1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/fs/binfmt_elf.c 4 * 5 * These are the functions used to load ELF format executables as used 6 * on SVr4 machines. Information on the format may be found in the book 7 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support 8 * Tools". 9 * 10 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com). 11 */ 12 13 #include <linux/module.h> 14 #include <linux/kernel.h> 15 #include <linux/fs.h> 16 #include <linux/log2.h> 17 #include <linux/mm.h> 18 #include <linux/mman.h> 19 #include <linux/errno.h> 20 #include <linux/signal.h> 21 #include <linux/binfmts.h> 22 #include <linux/string.h> 23 #include <linux/file.h> 24 #include <linux/slab.h> 25 #include <linux/personality.h> 26 #include <linux/elfcore.h> 27 #include <linux/init.h> 28 #include <linux/highuid.h> 29 #include <linux/compiler.h> 30 #include <linux/highmem.h> 31 #include <linux/hugetlb.h> 32 #include <linux/pagemap.h> 33 #include <linux/vmalloc.h> 34 #include <linux/security.h> 35 #include <linux/random.h> 36 #include <linux/elf.h> 37 #include <linux/elf-randomize.h> 38 #include <linux/utsname.h> 39 #include <linux/coredump.h> 40 #include <linux/sched.h> 41 #include <linux/sched/coredump.h> 42 #include <linux/sched/task_stack.h> 43 #include <linux/sched/cputime.h> 44 #include <linux/sizes.h> 45 #include <linux/types.h> 46 #include <linux/cred.h> 47 #include <linux/dax.h> 48 #include <linux/uaccess.h> 49 #include <asm/param.h> 50 #include <asm/page.h> 51 52 #ifndef ELF_COMPAT 53 #define ELF_COMPAT 0 54 #endif 55 56 #ifndef user_long_t 57 #define user_long_t long 58 #endif 59 #ifndef user_siginfo_t 60 #define user_siginfo_t siginfo_t 61 #endif 62 63 /* That's for binfmt_elf_fdpic to deal with */ 64 #ifndef elf_check_fdpic 65 #define elf_check_fdpic(ex) false 66 #endif 67 68 static int load_elf_binary(struct linux_binprm *bprm); 69 70 #ifdef CONFIG_USELIB 71 static int load_elf_library(struct file *); 72 #else 73 #define load_elf_library NULL 74 #endif 75 76 /* 77 * If we don't support core dumping, then supply a NULL so we 78 * don't even try. 79 */ 80 #ifdef CONFIG_ELF_CORE 81 static int elf_core_dump(struct coredump_params *cprm); 82 #else 83 #define elf_core_dump NULL 84 #endif 85 86 #if ELF_EXEC_PAGESIZE > PAGE_SIZE 87 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE 88 #else 89 #define ELF_MIN_ALIGN PAGE_SIZE 90 #endif 91 92 #ifndef ELF_CORE_EFLAGS 93 #define ELF_CORE_EFLAGS 0 94 #endif 95 96 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) 97 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) 98 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) 99 100 static struct linux_binfmt elf_format = { 101 .module = THIS_MODULE, 102 .load_binary = load_elf_binary, 103 .load_shlib = load_elf_library, 104 .core_dump = elf_core_dump, 105 .min_coredump = ELF_EXEC_PAGESIZE, 106 }; 107 108 #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE)) 109 110 static int set_brk(unsigned long start, unsigned long end, int prot) 111 { 112 start = ELF_PAGEALIGN(start); 113 end = ELF_PAGEALIGN(end); 114 if (end > start) { 115 /* 116 * Map the last of the bss segment. 117 * If the header is requesting these pages to be 118 * executable, honour that (ppc32 needs this). 119 */ 120 int error = vm_brk_flags(start, end - start, 121 prot & PROT_EXEC ? VM_EXEC : 0); 122 if (error) 123 return error; 124 } 125 current->mm->start_brk = current->mm->brk = end; 126 return 0; 127 } 128 129 /* We need to explicitly zero any fractional pages 130 after the data section (i.e. bss). This would 131 contain the junk from the file that should not 132 be in memory 133 */ 134 static int padzero(unsigned long elf_bss) 135 { 136 unsigned long nbyte; 137 138 nbyte = ELF_PAGEOFFSET(elf_bss); 139 if (nbyte) { 140 nbyte = ELF_MIN_ALIGN - nbyte; 141 if (clear_user((void __user *) elf_bss, nbyte)) 142 return -EFAULT; 143 } 144 return 0; 145 } 146 147 /* Let's use some macros to make this stack manipulation a little clearer */ 148 #ifdef CONFIG_STACK_GROWSUP 149 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items)) 150 #define STACK_ROUND(sp, items) \ 151 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL) 152 #define STACK_ALLOC(sp, len) ({ \ 153 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \ 154 old_sp; }) 155 #else 156 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items)) 157 #define STACK_ROUND(sp, items) \ 158 (((unsigned long) (sp - items)) &~ 15UL) 159 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; }) 160 #endif 161 162 #ifndef ELF_BASE_PLATFORM 163 /* 164 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture. 165 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value 166 * will be copied to the user stack in the same manner as AT_PLATFORM. 167 */ 168 #define ELF_BASE_PLATFORM NULL 169 #endif 170 171 static int 172 create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, 173 unsigned long load_addr, unsigned long interp_load_addr, 174 unsigned long e_entry) 175 { 176 struct mm_struct *mm = current->mm; 177 unsigned long p = bprm->p; 178 int argc = bprm->argc; 179 int envc = bprm->envc; 180 elf_addr_t __user *sp; 181 elf_addr_t __user *u_platform; 182 elf_addr_t __user *u_base_platform; 183 elf_addr_t __user *u_rand_bytes; 184 const char *k_platform = ELF_PLATFORM; 185 const char *k_base_platform = ELF_BASE_PLATFORM; 186 unsigned char k_rand_bytes[16]; 187 int items; 188 elf_addr_t *elf_info; 189 int ei_index; 190 const struct cred *cred = current_cred(); 191 struct vm_area_struct *vma; 192 193 /* 194 * In some cases (e.g. Hyper-Threading), we want to avoid L1 195 * evictions by the processes running on the same package. One 196 * thing we can do is to shuffle the initial stack for them. 197 */ 198 199 p = arch_align_stack(p); 200 201 /* 202 * If this architecture has a platform capability string, copy it 203 * to userspace. In some cases (Sparc), this info is impossible 204 * for userspace to get any other way, in others (i386) it is 205 * merely difficult. 206 */ 207 u_platform = NULL; 208 if (k_platform) { 209 size_t len = strlen(k_platform) + 1; 210 211 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 212 if (copy_to_user(u_platform, k_platform, len)) 213 return -EFAULT; 214 } 215 216 /* 217 * If this architecture has a "base" platform capability 218 * string, copy it to userspace. 219 */ 220 u_base_platform = NULL; 221 if (k_base_platform) { 222 size_t len = strlen(k_base_platform) + 1; 223 224 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 225 if (copy_to_user(u_base_platform, k_base_platform, len)) 226 return -EFAULT; 227 } 228 229 /* 230 * Generate 16 random bytes for userspace PRNG seeding. 231 */ 232 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes)); 233 u_rand_bytes = (elf_addr_t __user *) 234 STACK_ALLOC(p, sizeof(k_rand_bytes)); 235 if (copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes))) 236 return -EFAULT; 237 238 /* Create the ELF interpreter info */ 239 elf_info = (elf_addr_t *)mm->saved_auxv; 240 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ 241 #define NEW_AUX_ENT(id, val) \ 242 do { \ 243 *elf_info++ = id; \ 244 *elf_info++ = val; \ 245 } while (0) 246 247 #ifdef ARCH_DLINFO 248 /* 249 * ARCH_DLINFO must come first so PPC can do its special alignment of 250 * AUXV. 251 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in 252 * ARCH_DLINFO changes 253 */ 254 ARCH_DLINFO; 255 #endif 256 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); 257 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); 258 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); 259 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); 260 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); 261 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); 262 NEW_AUX_ENT(AT_BASE, interp_load_addr); 263 NEW_AUX_ENT(AT_FLAGS, 0); 264 NEW_AUX_ENT(AT_ENTRY, e_entry); 265 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid)); 266 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid)); 267 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid)); 268 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid)); 269 NEW_AUX_ENT(AT_SECURE, bprm->secureexec); 270 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes); 271 #ifdef ELF_HWCAP2 272 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2); 273 #endif 274 NEW_AUX_ENT(AT_EXECFN, bprm->exec); 275 if (k_platform) { 276 NEW_AUX_ENT(AT_PLATFORM, 277 (elf_addr_t)(unsigned long)u_platform); 278 } 279 if (k_base_platform) { 280 NEW_AUX_ENT(AT_BASE_PLATFORM, 281 (elf_addr_t)(unsigned long)u_base_platform); 282 } 283 if (bprm->have_execfd) { 284 NEW_AUX_ENT(AT_EXECFD, bprm->execfd); 285 } 286 #undef NEW_AUX_ENT 287 /* AT_NULL is zero; clear the rest too */ 288 memset(elf_info, 0, (char *)mm->saved_auxv + 289 sizeof(mm->saved_auxv) - (char *)elf_info); 290 291 /* And advance past the AT_NULL entry. */ 292 elf_info += 2; 293 294 ei_index = elf_info - (elf_addr_t *)mm->saved_auxv; 295 sp = STACK_ADD(p, ei_index); 296 297 items = (argc + 1) + (envc + 1) + 1; 298 bprm->p = STACK_ROUND(sp, items); 299 300 /* Point sp at the lowest address on the stack */ 301 #ifdef CONFIG_STACK_GROWSUP 302 sp = (elf_addr_t __user *)bprm->p - items - ei_index; 303 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */ 304 #else 305 sp = (elf_addr_t __user *)bprm->p; 306 #endif 307 308 309 /* 310 * Grow the stack manually; some architectures have a limit on how 311 * far ahead a user-space access may be in order to grow the stack. 312 */ 313 if (mmap_read_lock_killable(mm)) 314 return -EINTR; 315 vma = find_extend_vma(mm, bprm->p); 316 mmap_read_unlock(mm); 317 if (!vma) 318 return -EFAULT; 319 320 /* Now, let's put argc (and argv, envp if appropriate) on the stack */ 321 if (put_user(argc, sp++)) 322 return -EFAULT; 323 324 /* Populate list of argv pointers back to argv strings. */ 325 p = mm->arg_end = mm->arg_start; 326 while (argc-- > 0) { 327 size_t len; 328 if (put_user((elf_addr_t)p, sp++)) 329 return -EFAULT; 330 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 331 if (!len || len > MAX_ARG_STRLEN) 332 return -EINVAL; 333 p += len; 334 } 335 if (put_user(0, sp++)) 336 return -EFAULT; 337 mm->arg_end = p; 338 339 /* Populate list of envp pointers back to envp strings. */ 340 mm->env_end = mm->env_start = p; 341 while (envc-- > 0) { 342 size_t len; 343 if (put_user((elf_addr_t)p, sp++)) 344 return -EFAULT; 345 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 346 if (!len || len > MAX_ARG_STRLEN) 347 return -EINVAL; 348 p += len; 349 } 350 if (put_user(0, sp++)) 351 return -EFAULT; 352 mm->env_end = p; 353 354 /* Put the elf_info on the stack in the right place. */ 355 if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t))) 356 return -EFAULT; 357 return 0; 358 } 359 360 static unsigned long elf_map(struct file *filep, unsigned long addr, 361 const struct elf_phdr *eppnt, int prot, int type, 362 unsigned long total_size) 363 { 364 unsigned long map_addr; 365 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr); 366 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr); 367 addr = ELF_PAGESTART(addr); 368 size = ELF_PAGEALIGN(size); 369 370 /* mmap() will return -EINVAL if given a zero size, but a 371 * segment with zero filesize is perfectly valid */ 372 if (!size) 373 return addr; 374 375 /* 376 * total_size is the size of the ELF (interpreter) image. 377 * The _first_ mmap needs to know the full size, otherwise 378 * randomization might put this image into an overlapping 379 * position with the ELF binary image. (since size < total_size) 380 * So we first map the 'big' image - and unmap the remainder at 381 * the end. (which unmap is needed for ELF images with holes.) 382 */ 383 if (total_size) { 384 total_size = ELF_PAGEALIGN(total_size); 385 map_addr = vm_mmap(filep, addr, total_size, prot, type, off); 386 if (!BAD_ADDR(map_addr)) 387 vm_munmap(map_addr+size, total_size-size); 388 } else 389 map_addr = vm_mmap(filep, addr, size, prot, type, off); 390 391 if ((type & MAP_FIXED_NOREPLACE) && 392 PTR_ERR((void *)map_addr) == -EEXIST) 393 pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n", 394 task_pid_nr(current), current->comm, (void *)addr); 395 396 return(map_addr); 397 } 398 399 static unsigned long total_mapping_size(const struct elf_phdr *cmds, int nr) 400 { 401 int i, first_idx = -1, last_idx = -1; 402 403 for (i = 0; i < nr; i++) { 404 if (cmds[i].p_type == PT_LOAD) { 405 last_idx = i; 406 if (first_idx == -1) 407 first_idx = i; 408 } 409 } 410 if (first_idx == -1) 411 return 0; 412 413 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz - 414 ELF_PAGESTART(cmds[first_idx].p_vaddr); 415 } 416 417 static int elf_read(struct file *file, void *buf, size_t len, loff_t pos) 418 { 419 ssize_t rv; 420 421 rv = kernel_read(file, buf, len, &pos); 422 if (unlikely(rv != len)) { 423 return (rv < 0) ? rv : -EIO; 424 } 425 return 0; 426 } 427 428 static unsigned long maximum_alignment(struct elf_phdr *cmds, int nr) 429 { 430 unsigned long alignment = 0; 431 int i; 432 433 for (i = 0; i < nr; i++) { 434 if (cmds[i].p_type == PT_LOAD) { 435 unsigned long p_align = cmds[i].p_align; 436 437 /* skip non-power of two alignments as invalid */ 438 if (!is_power_of_2(p_align)) 439 continue; 440 alignment = max(alignment, p_align); 441 } 442 } 443 444 /* ensure we align to at least one page */ 445 return ELF_PAGEALIGN(alignment); 446 } 447 448 /** 449 * load_elf_phdrs() - load ELF program headers 450 * @elf_ex: ELF header of the binary whose program headers should be loaded 451 * @elf_file: the opened ELF binary file 452 * 453 * Loads ELF program headers from the binary file elf_file, which has the ELF 454 * header pointed to by elf_ex, into a newly allocated array. The caller is 455 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure. 456 */ 457 static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex, 458 struct file *elf_file) 459 { 460 struct elf_phdr *elf_phdata = NULL; 461 int retval, err = -1; 462 unsigned int size; 463 464 /* 465 * If the size of this structure has changed, then punt, since 466 * we will be doing the wrong thing. 467 */ 468 if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) 469 goto out; 470 471 /* Sanity check the number of program headers... */ 472 /* ...and their total size. */ 473 size = sizeof(struct elf_phdr) * elf_ex->e_phnum; 474 if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN) 475 goto out; 476 477 elf_phdata = kmalloc(size, GFP_KERNEL); 478 if (!elf_phdata) 479 goto out; 480 481 /* Read in the program headers */ 482 retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff); 483 if (retval < 0) { 484 err = retval; 485 goto out; 486 } 487 488 /* Success! */ 489 err = 0; 490 out: 491 if (err) { 492 kfree(elf_phdata); 493 elf_phdata = NULL; 494 } 495 return elf_phdata; 496 } 497 498 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE 499 500 /** 501 * struct arch_elf_state - arch-specific ELF loading state 502 * 503 * This structure is used to preserve architecture specific data during 504 * the loading of an ELF file, throughout the checking of architecture 505 * specific ELF headers & through to the point where the ELF load is 506 * known to be proceeding (ie. SET_PERSONALITY). 507 * 508 * This implementation is a dummy for architectures which require no 509 * specific state. 510 */ 511 struct arch_elf_state { 512 }; 513 514 #define INIT_ARCH_ELF_STATE {} 515 516 /** 517 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header 518 * @ehdr: The main ELF header 519 * @phdr: The program header to check 520 * @elf: The open ELF file 521 * @is_interp: True if the phdr is from the interpreter of the ELF being 522 * loaded, else false. 523 * @state: Architecture-specific state preserved throughout the process 524 * of loading the ELF. 525 * 526 * Inspects the program header phdr to validate its correctness and/or 527 * suitability for the system. Called once per ELF program header in the 528 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its 529 * interpreter. 530 * 531 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 532 * with that return code. 533 */ 534 static inline int arch_elf_pt_proc(struct elfhdr *ehdr, 535 struct elf_phdr *phdr, 536 struct file *elf, bool is_interp, 537 struct arch_elf_state *state) 538 { 539 /* Dummy implementation, always proceed */ 540 return 0; 541 } 542 543 /** 544 * arch_check_elf() - check an ELF executable 545 * @ehdr: The main ELF header 546 * @has_interp: True if the ELF has an interpreter, else false. 547 * @interp_ehdr: The interpreter's ELF header 548 * @state: Architecture-specific state preserved throughout the process 549 * of loading the ELF. 550 * 551 * Provides a final opportunity for architecture code to reject the loading 552 * of the ELF & cause an exec syscall to return an error. This is called after 553 * all program headers to be checked by arch_elf_pt_proc have been. 554 * 555 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 556 * with that return code. 557 */ 558 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, 559 struct elfhdr *interp_ehdr, 560 struct arch_elf_state *state) 561 { 562 /* Dummy implementation, always proceed */ 563 return 0; 564 } 565 566 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ 567 568 static inline int make_prot(u32 p_flags, struct arch_elf_state *arch_state, 569 bool has_interp, bool is_interp) 570 { 571 int prot = 0; 572 573 if (p_flags & PF_R) 574 prot |= PROT_READ; 575 if (p_flags & PF_W) 576 prot |= PROT_WRITE; 577 if (p_flags & PF_X) 578 prot |= PROT_EXEC; 579 580 return arch_elf_adjust_prot(prot, arch_state, has_interp, is_interp); 581 } 582 583 /* This is much more generalized than the library routine read function, 584 so we keep this separate. Technically the library read function 585 is only provided so that we can read a.out libraries that have 586 an ELF header */ 587 588 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, 589 struct file *interpreter, 590 unsigned long no_base, struct elf_phdr *interp_elf_phdata, 591 struct arch_elf_state *arch_state) 592 { 593 struct elf_phdr *eppnt; 594 unsigned long load_addr = 0; 595 int load_addr_set = 0; 596 unsigned long last_bss = 0, elf_bss = 0; 597 int bss_prot = 0; 598 unsigned long error = ~0UL; 599 unsigned long total_size; 600 int i; 601 602 /* First of all, some simple consistency checks */ 603 if (interp_elf_ex->e_type != ET_EXEC && 604 interp_elf_ex->e_type != ET_DYN) 605 goto out; 606 if (!elf_check_arch(interp_elf_ex) || 607 elf_check_fdpic(interp_elf_ex)) 608 goto out; 609 if (!interpreter->f_op->mmap) 610 goto out; 611 612 total_size = total_mapping_size(interp_elf_phdata, 613 interp_elf_ex->e_phnum); 614 if (!total_size) { 615 error = -EINVAL; 616 goto out; 617 } 618 619 eppnt = interp_elf_phdata; 620 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { 621 if (eppnt->p_type == PT_LOAD) { 622 int elf_type = MAP_PRIVATE | MAP_DENYWRITE; 623 int elf_prot = make_prot(eppnt->p_flags, arch_state, 624 true, true); 625 unsigned long vaddr = 0; 626 unsigned long k, map_addr; 627 628 vaddr = eppnt->p_vaddr; 629 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) 630 elf_type |= MAP_FIXED_NOREPLACE; 631 else if (no_base && interp_elf_ex->e_type == ET_DYN) 632 load_addr = -vaddr; 633 634 map_addr = elf_map(interpreter, load_addr + vaddr, 635 eppnt, elf_prot, elf_type, total_size); 636 total_size = 0; 637 error = map_addr; 638 if (BAD_ADDR(map_addr)) 639 goto out; 640 641 if (!load_addr_set && 642 interp_elf_ex->e_type == ET_DYN) { 643 load_addr = map_addr - ELF_PAGESTART(vaddr); 644 load_addr_set = 1; 645 } 646 647 /* 648 * Check to see if the section's size will overflow the 649 * allowed task size. Note that p_filesz must always be 650 * <= p_memsize so it's only necessary to check p_memsz. 651 */ 652 k = load_addr + eppnt->p_vaddr; 653 if (BAD_ADDR(k) || 654 eppnt->p_filesz > eppnt->p_memsz || 655 eppnt->p_memsz > TASK_SIZE || 656 TASK_SIZE - eppnt->p_memsz < k) { 657 error = -ENOMEM; 658 goto out; 659 } 660 661 /* 662 * Find the end of the file mapping for this phdr, and 663 * keep track of the largest address we see for this. 664 */ 665 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz; 666 if (k > elf_bss) 667 elf_bss = k; 668 669 /* 670 * Do the same thing for the memory mapping - between 671 * elf_bss and last_bss is the bss section. 672 */ 673 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz; 674 if (k > last_bss) { 675 last_bss = k; 676 bss_prot = elf_prot; 677 } 678 } 679 } 680 681 /* 682 * Now fill out the bss section: first pad the last page from 683 * the file up to the page boundary, and zero it from elf_bss 684 * up to the end of the page. 685 */ 686 if (padzero(elf_bss)) { 687 error = -EFAULT; 688 goto out; 689 } 690 /* 691 * Next, align both the file and mem bss up to the page size, 692 * since this is where elf_bss was just zeroed up to, and where 693 * last_bss will end after the vm_brk_flags() below. 694 */ 695 elf_bss = ELF_PAGEALIGN(elf_bss); 696 last_bss = ELF_PAGEALIGN(last_bss); 697 /* Finally, if there is still more bss to allocate, do it. */ 698 if (last_bss > elf_bss) { 699 error = vm_brk_flags(elf_bss, last_bss - elf_bss, 700 bss_prot & PROT_EXEC ? VM_EXEC : 0); 701 if (error) 702 goto out; 703 } 704 705 error = load_addr; 706 out: 707 return error; 708 } 709 710 /* 711 * These are the functions used to load ELF style executables and shared 712 * libraries. There is no binary dependent code anywhere else. 713 */ 714 715 static int parse_elf_property(const char *data, size_t *off, size_t datasz, 716 struct arch_elf_state *arch, 717 bool have_prev_type, u32 *prev_type) 718 { 719 size_t o, step; 720 const struct gnu_property *pr; 721 int ret; 722 723 if (*off == datasz) 724 return -ENOENT; 725 726 if (WARN_ON_ONCE(*off > datasz || *off % ELF_GNU_PROPERTY_ALIGN)) 727 return -EIO; 728 o = *off; 729 datasz -= *off; 730 731 if (datasz < sizeof(*pr)) 732 return -ENOEXEC; 733 pr = (const struct gnu_property *)(data + o); 734 o += sizeof(*pr); 735 datasz -= sizeof(*pr); 736 737 if (pr->pr_datasz > datasz) 738 return -ENOEXEC; 739 740 WARN_ON_ONCE(o % ELF_GNU_PROPERTY_ALIGN); 741 step = round_up(pr->pr_datasz, ELF_GNU_PROPERTY_ALIGN); 742 if (step > datasz) 743 return -ENOEXEC; 744 745 /* Properties are supposed to be unique and sorted on pr_type: */ 746 if (have_prev_type && pr->pr_type <= *prev_type) 747 return -ENOEXEC; 748 *prev_type = pr->pr_type; 749 750 ret = arch_parse_elf_property(pr->pr_type, data + o, 751 pr->pr_datasz, ELF_COMPAT, arch); 752 if (ret) 753 return ret; 754 755 *off = o + step; 756 return 0; 757 } 758 759 #define NOTE_DATA_SZ SZ_1K 760 #define GNU_PROPERTY_TYPE_0_NAME "GNU" 761 #define NOTE_NAME_SZ (sizeof(GNU_PROPERTY_TYPE_0_NAME)) 762 763 static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr, 764 struct arch_elf_state *arch) 765 { 766 union { 767 struct elf_note nhdr; 768 char data[NOTE_DATA_SZ]; 769 } note; 770 loff_t pos; 771 ssize_t n; 772 size_t off, datasz; 773 int ret; 774 bool have_prev_type; 775 u32 prev_type; 776 777 if (!IS_ENABLED(CONFIG_ARCH_USE_GNU_PROPERTY) || !phdr) 778 return 0; 779 780 /* load_elf_binary() shouldn't call us unless this is true... */ 781 if (WARN_ON_ONCE(phdr->p_type != PT_GNU_PROPERTY)) 782 return -ENOEXEC; 783 784 /* If the properties are crazy large, that's too bad (for now): */ 785 if (phdr->p_filesz > sizeof(note)) 786 return -ENOEXEC; 787 788 pos = phdr->p_offset; 789 n = kernel_read(f, ¬e, phdr->p_filesz, &pos); 790 791 BUILD_BUG_ON(sizeof(note) < sizeof(note.nhdr) + NOTE_NAME_SZ); 792 if (n < 0 || n < sizeof(note.nhdr) + NOTE_NAME_SZ) 793 return -EIO; 794 795 if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 || 796 note.nhdr.n_namesz != NOTE_NAME_SZ || 797 strncmp(note.data + sizeof(note.nhdr), 798 GNU_PROPERTY_TYPE_0_NAME, n - sizeof(note.nhdr))) 799 return -ENOEXEC; 800 801 off = round_up(sizeof(note.nhdr) + NOTE_NAME_SZ, 802 ELF_GNU_PROPERTY_ALIGN); 803 if (off > n) 804 return -ENOEXEC; 805 806 if (note.nhdr.n_descsz > n - off) 807 return -ENOEXEC; 808 datasz = off + note.nhdr.n_descsz; 809 810 have_prev_type = false; 811 do { 812 ret = parse_elf_property(note.data, &off, datasz, arch, 813 have_prev_type, &prev_type); 814 have_prev_type = true; 815 } while (!ret); 816 817 return ret == -ENOENT ? 0 : ret; 818 } 819 820 static int load_elf_binary(struct linux_binprm *bprm) 821 { 822 struct file *interpreter = NULL; /* to shut gcc up */ 823 unsigned long load_addr = 0, load_bias = 0; 824 int load_addr_set = 0; 825 unsigned long error; 826 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; 827 struct elf_phdr *elf_property_phdata = NULL; 828 unsigned long elf_bss, elf_brk; 829 int bss_prot = 0; 830 int retval, i; 831 unsigned long elf_entry; 832 unsigned long e_entry; 833 unsigned long interp_load_addr = 0; 834 unsigned long start_code, end_code, start_data, end_data; 835 unsigned long reloc_func_desc __maybe_unused = 0; 836 int executable_stack = EXSTACK_DEFAULT; 837 struct elfhdr *elf_ex = (struct elfhdr *)bprm->buf; 838 struct elfhdr *interp_elf_ex = NULL; 839 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE; 840 struct mm_struct *mm; 841 struct pt_regs *regs; 842 843 retval = -ENOEXEC; 844 /* First of all, some simple consistency checks */ 845 if (memcmp(elf_ex->e_ident, ELFMAG, SELFMAG) != 0) 846 goto out; 847 848 if (elf_ex->e_type != ET_EXEC && elf_ex->e_type != ET_DYN) 849 goto out; 850 if (!elf_check_arch(elf_ex)) 851 goto out; 852 if (elf_check_fdpic(elf_ex)) 853 goto out; 854 if (!bprm->file->f_op->mmap) 855 goto out; 856 857 elf_phdata = load_elf_phdrs(elf_ex, bprm->file); 858 if (!elf_phdata) 859 goto out; 860 861 elf_ppnt = elf_phdata; 862 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) { 863 char *elf_interpreter; 864 865 if (elf_ppnt->p_type == PT_GNU_PROPERTY) { 866 elf_property_phdata = elf_ppnt; 867 continue; 868 } 869 870 if (elf_ppnt->p_type != PT_INTERP) 871 continue; 872 873 /* 874 * This is the program interpreter used for shared libraries - 875 * for now assume that this is an a.out format binary. 876 */ 877 retval = -ENOEXEC; 878 if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2) 879 goto out_free_ph; 880 881 retval = -ENOMEM; 882 elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL); 883 if (!elf_interpreter) 884 goto out_free_ph; 885 886 retval = elf_read(bprm->file, elf_interpreter, elf_ppnt->p_filesz, 887 elf_ppnt->p_offset); 888 if (retval < 0) 889 goto out_free_interp; 890 /* make sure path is NULL terminated */ 891 retval = -ENOEXEC; 892 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') 893 goto out_free_interp; 894 895 interpreter = open_exec(elf_interpreter); 896 kfree(elf_interpreter); 897 retval = PTR_ERR(interpreter); 898 if (IS_ERR(interpreter)) 899 goto out_free_ph; 900 901 /* 902 * If the binary is not readable then enforce mm->dumpable = 0 903 * regardless of the interpreter's permissions. 904 */ 905 would_dump(bprm, interpreter); 906 907 interp_elf_ex = kmalloc(sizeof(*interp_elf_ex), GFP_KERNEL); 908 if (!interp_elf_ex) { 909 retval = -ENOMEM; 910 goto out_free_ph; 911 } 912 913 /* Get the exec headers */ 914 retval = elf_read(interpreter, interp_elf_ex, 915 sizeof(*interp_elf_ex), 0); 916 if (retval < 0) 917 goto out_free_dentry; 918 919 break; 920 921 out_free_interp: 922 kfree(elf_interpreter); 923 goto out_free_ph; 924 } 925 926 elf_ppnt = elf_phdata; 927 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) 928 switch (elf_ppnt->p_type) { 929 case PT_GNU_STACK: 930 if (elf_ppnt->p_flags & PF_X) 931 executable_stack = EXSTACK_ENABLE_X; 932 else 933 executable_stack = EXSTACK_DISABLE_X; 934 break; 935 936 case PT_LOPROC ... PT_HIPROC: 937 retval = arch_elf_pt_proc(elf_ex, elf_ppnt, 938 bprm->file, false, 939 &arch_state); 940 if (retval) 941 goto out_free_dentry; 942 break; 943 } 944 945 /* Some simple consistency checks for the interpreter */ 946 if (interpreter) { 947 retval = -ELIBBAD; 948 /* Not an ELF interpreter */ 949 if (memcmp(interp_elf_ex->e_ident, ELFMAG, SELFMAG) != 0) 950 goto out_free_dentry; 951 /* Verify the interpreter has a valid arch */ 952 if (!elf_check_arch(interp_elf_ex) || 953 elf_check_fdpic(interp_elf_ex)) 954 goto out_free_dentry; 955 956 /* Load the interpreter program headers */ 957 interp_elf_phdata = load_elf_phdrs(interp_elf_ex, 958 interpreter); 959 if (!interp_elf_phdata) 960 goto out_free_dentry; 961 962 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ 963 elf_property_phdata = NULL; 964 elf_ppnt = interp_elf_phdata; 965 for (i = 0; i < interp_elf_ex->e_phnum; i++, elf_ppnt++) 966 switch (elf_ppnt->p_type) { 967 case PT_GNU_PROPERTY: 968 elf_property_phdata = elf_ppnt; 969 break; 970 971 case PT_LOPROC ... PT_HIPROC: 972 retval = arch_elf_pt_proc(interp_elf_ex, 973 elf_ppnt, interpreter, 974 true, &arch_state); 975 if (retval) 976 goto out_free_dentry; 977 break; 978 } 979 } 980 981 retval = parse_elf_properties(interpreter ?: bprm->file, 982 elf_property_phdata, &arch_state); 983 if (retval) 984 goto out_free_dentry; 985 986 /* 987 * Allow arch code to reject the ELF at this point, whilst it's 988 * still possible to return an error to the code that invoked 989 * the exec syscall. 990 */ 991 retval = arch_check_elf(elf_ex, 992 !!interpreter, interp_elf_ex, 993 &arch_state); 994 if (retval) 995 goto out_free_dentry; 996 997 /* Flush all traces of the currently running executable */ 998 retval = begin_new_exec(bprm); 999 if (retval) 1000 goto out_free_dentry; 1001 1002 /* Do this immediately, since STACK_TOP as used in setup_arg_pages 1003 may depend on the personality. */ 1004 SET_PERSONALITY2(*elf_ex, &arch_state); 1005 if (elf_read_implies_exec(*elf_ex, executable_stack)) 1006 current->personality |= READ_IMPLIES_EXEC; 1007 1008 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) 1009 current->flags |= PF_RANDOMIZE; 1010 1011 setup_new_exec(bprm); 1012 1013 /* Do this so that we can load the interpreter, if need be. We will 1014 change some of these later */ 1015 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), 1016 executable_stack); 1017 if (retval < 0) 1018 goto out_free_dentry; 1019 1020 elf_bss = 0; 1021 elf_brk = 0; 1022 1023 start_code = ~0UL; 1024 end_code = 0; 1025 start_data = 0; 1026 end_data = 0; 1027 1028 /* Now we do a little grungy work by mmapping the ELF image into 1029 the correct location in memory. */ 1030 for(i = 0, elf_ppnt = elf_phdata; 1031 i < elf_ex->e_phnum; i++, elf_ppnt++) { 1032 int elf_prot, elf_flags; 1033 unsigned long k, vaddr; 1034 unsigned long total_size = 0; 1035 unsigned long alignment; 1036 1037 if (elf_ppnt->p_type != PT_LOAD) 1038 continue; 1039 1040 if (unlikely (elf_brk > elf_bss)) { 1041 unsigned long nbyte; 1042 1043 /* There was a PT_LOAD segment with p_memsz > p_filesz 1044 before this one. Map anonymous pages, if needed, 1045 and clear the area. */ 1046 retval = set_brk(elf_bss + load_bias, 1047 elf_brk + load_bias, 1048 bss_prot); 1049 if (retval) 1050 goto out_free_dentry; 1051 nbyte = ELF_PAGEOFFSET(elf_bss); 1052 if (nbyte) { 1053 nbyte = ELF_MIN_ALIGN - nbyte; 1054 if (nbyte > elf_brk - elf_bss) 1055 nbyte = elf_brk - elf_bss; 1056 if (clear_user((void __user *)elf_bss + 1057 load_bias, nbyte)) { 1058 /* 1059 * This bss-zeroing can fail if the ELF 1060 * file specifies odd protections. So 1061 * we don't check the return value 1062 */ 1063 } 1064 } 1065 } 1066 1067 elf_prot = make_prot(elf_ppnt->p_flags, &arch_state, 1068 !!interpreter, false); 1069 1070 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE; 1071 1072 vaddr = elf_ppnt->p_vaddr; 1073 /* 1074 * If we are loading ET_EXEC or we have already performed 1075 * the ET_DYN load_addr calculations, proceed normally. 1076 */ 1077 if (elf_ex->e_type == ET_EXEC || load_addr_set) { 1078 elf_flags |= MAP_FIXED; 1079 } else if (elf_ex->e_type == ET_DYN) { 1080 /* 1081 * This logic is run once for the first LOAD Program 1082 * Header for ET_DYN binaries to calculate the 1083 * randomization (load_bias) for all the LOAD 1084 * Program Headers, and to calculate the entire 1085 * size of the ELF mapping (total_size). (Note that 1086 * load_addr_set is set to true later once the 1087 * initial mapping is performed.) 1088 * 1089 * There are effectively two types of ET_DYN 1090 * binaries: programs (i.e. PIE: ET_DYN with INTERP) 1091 * and loaders (ET_DYN without INTERP, since they 1092 * _are_ the ELF interpreter). The loaders must 1093 * be loaded away from programs since the program 1094 * may otherwise collide with the loader (especially 1095 * for ET_EXEC which does not have a randomized 1096 * position). For example to handle invocations of 1097 * "./ld.so someprog" to test out a new version of 1098 * the loader, the subsequent program that the 1099 * loader loads must avoid the loader itself, so 1100 * they cannot share the same load range. Sufficient 1101 * room for the brk must be allocated with the 1102 * loader as well, since brk must be available with 1103 * the loader. 1104 * 1105 * Therefore, programs are loaded offset from 1106 * ELF_ET_DYN_BASE and loaders are loaded into the 1107 * independently randomized mmap region (0 load_bias 1108 * without MAP_FIXED). 1109 */ 1110 if (interpreter) { 1111 load_bias = ELF_ET_DYN_BASE; 1112 if (current->flags & PF_RANDOMIZE) 1113 load_bias += arch_mmap_rnd(); 1114 alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum); 1115 if (alignment) 1116 load_bias &= ~(alignment - 1); 1117 elf_flags |= MAP_FIXED; 1118 } else 1119 load_bias = 0; 1120 1121 /* 1122 * Since load_bias is used for all subsequent loading 1123 * calculations, we must lower it by the first vaddr 1124 * so that the remaining calculations based on the 1125 * ELF vaddrs will be correctly offset. The result 1126 * is then page aligned. 1127 */ 1128 load_bias = ELF_PAGESTART(load_bias - vaddr); 1129 1130 total_size = total_mapping_size(elf_phdata, 1131 elf_ex->e_phnum); 1132 if (!total_size) { 1133 retval = -EINVAL; 1134 goto out_free_dentry; 1135 } 1136 } 1137 1138 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, 1139 elf_prot, elf_flags, total_size); 1140 if (BAD_ADDR(error)) { 1141 retval = IS_ERR((void *)error) ? 1142 PTR_ERR((void*)error) : -EINVAL; 1143 goto out_free_dentry; 1144 } 1145 1146 if (!load_addr_set) { 1147 load_addr_set = 1; 1148 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset); 1149 if (elf_ex->e_type == ET_DYN) { 1150 load_bias += error - 1151 ELF_PAGESTART(load_bias + vaddr); 1152 load_addr += load_bias; 1153 reloc_func_desc = load_bias; 1154 } 1155 } 1156 k = elf_ppnt->p_vaddr; 1157 if ((elf_ppnt->p_flags & PF_X) && k < start_code) 1158 start_code = k; 1159 if (start_data < k) 1160 start_data = k; 1161 1162 /* 1163 * Check to see if the section's size will overflow the 1164 * allowed task size. Note that p_filesz must always be 1165 * <= p_memsz so it is only necessary to check p_memsz. 1166 */ 1167 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || 1168 elf_ppnt->p_memsz > TASK_SIZE || 1169 TASK_SIZE - elf_ppnt->p_memsz < k) { 1170 /* set_brk can never work. Avoid overflows. */ 1171 retval = -EINVAL; 1172 goto out_free_dentry; 1173 } 1174 1175 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; 1176 1177 if (k > elf_bss) 1178 elf_bss = k; 1179 if ((elf_ppnt->p_flags & PF_X) && end_code < k) 1180 end_code = k; 1181 if (end_data < k) 1182 end_data = k; 1183 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; 1184 if (k > elf_brk) { 1185 bss_prot = elf_prot; 1186 elf_brk = k; 1187 } 1188 } 1189 1190 e_entry = elf_ex->e_entry + load_bias; 1191 elf_bss += load_bias; 1192 elf_brk += load_bias; 1193 start_code += load_bias; 1194 end_code += load_bias; 1195 start_data += load_bias; 1196 end_data += load_bias; 1197 1198 /* Calling set_brk effectively mmaps the pages that we need 1199 * for the bss and break sections. We must do this before 1200 * mapping in the interpreter, to make sure it doesn't wind 1201 * up getting placed where the bss needs to go. 1202 */ 1203 retval = set_brk(elf_bss, elf_brk, bss_prot); 1204 if (retval) 1205 goto out_free_dentry; 1206 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { 1207 retval = -EFAULT; /* Nobody gets to see this, but.. */ 1208 goto out_free_dentry; 1209 } 1210 1211 if (interpreter) { 1212 elf_entry = load_elf_interp(interp_elf_ex, 1213 interpreter, 1214 load_bias, interp_elf_phdata, 1215 &arch_state); 1216 if (!IS_ERR((void *)elf_entry)) { 1217 /* 1218 * load_elf_interp() returns relocation 1219 * adjustment 1220 */ 1221 interp_load_addr = elf_entry; 1222 elf_entry += interp_elf_ex->e_entry; 1223 } 1224 if (BAD_ADDR(elf_entry)) { 1225 retval = IS_ERR((void *)elf_entry) ? 1226 (int)elf_entry : -EINVAL; 1227 goto out_free_dentry; 1228 } 1229 reloc_func_desc = interp_load_addr; 1230 1231 allow_write_access(interpreter); 1232 fput(interpreter); 1233 1234 kfree(interp_elf_ex); 1235 kfree(interp_elf_phdata); 1236 } else { 1237 elf_entry = e_entry; 1238 if (BAD_ADDR(elf_entry)) { 1239 retval = -EINVAL; 1240 goto out_free_dentry; 1241 } 1242 } 1243 1244 kfree(elf_phdata); 1245 1246 set_binfmt(&elf_format); 1247 1248 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES 1249 retval = arch_setup_additional_pages(bprm, !!interpreter); 1250 if (retval < 0) 1251 goto out; 1252 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ 1253 1254 retval = create_elf_tables(bprm, elf_ex, 1255 load_addr, interp_load_addr, e_entry); 1256 if (retval < 0) 1257 goto out; 1258 1259 mm = current->mm; 1260 mm->end_code = end_code; 1261 mm->start_code = start_code; 1262 mm->start_data = start_data; 1263 mm->end_data = end_data; 1264 mm->start_stack = bprm->p; 1265 1266 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) { 1267 /* 1268 * For architectures with ELF randomization, when executing 1269 * a loader directly (i.e. no interpreter listed in ELF 1270 * headers), move the brk area out of the mmap region 1271 * (since it grows up, and may collide early with the stack 1272 * growing down), and into the unused ELF_ET_DYN_BASE region. 1273 */ 1274 if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && 1275 elf_ex->e_type == ET_DYN && !interpreter) { 1276 mm->brk = mm->start_brk = ELF_ET_DYN_BASE; 1277 } 1278 1279 mm->brk = mm->start_brk = arch_randomize_brk(mm); 1280 #ifdef compat_brk_randomized 1281 current->brk_randomized = 1; 1282 #endif 1283 } 1284 1285 if (current->personality & MMAP_PAGE_ZERO) { 1286 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 1287 and some applications "depend" upon this behavior. 1288 Since we do not have the power to recompile these, we 1289 emulate the SVr4 behavior. Sigh. */ 1290 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, 1291 MAP_FIXED | MAP_PRIVATE, 0); 1292 } 1293 1294 regs = current_pt_regs(); 1295 #ifdef ELF_PLAT_INIT 1296 /* 1297 * The ABI may specify that certain registers be set up in special 1298 * ways (on i386 %edx is the address of a DT_FINI function, for 1299 * example. In addition, it may also specify (eg, PowerPC64 ELF) 1300 * that the e_entry field is the address of the function descriptor 1301 * for the startup routine, rather than the address of the startup 1302 * routine itself. This macro performs whatever initialization to 1303 * the regs structure is required as well as any relocations to the 1304 * function descriptor entries when executing dynamically links apps. 1305 */ 1306 ELF_PLAT_INIT(regs, reloc_func_desc); 1307 #endif 1308 1309 finalize_exec(bprm); 1310 start_thread(regs, elf_entry, bprm->p); 1311 retval = 0; 1312 out: 1313 return retval; 1314 1315 /* error cleanup */ 1316 out_free_dentry: 1317 kfree(interp_elf_ex); 1318 kfree(interp_elf_phdata); 1319 allow_write_access(interpreter); 1320 if (interpreter) 1321 fput(interpreter); 1322 out_free_ph: 1323 kfree(elf_phdata); 1324 goto out; 1325 } 1326 1327 #ifdef CONFIG_USELIB 1328 /* This is really simpleminded and specialized - we are loading an 1329 a.out library that is given an ELF header. */ 1330 static int load_elf_library(struct file *file) 1331 { 1332 struct elf_phdr *elf_phdata; 1333 struct elf_phdr *eppnt; 1334 unsigned long elf_bss, bss, len; 1335 int retval, error, i, j; 1336 struct elfhdr elf_ex; 1337 1338 error = -ENOEXEC; 1339 retval = elf_read(file, &elf_ex, sizeof(elf_ex), 0); 1340 if (retval < 0) 1341 goto out; 1342 1343 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 1344 goto out; 1345 1346 /* First of all, some simple consistency checks */ 1347 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 || 1348 !elf_check_arch(&elf_ex) || !file->f_op->mmap) 1349 goto out; 1350 if (elf_check_fdpic(&elf_ex)) 1351 goto out; 1352 1353 /* Now read in all of the header information */ 1354 1355 j = sizeof(struct elf_phdr) * elf_ex.e_phnum; 1356 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */ 1357 1358 error = -ENOMEM; 1359 elf_phdata = kmalloc(j, GFP_KERNEL); 1360 if (!elf_phdata) 1361 goto out; 1362 1363 eppnt = elf_phdata; 1364 error = -ENOEXEC; 1365 retval = elf_read(file, eppnt, j, elf_ex.e_phoff); 1366 if (retval < 0) 1367 goto out_free_ph; 1368 1369 for (j = 0, i = 0; i<elf_ex.e_phnum; i++) 1370 if ((eppnt + i)->p_type == PT_LOAD) 1371 j++; 1372 if (j != 1) 1373 goto out_free_ph; 1374 1375 while (eppnt->p_type != PT_LOAD) 1376 eppnt++; 1377 1378 /* Now use mmap to map the library into memory. */ 1379 error = vm_mmap(file, 1380 ELF_PAGESTART(eppnt->p_vaddr), 1381 (eppnt->p_filesz + 1382 ELF_PAGEOFFSET(eppnt->p_vaddr)), 1383 PROT_READ | PROT_WRITE | PROT_EXEC, 1384 MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_DENYWRITE, 1385 (eppnt->p_offset - 1386 ELF_PAGEOFFSET(eppnt->p_vaddr))); 1387 if (error != ELF_PAGESTART(eppnt->p_vaddr)) 1388 goto out_free_ph; 1389 1390 elf_bss = eppnt->p_vaddr + eppnt->p_filesz; 1391 if (padzero(elf_bss)) { 1392 error = -EFAULT; 1393 goto out_free_ph; 1394 } 1395 1396 len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr); 1397 bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr); 1398 if (bss > len) { 1399 error = vm_brk(len, bss - len); 1400 if (error) 1401 goto out_free_ph; 1402 } 1403 error = 0; 1404 1405 out_free_ph: 1406 kfree(elf_phdata); 1407 out: 1408 return error; 1409 } 1410 #endif /* #ifdef CONFIG_USELIB */ 1411 1412 #ifdef CONFIG_ELF_CORE 1413 /* 1414 * ELF core dumper 1415 * 1416 * Modelled on fs/exec.c:aout_core_dump() 1417 * Jeremy Fitzhardinge <jeremy@sw.oz.au> 1418 */ 1419 1420 /* An ELF note in memory */ 1421 struct memelfnote 1422 { 1423 const char *name; 1424 int type; 1425 unsigned int datasz; 1426 void *data; 1427 }; 1428 1429 static int notesize(struct memelfnote *en) 1430 { 1431 int sz; 1432 1433 sz = sizeof(struct elf_note); 1434 sz += roundup(strlen(en->name) + 1, 4); 1435 sz += roundup(en->datasz, 4); 1436 1437 return sz; 1438 } 1439 1440 static int writenote(struct memelfnote *men, struct coredump_params *cprm) 1441 { 1442 struct elf_note en; 1443 en.n_namesz = strlen(men->name) + 1; 1444 en.n_descsz = men->datasz; 1445 en.n_type = men->type; 1446 1447 return dump_emit(cprm, &en, sizeof(en)) && 1448 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) && 1449 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4); 1450 } 1451 1452 static void fill_elf_header(struct elfhdr *elf, int segs, 1453 u16 machine, u32 flags) 1454 { 1455 memset(elf, 0, sizeof(*elf)); 1456 1457 memcpy(elf->e_ident, ELFMAG, SELFMAG); 1458 elf->e_ident[EI_CLASS] = ELF_CLASS; 1459 elf->e_ident[EI_DATA] = ELF_DATA; 1460 elf->e_ident[EI_VERSION] = EV_CURRENT; 1461 elf->e_ident[EI_OSABI] = ELF_OSABI; 1462 1463 elf->e_type = ET_CORE; 1464 elf->e_machine = machine; 1465 elf->e_version = EV_CURRENT; 1466 elf->e_phoff = sizeof(struct elfhdr); 1467 elf->e_flags = flags; 1468 elf->e_ehsize = sizeof(struct elfhdr); 1469 elf->e_phentsize = sizeof(struct elf_phdr); 1470 elf->e_phnum = segs; 1471 } 1472 1473 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset) 1474 { 1475 phdr->p_type = PT_NOTE; 1476 phdr->p_offset = offset; 1477 phdr->p_vaddr = 0; 1478 phdr->p_paddr = 0; 1479 phdr->p_filesz = sz; 1480 phdr->p_memsz = 0; 1481 phdr->p_flags = 0; 1482 phdr->p_align = 0; 1483 } 1484 1485 static void fill_note(struct memelfnote *note, const char *name, int type, 1486 unsigned int sz, void *data) 1487 { 1488 note->name = name; 1489 note->type = type; 1490 note->datasz = sz; 1491 note->data = data; 1492 } 1493 1494 /* 1495 * fill up all the fields in prstatus from the given task struct, except 1496 * registers which need to be filled up separately. 1497 */ 1498 static void fill_prstatus(struct elf_prstatus *prstatus, 1499 struct task_struct *p, long signr) 1500 { 1501 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 1502 prstatus->pr_sigpend = p->pending.signal.sig[0]; 1503 prstatus->pr_sighold = p->blocked.sig[0]; 1504 rcu_read_lock(); 1505 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1506 rcu_read_unlock(); 1507 prstatus->pr_pid = task_pid_vnr(p); 1508 prstatus->pr_pgrp = task_pgrp_vnr(p); 1509 prstatus->pr_sid = task_session_vnr(p); 1510 if (thread_group_leader(p)) { 1511 struct task_cputime cputime; 1512 1513 /* 1514 * This is the record for the group leader. It shows the 1515 * group-wide total, not its individual thread total. 1516 */ 1517 thread_group_cputime(p, &cputime); 1518 prstatus->pr_utime = ns_to_kernel_old_timeval(cputime.utime); 1519 prstatus->pr_stime = ns_to_kernel_old_timeval(cputime.stime); 1520 } else { 1521 u64 utime, stime; 1522 1523 task_cputime(p, &utime, &stime); 1524 prstatus->pr_utime = ns_to_kernel_old_timeval(utime); 1525 prstatus->pr_stime = ns_to_kernel_old_timeval(stime); 1526 } 1527 1528 prstatus->pr_cutime = ns_to_kernel_old_timeval(p->signal->cutime); 1529 prstatus->pr_cstime = ns_to_kernel_old_timeval(p->signal->cstime); 1530 } 1531 1532 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, 1533 struct mm_struct *mm) 1534 { 1535 const struct cred *cred; 1536 unsigned int i, len; 1537 1538 /* first copy the parameters from user space */ 1539 memset(psinfo, 0, sizeof(struct elf_prpsinfo)); 1540 1541 len = mm->arg_end - mm->arg_start; 1542 if (len >= ELF_PRARGSZ) 1543 len = ELF_PRARGSZ-1; 1544 if (copy_from_user(&psinfo->pr_psargs, 1545 (const char __user *)mm->arg_start, len)) 1546 return -EFAULT; 1547 for(i = 0; i < len; i++) 1548 if (psinfo->pr_psargs[i] == 0) 1549 psinfo->pr_psargs[i] = ' '; 1550 psinfo->pr_psargs[len] = 0; 1551 1552 rcu_read_lock(); 1553 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1554 rcu_read_unlock(); 1555 psinfo->pr_pid = task_pid_vnr(p); 1556 psinfo->pr_pgrp = task_pgrp_vnr(p); 1557 psinfo->pr_sid = task_session_vnr(p); 1558 1559 i = p->state ? ffz(~p->state) + 1 : 0; 1560 psinfo->pr_state = i; 1561 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i]; 1562 psinfo->pr_zomb = psinfo->pr_sname == 'Z'; 1563 psinfo->pr_nice = task_nice(p); 1564 psinfo->pr_flag = p->flags; 1565 rcu_read_lock(); 1566 cred = __task_cred(p); 1567 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid)); 1568 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid)); 1569 rcu_read_unlock(); 1570 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname)); 1571 1572 return 0; 1573 } 1574 1575 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) 1576 { 1577 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; 1578 int i = 0; 1579 do 1580 i += 2; 1581 while (auxv[i - 2] != AT_NULL); 1582 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); 1583 } 1584 1585 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata, 1586 const kernel_siginfo_t *siginfo) 1587 { 1588 copy_siginfo_to_external(csigdata, siginfo); 1589 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata); 1590 } 1591 1592 #define MAX_FILE_NOTE_SIZE (4*1024*1024) 1593 /* 1594 * Format of NT_FILE note: 1595 * 1596 * long count -- how many files are mapped 1597 * long page_size -- units for file_ofs 1598 * array of [COUNT] elements of 1599 * long start 1600 * long end 1601 * long file_ofs 1602 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL... 1603 */ 1604 static int fill_files_note(struct memelfnote *note) 1605 { 1606 struct mm_struct *mm = current->mm; 1607 struct vm_area_struct *vma; 1608 unsigned count, size, names_ofs, remaining, n; 1609 user_long_t *data; 1610 user_long_t *start_end_ofs; 1611 char *name_base, *name_curpos; 1612 1613 /* *Estimated* file count and total data size needed */ 1614 count = mm->map_count; 1615 if (count > UINT_MAX / 64) 1616 return -EINVAL; 1617 size = count * 64; 1618 1619 names_ofs = (2 + 3 * count) * sizeof(data[0]); 1620 alloc: 1621 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */ 1622 return -EINVAL; 1623 size = round_up(size, PAGE_SIZE); 1624 /* 1625 * "size" can be 0 here legitimately. 1626 * Let it ENOMEM and omit NT_FILE section which will be empty anyway. 1627 */ 1628 data = kvmalloc(size, GFP_KERNEL); 1629 if (ZERO_OR_NULL_PTR(data)) 1630 return -ENOMEM; 1631 1632 start_end_ofs = data + 2; 1633 name_base = name_curpos = ((char *)data) + names_ofs; 1634 remaining = size - names_ofs; 1635 count = 0; 1636 for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) { 1637 struct file *file; 1638 const char *filename; 1639 1640 file = vma->vm_file; 1641 if (!file) 1642 continue; 1643 filename = file_path(file, name_curpos, remaining); 1644 if (IS_ERR(filename)) { 1645 if (PTR_ERR(filename) == -ENAMETOOLONG) { 1646 kvfree(data); 1647 size = size * 5 / 4; 1648 goto alloc; 1649 } 1650 continue; 1651 } 1652 1653 /* file_path() fills at the end, move name down */ 1654 /* n = strlen(filename) + 1: */ 1655 n = (name_curpos + remaining) - filename; 1656 remaining = filename - name_curpos; 1657 memmove(name_curpos, filename, n); 1658 name_curpos += n; 1659 1660 *start_end_ofs++ = vma->vm_start; 1661 *start_end_ofs++ = vma->vm_end; 1662 *start_end_ofs++ = vma->vm_pgoff; 1663 count++; 1664 } 1665 1666 /* Now we know exact count of files, can store it */ 1667 data[0] = count; 1668 data[1] = PAGE_SIZE; 1669 /* 1670 * Count usually is less than mm->map_count, 1671 * we need to move filenames down. 1672 */ 1673 n = mm->map_count - count; 1674 if (n != 0) { 1675 unsigned shift_bytes = n * 3 * sizeof(data[0]); 1676 memmove(name_base - shift_bytes, name_base, 1677 name_curpos - name_base); 1678 name_curpos -= shift_bytes; 1679 } 1680 1681 size = name_curpos - (char *)data; 1682 fill_note(note, "CORE", NT_FILE, size, data); 1683 return 0; 1684 } 1685 1686 #ifdef CORE_DUMP_USE_REGSET 1687 #include <linux/regset.h> 1688 1689 struct elf_thread_core_info { 1690 struct elf_thread_core_info *next; 1691 struct task_struct *task; 1692 struct elf_prstatus prstatus; 1693 struct memelfnote notes[]; 1694 }; 1695 1696 struct elf_note_info { 1697 struct elf_thread_core_info *thread; 1698 struct memelfnote psinfo; 1699 struct memelfnote signote; 1700 struct memelfnote auxv; 1701 struct memelfnote files; 1702 user_siginfo_t csigdata; 1703 size_t size; 1704 int thread_notes; 1705 }; 1706 1707 /* 1708 * When a regset has a writeback hook, we call it on each thread before 1709 * dumping user memory. On register window machines, this makes sure the 1710 * user memory backing the register data is up to date before we read it. 1711 */ 1712 static void do_thread_regset_writeback(struct task_struct *task, 1713 const struct user_regset *regset) 1714 { 1715 if (regset->writeback) 1716 regset->writeback(task, regset, 1); 1717 } 1718 1719 #ifndef PRSTATUS_SIZE 1720 #define PRSTATUS_SIZE(S, R) sizeof(S) 1721 #endif 1722 1723 #ifndef SET_PR_FPVALID 1724 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V)) 1725 #endif 1726 1727 static int fill_thread_core_info(struct elf_thread_core_info *t, 1728 const struct user_regset_view *view, 1729 long signr, size_t *total) 1730 { 1731 unsigned int i; 1732 int regset0_size; 1733 1734 /* 1735 * NT_PRSTATUS is the one special case, because the regset data 1736 * goes into the pr_reg field inside the note contents, rather 1737 * than being the whole note contents. We fill the reset in here. 1738 * We assume that regset 0 is NT_PRSTATUS. 1739 */ 1740 fill_prstatus(&t->prstatus, t->task, signr); 1741 regset0_size = regset_get(t->task, &view->regsets[0], 1742 sizeof(t->prstatus.pr_reg), &t->prstatus.pr_reg); 1743 if (regset0_size < 0) 1744 return 0; 1745 1746 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, 1747 PRSTATUS_SIZE(t->prstatus, regset0_size), &t->prstatus); 1748 *total += notesize(&t->notes[0]); 1749 1750 do_thread_regset_writeback(t->task, &view->regsets[0]); 1751 1752 /* 1753 * Each other regset might generate a note too. For each regset 1754 * that has no core_note_type or is inactive, we leave t->notes[i] 1755 * all zero and we'll know to skip writing it later. 1756 */ 1757 for (i = 1; i < view->n; ++i) { 1758 const struct user_regset *regset = &view->regsets[i]; 1759 int note_type = regset->core_note_type; 1760 bool is_fpreg = note_type == NT_PRFPREG; 1761 void *data; 1762 int ret; 1763 1764 do_thread_regset_writeback(t->task, regset); 1765 if (!note_type) // not for coredumps 1766 continue; 1767 if (regset->active && regset->active(t->task, regset) <= 0) 1768 continue; 1769 1770 ret = regset_get_alloc(t->task, regset, ~0U, &data); 1771 if (ret < 0) 1772 continue; 1773 1774 if (is_fpreg) 1775 SET_PR_FPVALID(&t->prstatus, 1, regset0_size); 1776 1777 fill_note(&t->notes[i], is_fpreg ? "CORE" : "LINUX", 1778 note_type, ret, data); 1779 1780 *total += notesize(&t->notes[i]); 1781 } 1782 1783 return 1; 1784 } 1785 1786 static int fill_note_info(struct elfhdr *elf, int phdrs, 1787 struct elf_note_info *info, 1788 const kernel_siginfo_t *siginfo, struct pt_regs *regs) 1789 { 1790 struct task_struct *dump_task = current; 1791 const struct user_regset_view *view = task_user_regset_view(dump_task); 1792 struct elf_thread_core_info *t; 1793 struct elf_prpsinfo *psinfo; 1794 struct core_thread *ct; 1795 unsigned int i; 1796 1797 info->size = 0; 1798 info->thread = NULL; 1799 1800 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1801 if (psinfo == NULL) { 1802 info->psinfo.data = NULL; /* So we don't free this wrongly */ 1803 return 0; 1804 } 1805 1806 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); 1807 1808 /* 1809 * Figure out how many notes we're going to need for each thread. 1810 */ 1811 info->thread_notes = 0; 1812 for (i = 0; i < view->n; ++i) 1813 if (view->regsets[i].core_note_type != 0) 1814 ++info->thread_notes; 1815 1816 /* 1817 * Sanity check. We rely on regset 0 being in NT_PRSTATUS, 1818 * since it is our one special case. 1819 */ 1820 if (unlikely(info->thread_notes == 0) || 1821 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) { 1822 WARN_ON(1); 1823 return 0; 1824 } 1825 1826 /* 1827 * Initialize the ELF file header. 1828 */ 1829 fill_elf_header(elf, phdrs, 1830 view->e_machine, view->e_flags); 1831 1832 /* 1833 * Allocate a structure for each thread. 1834 */ 1835 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) { 1836 t = kzalloc(offsetof(struct elf_thread_core_info, 1837 notes[info->thread_notes]), 1838 GFP_KERNEL); 1839 if (unlikely(!t)) 1840 return 0; 1841 1842 t->task = ct->task; 1843 if (ct->task == dump_task || !info->thread) { 1844 t->next = info->thread; 1845 info->thread = t; 1846 } else { 1847 /* 1848 * Make sure to keep the original task at 1849 * the head of the list. 1850 */ 1851 t->next = info->thread->next; 1852 info->thread->next = t; 1853 } 1854 } 1855 1856 /* 1857 * Now fill in each thread's information. 1858 */ 1859 for (t = info->thread; t != NULL; t = t->next) 1860 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size)) 1861 return 0; 1862 1863 /* 1864 * Fill in the two process-wide notes. 1865 */ 1866 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm); 1867 info->size += notesize(&info->psinfo); 1868 1869 fill_siginfo_note(&info->signote, &info->csigdata, siginfo); 1870 info->size += notesize(&info->signote); 1871 1872 fill_auxv_note(&info->auxv, current->mm); 1873 info->size += notesize(&info->auxv); 1874 1875 if (fill_files_note(&info->files) == 0) 1876 info->size += notesize(&info->files); 1877 1878 return 1; 1879 } 1880 1881 static size_t get_note_info_size(struct elf_note_info *info) 1882 { 1883 return info->size; 1884 } 1885 1886 /* 1887 * Write all the notes for each thread. When writing the first thread, the 1888 * process-wide notes are interleaved after the first thread-specific note. 1889 */ 1890 static int write_note_info(struct elf_note_info *info, 1891 struct coredump_params *cprm) 1892 { 1893 bool first = true; 1894 struct elf_thread_core_info *t = info->thread; 1895 1896 do { 1897 int i; 1898 1899 if (!writenote(&t->notes[0], cprm)) 1900 return 0; 1901 1902 if (first && !writenote(&info->psinfo, cprm)) 1903 return 0; 1904 if (first && !writenote(&info->signote, cprm)) 1905 return 0; 1906 if (first && !writenote(&info->auxv, cprm)) 1907 return 0; 1908 if (first && info->files.data && 1909 !writenote(&info->files, cprm)) 1910 return 0; 1911 1912 for (i = 1; i < info->thread_notes; ++i) 1913 if (t->notes[i].data && 1914 !writenote(&t->notes[i], cprm)) 1915 return 0; 1916 1917 first = false; 1918 t = t->next; 1919 } while (t); 1920 1921 return 1; 1922 } 1923 1924 static void free_note_info(struct elf_note_info *info) 1925 { 1926 struct elf_thread_core_info *threads = info->thread; 1927 while (threads) { 1928 unsigned int i; 1929 struct elf_thread_core_info *t = threads; 1930 threads = t->next; 1931 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus); 1932 for (i = 1; i < info->thread_notes; ++i) 1933 kfree(t->notes[i].data); 1934 kfree(t); 1935 } 1936 kfree(info->psinfo.data); 1937 kvfree(info->files.data); 1938 } 1939 1940 #else 1941 1942 /* Here is the structure in which status of each thread is captured. */ 1943 struct elf_thread_status 1944 { 1945 struct list_head list; 1946 struct elf_prstatus prstatus; /* NT_PRSTATUS */ 1947 elf_fpregset_t fpu; /* NT_PRFPREG */ 1948 struct task_struct *thread; 1949 struct memelfnote notes[3]; 1950 int num_notes; 1951 }; 1952 1953 /* 1954 * In order to add the specific thread information for the elf file format, 1955 * we need to keep a linked list of every threads pr_status and then create 1956 * a single section for them in the final core file. 1957 */ 1958 static int elf_dump_thread_status(long signr, struct elf_thread_status *t) 1959 { 1960 int sz = 0; 1961 struct task_struct *p = t->thread; 1962 t->num_notes = 0; 1963 1964 fill_prstatus(&t->prstatus, p, signr); 1965 elf_core_copy_task_regs(p, &t->prstatus.pr_reg); 1966 1967 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), 1968 &(t->prstatus)); 1969 t->num_notes++; 1970 sz += notesize(&t->notes[0]); 1971 1972 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, 1973 &t->fpu))) { 1974 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), 1975 &(t->fpu)); 1976 t->num_notes++; 1977 sz += notesize(&t->notes[1]); 1978 } 1979 return sz; 1980 } 1981 1982 struct elf_note_info { 1983 struct memelfnote *notes; 1984 struct memelfnote *notes_files; 1985 struct elf_prstatus *prstatus; /* NT_PRSTATUS */ 1986 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */ 1987 struct list_head thread_list; 1988 elf_fpregset_t *fpu; 1989 user_siginfo_t csigdata; 1990 int thread_status_size; 1991 int numnote; 1992 }; 1993 1994 static int elf_note_info_init(struct elf_note_info *info) 1995 { 1996 memset(info, 0, sizeof(*info)); 1997 INIT_LIST_HEAD(&info->thread_list); 1998 1999 /* Allocate space for ELF notes */ 2000 info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL); 2001 if (!info->notes) 2002 return 0; 2003 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL); 2004 if (!info->psinfo) 2005 return 0; 2006 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL); 2007 if (!info->prstatus) 2008 return 0; 2009 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL); 2010 if (!info->fpu) 2011 return 0; 2012 return 1; 2013 } 2014 2015 static int fill_note_info(struct elfhdr *elf, int phdrs, 2016 struct elf_note_info *info, 2017 const kernel_siginfo_t *siginfo, struct pt_regs *regs) 2018 { 2019 struct core_thread *ct; 2020 struct elf_thread_status *ets; 2021 2022 if (!elf_note_info_init(info)) 2023 return 0; 2024 2025 for (ct = current->mm->core_state->dumper.next; 2026 ct; ct = ct->next) { 2027 ets = kzalloc(sizeof(*ets), GFP_KERNEL); 2028 if (!ets) 2029 return 0; 2030 2031 ets->thread = ct->task; 2032 list_add(&ets->list, &info->thread_list); 2033 } 2034 2035 list_for_each_entry(ets, &info->thread_list, list) { 2036 int sz; 2037 2038 sz = elf_dump_thread_status(siginfo->si_signo, ets); 2039 info->thread_status_size += sz; 2040 } 2041 /* now collect the dump for the current */ 2042 memset(info->prstatus, 0, sizeof(*info->prstatus)); 2043 fill_prstatus(info->prstatus, current, siginfo->si_signo); 2044 elf_core_copy_regs(&info->prstatus->pr_reg, regs); 2045 2046 /* Set up header */ 2047 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS); 2048 2049 /* 2050 * Set up the notes in similar form to SVR4 core dumps made 2051 * with info from their /proc. 2052 */ 2053 2054 fill_note(info->notes + 0, "CORE", NT_PRSTATUS, 2055 sizeof(*info->prstatus), info->prstatus); 2056 fill_psinfo(info->psinfo, current->group_leader, current->mm); 2057 fill_note(info->notes + 1, "CORE", NT_PRPSINFO, 2058 sizeof(*info->psinfo), info->psinfo); 2059 2060 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo); 2061 fill_auxv_note(info->notes + 3, current->mm); 2062 info->numnote = 4; 2063 2064 if (fill_files_note(info->notes + info->numnote) == 0) { 2065 info->notes_files = info->notes + info->numnote; 2066 info->numnote++; 2067 } 2068 2069 /* Try to dump the FPU. */ 2070 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, 2071 info->fpu); 2072 if (info->prstatus->pr_fpvalid) 2073 fill_note(info->notes + info->numnote++, 2074 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu); 2075 return 1; 2076 } 2077 2078 static size_t get_note_info_size(struct elf_note_info *info) 2079 { 2080 int sz = 0; 2081 int i; 2082 2083 for (i = 0; i < info->numnote; i++) 2084 sz += notesize(info->notes + i); 2085 2086 sz += info->thread_status_size; 2087 2088 return sz; 2089 } 2090 2091 static int write_note_info(struct elf_note_info *info, 2092 struct coredump_params *cprm) 2093 { 2094 struct elf_thread_status *ets; 2095 int i; 2096 2097 for (i = 0; i < info->numnote; i++) 2098 if (!writenote(info->notes + i, cprm)) 2099 return 0; 2100 2101 /* write out the thread status notes section */ 2102 list_for_each_entry(ets, &info->thread_list, list) { 2103 for (i = 0; i < ets->num_notes; i++) 2104 if (!writenote(&ets->notes[i], cprm)) 2105 return 0; 2106 } 2107 2108 return 1; 2109 } 2110 2111 static void free_note_info(struct elf_note_info *info) 2112 { 2113 while (!list_empty(&info->thread_list)) { 2114 struct list_head *tmp = info->thread_list.next; 2115 list_del(tmp); 2116 kfree(list_entry(tmp, struct elf_thread_status, list)); 2117 } 2118 2119 /* Free data possibly allocated by fill_files_note(): */ 2120 if (info->notes_files) 2121 kvfree(info->notes_files->data); 2122 2123 kfree(info->prstatus); 2124 kfree(info->psinfo); 2125 kfree(info->notes); 2126 kfree(info->fpu); 2127 } 2128 2129 #endif 2130 2131 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, 2132 elf_addr_t e_shoff, int segs) 2133 { 2134 elf->e_shoff = e_shoff; 2135 elf->e_shentsize = sizeof(*shdr4extnum); 2136 elf->e_shnum = 1; 2137 elf->e_shstrndx = SHN_UNDEF; 2138 2139 memset(shdr4extnum, 0, sizeof(*shdr4extnum)); 2140 2141 shdr4extnum->sh_type = SHT_NULL; 2142 shdr4extnum->sh_size = elf->e_shnum; 2143 shdr4extnum->sh_link = elf->e_shstrndx; 2144 shdr4extnum->sh_info = segs; 2145 } 2146 2147 /* 2148 * Actual dumper 2149 * 2150 * This is a two-pass process; first we find the offsets of the bits, 2151 * and then they are actually written out. If we run out of core limit 2152 * we just truncate. 2153 */ 2154 static int elf_core_dump(struct coredump_params *cprm) 2155 { 2156 int has_dumped = 0; 2157 int vma_count, segs, i; 2158 size_t vma_data_size; 2159 struct elfhdr elf; 2160 loff_t offset = 0, dataoff; 2161 struct elf_note_info info = { }; 2162 struct elf_phdr *phdr4note = NULL; 2163 struct elf_shdr *shdr4extnum = NULL; 2164 Elf_Half e_phnum; 2165 elf_addr_t e_shoff; 2166 struct core_vma_metadata *vma_meta; 2167 2168 if (dump_vma_snapshot(cprm, &vma_count, &vma_meta, &vma_data_size)) 2169 return 0; 2170 2171 /* 2172 * The number of segs are recored into ELF header as 16bit value. 2173 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. 2174 */ 2175 segs = vma_count + elf_core_extra_phdrs(); 2176 2177 /* for notes section */ 2178 segs++; 2179 2180 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid 2181 * this, kernel supports extended numbering. Have a look at 2182 * include/linux/elf.h for further information. */ 2183 e_phnum = segs > PN_XNUM ? PN_XNUM : segs; 2184 2185 /* 2186 * Collect all the non-memory information about the process for the 2187 * notes. This also sets up the file header. 2188 */ 2189 if (!fill_note_info(&elf, e_phnum, &info, cprm->siginfo, cprm->regs)) 2190 goto end_coredump; 2191 2192 has_dumped = 1; 2193 2194 offset += sizeof(elf); /* Elf header */ 2195 offset += segs * sizeof(struct elf_phdr); /* Program headers */ 2196 2197 /* Write notes phdr entry */ 2198 { 2199 size_t sz = get_note_info_size(&info); 2200 2201 sz += elf_coredump_extra_notes_size(); 2202 2203 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL); 2204 if (!phdr4note) 2205 goto end_coredump; 2206 2207 fill_elf_note_phdr(phdr4note, sz, offset); 2208 offset += sz; 2209 } 2210 2211 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); 2212 2213 offset += vma_data_size; 2214 offset += elf_core_extra_data_size(); 2215 e_shoff = offset; 2216 2217 if (e_phnum == PN_XNUM) { 2218 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL); 2219 if (!shdr4extnum) 2220 goto end_coredump; 2221 fill_extnum_info(&elf, shdr4extnum, e_shoff, segs); 2222 } 2223 2224 offset = dataoff; 2225 2226 if (!dump_emit(cprm, &elf, sizeof(elf))) 2227 goto end_coredump; 2228 2229 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note))) 2230 goto end_coredump; 2231 2232 /* Write program headers for segments dump */ 2233 for (i = 0; i < vma_count; i++) { 2234 struct core_vma_metadata *meta = vma_meta + i; 2235 struct elf_phdr phdr; 2236 2237 phdr.p_type = PT_LOAD; 2238 phdr.p_offset = offset; 2239 phdr.p_vaddr = meta->start; 2240 phdr.p_paddr = 0; 2241 phdr.p_filesz = meta->dump_size; 2242 phdr.p_memsz = meta->end - meta->start; 2243 offset += phdr.p_filesz; 2244 phdr.p_flags = 0; 2245 if (meta->flags & VM_READ) 2246 phdr.p_flags |= PF_R; 2247 if (meta->flags & VM_WRITE) 2248 phdr.p_flags |= PF_W; 2249 if (meta->flags & VM_EXEC) 2250 phdr.p_flags |= PF_X; 2251 phdr.p_align = ELF_EXEC_PAGESIZE; 2252 2253 if (!dump_emit(cprm, &phdr, sizeof(phdr))) 2254 goto end_coredump; 2255 } 2256 2257 if (!elf_core_write_extra_phdrs(cprm, offset)) 2258 goto end_coredump; 2259 2260 /* write out the notes section */ 2261 if (!write_note_info(&info, cprm)) 2262 goto end_coredump; 2263 2264 if (elf_coredump_extra_notes_write(cprm)) 2265 goto end_coredump; 2266 2267 /* Align to page */ 2268 if (!dump_skip(cprm, dataoff - cprm->pos)) 2269 goto end_coredump; 2270 2271 for (i = 0; i < vma_count; i++) { 2272 struct core_vma_metadata *meta = vma_meta + i; 2273 2274 if (!dump_user_range(cprm, meta->start, meta->dump_size)) 2275 goto end_coredump; 2276 } 2277 dump_truncate(cprm); 2278 2279 if (!elf_core_write_extra_data(cprm)) 2280 goto end_coredump; 2281 2282 if (e_phnum == PN_XNUM) { 2283 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum))) 2284 goto end_coredump; 2285 } 2286 2287 end_coredump: 2288 free_note_info(&info); 2289 kfree(shdr4extnum); 2290 kvfree(vma_meta); 2291 kfree(phdr4note); 2292 return has_dumped; 2293 } 2294 2295 #endif /* CONFIG_ELF_CORE */ 2296 2297 static int __init init_elf_binfmt(void) 2298 { 2299 register_binfmt(&elf_format); 2300 return 0; 2301 } 2302 2303 static void __exit exit_elf_binfmt(void) 2304 { 2305 /* Remove the COFF and ELF loaders. */ 2306 unregister_binfmt(&elf_format); 2307 } 2308 2309 core_initcall(init_elf_binfmt); 2310 module_exit(exit_elf_binfmt); 2311 MODULE_LICENSE("GPL"); 2312