um/kernel/trap.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * Copyright (C) 2000 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
0004  */
0005
0006 #include <linux/mm.h>
0007 #include <linux/sched/signal.h>
0008 #include <linux/hardirq.h>
0009 #include <linux/module.h>
0010 #include <linux/uaccess.h>
0011 #include <linux/sched/debug.h>
0012 #include <asm/current.h>
0013 #include <asm/tlbflush.h>
0014 #include <arch.h>
0015 #include <as-layout.h>
0016 #include <kern_util.h>
0017 #include <os.h>
0018 #include <skas.h>
0019
0020 /*
0021  * Note this is constrained to return 0, -EFAULT, -EACCES, -ENOMEM by
0022  * segv().
0023  */
0024 int handle_page_fault(unsigned long address, unsigned long ip,
0025               int is_write, int is_user, int *code_out)
0026 {
0027     struct mm_struct *mm = current->mm;
0028     struct vm_area_struct *vma;
0029     pmd_t *pmd;
0030     pte_t *pte;
0031     int err = -EFAULT;
0032     unsigned int flags = FAULT_FLAG_DEFAULT;
0033
0034     *code_out = SEGV_MAPERR;
0035
0036     /*
0037      * If the fault was with pagefaults disabled, don't take the fault, just
0038      * fail.
0039      */
0040     if (faulthandler_disabled())
0041         goto out_nosemaphore;
0042
0043     if (is_user)
0044         flags |= FAULT_FLAG_USER;
0045 retry:
0046     mmap_read_lock(mm);
0047     vma = find_vma(mm, address);
0048     if (!vma)
0049         goto out;
0050     else if (vma->vm_start <= address)
0051         goto good_area;
0052     else if (!(vma->vm_flags & VM_GROWSDOWN))
0053         goto out;
0054     else if (is_user && !ARCH_IS_STACKGROW(address))
0055         goto out;
0056     else if (expand_stack(vma, address))
0057         goto out;
0058
0059 good_area:
0060     *code_out = SEGV_ACCERR;
0061     if (is_write) {
0062         if (!(vma->vm_flags & VM_WRITE))
0063             goto out;
0064         flags |= FAULT_FLAG_WRITE;
0065     } else {
0066         /* Don't require VM_READ|VM_EXEC for write faults! */
0067         if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
0068             goto out;
0069     }
0070
0071     do {
0072         vm_fault_t fault;
0073
0074         fault = handle_mm_fault(vma, address, flags, NULL);
0075
0076         if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
0077             goto out_nosemaphore;
0078
0079         /* The fault is fully completed (including releasing mmap lock) */
0080         if (fault & VM_FAULT_COMPLETED)
0081             return 0;
0082
0083         if (unlikely(fault & VM_FAULT_ERROR)) {
0084             if (fault & VM_FAULT_OOM) {
0085                 goto out_of_memory;
0086             } else if (fault & VM_FAULT_SIGSEGV) {
0087                 goto out;
0088             } else if (fault & VM_FAULT_SIGBUS) {
0089                 err = -EACCES;
0090                 goto out;
0091             }
0092             BUG();
0093         }
0094         if (fault & VM_FAULT_RETRY) {
0095             flags |= FAULT_FLAG_TRIED;
0096
0097             goto retry;
0098         }
0099
0100         pmd = pmd_off(mm, address);
0101         pte = pte_offset_kernel(pmd, address);
0102     } while (!pte_present(*pte));
0103     err = 0;
0104     /*
0105      * The below warning was added in place of
0106      *  pte_mkyoung(); if (is_write) pte_mkdirty();
0107      * If it's triggered, we'd see normally a hang here (a clean pte is
0108      * marked read-only to emulate the dirty bit).
0109      * However, the generic code can mark a PTE writable but clean on a
0110      * concurrent read fault, triggering this harmlessly. So comment it out.
0111      */
0112 #if 0
0113     WARN_ON(!pte_young(*pte) || (is_write && !pte_dirty(*pte)));
0114 #endif
0115     flush_tlb_page(vma, address);
0116 out:
0117     mmap_read_unlock(mm);
0118 out_nosemaphore:
0119     return err;
0120
0121 out_of_memory:
0122     /*
0123      * We ran out of memory, call the OOM killer, and return the userspace
0124      * (which will retry the fault, or kill us if we got oom-killed).
0125      */
0126     mmap_read_unlock(mm);
0127     if (!is_user)
0128         goto out_nosemaphore;
0129     pagefault_out_of_memory();
0130     return 0;
0131 }
0132
0133 static void show_segv_info(struct uml_pt_regs *regs)
0134 {
0135     struct task_struct *tsk = current;
0136     struct faultinfo *fi = UPT_FAULTINFO(regs);
0137
0138     if (!unhandled_signal(tsk, SIGSEGV))
0139         return;
0140
0141     if (!printk_ratelimit())
0142         return;
0143
0144     printk("%s%s[%d]: segfault at %lx ip %px sp %px error %x",
0145         task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
0146         tsk->comm, task_pid_nr(tsk), FAULT_ADDRESS(*fi),
0147         (void *)UPT_IP(regs), (void *)UPT_SP(regs),
0148         fi->error_code);
0149
0150     print_vma_addr(KERN_CONT " in ", UPT_IP(regs));
0151     printk(KERN_CONT "\n");
0152 }
0153
0154 static void bad_segv(struct faultinfo fi, unsigned long ip)
0155 {
0156     current->thread.arch.faultinfo = fi;
0157     force_sig_fault(SIGSEGV, SEGV_ACCERR, (void __user *) FAULT_ADDRESS(fi));
0158 }
0159
0160 void fatal_sigsegv(void)
0161 {
0162     force_fatal_sig(SIGSEGV);
0163     do_signal(&current->thread.regs);
0164     /*
0165      * This is to tell gcc that we're not returning - do_signal
0166      * can, in general, return, but in this case, it's not, since
0167      * we just got a fatal SIGSEGV queued.
0168      */
0169     os_dump_core();
0170 }
0171
0172 /**
0173  * segv_handler() - the SIGSEGV handler
0174  * @sig:    the signal number
0175  * @unused_si:  the signal info struct; unused in this handler
0176  * @regs:   the ptrace register information
0177  *
0178  * The handler first extracts the faultinfo from the UML ptrace regs struct.
0179  * If the userfault did not happen in an UML userspace process, bad_segv is called.
0180  * Otherwise the signal did happen in a cloned userspace process, handle it.
0181  */
0182 void segv_handler(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs)
0183 {
0184     struct faultinfo * fi = UPT_FAULTINFO(regs);
0185
0186     if (UPT_IS_USER(regs) && !SEGV_IS_FIXABLE(fi)) {
0187         show_segv_info(regs);
0188         bad_segv(*fi, UPT_IP(regs));
0189         return;
0190     }
0191     segv(*fi, UPT_IP(regs), UPT_IS_USER(regs), regs);
0192 }
0193
0194 /*
0195  * We give a *copy* of the faultinfo in the regs to segv.
0196  * This must be done, since nesting SEGVs could overwrite
0197  * the info in the regs. A pointer to the info then would
0198  * give us bad data!
0199  */
0200 unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user,
0201            struct uml_pt_regs *regs)
0202 {
0203     jmp_buf *catcher;
0204     int si_code;
0205     int err;
0206     int is_write = FAULT_WRITE(fi);
0207     unsigned long address = FAULT_ADDRESS(fi);
0208
0209     if (!is_user && regs)
0210         current->thread.segv_regs = container_of(regs, struct pt_regs, regs);
0211
0212     if (!is_user && (address >= start_vm) && (address < end_vm)) {
0213         flush_tlb_kernel_vm();
0214         goto out;
0215     }
0216     else if (current->mm == NULL) {
0217         show_regs(container_of(regs, struct pt_regs, regs));
0218         panic("Segfault with no mm");
0219     }
0220     else if (!is_user && address > PAGE_SIZE && address < TASK_SIZE) {
0221         show_regs(container_of(regs, struct pt_regs, regs));
0222         panic("Kernel tried to access user memory at addr 0x%lx, ip 0x%lx",
0223                address, ip);
0224     }
0225
0226     if (SEGV_IS_FIXABLE(&fi))
0227         err = handle_page_fault(address, ip, is_write, is_user,
0228                     &si_code);
0229     else {
0230         err = -EFAULT;
0231         /*
0232          * A thread accessed NULL, we get a fault, but CR2 is invalid.
0233          * This code is used in __do_copy_from_user() of TT mode.
0234          * XXX tt mode is gone, so maybe this isn't needed any more
0235          */
0236         address = 0;
0237     }
0238
0239     catcher = current->thread.fault_catcher;
0240     if (!err)
0241         goto out;
0242     else if (catcher != NULL) {
0243         current->thread.fault_addr = (void *) address;
0244         UML_LONGJMP(catcher, 1);
0245     }
0246     else if (current->thread.fault_addr != NULL)
0247         panic("fault_addr set but no fault catcher");
0248     else if (!is_user && arch_fixup(ip, regs))
0249         goto out;
0250
0251     if (!is_user) {
0252         show_regs(container_of(regs, struct pt_regs, regs));
0253         panic("Kernel mode fault at addr 0x%lx, ip 0x%lx",
0254               address, ip);
0255     }
0256
0257     show_segv_info(regs);
0258
0259     if (err == -EACCES) {
0260         current->thread.arch.faultinfo = fi;
0261         force_sig_fault(SIGBUS, BUS_ADRERR, (void __user *)address);
0262     } else {
0263         BUG_ON(err != -EFAULT);
0264         current->thread.arch.faultinfo = fi;
0265         force_sig_fault(SIGSEGV, si_code, (void __user *) address);
0266     }
0267
0268 out:
0269     if (regs)
0270         current->thread.segv_regs = NULL;
0271
0272     return 0;
0273 }
0274
0275 void relay_signal(int sig, struct siginfo *si, struct uml_pt_regs *regs)
0276 {
0277     int code, err;
0278     if (!UPT_IS_USER(regs)) {
0279         if (sig == SIGBUS)
0280             printk(KERN_ERR "Bus error - the host /dev/shm or /tmp "
0281                    "mount likely just ran out of space\n");
0282         panic("Kernel mode signal %d", sig);
0283     }
0284
0285     arch_examine_signal(sig, regs);
0286
0287     /* Is the signal layout for the signal known?
0288      * Signal data must be scrubbed to prevent information leaks.
0289      */
0290     code = si->si_code;
0291     err = si->si_errno;
0292     if ((err == 0) && (siginfo_layout(sig, code) == SIL_FAULT)) {
0293         struct faultinfo *fi = UPT_FAULTINFO(regs);
0294         current->thread.arch.faultinfo = *fi;
0295         force_sig_fault(sig, code, (void __user *)FAULT_ADDRESS(*fi));
0296     } else {
0297         printk(KERN_ERR "Attempted to relay unknown signal %d (si_code = %d) with errno %d\n",
0298                sig, code, err);
0299         force_sig(sig);
0300     }
0301 }
0302
0303 void bus_handler(int sig, struct siginfo *si, struct uml_pt_regs *regs)
0304 {
0305     if (current->thread.fault_catcher != NULL)
0306         UML_LONGJMP(current->thread.fault_catcher, 1);
0307     else
0308         relay_signal(sig, si, regs);
0309 }
0310
0311 void winch(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs)
0312 {
0313     do_IRQ(WINCH_IRQ, regs);
0314 }