^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0+
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * flexible mmap layout support
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * All Rights Reserved.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Started by Ingo Molnar <mingo@elte.hu>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/elf-randomize.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/personality.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/mm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/mman.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/sched/signal.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/sched/mm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/random.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/compat.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/security.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <asm/elf.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) static unsigned long stack_maxrandom_size(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) if (!(current->flags & PF_RANDOMIZE))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) return STACK_RND_MASK << PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) static inline int mmap_is_legacy(struct rlimit *rlim_stack)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) if (current->personality & ADDR_COMPAT_LAYOUT)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) if (rlim_stack->rlim_cur == RLIM_INFINITY)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) return sysctl_legacy_va_layout;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) unsigned long arch_mmap_rnd(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) return (get_random_int() & MMAP_RND_MASK) << PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) static unsigned long mmap_base_legacy(unsigned long rnd)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) return TASK_UNMAPPED_BASE + rnd;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) static inline unsigned long mmap_base(unsigned long rnd,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) struct rlimit *rlim_stack)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) unsigned long gap = rlim_stack->rlim_cur;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) unsigned long pad = stack_maxrandom_size() + stack_guard_gap;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) unsigned long gap_min, gap_max;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) /* Values close to RLIM_INFINITY can overflow. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) if (gap + pad > gap)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) gap += pad;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) * Top of mmap area (just below the process stack).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) * Leave at least a ~32 MB hole.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) gap_min = 32 * 1024 * 1024UL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) gap_max = (STACK_TOP / 6) * 5;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) if (gap < gap_min)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) gap = gap_min;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) else if (gap > gap_max)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) gap = gap_max;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) return PAGE_ALIGN(STACK_TOP - gap - rnd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) unsigned long len, unsigned long pgoff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) unsigned long flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) struct mm_struct *mm = current->mm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) struct vm_area_struct *vma;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) struct vm_unmapped_area_info info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) if (len > TASK_SIZE - mmap_min_addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) if (flags & MAP_FIXED)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) goto check_asce_limit;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) if (addr) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) addr = PAGE_ALIGN(addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) vma = find_vma(mm, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) (!vma || addr + len <= vm_start_gap(vma)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) goto check_asce_limit;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) info.flags = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) info.length = len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) info.low_limit = mm->mmap_base;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) info.high_limit = TASK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) if (filp || (flags & MAP_SHARED))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) info.align_mask = MMAP_ALIGN_MASK << PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) info.align_mask = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) info.align_offset = pgoff << PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) addr = vm_unmapped_area(&info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) if (offset_in_page(addr))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) return addr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) check_asce_limit:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) return check_asce_limit(mm, addr, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) unsigned long arch_get_unmapped_area_topdown(struct file *filp, unsigned long addr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) unsigned long len, unsigned long pgoff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) unsigned long flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) struct vm_area_struct *vma;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) struct mm_struct *mm = current->mm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) struct vm_unmapped_area_info info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) /* requested length too big for entire address space */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) if (len > TASK_SIZE - mmap_min_addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) if (flags & MAP_FIXED)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) goto check_asce_limit;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) /* requesting a specific address */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) if (addr) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) addr = PAGE_ALIGN(addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) vma = find_vma(mm, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) (!vma || addr + len <= vm_start_gap(vma)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) goto check_asce_limit;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) info.flags = VM_UNMAPPED_AREA_TOPDOWN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) info.length = len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) info.low_limit = max(PAGE_SIZE, mmap_min_addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) info.high_limit = mm->mmap_base;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) if (filp || (flags & MAP_SHARED))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) info.align_mask = MMAP_ALIGN_MASK << PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) info.align_mask = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) info.align_offset = pgoff << PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) addr = vm_unmapped_area(&info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) * A failed mmap() very likely causes application failure,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) * so fall back to the bottom-up function here. This scenario
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) * can happen with large stack limits and large mmap()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) * allocations.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) if (offset_in_page(addr)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) VM_BUG_ON(addr != -ENOMEM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) info.flags = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) info.low_limit = TASK_UNMAPPED_BASE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) info.high_limit = TASK_SIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) addr = vm_unmapped_area(&info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) if (offset_in_page(addr))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) return addr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) check_asce_limit:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) return check_asce_limit(mm, addr, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) * This function, called very early during the creation of a new
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) * process VM image, sets up which VM layout function to use:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) void arch_pick_mmap_layout(struct mm_struct *mm, struct rlimit *rlim_stack)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) unsigned long random_factor = 0UL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) if (current->flags & PF_RANDOMIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) random_factor = arch_mmap_rnd();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) * Fall back to the standard layout if the personality
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) * bit is set, or if the expected stack growth is unlimited:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) if (mmap_is_legacy(rlim_stack)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) mm->mmap_base = mmap_base_legacy(random_factor);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) mm->get_unmapped_area = arch_get_unmapped_area;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) mm->mmap_base = mmap_base(random_factor, rlim_stack);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) mm->get_unmapped_area = arch_get_unmapped_area_topdown;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) }