1 /* 2 * linux/fs/binfmt_elf.c 3 * 4 * These are the functions used to load ELF format executables as used 5 * on SVr4 machines. Information on the format may be found in the book 6 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support 7 * Tools". 8 * 9 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com). 10 */ 11 12 #include <linux/module.h> 13 #include <linux/kernel.h> 14 #include <linux/fs.h> 15 #include <linux/mm.h> 16 #include <linux/mman.h> 17 #include <linux/errno.h> 18 #include <linux/signal.h> 19 #include <linux/binfmts.h> 20 #include <linux/string.h> 21 #include <linux/file.h> 22 #include <linux/slab.h> 23 #include <linux/personality.h> 24 #include <linux/elfcore.h> 25 #include <linux/init.h> 26 #include <linux/highuid.h> 27 #include <linux/compiler.h> 28 #include <linux/highmem.h> 29 #include <linux/pagemap.h> 30 #include <linux/vmalloc.h> 31 #include <linux/security.h> 32 #include <linux/random.h> 33 #include <linux/elf.h> 34 #include <linux/elf-randomize.h> 35 #include <linux/utsname.h> 36 #include <linux/coredump.h> 37 #include <linux/sched.h> 38 #include <linux/dax.h> 39 #include <asm/uaccess.h> 40 #include <asm/param.h> 41 #include <asm/page.h> 42 43 #ifndef user_long_t 44 #define user_long_t long 45 #endif 46 #ifndef user_siginfo_t 47 #define user_siginfo_t siginfo_t 48 #endif 49 50 static int load_elf_binary(struct linux_binprm *bprm); 51 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *, 52 int, int, unsigned long); 53 54 #ifdef CONFIG_USELIB 55 static int load_elf_library(struct file *); 56 #else 57 #define load_elf_library NULL 58 #endif 59 60 /* 61 * If we don't support core dumping, then supply a NULL so we 62 * don't even try. 63 */ 64 #ifdef CONFIG_ELF_CORE 65 static int elf_core_dump(struct coredump_params *cprm); 66 #else 67 #define elf_core_dump NULL 68 #endif 69 70 #if ELF_EXEC_PAGESIZE > PAGE_SIZE 71 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE 72 #else 73 #define ELF_MIN_ALIGN PAGE_SIZE 74 #endif 75 76 #ifndef ELF_CORE_EFLAGS 77 #define ELF_CORE_EFLAGS 0 78 #endif 79 80 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) 81 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) 82 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) 83 84 static struct linux_binfmt elf_format = { 85 .module = THIS_MODULE, 86 .load_binary = load_elf_binary, 87 .load_shlib = load_elf_library, 88 .core_dump = elf_core_dump, 89 .min_coredump = ELF_EXEC_PAGESIZE, 90 }; 91 92 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) 93 94 static int set_brk(unsigned long start, unsigned long end) 95 { 96 start = ELF_PAGEALIGN(start); 97 end = ELF_PAGEALIGN(end); 98 if (end > start) { 99 int error = vm_brk(start, end - start); 100 if (error) 101 return error; 102 } 103 current->mm->start_brk = current->mm->brk = end; 104 return 0; 105 } 106 107 /* We need to explicitly zero any fractional pages 108 after the data section (i.e. bss). This would 109 contain the junk from the file that should not 110 be in memory 111 */ 112 static int padzero(unsigned long elf_bss) 113 { 114 unsigned long nbyte; 115 116 nbyte = ELF_PAGEOFFSET(elf_bss); 117 if (nbyte) { 118 nbyte = ELF_MIN_ALIGN - nbyte; 119 if (clear_user((void __user *) elf_bss, nbyte)) 120 return -EFAULT; 121 } 122 return 0; 123 } 124 125 /* Let's use some macros to make this stack manipulation a little clearer */ 126 #ifdef CONFIG_STACK_GROWSUP 127 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items)) 128 #define STACK_ROUND(sp, items) \ 129 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL) 130 #define STACK_ALLOC(sp, len) ({ \ 131 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \ 132 old_sp; }) 133 #else 134 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items)) 135 #define STACK_ROUND(sp, items) \ 136 (((unsigned long) (sp - items)) &~ 15UL) 137 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; }) 138 #endif 139 140 #ifndef ELF_BASE_PLATFORM 141 /* 142 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture. 143 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value 144 * will be copied to the user stack in the same manner as AT_PLATFORM. 145 */ 146 #define ELF_BASE_PLATFORM NULL 147 #endif 148 149 static int 150 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec, 151 unsigned long load_addr, unsigned long interp_load_addr) 152 { 153 unsigned long p = bprm->p; 154 int argc = bprm->argc; 155 int envc = bprm->envc; 156 elf_addr_t __user *argv; 157 elf_addr_t __user *envp; 158 elf_addr_t __user *sp; 159 elf_addr_t __user *u_platform; 160 elf_addr_t __user *u_base_platform; 161 elf_addr_t __user *u_rand_bytes; 162 const char *k_platform = ELF_PLATFORM; 163 const char *k_base_platform = ELF_BASE_PLATFORM; 164 unsigned char k_rand_bytes[16]; 165 int items; 166 elf_addr_t *elf_info; 167 int ei_index = 0; 168 const struct cred *cred = current_cred(); 169 struct vm_area_struct *vma; 170 171 /* 172 * In some cases (e.g. Hyper-Threading), we want to avoid L1 173 * evictions by the processes running on the same package. One 174 * thing we can do is to shuffle the initial stack for them. 175 */ 176 177 p = arch_align_stack(p); 178 179 /* 180 * If this architecture has a platform capability string, copy it 181 * to userspace. In some cases (Sparc), this info is impossible 182 * for userspace to get any other way, in others (i386) it is 183 * merely difficult. 184 */ 185 u_platform = NULL; 186 if (k_platform) { 187 size_t len = strlen(k_platform) + 1; 188 189 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 190 if (__copy_to_user(u_platform, k_platform, len)) 191 return -EFAULT; 192 } 193 194 /* 195 * If this architecture has a "base" platform capability 196 * string, copy it to userspace. 197 */ 198 u_base_platform = NULL; 199 if (k_base_platform) { 200 size_t len = strlen(k_base_platform) + 1; 201 202 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 203 if (__copy_to_user(u_base_platform, k_base_platform, len)) 204 return -EFAULT; 205 } 206 207 /* 208 * Generate 16 random bytes for userspace PRNG seeding. 209 */ 210 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes)); 211 u_rand_bytes = (elf_addr_t __user *) 212 STACK_ALLOC(p, sizeof(k_rand_bytes)); 213 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes))) 214 return -EFAULT; 215 216 /* Create the ELF interpreter info */ 217 elf_info = (elf_addr_t *)current->mm->saved_auxv; 218 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ 219 #define NEW_AUX_ENT(id, val) \ 220 do { \ 221 elf_info[ei_index++] = id; \ 222 elf_info[ei_index++] = val; \ 223 } while (0) 224 225 #ifdef ARCH_DLINFO 226 /* 227 * ARCH_DLINFO must come first so PPC can do its special alignment of 228 * AUXV. 229 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in 230 * ARCH_DLINFO changes 231 */ 232 ARCH_DLINFO; 233 #endif 234 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); 235 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); 236 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); 237 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); 238 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); 239 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); 240 NEW_AUX_ENT(AT_BASE, interp_load_addr); 241 NEW_AUX_ENT(AT_FLAGS, 0); 242 NEW_AUX_ENT(AT_ENTRY, exec->e_entry); 243 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid)); 244 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid)); 245 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid)); 246 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid)); 247 NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm)); 248 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes); 249 #ifdef ELF_HWCAP2 250 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2); 251 #endif 252 NEW_AUX_ENT(AT_EXECFN, bprm->exec); 253 if (k_platform) { 254 NEW_AUX_ENT(AT_PLATFORM, 255 (elf_addr_t)(unsigned long)u_platform); 256 } 257 if (k_base_platform) { 258 NEW_AUX_ENT(AT_BASE_PLATFORM, 259 (elf_addr_t)(unsigned long)u_base_platform); 260 } 261 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) { 262 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data); 263 } 264 #undef NEW_AUX_ENT 265 /* AT_NULL is zero; clear the rest too */ 266 memset(&elf_info[ei_index], 0, 267 sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]); 268 269 /* And advance past the AT_NULL entry. */ 270 ei_index += 2; 271 272 sp = STACK_ADD(p, ei_index); 273 274 items = (argc + 1) + (envc + 1) + 1; 275 bprm->p = STACK_ROUND(sp, items); 276 277 /* Point sp at the lowest address on the stack */ 278 #ifdef CONFIG_STACK_GROWSUP 279 sp = (elf_addr_t __user *)bprm->p - items - ei_index; 280 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */ 281 #else 282 sp = (elf_addr_t __user *)bprm->p; 283 #endif 284 285 286 /* 287 * Grow the stack manually; some architectures have a limit on how 288 * far ahead a user-space access may be in order to grow the stack. 289 */ 290 vma = find_extend_vma(current->mm, bprm->p); 291 if (!vma) 292 return -EFAULT; 293 294 /* Now, let's put argc (and argv, envp if appropriate) on the stack */ 295 if (__put_user(argc, sp++)) 296 return -EFAULT; 297 argv = sp; 298 envp = argv + argc + 1; 299 300 /* Populate argv and envp */ 301 p = current->mm->arg_end = current->mm->arg_start; 302 while (argc-- > 0) { 303 size_t len; 304 if (__put_user((elf_addr_t)p, argv++)) 305 return -EFAULT; 306 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 307 if (!len || len > MAX_ARG_STRLEN) 308 return -EINVAL; 309 p += len; 310 } 311 if (__put_user(0, argv)) 312 return -EFAULT; 313 current->mm->arg_end = current->mm->env_start = p; 314 while (envc-- > 0) { 315 size_t len; 316 if (__put_user((elf_addr_t)p, envp++)) 317 return -EFAULT; 318 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 319 if (!len || len > MAX_ARG_STRLEN) 320 return -EINVAL; 321 p += len; 322 } 323 if (__put_user(0, envp)) 324 return -EFAULT; 325 current->mm->env_end = p; 326 327 /* Put the elf_info on the stack in the right place. */ 328 sp = (elf_addr_t __user *)envp + 1; 329 if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t))) 330 return -EFAULT; 331 return 0; 332 } 333 334 #ifndef elf_map 335 336 static unsigned long elf_map(struct file *filep, unsigned long addr, 337 struct elf_phdr *eppnt, int prot, int type, 338 unsigned long total_size) 339 { 340 unsigned long map_addr; 341 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr); 342 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr); 343 addr = ELF_PAGESTART(addr); 344 size = ELF_PAGEALIGN(size); 345 346 /* mmap() will return -EINVAL if given a zero size, but a 347 * segment with zero filesize is perfectly valid */ 348 if (!size) 349 return addr; 350 351 /* 352 * total_size is the size of the ELF (interpreter) image. 353 * The _first_ mmap needs to know the full size, otherwise 354 * randomization might put this image into an overlapping 355 * position with the ELF binary image. (since size < total_size) 356 * So we first map the 'big' image - and unmap the remainder at 357 * the end. (which unmap is needed for ELF images with holes.) 358 */ 359 if (total_size) { 360 total_size = ELF_PAGEALIGN(total_size); 361 map_addr = vm_mmap(filep, addr, total_size, prot, type, off); 362 if (!BAD_ADDR(map_addr)) 363 vm_munmap(map_addr+size, total_size-size); 364 } else 365 map_addr = vm_mmap(filep, addr, size, prot, type, off); 366 367 return(map_addr); 368 } 369 370 #endif /* !elf_map */ 371 372 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr) 373 { 374 int i, first_idx = -1, last_idx = -1; 375 376 for (i = 0; i < nr; i++) { 377 if (cmds[i].p_type == PT_LOAD) { 378 last_idx = i; 379 if (first_idx == -1) 380 first_idx = i; 381 } 382 } 383 if (first_idx == -1) 384 return 0; 385 386 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz - 387 ELF_PAGESTART(cmds[first_idx].p_vaddr); 388 } 389 390 /** 391 * load_elf_phdrs() - load ELF program headers 392 * @elf_ex: ELF header of the binary whose program headers should be loaded 393 * @elf_file: the opened ELF binary file 394 * 395 * Loads ELF program headers from the binary file elf_file, which has the ELF 396 * header pointed to by elf_ex, into a newly allocated array. The caller is 397 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure. 398 */ 399 static struct elf_phdr *load_elf_phdrs(struct elfhdr *elf_ex, 400 struct file *elf_file) 401 { 402 struct elf_phdr *elf_phdata = NULL; 403 int retval, size, err = -1; 404 405 /* 406 * If the size of this structure has changed, then punt, since 407 * we will be doing the wrong thing. 408 */ 409 if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) 410 goto out; 411 412 /* Sanity check the number of program headers... */ 413 if (elf_ex->e_phnum < 1 || 414 elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr)) 415 goto out; 416 417 /* ...and their total size. */ 418 size = sizeof(struct elf_phdr) * elf_ex->e_phnum; 419 if (size > ELF_MIN_ALIGN) 420 goto out; 421 422 elf_phdata = kmalloc(size, GFP_KERNEL); 423 if (!elf_phdata) 424 goto out; 425 426 /* Read in the program headers */ 427 retval = kernel_read(elf_file, elf_ex->e_phoff, 428 (char *)elf_phdata, size); 429 if (retval != size) { 430 err = (retval < 0) ? retval : -EIO; 431 goto out; 432 } 433 434 /* Success! */ 435 err = 0; 436 out: 437 if (err) { 438 kfree(elf_phdata); 439 elf_phdata = NULL; 440 } 441 return elf_phdata; 442 } 443 444 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE 445 446 /** 447 * struct arch_elf_state - arch-specific ELF loading state 448 * 449 * This structure is used to preserve architecture specific data during 450 * the loading of an ELF file, throughout the checking of architecture 451 * specific ELF headers & through to the point where the ELF load is 452 * known to be proceeding (ie. SET_PERSONALITY). 453 * 454 * This implementation is a dummy for architectures which require no 455 * specific state. 456 */ 457 struct arch_elf_state { 458 }; 459 460 #define INIT_ARCH_ELF_STATE {} 461 462 /** 463 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header 464 * @ehdr: The main ELF header 465 * @phdr: The program header to check 466 * @elf: The open ELF file 467 * @is_interp: True if the phdr is from the interpreter of the ELF being 468 * loaded, else false. 469 * @state: Architecture-specific state preserved throughout the process 470 * of loading the ELF. 471 * 472 * Inspects the program header phdr to validate its correctness and/or 473 * suitability for the system. Called once per ELF program header in the 474 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its 475 * interpreter. 476 * 477 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 478 * with that return code. 479 */ 480 static inline int arch_elf_pt_proc(struct elfhdr *ehdr, 481 struct elf_phdr *phdr, 482 struct file *elf, bool is_interp, 483 struct arch_elf_state *state) 484 { 485 /* Dummy implementation, always proceed */ 486 return 0; 487 } 488 489 /** 490 * arch_check_elf() - check an ELF executable 491 * @ehdr: The main ELF header 492 * @has_interp: True if the ELF has an interpreter, else false. 493 * @interp_ehdr: The interpreter's ELF header 494 * @state: Architecture-specific state preserved throughout the process 495 * of loading the ELF. 496 * 497 * Provides a final opportunity for architecture code to reject the loading 498 * of the ELF & cause an exec syscall to return an error. This is called after 499 * all program headers to be checked by arch_elf_pt_proc have been. 500 * 501 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 502 * with that return code. 503 */ 504 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, 505 struct elfhdr *interp_ehdr, 506 struct arch_elf_state *state) 507 { 508 /* Dummy implementation, always proceed */ 509 return 0; 510 } 511 512 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ 513 514 /* This is much more generalized than the library routine read function, 515 so we keep this separate. Technically the library read function 516 is only provided so that we can read a.out libraries that have 517 an ELF header */ 518 519 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, 520 struct file *interpreter, unsigned long *interp_map_addr, 521 unsigned long no_base, struct elf_phdr *interp_elf_phdata) 522 { 523 struct elf_phdr *eppnt; 524 unsigned long load_addr = 0; 525 int load_addr_set = 0; 526 unsigned long last_bss = 0, elf_bss = 0; 527 unsigned long error = ~0UL; 528 unsigned long total_size; 529 int i; 530 531 /* First of all, some simple consistency checks */ 532 if (interp_elf_ex->e_type != ET_EXEC && 533 interp_elf_ex->e_type != ET_DYN) 534 goto out; 535 if (!elf_check_arch(interp_elf_ex)) 536 goto out; 537 if (!interpreter->f_op->mmap) 538 goto out; 539 540 total_size = total_mapping_size(interp_elf_phdata, 541 interp_elf_ex->e_phnum); 542 if (!total_size) { 543 error = -EINVAL; 544 goto out; 545 } 546 547 eppnt = interp_elf_phdata; 548 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { 549 if (eppnt->p_type == PT_LOAD) { 550 int elf_type = MAP_PRIVATE | MAP_DENYWRITE; 551 int elf_prot = 0; 552 unsigned long vaddr = 0; 553 unsigned long k, map_addr; 554 555 if (eppnt->p_flags & PF_R) 556 elf_prot = PROT_READ; 557 if (eppnt->p_flags & PF_W) 558 elf_prot |= PROT_WRITE; 559 if (eppnt->p_flags & PF_X) 560 elf_prot |= PROT_EXEC; 561 vaddr = eppnt->p_vaddr; 562 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) 563 elf_type |= MAP_FIXED; 564 else if (no_base && interp_elf_ex->e_type == ET_DYN) 565 load_addr = -vaddr; 566 567 map_addr = elf_map(interpreter, load_addr + vaddr, 568 eppnt, elf_prot, elf_type, total_size); 569 total_size = 0; 570 if (!*interp_map_addr) 571 *interp_map_addr = map_addr; 572 error = map_addr; 573 if (BAD_ADDR(map_addr)) 574 goto out; 575 576 if (!load_addr_set && 577 interp_elf_ex->e_type == ET_DYN) { 578 load_addr = map_addr - ELF_PAGESTART(vaddr); 579 load_addr_set = 1; 580 } 581 582 /* 583 * Check to see if the section's size will overflow the 584 * allowed task size. Note that p_filesz must always be 585 * <= p_memsize so it's only necessary to check p_memsz. 586 */ 587 k = load_addr + eppnt->p_vaddr; 588 if (BAD_ADDR(k) || 589 eppnt->p_filesz > eppnt->p_memsz || 590 eppnt->p_memsz > TASK_SIZE || 591 TASK_SIZE - eppnt->p_memsz < k) { 592 error = -ENOMEM; 593 goto out; 594 } 595 596 /* 597 * Find the end of the file mapping for this phdr, and 598 * keep track of the largest address we see for this. 599 */ 600 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz; 601 if (k > elf_bss) 602 elf_bss = k; 603 604 /* 605 * Do the same thing for the memory mapping - between 606 * elf_bss and last_bss is the bss section. 607 */ 608 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz; 609 if (k > last_bss) 610 last_bss = k; 611 } 612 } 613 614 /* 615 * Now fill out the bss section: first pad the last page from 616 * the file up to the page boundary, and zero it from elf_bss 617 * up to the end of the page. 618 */ 619 if (padzero(elf_bss)) { 620 error = -EFAULT; 621 goto out; 622 } 623 /* 624 * Next, align both the file and mem bss up to the page size, 625 * since this is where elf_bss was just zeroed up to, and where 626 * last_bss will end after the vm_brk() below. 627 */ 628 elf_bss = ELF_PAGEALIGN(elf_bss); 629 last_bss = ELF_PAGEALIGN(last_bss); 630 /* Finally, if there is still more bss to allocate, do it. */ 631 if (last_bss > elf_bss) { 632 error = vm_brk(elf_bss, last_bss - elf_bss); 633 if (error) 634 goto out; 635 } 636 637 error = load_addr; 638 out: 639 return error; 640 } 641 642 /* 643 * These are the functions used to load ELF style executables and shared 644 * libraries. There is no binary dependent code anywhere else. 645 */ 646 647 #ifndef STACK_RND_MASK 648 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */ 649 #endif 650 651 static unsigned long randomize_stack_top(unsigned long stack_top) 652 { 653 unsigned long random_variable = 0; 654 655 if ((current->flags & PF_RANDOMIZE) && 656 !(current->personality & ADDR_NO_RANDOMIZE)) { 657 random_variable = get_random_long(); 658 random_variable &= STACK_RND_MASK; 659 random_variable <<= PAGE_SHIFT; 660 } 661 #ifdef CONFIG_STACK_GROWSUP 662 return PAGE_ALIGN(stack_top) + random_variable; 663 #else 664 return PAGE_ALIGN(stack_top) - random_variable; 665 #endif 666 } 667 668 static int load_elf_binary(struct linux_binprm *bprm) 669 { 670 struct file *interpreter = NULL; /* to shut gcc up */ 671 unsigned long load_addr = 0, load_bias = 0; 672 int load_addr_set = 0; 673 char * elf_interpreter = NULL; 674 unsigned long error; 675 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; 676 unsigned long elf_bss, elf_brk; 677 int retval, i; 678 unsigned long elf_entry; 679 unsigned long interp_load_addr = 0; 680 unsigned long start_code, end_code, start_data, end_data; 681 unsigned long reloc_func_desc __maybe_unused = 0; 682 int executable_stack = EXSTACK_DEFAULT; 683 struct pt_regs *regs = current_pt_regs(); 684 struct { 685 struct elfhdr elf_ex; 686 struct elfhdr interp_elf_ex; 687 } *loc; 688 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE; 689 690 loc = kmalloc(sizeof(*loc), GFP_KERNEL); 691 if (!loc) { 692 retval = -ENOMEM; 693 goto out_ret; 694 } 695 696 /* Get the exec-header */ 697 loc->elf_ex = *((struct elfhdr *)bprm->buf); 698 699 retval = -ENOEXEC; 700 /* First of all, some simple consistency checks */ 701 if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 702 goto out; 703 704 if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN) 705 goto out; 706 if (!elf_check_arch(&loc->elf_ex)) 707 goto out; 708 if (!bprm->file->f_op->mmap) 709 goto out; 710 711 elf_phdata = load_elf_phdrs(&loc->elf_ex, bprm->file); 712 if (!elf_phdata) 713 goto out; 714 715 elf_ppnt = elf_phdata; 716 elf_bss = 0; 717 elf_brk = 0; 718 719 start_code = ~0UL; 720 end_code = 0; 721 start_data = 0; 722 end_data = 0; 723 724 for (i = 0; i < loc->elf_ex.e_phnum; i++) { 725 if (elf_ppnt->p_type == PT_INTERP) { 726 /* This is the program interpreter used for 727 * shared libraries - for now assume that this 728 * is an a.out format binary 729 */ 730 retval = -ENOEXEC; 731 if (elf_ppnt->p_filesz > PATH_MAX || 732 elf_ppnt->p_filesz < 2) 733 goto out_free_ph; 734 735 retval = -ENOMEM; 736 elf_interpreter = kmalloc(elf_ppnt->p_filesz, 737 GFP_KERNEL); 738 if (!elf_interpreter) 739 goto out_free_ph; 740 741 retval = kernel_read(bprm->file, elf_ppnt->p_offset, 742 elf_interpreter, 743 elf_ppnt->p_filesz); 744 if (retval != elf_ppnt->p_filesz) { 745 if (retval >= 0) 746 retval = -EIO; 747 goto out_free_interp; 748 } 749 /* make sure path is NULL terminated */ 750 retval = -ENOEXEC; 751 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') 752 goto out_free_interp; 753 754 interpreter = open_exec(elf_interpreter); 755 retval = PTR_ERR(interpreter); 756 if (IS_ERR(interpreter)) 757 goto out_free_interp; 758 759 /* 760 * If the binary is not readable then enforce 761 * mm->dumpable = 0 regardless of the interpreter's 762 * permissions. 763 */ 764 would_dump(bprm, interpreter); 765 766 /* Get the exec headers */ 767 retval = kernel_read(interpreter, 0, 768 (void *)&loc->interp_elf_ex, 769 sizeof(loc->interp_elf_ex)); 770 if (retval != sizeof(loc->interp_elf_ex)) { 771 if (retval >= 0) 772 retval = -EIO; 773 goto out_free_dentry; 774 } 775 776 break; 777 } 778 elf_ppnt++; 779 } 780 781 elf_ppnt = elf_phdata; 782 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) 783 switch (elf_ppnt->p_type) { 784 case PT_GNU_STACK: 785 if (elf_ppnt->p_flags & PF_X) 786 executable_stack = EXSTACK_ENABLE_X; 787 else 788 executable_stack = EXSTACK_DISABLE_X; 789 break; 790 791 case PT_LOPROC ... PT_HIPROC: 792 retval = arch_elf_pt_proc(&loc->elf_ex, elf_ppnt, 793 bprm->file, false, 794 &arch_state); 795 if (retval) 796 goto out_free_dentry; 797 break; 798 } 799 800 /* Some simple consistency checks for the interpreter */ 801 if (elf_interpreter) { 802 retval = -ELIBBAD; 803 /* Not an ELF interpreter */ 804 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 805 goto out_free_dentry; 806 /* Verify the interpreter has a valid arch */ 807 if (!elf_check_arch(&loc->interp_elf_ex)) 808 goto out_free_dentry; 809 810 /* Load the interpreter program headers */ 811 interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex, 812 interpreter); 813 if (!interp_elf_phdata) 814 goto out_free_dentry; 815 816 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ 817 elf_ppnt = interp_elf_phdata; 818 for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++) 819 switch (elf_ppnt->p_type) { 820 case PT_LOPROC ... PT_HIPROC: 821 retval = arch_elf_pt_proc(&loc->interp_elf_ex, 822 elf_ppnt, interpreter, 823 true, &arch_state); 824 if (retval) 825 goto out_free_dentry; 826 break; 827 } 828 } 829 830 /* 831 * Allow arch code to reject the ELF at this point, whilst it's 832 * still possible to return an error to the code that invoked 833 * the exec syscall. 834 */ 835 retval = arch_check_elf(&loc->elf_ex, 836 !!interpreter, &loc->interp_elf_ex, 837 &arch_state); 838 if (retval) 839 goto out_free_dentry; 840 841 /* Flush all traces of the currently running executable */ 842 retval = flush_old_exec(bprm); 843 if (retval) 844 goto out_free_dentry; 845 846 /* Do this immediately, since STACK_TOP as used in setup_arg_pages 847 may depend on the personality. */ 848 SET_PERSONALITY2(loc->elf_ex, &arch_state); 849 if (elf_read_implies_exec(loc->elf_ex, executable_stack)) 850 current->personality |= READ_IMPLIES_EXEC; 851 852 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) 853 current->flags |= PF_RANDOMIZE; 854 855 setup_new_exec(bprm); 856 install_exec_creds(bprm); 857 858 /* Do this so that we can load the interpreter, if need be. We will 859 change some of these later */ 860 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), 861 executable_stack); 862 if (retval < 0) 863 goto out_free_dentry; 864 865 current->mm->start_stack = bprm->p; 866 867 /* Now we do a little grungy work by mmapping the ELF image into 868 the correct location in memory. */ 869 for(i = 0, elf_ppnt = elf_phdata; 870 i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { 871 int elf_prot = 0, elf_flags; 872 unsigned long k, vaddr; 873 unsigned long total_size = 0; 874 875 if (elf_ppnt->p_type != PT_LOAD) 876 continue; 877 878 if (unlikely (elf_brk > elf_bss)) { 879 unsigned long nbyte; 880 881 /* There was a PT_LOAD segment with p_memsz > p_filesz 882 before this one. Map anonymous pages, if needed, 883 and clear the area. */ 884 retval = set_brk(elf_bss + load_bias, 885 elf_brk + load_bias); 886 if (retval) 887 goto out_free_dentry; 888 nbyte = ELF_PAGEOFFSET(elf_bss); 889 if (nbyte) { 890 nbyte = ELF_MIN_ALIGN - nbyte; 891 if (nbyte > elf_brk - elf_bss) 892 nbyte = elf_brk - elf_bss; 893 if (clear_user((void __user *)elf_bss + 894 load_bias, nbyte)) { 895 /* 896 * This bss-zeroing can fail if the ELF 897 * file specifies odd protections. So 898 * we don't check the return value 899 */ 900 } 901 } 902 } 903 904 if (elf_ppnt->p_flags & PF_R) 905 elf_prot |= PROT_READ; 906 if (elf_ppnt->p_flags & PF_W) 907 elf_prot |= PROT_WRITE; 908 if (elf_ppnt->p_flags & PF_X) 909 elf_prot |= PROT_EXEC; 910 911 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE; 912 913 vaddr = elf_ppnt->p_vaddr; 914 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) { 915 elf_flags |= MAP_FIXED; 916 } else if (loc->elf_ex.e_type == ET_DYN) { 917 /* Try and get dynamic programs out of the way of the 918 * default mmap base, as well as whatever program they 919 * might try to exec. This is because the brk will 920 * follow the loader, and is not movable. */ 921 load_bias = ELF_ET_DYN_BASE - vaddr; 922 if (current->flags & PF_RANDOMIZE) 923 load_bias += arch_mmap_rnd(); 924 load_bias = ELF_PAGESTART(load_bias); 925 total_size = total_mapping_size(elf_phdata, 926 loc->elf_ex.e_phnum); 927 if (!total_size) { 928 retval = -EINVAL; 929 goto out_free_dentry; 930 } 931 } 932 933 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, 934 elf_prot, elf_flags, total_size); 935 if (BAD_ADDR(error)) { 936 retval = IS_ERR((void *)error) ? 937 PTR_ERR((void*)error) : -EINVAL; 938 goto out_free_dentry; 939 } 940 941 if (!load_addr_set) { 942 load_addr_set = 1; 943 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset); 944 if (loc->elf_ex.e_type == ET_DYN) { 945 load_bias += error - 946 ELF_PAGESTART(load_bias + vaddr); 947 load_addr += load_bias; 948 reloc_func_desc = load_bias; 949 } 950 } 951 k = elf_ppnt->p_vaddr; 952 if (k < start_code) 953 start_code = k; 954 if (start_data < k) 955 start_data = k; 956 957 /* 958 * Check to see if the section's size will overflow the 959 * allowed task size. Note that p_filesz must always be 960 * <= p_memsz so it is only necessary to check p_memsz. 961 */ 962 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || 963 elf_ppnt->p_memsz > TASK_SIZE || 964 TASK_SIZE - elf_ppnt->p_memsz < k) { 965 /* set_brk can never work. Avoid overflows. */ 966 retval = -EINVAL; 967 goto out_free_dentry; 968 } 969 970 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; 971 972 if (k > elf_bss) 973 elf_bss = k; 974 if ((elf_ppnt->p_flags & PF_X) && end_code < k) 975 end_code = k; 976 if (end_data < k) 977 end_data = k; 978 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; 979 if (k > elf_brk) 980 elf_brk = k; 981 } 982 983 loc->elf_ex.e_entry += load_bias; 984 elf_bss += load_bias; 985 elf_brk += load_bias; 986 start_code += load_bias; 987 end_code += load_bias; 988 start_data += load_bias; 989 end_data += load_bias; 990 991 /* Calling set_brk effectively mmaps the pages that we need 992 * for the bss and break sections. We must do this before 993 * mapping in the interpreter, to make sure it doesn't wind 994 * up getting placed where the bss needs to go. 995 */ 996 retval = set_brk(elf_bss, elf_brk); 997 if (retval) 998 goto out_free_dentry; 999 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { 1000 retval = -EFAULT; /* Nobody gets to see this, but.. */ 1001 goto out_free_dentry; 1002 } 1003 1004 if (elf_interpreter) { 1005 unsigned long interp_map_addr = 0; 1006 1007 elf_entry = load_elf_interp(&loc->interp_elf_ex, 1008 interpreter, 1009 &interp_map_addr, 1010 load_bias, interp_elf_phdata); 1011 if (!IS_ERR((void *)elf_entry)) { 1012 /* 1013 * load_elf_interp() returns relocation 1014 * adjustment 1015 */ 1016 interp_load_addr = elf_entry; 1017 elf_entry += loc->interp_elf_ex.e_entry; 1018 } 1019 if (BAD_ADDR(elf_entry)) { 1020 retval = IS_ERR((void *)elf_entry) ? 1021 (int)elf_entry : -EINVAL; 1022 goto out_free_dentry; 1023 } 1024 reloc_func_desc = interp_load_addr; 1025 1026 allow_write_access(interpreter); 1027 fput(interpreter); 1028 kfree(elf_interpreter); 1029 } else { 1030 elf_entry = loc->elf_ex.e_entry; 1031 if (BAD_ADDR(elf_entry)) { 1032 retval = -EINVAL; 1033 goto out_free_dentry; 1034 } 1035 } 1036 1037 kfree(interp_elf_phdata); 1038 kfree(elf_phdata); 1039 1040 set_binfmt(&elf_format); 1041 1042 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES 1043 retval = arch_setup_additional_pages(bprm, !!elf_interpreter); 1044 if (retval < 0) 1045 goto out; 1046 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ 1047 1048 retval = create_elf_tables(bprm, &loc->elf_ex, 1049 load_addr, interp_load_addr); 1050 if (retval < 0) 1051 goto out; 1052 /* N.B. passed_fileno might not be initialized? */ 1053 current->mm->end_code = end_code; 1054 current->mm->start_code = start_code; 1055 current->mm->start_data = start_data; 1056 current->mm->end_data = end_data; 1057 current->mm->start_stack = bprm->p; 1058 1059 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) { 1060 current->mm->brk = current->mm->start_brk = 1061 arch_randomize_brk(current->mm); 1062 #ifdef compat_brk_randomized 1063 current->brk_randomized = 1; 1064 #endif 1065 } 1066 1067 if (current->personality & MMAP_PAGE_ZERO) { 1068 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 1069 and some applications "depend" upon this behavior. 1070 Since we do not have the power to recompile these, we 1071 emulate the SVr4 behavior. Sigh. */ 1072 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, 1073 MAP_FIXED | MAP_PRIVATE, 0); 1074 } 1075 1076 #ifdef ELF_PLAT_INIT 1077 /* 1078 * The ABI may specify that certain registers be set up in special 1079 * ways (on i386 %edx is the address of a DT_FINI function, for 1080 * example. In addition, it may also specify (eg, PowerPC64 ELF) 1081 * that the e_entry field is the address of the function descriptor 1082 * for the startup routine, rather than the address of the startup 1083 * routine itself. This macro performs whatever initialization to 1084 * the regs structure is required as well as any relocations to the 1085 * function descriptor entries when executing dynamically links apps. 1086 */ 1087 ELF_PLAT_INIT(regs, reloc_func_desc); 1088 #endif 1089 1090 start_thread(regs, elf_entry, bprm->p); 1091 retval = 0; 1092 out: 1093 kfree(loc); 1094 out_ret: 1095 return retval; 1096 1097 /* error cleanup */ 1098 out_free_dentry: 1099 kfree(interp_elf_phdata); 1100 allow_write_access(interpreter); 1101 if (interpreter) 1102 fput(interpreter); 1103 out_free_interp: 1104 kfree(elf_interpreter); 1105 out_free_ph: 1106 kfree(elf_phdata); 1107 goto out; 1108 } 1109 1110 #ifdef CONFIG_USELIB 1111 /* This is really simpleminded and specialized - we are loading an 1112 a.out library that is given an ELF header. */ 1113 static int load_elf_library(struct file *file) 1114 { 1115 struct elf_phdr *elf_phdata; 1116 struct elf_phdr *eppnt; 1117 unsigned long elf_bss, bss, len; 1118 int retval, error, i, j; 1119 struct elfhdr elf_ex; 1120 1121 error = -ENOEXEC; 1122 retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex)); 1123 if (retval != sizeof(elf_ex)) 1124 goto out; 1125 1126 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 1127 goto out; 1128 1129 /* First of all, some simple consistency checks */ 1130 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 || 1131 !elf_check_arch(&elf_ex) || !file->f_op->mmap) 1132 goto out; 1133 1134 /* Now read in all of the header information */ 1135 1136 j = sizeof(struct elf_phdr) * elf_ex.e_phnum; 1137 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */ 1138 1139 error = -ENOMEM; 1140 elf_phdata = kmalloc(j, GFP_KERNEL); 1141 if (!elf_phdata) 1142 goto out; 1143 1144 eppnt = elf_phdata; 1145 error = -ENOEXEC; 1146 retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j); 1147 if (retval != j) 1148 goto out_free_ph; 1149 1150 for (j = 0, i = 0; i<elf_ex.e_phnum; i++) 1151 if ((eppnt + i)->p_type == PT_LOAD) 1152 j++; 1153 if (j != 1) 1154 goto out_free_ph; 1155 1156 while (eppnt->p_type != PT_LOAD) 1157 eppnt++; 1158 1159 /* Now use mmap to map the library into memory. */ 1160 error = vm_mmap(file, 1161 ELF_PAGESTART(eppnt->p_vaddr), 1162 (eppnt->p_filesz + 1163 ELF_PAGEOFFSET(eppnt->p_vaddr)), 1164 PROT_READ | PROT_WRITE | PROT_EXEC, 1165 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE, 1166 (eppnt->p_offset - 1167 ELF_PAGEOFFSET(eppnt->p_vaddr))); 1168 if (error != ELF_PAGESTART(eppnt->p_vaddr)) 1169 goto out_free_ph; 1170 1171 elf_bss = eppnt->p_vaddr + eppnt->p_filesz; 1172 if (padzero(elf_bss)) { 1173 error = -EFAULT; 1174 goto out_free_ph; 1175 } 1176 1177 len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + 1178 ELF_MIN_ALIGN - 1); 1179 bss = eppnt->p_memsz + eppnt->p_vaddr; 1180 if (bss > len) { 1181 error = vm_brk(len, bss - len); 1182 if (error) 1183 goto out_free_ph; 1184 } 1185 error = 0; 1186 1187 out_free_ph: 1188 kfree(elf_phdata); 1189 out: 1190 return error; 1191 } 1192 #endif /* #ifdef CONFIG_USELIB */ 1193 1194 #ifdef CONFIG_ELF_CORE 1195 /* 1196 * ELF core dumper 1197 * 1198 * Modelled on fs/exec.c:aout_core_dump() 1199 * Jeremy Fitzhardinge <jeremy@sw.oz.au> 1200 */ 1201 1202 /* 1203 * The purpose of always_dump_vma() is to make sure that special kernel mappings 1204 * that are useful for post-mortem analysis are included in every core dump. 1205 * In that way we ensure that the core dump is fully interpretable later 1206 * without matching up the same kernel and hardware config to see what PC values 1207 * meant. These special mappings include - vDSO, vsyscall, and other 1208 * architecture specific mappings 1209 */ 1210 static bool always_dump_vma(struct vm_area_struct *vma) 1211 { 1212 /* Any vsyscall mappings? */ 1213 if (vma == get_gate_vma(vma->vm_mm)) 1214 return true; 1215 1216 /* 1217 * Assume that all vmas with a .name op should always be dumped. 1218 * If this changes, a new vm_ops field can easily be added. 1219 */ 1220 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 1221 return true; 1222 1223 /* 1224 * arch_vma_name() returns non-NULL for special architecture mappings, 1225 * such as vDSO sections. 1226 */ 1227 if (arch_vma_name(vma)) 1228 return true; 1229 1230 return false; 1231 } 1232 1233 /* 1234 * Decide what to dump of a segment, part, all or none. 1235 */ 1236 static unsigned long vma_dump_size(struct vm_area_struct *vma, 1237 unsigned long mm_flags) 1238 { 1239 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) 1240 1241 /* always dump the vdso and vsyscall sections */ 1242 if (always_dump_vma(vma)) 1243 goto whole; 1244 1245 if (vma->vm_flags & VM_DONTDUMP) 1246 return 0; 1247 1248 /* support for DAX */ 1249 if (vma_is_dax(vma)) { 1250 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED)) 1251 goto whole; 1252 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE)) 1253 goto whole; 1254 return 0; 1255 } 1256 1257 /* Hugetlb memory check */ 1258 if (vma->vm_flags & VM_HUGETLB) { 1259 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED)) 1260 goto whole; 1261 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) 1262 goto whole; 1263 return 0; 1264 } 1265 1266 /* Do not dump I/O mapped devices or special mappings */ 1267 if (vma->vm_flags & VM_IO) 1268 return 0; 1269 1270 /* By default, dump shared memory if mapped from an anonymous file. */ 1271 if (vma->vm_flags & VM_SHARED) { 1272 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1273 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED)) 1274 goto whole; 1275 return 0; 1276 } 1277 1278 /* Dump segments that have been written to. */ 1279 if (vma->anon_vma && FILTER(ANON_PRIVATE)) 1280 goto whole; 1281 if (vma->vm_file == NULL) 1282 return 0; 1283 1284 if (FILTER(MAPPED_PRIVATE)) 1285 goto whole; 1286 1287 /* 1288 * If this looks like the beginning of a DSO or executable mapping, 1289 * check for an ELF header. If we find one, dump the first page to 1290 * aid in determining what was mapped here. 1291 */ 1292 if (FILTER(ELF_HEADERS) && 1293 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1294 u32 __user *header = (u32 __user *) vma->vm_start; 1295 u32 word; 1296 mm_segment_t fs = get_fs(); 1297 /* 1298 * Doing it this way gets the constant folded by GCC. 1299 */ 1300 union { 1301 u32 cmp; 1302 char elfmag[SELFMAG]; 1303 } magic; 1304 BUILD_BUG_ON(SELFMAG != sizeof word); 1305 magic.elfmag[EI_MAG0] = ELFMAG0; 1306 magic.elfmag[EI_MAG1] = ELFMAG1; 1307 magic.elfmag[EI_MAG2] = ELFMAG2; 1308 magic.elfmag[EI_MAG3] = ELFMAG3; 1309 /* 1310 * Switch to the user "segment" for get_user(), 1311 * then put back what elf_core_dump() had in place. 1312 */ 1313 set_fs(USER_DS); 1314 if (unlikely(get_user(word, header))) 1315 word = 0; 1316 set_fs(fs); 1317 if (word == magic.cmp) 1318 return PAGE_SIZE; 1319 } 1320 1321 #undef FILTER 1322 1323 return 0; 1324 1325 whole: 1326 return vma->vm_end - vma->vm_start; 1327 } 1328 1329 /* An ELF note in memory */ 1330 struct memelfnote 1331 { 1332 const char *name; 1333 int type; 1334 unsigned int datasz; 1335 void *data; 1336 }; 1337 1338 static int notesize(struct memelfnote *en) 1339 { 1340 int sz; 1341 1342 sz = sizeof(struct elf_note); 1343 sz += roundup(strlen(en->name) + 1, 4); 1344 sz += roundup(en->datasz, 4); 1345 1346 return sz; 1347 } 1348 1349 static int writenote(struct memelfnote *men, struct coredump_params *cprm) 1350 { 1351 struct elf_note en; 1352 en.n_namesz = strlen(men->name) + 1; 1353 en.n_descsz = men->datasz; 1354 en.n_type = men->type; 1355 1356 return dump_emit(cprm, &en, sizeof(en)) && 1357 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) && 1358 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4); 1359 } 1360 1361 static void fill_elf_header(struct elfhdr *elf, int segs, 1362 u16 machine, u32 flags) 1363 { 1364 memset(elf, 0, sizeof(*elf)); 1365 1366 memcpy(elf->e_ident, ELFMAG, SELFMAG); 1367 elf->e_ident[EI_CLASS] = ELF_CLASS; 1368 elf->e_ident[EI_DATA] = ELF_DATA; 1369 elf->e_ident[EI_VERSION] = EV_CURRENT; 1370 elf->e_ident[EI_OSABI] = ELF_OSABI; 1371 1372 elf->e_type = ET_CORE; 1373 elf->e_machine = machine; 1374 elf->e_version = EV_CURRENT; 1375 elf->e_phoff = sizeof(struct elfhdr); 1376 elf->e_flags = flags; 1377 elf->e_ehsize = sizeof(struct elfhdr); 1378 elf->e_phentsize = sizeof(struct elf_phdr); 1379 elf->e_phnum = segs; 1380 1381 return; 1382 } 1383 1384 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset) 1385 { 1386 phdr->p_type = PT_NOTE; 1387 phdr->p_offset = offset; 1388 phdr->p_vaddr = 0; 1389 phdr->p_paddr = 0; 1390 phdr->p_filesz = sz; 1391 phdr->p_memsz = 0; 1392 phdr->p_flags = 0; 1393 phdr->p_align = 0; 1394 return; 1395 } 1396 1397 static void fill_note(struct memelfnote *note, const char *name, int type, 1398 unsigned int sz, void *data) 1399 { 1400 note->name = name; 1401 note->type = type; 1402 note->datasz = sz; 1403 note->data = data; 1404 return; 1405 } 1406 1407 /* 1408 * fill up all the fields in prstatus from the given task struct, except 1409 * registers which need to be filled up separately. 1410 */ 1411 static void fill_prstatus(struct elf_prstatus *prstatus, 1412 struct task_struct *p, long signr) 1413 { 1414 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 1415 prstatus->pr_sigpend = p->pending.signal.sig[0]; 1416 prstatus->pr_sighold = p->blocked.sig[0]; 1417 rcu_read_lock(); 1418 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1419 rcu_read_unlock(); 1420 prstatus->pr_pid = task_pid_vnr(p); 1421 prstatus->pr_pgrp = task_pgrp_vnr(p); 1422 prstatus->pr_sid = task_session_vnr(p); 1423 if (thread_group_leader(p)) { 1424 struct task_cputime cputime; 1425 1426 /* 1427 * This is the record for the group leader. It shows the 1428 * group-wide total, not its individual thread total. 1429 */ 1430 thread_group_cputime(p, &cputime); 1431 cputime_to_timeval(cputime.utime, &prstatus->pr_utime); 1432 cputime_to_timeval(cputime.stime, &prstatus->pr_stime); 1433 } else { 1434 cputime_t utime, stime; 1435 1436 task_cputime(p, &utime, &stime); 1437 cputime_to_timeval(utime, &prstatus->pr_utime); 1438 cputime_to_timeval(stime, &prstatus->pr_stime); 1439 } 1440 cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime); 1441 cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime); 1442 } 1443 1444 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, 1445 struct mm_struct *mm) 1446 { 1447 const struct cred *cred; 1448 unsigned int i, len; 1449 1450 /* first copy the parameters from user space */ 1451 memset(psinfo, 0, sizeof(struct elf_prpsinfo)); 1452 1453 len = mm->arg_end - mm->arg_start; 1454 if (len >= ELF_PRARGSZ) 1455 len = ELF_PRARGSZ-1; 1456 if (copy_from_user(&psinfo->pr_psargs, 1457 (const char __user *)mm->arg_start, len)) 1458 return -EFAULT; 1459 for(i = 0; i < len; i++) 1460 if (psinfo->pr_psargs[i] == 0) 1461 psinfo->pr_psargs[i] = ' '; 1462 psinfo->pr_psargs[len] = 0; 1463 1464 rcu_read_lock(); 1465 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1466 rcu_read_unlock(); 1467 psinfo->pr_pid = task_pid_vnr(p); 1468 psinfo->pr_pgrp = task_pgrp_vnr(p); 1469 psinfo->pr_sid = task_session_vnr(p); 1470 1471 i = p->state ? ffz(~p->state) + 1 : 0; 1472 psinfo->pr_state = i; 1473 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i]; 1474 psinfo->pr_zomb = psinfo->pr_sname == 'Z'; 1475 psinfo->pr_nice = task_nice(p); 1476 psinfo->pr_flag = p->flags; 1477 rcu_read_lock(); 1478 cred = __task_cred(p); 1479 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid)); 1480 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid)); 1481 rcu_read_unlock(); 1482 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname)); 1483 1484 return 0; 1485 } 1486 1487 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) 1488 { 1489 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; 1490 int i = 0; 1491 do 1492 i += 2; 1493 while (auxv[i - 2] != AT_NULL); 1494 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); 1495 } 1496 1497 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata, 1498 const siginfo_t *siginfo) 1499 { 1500 mm_segment_t old_fs = get_fs(); 1501 set_fs(KERNEL_DS); 1502 copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo); 1503 set_fs(old_fs); 1504 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata); 1505 } 1506 1507 #define MAX_FILE_NOTE_SIZE (4*1024*1024) 1508 /* 1509 * Format of NT_FILE note: 1510 * 1511 * long count -- how many files are mapped 1512 * long page_size -- units for file_ofs 1513 * array of [COUNT] elements of 1514 * long start 1515 * long end 1516 * long file_ofs 1517 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL... 1518 */ 1519 static int fill_files_note(struct memelfnote *note) 1520 { 1521 struct vm_area_struct *vma; 1522 unsigned count, size, names_ofs, remaining, n; 1523 user_long_t *data; 1524 user_long_t *start_end_ofs; 1525 char *name_base, *name_curpos; 1526 1527 /* *Estimated* file count and total data size needed */ 1528 count = current->mm->map_count; 1529 size = count * 64; 1530 1531 names_ofs = (2 + 3 * count) * sizeof(data[0]); 1532 alloc: 1533 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */ 1534 return -EINVAL; 1535 size = round_up(size, PAGE_SIZE); 1536 data = vmalloc(size); 1537 if (!data) 1538 return -ENOMEM; 1539 1540 start_end_ofs = data + 2; 1541 name_base = name_curpos = ((char *)data) + names_ofs; 1542 remaining = size - names_ofs; 1543 count = 0; 1544 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) { 1545 struct file *file; 1546 const char *filename; 1547 1548 file = vma->vm_file; 1549 if (!file) 1550 continue; 1551 filename = file_path(file, name_curpos, remaining); 1552 if (IS_ERR(filename)) { 1553 if (PTR_ERR(filename) == -ENAMETOOLONG) { 1554 vfree(data); 1555 size = size * 5 / 4; 1556 goto alloc; 1557 } 1558 continue; 1559 } 1560 1561 /* file_path() fills at the end, move name down */ 1562 /* n = strlen(filename) + 1: */ 1563 n = (name_curpos + remaining) - filename; 1564 remaining = filename - name_curpos; 1565 memmove(name_curpos, filename, n); 1566 name_curpos += n; 1567 1568 *start_end_ofs++ = vma->vm_start; 1569 *start_end_ofs++ = vma->vm_end; 1570 *start_end_ofs++ = vma->vm_pgoff; 1571 count++; 1572 } 1573 1574 /* Now we know exact count of files, can store it */ 1575 data[0] = count; 1576 data[1] = PAGE_SIZE; 1577 /* 1578 * Count usually is less than current->mm->map_count, 1579 * we need to move filenames down. 1580 */ 1581 n = current->mm->map_count - count; 1582 if (n != 0) { 1583 unsigned shift_bytes = n * 3 * sizeof(data[0]); 1584 memmove(name_base - shift_bytes, name_base, 1585 name_curpos - name_base); 1586 name_curpos -= shift_bytes; 1587 } 1588 1589 size = name_curpos - (char *)data; 1590 fill_note(note, "CORE", NT_FILE, size, data); 1591 return 0; 1592 } 1593 1594 #ifdef CORE_DUMP_USE_REGSET 1595 #include <linux/regset.h> 1596 1597 struct elf_thread_core_info { 1598 struct elf_thread_core_info *next; 1599 struct task_struct *task; 1600 struct elf_prstatus prstatus; 1601 struct memelfnote notes[0]; 1602 }; 1603 1604 struct elf_note_info { 1605 struct elf_thread_core_info *thread; 1606 struct memelfnote psinfo; 1607 struct memelfnote signote; 1608 struct memelfnote auxv; 1609 struct memelfnote files; 1610 user_siginfo_t csigdata; 1611 size_t size; 1612 int thread_notes; 1613 }; 1614 1615 /* 1616 * When a regset has a writeback hook, we call it on each thread before 1617 * dumping user memory. On register window machines, this makes sure the 1618 * user memory backing the register data is up to date before we read it. 1619 */ 1620 static void do_thread_regset_writeback(struct task_struct *task, 1621 const struct user_regset *regset) 1622 { 1623 if (regset->writeback) 1624 regset->writeback(task, regset, 1); 1625 } 1626 1627 #ifndef PRSTATUS_SIZE 1628 #define PRSTATUS_SIZE(S, R) sizeof(S) 1629 #endif 1630 1631 #ifndef SET_PR_FPVALID 1632 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V)) 1633 #endif 1634 1635 static int fill_thread_core_info(struct elf_thread_core_info *t, 1636 const struct user_regset_view *view, 1637 long signr, size_t *total) 1638 { 1639 unsigned int i; 1640 unsigned int regset_size = view->regsets[0].n * view->regsets[0].size; 1641 1642 /* 1643 * NT_PRSTATUS is the one special case, because the regset data 1644 * goes into the pr_reg field inside the note contents, rather 1645 * than being the whole note contents. We fill the reset in here. 1646 * We assume that regset 0 is NT_PRSTATUS. 1647 */ 1648 fill_prstatus(&t->prstatus, t->task, signr); 1649 (void) view->regsets[0].get(t->task, &view->regsets[0], 0, regset_size, 1650 &t->prstatus.pr_reg, NULL); 1651 1652 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, 1653 PRSTATUS_SIZE(t->prstatus, regset_size), &t->prstatus); 1654 *total += notesize(&t->notes[0]); 1655 1656 do_thread_regset_writeback(t->task, &view->regsets[0]); 1657 1658 /* 1659 * Each other regset might generate a note too. For each regset 1660 * that has no core_note_type or is inactive, we leave t->notes[i] 1661 * all zero and we'll know to skip writing it later. 1662 */ 1663 for (i = 1; i < view->n; ++i) { 1664 const struct user_regset *regset = &view->regsets[i]; 1665 do_thread_regset_writeback(t->task, regset); 1666 if (regset->core_note_type && regset->get && 1667 (!regset->active || regset->active(t->task, regset))) { 1668 int ret; 1669 size_t size = regset->n * regset->size; 1670 void *data = kmalloc(size, GFP_KERNEL); 1671 if (unlikely(!data)) 1672 return 0; 1673 ret = regset->get(t->task, regset, 1674 0, size, data, NULL); 1675 if (unlikely(ret)) 1676 kfree(data); 1677 else { 1678 if (regset->core_note_type != NT_PRFPREG) 1679 fill_note(&t->notes[i], "LINUX", 1680 regset->core_note_type, 1681 size, data); 1682 else { 1683 SET_PR_FPVALID(&t->prstatus, 1684 1, regset_size); 1685 fill_note(&t->notes[i], "CORE", 1686 NT_PRFPREG, size, data); 1687 } 1688 *total += notesize(&t->notes[i]); 1689 } 1690 } 1691 } 1692 1693 return 1; 1694 } 1695 1696 static int fill_note_info(struct elfhdr *elf, int phdrs, 1697 struct elf_note_info *info, 1698 const siginfo_t *siginfo, struct pt_regs *regs) 1699 { 1700 struct task_struct *dump_task = current; 1701 const struct user_regset_view *view = task_user_regset_view(dump_task); 1702 struct elf_thread_core_info *t; 1703 struct elf_prpsinfo *psinfo; 1704 struct core_thread *ct; 1705 unsigned int i; 1706 1707 info->size = 0; 1708 info->thread = NULL; 1709 1710 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1711 if (psinfo == NULL) { 1712 info->psinfo.data = NULL; /* So we don't free this wrongly */ 1713 return 0; 1714 } 1715 1716 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); 1717 1718 /* 1719 * Figure out how many notes we're going to need for each thread. 1720 */ 1721 info->thread_notes = 0; 1722 for (i = 0; i < view->n; ++i) 1723 if (view->regsets[i].core_note_type != 0) 1724 ++info->thread_notes; 1725 1726 /* 1727 * Sanity check. We rely on regset 0 being in NT_PRSTATUS, 1728 * since it is our one special case. 1729 */ 1730 if (unlikely(info->thread_notes == 0) || 1731 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) { 1732 WARN_ON(1); 1733 return 0; 1734 } 1735 1736 /* 1737 * Initialize the ELF file header. 1738 */ 1739 fill_elf_header(elf, phdrs, 1740 view->e_machine, view->e_flags); 1741 1742 /* 1743 * Allocate a structure for each thread. 1744 */ 1745 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) { 1746 t = kzalloc(offsetof(struct elf_thread_core_info, 1747 notes[info->thread_notes]), 1748 GFP_KERNEL); 1749 if (unlikely(!t)) 1750 return 0; 1751 1752 t->task = ct->task; 1753 if (ct->task == dump_task || !info->thread) { 1754 t->next = info->thread; 1755 info->thread = t; 1756 } else { 1757 /* 1758 * Make sure to keep the original task at 1759 * the head of the list. 1760 */ 1761 t->next = info->thread->next; 1762 info->thread->next = t; 1763 } 1764 } 1765 1766 /* 1767 * Now fill in each thread's information. 1768 */ 1769 for (t = info->thread; t != NULL; t = t->next) 1770 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size)) 1771 return 0; 1772 1773 /* 1774 * Fill in the two process-wide notes. 1775 */ 1776 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm); 1777 info->size += notesize(&info->psinfo); 1778 1779 fill_siginfo_note(&info->signote, &info->csigdata, siginfo); 1780 info->size += notesize(&info->signote); 1781 1782 fill_auxv_note(&info->auxv, current->mm); 1783 info->size += notesize(&info->auxv); 1784 1785 if (fill_files_note(&info->files) == 0) 1786 info->size += notesize(&info->files); 1787 1788 return 1; 1789 } 1790 1791 static size_t get_note_info_size(struct elf_note_info *info) 1792 { 1793 return info->size; 1794 } 1795 1796 /* 1797 * Write all the notes for each thread. When writing the first thread, the 1798 * process-wide notes are interleaved after the first thread-specific note. 1799 */ 1800 static int write_note_info(struct elf_note_info *info, 1801 struct coredump_params *cprm) 1802 { 1803 bool first = true; 1804 struct elf_thread_core_info *t = info->thread; 1805 1806 do { 1807 int i; 1808 1809 if (!writenote(&t->notes[0], cprm)) 1810 return 0; 1811 1812 if (first && !writenote(&info->psinfo, cprm)) 1813 return 0; 1814 if (first && !writenote(&info->signote, cprm)) 1815 return 0; 1816 if (first && !writenote(&info->auxv, cprm)) 1817 return 0; 1818 if (first && info->files.data && 1819 !writenote(&info->files, cprm)) 1820 return 0; 1821 1822 for (i = 1; i < info->thread_notes; ++i) 1823 if (t->notes[i].data && 1824 !writenote(&t->notes[i], cprm)) 1825 return 0; 1826 1827 first = false; 1828 t = t->next; 1829 } while (t); 1830 1831 return 1; 1832 } 1833 1834 static void free_note_info(struct elf_note_info *info) 1835 { 1836 struct elf_thread_core_info *threads = info->thread; 1837 while (threads) { 1838 unsigned int i; 1839 struct elf_thread_core_info *t = threads; 1840 threads = t->next; 1841 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus); 1842 for (i = 1; i < info->thread_notes; ++i) 1843 kfree(t->notes[i].data); 1844 kfree(t); 1845 } 1846 kfree(info->psinfo.data); 1847 vfree(info->files.data); 1848 } 1849 1850 #else 1851 1852 /* Here is the structure in which status of each thread is captured. */ 1853 struct elf_thread_status 1854 { 1855 struct list_head list; 1856 struct elf_prstatus prstatus; /* NT_PRSTATUS */ 1857 elf_fpregset_t fpu; /* NT_PRFPREG */ 1858 struct task_struct *thread; 1859 #ifdef ELF_CORE_COPY_XFPREGS 1860 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */ 1861 #endif 1862 struct memelfnote notes[3]; 1863 int num_notes; 1864 }; 1865 1866 /* 1867 * In order to add the specific thread information for the elf file format, 1868 * we need to keep a linked list of every threads pr_status and then create 1869 * a single section for them in the final core file. 1870 */ 1871 static int elf_dump_thread_status(long signr, struct elf_thread_status *t) 1872 { 1873 int sz = 0; 1874 struct task_struct *p = t->thread; 1875 t->num_notes = 0; 1876 1877 fill_prstatus(&t->prstatus, p, signr); 1878 elf_core_copy_task_regs(p, &t->prstatus.pr_reg); 1879 1880 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), 1881 &(t->prstatus)); 1882 t->num_notes++; 1883 sz += notesize(&t->notes[0]); 1884 1885 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, 1886 &t->fpu))) { 1887 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), 1888 &(t->fpu)); 1889 t->num_notes++; 1890 sz += notesize(&t->notes[1]); 1891 } 1892 1893 #ifdef ELF_CORE_COPY_XFPREGS 1894 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) { 1895 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE, 1896 sizeof(t->xfpu), &t->xfpu); 1897 t->num_notes++; 1898 sz += notesize(&t->notes[2]); 1899 } 1900 #endif 1901 return sz; 1902 } 1903 1904 struct elf_note_info { 1905 struct memelfnote *notes; 1906 struct memelfnote *notes_files; 1907 struct elf_prstatus *prstatus; /* NT_PRSTATUS */ 1908 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */ 1909 struct list_head thread_list; 1910 elf_fpregset_t *fpu; 1911 #ifdef ELF_CORE_COPY_XFPREGS 1912 elf_fpxregset_t *xfpu; 1913 #endif 1914 user_siginfo_t csigdata; 1915 int thread_status_size; 1916 int numnote; 1917 }; 1918 1919 static int elf_note_info_init(struct elf_note_info *info) 1920 { 1921 memset(info, 0, sizeof(*info)); 1922 INIT_LIST_HEAD(&info->thread_list); 1923 1924 /* Allocate space for ELF notes */ 1925 info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL); 1926 if (!info->notes) 1927 return 0; 1928 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL); 1929 if (!info->psinfo) 1930 return 0; 1931 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL); 1932 if (!info->prstatus) 1933 return 0; 1934 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL); 1935 if (!info->fpu) 1936 return 0; 1937 #ifdef ELF_CORE_COPY_XFPREGS 1938 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL); 1939 if (!info->xfpu) 1940 return 0; 1941 #endif 1942 return 1; 1943 } 1944 1945 static int fill_note_info(struct elfhdr *elf, int phdrs, 1946 struct elf_note_info *info, 1947 const siginfo_t *siginfo, struct pt_regs *regs) 1948 { 1949 struct list_head *t; 1950 struct core_thread *ct; 1951 struct elf_thread_status *ets; 1952 1953 if (!elf_note_info_init(info)) 1954 return 0; 1955 1956 for (ct = current->mm->core_state->dumper.next; 1957 ct; ct = ct->next) { 1958 ets = kzalloc(sizeof(*ets), GFP_KERNEL); 1959 if (!ets) 1960 return 0; 1961 1962 ets->thread = ct->task; 1963 list_add(&ets->list, &info->thread_list); 1964 } 1965 1966 list_for_each(t, &info->thread_list) { 1967 int sz; 1968 1969 ets = list_entry(t, struct elf_thread_status, list); 1970 sz = elf_dump_thread_status(siginfo->si_signo, ets); 1971 info->thread_status_size += sz; 1972 } 1973 /* now collect the dump for the current */ 1974 memset(info->prstatus, 0, sizeof(*info->prstatus)); 1975 fill_prstatus(info->prstatus, current, siginfo->si_signo); 1976 elf_core_copy_regs(&info->prstatus->pr_reg, regs); 1977 1978 /* Set up header */ 1979 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS); 1980 1981 /* 1982 * Set up the notes in similar form to SVR4 core dumps made 1983 * with info from their /proc. 1984 */ 1985 1986 fill_note(info->notes + 0, "CORE", NT_PRSTATUS, 1987 sizeof(*info->prstatus), info->prstatus); 1988 fill_psinfo(info->psinfo, current->group_leader, current->mm); 1989 fill_note(info->notes + 1, "CORE", NT_PRPSINFO, 1990 sizeof(*info->psinfo), info->psinfo); 1991 1992 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo); 1993 fill_auxv_note(info->notes + 3, current->mm); 1994 info->numnote = 4; 1995 1996 if (fill_files_note(info->notes + info->numnote) == 0) { 1997 info->notes_files = info->notes + info->numnote; 1998 info->numnote++; 1999 } 2000 2001 /* Try to dump the FPU. */ 2002 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, 2003 info->fpu); 2004 if (info->prstatus->pr_fpvalid) 2005 fill_note(info->notes + info->numnote++, 2006 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu); 2007 #ifdef ELF_CORE_COPY_XFPREGS 2008 if (elf_core_copy_task_xfpregs(current, info->xfpu)) 2009 fill_note(info->notes + info->numnote++, 2010 "LINUX", ELF_CORE_XFPREG_TYPE, 2011 sizeof(*info->xfpu), info->xfpu); 2012 #endif 2013 2014 return 1; 2015 } 2016 2017 static size_t get_note_info_size(struct elf_note_info *info) 2018 { 2019 int sz = 0; 2020 int i; 2021 2022 for (i = 0; i < info->numnote; i++) 2023 sz += notesize(info->notes + i); 2024 2025 sz += info->thread_status_size; 2026 2027 return sz; 2028 } 2029 2030 static int write_note_info(struct elf_note_info *info, 2031 struct coredump_params *cprm) 2032 { 2033 int i; 2034 struct list_head *t; 2035 2036 for (i = 0; i < info->numnote; i++) 2037 if (!writenote(info->notes + i, cprm)) 2038 return 0; 2039 2040 /* write out the thread status notes section */ 2041 list_for_each(t, &info->thread_list) { 2042 struct elf_thread_status *tmp = 2043 list_entry(t, struct elf_thread_status, list); 2044 2045 for (i = 0; i < tmp->num_notes; i++) 2046 if (!writenote(&tmp->notes[i], cprm)) 2047 return 0; 2048 } 2049 2050 return 1; 2051 } 2052 2053 static void free_note_info(struct elf_note_info *info) 2054 { 2055 while (!list_empty(&info->thread_list)) { 2056 struct list_head *tmp = info->thread_list.next; 2057 list_del(tmp); 2058 kfree(list_entry(tmp, struct elf_thread_status, list)); 2059 } 2060 2061 /* Free data possibly allocated by fill_files_note(): */ 2062 if (info->notes_files) 2063 vfree(info->notes_files->data); 2064 2065 kfree(info->prstatus); 2066 kfree(info->psinfo); 2067 kfree(info->notes); 2068 kfree(info->fpu); 2069 #ifdef ELF_CORE_COPY_XFPREGS 2070 kfree(info->xfpu); 2071 #endif 2072 } 2073 2074 #endif 2075 2076 static struct vm_area_struct *first_vma(struct task_struct *tsk, 2077 struct vm_area_struct *gate_vma) 2078 { 2079 struct vm_area_struct *ret = tsk->mm->mmap; 2080 2081 if (ret) 2082 return ret; 2083 return gate_vma; 2084 } 2085 /* 2086 * Helper function for iterating across a vma list. It ensures that the caller 2087 * will visit `gate_vma' prior to terminating the search. 2088 */ 2089 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma, 2090 struct vm_area_struct *gate_vma) 2091 { 2092 struct vm_area_struct *ret; 2093 2094 ret = this_vma->vm_next; 2095 if (ret) 2096 return ret; 2097 if (this_vma == gate_vma) 2098 return NULL; 2099 return gate_vma; 2100 } 2101 2102 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, 2103 elf_addr_t e_shoff, int segs) 2104 { 2105 elf->e_shoff = e_shoff; 2106 elf->e_shentsize = sizeof(*shdr4extnum); 2107 elf->e_shnum = 1; 2108 elf->e_shstrndx = SHN_UNDEF; 2109 2110 memset(shdr4extnum, 0, sizeof(*shdr4extnum)); 2111 2112 shdr4extnum->sh_type = SHT_NULL; 2113 shdr4extnum->sh_size = elf->e_shnum; 2114 shdr4extnum->sh_link = elf->e_shstrndx; 2115 shdr4extnum->sh_info = segs; 2116 } 2117 2118 /* 2119 * Actual dumper 2120 * 2121 * This is a two-pass process; first we find the offsets of the bits, 2122 * and then they are actually written out. If we run out of core limit 2123 * we just truncate. 2124 */ 2125 static int elf_core_dump(struct coredump_params *cprm) 2126 { 2127 int has_dumped = 0; 2128 mm_segment_t fs; 2129 int segs, i; 2130 size_t vma_data_size = 0; 2131 struct vm_area_struct *vma, *gate_vma; 2132 struct elfhdr *elf = NULL; 2133 loff_t offset = 0, dataoff; 2134 struct elf_note_info info = { }; 2135 struct elf_phdr *phdr4note = NULL; 2136 struct elf_shdr *shdr4extnum = NULL; 2137 Elf_Half e_phnum; 2138 elf_addr_t e_shoff; 2139 elf_addr_t *vma_filesz = NULL; 2140 2141 /* 2142 * We no longer stop all VM operations. 2143 * 2144 * This is because those proceses that could possibly change map_count 2145 * or the mmap / vma pages are now blocked in do_exit on current 2146 * finishing this core dump. 2147 * 2148 * Only ptrace can touch these memory addresses, but it doesn't change 2149 * the map_count or the pages allocated. So no possibility of crashing 2150 * exists while dumping the mm->vm_next areas to the core file. 2151 */ 2152 2153 /* alloc memory for large data structures: too large to be on stack */ 2154 elf = kmalloc(sizeof(*elf), GFP_KERNEL); 2155 if (!elf) 2156 goto out; 2157 /* 2158 * The number of segs are recored into ELF header as 16bit value. 2159 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. 2160 */ 2161 segs = current->mm->map_count; 2162 segs += elf_core_extra_phdrs(); 2163 2164 gate_vma = get_gate_vma(current->mm); 2165 if (gate_vma != NULL) 2166 segs++; 2167 2168 /* for notes section */ 2169 segs++; 2170 2171 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid 2172 * this, kernel supports extended numbering. Have a look at 2173 * include/linux/elf.h for further information. */ 2174 e_phnum = segs > PN_XNUM ? PN_XNUM : segs; 2175 2176 /* 2177 * Collect all the non-memory information about the process for the 2178 * notes. This also sets up the file header. 2179 */ 2180 if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs)) 2181 goto cleanup; 2182 2183 has_dumped = 1; 2184 2185 fs = get_fs(); 2186 set_fs(KERNEL_DS); 2187 2188 offset += sizeof(*elf); /* Elf header */ 2189 offset += segs * sizeof(struct elf_phdr); /* Program headers */ 2190 2191 /* Write notes phdr entry */ 2192 { 2193 size_t sz = get_note_info_size(&info); 2194 2195 sz += elf_coredump_extra_notes_size(); 2196 2197 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL); 2198 if (!phdr4note) 2199 goto end_coredump; 2200 2201 fill_elf_note_phdr(phdr4note, sz, offset); 2202 offset += sz; 2203 } 2204 2205 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); 2206 2207 vma_filesz = kmalloc_array(segs - 1, sizeof(*vma_filesz), GFP_KERNEL); 2208 if (!vma_filesz) 2209 goto end_coredump; 2210 2211 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2212 vma = next_vma(vma, gate_vma)) { 2213 unsigned long dump_size; 2214 2215 dump_size = vma_dump_size(vma, cprm->mm_flags); 2216 vma_filesz[i++] = dump_size; 2217 vma_data_size += dump_size; 2218 } 2219 2220 offset += vma_data_size; 2221 offset += elf_core_extra_data_size(); 2222 e_shoff = offset; 2223 2224 if (e_phnum == PN_XNUM) { 2225 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL); 2226 if (!shdr4extnum) 2227 goto end_coredump; 2228 fill_extnum_info(elf, shdr4extnum, e_shoff, segs); 2229 } 2230 2231 offset = dataoff; 2232 2233 if (!dump_emit(cprm, elf, sizeof(*elf))) 2234 goto end_coredump; 2235 2236 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note))) 2237 goto end_coredump; 2238 2239 /* Write program headers for segments dump */ 2240 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2241 vma = next_vma(vma, gate_vma)) { 2242 struct elf_phdr phdr; 2243 2244 phdr.p_type = PT_LOAD; 2245 phdr.p_offset = offset; 2246 phdr.p_vaddr = vma->vm_start; 2247 phdr.p_paddr = 0; 2248 phdr.p_filesz = vma_filesz[i++]; 2249 phdr.p_memsz = vma->vm_end - vma->vm_start; 2250 offset += phdr.p_filesz; 2251 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; 2252 if (vma->vm_flags & VM_WRITE) 2253 phdr.p_flags |= PF_W; 2254 if (vma->vm_flags & VM_EXEC) 2255 phdr.p_flags |= PF_X; 2256 phdr.p_align = ELF_EXEC_PAGESIZE; 2257 2258 if (!dump_emit(cprm, &phdr, sizeof(phdr))) 2259 goto end_coredump; 2260 } 2261 2262 if (!elf_core_write_extra_phdrs(cprm, offset)) 2263 goto end_coredump; 2264 2265 /* write out the notes section */ 2266 if (!write_note_info(&info, cprm)) 2267 goto end_coredump; 2268 2269 if (elf_coredump_extra_notes_write(cprm)) 2270 goto end_coredump; 2271 2272 /* Align to page */ 2273 if (!dump_skip(cprm, dataoff - cprm->pos)) 2274 goto end_coredump; 2275 2276 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2277 vma = next_vma(vma, gate_vma)) { 2278 unsigned long addr; 2279 unsigned long end; 2280 2281 end = vma->vm_start + vma_filesz[i++]; 2282 2283 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) { 2284 struct page *page; 2285 int stop; 2286 2287 page = get_dump_page(addr); 2288 if (page) { 2289 void *kaddr = kmap(page); 2290 stop = !dump_emit(cprm, kaddr, PAGE_SIZE); 2291 kunmap(page); 2292 put_page(page); 2293 } else 2294 stop = !dump_skip(cprm, PAGE_SIZE); 2295 if (stop) 2296 goto end_coredump; 2297 } 2298 } 2299 2300 if (!elf_core_write_extra_data(cprm)) 2301 goto end_coredump; 2302 2303 if (e_phnum == PN_XNUM) { 2304 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum))) 2305 goto end_coredump; 2306 } 2307 2308 end_coredump: 2309 set_fs(fs); 2310 2311 cleanup: 2312 free_note_info(&info); 2313 kfree(shdr4extnum); 2314 kfree(vma_filesz); 2315 kfree(phdr4note); 2316 kfree(elf); 2317 out: 2318 return has_dumped; 2319 } 2320 2321 #endif /* CONFIG_ELF_CORE */ 2322 2323 static int __init init_elf_binfmt(void) 2324 { 2325 register_binfmt(&elf_format); 2326 return 0; 2327 } 2328 2329 static void __exit exit_elf_binfmt(void) 2330 { 2331 /* Remove the COFF and ELF loaders. */ 2332 unregister_binfmt(&elf_format); 2333 } 2334 2335 core_initcall(init_elf_binfmt); 2336 module_exit(exit_elf_binfmt); 2337 MODULE_LICENSE("GPL"); 2338