iov_iter.c 44 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. #include <crypto/hash.h>
  3. #include <linux/export.h>
  4. #include <linux/bvec.h>
  5. #include <linux/fault-inject-usercopy.h>
  6. #include <linux/uio.h>
  7. #include <linux/pagemap.h>
  8. #include <linux/slab.h>
  9. #include <linux/vmalloc.h>
  10. #include <linux/splice.h>
  11. #include <linux/compat.h>
  12. #include <net/checksum.h>
  13. #include <linux/scatterlist.h>
  14. #include <linux/instrumented.h>
  15. #define PIPE_PARANOIA /* for now */
  16. #define iterate_iovec(i, n, __v, __p, skip, STEP) { \
  17. size_t left; \
  18. size_t wanted = n; \
  19. __p = i->iov; \
  20. __v.iov_len = min(n, __p->iov_len - skip); \
  21. if (likely(__v.iov_len)) { \
  22. __v.iov_base = __p->iov_base + skip; \
  23. left = (STEP); \
  24. __v.iov_len -= left; \
  25. skip += __v.iov_len; \
  26. n -= __v.iov_len; \
  27. } else { \
  28. left = 0; \
  29. } \
  30. while (unlikely(!left && n)) { \
  31. __p++; \
  32. __v.iov_len = min(n, __p->iov_len); \
  33. if (unlikely(!__v.iov_len)) \
  34. continue; \
  35. __v.iov_base = __p->iov_base; \
  36. left = (STEP); \
  37. __v.iov_len -= left; \
  38. skip = __v.iov_len; \
  39. n -= __v.iov_len; \
  40. } \
  41. n = wanted - n; \
  42. }
  43. #define iterate_kvec(i, n, __v, __p, skip, STEP) { \
  44. size_t wanted = n; \
  45. __p = i->kvec; \
  46. __v.iov_len = min(n, __p->iov_len - skip); \
  47. if (likely(__v.iov_len)) { \
  48. __v.iov_base = __p->iov_base + skip; \
  49. (void)(STEP); \
  50. skip += __v.iov_len; \
  51. n -= __v.iov_len; \
  52. } \
  53. while (unlikely(n)) { \
  54. __p++; \
  55. __v.iov_len = min(n, __p->iov_len); \
  56. if (unlikely(!__v.iov_len)) \
  57. continue; \
  58. __v.iov_base = __p->iov_base; \
  59. (void)(STEP); \
  60. skip = __v.iov_len; \
  61. n -= __v.iov_len; \
  62. } \
  63. n = wanted; \
  64. }
  65. #define iterate_bvec(i, n, __v, __bi, skip, STEP) { \
  66. struct bvec_iter __start; \
  67. __start.bi_size = n; \
  68. __start.bi_bvec_done = skip; \
  69. __start.bi_idx = 0; \
  70. for_each_bvec(__v, i->bvec, __bi, __start) { \
  71. if (!__v.bv_len) \
  72. continue; \
  73. (void)(STEP); \
  74. } \
  75. }
  76. #define iterate_all_kinds(i, n, v, I, B, K) { \
  77. if (likely(n)) { \
  78. size_t skip = i->iov_offset; \
  79. if (unlikely(i->type & ITER_BVEC)) { \
  80. struct bio_vec v; \
  81. struct bvec_iter __bi; \
  82. iterate_bvec(i, n, v, __bi, skip, (B)) \
  83. } else if (unlikely(i->type & ITER_KVEC)) { \
  84. const struct kvec *kvec; \
  85. struct kvec v; \
  86. iterate_kvec(i, n, v, kvec, skip, (K)) \
  87. } else if (unlikely(i->type & ITER_DISCARD)) { \
  88. } else { \
  89. const struct iovec *iov; \
  90. struct iovec v; \
  91. iterate_iovec(i, n, v, iov, skip, (I)) \
  92. } \
  93. } \
  94. }
  95. #define iterate_and_advance(i, n, v, I, B, K) { \
  96. if (unlikely(i->count < n)) \
  97. n = i->count; \
  98. if (i->count) { \
  99. size_t skip = i->iov_offset; \
  100. if (unlikely(i->type & ITER_BVEC)) { \
  101. const struct bio_vec *bvec = i->bvec; \
  102. struct bio_vec v; \
  103. struct bvec_iter __bi; \
  104. iterate_bvec(i, n, v, __bi, skip, (B)) \
  105. i->bvec = __bvec_iter_bvec(i->bvec, __bi); \
  106. i->nr_segs -= i->bvec - bvec; \
  107. skip = __bi.bi_bvec_done; \
  108. } else if (unlikely(i->type & ITER_KVEC)) { \
  109. const struct kvec *kvec; \
  110. struct kvec v; \
  111. iterate_kvec(i, n, v, kvec, skip, (K)) \
  112. if (skip == kvec->iov_len) { \
  113. kvec++; \
  114. skip = 0; \
  115. } \
  116. i->nr_segs -= kvec - i->kvec; \
  117. i->kvec = kvec; \
  118. } else if (unlikely(i->type & ITER_DISCARD)) { \
  119. skip += n; \
  120. } else { \
  121. const struct iovec *iov; \
  122. struct iovec v; \
  123. iterate_iovec(i, n, v, iov, skip, (I)) \
  124. if (skip == iov->iov_len) { \
  125. iov++; \
  126. skip = 0; \
  127. } \
  128. i->nr_segs -= iov - i->iov; \
  129. i->iov = iov; \
  130. } \
  131. i->count -= n; \
  132. i->iov_offset = skip; \
  133. } \
  134. }
  135. static int copyout(void __user *to, const void *from, size_t n)
  136. {
  137. if (should_fail_usercopy())
  138. return n;
  139. if (access_ok(to, n)) {
  140. instrument_copy_to_user(to, from, n);
  141. n = raw_copy_to_user(to, from, n);
  142. }
  143. return n;
  144. }
  145. static int copyin(void *to, const void __user *from, size_t n)
  146. {
  147. if (should_fail_usercopy())
  148. return n;
  149. if (access_ok(from, n)) {
  150. instrument_copy_from_user(to, from, n);
  151. n = raw_copy_from_user(to, from, n);
  152. }
  153. return n;
  154. }
  155. static size_t copy_page_to_iter_iovec(struct page *page, size_t offset, size_t bytes,
  156. struct iov_iter *i)
  157. {
  158. size_t skip, copy, left, wanted;
  159. const struct iovec *iov;
  160. char __user *buf;
  161. void *kaddr, *from;
  162. if (unlikely(bytes > i->count))
  163. bytes = i->count;
  164. if (unlikely(!bytes))
  165. return 0;
  166. might_fault();
  167. wanted = bytes;
  168. iov = i->iov;
  169. skip = i->iov_offset;
  170. buf = iov->iov_base + skip;
  171. copy = min(bytes, iov->iov_len - skip);
  172. if (IS_ENABLED(CONFIG_HIGHMEM) && !fault_in_pages_writeable(buf, copy)) {
  173. kaddr = kmap_atomic(page);
  174. from = kaddr + offset;
  175. /* first chunk, usually the only one */
  176. left = copyout(buf, from, copy);
  177. copy -= left;
  178. skip += copy;
  179. from += copy;
  180. bytes -= copy;
  181. while (unlikely(!left && bytes)) {
  182. iov++;
  183. buf = iov->iov_base;
  184. copy = min(bytes, iov->iov_len);
  185. left = copyout(buf, from, copy);
  186. copy -= left;
  187. skip = copy;
  188. from += copy;
  189. bytes -= copy;
  190. }
  191. if (likely(!bytes)) {
  192. kunmap_atomic(kaddr);
  193. goto done;
  194. }
  195. offset = from - kaddr;
  196. buf += copy;
  197. kunmap_atomic(kaddr);
  198. copy = min(bytes, iov->iov_len - skip);
  199. }
  200. /* Too bad - revert to non-atomic kmap */
  201. kaddr = kmap(page);
  202. from = kaddr + offset;
  203. left = copyout(buf, from, copy);
  204. copy -= left;
  205. skip += copy;
  206. from += copy;
  207. bytes -= copy;
  208. while (unlikely(!left && bytes)) {
  209. iov++;
  210. buf = iov->iov_base;
  211. copy = min(bytes, iov->iov_len);
  212. left = copyout(buf, from, copy);
  213. copy -= left;
  214. skip = copy;
  215. from += copy;
  216. bytes -= copy;
  217. }
  218. kunmap(page);
  219. done:
  220. if (skip == iov->iov_len) {
  221. iov++;
  222. skip = 0;
  223. }
  224. i->count -= wanted - bytes;
  225. i->nr_segs -= iov - i->iov;
  226. i->iov = iov;
  227. i->iov_offset = skip;
  228. return wanted - bytes;
  229. }
  230. static size_t copy_page_from_iter_iovec(struct page *page, size_t offset, size_t bytes,
  231. struct iov_iter *i)
  232. {
  233. size_t skip, copy, left, wanted;
  234. const struct iovec *iov;
  235. char __user *buf;
  236. void *kaddr, *to;
  237. if (unlikely(bytes > i->count))
  238. bytes = i->count;
  239. if (unlikely(!bytes))
  240. return 0;
  241. might_fault();
  242. wanted = bytes;
  243. iov = i->iov;
  244. skip = i->iov_offset;
  245. buf = iov->iov_base + skip;
  246. copy = min(bytes, iov->iov_len - skip);
  247. if (IS_ENABLED(CONFIG_HIGHMEM) && !fault_in_pages_readable(buf, copy)) {
  248. kaddr = kmap_atomic(page);
  249. to = kaddr + offset;
  250. /* first chunk, usually the only one */
  251. left = copyin(to, buf, copy);
  252. copy -= left;
  253. skip += copy;
  254. to += copy;
  255. bytes -= copy;
  256. while (unlikely(!left && bytes)) {
  257. iov++;
  258. buf = iov->iov_base;
  259. copy = min(bytes, iov->iov_len);
  260. left = copyin(to, buf, copy);
  261. copy -= left;
  262. skip = copy;
  263. to += copy;
  264. bytes -= copy;
  265. }
  266. if (likely(!bytes)) {
  267. kunmap_atomic(kaddr);
  268. goto done;
  269. }
  270. offset = to - kaddr;
  271. buf += copy;
  272. kunmap_atomic(kaddr);
  273. copy = min(bytes, iov->iov_len - skip);
  274. }
  275. /* Too bad - revert to non-atomic kmap */
  276. kaddr = kmap(page);
  277. to = kaddr + offset;
  278. left = copyin(to, buf, copy);
  279. copy -= left;
  280. skip += copy;
  281. to += copy;
  282. bytes -= copy;
  283. while (unlikely(!left && bytes)) {
  284. iov++;
  285. buf = iov->iov_base;
  286. copy = min(bytes, iov->iov_len);
  287. left = copyin(to, buf, copy);
  288. copy -= left;
  289. skip = copy;
  290. to += copy;
  291. bytes -= copy;
  292. }
  293. kunmap(page);
  294. done:
  295. if (skip == iov->iov_len) {
  296. iov++;
  297. skip = 0;
  298. }
  299. i->count -= wanted - bytes;
  300. i->nr_segs -= iov - i->iov;
  301. i->iov = iov;
  302. i->iov_offset = skip;
  303. return wanted - bytes;
  304. }
  305. #ifdef PIPE_PARANOIA
  306. static bool sanity(const struct iov_iter *i)
  307. {
  308. struct pipe_inode_info *pipe = i->pipe;
  309. unsigned int p_head = pipe->head;
  310. unsigned int p_tail = pipe->tail;
  311. unsigned int p_mask = pipe->ring_size - 1;
  312. unsigned int p_occupancy = pipe_occupancy(p_head, p_tail);
  313. unsigned int i_head = i->head;
  314. unsigned int idx;
  315. if (i->iov_offset) {
  316. struct pipe_buffer *p;
  317. if (unlikely(p_occupancy == 0))
  318. goto Bad; // pipe must be non-empty
  319. if (unlikely(i_head != p_head - 1))
  320. goto Bad; // must be at the last buffer...
  321. p = &pipe->bufs[i_head & p_mask];
  322. if (unlikely(p->offset + p->len != i->iov_offset))
  323. goto Bad; // ... at the end of segment
  324. } else {
  325. if (i_head != p_head)
  326. goto Bad; // must be right after the last buffer
  327. }
  328. return true;
  329. Bad:
  330. printk(KERN_ERR "idx = %d, offset = %zd\n", i_head, i->iov_offset);
  331. printk(KERN_ERR "head = %d, tail = %d, buffers = %d\n",
  332. p_head, p_tail, pipe->ring_size);
  333. for (idx = 0; idx < pipe->ring_size; idx++)
  334. printk(KERN_ERR "[%p %p %d %d]\n",
  335. pipe->bufs[idx].ops,
  336. pipe->bufs[idx].page,
  337. pipe->bufs[idx].offset,
  338. pipe->bufs[idx].len);
  339. WARN_ON(1);
  340. return false;
  341. }
  342. #else
  343. #define sanity(i) true
  344. #endif
  345. static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t bytes,
  346. struct iov_iter *i)
  347. {
  348. struct pipe_inode_info *pipe = i->pipe;
  349. struct pipe_buffer *buf;
  350. unsigned int p_tail = pipe->tail;
  351. unsigned int p_mask = pipe->ring_size - 1;
  352. unsigned int i_head = i->head;
  353. size_t off;
  354. if (unlikely(bytes > i->count))
  355. bytes = i->count;
  356. if (unlikely(!bytes))
  357. return 0;
  358. if (!sanity(i))
  359. return 0;
  360. off = i->iov_offset;
  361. buf = &pipe->bufs[i_head & p_mask];
  362. if (off) {
  363. if (offset == off && buf->page == page) {
  364. /* merge with the last one */
  365. buf->len += bytes;
  366. i->iov_offset += bytes;
  367. goto out;
  368. }
  369. i_head++;
  370. buf = &pipe->bufs[i_head & p_mask];
  371. }
  372. if (pipe_full(i_head, p_tail, pipe->max_usage))
  373. return 0;
  374. buf->ops = &page_cache_pipe_buf_ops;
  375. buf->flags = 0;
  376. get_page(page);
  377. buf->page = page;
  378. buf->offset = offset;
  379. buf->len = bytes;
  380. pipe->head = i_head + 1;
  381. i->iov_offset = offset + bytes;
  382. i->head = i_head;
  383. out:
  384. i->count -= bytes;
  385. return bytes;
  386. }
  387. /*
  388. * Fault in one or more iovecs of the given iov_iter, to a maximum length of
  389. * bytes. For each iovec, fault in each page that constitutes the iovec.
  390. *
  391. * Return 0 on success, or non-zero if the memory could not be accessed (i.e.
  392. * because it is an invalid address).
  393. */
  394. int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
  395. {
  396. size_t skip = i->iov_offset;
  397. const struct iovec *iov;
  398. int err;
  399. struct iovec v;
  400. if (iter_is_iovec(i)) {
  401. iterate_iovec(i, bytes, v, iov, skip, ({
  402. err = fault_in_pages_readable(v.iov_base, v.iov_len);
  403. if (unlikely(err))
  404. return err;
  405. 0;}))
  406. }
  407. return 0;
  408. }
  409. EXPORT_SYMBOL(iov_iter_fault_in_readable);
  410. void iov_iter_init(struct iov_iter *i, unsigned int direction,
  411. const struct iovec *iov, unsigned long nr_segs,
  412. size_t count)
  413. {
  414. WARN_ON(direction & ~(READ | WRITE));
  415. direction &= READ | WRITE;
  416. /* It will get better. Eventually... */
  417. if (uaccess_kernel()) {
  418. i->type = ITER_KVEC | direction;
  419. i->kvec = (struct kvec *)iov;
  420. } else {
  421. i->type = ITER_IOVEC | direction;
  422. i->iov = iov;
  423. }
  424. i->nr_segs = nr_segs;
  425. i->iov_offset = 0;
  426. i->count = count;
  427. }
  428. EXPORT_SYMBOL(iov_iter_init);
  429. static void memcpy_from_page(char *to, struct page *page, size_t offset, size_t len)
  430. {
  431. char *from = kmap_atomic(page);
  432. memcpy(to, from + offset, len);
  433. kunmap_atomic(from);
  434. }
  435. static void memcpy_to_page(struct page *page, size_t offset, const char *from, size_t len)
  436. {
  437. char *to = kmap_atomic(page);
  438. memcpy(to + offset, from, len);
  439. kunmap_atomic(to);
  440. }
  441. static void memzero_page(struct page *page, size_t offset, size_t len)
  442. {
  443. char *addr = kmap_atomic(page);
  444. memset(addr + offset, 0, len);
  445. kunmap_atomic(addr);
  446. }
  447. static inline bool allocated(struct pipe_buffer *buf)
  448. {
  449. return buf->ops == &default_pipe_buf_ops;
  450. }
  451. static inline void data_start(const struct iov_iter *i,
  452. unsigned int *iter_headp, size_t *offp)
  453. {
  454. unsigned int p_mask = i->pipe->ring_size - 1;
  455. unsigned int iter_head = i->head;
  456. size_t off = i->iov_offset;
  457. if (off && (!allocated(&i->pipe->bufs[iter_head & p_mask]) ||
  458. off == PAGE_SIZE)) {
  459. iter_head++;
  460. off = 0;
  461. }
  462. *iter_headp = iter_head;
  463. *offp = off;
  464. }
  465. static size_t push_pipe(struct iov_iter *i, size_t size,
  466. int *iter_headp, size_t *offp)
  467. {
  468. struct pipe_inode_info *pipe = i->pipe;
  469. unsigned int p_tail = pipe->tail;
  470. unsigned int p_mask = pipe->ring_size - 1;
  471. unsigned int iter_head;
  472. size_t off;
  473. ssize_t left;
  474. if (unlikely(size > i->count))
  475. size = i->count;
  476. if (unlikely(!size))
  477. return 0;
  478. left = size;
  479. data_start(i, &iter_head, &off);
  480. *iter_headp = iter_head;
  481. *offp = off;
  482. if (off) {
  483. left -= PAGE_SIZE - off;
  484. if (left <= 0) {
  485. pipe->bufs[iter_head & p_mask].len += size;
  486. return size;
  487. }
  488. pipe->bufs[iter_head & p_mask].len = PAGE_SIZE;
  489. iter_head++;
  490. }
  491. while (!pipe_full(iter_head, p_tail, pipe->max_usage)) {
  492. struct pipe_buffer *buf = &pipe->bufs[iter_head & p_mask];
  493. struct page *page = alloc_page(GFP_USER);
  494. if (!page)
  495. break;
  496. buf->ops = &default_pipe_buf_ops;
  497. buf->flags = 0;
  498. buf->page = page;
  499. buf->offset = 0;
  500. buf->len = min_t(ssize_t, left, PAGE_SIZE);
  501. left -= buf->len;
  502. iter_head++;
  503. pipe->head = iter_head;
  504. if (left == 0)
  505. return size;
  506. }
  507. return size - left;
  508. }
  509. static size_t copy_pipe_to_iter(const void *addr, size_t bytes,
  510. struct iov_iter *i)
  511. {
  512. struct pipe_inode_info *pipe = i->pipe;
  513. unsigned int p_mask = pipe->ring_size - 1;
  514. unsigned int i_head;
  515. size_t n, off;
  516. if (!sanity(i))
  517. return 0;
  518. bytes = n = push_pipe(i, bytes, &i_head, &off);
  519. if (unlikely(!n))
  520. return 0;
  521. do {
  522. size_t chunk = min_t(size_t, n, PAGE_SIZE - off);
  523. memcpy_to_page(pipe->bufs[i_head & p_mask].page, off, addr, chunk);
  524. i->head = i_head;
  525. i->iov_offset = off + chunk;
  526. n -= chunk;
  527. addr += chunk;
  528. off = 0;
  529. i_head++;
  530. } while (n);
  531. i->count -= bytes;
  532. return bytes;
  533. }
  534. static __wsum csum_and_memcpy(void *to, const void *from, size_t len,
  535. __wsum sum, size_t off)
  536. {
  537. __wsum next = csum_partial_copy_nocheck(from, to, len);
  538. return csum_block_add(sum, next, off);
  539. }
  540. static size_t csum_and_copy_to_pipe_iter(const void *addr, size_t bytes,
  541. struct csum_state *csstate,
  542. struct iov_iter *i)
  543. {
  544. struct pipe_inode_info *pipe = i->pipe;
  545. unsigned int p_mask = pipe->ring_size - 1;
  546. __wsum sum = csstate->csum;
  547. size_t off = csstate->off;
  548. unsigned int i_head;
  549. size_t n, r;
  550. if (!sanity(i))
  551. return 0;
  552. bytes = n = push_pipe(i, bytes, &i_head, &r);
  553. if (unlikely(!n))
  554. return 0;
  555. do {
  556. size_t chunk = min_t(size_t, n, PAGE_SIZE - r);
  557. char *p = kmap_atomic(pipe->bufs[i_head & p_mask].page);
  558. sum = csum_and_memcpy(p + r, addr, chunk, sum, off);
  559. kunmap_atomic(p);
  560. i->head = i_head;
  561. i->iov_offset = r + chunk;
  562. n -= chunk;
  563. off += chunk;
  564. addr += chunk;
  565. r = 0;
  566. i_head++;
  567. } while (n);
  568. i->count -= bytes;
  569. csstate->csum = sum;
  570. csstate->off = off;
  571. return bytes;
  572. }
  573. size_t _copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
  574. {
  575. const char *from = addr;
  576. if (unlikely(iov_iter_is_pipe(i)))
  577. return copy_pipe_to_iter(addr, bytes, i);
  578. if (iter_is_iovec(i))
  579. might_fault();
  580. iterate_and_advance(i, bytes, v,
  581. copyout(v.iov_base, (from += v.iov_len) - v.iov_len, v.iov_len),
  582. memcpy_to_page(v.bv_page, v.bv_offset,
  583. (from += v.bv_len) - v.bv_len, v.bv_len),
  584. memcpy(v.iov_base, (from += v.iov_len) - v.iov_len, v.iov_len)
  585. )
  586. return bytes;
  587. }
  588. EXPORT_SYMBOL(_copy_to_iter);
  589. #ifdef CONFIG_ARCH_HAS_COPY_MC
  590. static int copyout_mc(void __user *to, const void *from, size_t n)
  591. {
  592. if (access_ok(to, n)) {
  593. instrument_copy_to_user(to, from, n);
  594. n = copy_mc_to_user((__force void *) to, from, n);
  595. }
  596. return n;
  597. }
  598. static unsigned long copy_mc_to_page(struct page *page, size_t offset,
  599. const char *from, size_t len)
  600. {
  601. unsigned long ret;
  602. char *to;
  603. to = kmap_atomic(page);
  604. ret = copy_mc_to_kernel(to + offset, from, len);
  605. kunmap_atomic(to);
  606. return ret;
  607. }
  608. static size_t copy_mc_pipe_to_iter(const void *addr, size_t bytes,
  609. struct iov_iter *i)
  610. {
  611. struct pipe_inode_info *pipe = i->pipe;
  612. unsigned int p_mask = pipe->ring_size - 1;
  613. unsigned int i_head;
  614. size_t n, off, xfer = 0;
  615. if (!sanity(i))
  616. return 0;
  617. bytes = n = push_pipe(i, bytes, &i_head, &off);
  618. if (unlikely(!n))
  619. return 0;
  620. do {
  621. size_t chunk = min_t(size_t, n, PAGE_SIZE - off);
  622. unsigned long rem;
  623. rem = copy_mc_to_page(pipe->bufs[i_head & p_mask].page,
  624. off, addr, chunk);
  625. i->head = i_head;
  626. i->iov_offset = off + chunk - rem;
  627. xfer += chunk - rem;
  628. if (rem)
  629. break;
  630. n -= chunk;
  631. addr += chunk;
  632. off = 0;
  633. i_head++;
  634. } while (n);
  635. i->count -= xfer;
  636. return xfer;
  637. }
  638. /**
  639. * _copy_mc_to_iter - copy to iter with source memory error exception handling
  640. * @addr: source kernel address
  641. * @bytes: total transfer length
  642. * @iter: destination iterator
  643. *
  644. * The pmem driver deploys this for the dax operation
  645. * (dax_copy_to_iter()) for dax reads (bypass page-cache and the
  646. * block-layer). Upon #MC read(2) aborts and returns EIO or the bytes
  647. * successfully copied.
  648. *
  649. * The main differences between this and typical _copy_to_iter().
  650. *
  651. * * Typical tail/residue handling after a fault retries the copy
  652. * byte-by-byte until the fault happens again. Re-triggering machine
  653. * checks is potentially fatal so the implementation uses source
  654. * alignment and poison alignment assumptions to avoid re-triggering
  655. * hardware exceptions.
  656. *
  657. * * ITER_KVEC, ITER_PIPE, and ITER_BVEC can return short copies.
  658. * Compare to copy_to_iter() where only ITER_IOVEC attempts might return
  659. * a short copy.
  660. */
  661. size_t _copy_mc_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
  662. {
  663. const char *from = addr;
  664. unsigned long rem, curr_addr, s_addr = (unsigned long) addr;
  665. if (unlikely(iov_iter_is_pipe(i)))
  666. return copy_mc_pipe_to_iter(addr, bytes, i);
  667. if (iter_is_iovec(i))
  668. might_fault();
  669. iterate_and_advance(i, bytes, v,
  670. copyout_mc(v.iov_base, (from += v.iov_len) - v.iov_len,
  671. v.iov_len),
  672. ({
  673. rem = copy_mc_to_page(v.bv_page, v.bv_offset,
  674. (from += v.bv_len) - v.bv_len, v.bv_len);
  675. if (rem) {
  676. curr_addr = (unsigned long) from;
  677. bytes = curr_addr - s_addr - rem;
  678. return bytes;
  679. }
  680. }),
  681. ({
  682. rem = copy_mc_to_kernel(v.iov_base, (from += v.iov_len)
  683. - v.iov_len, v.iov_len);
  684. if (rem) {
  685. curr_addr = (unsigned long) from;
  686. bytes = curr_addr - s_addr - rem;
  687. return bytes;
  688. }
  689. })
  690. )
  691. return bytes;
  692. }
  693. EXPORT_SYMBOL_GPL(_copy_mc_to_iter);
  694. #endif /* CONFIG_ARCH_HAS_COPY_MC */
  695. size_t _copy_from_iter(void *addr, size_t bytes, struct iov_iter *i)
  696. {
  697. char *to = addr;
  698. if (unlikely(iov_iter_is_pipe(i))) {
  699. WARN_ON(1);
  700. return 0;
  701. }
  702. if (iter_is_iovec(i))
  703. might_fault();
  704. iterate_and_advance(i, bytes, v,
  705. copyin((to += v.iov_len) - v.iov_len, v.iov_base, v.iov_len),
  706. memcpy_from_page((to += v.bv_len) - v.bv_len, v.bv_page,
  707. v.bv_offset, v.bv_len),
  708. memcpy((to += v.iov_len) - v.iov_len, v.iov_base, v.iov_len)
  709. )
  710. return bytes;
  711. }
  712. EXPORT_SYMBOL(_copy_from_iter);
  713. bool _copy_from_iter_full(void *addr, size_t bytes, struct iov_iter *i)
  714. {
  715. char *to = addr;
  716. if (unlikely(iov_iter_is_pipe(i))) {
  717. WARN_ON(1);
  718. return false;
  719. }
  720. if (unlikely(i->count < bytes))
  721. return false;
  722. if (iter_is_iovec(i))
  723. might_fault();
  724. iterate_all_kinds(i, bytes, v, ({
  725. if (copyin((to += v.iov_len) - v.iov_len,
  726. v.iov_base, v.iov_len))
  727. return false;
  728. 0;}),
  729. memcpy_from_page((to += v.bv_len) - v.bv_len, v.bv_page,
  730. v.bv_offset, v.bv_len),
  731. memcpy((to += v.iov_len) - v.iov_len, v.iov_base, v.iov_len)
  732. )
  733. iov_iter_advance(i, bytes);
  734. return true;
  735. }
  736. EXPORT_SYMBOL(_copy_from_iter_full);
  737. size_t _copy_from_iter_nocache(void *addr, size_t bytes, struct iov_iter *i)
  738. {
  739. char *to = addr;
  740. if (unlikely(iov_iter_is_pipe(i))) {
  741. WARN_ON(1);
  742. return 0;
  743. }
  744. iterate_and_advance(i, bytes, v,
  745. __copy_from_user_inatomic_nocache((to += v.iov_len) - v.iov_len,
  746. v.iov_base, v.iov_len),
  747. memcpy_from_page((to += v.bv_len) - v.bv_len, v.bv_page,
  748. v.bv_offset, v.bv_len),
  749. memcpy((to += v.iov_len) - v.iov_len, v.iov_base, v.iov_len)
  750. )
  751. return bytes;
  752. }
  753. EXPORT_SYMBOL(_copy_from_iter_nocache);
  754. #ifdef CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE
  755. /**
  756. * _copy_from_iter_flushcache - write destination through cpu cache
  757. * @addr: destination kernel address
  758. * @bytes: total transfer length
  759. * @iter: source iterator
  760. *
  761. * The pmem driver arranges for filesystem-dax to use this facility via
  762. * dax_copy_from_iter() for ensuring that writes to persistent memory
  763. * are flushed through the CPU cache. It is differentiated from
  764. * _copy_from_iter_nocache() in that guarantees all data is flushed for
  765. * all iterator types. The _copy_from_iter_nocache() only attempts to
  766. * bypass the cache for the ITER_IOVEC case, and on some archs may use
  767. * instructions that strand dirty-data in the cache.
  768. */
  769. size_t _copy_from_iter_flushcache(void *addr, size_t bytes, struct iov_iter *i)
  770. {
  771. char *to = addr;
  772. if (unlikely(iov_iter_is_pipe(i))) {
  773. WARN_ON(1);
  774. return 0;
  775. }
  776. iterate_and_advance(i, bytes, v,
  777. __copy_from_user_flushcache((to += v.iov_len) - v.iov_len,
  778. v.iov_base, v.iov_len),
  779. memcpy_page_flushcache((to += v.bv_len) - v.bv_len, v.bv_page,
  780. v.bv_offset, v.bv_len),
  781. memcpy_flushcache((to += v.iov_len) - v.iov_len, v.iov_base,
  782. v.iov_len)
  783. )
  784. return bytes;
  785. }
  786. EXPORT_SYMBOL_GPL(_copy_from_iter_flushcache);
  787. #endif
  788. bool _copy_from_iter_full_nocache(void *addr, size_t bytes, struct iov_iter *i)
  789. {
  790. char *to = addr;
  791. if (unlikely(iov_iter_is_pipe(i))) {
  792. WARN_ON(1);
  793. return false;
  794. }
  795. if (unlikely(i->count < bytes))
  796. return false;
  797. iterate_all_kinds(i, bytes, v, ({
  798. if (__copy_from_user_inatomic_nocache((to += v.iov_len) - v.iov_len,
  799. v.iov_base, v.iov_len))
  800. return false;
  801. 0;}),
  802. memcpy_from_page((to += v.bv_len) - v.bv_len, v.bv_page,
  803. v.bv_offset, v.bv_len),
  804. memcpy((to += v.iov_len) - v.iov_len, v.iov_base, v.iov_len)
  805. )
  806. iov_iter_advance(i, bytes);
  807. return true;
  808. }
  809. EXPORT_SYMBOL(_copy_from_iter_full_nocache);
  810. static inline bool page_copy_sane(struct page *page, size_t offset, size_t n)
  811. {
  812. struct page *head;
  813. size_t v = n + offset;
  814. /*
  815. * The general case needs to access the page order in order
  816. * to compute the page size.
  817. * However, we mostly deal with order-0 pages and thus can
  818. * avoid a possible cache line miss for requests that fit all
  819. * page orders.
  820. */
  821. if (n <= v && v <= PAGE_SIZE)
  822. return true;
  823. head = compound_head(page);
  824. v += (page - head) << PAGE_SHIFT;
  825. if (likely(n <= v && v <= (page_size(head))))
  826. return true;
  827. WARN_ON(1);
  828. return false;
  829. }
  830. size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
  831. struct iov_iter *i)
  832. {
  833. if (unlikely(!page_copy_sane(page, offset, bytes)))
  834. return 0;
  835. if (i->type & (ITER_BVEC|ITER_KVEC)) {
  836. void *kaddr = kmap_atomic(page);
  837. size_t wanted = copy_to_iter(kaddr + offset, bytes, i);
  838. kunmap_atomic(kaddr);
  839. return wanted;
  840. } else if (unlikely(iov_iter_is_discard(i))) {
  841. if (unlikely(i->count < bytes))
  842. bytes = i->count;
  843. i->count -= bytes;
  844. return bytes;
  845. } else if (likely(!iov_iter_is_pipe(i)))
  846. return copy_page_to_iter_iovec(page, offset, bytes, i);
  847. else
  848. return copy_page_to_iter_pipe(page, offset, bytes, i);
  849. }
  850. EXPORT_SYMBOL(copy_page_to_iter);
  851. size_t copy_page_from_iter(struct page *page, size_t offset, size_t bytes,
  852. struct iov_iter *i)
  853. {
  854. if (unlikely(!page_copy_sane(page, offset, bytes)))
  855. return 0;
  856. if (unlikely(iov_iter_is_pipe(i) || iov_iter_is_discard(i))) {
  857. WARN_ON(1);
  858. return 0;
  859. }
  860. if (i->type & (ITER_BVEC|ITER_KVEC)) {
  861. void *kaddr = kmap_atomic(page);
  862. size_t wanted = _copy_from_iter(kaddr + offset, bytes, i);
  863. kunmap_atomic(kaddr);
  864. return wanted;
  865. } else
  866. return copy_page_from_iter_iovec(page, offset, bytes, i);
  867. }
  868. EXPORT_SYMBOL(copy_page_from_iter);
  869. static size_t pipe_zero(size_t bytes, struct iov_iter *i)
  870. {
  871. struct pipe_inode_info *pipe = i->pipe;
  872. unsigned int p_mask = pipe->ring_size - 1;
  873. unsigned int i_head;
  874. size_t n, off;
  875. if (!sanity(i))
  876. return 0;
  877. bytes = n = push_pipe(i, bytes, &i_head, &off);
  878. if (unlikely(!n))
  879. return 0;
  880. do {
  881. size_t chunk = min_t(size_t, n, PAGE_SIZE - off);
  882. memzero_page(pipe->bufs[i_head & p_mask].page, off, chunk);
  883. i->head = i_head;
  884. i->iov_offset = off + chunk;
  885. n -= chunk;
  886. off = 0;
  887. i_head++;
  888. } while (n);
  889. i->count -= bytes;
  890. return bytes;
  891. }
  892. size_t iov_iter_zero(size_t bytes, struct iov_iter *i)
  893. {
  894. if (unlikely(iov_iter_is_pipe(i)))
  895. return pipe_zero(bytes, i);
  896. iterate_and_advance(i, bytes, v,
  897. clear_user(v.iov_base, v.iov_len),
  898. memzero_page(v.bv_page, v.bv_offset, v.bv_len),
  899. memset(v.iov_base, 0, v.iov_len)
  900. )
  901. return bytes;
  902. }
  903. EXPORT_SYMBOL(iov_iter_zero);
  904. size_t iov_iter_copy_from_user_atomic(struct page *page,
  905. struct iov_iter *i, unsigned long offset, size_t bytes)
  906. {
  907. char *kaddr = kmap_atomic(page), *p = kaddr + offset;
  908. if (unlikely(!page_copy_sane(page, offset, bytes))) {
  909. kunmap_atomic(kaddr);
  910. return 0;
  911. }
  912. if (unlikely(iov_iter_is_pipe(i) || iov_iter_is_discard(i))) {
  913. kunmap_atomic(kaddr);
  914. WARN_ON(1);
  915. return 0;
  916. }
  917. iterate_all_kinds(i, bytes, v,
  918. copyin((p += v.iov_len) - v.iov_len, v.iov_base, v.iov_len),
  919. memcpy_from_page((p += v.bv_len) - v.bv_len, v.bv_page,
  920. v.bv_offset, v.bv_len),
  921. memcpy((p += v.iov_len) - v.iov_len, v.iov_base, v.iov_len)
  922. )
  923. kunmap_atomic(kaddr);
  924. return bytes;
  925. }
  926. EXPORT_SYMBOL(iov_iter_copy_from_user_atomic);
  927. static inline void pipe_truncate(struct iov_iter *i)
  928. {
  929. struct pipe_inode_info *pipe = i->pipe;
  930. unsigned int p_tail = pipe->tail;
  931. unsigned int p_head = pipe->head;
  932. unsigned int p_mask = pipe->ring_size - 1;
  933. if (!pipe_empty(p_head, p_tail)) {
  934. struct pipe_buffer *buf;
  935. unsigned int i_head = i->head;
  936. size_t off = i->iov_offset;
  937. if (off) {
  938. buf = &pipe->bufs[i_head & p_mask];
  939. buf->len = off - buf->offset;
  940. i_head++;
  941. }
  942. while (p_head != i_head) {
  943. p_head--;
  944. pipe_buf_release(pipe, &pipe->bufs[p_head & p_mask]);
  945. }
  946. pipe->head = p_head;
  947. }
  948. }
  949. static void pipe_advance(struct iov_iter *i, size_t size)
  950. {
  951. struct pipe_inode_info *pipe = i->pipe;
  952. if (unlikely(i->count < size))
  953. size = i->count;
  954. if (size) {
  955. struct pipe_buffer *buf;
  956. unsigned int p_mask = pipe->ring_size - 1;
  957. unsigned int i_head = i->head;
  958. size_t off = i->iov_offset, left = size;
  959. if (off) /* make it relative to the beginning of buffer */
  960. left += off - pipe->bufs[i_head & p_mask].offset;
  961. while (1) {
  962. buf = &pipe->bufs[i_head & p_mask];
  963. if (left <= buf->len)
  964. break;
  965. left -= buf->len;
  966. i_head++;
  967. }
  968. i->head = i_head;
  969. i->iov_offset = buf->offset + left;
  970. }
  971. i->count -= size;
  972. /* ... and discard everything past that point */
  973. pipe_truncate(i);
  974. }
  975. void iov_iter_advance(struct iov_iter *i, size_t size)
  976. {
  977. if (unlikely(iov_iter_is_pipe(i))) {
  978. pipe_advance(i, size);
  979. return;
  980. }
  981. if (unlikely(iov_iter_is_discard(i))) {
  982. i->count -= size;
  983. return;
  984. }
  985. iterate_and_advance(i, size, v, 0, 0, 0)
  986. }
  987. EXPORT_SYMBOL(iov_iter_advance);
  988. void iov_iter_revert(struct iov_iter *i, size_t unroll)
  989. {
  990. if (!unroll)
  991. return;
  992. if (WARN_ON(unroll > MAX_RW_COUNT))
  993. return;
  994. i->count += unroll;
  995. if (unlikely(iov_iter_is_pipe(i))) {
  996. struct pipe_inode_info *pipe = i->pipe;
  997. unsigned int p_mask = pipe->ring_size - 1;
  998. unsigned int i_head = i->head;
  999. size_t off = i->iov_offset;
  1000. while (1) {
  1001. struct pipe_buffer *b = &pipe->bufs[i_head & p_mask];
  1002. size_t n = off - b->offset;
  1003. if (unroll < n) {
  1004. off -= unroll;
  1005. break;
  1006. }
  1007. unroll -= n;
  1008. if (!unroll && i_head == i->start_head) {
  1009. off = 0;
  1010. break;
  1011. }
  1012. i_head--;
  1013. b = &pipe->bufs[i_head & p_mask];
  1014. off = b->offset + b->len;
  1015. }
  1016. i->iov_offset = off;
  1017. i->head = i_head;
  1018. pipe_truncate(i);
  1019. return;
  1020. }
  1021. if (unlikely(iov_iter_is_discard(i)))
  1022. return;
  1023. if (unroll <= i->iov_offset) {
  1024. i->iov_offset -= unroll;
  1025. return;
  1026. }
  1027. unroll -= i->iov_offset;
  1028. if (iov_iter_is_bvec(i)) {
  1029. const struct bio_vec *bvec = i->bvec;
  1030. while (1) {
  1031. size_t n = (--bvec)->bv_len;
  1032. i->nr_segs++;
  1033. if (unroll <= n) {
  1034. i->bvec = bvec;
  1035. i->iov_offset = n - unroll;
  1036. return;
  1037. }
  1038. unroll -= n;
  1039. }
  1040. } else { /* same logics for iovec and kvec */
  1041. const struct iovec *iov = i->iov;
  1042. while (1) {
  1043. size_t n = (--iov)->iov_len;
  1044. i->nr_segs++;
  1045. if (unroll <= n) {
  1046. i->iov = iov;
  1047. i->iov_offset = n - unroll;
  1048. return;
  1049. }
  1050. unroll -= n;
  1051. }
  1052. }
  1053. }
  1054. EXPORT_SYMBOL(iov_iter_revert);
  1055. /*
  1056. * Return the count of just the current iov_iter segment.
  1057. */
  1058. size_t iov_iter_single_seg_count(const struct iov_iter *i)
  1059. {
  1060. if (unlikely(iov_iter_is_pipe(i)))
  1061. return i->count; // it is a silly place, anyway
  1062. if (i->nr_segs == 1)
  1063. return i->count;
  1064. if (unlikely(iov_iter_is_discard(i)))
  1065. return i->count;
  1066. else if (iov_iter_is_bvec(i))
  1067. return min(i->count, i->bvec->bv_len - i->iov_offset);
  1068. else
  1069. return min(i->count, i->iov->iov_len - i->iov_offset);
  1070. }
  1071. EXPORT_SYMBOL(iov_iter_single_seg_count);
  1072. void iov_iter_kvec(struct iov_iter *i, unsigned int direction,
  1073. const struct kvec *kvec, unsigned long nr_segs,
  1074. size_t count)
  1075. {
  1076. WARN_ON(direction & ~(READ | WRITE));
  1077. i->type = ITER_KVEC | (direction & (READ | WRITE));
  1078. i->kvec = kvec;
  1079. i->nr_segs = nr_segs;
  1080. i->iov_offset = 0;
  1081. i->count = count;
  1082. }
  1083. EXPORT_SYMBOL(iov_iter_kvec);
  1084. void iov_iter_bvec(struct iov_iter *i, unsigned int direction,
  1085. const struct bio_vec *bvec, unsigned long nr_segs,
  1086. size_t count)
  1087. {
  1088. WARN_ON(direction & ~(READ | WRITE));
  1089. i->type = ITER_BVEC | (direction & (READ | WRITE));
  1090. i->bvec = bvec;
  1091. i->nr_segs = nr_segs;
  1092. i->iov_offset = 0;
  1093. i->count = count;
  1094. }
  1095. EXPORT_SYMBOL(iov_iter_bvec);
  1096. void iov_iter_pipe(struct iov_iter *i, unsigned int direction,
  1097. struct pipe_inode_info *pipe,
  1098. size_t count)
  1099. {
  1100. BUG_ON(direction != READ);
  1101. WARN_ON(pipe_full(pipe->head, pipe->tail, pipe->ring_size));
  1102. i->type = ITER_PIPE | READ;
  1103. i->pipe = pipe;
  1104. i->head = pipe->head;
  1105. i->iov_offset = 0;
  1106. i->count = count;
  1107. i->start_head = i->head;
  1108. }
  1109. EXPORT_SYMBOL(iov_iter_pipe);
  1110. /**
  1111. * iov_iter_discard - Initialise an I/O iterator that discards data
  1112. * @i: The iterator to initialise.
  1113. * @direction: The direction of the transfer.
  1114. * @count: The size of the I/O buffer in bytes.
  1115. *
  1116. * Set up an I/O iterator that just discards everything that's written to it.
  1117. * It's only available as a READ iterator.
  1118. */
  1119. void iov_iter_discard(struct iov_iter *i, unsigned int direction, size_t count)
  1120. {
  1121. BUG_ON(direction != READ);
  1122. i->type = ITER_DISCARD | READ;
  1123. i->count = count;
  1124. i->iov_offset = 0;
  1125. }
  1126. EXPORT_SYMBOL(iov_iter_discard);
  1127. unsigned long iov_iter_alignment(const struct iov_iter *i)
  1128. {
  1129. unsigned long res = 0;
  1130. size_t size = i->count;
  1131. if (unlikely(iov_iter_is_pipe(i))) {
  1132. unsigned int p_mask = i->pipe->ring_size - 1;
  1133. if (size && i->iov_offset && allocated(&i->pipe->bufs[i->head & p_mask]))
  1134. return size | i->iov_offset;
  1135. return size;
  1136. }
  1137. iterate_all_kinds(i, size, v,
  1138. (res |= (unsigned long)v.iov_base | v.iov_len, 0),
  1139. res |= v.bv_offset | v.bv_len,
  1140. res |= (unsigned long)v.iov_base | v.iov_len
  1141. )
  1142. return res;
  1143. }
  1144. EXPORT_SYMBOL(iov_iter_alignment);
  1145. unsigned long iov_iter_gap_alignment(const struct iov_iter *i)
  1146. {
  1147. unsigned long res = 0;
  1148. size_t size = i->count;
  1149. if (unlikely(iov_iter_is_pipe(i) || iov_iter_is_discard(i))) {
  1150. WARN_ON(1);
  1151. return ~0U;
  1152. }
  1153. iterate_all_kinds(i, size, v,
  1154. (res |= (!res ? 0 : (unsigned long)v.iov_base) |
  1155. (size != v.iov_len ? size : 0), 0),
  1156. (res |= (!res ? 0 : (unsigned long)v.bv_offset) |
  1157. (size != v.bv_len ? size : 0)),
  1158. (res |= (!res ? 0 : (unsigned long)v.iov_base) |
  1159. (size != v.iov_len ? size : 0))
  1160. );
  1161. return res;
  1162. }
  1163. EXPORT_SYMBOL(iov_iter_gap_alignment);
  1164. static inline ssize_t __pipe_get_pages(struct iov_iter *i,
  1165. size_t maxsize,
  1166. struct page **pages,
  1167. int iter_head,
  1168. size_t *start)
  1169. {
  1170. struct pipe_inode_info *pipe = i->pipe;
  1171. unsigned int p_mask = pipe->ring_size - 1;
  1172. ssize_t n = push_pipe(i, maxsize, &iter_head, start);
  1173. if (!n)
  1174. return -EFAULT;
  1175. maxsize = n;
  1176. n += *start;
  1177. while (n > 0) {
  1178. get_page(*pages++ = pipe->bufs[iter_head & p_mask].page);
  1179. iter_head++;
  1180. n -= PAGE_SIZE;
  1181. }
  1182. return maxsize;
  1183. }
  1184. static ssize_t pipe_get_pages(struct iov_iter *i,
  1185. struct page **pages, size_t maxsize, unsigned maxpages,
  1186. size_t *start)
  1187. {
  1188. unsigned int iter_head, npages;
  1189. size_t capacity;
  1190. if (!maxsize)
  1191. return 0;
  1192. if (!sanity(i))
  1193. return -EFAULT;
  1194. data_start(i, &iter_head, start);
  1195. /* Amount of free space: some of this one + all after this one */
  1196. npages = pipe_space_for_user(iter_head, i->pipe->tail, i->pipe);
  1197. capacity = min(npages, maxpages) * PAGE_SIZE - *start;
  1198. return __pipe_get_pages(i, min(maxsize, capacity), pages, iter_head, start);
  1199. }
  1200. ssize_t iov_iter_get_pages(struct iov_iter *i,
  1201. struct page **pages, size_t maxsize, unsigned maxpages,
  1202. size_t *start)
  1203. {
  1204. if (maxsize > i->count)
  1205. maxsize = i->count;
  1206. if (unlikely(iov_iter_is_pipe(i)))
  1207. return pipe_get_pages(i, pages, maxsize, maxpages, start);
  1208. if (unlikely(iov_iter_is_discard(i)))
  1209. return -EFAULT;
  1210. iterate_all_kinds(i, maxsize, v, ({
  1211. unsigned long addr = (unsigned long)v.iov_base;
  1212. size_t len = v.iov_len + (*start = addr & (PAGE_SIZE - 1));
  1213. int n;
  1214. int res;
  1215. if (len > maxpages * PAGE_SIZE)
  1216. len = maxpages * PAGE_SIZE;
  1217. addr &= ~(PAGE_SIZE - 1);
  1218. n = DIV_ROUND_UP(len, PAGE_SIZE);
  1219. res = get_user_pages_fast(addr, n,
  1220. iov_iter_rw(i) != WRITE ? FOLL_WRITE : 0,
  1221. pages);
  1222. if (unlikely(res <= 0))
  1223. return res;
  1224. return (res == n ? len : res * PAGE_SIZE) - *start;
  1225. 0;}),({
  1226. /* can't be more than PAGE_SIZE */
  1227. *start = v.bv_offset;
  1228. get_page(*pages = v.bv_page);
  1229. return v.bv_len;
  1230. }),({
  1231. return -EFAULT;
  1232. })
  1233. )
  1234. return 0;
  1235. }
  1236. EXPORT_SYMBOL(iov_iter_get_pages);
  1237. static struct page **get_pages_array(size_t n)
  1238. {
  1239. return kvmalloc_array(n, sizeof(struct page *), GFP_KERNEL);
  1240. }
  1241. static ssize_t pipe_get_pages_alloc(struct iov_iter *i,
  1242. struct page ***pages, size_t maxsize,
  1243. size_t *start)
  1244. {
  1245. struct page **p;
  1246. unsigned int iter_head, npages;
  1247. ssize_t n;
  1248. if (!maxsize)
  1249. return 0;
  1250. if (!sanity(i))
  1251. return -EFAULT;
  1252. data_start(i, &iter_head, start);
  1253. /* Amount of free space: some of this one + all after this one */
  1254. npages = pipe_space_for_user(iter_head, i->pipe->tail, i->pipe);
  1255. n = npages * PAGE_SIZE - *start;
  1256. if (maxsize > n)
  1257. maxsize = n;
  1258. else
  1259. npages = DIV_ROUND_UP(maxsize + *start, PAGE_SIZE);
  1260. p = get_pages_array(npages);
  1261. if (!p)
  1262. return -ENOMEM;
  1263. n = __pipe_get_pages(i, maxsize, p, iter_head, start);
  1264. if (n > 0)
  1265. *pages = p;
  1266. else
  1267. kvfree(p);
  1268. return n;
  1269. }
  1270. ssize_t iov_iter_get_pages_alloc(struct iov_iter *i,
  1271. struct page ***pages, size_t maxsize,
  1272. size_t *start)
  1273. {
  1274. struct page **p;
  1275. if (maxsize > i->count)
  1276. maxsize = i->count;
  1277. if (unlikely(iov_iter_is_pipe(i)))
  1278. return pipe_get_pages_alloc(i, pages, maxsize, start);
  1279. if (unlikely(iov_iter_is_discard(i)))
  1280. return -EFAULT;
  1281. iterate_all_kinds(i, maxsize, v, ({
  1282. unsigned long addr = (unsigned long)v.iov_base;
  1283. size_t len = v.iov_len + (*start = addr & (PAGE_SIZE - 1));
  1284. int n;
  1285. int res;
  1286. addr &= ~(PAGE_SIZE - 1);
  1287. n = DIV_ROUND_UP(len, PAGE_SIZE);
  1288. p = get_pages_array(n);
  1289. if (!p)
  1290. return -ENOMEM;
  1291. res = get_user_pages_fast(addr, n,
  1292. iov_iter_rw(i) != WRITE ? FOLL_WRITE : 0, p);
  1293. if (unlikely(res <= 0)) {
  1294. kvfree(p);
  1295. *pages = NULL;
  1296. return res;
  1297. }
  1298. *pages = p;
  1299. return (res == n ? len : res * PAGE_SIZE) - *start;
  1300. 0;}),({
  1301. /* can't be more than PAGE_SIZE */
  1302. *start = v.bv_offset;
  1303. *pages = p = get_pages_array(1);
  1304. if (!p)
  1305. return -ENOMEM;
  1306. get_page(*p = v.bv_page);
  1307. return v.bv_len;
  1308. }),({
  1309. return -EFAULT;
  1310. })
  1311. )
  1312. return 0;
  1313. }
  1314. EXPORT_SYMBOL(iov_iter_get_pages_alloc);
  1315. size_t csum_and_copy_from_iter(void *addr, size_t bytes, __wsum *csum,
  1316. struct iov_iter *i)
  1317. {
  1318. char *to = addr;
  1319. __wsum sum, next;
  1320. size_t off = 0;
  1321. sum = *csum;
  1322. if (unlikely(iov_iter_is_pipe(i) || iov_iter_is_discard(i))) {
  1323. WARN_ON(1);
  1324. return 0;
  1325. }
  1326. iterate_and_advance(i, bytes, v, ({
  1327. next = csum_and_copy_from_user(v.iov_base,
  1328. (to += v.iov_len) - v.iov_len,
  1329. v.iov_len);
  1330. if (next) {
  1331. sum = csum_block_add(sum, next, off);
  1332. off += v.iov_len;
  1333. }
  1334. next ? 0 : v.iov_len;
  1335. }), ({
  1336. char *p = kmap_atomic(v.bv_page);
  1337. sum = csum_and_memcpy((to += v.bv_len) - v.bv_len,
  1338. p + v.bv_offset, v.bv_len,
  1339. sum, off);
  1340. kunmap_atomic(p);
  1341. off += v.bv_len;
  1342. }),({
  1343. sum = csum_and_memcpy((to += v.iov_len) - v.iov_len,
  1344. v.iov_base, v.iov_len,
  1345. sum, off);
  1346. off += v.iov_len;
  1347. })
  1348. )
  1349. *csum = sum;
  1350. return bytes;
  1351. }
  1352. EXPORT_SYMBOL(csum_and_copy_from_iter);
  1353. bool csum_and_copy_from_iter_full(void *addr, size_t bytes, __wsum *csum,
  1354. struct iov_iter *i)
  1355. {
  1356. char *to = addr;
  1357. __wsum sum, next;
  1358. size_t off = 0;
  1359. sum = *csum;
  1360. if (unlikely(iov_iter_is_pipe(i) || iov_iter_is_discard(i))) {
  1361. WARN_ON(1);
  1362. return false;
  1363. }
  1364. if (unlikely(i->count < bytes))
  1365. return false;
  1366. iterate_all_kinds(i, bytes, v, ({
  1367. next = csum_and_copy_from_user(v.iov_base,
  1368. (to += v.iov_len) - v.iov_len,
  1369. v.iov_len);
  1370. if (!next)
  1371. return false;
  1372. sum = csum_block_add(sum, next, off);
  1373. off += v.iov_len;
  1374. 0;
  1375. }), ({
  1376. char *p = kmap_atomic(v.bv_page);
  1377. sum = csum_and_memcpy((to += v.bv_len) - v.bv_len,
  1378. p + v.bv_offset, v.bv_len,
  1379. sum, off);
  1380. kunmap_atomic(p);
  1381. off += v.bv_len;
  1382. }),({
  1383. sum = csum_and_memcpy((to += v.iov_len) - v.iov_len,
  1384. v.iov_base, v.iov_len,
  1385. sum, off);
  1386. off += v.iov_len;
  1387. })
  1388. )
  1389. *csum = sum;
  1390. iov_iter_advance(i, bytes);
  1391. return true;
  1392. }
  1393. EXPORT_SYMBOL(csum_and_copy_from_iter_full);
  1394. size_t csum_and_copy_to_iter(const void *addr, size_t bytes, void *_csstate,
  1395. struct iov_iter *i)
  1396. {
  1397. struct csum_state *csstate = _csstate;
  1398. const char *from = addr;
  1399. __wsum sum, next;
  1400. size_t off;
  1401. if (unlikely(iov_iter_is_pipe(i)))
  1402. return csum_and_copy_to_pipe_iter(addr, bytes, _csstate, i);
  1403. sum = csstate->csum;
  1404. off = csstate->off;
  1405. if (unlikely(iov_iter_is_discard(i))) {
  1406. WARN_ON(1); /* for now */
  1407. return 0;
  1408. }
  1409. iterate_and_advance(i, bytes, v, ({
  1410. next = csum_and_copy_to_user((from += v.iov_len) - v.iov_len,
  1411. v.iov_base,
  1412. v.iov_len);
  1413. if (next) {
  1414. sum = csum_block_add(sum, next, off);
  1415. off += v.iov_len;
  1416. }
  1417. next ? 0 : v.iov_len;
  1418. }), ({
  1419. char *p = kmap_atomic(v.bv_page);
  1420. sum = csum_and_memcpy(p + v.bv_offset,
  1421. (from += v.bv_len) - v.bv_len,
  1422. v.bv_len, sum, off);
  1423. kunmap_atomic(p);
  1424. off += v.bv_len;
  1425. }),({
  1426. sum = csum_and_memcpy(v.iov_base,
  1427. (from += v.iov_len) - v.iov_len,
  1428. v.iov_len, sum, off);
  1429. off += v.iov_len;
  1430. })
  1431. )
  1432. csstate->csum = sum;
  1433. csstate->off = off;
  1434. return bytes;
  1435. }
  1436. EXPORT_SYMBOL(csum_and_copy_to_iter);
  1437. size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
  1438. struct iov_iter *i)
  1439. {
  1440. #ifdef CONFIG_CRYPTO_HASH
  1441. struct ahash_request *hash = hashp;
  1442. struct scatterlist sg;
  1443. size_t copied;
  1444. copied = copy_to_iter(addr, bytes, i);
  1445. sg_init_one(&sg, addr, copied);
  1446. ahash_request_set_crypt(hash, &sg, NULL, copied);
  1447. crypto_ahash_update(hash);
  1448. return copied;
  1449. #else
  1450. return 0;
  1451. #endif
  1452. }
  1453. EXPORT_SYMBOL(hash_and_copy_to_iter);
  1454. int iov_iter_npages(const struct iov_iter *i, int maxpages)
  1455. {
  1456. size_t size = i->count;
  1457. int npages = 0;
  1458. if (!size)
  1459. return 0;
  1460. if (unlikely(iov_iter_is_discard(i)))
  1461. return 0;
  1462. if (unlikely(iov_iter_is_pipe(i))) {
  1463. struct pipe_inode_info *pipe = i->pipe;
  1464. unsigned int iter_head;
  1465. size_t off;
  1466. if (!sanity(i))
  1467. return 0;
  1468. data_start(i, &iter_head, &off);
  1469. /* some of this one + all after this one */
  1470. npages = pipe_space_for_user(iter_head, pipe->tail, pipe);
  1471. if (npages >= maxpages)
  1472. return maxpages;
  1473. } else iterate_all_kinds(i, size, v, ({
  1474. unsigned long p = (unsigned long)v.iov_base;
  1475. npages += DIV_ROUND_UP(p + v.iov_len, PAGE_SIZE)
  1476. - p / PAGE_SIZE;
  1477. if (npages >= maxpages)
  1478. return maxpages;
  1479. 0;}),({
  1480. npages++;
  1481. if (npages >= maxpages)
  1482. return maxpages;
  1483. }),({
  1484. unsigned long p = (unsigned long)v.iov_base;
  1485. npages += DIV_ROUND_UP(p + v.iov_len, PAGE_SIZE)
  1486. - p / PAGE_SIZE;
  1487. if (npages >= maxpages)
  1488. return maxpages;
  1489. })
  1490. )
  1491. return npages;
  1492. }
  1493. EXPORT_SYMBOL(iov_iter_npages);
  1494. const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags)
  1495. {
  1496. *new = *old;
  1497. if (unlikely(iov_iter_is_pipe(new))) {
  1498. WARN_ON(1);
  1499. return NULL;
  1500. }
  1501. if (unlikely(iov_iter_is_discard(new)))
  1502. return NULL;
  1503. if (iov_iter_is_bvec(new))
  1504. return new->bvec = kmemdup(new->bvec,
  1505. new->nr_segs * sizeof(struct bio_vec),
  1506. flags);
  1507. else
  1508. /* iovec and kvec have identical layout */
  1509. return new->iov = kmemdup(new->iov,
  1510. new->nr_segs * sizeof(struct iovec),
  1511. flags);
  1512. }
  1513. EXPORT_SYMBOL(dup_iter);
  1514. static int copy_compat_iovec_from_user(struct iovec *iov,
  1515. const struct iovec __user *uvec, unsigned long nr_segs)
  1516. {
  1517. const struct compat_iovec __user *uiov =
  1518. (const struct compat_iovec __user *)uvec;
  1519. int ret = -EFAULT, i;
  1520. if (!user_access_begin(uiov, nr_segs * sizeof(*uiov)))
  1521. return -EFAULT;
  1522. for (i = 0; i < nr_segs; i++) {
  1523. compat_uptr_t buf;
  1524. compat_ssize_t len;
  1525. unsafe_get_user(len, &uiov[i].iov_len, uaccess_end);
  1526. unsafe_get_user(buf, &uiov[i].iov_base, uaccess_end);
  1527. /* check for compat_size_t not fitting in compat_ssize_t .. */
  1528. if (len < 0) {
  1529. ret = -EINVAL;
  1530. goto uaccess_end;
  1531. }
  1532. iov[i].iov_base = compat_ptr(buf);
  1533. iov[i].iov_len = len;
  1534. }
  1535. ret = 0;
  1536. uaccess_end:
  1537. user_access_end();
  1538. return ret;
  1539. }
  1540. static int copy_iovec_from_user(struct iovec *iov,
  1541. const struct iovec __user *uvec, unsigned long nr_segs)
  1542. {
  1543. unsigned long seg;
  1544. if (copy_from_user(iov, uvec, nr_segs * sizeof(*uvec)))
  1545. return -EFAULT;
  1546. for (seg = 0; seg < nr_segs; seg++) {
  1547. if ((ssize_t)iov[seg].iov_len < 0)
  1548. return -EINVAL;
  1549. }
  1550. return 0;
  1551. }
  1552. struct iovec *iovec_from_user(const struct iovec __user *uvec,
  1553. unsigned long nr_segs, unsigned long fast_segs,
  1554. struct iovec *fast_iov, bool compat)
  1555. {
  1556. struct iovec *iov = fast_iov;
  1557. int ret;
  1558. /*
  1559. * SuS says "The readv() function *may* fail if the iovcnt argument was
  1560. * less than or equal to 0, or greater than {IOV_MAX}. Linux has
  1561. * traditionally returned zero for zero segments, so...
  1562. */
  1563. if (nr_segs == 0)
  1564. return iov;
  1565. if (nr_segs > UIO_MAXIOV)
  1566. return ERR_PTR(-EINVAL);
  1567. if (nr_segs > fast_segs) {
  1568. iov = kmalloc_array(nr_segs, sizeof(struct iovec), GFP_KERNEL);
  1569. if (!iov)
  1570. return ERR_PTR(-ENOMEM);
  1571. }
  1572. if (compat)
  1573. ret = copy_compat_iovec_from_user(iov, uvec, nr_segs);
  1574. else
  1575. ret = copy_iovec_from_user(iov, uvec, nr_segs);
  1576. if (ret) {
  1577. if (iov != fast_iov)
  1578. kfree(iov);
  1579. return ERR_PTR(ret);
  1580. }
  1581. return iov;
  1582. }
  1583. ssize_t __import_iovec(int type, const struct iovec __user *uvec,
  1584. unsigned nr_segs, unsigned fast_segs, struct iovec **iovp,
  1585. struct iov_iter *i, bool compat)
  1586. {
  1587. ssize_t total_len = 0;
  1588. unsigned long seg;
  1589. struct iovec *iov;
  1590. iov = iovec_from_user(uvec, nr_segs, fast_segs, *iovp, compat);
  1591. if (IS_ERR(iov)) {
  1592. *iovp = NULL;
  1593. return PTR_ERR(iov);
  1594. }
  1595. /*
  1596. * According to the Single Unix Specification we should return EINVAL if
  1597. * an element length is < 0 when cast to ssize_t or if the total length
  1598. * would overflow the ssize_t return value of the system call.
  1599. *
  1600. * Linux caps all read/write calls to MAX_RW_COUNT, and avoids the
  1601. * overflow case.
  1602. */
  1603. for (seg = 0; seg < nr_segs; seg++) {
  1604. ssize_t len = (ssize_t)iov[seg].iov_len;
  1605. if (!access_ok(iov[seg].iov_base, len)) {
  1606. if (iov != *iovp)
  1607. kfree(iov);
  1608. *iovp = NULL;
  1609. return -EFAULT;
  1610. }
  1611. if (len > MAX_RW_COUNT - total_len) {
  1612. len = MAX_RW_COUNT - total_len;
  1613. iov[seg].iov_len = len;
  1614. }
  1615. total_len += len;
  1616. }
  1617. iov_iter_init(i, type, iov, nr_segs, total_len);
  1618. if (iov == *iovp)
  1619. *iovp = NULL;
  1620. else
  1621. *iovp = iov;
  1622. return total_len;
  1623. }
  1624. /**
  1625. * import_iovec() - Copy an array of &struct iovec from userspace
  1626. * into the kernel, check that it is valid, and initialize a new
  1627. * &struct iov_iter iterator to access it.
  1628. *
  1629. * @type: One of %READ or %WRITE.
  1630. * @uvec: Pointer to the userspace array.
  1631. * @nr_segs: Number of elements in userspace array.
  1632. * @fast_segs: Number of elements in @iov.
  1633. * @iovp: (input and output parameter) Pointer to pointer to (usually small
  1634. * on-stack) kernel array.
  1635. * @i: Pointer to iterator that will be initialized on success.
  1636. *
  1637. * If the array pointed to by *@iov is large enough to hold all @nr_segs,
  1638. * then this function places %NULL in *@iov on return. Otherwise, a new
  1639. * array will be allocated and the result placed in *@iov. This means that
  1640. * the caller may call kfree() on *@iov regardless of whether the small
  1641. * on-stack array was used or not (and regardless of whether this function
  1642. * returns an error or not).
  1643. *
  1644. * Return: Negative error code on error, bytes imported on success
  1645. */
  1646. ssize_t import_iovec(int type, const struct iovec __user *uvec,
  1647. unsigned nr_segs, unsigned fast_segs,
  1648. struct iovec **iovp, struct iov_iter *i)
  1649. {
  1650. return __import_iovec(type, uvec, nr_segs, fast_segs, iovp, i,
  1651. in_compat_syscall());
  1652. }
  1653. EXPORT_SYMBOL(import_iovec);
  1654. int import_single_range(int rw, void __user *buf, size_t len,
  1655. struct iovec *iov, struct iov_iter *i)
  1656. {
  1657. if (len > MAX_RW_COUNT)
  1658. len = MAX_RW_COUNT;
  1659. if (unlikely(!access_ok(buf, len)))
  1660. return -EFAULT;
  1661. iov->iov_base = buf;
  1662. iov->iov_len = len;
  1663. iov_iter_init(i, rw, iov, 1, len);
  1664. return 0;
  1665. }
  1666. EXPORT_SYMBOL(import_single_range);
  1667. int iov_iter_for_each_range(struct iov_iter *i, size_t bytes,
  1668. int (*f)(struct kvec *vec, void *context),
  1669. void *context)
  1670. {
  1671. struct kvec w;
  1672. int err = -EINVAL;
  1673. if (!bytes)
  1674. return 0;
  1675. iterate_all_kinds(i, bytes, v, -EINVAL, ({
  1676. w.iov_base = kmap(v.bv_page) + v.bv_offset;
  1677. w.iov_len = v.bv_len;
  1678. err = f(&w, context);
  1679. kunmap(v.bv_page);
  1680. err;}), ({
  1681. w = v;
  1682. err = f(&w, context);})
  1683. )
  1684. return err;
  1685. }
  1686. EXPORT_SYMBOL(iov_iter_for_each_range);