1 /* 2 * linux/fs/binfmt_elf.c 3 * 4 * These are the functions used to load ELF format executables as used 5 * on SVr4 machines. Information on the format may be found in the book 6 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support 7 * Tools". 8 * 9 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com). 10 */ 11 12 #include <linux/module.h> 13 #include <linux/kernel.h> 14 #include <linux/fs.h> 15 #include <linux/mm.h> 16 #include <linux/mman.h> 17 #include <linux/errno.h> 18 #include <linux/signal.h> 19 #include <linux/binfmts.h> 20 #include <linux/string.h> 21 #include <linux/file.h> 22 #include <linux/slab.h> 23 #include <linux/personality.h> 24 #include <linux/elfcore.h> 25 #include <linux/init.h> 26 #include <linux/highuid.h> 27 #include <linux/compiler.h> 28 #include <linux/highmem.h> 29 #include <linux/pagemap.h> 30 #include <linux/vmalloc.h> 31 #include <linux/security.h> 32 #include <linux/random.h> 33 #include <linux/elf.h> 34 #include <linux/elf-randomize.h> 35 #include <linux/utsname.h> 36 #include <linux/coredump.h> 37 #include <linux/sched.h> 38 #include <linux/sched/coredump.h> 39 #include <linux/sched/task_stack.h> 40 #include <linux/sched/cputime.h> 41 #include <linux/cred.h> 42 #include <linux/dax.h> 43 #include <linux/uaccess.h> 44 #include <asm/param.h> 45 #include <asm/page.h> 46 47 #ifndef user_long_t 48 #define user_long_t long 49 #endif 50 #ifndef user_siginfo_t 51 #define user_siginfo_t siginfo_t 52 #endif 53 54 /* That's for binfmt_elf_fdpic to deal with */ 55 #ifndef elf_check_fdpic 56 #define elf_check_fdpic(ex) false 57 #endif 58 59 static int load_elf_binary(struct linux_binprm *bprm); 60 61 #ifdef CONFIG_USELIB 62 static int load_elf_library(struct file *); 63 #else 64 #define load_elf_library NULL 65 #endif 66 67 /* 68 * If we don't support core dumping, then supply a NULL so we 69 * don't even try. 70 */ 71 #ifdef CONFIG_ELF_CORE 72 static int elf_core_dump(struct coredump_params *cprm); 73 #else 74 #define elf_core_dump NULL 75 #endif 76 77 #if ELF_EXEC_PAGESIZE > PAGE_SIZE 78 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE 79 #else 80 #define ELF_MIN_ALIGN PAGE_SIZE 81 #endif 82 83 #ifndef ELF_CORE_EFLAGS 84 #define ELF_CORE_EFLAGS 0 85 #endif 86 87 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) 88 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) 89 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) 90 91 static struct linux_binfmt elf_format = { 92 .module = THIS_MODULE, 93 .load_binary = load_elf_binary, 94 .load_shlib = load_elf_library, 95 .core_dump = elf_core_dump, 96 .min_coredump = ELF_EXEC_PAGESIZE, 97 }; 98 99 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) 100 101 static int set_brk(unsigned long start, unsigned long end, int prot) 102 { 103 start = ELF_PAGEALIGN(start); 104 end = ELF_PAGEALIGN(end); 105 if (end > start) { 106 /* 107 * Map the last of the bss segment. 108 * If the header is requesting these pages to be 109 * executable, honour that (ppc32 needs this). 110 */ 111 int error = vm_brk_flags(start, end - start, 112 prot & PROT_EXEC ? VM_EXEC : 0); 113 if (error) 114 return error; 115 } 116 current->mm->start_brk = current->mm->brk = end; 117 return 0; 118 } 119 120 /* We need to explicitly zero any fractional pages 121 after the data section (i.e. bss). This would 122 contain the junk from the file that should not 123 be in memory 124 */ 125 static int padzero(unsigned long elf_bss) 126 { 127 unsigned long nbyte; 128 129 nbyte = ELF_PAGEOFFSET(elf_bss); 130 if (nbyte) { 131 nbyte = ELF_MIN_ALIGN - nbyte; 132 if (clear_user((void __user *) elf_bss, nbyte)) 133 return -EFAULT; 134 } 135 return 0; 136 } 137 138 /* Let's use some macros to make this stack manipulation a little clearer */ 139 #ifdef CONFIG_STACK_GROWSUP 140 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items)) 141 #define STACK_ROUND(sp, items) \ 142 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL) 143 #define STACK_ALLOC(sp, len) ({ \ 144 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \ 145 old_sp; }) 146 #else 147 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items)) 148 #define STACK_ROUND(sp, items) \ 149 (((unsigned long) (sp - items)) &~ 15UL) 150 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; }) 151 #endif 152 153 #ifndef ELF_BASE_PLATFORM 154 /* 155 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture. 156 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value 157 * will be copied to the user stack in the same manner as AT_PLATFORM. 158 */ 159 #define ELF_BASE_PLATFORM NULL 160 #endif 161 162 static int 163 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec, 164 unsigned long load_addr, unsigned long interp_load_addr) 165 { 166 unsigned long p = bprm->p; 167 int argc = bprm->argc; 168 int envc = bprm->envc; 169 elf_addr_t __user *sp; 170 elf_addr_t __user *u_platform; 171 elf_addr_t __user *u_base_platform; 172 elf_addr_t __user *u_rand_bytes; 173 const char *k_platform = ELF_PLATFORM; 174 const char *k_base_platform = ELF_BASE_PLATFORM; 175 unsigned char k_rand_bytes[16]; 176 int items; 177 elf_addr_t *elf_info; 178 int ei_index = 0; 179 const struct cred *cred = current_cred(); 180 struct vm_area_struct *vma; 181 182 /* 183 * In some cases (e.g. Hyper-Threading), we want to avoid L1 184 * evictions by the processes running on the same package. One 185 * thing we can do is to shuffle the initial stack for them. 186 */ 187 188 p = arch_align_stack(p); 189 190 /* 191 * If this architecture has a platform capability string, copy it 192 * to userspace. In some cases (Sparc), this info is impossible 193 * for userspace to get any other way, in others (i386) it is 194 * merely difficult. 195 */ 196 u_platform = NULL; 197 if (k_platform) { 198 size_t len = strlen(k_platform) + 1; 199 200 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 201 if (__copy_to_user(u_platform, k_platform, len)) 202 return -EFAULT; 203 } 204 205 /* 206 * If this architecture has a "base" platform capability 207 * string, copy it to userspace. 208 */ 209 u_base_platform = NULL; 210 if (k_base_platform) { 211 size_t len = strlen(k_base_platform) + 1; 212 213 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 214 if (__copy_to_user(u_base_platform, k_base_platform, len)) 215 return -EFAULT; 216 } 217 218 /* 219 * Generate 16 random bytes for userspace PRNG seeding. 220 */ 221 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes)); 222 u_rand_bytes = (elf_addr_t __user *) 223 STACK_ALLOC(p, sizeof(k_rand_bytes)); 224 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes))) 225 return -EFAULT; 226 227 /* Create the ELF interpreter info */ 228 elf_info = (elf_addr_t *)current->mm->saved_auxv; 229 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ 230 #define NEW_AUX_ENT(id, val) \ 231 do { \ 232 elf_info[ei_index++] = id; \ 233 elf_info[ei_index++] = val; \ 234 } while (0) 235 236 #ifdef ARCH_DLINFO 237 /* 238 * ARCH_DLINFO must come first so PPC can do its special alignment of 239 * AUXV. 240 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in 241 * ARCH_DLINFO changes 242 */ 243 ARCH_DLINFO; 244 #endif 245 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); 246 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); 247 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); 248 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); 249 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); 250 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); 251 NEW_AUX_ENT(AT_BASE, interp_load_addr); 252 NEW_AUX_ENT(AT_FLAGS, 0); 253 NEW_AUX_ENT(AT_ENTRY, exec->e_entry); 254 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid)); 255 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid)); 256 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid)); 257 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid)); 258 NEW_AUX_ENT(AT_SECURE, bprm->secureexec); 259 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes); 260 #ifdef ELF_HWCAP2 261 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2); 262 #endif 263 NEW_AUX_ENT(AT_EXECFN, bprm->exec); 264 if (k_platform) { 265 NEW_AUX_ENT(AT_PLATFORM, 266 (elf_addr_t)(unsigned long)u_platform); 267 } 268 if (k_base_platform) { 269 NEW_AUX_ENT(AT_BASE_PLATFORM, 270 (elf_addr_t)(unsigned long)u_base_platform); 271 } 272 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) { 273 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data); 274 } 275 #undef NEW_AUX_ENT 276 /* AT_NULL is zero; clear the rest too */ 277 memset(&elf_info[ei_index], 0, 278 sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]); 279 280 /* And advance past the AT_NULL entry. */ 281 ei_index += 2; 282 283 sp = STACK_ADD(p, ei_index); 284 285 items = (argc + 1) + (envc + 1) + 1; 286 bprm->p = STACK_ROUND(sp, items); 287 288 /* Point sp at the lowest address on the stack */ 289 #ifdef CONFIG_STACK_GROWSUP 290 sp = (elf_addr_t __user *)bprm->p - items - ei_index; 291 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */ 292 #else 293 sp = (elf_addr_t __user *)bprm->p; 294 #endif 295 296 297 /* 298 * Grow the stack manually; some architectures have a limit on how 299 * far ahead a user-space access may be in order to grow the stack. 300 */ 301 vma = find_extend_vma(current->mm, bprm->p); 302 if (!vma) 303 return -EFAULT; 304 305 /* Now, let's put argc (and argv, envp if appropriate) on the stack */ 306 if (__put_user(argc, sp++)) 307 return -EFAULT; 308 309 /* Populate list of argv pointers back to argv strings. */ 310 p = current->mm->arg_end = current->mm->arg_start; 311 while (argc-- > 0) { 312 size_t len; 313 if (__put_user((elf_addr_t)p, sp++)) 314 return -EFAULT; 315 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 316 if (!len || len > MAX_ARG_STRLEN) 317 return -EINVAL; 318 p += len; 319 } 320 if (__put_user(0, sp++)) 321 return -EFAULT; 322 current->mm->arg_end = p; 323 324 /* Populate list of envp pointers back to envp strings. */ 325 current->mm->env_end = current->mm->env_start = p; 326 while (envc-- > 0) { 327 size_t len; 328 if (__put_user((elf_addr_t)p, sp++)) 329 return -EFAULT; 330 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 331 if (!len || len > MAX_ARG_STRLEN) 332 return -EINVAL; 333 p += len; 334 } 335 if (__put_user(0, sp++)) 336 return -EFAULT; 337 current->mm->env_end = p; 338 339 /* Put the elf_info on the stack in the right place. */ 340 if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t))) 341 return -EFAULT; 342 return 0; 343 } 344 345 #ifndef elf_map 346 347 static unsigned long elf_map(struct file *filep, unsigned long addr, 348 const struct elf_phdr *eppnt, int prot, int type, 349 unsigned long total_size) 350 { 351 unsigned long map_addr; 352 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr); 353 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr); 354 addr = ELF_PAGESTART(addr); 355 size = ELF_PAGEALIGN(size); 356 357 /* mmap() will return -EINVAL if given a zero size, but a 358 * segment with zero filesize is perfectly valid */ 359 if (!size) 360 return addr; 361 362 /* 363 * total_size is the size of the ELF (interpreter) image. 364 * The _first_ mmap needs to know the full size, otherwise 365 * randomization might put this image into an overlapping 366 * position with the ELF binary image. (since size < total_size) 367 * So we first map the 'big' image - and unmap the remainder at 368 * the end. (which unmap is needed for ELF images with holes.) 369 */ 370 if (total_size) { 371 total_size = ELF_PAGEALIGN(total_size); 372 map_addr = vm_mmap(filep, addr, total_size, prot, type, off); 373 if (!BAD_ADDR(map_addr)) 374 vm_munmap(map_addr+size, total_size-size); 375 } else 376 map_addr = vm_mmap(filep, addr, size, prot, type, off); 377 378 if ((type & MAP_FIXED_NOREPLACE) && 379 PTR_ERR((void *)map_addr) == -EEXIST) 380 pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n", 381 task_pid_nr(current), current->comm, (void *)addr); 382 383 return(map_addr); 384 } 385 386 #endif /* !elf_map */ 387 388 static unsigned long total_mapping_size(const struct elf_phdr *cmds, int nr) 389 { 390 int i, first_idx = -1, last_idx = -1; 391 392 for (i = 0; i < nr; i++) { 393 if (cmds[i].p_type == PT_LOAD) { 394 last_idx = i; 395 if (first_idx == -1) 396 first_idx = i; 397 } 398 } 399 if (first_idx == -1) 400 return 0; 401 402 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz - 403 ELF_PAGESTART(cmds[first_idx].p_vaddr); 404 } 405 406 /** 407 * load_elf_phdrs() - load ELF program headers 408 * @elf_ex: ELF header of the binary whose program headers should be loaded 409 * @elf_file: the opened ELF binary file 410 * 411 * Loads ELF program headers from the binary file elf_file, which has the ELF 412 * header pointed to by elf_ex, into a newly allocated array. The caller is 413 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure. 414 */ 415 static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex, 416 struct file *elf_file) 417 { 418 struct elf_phdr *elf_phdata = NULL; 419 int retval, err = -1; 420 loff_t pos = elf_ex->e_phoff; 421 unsigned int size; 422 423 /* 424 * If the size of this structure has changed, then punt, since 425 * we will be doing the wrong thing. 426 */ 427 if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) 428 goto out; 429 430 /* Sanity check the number of program headers... */ 431 /* ...and their total size. */ 432 size = sizeof(struct elf_phdr) * elf_ex->e_phnum; 433 if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN) 434 goto out; 435 436 elf_phdata = kmalloc(size, GFP_KERNEL); 437 if (!elf_phdata) 438 goto out; 439 440 /* Read in the program headers */ 441 retval = kernel_read(elf_file, elf_phdata, size, &pos); 442 if (retval != size) { 443 err = (retval < 0) ? retval : -EIO; 444 goto out; 445 } 446 447 /* Success! */ 448 err = 0; 449 out: 450 if (err) { 451 kfree(elf_phdata); 452 elf_phdata = NULL; 453 } 454 return elf_phdata; 455 } 456 457 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE 458 459 /** 460 * struct arch_elf_state - arch-specific ELF loading state 461 * 462 * This structure is used to preserve architecture specific data during 463 * the loading of an ELF file, throughout the checking of architecture 464 * specific ELF headers & through to the point where the ELF load is 465 * known to be proceeding (ie. SET_PERSONALITY). 466 * 467 * This implementation is a dummy for architectures which require no 468 * specific state. 469 */ 470 struct arch_elf_state { 471 }; 472 473 #define INIT_ARCH_ELF_STATE {} 474 475 /** 476 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header 477 * @ehdr: The main ELF header 478 * @phdr: The program header to check 479 * @elf: The open ELF file 480 * @is_interp: True if the phdr is from the interpreter of the ELF being 481 * loaded, else false. 482 * @state: Architecture-specific state preserved throughout the process 483 * of loading the ELF. 484 * 485 * Inspects the program header phdr to validate its correctness and/or 486 * suitability for the system. Called once per ELF program header in the 487 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its 488 * interpreter. 489 * 490 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 491 * with that return code. 492 */ 493 static inline int arch_elf_pt_proc(struct elfhdr *ehdr, 494 struct elf_phdr *phdr, 495 struct file *elf, bool is_interp, 496 struct arch_elf_state *state) 497 { 498 /* Dummy implementation, always proceed */ 499 return 0; 500 } 501 502 /** 503 * arch_check_elf() - check an ELF executable 504 * @ehdr: The main ELF header 505 * @has_interp: True if the ELF has an interpreter, else false. 506 * @interp_ehdr: The interpreter's ELF header 507 * @state: Architecture-specific state preserved throughout the process 508 * of loading the ELF. 509 * 510 * Provides a final opportunity for architecture code to reject the loading 511 * of the ELF & cause an exec syscall to return an error. This is called after 512 * all program headers to be checked by arch_elf_pt_proc have been. 513 * 514 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 515 * with that return code. 516 */ 517 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, 518 struct elfhdr *interp_ehdr, 519 struct arch_elf_state *state) 520 { 521 /* Dummy implementation, always proceed */ 522 return 0; 523 } 524 525 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ 526 527 /* This is much more generalized than the library routine read function, 528 so we keep this separate. Technically the library read function 529 is only provided so that we can read a.out libraries that have 530 an ELF header */ 531 532 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, 533 struct file *interpreter, unsigned long *interp_map_addr, 534 unsigned long no_base, struct elf_phdr *interp_elf_phdata) 535 { 536 struct elf_phdr *eppnt; 537 unsigned long load_addr = 0; 538 int load_addr_set = 0; 539 unsigned long last_bss = 0, elf_bss = 0; 540 int bss_prot = 0; 541 unsigned long error = ~0UL; 542 unsigned long total_size; 543 int i; 544 545 /* First of all, some simple consistency checks */ 546 if (interp_elf_ex->e_type != ET_EXEC && 547 interp_elf_ex->e_type != ET_DYN) 548 goto out; 549 if (!elf_check_arch(interp_elf_ex) || 550 elf_check_fdpic(interp_elf_ex)) 551 goto out; 552 if (!interpreter->f_op->mmap) 553 goto out; 554 555 total_size = total_mapping_size(interp_elf_phdata, 556 interp_elf_ex->e_phnum); 557 if (!total_size) { 558 error = -EINVAL; 559 goto out; 560 } 561 562 eppnt = interp_elf_phdata; 563 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { 564 if (eppnt->p_type == PT_LOAD) { 565 int elf_type = MAP_PRIVATE | MAP_DENYWRITE; 566 int elf_prot = 0; 567 unsigned long vaddr = 0; 568 unsigned long k, map_addr; 569 570 if (eppnt->p_flags & PF_R) 571 elf_prot = PROT_READ; 572 if (eppnt->p_flags & PF_W) 573 elf_prot |= PROT_WRITE; 574 if (eppnt->p_flags & PF_X) 575 elf_prot |= PROT_EXEC; 576 vaddr = eppnt->p_vaddr; 577 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) 578 elf_type |= MAP_FIXED_NOREPLACE; 579 else if (no_base && interp_elf_ex->e_type == ET_DYN) 580 load_addr = -vaddr; 581 582 map_addr = elf_map(interpreter, load_addr + vaddr, 583 eppnt, elf_prot, elf_type, total_size); 584 total_size = 0; 585 if (!*interp_map_addr) 586 *interp_map_addr = map_addr; 587 error = map_addr; 588 if (BAD_ADDR(map_addr)) 589 goto out; 590 591 if (!load_addr_set && 592 interp_elf_ex->e_type == ET_DYN) { 593 load_addr = map_addr - ELF_PAGESTART(vaddr); 594 load_addr_set = 1; 595 } 596 597 /* 598 * Check to see if the section's size will overflow the 599 * allowed task size. Note that p_filesz must always be 600 * <= p_memsize so it's only necessary to check p_memsz. 601 */ 602 k = load_addr + eppnt->p_vaddr; 603 if (BAD_ADDR(k) || 604 eppnt->p_filesz > eppnt->p_memsz || 605 eppnt->p_memsz > TASK_SIZE || 606 TASK_SIZE - eppnt->p_memsz < k) { 607 error = -ENOMEM; 608 goto out; 609 } 610 611 /* 612 * Find the end of the file mapping for this phdr, and 613 * keep track of the largest address we see for this. 614 */ 615 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz; 616 if (k > elf_bss) 617 elf_bss = k; 618 619 /* 620 * Do the same thing for the memory mapping - between 621 * elf_bss and last_bss is the bss section. 622 */ 623 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz; 624 if (k > last_bss) { 625 last_bss = k; 626 bss_prot = elf_prot; 627 } 628 } 629 } 630 631 /* 632 * Now fill out the bss section: first pad the last page from 633 * the file up to the page boundary, and zero it from elf_bss 634 * up to the end of the page. 635 */ 636 if (padzero(elf_bss)) { 637 error = -EFAULT; 638 goto out; 639 } 640 /* 641 * Next, align both the file and mem bss up to the page size, 642 * since this is where elf_bss was just zeroed up to, and where 643 * last_bss will end after the vm_brk_flags() below. 644 */ 645 elf_bss = ELF_PAGEALIGN(elf_bss); 646 last_bss = ELF_PAGEALIGN(last_bss); 647 /* Finally, if there is still more bss to allocate, do it. */ 648 if (last_bss > elf_bss) { 649 error = vm_brk_flags(elf_bss, last_bss - elf_bss, 650 bss_prot & PROT_EXEC ? VM_EXEC : 0); 651 if (error) 652 goto out; 653 } 654 655 error = load_addr; 656 out: 657 return error; 658 } 659 660 /* 661 * These are the functions used to load ELF style executables and shared 662 * libraries. There is no binary dependent code anywhere else. 663 */ 664 665 #ifndef STACK_RND_MASK 666 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */ 667 #endif 668 669 static unsigned long randomize_stack_top(unsigned long stack_top) 670 { 671 unsigned long random_variable = 0; 672 673 if (current->flags & PF_RANDOMIZE) { 674 random_variable = get_random_long(); 675 random_variable &= STACK_RND_MASK; 676 random_variable <<= PAGE_SHIFT; 677 } 678 #ifdef CONFIG_STACK_GROWSUP 679 return PAGE_ALIGN(stack_top) + random_variable; 680 #else 681 return PAGE_ALIGN(stack_top) - random_variable; 682 #endif 683 } 684 685 static int load_elf_binary(struct linux_binprm *bprm) 686 { 687 struct file *interpreter = NULL; /* to shut gcc up */ 688 unsigned long load_addr = 0, load_bias = 0; 689 int load_addr_set = 0; 690 char * elf_interpreter = NULL; 691 unsigned long error; 692 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; 693 unsigned long elf_bss, elf_brk; 694 int bss_prot = 0; 695 int retval, i; 696 unsigned long elf_entry; 697 unsigned long interp_load_addr = 0; 698 unsigned long start_code, end_code, start_data, end_data; 699 unsigned long reloc_func_desc __maybe_unused = 0; 700 int executable_stack = EXSTACK_DEFAULT; 701 struct pt_regs *regs = current_pt_regs(); 702 struct { 703 struct elfhdr elf_ex; 704 struct elfhdr interp_elf_ex; 705 } *loc; 706 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE; 707 loff_t pos; 708 709 loc = kmalloc(sizeof(*loc), GFP_KERNEL); 710 if (!loc) { 711 retval = -ENOMEM; 712 goto out_ret; 713 } 714 715 /* Get the exec-header */ 716 loc->elf_ex = *((struct elfhdr *)bprm->buf); 717 718 retval = -ENOEXEC; 719 /* First of all, some simple consistency checks */ 720 if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 721 goto out; 722 723 if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN) 724 goto out; 725 if (!elf_check_arch(&loc->elf_ex)) 726 goto out; 727 if (elf_check_fdpic(&loc->elf_ex)) 728 goto out; 729 if (!bprm->file->f_op->mmap) 730 goto out; 731 732 elf_phdata = load_elf_phdrs(&loc->elf_ex, bprm->file); 733 if (!elf_phdata) 734 goto out; 735 736 elf_ppnt = elf_phdata; 737 elf_bss = 0; 738 elf_brk = 0; 739 740 start_code = ~0UL; 741 end_code = 0; 742 start_data = 0; 743 end_data = 0; 744 745 for (i = 0; i < loc->elf_ex.e_phnum; i++) { 746 if (elf_ppnt->p_type == PT_INTERP) { 747 /* This is the program interpreter used for 748 * shared libraries - for now assume that this 749 * is an a.out format binary 750 */ 751 retval = -ENOEXEC; 752 if (elf_ppnt->p_filesz > PATH_MAX || 753 elf_ppnt->p_filesz < 2) 754 goto out_free_ph; 755 756 retval = -ENOMEM; 757 elf_interpreter = kmalloc(elf_ppnt->p_filesz, 758 GFP_KERNEL); 759 if (!elf_interpreter) 760 goto out_free_ph; 761 762 pos = elf_ppnt->p_offset; 763 retval = kernel_read(bprm->file, elf_interpreter, 764 elf_ppnt->p_filesz, &pos); 765 if (retval != elf_ppnt->p_filesz) { 766 if (retval >= 0) 767 retval = -EIO; 768 goto out_free_interp; 769 } 770 /* make sure path is NULL terminated */ 771 retval = -ENOEXEC; 772 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') 773 goto out_free_interp; 774 775 interpreter = open_exec(elf_interpreter); 776 retval = PTR_ERR(interpreter); 777 if (IS_ERR(interpreter)) 778 goto out_free_interp; 779 780 /* 781 * If the binary is not readable then enforce 782 * mm->dumpable = 0 regardless of the interpreter's 783 * permissions. 784 */ 785 would_dump(bprm, interpreter); 786 787 /* Get the exec headers */ 788 pos = 0; 789 retval = kernel_read(interpreter, &loc->interp_elf_ex, 790 sizeof(loc->interp_elf_ex), &pos); 791 if (retval != sizeof(loc->interp_elf_ex)) { 792 if (retval >= 0) 793 retval = -EIO; 794 goto out_free_dentry; 795 } 796 797 break; 798 } 799 elf_ppnt++; 800 } 801 802 elf_ppnt = elf_phdata; 803 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) 804 switch (elf_ppnt->p_type) { 805 case PT_GNU_STACK: 806 if (elf_ppnt->p_flags & PF_X) 807 executable_stack = EXSTACK_ENABLE_X; 808 else 809 executable_stack = EXSTACK_DISABLE_X; 810 break; 811 812 case PT_LOPROC ... PT_HIPROC: 813 retval = arch_elf_pt_proc(&loc->elf_ex, elf_ppnt, 814 bprm->file, false, 815 &arch_state); 816 if (retval) 817 goto out_free_dentry; 818 break; 819 } 820 821 /* Some simple consistency checks for the interpreter */ 822 if (elf_interpreter) { 823 retval = -ELIBBAD; 824 /* Not an ELF interpreter */ 825 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 826 goto out_free_dentry; 827 /* Verify the interpreter has a valid arch */ 828 if (!elf_check_arch(&loc->interp_elf_ex) || 829 elf_check_fdpic(&loc->interp_elf_ex)) 830 goto out_free_dentry; 831 832 /* Load the interpreter program headers */ 833 interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex, 834 interpreter); 835 if (!interp_elf_phdata) 836 goto out_free_dentry; 837 838 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ 839 elf_ppnt = interp_elf_phdata; 840 for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++) 841 switch (elf_ppnt->p_type) { 842 case PT_LOPROC ... PT_HIPROC: 843 retval = arch_elf_pt_proc(&loc->interp_elf_ex, 844 elf_ppnt, interpreter, 845 true, &arch_state); 846 if (retval) 847 goto out_free_dentry; 848 break; 849 } 850 } 851 852 /* 853 * Allow arch code to reject the ELF at this point, whilst it's 854 * still possible to return an error to the code that invoked 855 * the exec syscall. 856 */ 857 retval = arch_check_elf(&loc->elf_ex, 858 !!interpreter, &loc->interp_elf_ex, 859 &arch_state); 860 if (retval) 861 goto out_free_dentry; 862 863 /* Flush all traces of the currently running executable */ 864 retval = flush_old_exec(bprm); 865 if (retval) 866 goto out_free_dentry; 867 868 /* Do this immediately, since STACK_TOP as used in setup_arg_pages 869 may depend on the personality. */ 870 SET_PERSONALITY2(loc->elf_ex, &arch_state); 871 if (elf_read_implies_exec(loc->elf_ex, executable_stack)) 872 current->personality |= READ_IMPLIES_EXEC; 873 874 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) 875 current->flags |= PF_RANDOMIZE; 876 877 setup_new_exec(bprm); 878 install_exec_creds(bprm); 879 880 /* Do this so that we can load the interpreter, if need be. We will 881 change some of these later */ 882 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), 883 executable_stack); 884 if (retval < 0) 885 goto out_free_dentry; 886 887 current->mm->start_stack = bprm->p; 888 889 /* Now we do a little grungy work by mmapping the ELF image into 890 the correct location in memory. */ 891 for(i = 0, elf_ppnt = elf_phdata; 892 i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { 893 int elf_prot = 0, elf_flags, elf_fixed = MAP_FIXED_NOREPLACE; 894 unsigned long k, vaddr; 895 unsigned long total_size = 0; 896 897 if (elf_ppnt->p_type != PT_LOAD) 898 continue; 899 900 if (unlikely (elf_brk > elf_bss)) { 901 unsigned long nbyte; 902 903 /* There was a PT_LOAD segment with p_memsz > p_filesz 904 before this one. Map anonymous pages, if needed, 905 and clear the area. */ 906 retval = set_brk(elf_bss + load_bias, 907 elf_brk + load_bias, 908 bss_prot); 909 if (retval) 910 goto out_free_dentry; 911 nbyte = ELF_PAGEOFFSET(elf_bss); 912 if (nbyte) { 913 nbyte = ELF_MIN_ALIGN - nbyte; 914 if (nbyte > elf_brk - elf_bss) 915 nbyte = elf_brk - elf_bss; 916 if (clear_user((void __user *)elf_bss + 917 load_bias, nbyte)) { 918 /* 919 * This bss-zeroing can fail if the ELF 920 * file specifies odd protections. So 921 * we don't check the return value 922 */ 923 } 924 } 925 926 /* 927 * Some binaries have overlapping elf segments and then 928 * we have to forcefully map over an existing mapping 929 * e.g. over this newly established brk mapping. 930 */ 931 elf_fixed = MAP_FIXED; 932 } 933 934 if (elf_ppnt->p_flags & PF_R) 935 elf_prot |= PROT_READ; 936 if (elf_ppnt->p_flags & PF_W) 937 elf_prot |= PROT_WRITE; 938 if (elf_ppnt->p_flags & PF_X) 939 elf_prot |= PROT_EXEC; 940 941 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE; 942 943 vaddr = elf_ppnt->p_vaddr; 944 /* 945 * If we are loading ET_EXEC or we have already performed 946 * the ET_DYN load_addr calculations, proceed normally. 947 */ 948 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) { 949 elf_flags |= elf_fixed; 950 } else if (loc->elf_ex.e_type == ET_DYN) { 951 /* 952 * This logic is run once for the first LOAD Program 953 * Header for ET_DYN binaries to calculate the 954 * randomization (load_bias) for all the LOAD 955 * Program Headers, and to calculate the entire 956 * size of the ELF mapping (total_size). (Note that 957 * load_addr_set is set to true later once the 958 * initial mapping is performed.) 959 * 960 * There are effectively two types of ET_DYN 961 * binaries: programs (i.e. PIE: ET_DYN with INTERP) 962 * and loaders (ET_DYN without INTERP, since they 963 * _are_ the ELF interpreter). The loaders must 964 * be loaded away from programs since the program 965 * may otherwise collide with the loader (especially 966 * for ET_EXEC which does not have a randomized 967 * position). For example to handle invocations of 968 * "./ld.so someprog" to test out a new version of 969 * the loader, the subsequent program that the 970 * loader loads must avoid the loader itself, so 971 * they cannot share the same load range. Sufficient 972 * room for the brk must be allocated with the 973 * loader as well, since brk must be available with 974 * the loader. 975 * 976 * Therefore, programs are loaded offset from 977 * ELF_ET_DYN_BASE and loaders are loaded into the 978 * independently randomized mmap region (0 load_bias 979 * without MAP_FIXED). 980 */ 981 if (elf_interpreter) { 982 load_bias = ELF_ET_DYN_BASE; 983 if (current->flags & PF_RANDOMIZE) 984 load_bias += arch_mmap_rnd(); 985 elf_flags |= elf_fixed; 986 } else 987 load_bias = 0; 988 989 /* 990 * Since load_bias is used for all subsequent loading 991 * calculations, we must lower it by the first vaddr 992 * so that the remaining calculations based on the 993 * ELF vaddrs will be correctly offset. The result 994 * is then page aligned. 995 */ 996 load_bias = ELF_PAGESTART(load_bias - vaddr); 997 998 total_size = total_mapping_size(elf_phdata, 999 loc->elf_ex.e_phnum); 1000 if (!total_size) { 1001 retval = -EINVAL; 1002 goto out_free_dentry; 1003 } 1004 } 1005 1006 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, 1007 elf_prot, elf_flags, total_size); 1008 if (BAD_ADDR(error)) { 1009 retval = IS_ERR((void *)error) ? 1010 PTR_ERR((void*)error) : -EINVAL; 1011 goto out_free_dentry; 1012 } 1013 1014 if (!load_addr_set) { 1015 load_addr_set = 1; 1016 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset); 1017 if (loc->elf_ex.e_type == ET_DYN) { 1018 load_bias += error - 1019 ELF_PAGESTART(load_bias + vaddr); 1020 load_addr += load_bias; 1021 reloc_func_desc = load_bias; 1022 } 1023 } 1024 k = elf_ppnt->p_vaddr; 1025 if (k < start_code) 1026 start_code = k; 1027 if (start_data < k) 1028 start_data = k; 1029 1030 /* 1031 * Check to see if the section's size will overflow the 1032 * allowed task size. Note that p_filesz must always be 1033 * <= p_memsz so it is only necessary to check p_memsz. 1034 */ 1035 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || 1036 elf_ppnt->p_memsz > TASK_SIZE || 1037 TASK_SIZE - elf_ppnt->p_memsz < k) { 1038 /* set_brk can never work. Avoid overflows. */ 1039 retval = -EINVAL; 1040 goto out_free_dentry; 1041 } 1042 1043 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; 1044 1045 if (k > elf_bss) 1046 elf_bss = k; 1047 if ((elf_ppnt->p_flags & PF_X) && end_code < k) 1048 end_code = k; 1049 if (end_data < k) 1050 end_data = k; 1051 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; 1052 if (k > elf_brk) { 1053 bss_prot = elf_prot; 1054 elf_brk = k; 1055 } 1056 } 1057 1058 loc->elf_ex.e_entry += load_bias; 1059 elf_bss += load_bias; 1060 elf_brk += load_bias; 1061 start_code += load_bias; 1062 end_code += load_bias; 1063 start_data += load_bias; 1064 end_data += load_bias; 1065 1066 /* Calling set_brk effectively mmaps the pages that we need 1067 * for the bss and break sections. We must do this before 1068 * mapping in the interpreter, to make sure it doesn't wind 1069 * up getting placed where the bss needs to go. 1070 */ 1071 retval = set_brk(elf_bss, elf_brk, bss_prot); 1072 if (retval) 1073 goto out_free_dentry; 1074 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { 1075 retval = -EFAULT; /* Nobody gets to see this, but.. */ 1076 goto out_free_dentry; 1077 } 1078 1079 if (elf_interpreter) { 1080 unsigned long interp_map_addr = 0; 1081 1082 elf_entry = load_elf_interp(&loc->interp_elf_ex, 1083 interpreter, 1084 &interp_map_addr, 1085 load_bias, interp_elf_phdata); 1086 if (!IS_ERR((void *)elf_entry)) { 1087 /* 1088 * load_elf_interp() returns relocation 1089 * adjustment 1090 */ 1091 interp_load_addr = elf_entry; 1092 elf_entry += loc->interp_elf_ex.e_entry; 1093 } 1094 if (BAD_ADDR(elf_entry)) { 1095 retval = IS_ERR((void *)elf_entry) ? 1096 (int)elf_entry : -EINVAL; 1097 goto out_free_dentry; 1098 } 1099 reloc_func_desc = interp_load_addr; 1100 1101 allow_write_access(interpreter); 1102 fput(interpreter); 1103 kfree(elf_interpreter); 1104 } else { 1105 elf_entry = loc->elf_ex.e_entry; 1106 if (BAD_ADDR(elf_entry)) { 1107 retval = -EINVAL; 1108 goto out_free_dentry; 1109 } 1110 } 1111 1112 kfree(interp_elf_phdata); 1113 kfree(elf_phdata); 1114 1115 set_binfmt(&elf_format); 1116 1117 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES 1118 retval = arch_setup_additional_pages(bprm, !!elf_interpreter); 1119 if (retval < 0) 1120 goto out; 1121 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ 1122 1123 retval = create_elf_tables(bprm, &loc->elf_ex, 1124 load_addr, interp_load_addr); 1125 if (retval < 0) 1126 goto out; 1127 /* N.B. passed_fileno might not be initialized? */ 1128 current->mm->end_code = end_code; 1129 current->mm->start_code = start_code; 1130 current->mm->start_data = start_data; 1131 current->mm->end_data = end_data; 1132 current->mm->start_stack = bprm->p; 1133 1134 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) { 1135 current->mm->brk = current->mm->start_brk = 1136 arch_randomize_brk(current->mm); 1137 #ifdef compat_brk_randomized 1138 current->brk_randomized = 1; 1139 #endif 1140 } 1141 1142 if (current->personality & MMAP_PAGE_ZERO) { 1143 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 1144 and some applications "depend" upon this behavior. 1145 Since we do not have the power to recompile these, we 1146 emulate the SVr4 behavior. Sigh. */ 1147 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, 1148 MAP_FIXED | MAP_PRIVATE, 0); 1149 } 1150 1151 #ifdef ELF_PLAT_INIT 1152 /* 1153 * The ABI may specify that certain registers be set up in special 1154 * ways (on i386 %edx is the address of a DT_FINI function, for 1155 * example. In addition, it may also specify (eg, PowerPC64 ELF) 1156 * that the e_entry field is the address of the function descriptor 1157 * for the startup routine, rather than the address of the startup 1158 * routine itself. This macro performs whatever initialization to 1159 * the regs structure is required as well as any relocations to the 1160 * function descriptor entries when executing dynamically links apps. 1161 */ 1162 ELF_PLAT_INIT(regs, reloc_func_desc); 1163 #endif 1164 1165 finalize_exec(bprm); 1166 start_thread(regs, elf_entry, bprm->p); 1167 retval = 0; 1168 out: 1169 kfree(loc); 1170 out_ret: 1171 return retval; 1172 1173 /* error cleanup */ 1174 out_free_dentry: 1175 kfree(interp_elf_phdata); 1176 allow_write_access(interpreter); 1177 if (interpreter) 1178 fput(interpreter); 1179 out_free_interp: 1180 kfree(elf_interpreter); 1181 out_free_ph: 1182 kfree(elf_phdata); 1183 goto out; 1184 } 1185 1186 #ifdef CONFIG_USELIB 1187 /* This is really simpleminded and specialized - we are loading an 1188 a.out library that is given an ELF header. */ 1189 static int load_elf_library(struct file *file) 1190 { 1191 struct elf_phdr *elf_phdata; 1192 struct elf_phdr *eppnt; 1193 unsigned long elf_bss, bss, len; 1194 int retval, error, i, j; 1195 struct elfhdr elf_ex; 1196 loff_t pos = 0; 1197 1198 error = -ENOEXEC; 1199 retval = kernel_read(file, &elf_ex, sizeof(elf_ex), &pos); 1200 if (retval != sizeof(elf_ex)) 1201 goto out; 1202 1203 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 1204 goto out; 1205 1206 /* First of all, some simple consistency checks */ 1207 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 || 1208 !elf_check_arch(&elf_ex) || !file->f_op->mmap) 1209 goto out; 1210 if (elf_check_fdpic(&elf_ex)) 1211 goto out; 1212 1213 /* Now read in all of the header information */ 1214 1215 j = sizeof(struct elf_phdr) * elf_ex.e_phnum; 1216 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */ 1217 1218 error = -ENOMEM; 1219 elf_phdata = kmalloc(j, GFP_KERNEL); 1220 if (!elf_phdata) 1221 goto out; 1222 1223 eppnt = elf_phdata; 1224 error = -ENOEXEC; 1225 pos = elf_ex.e_phoff; 1226 retval = kernel_read(file, eppnt, j, &pos); 1227 if (retval != j) 1228 goto out_free_ph; 1229 1230 for (j = 0, i = 0; i<elf_ex.e_phnum; i++) 1231 if ((eppnt + i)->p_type == PT_LOAD) 1232 j++; 1233 if (j != 1) 1234 goto out_free_ph; 1235 1236 while (eppnt->p_type != PT_LOAD) 1237 eppnt++; 1238 1239 /* Now use mmap to map the library into memory. */ 1240 error = vm_mmap(file, 1241 ELF_PAGESTART(eppnt->p_vaddr), 1242 (eppnt->p_filesz + 1243 ELF_PAGEOFFSET(eppnt->p_vaddr)), 1244 PROT_READ | PROT_WRITE | PROT_EXEC, 1245 MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_DENYWRITE, 1246 (eppnt->p_offset - 1247 ELF_PAGEOFFSET(eppnt->p_vaddr))); 1248 if (error != ELF_PAGESTART(eppnt->p_vaddr)) 1249 goto out_free_ph; 1250 1251 elf_bss = eppnt->p_vaddr + eppnt->p_filesz; 1252 if (padzero(elf_bss)) { 1253 error = -EFAULT; 1254 goto out_free_ph; 1255 } 1256 1257 len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr); 1258 bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr); 1259 if (bss > len) { 1260 error = vm_brk(len, bss - len); 1261 if (error) 1262 goto out_free_ph; 1263 } 1264 error = 0; 1265 1266 out_free_ph: 1267 kfree(elf_phdata); 1268 out: 1269 return error; 1270 } 1271 #endif /* #ifdef CONFIG_USELIB */ 1272 1273 #ifdef CONFIG_ELF_CORE 1274 /* 1275 * ELF core dumper 1276 * 1277 * Modelled on fs/exec.c:aout_core_dump() 1278 * Jeremy Fitzhardinge <jeremy@sw.oz.au> 1279 */ 1280 1281 /* 1282 * The purpose of always_dump_vma() is to make sure that special kernel mappings 1283 * that are useful for post-mortem analysis are included in every core dump. 1284 * In that way we ensure that the core dump is fully interpretable later 1285 * without matching up the same kernel and hardware config to see what PC values 1286 * meant. These special mappings include - vDSO, vsyscall, and other 1287 * architecture specific mappings 1288 */ 1289 static bool always_dump_vma(struct vm_area_struct *vma) 1290 { 1291 /* Any vsyscall mappings? */ 1292 if (vma == get_gate_vma(vma->vm_mm)) 1293 return true; 1294 1295 /* 1296 * Assume that all vmas with a .name op should always be dumped. 1297 * If this changes, a new vm_ops field can easily be added. 1298 */ 1299 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 1300 return true; 1301 1302 /* 1303 * arch_vma_name() returns non-NULL for special architecture mappings, 1304 * such as vDSO sections. 1305 */ 1306 if (arch_vma_name(vma)) 1307 return true; 1308 1309 return false; 1310 } 1311 1312 /* 1313 * Decide what to dump of a segment, part, all or none. 1314 */ 1315 static unsigned long vma_dump_size(struct vm_area_struct *vma, 1316 unsigned long mm_flags) 1317 { 1318 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) 1319 1320 /* always dump the vdso and vsyscall sections */ 1321 if (always_dump_vma(vma)) 1322 goto whole; 1323 1324 if (vma->vm_flags & VM_DONTDUMP) 1325 return 0; 1326 1327 /* support for DAX */ 1328 if (vma_is_dax(vma)) { 1329 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED)) 1330 goto whole; 1331 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE)) 1332 goto whole; 1333 return 0; 1334 } 1335 1336 /* Hugetlb memory check */ 1337 if (vma->vm_flags & VM_HUGETLB) { 1338 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED)) 1339 goto whole; 1340 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) 1341 goto whole; 1342 return 0; 1343 } 1344 1345 /* Do not dump I/O mapped devices or special mappings */ 1346 if (vma->vm_flags & VM_IO) 1347 return 0; 1348 1349 /* By default, dump shared memory if mapped from an anonymous file. */ 1350 if (vma->vm_flags & VM_SHARED) { 1351 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1352 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED)) 1353 goto whole; 1354 return 0; 1355 } 1356 1357 /* Dump segments that have been written to. */ 1358 if (vma->anon_vma && FILTER(ANON_PRIVATE)) 1359 goto whole; 1360 if (vma->vm_file == NULL) 1361 return 0; 1362 1363 if (FILTER(MAPPED_PRIVATE)) 1364 goto whole; 1365 1366 /* 1367 * If this looks like the beginning of a DSO or executable mapping, 1368 * check for an ELF header. If we find one, dump the first page to 1369 * aid in determining what was mapped here. 1370 */ 1371 if (FILTER(ELF_HEADERS) && 1372 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1373 u32 __user *header = (u32 __user *) vma->vm_start; 1374 u32 word; 1375 mm_segment_t fs = get_fs(); 1376 /* 1377 * Doing it this way gets the constant folded by GCC. 1378 */ 1379 union { 1380 u32 cmp; 1381 char elfmag[SELFMAG]; 1382 } magic; 1383 BUILD_BUG_ON(SELFMAG != sizeof word); 1384 magic.elfmag[EI_MAG0] = ELFMAG0; 1385 magic.elfmag[EI_MAG1] = ELFMAG1; 1386 magic.elfmag[EI_MAG2] = ELFMAG2; 1387 magic.elfmag[EI_MAG3] = ELFMAG3; 1388 /* 1389 * Switch to the user "segment" for get_user(), 1390 * then put back what elf_core_dump() had in place. 1391 */ 1392 set_fs(USER_DS); 1393 if (unlikely(get_user(word, header))) 1394 word = 0; 1395 set_fs(fs); 1396 if (word == magic.cmp) 1397 return PAGE_SIZE; 1398 } 1399 1400 #undef FILTER 1401 1402 return 0; 1403 1404 whole: 1405 return vma->vm_end - vma->vm_start; 1406 } 1407 1408 /* An ELF note in memory */ 1409 struct memelfnote 1410 { 1411 const char *name; 1412 int type; 1413 unsigned int datasz; 1414 void *data; 1415 }; 1416 1417 static int notesize(struct memelfnote *en) 1418 { 1419 int sz; 1420 1421 sz = sizeof(struct elf_note); 1422 sz += roundup(strlen(en->name) + 1, 4); 1423 sz += roundup(en->datasz, 4); 1424 1425 return sz; 1426 } 1427 1428 static int writenote(struct memelfnote *men, struct coredump_params *cprm) 1429 { 1430 struct elf_note en; 1431 en.n_namesz = strlen(men->name) + 1; 1432 en.n_descsz = men->datasz; 1433 en.n_type = men->type; 1434 1435 return dump_emit(cprm, &en, sizeof(en)) && 1436 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) && 1437 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4); 1438 } 1439 1440 static void fill_elf_header(struct elfhdr *elf, int segs, 1441 u16 machine, u32 flags) 1442 { 1443 memset(elf, 0, sizeof(*elf)); 1444 1445 memcpy(elf->e_ident, ELFMAG, SELFMAG); 1446 elf->e_ident[EI_CLASS] = ELF_CLASS; 1447 elf->e_ident[EI_DATA] = ELF_DATA; 1448 elf->e_ident[EI_VERSION] = EV_CURRENT; 1449 elf->e_ident[EI_OSABI] = ELF_OSABI; 1450 1451 elf->e_type = ET_CORE; 1452 elf->e_machine = machine; 1453 elf->e_version = EV_CURRENT; 1454 elf->e_phoff = sizeof(struct elfhdr); 1455 elf->e_flags = flags; 1456 elf->e_ehsize = sizeof(struct elfhdr); 1457 elf->e_phentsize = sizeof(struct elf_phdr); 1458 elf->e_phnum = segs; 1459 1460 return; 1461 } 1462 1463 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset) 1464 { 1465 phdr->p_type = PT_NOTE; 1466 phdr->p_offset = offset; 1467 phdr->p_vaddr = 0; 1468 phdr->p_paddr = 0; 1469 phdr->p_filesz = sz; 1470 phdr->p_memsz = 0; 1471 phdr->p_flags = 0; 1472 phdr->p_align = 0; 1473 return; 1474 } 1475 1476 static void fill_note(struct memelfnote *note, const char *name, int type, 1477 unsigned int sz, void *data) 1478 { 1479 note->name = name; 1480 note->type = type; 1481 note->datasz = sz; 1482 note->data = data; 1483 return; 1484 } 1485 1486 /* 1487 * fill up all the fields in prstatus from the given task struct, except 1488 * registers which need to be filled up separately. 1489 */ 1490 static void fill_prstatus(struct elf_prstatus *prstatus, 1491 struct task_struct *p, long signr) 1492 { 1493 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 1494 prstatus->pr_sigpend = p->pending.signal.sig[0]; 1495 prstatus->pr_sighold = p->blocked.sig[0]; 1496 rcu_read_lock(); 1497 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1498 rcu_read_unlock(); 1499 prstatus->pr_pid = task_pid_vnr(p); 1500 prstatus->pr_pgrp = task_pgrp_vnr(p); 1501 prstatus->pr_sid = task_session_vnr(p); 1502 if (thread_group_leader(p)) { 1503 struct task_cputime cputime; 1504 1505 /* 1506 * This is the record for the group leader. It shows the 1507 * group-wide total, not its individual thread total. 1508 */ 1509 thread_group_cputime(p, &cputime); 1510 prstatus->pr_utime = ns_to_timeval(cputime.utime); 1511 prstatus->pr_stime = ns_to_timeval(cputime.stime); 1512 } else { 1513 u64 utime, stime; 1514 1515 task_cputime(p, &utime, &stime); 1516 prstatus->pr_utime = ns_to_timeval(utime); 1517 prstatus->pr_stime = ns_to_timeval(stime); 1518 } 1519 1520 prstatus->pr_cutime = ns_to_timeval(p->signal->cutime); 1521 prstatus->pr_cstime = ns_to_timeval(p->signal->cstime); 1522 } 1523 1524 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, 1525 struct mm_struct *mm) 1526 { 1527 const struct cred *cred; 1528 unsigned int i, len; 1529 1530 /* first copy the parameters from user space */ 1531 memset(psinfo, 0, sizeof(struct elf_prpsinfo)); 1532 1533 len = mm->arg_end - mm->arg_start; 1534 if (len >= ELF_PRARGSZ) 1535 len = ELF_PRARGSZ-1; 1536 if (copy_from_user(&psinfo->pr_psargs, 1537 (const char __user *)mm->arg_start, len)) 1538 return -EFAULT; 1539 for(i = 0; i < len; i++) 1540 if (psinfo->pr_psargs[i] == 0) 1541 psinfo->pr_psargs[i] = ' '; 1542 psinfo->pr_psargs[len] = 0; 1543 1544 rcu_read_lock(); 1545 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1546 rcu_read_unlock(); 1547 psinfo->pr_pid = task_pid_vnr(p); 1548 psinfo->pr_pgrp = task_pgrp_vnr(p); 1549 psinfo->pr_sid = task_session_vnr(p); 1550 1551 i = p->state ? ffz(~p->state) + 1 : 0; 1552 psinfo->pr_state = i; 1553 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i]; 1554 psinfo->pr_zomb = psinfo->pr_sname == 'Z'; 1555 psinfo->pr_nice = task_nice(p); 1556 psinfo->pr_flag = p->flags; 1557 rcu_read_lock(); 1558 cred = __task_cred(p); 1559 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid)); 1560 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid)); 1561 rcu_read_unlock(); 1562 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname)); 1563 1564 return 0; 1565 } 1566 1567 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) 1568 { 1569 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; 1570 int i = 0; 1571 do 1572 i += 2; 1573 while (auxv[i - 2] != AT_NULL); 1574 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); 1575 } 1576 1577 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata, 1578 const kernel_siginfo_t *siginfo) 1579 { 1580 mm_segment_t old_fs = get_fs(); 1581 set_fs(KERNEL_DS); 1582 copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo); 1583 set_fs(old_fs); 1584 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata); 1585 } 1586 1587 #define MAX_FILE_NOTE_SIZE (4*1024*1024) 1588 /* 1589 * Format of NT_FILE note: 1590 * 1591 * long count -- how many files are mapped 1592 * long page_size -- units for file_ofs 1593 * array of [COUNT] elements of 1594 * long start 1595 * long end 1596 * long file_ofs 1597 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL... 1598 */ 1599 static int fill_files_note(struct memelfnote *note) 1600 { 1601 struct vm_area_struct *vma; 1602 unsigned count, size, names_ofs, remaining, n; 1603 user_long_t *data; 1604 user_long_t *start_end_ofs; 1605 char *name_base, *name_curpos; 1606 1607 /* *Estimated* file count and total data size needed */ 1608 count = current->mm->map_count; 1609 if (count > UINT_MAX / 64) 1610 return -EINVAL; 1611 size = count * 64; 1612 1613 names_ofs = (2 + 3 * count) * sizeof(data[0]); 1614 alloc: 1615 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */ 1616 return -EINVAL; 1617 size = round_up(size, PAGE_SIZE); 1618 data = kvmalloc(size, GFP_KERNEL); 1619 if (ZERO_OR_NULL_PTR(data)) 1620 return -ENOMEM; 1621 1622 start_end_ofs = data + 2; 1623 name_base = name_curpos = ((char *)data) + names_ofs; 1624 remaining = size - names_ofs; 1625 count = 0; 1626 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) { 1627 struct file *file; 1628 const char *filename; 1629 1630 file = vma->vm_file; 1631 if (!file) 1632 continue; 1633 filename = file_path(file, name_curpos, remaining); 1634 if (IS_ERR(filename)) { 1635 if (PTR_ERR(filename) == -ENAMETOOLONG) { 1636 kvfree(data); 1637 size = size * 5 / 4; 1638 goto alloc; 1639 } 1640 continue; 1641 } 1642 1643 /* file_path() fills at the end, move name down */ 1644 /* n = strlen(filename) + 1: */ 1645 n = (name_curpos + remaining) - filename; 1646 remaining = filename - name_curpos; 1647 memmove(name_curpos, filename, n); 1648 name_curpos += n; 1649 1650 *start_end_ofs++ = vma->vm_start; 1651 *start_end_ofs++ = vma->vm_end; 1652 *start_end_ofs++ = vma->vm_pgoff; 1653 count++; 1654 } 1655 1656 /* Now we know exact count of files, can store it */ 1657 data[0] = count; 1658 data[1] = PAGE_SIZE; 1659 /* 1660 * Count usually is less than current->mm->map_count, 1661 * we need to move filenames down. 1662 */ 1663 n = current->mm->map_count - count; 1664 if (n != 0) { 1665 unsigned shift_bytes = n * 3 * sizeof(data[0]); 1666 memmove(name_base - shift_bytes, name_base, 1667 name_curpos - name_base); 1668 name_curpos -= shift_bytes; 1669 } 1670 1671 size = name_curpos - (char *)data; 1672 fill_note(note, "CORE", NT_FILE, size, data); 1673 return 0; 1674 } 1675 1676 #ifdef CORE_DUMP_USE_REGSET 1677 #include <linux/regset.h> 1678 1679 struct elf_thread_core_info { 1680 struct elf_thread_core_info *next; 1681 struct task_struct *task; 1682 struct elf_prstatus prstatus; 1683 struct memelfnote notes[0]; 1684 }; 1685 1686 struct elf_note_info { 1687 struct elf_thread_core_info *thread; 1688 struct memelfnote psinfo; 1689 struct memelfnote signote; 1690 struct memelfnote auxv; 1691 struct memelfnote files; 1692 user_siginfo_t csigdata; 1693 size_t size; 1694 int thread_notes; 1695 }; 1696 1697 /* 1698 * When a regset has a writeback hook, we call it on each thread before 1699 * dumping user memory. On register window machines, this makes sure the 1700 * user memory backing the register data is up to date before we read it. 1701 */ 1702 static void do_thread_regset_writeback(struct task_struct *task, 1703 const struct user_regset *regset) 1704 { 1705 if (regset->writeback) 1706 regset->writeback(task, regset, 1); 1707 } 1708 1709 #ifndef PRSTATUS_SIZE 1710 #define PRSTATUS_SIZE(S, R) sizeof(S) 1711 #endif 1712 1713 #ifndef SET_PR_FPVALID 1714 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V)) 1715 #endif 1716 1717 static int fill_thread_core_info(struct elf_thread_core_info *t, 1718 const struct user_regset_view *view, 1719 long signr, size_t *total) 1720 { 1721 unsigned int i; 1722 unsigned int regset0_size = regset_size(t->task, &view->regsets[0]); 1723 1724 /* 1725 * NT_PRSTATUS is the one special case, because the regset data 1726 * goes into the pr_reg field inside the note contents, rather 1727 * than being the whole note contents. We fill the reset in here. 1728 * We assume that regset 0 is NT_PRSTATUS. 1729 */ 1730 fill_prstatus(&t->prstatus, t->task, signr); 1731 (void) view->regsets[0].get(t->task, &view->regsets[0], 0, regset0_size, 1732 &t->prstatus.pr_reg, NULL); 1733 1734 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, 1735 PRSTATUS_SIZE(t->prstatus, regset0_size), &t->prstatus); 1736 *total += notesize(&t->notes[0]); 1737 1738 do_thread_regset_writeback(t->task, &view->regsets[0]); 1739 1740 /* 1741 * Each other regset might generate a note too. For each regset 1742 * that has no core_note_type or is inactive, we leave t->notes[i] 1743 * all zero and we'll know to skip writing it later. 1744 */ 1745 for (i = 1; i < view->n; ++i) { 1746 const struct user_regset *regset = &view->regsets[i]; 1747 do_thread_regset_writeback(t->task, regset); 1748 if (regset->core_note_type && regset->get && 1749 (!regset->active || regset->active(t->task, regset) > 0)) { 1750 int ret; 1751 size_t size = regset_size(t->task, regset); 1752 void *data = kmalloc(size, GFP_KERNEL); 1753 if (unlikely(!data)) 1754 return 0; 1755 ret = regset->get(t->task, regset, 1756 0, size, data, NULL); 1757 if (unlikely(ret)) 1758 kfree(data); 1759 else { 1760 if (regset->core_note_type != NT_PRFPREG) 1761 fill_note(&t->notes[i], "LINUX", 1762 regset->core_note_type, 1763 size, data); 1764 else { 1765 SET_PR_FPVALID(&t->prstatus, 1766 1, regset0_size); 1767 fill_note(&t->notes[i], "CORE", 1768 NT_PRFPREG, size, data); 1769 } 1770 *total += notesize(&t->notes[i]); 1771 } 1772 } 1773 } 1774 1775 return 1; 1776 } 1777 1778 static int fill_note_info(struct elfhdr *elf, int phdrs, 1779 struct elf_note_info *info, 1780 const kernel_siginfo_t *siginfo, struct pt_regs *regs) 1781 { 1782 struct task_struct *dump_task = current; 1783 const struct user_regset_view *view = task_user_regset_view(dump_task); 1784 struct elf_thread_core_info *t; 1785 struct elf_prpsinfo *psinfo; 1786 struct core_thread *ct; 1787 unsigned int i; 1788 1789 info->size = 0; 1790 info->thread = NULL; 1791 1792 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1793 if (psinfo == NULL) { 1794 info->psinfo.data = NULL; /* So we don't free this wrongly */ 1795 return 0; 1796 } 1797 1798 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); 1799 1800 /* 1801 * Figure out how many notes we're going to need for each thread. 1802 */ 1803 info->thread_notes = 0; 1804 for (i = 0; i < view->n; ++i) 1805 if (view->regsets[i].core_note_type != 0) 1806 ++info->thread_notes; 1807 1808 /* 1809 * Sanity check. We rely on regset 0 being in NT_PRSTATUS, 1810 * since it is our one special case. 1811 */ 1812 if (unlikely(info->thread_notes == 0) || 1813 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) { 1814 WARN_ON(1); 1815 return 0; 1816 } 1817 1818 /* 1819 * Initialize the ELF file header. 1820 */ 1821 fill_elf_header(elf, phdrs, 1822 view->e_machine, view->e_flags); 1823 1824 /* 1825 * Allocate a structure for each thread. 1826 */ 1827 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) { 1828 t = kzalloc(offsetof(struct elf_thread_core_info, 1829 notes[info->thread_notes]), 1830 GFP_KERNEL); 1831 if (unlikely(!t)) 1832 return 0; 1833 1834 t->task = ct->task; 1835 if (ct->task == dump_task || !info->thread) { 1836 t->next = info->thread; 1837 info->thread = t; 1838 } else { 1839 /* 1840 * Make sure to keep the original task at 1841 * the head of the list. 1842 */ 1843 t->next = info->thread->next; 1844 info->thread->next = t; 1845 } 1846 } 1847 1848 /* 1849 * Now fill in each thread's information. 1850 */ 1851 for (t = info->thread; t != NULL; t = t->next) 1852 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size)) 1853 return 0; 1854 1855 /* 1856 * Fill in the two process-wide notes. 1857 */ 1858 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm); 1859 info->size += notesize(&info->psinfo); 1860 1861 fill_siginfo_note(&info->signote, &info->csigdata, siginfo); 1862 info->size += notesize(&info->signote); 1863 1864 fill_auxv_note(&info->auxv, current->mm); 1865 info->size += notesize(&info->auxv); 1866 1867 if (fill_files_note(&info->files) == 0) 1868 info->size += notesize(&info->files); 1869 1870 return 1; 1871 } 1872 1873 static size_t get_note_info_size(struct elf_note_info *info) 1874 { 1875 return info->size; 1876 } 1877 1878 /* 1879 * Write all the notes for each thread. When writing the first thread, the 1880 * process-wide notes are interleaved after the first thread-specific note. 1881 */ 1882 static int write_note_info(struct elf_note_info *info, 1883 struct coredump_params *cprm) 1884 { 1885 bool first = true; 1886 struct elf_thread_core_info *t = info->thread; 1887 1888 do { 1889 int i; 1890 1891 if (!writenote(&t->notes[0], cprm)) 1892 return 0; 1893 1894 if (first && !writenote(&info->psinfo, cprm)) 1895 return 0; 1896 if (first && !writenote(&info->signote, cprm)) 1897 return 0; 1898 if (first && !writenote(&info->auxv, cprm)) 1899 return 0; 1900 if (first && info->files.data && 1901 !writenote(&info->files, cprm)) 1902 return 0; 1903 1904 for (i = 1; i < info->thread_notes; ++i) 1905 if (t->notes[i].data && 1906 !writenote(&t->notes[i], cprm)) 1907 return 0; 1908 1909 first = false; 1910 t = t->next; 1911 } while (t); 1912 1913 return 1; 1914 } 1915 1916 static void free_note_info(struct elf_note_info *info) 1917 { 1918 struct elf_thread_core_info *threads = info->thread; 1919 while (threads) { 1920 unsigned int i; 1921 struct elf_thread_core_info *t = threads; 1922 threads = t->next; 1923 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus); 1924 for (i = 1; i < info->thread_notes; ++i) 1925 kfree(t->notes[i].data); 1926 kfree(t); 1927 } 1928 kfree(info->psinfo.data); 1929 kvfree(info->files.data); 1930 } 1931 1932 #else 1933 1934 /* Here is the structure in which status of each thread is captured. */ 1935 struct elf_thread_status 1936 { 1937 struct list_head list; 1938 struct elf_prstatus prstatus; /* NT_PRSTATUS */ 1939 elf_fpregset_t fpu; /* NT_PRFPREG */ 1940 struct task_struct *thread; 1941 #ifdef ELF_CORE_COPY_XFPREGS 1942 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */ 1943 #endif 1944 struct memelfnote notes[3]; 1945 int num_notes; 1946 }; 1947 1948 /* 1949 * In order to add the specific thread information for the elf file format, 1950 * we need to keep a linked list of every threads pr_status and then create 1951 * a single section for them in the final core file. 1952 */ 1953 static int elf_dump_thread_status(long signr, struct elf_thread_status *t) 1954 { 1955 int sz = 0; 1956 struct task_struct *p = t->thread; 1957 t->num_notes = 0; 1958 1959 fill_prstatus(&t->prstatus, p, signr); 1960 elf_core_copy_task_regs(p, &t->prstatus.pr_reg); 1961 1962 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), 1963 &(t->prstatus)); 1964 t->num_notes++; 1965 sz += notesize(&t->notes[0]); 1966 1967 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, 1968 &t->fpu))) { 1969 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), 1970 &(t->fpu)); 1971 t->num_notes++; 1972 sz += notesize(&t->notes[1]); 1973 } 1974 1975 #ifdef ELF_CORE_COPY_XFPREGS 1976 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) { 1977 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE, 1978 sizeof(t->xfpu), &t->xfpu); 1979 t->num_notes++; 1980 sz += notesize(&t->notes[2]); 1981 } 1982 #endif 1983 return sz; 1984 } 1985 1986 struct elf_note_info { 1987 struct memelfnote *notes; 1988 struct memelfnote *notes_files; 1989 struct elf_prstatus *prstatus; /* NT_PRSTATUS */ 1990 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */ 1991 struct list_head thread_list; 1992 elf_fpregset_t *fpu; 1993 #ifdef ELF_CORE_COPY_XFPREGS 1994 elf_fpxregset_t *xfpu; 1995 #endif 1996 user_siginfo_t csigdata; 1997 int thread_status_size; 1998 int numnote; 1999 }; 2000 2001 static int elf_note_info_init(struct elf_note_info *info) 2002 { 2003 memset(info, 0, sizeof(*info)); 2004 INIT_LIST_HEAD(&info->thread_list); 2005 2006 /* Allocate space for ELF notes */ 2007 info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL); 2008 if (!info->notes) 2009 return 0; 2010 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL); 2011 if (!info->psinfo) 2012 return 0; 2013 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL); 2014 if (!info->prstatus) 2015 return 0; 2016 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL); 2017 if (!info->fpu) 2018 return 0; 2019 #ifdef ELF_CORE_COPY_XFPREGS 2020 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL); 2021 if (!info->xfpu) 2022 return 0; 2023 #endif 2024 return 1; 2025 } 2026 2027 static int fill_note_info(struct elfhdr *elf, int phdrs, 2028 struct elf_note_info *info, 2029 const kernel_siginfo_t *siginfo, struct pt_regs *regs) 2030 { 2031 struct core_thread *ct; 2032 struct elf_thread_status *ets; 2033 2034 if (!elf_note_info_init(info)) 2035 return 0; 2036 2037 for (ct = current->mm->core_state->dumper.next; 2038 ct; ct = ct->next) { 2039 ets = kzalloc(sizeof(*ets), GFP_KERNEL); 2040 if (!ets) 2041 return 0; 2042 2043 ets->thread = ct->task; 2044 list_add(&ets->list, &info->thread_list); 2045 } 2046 2047 list_for_each_entry(ets, &info->thread_list, list) { 2048 int sz; 2049 2050 sz = elf_dump_thread_status(siginfo->si_signo, ets); 2051 info->thread_status_size += sz; 2052 } 2053 /* now collect the dump for the current */ 2054 memset(info->prstatus, 0, sizeof(*info->prstatus)); 2055 fill_prstatus(info->prstatus, current, siginfo->si_signo); 2056 elf_core_copy_regs(&info->prstatus->pr_reg, regs); 2057 2058 /* Set up header */ 2059 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS); 2060 2061 /* 2062 * Set up the notes in similar form to SVR4 core dumps made 2063 * with info from their /proc. 2064 */ 2065 2066 fill_note(info->notes + 0, "CORE", NT_PRSTATUS, 2067 sizeof(*info->prstatus), info->prstatus); 2068 fill_psinfo(info->psinfo, current->group_leader, current->mm); 2069 fill_note(info->notes + 1, "CORE", NT_PRPSINFO, 2070 sizeof(*info->psinfo), info->psinfo); 2071 2072 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo); 2073 fill_auxv_note(info->notes + 3, current->mm); 2074 info->numnote = 4; 2075 2076 if (fill_files_note(info->notes + info->numnote) == 0) { 2077 info->notes_files = info->notes + info->numnote; 2078 info->numnote++; 2079 } 2080 2081 /* Try to dump the FPU. */ 2082 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, 2083 info->fpu); 2084 if (info->prstatus->pr_fpvalid) 2085 fill_note(info->notes + info->numnote++, 2086 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu); 2087 #ifdef ELF_CORE_COPY_XFPREGS 2088 if (elf_core_copy_task_xfpregs(current, info->xfpu)) 2089 fill_note(info->notes + info->numnote++, 2090 "LINUX", ELF_CORE_XFPREG_TYPE, 2091 sizeof(*info->xfpu), info->xfpu); 2092 #endif 2093 2094 return 1; 2095 } 2096 2097 static size_t get_note_info_size(struct elf_note_info *info) 2098 { 2099 int sz = 0; 2100 int i; 2101 2102 for (i = 0; i < info->numnote; i++) 2103 sz += notesize(info->notes + i); 2104 2105 sz += info->thread_status_size; 2106 2107 return sz; 2108 } 2109 2110 static int write_note_info(struct elf_note_info *info, 2111 struct coredump_params *cprm) 2112 { 2113 struct elf_thread_status *ets; 2114 int i; 2115 2116 for (i = 0; i < info->numnote; i++) 2117 if (!writenote(info->notes + i, cprm)) 2118 return 0; 2119 2120 /* write out the thread status notes section */ 2121 list_for_each_entry(ets, &info->thread_list, list) { 2122 for (i = 0; i < ets->num_notes; i++) 2123 if (!writenote(&ets->notes[i], cprm)) 2124 return 0; 2125 } 2126 2127 return 1; 2128 } 2129 2130 static void free_note_info(struct elf_note_info *info) 2131 { 2132 while (!list_empty(&info->thread_list)) { 2133 struct list_head *tmp = info->thread_list.next; 2134 list_del(tmp); 2135 kfree(list_entry(tmp, struct elf_thread_status, list)); 2136 } 2137 2138 /* Free data possibly allocated by fill_files_note(): */ 2139 if (info->notes_files) 2140 kvfree(info->notes_files->data); 2141 2142 kfree(info->prstatus); 2143 kfree(info->psinfo); 2144 kfree(info->notes); 2145 kfree(info->fpu); 2146 #ifdef ELF_CORE_COPY_XFPREGS 2147 kfree(info->xfpu); 2148 #endif 2149 } 2150 2151 #endif 2152 2153 static struct vm_area_struct *first_vma(struct task_struct *tsk, 2154 struct vm_area_struct *gate_vma) 2155 { 2156 struct vm_area_struct *ret = tsk->mm->mmap; 2157 2158 if (ret) 2159 return ret; 2160 return gate_vma; 2161 } 2162 /* 2163 * Helper function for iterating across a vma list. It ensures that the caller 2164 * will visit `gate_vma' prior to terminating the search. 2165 */ 2166 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma, 2167 struct vm_area_struct *gate_vma) 2168 { 2169 struct vm_area_struct *ret; 2170 2171 ret = this_vma->vm_next; 2172 if (ret) 2173 return ret; 2174 if (this_vma == gate_vma) 2175 return NULL; 2176 return gate_vma; 2177 } 2178 2179 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, 2180 elf_addr_t e_shoff, int segs) 2181 { 2182 elf->e_shoff = e_shoff; 2183 elf->e_shentsize = sizeof(*shdr4extnum); 2184 elf->e_shnum = 1; 2185 elf->e_shstrndx = SHN_UNDEF; 2186 2187 memset(shdr4extnum, 0, sizeof(*shdr4extnum)); 2188 2189 shdr4extnum->sh_type = SHT_NULL; 2190 shdr4extnum->sh_size = elf->e_shnum; 2191 shdr4extnum->sh_link = elf->e_shstrndx; 2192 shdr4extnum->sh_info = segs; 2193 } 2194 2195 /* 2196 * Actual dumper 2197 * 2198 * This is a two-pass process; first we find the offsets of the bits, 2199 * and then they are actually written out. If we run out of core limit 2200 * we just truncate. 2201 */ 2202 static int elf_core_dump(struct coredump_params *cprm) 2203 { 2204 int has_dumped = 0; 2205 mm_segment_t fs; 2206 int segs, i; 2207 size_t vma_data_size = 0; 2208 struct vm_area_struct *vma, *gate_vma; 2209 struct elfhdr *elf = NULL; 2210 loff_t offset = 0, dataoff; 2211 struct elf_note_info info = { }; 2212 struct elf_phdr *phdr4note = NULL; 2213 struct elf_shdr *shdr4extnum = NULL; 2214 Elf_Half e_phnum; 2215 elf_addr_t e_shoff; 2216 elf_addr_t *vma_filesz = NULL; 2217 2218 /* 2219 * We no longer stop all VM operations. 2220 * 2221 * This is because those proceses that could possibly change map_count 2222 * or the mmap / vma pages are now blocked in do_exit on current 2223 * finishing this core dump. 2224 * 2225 * Only ptrace can touch these memory addresses, but it doesn't change 2226 * the map_count or the pages allocated. So no possibility of crashing 2227 * exists while dumping the mm->vm_next areas to the core file. 2228 */ 2229 2230 /* alloc memory for large data structures: too large to be on stack */ 2231 elf = kmalloc(sizeof(*elf), GFP_KERNEL); 2232 if (!elf) 2233 goto out; 2234 /* 2235 * The number of segs are recored into ELF header as 16bit value. 2236 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. 2237 */ 2238 segs = current->mm->map_count; 2239 segs += elf_core_extra_phdrs(); 2240 2241 gate_vma = get_gate_vma(current->mm); 2242 if (gate_vma != NULL) 2243 segs++; 2244 2245 /* for notes section */ 2246 segs++; 2247 2248 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid 2249 * this, kernel supports extended numbering. Have a look at 2250 * include/linux/elf.h for further information. */ 2251 e_phnum = segs > PN_XNUM ? PN_XNUM : segs; 2252 2253 /* 2254 * Collect all the non-memory information about the process for the 2255 * notes. This also sets up the file header. 2256 */ 2257 if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs)) 2258 goto cleanup; 2259 2260 has_dumped = 1; 2261 2262 fs = get_fs(); 2263 set_fs(KERNEL_DS); 2264 2265 offset += sizeof(*elf); /* Elf header */ 2266 offset += segs * sizeof(struct elf_phdr); /* Program headers */ 2267 2268 /* Write notes phdr entry */ 2269 { 2270 size_t sz = get_note_info_size(&info); 2271 2272 sz += elf_coredump_extra_notes_size(); 2273 2274 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL); 2275 if (!phdr4note) 2276 goto end_coredump; 2277 2278 fill_elf_note_phdr(phdr4note, sz, offset); 2279 offset += sz; 2280 } 2281 2282 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); 2283 2284 if (segs - 1 > ULONG_MAX / sizeof(*vma_filesz)) 2285 goto end_coredump; 2286 vma_filesz = kvmalloc(array_size(sizeof(*vma_filesz), (segs - 1)), 2287 GFP_KERNEL); 2288 if (ZERO_OR_NULL_PTR(vma_filesz)) 2289 goto end_coredump; 2290 2291 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2292 vma = next_vma(vma, gate_vma)) { 2293 unsigned long dump_size; 2294 2295 dump_size = vma_dump_size(vma, cprm->mm_flags); 2296 vma_filesz[i++] = dump_size; 2297 vma_data_size += dump_size; 2298 } 2299 2300 offset += vma_data_size; 2301 offset += elf_core_extra_data_size(); 2302 e_shoff = offset; 2303 2304 if (e_phnum == PN_XNUM) { 2305 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL); 2306 if (!shdr4extnum) 2307 goto end_coredump; 2308 fill_extnum_info(elf, shdr4extnum, e_shoff, segs); 2309 } 2310 2311 offset = dataoff; 2312 2313 if (!dump_emit(cprm, elf, sizeof(*elf))) 2314 goto end_coredump; 2315 2316 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note))) 2317 goto end_coredump; 2318 2319 /* Write program headers for segments dump */ 2320 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2321 vma = next_vma(vma, gate_vma)) { 2322 struct elf_phdr phdr; 2323 2324 phdr.p_type = PT_LOAD; 2325 phdr.p_offset = offset; 2326 phdr.p_vaddr = vma->vm_start; 2327 phdr.p_paddr = 0; 2328 phdr.p_filesz = vma_filesz[i++]; 2329 phdr.p_memsz = vma->vm_end - vma->vm_start; 2330 offset += phdr.p_filesz; 2331 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; 2332 if (vma->vm_flags & VM_WRITE) 2333 phdr.p_flags |= PF_W; 2334 if (vma->vm_flags & VM_EXEC) 2335 phdr.p_flags |= PF_X; 2336 phdr.p_align = ELF_EXEC_PAGESIZE; 2337 2338 if (!dump_emit(cprm, &phdr, sizeof(phdr))) 2339 goto end_coredump; 2340 } 2341 2342 if (!elf_core_write_extra_phdrs(cprm, offset)) 2343 goto end_coredump; 2344 2345 /* write out the notes section */ 2346 if (!write_note_info(&info, cprm)) 2347 goto end_coredump; 2348 2349 if (elf_coredump_extra_notes_write(cprm)) 2350 goto end_coredump; 2351 2352 /* Align to page */ 2353 if (!dump_skip(cprm, dataoff - cprm->pos)) 2354 goto end_coredump; 2355 2356 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2357 vma = next_vma(vma, gate_vma)) { 2358 unsigned long addr; 2359 unsigned long end; 2360 2361 end = vma->vm_start + vma_filesz[i++]; 2362 2363 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) { 2364 struct page *page; 2365 int stop; 2366 2367 page = get_dump_page(addr); 2368 if (page) { 2369 void *kaddr = kmap(page); 2370 stop = !dump_emit(cprm, kaddr, PAGE_SIZE); 2371 kunmap(page); 2372 put_page(page); 2373 } else 2374 stop = !dump_skip(cprm, PAGE_SIZE); 2375 if (stop) 2376 goto end_coredump; 2377 } 2378 } 2379 dump_truncate(cprm); 2380 2381 if (!elf_core_write_extra_data(cprm)) 2382 goto end_coredump; 2383 2384 if (e_phnum == PN_XNUM) { 2385 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum))) 2386 goto end_coredump; 2387 } 2388 2389 end_coredump: 2390 set_fs(fs); 2391 2392 cleanup: 2393 free_note_info(&info); 2394 kfree(shdr4extnum); 2395 kvfree(vma_filesz); 2396 kfree(phdr4note); 2397 kfree(elf); 2398 out: 2399 return has_dumped; 2400 } 2401 2402 #endif /* CONFIG_ELF_CORE */ 2403 2404 static int __init init_elf_binfmt(void) 2405 { 2406 register_binfmt(&elf_format); 2407 return 0; 2408 } 2409 2410 static void __exit exit_elf_binfmt(void) 2411 { 2412 /* Remove the COFF and ELF loaders. */ 2413 unregister_binfmt(&elf_format); 2414 } 2415 2416 core_initcall(init_elf_binfmt); 2417 module_exit(exit_elf_binfmt); 2418 MODULE_LICENSE("GPL"); 2419