mm/maccess.c

   1 /*
   2  * Access kernel memory without faulting.
   3  */
   4 #include <linux/export.h>
   5 #include <linux/mm.h>
   6 #include <linux/uaccess.h>
   7
   8 /**
   9  * probe_kernel_read(): safely attempt to read from a location
  10  * @dst: pointer to the buffer that shall take the data
  11  * @src: address to read from
  12  * @size: size of the data chunk
  13  *
  14  * Safely read from address @src to the buffer at @dst.  If a kernel fault
  15  * happens, handle that and return -EFAULT.
  16  *
  17  * We ensure that the copy_from_user is executed in atomic context so that
  18  * do_page_fault() doesn't attempt to take mmap_sem.  This makes
  19  * probe_kernel_read() suitable for use within regions where the caller
  20  * already holds mmap_sem, or other locks which nest inside mmap_sem.
  21  */
  22
  23 long __weak probe_kernel_read(void *dst, const void *src, size_t size)
  24     __attribute__((alias("__probe_kernel_read")));
  25
  26 long __probe_kernel_read(void *dst, const void *src, size_t size)
  27 {
  28         long ret;
  29         mm_segment_t old_fs = get_fs();
  30
  31         set_fs(KERNEL_DS);
  32         pagefault_disable();
  33         current->kernel_uaccess_faults_ok++;
  34         ret = __copy_from_user_inatomic(dst,
  35                         (__force const void __user *)src, size);
  36         current->kernel_uaccess_faults_ok--;
  37         pagefault_enable();
  38         set_fs(old_fs);
  39
  40         return ret ? -EFAULT : 0;
  41 }
  42 EXPORT_SYMBOL_GPL(probe_kernel_read);
  43
  44 /**
  45  * probe_kernel_write(): safely attempt to write to a location
  46  * @dst: address to write to
  47  * @src: pointer to the data that shall be written
  48  * @size: size of the data chunk
  49  *
  50  * Safely write to address @dst from the buffer at @src.  If a kernel fault
  51  * happens, handle that and return -EFAULT.
  52  */
  53 long __weak probe_kernel_write(void *dst, const void *src, size_t size)
  54     __attribute__((alias("__probe_kernel_write")));
  55
  56 long __probe_kernel_write(void *dst, const void *src, size_t size)
  57 {
  58         long ret;
  59         mm_segment_t old_fs = get_fs();
  60
  61         set_fs(KERNEL_DS);
  62         pagefault_disable();
  63         current->kernel_uaccess_faults_ok++;
  64         ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
  65         current->kernel_uaccess_faults_ok--;
  66         pagefault_enable();
  67         set_fs(old_fs);
  68
  69         return ret ? -EFAULT : 0;
  70 }
  71 EXPORT_SYMBOL_GPL(probe_kernel_write);
  72
  73 /**
  74  * strncpy_from_unsafe: - Copy a NUL terminated string from unsafe address.
  75  * @dst:   Destination address, in kernel space.  This buffer must be at
  76  *         least @count bytes long.
  77  * @unsafe_addr: Unsafe address.
  78  * @count: Maximum number of bytes to copy, including the trailing NUL.
  79  *
  80  * Copies a NUL-terminated string from unsafe address to kernel buffer.
  81  *
  82  * On success, returns the length of the string INCLUDING the trailing NUL.
  83  *
  84  * If access fails, returns -EFAULT (some data may have been copied
  85  * and the trailing NUL added).
  86  *
  87  * If @count is smaller than the length of the string, copies @count-1 bytes,
  88  * sets the last byte of @dst buffer to NUL and returns @count.
  89  */
  90 long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count)
  91 {
  92         mm_segment_t old_fs = get_fs();
  93         const void *src = unsafe_addr;
  94         long ret;
  95
  96         if (unlikely(count <= 0))
  97                 return 0;
  98
  99         set_fs(KERNEL_DS);
 100         pagefault_disable();
 101         current->kernel_uaccess_faults_ok++;
 102
 103         do {
 104                 ret = __get_user(*dst++, (const char __user __force *)src++);
 105         } while (dst[-1] && ret == 0 && src - unsafe_addr < count);
 106
 107         current->kernel_uaccess_faults_ok--;
 108         dst[-1] = '\0';
 109         pagefault_enable();
 110         set_fs(old_fs);
 111
 112         return ret ? -EFAULT : src - unsafe_addr;
 113 }