1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/fs/binfmt_elf.c 4 * 5 * These are the functions used to load ELF format executables as used 6 * on SVr4 machines. Information on the format may be found in the book 7 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support 8 * Tools". 9 * 10 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com). 11 */ 12 13 #include <linux/module.h> 14 #include <linux/kernel.h> 15 #include <linux/fs.h> 16 #include <linux/mm.h> 17 #include <linux/mman.h> 18 #include <linux/errno.h> 19 #include <linux/signal.h> 20 #include <linux/binfmts.h> 21 #include <linux/string.h> 22 #include <linux/file.h> 23 #include <linux/slab.h> 24 #include <linux/personality.h> 25 #include <linux/elfcore.h> 26 #include <linux/init.h> 27 #include <linux/highuid.h> 28 #include <linux/compiler.h> 29 #include <linux/highmem.h> 30 #include <linux/hugetlb.h> 31 #include <linux/pagemap.h> 32 #include <linux/vmalloc.h> 33 #include <linux/security.h> 34 #include <linux/random.h> 35 #include <linux/elf.h> 36 #include <linux/elf-randomize.h> 37 #include <linux/utsname.h> 38 #include <linux/coredump.h> 39 #include <linux/sched.h> 40 #include <linux/sched/coredump.h> 41 #include <linux/sched/task_stack.h> 42 #include <linux/sched/cputime.h> 43 #include <linux/cred.h> 44 #include <linux/dax.h> 45 #include <linux/uaccess.h> 46 #include <asm/param.h> 47 #include <asm/page.h> 48 49 #ifndef user_long_t 50 #define user_long_t long 51 #endif 52 #ifndef user_siginfo_t 53 #define user_siginfo_t siginfo_t 54 #endif 55 56 /* That's for binfmt_elf_fdpic to deal with */ 57 #ifndef elf_check_fdpic 58 #define elf_check_fdpic(ex) false 59 #endif 60 61 static int load_elf_binary(struct linux_binprm *bprm); 62 63 #ifdef CONFIG_USELIB 64 static int load_elf_library(struct file *); 65 #else 66 #define load_elf_library NULL 67 #endif 68 69 /* 70 * If we don't support core dumping, then supply a NULL so we 71 * don't even try. 72 */ 73 #ifdef CONFIG_ELF_CORE 74 static int elf_core_dump(struct coredump_params *cprm); 75 #else 76 #define elf_core_dump NULL 77 #endif 78 79 #if ELF_EXEC_PAGESIZE > PAGE_SIZE 80 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE 81 #else 82 #define ELF_MIN_ALIGN PAGE_SIZE 83 #endif 84 85 #ifndef ELF_CORE_EFLAGS 86 #define ELF_CORE_EFLAGS 0 87 #endif 88 89 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) 90 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) 91 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) 92 93 static struct linux_binfmt elf_format = { 94 .module = THIS_MODULE, 95 .load_binary = load_elf_binary, 96 .load_shlib = load_elf_library, 97 .core_dump = elf_core_dump, 98 .min_coredump = ELF_EXEC_PAGESIZE, 99 }; 100 101 #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE)) 102 103 static int set_brk(unsigned long start, unsigned long end, int prot) 104 { 105 start = ELF_PAGEALIGN(start); 106 end = ELF_PAGEALIGN(end); 107 if (end > start) { 108 /* 109 * Map the last of the bss segment. 110 * If the header is requesting these pages to be 111 * executable, honour that (ppc32 needs this). 112 */ 113 int error = vm_brk_flags(start, end - start, 114 prot & PROT_EXEC ? VM_EXEC : 0); 115 if (error) 116 return error; 117 } 118 current->mm->start_brk = current->mm->brk = end; 119 return 0; 120 } 121 122 /* We need to explicitly zero any fractional pages 123 after the data section (i.e. bss). This would 124 contain the junk from the file that should not 125 be in memory 126 */ 127 static int padzero(unsigned long elf_bss) 128 { 129 unsigned long nbyte; 130 131 nbyte = ELF_PAGEOFFSET(elf_bss); 132 if (nbyte) { 133 nbyte = ELF_MIN_ALIGN - nbyte; 134 if (clear_user((void __user *) elf_bss, nbyte)) 135 return -EFAULT; 136 } 137 return 0; 138 } 139 140 /* Let's use some macros to make this stack manipulation a little clearer */ 141 #ifdef CONFIG_STACK_GROWSUP 142 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items)) 143 #define STACK_ROUND(sp, items) \ 144 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL) 145 #define STACK_ALLOC(sp, len) ({ \ 146 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \ 147 old_sp; }) 148 #else 149 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items)) 150 #define STACK_ROUND(sp, items) \ 151 (((unsigned long) (sp - items)) &~ 15UL) 152 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; }) 153 #endif 154 155 #ifndef ELF_BASE_PLATFORM 156 /* 157 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture. 158 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value 159 * will be copied to the user stack in the same manner as AT_PLATFORM. 160 */ 161 #define ELF_BASE_PLATFORM NULL 162 #endif 163 164 static int 165 create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, 166 unsigned long load_addr, unsigned long interp_load_addr, 167 unsigned long e_entry) 168 { 169 struct mm_struct *mm = current->mm; 170 unsigned long p = bprm->p; 171 int argc = bprm->argc; 172 int envc = bprm->envc; 173 elf_addr_t __user *sp; 174 elf_addr_t __user *u_platform; 175 elf_addr_t __user *u_base_platform; 176 elf_addr_t __user *u_rand_bytes; 177 const char *k_platform = ELF_PLATFORM; 178 const char *k_base_platform = ELF_BASE_PLATFORM; 179 unsigned char k_rand_bytes[16]; 180 int items; 181 elf_addr_t *elf_info; 182 int ei_index; 183 const struct cred *cred = current_cred(); 184 struct vm_area_struct *vma; 185 186 /* 187 * In some cases (e.g. Hyper-Threading), we want to avoid L1 188 * evictions by the processes running on the same package. One 189 * thing we can do is to shuffle the initial stack for them. 190 */ 191 192 p = arch_align_stack(p); 193 194 /* 195 * If this architecture has a platform capability string, copy it 196 * to userspace. In some cases (Sparc), this info is impossible 197 * for userspace to get any other way, in others (i386) it is 198 * merely difficult. 199 */ 200 u_platform = NULL; 201 if (k_platform) { 202 size_t len = strlen(k_platform) + 1; 203 204 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 205 if (__copy_to_user(u_platform, k_platform, len)) 206 return -EFAULT; 207 } 208 209 /* 210 * If this architecture has a "base" platform capability 211 * string, copy it to userspace. 212 */ 213 u_base_platform = NULL; 214 if (k_base_platform) { 215 size_t len = strlen(k_base_platform) + 1; 216 217 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 218 if (__copy_to_user(u_base_platform, k_base_platform, len)) 219 return -EFAULT; 220 } 221 222 /* 223 * Generate 16 random bytes for userspace PRNG seeding. 224 */ 225 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes)); 226 u_rand_bytes = (elf_addr_t __user *) 227 STACK_ALLOC(p, sizeof(k_rand_bytes)); 228 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes))) 229 return -EFAULT; 230 231 /* Create the ELF interpreter info */ 232 elf_info = (elf_addr_t *)mm->saved_auxv; 233 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ 234 #define NEW_AUX_ENT(id, val) \ 235 do { \ 236 *elf_info++ = id; \ 237 *elf_info++ = val; \ 238 } while (0) 239 240 #ifdef ARCH_DLINFO 241 /* 242 * ARCH_DLINFO must come first so PPC can do its special alignment of 243 * AUXV. 244 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in 245 * ARCH_DLINFO changes 246 */ 247 ARCH_DLINFO; 248 #endif 249 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); 250 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); 251 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); 252 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); 253 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); 254 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); 255 NEW_AUX_ENT(AT_BASE, interp_load_addr); 256 NEW_AUX_ENT(AT_FLAGS, 0); 257 NEW_AUX_ENT(AT_ENTRY, e_entry); 258 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid)); 259 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid)); 260 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid)); 261 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid)); 262 NEW_AUX_ENT(AT_SECURE, bprm->secureexec); 263 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes); 264 #ifdef ELF_HWCAP2 265 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2); 266 #endif 267 NEW_AUX_ENT(AT_EXECFN, bprm->exec); 268 if (k_platform) { 269 NEW_AUX_ENT(AT_PLATFORM, 270 (elf_addr_t)(unsigned long)u_platform); 271 } 272 if (k_base_platform) { 273 NEW_AUX_ENT(AT_BASE_PLATFORM, 274 (elf_addr_t)(unsigned long)u_base_platform); 275 } 276 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) { 277 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data); 278 } 279 #undef NEW_AUX_ENT 280 /* AT_NULL is zero; clear the rest too */ 281 memset(elf_info, 0, (char *)mm->saved_auxv + 282 sizeof(mm->saved_auxv) - (char *)elf_info); 283 284 /* And advance past the AT_NULL entry. */ 285 elf_info += 2; 286 287 ei_index = elf_info - (elf_addr_t *)mm->saved_auxv; 288 sp = STACK_ADD(p, ei_index); 289 290 items = (argc + 1) + (envc + 1) + 1; 291 bprm->p = STACK_ROUND(sp, items); 292 293 /* Point sp at the lowest address on the stack */ 294 #ifdef CONFIG_STACK_GROWSUP 295 sp = (elf_addr_t __user *)bprm->p - items - ei_index; 296 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */ 297 #else 298 sp = (elf_addr_t __user *)bprm->p; 299 #endif 300 301 302 /* 303 * Grow the stack manually; some architectures have a limit on how 304 * far ahead a user-space access may be in order to grow the stack. 305 */ 306 vma = find_extend_vma(mm, bprm->p); 307 if (!vma) 308 return -EFAULT; 309 310 /* Now, let's put argc (and argv, envp if appropriate) on the stack */ 311 if (__put_user(argc, sp++)) 312 return -EFAULT; 313 314 /* Populate list of argv pointers back to argv strings. */ 315 p = mm->arg_end = mm->arg_start; 316 while (argc-- > 0) { 317 size_t len; 318 if (__put_user((elf_addr_t)p, sp++)) 319 return -EFAULT; 320 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 321 if (!len || len > MAX_ARG_STRLEN) 322 return -EINVAL; 323 p += len; 324 } 325 if (__put_user(0, sp++)) 326 return -EFAULT; 327 mm->arg_end = p; 328 329 /* Populate list of envp pointers back to envp strings. */ 330 mm->env_end = mm->env_start = p; 331 while (envc-- > 0) { 332 size_t len; 333 if (__put_user((elf_addr_t)p, sp++)) 334 return -EFAULT; 335 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 336 if (!len || len > MAX_ARG_STRLEN) 337 return -EINVAL; 338 p += len; 339 } 340 if (__put_user(0, sp++)) 341 return -EFAULT; 342 mm->env_end = p; 343 344 /* Put the elf_info on the stack in the right place. */ 345 if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t))) 346 return -EFAULT; 347 return 0; 348 } 349 350 #ifndef elf_map 351 352 static unsigned long elf_map(struct file *filep, unsigned long addr, 353 const struct elf_phdr *eppnt, int prot, int type, 354 unsigned long total_size) 355 { 356 unsigned long map_addr; 357 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr); 358 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr); 359 addr = ELF_PAGESTART(addr); 360 size = ELF_PAGEALIGN(size); 361 362 /* mmap() will return -EINVAL if given a zero size, but a 363 * segment with zero filesize is perfectly valid */ 364 if (!size) 365 return addr; 366 367 /* 368 * total_size is the size of the ELF (interpreter) image. 369 * The _first_ mmap needs to know the full size, otherwise 370 * randomization might put this image into an overlapping 371 * position with the ELF binary image. (since size < total_size) 372 * So we first map the 'big' image - and unmap the remainder at 373 * the end. (which unmap is needed for ELF images with holes.) 374 */ 375 if (total_size) { 376 total_size = ELF_PAGEALIGN(total_size); 377 map_addr = vm_mmap(filep, addr, total_size, prot, type, off); 378 if (!BAD_ADDR(map_addr)) 379 vm_munmap(map_addr+size, total_size-size); 380 } else 381 map_addr = vm_mmap(filep, addr, size, prot, type, off); 382 383 if ((type & MAP_FIXED_NOREPLACE) && 384 PTR_ERR((void *)map_addr) == -EEXIST) 385 pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n", 386 task_pid_nr(current), current->comm, (void *)addr); 387 388 return(map_addr); 389 } 390 391 #endif /* !elf_map */ 392 393 static unsigned long total_mapping_size(const struct elf_phdr *cmds, int nr) 394 { 395 int i, first_idx = -1, last_idx = -1; 396 397 for (i = 0; i < nr; i++) { 398 if (cmds[i].p_type == PT_LOAD) { 399 last_idx = i; 400 if (first_idx == -1) 401 first_idx = i; 402 } 403 } 404 if (first_idx == -1) 405 return 0; 406 407 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz - 408 ELF_PAGESTART(cmds[first_idx].p_vaddr); 409 } 410 411 static int elf_read(struct file *file, void *buf, size_t len, loff_t pos) 412 { 413 ssize_t rv; 414 415 rv = kernel_read(file, buf, len, &pos); 416 if (unlikely(rv != len)) { 417 return (rv < 0) ? rv : -EIO; 418 } 419 return 0; 420 } 421 422 /** 423 * load_elf_phdrs() - load ELF program headers 424 * @elf_ex: ELF header of the binary whose program headers should be loaded 425 * @elf_file: the opened ELF binary file 426 * 427 * Loads ELF program headers from the binary file elf_file, which has the ELF 428 * header pointed to by elf_ex, into a newly allocated array. The caller is 429 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure. 430 */ 431 static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex, 432 struct file *elf_file) 433 { 434 struct elf_phdr *elf_phdata = NULL; 435 int retval, err = -1; 436 unsigned int size; 437 438 /* 439 * If the size of this structure has changed, then punt, since 440 * we will be doing the wrong thing. 441 */ 442 if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) 443 goto out; 444 445 /* Sanity check the number of program headers... */ 446 /* ...and their total size. */ 447 size = sizeof(struct elf_phdr) * elf_ex->e_phnum; 448 if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN) 449 goto out; 450 451 elf_phdata = kmalloc(size, GFP_KERNEL); 452 if (!elf_phdata) 453 goto out; 454 455 /* Read in the program headers */ 456 retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff); 457 if (retval < 0) { 458 err = retval; 459 goto out; 460 } 461 462 /* Success! */ 463 err = 0; 464 out: 465 if (err) { 466 kfree(elf_phdata); 467 elf_phdata = NULL; 468 } 469 return elf_phdata; 470 } 471 472 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE 473 474 /** 475 * struct arch_elf_state - arch-specific ELF loading state 476 * 477 * This structure is used to preserve architecture specific data during 478 * the loading of an ELF file, throughout the checking of architecture 479 * specific ELF headers & through to the point where the ELF load is 480 * known to be proceeding (ie. SET_PERSONALITY). 481 * 482 * This implementation is a dummy for architectures which require no 483 * specific state. 484 */ 485 struct arch_elf_state { 486 }; 487 488 #define INIT_ARCH_ELF_STATE {} 489 490 /** 491 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header 492 * @ehdr: The main ELF header 493 * @phdr: The program header to check 494 * @elf: The open ELF file 495 * @is_interp: True if the phdr is from the interpreter of the ELF being 496 * loaded, else false. 497 * @state: Architecture-specific state preserved throughout the process 498 * of loading the ELF. 499 * 500 * Inspects the program header phdr to validate its correctness and/or 501 * suitability for the system. Called once per ELF program header in the 502 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its 503 * interpreter. 504 * 505 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 506 * with that return code. 507 */ 508 static inline int arch_elf_pt_proc(struct elfhdr *ehdr, 509 struct elf_phdr *phdr, 510 struct file *elf, bool is_interp, 511 struct arch_elf_state *state) 512 { 513 /* Dummy implementation, always proceed */ 514 return 0; 515 } 516 517 /** 518 * arch_check_elf() - check an ELF executable 519 * @ehdr: The main ELF header 520 * @has_interp: True if the ELF has an interpreter, else false. 521 * @interp_ehdr: The interpreter's ELF header 522 * @state: Architecture-specific state preserved throughout the process 523 * of loading the ELF. 524 * 525 * Provides a final opportunity for architecture code to reject the loading 526 * of the ELF & cause an exec syscall to return an error. This is called after 527 * all program headers to be checked by arch_elf_pt_proc have been. 528 * 529 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 530 * with that return code. 531 */ 532 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, 533 struct elfhdr *interp_ehdr, 534 struct arch_elf_state *state) 535 { 536 /* Dummy implementation, always proceed */ 537 return 0; 538 } 539 540 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ 541 542 static inline int make_prot(u32 p_flags) 543 { 544 int prot = 0; 545 546 if (p_flags & PF_R) 547 prot |= PROT_READ; 548 if (p_flags & PF_W) 549 prot |= PROT_WRITE; 550 if (p_flags & PF_X) 551 prot |= PROT_EXEC; 552 return prot; 553 } 554 555 /* This is much more generalized than the library routine read function, 556 so we keep this separate. Technically the library read function 557 is only provided so that we can read a.out libraries that have 558 an ELF header */ 559 560 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, 561 struct file *interpreter, 562 unsigned long no_base, struct elf_phdr *interp_elf_phdata) 563 { 564 struct elf_phdr *eppnt; 565 unsigned long load_addr = 0; 566 int load_addr_set = 0; 567 unsigned long last_bss = 0, elf_bss = 0; 568 int bss_prot = 0; 569 unsigned long error = ~0UL; 570 unsigned long total_size; 571 int i; 572 573 /* First of all, some simple consistency checks */ 574 if (interp_elf_ex->e_type != ET_EXEC && 575 interp_elf_ex->e_type != ET_DYN) 576 goto out; 577 if (!elf_check_arch(interp_elf_ex) || 578 elf_check_fdpic(interp_elf_ex)) 579 goto out; 580 if (!interpreter->f_op->mmap) 581 goto out; 582 583 total_size = total_mapping_size(interp_elf_phdata, 584 interp_elf_ex->e_phnum); 585 if (!total_size) { 586 error = -EINVAL; 587 goto out; 588 } 589 590 eppnt = interp_elf_phdata; 591 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { 592 if (eppnt->p_type == PT_LOAD) { 593 int elf_type = MAP_PRIVATE | MAP_DENYWRITE; 594 int elf_prot = make_prot(eppnt->p_flags); 595 unsigned long vaddr = 0; 596 unsigned long k, map_addr; 597 598 vaddr = eppnt->p_vaddr; 599 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) 600 elf_type |= MAP_FIXED_NOREPLACE; 601 else if (no_base && interp_elf_ex->e_type == ET_DYN) 602 load_addr = -vaddr; 603 604 map_addr = elf_map(interpreter, load_addr + vaddr, 605 eppnt, elf_prot, elf_type, total_size); 606 total_size = 0; 607 error = map_addr; 608 if (BAD_ADDR(map_addr)) 609 goto out; 610 611 if (!load_addr_set && 612 interp_elf_ex->e_type == ET_DYN) { 613 load_addr = map_addr - ELF_PAGESTART(vaddr); 614 load_addr_set = 1; 615 } 616 617 /* 618 * Check to see if the section's size will overflow the 619 * allowed task size. Note that p_filesz must always be 620 * <= p_memsize so it's only necessary to check p_memsz. 621 */ 622 k = load_addr + eppnt->p_vaddr; 623 if (BAD_ADDR(k) || 624 eppnt->p_filesz > eppnt->p_memsz || 625 eppnt->p_memsz > TASK_SIZE || 626 TASK_SIZE - eppnt->p_memsz < k) { 627 error = -ENOMEM; 628 goto out; 629 } 630 631 /* 632 * Find the end of the file mapping for this phdr, and 633 * keep track of the largest address we see for this. 634 */ 635 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz; 636 if (k > elf_bss) 637 elf_bss = k; 638 639 /* 640 * Do the same thing for the memory mapping - between 641 * elf_bss and last_bss is the bss section. 642 */ 643 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz; 644 if (k > last_bss) { 645 last_bss = k; 646 bss_prot = elf_prot; 647 } 648 } 649 } 650 651 /* 652 * Now fill out the bss section: first pad the last page from 653 * the file up to the page boundary, and zero it from elf_bss 654 * up to the end of the page. 655 */ 656 if (padzero(elf_bss)) { 657 error = -EFAULT; 658 goto out; 659 } 660 /* 661 * Next, align both the file and mem bss up to the page size, 662 * since this is where elf_bss was just zeroed up to, and where 663 * last_bss will end after the vm_brk_flags() below. 664 */ 665 elf_bss = ELF_PAGEALIGN(elf_bss); 666 last_bss = ELF_PAGEALIGN(last_bss); 667 /* Finally, if there is still more bss to allocate, do it. */ 668 if (last_bss > elf_bss) { 669 error = vm_brk_flags(elf_bss, last_bss - elf_bss, 670 bss_prot & PROT_EXEC ? VM_EXEC : 0); 671 if (error) 672 goto out; 673 } 674 675 error = load_addr; 676 out: 677 return error; 678 } 679 680 /* 681 * These are the functions used to load ELF style executables and shared 682 * libraries. There is no binary dependent code anywhere else. 683 */ 684 685 static int load_elf_binary(struct linux_binprm *bprm) 686 { 687 struct file *interpreter = NULL; /* to shut gcc up */ 688 unsigned long load_addr = 0, load_bias = 0; 689 int load_addr_set = 0; 690 unsigned long error; 691 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; 692 unsigned long elf_bss, elf_brk; 693 int bss_prot = 0; 694 int retval, i; 695 unsigned long elf_entry; 696 unsigned long e_entry; 697 unsigned long interp_load_addr = 0; 698 unsigned long start_code, end_code, start_data, end_data; 699 unsigned long reloc_func_desc __maybe_unused = 0; 700 int executable_stack = EXSTACK_DEFAULT; 701 struct elfhdr *elf_ex = (struct elfhdr *)bprm->buf; 702 struct { 703 struct elfhdr interp_elf_ex; 704 } *loc; 705 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE; 706 struct mm_struct *mm; 707 struct pt_regs *regs; 708 709 loc = kmalloc(sizeof(*loc), GFP_KERNEL); 710 if (!loc) { 711 retval = -ENOMEM; 712 goto out_ret; 713 } 714 715 retval = -ENOEXEC; 716 /* First of all, some simple consistency checks */ 717 if (memcmp(elf_ex->e_ident, ELFMAG, SELFMAG) != 0) 718 goto out; 719 720 if (elf_ex->e_type != ET_EXEC && elf_ex->e_type != ET_DYN) 721 goto out; 722 if (!elf_check_arch(elf_ex)) 723 goto out; 724 if (elf_check_fdpic(elf_ex)) 725 goto out; 726 if (!bprm->file->f_op->mmap) 727 goto out; 728 729 elf_phdata = load_elf_phdrs(elf_ex, bprm->file); 730 if (!elf_phdata) 731 goto out; 732 733 elf_ppnt = elf_phdata; 734 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) { 735 char *elf_interpreter; 736 737 if (elf_ppnt->p_type != PT_INTERP) 738 continue; 739 740 /* 741 * This is the program interpreter used for shared libraries - 742 * for now assume that this is an a.out format binary. 743 */ 744 retval = -ENOEXEC; 745 if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2) 746 goto out_free_ph; 747 748 retval = -ENOMEM; 749 elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL); 750 if (!elf_interpreter) 751 goto out_free_ph; 752 753 retval = elf_read(bprm->file, elf_interpreter, elf_ppnt->p_filesz, 754 elf_ppnt->p_offset); 755 if (retval < 0) 756 goto out_free_interp; 757 /* make sure path is NULL terminated */ 758 retval = -ENOEXEC; 759 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') 760 goto out_free_interp; 761 762 interpreter = open_exec(elf_interpreter); 763 kfree(elf_interpreter); 764 retval = PTR_ERR(interpreter); 765 if (IS_ERR(interpreter)) 766 goto out_free_ph; 767 768 /* 769 * If the binary is not readable then enforce mm->dumpable = 0 770 * regardless of the interpreter's permissions. 771 */ 772 would_dump(bprm, interpreter); 773 774 /* Get the exec headers */ 775 retval = elf_read(interpreter, &loc->interp_elf_ex, 776 sizeof(loc->interp_elf_ex), 0); 777 if (retval < 0) 778 goto out_free_dentry; 779 780 break; 781 782 out_free_interp: 783 kfree(elf_interpreter); 784 goto out_free_ph; 785 } 786 787 elf_ppnt = elf_phdata; 788 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) 789 switch (elf_ppnt->p_type) { 790 case PT_GNU_STACK: 791 if (elf_ppnt->p_flags & PF_X) 792 executable_stack = EXSTACK_ENABLE_X; 793 else 794 executable_stack = EXSTACK_DISABLE_X; 795 break; 796 797 case PT_LOPROC ... PT_HIPROC: 798 retval = arch_elf_pt_proc(elf_ex, elf_ppnt, 799 bprm->file, false, 800 &arch_state); 801 if (retval) 802 goto out_free_dentry; 803 break; 804 } 805 806 /* Some simple consistency checks for the interpreter */ 807 if (interpreter) { 808 retval = -ELIBBAD; 809 /* Not an ELF interpreter */ 810 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 811 goto out_free_dentry; 812 /* Verify the interpreter has a valid arch */ 813 if (!elf_check_arch(&loc->interp_elf_ex) || 814 elf_check_fdpic(&loc->interp_elf_ex)) 815 goto out_free_dentry; 816 817 /* Load the interpreter program headers */ 818 interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex, 819 interpreter); 820 if (!interp_elf_phdata) 821 goto out_free_dentry; 822 823 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ 824 elf_ppnt = interp_elf_phdata; 825 for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++) 826 switch (elf_ppnt->p_type) { 827 case PT_LOPROC ... PT_HIPROC: 828 retval = arch_elf_pt_proc(&loc->interp_elf_ex, 829 elf_ppnt, interpreter, 830 true, &arch_state); 831 if (retval) 832 goto out_free_dentry; 833 break; 834 } 835 } 836 837 /* 838 * Allow arch code to reject the ELF at this point, whilst it's 839 * still possible to return an error to the code that invoked 840 * the exec syscall. 841 */ 842 retval = arch_check_elf(elf_ex, 843 !!interpreter, &loc->interp_elf_ex, 844 &arch_state); 845 if (retval) 846 goto out_free_dentry; 847 848 /* Flush all traces of the currently running executable */ 849 retval = flush_old_exec(bprm); 850 if (retval) 851 goto out_free_dentry; 852 853 /* Do this immediately, since STACK_TOP as used in setup_arg_pages 854 may depend on the personality. */ 855 SET_PERSONALITY2(*elf_ex, &arch_state); 856 if (elf_read_implies_exec(*elf_ex, executable_stack)) 857 current->personality |= READ_IMPLIES_EXEC; 858 859 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) 860 current->flags |= PF_RANDOMIZE; 861 862 setup_new_exec(bprm); 863 install_exec_creds(bprm); 864 865 /* Do this so that we can load the interpreter, if need be. We will 866 change some of these later */ 867 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), 868 executable_stack); 869 if (retval < 0) 870 goto out_free_dentry; 871 872 elf_bss = 0; 873 elf_brk = 0; 874 875 start_code = ~0UL; 876 end_code = 0; 877 start_data = 0; 878 end_data = 0; 879 880 /* Now we do a little grungy work by mmapping the ELF image into 881 the correct location in memory. */ 882 for(i = 0, elf_ppnt = elf_phdata; 883 i < elf_ex->e_phnum; i++, elf_ppnt++) { 884 int elf_prot, elf_flags; 885 unsigned long k, vaddr; 886 unsigned long total_size = 0; 887 888 if (elf_ppnt->p_type != PT_LOAD) 889 continue; 890 891 if (unlikely (elf_brk > elf_bss)) { 892 unsigned long nbyte; 893 894 /* There was a PT_LOAD segment with p_memsz > p_filesz 895 before this one. Map anonymous pages, if needed, 896 and clear the area. */ 897 retval = set_brk(elf_bss + load_bias, 898 elf_brk + load_bias, 899 bss_prot); 900 if (retval) 901 goto out_free_dentry; 902 nbyte = ELF_PAGEOFFSET(elf_bss); 903 if (nbyte) { 904 nbyte = ELF_MIN_ALIGN - nbyte; 905 if (nbyte > elf_brk - elf_bss) 906 nbyte = elf_brk - elf_bss; 907 if (clear_user((void __user *)elf_bss + 908 load_bias, nbyte)) { 909 /* 910 * This bss-zeroing can fail if the ELF 911 * file specifies odd protections. So 912 * we don't check the return value 913 */ 914 } 915 } 916 } 917 918 elf_prot = make_prot(elf_ppnt->p_flags); 919 920 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE; 921 922 vaddr = elf_ppnt->p_vaddr; 923 /* 924 * If we are loading ET_EXEC or we have already performed 925 * the ET_DYN load_addr calculations, proceed normally. 926 */ 927 if (elf_ex->e_type == ET_EXEC || load_addr_set) { 928 elf_flags |= MAP_FIXED; 929 } else if (elf_ex->e_type == ET_DYN) { 930 /* 931 * This logic is run once for the first LOAD Program 932 * Header for ET_DYN binaries to calculate the 933 * randomization (load_bias) for all the LOAD 934 * Program Headers, and to calculate the entire 935 * size of the ELF mapping (total_size). (Note that 936 * load_addr_set is set to true later once the 937 * initial mapping is performed.) 938 * 939 * There are effectively two types of ET_DYN 940 * binaries: programs (i.e. PIE: ET_DYN with INTERP) 941 * and loaders (ET_DYN without INTERP, since they 942 * _are_ the ELF interpreter). The loaders must 943 * be loaded away from programs since the program 944 * may otherwise collide with the loader (especially 945 * for ET_EXEC which does not have a randomized 946 * position). For example to handle invocations of 947 * "./ld.so someprog" to test out a new version of 948 * the loader, the subsequent program that the 949 * loader loads must avoid the loader itself, so 950 * they cannot share the same load range. Sufficient 951 * room for the brk must be allocated with the 952 * loader as well, since brk must be available with 953 * the loader. 954 * 955 * Therefore, programs are loaded offset from 956 * ELF_ET_DYN_BASE and loaders are loaded into the 957 * independently randomized mmap region (0 load_bias 958 * without MAP_FIXED). 959 */ 960 if (interpreter) { 961 load_bias = ELF_ET_DYN_BASE; 962 if (current->flags & PF_RANDOMIZE) 963 load_bias += arch_mmap_rnd(); 964 elf_flags |= MAP_FIXED; 965 } else 966 load_bias = 0; 967 968 /* 969 * Since load_bias is used for all subsequent loading 970 * calculations, we must lower it by the first vaddr 971 * so that the remaining calculations based on the 972 * ELF vaddrs will be correctly offset. The result 973 * is then page aligned. 974 */ 975 load_bias = ELF_PAGESTART(load_bias - vaddr); 976 977 total_size = total_mapping_size(elf_phdata, 978 elf_ex->e_phnum); 979 if (!total_size) { 980 retval = -EINVAL; 981 goto out_free_dentry; 982 } 983 } 984 985 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, 986 elf_prot, elf_flags, total_size); 987 if (BAD_ADDR(error)) { 988 retval = IS_ERR((void *)error) ? 989 PTR_ERR((void*)error) : -EINVAL; 990 goto out_free_dentry; 991 } 992 993 if (!load_addr_set) { 994 load_addr_set = 1; 995 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset); 996 if (elf_ex->e_type == ET_DYN) { 997 load_bias += error - 998 ELF_PAGESTART(load_bias + vaddr); 999 load_addr += load_bias; 1000 reloc_func_desc = load_bias; 1001 } 1002 } 1003 k = elf_ppnt->p_vaddr; 1004 if ((elf_ppnt->p_flags & PF_X) && k < start_code) 1005 start_code = k; 1006 if (start_data < k) 1007 start_data = k; 1008 1009 /* 1010 * Check to see if the section's size will overflow the 1011 * allowed task size. Note that p_filesz must always be 1012 * <= p_memsz so it is only necessary to check p_memsz. 1013 */ 1014 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || 1015 elf_ppnt->p_memsz > TASK_SIZE || 1016 TASK_SIZE - elf_ppnt->p_memsz < k) { 1017 /* set_brk can never work. Avoid overflows. */ 1018 retval = -EINVAL; 1019 goto out_free_dentry; 1020 } 1021 1022 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; 1023 1024 if (k > elf_bss) 1025 elf_bss = k; 1026 if ((elf_ppnt->p_flags & PF_X) && end_code < k) 1027 end_code = k; 1028 if (end_data < k) 1029 end_data = k; 1030 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; 1031 if (k > elf_brk) { 1032 bss_prot = elf_prot; 1033 elf_brk = k; 1034 } 1035 } 1036 1037 e_entry = elf_ex->e_entry + load_bias; 1038 elf_bss += load_bias; 1039 elf_brk += load_bias; 1040 start_code += load_bias; 1041 end_code += load_bias; 1042 start_data += load_bias; 1043 end_data += load_bias; 1044 1045 /* Calling set_brk effectively mmaps the pages that we need 1046 * for the bss and break sections. We must do this before 1047 * mapping in the interpreter, to make sure it doesn't wind 1048 * up getting placed where the bss needs to go. 1049 */ 1050 retval = set_brk(elf_bss, elf_brk, bss_prot); 1051 if (retval) 1052 goto out_free_dentry; 1053 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { 1054 retval = -EFAULT; /* Nobody gets to see this, but.. */ 1055 goto out_free_dentry; 1056 } 1057 1058 if (interpreter) { 1059 elf_entry = load_elf_interp(&loc->interp_elf_ex, 1060 interpreter, 1061 load_bias, interp_elf_phdata); 1062 if (!IS_ERR((void *)elf_entry)) { 1063 /* 1064 * load_elf_interp() returns relocation 1065 * adjustment 1066 */ 1067 interp_load_addr = elf_entry; 1068 elf_entry += loc->interp_elf_ex.e_entry; 1069 } 1070 if (BAD_ADDR(elf_entry)) { 1071 retval = IS_ERR((void *)elf_entry) ? 1072 (int)elf_entry : -EINVAL; 1073 goto out_free_dentry; 1074 } 1075 reloc_func_desc = interp_load_addr; 1076 1077 allow_write_access(interpreter); 1078 fput(interpreter); 1079 } else { 1080 elf_entry = e_entry; 1081 if (BAD_ADDR(elf_entry)) { 1082 retval = -EINVAL; 1083 goto out_free_dentry; 1084 } 1085 } 1086 1087 kfree(interp_elf_phdata); 1088 kfree(elf_phdata); 1089 1090 set_binfmt(&elf_format); 1091 1092 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES 1093 retval = arch_setup_additional_pages(bprm, !!interpreter); 1094 if (retval < 0) 1095 goto out; 1096 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ 1097 1098 retval = create_elf_tables(bprm, elf_ex, 1099 load_addr, interp_load_addr, e_entry); 1100 if (retval < 0) 1101 goto out; 1102 1103 mm = current->mm; 1104 mm->end_code = end_code; 1105 mm->start_code = start_code; 1106 mm->start_data = start_data; 1107 mm->end_data = end_data; 1108 mm->start_stack = bprm->p; 1109 1110 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) { 1111 /* 1112 * For architectures with ELF randomization, when executing 1113 * a loader directly (i.e. no interpreter listed in ELF 1114 * headers), move the brk area out of the mmap region 1115 * (since it grows up, and may collide early with the stack 1116 * growing down), and into the unused ELF_ET_DYN_BASE region. 1117 */ 1118 if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && 1119 elf_ex->e_type == ET_DYN && !interpreter) { 1120 mm->brk = mm->start_brk = ELF_ET_DYN_BASE; 1121 } 1122 1123 mm->brk = mm->start_brk = arch_randomize_brk(mm); 1124 #ifdef compat_brk_randomized 1125 current->brk_randomized = 1; 1126 #endif 1127 } 1128 1129 if (current->personality & MMAP_PAGE_ZERO) { 1130 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 1131 and some applications "depend" upon this behavior. 1132 Since we do not have the power to recompile these, we 1133 emulate the SVr4 behavior. Sigh. */ 1134 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, 1135 MAP_FIXED | MAP_PRIVATE, 0); 1136 } 1137 1138 regs = current_pt_regs(); 1139 #ifdef ELF_PLAT_INIT 1140 /* 1141 * The ABI may specify that certain registers be set up in special 1142 * ways (on i386 %edx is the address of a DT_FINI function, for 1143 * example. In addition, it may also specify (eg, PowerPC64 ELF) 1144 * that the e_entry field is the address of the function descriptor 1145 * for the startup routine, rather than the address of the startup 1146 * routine itself. This macro performs whatever initialization to 1147 * the regs structure is required as well as any relocations to the 1148 * function descriptor entries when executing dynamically links apps. 1149 */ 1150 ELF_PLAT_INIT(regs, reloc_func_desc); 1151 #endif 1152 1153 finalize_exec(bprm); 1154 start_thread(regs, elf_entry, bprm->p); 1155 retval = 0; 1156 out: 1157 kfree(loc); 1158 out_ret: 1159 return retval; 1160 1161 /* error cleanup */ 1162 out_free_dentry: 1163 kfree(interp_elf_phdata); 1164 allow_write_access(interpreter); 1165 if (interpreter) 1166 fput(interpreter); 1167 out_free_ph: 1168 kfree(elf_phdata); 1169 goto out; 1170 } 1171 1172 #ifdef CONFIG_USELIB 1173 /* This is really simpleminded and specialized - we are loading an 1174 a.out library that is given an ELF header. */ 1175 static int load_elf_library(struct file *file) 1176 { 1177 struct elf_phdr *elf_phdata; 1178 struct elf_phdr *eppnt; 1179 unsigned long elf_bss, bss, len; 1180 int retval, error, i, j; 1181 struct elfhdr elf_ex; 1182 1183 error = -ENOEXEC; 1184 retval = elf_read(file, &elf_ex, sizeof(elf_ex), 0); 1185 if (retval < 0) 1186 goto out; 1187 1188 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 1189 goto out; 1190 1191 /* First of all, some simple consistency checks */ 1192 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 || 1193 !elf_check_arch(&elf_ex) || !file->f_op->mmap) 1194 goto out; 1195 if (elf_check_fdpic(&elf_ex)) 1196 goto out; 1197 1198 /* Now read in all of the header information */ 1199 1200 j = sizeof(struct elf_phdr) * elf_ex.e_phnum; 1201 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */ 1202 1203 error = -ENOMEM; 1204 elf_phdata = kmalloc(j, GFP_KERNEL); 1205 if (!elf_phdata) 1206 goto out; 1207 1208 eppnt = elf_phdata; 1209 error = -ENOEXEC; 1210 retval = elf_read(file, eppnt, j, elf_ex.e_phoff); 1211 if (retval < 0) 1212 goto out_free_ph; 1213 1214 for (j = 0, i = 0; i<elf_ex.e_phnum; i++) 1215 if ((eppnt + i)->p_type == PT_LOAD) 1216 j++; 1217 if (j != 1) 1218 goto out_free_ph; 1219 1220 while (eppnt->p_type != PT_LOAD) 1221 eppnt++; 1222 1223 /* Now use mmap to map the library into memory. */ 1224 error = vm_mmap(file, 1225 ELF_PAGESTART(eppnt->p_vaddr), 1226 (eppnt->p_filesz + 1227 ELF_PAGEOFFSET(eppnt->p_vaddr)), 1228 PROT_READ | PROT_WRITE | PROT_EXEC, 1229 MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_DENYWRITE, 1230 (eppnt->p_offset - 1231 ELF_PAGEOFFSET(eppnt->p_vaddr))); 1232 if (error != ELF_PAGESTART(eppnt->p_vaddr)) 1233 goto out_free_ph; 1234 1235 elf_bss = eppnt->p_vaddr + eppnt->p_filesz; 1236 if (padzero(elf_bss)) { 1237 error = -EFAULT; 1238 goto out_free_ph; 1239 } 1240 1241 len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr); 1242 bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr); 1243 if (bss > len) { 1244 error = vm_brk(len, bss - len); 1245 if (error) 1246 goto out_free_ph; 1247 } 1248 error = 0; 1249 1250 out_free_ph: 1251 kfree(elf_phdata); 1252 out: 1253 return error; 1254 } 1255 #endif /* #ifdef CONFIG_USELIB */ 1256 1257 #ifdef CONFIG_ELF_CORE 1258 /* 1259 * ELF core dumper 1260 * 1261 * Modelled on fs/exec.c:aout_core_dump() 1262 * Jeremy Fitzhardinge <jeremy@sw.oz.au> 1263 */ 1264 1265 /* 1266 * The purpose of always_dump_vma() is to make sure that special kernel mappings 1267 * that are useful for post-mortem analysis are included in every core dump. 1268 * In that way we ensure that the core dump is fully interpretable later 1269 * without matching up the same kernel and hardware config to see what PC values 1270 * meant. These special mappings include - vDSO, vsyscall, and other 1271 * architecture specific mappings 1272 */ 1273 static bool always_dump_vma(struct vm_area_struct *vma) 1274 { 1275 /* Any vsyscall mappings? */ 1276 if (vma == get_gate_vma(vma->vm_mm)) 1277 return true; 1278 1279 /* 1280 * Assume that all vmas with a .name op should always be dumped. 1281 * If this changes, a new vm_ops field can easily be added. 1282 */ 1283 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 1284 return true; 1285 1286 /* 1287 * arch_vma_name() returns non-NULL for special architecture mappings, 1288 * such as vDSO sections. 1289 */ 1290 if (arch_vma_name(vma)) 1291 return true; 1292 1293 return false; 1294 } 1295 1296 /* 1297 * Decide what to dump of a segment, part, all or none. 1298 */ 1299 static unsigned long vma_dump_size(struct vm_area_struct *vma, 1300 unsigned long mm_flags) 1301 { 1302 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) 1303 1304 /* always dump the vdso and vsyscall sections */ 1305 if (always_dump_vma(vma)) 1306 goto whole; 1307 1308 if (vma->vm_flags & VM_DONTDUMP) 1309 return 0; 1310 1311 /* support for DAX */ 1312 if (vma_is_dax(vma)) { 1313 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED)) 1314 goto whole; 1315 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE)) 1316 goto whole; 1317 return 0; 1318 } 1319 1320 /* Hugetlb memory check */ 1321 if (is_vm_hugetlb_page(vma)) { 1322 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED)) 1323 goto whole; 1324 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) 1325 goto whole; 1326 return 0; 1327 } 1328 1329 /* Do not dump I/O mapped devices or special mappings */ 1330 if (vma->vm_flags & VM_IO) 1331 return 0; 1332 1333 /* By default, dump shared memory if mapped from an anonymous file. */ 1334 if (vma->vm_flags & VM_SHARED) { 1335 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1336 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED)) 1337 goto whole; 1338 return 0; 1339 } 1340 1341 /* Dump segments that have been written to. */ 1342 if (vma->anon_vma && FILTER(ANON_PRIVATE)) 1343 goto whole; 1344 if (vma->vm_file == NULL) 1345 return 0; 1346 1347 if (FILTER(MAPPED_PRIVATE)) 1348 goto whole; 1349 1350 /* 1351 * If this looks like the beginning of a DSO or executable mapping, 1352 * check for an ELF header. If we find one, dump the first page to 1353 * aid in determining what was mapped here. 1354 */ 1355 if (FILTER(ELF_HEADERS) && 1356 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1357 u32 __user *header = (u32 __user *) vma->vm_start; 1358 u32 word; 1359 mm_segment_t fs = get_fs(); 1360 /* 1361 * Doing it this way gets the constant folded by GCC. 1362 */ 1363 union { 1364 u32 cmp; 1365 char elfmag[SELFMAG]; 1366 } magic; 1367 BUILD_BUG_ON(SELFMAG != sizeof word); 1368 magic.elfmag[EI_MAG0] = ELFMAG0; 1369 magic.elfmag[EI_MAG1] = ELFMAG1; 1370 magic.elfmag[EI_MAG2] = ELFMAG2; 1371 magic.elfmag[EI_MAG3] = ELFMAG3; 1372 /* 1373 * Switch to the user "segment" for get_user(), 1374 * then put back what elf_core_dump() had in place. 1375 */ 1376 set_fs(USER_DS); 1377 if (unlikely(get_user(word, header))) 1378 word = 0; 1379 set_fs(fs); 1380 if (word == magic.cmp) 1381 return PAGE_SIZE; 1382 } 1383 1384 #undef FILTER 1385 1386 return 0; 1387 1388 whole: 1389 return vma->vm_end - vma->vm_start; 1390 } 1391 1392 /* An ELF note in memory */ 1393 struct memelfnote 1394 { 1395 const char *name; 1396 int type; 1397 unsigned int datasz; 1398 void *data; 1399 }; 1400 1401 static int notesize(struct memelfnote *en) 1402 { 1403 int sz; 1404 1405 sz = sizeof(struct elf_note); 1406 sz += roundup(strlen(en->name) + 1, 4); 1407 sz += roundup(en->datasz, 4); 1408 1409 return sz; 1410 } 1411 1412 static int writenote(struct memelfnote *men, struct coredump_params *cprm) 1413 { 1414 struct elf_note en; 1415 en.n_namesz = strlen(men->name) + 1; 1416 en.n_descsz = men->datasz; 1417 en.n_type = men->type; 1418 1419 return dump_emit(cprm, &en, sizeof(en)) && 1420 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) && 1421 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4); 1422 } 1423 1424 static void fill_elf_header(struct elfhdr *elf, int segs, 1425 u16 machine, u32 flags) 1426 { 1427 memset(elf, 0, sizeof(*elf)); 1428 1429 memcpy(elf->e_ident, ELFMAG, SELFMAG); 1430 elf->e_ident[EI_CLASS] = ELF_CLASS; 1431 elf->e_ident[EI_DATA] = ELF_DATA; 1432 elf->e_ident[EI_VERSION] = EV_CURRENT; 1433 elf->e_ident[EI_OSABI] = ELF_OSABI; 1434 1435 elf->e_type = ET_CORE; 1436 elf->e_machine = machine; 1437 elf->e_version = EV_CURRENT; 1438 elf->e_phoff = sizeof(struct elfhdr); 1439 elf->e_flags = flags; 1440 elf->e_ehsize = sizeof(struct elfhdr); 1441 elf->e_phentsize = sizeof(struct elf_phdr); 1442 elf->e_phnum = segs; 1443 } 1444 1445 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset) 1446 { 1447 phdr->p_type = PT_NOTE; 1448 phdr->p_offset = offset; 1449 phdr->p_vaddr = 0; 1450 phdr->p_paddr = 0; 1451 phdr->p_filesz = sz; 1452 phdr->p_memsz = 0; 1453 phdr->p_flags = 0; 1454 phdr->p_align = 0; 1455 } 1456 1457 static void fill_note(struct memelfnote *note, const char *name, int type, 1458 unsigned int sz, void *data) 1459 { 1460 note->name = name; 1461 note->type = type; 1462 note->datasz = sz; 1463 note->data = data; 1464 } 1465 1466 /* 1467 * fill up all the fields in prstatus from the given task struct, except 1468 * registers which need to be filled up separately. 1469 */ 1470 static void fill_prstatus(struct elf_prstatus *prstatus, 1471 struct task_struct *p, long signr) 1472 { 1473 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 1474 prstatus->pr_sigpend = p->pending.signal.sig[0]; 1475 prstatus->pr_sighold = p->blocked.sig[0]; 1476 rcu_read_lock(); 1477 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1478 rcu_read_unlock(); 1479 prstatus->pr_pid = task_pid_vnr(p); 1480 prstatus->pr_pgrp = task_pgrp_vnr(p); 1481 prstatus->pr_sid = task_session_vnr(p); 1482 if (thread_group_leader(p)) { 1483 struct task_cputime cputime; 1484 1485 /* 1486 * This is the record for the group leader. It shows the 1487 * group-wide total, not its individual thread total. 1488 */ 1489 thread_group_cputime(p, &cputime); 1490 prstatus->pr_utime = ns_to_kernel_old_timeval(cputime.utime); 1491 prstatus->pr_stime = ns_to_kernel_old_timeval(cputime.stime); 1492 } else { 1493 u64 utime, stime; 1494 1495 task_cputime(p, &utime, &stime); 1496 prstatus->pr_utime = ns_to_kernel_old_timeval(utime); 1497 prstatus->pr_stime = ns_to_kernel_old_timeval(stime); 1498 } 1499 1500 prstatus->pr_cutime = ns_to_kernel_old_timeval(p->signal->cutime); 1501 prstatus->pr_cstime = ns_to_kernel_old_timeval(p->signal->cstime); 1502 } 1503 1504 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, 1505 struct mm_struct *mm) 1506 { 1507 const struct cred *cred; 1508 unsigned int i, len; 1509 1510 /* first copy the parameters from user space */ 1511 memset(psinfo, 0, sizeof(struct elf_prpsinfo)); 1512 1513 len = mm->arg_end - mm->arg_start; 1514 if (len >= ELF_PRARGSZ) 1515 len = ELF_PRARGSZ-1; 1516 if (copy_from_user(&psinfo->pr_psargs, 1517 (const char __user *)mm->arg_start, len)) 1518 return -EFAULT; 1519 for(i = 0; i < len; i++) 1520 if (psinfo->pr_psargs[i] == 0) 1521 psinfo->pr_psargs[i] = ' '; 1522 psinfo->pr_psargs[len] = 0; 1523 1524 rcu_read_lock(); 1525 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1526 rcu_read_unlock(); 1527 psinfo->pr_pid = task_pid_vnr(p); 1528 psinfo->pr_pgrp = task_pgrp_vnr(p); 1529 psinfo->pr_sid = task_session_vnr(p); 1530 1531 i = p->state ? ffz(~p->state) + 1 : 0; 1532 psinfo->pr_state = i; 1533 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i]; 1534 psinfo->pr_zomb = psinfo->pr_sname == 'Z'; 1535 psinfo->pr_nice = task_nice(p); 1536 psinfo->pr_flag = p->flags; 1537 rcu_read_lock(); 1538 cred = __task_cred(p); 1539 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid)); 1540 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid)); 1541 rcu_read_unlock(); 1542 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname)); 1543 1544 return 0; 1545 } 1546 1547 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) 1548 { 1549 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; 1550 int i = 0; 1551 do 1552 i += 2; 1553 while (auxv[i - 2] != AT_NULL); 1554 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); 1555 } 1556 1557 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata, 1558 const kernel_siginfo_t *siginfo) 1559 { 1560 mm_segment_t old_fs = get_fs(); 1561 set_fs(KERNEL_DS); 1562 copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo); 1563 set_fs(old_fs); 1564 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata); 1565 } 1566 1567 #define MAX_FILE_NOTE_SIZE (4*1024*1024) 1568 /* 1569 * Format of NT_FILE note: 1570 * 1571 * long count -- how many files are mapped 1572 * long page_size -- units for file_ofs 1573 * array of [COUNT] elements of 1574 * long start 1575 * long end 1576 * long file_ofs 1577 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL... 1578 */ 1579 static int fill_files_note(struct memelfnote *note) 1580 { 1581 struct mm_struct *mm = current->mm; 1582 struct vm_area_struct *vma; 1583 unsigned count, size, names_ofs, remaining, n; 1584 user_long_t *data; 1585 user_long_t *start_end_ofs; 1586 char *name_base, *name_curpos; 1587 1588 /* *Estimated* file count and total data size needed */ 1589 count = mm->map_count; 1590 if (count > UINT_MAX / 64) 1591 return -EINVAL; 1592 size = count * 64; 1593 1594 names_ofs = (2 + 3 * count) * sizeof(data[0]); 1595 alloc: 1596 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */ 1597 return -EINVAL; 1598 size = round_up(size, PAGE_SIZE); 1599 /* 1600 * "size" can be 0 here legitimately. 1601 * Let it ENOMEM and omit NT_FILE section which will be empty anyway. 1602 */ 1603 data = kvmalloc(size, GFP_KERNEL); 1604 if (ZERO_OR_NULL_PTR(data)) 1605 return -ENOMEM; 1606 1607 start_end_ofs = data + 2; 1608 name_base = name_curpos = ((char *)data) + names_ofs; 1609 remaining = size - names_ofs; 1610 count = 0; 1611 for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) { 1612 struct file *file; 1613 const char *filename; 1614 1615 file = vma->vm_file; 1616 if (!file) 1617 continue; 1618 filename = file_path(file, name_curpos, remaining); 1619 if (IS_ERR(filename)) { 1620 if (PTR_ERR(filename) == -ENAMETOOLONG) { 1621 kvfree(data); 1622 size = size * 5 / 4; 1623 goto alloc; 1624 } 1625 continue; 1626 } 1627 1628 /* file_path() fills at the end, move name down */ 1629 /* n = strlen(filename) + 1: */ 1630 n = (name_curpos + remaining) - filename; 1631 remaining = filename - name_curpos; 1632 memmove(name_curpos, filename, n); 1633 name_curpos += n; 1634 1635 *start_end_ofs++ = vma->vm_start; 1636 *start_end_ofs++ = vma->vm_end; 1637 *start_end_ofs++ = vma->vm_pgoff; 1638 count++; 1639 } 1640 1641 /* Now we know exact count of files, can store it */ 1642 data[0] = count; 1643 data[1] = PAGE_SIZE; 1644 /* 1645 * Count usually is less than mm->map_count, 1646 * we need to move filenames down. 1647 */ 1648 n = mm->map_count - count; 1649 if (n != 0) { 1650 unsigned shift_bytes = n * 3 * sizeof(data[0]); 1651 memmove(name_base - shift_bytes, name_base, 1652 name_curpos - name_base); 1653 name_curpos -= shift_bytes; 1654 } 1655 1656 size = name_curpos - (char *)data; 1657 fill_note(note, "CORE", NT_FILE, size, data); 1658 return 0; 1659 } 1660 1661 #ifdef CORE_DUMP_USE_REGSET 1662 #include <linux/regset.h> 1663 1664 struct elf_thread_core_info { 1665 struct elf_thread_core_info *next; 1666 struct task_struct *task; 1667 struct elf_prstatus prstatus; 1668 struct memelfnote notes[0]; 1669 }; 1670 1671 struct elf_note_info { 1672 struct elf_thread_core_info *thread; 1673 struct memelfnote psinfo; 1674 struct memelfnote signote; 1675 struct memelfnote auxv; 1676 struct memelfnote files; 1677 user_siginfo_t csigdata; 1678 size_t size; 1679 int thread_notes; 1680 }; 1681 1682 /* 1683 * When a regset has a writeback hook, we call it on each thread before 1684 * dumping user memory. On register window machines, this makes sure the 1685 * user memory backing the register data is up to date before we read it. 1686 */ 1687 static void do_thread_regset_writeback(struct task_struct *task, 1688 const struct user_regset *regset) 1689 { 1690 if (regset->writeback) 1691 regset->writeback(task, regset, 1); 1692 } 1693 1694 #ifndef PRSTATUS_SIZE 1695 #define PRSTATUS_SIZE(S, R) sizeof(S) 1696 #endif 1697 1698 #ifndef SET_PR_FPVALID 1699 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V)) 1700 #endif 1701 1702 static int fill_thread_core_info(struct elf_thread_core_info *t, 1703 const struct user_regset_view *view, 1704 long signr, size_t *total) 1705 { 1706 unsigned int i; 1707 unsigned int regset0_size = regset_size(t->task, &view->regsets[0]); 1708 1709 /* 1710 * NT_PRSTATUS is the one special case, because the regset data 1711 * goes into the pr_reg field inside the note contents, rather 1712 * than being the whole note contents. We fill the reset in here. 1713 * We assume that regset 0 is NT_PRSTATUS. 1714 */ 1715 fill_prstatus(&t->prstatus, t->task, signr); 1716 (void) view->regsets[0].get(t->task, &view->regsets[0], 0, regset0_size, 1717 &t->prstatus.pr_reg, NULL); 1718 1719 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, 1720 PRSTATUS_SIZE(t->prstatus, regset0_size), &t->prstatus); 1721 *total += notesize(&t->notes[0]); 1722 1723 do_thread_regset_writeback(t->task, &view->regsets[0]); 1724 1725 /* 1726 * Each other regset might generate a note too. For each regset 1727 * that has no core_note_type or is inactive, we leave t->notes[i] 1728 * all zero and we'll know to skip writing it later. 1729 */ 1730 for (i = 1; i < view->n; ++i) { 1731 const struct user_regset *regset = &view->regsets[i]; 1732 do_thread_regset_writeback(t->task, regset); 1733 if (regset->core_note_type && regset->get && 1734 (!regset->active || regset->active(t->task, regset) > 0)) { 1735 int ret; 1736 size_t size = regset_size(t->task, regset); 1737 void *data = kmalloc(size, GFP_KERNEL); 1738 if (unlikely(!data)) 1739 return 0; 1740 ret = regset->get(t->task, regset, 1741 0, size, data, NULL); 1742 if (unlikely(ret)) 1743 kfree(data); 1744 else { 1745 if (regset->core_note_type != NT_PRFPREG) 1746 fill_note(&t->notes[i], "LINUX", 1747 regset->core_note_type, 1748 size, data); 1749 else { 1750 SET_PR_FPVALID(&t->prstatus, 1751 1, regset0_size); 1752 fill_note(&t->notes[i], "CORE", 1753 NT_PRFPREG, size, data); 1754 } 1755 *total += notesize(&t->notes[i]); 1756 } 1757 } 1758 } 1759 1760 return 1; 1761 } 1762 1763 static int fill_note_info(struct elfhdr *elf, int phdrs, 1764 struct elf_note_info *info, 1765 const kernel_siginfo_t *siginfo, struct pt_regs *regs) 1766 { 1767 struct task_struct *dump_task = current; 1768 const struct user_regset_view *view = task_user_regset_view(dump_task); 1769 struct elf_thread_core_info *t; 1770 struct elf_prpsinfo *psinfo; 1771 struct core_thread *ct; 1772 unsigned int i; 1773 1774 info->size = 0; 1775 info->thread = NULL; 1776 1777 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1778 if (psinfo == NULL) { 1779 info->psinfo.data = NULL; /* So we don't free this wrongly */ 1780 return 0; 1781 } 1782 1783 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); 1784 1785 /* 1786 * Figure out how many notes we're going to need for each thread. 1787 */ 1788 info->thread_notes = 0; 1789 for (i = 0; i < view->n; ++i) 1790 if (view->regsets[i].core_note_type != 0) 1791 ++info->thread_notes; 1792 1793 /* 1794 * Sanity check. We rely on regset 0 being in NT_PRSTATUS, 1795 * since it is our one special case. 1796 */ 1797 if (unlikely(info->thread_notes == 0) || 1798 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) { 1799 WARN_ON(1); 1800 return 0; 1801 } 1802 1803 /* 1804 * Initialize the ELF file header. 1805 */ 1806 fill_elf_header(elf, phdrs, 1807 view->e_machine, view->e_flags); 1808 1809 /* 1810 * Allocate a structure for each thread. 1811 */ 1812 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) { 1813 t = kzalloc(offsetof(struct elf_thread_core_info, 1814 notes[info->thread_notes]), 1815 GFP_KERNEL); 1816 if (unlikely(!t)) 1817 return 0; 1818 1819 t->task = ct->task; 1820 if (ct->task == dump_task || !info->thread) { 1821 t->next = info->thread; 1822 info->thread = t; 1823 } else { 1824 /* 1825 * Make sure to keep the original task at 1826 * the head of the list. 1827 */ 1828 t->next = info->thread->next; 1829 info->thread->next = t; 1830 } 1831 } 1832 1833 /* 1834 * Now fill in each thread's information. 1835 */ 1836 for (t = info->thread; t != NULL; t = t->next) 1837 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size)) 1838 return 0; 1839 1840 /* 1841 * Fill in the two process-wide notes. 1842 */ 1843 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm); 1844 info->size += notesize(&info->psinfo); 1845 1846 fill_siginfo_note(&info->signote, &info->csigdata, siginfo); 1847 info->size += notesize(&info->signote); 1848 1849 fill_auxv_note(&info->auxv, current->mm); 1850 info->size += notesize(&info->auxv); 1851 1852 if (fill_files_note(&info->files) == 0) 1853 info->size += notesize(&info->files); 1854 1855 return 1; 1856 } 1857 1858 static size_t get_note_info_size(struct elf_note_info *info) 1859 { 1860 return info->size; 1861 } 1862 1863 /* 1864 * Write all the notes for each thread. When writing the first thread, the 1865 * process-wide notes are interleaved after the first thread-specific note. 1866 */ 1867 static int write_note_info(struct elf_note_info *info, 1868 struct coredump_params *cprm) 1869 { 1870 bool first = true; 1871 struct elf_thread_core_info *t = info->thread; 1872 1873 do { 1874 int i; 1875 1876 if (!writenote(&t->notes[0], cprm)) 1877 return 0; 1878 1879 if (first && !writenote(&info->psinfo, cprm)) 1880 return 0; 1881 if (first && !writenote(&info->signote, cprm)) 1882 return 0; 1883 if (first && !writenote(&info->auxv, cprm)) 1884 return 0; 1885 if (first && info->files.data && 1886 !writenote(&info->files, cprm)) 1887 return 0; 1888 1889 for (i = 1; i < info->thread_notes; ++i) 1890 if (t->notes[i].data && 1891 !writenote(&t->notes[i], cprm)) 1892 return 0; 1893 1894 first = false; 1895 t = t->next; 1896 } while (t); 1897 1898 return 1; 1899 } 1900 1901 static void free_note_info(struct elf_note_info *info) 1902 { 1903 struct elf_thread_core_info *threads = info->thread; 1904 while (threads) { 1905 unsigned int i; 1906 struct elf_thread_core_info *t = threads; 1907 threads = t->next; 1908 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus); 1909 for (i = 1; i < info->thread_notes; ++i) 1910 kfree(t->notes[i].data); 1911 kfree(t); 1912 } 1913 kfree(info->psinfo.data); 1914 kvfree(info->files.data); 1915 } 1916 1917 #else 1918 1919 /* Here is the structure in which status of each thread is captured. */ 1920 struct elf_thread_status 1921 { 1922 struct list_head list; 1923 struct elf_prstatus prstatus; /* NT_PRSTATUS */ 1924 elf_fpregset_t fpu; /* NT_PRFPREG */ 1925 struct task_struct *thread; 1926 #ifdef ELF_CORE_COPY_XFPREGS 1927 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */ 1928 #endif 1929 struct memelfnote notes[3]; 1930 int num_notes; 1931 }; 1932 1933 /* 1934 * In order to add the specific thread information for the elf file format, 1935 * we need to keep a linked list of every threads pr_status and then create 1936 * a single section for them in the final core file. 1937 */ 1938 static int elf_dump_thread_status(long signr, struct elf_thread_status *t) 1939 { 1940 int sz = 0; 1941 struct task_struct *p = t->thread; 1942 t->num_notes = 0; 1943 1944 fill_prstatus(&t->prstatus, p, signr); 1945 elf_core_copy_task_regs(p, &t->prstatus.pr_reg); 1946 1947 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), 1948 &(t->prstatus)); 1949 t->num_notes++; 1950 sz += notesize(&t->notes[0]); 1951 1952 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, 1953 &t->fpu))) { 1954 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), 1955 &(t->fpu)); 1956 t->num_notes++; 1957 sz += notesize(&t->notes[1]); 1958 } 1959 1960 #ifdef ELF_CORE_COPY_XFPREGS 1961 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) { 1962 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE, 1963 sizeof(t->xfpu), &t->xfpu); 1964 t->num_notes++; 1965 sz += notesize(&t->notes[2]); 1966 } 1967 #endif 1968 return sz; 1969 } 1970 1971 struct elf_note_info { 1972 struct memelfnote *notes; 1973 struct memelfnote *notes_files; 1974 struct elf_prstatus *prstatus; /* NT_PRSTATUS */ 1975 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */ 1976 struct list_head thread_list; 1977 elf_fpregset_t *fpu; 1978 #ifdef ELF_CORE_COPY_XFPREGS 1979 elf_fpxregset_t *xfpu; 1980 #endif 1981 user_siginfo_t csigdata; 1982 int thread_status_size; 1983 int numnote; 1984 }; 1985 1986 static int elf_note_info_init(struct elf_note_info *info) 1987 { 1988 memset(info, 0, sizeof(*info)); 1989 INIT_LIST_HEAD(&info->thread_list); 1990 1991 /* Allocate space for ELF notes */ 1992 info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL); 1993 if (!info->notes) 1994 return 0; 1995 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL); 1996 if (!info->psinfo) 1997 return 0; 1998 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL); 1999 if (!info->prstatus) 2000 return 0; 2001 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL); 2002 if (!info->fpu) 2003 return 0; 2004 #ifdef ELF_CORE_COPY_XFPREGS 2005 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL); 2006 if (!info->xfpu) 2007 return 0; 2008 #endif 2009 return 1; 2010 } 2011 2012 static int fill_note_info(struct elfhdr *elf, int phdrs, 2013 struct elf_note_info *info, 2014 const kernel_siginfo_t *siginfo, struct pt_regs *regs) 2015 { 2016 struct core_thread *ct; 2017 struct elf_thread_status *ets; 2018 2019 if (!elf_note_info_init(info)) 2020 return 0; 2021 2022 for (ct = current->mm->core_state->dumper.next; 2023 ct; ct = ct->next) { 2024 ets = kzalloc(sizeof(*ets), GFP_KERNEL); 2025 if (!ets) 2026 return 0; 2027 2028 ets->thread = ct->task; 2029 list_add(&ets->list, &info->thread_list); 2030 } 2031 2032 list_for_each_entry(ets, &info->thread_list, list) { 2033 int sz; 2034 2035 sz = elf_dump_thread_status(siginfo->si_signo, ets); 2036 info->thread_status_size += sz; 2037 } 2038 /* now collect the dump for the current */ 2039 memset(info->prstatus, 0, sizeof(*info->prstatus)); 2040 fill_prstatus(info->prstatus, current, siginfo->si_signo); 2041 elf_core_copy_regs(&info->prstatus->pr_reg, regs); 2042 2043 /* Set up header */ 2044 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS); 2045 2046 /* 2047 * Set up the notes in similar form to SVR4 core dumps made 2048 * with info from their /proc. 2049 */ 2050 2051 fill_note(info->notes + 0, "CORE", NT_PRSTATUS, 2052 sizeof(*info->prstatus), info->prstatus); 2053 fill_psinfo(info->psinfo, current->group_leader, current->mm); 2054 fill_note(info->notes + 1, "CORE", NT_PRPSINFO, 2055 sizeof(*info->psinfo), info->psinfo); 2056 2057 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo); 2058 fill_auxv_note(info->notes + 3, current->mm); 2059 info->numnote = 4; 2060 2061 if (fill_files_note(info->notes + info->numnote) == 0) { 2062 info->notes_files = info->notes + info->numnote; 2063 info->numnote++; 2064 } 2065 2066 /* Try to dump the FPU. */ 2067 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, 2068 info->fpu); 2069 if (info->prstatus->pr_fpvalid) 2070 fill_note(info->notes + info->numnote++, 2071 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu); 2072 #ifdef ELF_CORE_COPY_XFPREGS 2073 if (elf_core_copy_task_xfpregs(current, info->xfpu)) 2074 fill_note(info->notes + info->numnote++, 2075 "LINUX", ELF_CORE_XFPREG_TYPE, 2076 sizeof(*info->xfpu), info->xfpu); 2077 #endif 2078 2079 return 1; 2080 } 2081 2082 static size_t get_note_info_size(struct elf_note_info *info) 2083 { 2084 int sz = 0; 2085 int i; 2086 2087 for (i = 0; i < info->numnote; i++) 2088 sz += notesize(info->notes + i); 2089 2090 sz += info->thread_status_size; 2091 2092 return sz; 2093 } 2094 2095 static int write_note_info(struct elf_note_info *info, 2096 struct coredump_params *cprm) 2097 { 2098 struct elf_thread_status *ets; 2099 int i; 2100 2101 for (i = 0; i < info->numnote; i++) 2102 if (!writenote(info->notes + i, cprm)) 2103 return 0; 2104 2105 /* write out the thread status notes section */ 2106 list_for_each_entry(ets, &info->thread_list, list) { 2107 for (i = 0; i < ets->num_notes; i++) 2108 if (!writenote(&ets->notes[i], cprm)) 2109 return 0; 2110 } 2111 2112 return 1; 2113 } 2114 2115 static void free_note_info(struct elf_note_info *info) 2116 { 2117 while (!list_empty(&info->thread_list)) { 2118 struct list_head *tmp = info->thread_list.next; 2119 list_del(tmp); 2120 kfree(list_entry(tmp, struct elf_thread_status, list)); 2121 } 2122 2123 /* Free data possibly allocated by fill_files_note(): */ 2124 if (info->notes_files) 2125 kvfree(info->notes_files->data); 2126 2127 kfree(info->prstatus); 2128 kfree(info->psinfo); 2129 kfree(info->notes); 2130 kfree(info->fpu); 2131 #ifdef ELF_CORE_COPY_XFPREGS 2132 kfree(info->xfpu); 2133 #endif 2134 } 2135 2136 #endif 2137 2138 static struct vm_area_struct *first_vma(struct task_struct *tsk, 2139 struct vm_area_struct *gate_vma) 2140 { 2141 struct vm_area_struct *ret = tsk->mm->mmap; 2142 2143 if (ret) 2144 return ret; 2145 return gate_vma; 2146 } 2147 /* 2148 * Helper function for iterating across a vma list. It ensures that the caller 2149 * will visit `gate_vma' prior to terminating the search. 2150 */ 2151 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma, 2152 struct vm_area_struct *gate_vma) 2153 { 2154 struct vm_area_struct *ret; 2155 2156 ret = this_vma->vm_next; 2157 if (ret) 2158 return ret; 2159 if (this_vma == gate_vma) 2160 return NULL; 2161 return gate_vma; 2162 } 2163 2164 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, 2165 elf_addr_t e_shoff, int segs) 2166 { 2167 elf->e_shoff = e_shoff; 2168 elf->e_shentsize = sizeof(*shdr4extnum); 2169 elf->e_shnum = 1; 2170 elf->e_shstrndx = SHN_UNDEF; 2171 2172 memset(shdr4extnum, 0, sizeof(*shdr4extnum)); 2173 2174 shdr4extnum->sh_type = SHT_NULL; 2175 shdr4extnum->sh_size = elf->e_shnum; 2176 shdr4extnum->sh_link = elf->e_shstrndx; 2177 shdr4extnum->sh_info = segs; 2178 } 2179 2180 /* 2181 * Actual dumper 2182 * 2183 * This is a two-pass process; first we find the offsets of the bits, 2184 * and then they are actually written out. If we run out of core limit 2185 * we just truncate. 2186 */ 2187 static int elf_core_dump(struct coredump_params *cprm) 2188 { 2189 int has_dumped = 0; 2190 mm_segment_t fs; 2191 int segs, i; 2192 size_t vma_data_size = 0; 2193 struct vm_area_struct *vma, *gate_vma; 2194 struct elfhdr elf; 2195 loff_t offset = 0, dataoff; 2196 struct elf_note_info info = { }; 2197 struct elf_phdr *phdr4note = NULL; 2198 struct elf_shdr *shdr4extnum = NULL; 2199 Elf_Half e_phnum; 2200 elf_addr_t e_shoff; 2201 elf_addr_t *vma_filesz = NULL; 2202 2203 /* 2204 * We no longer stop all VM operations. 2205 * 2206 * This is because those proceses that could possibly change map_count 2207 * or the mmap / vma pages are now blocked in do_exit on current 2208 * finishing this core dump. 2209 * 2210 * Only ptrace can touch these memory addresses, but it doesn't change 2211 * the map_count or the pages allocated. So no possibility of crashing 2212 * exists while dumping the mm->vm_next areas to the core file. 2213 */ 2214 2215 /* 2216 * The number of segs are recored into ELF header as 16bit value. 2217 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. 2218 */ 2219 segs = current->mm->map_count; 2220 segs += elf_core_extra_phdrs(); 2221 2222 gate_vma = get_gate_vma(current->mm); 2223 if (gate_vma != NULL) 2224 segs++; 2225 2226 /* for notes section */ 2227 segs++; 2228 2229 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid 2230 * this, kernel supports extended numbering. Have a look at 2231 * include/linux/elf.h for further information. */ 2232 e_phnum = segs > PN_XNUM ? PN_XNUM : segs; 2233 2234 /* 2235 * Collect all the non-memory information about the process for the 2236 * notes. This also sets up the file header. 2237 */ 2238 if (!fill_note_info(&elf, e_phnum, &info, cprm->siginfo, cprm->regs)) 2239 goto cleanup; 2240 2241 has_dumped = 1; 2242 2243 fs = get_fs(); 2244 set_fs(KERNEL_DS); 2245 2246 offset += sizeof(elf); /* Elf header */ 2247 offset += segs * sizeof(struct elf_phdr); /* Program headers */ 2248 2249 /* Write notes phdr entry */ 2250 { 2251 size_t sz = get_note_info_size(&info); 2252 2253 sz += elf_coredump_extra_notes_size(); 2254 2255 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL); 2256 if (!phdr4note) 2257 goto end_coredump; 2258 2259 fill_elf_note_phdr(phdr4note, sz, offset); 2260 offset += sz; 2261 } 2262 2263 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); 2264 2265 /* 2266 * Zero vma process will get ZERO_SIZE_PTR here. 2267 * Let coredump continue for register state at least. 2268 */ 2269 vma_filesz = kvmalloc(array_size(sizeof(*vma_filesz), (segs - 1)), 2270 GFP_KERNEL); 2271 if (!vma_filesz) 2272 goto end_coredump; 2273 2274 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2275 vma = next_vma(vma, gate_vma)) { 2276 unsigned long dump_size; 2277 2278 dump_size = vma_dump_size(vma, cprm->mm_flags); 2279 vma_filesz[i++] = dump_size; 2280 vma_data_size += dump_size; 2281 } 2282 2283 offset += vma_data_size; 2284 offset += elf_core_extra_data_size(); 2285 e_shoff = offset; 2286 2287 if (e_phnum == PN_XNUM) { 2288 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL); 2289 if (!shdr4extnum) 2290 goto end_coredump; 2291 fill_extnum_info(&elf, shdr4extnum, e_shoff, segs); 2292 } 2293 2294 offset = dataoff; 2295 2296 if (!dump_emit(cprm, &elf, sizeof(elf))) 2297 goto end_coredump; 2298 2299 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note))) 2300 goto end_coredump; 2301 2302 /* Write program headers for segments dump */ 2303 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2304 vma = next_vma(vma, gate_vma)) { 2305 struct elf_phdr phdr; 2306 2307 phdr.p_type = PT_LOAD; 2308 phdr.p_offset = offset; 2309 phdr.p_vaddr = vma->vm_start; 2310 phdr.p_paddr = 0; 2311 phdr.p_filesz = vma_filesz[i++]; 2312 phdr.p_memsz = vma->vm_end - vma->vm_start; 2313 offset += phdr.p_filesz; 2314 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; 2315 if (vma->vm_flags & VM_WRITE) 2316 phdr.p_flags |= PF_W; 2317 if (vma->vm_flags & VM_EXEC) 2318 phdr.p_flags |= PF_X; 2319 phdr.p_align = ELF_EXEC_PAGESIZE; 2320 2321 if (!dump_emit(cprm, &phdr, sizeof(phdr))) 2322 goto end_coredump; 2323 } 2324 2325 if (!elf_core_write_extra_phdrs(cprm, offset)) 2326 goto end_coredump; 2327 2328 /* write out the notes section */ 2329 if (!write_note_info(&info, cprm)) 2330 goto end_coredump; 2331 2332 if (elf_coredump_extra_notes_write(cprm)) 2333 goto end_coredump; 2334 2335 /* Align to page */ 2336 if (!dump_skip(cprm, dataoff - cprm->pos)) 2337 goto end_coredump; 2338 2339 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2340 vma = next_vma(vma, gate_vma)) { 2341 unsigned long addr; 2342 unsigned long end; 2343 2344 end = vma->vm_start + vma_filesz[i++]; 2345 2346 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) { 2347 struct page *page; 2348 int stop; 2349 2350 page = get_dump_page(addr); 2351 if (page) { 2352 void *kaddr = kmap(page); 2353 stop = !dump_emit(cprm, kaddr, PAGE_SIZE); 2354 kunmap(page); 2355 put_page(page); 2356 } else 2357 stop = !dump_skip(cprm, PAGE_SIZE); 2358 if (stop) 2359 goto end_coredump; 2360 } 2361 } 2362 dump_truncate(cprm); 2363 2364 if (!elf_core_write_extra_data(cprm)) 2365 goto end_coredump; 2366 2367 if (e_phnum == PN_XNUM) { 2368 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum))) 2369 goto end_coredump; 2370 } 2371 2372 end_coredump: 2373 set_fs(fs); 2374 2375 cleanup: 2376 free_note_info(&info); 2377 kfree(shdr4extnum); 2378 kvfree(vma_filesz); 2379 kfree(phdr4note); 2380 return has_dumped; 2381 } 2382 2383 #endif /* CONFIG_ELF_CORE */ 2384 2385 static int __init init_elf_binfmt(void) 2386 { 2387 register_binfmt(&elf_format); 2388 return 0; 2389 } 2390 2391 static void __exit exit_elf_binfmt(void) 2392 { 2393 /* Remove the COFF and ELF loaders. */ 2394 unregister_binfmt(&elf_format); 2395 } 2396 2397 core_initcall(init_elf_binfmt); 2398 module_exit(exit_elf_binfmt); 2399 MODULE_LICENSE("GPL"); 2400