Skip to content

Commit

Permalink
mm: replace access_remote_vm() write parameter with gup_flags
Browse files Browse the repository at this point in the history 
This removes the 'write' argument from access_remote_vm() and replaces
it with 'gup_flags' as use of this function previously silently implied
FOLL_FORCE, whereas after this patch callers explicitly pass this flag.

We make this explicit as use of FOLL_FORCE can result in surprising
behaviour (and hence bugs) within the mm subsystem.

Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  • Loading branch information
@lorenzo-stoakes @torvalds
lorenzo-stoakes authored and torvalds committed Oct 19, 2016
1 parent 442486e commit 6347e8d
Show file tree
Hide file tree
Showing 4 changed files with 20 additions and 19 deletions.
19 changes: 13 additions & 6 deletions fs/proc/base.c
View file
Expand Up @@ -252,7 +252,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
* Inherently racy -- command line shares address space * Inherently racy -- command line shares address space
* with code and data. * with code and data.
*/ */
rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0); rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_FORCE);
if (rv <= 0) if (rv <= 0)
goto out_free_page; goto out_free_page;


Expand All @@ -270,7 +270,8 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
int nr_read; int nr_read;


_count = min3(count, len, PAGE_SIZE); _count = min3(count, len, PAGE_SIZE);
nr_read = access_remote_vm(mm, p, page, _count, 0); nr_read = access_remote_vm(mm, p, page, _count,
FOLL_FORCE);
if (nr_read < 0) if (nr_read < 0)
rv = nr_read; rv = nr_read;
if (nr_read <= 0) if (nr_read <= 0)
Expand Down Expand Up @@ -305,7 +306,8 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
bool final; bool final;


_count = min3(count, len, PAGE_SIZE); _count = min3(count, len, PAGE_SIZE);
nr_read = access_remote_vm(mm, p, page, _count, 0); nr_read = access_remote_vm(mm, p, page, _count,
FOLL_FORCE);
if (nr_read < 0) if (nr_read < 0)
rv = nr_read; rv = nr_read;
if (nr_read <= 0) if (nr_read <= 0)
Expand Down Expand Up @@ -354,7 +356,8 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
bool final; bool final;


_count = min3(count, len, PAGE_SIZE); _count = min3(count, len, PAGE_SIZE);
nr_read = access_remote_vm(mm, p, page, _count, 0); nr_read = access_remote_vm(mm, p, page, _count,
FOLL_FORCE);
if (nr_read < 0) if (nr_read < 0)
rv = nr_read; rv = nr_read;
if (nr_read <= 0) if (nr_read <= 0)
Expand Down Expand Up @@ -832,6 +835,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
unsigned long addr = *ppos; unsigned long addr = *ppos;
ssize_t copied; ssize_t copied;
char *page; char *page;
unsigned int flags = FOLL_FORCE;


if (!mm) if (!mm)
return 0; return 0;
Expand All @@ -844,6 +848,9 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
if (!atomic_inc_not_zero(&mm->mm_users)) if (!atomic_inc_not_zero(&mm->mm_users))
goto free; goto free;


if (write)
flags |= FOLL_WRITE;

while (count > 0) { while (count > 0) {
int this_len = min_t(int, count, PAGE_SIZE); int this_len = min_t(int, count, PAGE_SIZE);


Expand All @@ -852,7 +859,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
break; break;
} }


this_len = access_remote_vm(mm, addr, page, this_len, write); this_len = access_remote_vm(mm, addr, page, this_len, flags);
if (!this_len) { if (!this_len) {
if (!copied) if (!copied)
copied = -EIO; copied = -EIO;
Expand Down Expand Up @@ -965,7 +972,7 @@ static ssize_t environ_read(struct file *file, char __user *buf,
this_len = min(max_len, this_len); this_len = min(max_len, this_len);


retval = access_remote_vm(mm, (env_start + src), retval = access_remote_vm(mm, (env_start + src),
page, this_len, 0); page, this_len, FOLL_FORCE);


if (retval <= 0) { if (retval <= 0) {
ret = retval; ret = retval;
Expand Down
2 changes: 1 addition & 1 deletion include/linux/mm.h
View file
Expand Up @@ -1268,7 +1268,7 @@ static inline int fixup_user_fault(struct task_struct *tsk,


extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write); extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write);
extern int access_remote_vm(struct mm_struct *mm, unsigned long addr, extern int access_remote_vm(struct mm_struct *mm, unsigned long addr,
void *buf, int len, int write); void *buf, int len, unsigned int gup_flags);


long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
unsigned long start, unsigned long nr_pages, unsigned long start, unsigned long nr_pages,
Expand Down
11 changes: 3 additions & 8 deletions mm/memory.c
View file
Expand Up @@ -3935,19 +3935,14 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
* @addr: start address to access * @addr: start address to access
* @buf: source or destination buffer * @buf: source or destination buffer
* @len: number of bytes to transfer * @len: number of bytes to transfer
* @write: whether the access is a write * @gup_flags: flags modifying lookup behaviour
* *
* The caller must hold a reference on @mm. * The caller must hold a reference on @mm.
*/ */
int access_remote_vm(struct mm_struct *mm, unsigned long addr, int access_remote_vm(struct mm_struct *mm, unsigned long addr,
void *buf, int len, int write) void *buf, int len, unsigned int gup_flags)
{ {
unsigned int flags = FOLL_FORCE; return __access_remote_vm(NULL, mm, addr, buf, len, gup_flags);

if (write)
flags |= FOLL_WRITE;

return __access_remote_vm(NULL, mm, addr, buf, len, flags);
} }


/* /*
Expand Down
7 changes: 3 additions & 4 deletions mm/nommu.c
View file
Expand Up @@ -1847,15 +1847,14 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
* @addr: start address to access * @addr: start address to access
* @buf: source or destination buffer * @buf: source or destination buffer
* @len: number of bytes to transfer * @len: number of bytes to transfer
* @write: whether the access is a write * @gup_flags: flags modifying lookup behaviour
* *
* The caller must hold a reference on @mm. * The caller must hold a reference on @mm.
*/ */
int access_remote_vm(struct mm_struct *mm, unsigned long addr, int access_remote_vm(struct mm_struct *mm, unsigned long addr,
void *buf, int len, int write) void *buf, int len, unsigned int gup_flags)
{ {
return __access_remote_vm(NULL, mm, addr, buf, len, return __access_remote_vm(NULL, mm, addr, buf, len, gup_flags);
write ? FOLL_WRITE : 0);
} }


/* /*
Expand Down

0 comments on commit 6347e8d

Please sign in to comment.