From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCCC1C43469 for ; Mon, 21 Sep 2020 14:34:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 48178221EC for ; Mon, 21 Sep 2020 14:34:48 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="Fj58CJcp" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 48178221EC Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=lst.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 20F1A900073; Mon, 21 Sep 2020 10:34:40 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1AF7E900071; Mon, 21 Sep 2020 10:34:39 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D9A9D900073; Mon, 21 Sep 2020 10:34:39 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0243.hostedemail.com [216.40.44.243]) by kanga.kvack.org (Postfix) with ESMTP id B0F73900074 for ; Mon, 21 Sep 2020 10:34:39 -0400 (EDT) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 73CF81EE6 for ; Mon, 21 Sep 2020 14:34:39 +0000 (UTC) X-FDA: 77287314678.18.earth60_620de0c27145 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin18.hostedemail.com (Postfix) with ESMTP id 34629100EC661; Mon, 21 Sep 2020 14:34:39 +0000 (UTC) X-HE-Tag: earth60_620de0c27145 X-Filterd-Recvd-Size: 9513 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf43.hostedemail.com (Postfix) with ESMTP; Mon, 21 Sep 2020 14:34:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To: Content-Type:Content-ID:Content-Description; bh=Go9jhNaIOowAS6zneWVKxUnX9eeQI4Dg/fB924GqFYE=; b=Fj58CJcpE4sDehkNalXnmTWxw3 DGiFYIP4alu/yNV8DzWwojGGHVbkvpmKEO7O+v0+KEtvpmTaC/8+AUg0vCnlW8Wpv+pAOL+TIHAXs Lf9zgvzv0nGbJApTt23suPBMJYvD/I52+eYKa80lYKU2kYmiupntzgNpmlacjuZmaAb/jexwc15yY OjMhbL124H+1M/SLeR2CIAEo+Lf9JqavRm3CepjlI3zAdY9MdM0FPRHh4OAXo3OG8B1/qJAe/+KNI w2LkgoRumDCz5RSjK0Fm3jjyQE6KRkOn4CicLrA3zvg0nRNU1GqT3jtXECzFud20JC5Wb2no3nlLO 4ZZEkf/w==; Received: from p4fdb0c34.dip0.t-ipconnect.de ([79.219.12.52] helo=localhost) by casper.infradead.org with esmtpsa (Exim 4.92.3 #3 (Red Hat Linux)) id 1kKMtd-0007rg-Jy; Mon, 21 Sep 2020 14:34:25 +0000 From: Christoph Hellwig To: Alexander Viro Cc: Andrew Morton , Jens Axboe , Arnd Bergmann , David Howells , David Laight , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mips@vger.kernel.org, linux-parisc@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-s390@vger.kernel.org, sparclinux@vger.kernel.org, linux-block@vger.kernel.org, linux-scsi@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-aio@kvack.org, io-uring@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, netdev@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH 05/11] iov_iter: merge the compat case into rw_copy_check_uvector Date: Mon, 21 Sep 2020 16:34:28 +0200 Message-Id: <20200921143434.707844-6-hch@lst.de> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200921143434.707844-1-hch@lst.de> References: <20200921143434.707844-1-hch@lst.de> MIME-Version: 1.0 X-SRS-Rewrite: SMTP reverse-path rewritten from by casper.infradead.org. See http://www.infradead.org/rpr.html Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Stop duplicating the iovec verify code, and instead add add a __import_iovec helper that does the whole verify and import, but takes a bool compat to decided on the native or compat layout. This also ends up massively simplifying the calling conventions. Signed-off-by: Christoph Hellwig --- lib/iov_iter.c | 195 ++++++++++++++++++------------------------------- 1 file changed, 70 insertions(+), 125 deletions(-) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index a64867501a7483..8bfa47b63d39aa 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -10,6 +10,7 @@ #include #include #include +#include =20 #define PIPE_PARANOIA /* for now */ =20 @@ -1650,43 +1651,76 @@ const void *dup_iter(struct iov_iter *new, struct= iov_iter *old, gfp_t flags) } EXPORT_SYMBOL(dup_iter); =20 -static ssize_t rw_copy_check_uvector(int type, - const struct iovec __user *uvector, unsigned long nr_segs, - unsigned long fast_segs, struct iovec *fast_pointer, - struct iovec **ret_pointer) +static int compat_copy_iovecs_from_user(struct iovec *iov, + const struct iovec __user *uvector, unsigned long nr_segs) +{ + const struct compat_iovec __user *uiov =3D + (const struct compat_iovec __user *)uvector; + unsigned long i; + int ret =3D -EFAULT; + + if (!user_access_begin(uvector, nr_segs * sizeof(*uvector))) + return -EFAULT; + + for (i =3D 0; i < nr_segs; i++) { + compat_uptr_t buf; + compat_ssize_t len; + + unsafe_get_user(len, &uiov[i].iov_len, out); + unsafe_get_user(buf, &uiov[i].iov_base, out); + + /* check for compat_size_t not fitting in compat_ssize_t .. */ + if (len < 0) { + ret =3D -EINVAL; + goto out; + } + iov[i].iov_base =3D compat_ptr(buf); + iov[i].iov_len =3D len; + } + ret =3D 0; +out: + user_access_end(); + return ret; +} + +static ssize_t __import_iovec(int type, const struct iovec __user *uvect= or, + unsigned nr_segs, unsigned fast_segs, struct iovec **iovp, + struct iov_iter *i, bool compat) { + struct iovec *iov =3D *iovp; unsigned long seg; - ssize_t ret; - struct iovec *iov =3D fast_pointer; + ssize_t ret =3D 0; =20 /* * SuS says "The readv() function *may* fail if the iovcnt argument * was less than or equal to 0, or greater than {IOV_MAX}. Linux has * traditionally returned zero for zero segments, so... */ - if (nr_segs =3D=3D 0) { - ret =3D 0; - goto out; - } + if (nr_segs =3D=3D 0) + goto done; =20 /* * First get the "struct iovec" from user memory and * verify all the pointers */ - if (nr_segs > UIO_MAXIOV) { - ret =3D -EINVAL; - goto out; - } + ret =3D -EINVAL; + if (nr_segs > UIO_MAXIOV) + goto fail; if (nr_segs > fast_segs) { + ret =3D -ENOMEM; iov =3D kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL); - if (iov =3D=3D NULL) { - ret =3D -ENOMEM; - goto out; - } + if (!iov) + goto fail; } - if (copy_from_user(iov, uvector, nr_segs*sizeof(*uvector))) { + + if (compat) { + ret =3D compat_copy_iovecs_from_user(iov, uvector, nr_segs); + if (ret) + goto fail; + } else { ret =3D -EFAULT; - goto out; + if (copy_from_user(iov, uvector, nr_segs * sizeof(*uvector))) + goto fail; } =20 /* @@ -1707,11 +1741,11 @@ static ssize_t rw_copy_check_uvector(int type, * it's about to overflow ssize_t */ if (len < 0) { ret =3D -EINVAL; - goto out; + goto fail; } if (type !=3D CHECK_IOVEC_ONLY && !access_ok(buf, len)) { ret =3D -EFAULT; - goto out; + goto fail; } if (len > MAX_RW_COUNT - ret) { len =3D MAX_RW_COUNT - ret; @@ -1719,8 +1753,17 @@ static ssize_t rw_copy_check_uvector(int type, } ret +=3D len; } -out: - *ret_pointer =3D iov; +done: + iov_iter_init(i, type, iov, nr_segs, ret); + if (iov =3D=3D *iovp) + *iovp =3D NULL; + else + *iovp =3D iov; + return ret; +fail: + if (iov !=3D *iovp) + kfree(iov); + *iovp =3D NULL; return ret; } =20 @@ -1750,116 +1793,18 @@ ssize_t import_iovec(int type, const struct iove= c __user * uvector, unsigned nr_segs, unsigned fast_segs, struct iovec **iov, struct iov_iter *i) { - ssize_t n; - struct iovec *p; - n =3D rw_copy_check_uvector(type, uvector, nr_segs, fast_segs, - *iov, &p); - if (n < 0) { - if (p !=3D *iov) - kfree(p); - *iov =3D NULL; - return n; - } - iov_iter_init(i, type, p, nr_segs, n); - *iov =3D p =3D=3D *iov ? NULL : p; - return n; + return __import_iovec(type, uvector, nr_segs, fast_segs, iov, i, false)= ; } EXPORT_SYMBOL(import_iovec); =20 #ifdef CONFIG_COMPAT -#include - -static ssize_t compat_rw_copy_check_uvector(int type, - const struct compat_iovec __user *uvector, unsigned long nr_segs, - unsigned long fast_segs, struct iovec *fast_pointer, - struct iovec **ret_pointer) -{ - compat_ssize_t tot_len; - struct iovec *iov =3D *ret_pointer =3D fast_pointer; - ssize_t ret =3D 0; - int seg; - - /* - * SuS says "The readv() function *may* fail if the iovcnt argument - * was less than or equal to 0, or greater than {IOV_MAX}. Linux has - * traditionally returned zero for zero segments, so... - */ - if (nr_segs =3D=3D 0) - goto out; - - ret =3D -EINVAL; - if (nr_segs > UIO_MAXIOV) - goto out; - if (nr_segs > fast_segs) { - ret =3D -ENOMEM; - iov =3D kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL); - if (iov =3D=3D NULL) - goto out; - } - *ret_pointer =3D iov; - - ret =3D -EFAULT; - if (!access_ok(uvector, nr_segs*sizeof(*uvector))) - goto out; - - /* - * Single unix specification: - * We should -EINVAL if an element length is not >=3D 0 and fitting an - * ssize_t. - * - * In Linux, the total length is limited to MAX_RW_COUNT, there is - * no overflow possibility. - */ - tot_len =3D 0; - ret =3D -EINVAL; - for (seg =3D 0; seg < nr_segs; seg++) { - compat_uptr_t buf; - compat_ssize_t len; - - if (__get_user(len, &uvector->iov_len) || - __get_user(buf, &uvector->iov_base)) { - ret =3D -EFAULT; - goto out; - } - if (len < 0) /* size_t not fitting in compat_ssize_t .. */ - goto out; - if (type !=3D CHECK_IOVEC_ONLY && - !access_ok(compat_ptr(buf), len)) { - ret =3D -EFAULT; - goto out; - } - if (len > MAX_RW_COUNT - tot_len) - len =3D MAX_RW_COUNT - tot_len; - tot_len +=3D len; - iov->iov_base =3D compat_ptr(buf); - iov->iov_len =3D (compat_size_t) len; - uvector++; - iov++; - } - ret =3D tot_len; - -out: - return ret; -} - ssize_t compat_import_iovec(int type, const struct compat_iovec __user * uvector, unsigned nr_segs, unsigned fast_segs, struct iovec **iov, struct iov_iter *i) { - ssize_t n; - struct iovec *p; - n =3D compat_rw_copy_check_uvector(type, uvector, nr_segs, fast_segs, - *iov, &p); - if (n < 0) { - if (p !=3D *iov) - kfree(p); - *iov =3D NULL; - return n; - } - iov_iter_init(i, type, p, nr_segs, n); - *iov =3D p =3D=3D *iov ? NULL : p; - return n; + return __import_iovec(type, (const struct iovec __user *)uvector, + nr_segs, fast_segs, iov, i, true); } EXPORT_SYMBOL(compat_import_iovec); #endif --=20 2.28.0