1 /* 2 * mm/mprotect.c 3 * 4 * (C) Copyright 1994 Linus Torvalds 5 * (C) Copyright 2002 Christoph Hellwig 6 * 7 * Address space accounting code <alan@redhat.com> 8 * (C) Copyright 2002 Red Hat Inc, All Rights Reserved 9 */ 10 11 #include <linux/mm.h> 12 #include <linux/hugetlb.h> 13 #include <linux/slab.h> 14 #include <linux/shm.h> 15 #include <linux/mman.h> 16 #include <linux/fs.h> 17 #include <linux/highmem.h> 18 #include <linux/security.h> 19 #include <linux/mempolicy.h> 20 #include <linux/personality.h> 21 22 #include <asm/uaccess.h> 23 #include <asm/pgtable.h> 24 #include <asm/cacheflush.h> 25 #include <asm/tlbflush.h> 26 27 static inline void 28 change_pte_range(pmd_t *pmd, unsigned long address, 29 unsigned long size, pgprot_t newprot) 30 { 31 pte_t * pte; 32 unsigned long end; 33 34 if (pmd_none(*pmd)) 35 return; 36 if (pmd_bad(*pmd)) { 37 pmd_ERROR(*pmd); 38 pmd_clear(pmd); 39 return; 40 } 41 pte = pte_offset_map(pmd, address); 42 address &= ~PMD_MASK; 43 end = address + size; 44 if (end > PMD_SIZE) 45 end = PMD_SIZE; 46 do { 47 if (pte_present(*pte)) { 48 pte_t entry; 49 50 /* Avoid an SMP race with hardware updated dirty/clean 51 * bits by wiping the pte and then setting the new pte 52 * into place. 53 */ 54 entry = pte_modify(ptep_get_and_clear(pte), newprot); 55 set_pte(pte, entry); 56 lazy_mmu_prot_update(entry); 57 } 58 address += PAGE_SIZE; 59 pte++; 60 } while (address && (address < end)); 61 pte_unmap(pte - 1); 62 } 63 64 static inline void 65 change_pmd_range(pgd_t *pgd, unsigned long address, 66 unsigned long size, pgprot_t newprot) 67 { 68 pmd_t * pmd; 69 unsigned long end; 70 71 if (pgd_none(*pgd)) 72 return; 73 if (pgd_bad(*pgd)) { 74 pgd_ERROR(*pgd); 75 pgd_clear(pgd); 76 return; 77 } 78 pmd = pmd_offset(pgd, address); 79 address &= ~PGDIR_MASK; 80 end = address + size; 81 if (end > PGDIR_SIZE) 82 end = PGDIR_SIZE; 83 do { 84 change_pte_range(pmd, address, end - address, newprot); 85 address = (address + PMD_SIZE) & PMD_MASK; 86 pmd++; 87 } while (address && (address < end)); 88 } 89 90 static void 91 change_protection(struct vm_area_struct *vma, unsigned long start, 92 unsigned long end, pgprot_t newprot) 93 { 94 pgd_t *dir; 95 unsigned long beg = start; 96 97 dir = pgd_offset(current->mm, start); 98 flush_cache_range(vma, beg, end); 99 if (start >= end) 100 BUG(); 101 spin_lock(¤t->mm->page_table_lock); 102 do { 103 change_pmd_range(dir, start, end - start, newprot); 104 start = (start + PGDIR_SIZE) & PGDIR_MASK; 105 dir++; 106 } while (start && (start < end)); 107 flush_tlb_range(vma, beg, end); 108 spin_unlock(¤t->mm->page_table_lock); 109 return; 110 } 111 112 static int 113 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev, 114 unsigned long start, unsigned long end, unsigned int newflags) 115 { 116 struct mm_struct * mm = vma->vm_mm; 117 unsigned long charged = 0; 118 pgprot_t newprot; 119 pgoff_t pgoff; 120 int error; 121 122 if (newflags == vma->vm_flags) { 123 *pprev = vma; 124 return 0; 125 } 126 127 /* 128 * If we make a private mapping writable we increase our commit; 129 * but (without finer accounting) cannot reduce our commit if we 130 * make it unwritable again. 131 * 132 * FIXME? We haven't defined a VM_NORESERVE flag, so mprotecting 133 * a MAP_NORESERVE private mapping to writable will now reserve. 134 */ 135 if (newflags & VM_WRITE) { 136 if (!(vma->vm_flags & (VM_ACCOUNT|VM_WRITE|VM_SHARED|VM_HUGETLB))) { 137 charged = (end - start) >> PAGE_SHIFT; 138 if (security_vm_enough_memory(charged)) 139 return -ENOMEM; 140 newflags |= VM_ACCOUNT; 141 } 142 } 143 144 newprot = protection_map[newflags & 0xf]; 145 146 /* 147 * First try to merge with previous and/or next vma. 148 */ 149 pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT); 150 *pprev = vma_merge(mm, *pprev, start, end, newflags, 151 vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma)); 152 if (*pprev) { 153 vma = *pprev; 154 goto success; 155 } 156 157 if (start != vma->vm_start) { 158 error = split_vma(mm, vma, start, 1); 159 if (error) 160 goto fail; 161 } 162 /* 163 * Unless it returns an error, this function always sets *pprev to 164 * the first vma for which vma->vm_end >= end. 165 */ 166 *pprev = vma; 167 168 if (end != vma->vm_end) { 169 error = split_vma(mm, vma, end, 0); 170 if (error) 171 goto fail; 172 } 173 174 success: 175 /* 176 * vm_flags and vm_page_prot are protected by the mmap_sem 177 * held in write mode. 178 */ 179 vma->vm_flags = newflags; 180 vma->vm_page_prot = newprot; 181 change_protection(vma, start, end, newprot); 182 return 0; 183 184 fail: 185 vm_unacct_memory(charged); 186 return error; 187 } 188 189 asmlinkage long 190 sys_mprotect(unsigned long start, size_t len, unsigned long prot) 191 { 192 unsigned long vm_flags, nstart, end, tmp; 193 struct vm_area_struct *vma, *prev; 194 int error = -EINVAL; 195 const int grows = prot & (PROT_GROWSDOWN|PROT_GROWSUP); 196 prot &= ~(PROT_GROWSDOWN|PROT_GROWSUP); 197 if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */ 198 return -EINVAL; 199 200 if (start & ~PAGE_MASK) 201 return -EINVAL; 202 len = PAGE_ALIGN(len); 203 end = start + len; 204 if (end < start) 205 return -ENOMEM; 206 if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM)) 207 return -EINVAL; 208 if (end == start) 209 return 0; 210 /* 211 * Does the application expect PROT_READ to imply PROT_EXEC: 212 */ 213 if (unlikely((prot & PROT_READ) && 214 (current->personality & READ_IMPLIES_EXEC))) 215 prot |= PROT_EXEC; 216 217 vm_flags = calc_vm_prot_bits(prot); 218 219 down_write(¤t->mm->mmap_sem); 220 221 vma = find_vma_prev(current->mm, start, &prev); 222 error = -ENOMEM; 223 if (!vma) 224 goto out; 225 if (unlikely(grows & PROT_GROWSDOWN)) { 226 if (vma->vm_start >= end) 227 goto out; 228 start = vma->vm_start; 229 error = -EINVAL; 230 if (!(vma->vm_flags & VM_GROWSDOWN)) 231 goto out; 232 } 233 else { 234 if (vma->vm_start > start) 235 goto out; 236 if (unlikely(grows & PROT_GROWSUP)) { 237 end = vma->vm_end; 238 error = -EINVAL; 239 if (!(vma->vm_flags & VM_GROWSUP)) 240 goto out; 241 } 242 } 243 if (start > vma->vm_start) 244 prev = vma; 245 246 for (nstart = start ; ; ) { 247 unsigned int newflags; 248 249 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */ 250 251 if (is_vm_hugetlb_page(vma)) { 252 error = -EACCES; 253 goto out; 254 } 255 256 newflags = vm_flags | (vma->vm_flags & ~(VM_READ | VM_WRITE | VM_EXEC)); 257 258 if ((newflags & ~(newflags >> 4)) & 0xf) { 259 error = -EACCES; 260 goto out; 261 } 262 263 error = security_file_mprotect(vma, prot); 264 if (error) 265 goto out; 266 267 tmp = vma->vm_end; 268 if (tmp > end) 269 tmp = end; 270 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags); 271 if (error) 272 goto out; 273 nstart = tmp; 274 275 if (nstart < prev->vm_end) 276 nstart = prev->vm_end; 277 if (nstart >= end) 278 goto out; 279 280 vma = prev->vm_next; 281 if (!vma || vma->vm_start != nstart) { 282 error = -ENOMEM; 283 goto out; 284 } 285 } 286 out: 287 up_write(¤t->mm->mmap_sem); 288 return error; 289 } 290
This page was automatically generated by LXR 0.3.1. • Linux is a registered trademark of Linus Torvalds