xref: /openbmc/linux/fs/binfmt_elf.c (revision b96fc2f3)
1 /*
2  * linux/fs/binfmt_elf.c
3  *
4  * These are the functions used to load ELF format executables as used
5  * on SVr4 machines.  Information on the format may be found in the book
6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
7  * Tools".
8  *
9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
10  */
11 
12 #include <linux/module.h>
13 #include <linux/kernel.h>
14 #include <linux/fs.h>
15 #include <linux/mm.h>
16 #include <linux/mman.h>
17 #include <linux/errno.h>
18 #include <linux/signal.h>
19 #include <linux/binfmts.h>
20 #include <linux/string.h>
21 #include <linux/file.h>
22 #include <linux/slab.h>
23 #include <linux/personality.h>
24 #include <linux/elfcore.h>
25 #include <linux/init.h>
26 #include <linux/highuid.h>
27 #include <linux/compiler.h>
28 #include <linux/highmem.h>
29 #include <linux/pagemap.h>
30 #include <linux/vmalloc.h>
31 #include <linux/security.h>
32 #include <linux/random.h>
33 #include <linux/elf.h>
34 #include <linux/elf-randomize.h>
35 #include <linux/utsname.h>
36 #include <linux/coredump.h>
37 #include <linux/sched.h>
38 #include <asm/uaccess.h>
39 #include <asm/param.h>
40 #include <asm/page.h>
41 
42 #ifndef user_long_t
43 #define user_long_t long
44 #endif
45 #ifndef user_siginfo_t
46 #define user_siginfo_t siginfo_t
47 #endif
48 
49 static int load_elf_binary(struct linux_binprm *bprm);
50 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
51 				int, int, unsigned long);
52 
53 #ifdef CONFIG_USELIB
54 static int load_elf_library(struct file *);
55 #else
56 #define load_elf_library NULL
57 #endif
58 
59 /*
60  * If we don't support core dumping, then supply a NULL so we
61  * don't even try.
62  */
63 #ifdef CONFIG_ELF_CORE
64 static int elf_core_dump(struct coredump_params *cprm);
65 #else
66 #define elf_core_dump	NULL
67 #endif
68 
69 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
70 #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
71 #else
72 #define ELF_MIN_ALIGN	PAGE_SIZE
73 #endif
74 
75 #ifndef ELF_CORE_EFLAGS
76 #define ELF_CORE_EFLAGS	0
77 #endif
78 
79 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
80 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
81 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
82 
83 static struct linux_binfmt elf_format = {
84 	.module		= THIS_MODULE,
85 	.load_binary	= load_elf_binary,
86 	.load_shlib	= load_elf_library,
87 	.core_dump	= elf_core_dump,
88 	.min_coredump	= ELF_EXEC_PAGESIZE,
89 };
90 
91 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
92 
93 static int set_brk(unsigned long start, unsigned long end)
94 {
95 	start = ELF_PAGEALIGN(start);
96 	end = ELF_PAGEALIGN(end);
97 	if (end > start) {
98 		unsigned long addr;
99 		addr = vm_brk(start, end - start);
100 		if (BAD_ADDR(addr))
101 			return addr;
102 	}
103 	current->mm->start_brk = current->mm->brk = end;
104 	return 0;
105 }
106 
107 /* We need to explicitly zero any fractional pages
108    after the data section (i.e. bss).  This would
109    contain the junk from the file that should not
110    be in memory
111  */
112 static int padzero(unsigned long elf_bss)
113 {
114 	unsigned long nbyte;
115 
116 	nbyte = ELF_PAGEOFFSET(elf_bss);
117 	if (nbyte) {
118 		nbyte = ELF_MIN_ALIGN - nbyte;
119 		if (clear_user((void __user *) elf_bss, nbyte))
120 			return -EFAULT;
121 	}
122 	return 0;
123 }
124 
125 /* Let's use some macros to make this stack manipulation a little clearer */
126 #ifdef CONFIG_STACK_GROWSUP
127 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
128 #define STACK_ROUND(sp, items) \
129 	((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
130 #define STACK_ALLOC(sp, len) ({ \
131 	elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
132 	old_sp; })
133 #else
134 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
135 #define STACK_ROUND(sp, items) \
136 	(((unsigned long) (sp - items)) &~ 15UL)
137 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
138 #endif
139 
140 #ifndef ELF_BASE_PLATFORM
141 /*
142  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
143  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
144  * will be copied to the user stack in the same manner as AT_PLATFORM.
145  */
146 #define ELF_BASE_PLATFORM NULL
147 #endif
148 
149 static int
150 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
151 		unsigned long load_addr, unsigned long interp_load_addr)
152 {
153 	unsigned long p = bprm->p;
154 	int argc = bprm->argc;
155 	int envc = bprm->envc;
156 	elf_addr_t __user *argv;
157 	elf_addr_t __user *envp;
158 	elf_addr_t __user *sp;
159 	elf_addr_t __user *u_platform;
160 	elf_addr_t __user *u_base_platform;
161 	elf_addr_t __user *u_rand_bytes;
162 	const char *k_platform = ELF_PLATFORM;
163 	const char *k_base_platform = ELF_BASE_PLATFORM;
164 	unsigned char k_rand_bytes[16];
165 	int items;
166 	elf_addr_t *elf_info;
167 	int ei_index = 0;
168 	const struct cred *cred = current_cred();
169 	struct vm_area_struct *vma;
170 
171 	/*
172 	 * In some cases (e.g. Hyper-Threading), we want to avoid L1
173 	 * evictions by the processes running on the same package. One
174 	 * thing we can do is to shuffle the initial stack for them.
175 	 */
176 
177 	p = arch_align_stack(p);
178 
179 	/*
180 	 * If this architecture has a platform capability string, copy it
181 	 * to userspace.  In some cases (Sparc), this info is impossible
182 	 * for userspace to get any other way, in others (i386) it is
183 	 * merely difficult.
184 	 */
185 	u_platform = NULL;
186 	if (k_platform) {
187 		size_t len = strlen(k_platform) + 1;
188 
189 		u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
190 		if (__copy_to_user(u_platform, k_platform, len))
191 			return -EFAULT;
192 	}
193 
194 	/*
195 	 * If this architecture has a "base" platform capability
196 	 * string, copy it to userspace.
197 	 */
198 	u_base_platform = NULL;
199 	if (k_base_platform) {
200 		size_t len = strlen(k_base_platform) + 1;
201 
202 		u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
203 		if (__copy_to_user(u_base_platform, k_base_platform, len))
204 			return -EFAULT;
205 	}
206 
207 	/*
208 	 * Generate 16 random bytes for userspace PRNG seeding.
209 	 */
210 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
211 	u_rand_bytes = (elf_addr_t __user *)
212 		       STACK_ALLOC(p, sizeof(k_rand_bytes));
213 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
214 		return -EFAULT;
215 
216 	/* Create the ELF interpreter info */
217 	elf_info = (elf_addr_t *)current->mm->saved_auxv;
218 	/* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
219 #define NEW_AUX_ENT(id, val) \
220 	do { \
221 		elf_info[ei_index++] = id; \
222 		elf_info[ei_index++] = val; \
223 	} while (0)
224 
225 #ifdef ARCH_DLINFO
226 	/*
227 	 * ARCH_DLINFO must come first so PPC can do its special alignment of
228 	 * AUXV.
229 	 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
230 	 * ARCH_DLINFO changes
231 	 */
232 	ARCH_DLINFO;
233 #endif
234 	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
235 	NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
236 	NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
237 	NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
238 	NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
239 	NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
240 	NEW_AUX_ENT(AT_BASE, interp_load_addr);
241 	NEW_AUX_ENT(AT_FLAGS, 0);
242 	NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
243 	NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
244 	NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
245 	NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
246 	NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
247  	NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
248 	NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
249 #ifdef ELF_HWCAP2
250 	NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
251 #endif
252 	NEW_AUX_ENT(AT_EXECFN, bprm->exec);
253 	if (k_platform) {
254 		NEW_AUX_ENT(AT_PLATFORM,
255 			    (elf_addr_t)(unsigned long)u_platform);
256 	}
257 	if (k_base_platform) {
258 		NEW_AUX_ENT(AT_BASE_PLATFORM,
259 			    (elf_addr_t)(unsigned long)u_base_platform);
260 	}
261 	if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
262 		NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
263 	}
264 #undef NEW_AUX_ENT
265 	/* AT_NULL is zero; clear the rest too */
266 	memset(&elf_info[ei_index], 0,
267 	       sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
268 
269 	/* And advance past the AT_NULL entry.  */
270 	ei_index += 2;
271 
272 	sp = STACK_ADD(p, ei_index);
273 
274 	items = (argc + 1) + (envc + 1) + 1;
275 	bprm->p = STACK_ROUND(sp, items);
276 
277 	/* Point sp at the lowest address on the stack */
278 #ifdef CONFIG_STACK_GROWSUP
279 	sp = (elf_addr_t __user *)bprm->p - items - ei_index;
280 	bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
281 #else
282 	sp = (elf_addr_t __user *)bprm->p;
283 #endif
284 
285 
286 	/*
287 	 * Grow the stack manually; some architectures have a limit on how
288 	 * far ahead a user-space access may be in order to grow the stack.
289 	 */
290 	vma = find_extend_vma(current->mm, bprm->p);
291 	if (!vma)
292 		return -EFAULT;
293 
294 	/* Now, let's put argc (and argv, envp if appropriate) on the stack */
295 	if (__put_user(argc, sp++))
296 		return -EFAULT;
297 	argv = sp;
298 	envp = argv + argc + 1;
299 
300 	/* Populate argv and envp */
301 	p = current->mm->arg_end = current->mm->arg_start;
302 	while (argc-- > 0) {
303 		size_t len;
304 		if (__put_user((elf_addr_t)p, argv++))
305 			return -EFAULT;
306 		len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
307 		if (!len || len > MAX_ARG_STRLEN)
308 			return -EINVAL;
309 		p += len;
310 	}
311 	if (__put_user(0, argv))
312 		return -EFAULT;
313 	current->mm->arg_end = current->mm->env_start = p;
314 	while (envc-- > 0) {
315 		size_t len;
316 		if (__put_user((elf_addr_t)p, envp++))
317 			return -EFAULT;
318 		len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
319 		if (!len || len > MAX_ARG_STRLEN)
320 			return -EINVAL;
321 		p += len;
322 	}
323 	if (__put_user(0, envp))
324 		return -EFAULT;
325 	current->mm->env_end = p;
326 
327 	/* Put the elf_info on the stack in the right place.  */
328 	sp = (elf_addr_t __user *)envp + 1;
329 	if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
330 		return -EFAULT;
331 	return 0;
332 }
333 
334 #ifndef elf_map
335 
336 static unsigned long elf_map(struct file *filep, unsigned long addr,
337 		struct elf_phdr *eppnt, int prot, int type,
338 		unsigned long total_size)
339 {
340 	unsigned long map_addr;
341 	unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
342 	unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
343 	addr = ELF_PAGESTART(addr);
344 	size = ELF_PAGEALIGN(size);
345 
346 	/* mmap() will return -EINVAL if given a zero size, but a
347 	 * segment with zero filesize is perfectly valid */
348 	if (!size)
349 		return addr;
350 
351 	/*
352 	* total_size is the size of the ELF (interpreter) image.
353 	* The _first_ mmap needs to know the full size, otherwise
354 	* randomization might put this image into an overlapping
355 	* position with the ELF binary image. (since size < total_size)
356 	* So we first map the 'big' image - and unmap the remainder at
357 	* the end. (which unmap is needed for ELF images with holes.)
358 	*/
359 	if (total_size) {
360 		total_size = ELF_PAGEALIGN(total_size);
361 		map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
362 		if (!BAD_ADDR(map_addr))
363 			vm_munmap(map_addr+size, total_size-size);
364 	} else
365 		map_addr = vm_mmap(filep, addr, size, prot, type, off);
366 
367 	return(map_addr);
368 }
369 
370 #endif /* !elf_map */
371 
372 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
373 {
374 	int i, first_idx = -1, last_idx = -1;
375 
376 	for (i = 0; i < nr; i++) {
377 		if (cmds[i].p_type == PT_LOAD) {
378 			last_idx = i;
379 			if (first_idx == -1)
380 				first_idx = i;
381 		}
382 	}
383 	if (first_idx == -1)
384 		return 0;
385 
386 	return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
387 				ELF_PAGESTART(cmds[first_idx].p_vaddr);
388 }
389 
390 /**
391  * load_elf_phdrs() - load ELF program headers
392  * @elf_ex:   ELF header of the binary whose program headers should be loaded
393  * @elf_file: the opened ELF binary file
394  *
395  * Loads ELF program headers from the binary file elf_file, which has the ELF
396  * header pointed to by elf_ex, into a newly allocated array. The caller is
397  * responsible for freeing the allocated data. Returns an ERR_PTR upon failure.
398  */
399 static struct elf_phdr *load_elf_phdrs(struct elfhdr *elf_ex,
400 				       struct file *elf_file)
401 {
402 	struct elf_phdr *elf_phdata = NULL;
403 	int retval, size, err = -1;
404 
405 	/*
406 	 * If the size of this structure has changed, then punt, since
407 	 * we will be doing the wrong thing.
408 	 */
409 	if (elf_ex->e_phentsize != sizeof(struct elf_phdr))
410 		goto out;
411 
412 	/* Sanity check the number of program headers... */
413 	if (elf_ex->e_phnum < 1 ||
414 		elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
415 		goto out;
416 
417 	/* ...and their total size. */
418 	size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
419 	if (size > ELF_MIN_ALIGN)
420 		goto out;
421 
422 	elf_phdata = kmalloc(size, GFP_KERNEL);
423 	if (!elf_phdata)
424 		goto out;
425 
426 	/* Read in the program headers */
427 	retval = kernel_read(elf_file, elf_ex->e_phoff,
428 			     (char *)elf_phdata, size);
429 	if (retval != size) {
430 		err = (retval < 0) ? retval : -EIO;
431 		goto out;
432 	}
433 
434 	/* Success! */
435 	err = 0;
436 out:
437 	if (err) {
438 		kfree(elf_phdata);
439 		elf_phdata = NULL;
440 	}
441 	return elf_phdata;
442 }
443 
444 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE
445 
446 /**
447  * struct arch_elf_state - arch-specific ELF loading state
448  *
449  * This structure is used to preserve architecture specific data during
450  * the loading of an ELF file, throughout the checking of architecture
451  * specific ELF headers & through to the point where the ELF load is
452  * known to be proceeding (ie. SET_PERSONALITY).
453  *
454  * This implementation is a dummy for architectures which require no
455  * specific state.
456  */
457 struct arch_elf_state {
458 };
459 
460 #define INIT_ARCH_ELF_STATE {}
461 
462 /**
463  * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header
464  * @ehdr:	The main ELF header
465  * @phdr:	The program header to check
466  * @elf:	The open ELF file
467  * @is_interp:	True if the phdr is from the interpreter of the ELF being
468  *		loaded, else false.
469  * @state:	Architecture-specific state preserved throughout the process
470  *		of loading the ELF.
471  *
472  * Inspects the program header phdr to validate its correctness and/or
473  * suitability for the system. Called once per ELF program header in the
474  * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its
475  * interpreter.
476  *
477  * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
478  *         with that return code.
479  */
480 static inline int arch_elf_pt_proc(struct elfhdr *ehdr,
481 				   struct elf_phdr *phdr,
482 				   struct file *elf, bool is_interp,
483 				   struct arch_elf_state *state)
484 {
485 	/* Dummy implementation, always proceed */
486 	return 0;
487 }
488 
489 /**
490  * arch_check_elf() - check a PT_LOPROC..PT_HIPROC ELF program header
491  * @ehdr:	The main ELF header
492  * @has_interp:	True if the ELF has an interpreter, else false.
493  * @state:	Architecture-specific state preserved throughout the process
494  *		of loading the ELF.
495  *
496  * Provides a final opportunity for architecture code to reject the loading
497  * of the ELF & cause an exec syscall to return an error. This is called after
498  * all program headers to be checked by arch_elf_pt_proc have been.
499  *
500  * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
501  *         with that return code.
502  */
503 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp,
504 				 struct arch_elf_state *state)
505 {
506 	/* Dummy implementation, always proceed */
507 	return 0;
508 }
509 
510 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */
511 
512 /* This is much more generalized than the library routine read function,
513    so we keep this separate.  Technically the library read function
514    is only provided so that we can read a.out libraries that have
515    an ELF header */
516 
517 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
518 		struct file *interpreter, unsigned long *interp_map_addr,
519 		unsigned long no_base, struct elf_phdr *interp_elf_phdata)
520 {
521 	struct elf_phdr *eppnt;
522 	unsigned long load_addr = 0;
523 	int load_addr_set = 0;
524 	unsigned long last_bss = 0, elf_bss = 0;
525 	unsigned long error = ~0UL;
526 	unsigned long total_size;
527 	int i;
528 
529 	/* First of all, some simple consistency checks */
530 	if (interp_elf_ex->e_type != ET_EXEC &&
531 	    interp_elf_ex->e_type != ET_DYN)
532 		goto out;
533 	if (!elf_check_arch(interp_elf_ex))
534 		goto out;
535 	if (!interpreter->f_op->mmap)
536 		goto out;
537 
538 	total_size = total_mapping_size(interp_elf_phdata,
539 					interp_elf_ex->e_phnum);
540 	if (!total_size) {
541 		error = -EINVAL;
542 		goto out;
543 	}
544 
545 	eppnt = interp_elf_phdata;
546 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
547 		if (eppnt->p_type == PT_LOAD) {
548 			int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
549 			int elf_prot = 0;
550 			unsigned long vaddr = 0;
551 			unsigned long k, map_addr;
552 
553 			if (eppnt->p_flags & PF_R)
554 		    		elf_prot = PROT_READ;
555 			if (eppnt->p_flags & PF_W)
556 				elf_prot |= PROT_WRITE;
557 			if (eppnt->p_flags & PF_X)
558 				elf_prot |= PROT_EXEC;
559 			vaddr = eppnt->p_vaddr;
560 			if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
561 				elf_type |= MAP_FIXED;
562 			else if (no_base && interp_elf_ex->e_type == ET_DYN)
563 				load_addr = -vaddr;
564 
565 			map_addr = elf_map(interpreter, load_addr + vaddr,
566 					eppnt, elf_prot, elf_type, total_size);
567 			total_size = 0;
568 			if (!*interp_map_addr)
569 				*interp_map_addr = map_addr;
570 			error = map_addr;
571 			if (BAD_ADDR(map_addr))
572 				goto out;
573 
574 			if (!load_addr_set &&
575 			    interp_elf_ex->e_type == ET_DYN) {
576 				load_addr = map_addr - ELF_PAGESTART(vaddr);
577 				load_addr_set = 1;
578 			}
579 
580 			/*
581 			 * Check to see if the section's size will overflow the
582 			 * allowed task size. Note that p_filesz must always be
583 			 * <= p_memsize so it's only necessary to check p_memsz.
584 			 */
585 			k = load_addr + eppnt->p_vaddr;
586 			if (BAD_ADDR(k) ||
587 			    eppnt->p_filesz > eppnt->p_memsz ||
588 			    eppnt->p_memsz > TASK_SIZE ||
589 			    TASK_SIZE - eppnt->p_memsz < k) {
590 				error = -ENOMEM;
591 				goto out;
592 			}
593 
594 			/*
595 			 * Find the end of the file mapping for this phdr, and
596 			 * keep track of the largest address we see for this.
597 			 */
598 			k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
599 			if (k > elf_bss)
600 				elf_bss = k;
601 
602 			/*
603 			 * Do the same thing for the memory mapping - between
604 			 * elf_bss and last_bss is the bss section.
605 			 */
606 			k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
607 			if (k > last_bss)
608 				last_bss = k;
609 		}
610 	}
611 
612 	if (last_bss > elf_bss) {
613 		/*
614 		 * Now fill out the bss section.  First pad the last page up
615 		 * to the page boundary, and then perform a mmap to make sure
616 		 * that there are zero-mapped pages up to and including the
617 		 * last bss page.
618 		 */
619 		if (padzero(elf_bss)) {
620 			error = -EFAULT;
621 			goto out;
622 		}
623 
624 		/* What we have mapped so far */
625 		elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
626 
627 		/* Map the last of the bss segment */
628 		error = vm_brk(elf_bss, last_bss - elf_bss);
629 		if (BAD_ADDR(error))
630 			goto out;
631 	}
632 
633 	error = load_addr;
634 out:
635 	return error;
636 }
637 
638 /*
639  * These are the functions used to load ELF style executables and shared
640  * libraries.  There is no binary dependent code anywhere else.
641  */
642 
643 #ifndef STACK_RND_MASK
644 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))	/* 8MB of VA */
645 #endif
646 
647 static unsigned long randomize_stack_top(unsigned long stack_top)
648 {
649 	unsigned long random_variable = 0;
650 
651 	if ((current->flags & PF_RANDOMIZE) &&
652 		!(current->personality & ADDR_NO_RANDOMIZE)) {
653 		random_variable = (unsigned long) get_random_int();
654 		random_variable &= STACK_RND_MASK;
655 		random_variable <<= PAGE_SHIFT;
656 	}
657 #ifdef CONFIG_STACK_GROWSUP
658 	return PAGE_ALIGN(stack_top) + random_variable;
659 #else
660 	return PAGE_ALIGN(stack_top) - random_variable;
661 #endif
662 }
663 
664 static int load_elf_binary(struct linux_binprm *bprm)
665 {
666 	struct file *interpreter = NULL; /* to shut gcc up */
667  	unsigned long load_addr = 0, load_bias = 0;
668 	int load_addr_set = 0;
669 	char * elf_interpreter = NULL;
670 	unsigned long error;
671 	struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
672 	unsigned long elf_bss, elf_brk;
673 	int retval, i;
674 	unsigned long elf_entry;
675 	unsigned long interp_load_addr = 0;
676 	unsigned long start_code, end_code, start_data, end_data;
677 	unsigned long reloc_func_desc __maybe_unused = 0;
678 	int executable_stack = EXSTACK_DEFAULT;
679 	struct pt_regs *regs = current_pt_regs();
680 	struct {
681 		struct elfhdr elf_ex;
682 		struct elfhdr interp_elf_ex;
683 	} *loc;
684 	struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
685 
686 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
687 	if (!loc) {
688 		retval = -ENOMEM;
689 		goto out_ret;
690 	}
691 
692 	/* Get the exec-header */
693 	loc->elf_ex = *((struct elfhdr *)bprm->buf);
694 
695 	retval = -ENOEXEC;
696 	/* First of all, some simple consistency checks */
697 	if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
698 		goto out;
699 
700 	if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
701 		goto out;
702 	if (!elf_check_arch(&loc->elf_ex))
703 		goto out;
704 	if (!bprm->file->f_op->mmap)
705 		goto out;
706 
707 	elf_phdata = load_elf_phdrs(&loc->elf_ex, bprm->file);
708 	if (!elf_phdata)
709 		goto out;
710 
711 	elf_ppnt = elf_phdata;
712 	elf_bss = 0;
713 	elf_brk = 0;
714 
715 	start_code = ~0UL;
716 	end_code = 0;
717 	start_data = 0;
718 	end_data = 0;
719 
720 	for (i = 0; i < loc->elf_ex.e_phnum; i++) {
721 		if (elf_ppnt->p_type == PT_INTERP) {
722 			/* This is the program interpreter used for
723 			 * shared libraries - for now assume that this
724 			 * is an a.out format binary
725 			 */
726 			retval = -ENOEXEC;
727 			if (elf_ppnt->p_filesz > PATH_MAX ||
728 			    elf_ppnt->p_filesz < 2)
729 				goto out_free_ph;
730 
731 			retval = -ENOMEM;
732 			elf_interpreter = kmalloc(elf_ppnt->p_filesz,
733 						  GFP_KERNEL);
734 			if (!elf_interpreter)
735 				goto out_free_ph;
736 
737 			retval = kernel_read(bprm->file, elf_ppnt->p_offset,
738 					     elf_interpreter,
739 					     elf_ppnt->p_filesz);
740 			if (retval != elf_ppnt->p_filesz) {
741 				if (retval >= 0)
742 					retval = -EIO;
743 				goto out_free_interp;
744 			}
745 			/* make sure path is NULL terminated */
746 			retval = -ENOEXEC;
747 			if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
748 				goto out_free_interp;
749 
750 			interpreter = open_exec(elf_interpreter);
751 			retval = PTR_ERR(interpreter);
752 			if (IS_ERR(interpreter))
753 				goto out_free_interp;
754 
755 			/*
756 			 * If the binary is not readable then enforce
757 			 * mm->dumpable = 0 regardless of the interpreter's
758 			 * permissions.
759 			 */
760 			would_dump(bprm, interpreter);
761 
762 			retval = kernel_read(interpreter, 0, bprm->buf,
763 					     BINPRM_BUF_SIZE);
764 			if (retval != BINPRM_BUF_SIZE) {
765 				if (retval >= 0)
766 					retval = -EIO;
767 				goto out_free_dentry;
768 			}
769 
770 			/* Get the exec headers */
771 			loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
772 			break;
773 		}
774 		elf_ppnt++;
775 	}
776 
777 	elf_ppnt = elf_phdata;
778 	for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
779 		switch (elf_ppnt->p_type) {
780 		case PT_GNU_STACK:
781 			if (elf_ppnt->p_flags & PF_X)
782 				executable_stack = EXSTACK_ENABLE_X;
783 			else
784 				executable_stack = EXSTACK_DISABLE_X;
785 			break;
786 
787 		case PT_LOPROC ... PT_HIPROC:
788 			retval = arch_elf_pt_proc(&loc->elf_ex, elf_ppnt,
789 						  bprm->file, false,
790 						  &arch_state);
791 			if (retval)
792 				goto out_free_dentry;
793 			break;
794 		}
795 
796 	/* Some simple consistency checks for the interpreter */
797 	if (elf_interpreter) {
798 		retval = -ELIBBAD;
799 		/* Not an ELF interpreter */
800 		if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
801 			goto out_free_dentry;
802 		/* Verify the interpreter has a valid arch */
803 		if (!elf_check_arch(&loc->interp_elf_ex))
804 			goto out_free_dentry;
805 
806 		/* Load the interpreter program headers */
807 		interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex,
808 						   interpreter);
809 		if (!interp_elf_phdata)
810 			goto out_free_dentry;
811 
812 		/* Pass PT_LOPROC..PT_HIPROC headers to arch code */
813 		elf_ppnt = interp_elf_phdata;
814 		for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++)
815 			switch (elf_ppnt->p_type) {
816 			case PT_LOPROC ... PT_HIPROC:
817 				retval = arch_elf_pt_proc(&loc->interp_elf_ex,
818 							  elf_ppnt, interpreter,
819 							  true, &arch_state);
820 				if (retval)
821 					goto out_free_dentry;
822 				break;
823 			}
824 	}
825 
826 	/*
827 	 * Allow arch code to reject the ELF at this point, whilst it's
828 	 * still possible to return an error to the code that invoked
829 	 * the exec syscall.
830 	 */
831 	retval = arch_check_elf(&loc->elf_ex, !!interpreter, &arch_state);
832 	if (retval)
833 		goto out_free_dentry;
834 
835 	/* Flush all traces of the currently running executable */
836 	retval = flush_old_exec(bprm);
837 	if (retval)
838 		goto out_free_dentry;
839 
840 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
841 	   may depend on the personality.  */
842 	SET_PERSONALITY2(loc->elf_ex, &arch_state);
843 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
844 		current->personality |= READ_IMPLIES_EXEC;
845 
846 	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
847 		current->flags |= PF_RANDOMIZE;
848 
849 	setup_new_exec(bprm);
850 
851 	/* Do this so that we can load the interpreter, if need be.  We will
852 	   change some of these later */
853 	retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
854 				 executable_stack);
855 	if (retval < 0)
856 		goto out_free_dentry;
857 
858 	current->mm->start_stack = bprm->p;
859 
860 	/* Now we do a little grungy work by mmapping the ELF image into
861 	   the correct location in memory. */
862 	for(i = 0, elf_ppnt = elf_phdata;
863 	    i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
864 		int elf_prot = 0, elf_flags;
865 		unsigned long k, vaddr;
866 		unsigned long total_size = 0;
867 
868 		if (elf_ppnt->p_type != PT_LOAD)
869 			continue;
870 
871 		if (unlikely (elf_brk > elf_bss)) {
872 			unsigned long nbyte;
873 
874 			/* There was a PT_LOAD segment with p_memsz > p_filesz
875 			   before this one. Map anonymous pages, if needed,
876 			   and clear the area.  */
877 			retval = set_brk(elf_bss + load_bias,
878 					 elf_brk + load_bias);
879 			if (retval)
880 				goto out_free_dentry;
881 			nbyte = ELF_PAGEOFFSET(elf_bss);
882 			if (nbyte) {
883 				nbyte = ELF_MIN_ALIGN - nbyte;
884 				if (nbyte > elf_brk - elf_bss)
885 					nbyte = elf_brk - elf_bss;
886 				if (clear_user((void __user *)elf_bss +
887 							load_bias, nbyte)) {
888 					/*
889 					 * This bss-zeroing can fail if the ELF
890 					 * file specifies odd protections. So
891 					 * we don't check the return value
892 					 */
893 				}
894 			}
895 		}
896 
897 		if (elf_ppnt->p_flags & PF_R)
898 			elf_prot |= PROT_READ;
899 		if (elf_ppnt->p_flags & PF_W)
900 			elf_prot |= PROT_WRITE;
901 		if (elf_ppnt->p_flags & PF_X)
902 			elf_prot |= PROT_EXEC;
903 
904 		elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
905 
906 		vaddr = elf_ppnt->p_vaddr;
907 		if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
908 			elf_flags |= MAP_FIXED;
909 		} else if (loc->elf_ex.e_type == ET_DYN) {
910 			/* Try and get dynamic programs out of the way of the
911 			 * default mmap base, as well as whatever program they
912 			 * might try to exec.  This is because the brk will
913 			 * follow the loader, and is not movable.  */
914 			load_bias = ELF_ET_DYN_BASE - vaddr;
915 			if (current->flags & PF_RANDOMIZE)
916 				load_bias += arch_mmap_rnd();
917 			load_bias = ELF_PAGESTART(load_bias);
918 			total_size = total_mapping_size(elf_phdata,
919 							loc->elf_ex.e_phnum);
920 			if (!total_size) {
921 				retval = -EINVAL;
922 				goto out_free_dentry;
923 			}
924 		}
925 
926 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
927 				elf_prot, elf_flags, total_size);
928 		if (BAD_ADDR(error)) {
929 			retval = IS_ERR((void *)error) ?
930 				PTR_ERR((void*)error) : -EINVAL;
931 			goto out_free_dentry;
932 		}
933 
934 		if (!load_addr_set) {
935 			load_addr_set = 1;
936 			load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
937 			if (loc->elf_ex.e_type == ET_DYN) {
938 				load_bias += error -
939 				             ELF_PAGESTART(load_bias + vaddr);
940 				load_addr += load_bias;
941 				reloc_func_desc = load_bias;
942 			}
943 		}
944 		k = elf_ppnt->p_vaddr;
945 		if (k < start_code)
946 			start_code = k;
947 		if (start_data < k)
948 			start_data = k;
949 
950 		/*
951 		 * Check to see if the section's size will overflow the
952 		 * allowed task size. Note that p_filesz must always be
953 		 * <= p_memsz so it is only necessary to check p_memsz.
954 		 */
955 		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
956 		    elf_ppnt->p_memsz > TASK_SIZE ||
957 		    TASK_SIZE - elf_ppnt->p_memsz < k) {
958 			/* set_brk can never work. Avoid overflows. */
959 			retval = -EINVAL;
960 			goto out_free_dentry;
961 		}
962 
963 		k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
964 
965 		if (k > elf_bss)
966 			elf_bss = k;
967 		if ((elf_ppnt->p_flags & PF_X) && end_code < k)
968 			end_code = k;
969 		if (end_data < k)
970 			end_data = k;
971 		k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
972 		if (k > elf_brk)
973 			elf_brk = k;
974 	}
975 
976 	loc->elf_ex.e_entry += load_bias;
977 	elf_bss += load_bias;
978 	elf_brk += load_bias;
979 	start_code += load_bias;
980 	end_code += load_bias;
981 	start_data += load_bias;
982 	end_data += load_bias;
983 
984 	/* Calling set_brk effectively mmaps the pages that we need
985 	 * for the bss and break sections.  We must do this before
986 	 * mapping in the interpreter, to make sure it doesn't wind
987 	 * up getting placed where the bss needs to go.
988 	 */
989 	retval = set_brk(elf_bss, elf_brk);
990 	if (retval)
991 		goto out_free_dentry;
992 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
993 		retval = -EFAULT; /* Nobody gets to see this, but.. */
994 		goto out_free_dentry;
995 	}
996 
997 	if (elf_interpreter) {
998 		unsigned long interp_map_addr = 0;
999 
1000 		elf_entry = load_elf_interp(&loc->interp_elf_ex,
1001 					    interpreter,
1002 					    &interp_map_addr,
1003 					    load_bias, interp_elf_phdata);
1004 		if (!IS_ERR((void *)elf_entry)) {
1005 			/*
1006 			 * load_elf_interp() returns relocation
1007 			 * adjustment
1008 			 */
1009 			interp_load_addr = elf_entry;
1010 			elf_entry += loc->interp_elf_ex.e_entry;
1011 		}
1012 		if (BAD_ADDR(elf_entry)) {
1013 			retval = IS_ERR((void *)elf_entry) ?
1014 					(int)elf_entry : -EINVAL;
1015 			goto out_free_dentry;
1016 		}
1017 		reloc_func_desc = interp_load_addr;
1018 
1019 		allow_write_access(interpreter);
1020 		fput(interpreter);
1021 		kfree(elf_interpreter);
1022 	} else {
1023 		elf_entry = loc->elf_ex.e_entry;
1024 		if (BAD_ADDR(elf_entry)) {
1025 			retval = -EINVAL;
1026 			goto out_free_dentry;
1027 		}
1028 	}
1029 
1030 	kfree(interp_elf_phdata);
1031 	kfree(elf_phdata);
1032 
1033 	set_binfmt(&elf_format);
1034 
1035 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
1036 	retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
1037 	if (retval < 0)
1038 		goto out;
1039 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
1040 
1041 	install_exec_creds(bprm);
1042 	retval = create_elf_tables(bprm, &loc->elf_ex,
1043 			  load_addr, interp_load_addr);
1044 	if (retval < 0)
1045 		goto out;
1046 	/* N.B. passed_fileno might not be initialized? */
1047 	current->mm->end_code = end_code;
1048 	current->mm->start_code = start_code;
1049 	current->mm->start_data = start_data;
1050 	current->mm->end_data = end_data;
1051 	current->mm->start_stack = bprm->p;
1052 
1053 	if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
1054 		current->mm->brk = current->mm->start_brk =
1055 			arch_randomize_brk(current->mm);
1056 #ifdef compat_brk_randomized
1057 		current->brk_randomized = 1;
1058 #endif
1059 	}
1060 
1061 	if (current->personality & MMAP_PAGE_ZERO) {
1062 		/* Why this, you ask???  Well SVr4 maps page 0 as read-only,
1063 		   and some applications "depend" upon this behavior.
1064 		   Since we do not have the power to recompile these, we
1065 		   emulate the SVr4 behavior. Sigh. */
1066 		error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
1067 				MAP_FIXED | MAP_PRIVATE, 0);
1068 	}
1069 
1070 #ifdef ELF_PLAT_INIT
1071 	/*
1072 	 * The ABI may specify that certain registers be set up in special
1073 	 * ways (on i386 %edx is the address of a DT_FINI function, for
1074 	 * example.  In addition, it may also specify (eg, PowerPC64 ELF)
1075 	 * that the e_entry field is the address of the function descriptor
1076 	 * for the startup routine, rather than the address of the startup
1077 	 * routine itself.  This macro performs whatever initialization to
1078 	 * the regs structure is required as well as any relocations to the
1079 	 * function descriptor entries when executing dynamically links apps.
1080 	 */
1081 	ELF_PLAT_INIT(regs, reloc_func_desc);
1082 #endif
1083 
1084 	start_thread(regs, elf_entry, bprm->p);
1085 	retval = 0;
1086 out:
1087 	kfree(loc);
1088 out_ret:
1089 	return retval;
1090 
1091 	/* error cleanup */
1092 out_free_dentry:
1093 	kfree(interp_elf_phdata);
1094 	allow_write_access(interpreter);
1095 	if (interpreter)
1096 		fput(interpreter);
1097 out_free_interp:
1098 	kfree(elf_interpreter);
1099 out_free_ph:
1100 	kfree(elf_phdata);
1101 	goto out;
1102 }
1103 
1104 #ifdef CONFIG_USELIB
1105 /* This is really simpleminded and specialized - we are loading an
1106    a.out library that is given an ELF header. */
1107 static int load_elf_library(struct file *file)
1108 {
1109 	struct elf_phdr *elf_phdata;
1110 	struct elf_phdr *eppnt;
1111 	unsigned long elf_bss, bss, len;
1112 	int retval, error, i, j;
1113 	struct elfhdr elf_ex;
1114 
1115 	error = -ENOEXEC;
1116 	retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1117 	if (retval != sizeof(elf_ex))
1118 		goto out;
1119 
1120 	if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1121 		goto out;
1122 
1123 	/* First of all, some simple consistency checks */
1124 	if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1125 	    !elf_check_arch(&elf_ex) || !file->f_op->mmap)
1126 		goto out;
1127 
1128 	/* Now read in all of the header information */
1129 
1130 	j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1131 	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1132 
1133 	error = -ENOMEM;
1134 	elf_phdata = kmalloc(j, GFP_KERNEL);
1135 	if (!elf_phdata)
1136 		goto out;
1137 
1138 	eppnt = elf_phdata;
1139 	error = -ENOEXEC;
1140 	retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1141 	if (retval != j)
1142 		goto out_free_ph;
1143 
1144 	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1145 		if ((eppnt + i)->p_type == PT_LOAD)
1146 			j++;
1147 	if (j != 1)
1148 		goto out_free_ph;
1149 
1150 	while (eppnt->p_type != PT_LOAD)
1151 		eppnt++;
1152 
1153 	/* Now use mmap to map the library into memory. */
1154 	error = vm_mmap(file,
1155 			ELF_PAGESTART(eppnt->p_vaddr),
1156 			(eppnt->p_filesz +
1157 			 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1158 			PROT_READ | PROT_WRITE | PROT_EXEC,
1159 			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1160 			(eppnt->p_offset -
1161 			 ELF_PAGEOFFSET(eppnt->p_vaddr)));
1162 	if (error != ELF_PAGESTART(eppnt->p_vaddr))
1163 		goto out_free_ph;
1164 
1165 	elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1166 	if (padzero(elf_bss)) {
1167 		error = -EFAULT;
1168 		goto out_free_ph;
1169 	}
1170 
1171 	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1172 			    ELF_MIN_ALIGN - 1);
1173 	bss = eppnt->p_memsz + eppnt->p_vaddr;
1174 	if (bss > len)
1175 		vm_brk(len, bss - len);
1176 	error = 0;
1177 
1178 out_free_ph:
1179 	kfree(elf_phdata);
1180 out:
1181 	return error;
1182 }
1183 #endif /* #ifdef CONFIG_USELIB */
1184 
1185 #ifdef CONFIG_ELF_CORE
1186 /*
1187  * ELF core dumper
1188  *
1189  * Modelled on fs/exec.c:aout_core_dump()
1190  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1191  */
1192 
1193 /*
1194  * The purpose of always_dump_vma() is to make sure that special kernel mappings
1195  * that are useful for post-mortem analysis are included in every core dump.
1196  * In that way we ensure that the core dump is fully interpretable later
1197  * without matching up the same kernel and hardware config to see what PC values
1198  * meant. These special mappings include - vDSO, vsyscall, and other
1199  * architecture specific mappings
1200  */
1201 static bool always_dump_vma(struct vm_area_struct *vma)
1202 {
1203 	/* Any vsyscall mappings? */
1204 	if (vma == get_gate_vma(vma->vm_mm))
1205 		return true;
1206 
1207 	/*
1208 	 * Assume that all vmas with a .name op should always be dumped.
1209 	 * If this changes, a new vm_ops field can easily be added.
1210 	 */
1211 	if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma))
1212 		return true;
1213 
1214 	/*
1215 	 * arch_vma_name() returns non-NULL for special architecture mappings,
1216 	 * such as vDSO sections.
1217 	 */
1218 	if (arch_vma_name(vma))
1219 		return true;
1220 
1221 	return false;
1222 }
1223 
1224 /*
1225  * Decide what to dump of a segment, part, all or none.
1226  */
1227 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1228 				   unsigned long mm_flags)
1229 {
1230 #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
1231 
1232 	/* always dump the vdso and vsyscall sections */
1233 	if (always_dump_vma(vma))
1234 		goto whole;
1235 
1236 	if (vma->vm_flags & VM_DONTDUMP)
1237 		return 0;
1238 
1239 	/* Hugetlb memory check */
1240 	if (vma->vm_flags & VM_HUGETLB) {
1241 		if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1242 			goto whole;
1243 		if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1244 			goto whole;
1245 		return 0;
1246 	}
1247 
1248 	/* Do not dump I/O mapped devices or special mappings */
1249 	if (vma->vm_flags & VM_IO)
1250 		return 0;
1251 
1252 	/* By default, dump shared memory if mapped from an anonymous file. */
1253 	if (vma->vm_flags & VM_SHARED) {
1254 		if (file_inode(vma->vm_file)->i_nlink == 0 ?
1255 		    FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1256 			goto whole;
1257 		return 0;
1258 	}
1259 
1260 	/* Dump segments that have been written to.  */
1261 	if (vma->anon_vma && FILTER(ANON_PRIVATE))
1262 		goto whole;
1263 	if (vma->vm_file == NULL)
1264 		return 0;
1265 
1266 	if (FILTER(MAPPED_PRIVATE))
1267 		goto whole;
1268 
1269 	/*
1270 	 * If this looks like the beginning of a DSO or executable mapping,
1271 	 * check for an ELF header.  If we find one, dump the first page to
1272 	 * aid in determining what was mapped here.
1273 	 */
1274 	if (FILTER(ELF_HEADERS) &&
1275 	    vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1276 		u32 __user *header = (u32 __user *) vma->vm_start;
1277 		u32 word;
1278 		mm_segment_t fs = get_fs();
1279 		/*
1280 		 * Doing it this way gets the constant folded by GCC.
1281 		 */
1282 		union {
1283 			u32 cmp;
1284 			char elfmag[SELFMAG];
1285 		} magic;
1286 		BUILD_BUG_ON(SELFMAG != sizeof word);
1287 		magic.elfmag[EI_MAG0] = ELFMAG0;
1288 		magic.elfmag[EI_MAG1] = ELFMAG1;
1289 		magic.elfmag[EI_MAG2] = ELFMAG2;
1290 		magic.elfmag[EI_MAG3] = ELFMAG3;
1291 		/*
1292 		 * Switch to the user "segment" for get_user(),
1293 		 * then put back what elf_core_dump() had in place.
1294 		 */
1295 		set_fs(USER_DS);
1296 		if (unlikely(get_user(word, header)))
1297 			word = 0;
1298 		set_fs(fs);
1299 		if (word == magic.cmp)
1300 			return PAGE_SIZE;
1301 	}
1302 
1303 #undef	FILTER
1304 
1305 	return 0;
1306 
1307 whole:
1308 	return vma->vm_end - vma->vm_start;
1309 }
1310 
1311 /* An ELF note in memory */
1312 struct memelfnote
1313 {
1314 	const char *name;
1315 	int type;
1316 	unsigned int datasz;
1317 	void *data;
1318 };
1319 
1320 static int notesize(struct memelfnote *en)
1321 {
1322 	int sz;
1323 
1324 	sz = sizeof(struct elf_note);
1325 	sz += roundup(strlen(en->name) + 1, 4);
1326 	sz += roundup(en->datasz, 4);
1327 
1328 	return sz;
1329 }
1330 
1331 static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1332 {
1333 	struct elf_note en;
1334 	en.n_namesz = strlen(men->name) + 1;
1335 	en.n_descsz = men->datasz;
1336 	en.n_type = men->type;
1337 
1338 	return dump_emit(cprm, &en, sizeof(en)) &&
1339 	    dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1340 	    dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1341 }
1342 
1343 static void fill_elf_header(struct elfhdr *elf, int segs,
1344 			    u16 machine, u32 flags)
1345 {
1346 	memset(elf, 0, sizeof(*elf));
1347 
1348 	memcpy(elf->e_ident, ELFMAG, SELFMAG);
1349 	elf->e_ident[EI_CLASS] = ELF_CLASS;
1350 	elf->e_ident[EI_DATA] = ELF_DATA;
1351 	elf->e_ident[EI_VERSION] = EV_CURRENT;
1352 	elf->e_ident[EI_OSABI] = ELF_OSABI;
1353 
1354 	elf->e_type = ET_CORE;
1355 	elf->e_machine = machine;
1356 	elf->e_version = EV_CURRENT;
1357 	elf->e_phoff = sizeof(struct elfhdr);
1358 	elf->e_flags = flags;
1359 	elf->e_ehsize = sizeof(struct elfhdr);
1360 	elf->e_phentsize = sizeof(struct elf_phdr);
1361 	elf->e_phnum = segs;
1362 
1363 	return;
1364 }
1365 
1366 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1367 {
1368 	phdr->p_type = PT_NOTE;
1369 	phdr->p_offset = offset;
1370 	phdr->p_vaddr = 0;
1371 	phdr->p_paddr = 0;
1372 	phdr->p_filesz = sz;
1373 	phdr->p_memsz = 0;
1374 	phdr->p_flags = 0;
1375 	phdr->p_align = 0;
1376 	return;
1377 }
1378 
1379 static void fill_note(struct memelfnote *note, const char *name, int type,
1380 		unsigned int sz, void *data)
1381 {
1382 	note->name = name;
1383 	note->type = type;
1384 	note->datasz = sz;
1385 	note->data = data;
1386 	return;
1387 }
1388 
1389 /*
1390  * fill up all the fields in prstatus from the given task struct, except
1391  * registers which need to be filled up separately.
1392  */
1393 static void fill_prstatus(struct elf_prstatus *prstatus,
1394 		struct task_struct *p, long signr)
1395 {
1396 	prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1397 	prstatus->pr_sigpend = p->pending.signal.sig[0];
1398 	prstatus->pr_sighold = p->blocked.sig[0];
1399 	rcu_read_lock();
1400 	prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1401 	rcu_read_unlock();
1402 	prstatus->pr_pid = task_pid_vnr(p);
1403 	prstatus->pr_pgrp = task_pgrp_vnr(p);
1404 	prstatus->pr_sid = task_session_vnr(p);
1405 	if (thread_group_leader(p)) {
1406 		struct task_cputime cputime;
1407 
1408 		/*
1409 		 * This is the record for the group leader.  It shows the
1410 		 * group-wide total, not its individual thread total.
1411 		 */
1412 		thread_group_cputime(p, &cputime);
1413 		cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1414 		cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1415 	} else {
1416 		cputime_t utime, stime;
1417 
1418 		task_cputime(p, &utime, &stime);
1419 		cputime_to_timeval(utime, &prstatus->pr_utime);
1420 		cputime_to_timeval(stime, &prstatus->pr_stime);
1421 	}
1422 	cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1423 	cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1424 }
1425 
1426 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1427 		       struct mm_struct *mm)
1428 {
1429 	const struct cred *cred;
1430 	unsigned int i, len;
1431 
1432 	/* first copy the parameters from user space */
1433 	memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1434 
1435 	len = mm->arg_end - mm->arg_start;
1436 	if (len >= ELF_PRARGSZ)
1437 		len = ELF_PRARGSZ-1;
1438 	if (copy_from_user(&psinfo->pr_psargs,
1439 		           (const char __user *)mm->arg_start, len))
1440 		return -EFAULT;
1441 	for(i = 0; i < len; i++)
1442 		if (psinfo->pr_psargs[i] == 0)
1443 			psinfo->pr_psargs[i] = ' ';
1444 	psinfo->pr_psargs[len] = 0;
1445 
1446 	rcu_read_lock();
1447 	psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1448 	rcu_read_unlock();
1449 	psinfo->pr_pid = task_pid_vnr(p);
1450 	psinfo->pr_pgrp = task_pgrp_vnr(p);
1451 	psinfo->pr_sid = task_session_vnr(p);
1452 
1453 	i = p->state ? ffz(~p->state) + 1 : 0;
1454 	psinfo->pr_state = i;
1455 	psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1456 	psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1457 	psinfo->pr_nice = task_nice(p);
1458 	psinfo->pr_flag = p->flags;
1459 	rcu_read_lock();
1460 	cred = __task_cred(p);
1461 	SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1462 	SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1463 	rcu_read_unlock();
1464 	strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1465 
1466 	return 0;
1467 }
1468 
1469 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1470 {
1471 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1472 	int i = 0;
1473 	do
1474 		i += 2;
1475 	while (auxv[i - 2] != AT_NULL);
1476 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1477 }
1478 
1479 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1480 		const siginfo_t *siginfo)
1481 {
1482 	mm_segment_t old_fs = get_fs();
1483 	set_fs(KERNEL_DS);
1484 	copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo);
1485 	set_fs(old_fs);
1486 	fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1487 }
1488 
1489 #define MAX_FILE_NOTE_SIZE (4*1024*1024)
1490 /*
1491  * Format of NT_FILE note:
1492  *
1493  * long count     -- how many files are mapped
1494  * long page_size -- units for file_ofs
1495  * array of [COUNT] elements of
1496  *   long start
1497  *   long end
1498  *   long file_ofs
1499  * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1500  */
1501 static int fill_files_note(struct memelfnote *note)
1502 {
1503 	struct vm_area_struct *vma;
1504 	unsigned count, size, names_ofs, remaining, n;
1505 	user_long_t *data;
1506 	user_long_t *start_end_ofs;
1507 	char *name_base, *name_curpos;
1508 
1509 	/* *Estimated* file count and total data size needed */
1510 	count = current->mm->map_count;
1511 	size = count * 64;
1512 
1513 	names_ofs = (2 + 3 * count) * sizeof(data[0]);
1514  alloc:
1515 	if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
1516 		return -EINVAL;
1517 	size = round_up(size, PAGE_SIZE);
1518 	data = vmalloc(size);
1519 	if (!data)
1520 		return -ENOMEM;
1521 
1522 	start_end_ofs = data + 2;
1523 	name_base = name_curpos = ((char *)data) + names_ofs;
1524 	remaining = size - names_ofs;
1525 	count = 0;
1526 	for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1527 		struct file *file;
1528 		const char *filename;
1529 
1530 		file = vma->vm_file;
1531 		if (!file)
1532 			continue;
1533 		filename = file_path(file, name_curpos, remaining);
1534 		if (IS_ERR(filename)) {
1535 			if (PTR_ERR(filename) == -ENAMETOOLONG) {
1536 				vfree(data);
1537 				size = size * 5 / 4;
1538 				goto alloc;
1539 			}
1540 			continue;
1541 		}
1542 
1543 		/* file_path() fills at the end, move name down */
1544 		/* n = strlen(filename) + 1: */
1545 		n = (name_curpos + remaining) - filename;
1546 		remaining = filename - name_curpos;
1547 		memmove(name_curpos, filename, n);
1548 		name_curpos += n;
1549 
1550 		*start_end_ofs++ = vma->vm_start;
1551 		*start_end_ofs++ = vma->vm_end;
1552 		*start_end_ofs++ = vma->vm_pgoff;
1553 		count++;
1554 	}
1555 
1556 	/* Now we know exact count of files, can store it */
1557 	data[0] = count;
1558 	data[1] = PAGE_SIZE;
1559 	/*
1560 	 * Count usually is less than current->mm->map_count,
1561 	 * we need to move filenames down.
1562 	 */
1563 	n = current->mm->map_count - count;
1564 	if (n != 0) {
1565 		unsigned shift_bytes = n * 3 * sizeof(data[0]);
1566 		memmove(name_base - shift_bytes, name_base,
1567 			name_curpos - name_base);
1568 		name_curpos -= shift_bytes;
1569 	}
1570 
1571 	size = name_curpos - (char *)data;
1572 	fill_note(note, "CORE", NT_FILE, size, data);
1573 	return 0;
1574 }
1575 
1576 #ifdef CORE_DUMP_USE_REGSET
1577 #include <linux/regset.h>
1578 
1579 struct elf_thread_core_info {
1580 	struct elf_thread_core_info *next;
1581 	struct task_struct *task;
1582 	struct elf_prstatus prstatus;
1583 	struct memelfnote notes[0];
1584 };
1585 
1586 struct elf_note_info {
1587 	struct elf_thread_core_info *thread;
1588 	struct memelfnote psinfo;
1589 	struct memelfnote signote;
1590 	struct memelfnote auxv;
1591 	struct memelfnote files;
1592 	user_siginfo_t csigdata;
1593 	size_t size;
1594 	int thread_notes;
1595 };
1596 
1597 /*
1598  * When a regset has a writeback hook, we call it on each thread before
1599  * dumping user memory.  On register window machines, this makes sure the
1600  * user memory backing the register data is up to date before we read it.
1601  */
1602 static void do_thread_regset_writeback(struct task_struct *task,
1603 				       const struct user_regset *regset)
1604 {
1605 	if (regset->writeback)
1606 		regset->writeback(task, regset, 1);
1607 }
1608 
1609 #ifndef PR_REG_SIZE
1610 #define PR_REG_SIZE(S) sizeof(S)
1611 #endif
1612 
1613 #ifndef PRSTATUS_SIZE
1614 #define PRSTATUS_SIZE(S) sizeof(S)
1615 #endif
1616 
1617 #ifndef PR_REG_PTR
1618 #define PR_REG_PTR(S) (&((S)->pr_reg))
1619 #endif
1620 
1621 #ifndef SET_PR_FPVALID
1622 #define SET_PR_FPVALID(S, V) ((S)->pr_fpvalid = (V))
1623 #endif
1624 
1625 static int fill_thread_core_info(struct elf_thread_core_info *t,
1626 				 const struct user_regset_view *view,
1627 				 long signr, size_t *total)
1628 {
1629 	unsigned int i;
1630 
1631 	/*
1632 	 * NT_PRSTATUS is the one special case, because the regset data
1633 	 * goes into the pr_reg field inside the note contents, rather
1634 	 * than being the whole note contents.  We fill the reset in here.
1635 	 * We assume that regset 0 is NT_PRSTATUS.
1636 	 */
1637 	fill_prstatus(&t->prstatus, t->task, signr);
1638 	(void) view->regsets[0].get(t->task, &view->regsets[0],
1639 				    0, PR_REG_SIZE(t->prstatus.pr_reg),
1640 				    PR_REG_PTR(&t->prstatus), NULL);
1641 
1642 	fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1643 		  PRSTATUS_SIZE(t->prstatus), &t->prstatus);
1644 	*total += notesize(&t->notes[0]);
1645 
1646 	do_thread_regset_writeback(t->task, &view->regsets[0]);
1647 
1648 	/*
1649 	 * Each other regset might generate a note too.  For each regset
1650 	 * that has no core_note_type or is inactive, we leave t->notes[i]
1651 	 * all zero and we'll know to skip writing it later.
1652 	 */
1653 	for (i = 1; i < view->n; ++i) {
1654 		const struct user_regset *regset = &view->regsets[i];
1655 		do_thread_regset_writeback(t->task, regset);
1656 		if (regset->core_note_type && regset->get &&
1657 		    (!regset->active || regset->active(t->task, regset))) {
1658 			int ret;
1659 			size_t size = regset->n * regset->size;
1660 			void *data = kmalloc(size, GFP_KERNEL);
1661 			if (unlikely(!data))
1662 				return 0;
1663 			ret = regset->get(t->task, regset,
1664 					  0, size, data, NULL);
1665 			if (unlikely(ret))
1666 				kfree(data);
1667 			else {
1668 				if (regset->core_note_type != NT_PRFPREG)
1669 					fill_note(&t->notes[i], "LINUX",
1670 						  regset->core_note_type,
1671 						  size, data);
1672 				else {
1673 					SET_PR_FPVALID(&t->prstatus, 1);
1674 					fill_note(&t->notes[i], "CORE",
1675 						  NT_PRFPREG, size, data);
1676 				}
1677 				*total += notesize(&t->notes[i]);
1678 			}
1679 		}
1680 	}
1681 
1682 	return 1;
1683 }
1684 
1685 static int fill_note_info(struct elfhdr *elf, int phdrs,
1686 			  struct elf_note_info *info,
1687 			  const siginfo_t *siginfo, struct pt_regs *regs)
1688 {
1689 	struct task_struct *dump_task = current;
1690 	const struct user_regset_view *view = task_user_regset_view(dump_task);
1691 	struct elf_thread_core_info *t;
1692 	struct elf_prpsinfo *psinfo;
1693 	struct core_thread *ct;
1694 	unsigned int i;
1695 
1696 	info->size = 0;
1697 	info->thread = NULL;
1698 
1699 	psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1700 	if (psinfo == NULL) {
1701 		info->psinfo.data = NULL; /* So we don't free this wrongly */
1702 		return 0;
1703 	}
1704 
1705 	fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1706 
1707 	/*
1708 	 * Figure out how many notes we're going to need for each thread.
1709 	 */
1710 	info->thread_notes = 0;
1711 	for (i = 0; i < view->n; ++i)
1712 		if (view->regsets[i].core_note_type != 0)
1713 			++info->thread_notes;
1714 
1715 	/*
1716 	 * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1717 	 * since it is our one special case.
1718 	 */
1719 	if (unlikely(info->thread_notes == 0) ||
1720 	    unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1721 		WARN_ON(1);
1722 		return 0;
1723 	}
1724 
1725 	/*
1726 	 * Initialize the ELF file header.
1727 	 */
1728 	fill_elf_header(elf, phdrs,
1729 			view->e_machine, view->e_flags);
1730 
1731 	/*
1732 	 * Allocate a structure for each thread.
1733 	 */
1734 	for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1735 		t = kzalloc(offsetof(struct elf_thread_core_info,
1736 				     notes[info->thread_notes]),
1737 			    GFP_KERNEL);
1738 		if (unlikely(!t))
1739 			return 0;
1740 
1741 		t->task = ct->task;
1742 		if (ct->task == dump_task || !info->thread) {
1743 			t->next = info->thread;
1744 			info->thread = t;
1745 		} else {
1746 			/*
1747 			 * Make sure to keep the original task at
1748 			 * the head of the list.
1749 			 */
1750 			t->next = info->thread->next;
1751 			info->thread->next = t;
1752 		}
1753 	}
1754 
1755 	/*
1756 	 * Now fill in each thread's information.
1757 	 */
1758 	for (t = info->thread; t != NULL; t = t->next)
1759 		if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size))
1760 			return 0;
1761 
1762 	/*
1763 	 * Fill in the two process-wide notes.
1764 	 */
1765 	fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1766 	info->size += notesize(&info->psinfo);
1767 
1768 	fill_siginfo_note(&info->signote, &info->csigdata, siginfo);
1769 	info->size += notesize(&info->signote);
1770 
1771 	fill_auxv_note(&info->auxv, current->mm);
1772 	info->size += notesize(&info->auxv);
1773 
1774 	if (fill_files_note(&info->files) == 0)
1775 		info->size += notesize(&info->files);
1776 
1777 	return 1;
1778 }
1779 
1780 static size_t get_note_info_size(struct elf_note_info *info)
1781 {
1782 	return info->size;
1783 }
1784 
1785 /*
1786  * Write all the notes for each thread.  When writing the first thread, the
1787  * process-wide notes are interleaved after the first thread-specific note.
1788  */
1789 static int write_note_info(struct elf_note_info *info,
1790 			   struct coredump_params *cprm)
1791 {
1792 	bool first = true;
1793 	struct elf_thread_core_info *t = info->thread;
1794 
1795 	do {
1796 		int i;
1797 
1798 		if (!writenote(&t->notes[0], cprm))
1799 			return 0;
1800 
1801 		if (first && !writenote(&info->psinfo, cprm))
1802 			return 0;
1803 		if (first && !writenote(&info->signote, cprm))
1804 			return 0;
1805 		if (first && !writenote(&info->auxv, cprm))
1806 			return 0;
1807 		if (first && info->files.data &&
1808 				!writenote(&info->files, cprm))
1809 			return 0;
1810 
1811 		for (i = 1; i < info->thread_notes; ++i)
1812 			if (t->notes[i].data &&
1813 			    !writenote(&t->notes[i], cprm))
1814 				return 0;
1815 
1816 		first = false;
1817 		t = t->next;
1818 	} while (t);
1819 
1820 	return 1;
1821 }
1822 
1823 static void free_note_info(struct elf_note_info *info)
1824 {
1825 	struct elf_thread_core_info *threads = info->thread;
1826 	while (threads) {
1827 		unsigned int i;
1828 		struct elf_thread_core_info *t = threads;
1829 		threads = t->next;
1830 		WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1831 		for (i = 1; i < info->thread_notes; ++i)
1832 			kfree(t->notes[i].data);
1833 		kfree(t);
1834 	}
1835 	kfree(info->psinfo.data);
1836 	vfree(info->files.data);
1837 }
1838 
1839 #else
1840 
1841 /* Here is the structure in which status of each thread is captured. */
1842 struct elf_thread_status
1843 {
1844 	struct list_head list;
1845 	struct elf_prstatus prstatus;	/* NT_PRSTATUS */
1846 	elf_fpregset_t fpu;		/* NT_PRFPREG */
1847 	struct task_struct *thread;
1848 #ifdef ELF_CORE_COPY_XFPREGS
1849 	elf_fpxregset_t xfpu;		/* ELF_CORE_XFPREG_TYPE */
1850 #endif
1851 	struct memelfnote notes[3];
1852 	int num_notes;
1853 };
1854 
1855 /*
1856  * In order to add the specific thread information for the elf file format,
1857  * we need to keep a linked list of every threads pr_status and then create
1858  * a single section for them in the final core file.
1859  */
1860 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1861 {
1862 	int sz = 0;
1863 	struct task_struct *p = t->thread;
1864 	t->num_notes = 0;
1865 
1866 	fill_prstatus(&t->prstatus, p, signr);
1867 	elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1868 
1869 	fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1870 		  &(t->prstatus));
1871 	t->num_notes++;
1872 	sz += notesize(&t->notes[0]);
1873 
1874 	if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1875 								&t->fpu))) {
1876 		fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1877 			  &(t->fpu));
1878 		t->num_notes++;
1879 		sz += notesize(&t->notes[1]);
1880 	}
1881 
1882 #ifdef ELF_CORE_COPY_XFPREGS
1883 	if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1884 		fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1885 			  sizeof(t->xfpu), &t->xfpu);
1886 		t->num_notes++;
1887 		sz += notesize(&t->notes[2]);
1888 	}
1889 #endif
1890 	return sz;
1891 }
1892 
1893 struct elf_note_info {
1894 	struct memelfnote *notes;
1895 	struct memelfnote *notes_files;
1896 	struct elf_prstatus *prstatus;	/* NT_PRSTATUS */
1897 	struct elf_prpsinfo *psinfo;	/* NT_PRPSINFO */
1898 	struct list_head thread_list;
1899 	elf_fpregset_t *fpu;
1900 #ifdef ELF_CORE_COPY_XFPREGS
1901 	elf_fpxregset_t *xfpu;
1902 #endif
1903 	user_siginfo_t csigdata;
1904 	int thread_status_size;
1905 	int numnote;
1906 };
1907 
1908 static int elf_note_info_init(struct elf_note_info *info)
1909 {
1910 	memset(info, 0, sizeof(*info));
1911 	INIT_LIST_HEAD(&info->thread_list);
1912 
1913 	/* Allocate space for ELF notes */
1914 	info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL);
1915 	if (!info->notes)
1916 		return 0;
1917 	info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1918 	if (!info->psinfo)
1919 		return 0;
1920 	info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1921 	if (!info->prstatus)
1922 		return 0;
1923 	info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1924 	if (!info->fpu)
1925 		return 0;
1926 #ifdef ELF_CORE_COPY_XFPREGS
1927 	info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1928 	if (!info->xfpu)
1929 		return 0;
1930 #endif
1931 	return 1;
1932 }
1933 
1934 static int fill_note_info(struct elfhdr *elf, int phdrs,
1935 			  struct elf_note_info *info,
1936 			  const siginfo_t *siginfo, struct pt_regs *regs)
1937 {
1938 	struct list_head *t;
1939 	struct core_thread *ct;
1940 	struct elf_thread_status *ets;
1941 
1942 	if (!elf_note_info_init(info))
1943 		return 0;
1944 
1945 	for (ct = current->mm->core_state->dumper.next;
1946 					ct; ct = ct->next) {
1947 		ets = kzalloc(sizeof(*ets), GFP_KERNEL);
1948 		if (!ets)
1949 			return 0;
1950 
1951 		ets->thread = ct->task;
1952 		list_add(&ets->list, &info->thread_list);
1953 	}
1954 
1955 	list_for_each(t, &info->thread_list) {
1956 		int sz;
1957 
1958 		ets = list_entry(t, struct elf_thread_status, list);
1959 		sz = elf_dump_thread_status(siginfo->si_signo, ets);
1960 		info->thread_status_size += sz;
1961 	}
1962 	/* now collect the dump for the current */
1963 	memset(info->prstatus, 0, sizeof(*info->prstatus));
1964 	fill_prstatus(info->prstatus, current, siginfo->si_signo);
1965 	elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1966 
1967 	/* Set up header */
1968 	fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS);
1969 
1970 	/*
1971 	 * Set up the notes in similar form to SVR4 core dumps made
1972 	 * with info from their /proc.
1973 	 */
1974 
1975 	fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1976 		  sizeof(*info->prstatus), info->prstatus);
1977 	fill_psinfo(info->psinfo, current->group_leader, current->mm);
1978 	fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1979 		  sizeof(*info->psinfo), info->psinfo);
1980 
1981 	fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
1982 	fill_auxv_note(info->notes + 3, current->mm);
1983 	info->numnote = 4;
1984 
1985 	if (fill_files_note(info->notes + info->numnote) == 0) {
1986 		info->notes_files = info->notes + info->numnote;
1987 		info->numnote++;
1988 	}
1989 
1990 	/* Try to dump the FPU. */
1991 	info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1992 							       info->fpu);
1993 	if (info->prstatus->pr_fpvalid)
1994 		fill_note(info->notes + info->numnote++,
1995 			  "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1996 #ifdef ELF_CORE_COPY_XFPREGS
1997 	if (elf_core_copy_task_xfpregs(current, info->xfpu))
1998 		fill_note(info->notes + info->numnote++,
1999 			  "LINUX", ELF_CORE_XFPREG_TYPE,
2000 			  sizeof(*info->xfpu), info->xfpu);
2001 #endif
2002 
2003 	return 1;
2004 }
2005 
2006 static size_t get_note_info_size(struct elf_note_info *info)
2007 {
2008 	int sz = 0;
2009 	int i;
2010 
2011 	for (i = 0; i < info->numnote; i++)
2012 		sz += notesize(info->notes + i);
2013 
2014 	sz += info->thread_status_size;
2015 
2016 	return sz;
2017 }
2018 
2019 static int write_note_info(struct elf_note_info *info,
2020 			   struct coredump_params *cprm)
2021 {
2022 	int i;
2023 	struct list_head *t;
2024 
2025 	for (i = 0; i < info->numnote; i++)
2026 		if (!writenote(info->notes + i, cprm))
2027 			return 0;
2028 
2029 	/* write out the thread status notes section */
2030 	list_for_each(t, &info->thread_list) {
2031 		struct elf_thread_status *tmp =
2032 				list_entry(t, struct elf_thread_status, list);
2033 
2034 		for (i = 0; i < tmp->num_notes; i++)
2035 			if (!writenote(&tmp->notes[i], cprm))
2036 				return 0;
2037 	}
2038 
2039 	return 1;
2040 }
2041 
2042 static void free_note_info(struct elf_note_info *info)
2043 {
2044 	while (!list_empty(&info->thread_list)) {
2045 		struct list_head *tmp = info->thread_list.next;
2046 		list_del(tmp);
2047 		kfree(list_entry(tmp, struct elf_thread_status, list));
2048 	}
2049 
2050 	/* Free data possibly allocated by fill_files_note(): */
2051 	if (info->notes_files)
2052 		vfree(info->notes_files->data);
2053 
2054 	kfree(info->prstatus);
2055 	kfree(info->psinfo);
2056 	kfree(info->notes);
2057 	kfree(info->fpu);
2058 #ifdef ELF_CORE_COPY_XFPREGS
2059 	kfree(info->xfpu);
2060 #endif
2061 }
2062 
2063 #endif
2064 
2065 static struct vm_area_struct *first_vma(struct task_struct *tsk,
2066 					struct vm_area_struct *gate_vma)
2067 {
2068 	struct vm_area_struct *ret = tsk->mm->mmap;
2069 
2070 	if (ret)
2071 		return ret;
2072 	return gate_vma;
2073 }
2074 /*
2075  * Helper function for iterating across a vma list.  It ensures that the caller
2076  * will visit `gate_vma' prior to terminating the search.
2077  */
2078 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
2079 					struct vm_area_struct *gate_vma)
2080 {
2081 	struct vm_area_struct *ret;
2082 
2083 	ret = this_vma->vm_next;
2084 	if (ret)
2085 		return ret;
2086 	if (this_vma == gate_vma)
2087 		return NULL;
2088 	return gate_vma;
2089 }
2090 
2091 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
2092 			     elf_addr_t e_shoff, int segs)
2093 {
2094 	elf->e_shoff = e_shoff;
2095 	elf->e_shentsize = sizeof(*shdr4extnum);
2096 	elf->e_shnum = 1;
2097 	elf->e_shstrndx = SHN_UNDEF;
2098 
2099 	memset(shdr4extnum, 0, sizeof(*shdr4extnum));
2100 
2101 	shdr4extnum->sh_type = SHT_NULL;
2102 	shdr4extnum->sh_size = elf->e_shnum;
2103 	shdr4extnum->sh_link = elf->e_shstrndx;
2104 	shdr4extnum->sh_info = segs;
2105 }
2106 
2107 /*
2108  * Actual dumper
2109  *
2110  * This is a two-pass process; first we find the offsets of the bits,
2111  * and then they are actually written out.  If we run out of core limit
2112  * we just truncate.
2113  */
2114 static int elf_core_dump(struct coredump_params *cprm)
2115 {
2116 	int has_dumped = 0;
2117 	mm_segment_t fs;
2118 	int segs, i;
2119 	size_t vma_data_size = 0;
2120 	struct vm_area_struct *vma, *gate_vma;
2121 	struct elfhdr *elf = NULL;
2122 	loff_t offset = 0, dataoff;
2123 	struct elf_note_info info = { };
2124 	struct elf_phdr *phdr4note = NULL;
2125 	struct elf_shdr *shdr4extnum = NULL;
2126 	Elf_Half e_phnum;
2127 	elf_addr_t e_shoff;
2128 	elf_addr_t *vma_filesz = NULL;
2129 
2130 	/*
2131 	 * We no longer stop all VM operations.
2132 	 *
2133 	 * This is because those proceses that could possibly change map_count
2134 	 * or the mmap / vma pages are now blocked in do_exit on current
2135 	 * finishing this core dump.
2136 	 *
2137 	 * Only ptrace can touch these memory addresses, but it doesn't change
2138 	 * the map_count or the pages allocated. So no possibility of crashing
2139 	 * exists while dumping the mm->vm_next areas to the core file.
2140 	 */
2141 
2142 	/* alloc memory for large data structures: too large to be on stack */
2143 	elf = kmalloc(sizeof(*elf), GFP_KERNEL);
2144 	if (!elf)
2145 		goto out;
2146 	/*
2147 	 * The number of segs are recored into ELF header as 16bit value.
2148 	 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2149 	 */
2150 	segs = current->mm->map_count;
2151 	segs += elf_core_extra_phdrs();
2152 
2153 	gate_vma = get_gate_vma(current->mm);
2154 	if (gate_vma != NULL)
2155 		segs++;
2156 
2157 	/* for notes section */
2158 	segs++;
2159 
2160 	/* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2161 	 * this, kernel supports extended numbering. Have a look at
2162 	 * include/linux/elf.h for further information. */
2163 	e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2164 
2165 	/*
2166 	 * Collect all the non-memory information about the process for the
2167 	 * notes.  This also sets up the file header.
2168 	 */
2169 	if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs))
2170 		goto cleanup;
2171 
2172 	has_dumped = 1;
2173 
2174 	fs = get_fs();
2175 	set_fs(KERNEL_DS);
2176 
2177 	offset += sizeof(*elf);				/* Elf header */
2178 	offset += segs * sizeof(struct elf_phdr);	/* Program headers */
2179 
2180 	/* Write notes phdr entry */
2181 	{
2182 		size_t sz = get_note_info_size(&info);
2183 
2184 		sz += elf_coredump_extra_notes_size();
2185 
2186 		phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2187 		if (!phdr4note)
2188 			goto end_coredump;
2189 
2190 		fill_elf_note_phdr(phdr4note, sz, offset);
2191 		offset += sz;
2192 	}
2193 
2194 	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2195 
2196 	vma_filesz = kmalloc_array(segs - 1, sizeof(*vma_filesz), GFP_KERNEL);
2197 	if (!vma_filesz)
2198 		goto end_coredump;
2199 
2200 	for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2201 			vma = next_vma(vma, gate_vma)) {
2202 		unsigned long dump_size;
2203 
2204 		dump_size = vma_dump_size(vma, cprm->mm_flags);
2205 		vma_filesz[i++] = dump_size;
2206 		vma_data_size += dump_size;
2207 	}
2208 
2209 	offset += vma_data_size;
2210 	offset += elf_core_extra_data_size();
2211 	e_shoff = offset;
2212 
2213 	if (e_phnum == PN_XNUM) {
2214 		shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2215 		if (!shdr4extnum)
2216 			goto end_coredump;
2217 		fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2218 	}
2219 
2220 	offset = dataoff;
2221 
2222 	if (!dump_emit(cprm, elf, sizeof(*elf)))
2223 		goto end_coredump;
2224 
2225 	if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
2226 		goto end_coredump;
2227 
2228 	/* Write program headers for segments dump */
2229 	for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2230 			vma = next_vma(vma, gate_vma)) {
2231 		struct elf_phdr phdr;
2232 
2233 		phdr.p_type = PT_LOAD;
2234 		phdr.p_offset = offset;
2235 		phdr.p_vaddr = vma->vm_start;
2236 		phdr.p_paddr = 0;
2237 		phdr.p_filesz = vma_filesz[i++];
2238 		phdr.p_memsz = vma->vm_end - vma->vm_start;
2239 		offset += phdr.p_filesz;
2240 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2241 		if (vma->vm_flags & VM_WRITE)
2242 			phdr.p_flags |= PF_W;
2243 		if (vma->vm_flags & VM_EXEC)
2244 			phdr.p_flags |= PF_X;
2245 		phdr.p_align = ELF_EXEC_PAGESIZE;
2246 
2247 		if (!dump_emit(cprm, &phdr, sizeof(phdr)))
2248 			goto end_coredump;
2249 	}
2250 
2251 	if (!elf_core_write_extra_phdrs(cprm, offset))
2252 		goto end_coredump;
2253 
2254  	/* write out the notes section */
2255 	if (!write_note_info(&info, cprm))
2256 		goto end_coredump;
2257 
2258 	if (elf_coredump_extra_notes_write(cprm))
2259 		goto end_coredump;
2260 
2261 	/* Align to page */
2262 	if (!dump_skip(cprm, dataoff - cprm->written))
2263 		goto end_coredump;
2264 
2265 	for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2266 			vma = next_vma(vma, gate_vma)) {
2267 		unsigned long addr;
2268 		unsigned long end;
2269 
2270 		end = vma->vm_start + vma_filesz[i++];
2271 
2272 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2273 			struct page *page;
2274 			int stop;
2275 
2276 			page = get_dump_page(addr);
2277 			if (page) {
2278 				void *kaddr = kmap(page);
2279 				stop = !dump_emit(cprm, kaddr, PAGE_SIZE);
2280 				kunmap(page);
2281 				page_cache_release(page);
2282 			} else
2283 				stop = !dump_skip(cprm, PAGE_SIZE);
2284 			if (stop)
2285 				goto end_coredump;
2286 		}
2287 	}
2288 
2289 	if (!elf_core_write_extra_data(cprm))
2290 		goto end_coredump;
2291 
2292 	if (e_phnum == PN_XNUM) {
2293 		if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
2294 			goto end_coredump;
2295 	}
2296 
2297 end_coredump:
2298 	set_fs(fs);
2299 
2300 cleanup:
2301 	free_note_info(&info);
2302 	kfree(shdr4extnum);
2303 	kfree(vma_filesz);
2304 	kfree(phdr4note);
2305 	kfree(elf);
2306 out:
2307 	return has_dumped;
2308 }
2309 
2310 #endif		/* CONFIG_ELF_CORE */
2311 
2312 static int __init init_elf_binfmt(void)
2313 {
2314 	register_binfmt(&elf_format);
2315 	return 0;
2316 }
2317 
2318 static void __exit exit_elf_binfmt(void)
2319 {
2320 	/* Remove the COFF and ELF loaders. */
2321 	unregister_binfmt(&elf_format);
2322 }
2323 
2324 core_initcall(init_elf_binfmt);
2325 module_exit(exit_elf_binfmt);
2326 MODULE_LICENSE("GPL");
2327