openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix incorrect user space access locking in mincore() 

Doug Chapman noticed that mincore() will doa "copy_to_user()" of the
result while holding the mmap semaphore for reading, which is a big
no-no.  While a recursive read-lock on a semaphore in the case of a page
fault happens to work, we don't actually allow them due to deadlock
schenarios with writers due to fairness issues.

Doug and Marcel sent in a patch to fix it, but I decided to just rewrite
the mess instead - not just fixing the locking problem, but making the
code smaller and (imho) much easier to understand.

Cc: Doug Chapman <dchapman@redhat.com>
Cc: Marcel Holtmann <holtmann@redhat.com>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Linus Torvalds 2006-12-16 09:44:32 -08:00
parent 0221872a3b
commit 2f77d10705
1 changed files with 87 additions and 105 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

192
mm/mincore.c
View File

@ -1,7 +1,7 @@
/* /*
* linux/mm/mincore.c * linux/mm/mincore.c
* *
* Copyright (C) 1994-1999 Linus Torvalds * Copyright (C) 1994-2006 Linus Torvalds
*/ */
/* /*
@ -38,46 +38,60 @@ static unsigned char mincore_page(struct vm_area_struct * vma,
return present; return present;
} }
static long mincore_vma(struct vm_area_struct * vma, /*
unsigned long start, unsigned long end, unsigned char __user * vec) * Do a chunk of "sys_mincore()". We've already checked
* all the arguments, we hold the mmap semaphore: we should
* just return the amount of info we're asked for.
*/
static long do_mincore(unsigned long addr, unsigned char *vec, unsigned long pages)
{ {
long error, i, remaining; unsigned long i, nr, pgoff;
unsigned char * tmp; struct vm_area_struct *vma = find_vma(current->mm, addr);
error = -ENOMEM; /*
if (!vma->vm_file) * find_vma() didn't find anything: the address
return error; * is above everything we have mapped.
*/
start = ((start - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; if (!vma) {
if (end > vma->vm_end) memset(vec, 0, pages);
end = vma->vm_end; return pages;
end = ((end - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
error = -EAGAIN;
tmp = (unsigned char *) __get_free_page(GFP_KERNEL);
if (!tmp)
return error;
/* (end - start) is # of pages, and also # of bytes in "vec */
remaining = (end - start),
error = 0;
for (i = 0; remaining > 0; remaining -= PAGE_SIZE, i++) {
int j = 0;
long thispiece = (remaining < PAGE_SIZE) ?
remaining : PAGE_SIZE;
while (j < thispiece)
tmp[j++] = mincore_page(vma, start++);
if (copy_to_user(vec + PAGE_SIZE * i, tmp, thispiece)) {
error = -EFAULT;
break;
}
} }
free_page((unsigned long) tmp); /*
return error; * find_vma() found something, but we might be
* below it: check for that.
*/
if (addr < vma->vm_start) {
unsigned long gap = (vma->vm_start - addr) >> PAGE_SHIFT;
if (gap > pages)
gap = pages;
memset(vec, 0, gap);
return gap;
}
/*
* Ok, got it. But check whether it's a segment we support
* mincore() on. Right now, we don't do any anonymous mappings.
*/
if (!vma->vm_file)
return -ENOMEM;
/*
* Calculate how many pages there are left in the vma, and
* what the pgoff is for our address.
*/
nr = (vma->vm_end - addr) >> PAGE_SHIFT;
if (nr > pages)
nr = pages;
pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
pgoff += vma->vm_pgoff;
/* And then we just fill the sucker in.. */
for (i = 0 ; i < nr; i++, pgoff++)
vec[i] = mincore_page(vma, pgoff);
return nr;
} }
/* /*
@ -107,82 +121,50 @@ static long mincore_vma(struct vm_area_struct * vma,
asmlinkage long sys_mincore(unsigned long start, size_t len, asmlinkage long sys_mincore(unsigned long start, size_t len,
unsigned char __user * vec) unsigned char __user * vec)
{ {
int index = 0; long retval;
unsigned long end, limit; unsigned long pages;
struct vm_area_struct * vma; unsigned char *tmp;
size_t max;
int unmapped_error = 0;
long error;
/* check the arguments */ /* Check the start address: needs to be page-aligned.. */
if (start & ~PAGE_CACHE_MASK) if (start & ~PAGE_CACHE_MASK)
goto einval; return -EINVAL;
limit = TASK_SIZE; /* ..and we need to be passed a valid user-space range */
if (start >= limit) if (!access_ok(VERIFY_READ, (void __user *) start, len))
goto enomem; return -ENOMEM;
if (!len) /* This also avoids any overflows on PAGE_CACHE_ALIGN */
return 0; pages = len >> PAGE_SHIFT;
pages += (len & ~PAGE_MASK) != 0;
max = limit - start; if (!access_ok(VERIFY_WRITE, vec, pages))
len = PAGE_CACHE_ALIGN(len); return -EFAULT;
if (len > max || !len)
goto enomem;
end = start + len; tmp = (void *) __get_free_page(GFP_USER);
if (!tmp)
return -ENOMEM;
/* check the output buffer whilst holding the lock */ retval = 0;
error = -EFAULT; while (pages) {
down_read(&current->mm->mmap_sem); /*
* Do at most PAGE_SIZE entries per iteration, due to
* the temporary buffer size.
*/
down_read(&current->mm->mmap_sem);
retval = do_mincore(start, tmp, max(pages, PAGE_SIZE));
up_read(&current->mm->mmap_sem);
if (!access_ok(VERIFY_WRITE, vec, len >> PAGE_SHIFT)) if (retval <= 0)
goto out; break;
if (copy_to_user(vec, tmp, retval)) {
/* retval = -EFAULT;
* If the interval [start,end) covers some unmapped address break;
* ranges, just ignore them, but return -ENOMEM at the end.
*/
error = 0;
vma = find_vma(current->mm, start);
while (vma) {
/* Here start < vma->vm_end. */
if (start < vma->vm_start) {
unmapped_error = -ENOMEM;
start = vma->vm_start;
} }
pages -= retval;
/* Here vma->vm_start <= start < vma->vm_end. */ vec += retval;
if (end <= vma->vm_end) { start += retval << PAGE_SHIFT;
if (start < end) { retval = 0;
error = mincore_vma(vma, start, end,
&vec[index]);
if (error)
goto out;
}
error = unmapped_error;
goto out;
}
/* Here vma->vm_start <= start < vma->vm_end < end. */
error = mincore_vma(vma, start, vma->vm_end, &vec[index]);
if (error)
goto out;
index += (vma->vm_end - start) >> PAGE_CACHE_SHIFT;
start = vma->vm_end;
vma = vma->vm_next;
} }
free_page((unsigned long) tmp);
/* we found a hole in the area queried if we arrive here */ return retval;
error = -ENOMEM;
out:
up_read(&current->mm->mmap_sem);
return error;
einval:
return -EINVAL;
enomem:
return -ENOMEM;
} }