *ctx, struct vm_area_struct *vma, 314 struct page **pages, int npages) 315 { 316 unsigned long nr_pages = npages; 317 318 vm_flags_set(vma, VM_DONTEXPAND); 319 return vm_insert_pages(vma, vma->vm_start, pages, &nr_pages); 320 } 321 322 #ifdef CONFIG_MMU 323 324 __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 325 { 326 struct io_ring_ctx *ctx = file->private_data; 327 size_t sz = vma->vm_end - vma->vm_start; 328 long offset = vma->vm_pgoff << PAGE_SHIFT; 329 unsigned int npages; 330 void *ptr; 331 332 guard(mutex)(&ctx->resize_lock); 333 334 ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff, sz); 335 if (IS_ERR(ptr)) 336 return PTR_ERR(ptr); 337 338 switch (offset & IORING_OFF_MMAP_MASK) { 339 case IORING_OFF_SQ_RING: 340 case IORING_OFF_CQ_RING: 341 npages = min(ctx->n_ring_pages, (sz + PAGE_SIZE - 1) >> PAGE_SHIFT); 342 return io_uring_mmap_pages(ctx, vma, ctx->ring_pages, npages); 343 case IORING_OFF_SQES: 344 return io_uring_mmap_pages(ctx, vma, ctx->sqe_pages, 345 ctx->n_sqe_pages); 346 case IORING_OFF_PBUF_RING: 347 return io_pbuf_mmap(file, vma); 348 } 349 350 return -EINVAL; 351 } 352 353 unsigned long io_uring_get_unmapped_area(struct file *filp, unsigned long addr, 354 unsigned long len, unsigned long pgoff, 355 unsigned long flags) 356 { 357 struct io_ring_ctx *ctx = filp->private_data; 358 void *ptr; 359 360 /* 361 * Do not allow to map to user-provided address to avoid breaking the 362 * aliasing rules. Userspace is not able to guess the offset address of 363 * kernel kmalloc()ed memory area. 364 */ 365 if (addr) 366 return -EINVAL; 367 368 guard(mutex)(&ctx->resize_lock); 369 370 ptr = io_uring_validate_mmap_request(filp, pgoff, len); 371 if (IS_ERR(ptr)) 372 return -ENOMEM; 373 374 /* 375 * Some architectures have strong cache aliasing requirements. 376 * For such architectures we need a coherent mapping which aliases 377 * kernel memory *and* userspace memory. To achieve that: 378 * - use a NULL file pointer to reference physical memory, and 379 * - use the kernel virtual address of the shared io_uring context 380 * (instead of the userspace-provided address, which has to be 0UL 381 * anyway). 382 * - use the same pgoff which the get_unmapped_area() uses to 383 * calculate the page colouring. 384 * For architectures without such aliasing requirements, the 385 * architecture will return any suitable mapping because addr is 0. 386 */ 387 filp = NULL; 388 flags |= MAP_SHARED; 389 pgoff = 0; /* has been translated to ptr above */ 390 #ifdef SHM_COLOUR 391 addr = (uintptr_t) ptr; 392 pgoff = addr >> PAGE_SHIFT; 393 #else 394 addr = 0UL; 395 #endif 396 return mm_get_unmapped_area(current->mm, filp, addr, len, pgoff, flags); 397 } 398 399 #else /* !CONFIG_MMU */ 400 401 int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 402 { 403 return is_nommu_shared_mapping(vma->vm_flags) ? 0 : -EINVAL; 404 } 405 406 unsigned int io_uring_nommu_mmap_capabilities(struct file *file) 407 { 408 return NOMMU_MAP_DIRECT | NOMMU_MAP_READ | NOMMU_MAP_WRITE; 409 } 410 411 unsigned long io_uring_get_unmapped_area(struct file *file, unsigned long addr, 412 unsigned long len, unsigned long pgoff, 413 unsigned long flags) 414 { 415 struct io_ring_ctx *ctx = file->private_data; 416 void *ptr; 417 418 guard(mutex)(&ctx->resize_lock); 419 420 ptr = io_uring_validate_mmap_request(file, pgoff, len); 421 if (IS_ERR(ptr)) 422 return PTR_ERR(ptr); 423 424 return (unsigned long) ptr; 425 } 426 427 #endif /* !CONFIG_MMU */ 428