1 /* 2 * linux/fs/binfmt_elf.c 3 * 4 * These are the functions used to load ELF format executables as used 5 * on SVr4 machines. Information on the format may be found in the book 6 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support 7 * Tools". 8 * 9 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com). 10 */ 11 12 #include <linux/module.h> 13 #include <linux/kernel.h> 14 #include <linux/fs.h> 15 #include <linux/mm.h> 16 #include <linux/mman.h> 17 #include <linux/errno.h> 18 #include <linux/signal.h> 19 #include <linux/binfmts.h> 20 #include <linux/string.h> 21 #include <linux/file.h> 22 #include <linux/slab.h> 23 #include <linux/personality.h> 24 #include <linux/elfcore.h> 25 #include <linux/init.h> 26 #include <linux/highuid.h> 27 #include <linux/compiler.h> 28 #include <linux/highmem.h> 29 #include <linux/pagemap.h> 30 #include <linux/vmalloc.h> 31 #include <linux/security.h> 32 #include <linux/random.h> 33 #include <linux/elf.h> 34 #include <linux/elf-randomize.h> 35 #include <linux/utsname.h> 36 #include <linux/coredump.h> 37 #include <linux/sched.h> 38 #include <linux/dax.h> 39 #include <asm/uaccess.h> 40 #include <asm/param.h> 41 #include <asm/page.h> 42 43 #ifndef user_long_t 44 #define user_long_t long 45 #endif 46 #ifndef user_siginfo_t 47 #define user_siginfo_t siginfo_t 48 #endif 49 50 static int load_elf_binary(struct linux_binprm *bprm); 51 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *, 52 int, int, unsigned long); 53 54 #ifdef CONFIG_USELIB 55 static int load_elf_library(struct file *); 56 #else 57 #define load_elf_library NULL 58 #endif 59 60 /* 61 * If we don't support core dumping, then supply a NULL so we 62 * don't even try. 63 */ 64 #ifdef CONFIG_ELF_CORE 65 static int elf_core_dump(struct coredump_params *cprm); 66 #else 67 #define elf_core_dump NULL 68 #endif 69 70 #if ELF_EXEC_PAGESIZE > PAGE_SIZE 71 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE 72 #else 73 #define ELF_MIN_ALIGN PAGE_SIZE 74 #endif 75 76 #ifndef ELF_CORE_EFLAGS 77 #define ELF_CORE_EFLAGS 0 78 #endif 79 80 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) 81 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) 82 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) 83 84 static struct linux_binfmt elf_format = { 85 .module = THIS_MODULE, 86 .load_binary = load_elf_binary, 87 .load_shlib = load_elf_library, 88 .core_dump = elf_core_dump, 89 .min_coredump = ELF_EXEC_PAGESIZE, 90 }; 91 92 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) 93 94 static int set_brk(unsigned long start, unsigned long end) 95 { 96 start = ELF_PAGEALIGN(start); 97 end = ELF_PAGEALIGN(end); 98 if (end > start) { 99 int error = vm_brk(start, end - start); 100 if (error) 101 return error; 102 } 103 current->mm->start_brk = current->mm->brk = end; 104 return 0; 105 } 106 107 /* We need to explicitly zero any fractional pages 108 after the data section (i.e. bss). This would 109 contain the junk from the file that should not 110 be in memory 111 */ 112 static int padzero(unsigned long elf_bss) 113 { 114 unsigned long nbyte; 115 116 nbyte = ELF_PAGEOFFSET(elf_bss); 117 if (nbyte) { 118 nbyte = ELF_MIN_ALIGN - nbyte; 119 if (clear_user((void __user *) elf_bss, nbyte)) 120 return -EFAULT; 121 } 122 return 0; 123 } 124 125 /* Let's use some macros to make this stack manipulation a little clearer */ 126 #ifdef CONFIG_STACK_GROWSUP 127 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items)) 128 #define STACK_ROUND(sp, items) \ 129 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL) 130 #define STACK_ALLOC(sp, len) ({ \ 131 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \ 132 old_sp; }) 133 #else 134 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items)) 135 #define STACK_ROUND(sp, items) \ 136 (((unsigned long) (sp - items)) &~ 15UL) 137 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; }) 138 #endif 139 140 #ifndef ELF_BASE_PLATFORM 141 /* 142 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture. 143 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value 144 * will be copied to the user stack in the same manner as AT_PLATFORM. 145 */ 146 #define ELF_BASE_PLATFORM NULL 147 #endif 148 149 static int 150 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec, 151 unsigned long load_addr, unsigned long interp_load_addr) 152 { 153 unsigned long p = bprm->p; 154 int argc = bprm->argc; 155 int envc = bprm->envc; 156 elf_addr_t __user *argv; 157 elf_addr_t __user *envp; 158 elf_addr_t __user *sp; 159 elf_addr_t __user *u_platform; 160 elf_addr_t __user *u_base_platform; 161 elf_addr_t __user *u_rand_bytes; 162 const char *k_platform = ELF_PLATFORM; 163 const char *k_base_platform = ELF_BASE_PLATFORM; 164 unsigned char k_rand_bytes[16]; 165 int items; 166 elf_addr_t *elf_info; 167 int ei_index = 0; 168 const struct cred *cred = current_cred(); 169 struct vm_area_struct *vma; 170 171 /* 172 * In some cases (e.g. Hyper-Threading), we want to avoid L1 173 * evictions by the processes running on the same package. One 174 * thing we can do is to shuffle the initial stack for them. 175 */ 176 177 p = arch_align_stack(p); 178 179 /* 180 * If this architecture has a platform capability string, copy it 181 * to userspace. In some cases (Sparc), this info is impossible 182 * for userspace to get any other way, in others (i386) it is 183 * merely difficult. 184 */ 185 u_platform = NULL; 186 if (k_platform) { 187 size_t len = strlen(k_platform) + 1; 188 189 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 190 if (__copy_to_user(u_platform, k_platform, len)) 191 return -EFAULT; 192 } 193 194 /* 195 * If this architecture has a "base" platform capability 196 * string, copy it to userspace. 197 */ 198 u_base_platform = NULL; 199 if (k_base_platform) { 200 size_t len = strlen(k_base_platform) + 1; 201 202 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 203 if (__copy_to_user(u_base_platform, k_base_platform, len)) 204 return -EFAULT; 205 } 206 207 /* 208 * Generate 16 random bytes for userspace PRNG seeding. 209 */ 210 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes)); 211 u_rand_bytes = (elf_addr_t __user *) 212 STACK_ALLOC(p, sizeof(k_rand_bytes)); 213 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes))) 214 return -EFAULT; 215 216 /* Create the ELF interpreter info */ 217 elf_info = (elf_addr_t *)current->mm->saved_auxv; 218 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ 219 #define NEW_AUX_ENT(id, val) \ 220 do { \ 221 elf_info[ei_index++] = id; \ 222 elf_info[ei_index++] = val; \ 223 } while (0) 224 225 #ifdef ARCH_DLINFO 226 /* 227 * ARCH_DLINFO must come first so PPC can do its special alignment of 228 * AUXV. 229 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in 230 * ARCH_DLINFO changes 231 */ 232 ARCH_DLINFO; 233 #endif 234 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); 235 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); 236 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); 237 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); 238 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); 239 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); 240 NEW_AUX_ENT(AT_BASE, interp_load_addr); 241 NEW_AUX_ENT(AT_FLAGS, 0); 242 NEW_AUX_ENT(AT_ENTRY, exec->e_entry); 243 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid)); 244 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid)); 245 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid)); 246 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid)); 247 NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm)); 248 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes); 249 #ifdef ELF_HWCAP2 250 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2); 251 #endif 252 NEW_AUX_ENT(AT_EXECFN, bprm->exec); 253 if (k_platform) { 254 NEW_AUX_ENT(AT_PLATFORM, 255 (elf_addr_t)(unsigned long)u_platform); 256 } 257 if (k_base_platform) { 258 NEW_AUX_ENT(AT_BASE_PLATFORM, 259 (elf_addr_t)(unsigned long)u_base_platform); 260 } 261 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) { 262 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data); 263 } 264 #undef NEW_AUX_ENT 265 /* AT_NULL is zero; clear the rest too */ 266 memset(&elf_info[ei_index], 0, 267 sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]); 268 269 /* And advance past the AT_NULL entry. */ 270 ei_index += 2; 271 272 sp = STACK_ADD(p, ei_index); 273 274 items = (argc + 1) + (envc + 1) + 1; 275 bprm->p = STACK_ROUND(sp, items); 276 277 /* Point sp at the lowest address on the stack */ 278 #ifdef CONFIG_STACK_GROWSUP 279 sp = (elf_addr_t __user *)bprm->p - items - ei_index; 280 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */ 281 #else 282 sp = (elf_addr_t __user *)bprm->p; 283 #endif 284 285 286 /* 287 * Grow the stack manually; some architectures have a limit on how 288 * far ahead a user-space access may be in order to grow the stack. 289 */ 290 vma = find_extend_vma(current->mm, bprm->p); 291 if (!vma) 292 return -EFAULT; 293 294 /* Now, let's put argc (and argv, envp if appropriate) on the stack */ 295 if (__put_user(argc, sp++)) 296 return -EFAULT; 297 argv = sp; 298 envp = argv + argc + 1; 299 300 /* Populate argv and envp */ 301 p = current->mm->arg_end = current->mm->arg_start; 302 while (argc-- > 0) { 303 size_t len; 304 if (__put_user((elf_addr_t)p, argv++)) 305 return -EFAULT; 306 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 307 if (!len || len > MAX_ARG_STRLEN) 308 return -EINVAL; 309 p += len; 310 } 311 if (__put_user(0, argv)) 312 return -EFAULT; 313 current->mm->arg_end = current->mm->env_start = p; 314 while (envc-- > 0) { 315 size_t len; 316 if (__put_user((elf_addr_t)p, envp++)) 317 return -EFAULT; 318 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 319 if (!len || len > MAX_ARG_STRLEN) 320 return -EINVAL; 321 p += len; 322 } 323 if (__put_user(0, envp)) 324 return -EFAULT; 325 current->mm->env_end = p; 326 327 /* Put the elf_info on the stack in the right place. */ 328 sp = (elf_addr_t __user *)envp + 1; 329 if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t))) 330 return -EFAULT; 331 return 0; 332 } 333 334 #ifndef elf_map 335 336 static unsigned long elf_map(struct file *filep, unsigned long addr, 337 struct elf_phdr *eppnt, int prot, int type, 338 unsigned long total_size) 339 { 340 unsigned long map_addr; 341 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr); 342 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr); 343 addr = ELF_PAGESTART(addr); 344 size = ELF_PAGEALIGN(size); 345 346 /* mmap() will return -EINVAL if given a zero size, but a 347 * segment with zero filesize is perfectly valid */ 348 if (!size) 349 return addr; 350 351 /* 352 * total_size is the size of the ELF (interpreter) image. 353 * The _first_ mmap needs to know the full size, otherwise 354 * randomization might put this image into an overlapping 355 * position with the ELF binary image. (since size < total_size) 356 * So we first map the 'big' image - and unmap the remainder at 357 * the end. (which unmap is needed for ELF images with holes.) 358 */ 359 if (total_size) { 360 total_size = ELF_PAGEALIGN(total_size); 361 map_addr = vm_mmap(filep, addr, total_size, prot, type, off); 362 if (!BAD_ADDR(map_addr)) 363 vm_munmap(map_addr+size, total_size-size); 364 } else 365 map_addr = vm_mmap(filep, addr, size, prot, type, off); 366 367 return(map_addr); 368 } 369 370 #endif /* !elf_map */ 371 372 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr) 373 { 374 int i, first_idx = -1, last_idx = -1; 375 376 for (i = 0; i < nr; i++) { 377 if (cmds[i].p_type == PT_LOAD) { 378 last_idx = i; 379 if (first_idx == -1) 380 first_idx = i; 381 } 382 } 383 if (first_idx == -1) 384 return 0; 385 386 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz - 387 ELF_PAGESTART(cmds[first_idx].p_vaddr); 388 } 389 390 /** 391 * load_elf_phdrs() - load ELF program headers 392 * @elf_ex: ELF header of the binary whose program headers should be loaded 393 * @elf_file: the opened ELF binary file 394 * 395 * Loads ELF program headers from the binary file elf_file, which has the ELF 396 * header pointed to by elf_ex, into a newly allocated array. The caller is 397 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure. 398 */ 399 static struct elf_phdr *load_elf_phdrs(struct elfhdr *elf_ex, 400 struct file *elf_file) 401 { 402 struct elf_phdr *elf_phdata = NULL; 403 int retval, size, err = -1; 404 405 /* 406 * If the size of this structure has changed, then punt, since 407 * we will be doing the wrong thing. 408 */ 409 if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) 410 goto out; 411 412 /* Sanity check the number of program headers... */ 413 if (elf_ex->e_phnum < 1 || 414 elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr)) 415 goto out; 416 417 /* ...and their total size. */ 418 size = sizeof(struct elf_phdr) * elf_ex->e_phnum; 419 if (size > ELF_MIN_ALIGN) 420 goto out; 421 422 elf_phdata = kmalloc(size, GFP_KERNEL); 423 if (!elf_phdata) 424 goto out; 425 426 /* Read in the program headers */ 427 retval = kernel_read(elf_file, elf_ex->e_phoff, 428 (char *)elf_phdata, size); 429 if (retval != size) { 430 err = (retval < 0) ? retval : -EIO; 431 goto out; 432 } 433 434 /* Success! */ 435 err = 0; 436 out: 437 if (err) { 438 kfree(elf_phdata); 439 elf_phdata = NULL; 440 } 441 return elf_phdata; 442 } 443 444 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE 445 446 /** 447 * struct arch_elf_state - arch-specific ELF loading state 448 * 449 * This structure is used to preserve architecture specific data during 450 * the loading of an ELF file, throughout the checking of architecture 451 * specific ELF headers & through to the point where the ELF load is 452 * known to be proceeding (ie. SET_PERSONALITY). 453 * 454 * This implementation is a dummy for architectures which require no 455 * specific state. 456 */ 457 struct arch_elf_state { 458 }; 459 460 #define INIT_ARCH_ELF_STATE {} 461 462 /** 463 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header 464 * @ehdr: The main ELF header 465 * @phdr: The program header to check 466 * @elf: The open ELF file 467 * @is_interp: True if the phdr is from the interpreter of the ELF being 468 * loaded, else false. 469 * @state: Architecture-specific state preserved throughout the process 470 * of loading the ELF. 471 * 472 * Inspects the program header phdr to validate its correctness and/or 473 * suitability for the system. Called once per ELF program header in the 474 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its 475 * interpreter. 476 * 477 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 478 * with that return code. 479 */ 480 static inline int arch_elf_pt_proc(struct elfhdr *ehdr, 481 struct elf_phdr *phdr, 482 struct file *elf, bool is_interp, 483 struct arch_elf_state *state) 484 { 485 /* Dummy implementation, always proceed */ 486 return 0; 487 } 488 489 /** 490 * arch_check_elf() - check an ELF executable 491 * @ehdr: The main ELF header 492 * @has_interp: True if the ELF has an interpreter, else false. 493 * @interp_ehdr: The interpreter's ELF header 494 * @state: Architecture-specific state preserved throughout the process 495 * of loading the ELF. 496 * 497 * Provides a final opportunity for architecture code to reject the loading 498 * of the ELF & cause an exec syscall to return an error. This is called after 499 * all program headers to be checked by arch_elf_pt_proc have been. 500 * 501 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 502 * with that return code. 503 */ 504 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, 505 struct elfhdr *interp_ehdr, 506 struct arch_elf_state *state) 507 { 508 /* Dummy implementation, always proceed */ 509 return 0; 510 } 511 512 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ 513 514 /* This is much more generalized than the library routine read function, 515 so we keep this separate. Technically the library read function 516 is only provided so that we can read a.out libraries that have 517 an ELF header */ 518 519 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, 520 struct file *interpreter, unsigned long *interp_map_addr, 521 unsigned long no_base, struct elf_phdr *interp_elf_phdata) 522 { 523 struct elf_phdr *eppnt; 524 unsigned long load_addr = 0; 525 int load_addr_set = 0; 526 unsigned long last_bss = 0, elf_bss = 0; 527 unsigned long error = ~0UL; 528 unsigned long total_size; 529 int i; 530 531 /* First of all, some simple consistency checks */ 532 if (interp_elf_ex->e_type != ET_EXEC && 533 interp_elf_ex->e_type != ET_DYN) 534 goto out; 535 if (!elf_check_arch(interp_elf_ex)) 536 goto out; 537 if (!interpreter->f_op->mmap) 538 goto out; 539 540 total_size = total_mapping_size(interp_elf_phdata, 541 interp_elf_ex->e_phnum); 542 if (!total_size) { 543 error = -EINVAL; 544 goto out; 545 } 546 547 eppnt = interp_elf_phdata; 548 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { 549 if (eppnt->p_type == PT_LOAD) { 550 int elf_type = MAP_PRIVATE | MAP_DENYWRITE; 551 int elf_prot = 0; 552 unsigned long vaddr = 0; 553 unsigned long k, map_addr; 554 555 if (eppnt->p_flags & PF_R) 556 elf_prot = PROT_READ; 557 if (eppnt->p_flags & PF_W) 558 elf_prot |= PROT_WRITE; 559 if (eppnt->p_flags & PF_X) 560 elf_prot |= PROT_EXEC; 561 vaddr = eppnt->p_vaddr; 562 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) 563 elf_type |= MAP_FIXED; 564 else if (no_base && interp_elf_ex->e_type == ET_DYN) 565 load_addr = -vaddr; 566 567 map_addr = elf_map(interpreter, load_addr + vaddr, 568 eppnt, elf_prot, elf_type, total_size); 569 total_size = 0; 570 if (!*interp_map_addr) 571 *interp_map_addr = map_addr; 572 error = map_addr; 573 if (BAD_ADDR(map_addr)) 574 goto out; 575 576 if (!load_addr_set && 577 interp_elf_ex->e_type == ET_DYN) { 578 load_addr = map_addr - ELF_PAGESTART(vaddr); 579 load_addr_set = 1; 580 } 581 582 /* 583 * Check to see if the section's size will overflow the 584 * allowed task size. Note that p_filesz must always be 585 * <= p_memsize so it's only necessary to check p_memsz. 586 */ 587 k = load_addr + eppnt->p_vaddr; 588 if (BAD_ADDR(k) || 589 eppnt->p_filesz > eppnt->p_memsz || 590 eppnt->p_memsz > TASK_SIZE || 591 TASK_SIZE - eppnt->p_memsz < k) { 592 error = -ENOMEM; 593 goto out; 594 } 595 596 /* 597 * Find the end of the file mapping for this phdr, and 598 * keep track of the largest address we see for this. 599 */ 600 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz; 601 if (k > elf_bss) 602 elf_bss = k; 603 604 /* 605 * Do the same thing for the memory mapping - between 606 * elf_bss and last_bss is the bss section. 607 */ 608 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz; 609 if (k > last_bss) 610 last_bss = k; 611 } 612 } 613 614 /* 615 * Now fill out the bss section: first pad the last page from 616 * the file up to the page boundary, and zero it from elf_bss 617 * up to the end of the page. 618 */ 619 if (padzero(elf_bss)) { 620 error = -EFAULT; 621 goto out; 622 } 623 /* 624 * Next, align both the file and mem bss up to the page size, 625 * since this is where elf_bss was just zeroed up to, and where 626 * last_bss will end after the vm_brk() below. 627 */ 628 elf_bss = ELF_PAGEALIGN(elf_bss); 629 last_bss = ELF_PAGEALIGN(last_bss); 630 /* Finally, if there is still more bss to allocate, do it. */ 631 if (last_bss > elf_bss) { 632 error = vm_brk(elf_bss, last_bss - elf_bss); 633 if (error) 634 goto out; 635 } 636 637 error = load_addr; 638 out: 639 return error; 640 } 641 642 /* 643 * These are the functions used to load ELF style executables and shared 644 * libraries. There is no binary dependent code anywhere else. 645 */ 646 647 #ifndef STACK_RND_MASK 648 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */ 649 #endif 650 651 static unsigned long randomize_stack_top(unsigned long stack_top) 652 { 653 unsigned long random_variable = 0; 654 655 if ((current->flags & PF_RANDOMIZE) && 656 !(current->personality & ADDR_NO_RANDOMIZE)) { 657 random_variable = get_random_long(); 658 random_variable &= STACK_RND_MASK; 659 random_variable <<= PAGE_SHIFT; 660 } 661 #ifdef CONFIG_STACK_GROWSUP 662 return PAGE_ALIGN(stack_top) + random_variable; 663 #else 664 return PAGE_ALIGN(stack_top) - random_variable; 665 #endif 666 } 667 668 static int load_elf_binary(struct linux_binprm *bprm) 669 { 670 struct file *interpreter = NULL; /* to shut gcc up */ 671 unsigned long load_addr = 0, load_bias = 0; 672 int load_addr_set = 0; 673 char * elf_interpreter = NULL; 674 unsigned long error; 675 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; 676 unsigned long elf_bss, elf_brk; 677 int retval, i; 678 unsigned long elf_entry; 679 unsigned long interp_load_addr = 0; 680 unsigned long start_code, end_code, start_data, end_data; 681 unsigned long reloc_func_desc __maybe_unused = 0; 682 int executable_stack = EXSTACK_DEFAULT; 683 struct pt_regs *regs = current_pt_regs(); 684 struct { 685 struct elfhdr elf_ex; 686 struct elfhdr interp_elf_ex; 687 } *loc; 688 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE; 689 690 loc = kmalloc(sizeof(*loc), GFP_KERNEL); 691 if (!loc) { 692 retval = -ENOMEM; 693 goto out_ret; 694 } 695 696 /* Get the exec-header */ 697 loc->elf_ex = *((struct elfhdr *)bprm->buf); 698 699 retval = -ENOEXEC; 700 /* First of all, some simple consistency checks */ 701 if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 702 goto out; 703 704 if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN) 705 goto out; 706 if (!elf_check_arch(&loc->elf_ex)) 707 goto out; 708 if (!bprm->file->f_op->mmap) 709 goto out; 710 711 elf_phdata = load_elf_phdrs(&loc->elf_ex, bprm->file); 712 if (!elf_phdata) 713 goto out; 714 715 elf_ppnt = elf_phdata; 716 elf_bss = 0; 717 elf_brk = 0; 718 719 start_code = ~0UL; 720 end_code = 0; 721 start_data = 0; 722 end_data = 0; 723 724 for (i = 0; i < loc->elf_ex.e_phnum; i++) { 725 if (elf_ppnt->p_type == PT_INTERP) { 726 /* This is the program interpreter used for 727 * shared libraries - for now assume that this 728 * is an a.out format binary 729 */ 730 retval = -ENOEXEC; 731 if (elf_ppnt->p_filesz > PATH_MAX || 732 elf_ppnt->p_filesz < 2) 733 goto out_free_ph; 734 735 retval = -ENOMEM; 736 elf_interpreter = kmalloc(elf_ppnt->p_filesz, 737 GFP_KERNEL); 738 if (!elf_interpreter) 739 goto out_free_ph; 740 741 retval = kernel_read(bprm->file, elf_ppnt->p_offset, 742 elf_interpreter, 743 elf_ppnt->p_filesz); 744 if (retval != elf_ppnt->p_filesz) { 745 if (retval >= 0) 746 retval = -EIO; 747 goto out_free_interp; 748 } 749 /* make sure path is NULL terminated */ 750 retval = -ENOEXEC; 751 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') 752 goto out_free_interp; 753 754 interpreter = open_exec(elf_interpreter); 755 retval = PTR_ERR(interpreter); 756 if (IS_ERR(interpreter)) 757 goto out_free_interp; 758 759 /* 760 * If the binary is not readable then enforce 761 * mm->dumpable = 0 regardless of the interpreter's 762 * permissions. 763 */ 764 would_dump(bprm, interpreter); 765 766 /* Get the exec headers */ 767 retval = kernel_read(interpreter, 0, 768 (void *)&loc->interp_elf_ex, 769 sizeof(loc->interp_elf_ex)); 770 if (retval != sizeof(loc->interp_elf_ex)) { 771 if (retval >= 0) 772 retval = -EIO; 773 goto out_free_dentry; 774 } 775 776 break; 777 } 778 elf_ppnt++; 779 } 780 781 elf_ppnt = elf_phdata; 782 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) 783 switch (elf_ppnt->p_type) { 784 case PT_GNU_STACK: 785 if (elf_ppnt->p_flags & PF_X) 786 executable_stack = EXSTACK_ENABLE_X; 787 else 788 executable_stack = EXSTACK_DISABLE_X; 789 break; 790 791 case PT_LOPROC ... PT_HIPROC: 792 retval = arch_elf_pt_proc(&loc->elf_ex, elf_ppnt, 793 bprm->file, false, 794 &arch_state); 795 if (retval) 796 goto out_free_dentry; 797 break; 798 } 799 800 /* Some simple consistency checks for the interpreter */ 801 if (elf_interpreter) { 802 retval = -ELIBBAD; 803 /* Not an ELF interpreter */ 804 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 805 goto out_free_dentry; 806 /* Verify the interpreter has a valid arch */ 807 if (!elf_check_arch(&loc->interp_elf_ex)) 808 goto out_free_dentry; 809 810 /* Load the interpreter program headers */ 811 interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex, 812 interpreter); 813 if (!interp_elf_phdata) 814 goto out_free_dentry; 815 816 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ 817 elf_ppnt = interp_elf_phdata; 818 for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++) 819 switch (elf_ppnt->p_type) { 820 case PT_LOPROC ... PT_HIPROC: 821 retval = arch_elf_pt_proc(&loc->interp_elf_ex, 822 elf_ppnt, interpreter, 823 true, &arch_state); 824 if (retval) 825 goto out_free_dentry; 826 break; 827 } 828 } 829 830 /* 831 * Allow arch code to reject the ELF at this point, whilst it's 832 * still possible to return an error to the code that invoked 833 * the exec syscall. 834 */ 835 retval = arch_check_elf(&loc->elf_ex, 836 !!interpreter, &loc->interp_elf_ex, 837 &arch_state); 838 if (retval) 839 goto out_free_dentry; 840 841 /* Flush all traces of the currently running executable */ 842 retval = flush_old_exec(bprm); 843 if (retval) 844 goto out_free_dentry; 845 846 /* Do this immediately, since STACK_TOP as used in setup_arg_pages 847 may depend on the personality. */ 848 SET_PERSONALITY2(loc->elf_ex, &arch_state); 849 if (elf_read_implies_exec(loc->elf_ex, executable_stack)) 850 current->personality |= READ_IMPLIES_EXEC; 851 852 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) 853 current->flags |= PF_RANDOMIZE; 854 855 setup_new_exec(bprm); 856 857 /* Do this so that we can load the interpreter, if need be. We will 858 change some of these later */ 859 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), 860 executable_stack); 861 if (retval < 0) 862 goto out_free_dentry; 863 864 current->mm->start_stack = bprm->p; 865 866 /* Now we do a little grungy work by mmapping the ELF image into 867 the correct location in memory. */ 868 for(i = 0, elf_ppnt = elf_phdata; 869 i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { 870 int elf_prot = 0, elf_flags; 871 unsigned long k, vaddr; 872 unsigned long total_size = 0; 873 874 if (elf_ppnt->p_type != PT_LOAD) 875 continue; 876 877 if (unlikely (elf_brk > elf_bss)) { 878 unsigned long nbyte; 879 880 /* There was a PT_LOAD segment with p_memsz > p_filesz 881 before this one. Map anonymous pages, if needed, 882 and clear the area. */ 883 retval = set_brk(elf_bss + load_bias, 884 elf_brk + load_bias); 885 if (retval) 886 goto out_free_dentry; 887 nbyte = ELF_PAGEOFFSET(elf_bss); 888 if (nbyte) { 889 nbyte = ELF_MIN_ALIGN - nbyte; 890 if (nbyte > elf_brk - elf_bss) 891 nbyte = elf_brk - elf_bss; 892 if (clear_user((void __user *)elf_bss + 893 load_bias, nbyte)) { 894 /* 895 * This bss-zeroing can fail if the ELF 896 * file specifies odd protections. So 897 * we don't check the return value 898 */ 899 } 900 } 901 } 902 903 if (elf_ppnt->p_flags & PF_R) 904 elf_prot |= PROT_READ; 905 if (elf_ppnt->p_flags & PF_W) 906 elf_prot |= PROT_WRITE; 907 if (elf_ppnt->p_flags & PF_X) 908 elf_prot |= PROT_EXEC; 909 910 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE; 911 912 vaddr = elf_ppnt->p_vaddr; 913 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) { 914 elf_flags |= MAP_FIXED; 915 } else if (loc->elf_ex.e_type == ET_DYN) { 916 /* Try and get dynamic programs out of the way of the 917 * default mmap base, as well as whatever program they 918 * might try to exec. This is because the brk will 919 * follow the loader, and is not movable. */ 920 load_bias = ELF_ET_DYN_BASE - vaddr; 921 if (current->flags & PF_RANDOMIZE) 922 load_bias += arch_mmap_rnd(); 923 load_bias = ELF_PAGESTART(load_bias); 924 total_size = total_mapping_size(elf_phdata, 925 loc->elf_ex.e_phnum); 926 if (!total_size) { 927 retval = -EINVAL; 928 goto out_free_dentry; 929 } 930 } 931 932 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, 933 elf_prot, elf_flags, total_size); 934 if (BAD_ADDR(error)) { 935 retval = IS_ERR((void *)error) ? 936 PTR_ERR((void*)error) : -EINVAL; 937 goto out_free_dentry; 938 } 939 940 if (!load_addr_set) { 941 load_addr_set = 1; 942 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset); 943 if (loc->elf_ex.e_type == ET_DYN) { 944 load_bias += error - 945 ELF_PAGESTART(load_bias + vaddr); 946 load_addr += load_bias; 947 reloc_func_desc = load_bias; 948 } 949 } 950 k = elf_ppnt->p_vaddr; 951 if (k < start_code) 952 start_code = k; 953 if (start_data < k) 954 start_data = k; 955 956 /* 957 * Check to see if the section's size will overflow the 958 * allowed task size. Note that p_filesz must always be 959 * <= p_memsz so it is only necessary to check p_memsz. 960 */ 961 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || 962 elf_ppnt->p_memsz > TASK_SIZE || 963 TASK_SIZE - elf_ppnt->p_memsz < k) { 964 /* set_brk can never work. Avoid overflows. */ 965 retval = -EINVAL; 966 goto out_free_dentry; 967 } 968 969 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; 970 971 if (k > elf_bss) 972 elf_bss = k; 973 if ((elf_ppnt->p_flags & PF_X) && end_code < k) 974 end_code = k; 975 if (end_data < k) 976 end_data = k; 977 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; 978 if (k > elf_brk) 979 elf_brk = k; 980 } 981 982 loc->elf_ex.e_entry += load_bias; 983 elf_bss += load_bias; 984 elf_brk += load_bias; 985 start_code += load_bias; 986 end_code += load_bias; 987 start_data += load_bias; 988 end_data += load_bias; 989 990 /* Calling set_brk effectively mmaps the pages that we need 991 * for the bss and break sections. We must do this before 992 * mapping in the interpreter, to make sure it doesn't wind 993 * up getting placed where the bss needs to go. 994 */ 995 retval = set_brk(elf_bss, elf_brk); 996 if (retval) 997 goto out_free_dentry; 998 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { 999 retval = -EFAULT; /* Nobody gets to see this, but.. */ 1000 goto out_free_dentry; 1001 } 1002 1003 if (elf_interpreter) { 1004 unsigned long interp_map_addr = 0; 1005 1006 elf_entry = load_elf_interp(&loc->interp_elf_ex, 1007 interpreter, 1008 &interp_map_addr, 1009 load_bias, interp_elf_phdata); 1010 if (!IS_ERR((void *)elf_entry)) { 1011 /* 1012 * load_elf_interp() returns relocation 1013 * adjustment 1014 */ 1015 interp_load_addr = elf_entry; 1016 elf_entry += loc->interp_elf_ex.e_entry; 1017 } 1018 if (BAD_ADDR(elf_entry)) { 1019 retval = IS_ERR((void *)elf_entry) ? 1020 (int)elf_entry : -EINVAL; 1021 goto out_free_dentry; 1022 } 1023 reloc_func_desc = interp_load_addr; 1024 1025 allow_write_access(interpreter); 1026 fput(interpreter); 1027 kfree(elf_interpreter); 1028 } else { 1029 elf_entry = loc->elf_ex.e_entry; 1030 if (BAD_ADDR(elf_entry)) { 1031 retval = -EINVAL; 1032 goto out_free_dentry; 1033 } 1034 } 1035 1036 kfree(interp_elf_phdata); 1037 kfree(elf_phdata); 1038 1039 set_binfmt(&elf_format); 1040 1041 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES 1042 retval = arch_setup_additional_pages(bprm, !!elf_interpreter); 1043 if (retval < 0) 1044 goto out; 1045 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ 1046 1047 install_exec_creds(bprm); 1048 retval = create_elf_tables(bprm, &loc->elf_ex, 1049 load_addr, interp_load_addr); 1050 if (retval < 0) 1051 goto out; 1052 /* N.B. passed_fileno might not be initialized? */ 1053 current->mm->end_code = end_code; 1054 current->mm->start_code = start_code; 1055 current->mm->start_data = start_data; 1056 current->mm->end_data = end_data; 1057 current->mm->start_stack = bprm->p; 1058 1059 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) { 1060 current->mm->brk = current->mm->start_brk = 1061 arch_randomize_brk(current->mm); 1062 #ifdef compat_brk_randomized 1063 current->brk_randomized = 1; 1064 #endif 1065 } 1066 1067 if (current->personality & MMAP_PAGE_ZERO) { 1068 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 1069 and some applications "depend" upon this behavior. 1070 Since we do not have the power to recompile these, we 1071 emulate the SVr4 behavior. Sigh. */ 1072 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, 1073 MAP_FIXED | MAP_PRIVATE, 0); 1074 } 1075 1076 #ifdef ELF_PLAT_INIT 1077 /* 1078 * The ABI may specify that certain registers be set up in special 1079 * ways (on i386 %edx is the address of a DT_FINI function, for 1080 * example. In addition, it may also specify (eg, PowerPC64 ELF) 1081 * that the e_entry field is the address of the function descriptor 1082 * for the startup routine, rather than the address of the startup 1083 * routine itself. This macro performs whatever initialization to 1084 * the regs structure is required as well as any relocations to the 1085 * function descriptor entries when executing dynamically links apps. 1086 */ 1087 ELF_PLAT_INIT(regs, reloc_func_desc); 1088 #endif 1089 1090 start_thread(regs, elf_entry, bprm->p); 1091 retval = 0; 1092 out: 1093 kfree(loc); 1094 out_ret: 1095 return retval; 1096 1097 /* error cleanup */ 1098 out_free_dentry: 1099 kfree(interp_elf_phdata); 1100 allow_write_access(interpreter); 1101 if (interpreter) 1102 fput(interpreter); 1103 out_free_interp: 1104 kfree(elf_interpreter); 1105 out_free_ph: 1106 kfree(elf_phdata); 1107 goto out; 1108 } 1109 1110 #ifdef CONFIG_USELIB 1111 /* This is really simpleminded and specialized - we are loading an 1112 a.out library that is given an ELF header. */ 1113 static int load_elf_library(struct file *file) 1114 { 1115 struct elf_phdr *elf_phdata; 1116 struct elf_phdr *eppnt; 1117 unsigned long elf_bss, bss, len; 1118 int retval, error, i, j; 1119 struct elfhdr elf_ex; 1120 1121 error = -ENOEXEC; 1122 retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex)); 1123 if (retval != sizeof(elf_ex)) 1124 goto out; 1125 1126 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 1127 goto out; 1128 1129 /* First of all, some simple consistency checks */ 1130 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 || 1131 !elf_check_arch(&elf_ex) || !file->f_op->mmap) 1132 goto out; 1133 1134 /* Now read in all of the header information */ 1135 1136 j = sizeof(struct elf_phdr) * elf_ex.e_phnum; 1137 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */ 1138 1139 error = -ENOMEM; 1140 elf_phdata = kmalloc(j, GFP_KERNEL); 1141 if (!elf_phdata) 1142 goto out; 1143 1144 eppnt = elf_phdata; 1145 error = -ENOEXEC; 1146 retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j); 1147 if (retval != j) 1148 goto out_free_ph; 1149 1150 for (j = 0, i = 0; i<elf_ex.e_phnum; i++) 1151 if ((eppnt + i)->p_type == PT_LOAD) 1152 j++; 1153 if (j != 1) 1154 goto out_free_ph; 1155 1156 while (eppnt->p_type != PT_LOAD) 1157 eppnt++; 1158 1159 /* Now use mmap to map the library into memory. */ 1160 error = vm_mmap(file, 1161 ELF_PAGESTART(eppnt->p_vaddr), 1162 (eppnt->p_filesz + 1163 ELF_PAGEOFFSET(eppnt->p_vaddr)), 1164 PROT_READ | PROT_WRITE | PROT_EXEC, 1165 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE, 1166 (eppnt->p_offset - 1167 ELF_PAGEOFFSET(eppnt->p_vaddr))); 1168 if (error != ELF_PAGESTART(eppnt->p_vaddr)) 1169 goto out_free_ph; 1170 1171 elf_bss = eppnt->p_vaddr + eppnt->p_filesz; 1172 if (padzero(elf_bss)) { 1173 error = -EFAULT; 1174 goto out_free_ph; 1175 } 1176 1177 len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + 1178 ELF_MIN_ALIGN - 1); 1179 bss = eppnt->p_memsz + eppnt->p_vaddr; 1180 if (bss > len) { 1181 error = vm_brk(len, bss - len); 1182 if (error) 1183 goto out_free_ph; 1184 } 1185 error = 0; 1186 1187 out_free_ph: 1188 kfree(elf_phdata); 1189 out: 1190 return error; 1191 } 1192 #endif /* #ifdef CONFIG_USELIB */ 1193 1194 #ifdef CONFIG_ELF_CORE 1195 /* 1196 * ELF core dumper 1197 * 1198 * Modelled on fs/exec.c:aout_core_dump() 1199 * Jeremy Fitzhardinge <jeremy@sw.oz.au> 1200 */ 1201 1202 /* 1203 * The purpose of always_dump_vma() is to make sure that special kernel mappings 1204 * that are useful for post-mortem analysis are included in every core dump. 1205 * In that way we ensure that the core dump is fully interpretable later 1206 * without matching up the same kernel and hardware config to see what PC values 1207 * meant. These special mappings include - vDSO, vsyscall, and other 1208 * architecture specific mappings 1209 */ 1210 static bool always_dump_vma(struct vm_area_struct *vma) 1211 { 1212 /* Any vsyscall mappings? */ 1213 if (vma == get_gate_vma(vma->vm_mm)) 1214 return true; 1215 1216 /* 1217 * Assume that all vmas with a .name op should always be dumped. 1218 * If this changes, a new vm_ops field can easily be added. 1219 */ 1220 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 1221 return true; 1222 1223 /* 1224 * arch_vma_name() returns non-NULL for special architecture mappings, 1225 * such as vDSO sections. 1226 */ 1227 if (arch_vma_name(vma)) 1228 return true; 1229 1230 return false; 1231 } 1232 1233 /* 1234 * Decide what to dump of a segment, part, all or none. 1235 */ 1236 static unsigned long vma_dump_size(struct vm_area_struct *vma, 1237 unsigned long mm_flags) 1238 { 1239 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) 1240 1241 /* always dump the vdso and vsyscall sections */ 1242 if (always_dump_vma(vma)) 1243 goto whole; 1244 1245 if (vma->vm_flags & VM_DONTDUMP) 1246 return 0; 1247 1248 /* support for DAX */ 1249 if (vma_is_dax(vma)) { 1250 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED)) 1251 goto whole; 1252 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE)) 1253 goto whole; 1254 return 0; 1255 } 1256 1257 /* Hugetlb memory check */ 1258 if (vma->vm_flags & VM_HUGETLB) { 1259 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED)) 1260 goto whole; 1261 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) 1262 goto whole; 1263 return 0; 1264 } 1265 1266 /* Do not dump I/O mapped devices or special mappings */ 1267 if (vma->vm_flags & VM_IO) 1268 return 0; 1269 1270 /* By default, dump shared memory if mapped from an anonymous file. */ 1271 if (vma->vm_flags & VM_SHARED) { 1272 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1273 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED)) 1274 goto whole; 1275 return 0; 1276 } 1277 1278 /* Dump segments that have been written to. */ 1279 if (vma->anon_vma && FILTER(ANON_PRIVATE)) 1280 goto whole; 1281 if (vma->vm_file == NULL) 1282 return 0; 1283 1284 if (FILTER(MAPPED_PRIVATE)) 1285 goto whole; 1286 1287 /* 1288 * If this looks like the beginning of a DSO or executable mapping, 1289 * check for an ELF header. If we find one, dump the first page to 1290 * aid in determining what was mapped here. 1291 */ 1292 if (FILTER(ELF_HEADERS) && 1293 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1294 u32 __user *header = (u32 __user *) vma->vm_start; 1295 u32 word; 1296 mm_segment_t fs = get_fs(); 1297 /* 1298 * Doing it this way gets the constant folded by GCC. 1299 */ 1300 union { 1301 u32 cmp; 1302 char elfmag[SELFMAG]; 1303 } magic; 1304 BUILD_BUG_ON(SELFMAG != sizeof word); 1305 magic.elfmag[EI_MAG0] = ELFMAG0; 1306 magic.elfmag[EI_MAG1] = ELFMAG1; 1307 magic.elfmag[EI_MAG2] = ELFMAG2; 1308 magic.elfmag[EI_MAG3] = ELFMAG3; 1309 /* 1310 * Switch to the user "segment" for get_user(), 1311 * then put back what elf_core_dump() had in place. 1312 */ 1313 set_fs(USER_DS); 1314 if (unlikely(get_user(word, header))) 1315 word = 0; 1316 set_fs(fs); 1317 if (word == magic.cmp) 1318 return PAGE_SIZE; 1319 } 1320 1321 #undef FILTER 1322 1323 return 0; 1324 1325 whole: 1326 return vma->vm_end - vma->vm_start; 1327 } 1328 1329 /* An ELF note in memory */ 1330 struct memelfnote 1331 { 1332 const char *name; 1333 int type; 1334 unsigned int datasz; 1335 void *data; 1336 }; 1337 1338 static int notesize(struct memelfnote *en) 1339 { 1340 int sz; 1341 1342 sz = sizeof(struct elf_note); 1343 sz += roundup(strlen(en->name) + 1, 4); 1344 sz += roundup(en->datasz, 4); 1345 1346 return sz; 1347 } 1348 1349 static int writenote(struct memelfnote *men, struct coredump_params *cprm) 1350 { 1351 struct elf_note en; 1352 en.n_namesz = strlen(men->name) + 1; 1353 en.n_descsz = men->datasz; 1354 en.n_type = men->type; 1355 1356 return dump_emit(cprm, &en, sizeof(en)) && 1357 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) && 1358 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4); 1359 } 1360 1361 static void fill_elf_header(struct elfhdr *elf, int segs, 1362 u16 machine, u32 flags) 1363 { 1364 memset(elf, 0, sizeof(*elf)); 1365 1366 memcpy(elf->e_ident, ELFMAG, SELFMAG); 1367 elf->e_ident[EI_CLASS] = ELF_CLASS; 1368 elf->e_ident[EI_DATA] = ELF_DATA; 1369 elf->e_ident[EI_VERSION] = EV_CURRENT; 1370 elf->e_ident[EI_OSABI] = ELF_OSABI; 1371 1372 elf->e_type = ET_CORE; 1373 elf->e_machine = machine; 1374 elf->e_version = EV_CURRENT; 1375 elf->e_phoff = sizeof(struct elfhdr); 1376 elf->e_flags = flags; 1377 elf->e_ehsize = sizeof(struct elfhdr); 1378 elf->e_phentsize = sizeof(struct elf_phdr); 1379 elf->e_phnum = segs; 1380 1381 return; 1382 } 1383 1384 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset) 1385 { 1386 phdr->p_type = PT_NOTE; 1387 phdr->p_offset = offset; 1388 phdr->p_vaddr = 0; 1389 phdr->p_paddr = 0; 1390 phdr->p_filesz = sz; 1391 phdr->p_memsz = 0; 1392 phdr->p_flags = 0; 1393 phdr->p_align = 0; 1394 return; 1395 } 1396 1397 static void fill_note(struct memelfnote *note, const char *name, int type, 1398 unsigned int sz, void *data) 1399 { 1400 note->name = name; 1401 note->type = type; 1402 note->datasz = sz; 1403 note->data = data; 1404 return; 1405 } 1406 1407 /* 1408 * fill up all the fields in prstatus from the given task struct, except 1409 * registers which need to be filled up separately. 1410 */ 1411 static void fill_prstatus(struct elf_prstatus *prstatus, 1412 struct task_struct *p, long signr) 1413 { 1414 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 1415 prstatus->pr_sigpend = p->pending.signal.sig[0]; 1416 prstatus->pr_sighold = p->blocked.sig[0]; 1417 rcu_read_lock(); 1418 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1419 rcu_read_unlock(); 1420 prstatus->pr_pid = task_pid_vnr(p); 1421 prstatus->pr_pgrp = task_pgrp_vnr(p); 1422 prstatus->pr_sid = task_session_vnr(p); 1423 if (thread_group_leader(p)) { 1424 struct task_cputime cputime; 1425 1426 /* 1427 * This is the record for the group leader. It shows the 1428 * group-wide total, not its individual thread total. 1429 */ 1430 thread_group_cputime(p, &cputime); 1431 cputime_to_timeval(cputime.utime, &prstatus->pr_utime); 1432 cputime_to_timeval(cputime.stime, &prstatus->pr_stime); 1433 } else { 1434 cputime_t utime, stime; 1435 1436 task_cputime(p, &utime, &stime); 1437 cputime_to_timeval(utime, &prstatus->pr_utime); 1438 cputime_to_timeval(stime, &prstatus->pr_stime); 1439 } 1440 cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime); 1441 cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime); 1442 } 1443 1444 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, 1445 struct mm_struct *mm) 1446 { 1447 const struct cred *cred; 1448 unsigned int i, len; 1449 1450 /* first copy the parameters from user space */ 1451 memset(psinfo, 0, sizeof(struct elf_prpsinfo)); 1452 1453 len = mm->arg_end - mm->arg_start; 1454 if (len >= ELF_PRARGSZ) 1455 len = ELF_PRARGSZ-1; 1456 if (copy_from_user(&psinfo->pr_psargs, 1457 (const char __user *)mm->arg_start, len)) 1458 return -EFAULT; 1459 for(i = 0; i < len; i++) 1460 if (psinfo->pr_psargs[i] == 0) 1461 psinfo->pr_psargs[i] = ' '; 1462 psinfo->pr_psargs[len] = 0; 1463 1464 rcu_read_lock(); 1465 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1466 rcu_read_unlock(); 1467 psinfo->pr_pid = task_pid_vnr(p); 1468 psinfo->pr_pgrp = task_pgrp_vnr(p); 1469 psinfo->pr_sid = task_session_vnr(p); 1470 1471 i = p->state ? ffz(~p->state) + 1 : 0; 1472 psinfo->pr_state = i; 1473 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i]; 1474 psinfo->pr_zomb = psinfo->pr_sname == 'Z'; 1475 psinfo->pr_nice = task_nice(p); 1476 psinfo->pr_flag = p->flags; 1477 rcu_read_lock(); 1478 cred = __task_cred(p); 1479 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid)); 1480 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid)); 1481 rcu_read_unlock(); 1482 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname)); 1483 1484 return 0; 1485 } 1486 1487 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) 1488 { 1489 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; 1490 int i = 0; 1491 do 1492 i += 2; 1493 while (auxv[i - 2] != AT_NULL); 1494 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); 1495 } 1496 1497 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata, 1498 const siginfo_t *siginfo) 1499 { 1500 mm_segment_t old_fs = get_fs(); 1501 set_fs(KERNEL_DS); 1502 copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo); 1503 set_fs(old_fs); 1504 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata); 1505 } 1506 1507 #define MAX_FILE_NOTE_SIZE (4*1024*1024) 1508 /* 1509 * Format of NT_FILE note: 1510 * 1511 * long count -- how many files are mapped 1512 * long page_size -- units for file_ofs 1513 * array of [COUNT] elements of 1514 * long start 1515 * long end 1516 * long file_ofs 1517 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL... 1518 */ 1519 static int fill_files_note(struct memelfnote *note) 1520 { 1521 struct vm_area_struct *vma; 1522 unsigned count, size, names_ofs, remaining, n; 1523 user_long_t *data; 1524 user_long_t *start_end_ofs; 1525 char *name_base, *name_curpos; 1526 1527 /* *Estimated* file count and total data size needed */ 1528 count = current->mm->map_count; 1529 size = count * 64; 1530 1531 names_ofs = (2 + 3 * count) * sizeof(data[0]); 1532 alloc: 1533 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */ 1534 return -EINVAL; 1535 size = round_up(size, PAGE_SIZE); 1536 data = vmalloc(size); 1537 if (!data) 1538 return -ENOMEM; 1539 1540 start_end_ofs = data + 2; 1541 name_base = name_curpos = ((char *)data) + names_ofs; 1542 remaining = size - names_ofs; 1543 count = 0; 1544 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) { 1545 struct file *file; 1546 const char *filename; 1547 1548 file = vma->vm_file; 1549 if (!file) 1550 continue; 1551 filename = file_path(file, name_curpos, remaining); 1552 if (IS_ERR(filename)) { 1553 if (PTR_ERR(filename) == -ENAMETOOLONG) { 1554 vfree(data); 1555 size = size * 5 / 4; 1556 goto alloc; 1557 } 1558 continue; 1559 } 1560 1561 /* file_path() fills at the end, move name down */ 1562 /* n = strlen(filename) + 1: */ 1563 n = (name_curpos + remaining) - filename; 1564 remaining = filename - name_curpos; 1565 memmove(name_curpos, filename, n); 1566 name_curpos += n; 1567 1568 *start_end_ofs++ = vma->vm_start; 1569 *start_end_ofs++ = vma->vm_end; 1570 *start_end_ofs++ = vma->vm_pgoff; 1571 count++; 1572 } 1573 1574 /* Now we know exact count of files, can store it */ 1575 data[0] = count; 1576 data[1] = PAGE_SIZE; 1577 /* 1578 * Count usually is less than current->mm->map_count, 1579 * we need to move filenames down. 1580 */ 1581 n = current->mm->map_count - count; 1582 if (n != 0) { 1583 unsigned shift_bytes = n * 3 * sizeof(data[0]); 1584 memmove(name_base - shift_bytes, name_base, 1585 name_curpos - name_base); 1586 name_curpos -= shift_bytes; 1587 } 1588 1589 size = name_curpos - (char *)data; 1590 fill_note(note, "CORE", NT_FILE, size, data); 1591 return 0; 1592 } 1593 1594 #ifdef CORE_DUMP_USE_REGSET 1595 #include <linux/regset.h> 1596 1597 struct elf_thread_core_info { 1598 struct elf_thread_core_info *next; 1599 struct task_struct *task; 1600 struct elf_prstatus prstatus; 1601 struct memelfnote notes[0]; 1602 }; 1603 1604 struct elf_note_info { 1605 struct elf_thread_core_info *thread; 1606 struct memelfnote psinfo; 1607 struct memelfnote signote; 1608 struct memelfnote auxv; 1609 struct memelfnote files; 1610 user_siginfo_t csigdata; 1611 size_t size; 1612 int thread_notes; 1613 }; 1614 1615 /* 1616 * When a regset has a writeback hook, we call it on each thread before 1617 * dumping user memory. On register window machines, this makes sure the 1618 * user memory backing the register data is up to date before we read it. 1619 */ 1620 static void do_thread_regset_writeback(struct task_struct *task, 1621 const struct user_regset *regset) 1622 { 1623 if (regset->writeback) 1624 regset->writeback(task, regset, 1); 1625 } 1626 1627 #ifndef PR_REG_SIZE 1628 #define PR_REG_SIZE(S) sizeof(S) 1629 #endif 1630 1631 #ifndef PRSTATUS_SIZE 1632 #define PRSTATUS_SIZE(S) sizeof(S) 1633 #endif 1634 1635 #ifndef PR_REG_PTR 1636 #define PR_REG_PTR(S) (&((S)->pr_reg)) 1637 #endif 1638 1639 #ifndef SET_PR_FPVALID 1640 #define SET_PR_FPVALID(S, V) ((S)->pr_fpvalid = (V)) 1641 #endif 1642 1643 static int fill_thread_core_info(struct elf_thread_core_info *t, 1644 const struct user_regset_view *view, 1645 long signr, size_t *total) 1646 { 1647 unsigned int i; 1648 1649 /* 1650 * NT_PRSTATUS is the one special case, because the regset data 1651 * goes into the pr_reg field inside the note contents, rather 1652 * than being the whole note contents. We fill the reset in here. 1653 * We assume that regset 0 is NT_PRSTATUS. 1654 */ 1655 fill_prstatus(&t->prstatus, t->task, signr); 1656 (void) view->regsets[0].get(t->task, &view->regsets[0], 1657 0, PR_REG_SIZE(t->prstatus.pr_reg), 1658 PR_REG_PTR(&t->prstatus), NULL); 1659 1660 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, 1661 PRSTATUS_SIZE(t->prstatus), &t->prstatus); 1662 *total += notesize(&t->notes[0]); 1663 1664 do_thread_regset_writeback(t->task, &view->regsets[0]); 1665 1666 /* 1667 * Each other regset might generate a note too. For each regset 1668 * that has no core_note_type or is inactive, we leave t->notes[i] 1669 * all zero and we'll know to skip writing it later. 1670 */ 1671 for (i = 1; i < view->n; ++i) { 1672 const struct user_regset *regset = &view->regsets[i]; 1673 do_thread_regset_writeback(t->task, regset); 1674 if (regset->core_note_type && regset->get && 1675 (!regset->active || regset->active(t->task, regset))) { 1676 int ret; 1677 size_t size = regset->n * regset->size; 1678 void *data = kmalloc(size, GFP_KERNEL); 1679 if (unlikely(!data)) 1680 return 0; 1681 ret = regset->get(t->task, regset, 1682 0, size, data, NULL); 1683 if (unlikely(ret)) 1684 kfree(data); 1685 else { 1686 if (regset->core_note_type != NT_PRFPREG) 1687 fill_note(&t->notes[i], "LINUX", 1688 regset->core_note_type, 1689 size, data); 1690 else { 1691 SET_PR_FPVALID(&t->prstatus, 1); 1692 fill_note(&t->notes[i], "CORE", 1693 NT_PRFPREG, size, data); 1694 } 1695 *total += notesize(&t->notes[i]); 1696 } 1697 } 1698 } 1699 1700 return 1; 1701 } 1702 1703 static int fill_note_info(struct elfhdr *elf, int phdrs, 1704 struct elf_note_info *info, 1705 const siginfo_t *siginfo, struct pt_regs *regs) 1706 { 1707 struct task_struct *dump_task = current; 1708 const struct user_regset_view *view = task_user_regset_view(dump_task); 1709 struct elf_thread_core_info *t; 1710 struct elf_prpsinfo *psinfo; 1711 struct core_thread *ct; 1712 unsigned int i; 1713 1714 info->size = 0; 1715 info->thread = NULL; 1716 1717 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1718 if (psinfo == NULL) { 1719 info->psinfo.data = NULL; /* So we don't free this wrongly */ 1720 return 0; 1721 } 1722 1723 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); 1724 1725 /* 1726 * Figure out how many notes we're going to need for each thread. 1727 */ 1728 info->thread_notes = 0; 1729 for (i = 0; i < view->n; ++i) 1730 if (view->regsets[i].core_note_type != 0) 1731 ++info->thread_notes; 1732 1733 /* 1734 * Sanity check. We rely on regset 0 being in NT_PRSTATUS, 1735 * since it is our one special case. 1736 */ 1737 if (unlikely(info->thread_notes == 0) || 1738 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) { 1739 WARN_ON(1); 1740 return 0; 1741 } 1742 1743 /* 1744 * Initialize the ELF file header. 1745 */ 1746 fill_elf_header(elf, phdrs, 1747 view->e_machine, view->e_flags); 1748 1749 /* 1750 * Allocate a structure for each thread. 1751 */ 1752 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) { 1753 t = kzalloc(offsetof(struct elf_thread_core_info, 1754 notes[info->thread_notes]), 1755 GFP_KERNEL); 1756 if (unlikely(!t)) 1757 return 0; 1758 1759 t->task = ct->task; 1760 if (ct->task == dump_task || !info->thread) { 1761 t->next = info->thread; 1762 info->thread = t; 1763 } else { 1764 /* 1765 * Make sure to keep the original task at 1766 * the head of the list. 1767 */ 1768 t->next = info->thread->next; 1769 info->thread->next = t; 1770 } 1771 } 1772 1773 /* 1774 * Now fill in each thread's information. 1775 */ 1776 for (t = info->thread; t != NULL; t = t->next) 1777 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size)) 1778 return 0; 1779 1780 /* 1781 * Fill in the two process-wide notes. 1782 */ 1783 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm); 1784 info->size += notesize(&info->psinfo); 1785 1786 fill_siginfo_note(&info->signote, &info->csigdata, siginfo); 1787 info->size += notesize(&info->signote); 1788 1789 fill_auxv_note(&info->auxv, current->mm); 1790 info->size += notesize(&info->auxv); 1791 1792 if (fill_files_note(&info->files) == 0) 1793 info->size += notesize(&info->files); 1794 1795 return 1; 1796 } 1797 1798 static size_t get_note_info_size(struct elf_note_info *info) 1799 { 1800 return info->size; 1801 } 1802 1803 /* 1804 * Write all the notes for each thread. When writing the first thread, the 1805 * process-wide notes are interleaved after the first thread-specific note. 1806 */ 1807 static int write_note_info(struct elf_note_info *info, 1808 struct coredump_params *cprm) 1809 { 1810 bool first = true; 1811 struct elf_thread_core_info *t = info->thread; 1812 1813 do { 1814 int i; 1815 1816 if (!writenote(&t->notes[0], cprm)) 1817 return 0; 1818 1819 if (first && !writenote(&info->psinfo, cprm)) 1820 return 0; 1821 if (first && !writenote(&info->signote, cprm)) 1822 return 0; 1823 if (first && !writenote(&info->auxv, cprm)) 1824 return 0; 1825 if (first && info->files.data && 1826 !writenote(&info->files, cprm)) 1827 return 0; 1828 1829 for (i = 1; i < info->thread_notes; ++i) 1830 if (t->notes[i].data && 1831 !writenote(&t->notes[i], cprm)) 1832 return 0; 1833 1834 first = false; 1835 t = t->next; 1836 } while (t); 1837 1838 return 1; 1839 } 1840 1841 static void free_note_info(struct elf_note_info *info) 1842 { 1843 struct elf_thread_core_info *threads = info->thread; 1844 while (threads) { 1845 unsigned int i; 1846 struct elf_thread_core_info *t = threads; 1847 threads = t->next; 1848 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus); 1849 for (i = 1; i < info->thread_notes; ++i) 1850 kfree(t->notes[i].data); 1851 kfree(t); 1852 } 1853 kfree(info->psinfo.data); 1854 vfree(info->files.data); 1855 } 1856 1857 #else 1858 1859 /* Here is the structure in which status of each thread is captured. */ 1860 struct elf_thread_status 1861 { 1862 struct list_head list; 1863 struct elf_prstatus prstatus; /* NT_PRSTATUS */ 1864 elf_fpregset_t fpu; /* NT_PRFPREG */ 1865 struct task_struct *thread; 1866 #ifdef ELF_CORE_COPY_XFPREGS 1867 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */ 1868 #endif 1869 struct memelfnote notes[3]; 1870 int num_notes; 1871 }; 1872 1873 /* 1874 * In order to add the specific thread information for the elf file format, 1875 * we need to keep a linked list of every threads pr_status and then create 1876 * a single section for them in the final core file. 1877 */ 1878 static int elf_dump_thread_status(long signr, struct elf_thread_status *t) 1879 { 1880 int sz = 0; 1881 struct task_struct *p = t->thread; 1882 t->num_notes = 0; 1883 1884 fill_prstatus(&t->prstatus, p, signr); 1885 elf_core_copy_task_regs(p, &t->prstatus.pr_reg); 1886 1887 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), 1888 &(t->prstatus)); 1889 t->num_notes++; 1890 sz += notesize(&t->notes[0]); 1891 1892 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, 1893 &t->fpu))) { 1894 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), 1895 &(t->fpu)); 1896 t->num_notes++; 1897 sz += notesize(&t->notes[1]); 1898 } 1899 1900 #ifdef ELF_CORE_COPY_XFPREGS 1901 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) { 1902 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE, 1903 sizeof(t->xfpu), &t->xfpu); 1904 t->num_notes++; 1905 sz += notesize(&t->notes[2]); 1906 } 1907 #endif 1908 return sz; 1909 } 1910 1911 struct elf_note_info { 1912 struct memelfnote *notes; 1913 struct memelfnote *notes_files; 1914 struct elf_prstatus *prstatus; /* NT_PRSTATUS */ 1915 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */ 1916 struct list_head thread_list; 1917 elf_fpregset_t *fpu; 1918 #ifdef ELF_CORE_COPY_XFPREGS 1919 elf_fpxregset_t *xfpu; 1920 #endif 1921 user_siginfo_t csigdata; 1922 int thread_status_size; 1923 int numnote; 1924 }; 1925 1926 static int elf_note_info_init(struct elf_note_info *info) 1927 { 1928 memset(info, 0, sizeof(*info)); 1929 INIT_LIST_HEAD(&info->thread_list); 1930 1931 /* Allocate space for ELF notes */ 1932 info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL); 1933 if (!info->notes) 1934 return 0; 1935 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL); 1936 if (!info->psinfo) 1937 return 0; 1938 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL); 1939 if (!info->prstatus) 1940 return 0; 1941 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL); 1942 if (!info->fpu) 1943 return 0; 1944 #ifdef ELF_CORE_COPY_XFPREGS 1945 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL); 1946 if (!info->xfpu) 1947 return 0; 1948 #endif 1949 return 1; 1950 } 1951 1952 static int fill_note_info(struct elfhdr *elf, int phdrs, 1953 struct elf_note_info *info, 1954 const siginfo_t *siginfo, struct pt_regs *regs) 1955 { 1956 struct list_head *t; 1957 struct core_thread *ct; 1958 struct elf_thread_status *ets; 1959 1960 if (!elf_note_info_init(info)) 1961 return 0; 1962 1963 for (ct = current->mm->core_state->dumper.next; 1964 ct; ct = ct->next) { 1965 ets = kzalloc(sizeof(*ets), GFP_KERNEL); 1966 if (!ets) 1967 return 0; 1968 1969 ets->thread = ct->task; 1970 list_add(&ets->list, &info->thread_list); 1971 } 1972 1973 list_for_each(t, &info->thread_list) { 1974 int sz; 1975 1976 ets = list_entry(t, struct elf_thread_status, list); 1977 sz = elf_dump_thread_status(siginfo->si_signo, ets); 1978 info->thread_status_size += sz; 1979 } 1980 /* now collect the dump for the current */ 1981 memset(info->prstatus, 0, sizeof(*info->prstatus)); 1982 fill_prstatus(info->prstatus, current, siginfo->si_signo); 1983 elf_core_copy_regs(&info->prstatus->pr_reg, regs); 1984 1985 /* Set up header */ 1986 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS); 1987 1988 /* 1989 * Set up the notes in similar form to SVR4 core dumps made 1990 * with info from their /proc. 1991 */ 1992 1993 fill_note(info->notes + 0, "CORE", NT_PRSTATUS, 1994 sizeof(*info->prstatus), info->prstatus); 1995 fill_psinfo(info->psinfo, current->group_leader, current->mm); 1996 fill_note(info->notes + 1, "CORE", NT_PRPSINFO, 1997 sizeof(*info->psinfo), info->psinfo); 1998 1999 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo); 2000 fill_auxv_note(info->notes + 3, current->mm); 2001 info->numnote = 4; 2002 2003 if (fill_files_note(info->notes + info->numnote) == 0) { 2004 info->notes_files = info->notes + info->numnote; 2005 info->numnote++; 2006 } 2007 2008 /* Try to dump the FPU. */ 2009 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, 2010 info->fpu); 2011 if (info->prstatus->pr_fpvalid) 2012 fill_note(info->notes + info->numnote++, 2013 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu); 2014 #ifdef ELF_CORE_COPY_XFPREGS 2015 if (elf_core_copy_task_xfpregs(current, info->xfpu)) 2016 fill_note(info->notes + info->numnote++, 2017 "LINUX", ELF_CORE_XFPREG_TYPE, 2018 sizeof(*info->xfpu), info->xfpu); 2019 #endif 2020 2021 return 1; 2022 } 2023 2024 static size_t get_note_info_size(struct elf_note_info *info) 2025 { 2026 int sz = 0; 2027 int i; 2028 2029 for (i = 0; i < info->numnote; i++) 2030 sz += notesize(info->notes + i); 2031 2032 sz += info->thread_status_size; 2033 2034 return sz; 2035 } 2036 2037 static int write_note_info(struct elf_note_info *info, 2038 struct coredump_params *cprm) 2039 { 2040 int i; 2041 struct list_head *t; 2042 2043 for (i = 0; i < info->numnote; i++) 2044 if (!writenote(info->notes + i, cprm)) 2045 return 0; 2046 2047 /* write out the thread status notes section */ 2048 list_for_each(t, &info->thread_list) { 2049 struct elf_thread_status *tmp = 2050 list_entry(t, struct elf_thread_status, list); 2051 2052 for (i = 0; i < tmp->num_notes; i++) 2053 if (!writenote(&tmp->notes[i], cprm)) 2054 return 0; 2055 } 2056 2057 return 1; 2058 } 2059 2060 static void free_note_info(struct elf_note_info *info) 2061 { 2062 while (!list_empty(&info->thread_list)) { 2063 struct list_head *tmp = info->thread_list.next; 2064 list_del(tmp); 2065 kfree(list_entry(tmp, struct elf_thread_status, list)); 2066 } 2067 2068 /* Free data possibly allocated by fill_files_note(): */ 2069 if (info->notes_files) 2070 vfree(info->notes_files->data); 2071 2072 kfree(info->prstatus); 2073 kfree(info->psinfo); 2074 kfree(info->notes); 2075 kfree(info->fpu); 2076 #ifdef ELF_CORE_COPY_XFPREGS 2077 kfree(info->xfpu); 2078 #endif 2079 } 2080 2081 #endif 2082 2083 static struct vm_area_struct *first_vma(struct task_struct *tsk, 2084 struct vm_area_struct *gate_vma) 2085 { 2086 struct vm_area_struct *ret = tsk->mm->mmap; 2087 2088 if (ret) 2089 return ret; 2090 return gate_vma; 2091 } 2092 /* 2093 * Helper function for iterating across a vma list. It ensures that the caller 2094 * will visit `gate_vma' prior to terminating the search. 2095 */ 2096 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma, 2097 struct vm_area_struct *gate_vma) 2098 { 2099 struct vm_area_struct *ret; 2100 2101 ret = this_vma->vm_next; 2102 if (ret) 2103 return ret; 2104 if (this_vma == gate_vma) 2105 return NULL; 2106 return gate_vma; 2107 } 2108 2109 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, 2110 elf_addr_t e_shoff, int segs) 2111 { 2112 elf->e_shoff = e_shoff; 2113 elf->e_shentsize = sizeof(*shdr4extnum); 2114 elf->e_shnum = 1; 2115 elf->e_shstrndx = SHN_UNDEF; 2116 2117 memset(shdr4extnum, 0, sizeof(*shdr4extnum)); 2118 2119 shdr4extnum->sh_type = SHT_NULL; 2120 shdr4extnum->sh_size = elf->e_shnum; 2121 shdr4extnum->sh_link = elf->e_shstrndx; 2122 shdr4extnum->sh_info = segs; 2123 } 2124 2125 /* 2126 * Actual dumper 2127 * 2128 * This is a two-pass process; first we find the offsets of the bits, 2129 * and then they are actually written out. If we run out of core limit 2130 * we just truncate. 2131 */ 2132 static int elf_core_dump(struct coredump_params *cprm) 2133 { 2134 int has_dumped = 0; 2135 mm_segment_t fs; 2136 int segs, i; 2137 size_t vma_data_size = 0; 2138 struct vm_area_struct *vma, *gate_vma; 2139 struct elfhdr *elf = NULL; 2140 loff_t offset = 0, dataoff; 2141 struct elf_note_info info = { }; 2142 struct elf_phdr *phdr4note = NULL; 2143 struct elf_shdr *shdr4extnum = NULL; 2144 Elf_Half e_phnum; 2145 elf_addr_t e_shoff; 2146 elf_addr_t *vma_filesz = NULL; 2147 2148 /* 2149 * We no longer stop all VM operations. 2150 * 2151 * This is because those proceses that could possibly change map_count 2152 * or the mmap / vma pages are now blocked in do_exit on current 2153 * finishing this core dump. 2154 * 2155 * Only ptrace can touch these memory addresses, but it doesn't change 2156 * the map_count or the pages allocated. So no possibility of crashing 2157 * exists while dumping the mm->vm_next areas to the core file. 2158 */ 2159 2160 /* alloc memory for large data structures: too large to be on stack */ 2161 elf = kmalloc(sizeof(*elf), GFP_KERNEL); 2162 if (!elf) 2163 goto out; 2164 /* 2165 * The number of segs are recored into ELF header as 16bit value. 2166 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. 2167 */ 2168 segs = current->mm->map_count; 2169 segs += elf_core_extra_phdrs(); 2170 2171 gate_vma = get_gate_vma(current->mm); 2172 if (gate_vma != NULL) 2173 segs++; 2174 2175 /* for notes section */ 2176 segs++; 2177 2178 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid 2179 * this, kernel supports extended numbering. Have a look at 2180 * include/linux/elf.h for further information. */ 2181 e_phnum = segs > PN_XNUM ? PN_XNUM : segs; 2182 2183 /* 2184 * Collect all the non-memory information about the process for the 2185 * notes. This also sets up the file header. 2186 */ 2187 if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs)) 2188 goto cleanup; 2189 2190 has_dumped = 1; 2191 2192 fs = get_fs(); 2193 set_fs(KERNEL_DS); 2194 2195 offset += sizeof(*elf); /* Elf header */ 2196 offset += segs * sizeof(struct elf_phdr); /* Program headers */ 2197 2198 /* Write notes phdr entry */ 2199 { 2200 size_t sz = get_note_info_size(&info); 2201 2202 sz += elf_coredump_extra_notes_size(); 2203 2204 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL); 2205 if (!phdr4note) 2206 goto end_coredump; 2207 2208 fill_elf_note_phdr(phdr4note, sz, offset); 2209 offset += sz; 2210 } 2211 2212 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); 2213 2214 vma_filesz = kmalloc_array(segs - 1, sizeof(*vma_filesz), GFP_KERNEL); 2215 if (!vma_filesz) 2216 goto end_coredump; 2217 2218 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2219 vma = next_vma(vma, gate_vma)) { 2220 unsigned long dump_size; 2221 2222 dump_size = vma_dump_size(vma, cprm->mm_flags); 2223 vma_filesz[i++] = dump_size; 2224 vma_data_size += dump_size; 2225 } 2226 2227 offset += vma_data_size; 2228 offset += elf_core_extra_data_size(); 2229 e_shoff = offset; 2230 2231 if (e_phnum == PN_XNUM) { 2232 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL); 2233 if (!shdr4extnum) 2234 goto end_coredump; 2235 fill_extnum_info(elf, shdr4extnum, e_shoff, segs); 2236 } 2237 2238 offset = dataoff; 2239 2240 if (!dump_emit(cprm, elf, sizeof(*elf))) 2241 goto end_coredump; 2242 2243 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note))) 2244 goto end_coredump; 2245 2246 /* Write program headers for segments dump */ 2247 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2248 vma = next_vma(vma, gate_vma)) { 2249 struct elf_phdr phdr; 2250 2251 phdr.p_type = PT_LOAD; 2252 phdr.p_offset = offset; 2253 phdr.p_vaddr = vma->vm_start; 2254 phdr.p_paddr = 0; 2255 phdr.p_filesz = vma_filesz[i++]; 2256 phdr.p_memsz = vma->vm_end - vma->vm_start; 2257 offset += phdr.p_filesz; 2258 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; 2259 if (vma->vm_flags & VM_WRITE) 2260 phdr.p_flags |= PF_W; 2261 if (vma->vm_flags & VM_EXEC) 2262 phdr.p_flags |= PF_X; 2263 phdr.p_align = ELF_EXEC_PAGESIZE; 2264 2265 if (!dump_emit(cprm, &phdr, sizeof(phdr))) 2266 goto end_coredump; 2267 } 2268 2269 if (!elf_core_write_extra_phdrs(cprm, offset)) 2270 goto end_coredump; 2271 2272 /* write out the notes section */ 2273 if (!write_note_info(&info, cprm)) 2274 goto end_coredump; 2275 2276 if (elf_coredump_extra_notes_write(cprm)) 2277 goto end_coredump; 2278 2279 /* Align to page */ 2280 if (!dump_skip(cprm, dataoff - cprm->pos)) 2281 goto end_coredump; 2282 2283 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2284 vma = next_vma(vma, gate_vma)) { 2285 unsigned long addr; 2286 unsigned long end; 2287 2288 end = vma->vm_start + vma_filesz[i++]; 2289 2290 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) { 2291 struct page *page; 2292 int stop; 2293 2294 page = get_dump_page(addr); 2295 if (page) { 2296 void *kaddr = kmap(page); 2297 stop = !dump_emit(cprm, kaddr, PAGE_SIZE); 2298 kunmap(page); 2299 put_page(page); 2300 } else 2301 stop = !dump_skip(cprm, PAGE_SIZE); 2302 if (stop) 2303 goto end_coredump; 2304 } 2305 } 2306 2307 if (!elf_core_write_extra_data(cprm)) 2308 goto end_coredump; 2309 2310 if (e_phnum == PN_XNUM) { 2311 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum))) 2312 goto end_coredump; 2313 } 2314 2315 end_coredump: 2316 set_fs(fs); 2317 2318 cleanup: 2319 free_note_info(&info); 2320 kfree(shdr4extnum); 2321 kfree(vma_filesz); 2322 kfree(phdr4note); 2323 kfree(elf); 2324 out: 2325 return has_dumped; 2326 } 2327 2328 #endif /* CONFIG_ELF_CORE */ 2329 2330 static int __init init_elf_binfmt(void) 2331 { 2332 register_binfmt(&elf_format); 2333 return 0; 2334 } 2335 2336 static void __exit exit_elf_binfmt(void) 2337 { 2338 /* Remove the COFF and ELF loaders. */ 2339 unregister_binfmt(&elf_format); 2340 } 2341 2342 core_initcall(init_elf_binfmt); 2343 module_exit(exit_elf_binfmt); 2344 MODULE_LICENSE("GPL"); 2345