x86/mm/mmap.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * Flexible mmap layout support
0004  *
0005  * Based on code by Ingo Molnar and Andi Kleen, copyrighted
0006  * as follows:
0007  *
0008  * Copyright 2003-2009 Red Hat Inc.
0009  * All Rights Reserved.
0010  * Copyright 2005 Andi Kleen, SUSE Labs.
0011  * Copyright 2007 Jiri Kosina, SUSE Labs.
0012  */
0013
0014 #include <linux/personality.h>
0015 #include <linux/mm.h>
0016 #include <linux/random.h>
0017 #include <linux/limits.h>
0018 #include <linux/sched/signal.h>
0019 #include <linux/sched/mm.h>
0020 #include <linux/compat.h>
0021 #include <linux/elf-randomize.h>
0022 #include <asm/elf.h>
0023 #include <asm/io.h>
0024
0025 #include "physaddr.h"
0026
0027 struct va_alignment __read_mostly va_align = {
0028     .flags = -1,
0029 };
0030
0031 unsigned long task_size_32bit(void)
0032 {
0033     return IA32_PAGE_OFFSET;
0034 }
0035
0036 unsigned long task_size_64bit(int full_addr_space)
0037 {
0038     return full_addr_space ? TASK_SIZE_MAX : DEFAULT_MAP_WINDOW;
0039 }
0040
0041 static unsigned long stack_maxrandom_size(unsigned long task_size)
0042 {
0043     unsigned long max = 0;
0044     if (current->flags & PF_RANDOMIZE) {
0045         max = (-1UL) & __STACK_RND_MASK(task_size == task_size_32bit());
0046         max <<= PAGE_SHIFT;
0047     }
0048
0049     return max;
0050 }
0051
0052 #ifdef CONFIG_COMPAT
0053 # define mmap32_rnd_bits  mmap_rnd_compat_bits
0054 # define mmap64_rnd_bits  mmap_rnd_bits
0055 #else
0056 # define mmap32_rnd_bits  mmap_rnd_bits
0057 # define mmap64_rnd_bits  mmap_rnd_bits
0058 #endif
0059
0060 #define SIZE_128M    (128 * 1024 * 1024UL)
0061
0062 static int mmap_is_legacy(void)
0063 {
0064     if (current->personality & ADDR_COMPAT_LAYOUT)
0065         return 1;
0066
0067     return sysctl_legacy_va_layout;
0068 }
0069
0070 static unsigned long arch_rnd(unsigned int rndbits)
0071 {
0072     if (!(current->flags & PF_RANDOMIZE))
0073         return 0;
0074     return (get_random_long() & ((1UL << rndbits) - 1)) << PAGE_SHIFT;
0075 }
0076
0077 unsigned long arch_mmap_rnd(void)
0078 {
0079     return arch_rnd(mmap_is_ia32() ? mmap32_rnd_bits : mmap64_rnd_bits);
0080 }
0081
0082 static unsigned long mmap_base(unsigned long rnd, unsigned long task_size,
0083                    struct rlimit *rlim_stack)
0084 {
0085     unsigned long gap = rlim_stack->rlim_cur;
0086     unsigned long pad = stack_maxrandom_size(task_size) + stack_guard_gap;
0087     unsigned long gap_min, gap_max;
0088
0089     /* Values close to RLIM_INFINITY can overflow. */
0090     if (gap + pad > gap)
0091         gap += pad;
0092
0093     /*
0094      * Top of mmap area (just below the process stack).
0095      * Leave an at least ~128 MB hole with possible stack randomization.
0096      */
0097     gap_min = SIZE_128M;
0098     gap_max = (task_size / 6) * 5;
0099
0100     if (gap < gap_min)
0101         gap = gap_min;
0102     else if (gap > gap_max)
0103         gap = gap_max;
0104
0105     return PAGE_ALIGN(task_size - gap - rnd);
0106 }
0107
0108 static unsigned long mmap_legacy_base(unsigned long rnd,
0109                       unsigned long task_size)
0110 {
0111     return __TASK_UNMAPPED_BASE(task_size) + rnd;
0112 }
0113
0114 /*
0115  * This function, called very early during the creation of a new
0116  * process VM image, sets up which VM layout function to use:
0117  */
0118 static void arch_pick_mmap_base(unsigned long *base, unsigned long *legacy_base,
0119         unsigned long random_factor, unsigned long task_size,
0120         struct rlimit *rlim_stack)
0121 {
0122     *legacy_base = mmap_legacy_base(random_factor, task_size);
0123     if (mmap_is_legacy())
0124         *base = *legacy_base;
0125     else
0126         *base = mmap_base(random_factor, task_size, rlim_stack);
0127 }
0128
0129 void arch_pick_mmap_layout(struct mm_struct *mm, struct rlimit *rlim_stack)
0130 {
0131     if (mmap_is_legacy())
0132         mm->get_unmapped_area = arch_get_unmapped_area;
0133     else
0134         mm->get_unmapped_area = arch_get_unmapped_area_topdown;
0135
0136     arch_pick_mmap_base(&mm->mmap_base, &mm->mmap_legacy_base,
0137             arch_rnd(mmap64_rnd_bits), task_size_64bit(0),
0138             rlim_stack);
0139
0140 #ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
0141     /*
0142      * The mmap syscall mapping base decision depends solely on the
0143      * syscall type (64-bit or compat). This applies for 64bit
0144      * applications and 32bit applications. The 64bit syscall uses
0145      * mmap_base, the compat syscall uses mmap_compat_base.
0146      */
0147     arch_pick_mmap_base(&mm->mmap_compat_base, &mm->mmap_compat_legacy_base,
0148             arch_rnd(mmap32_rnd_bits), task_size_32bit(),
0149             rlim_stack);
0150 #endif
0151 }
0152
0153 unsigned long get_mmap_base(int is_legacy)
0154 {
0155     struct mm_struct *mm = current->mm;
0156
0157 #ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
0158     if (in_32bit_syscall()) {
0159         return is_legacy ? mm->mmap_compat_legacy_base
0160                  : mm->mmap_compat_base;
0161     }
0162 #endif
0163     return is_legacy ? mm->mmap_legacy_base : mm->mmap_base;
0164 }
0165
0166 const char *arch_vma_name(struct vm_area_struct *vma)
0167 {
0168     return NULL;
0169 }
0170
0171 /**
0172  * mmap_address_hint_valid - Validate the address hint of mmap
0173  * @addr:   Address hint
0174  * @len:    Mapping length
0175  *
0176  * Check whether @addr and @addr + @len result in a valid mapping.
0177  *
0178  * On 32bit this only checks whether @addr + @len is <= TASK_SIZE.
0179  *
0180  * On 64bit with 5-level page tables another sanity check is required
0181  * because mappings requested by mmap(@addr, 0) which cross the 47-bit
0182  * virtual address boundary can cause the following theoretical issue:
0183  *
0184  *  An application calls mmap(addr, 0), i.e. without MAP_FIXED, where @addr
0185  *  is below the border of the 47-bit address space and @addr + @len is
0186  *  above the border.
0187  *
0188  *  With 4-level paging this request succeeds, but the resulting mapping
0189  *  address will always be within the 47-bit virtual address space, because
0190  *  the hint address does not result in a valid mapping and is
0191  *  ignored. Hence applications which are not prepared to handle virtual
0192  *  addresses above 47-bit work correctly.
0193  *
0194  *  With 5-level paging this request would be granted and result in a
0195  *  mapping which crosses the border of the 47-bit virtual address
0196  *  space. If the application cannot handle addresses above 47-bit this
0197  *  will lead to misbehaviour and hard to diagnose failures.
0198  *
0199  * Therefore ignore address hints which would result in a mapping crossing
0200  * the 47-bit virtual address boundary.
0201  *
0202  * Note, that in the same scenario with MAP_FIXED the behaviour is
0203  * different. The request with @addr < 47-bit and @addr + @len > 47-bit
0204  * fails on a 4-level paging machine but succeeds on a 5-level paging
0205  * machine. It is reasonable to expect that an application does not rely on
0206  * the failure of such a fixed mapping request, so the restriction is not
0207  * applied.
0208  */
0209 bool mmap_address_hint_valid(unsigned long addr, unsigned long len)
0210 {
0211     if (TASK_SIZE - len < addr)
0212         return false;
0213
0214     return (addr > DEFAULT_MAP_WINDOW) == (addr + len > DEFAULT_MAP_WINDOW);
0215 }
0216
0217 /* Can we access it for direct reading/writing? Must be RAM: */
0218 int valid_phys_addr_range(phys_addr_t addr, size_t count)
0219 {
0220     return addr + count - 1 <= __pa(high_memory - 1);
0221 }
0222
0223 /* Can we access it through mmap? Must be a valid physical address: */
0224 int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
0225 {
0226     phys_addr_t addr = (phys_addr_t)pfn << PAGE_SHIFT;
0227
0228     return phys_addr_valid(addr + count - 1);
0229 }
0230
0231 /*
0232  * Only allow root to set high MMIO mappings to PROT_NONE.
0233  * This prevents an unpriv. user to set them to PROT_NONE and invert
0234  * them, then pointing to valid memory for L1TF speculation.
0235  *
0236  * Note: for locked down kernels may want to disable the root override.
0237  */
0238 bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot)
0239 {
0240     if (!boot_cpu_has_bug(X86_BUG_L1TF))
0241         return true;
0242     if (!__pte_needs_invert(pgprot_val(prot)))
0243         return true;
0244     /* If it's real memory always allow */
0245     if (pfn_valid(pfn))
0246         return true;
0247     if (pfn >= l1tf_pfn_limit() && !capable(CAP_SYS_ADMIN))
0248         return false;
0249     return true;
0250 }