Commit | Line | Data |
---|---|---|
c33fa9f5 IM |
1 | /* |
2 | * Access kernel memory without faulting. | |
3 | */ | |
b95f1b31 | 4 | #include <linux/export.h> |
c33fa9f5 | 5 | #include <linux/mm.h> |
7c7fcf76 | 6 | #include <linux/uaccess.h> |
c33fa9f5 IM |
7 | |
8 | /** | |
9 | * probe_kernel_read(): safely attempt to read from a location | |
10 | * @dst: pointer to the buffer that shall take the data | |
11 | * @src: address to read from | |
12 | * @size: size of the data chunk | |
13 | * | |
14 | * Safely read from address @src to the buffer at @dst. If a kernel fault | |
15 | * happens, handle that and return -EFAULT. | |
0ab32b6f AM |
16 | * |
17 | * We ensure that the copy_from_user is executed in atomic context so that | |
18 | * do_page_fault() doesn't attempt to take mmap_sem. This makes | |
19 | * probe_kernel_read() suitable for use within regions where the caller | |
20 | * already holds mmap_sem, or other locks which nest inside mmap_sem. | |
c33fa9f5 | 21 | */ |
6144a85a | 22 | |
f29c5041 | 23 | long __weak probe_kernel_read(void *dst, const void *src, size_t size) |
6144a85a JW |
24 | __attribute__((alias("__probe_kernel_read"))); |
25 | ||
f29c5041 | 26 | long __probe_kernel_read(void *dst, const void *src, size_t size) |
c33fa9f5 IM |
27 | { |
28 | long ret; | |
b4b8ac52 | 29 | mm_segment_t old_fs = get_fs(); |
c33fa9f5 | 30 | |
b4b8ac52 | 31 | set_fs(KERNEL_DS); |
c33fa9f5 | 32 | pagefault_disable(); |
9da3f2b7 | 33 | current->kernel_uaccess_faults_ok++; |
c33fa9f5 IM |
34 | ret = __copy_from_user_inatomic(dst, |
35 | (__force const void __user *)src, size); | |
9da3f2b7 | 36 | current->kernel_uaccess_faults_ok--; |
c33fa9f5 | 37 | pagefault_enable(); |
b4b8ac52 | 38 | set_fs(old_fs); |
c33fa9f5 IM |
39 | |
40 | return ret ? -EFAULT : 0; | |
41 | } | |
42 | EXPORT_SYMBOL_GPL(probe_kernel_read); | |
43 | ||
44 | /** | |
45 | * probe_kernel_write(): safely attempt to write to a location | |
46 | * @dst: address to write to | |
47 | * @src: pointer to the data that shall be written | |
48 | * @size: size of the data chunk | |
49 | * | |
50 | * Safely write to address @dst from the buffer at @src. If a kernel fault | |
51 | * happens, handle that and return -EFAULT. | |
52 | */ | |
f29c5041 | 53 | long __weak probe_kernel_write(void *dst, const void *src, size_t size) |
6144a85a JW |
54 | __attribute__((alias("__probe_kernel_write"))); |
55 | ||
f29c5041 | 56 | long __probe_kernel_write(void *dst, const void *src, size_t size) |
c33fa9f5 IM |
57 | { |
58 | long ret; | |
b4b8ac52 | 59 | mm_segment_t old_fs = get_fs(); |
c33fa9f5 | 60 | |
b4b8ac52 | 61 | set_fs(KERNEL_DS); |
c33fa9f5 | 62 | pagefault_disable(); |
9da3f2b7 | 63 | current->kernel_uaccess_faults_ok++; |
c33fa9f5 | 64 | ret = __copy_to_user_inatomic((__force void __user *)dst, src, size); |
9da3f2b7 | 65 | current->kernel_uaccess_faults_ok--; |
c33fa9f5 | 66 | pagefault_enable(); |
b4b8ac52 | 67 | set_fs(old_fs); |
c33fa9f5 IM |
68 | |
69 | return ret ? -EFAULT : 0; | |
70 | } | |
71 | EXPORT_SYMBOL_GPL(probe_kernel_write); | |
dbb7ee0e AS |
72 | |
73 | /** | |
74 | * strncpy_from_unsafe: - Copy a NUL terminated string from unsafe address. | |
75 | * @dst: Destination address, in kernel space. This buffer must be at | |
76 | * least @count bytes long. | |
f144c390 | 77 | * @unsafe_addr: Unsafe address. |
dbb7ee0e AS |
78 | * @count: Maximum number of bytes to copy, including the trailing NUL. |
79 | * | |
80 | * Copies a NUL-terminated string from unsafe address to kernel buffer. | |
81 | * | |
82 | * On success, returns the length of the string INCLUDING the trailing NUL. | |
83 | * | |
84 | * If access fails, returns -EFAULT (some data may have been copied | |
85 | * and the trailing NUL added). | |
86 | * | |
87 | * If @count is smaller than the length of the string, copies @count-1 bytes, | |
88 | * sets the last byte of @dst buffer to NUL and returns @count. | |
89 | */ | |
90 | long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count) | |
91 | { | |
92 | mm_segment_t old_fs = get_fs(); | |
93 | const void *src = unsafe_addr; | |
94 | long ret; | |
95 | ||
96 | if (unlikely(count <= 0)) | |
97 | return 0; | |
98 | ||
99 | set_fs(KERNEL_DS); | |
100 | pagefault_disable(); | |
9da3f2b7 | 101 | current->kernel_uaccess_faults_ok++; |
dbb7ee0e AS |
102 | |
103 | do { | |
bd28b145 | 104 | ret = __get_user(*dst++, (const char __user __force *)src++); |
dbb7ee0e AS |
105 | } while (dst[-1] && ret == 0 && src - unsafe_addr < count); |
106 | ||
9da3f2b7 | 107 | current->kernel_uaccess_faults_ok--; |
dbb7ee0e AS |
108 | dst[-1] = '\0'; |
109 | pagefault_enable(); | |
110 | set_fs(old_fs); | |
111 | ||
9dd861d5 | 112 | return ret ? -EFAULT : src - unsafe_addr; |
dbb7ee0e | 113 | } |