1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/kernel.h> 3 #include <linux/init.h> 4 #include <linux/errno.h> 5 #include <linux/mm.h> 6 #include <linux/mman.h> 7 #include <linux/slab.h> 8 #include <linux/vmalloc.h> 9 #include <linux/io_uring.h> 10 #include <linux/io_uring_types.h> 11 #include <asm/shmparam.h> 12 13 #include "memmap.h" 14 #include "kbuf.h" 15 #include "rsrc.h" 16 17 static void *io_mem_alloc_compound(struct page **pages, int nr_pages, 18 size_t size, gfp_t gfp) 19 { 20 struct page *page; 21 int i, order; 22 23 order = get_order(size); 24 if (order > MAX_PAGE_ORDER) 25 return ERR_PTR(-ENOMEM); 26 else if (order) 27 gfp |= __GFP_COMP; 28 29 page = alloc_pages(gfp, order); 30 if (!page) 31 return ERR_PTR(-ENOMEM); 32 33 for (i = 0; i < nr_pages; i++) 34 pages[i] = page + i; 35 36 return page_address(page); 37 } 38 39 static void *io_mem_alloc_single(struct page **pages, int nr_pages, size_t size, 40 gfp_t gfp) 41 { 42 void *ret; 43 int i; 44 45 for (i = 0; i < nr_pages; i++) { 46 pages[i] = alloc_page(gfp); 47 if (!pages[i]) 48 goto err; 49 } 50 51 ret = vmap(pages, nr_pages, VM_MAP, PAGE_KERNEL); 52 if (ret) 53 return ret; 54 err: 55 while (i--) 56 put_page(pages[i]); 57 return ERR_PTR(-ENOMEM); 58 } 59 60 void *io_pages_map(struct page ***out_pages, unsigned short *npages, 61 size_t size) 62 { 63 gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN; 64 struct page **pages; 65 int nr_pages; 66 void *ret; 67 68 nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; 69 pages = kvmalloc_array(nr_pages, sizeof(struct page *), gfp); 70 if (!pages) 71 return ERR_PTR(-ENOMEM); 72 73 ret = io_mem_alloc_compound(pages, nr_pages, size, gfp); 74 if (!IS_ERR(ret)) 75 goto done; 76 77 ret = io_mem_alloc_single(pages, nr_pages, size, gfp); 78 if (!IS_ERR(ret)) { 79 done: 80 *out_pages = pages; 81 *npages = nr_pages; 82 return ret; 83 } 84 85 kvfree(pages); 86 *out_pages = NULL; 87 *npages = 0; 88 return ret; 89 } 90 91 void io_pages_unmap(void *ptr, struct page ***pages, unsigned short *npages, 92 bool put_pages) 93 { 94 bool do_vunmap = false; 95 96 if (!ptr) 97 return; 98 99 if (put_pages && *npages) { 100 struct page **to_free = *pages; 101 int i; 102 103 /* 104 * Only did vmap for the non-compound multiple page case. 105 * For the compound page, we just need to put the head. 106 */ 107 if (PageCompound(to_free[0])) 108 *npages = 1; 109 else if (*npages > 1) 110 do_vunmap = true; 111 for (i = 0; i < *npages; i++) 112 put_page(to_free[i]); 113 } 114 if (do_vunmap) 115 vunmap(ptr); 116 kvfree(*pages); 117 *pages = NULL; 118 *npages = 0; 119 } 120 121 void io_pages_free(struct page ***pages, int npages) 122 { 123 struct page **page_array = *pages; 124 125 if (!page_array) 126 return; 127 128 unpin_user_pages(page_array, npages); 129 kvfree(page_array); 130 *pages = NULL; 131 } 132 133 struct page **io_pin_pages(unsigned long uaddr, unsigned long len, int *npages) 134 { 135 unsigned long start, end, nr_pages; 136 struct page **pages; 137 int ret; 138 139 end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT; 140 start = uaddr >> PAGE_SHIFT; 141 nr_pages = end - start; 142 if (WARN_ON_ONCE(!nr_pages)) 143 return ERR_PTR(-EINVAL); 144 if (WARN_ON_ONCE(nr_pages > INT_MAX)) 145 return ERR_PTR(-EOVERFLOW); 146 147 pages = kvmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL); 148 if (!pages) 149 return ERR_PTR(-ENOMEM); 150 151 ret = pin_user_pages_fast(uaddr, nr_pages, FOLL_WRITE | FOLL_LONGTERM, 152 pages); 153 /* success, mapped all pages */ 154 if (ret == nr_pages) { 155 *npages = nr_pages; 156 return pages; 157 } 158 159 /* partial map, or didn't map anything */ 160 if (ret >= 0) { 161 /* if we did partial map, release any pages we did get */ 162 if (ret) 163 unpin_user_pages(pages, ret); 164 ret = -EFAULT; 165 } 166 kvfree(pages); 167 return ERR_PTR(ret); 168 } 169 170 void *__io_uaddr_map(struct page ***pages, unsigned short *npages, 171 unsigned long uaddr, size_t size) 172 { 173 struct page **page_array; 174 unsigned int nr_pages; 175 void *page_addr; 176 177 *npages = 0; 178 179 if (uaddr & (PAGE_SIZE - 1) || !size) 180 return ERR_PTR(-EINVAL); 181 182 nr_pages = 0; 183 page_array = io_pin_pages(uaddr, size, &nr_pages); 184 if (IS_ERR(page_array)) 185 return page_array; 186 187 page_addr = vmap(page_array, nr_pages, VM_MAP, PAGE_KERNEL); 188 if (page_addr) { 189 *pages = page_array; 190 *npages = nr_pages; 191 return page_addr; 192 } 193 194 io_pages_free(&page_array, nr_pages); 195 return ERR_PTR(-ENOMEM); 196 } 197 198 void io_free_region(struct io_ring_ctx *ctx, struct io_mapped_region *mr) 199 { 200 if (mr->pages) { 201 unpin_user_pages(mr->pages, mr->nr_pages); 202 kvfree(mr->pages); 203 } 204 if (mr->vmap_ptr) 205 vunmap(mr->vmap_ptr); 206 if (mr->nr_pages && ctx->user) 207 __io_unaccount_mem(ctx->user, mr->nr_pages); 208 209 memset(mr, 0, sizeof(*mr)); 210 } 211 212 int io_create_region(struct io_ring_ctx *ctx, struct io_mapped_region *mr, 213 struct io_uring_region_desc *reg) 214 { 215 int pages_accounted = 0; 216 struct page **pages; 217 int nr_pages, ret; 218 void *vptr; 219 u64 end; 220 221 if (WARN_ON_ONCE(mr->pages || mr->vmap_ptr || mr->nr_pages)) 222 return -EFAULT; 223 if (memchr_inv(®->__resv, 0, sizeof(reg->__resv))) 224 return -EINVAL; 225 if (reg->flags != IORING_MEM_REGION_TYPE_USER) 226 return -EINVAL; 227 if (!reg->user_addr) 228 return -EFAULT; 229 if (!reg->size || reg->mmap_offset || reg->id) 230 return -EINVAL; 231 if ((reg->size >> PAGE_SHIFT) > INT_MAX) 232 return E2BIG; 233 if ((reg->user_addr | reg->size) & ~PAGE_MASK) 234 return -EINVAL; 235 if (check_add_overflow(reg->user_addr, reg->size, &end)) 236 return -EOVERFLOW; 237 238 pages = io_pin_pages(reg->user_addr, reg->size, &nr_pages); 239 if (IS_ERR(pages)) 240 return PTR_ERR(pages); 241 242 if (ctx->user) { 243 ret = __io_account_mem(ctx->user, nr_pages); 244 if (ret) 245 goto out_free; 246 pages_accounted = nr_pages; 247 } 248 249 vptr = vmap(pages, nr_pages, VM_MAP, PAGE_KERNEL); 250 if (!vptr) 251 goto out_free; 252 253 mr->pages = pages; 254 mr->vmap_ptr = vptr; 255 mr->nr_pages = nr_pages; 256 return 0; 257 out_free: 258 if (pages_accounted) 259 __io_unaccount_mem(ctx->user, pages_accounted); 260 io_pages_free(&pages, nr_pages); 261 return ret; 262 } 263 264 static void *io_uring_validate_mmap_request(struct file *file, loff_t pgoff, 265 size_t sz) 266 { 267 struct io_ring_ctx *ctx = file->private_data; 268 loff_t offset = pgoff << PAGE_SHIFT; 269 270 switch ((pgoff << PAGE_SHIFT) & IORING_OFF_MMAP_MASK) { 271 case IORING_OFF_SQ_RING: 272 case IORING_OFF_CQ_RING: 273 /* Don't allow mmap if the ring was setup without it */ 274 if (ctx->flags & IORING_SETUP_NO_MMAP) 275 return ERR_PTR(-EINVAL); 276 if (!ctx->rings) 277 return ERR_PTR(-EFAULT); 278 return ctx->rings; 279 case IORING_OFF_SQES: 280 /* Don't allow mmap if the ring was setup without it */ 281 if (ctx->flags & IORING_SETUP_NO_MMAP) 282 return ERR_PTR(-EINVAL); 283 if (!ctx->sq_sqes) 284 return ERR_PTR(-EFAULT); 285 return ctx->sq_sqes; 286 case IORING_OFF_PBUF_RING: { 287 struct io_buffer_list *bl; 288 unsigned int bgid; 289 void *ptr; 290 291 bgid = (offset & ~IORING_OFF_MMAP_MASK) >> IORING_OFF_PBUF_SHIFT; 292 bl = io_pbuf_get_bl(ctx, bgid); 293 if (IS_ERR(bl)) 294 return bl; 295 ptr = bl->buf_ring; 296 io_put_bl(ctx, bl); 297 return ptr; 298 } 299 } 300 301 return ERR_PTR(-EINVAL); 302 } 303 304 int io_uring_mmap_pages(struct io_ring_ctx *ctx, struct vm_area_struct *vma, 305 struct page **pages, int npages) 306 { 307 unsigned long nr_pages = npages; 308 309 vm_flags_set(vma, VM_DONTEXPAND); 310 return vm_insert_pages(vma, vma->vm_start, pages, &nr_pages); 311 } 312 313 #ifdef CONFIG_MMU 314 315 __cold int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 316 { 317 struct io_ring_ctx *ctx = file->private_data; 318 size_t sz = vma->vm_end - vma->vm_start; 319 long offset = vma->vm_pgoff << PAGE_SHIFT; 320 unsigned int npages; 321 void *ptr; 322 323 guard(mutex)(&ctx->resize_lock); 324 325 ptr = io_uring_validate_mmap_request(file, vma->vm_pgoff, sz); 326 if (IS_ERR(ptr)) 327 return PTR_ERR(ptr); 328 329 switch (offset & IORING_OFF_MMAP_MASK) { 330 case IORING_OFF_SQ_RING: 331 case IORING_OFF_CQ_RING: 332 npages = min(ctx->n_ring_pages, (sz + PAGE_SIZE - 1) >> PAGE_SHIFT); 333 return io_uring_mmap_pages(ctx, vma, ctx->ring_pages, npages); 334 case IORING_OFF_SQES: 335 return io_uring_mmap_pages(ctx, vma, ctx->sqe_pages, 336 ctx->n_sqe_pages); 337 case IORING_OFF_PBUF_RING: 338 return io_pbuf_mmap(file, vma); 339 } 340 341 return -EINVAL; 342 } 343 344 unsigned long io_uring_get_unmapped_area(struct file *filp, unsigned long addr, 345 unsigned long len, unsigned long pgoff, 346 unsigned long flags) 347 { 348 struct io_ring_ctx *ctx = filp->private_data; 349 void *ptr; 350 351 /* 352 * Do not allow to map to user-provided address to avoid breaking the 353 * aliasing rules. Userspace is not able to guess the offset address of 354 * kernel kmalloc()ed memory area. 355 */ 356 if (addr) 357 return -EINVAL; 358 359 guard(mutex)(&ctx->resize_lock); 360 361 ptr = io_uring_validate_mmap_request(filp, pgoff, len); 362 if (IS_ERR(ptr)) 363 return -ENOMEM; 364 365 /* 366 * Some architectures have strong cache aliasing requirements. 367 * For such architectures we need a coherent mapping which aliases 368 * kernel memory *and* userspace memory. To achieve that: 369 * - use a NULL file pointer to reference physical memory, and 370 * - use the kernel virtual address of the shared io_uring context 371 * (instead of the userspace-provided address, which has to be 0UL 372 * anyway). 373 * - use the same pgoff which the get_unmapped_area() uses to 374 * calculate the page colouring. 375 * For architectures without such aliasing requirements, the 376 * architecture will return any suitable mapping because addr is 0. 377 */ 378 filp = NULL; 379 flags |= MAP_SHARED; 380 pgoff = 0; /* has been translated to ptr above */ 381 #ifdef SHM_COLOUR 382 addr = (uintptr_t) ptr; 383 pgoff = addr >> PAGE_SHIFT; 384 #else 385 addr = 0UL; 386 #endif 387 return mm_get_unmapped_area(current->mm, filp, addr, len, pgoff, flags); 388 } 389 390 #else /* !CONFIG_MMU */ 391 392 int io_uring_mmap(struct file *file, struct vm_area_struct *vma) 393 { 394 return is_nommu_shared_mapping(vma->vm_flags) ? 0 : -EINVAL; 395 } 396 397 unsigned int io_uring_nommu_mmap_capabilities(struct file *file) 398 { 399 return NOMMU_MAP_DIRECT | NOMMU_MAP_READ | NOMMU_MAP_WRITE; 400 } 401 402 unsigned long io_uring_get_unmapped_area(struct file *file, unsigned long addr, 403 unsigned long len, unsigned long pgoff, 404 unsigned long flags) 405 { 406 struct io_ring_ctx *ctx = file->private_data; 407 void *ptr; 408 409 guard(mutex)(&ctx->resize_lock); 410 411 ptr = io_uring_validate_mmap_request(file, pgoff, len); 412 if (IS_ERR(ptr)) 413 return PTR_ERR(ptr); 414 415 return (unsigned long) ptr; 416 } 417 418 #endif /* !CONFIG_MMU */ 419