1#include <linux/mm.h>
2#include <linux/slab.h>
3#include <linux/string.h>
4#include <linux/compiler.h>
5#include <linux/export.h>
6#include <linux/err.h>
7#include <linux/sched.h>
8#include <linux/sched/mm.h>
9#include <linux/sched/task_stack.h>
10#include <linux/security.h>
11#include <linux/swap.h>
12#include <linux/swapops.h>
13#include <linux/mman.h>
14#include <linux/hugetlb.h>
15#include <linux/vmalloc.h>
16#include <linux/userfaultfd_k.h>
17
18#include <asm/sections.h>
19#include <linux/uaccess.h>
20
21#include "internal.h"
22
23static inline int is_kernel_rodata(unsigned long addr)
24{
25 return addr >= (unsigned long)__start_rodata &&
26 addr < (unsigned long)__end_rodata;
27}
28
29
30
31
32
33
34
35void kfree_const(const void *x)
36{
37 if (!is_kernel_rodata((unsigned long)x))
38 kfree(x);
39}
40EXPORT_SYMBOL(kfree_const);
41
42
43
44
45
46
47char *kstrdup(const char *s, gfp_t gfp)
48{
49 size_t len;
50 char *buf;
51
52 if (!s)
53 return NULL;
54
55 len = strlen(s) + 1;
56 buf = kmalloc_track_caller(len, gfp);
57 if (buf)
58 memcpy(buf, s, len);
59 return buf;
60}
61EXPORT_SYMBOL(kstrdup);
62
63
64
65
66
67
68
69
70
71
72const char *kstrdup_const(const char *s, gfp_t gfp)
73{
74 if (is_kernel_rodata((unsigned long)s))
75 return s;
76
77 return kstrdup(s, gfp);
78}
79EXPORT_SYMBOL(kstrdup_const);
80
81
82
83
84
85
86
87
88
89char *kstrndup(const char *s, size_t max, gfp_t gfp)
90{
91 size_t len;
92 char *buf;
93
94 if (!s)
95 return NULL;
96
97 len = strnlen(s, max);
98 buf = kmalloc_track_caller(len+1, gfp);
99 if (buf) {
100 memcpy(buf, s, len);
101 buf[len] = '\0';
102 }
103 return buf;
104}
105EXPORT_SYMBOL(kstrndup);
106
107
108
109
110
111
112
113
114void *kmemdup(const void *src, size_t len, gfp_t gfp)
115{
116 void *p;
117
118 p = kmalloc_track_caller(len, gfp);
119 if (p)
120 memcpy(p, src, len);
121 return p;
122}
123EXPORT_SYMBOL(kmemdup);
124
125
126
127
128
129
130
131char *kmemdup_nul(const char *s, size_t len, gfp_t gfp)
132{
133 char *buf;
134
135 if (!s)
136 return NULL;
137
138 buf = kmalloc_track_caller(len + 1, gfp);
139 if (buf) {
140 memcpy(buf, s, len);
141 buf[len] = '\0';
142 }
143 return buf;
144}
145EXPORT_SYMBOL(kmemdup_nul);
146
147
148
149
150
151
152
153
154
155void *memdup_user(const void __user *src, size_t len)
156{
157 void *p;
158
159
160
161
162
163
164 p = kmalloc_track_caller(len, GFP_KERNEL);
165 if (!p)
166 return ERR_PTR(-ENOMEM);
167
168 if (copy_from_user(p, src, len)) {
169 kfree(p);
170 return ERR_PTR(-EFAULT);
171 }
172
173 return p;
174}
175EXPORT_SYMBOL(memdup_user);
176
177
178
179
180
181
182char *strndup_user(const char __user *s, long n)
183{
184 char *p;
185 long length;
186
187 length = strnlen_user(s, n);
188
189 if (!length)
190 return ERR_PTR(-EFAULT);
191
192 if (length > n)
193 return ERR_PTR(-EINVAL);
194
195 p = memdup_user(s, length);
196
197 if (IS_ERR(p))
198 return p;
199
200 p[length - 1] = '\0';
201
202 return p;
203}
204EXPORT_SYMBOL(strndup_user);
205
206
207
208
209
210
211
212
213
214void *memdup_user_nul(const void __user *src, size_t len)
215{
216 char *p;
217
218
219
220
221
222
223 p = kmalloc_track_caller(len + 1, GFP_KERNEL);
224 if (!p)
225 return ERR_PTR(-ENOMEM);
226
227 if (copy_from_user(p, src, len)) {
228 kfree(p);
229 return ERR_PTR(-EFAULT);
230 }
231 p[len] = '\0';
232
233 return p;
234}
235EXPORT_SYMBOL(memdup_user_nul);
236
237void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
238 struct vm_area_struct *prev, struct rb_node *rb_parent)
239{
240 struct vm_area_struct *next;
241
242 vma->vm_prev = prev;
243 if (prev) {
244 next = prev->vm_next;
245 prev->vm_next = vma;
246 } else {
247 mm->mmap = vma;
248 if (rb_parent)
249 next = rb_entry(rb_parent,
250 struct vm_area_struct, vm_rb);
251 else
252 next = NULL;
253 }
254 vma->vm_next = next;
255 if (next)
256 next->vm_prev = vma;
257}
258
259
260int vma_is_stack_for_current(struct vm_area_struct *vma)
261{
262 struct task_struct * __maybe_unused t = current;
263
264 return (vma->vm_start <= KSTK_ESP(t) && vma->vm_end >= KSTK_ESP(t));
265}
266
267#if defined(CONFIG_MMU) && !defined(HAVE_ARCH_PICK_MMAP_LAYOUT)
268void arch_pick_mmap_layout(struct mm_struct *mm)
269{
270 mm->mmap_base = TASK_UNMAPPED_BASE;
271 mm->get_unmapped_area = arch_get_unmapped_area;
272}
273#endif
274
275
276
277
278
279
280
281int __weak __get_user_pages_fast(unsigned long start,
282 int nr_pages, int write, struct page **pages)
283{
284 return 0;
285}
286EXPORT_SYMBOL_GPL(__get_user_pages_fast);
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312int __weak get_user_pages_fast(unsigned long start,
313 int nr_pages, int write, struct page **pages)
314{
315 return get_user_pages_unlocked(start, nr_pages, pages,
316 write ? FOLL_WRITE : 0);
317}
318EXPORT_SYMBOL_GPL(get_user_pages_fast);
319
320unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr,
321 unsigned long len, unsigned long prot,
322 unsigned long flag, unsigned long pgoff)
323{
324 unsigned long ret;
325 struct mm_struct *mm = current->mm;
326 unsigned long populate;
327 LIST_HEAD(uf);
328
329 ret = security_mmap_file(file, prot, flag);
330 if (!ret) {
331 if (down_write_killable(&mm->mmap_sem))
332 return -EINTR;
333 ret = do_mmap_pgoff(file, addr, len, prot, flag, pgoff,
334 &populate, &uf);
335 up_write(&mm->mmap_sem);
336 userfaultfd_unmap_complete(mm, &uf);
337 if (populate)
338 mm_populate(ret, populate);
339 }
340 return ret;
341}
342
343unsigned long vm_mmap(struct file *file, unsigned long addr,
344 unsigned long len, unsigned long prot,
345 unsigned long flag, unsigned long offset)
346{
347 if (unlikely(offset + PAGE_ALIGN(len) < offset))
348 return -EINVAL;
349 if (unlikely(offset_in_page(offset)))
350 return -EINVAL;
351
352 return vm_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT);
353}
354EXPORT_SYMBOL(vm_mmap);
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372void *kvmalloc_node(size_t size, gfp_t flags, int node)
373{
374 gfp_t kmalloc_flags = flags;
375 void *ret;
376
377
378
379
380
381 WARN_ON_ONCE((flags & GFP_KERNEL) != GFP_KERNEL);
382
383
384
385
386
387
388
389
390 if (size > PAGE_SIZE) {
391 kmalloc_flags |= __GFP_NOWARN;
392
393 if (!(kmalloc_flags & __GFP_RETRY_MAYFAIL))
394 kmalloc_flags |= __GFP_NORETRY;
395 }
396
397 ret = kmalloc_node(size, kmalloc_flags, node);
398
399
400
401
402
403 if (ret || size <= PAGE_SIZE)
404 return ret;
405
406 return __vmalloc_node_flags_caller(size, node, flags,
407 __builtin_return_address(0));
408}
409EXPORT_SYMBOL(kvmalloc_node);
410
411void kvfree(const void *addr)
412{
413 if (is_vmalloc_addr(addr))
414 vfree(addr);
415 else
416 kfree(addr);
417}
418EXPORT_SYMBOL(kvfree);
419
420static inline void *__page_rmapping(struct page *page)
421{
422 unsigned long mapping;
423
424 mapping = (unsigned long)page->mapping;
425 mapping &= ~PAGE_MAPPING_FLAGS;
426
427 return (void *)mapping;
428}
429
430
431void *page_rmapping(struct page *page)
432{
433 page = compound_head(page);
434 return __page_rmapping(page);
435}
436
437
438
439
440
441bool page_mapped(struct page *page)
442{
443 int i;
444
445 if (likely(!PageCompound(page)))
446 return atomic_read(&page->_mapcount) >= 0;
447 page = compound_head(page);
448 if (atomic_read(compound_mapcount_ptr(page)) >= 0)
449 return true;
450 if (PageHuge(page))
451 return false;
452 for (i = 0; i < hpage_nr_pages(page); i++) {
453 if (atomic_read(&page[i]._mapcount) >= 0)
454 return true;
455 }
456 return false;
457}
458EXPORT_SYMBOL(page_mapped);
459
460struct anon_vma *page_anon_vma(struct page *page)
461{
462 unsigned long mapping;
463
464 page = compound_head(page);
465 mapping = (unsigned long)page->mapping;
466 if ((mapping & PAGE_MAPPING_FLAGS) != PAGE_MAPPING_ANON)
467 return NULL;
468 return __page_rmapping(page);
469}
470
471struct address_space *page_mapping(struct page *page)
472{
473 struct address_space *mapping;
474
475 page = compound_head(page);
476
477
478 if (unlikely(PageSlab(page)))
479 return NULL;
480
481 if (unlikely(PageSwapCache(page))) {
482 swp_entry_t entry;
483
484 entry.val = page_private(page);
485 return swap_address_space(entry);
486 }
487
488 mapping = page->mapping;
489 if ((unsigned long)mapping & PAGE_MAPPING_ANON)
490 return NULL;
491
492 return (void *)((unsigned long)mapping & ~PAGE_MAPPING_FLAGS);
493}
494EXPORT_SYMBOL(page_mapping);
495
496
497int __page_mapcount(struct page *page)
498{
499 int ret;
500
501 ret = atomic_read(&page->_mapcount) + 1;
502
503
504
505
506 if (!PageAnon(page) && !PageHuge(page))
507 return ret;
508 page = compound_head(page);
509 ret += atomic_read(compound_mapcount_ptr(page)) + 1;
510 if (PageDoubleMap(page))
511 ret--;
512 return ret;
513}
514EXPORT_SYMBOL_GPL(__page_mapcount);
515
516int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS;
517int sysctl_overcommit_ratio __read_mostly = 50;
518unsigned long sysctl_overcommit_kbytes __read_mostly;
519int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
520unsigned long sysctl_user_reserve_kbytes __read_mostly = 1UL << 17;
521unsigned long sysctl_admin_reserve_kbytes __read_mostly = 1UL << 13;
522
523int overcommit_ratio_handler(struct ctl_table *table, int write,
524 void __user *buffer, size_t *lenp,
525 loff_t *ppos)
526{
527 int ret;
528
529 ret = proc_dointvec(table, write, buffer, lenp, ppos);
530 if (ret == 0 && write)
531 sysctl_overcommit_kbytes = 0;
532 return ret;
533}
534
535int overcommit_kbytes_handler(struct ctl_table *table, int write,
536 void __user *buffer, size_t *lenp,
537 loff_t *ppos)
538{
539 int ret;
540
541 ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
542 if (ret == 0 && write)
543 sysctl_overcommit_ratio = 0;
544 return ret;
545}
546
547
548
549
550unsigned long vm_commit_limit(void)
551{
552 unsigned long allowed;
553
554 if (sysctl_overcommit_kbytes)
555 allowed = sysctl_overcommit_kbytes >> (PAGE_SHIFT - 10);
556 else
557 allowed = ((totalram_pages - hugetlb_total_pages())
558 * sysctl_overcommit_ratio / 100);
559 allowed += total_swap_pages;
560
561 return allowed;
562}
563
564
565
566
567
568struct percpu_counter vm_committed_as ____cacheline_aligned_in_smp;
569
570
571
572
573
574
575
576
577
578unsigned long vm_memory_committed(void)
579{
580 return percpu_counter_read_positive(&vm_committed_as);
581}
582EXPORT_SYMBOL_GPL(vm_memory_committed);
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
601{
602 long free, allowed, reserve;
603
604 VM_WARN_ONCE(percpu_counter_read(&vm_committed_as) <
605 -(s64)vm_committed_as_batch * num_online_cpus(),
606 "memory commitment underflow");
607
608 vm_acct_memory(pages);
609
610
611
612
613 if (sysctl_overcommit_memory == OVERCOMMIT_ALWAYS)
614 return 0;
615
616 if (sysctl_overcommit_memory == OVERCOMMIT_GUESS) {
617 free = global_zone_page_state(NR_FREE_PAGES);
618 free += global_node_page_state(NR_FILE_PAGES);
619
620
621
622
623
624
625
626 free -= global_node_page_state(NR_SHMEM);
627
628 free += get_nr_swap_pages();
629
630
631
632
633
634
635
636 free += global_node_page_state(NR_SLAB_RECLAIMABLE);
637
638
639
640
641 if (free <= totalreserve_pages)
642 goto error;
643 else
644 free -= totalreserve_pages;
645
646
647
648
649 if (!cap_sys_admin)
650 free -= sysctl_admin_reserve_kbytes >> (PAGE_SHIFT - 10);
651
652 if (free > pages)
653 return 0;
654
655 goto error;
656 }
657
658 allowed = vm_commit_limit();
659
660
661
662 if (!cap_sys_admin)
663 allowed -= sysctl_admin_reserve_kbytes >> (PAGE_SHIFT - 10);
664
665
666
667
668 if (mm) {
669 reserve = sysctl_user_reserve_kbytes >> (PAGE_SHIFT - 10);
670 allowed -= min_t(long, mm->total_vm / 32, reserve);
671 }
672
673 if (percpu_counter_read_positive(&vm_committed_as) < allowed)
674 return 0;
675error:
676 vm_unacct_memory(pages);
677
678 return -ENOMEM;
679}
680
681
682
683
684
685
686
687
688
689
690int get_cmdline(struct task_struct *task, char *buffer, int buflen)
691{
692 int res = 0;
693 unsigned int len;
694 struct mm_struct *mm = get_task_mm(task);
695 unsigned long arg_start, arg_end, env_start, env_end;
696 if (!mm)
697 goto out;
698 if (!mm->arg_end)
699 goto out_mm;
700
701 down_read(&mm->mmap_sem);
702 arg_start = mm->arg_start;
703 arg_end = mm->arg_end;
704 env_start = mm->env_start;
705 env_end = mm->env_end;
706 up_read(&mm->mmap_sem);
707
708 len = arg_end - arg_start;
709
710 if (len > buflen)
711 len = buflen;
712
713 res = access_process_vm(task, arg_start, buffer, len, FOLL_FORCE);
714
715
716
717
718
719 if (res > 0 && buffer[res-1] != '\0' && len < buflen) {
720 len = strnlen(buffer, res);
721 if (len < res) {
722 res = len;
723 } else {
724 len = env_end - env_start;
725 if (len > buflen - res)
726 len = buflen - res;
727 res += access_process_vm(task, env_start,
728 buffer+res, len,
729 FOLL_FORCE);
730 res = strnlen(buffer, res);
731 }
732 }
733out_mm:
734 mmput(mm);
735out:
736 return res;
737}
738