[linux.git] / lib / strnlen_user.c

#include <linux/kernel.h>
#include <linux/export.h>
#include <linux/uaccess.h>

#include <asm/word-at-a-time.h>

/* Set bits in the first 'n' bytes when loaded from memory */
#ifdef __LITTLE_ENDIAN
#  define aligned_byte_mask(n) ((1ul << 8*(n))-1)
#else
#  define aligned_byte_mask(n) (~0xfful << (BITS_PER_LONG - 8 - 8*(n)))
#endif

/*
 * Do a strnlen, return length of string *with* final '\0'.
 * 'count' is the user-supplied count, while 'max' is the
 * address space maximum.
 *
 * Return 0 for exceptions (which includes hitting the address
 * space maximum), or 'count+1' if hitting the user-supplied
 * maximum count.
 *
 * NOTE! We can sometimes overshoot the user-supplied maximum
 * if it fits in a aligned 'long'. The caller needs to check
 * the return value against "> max".
 */
static inline long do_strnlen_user(const char __user *src, unsigned long count, unsigned long max)
{
	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
	long align, res = 0;
	unsigned long c;

	/*
	 * Truncate 'max' to the user-specified limit, so that
	 * we only have one limit we need to check in the loop
	 */
	if (max > count)
		max = count;

	/*
	 * Do everything aligned. But that means that we
	 * need to also expand the maximum..
	 */
	align = (sizeof(long) - 1) & (unsigned long)src;
	src -= align;
	max += align;

	if (unlikely(__get_user(c,(unsigned long __user *)src)))
		return 0;
	c |= aligned_byte_mask(align);

	for (;;) {
		unsigned long data;
		if (has_zero(c, &data, &constants)) {
			data = prep_zero_mask(c, data, &constants);
			data = create_zero_mask(data);
			return res + find_zero(data) + 1 - align;
		}
		res += sizeof(unsigned long);
		/* We already handled 'unsigned long' bytes. Did we do it all ? */
		if (unlikely(max <= sizeof(unsigned long)))
			break;
		max -= sizeof(unsigned long);
		if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
			return 0;
	}
	res -= align;

	/*
	 * Uhhuh. We hit 'max'. But was that the user-specified maximum
	 * too? If so, return the marker for "too long".
	 */
	if (res >= count)
		return count+1;

	/*
	 * Nope: we hit the address space limit, and we still had more
	 * characters the caller would have wanted. That's 0.
	 */
	return 0;
}

/**
 * strnlen_user: - Get the size of a user string INCLUDING final NUL.
 * @str: The string to measure.
 * @count: Maximum count (including NUL character)
 *
 * Context: User context only. This function may sleep if pagefaults are
 *          enabled.
 *
 * Get the size of a NUL-terminated string in user space.
 *
 * Returns the size of the string INCLUDING the terminating NUL.
 * If the string is too long, returns a number larger than @count. User
 * has to check the return value against "> count".
 * On exception (or invalid count), returns 0.
 *
 * NOTE! You should basically never use this function. There is
 * almost never any valid case for using the length of a user space
 * string, since the string can be changed at any time by other
 * threads. Use "strncpy_from_user()" instead to get a stable copy
 * of the string.
 */
long strnlen_user(const char __user *str, long count)
{
	unsigned long max_addr, src_addr;

	if (unlikely(count <= 0))
		return 0;

	max_addr = user_addr_max();
	src_addr = (unsigned long)str;
	if (likely(src_addr < max_addr)) {
		unsigned long max = max_addr - src_addr;
		return do_strnlen_user(str, count, max);
	}
	return 0;
}
EXPORT_SYMBOL(strnlen_user);

/**
 * strlen_user: - Get the size of a user string INCLUDING final NUL.
 * @str: The string to measure.
 *
 * Context: User context only. This function may sleep if pagefaults are
 *          enabled.
 *
 * Get the size of a NUL-terminated string in user space.
 *
 * Returns the size of the string INCLUDING the terminating NUL.
 * On exception, returns 0.
 *
 * If there is a limit on the length of a valid string, you may wish to
 * consider using strnlen_user() instead.
 */
long strlen_user(const char __user *str)
{
	unsigned long max_addr, src_addr;

	max_addr = user_addr_max();
	src_addr = (unsigned long)str;
	if (likely(src_addr < max_addr)) {
		unsigned long max = max_addr - src_addr;
		return do_strnlen_user(str, ~0ul, max);
	}
	return 0;
}
EXPORT_SYMBOL(strlen_user);
Commit	Line	Data
a08c5356 LT	1	#include <linux/kernel.h>
	2	#include <linux/export.h>
	3	#include <linux/uaccess.h>
	4
	5	#include <asm/word-at-a-time.h>
	6
	7	/* Set bits in the first 'n' bytes when loaded from memory */
	8	#ifdef __LITTLE_ENDIAN
	9	# define aligned_byte_mask(n) ((1ul << 8*(n))-1)
	10	#else
69ea6405	11	# define aligned_byte_mask(n) (~0xfful << (BITS_PER_LONG - 8 - 8*(n)))
a08c5356 LT	12	#endif
	13
	14	/*
	15	* Do a strnlen, return length of string with final '\0'.
	16	* 'count' is the user-supplied count, while 'max' is the
	17	* address space maximum.
	18	*
	19	* Return 0 for exceptions (which includes hitting the address
	20	* space maximum), or 'count+1' if hitting the user-supplied
	21	* maximum count.
	22	*
	23	* NOTE! We can sometimes overshoot the user-supplied maximum
	24	* if it fits in a aligned 'long'. The caller needs to check
	25	* the return value against "> max".
	26	*/
	27	static inline long do_strnlen_user(const char __user *src, unsigned long count, unsigned long max)
	28	{
	29	const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
	30	long align, res = 0;
	31	unsigned long c;
	32
	33	/*
	34	* Truncate 'max' to the user-specified limit, so that
	35	* we only have one limit we need to check in the loop
	36	*/
	37	if (max > count)
	38	max = count;
	39
	40	/*
	41	* Do everything aligned. But that means that we
	42	* need to also expand the maximum..
	43	*/
	44	align = (sizeof(long) - 1) & (unsigned long)src;
	45	src -= align;
	46	max += align;
	47
	48	if (unlikely(__get_user(c,(unsigned long __user *)src)))
	49	return 0;
	50	c \|= aligned_byte_mask(align);
	51
	52	for (;;) {
	53	unsigned long data;
	54	if (has_zero(c, &data, &constants)) {
	55	data = prep_zero_mask(c, data, &constants);
	56	data = create_zero_mask(data);
	57	return res + find_zero(data) + 1 - align;
	58	}
	59	res += sizeof(unsigned long);
f18c34e4 JK	60	/* We already handled 'unsigned long' bytes. Did we do it all ? */
f18c34e4 JK	61	if (unlikely(max <= sizeof(unsigned long)))
a08c5356 LT	62	break;
	63	max -= sizeof(unsigned long);
	64	if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
	65	return 0;
	66	}
	67	res -= align;
	68
	69	/*
	70	* Uhhuh. We hit 'max'. But was that the user-specified maximum
	71	* too? If so, return the marker for "too long".
	72	*/
	73	if (res >= count)
	74	return count+1;
	75
	76	/*
	77	* Nope: we hit the address space limit, and we still had more
	78	* characters the caller would have wanted. That's 0.
	79	*/
	80	return 0;
	81	}
	82
	83	/**
	84	* strnlen_user: - Get the size of a user string INCLUDING final NUL.
	85	* @str: The string to measure.
	86	* @count: Maximum count (including NUL character)
	87	*
b3c395ef DH	88	* Context: User context only. This function may sleep if pagefaults are
b3c395ef DH	89	* enabled.
a08c5356 LT	90	*
	91	* Get the size of a NUL-terminated string in user space.
	92	*
	93	* Returns the size of the string INCLUDING the terminating NUL.
226a07ef JK	94	* If the string is too long, returns a number larger than @count. User
226a07ef JK	95	* has to check the return value against "> count".
a08c5356	96	* On exception (or invalid count), returns 0.
226a07ef JK	97	*
	98	* NOTE! You should basically never use this function. There is
	99	* almost never any valid case for using the length of a user space
	100	* string, since the string can be changed at any time by other
	101	* threads. Use "strncpy_from_user()" instead to get a stable copy
	102	* of the string.
a08c5356 LT	103	*/
	104	long strnlen_user(const char __user *str, long count)
	105	{
	106	unsigned long max_addr, src_addr;
	107
	108	if (unlikely(count <= 0))
	109	return 0;
	110
	111	max_addr = user_addr_max();
	112	src_addr = (unsigned long)str;
	113	if (likely(src_addr < max_addr)) {
	114	unsigned long max = max_addr - src_addr;
	115	return do_strnlen_user(str, count, max);
	116	}
	117	return 0;
	118	}
	119	EXPORT_SYMBOL(strnlen_user);
	120
	121	/**
	122	* strlen_user: - Get the size of a user string INCLUDING final NUL.
	123	* @str: The string to measure.
	124	*
b3c395ef DH	125	* Context: User context only. This function may sleep if pagefaults are
b3c395ef DH	126	* enabled.
a08c5356 LT	127	*
	128	* Get the size of a NUL-terminated string in user space.
	129	*
	130	* Returns the size of the string INCLUDING the terminating NUL.
	131	* On exception, returns 0.
	132	*
	133	* If there is a limit on the length of a valid string, you may wish to
	134	* consider using strnlen_user() instead.
	135	*/
	136	long strlen_user(const char __user *str)
	137	{
	138	unsigned long max_addr, src_addr;
	139
	140	max_addr = user_addr_max();
	141	src_addr = (unsigned long)str;
	142	if (likely(src_addr < max_addr)) {
	143	unsigned long max = max_addr - src_addr;
	144	return do_strnlen_user(str, ~0ul, max);
	145	}
	146	return 0;
	147	}
	148	EXPORT_SYMBOL(strlen_user);