xref: /openbmc/linux/fs/binfmt_elf.c (revision 78560d41)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * linux/fs/binfmt_elf.c
4  *
5  * These are the functions used to load ELF format executables as used
6  * on SVr4 machines.  Information on the format may be found in the book
7  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
8  * Tools".
9  *
10  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
11  */
12 
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/fs.h>
16 #include <linux/mm.h>
17 #include <linux/mman.h>
18 #include <linux/errno.h>
19 #include <linux/signal.h>
20 #include <linux/binfmts.h>
21 #include <linux/string.h>
22 #include <linux/file.h>
23 #include <linux/slab.h>
24 #include <linux/personality.h>
25 #include <linux/elfcore.h>
26 #include <linux/init.h>
27 #include <linux/highuid.h>
28 #include <linux/compiler.h>
29 #include <linux/highmem.h>
30 #include <linux/pagemap.h>
31 #include <linux/vmalloc.h>
32 #include <linux/security.h>
33 #include <linux/random.h>
34 #include <linux/elf.h>
35 #include <linux/elf-randomize.h>
36 #include <linux/utsname.h>
37 #include <linux/coredump.h>
38 #include <linux/sched.h>
39 #include <linux/sched/coredump.h>
40 #include <linux/sched/task_stack.h>
41 #include <linux/sched/cputime.h>
42 #include <linux/cred.h>
43 #include <linux/dax.h>
44 #include <linux/uaccess.h>
45 #include <asm/param.h>
46 #include <asm/page.h>
47 
48 #ifndef user_long_t
49 #define user_long_t long
50 #endif
51 #ifndef user_siginfo_t
52 #define user_siginfo_t siginfo_t
53 #endif
54 
55 /* That's for binfmt_elf_fdpic to deal with */
56 #ifndef elf_check_fdpic
57 #define elf_check_fdpic(ex) false
58 #endif
59 
60 static int load_elf_binary(struct linux_binprm *bprm);
61 
62 #ifdef CONFIG_USELIB
63 static int load_elf_library(struct file *);
64 #else
65 #define load_elf_library NULL
66 #endif
67 
68 /*
69  * If we don't support core dumping, then supply a NULL so we
70  * don't even try.
71  */
72 #ifdef CONFIG_ELF_CORE
73 static int elf_core_dump(struct coredump_params *cprm);
74 #else
75 #define elf_core_dump	NULL
76 #endif
77 
78 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
79 #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
80 #else
81 #define ELF_MIN_ALIGN	PAGE_SIZE
82 #endif
83 
84 #ifndef ELF_CORE_EFLAGS
85 #define ELF_CORE_EFLAGS	0
86 #endif
87 
88 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
89 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
90 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
91 
92 static struct linux_binfmt elf_format = {
93 	.module		= THIS_MODULE,
94 	.load_binary	= load_elf_binary,
95 	.load_shlib	= load_elf_library,
96 	.core_dump	= elf_core_dump,
97 	.min_coredump	= ELF_EXEC_PAGESIZE,
98 };
99 
100 #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE))
101 
102 static int set_brk(unsigned long start, unsigned long end, int prot)
103 {
104 	start = ELF_PAGEALIGN(start);
105 	end = ELF_PAGEALIGN(end);
106 	if (end > start) {
107 		/*
108 		 * Map the last of the bss segment.
109 		 * If the header is requesting these pages to be
110 		 * executable, honour that (ppc32 needs this).
111 		 */
112 		int error = vm_brk_flags(start, end - start,
113 				prot & PROT_EXEC ? VM_EXEC : 0);
114 		if (error)
115 			return error;
116 	}
117 	current->mm->start_brk = current->mm->brk = end;
118 	return 0;
119 }
120 
121 /* We need to explicitly zero any fractional pages
122    after the data section (i.e. bss).  This would
123    contain the junk from the file that should not
124    be in memory
125  */
126 static int padzero(unsigned long elf_bss)
127 {
128 	unsigned long nbyte;
129 
130 	nbyte = ELF_PAGEOFFSET(elf_bss);
131 	if (nbyte) {
132 		nbyte = ELF_MIN_ALIGN - nbyte;
133 		if (clear_user((void __user *) elf_bss, nbyte))
134 			return -EFAULT;
135 	}
136 	return 0;
137 }
138 
139 /* Let's use some macros to make this stack manipulation a little clearer */
140 #ifdef CONFIG_STACK_GROWSUP
141 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
142 #define STACK_ROUND(sp, items) \
143 	((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
144 #define STACK_ALLOC(sp, len) ({ \
145 	elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
146 	old_sp; })
147 #else
148 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
149 #define STACK_ROUND(sp, items) \
150 	(((unsigned long) (sp - items)) &~ 15UL)
151 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
152 #endif
153 
154 #ifndef ELF_BASE_PLATFORM
155 /*
156  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
157  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
158  * will be copied to the user stack in the same manner as AT_PLATFORM.
159  */
160 #define ELF_BASE_PLATFORM NULL
161 #endif
162 
163 static int
164 create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
165 		unsigned long load_addr, unsigned long interp_load_addr,
166 		unsigned long e_entry)
167 {
168 	struct mm_struct *mm = current->mm;
169 	unsigned long p = bprm->p;
170 	int argc = bprm->argc;
171 	int envc = bprm->envc;
172 	elf_addr_t __user *sp;
173 	elf_addr_t __user *u_platform;
174 	elf_addr_t __user *u_base_platform;
175 	elf_addr_t __user *u_rand_bytes;
176 	const char *k_platform = ELF_PLATFORM;
177 	const char *k_base_platform = ELF_BASE_PLATFORM;
178 	unsigned char k_rand_bytes[16];
179 	int items;
180 	elf_addr_t *elf_info;
181 	int ei_index;
182 	const struct cred *cred = current_cred();
183 	struct vm_area_struct *vma;
184 
185 	/*
186 	 * In some cases (e.g. Hyper-Threading), we want to avoid L1
187 	 * evictions by the processes running on the same package. One
188 	 * thing we can do is to shuffle the initial stack for them.
189 	 */
190 
191 	p = arch_align_stack(p);
192 
193 	/*
194 	 * If this architecture has a platform capability string, copy it
195 	 * to userspace.  In some cases (Sparc), this info is impossible
196 	 * for userspace to get any other way, in others (i386) it is
197 	 * merely difficult.
198 	 */
199 	u_platform = NULL;
200 	if (k_platform) {
201 		size_t len = strlen(k_platform) + 1;
202 
203 		u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
204 		if (__copy_to_user(u_platform, k_platform, len))
205 			return -EFAULT;
206 	}
207 
208 	/*
209 	 * If this architecture has a "base" platform capability
210 	 * string, copy it to userspace.
211 	 */
212 	u_base_platform = NULL;
213 	if (k_base_platform) {
214 		size_t len = strlen(k_base_platform) + 1;
215 
216 		u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
217 		if (__copy_to_user(u_base_platform, k_base_platform, len))
218 			return -EFAULT;
219 	}
220 
221 	/*
222 	 * Generate 16 random bytes for userspace PRNG seeding.
223 	 */
224 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
225 	u_rand_bytes = (elf_addr_t __user *)
226 		       STACK_ALLOC(p, sizeof(k_rand_bytes));
227 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
228 		return -EFAULT;
229 
230 	/* Create the ELF interpreter info */
231 	elf_info = (elf_addr_t *)mm->saved_auxv;
232 	/* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
233 #define NEW_AUX_ENT(id, val) \
234 	do { \
235 		*elf_info++ = id; \
236 		*elf_info++ = val; \
237 	} while (0)
238 
239 #ifdef ARCH_DLINFO
240 	/*
241 	 * ARCH_DLINFO must come first so PPC can do its special alignment of
242 	 * AUXV.
243 	 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
244 	 * ARCH_DLINFO changes
245 	 */
246 	ARCH_DLINFO;
247 #endif
248 	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
249 	NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
250 	NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
251 	NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
252 	NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
253 	NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
254 	NEW_AUX_ENT(AT_BASE, interp_load_addr);
255 	NEW_AUX_ENT(AT_FLAGS, 0);
256 	NEW_AUX_ENT(AT_ENTRY, e_entry);
257 	NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
258 	NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
259 	NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
260 	NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
261 	NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
262 	NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
263 #ifdef ELF_HWCAP2
264 	NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
265 #endif
266 	NEW_AUX_ENT(AT_EXECFN, bprm->exec);
267 	if (k_platform) {
268 		NEW_AUX_ENT(AT_PLATFORM,
269 			    (elf_addr_t)(unsigned long)u_platform);
270 	}
271 	if (k_base_platform) {
272 		NEW_AUX_ENT(AT_BASE_PLATFORM,
273 			    (elf_addr_t)(unsigned long)u_base_platform);
274 	}
275 	if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
276 		NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
277 	}
278 #undef NEW_AUX_ENT
279 	/* AT_NULL is zero; clear the rest too */
280 	memset(elf_info, 0, (char *)mm->saved_auxv +
281 			sizeof(mm->saved_auxv) - (char *)elf_info);
282 
283 	/* And advance past the AT_NULL entry.  */
284 	elf_info += 2;
285 
286 	ei_index = elf_info - (elf_addr_t *)mm->saved_auxv;
287 	sp = STACK_ADD(p, ei_index);
288 
289 	items = (argc + 1) + (envc + 1) + 1;
290 	bprm->p = STACK_ROUND(sp, items);
291 
292 	/* Point sp at the lowest address on the stack */
293 #ifdef CONFIG_STACK_GROWSUP
294 	sp = (elf_addr_t __user *)bprm->p - items - ei_index;
295 	bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
296 #else
297 	sp = (elf_addr_t __user *)bprm->p;
298 #endif
299 
300 
301 	/*
302 	 * Grow the stack manually; some architectures have a limit on how
303 	 * far ahead a user-space access may be in order to grow the stack.
304 	 */
305 	vma = find_extend_vma(mm, bprm->p);
306 	if (!vma)
307 		return -EFAULT;
308 
309 	/* Now, let's put argc (and argv, envp if appropriate) on the stack */
310 	if (__put_user(argc, sp++))
311 		return -EFAULT;
312 
313 	/* Populate list of argv pointers back to argv strings. */
314 	p = mm->arg_end = mm->arg_start;
315 	while (argc-- > 0) {
316 		size_t len;
317 		if (__put_user((elf_addr_t)p, sp++))
318 			return -EFAULT;
319 		len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
320 		if (!len || len > MAX_ARG_STRLEN)
321 			return -EINVAL;
322 		p += len;
323 	}
324 	if (__put_user(0, sp++))
325 		return -EFAULT;
326 	mm->arg_end = p;
327 
328 	/* Populate list of envp pointers back to envp strings. */
329 	mm->env_end = mm->env_start = p;
330 	while (envc-- > 0) {
331 		size_t len;
332 		if (__put_user((elf_addr_t)p, sp++))
333 			return -EFAULT;
334 		len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
335 		if (!len || len > MAX_ARG_STRLEN)
336 			return -EINVAL;
337 		p += len;
338 	}
339 	if (__put_user(0, sp++))
340 		return -EFAULT;
341 	mm->env_end = p;
342 
343 	/* Put the elf_info on the stack in the right place.  */
344 	if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t)))
345 		return -EFAULT;
346 	return 0;
347 }
348 
349 #ifndef elf_map
350 
351 static unsigned long elf_map(struct file *filep, unsigned long addr,
352 		const struct elf_phdr *eppnt, int prot, int type,
353 		unsigned long total_size)
354 {
355 	unsigned long map_addr;
356 	unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
357 	unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
358 	addr = ELF_PAGESTART(addr);
359 	size = ELF_PAGEALIGN(size);
360 
361 	/* mmap() will return -EINVAL if given a zero size, but a
362 	 * segment with zero filesize is perfectly valid */
363 	if (!size)
364 		return addr;
365 
366 	/*
367 	* total_size is the size of the ELF (interpreter) image.
368 	* The _first_ mmap needs to know the full size, otherwise
369 	* randomization might put this image into an overlapping
370 	* position with the ELF binary image. (since size < total_size)
371 	* So we first map the 'big' image - and unmap the remainder at
372 	* the end. (which unmap is needed for ELF images with holes.)
373 	*/
374 	if (total_size) {
375 		total_size = ELF_PAGEALIGN(total_size);
376 		map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
377 		if (!BAD_ADDR(map_addr))
378 			vm_munmap(map_addr+size, total_size-size);
379 	} else
380 		map_addr = vm_mmap(filep, addr, size, prot, type, off);
381 
382 	if ((type & MAP_FIXED_NOREPLACE) &&
383 	    PTR_ERR((void *)map_addr) == -EEXIST)
384 		pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n",
385 			task_pid_nr(current), current->comm, (void *)addr);
386 
387 	return(map_addr);
388 }
389 
390 #endif /* !elf_map */
391 
392 static unsigned long total_mapping_size(const struct elf_phdr *cmds, int nr)
393 {
394 	int i, first_idx = -1, last_idx = -1;
395 
396 	for (i = 0; i < nr; i++) {
397 		if (cmds[i].p_type == PT_LOAD) {
398 			last_idx = i;
399 			if (first_idx == -1)
400 				first_idx = i;
401 		}
402 	}
403 	if (first_idx == -1)
404 		return 0;
405 
406 	return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
407 				ELF_PAGESTART(cmds[first_idx].p_vaddr);
408 }
409 
410 static int elf_read(struct file *file, void *buf, size_t len, loff_t pos)
411 {
412 	ssize_t rv;
413 
414 	rv = kernel_read(file, buf, len, &pos);
415 	if (unlikely(rv != len)) {
416 		return (rv < 0) ? rv : -EIO;
417 	}
418 	return 0;
419 }
420 
421 /**
422  * load_elf_phdrs() - load ELF program headers
423  * @elf_ex:   ELF header of the binary whose program headers should be loaded
424  * @elf_file: the opened ELF binary file
425  *
426  * Loads ELF program headers from the binary file elf_file, which has the ELF
427  * header pointed to by elf_ex, into a newly allocated array. The caller is
428  * responsible for freeing the allocated data. Returns an ERR_PTR upon failure.
429  */
430 static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
431 				       struct file *elf_file)
432 {
433 	struct elf_phdr *elf_phdata = NULL;
434 	int retval, err = -1;
435 	unsigned int size;
436 
437 	/*
438 	 * If the size of this structure has changed, then punt, since
439 	 * we will be doing the wrong thing.
440 	 */
441 	if (elf_ex->e_phentsize != sizeof(struct elf_phdr))
442 		goto out;
443 
444 	/* Sanity check the number of program headers... */
445 	/* ...and their total size. */
446 	size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
447 	if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN)
448 		goto out;
449 
450 	elf_phdata = kmalloc(size, GFP_KERNEL);
451 	if (!elf_phdata)
452 		goto out;
453 
454 	/* Read in the program headers */
455 	retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff);
456 	if (retval < 0) {
457 		err = retval;
458 		goto out;
459 	}
460 
461 	/* Success! */
462 	err = 0;
463 out:
464 	if (err) {
465 		kfree(elf_phdata);
466 		elf_phdata = NULL;
467 	}
468 	return elf_phdata;
469 }
470 
471 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE
472 
473 /**
474  * struct arch_elf_state - arch-specific ELF loading state
475  *
476  * This structure is used to preserve architecture specific data during
477  * the loading of an ELF file, throughout the checking of architecture
478  * specific ELF headers & through to the point where the ELF load is
479  * known to be proceeding (ie. SET_PERSONALITY).
480  *
481  * This implementation is a dummy for architectures which require no
482  * specific state.
483  */
484 struct arch_elf_state {
485 };
486 
487 #define INIT_ARCH_ELF_STATE {}
488 
489 /**
490  * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header
491  * @ehdr:	The main ELF header
492  * @phdr:	The program header to check
493  * @elf:	The open ELF file
494  * @is_interp:	True if the phdr is from the interpreter of the ELF being
495  *		loaded, else false.
496  * @state:	Architecture-specific state preserved throughout the process
497  *		of loading the ELF.
498  *
499  * Inspects the program header phdr to validate its correctness and/or
500  * suitability for the system. Called once per ELF program header in the
501  * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its
502  * interpreter.
503  *
504  * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
505  *         with that return code.
506  */
507 static inline int arch_elf_pt_proc(struct elfhdr *ehdr,
508 				   struct elf_phdr *phdr,
509 				   struct file *elf, bool is_interp,
510 				   struct arch_elf_state *state)
511 {
512 	/* Dummy implementation, always proceed */
513 	return 0;
514 }
515 
516 /**
517  * arch_check_elf() - check an ELF executable
518  * @ehdr:	The main ELF header
519  * @has_interp:	True if the ELF has an interpreter, else false.
520  * @interp_ehdr: The interpreter's ELF header
521  * @state:	Architecture-specific state preserved throughout the process
522  *		of loading the ELF.
523  *
524  * Provides a final opportunity for architecture code to reject the loading
525  * of the ELF & cause an exec syscall to return an error. This is called after
526  * all program headers to be checked by arch_elf_pt_proc have been.
527  *
528  * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
529  *         with that return code.
530  */
531 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp,
532 				 struct elfhdr *interp_ehdr,
533 				 struct arch_elf_state *state)
534 {
535 	/* Dummy implementation, always proceed */
536 	return 0;
537 }
538 
539 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */
540 
541 static inline int make_prot(u32 p_flags)
542 {
543 	int prot = 0;
544 
545 	if (p_flags & PF_R)
546 		prot |= PROT_READ;
547 	if (p_flags & PF_W)
548 		prot |= PROT_WRITE;
549 	if (p_flags & PF_X)
550 		prot |= PROT_EXEC;
551 	return prot;
552 }
553 
554 /* This is much more generalized than the library routine read function,
555    so we keep this separate.  Technically the library read function
556    is only provided so that we can read a.out libraries that have
557    an ELF header */
558 
559 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
560 		struct file *interpreter,
561 		unsigned long no_base, struct elf_phdr *interp_elf_phdata)
562 {
563 	struct elf_phdr *eppnt;
564 	unsigned long load_addr = 0;
565 	int load_addr_set = 0;
566 	unsigned long last_bss = 0, elf_bss = 0;
567 	int bss_prot = 0;
568 	unsigned long error = ~0UL;
569 	unsigned long total_size;
570 	int i;
571 
572 	/* First of all, some simple consistency checks */
573 	if (interp_elf_ex->e_type != ET_EXEC &&
574 	    interp_elf_ex->e_type != ET_DYN)
575 		goto out;
576 	if (!elf_check_arch(interp_elf_ex) ||
577 	    elf_check_fdpic(interp_elf_ex))
578 		goto out;
579 	if (!interpreter->f_op->mmap)
580 		goto out;
581 
582 	total_size = total_mapping_size(interp_elf_phdata,
583 					interp_elf_ex->e_phnum);
584 	if (!total_size) {
585 		error = -EINVAL;
586 		goto out;
587 	}
588 
589 	eppnt = interp_elf_phdata;
590 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
591 		if (eppnt->p_type == PT_LOAD) {
592 			int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
593 			int elf_prot = make_prot(eppnt->p_flags);
594 			unsigned long vaddr = 0;
595 			unsigned long k, map_addr;
596 
597 			vaddr = eppnt->p_vaddr;
598 			if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
599 				elf_type |= MAP_FIXED_NOREPLACE;
600 			else if (no_base && interp_elf_ex->e_type == ET_DYN)
601 				load_addr = -vaddr;
602 
603 			map_addr = elf_map(interpreter, load_addr + vaddr,
604 					eppnt, elf_prot, elf_type, total_size);
605 			total_size = 0;
606 			error = map_addr;
607 			if (BAD_ADDR(map_addr))
608 				goto out;
609 
610 			if (!load_addr_set &&
611 			    interp_elf_ex->e_type == ET_DYN) {
612 				load_addr = map_addr - ELF_PAGESTART(vaddr);
613 				load_addr_set = 1;
614 			}
615 
616 			/*
617 			 * Check to see if the section's size will overflow the
618 			 * allowed task size. Note that p_filesz must always be
619 			 * <= p_memsize so it's only necessary to check p_memsz.
620 			 */
621 			k = load_addr + eppnt->p_vaddr;
622 			if (BAD_ADDR(k) ||
623 			    eppnt->p_filesz > eppnt->p_memsz ||
624 			    eppnt->p_memsz > TASK_SIZE ||
625 			    TASK_SIZE - eppnt->p_memsz < k) {
626 				error = -ENOMEM;
627 				goto out;
628 			}
629 
630 			/*
631 			 * Find the end of the file mapping for this phdr, and
632 			 * keep track of the largest address we see for this.
633 			 */
634 			k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
635 			if (k > elf_bss)
636 				elf_bss = k;
637 
638 			/*
639 			 * Do the same thing for the memory mapping - between
640 			 * elf_bss and last_bss is the bss section.
641 			 */
642 			k = load_addr + eppnt->p_vaddr + eppnt->p_memsz;
643 			if (k > last_bss) {
644 				last_bss = k;
645 				bss_prot = elf_prot;
646 			}
647 		}
648 	}
649 
650 	/*
651 	 * Now fill out the bss section: first pad the last page from
652 	 * the file up to the page boundary, and zero it from elf_bss
653 	 * up to the end of the page.
654 	 */
655 	if (padzero(elf_bss)) {
656 		error = -EFAULT;
657 		goto out;
658 	}
659 	/*
660 	 * Next, align both the file and mem bss up to the page size,
661 	 * since this is where elf_bss was just zeroed up to, and where
662 	 * last_bss will end after the vm_brk_flags() below.
663 	 */
664 	elf_bss = ELF_PAGEALIGN(elf_bss);
665 	last_bss = ELF_PAGEALIGN(last_bss);
666 	/* Finally, if there is still more bss to allocate, do it. */
667 	if (last_bss > elf_bss) {
668 		error = vm_brk_flags(elf_bss, last_bss - elf_bss,
669 				bss_prot & PROT_EXEC ? VM_EXEC : 0);
670 		if (error)
671 			goto out;
672 	}
673 
674 	error = load_addr;
675 out:
676 	return error;
677 }
678 
679 /*
680  * These are the functions used to load ELF style executables and shared
681  * libraries.  There is no binary dependent code anywhere else.
682  */
683 
684 static int load_elf_binary(struct linux_binprm *bprm)
685 {
686 	struct file *interpreter = NULL; /* to shut gcc up */
687  	unsigned long load_addr = 0, load_bias = 0;
688 	int load_addr_set = 0;
689 	unsigned long error;
690 	struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
691 	unsigned long elf_bss, elf_brk;
692 	int bss_prot = 0;
693 	int retval, i;
694 	unsigned long elf_entry;
695 	unsigned long e_entry;
696 	unsigned long interp_load_addr = 0;
697 	unsigned long start_code, end_code, start_data, end_data;
698 	unsigned long reloc_func_desc __maybe_unused = 0;
699 	int executable_stack = EXSTACK_DEFAULT;
700 	struct elfhdr *elf_ex = (struct elfhdr *)bprm->buf;
701 	struct {
702 		struct elfhdr interp_elf_ex;
703 	} *loc;
704 	struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
705 	struct mm_struct *mm;
706 	struct pt_regs *regs;
707 
708 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
709 	if (!loc) {
710 		retval = -ENOMEM;
711 		goto out_ret;
712 	}
713 
714 	retval = -ENOEXEC;
715 	/* First of all, some simple consistency checks */
716 	if (memcmp(elf_ex->e_ident, ELFMAG, SELFMAG) != 0)
717 		goto out;
718 
719 	if (elf_ex->e_type != ET_EXEC && elf_ex->e_type != ET_DYN)
720 		goto out;
721 	if (!elf_check_arch(elf_ex))
722 		goto out;
723 	if (elf_check_fdpic(elf_ex))
724 		goto out;
725 	if (!bprm->file->f_op->mmap)
726 		goto out;
727 
728 	elf_phdata = load_elf_phdrs(elf_ex, bprm->file);
729 	if (!elf_phdata)
730 		goto out;
731 
732 	elf_ppnt = elf_phdata;
733 	for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) {
734 		char *elf_interpreter;
735 
736 		if (elf_ppnt->p_type != PT_INTERP)
737 			continue;
738 
739 		/*
740 		 * This is the program interpreter used for shared libraries -
741 		 * for now assume that this is an a.out format binary.
742 		 */
743 		retval = -ENOEXEC;
744 		if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2)
745 			goto out_free_ph;
746 
747 		retval = -ENOMEM;
748 		elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL);
749 		if (!elf_interpreter)
750 			goto out_free_ph;
751 
752 		retval = elf_read(bprm->file, elf_interpreter, elf_ppnt->p_filesz,
753 				  elf_ppnt->p_offset);
754 		if (retval < 0)
755 			goto out_free_interp;
756 		/* make sure path is NULL terminated */
757 		retval = -ENOEXEC;
758 		if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
759 			goto out_free_interp;
760 
761 		interpreter = open_exec(elf_interpreter);
762 		kfree(elf_interpreter);
763 		retval = PTR_ERR(interpreter);
764 		if (IS_ERR(interpreter))
765 			goto out_free_ph;
766 
767 		/*
768 		 * If the binary is not readable then enforce mm->dumpable = 0
769 		 * regardless of the interpreter's permissions.
770 		 */
771 		would_dump(bprm, interpreter);
772 
773 		/* Get the exec headers */
774 		retval = elf_read(interpreter, &loc->interp_elf_ex,
775 				  sizeof(loc->interp_elf_ex), 0);
776 		if (retval < 0)
777 			goto out_free_dentry;
778 
779 		break;
780 
781 out_free_interp:
782 		kfree(elf_interpreter);
783 		goto out_free_ph;
784 	}
785 
786 	elf_ppnt = elf_phdata;
787 	for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++)
788 		switch (elf_ppnt->p_type) {
789 		case PT_GNU_STACK:
790 			if (elf_ppnt->p_flags & PF_X)
791 				executable_stack = EXSTACK_ENABLE_X;
792 			else
793 				executable_stack = EXSTACK_DISABLE_X;
794 			break;
795 
796 		case PT_LOPROC ... PT_HIPROC:
797 			retval = arch_elf_pt_proc(elf_ex, elf_ppnt,
798 						  bprm->file, false,
799 						  &arch_state);
800 			if (retval)
801 				goto out_free_dentry;
802 			break;
803 		}
804 
805 	/* Some simple consistency checks for the interpreter */
806 	if (interpreter) {
807 		retval = -ELIBBAD;
808 		/* Not an ELF interpreter */
809 		if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
810 			goto out_free_dentry;
811 		/* Verify the interpreter has a valid arch */
812 		if (!elf_check_arch(&loc->interp_elf_ex) ||
813 		    elf_check_fdpic(&loc->interp_elf_ex))
814 			goto out_free_dentry;
815 
816 		/* Load the interpreter program headers */
817 		interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex,
818 						   interpreter);
819 		if (!interp_elf_phdata)
820 			goto out_free_dentry;
821 
822 		/* Pass PT_LOPROC..PT_HIPROC headers to arch code */
823 		elf_ppnt = interp_elf_phdata;
824 		for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++)
825 			switch (elf_ppnt->p_type) {
826 			case PT_LOPROC ... PT_HIPROC:
827 				retval = arch_elf_pt_proc(&loc->interp_elf_ex,
828 							  elf_ppnt, interpreter,
829 							  true, &arch_state);
830 				if (retval)
831 					goto out_free_dentry;
832 				break;
833 			}
834 	}
835 
836 	/*
837 	 * Allow arch code to reject the ELF at this point, whilst it's
838 	 * still possible to return an error to the code that invoked
839 	 * the exec syscall.
840 	 */
841 	retval = arch_check_elf(elf_ex,
842 				!!interpreter, &loc->interp_elf_ex,
843 				&arch_state);
844 	if (retval)
845 		goto out_free_dentry;
846 
847 	/* Flush all traces of the currently running executable */
848 	retval = flush_old_exec(bprm);
849 	if (retval)
850 		goto out_free_dentry;
851 
852 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
853 	   may depend on the personality.  */
854 	SET_PERSONALITY2(*elf_ex, &arch_state);
855 	if (elf_read_implies_exec(*elf_ex, executable_stack))
856 		current->personality |= READ_IMPLIES_EXEC;
857 
858 	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
859 		current->flags |= PF_RANDOMIZE;
860 
861 	setup_new_exec(bprm);
862 	install_exec_creds(bprm);
863 
864 	/* Do this so that we can load the interpreter, if need be.  We will
865 	   change some of these later */
866 	retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
867 				 executable_stack);
868 	if (retval < 0)
869 		goto out_free_dentry;
870 
871 	elf_bss = 0;
872 	elf_brk = 0;
873 
874 	start_code = ~0UL;
875 	end_code = 0;
876 	start_data = 0;
877 	end_data = 0;
878 
879 	/* Now we do a little grungy work by mmapping the ELF image into
880 	   the correct location in memory. */
881 	for(i = 0, elf_ppnt = elf_phdata;
882 	    i < elf_ex->e_phnum; i++, elf_ppnt++) {
883 		int elf_prot, elf_flags;
884 		unsigned long k, vaddr;
885 		unsigned long total_size = 0;
886 
887 		if (elf_ppnt->p_type != PT_LOAD)
888 			continue;
889 
890 		if (unlikely (elf_brk > elf_bss)) {
891 			unsigned long nbyte;
892 
893 			/* There was a PT_LOAD segment with p_memsz > p_filesz
894 			   before this one. Map anonymous pages, if needed,
895 			   and clear the area.  */
896 			retval = set_brk(elf_bss + load_bias,
897 					 elf_brk + load_bias,
898 					 bss_prot);
899 			if (retval)
900 				goto out_free_dentry;
901 			nbyte = ELF_PAGEOFFSET(elf_bss);
902 			if (nbyte) {
903 				nbyte = ELF_MIN_ALIGN - nbyte;
904 				if (nbyte > elf_brk - elf_bss)
905 					nbyte = elf_brk - elf_bss;
906 				if (clear_user((void __user *)elf_bss +
907 							load_bias, nbyte)) {
908 					/*
909 					 * This bss-zeroing can fail if the ELF
910 					 * file specifies odd protections. So
911 					 * we don't check the return value
912 					 */
913 				}
914 			}
915 		}
916 
917 		elf_prot = make_prot(elf_ppnt->p_flags);
918 
919 		elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
920 
921 		vaddr = elf_ppnt->p_vaddr;
922 		/*
923 		 * If we are loading ET_EXEC or we have already performed
924 		 * the ET_DYN load_addr calculations, proceed normally.
925 		 */
926 		if (elf_ex->e_type == ET_EXEC || load_addr_set) {
927 			elf_flags |= MAP_FIXED;
928 		} else if (elf_ex->e_type == ET_DYN) {
929 			/*
930 			 * This logic is run once for the first LOAD Program
931 			 * Header for ET_DYN binaries to calculate the
932 			 * randomization (load_bias) for all the LOAD
933 			 * Program Headers, and to calculate the entire
934 			 * size of the ELF mapping (total_size). (Note that
935 			 * load_addr_set is set to true later once the
936 			 * initial mapping is performed.)
937 			 *
938 			 * There are effectively two types of ET_DYN
939 			 * binaries: programs (i.e. PIE: ET_DYN with INTERP)
940 			 * and loaders (ET_DYN without INTERP, since they
941 			 * _are_ the ELF interpreter). The loaders must
942 			 * be loaded away from programs since the program
943 			 * may otherwise collide with the loader (especially
944 			 * for ET_EXEC which does not have a randomized
945 			 * position). For example to handle invocations of
946 			 * "./ld.so someprog" to test out a new version of
947 			 * the loader, the subsequent program that the
948 			 * loader loads must avoid the loader itself, so
949 			 * they cannot share the same load range. Sufficient
950 			 * room for the brk must be allocated with the
951 			 * loader as well, since brk must be available with
952 			 * the loader.
953 			 *
954 			 * Therefore, programs are loaded offset from
955 			 * ELF_ET_DYN_BASE and loaders are loaded into the
956 			 * independently randomized mmap region (0 load_bias
957 			 * without MAP_FIXED).
958 			 */
959 			if (interpreter) {
960 				load_bias = ELF_ET_DYN_BASE;
961 				if (current->flags & PF_RANDOMIZE)
962 					load_bias += arch_mmap_rnd();
963 				elf_flags |= MAP_FIXED;
964 			} else
965 				load_bias = 0;
966 
967 			/*
968 			 * Since load_bias is used for all subsequent loading
969 			 * calculations, we must lower it by the first vaddr
970 			 * so that the remaining calculations based on the
971 			 * ELF vaddrs will be correctly offset. The result
972 			 * is then page aligned.
973 			 */
974 			load_bias = ELF_PAGESTART(load_bias - vaddr);
975 
976 			total_size = total_mapping_size(elf_phdata,
977 							elf_ex->e_phnum);
978 			if (!total_size) {
979 				retval = -EINVAL;
980 				goto out_free_dentry;
981 			}
982 		}
983 
984 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
985 				elf_prot, elf_flags, total_size);
986 		if (BAD_ADDR(error)) {
987 			retval = IS_ERR((void *)error) ?
988 				PTR_ERR((void*)error) : -EINVAL;
989 			goto out_free_dentry;
990 		}
991 
992 		if (!load_addr_set) {
993 			load_addr_set = 1;
994 			load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
995 			if (elf_ex->e_type == ET_DYN) {
996 				load_bias += error -
997 				             ELF_PAGESTART(load_bias + vaddr);
998 				load_addr += load_bias;
999 				reloc_func_desc = load_bias;
1000 			}
1001 		}
1002 		k = elf_ppnt->p_vaddr;
1003 		if ((elf_ppnt->p_flags & PF_X) && k < start_code)
1004 			start_code = k;
1005 		if (start_data < k)
1006 			start_data = k;
1007 
1008 		/*
1009 		 * Check to see if the section's size will overflow the
1010 		 * allowed task size. Note that p_filesz must always be
1011 		 * <= p_memsz so it is only necessary to check p_memsz.
1012 		 */
1013 		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
1014 		    elf_ppnt->p_memsz > TASK_SIZE ||
1015 		    TASK_SIZE - elf_ppnt->p_memsz < k) {
1016 			/* set_brk can never work. Avoid overflows. */
1017 			retval = -EINVAL;
1018 			goto out_free_dentry;
1019 		}
1020 
1021 		k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
1022 
1023 		if (k > elf_bss)
1024 			elf_bss = k;
1025 		if ((elf_ppnt->p_flags & PF_X) && end_code < k)
1026 			end_code = k;
1027 		if (end_data < k)
1028 			end_data = k;
1029 		k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
1030 		if (k > elf_brk) {
1031 			bss_prot = elf_prot;
1032 			elf_brk = k;
1033 		}
1034 	}
1035 
1036 	e_entry = elf_ex->e_entry + load_bias;
1037 	elf_bss += load_bias;
1038 	elf_brk += load_bias;
1039 	start_code += load_bias;
1040 	end_code += load_bias;
1041 	start_data += load_bias;
1042 	end_data += load_bias;
1043 
1044 	/* Calling set_brk effectively mmaps the pages that we need
1045 	 * for the bss and break sections.  We must do this before
1046 	 * mapping in the interpreter, to make sure it doesn't wind
1047 	 * up getting placed where the bss needs to go.
1048 	 */
1049 	retval = set_brk(elf_bss, elf_brk, bss_prot);
1050 	if (retval)
1051 		goto out_free_dentry;
1052 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
1053 		retval = -EFAULT; /* Nobody gets to see this, but.. */
1054 		goto out_free_dentry;
1055 	}
1056 
1057 	if (interpreter) {
1058 		elf_entry = load_elf_interp(&loc->interp_elf_ex,
1059 					    interpreter,
1060 					    load_bias, interp_elf_phdata);
1061 		if (!IS_ERR((void *)elf_entry)) {
1062 			/*
1063 			 * load_elf_interp() returns relocation
1064 			 * adjustment
1065 			 */
1066 			interp_load_addr = elf_entry;
1067 			elf_entry += loc->interp_elf_ex.e_entry;
1068 		}
1069 		if (BAD_ADDR(elf_entry)) {
1070 			retval = IS_ERR((void *)elf_entry) ?
1071 					(int)elf_entry : -EINVAL;
1072 			goto out_free_dentry;
1073 		}
1074 		reloc_func_desc = interp_load_addr;
1075 
1076 		allow_write_access(interpreter);
1077 		fput(interpreter);
1078 	} else {
1079 		elf_entry = e_entry;
1080 		if (BAD_ADDR(elf_entry)) {
1081 			retval = -EINVAL;
1082 			goto out_free_dentry;
1083 		}
1084 	}
1085 
1086 	kfree(interp_elf_phdata);
1087 	kfree(elf_phdata);
1088 
1089 	set_binfmt(&elf_format);
1090 
1091 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
1092 	retval = arch_setup_additional_pages(bprm, !!interpreter);
1093 	if (retval < 0)
1094 		goto out;
1095 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
1096 
1097 	retval = create_elf_tables(bprm, elf_ex,
1098 			  load_addr, interp_load_addr, e_entry);
1099 	if (retval < 0)
1100 		goto out;
1101 
1102 	mm = current->mm;
1103 	mm->end_code = end_code;
1104 	mm->start_code = start_code;
1105 	mm->start_data = start_data;
1106 	mm->end_data = end_data;
1107 	mm->start_stack = bprm->p;
1108 
1109 	if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
1110 		/*
1111 		 * For architectures with ELF randomization, when executing
1112 		 * a loader directly (i.e. no interpreter listed in ELF
1113 		 * headers), move the brk area out of the mmap region
1114 		 * (since it grows up, and may collide early with the stack
1115 		 * growing down), and into the unused ELF_ET_DYN_BASE region.
1116 		 */
1117 		if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
1118 		    elf_ex->e_type == ET_DYN && !interpreter) {
1119 			mm->brk = mm->start_brk = ELF_ET_DYN_BASE;
1120 		}
1121 
1122 		mm->brk = mm->start_brk = arch_randomize_brk(mm);
1123 #ifdef compat_brk_randomized
1124 		current->brk_randomized = 1;
1125 #endif
1126 	}
1127 
1128 	if (current->personality & MMAP_PAGE_ZERO) {
1129 		/* Why this, you ask???  Well SVr4 maps page 0 as read-only,
1130 		   and some applications "depend" upon this behavior.
1131 		   Since we do not have the power to recompile these, we
1132 		   emulate the SVr4 behavior. Sigh. */
1133 		error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
1134 				MAP_FIXED | MAP_PRIVATE, 0);
1135 	}
1136 
1137 	regs = current_pt_regs();
1138 #ifdef ELF_PLAT_INIT
1139 	/*
1140 	 * The ABI may specify that certain registers be set up in special
1141 	 * ways (on i386 %edx is the address of a DT_FINI function, for
1142 	 * example.  In addition, it may also specify (eg, PowerPC64 ELF)
1143 	 * that the e_entry field is the address of the function descriptor
1144 	 * for the startup routine, rather than the address of the startup
1145 	 * routine itself.  This macro performs whatever initialization to
1146 	 * the regs structure is required as well as any relocations to the
1147 	 * function descriptor entries when executing dynamically links apps.
1148 	 */
1149 	ELF_PLAT_INIT(regs, reloc_func_desc);
1150 #endif
1151 
1152 	finalize_exec(bprm);
1153 	start_thread(regs, elf_entry, bprm->p);
1154 	retval = 0;
1155 out:
1156 	kfree(loc);
1157 out_ret:
1158 	return retval;
1159 
1160 	/* error cleanup */
1161 out_free_dentry:
1162 	kfree(interp_elf_phdata);
1163 	allow_write_access(interpreter);
1164 	if (interpreter)
1165 		fput(interpreter);
1166 out_free_ph:
1167 	kfree(elf_phdata);
1168 	goto out;
1169 }
1170 
1171 #ifdef CONFIG_USELIB
1172 /* This is really simpleminded and specialized - we are loading an
1173    a.out library that is given an ELF header. */
1174 static int load_elf_library(struct file *file)
1175 {
1176 	struct elf_phdr *elf_phdata;
1177 	struct elf_phdr *eppnt;
1178 	unsigned long elf_bss, bss, len;
1179 	int retval, error, i, j;
1180 	struct elfhdr elf_ex;
1181 
1182 	error = -ENOEXEC;
1183 	retval = elf_read(file, &elf_ex, sizeof(elf_ex), 0);
1184 	if (retval < 0)
1185 		goto out;
1186 
1187 	if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1188 		goto out;
1189 
1190 	/* First of all, some simple consistency checks */
1191 	if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1192 	    !elf_check_arch(&elf_ex) || !file->f_op->mmap)
1193 		goto out;
1194 	if (elf_check_fdpic(&elf_ex))
1195 		goto out;
1196 
1197 	/* Now read in all of the header information */
1198 
1199 	j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1200 	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1201 
1202 	error = -ENOMEM;
1203 	elf_phdata = kmalloc(j, GFP_KERNEL);
1204 	if (!elf_phdata)
1205 		goto out;
1206 
1207 	eppnt = elf_phdata;
1208 	error = -ENOEXEC;
1209 	retval = elf_read(file, eppnt, j, elf_ex.e_phoff);
1210 	if (retval < 0)
1211 		goto out_free_ph;
1212 
1213 	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1214 		if ((eppnt + i)->p_type == PT_LOAD)
1215 			j++;
1216 	if (j != 1)
1217 		goto out_free_ph;
1218 
1219 	while (eppnt->p_type != PT_LOAD)
1220 		eppnt++;
1221 
1222 	/* Now use mmap to map the library into memory. */
1223 	error = vm_mmap(file,
1224 			ELF_PAGESTART(eppnt->p_vaddr),
1225 			(eppnt->p_filesz +
1226 			 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1227 			PROT_READ | PROT_WRITE | PROT_EXEC,
1228 			MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_DENYWRITE,
1229 			(eppnt->p_offset -
1230 			 ELF_PAGEOFFSET(eppnt->p_vaddr)));
1231 	if (error != ELF_PAGESTART(eppnt->p_vaddr))
1232 		goto out_free_ph;
1233 
1234 	elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1235 	if (padzero(elf_bss)) {
1236 		error = -EFAULT;
1237 		goto out_free_ph;
1238 	}
1239 
1240 	len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr);
1241 	bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr);
1242 	if (bss > len) {
1243 		error = vm_brk(len, bss - len);
1244 		if (error)
1245 			goto out_free_ph;
1246 	}
1247 	error = 0;
1248 
1249 out_free_ph:
1250 	kfree(elf_phdata);
1251 out:
1252 	return error;
1253 }
1254 #endif /* #ifdef CONFIG_USELIB */
1255 
1256 #ifdef CONFIG_ELF_CORE
1257 /*
1258  * ELF core dumper
1259  *
1260  * Modelled on fs/exec.c:aout_core_dump()
1261  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1262  */
1263 
1264 /*
1265  * The purpose of always_dump_vma() is to make sure that special kernel mappings
1266  * that are useful for post-mortem analysis are included in every core dump.
1267  * In that way we ensure that the core dump is fully interpretable later
1268  * without matching up the same kernel and hardware config to see what PC values
1269  * meant. These special mappings include - vDSO, vsyscall, and other
1270  * architecture specific mappings
1271  */
1272 static bool always_dump_vma(struct vm_area_struct *vma)
1273 {
1274 	/* Any vsyscall mappings? */
1275 	if (vma == get_gate_vma(vma->vm_mm))
1276 		return true;
1277 
1278 	/*
1279 	 * Assume that all vmas with a .name op should always be dumped.
1280 	 * If this changes, a new vm_ops field can easily be added.
1281 	 */
1282 	if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma))
1283 		return true;
1284 
1285 	/*
1286 	 * arch_vma_name() returns non-NULL for special architecture mappings,
1287 	 * such as vDSO sections.
1288 	 */
1289 	if (arch_vma_name(vma))
1290 		return true;
1291 
1292 	return false;
1293 }
1294 
1295 /*
1296  * Decide what to dump of a segment, part, all or none.
1297  */
1298 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1299 				   unsigned long mm_flags)
1300 {
1301 #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
1302 
1303 	/* always dump the vdso and vsyscall sections */
1304 	if (always_dump_vma(vma))
1305 		goto whole;
1306 
1307 	if (vma->vm_flags & VM_DONTDUMP)
1308 		return 0;
1309 
1310 	/* support for DAX */
1311 	if (vma_is_dax(vma)) {
1312 		if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED))
1313 			goto whole;
1314 		if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE))
1315 			goto whole;
1316 		return 0;
1317 	}
1318 
1319 	/* Hugetlb memory check */
1320 	if (vma->vm_flags & VM_HUGETLB) {
1321 		if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1322 			goto whole;
1323 		if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1324 			goto whole;
1325 		return 0;
1326 	}
1327 
1328 	/* Do not dump I/O mapped devices or special mappings */
1329 	if (vma->vm_flags & VM_IO)
1330 		return 0;
1331 
1332 	/* By default, dump shared memory if mapped from an anonymous file. */
1333 	if (vma->vm_flags & VM_SHARED) {
1334 		if (file_inode(vma->vm_file)->i_nlink == 0 ?
1335 		    FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1336 			goto whole;
1337 		return 0;
1338 	}
1339 
1340 	/* Dump segments that have been written to.  */
1341 	if (vma->anon_vma && FILTER(ANON_PRIVATE))
1342 		goto whole;
1343 	if (vma->vm_file == NULL)
1344 		return 0;
1345 
1346 	if (FILTER(MAPPED_PRIVATE))
1347 		goto whole;
1348 
1349 	/*
1350 	 * If this looks like the beginning of a DSO or executable mapping,
1351 	 * check for an ELF header.  If we find one, dump the first page to
1352 	 * aid in determining what was mapped here.
1353 	 */
1354 	if (FILTER(ELF_HEADERS) &&
1355 	    vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1356 		u32 __user *header = (u32 __user *) vma->vm_start;
1357 		u32 word;
1358 		mm_segment_t fs = get_fs();
1359 		/*
1360 		 * Doing it this way gets the constant folded by GCC.
1361 		 */
1362 		union {
1363 			u32 cmp;
1364 			char elfmag[SELFMAG];
1365 		} magic;
1366 		BUILD_BUG_ON(SELFMAG != sizeof word);
1367 		magic.elfmag[EI_MAG0] = ELFMAG0;
1368 		magic.elfmag[EI_MAG1] = ELFMAG1;
1369 		magic.elfmag[EI_MAG2] = ELFMAG2;
1370 		magic.elfmag[EI_MAG3] = ELFMAG3;
1371 		/*
1372 		 * Switch to the user "segment" for get_user(),
1373 		 * then put back what elf_core_dump() had in place.
1374 		 */
1375 		set_fs(USER_DS);
1376 		if (unlikely(get_user(word, header)))
1377 			word = 0;
1378 		set_fs(fs);
1379 		if (word == magic.cmp)
1380 			return PAGE_SIZE;
1381 	}
1382 
1383 #undef	FILTER
1384 
1385 	return 0;
1386 
1387 whole:
1388 	return vma->vm_end - vma->vm_start;
1389 }
1390 
1391 /* An ELF note in memory */
1392 struct memelfnote
1393 {
1394 	const char *name;
1395 	int type;
1396 	unsigned int datasz;
1397 	void *data;
1398 };
1399 
1400 static int notesize(struct memelfnote *en)
1401 {
1402 	int sz;
1403 
1404 	sz = sizeof(struct elf_note);
1405 	sz += roundup(strlen(en->name) + 1, 4);
1406 	sz += roundup(en->datasz, 4);
1407 
1408 	return sz;
1409 }
1410 
1411 static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1412 {
1413 	struct elf_note en;
1414 	en.n_namesz = strlen(men->name) + 1;
1415 	en.n_descsz = men->datasz;
1416 	en.n_type = men->type;
1417 
1418 	return dump_emit(cprm, &en, sizeof(en)) &&
1419 	    dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1420 	    dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1421 }
1422 
1423 static void fill_elf_header(struct elfhdr *elf, int segs,
1424 			    u16 machine, u32 flags)
1425 {
1426 	memset(elf, 0, sizeof(*elf));
1427 
1428 	memcpy(elf->e_ident, ELFMAG, SELFMAG);
1429 	elf->e_ident[EI_CLASS] = ELF_CLASS;
1430 	elf->e_ident[EI_DATA] = ELF_DATA;
1431 	elf->e_ident[EI_VERSION] = EV_CURRENT;
1432 	elf->e_ident[EI_OSABI] = ELF_OSABI;
1433 
1434 	elf->e_type = ET_CORE;
1435 	elf->e_machine = machine;
1436 	elf->e_version = EV_CURRENT;
1437 	elf->e_phoff = sizeof(struct elfhdr);
1438 	elf->e_flags = flags;
1439 	elf->e_ehsize = sizeof(struct elfhdr);
1440 	elf->e_phentsize = sizeof(struct elf_phdr);
1441 	elf->e_phnum = segs;
1442 }
1443 
1444 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1445 {
1446 	phdr->p_type = PT_NOTE;
1447 	phdr->p_offset = offset;
1448 	phdr->p_vaddr = 0;
1449 	phdr->p_paddr = 0;
1450 	phdr->p_filesz = sz;
1451 	phdr->p_memsz = 0;
1452 	phdr->p_flags = 0;
1453 	phdr->p_align = 0;
1454 }
1455 
1456 static void fill_note(struct memelfnote *note, const char *name, int type,
1457 		unsigned int sz, void *data)
1458 {
1459 	note->name = name;
1460 	note->type = type;
1461 	note->datasz = sz;
1462 	note->data = data;
1463 }
1464 
1465 /*
1466  * fill up all the fields in prstatus from the given task struct, except
1467  * registers which need to be filled up separately.
1468  */
1469 static void fill_prstatus(struct elf_prstatus *prstatus,
1470 		struct task_struct *p, long signr)
1471 {
1472 	prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1473 	prstatus->pr_sigpend = p->pending.signal.sig[0];
1474 	prstatus->pr_sighold = p->blocked.sig[0];
1475 	rcu_read_lock();
1476 	prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1477 	rcu_read_unlock();
1478 	prstatus->pr_pid = task_pid_vnr(p);
1479 	prstatus->pr_pgrp = task_pgrp_vnr(p);
1480 	prstatus->pr_sid = task_session_vnr(p);
1481 	if (thread_group_leader(p)) {
1482 		struct task_cputime cputime;
1483 
1484 		/*
1485 		 * This is the record for the group leader.  It shows the
1486 		 * group-wide total, not its individual thread total.
1487 		 */
1488 		thread_group_cputime(p, &cputime);
1489 		prstatus->pr_utime = ns_to_kernel_old_timeval(cputime.utime);
1490 		prstatus->pr_stime = ns_to_kernel_old_timeval(cputime.stime);
1491 	} else {
1492 		u64 utime, stime;
1493 
1494 		task_cputime(p, &utime, &stime);
1495 		prstatus->pr_utime = ns_to_kernel_old_timeval(utime);
1496 		prstatus->pr_stime = ns_to_kernel_old_timeval(stime);
1497 	}
1498 
1499 	prstatus->pr_cutime = ns_to_kernel_old_timeval(p->signal->cutime);
1500 	prstatus->pr_cstime = ns_to_kernel_old_timeval(p->signal->cstime);
1501 }
1502 
1503 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1504 		       struct mm_struct *mm)
1505 {
1506 	const struct cred *cred;
1507 	unsigned int i, len;
1508 
1509 	/* first copy the parameters from user space */
1510 	memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1511 
1512 	len = mm->arg_end - mm->arg_start;
1513 	if (len >= ELF_PRARGSZ)
1514 		len = ELF_PRARGSZ-1;
1515 	if (copy_from_user(&psinfo->pr_psargs,
1516 		           (const char __user *)mm->arg_start, len))
1517 		return -EFAULT;
1518 	for(i = 0; i < len; i++)
1519 		if (psinfo->pr_psargs[i] == 0)
1520 			psinfo->pr_psargs[i] = ' ';
1521 	psinfo->pr_psargs[len] = 0;
1522 
1523 	rcu_read_lock();
1524 	psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1525 	rcu_read_unlock();
1526 	psinfo->pr_pid = task_pid_vnr(p);
1527 	psinfo->pr_pgrp = task_pgrp_vnr(p);
1528 	psinfo->pr_sid = task_session_vnr(p);
1529 
1530 	i = p->state ? ffz(~p->state) + 1 : 0;
1531 	psinfo->pr_state = i;
1532 	psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1533 	psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1534 	psinfo->pr_nice = task_nice(p);
1535 	psinfo->pr_flag = p->flags;
1536 	rcu_read_lock();
1537 	cred = __task_cred(p);
1538 	SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1539 	SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1540 	rcu_read_unlock();
1541 	strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1542 
1543 	return 0;
1544 }
1545 
1546 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1547 {
1548 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1549 	int i = 0;
1550 	do
1551 		i += 2;
1552 	while (auxv[i - 2] != AT_NULL);
1553 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1554 }
1555 
1556 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1557 		const kernel_siginfo_t *siginfo)
1558 {
1559 	mm_segment_t old_fs = get_fs();
1560 	set_fs(KERNEL_DS);
1561 	copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo);
1562 	set_fs(old_fs);
1563 	fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1564 }
1565 
1566 #define MAX_FILE_NOTE_SIZE (4*1024*1024)
1567 /*
1568  * Format of NT_FILE note:
1569  *
1570  * long count     -- how many files are mapped
1571  * long page_size -- units for file_ofs
1572  * array of [COUNT] elements of
1573  *   long start
1574  *   long end
1575  *   long file_ofs
1576  * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1577  */
1578 static int fill_files_note(struct memelfnote *note)
1579 {
1580 	struct mm_struct *mm = current->mm;
1581 	struct vm_area_struct *vma;
1582 	unsigned count, size, names_ofs, remaining, n;
1583 	user_long_t *data;
1584 	user_long_t *start_end_ofs;
1585 	char *name_base, *name_curpos;
1586 
1587 	/* *Estimated* file count and total data size needed */
1588 	count = mm->map_count;
1589 	if (count > UINT_MAX / 64)
1590 		return -EINVAL;
1591 	size = count * 64;
1592 
1593 	names_ofs = (2 + 3 * count) * sizeof(data[0]);
1594  alloc:
1595 	if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
1596 		return -EINVAL;
1597 	size = round_up(size, PAGE_SIZE);
1598 	/*
1599 	 * "size" can be 0 here legitimately.
1600 	 * Let it ENOMEM and omit NT_FILE section which will be empty anyway.
1601 	 */
1602 	data = kvmalloc(size, GFP_KERNEL);
1603 	if (ZERO_OR_NULL_PTR(data))
1604 		return -ENOMEM;
1605 
1606 	start_end_ofs = data + 2;
1607 	name_base = name_curpos = ((char *)data) + names_ofs;
1608 	remaining = size - names_ofs;
1609 	count = 0;
1610 	for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) {
1611 		struct file *file;
1612 		const char *filename;
1613 
1614 		file = vma->vm_file;
1615 		if (!file)
1616 			continue;
1617 		filename = file_path(file, name_curpos, remaining);
1618 		if (IS_ERR(filename)) {
1619 			if (PTR_ERR(filename) == -ENAMETOOLONG) {
1620 				kvfree(data);
1621 				size = size * 5 / 4;
1622 				goto alloc;
1623 			}
1624 			continue;
1625 		}
1626 
1627 		/* file_path() fills at the end, move name down */
1628 		/* n = strlen(filename) + 1: */
1629 		n = (name_curpos + remaining) - filename;
1630 		remaining = filename - name_curpos;
1631 		memmove(name_curpos, filename, n);
1632 		name_curpos += n;
1633 
1634 		*start_end_ofs++ = vma->vm_start;
1635 		*start_end_ofs++ = vma->vm_end;
1636 		*start_end_ofs++ = vma->vm_pgoff;
1637 		count++;
1638 	}
1639 
1640 	/* Now we know exact count of files, can store it */
1641 	data[0] = count;
1642 	data[1] = PAGE_SIZE;
1643 	/*
1644 	 * Count usually is less than mm->map_count,
1645 	 * we need to move filenames down.
1646 	 */
1647 	n = mm->map_count - count;
1648 	if (n != 0) {
1649 		unsigned shift_bytes = n * 3 * sizeof(data[0]);
1650 		memmove(name_base - shift_bytes, name_base,
1651 			name_curpos - name_base);
1652 		name_curpos -= shift_bytes;
1653 	}
1654 
1655 	size = name_curpos - (char *)data;
1656 	fill_note(note, "CORE", NT_FILE, size, data);
1657 	return 0;
1658 }
1659 
1660 #ifdef CORE_DUMP_USE_REGSET
1661 #include <linux/regset.h>
1662 
1663 struct elf_thread_core_info {
1664 	struct elf_thread_core_info *next;
1665 	struct task_struct *task;
1666 	struct elf_prstatus prstatus;
1667 	struct memelfnote notes[0];
1668 };
1669 
1670 struct elf_note_info {
1671 	struct elf_thread_core_info *thread;
1672 	struct memelfnote psinfo;
1673 	struct memelfnote signote;
1674 	struct memelfnote auxv;
1675 	struct memelfnote files;
1676 	user_siginfo_t csigdata;
1677 	size_t size;
1678 	int thread_notes;
1679 };
1680 
1681 /*
1682  * When a regset has a writeback hook, we call it on each thread before
1683  * dumping user memory.  On register window machines, this makes sure the
1684  * user memory backing the register data is up to date before we read it.
1685  */
1686 static void do_thread_regset_writeback(struct task_struct *task,
1687 				       const struct user_regset *regset)
1688 {
1689 	if (regset->writeback)
1690 		regset->writeback(task, regset, 1);
1691 }
1692 
1693 #ifndef PRSTATUS_SIZE
1694 #define PRSTATUS_SIZE(S, R) sizeof(S)
1695 #endif
1696 
1697 #ifndef SET_PR_FPVALID
1698 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V))
1699 #endif
1700 
1701 static int fill_thread_core_info(struct elf_thread_core_info *t,
1702 				 const struct user_regset_view *view,
1703 				 long signr, size_t *total)
1704 {
1705 	unsigned int i;
1706 	unsigned int regset0_size = regset_size(t->task, &view->regsets[0]);
1707 
1708 	/*
1709 	 * NT_PRSTATUS is the one special case, because the regset data
1710 	 * goes into the pr_reg field inside the note contents, rather
1711 	 * than being the whole note contents.  We fill the reset in here.
1712 	 * We assume that regset 0 is NT_PRSTATUS.
1713 	 */
1714 	fill_prstatus(&t->prstatus, t->task, signr);
1715 	(void) view->regsets[0].get(t->task, &view->regsets[0], 0, regset0_size,
1716 				    &t->prstatus.pr_reg, NULL);
1717 
1718 	fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1719 		  PRSTATUS_SIZE(t->prstatus, regset0_size), &t->prstatus);
1720 	*total += notesize(&t->notes[0]);
1721 
1722 	do_thread_regset_writeback(t->task, &view->regsets[0]);
1723 
1724 	/*
1725 	 * Each other regset might generate a note too.  For each regset
1726 	 * that has no core_note_type or is inactive, we leave t->notes[i]
1727 	 * all zero and we'll know to skip writing it later.
1728 	 */
1729 	for (i = 1; i < view->n; ++i) {
1730 		const struct user_regset *regset = &view->regsets[i];
1731 		do_thread_regset_writeback(t->task, regset);
1732 		if (regset->core_note_type && regset->get &&
1733 		    (!regset->active || regset->active(t->task, regset) > 0)) {
1734 			int ret;
1735 			size_t size = regset_size(t->task, regset);
1736 			void *data = kmalloc(size, GFP_KERNEL);
1737 			if (unlikely(!data))
1738 				return 0;
1739 			ret = regset->get(t->task, regset,
1740 					  0, size, data, NULL);
1741 			if (unlikely(ret))
1742 				kfree(data);
1743 			else {
1744 				if (regset->core_note_type != NT_PRFPREG)
1745 					fill_note(&t->notes[i], "LINUX",
1746 						  regset->core_note_type,
1747 						  size, data);
1748 				else {
1749 					SET_PR_FPVALID(&t->prstatus,
1750 							1, regset0_size);
1751 					fill_note(&t->notes[i], "CORE",
1752 						  NT_PRFPREG, size, data);
1753 				}
1754 				*total += notesize(&t->notes[i]);
1755 			}
1756 		}
1757 	}
1758 
1759 	return 1;
1760 }
1761 
1762 static int fill_note_info(struct elfhdr *elf, int phdrs,
1763 			  struct elf_note_info *info,
1764 			  const kernel_siginfo_t *siginfo, struct pt_regs *regs)
1765 {
1766 	struct task_struct *dump_task = current;
1767 	const struct user_regset_view *view = task_user_regset_view(dump_task);
1768 	struct elf_thread_core_info *t;
1769 	struct elf_prpsinfo *psinfo;
1770 	struct core_thread *ct;
1771 	unsigned int i;
1772 
1773 	info->size = 0;
1774 	info->thread = NULL;
1775 
1776 	psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1777 	if (psinfo == NULL) {
1778 		info->psinfo.data = NULL; /* So we don't free this wrongly */
1779 		return 0;
1780 	}
1781 
1782 	fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1783 
1784 	/*
1785 	 * Figure out how many notes we're going to need for each thread.
1786 	 */
1787 	info->thread_notes = 0;
1788 	for (i = 0; i < view->n; ++i)
1789 		if (view->regsets[i].core_note_type != 0)
1790 			++info->thread_notes;
1791 
1792 	/*
1793 	 * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1794 	 * since it is our one special case.
1795 	 */
1796 	if (unlikely(info->thread_notes == 0) ||
1797 	    unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1798 		WARN_ON(1);
1799 		return 0;
1800 	}
1801 
1802 	/*
1803 	 * Initialize the ELF file header.
1804 	 */
1805 	fill_elf_header(elf, phdrs,
1806 			view->e_machine, view->e_flags);
1807 
1808 	/*
1809 	 * Allocate a structure for each thread.
1810 	 */
1811 	for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1812 		t = kzalloc(offsetof(struct elf_thread_core_info,
1813 				     notes[info->thread_notes]),
1814 			    GFP_KERNEL);
1815 		if (unlikely(!t))
1816 			return 0;
1817 
1818 		t->task = ct->task;
1819 		if (ct->task == dump_task || !info->thread) {
1820 			t->next = info->thread;
1821 			info->thread = t;
1822 		} else {
1823 			/*
1824 			 * Make sure to keep the original task at
1825 			 * the head of the list.
1826 			 */
1827 			t->next = info->thread->next;
1828 			info->thread->next = t;
1829 		}
1830 	}
1831 
1832 	/*
1833 	 * Now fill in each thread's information.
1834 	 */
1835 	for (t = info->thread; t != NULL; t = t->next)
1836 		if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size))
1837 			return 0;
1838 
1839 	/*
1840 	 * Fill in the two process-wide notes.
1841 	 */
1842 	fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1843 	info->size += notesize(&info->psinfo);
1844 
1845 	fill_siginfo_note(&info->signote, &info->csigdata, siginfo);
1846 	info->size += notesize(&info->signote);
1847 
1848 	fill_auxv_note(&info->auxv, current->mm);
1849 	info->size += notesize(&info->auxv);
1850 
1851 	if (fill_files_note(&info->files) == 0)
1852 		info->size += notesize(&info->files);
1853 
1854 	return 1;
1855 }
1856 
1857 static size_t get_note_info_size(struct elf_note_info *info)
1858 {
1859 	return info->size;
1860 }
1861 
1862 /*
1863  * Write all the notes for each thread.  When writing the first thread, the
1864  * process-wide notes are interleaved after the first thread-specific note.
1865  */
1866 static int write_note_info(struct elf_note_info *info,
1867 			   struct coredump_params *cprm)
1868 {
1869 	bool first = true;
1870 	struct elf_thread_core_info *t = info->thread;
1871 
1872 	do {
1873 		int i;
1874 
1875 		if (!writenote(&t->notes[0], cprm))
1876 			return 0;
1877 
1878 		if (first && !writenote(&info->psinfo, cprm))
1879 			return 0;
1880 		if (first && !writenote(&info->signote, cprm))
1881 			return 0;
1882 		if (first && !writenote(&info->auxv, cprm))
1883 			return 0;
1884 		if (first && info->files.data &&
1885 				!writenote(&info->files, cprm))
1886 			return 0;
1887 
1888 		for (i = 1; i < info->thread_notes; ++i)
1889 			if (t->notes[i].data &&
1890 			    !writenote(&t->notes[i], cprm))
1891 				return 0;
1892 
1893 		first = false;
1894 		t = t->next;
1895 	} while (t);
1896 
1897 	return 1;
1898 }
1899 
1900 static void free_note_info(struct elf_note_info *info)
1901 {
1902 	struct elf_thread_core_info *threads = info->thread;
1903 	while (threads) {
1904 		unsigned int i;
1905 		struct elf_thread_core_info *t = threads;
1906 		threads = t->next;
1907 		WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1908 		for (i = 1; i < info->thread_notes; ++i)
1909 			kfree(t->notes[i].data);
1910 		kfree(t);
1911 	}
1912 	kfree(info->psinfo.data);
1913 	kvfree(info->files.data);
1914 }
1915 
1916 #else
1917 
1918 /* Here is the structure in which status of each thread is captured. */
1919 struct elf_thread_status
1920 {
1921 	struct list_head list;
1922 	struct elf_prstatus prstatus;	/* NT_PRSTATUS */
1923 	elf_fpregset_t fpu;		/* NT_PRFPREG */
1924 	struct task_struct *thread;
1925 #ifdef ELF_CORE_COPY_XFPREGS
1926 	elf_fpxregset_t xfpu;		/* ELF_CORE_XFPREG_TYPE */
1927 #endif
1928 	struct memelfnote notes[3];
1929 	int num_notes;
1930 };
1931 
1932 /*
1933  * In order to add the specific thread information for the elf file format,
1934  * we need to keep a linked list of every threads pr_status and then create
1935  * a single section for them in the final core file.
1936  */
1937 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1938 {
1939 	int sz = 0;
1940 	struct task_struct *p = t->thread;
1941 	t->num_notes = 0;
1942 
1943 	fill_prstatus(&t->prstatus, p, signr);
1944 	elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1945 
1946 	fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1947 		  &(t->prstatus));
1948 	t->num_notes++;
1949 	sz += notesize(&t->notes[0]);
1950 
1951 	if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1952 								&t->fpu))) {
1953 		fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1954 			  &(t->fpu));
1955 		t->num_notes++;
1956 		sz += notesize(&t->notes[1]);
1957 	}
1958 
1959 #ifdef ELF_CORE_COPY_XFPREGS
1960 	if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1961 		fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1962 			  sizeof(t->xfpu), &t->xfpu);
1963 		t->num_notes++;
1964 		sz += notesize(&t->notes[2]);
1965 	}
1966 #endif
1967 	return sz;
1968 }
1969 
1970 struct elf_note_info {
1971 	struct memelfnote *notes;
1972 	struct memelfnote *notes_files;
1973 	struct elf_prstatus *prstatus;	/* NT_PRSTATUS */
1974 	struct elf_prpsinfo *psinfo;	/* NT_PRPSINFO */
1975 	struct list_head thread_list;
1976 	elf_fpregset_t *fpu;
1977 #ifdef ELF_CORE_COPY_XFPREGS
1978 	elf_fpxregset_t *xfpu;
1979 #endif
1980 	user_siginfo_t csigdata;
1981 	int thread_status_size;
1982 	int numnote;
1983 };
1984 
1985 static int elf_note_info_init(struct elf_note_info *info)
1986 {
1987 	memset(info, 0, sizeof(*info));
1988 	INIT_LIST_HEAD(&info->thread_list);
1989 
1990 	/* Allocate space for ELF notes */
1991 	info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL);
1992 	if (!info->notes)
1993 		return 0;
1994 	info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1995 	if (!info->psinfo)
1996 		return 0;
1997 	info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1998 	if (!info->prstatus)
1999 		return 0;
2000 	info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
2001 	if (!info->fpu)
2002 		return 0;
2003 #ifdef ELF_CORE_COPY_XFPREGS
2004 	info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
2005 	if (!info->xfpu)
2006 		return 0;
2007 #endif
2008 	return 1;
2009 }
2010 
2011 static int fill_note_info(struct elfhdr *elf, int phdrs,
2012 			  struct elf_note_info *info,
2013 			  const kernel_siginfo_t *siginfo, struct pt_regs *regs)
2014 {
2015 	struct core_thread *ct;
2016 	struct elf_thread_status *ets;
2017 
2018 	if (!elf_note_info_init(info))
2019 		return 0;
2020 
2021 	for (ct = current->mm->core_state->dumper.next;
2022 					ct; ct = ct->next) {
2023 		ets = kzalloc(sizeof(*ets), GFP_KERNEL);
2024 		if (!ets)
2025 			return 0;
2026 
2027 		ets->thread = ct->task;
2028 		list_add(&ets->list, &info->thread_list);
2029 	}
2030 
2031 	list_for_each_entry(ets, &info->thread_list, list) {
2032 		int sz;
2033 
2034 		sz = elf_dump_thread_status(siginfo->si_signo, ets);
2035 		info->thread_status_size += sz;
2036 	}
2037 	/* now collect the dump for the current */
2038 	memset(info->prstatus, 0, sizeof(*info->prstatus));
2039 	fill_prstatus(info->prstatus, current, siginfo->si_signo);
2040 	elf_core_copy_regs(&info->prstatus->pr_reg, regs);
2041 
2042 	/* Set up header */
2043 	fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS);
2044 
2045 	/*
2046 	 * Set up the notes in similar form to SVR4 core dumps made
2047 	 * with info from their /proc.
2048 	 */
2049 
2050 	fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
2051 		  sizeof(*info->prstatus), info->prstatus);
2052 	fill_psinfo(info->psinfo, current->group_leader, current->mm);
2053 	fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
2054 		  sizeof(*info->psinfo), info->psinfo);
2055 
2056 	fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
2057 	fill_auxv_note(info->notes + 3, current->mm);
2058 	info->numnote = 4;
2059 
2060 	if (fill_files_note(info->notes + info->numnote) == 0) {
2061 		info->notes_files = info->notes + info->numnote;
2062 		info->numnote++;
2063 	}
2064 
2065 	/* Try to dump the FPU. */
2066 	info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
2067 							       info->fpu);
2068 	if (info->prstatus->pr_fpvalid)
2069 		fill_note(info->notes + info->numnote++,
2070 			  "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
2071 #ifdef ELF_CORE_COPY_XFPREGS
2072 	if (elf_core_copy_task_xfpregs(current, info->xfpu))
2073 		fill_note(info->notes + info->numnote++,
2074 			  "LINUX", ELF_CORE_XFPREG_TYPE,
2075 			  sizeof(*info->xfpu), info->xfpu);
2076 #endif
2077 
2078 	return 1;
2079 }
2080 
2081 static size_t get_note_info_size(struct elf_note_info *info)
2082 {
2083 	int sz = 0;
2084 	int i;
2085 
2086 	for (i = 0; i < info->numnote; i++)
2087 		sz += notesize(info->notes + i);
2088 
2089 	sz += info->thread_status_size;
2090 
2091 	return sz;
2092 }
2093 
2094 static int write_note_info(struct elf_note_info *info,
2095 			   struct coredump_params *cprm)
2096 {
2097 	struct elf_thread_status *ets;
2098 	int i;
2099 
2100 	for (i = 0; i < info->numnote; i++)
2101 		if (!writenote(info->notes + i, cprm))
2102 			return 0;
2103 
2104 	/* write out the thread status notes section */
2105 	list_for_each_entry(ets, &info->thread_list, list) {
2106 		for (i = 0; i < ets->num_notes; i++)
2107 			if (!writenote(&ets->notes[i], cprm))
2108 				return 0;
2109 	}
2110 
2111 	return 1;
2112 }
2113 
2114 static void free_note_info(struct elf_note_info *info)
2115 {
2116 	while (!list_empty(&info->thread_list)) {
2117 		struct list_head *tmp = info->thread_list.next;
2118 		list_del(tmp);
2119 		kfree(list_entry(tmp, struct elf_thread_status, list));
2120 	}
2121 
2122 	/* Free data possibly allocated by fill_files_note(): */
2123 	if (info->notes_files)
2124 		kvfree(info->notes_files->data);
2125 
2126 	kfree(info->prstatus);
2127 	kfree(info->psinfo);
2128 	kfree(info->notes);
2129 	kfree(info->fpu);
2130 #ifdef ELF_CORE_COPY_XFPREGS
2131 	kfree(info->xfpu);
2132 #endif
2133 }
2134 
2135 #endif
2136 
2137 static struct vm_area_struct *first_vma(struct task_struct *tsk,
2138 					struct vm_area_struct *gate_vma)
2139 {
2140 	struct vm_area_struct *ret = tsk->mm->mmap;
2141 
2142 	if (ret)
2143 		return ret;
2144 	return gate_vma;
2145 }
2146 /*
2147  * Helper function for iterating across a vma list.  It ensures that the caller
2148  * will visit `gate_vma' prior to terminating the search.
2149  */
2150 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
2151 					struct vm_area_struct *gate_vma)
2152 {
2153 	struct vm_area_struct *ret;
2154 
2155 	ret = this_vma->vm_next;
2156 	if (ret)
2157 		return ret;
2158 	if (this_vma == gate_vma)
2159 		return NULL;
2160 	return gate_vma;
2161 }
2162 
2163 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
2164 			     elf_addr_t e_shoff, int segs)
2165 {
2166 	elf->e_shoff = e_shoff;
2167 	elf->e_shentsize = sizeof(*shdr4extnum);
2168 	elf->e_shnum = 1;
2169 	elf->e_shstrndx = SHN_UNDEF;
2170 
2171 	memset(shdr4extnum, 0, sizeof(*shdr4extnum));
2172 
2173 	shdr4extnum->sh_type = SHT_NULL;
2174 	shdr4extnum->sh_size = elf->e_shnum;
2175 	shdr4extnum->sh_link = elf->e_shstrndx;
2176 	shdr4extnum->sh_info = segs;
2177 }
2178 
2179 /*
2180  * Actual dumper
2181  *
2182  * This is a two-pass process; first we find the offsets of the bits,
2183  * and then they are actually written out.  If we run out of core limit
2184  * we just truncate.
2185  */
2186 static int elf_core_dump(struct coredump_params *cprm)
2187 {
2188 	int has_dumped = 0;
2189 	mm_segment_t fs;
2190 	int segs, i;
2191 	size_t vma_data_size = 0;
2192 	struct vm_area_struct *vma, *gate_vma;
2193 	struct elfhdr elf;
2194 	loff_t offset = 0, dataoff;
2195 	struct elf_note_info info = { };
2196 	struct elf_phdr *phdr4note = NULL;
2197 	struct elf_shdr *shdr4extnum = NULL;
2198 	Elf_Half e_phnum;
2199 	elf_addr_t e_shoff;
2200 	elf_addr_t *vma_filesz = NULL;
2201 
2202 	/*
2203 	 * We no longer stop all VM operations.
2204 	 *
2205 	 * This is because those proceses that could possibly change map_count
2206 	 * or the mmap / vma pages are now blocked in do_exit on current
2207 	 * finishing this core dump.
2208 	 *
2209 	 * Only ptrace can touch these memory addresses, but it doesn't change
2210 	 * the map_count or the pages allocated. So no possibility of crashing
2211 	 * exists while dumping the mm->vm_next areas to the core file.
2212 	 */
2213 
2214 	/*
2215 	 * The number of segs are recored into ELF header as 16bit value.
2216 	 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2217 	 */
2218 	segs = current->mm->map_count;
2219 	segs += elf_core_extra_phdrs();
2220 
2221 	gate_vma = get_gate_vma(current->mm);
2222 	if (gate_vma != NULL)
2223 		segs++;
2224 
2225 	/* for notes section */
2226 	segs++;
2227 
2228 	/* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2229 	 * this, kernel supports extended numbering. Have a look at
2230 	 * include/linux/elf.h for further information. */
2231 	e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2232 
2233 	/*
2234 	 * Collect all the non-memory information about the process for the
2235 	 * notes.  This also sets up the file header.
2236 	 */
2237 	if (!fill_note_info(&elf, e_phnum, &info, cprm->siginfo, cprm->regs))
2238 		goto cleanup;
2239 
2240 	has_dumped = 1;
2241 
2242 	fs = get_fs();
2243 	set_fs(KERNEL_DS);
2244 
2245 	offset += sizeof(elf);				/* Elf header */
2246 	offset += segs * sizeof(struct elf_phdr);	/* Program headers */
2247 
2248 	/* Write notes phdr entry */
2249 	{
2250 		size_t sz = get_note_info_size(&info);
2251 
2252 		sz += elf_coredump_extra_notes_size();
2253 
2254 		phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2255 		if (!phdr4note)
2256 			goto end_coredump;
2257 
2258 		fill_elf_note_phdr(phdr4note, sz, offset);
2259 		offset += sz;
2260 	}
2261 
2262 	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2263 
2264 	/*
2265 	 * Zero vma process will get ZERO_SIZE_PTR here.
2266 	 * Let coredump continue for register state at least.
2267 	 */
2268 	vma_filesz = kvmalloc(array_size(sizeof(*vma_filesz), (segs - 1)),
2269 			      GFP_KERNEL);
2270 	if (!vma_filesz)
2271 		goto end_coredump;
2272 
2273 	for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2274 			vma = next_vma(vma, gate_vma)) {
2275 		unsigned long dump_size;
2276 
2277 		dump_size = vma_dump_size(vma, cprm->mm_flags);
2278 		vma_filesz[i++] = dump_size;
2279 		vma_data_size += dump_size;
2280 	}
2281 
2282 	offset += vma_data_size;
2283 	offset += elf_core_extra_data_size();
2284 	e_shoff = offset;
2285 
2286 	if (e_phnum == PN_XNUM) {
2287 		shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2288 		if (!shdr4extnum)
2289 			goto end_coredump;
2290 		fill_extnum_info(&elf, shdr4extnum, e_shoff, segs);
2291 	}
2292 
2293 	offset = dataoff;
2294 
2295 	if (!dump_emit(cprm, &elf, sizeof(elf)))
2296 		goto end_coredump;
2297 
2298 	if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
2299 		goto end_coredump;
2300 
2301 	/* Write program headers for segments dump */
2302 	for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2303 			vma = next_vma(vma, gate_vma)) {
2304 		struct elf_phdr phdr;
2305 
2306 		phdr.p_type = PT_LOAD;
2307 		phdr.p_offset = offset;
2308 		phdr.p_vaddr = vma->vm_start;
2309 		phdr.p_paddr = 0;
2310 		phdr.p_filesz = vma_filesz[i++];
2311 		phdr.p_memsz = vma->vm_end - vma->vm_start;
2312 		offset += phdr.p_filesz;
2313 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2314 		if (vma->vm_flags & VM_WRITE)
2315 			phdr.p_flags |= PF_W;
2316 		if (vma->vm_flags & VM_EXEC)
2317 			phdr.p_flags |= PF_X;
2318 		phdr.p_align = ELF_EXEC_PAGESIZE;
2319 
2320 		if (!dump_emit(cprm, &phdr, sizeof(phdr)))
2321 			goto end_coredump;
2322 	}
2323 
2324 	if (!elf_core_write_extra_phdrs(cprm, offset))
2325 		goto end_coredump;
2326 
2327  	/* write out the notes section */
2328 	if (!write_note_info(&info, cprm))
2329 		goto end_coredump;
2330 
2331 	if (elf_coredump_extra_notes_write(cprm))
2332 		goto end_coredump;
2333 
2334 	/* Align to page */
2335 	if (!dump_skip(cprm, dataoff - cprm->pos))
2336 		goto end_coredump;
2337 
2338 	for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2339 			vma = next_vma(vma, gate_vma)) {
2340 		unsigned long addr;
2341 		unsigned long end;
2342 
2343 		end = vma->vm_start + vma_filesz[i++];
2344 
2345 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2346 			struct page *page;
2347 			int stop;
2348 
2349 			page = get_dump_page(addr);
2350 			if (page) {
2351 				void *kaddr = kmap(page);
2352 				stop = !dump_emit(cprm, kaddr, PAGE_SIZE);
2353 				kunmap(page);
2354 				put_page(page);
2355 			} else
2356 				stop = !dump_skip(cprm, PAGE_SIZE);
2357 			if (stop)
2358 				goto end_coredump;
2359 		}
2360 	}
2361 	dump_truncate(cprm);
2362 
2363 	if (!elf_core_write_extra_data(cprm))
2364 		goto end_coredump;
2365 
2366 	if (e_phnum == PN_XNUM) {
2367 		if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
2368 			goto end_coredump;
2369 	}
2370 
2371 end_coredump:
2372 	set_fs(fs);
2373 
2374 cleanup:
2375 	free_note_info(&info);
2376 	kfree(shdr4extnum);
2377 	kvfree(vma_filesz);
2378 	kfree(phdr4note);
2379 	return has_dumped;
2380 }
2381 
2382 #endif		/* CONFIG_ELF_CORE */
2383 
2384 static int __init init_elf_binfmt(void)
2385 {
2386 	register_binfmt(&elf_format);
2387 	return 0;
2388 }
2389 
2390 static void __exit exit_elf_binfmt(void)
2391 {
2392 	/* Remove the COFF and ELF loaders. */
2393 	unregister_binfmt(&elf_format);
2394 }
2395 
2396 core_initcall(init_elf_binfmt);
2397 module_exit(exit_elf_binfmt);
2398 MODULE_LICENSE("GPL");
2399