1 /* 2 * linux/fs/binfmt_elf.c 3 * 4 * These are the functions used to load ELF format executables as used 5 * on SVr4 machines. Information on the format may be found in the book 6 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support 7 * Tools". 8 * 9 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com). 10 */ 11 12 #include <linux/module.h> 13 #include <linux/kernel.h> 14 #include <linux/fs.h> 15 #include <linux/stat.h> 16 #include <linux/time.h> 17 #include <linux/mm.h> 18 #include <linux/mman.h> 19 #include <linux/a.out.h> 20 #include <linux/errno.h> 21 #include <linux/signal.h> 22 #include <linux/binfmts.h> 23 #include <linux/string.h> 24 #include <linux/file.h> 25 #include <linux/fcntl.h> 26 #include <linux/ptrace.h> 27 #include <linux/slab.h> 28 #include <linux/shm.h> 29 #include <linux/personality.h> 30 #include <linux/elfcore.h> 31 #include <linux/init.h> 32 #include <linux/highuid.h> 33 #include <linux/smp.h> 34 #include <linux/smp_lock.h> 35 #include <linux/compiler.h> 36 #include <linux/highmem.h> 37 #include <linux/pagemap.h> 38 #include <linux/security.h> 39 #include <linux/syscalls.h> 40 #include <linux/random.h> 41 42 #include <asm/uaccess.h> 43 #include <asm/param.h> 44 #include <asm/page.h> 45 46 #include <linux/elf.h> 47 48 static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs); 49 static int load_elf_library(struct file*); 50 static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int); 51 extern int dump_fpu (struct pt_regs *, elf_fpregset_t *); 52 53 #ifndef elf_addr_t 54 #define elf_addr_t unsigned long 55 #endif 56 57 /* 58 * If we don't support core dumping, then supply a NULL so we 59 * don't even try. 60 */ 61 #ifdef USE_ELF_CORE_DUMP 62 static int elf_core_dump(long signr, struct pt_regs * regs, struct file * file); 63 #else 64 #define elf_core_dump NULL 65 #endif 66 67 #if ELF_EXEC_PAGESIZE > PAGE_SIZE 68 # define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE 69 #else 70 # define ELF_MIN_ALIGN PAGE_SIZE 71 #endif 72 73 #ifndef ELF_CORE_EFLAGS 74 #define ELF_CORE_EFLAGS 0 75 #endif 76 77 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) 78 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) 79 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) 80 81 static struct linux_binfmt elf_format = { 82 .module = THIS_MODULE, 83 .load_binary = load_elf_binary, 84 .load_shlib = load_elf_library, 85 .core_dump = elf_core_dump, 86 .min_coredump = ELF_EXEC_PAGESIZE 87 }; 88 89 #define BAD_ADDR(x) ((unsigned long)(x) > TASK_SIZE) 90 91 static int set_brk(unsigned long start, unsigned long end) 92 { 93 start = ELF_PAGEALIGN(start); 94 end = ELF_PAGEALIGN(end); 95 if (end > start) { 96 unsigned long addr; 97 down_write(¤t->mm->mmap_sem); 98 addr = do_brk(start, end - start); 99 up_write(¤t->mm->mmap_sem); 100 if (BAD_ADDR(addr)) 101 return addr; 102 } 103 current->mm->start_brk = current->mm->brk = end; 104 return 0; 105 } 106 107 108 /* We need to explicitly zero any fractional pages 109 after the data section (i.e. bss). This would 110 contain the junk from the file that should not 111 be in memory */ 112 113 114 static int padzero(unsigned long elf_bss) 115 { 116 unsigned long nbyte; 117 118 nbyte = ELF_PAGEOFFSET(elf_bss); 119 if (nbyte) { 120 nbyte = ELF_MIN_ALIGN - nbyte; 121 if (clear_user((void __user *) elf_bss, nbyte)) 122 return -EFAULT; 123 } 124 return 0; 125 } 126 127 /* Let's use some macros to make this stack manipulation a litle clearer */ 128 #ifdef CONFIG_STACK_GROWSUP 129 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items)) 130 #define STACK_ROUND(sp, items) \ 131 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL) 132 #define STACK_ALLOC(sp, len) ({ elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; old_sp; }) 133 #else 134 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items)) 135 #define STACK_ROUND(sp, items) \ 136 (((unsigned long) (sp - items)) &~ 15UL) 137 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; }) 138 #endif 139 140 static int 141 create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec, 142 int interp_aout, unsigned long load_addr, 143 unsigned long interp_load_addr) 144 { 145 unsigned long p = bprm->p; 146 int argc = bprm->argc; 147 int envc = bprm->envc; 148 elf_addr_t __user *argv; 149 elf_addr_t __user *envp; 150 elf_addr_t __user *sp; 151 elf_addr_t __user *u_platform; 152 const char *k_platform = ELF_PLATFORM; 153 int items; 154 elf_addr_t *elf_info; 155 int ei_index = 0; 156 struct task_struct *tsk = current; 157 158 /* 159 * If this architecture has a platform capability string, copy it 160 * to userspace. In some cases (Sparc), this info is impossible 161 * for userspace to get any other way, in others (i386) it is 162 * merely difficult. 163 */ 164 165 u_platform = NULL; 166 if (k_platform) { 167 size_t len = strlen(k_platform) + 1; 168 169 /* 170 * In some cases (e.g. Hyper-Threading), we want to avoid L1 171 * evictions by the processes running on the same package. One 172 * thing we can do is to shuffle the initial stack for them. 173 */ 174 175 p = arch_align_stack(p); 176 177 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 178 if (__copy_to_user(u_platform, k_platform, len)) 179 return -EFAULT; 180 } 181 182 /* Create the ELF interpreter info */ 183 elf_info = (elf_addr_t *) current->mm->saved_auxv; 184 #define NEW_AUX_ENT(id, val) \ 185 do { elf_info[ei_index++] = id; elf_info[ei_index++] = val; } while (0) 186 187 #ifdef ARCH_DLINFO 188 /* 189 * ARCH_DLINFO must come first so PPC can do its special alignment of 190 * AUXV. 191 */ 192 ARCH_DLINFO; 193 #endif 194 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); 195 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); 196 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); 197 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); 198 NEW_AUX_ENT(AT_PHENT, sizeof (struct elf_phdr)); 199 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); 200 NEW_AUX_ENT(AT_BASE, interp_load_addr); 201 NEW_AUX_ENT(AT_FLAGS, 0); 202 NEW_AUX_ENT(AT_ENTRY, exec->e_entry); 203 NEW_AUX_ENT(AT_UID, (elf_addr_t) tsk->uid); 204 NEW_AUX_ENT(AT_EUID, (elf_addr_t) tsk->euid); 205 NEW_AUX_ENT(AT_GID, (elf_addr_t) tsk->gid); 206 NEW_AUX_ENT(AT_EGID, (elf_addr_t) tsk->egid); 207 NEW_AUX_ENT(AT_SECURE, (elf_addr_t) security_bprm_secureexec(bprm)); 208 if (k_platform) { 209 NEW_AUX_ENT(AT_PLATFORM, (elf_addr_t)(unsigned long)u_platform); 210 } 211 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) { 212 NEW_AUX_ENT(AT_EXECFD, (elf_addr_t) bprm->interp_data); 213 } 214 #undef NEW_AUX_ENT 215 /* AT_NULL is zero; clear the rest too */ 216 memset(&elf_info[ei_index], 0, 217 sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]); 218 219 /* And advance past the AT_NULL entry. */ 220 ei_index += 2; 221 222 sp = STACK_ADD(p, ei_index); 223 224 items = (argc + 1) + (envc + 1); 225 if (interp_aout) { 226 items += 3; /* a.out interpreters require argv & envp too */ 227 } else { 228 items += 1; /* ELF interpreters only put argc on the stack */ 229 } 230 bprm->p = STACK_ROUND(sp, items); 231 232 /* Point sp at the lowest address on the stack */ 233 #ifdef CONFIG_STACK_GROWSUP 234 sp = (elf_addr_t __user *)bprm->p - items - ei_index; 235 bprm->exec = (unsigned long) sp; /* XXX: PARISC HACK */ 236 #else 237 sp = (elf_addr_t __user *)bprm->p; 238 #endif 239 240 /* Now, let's put argc (and argv, envp if appropriate) on the stack */ 241 if (__put_user(argc, sp++)) 242 return -EFAULT; 243 if (interp_aout) { 244 argv = sp + 2; 245 envp = argv + argc + 1; 246 __put_user((elf_addr_t)(unsigned long)argv, sp++); 247 __put_user((elf_addr_t)(unsigned long)envp, sp++); 248 } else { 249 argv = sp; 250 envp = argv + argc + 1; 251 } 252 253 /* Populate argv and envp */ 254 p = current->mm->arg_start; 255 while (argc-- > 0) { 256 size_t len; 257 __put_user((elf_addr_t)p, argv++); 258 len = strnlen_user((void __user *)p, PAGE_SIZE*MAX_ARG_PAGES); 259 if (!len || len > PAGE_SIZE*MAX_ARG_PAGES) 260 return 0; 261 p += len; 262 } 263 if (__put_user(0, argv)) 264 return -EFAULT; 265 current->mm->arg_end = current->mm->env_start = p; 266 while (envc-- > 0) { 267 size_t len; 268 __put_user((elf_addr_t)p, envp++); 269 len = strnlen_user((void __user *)p, PAGE_SIZE*MAX_ARG_PAGES); 270 if (!len || len > PAGE_SIZE*MAX_ARG_PAGES) 271 return 0; 272 p += len; 273 } 274 if (__put_user(0, envp)) 275 return -EFAULT; 276 current->mm->env_end = p; 277 278 /* Put the elf_info on the stack in the right place. */ 279 sp = (elf_addr_t __user *)envp + 1; 280 if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t))) 281 return -EFAULT; 282 return 0; 283 } 284 285 #ifndef elf_map 286 287 static unsigned long elf_map(struct file *filep, unsigned long addr, 288 struct elf_phdr *eppnt, int prot, int type) 289 { 290 unsigned long map_addr; 291 292 down_write(¤t->mm->mmap_sem); 293 map_addr = do_mmap(filep, ELF_PAGESTART(addr), 294 eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr), prot, type, 295 eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr)); 296 up_write(¤t->mm->mmap_sem); 297 return(map_addr); 298 } 299 300 #endif /* !elf_map */ 301 302 /* This is much more generalized than the library routine read function, 303 so we keep this separate. Technically the library read function 304 is only provided so that we can read a.out libraries that have 305 an ELF header */ 306 307 static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex, 308 struct file * interpreter, 309 unsigned long *interp_load_addr) 310 { 311 struct elf_phdr *elf_phdata; 312 struct elf_phdr *eppnt; 313 unsigned long load_addr = 0; 314 int load_addr_set = 0; 315 unsigned long last_bss = 0, elf_bss = 0; 316 unsigned long error = ~0UL; 317 int retval, i, size; 318 319 /* First of all, some simple consistency checks */ 320 if (interp_elf_ex->e_type != ET_EXEC && 321 interp_elf_ex->e_type != ET_DYN) 322 goto out; 323 if (!elf_check_arch(interp_elf_ex)) 324 goto out; 325 if (!interpreter->f_op || !interpreter->f_op->mmap) 326 goto out; 327 328 /* 329 * If the size of this structure has changed, then punt, since 330 * we will be doing the wrong thing. 331 */ 332 if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr)) 333 goto out; 334 if (interp_elf_ex->e_phnum < 1 || 335 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr)) 336 goto out; 337 338 /* Now read in all of the header information */ 339 340 size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum; 341 if (size > ELF_MIN_ALIGN) 342 goto out; 343 elf_phdata = (struct elf_phdr *) kmalloc(size, GFP_KERNEL); 344 if (!elf_phdata) 345 goto out; 346 347 retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size); 348 error = -EIO; 349 if (retval != size) { 350 if (retval < 0) 351 error = retval; 352 goto out_close; 353 } 354 355 eppnt = elf_phdata; 356 for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) { 357 if (eppnt->p_type == PT_LOAD) { 358 int elf_type = MAP_PRIVATE | MAP_DENYWRITE; 359 int elf_prot = 0; 360 unsigned long vaddr = 0; 361 unsigned long k, map_addr; 362 363 if (eppnt->p_flags & PF_R) elf_prot = PROT_READ; 364 if (eppnt->p_flags & PF_W) elf_prot |= PROT_WRITE; 365 if (eppnt->p_flags & PF_X) elf_prot |= PROT_EXEC; 366 vaddr = eppnt->p_vaddr; 367 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) 368 elf_type |= MAP_FIXED; 369 370 map_addr = elf_map(interpreter, load_addr + vaddr, eppnt, elf_prot, elf_type); 371 error = map_addr; 372 if (BAD_ADDR(map_addr)) 373 goto out_close; 374 375 if (!load_addr_set && interp_elf_ex->e_type == ET_DYN) { 376 load_addr = map_addr - ELF_PAGESTART(vaddr); 377 load_addr_set = 1; 378 } 379 380 /* 381 * Check to see if the section's size will overflow the 382 * allowed task size. Note that p_filesz must always be 383 * <= p_memsize so it is only necessary to check p_memsz. 384 */ 385 k = load_addr + eppnt->p_vaddr; 386 if (k > TASK_SIZE || eppnt->p_filesz > eppnt->p_memsz || 387 eppnt->p_memsz > TASK_SIZE || TASK_SIZE - eppnt->p_memsz < k) { 388 error = -ENOMEM; 389 goto out_close; 390 } 391 392 /* 393 * Find the end of the file mapping for this phdr, and keep 394 * track of the largest address we see for this. 395 */ 396 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz; 397 if (k > elf_bss) 398 elf_bss = k; 399 400 /* 401 * Do the same thing for the memory mapping - between 402 * elf_bss and last_bss is the bss section. 403 */ 404 k = load_addr + eppnt->p_memsz + eppnt->p_vaddr; 405 if (k > last_bss) 406 last_bss = k; 407 } 408 } 409 410 /* 411 * Now fill out the bss section. First pad the last page up 412 * to the page boundary, and then perform a mmap to make sure 413 * that there are zero-mapped pages up to and including the 414 * last bss page. 415 */ 416 if (padzero(elf_bss)) { 417 error = -EFAULT; 418 goto out_close; 419 } 420 421 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1); /* What we have mapped so far */ 422 423 /* Map the last of the bss segment */ 424 if (last_bss > elf_bss) { 425 down_write(¤t->mm->mmap_sem); 426 error = do_brk(elf_bss, last_bss - elf_bss); 427 up_write(¤t->mm->mmap_sem); 428 if (BAD_ADDR(error)) 429 goto out_close; 430 } 431 432 *interp_load_addr = load_addr; 433 error = ((unsigned long) interp_elf_ex->e_entry) + load_addr; 434 435 out_close: 436 kfree(elf_phdata); 437 out: 438 return error; 439 } 440 441 static unsigned long load_aout_interp(struct exec * interp_ex, 442 struct file * interpreter) 443 { 444 unsigned long text_data, elf_entry = ~0UL; 445 char __user * addr; 446 loff_t offset; 447 448 current->mm->end_code = interp_ex->a_text; 449 text_data = interp_ex->a_text + interp_ex->a_data; 450 current->mm->end_data = text_data; 451 current->mm->brk = interp_ex->a_bss + text_data; 452 453 switch (N_MAGIC(*interp_ex)) { 454 case OMAGIC: 455 offset = 32; 456 addr = (char __user *)0; 457 break; 458 case ZMAGIC: 459 case QMAGIC: 460 offset = N_TXTOFF(*interp_ex); 461 addr = (char __user *) N_TXTADDR(*interp_ex); 462 break; 463 default: 464 goto out; 465 } 466 467 down_write(¤t->mm->mmap_sem); 468 do_brk(0, text_data); 469 up_write(¤t->mm->mmap_sem); 470 if (!interpreter->f_op || !interpreter->f_op->read) 471 goto out; 472 if (interpreter->f_op->read(interpreter, addr, text_data, &offset) < 0) 473 goto out; 474 flush_icache_range((unsigned long)addr, 475 (unsigned long)addr + text_data); 476 477 478 down_write(¤t->mm->mmap_sem); 479 do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1), 480 interp_ex->a_bss); 481 up_write(¤t->mm->mmap_sem); 482 elf_entry = interp_ex->a_entry; 483 484 out: 485 return elf_entry; 486 } 487 488 /* 489 * These are the functions used to load ELF style executables and shared 490 * libraries. There is no binary dependent code anywhere else. 491 */ 492 493 #define INTERPRETER_NONE 0 494 #define INTERPRETER_AOUT 1 495 #define INTERPRETER_ELF 2 496 497 498 static unsigned long randomize_stack_top(unsigned long stack_top) 499 { 500 unsigned int random_variable = 0; 501 502 if (current->flags & PF_RANDOMIZE) 503 random_variable = get_random_int() % (8*1024*1024); 504 #ifdef CONFIG_STACK_GROWSUP 505 return PAGE_ALIGN(stack_top + random_variable); 506 #else 507 return PAGE_ALIGN(stack_top - random_variable); 508 #endif 509 } 510 511 static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs) 512 { 513 struct file *interpreter = NULL; /* to shut gcc up */ 514 unsigned long load_addr = 0, load_bias = 0; 515 int load_addr_set = 0; 516 char * elf_interpreter = NULL; 517 unsigned int interpreter_type = INTERPRETER_NONE; 518 unsigned char ibcs2_interpreter = 0; 519 unsigned long error; 520 struct elf_phdr * elf_ppnt, *elf_phdata; 521 unsigned long elf_bss, elf_brk; 522 int elf_exec_fileno; 523 int retval, i; 524 unsigned int size; 525 unsigned long elf_entry, interp_load_addr = 0; 526 unsigned long start_code, end_code, start_data, end_data; 527 unsigned long reloc_func_desc = 0; 528 char passed_fileno[6]; 529 struct files_struct *files; 530 int have_pt_gnu_stack, executable_stack = EXSTACK_DEFAULT; 531 unsigned long def_flags = 0; 532 struct { 533 struct elfhdr elf_ex; 534 struct elfhdr interp_elf_ex; 535 struct exec interp_ex; 536 } *loc; 537 538 loc = kmalloc(sizeof(*loc), GFP_KERNEL); 539 if (!loc) { 540 retval = -ENOMEM; 541 goto out_ret; 542 } 543 544 /* Get the exec-header */ 545 loc->elf_ex = *((struct elfhdr *) bprm->buf); 546 547 retval = -ENOEXEC; 548 /* First of all, some simple consistency checks */ 549 if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 550 goto out; 551 552 if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN) 553 goto out; 554 if (!elf_check_arch(&loc->elf_ex)) 555 goto out; 556 if (!bprm->file->f_op||!bprm->file->f_op->mmap) 557 goto out; 558 559 /* Now read in all of the header information */ 560 561 if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr)) 562 goto out; 563 if (loc->elf_ex.e_phnum < 1 || 564 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr)) 565 goto out; 566 size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr); 567 retval = -ENOMEM; 568 elf_phdata = (struct elf_phdr *) kmalloc(size, GFP_KERNEL); 569 if (!elf_phdata) 570 goto out; 571 572 retval = kernel_read(bprm->file, loc->elf_ex.e_phoff, (char *) elf_phdata, size); 573 if (retval != size) { 574 if (retval >= 0) 575 retval = -EIO; 576 goto out_free_ph; 577 } 578 579 files = current->files; /* Refcounted so ok */ 580 retval = unshare_files(); 581 if (retval < 0) 582 goto out_free_ph; 583 if (files == current->files) { 584 put_files_struct(files); 585 files = NULL; 586 } 587 588 /* exec will make our files private anyway, but for the a.out 589 loader stuff we need to do it earlier */ 590 591 retval = get_unused_fd(); 592 if (retval < 0) 593 goto out_free_fh; 594 get_file(bprm->file); 595 fd_install(elf_exec_fileno = retval, bprm->file); 596 597 elf_ppnt = elf_phdata; 598 elf_bss = 0; 599 elf_brk = 0; 600 601 start_code = ~0UL; 602 end_code = 0; 603 start_data = 0; 604 end_data = 0; 605 606 for (i = 0; i < loc->elf_ex.e_phnum; i++) { 607 if (elf_ppnt->p_type == PT_INTERP) { 608 /* This is the program interpreter used for 609 * shared libraries - for now assume that this 610 * is an a.out format binary 611 */ 612 613 retval = -ENOEXEC; 614 if (elf_ppnt->p_filesz > PATH_MAX || 615 elf_ppnt->p_filesz < 2) 616 goto out_free_file; 617 618 retval = -ENOMEM; 619 elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz, 620 GFP_KERNEL); 621 if (!elf_interpreter) 622 goto out_free_file; 623 624 retval = kernel_read(bprm->file, elf_ppnt->p_offset, 625 elf_interpreter, 626 elf_ppnt->p_filesz); 627 if (retval != elf_ppnt->p_filesz) { 628 if (retval >= 0) 629 retval = -EIO; 630 goto out_free_interp; 631 } 632 /* make sure path is NULL terminated */ 633 retval = -ENOEXEC; 634 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') 635 goto out_free_interp; 636 637 /* If the program interpreter is one of these two, 638 * then assume an iBCS2 image. Otherwise assume 639 * a native linux image. 640 */ 641 if (strcmp(elf_interpreter,"/usr/lib/libc.so.1") == 0 || 642 strcmp(elf_interpreter,"/usr/lib/ld.so.1") == 0) 643 ibcs2_interpreter = 1; 644 645 /* 646 * The early SET_PERSONALITY here is so that the lookup 647 * for the interpreter happens in the namespace of the 648 * to-be-execed image. SET_PERSONALITY can select an 649 * alternate root. 650 * 651 * However, SET_PERSONALITY is NOT allowed to switch 652 * this task into the new images's memory mapping 653 * policy - that is, TASK_SIZE must still evaluate to 654 * that which is appropriate to the execing application. 655 * This is because exit_mmap() needs to have TASK_SIZE 656 * evaluate to the size of the old image. 657 * 658 * So if (say) a 64-bit application is execing a 32-bit 659 * application it is the architecture's responsibility 660 * to defer changing the value of TASK_SIZE until the 661 * switch really is going to happen - do this in 662 * flush_thread(). - akpm 663 */ 664 SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter); 665 666 interpreter = open_exec(elf_interpreter); 667 retval = PTR_ERR(interpreter); 668 if (IS_ERR(interpreter)) 669 goto out_free_interp; 670 retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE); 671 if (retval != BINPRM_BUF_SIZE) { 672 if (retval >= 0) 673 retval = -EIO; 674 goto out_free_dentry; 675 } 676 677 /* Get the exec headers */ 678 loc->interp_ex = *((struct exec *) bprm->buf); 679 loc->interp_elf_ex = *((struct elfhdr *) bprm->buf); 680 break; 681 } 682 elf_ppnt++; 683 } 684 685 elf_ppnt = elf_phdata; 686 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) 687 if (elf_ppnt->p_type == PT_GNU_STACK) { 688 if (elf_ppnt->p_flags & PF_X) 689 executable_stack = EXSTACK_ENABLE_X; 690 else 691 executable_stack = EXSTACK_DISABLE_X; 692 break; 693 } 694 have_pt_gnu_stack = (i < loc->elf_ex.e_phnum); 695 696 /* Some simple consistency checks for the interpreter */ 697 if (elf_interpreter) { 698 interpreter_type = INTERPRETER_ELF | INTERPRETER_AOUT; 699 700 /* Now figure out which format our binary is */ 701 if ((N_MAGIC(loc->interp_ex) != OMAGIC) && 702 (N_MAGIC(loc->interp_ex) != ZMAGIC) && 703 (N_MAGIC(loc->interp_ex) != QMAGIC)) 704 interpreter_type = INTERPRETER_ELF; 705 706 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 707 interpreter_type &= ~INTERPRETER_ELF; 708 709 retval = -ELIBBAD; 710 if (!interpreter_type) 711 goto out_free_dentry; 712 713 /* Make sure only one type was selected */ 714 if ((interpreter_type & INTERPRETER_ELF) && 715 interpreter_type != INTERPRETER_ELF) { 716 // FIXME - ratelimit this before re-enabling 717 // printk(KERN_WARNING "ELF: Ambiguous type, using ELF\n"); 718 interpreter_type = INTERPRETER_ELF; 719 } 720 /* Verify the interpreter has a valid arch */ 721 if ((interpreter_type == INTERPRETER_ELF) && 722 !elf_check_arch(&loc->interp_elf_ex)) 723 goto out_free_dentry; 724 } else { 725 /* Executables without an interpreter also need a personality */ 726 SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter); 727 } 728 729 /* OK, we are done with that, now set up the arg stuff, 730 and then start this sucker up */ 731 732 if ((!bprm->sh_bang) && (interpreter_type == INTERPRETER_AOUT)) { 733 char *passed_p = passed_fileno; 734 sprintf(passed_fileno, "%d", elf_exec_fileno); 735 736 if (elf_interpreter) { 737 retval = copy_strings_kernel(1, &passed_p, bprm); 738 if (retval) 739 goto out_free_dentry; 740 bprm->argc++; 741 } 742 } 743 744 /* Flush all traces of the currently running executable */ 745 retval = flush_old_exec(bprm); 746 if (retval) 747 goto out_free_dentry; 748 749 /* Discard our unneeded old files struct */ 750 if (files) { 751 steal_locks(files); 752 put_files_struct(files); 753 files = NULL; 754 } 755 756 /* OK, This is the point of no return */ 757 current->mm->start_data = 0; 758 current->mm->end_data = 0; 759 current->mm->end_code = 0; 760 current->mm->mmap = NULL; 761 current->flags &= ~PF_FORKNOEXEC; 762 current->mm->def_flags = def_flags; 763 764 /* Do this immediately, since STACK_TOP as used in setup_arg_pages 765 may depend on the personality. */ 766 SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter); 767 if (elf_read_implies_exec(loc->elf_ex, executable_stack)) 768 current->personality |= READ_IMPLIES_EXEC; 769 770 if ( !(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) 771 current->flags |= PF_RANDOMIZE; 772 arch_pick_mmap_layout(current->mm); 773 774 /* Do this so that we can load the interpreter, if need be. We will 775 change some of these later */ 776 set_mm_counter(current->mm, rss, 0); 777 current->mm->free_area_cache = current->mm->mmap_base; 778 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), 779 executable_stack); 780 if (retval < 0) { 781 send_sig(SIGKILL, current, 0); 782 goto out_free_dentry; 783 } 784 785 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES 786 retval = arch_setup_additional_pages(bprm, executable_stack); 787 if (retval < 0) { 788 send_sig(SIGKILL, current, 0); 789 goto out_free_dentry; 790 } 791 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ 792 793 current->mm->start_stack = bprm->p; 794 795 /* Now we do a little grungy work by mmaping the ELF image into 796 the correct location in memory. At this point, we assume that 797 the image should be loaded at fixed address, not at a variable 798 address. */ 799 800 for(i = 0, elf_ppnt = elf_phdata; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { 801 int elf_prot = 0, elf_flags; 802 unsigned long k, vaddr; 803 804 if (elf_ppnt->p_type != PT_LOAD) 805 continue; 806 807 if (unlikely (elf_brk > elf_bss)) { 808 unsigned long nbyte; 809 810 /* There was a PT_LOAD segment with p_memsz > p_filesz 811 before this one. Map anonymous pages, if needed, 812 and clear the area. */ 813 retval = set_brk (elf_bss + load_bias, 814 elf_brk + load_bias); 815 if (retval) { 816 send_sig(SIGKILL, current, 0); 817 goto out_free_dentry; 818 } 819 nbyte = ELF_PAGEOFFSET(elf_bss); 820 if (nbyte) { 821 nbyte = ELF_MIN_ALIGN - nbyte; 822 if (nbyte > elf_brk - elf_bss) 823 nbyte = elf_brk - elf_bss; 824 if (clear_user((void __user *)elf_bss + 825 load_bias, nbyte)) { 826 /* 827 * This bss-zeroing can fail if the ELF 828 * file specifies odd protections. So 829 * we don't check the return value 830 */ 831 } 832 } 833 } 834 835 if (elf_ppnt->p_flags & PF_R) elf_prot |= PROT_READ; 836 if (elf_ppnt->p_flags & PF_W) elf_prot |= PROT_WRITE; 837 if (elf_ppnt->p_flags & PF_X) elf_prot |= PROT_EXEC; 838 839 elf_flags = MAP_PRIVATE|MAP_DENYWRITE|MAP_EXECUTABLE; 840 841 vaddr = elf_ppnt->p_vaddr; 842 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) { 843 elf_flags |= MAP_FIXED; 844 } else if (loc->elf_ex.e_type == ET_DYN) { 845 /* Try and get dynamic programs out of the way of the default mmap 846 base, as well as whatever program they might try to exec. This 847 is because the brk will follow the loader, and is not movable. */ 848 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); 849 } 850 851 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags); 852 if (BAD_ADDR(error)) { 853 send_sig(SIGKILL, current, 0); 854 goto out_free_dentry; 855 } 856 857 if (!load_addr_set) { 858 load_addr_set = 1; 859 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset); 860 if (loc->elf_ex.e_type == ET_DYN) { 861 load_bias += error - 862 ELF_PAGESTART(load_bias + vaddr); 863 load_addr += load_bias; 864 reloc_func_desc = load_bias; 865 } 866 } 867 k = elf_ppnt->p_vaddr; 868 if (k < start_code) start_code = k; 869 if (start_data < k) start_data = k; 870 871 /* 872 * Check to see if the section's size will overflow the 873 * allowed task size. Note that p_filesz must always be 874 * <= p_memsz so it is only necessary to check p_memsz. 875 */ 876 if (k > TASK_SIZE || elf_ppnt->p_filesz > elf_ppnt->p_memsz || 877 elf_ppnt->p_memsz > TASK_SIZE || 878 TASK_SIZE - elf_ppnt->p_memsz < k) { 879 /* set_brk can never work. Avoid overflows. */ 880 send_sig(SIGKILL, current, 0); 881 goto out_free_dentry; 882 } 883 884 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; 885 886 if (k > elf_bss) 887 elf_bss = k; 888 if ((elf_ppnt->p_flags & PF_X) && end_code < k) 889 end_code = k; 890 if (end_data < k) 891 end_data = k; 892 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; 893 if (k > elf_brk) 894 elf_brk = k; 895 } 896 897 loc->elf_ex.e_entry += load_bias; 898 elf_bss += load_bias; 899 elf_brk += load_bias; 900 start_code += load_bias; 901 end_code += load_bias; 902 start_data += load_bias; 903 end_data += load_bias; 904 905 /* Calling set_brk effectively mmaps the pages that we need 906 * for the bss and break sections. We must do this before 907 * mapping in the interpreter, to make sure it doesn't wind 908 * up getting placed where the bss needs to go. 909 */ 910 retval = set_brk(elf_bss, elf_brk); 911 if (retval) { 912 send_sig(SIGKILL, current, 0); 913 goto out_free_dentry; 914 } 915 if (padzero(elf_bss)) { 916 send_sig(SIGSEGV, current, 0); 917 retval = -EFAULT; /* Nobody gets to see this, but.. */ 918 goto out_free_dentry; 919 } 920 921 if (elf_interpreter) { 922 if (interpreter_type == INTERPRETER_AOUT) 923 elf_entry = load_aout_interp(&loc->interp_ex, 924 interpreter); 925 else 926 elf_entry = load_elf_interp(&loc->interp_elf_ex, 927 interpreter, 928 &interp_load_addr); 929 if (BAD_ADDR(elf_entry)) { 930 printk(KERN_ERR "Unable to load interpreter %.128s\n", 931 elf_interpreter); 932 force_sig(SIGSEGV, current); 933 retval = -ENOEXEC; /* Nobody gets to see this, but.. */ 934 goto out_free_dentry; 935 } 936 reloc_func_desc = interp_load_addr; 937 938 allow_write_access(interpreter); 939 fput(interpreter); 940 kfree(elf_interpreter); 941 } else { 942 elf_entry = loc->elf_ex.e_entry; 943 } 944 945 kfree(elf_phdata); 946 947 if (interpreter_type != INTERPRETER_AOUT) 948 sys_close(elf_exec_fileno); 949 950 set_binfmt(&elf_format); 951 952 compute_creds(bprm); 953 current->flags &= ~PF_FORKNOEXEC; 954 create_elf_tables(bprm, &loc->elf_ex, (interpreter_type == INTERPRETER_AOUT), 955 load_addr, interp_load_addr); 956 /* N.B. passed_fileno might not be initialized? */ 957 if (interpreter_type == INTERPRETER_AOUT) 958 current->mm->arg_start += strlen(passed_fileno) + 1; 959 current->mm->end_code = end_code; 960 current->mm->start_code = start_code; 961 current->mm->start_data = start_data; 962 current->mm->end_data = end_data; 963 current->mm->start_stack = bprm->p; 964 965 if (current->personality & MMAP_PAGE_ZERO) { 966 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 967 and some applications "depend" upon this behavior. 968 Since we do not have the power to recompile these, we 969 emulate the SVr4 behavior. Sigh. */ 970 down_write(¤t->mm->mmap_sem); 971 error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, 972 MAP_FIXED | MAP_PRIVATE, 0); 973 up_write(¤t->mm->mmap_sem); 974 } 975 976 #ifdef ELF_PLAT_INIT 977 /* 978 * The ABI may specify that certain registers be set up in special 979 * ways (on i386 %edx is the address of a DT_FINI function, for 980 * example. In addition, it may also specify (eg, PowerPC64 ELF) 981 * that the e_entry field is the address of the function descriptor 982 * for the startup routine, rather than the address of the startup 983 * routine itself. This macro performs whatever initialization to 984 * the regs structure is required as well as any relocations to the 985 * function descriptor entries when executing dynamically links apps. 986 */ 987 ELF_PLAT_INIT(regs, reloc_func_desc); 988 #endif 989 990 start_thread(regs, elf_entry, bprm->p); 991 if (unlikely(current->ptrace & PT_PTRACED)) { 992 if (current->ptrace & PT_TRACE_EXEC) 993 ptrace_notify ((PTRACE_EVENT_EXEC << 8) | SIGTRAP); 994 else 995 send_sig(SIGTRAP, current, 0); 996 } 997 retval = 0; 998 out: 999 kfree(loc); 1000 out_ret: 1001 return retval; 1002 1003 /* error cleanup */ 1004 out_free_dentry: 1005 allow_write_access(interpreter); 1006 if (interpreter) 1007 fput(interpreter); 1008 out_free_interp: 1009 if (elf_interpreter) 1010 kfree(elf_interpreter); 1011 out_free_file: 1012 sys_close(elf_exec_fileno); 1013 out_free_fh: 1014 if (files) { 1015 put_files_struct(current->files); 1016 current->files = files; 1017 } 1018 out_free_ph: 1019 kfree(elf_phdata); 1020 goto out; 1021 } 1022 1023 /* This is really simpleminded and specialized - we are loading an 1024 a.out library that is given an ELF header. */ 1025 1026 static int load_elf_library(struct file *file) 1027 { 1028 struct elf_phdr *elf_phdata; 1029 struct elf_phdr *eppnt; 1030 unsigned long elf_bss, bss, len; 1031 int retval, error, i, j; 1032 struct elfhdr elf_ex; 1033 1034 error = -ENOEXEC; 1035 retval = kernel_read(file, 0, (char *) &elf_ex, sizeof(elf_ex)); 1036 if (retval != sizeof(elf_ex)) 1037 goto out; 1038 1039 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 1040 goto out; 1041 1042 /* First of all, some simple consistency checks */ 1043 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 || 1044 !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap) 1045 goto out; 1046 1047 /* Now read in all of the header information */ 1048 1049 j = sizeof(struct elf_phdr) * elf_ex.e_phnum; 1050 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */ 1051 1052 error = -ENOMEM; 1053 elf_phdata = kmalloc(j, GFP_KERNEL); 1054 if (!elf_phdata) 1055 goto out; 1056 1057 eppnt = elf_phdata; 1058 error = -ENOEXEC; 1059 retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j); 1060 if (retval != j) 1061 goto out_free_ph; 1062 1063 for (j = 0, i = 0; i<elf_ex.e_phnum; i++) 1064 if ((eppnt + i)->p_type == PT_LOAD) 1065 j++; 1066 if (j != 1) 1067 goto out_free_ph; 1068 1069 while (eppnt->p_type != PT_LOAD) 1070 eppnt++; 1071 1072 /* Now use mmap to map the library into memory. */ 1073 down_write(¤t->mm->mmap_sem); 1074 error = do_mmap(file, 1075 ELF_PAGESTART(eppnt->p_vaddr), 1076 (eppnt->p_filesz + 1077 ELF_PAGEOFFSET(eppnt->p_vaddr)), 1078 PROT_READ | PROT_WRITE | PROT_EXEC, 1079 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE, 1080 (eppnt->p_offset - 1081 ELF_PAGEOFFSET(eppnt->p_vaddr))); 1082 up_write(¤t->mm->mmap_sem); 1083 if (error != ELF_PAGESTART(eppnt->p_vaddr)) 1084 goto out_free_ph; 1085 1086 elf_bss = eppnt->p_vaddr + eppnt->p_filesz; 1087 if (padzero(elf_bss)) { 1088 error = -EFAULT; 1089 goto out_free_ph; 1090 } 1091 1092 len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + ELF_MIN_ALIGN - 1); 1093 bss = eppnt->p_memsz + eppnt->p_vaddr; 1094 if (bss > len) { 1095 down_write(¤t->mm->mmap_sem); 1096 do_brk(len, bss - len); 1097 up_write(¤t->mm->mmap_sem); 1098 } 1099 error = 0; 1100 1101 out_free_ph: 1102 kfree(elf_phdata); 1103 out: 1104 return error; 1105 } 1106 1107 /* 1108 * Note that some platforms still use traditional core dumps and not 1109 * the ELF core dump. Each platform can select it as appropriate. 1110 */ 1111 #ifdef USE_ELF_CORE_DUMP 1112 1113 /* 1114 * ELF core dumper 1115 * 1116 * Modelled on fs/exec.c:aout_core_dump() 1117 * Jeremy Fitzhardinge <jeremy@sw.oz.au> 1118 */ 1119 /* 1120 * These are the only things you should do on a core-file: use only these 1121 * functions to write out all the necessary info. 1122 */ 1123 static int dump_write(struct file *file, const void *addr, int nr) 1124 { 1125 return file->f_op->write(file, addr, nr, &file->f_pos) == nr; 1126 } 1127 1128 static int dump_seek(struct file *file, off_t off) 1129 { 1130 if (file->f_op->llseek) { 1131 if (file->f_op->llseek(file, off, 0) != off) 1132 return 0; 1133 } else 1134 file->f_pos = off; 1135 return 1; 1136 } 1137 1138 /* 1139 * Decide whether a segment is worth dumping; default is yes to be 1140 * sure (missing info is worse than too much; etc). 1141 * Personally I'd include everything, and use the coredump limit... 1142 * 1143 * I think we should skip something. But I am not sure how. H.J. 1144 */ 1145 static int maydump(struct vm_area_struct *vma) 1146 { 1147 /* Do not dump I/O mapped devices or special mappings */ 1148 if (vma->vm_flags & (VM_IO | VM_RESERVED)) 1149 return 0; 1150 1151 /* Dump shared memory only if mapped from an anonymous file. */ 1152 if (vma->vm_flags & VM_SHARED) 1153 return vma->vm_file->f_dentry->d_inode->i_nlink == 0; 1154 1155 /* If it hasn't been written to, don't write it out */ 1156 if (!vma->anon_vma) 1157 return 0; 1158 1159 return 1; 1160 } 1161 1162 #define roundup(x, y) ((((x)+((y)-1))/(y))*(y)) 1163 1164 /* An ELF note in memory */ 1165 struct memelfnote 1166 { 1167 const char *name; 1168 int type; 1169 unsigned int datasz; 1170 void *data; 1171 }; 1172 1173 static int notesize(struct memelfnote *en) 1174 { 1175 int sz; 1176 1177 sz = sizeof(struct elf_note); 1178 sz += roundup(strlen(en->name) + 1, 4); 1179 sz += roundup(en->datasz, 4); 1180 1181 return sz; 1182 } 1183 1184 #define DUMP_WRITE(addr, nr) \ 1185 do { if (!dump_write(file, (addr), (nr))) return 0; } while(0) 1186 #define DUMP_SEEK(off) \ 1187 do { if (!dump_seek(file, (off))) return 0; } while(0) 1188 1189 static int writenote(struct memelfnote *men, struct file *file) 1190 { 1191 struct elf_note en; 1192 1193 en.n_namesz = strlen(men->name) + 1; 1194 en.n_descsz = men->datasz; 1195 en.n_type = men->type; 1196 1197 DUMP_WRITE(&en, sizeof(en)); 1198 DUMP_WRITE(men->name, en.n_namesz); 1199 /* XXX - cast from long long to long to avoid need for libgcc.a */ 1200 DUMP_SEEK(roundup((unsigned long)file->f_pos, 4)); /* XXX */ 1201 DUMP_WRITE(men->data, men->datasz); 1202 DUMP_SEEK(roundup((unsigned long)file->f_pos, 4)); /* XXX */ 1203 1204 return 1; 1205 } 1206 #undef DUMP_WRITE 1207 #undef DUMP_SEEK 1208 1209 #define DUMP_WRITE(addr, nr) \ 1210 if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \ 1211 goto end_coredump; 1212 #define DUMP_SEEK(off) \ 1213 if (!dump_seek(file, (off))) \ 1214 goto end_coredump; 1215 1216 static inline void fill_elf_header(struct elfhdr *elf, int segs) 1217 { 1218 memcpy(elf->e_ident, ELFMAG, SELFMAG); 1219 elf->e_ident[EI_CLASS] = ELF_CLASS; 1220 elf->e_ident[EI_DATA] = ELF_DATA; 1221 elf->e_ident[EI_VERSION] = EV_CURRENT; 1222 elf->e_ident[EI_OSABI] = ELF_OSABI; 1223 memset(elf->e_ident+EI_PAD, 0, EI_NIDENT-EI_PAD); 1224 1225 elf->e_type = ET_CORE; 1226 elf->e_machine = ELF_ARCH; 1227 elf->e_version = EV_CURRENT; 1228 elf->e_entry = 0; 1229 elf->e_phoff = sizeof(struct elfhdr); 1230 elf->e_shoff = 0; 1231 elf->e_flags = ELF_CORE_EFLAGS; 1232 elf->e_ehsize = sizeof(struct elfhdr); 1233 elf->e_phentsize = sizeof(struct elf_phdr); 1234 elf->e_phnum = segs; 1235 elf->e_shentsize = 0; 1236 elf->e_shnum = 0; 1237 elf->e_shstrndx = 0; 1238 return; 1239 } 1240 1241 static inline void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, off_t offset) 1242 { 1243 phdr->p_type = PT_NOTE; 1244 phdr->p_offset = offset; 1245 phdr->p_vaddr = 0; 1246 phdr->p_paddr = 0; 1247 phdr->p_filesz = sz; 1248 phdr->p_memsz = 0; 1249 phdr->p_flags = 0; 1250 phdr->p_align = 0; 1251 return; 1252 } 1253 1254 static void fill_note(struct memelfnote *note, const char *name, int type, 1255 unsigned int sz, void *data) 1256 { 1257 note->name = name; 1258 note->type = type; 1259 note->datasz = sz; 1260 note->data = data; 1261 return; 1262 } 1263 1264 /* 1265 * fill up all the fields in prstatus from the given task struct, except registers 1266 * which need to be filled up separately. 1267 */ 1268 static void fill_prstatus(struct elf_prstatus *prstatus, 1269 struct task_struct *p, long signr) 1270 { 1271 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 1272 prstatus->pr_sigpend = p->pending.signal.sig[0]; 1273 prstatus->pr_sighold = p->blocked.sig[0]; 1274 prstatus->pr_pid = p->pid; 1275 prstatus->pr_ppid = p->parent->pid; 1276 prstatus->pr_pgrp = process_group(p); 1277 prstatus->pr_sid = p->signal->session; 1278 if (thread_group_leader(p)) { 1279 /* 1280 * This is the record for the group leader. Add in the 1281 * cumulative times of previous dead threads. This total 1282 * won't include the time of each live thread whose state 1283 * is included in the core dump. The final total reported 1284 * to our parent process when it calls wait4 will include 1285 * those sums as well as the little bit more time it takes 1286 * this and each other thread to finish dying after the 1287 * core dump synchronization phase. 1288 */ 1289 cputime_to_timeval(cputime_add(p->utime, p->signal->utime), 1290 &prstatus->pr_utime); 1291 cputime_to_timeval(cputime_add(p->stime, p->signal->stime), 1292 &prstatus->pr_stime); 1293 } else { 1294 cputime_to_timeval(p->utime, &prstatus->pr_utime); 1295 cputime_to_timeval(p->stime, &prstatus->pr_stime); 1296 } 1297 cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime); 1298 cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime); 1299 } 1300 1301 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, 1302 struct mm_struct *mm) 1303 { 1304 int i, len; 1305 1306 /* first copy the parameters from user space */ 1307 memset(psinfo, 0, sizeof(struct elf_prpsinfo)); 1308 1309 len = mm->arg_end - mm->arg_start; 1310 if (len >= ELF_PRARGSZ) 1311 len = ELF_PRARGSZ-1; 1312 if (copy_from_user(&psinfo->pr_psargs, 1313 (const char __user *)mm->arg_start, len)) 1314 return -EFAULT; 1315 for(i = 0; i < len; i++) 1316 if (psinfo->pr_psargs[i] == 0) 1317 psinfo->pr_psargs[i] = ' '; 1318 psinfo->pr_psargs[len] = 0; 1319 1320 psinfo->pr_pid = p->pid; 1321 psinfo->pr_ppid = p->parent->pid; 1322 psinfo->pr_pgrp = process_group(p); 1323 psinfo->pr_sid = p->signal->session; 1324 1325 i = p->state ? ffz(~p->state) + 1 : 0; 1326 psinfo->pr_state = i; 1327 psinfo->pr_sname = (i < 0 || i > 5) ? '.' : "RSDTZW"[i]; 1328 psinfo->pr_zomb = psinfo->pr_sname == 'Z'; 1329 psinfo->pr_nice = task_nice(p); 1330 psinfo->pr_flag = p->flags; 1331 SET_UID(psinfo->pr_uid, p->uid); 1332 SET_GID(psinfo->pr_gid, p->gid); 1333 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname)); 1334 1335 return 0; 1336 } 1337 1338 /* Here is the structure in which status of each thread is captured. */ 1339 struct elf_thread_status 1340 { 1341 struct list_head list; 1342 struct elf_prstatus prstatus; /* NT_PRSTATUS */ 1343 elf_fpregset_t fpu; /* NT_PRFPREG */ 1344 struct task_struct *thread; 1345 #ifdef ELF_CORE_COPY_XFPREGS 1346 elf_fpxregset_t xfpu; /* NT_PRXFPREG */ 1347 #endif 1348 struct memelfnote notes[3]; 1349 int num_notes; 1350 }; 1351 1352 /* 1353 * In order to add the specific thread information for the elf file format, 1354 * we need to keep a linked list of every threads pr_status and then 1355 * create a single section for them in the final core file. 1356 */ 1357 static int elf_dump_thread_status(long signr, struct elf_thread_status *t) 1358 { 1359 int sz = 0; 1360 struct task_struct *p = t->thread; 1361 t->num_notes = 0; 1362 1363 fill_prstatus(&t->prstatus, p, signr); 1364 elf_core_copy_task_regs(p, &t->prstatus.pr_reg); 1365 1366 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), &(t->prstatus)); 1367 t->num_notes++; 1368 sz += notesize(&t->notes[0]); 1369 1370 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, &t->fpu))) { 1371 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), &(t->fpu)); 1372 t->num_notes++; 1373 sz += notesize(&t->notes[1]); 1374 } 1375 1376 #ifdef ELF_CORE_COPY_XFPREGS 1377 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) { 1378 fill_note(&t->notes[2], "LINUX", NT_PRXFPREG, sizeof(t->xfpu), &t->xfpu); 1379 t->num_notes++; 1380 sz += notesize(&t->notes[2]); 1381 } 1382 #endif 1383 return sz; 1384 } 1385 1386 /* 1387 * Actual dumper 1388 * 1389 * This is a two-pass process; first we find the offsets of the bits, 1390 * and then they are actually written out. If we run out of core limit 1391 * we just truncate. 1392 */ 1393 static int elf_core_dump(long signr, struct pt_regs * regs, struct file * file) 1394 { 1395 #define NUM_NOTES 6 1396 int has_dumped = 0; 1397 mm_segment_t fs; 1398 int segs; 1399 size_t size = 0; 1400 int i; 1401 struct vm_area_struct *vma; 1402 struct elfhdr *elf = NULL; 1403 off_t offset = 0, dataoff; 1404 unsigned long limit = current->signal->rlim[RLIMIT_CORE].rlim_cur; 1405 int numnote; 1406 struct memelfnote *notes = NULL; 1407 struct elf_prstatus *prstatus = NULL; /* NT_PRSTATUS */ 1408 struct elf_prpsinfo *psinfo = NULL; /* NT_PRPSINFO */ 1409 struct task_struct *g, *p; 1410 LIST_HEAD(thread_list); 1411 struct list_head *t; 1412 elf_fpregset_t *fpu = NULL; 1413 #ifdef ELF_CORE_COPY_XFPREGS 1414 elf_fpxregset_t *xfpu = NULL; 1415 #endif 1416 int thread_status_size = 0; 1417 elf_addr_t *auxv; 1418 1419 /* 1420 * We no longer stop all VM operations. 1421 * 1422 * This is because those proceses that could possibly change map_count or 1423 * the mmap / vma pages are now blocked in do_exit on current finishing 1424 * this core dump. 1425 * 1426 * Only ptrace can touch these memory addresses, but it doesn't change 1427 * the map_count or the pages allocated. So no possibility of crashing 1428 * exists while dumping the mm->vm_next areas to the core file. 1429 */ 1430 1431 /* alloc memory for large data structures: too large to be on stack */ 1432 elf = kmalloc(sizeof(*elf), GFP_KERNEL); 1433 if (!elf) 1434 goto cleanup; 1435 prstatus = kmalloc(sizeof(*prstatus), GFP_KERNEL); 1436 if (!prstatus) 1437 goto cleanup; 1438 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1439 if (!psinfo) 1440 goto cleanup; 1441 notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote), GFP_KERNEL); 1442 if (!notes) 1443 goto cleanup; 1444 fpu = kmalloc(sizeof(*fpu), GFP_KERNEL); 1445 if (!fpu) 1446 goto cleanup; 1447 #ifdef ELF_CORE_COPY_XFPREGS 1448 xfpu = kmalloc(sizeof(*xfpu), GFP_KERNEL); 1449 if (!xfpu) 1450 goto cleanup; 1451 #endif 1452 1453 if (signr) { 1454 struct elf_thread_status *tmp; 1455 read_lock(&tasklist_lock); 1456 do_each_thread(g,p) 1457 if (current->mm == p->mm && current != p) { 1458 tmp = kmalloc(sizeof(*tmp), GFP_ATOMIC); 1459 if (!tmp) { 1460 read_unlock(&tasklist_lock); 1461 goto cleanup; 1462 } 1463 memset(tmp, 0, sizeof(*tmp)); 1464 INIT_LIST_HEAD(&tmp->list); 1465 tmp->thread = p; 1466 list_add(&tmp->list, &thread_list); 1467 } 1468 while_each_thread(g,p); 1469 read_unlock(&tasklist_lock); 1470 list_for_each(t, &thread_list) { 1471 struct elf_thread_status *tmp; 1472 int sz; 1473 1474 tmp = list_entry(t, struct elf_thread_status, list); 1475 sz = elf_dump_thread_status(signr, tmp); 1476 thread_status_size += sz; 1477 } 1478 } 1479 /* now collect the dump for the current */ 1480 memset(prstatus, 0, sizeof(*prstatus)); 1481 fill_prstatus(prstatus, current, signr); 1482 elf_core_copy_regs(&prstatus->pr_reg, regs); 1483 1484 segs = current->mm->map_count; 1485 #ifdef ELF_CORE_EXTRA_PHDRS 1486 segs += ELF_CORE_EXTRA_PHDRS; 1487 #endif 1488 1489 /* Set up header */ 1490 fill_elf_header(elf, segs+1); /* including notes section */ 1491 1492 has_dumped = 1; 1493 current->flags |= PF_DUMPCORE; 1494 1495 /* 1496 * Set up the notes in similar form to SVR4 core dumps made 1497 * with info from their /proc. 1498 */ 1499 1500 fill_note(notes +0, "CORE", NT_PRSTATUS, sizeof(*prstatus), prstatus); 1501 1502 fill_psinfo(psinfo, current->group_leader, current->mm); 1503 fill_note(notes +1, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); 1504 1505 fill_note(notes +2, "CORE", NT_TASKSTRUCT, sizeof(*current), current); 1506 1507 numnote = 3; 1508 1509 auxv = (elf_addr_t *) current->mm->saved_auxv; 1510 1511 i = 0; 1512 do 1513 i += 2; 1514 while (auxv[i - 2] != AT_NULL); 1515 fill_note(¬es[numnote++], "CORE", NT_AUXV, 1516 i * sizeof (elf_addr_t), auxv); 1517 1518 /* Try to dump the FPU. */ 1519 if ((prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, fpu))) 1520 fill_note(notes + numnote++, 1521 "CORE", NT_PRFPREG, sizeof(*fpu), fpu); 1522 #ifdef ELF_CORE_COPY_XFPREGS 1523 if (elf_core_copy_task_xfpregs(current, xfpu)) 1524 fill_note(notes + numnote++, 1525 "LINUX", NT_PRXFPREG, sizeof(*xfpu), xfpu); 1526 #endif 1527 1528 fs = get_fs(); 1529 set_fs(KERNEL_DS); 1530 1531 DUMP_WRITE(elf, sizeof(*elf)); 1532 offset += sizeof(*elf); /* Elf header */ 1533 offset += (segs+1) * sizeof(struct elf_phdr); /* Program headers */ 1534 1535 /* Write notes phdr entry */ 1536 { 1537 struct elf_phdr phdr; 1538 int sz = 0; 1539 1540 for (i = 0; i < numnote; i++) 1541 sz += notesize(notes + i); 1542 1543 sz += thread_status_size; 1544 1545 fill_elf_note_phdr(&phdr, sz, offset); 1546 offset += sz; 1547 DUMP_WRITE(&phdr, sizeof(phdr)); 1548 } 1549 1550 /* Page-align dumped data */ 1551 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); 1552 1553 /* Write program headers for segments dump */ 1554 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) { 1555 struct elf_phdr phdr; 1556 size_t sz; 1557 1558 sz = vma->vm_end - vma->vm_start; 1559 1560 phdr.p_type = PT_LOAD; 1561 phdr.p_offset = offset; 1562 phdr.p_vaddr = vma->vm_start; 1563 phdr.p_paddr = 0; 1564 phdr.p_filesz = maydump(vma) ? sz : 0; 1565 phdr.p_memsz = sz; 1566 offset += phdr.p_filesz; 1567 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; 1568 if (vma->vm_flags & VM_WRITE) phdr.p_flags |= PF_W; 1569 if (vma->vm_flags & VM_EXEC) phdr.p_flags |= PF_X; 1570 phdr.p_align = ELF_EXEC_PAGESIZE; 1571 1572 DUMP_WRITE(&phdr, sizeof(phdr)); 1573 } 1574 1575 #ifdef ELF_CORE_WRITE_EXTRA_PHDRS 1576 ELF_CORE_WRITE_EXTRA_PHDRS; 1577 #endif 1578 1579 /* write out the notes section */ 1580 for (i = 0; i < numnote; i++) 1581 if (!writenote(notes + i, file)) 1582 goto end_coredump; 1583 1584 /* write out the thread status notes section */ 1585 list_for_each(t, &thread_list) { 1586 struct elf_thread_status *tmp = list_entry(t, struct elf_thread_status, list); 1587 for (i = 0; i < tmp->num_notes; i++) 1588 if (!writenote(&tmp->notes[i], file)) 1589 goto end_coredump; 1590 } 1591 1592 DUMP_SEEK(dataoff); 1593 1594 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) { 1595 unsigned long addr; 1596 1597 if (!maydump(vma)) 1598 continue; 1599 1600 for (addr = vma->vm_start; 1601 addr < vma->vm_end; 1602 addr += PAGE_SIZE) { 1603 struct page* page; 1604 struct vm_area_struct *vma; 1605 1606 if (get_user_pages(current, current->mm, addr, 1, 0, 1, 1607 &page, &vma) <= 0) { 1608 DUMP_SEEK (file->f_pos + PAGE_SIZE); 1609 } else { 1610 if (page == ZERO_PAGE(addr)) { 1611 DUMP_SEEK (file->f_pos + PAGE_SIZE); 1612 } else { 1613 void *kaddr; 1614 flush_cache_page(vma, addr, page_to_pfn(page)); 1615 kaddr = kmap(page); 1616 if ((size += PAGE_SIZE) > limit || 1617 !dump_write(file, kaddr, 1618 PAGE_SIZE)) { 1619 kunmap(page); 1620 page_cache_release(page); 1621 goto end_coredump; 1622 } 1623 kunmap(page); 1624 } 1625 page_cache_release(page); 1626 } 1627 } 1628 } 1629 1630 #ifdef ELF_CORE_WRITE_EXTRA_DATA 1631 ELF_CORE_WRITE_EXTRA_DATA; 1632 #endif 1633 1634 if ((off_t) file->f_pos != offset) { 1635 /* Sanity check */ 1636 printk("elf_core_dump: file->f_pos (%ld) != offset (%ld)\n", 1637 (off_t) file->f_pos, offset); 1638 } 1639 1640 end_coredump: 1641 set_fs(fs); 1642 1643 cleanup: 1644 while(!list_empty(&thread_list)) { 1645 struct list_head *tmp = thread_list.next; 1646 list_del(tmp); 1647 kfree(list_entry(tmp, struct elf_thread_status, list)); 1648 } 1649 1650 kfree(elf); 1651 kfree(prstatus); 1652 kfree(psinfo); 1653 kfree(notes); 1654 kfree(fpu); 1655 #ifdef ELF_CORE_COPY_XFPREGS 1656 kfree(xfpu); 1657 #endif 1658 return has_dumped; 1659 #undef NUM_NOTES 1660 } 1661 1662 #endif /* USE_ELF_CORE_DUMP */ 1663 1664 static int __init init_elf_binfmt(void) 1665 { 1666 return register_binfmt(&elf_format); 1667 } 1668 1669 static void __exit exit_elf_binfmt(void) 1670 { 1671 /* Remove the COFF and ELF loaders. */ 1672 unregister_binfmt(&elf_format); 1673 } 1674 1675 core_initcall(init_elf_binfmt); 1676 module_exit(exit_elf_binfmt); 1677 MODULE_LICENSE("GPL"); 1678