mmap.c

  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 * Flexible mmap layout support
  4 *
  5 * Based on code by Ingo Molnar and Andi Kleen, copyrighted
  6 * as follows:
  7 *
  8 * Copyright 2003-2009 Red Hat Inc.
  9 * All Rights Reserved.
 10 * Copyright 2005 Andi Kleen, SUSE Labs.
 11 * Copyright 2007 Jiri Kosina, SUSE Labs.
 12 */
 13
 14#include <linux/personality.h>
 15#include <linux/mm.h>
 16#include <linux/random.h>
 17#include <linux/limits.h>
 18#include <linux/sched/signal.h>
 19#include <linux/sched/mm.h>
 20#include <linux/compat.h>
 21#include <linux/elf-randomize.h>
 22#include <asm/elf.h>
 23#include <asm/io.h>
 24
 25#include "physaddr.h"
 26
 27struct va_alignment __read_mostly va_align = {
 28	.flags = -1,
 29};
 30
 31unsigned long task_size_32bit(void)
 32{
 33	return IA32_PAGE_OFFSET;
 34}
 35
 36unsigned long task_size_64bit(int full_addr_space)
 37{
 38	return full_addr_space ? TASK_SIZE_MAX : DEFAULT_MAP_WINDOW;
 39}
 40
 41static unsigned long stack_maxrandom_size(unsigned long task_size)
 42{
 43	unsigned long max = 0;
 44	if (current->flags & PF_RANDOMIZE) {
 45		max = (-1UL) & __STACK_RND_MASK(task_size == task_size_32bit());
 46		max <<= PAGE_SHIFT;
 47	}
 48
 49	return max;
 50}
 51
 52#ifdef CONFIG_COMPAT
 53# define mmap32_rnd_bits  mmap_rnd_compat_bits
 54# define mmap64_rnd_bits  mmap_rnd_bits
 55#else
 56# define mmap32_rnd_bits  mmap_rnd_bits
 57# define mmap64_rnd_bits  mmap_rnd_bits
 58#endif
 59
 60#define SIZE_128M    (128 * 1024 * 1024UL)
 61
 62static int mmap_is_legacy(void)
 63{
 64	if (current->personality & ADDR_COMPAT_LAYOUT)
 65		return 1;
 66
 67	return sysctl_legacy_va_layout;
 68}
 69
 70static unsigned long arch_rnd(unsigned int rndbits)
 71{
 72	if (!(current->flags & PF_RANDOMIZE))
 73		return 0;
 74	return (get_random_long() & ((1UL << rndbits) - 1)) << PAGE_SHIFT;
 75}
 76
 77unsigned long arch_mmap_rnd(void)
 78{
 79	return arch_rnd(mmap_is_ia32() ? mmap32_rnd_bits : mmap64_rnd_bits);
 80}
 81
 82static unsigned long mmap_base(unsigned long rnd, unsigned long task_size,
 83			       const struct rlimit *rlim_stack)
 84{
 85	unsigned long gap = rlim_stack->rlim_cur;
 86	unsigned long pad = stack_maxrandom_size(task_size) + stack_guard_gap;
 87
 88	/* Values close to RLIM_INFINITY can overflow. */
 89	if (gap + pad > gap)
 90		gap += pad;
 91
 92	/*
 93	 * Top of mmap area (just below the process stack).
 94	 * Leave an at least ~128 MB hole with possible stack randomization.
 95	 */
 96	gap = clamp(gap, SIZE_128M, (task_size / 6) * 5);
 97
 98	return PAGE_ALIGN(task_size - gap - rnd);
 99}
100
101static unsigned long mmap_legacy_base(unsigned long rnd,
102				      unsigned long task_size)
103{
104	return __TASK_UNMAPPED_BASE(task_size) + rnd;
105}
106
107/*
108 * This function, called very early during the creation of a new
109 * process VM image, sets up which VM layout function to use:
110 */
111static void arch_pick_mmap_base(unsigned long *base, unsigned long *legacy_base,
112		unsigned long random_factor, unsigned long task_size,
113		const struct rlimit *rlim_stack)
114{
115	*legacy_base = mmap_legacy_base(random_factor, task_size);
116	if (mmap_is_legacy())
117		*base = *legacy_base;
118	else
119		*base = mmap_base(random_factor, task_size, rlim_stack);
120}
121
122void arch_pick_mmap_layout(struct mm_struct *mm, const struct rlimit *rlim_stack)
123{
124	if (mmap_is_legacy())
125		mm_flags_clear(MMF_TOPDOWN, mm);
126	else
127		mm_flags_set(MMF_TOPDOWN, mm);
128
129	arch_pick_mmap_base(&mm->mmap_base, &mm->mmap_legacy_base,
130			arch_rnd(mmap64_rnd_bits), task_size_64bit(0),
131			rlim_stack);
132
133#ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
134	/*
135	 * The mmap syscall mapping base decision depends solely on the
136	 * syscall type (64-bit or compat). This applies for 64bit
137	 * applications and 32bit applications. The 64bit syscall uses
138	 * mmap_base, the compat syscall uses mmap_compat_base.
139	 */
140	arch_pick_mmap_base(&mm->mmap_compat_base, &mm->mmap_compat_legacy_base,
141			arch_rnd(mmap32_rnd_bits), task_size_32bit(),
142			rlim_stack);
143#endif
144}
145
146unsigned long get_mmap_base(int is_legacy)
147{
148	struct mm_struct *mm = current->mm;
149
150#ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
151	if (in_32bit_syscall()) {
152		return is_legacy ? mm->mmap_compat_legacy_base
153				 : mm->mmap_compat_base;
154	}
155#endif
156	return is_legacy ? mm->mmap_legacy_base : mm->mmap_base;
157}
158
159/**
160 * mmap_address_hint_valid - Validate the address hint of mmap
161 * @addr:	Address hint
162 * @len:	Mapping length
163 *
164 * Check whether @addr and @addr + @len result in a valid mapping.
165 *
166 * On 32bit this only checks whether @addr + @len is <= TASK_SIZE.
167 *
168 * On 64bit with 5-level page tables another sanity check is required
169 * because mappings requested by mmap(@addr, 0) which cross the 47-bit
170 * virtual address boundary can cause the following theoretical issue:
171 *
172 *  An application calls mmap(addr, 0), i.e. without MAP_FIXED, where @addr
173 *  is below the border of the 47-bit address space and @addr + @len is
174 *  above the border.
175 *
176 *  With 4-level paging this request succeeds, but the resulting mapping
177 *  address will always be within the 47-bit virtual address space, because
178 *  the hint address does not result in a valid mapping and is
179 *  ignored. Hence applications which are not prepared to handle virtual
180 *  addresses above 47-bit work correctly.
181 *
182 *  With 5-level paging this request would be granted and result in a
183 *  mapping which crosses the border of the 47-bit virtual address
184 *  space. If the application cannot handle addresses above 47-bit this
185 *  will lead to misbehaviour and hard to diagnose failures.
186 *
187 * Therefore ignore address hints which would result in a mapping crossing
188 * the 47-bit virtual address boundary.
189 *
190 * Note, that in the same scenario with MAP_FIXED the behaviour is
191 * different. The request with @addr < 47-bit and @addr + @len > 47-bit
192 * fails on a 4-level paging machine but succeeds on a 5-level paging
193 * machine. It is reasonable to expect that an application does not rely on
194 * the failure of such a fixed mapping request, so the restriction is not
195 * applied.
196 */
197bool mmap_address_hint_valid(unsigned long addr, unsigned long len)
198{
199	if (TASK_SIZE - len < addr)
200		return false;
201
202	return (addr > DEFAULT_MAP_WINDOW) == (addr + len > DEFAULT_MAP_WINDOW);
203}
204
205/* Can we access it for direct reading/writing? Must be RAM: */
206int valid_phys_addr_range(phys_addr_t addr, size_t count)
207{
208	return addr + count - 1 <= __pa(high_memory - 1);
209}
210
211/* Can we access it through mmap? Must be a valid physical address: */
212int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
213{
214	phys_addr_t addr = (phys_addr_t)pfn << PAGE_SHIFT;
215
216	return phys_addr_valid(addr + count - 1);
217}
218
219/*
220 * Only allow root to set high MMIO mappings to PROT_NONE.
221 * This prevents an unpriv. user to set them to PROT_NONE and invert
222 * them, then pointing to valid memory for L1TF speculation.
223 *
224 * Note: for locked down kernels may want to disable the root override.
225 */
226bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot)
227{
228	if (!boot_cpu_has_bug(X86_BUG_L1TF))
229		return true;
230	if (!__pte_needs_invert(pgprot_val(prot)))
231		return true;
232	/* If it's real memory always allow */
233	if (pfn_valid(pfn))
234		return true;
235	if (pfn >= l1tf_pfn_limit() && !capable(CAP_SYS_ADMIN))
236		return false;
237	return true;
238}