1 /* 2 * linux/fs/binfmt_elf.c 3 * 4 * These are the functions used to load ELF format executables as used 5 * on SVr4 machines. Information on the format may be found in the book 6 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support 7 * Tools". 8 * 9 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com). 10 */ 11 12 #include <linux/module.h> 13 #include <linux/kernel.h> 14 #include <linux/fs.h> 15 #include <linux/mm.h> 16 #include <linux/mman.h> 17 #include <linux/errno.h> 18 #include <linux/signal.h> 19 #include <linux/binfmts.h> 20 #include <linux/string.h> 21 #include <linux/file.h> 22 #include <linux/slab.h> 23 #include <linux/personality.h> 24 #include <linux/elfcore.h> 25 #include <linux/init.h> 26 #include <linux/highuid.h> 27 #include <linux/compiler.h> 28 #include <linux/highmem.h> 29 #include <linux/pagemap.h> 30 #include <linux/vmalloc.h> 31 #include <linux/security.h> 32 #include <linux/random.h> 33 #include <linux/elf.h> 34 #include <linux/elf-randomize.h> 35 #include <linux/utsname.h> 36 #include <linux/coredump.h> 37 #include <linux/sched.h> 38 #include <linux/dax.h> 39 #include <linux/uaccess.h> 40 #include <asm/param.h> 41 #include <asm/page.h> 42 43 #ifndef user_long_t 44 #define user_long_t long 45 #endif 46 #ifndef user_siginfo_t 47 #define user_siginfo_t siginfo_t 48 #endif 49 50 static int load_elf_binary(struct linux_binprm *bprm); 51 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *, 52 int, int, unsigned long); 53 54 #ifdef CONFIG_USELIB 55 static int load_elf_library(struct file *); 56 #else 57 #define load_elf_library NULL 58 #endif 59 60 /* 61 * If we don't support core dumping, then supply a NULL so we 62 * don't even try. 63 */ 64 #ifdef CONFIG_ELF_CORE 65 static int elf_core_dump(struct coredump_params *cprm); 66 #else 67 #define elf_core_dump NULL 68 #endif 69 70 #if ELF_EXEC_PAGESIZE > PAGE_SIZE 71 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE 72 #else 73 #define ELF_MIN_ALIGN PAGE_SIZE 74 #endif 75 76 #ifndef ELF_CORE_EFLAGS 77 #define ELF_CORE_EFLAGS 0 78 #endif 79 80 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1)) 81 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) 82 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) 83 84 static struct linux_binfmt elf_format = { 85 .module = THIS_MODULE, 86 .load_binary = load_elf_binary, 87 .load_shlib = load_elf_library, 88 .core_dump = elf_core_dump, 89 .min_coredump = ELF_EXEC_PAGESIZE, 90 }; 91 92 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) 93 94 static int set_brk(unsigned long start, unsigned long end) 95 { 96 start = ELF_PAGEALIGN(start); 97 end = ELF_PAGEALIGN(end); 98 if (end > start) { 99 int error = vm_brk(start, end - start); 100 if (error) 101 return error; 102 } 103 current->mm->start_brk = current->mm->brk = end; 104 return 0; 105 } 106 107 /* We need to explicitly zero any fractional pages 108 after the data section (i.e. bss). This would 109 contain the junk from the file that should not 110 be in memory 111 */ 112 static int padzero(unsigned long elf_bss) 113 { 114 unsigned long nbyte; 115 116 nbyte = ELF_PAGEOFFSET(elf_bss); 117 if (nbyte) { 118 nbyte = ELF_MIN_ALIGN - nbyte; 119 if (clear_user((void __user *) elf_bss, nbyte)) 120 return -EFAULT; 121 } 122 return 0; 123 } 124 125 /* Let's use some macros to make this stack manipulation a little clearer */ 126 #ifdef CONFIG_STACK_GROWSUP 127 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items)) 128 #define STACK_ROUND(sp, items) \ 129 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL) 130 #define STACK_ALLOC(sp, len) ({ \ 131 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \ 132 old_sp; }) 133 #else 134 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items)) 135 #define STACK_ROUND(sp, items) \ 136 (((unsigned long) (sp - items)) &~ 15UL) 137 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; }) 138 #endif 139 140 #ifndef ELF_BASE_PLATFORM 141 /* 142 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture. 143 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value 144 * will be copied to the user stack in the same manner as AT_PLATFORM. 145 */ 146 #define ELF_BASE_PLATFORM NULL 147 #endif 148 149 static int 150 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec, 151 unsigned long load_addr, unsigned long interp_load_addr) 152 { 153 unsigned long p = bprm->p; 154 int argc = bprm->argc; 155 int envc = bprm->envc; 156 elf_addr_t __user *argv; 157 elf_addr_t __user *envp; 158 elf_addr_t __user *sp; 159 elf_addr_t __user *u_platform; 160 elf_addr_t __user *u_base_platform; 161 elf_addr_t __user *u_rand_bytes; 162 const char *k_platform = ELF_PLATFORM; 163 const char *k_base_platform = ELF_BASE_PLATFORM; 164 unsigned char k_rand_bytes[16]; 165 int items; 166 elf_addr_t *elf_info; 167 int ei_index = 0; 168 const struct cred *cred = current_cred(); 169 struct vm_area_struct *vma; 170 171 /* 172 * In some cases (e.g. Hyper-Threading), we want to avoid L1 173 * evictions by the processes running on the same package. One 174 * thing we can do is to shuffle the initial stack for them. 175 */ 176 177 p = arch_align_stack(p); 178 179 /* 180 * If this architecture has a platform capability string, copy it 181 * to userspace. In some cases (Sparc), this info is impossible 182 * for userspace to get any other way, in others (i386) it is 183 * merely difficult. 184 */ 185 u_platform = NULL; 186 if (k_platform) { 187 size_t len = strlen(k_platform) + 1; 188 189 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 190 if (__copy_to_user(u_platform, k_platform, len)) 191 return -EFAULT; 192 } 193 194 /* 195 * If this architecture has a "base" platform capability 196 * string, copy it to userspace. 197 */ 198 u_base_platform = NULL; 199 if (k_base_platform) { 200 size_t len = strlen(k_base_platform) + 1; 201 202 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 203 if (__copy_to_user(u_base_platform, k_base_platform, len)) 204 return -EFAULT; 205 } 206 207 /* 208 * Generate 16 random bytes for userspace PRNG seeding. 209 */ 210 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes)); 211 u_rand_bytes = (elf_addr_t __user *) 212 STACK_ALLOC(p, sizeof(k_rand_bytes)); 213 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes))) 214 return -EFAULT; 215 216 /* Create the ELF interpreter info */ 217 elf_info = (elf_addr_t *)current->mm->saved_auxv; 218 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ 219 #define NEW_AUX_ENT(id, val) \ 220 do { \ 221 elf_info[ei_index++] = id; \ 222 elf_info[ei_index++] = val; \ 223 } while (0) 224 225 #ifdef ARCH_DLINFO 226 /* 227 * ARCH_DLINFO must come first so PPC can do its special alignment of 228 * AUXV. 229 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in 230 * ARCH_DLINFO changes 231 */ 232 ARCH_DLINFO; 233 #endif 234 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); 235 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); 236 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); 237 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); 238 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); 239 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); 240 NEW_AUX_ENT(AT_BASE, interp_load_addr); 241 NEW_AUX_ENT(AT_FLAGS, 0); 242 NEW_AUX_ENT(AT_ENTRY, exec->e_entry); 243 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid)); 244 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid)); 245 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid)); 246 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid)); 247 NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm)); 248 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes); 249 #ifdef ELF_HWCAP2 250 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2); 251 #endif 252 NEW_AUX_ENT(AT_EXECFN, bprm->exec); 253 if (k_platform) { 254 NEW_AUX_ENT(AT_PLATFORM, 255 (elf_addr_t)(unsigned long)u_platform); 256 } 257 if (k_base_platform) { 258 NEW_AUX_ENT(AT_BASE_PLATFORM, 259 (elf_addr_t)(unsigned long)u_base_platform); 260 } 261 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) { 262 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data); 263 } 264 #undef NEW_AUX_ENT 265 /* AT_NULL is zero; clear the rest too */ 266 memset(&elf_info[ei_index], 0, 267 sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]); 268 269 /* And advance past the AT_NULL entry. */ 270 ei_index += 2; 271 272 sp = STACK_ADD(p, ei_index); 273 274 items = (argc + 1) + (envc + 1) + 1; 275 bprm->p = STACK_ROUND(sp, items); 276 277 /* Point sp at the lowest address on the stack */ 278 #ifdef CONFIG_STACK_GROWSUP 279 sp = (elf_addr_t __user *)bprm->p - items - ei_index; 280 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */ 281 #else 282 sp = (elf_addr_t __user *)bprm->p; 283 #endif 284 285 286 /* 287 * Grow the stack manually; some architectures have a limit on how 288 * far ahead a user-space access may be in order to grow the stack. 289 */ 290 vma = find_extend_vma(current->mm, bprm->p); 291 if (!vma) 292 return -EFAULT; 293 294 /* Now, let's put argc (and argv, envp if appropriate) on the stack */ 295 if (__put_user(argc, sp++)) 296 return -EFAULT; 297 argv = sp; 298 envp = argv + argc + 1; 299 300 /* Populate argv and envp */ 301 p = current->mm->arg_end = current->mm->arg_start; 302 while (argc-- > 0) { 303 size_t len; 304 if (__put_user((elf_addr_t)p, argv++)) 305 return -EFAULT; 306 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 307 if (!len || len > MAX_ARG_STRLEN) 308 return -EINVAL; 309 p += len; 310 } 311 if (__put_user(0, argv)) 312 return -EFAULT; 313 current->mm->arg_end = current->mm->env_start = p; 314 while (envc-- > 0) { 315 size_t len; 316 if (__put_user((elf_addr_t)p, envp++)) 317 return -EFAULT; 318 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 319 if (!len || len > MAX_ARG_STRLEN) 320 return -EINVAL; 321 p += len; 322 } 323 if (__put_user(0, envp)) 324 return -EFAULT; 325 current->mm->env_end = p; 326 327 /* Put the elf_info on the stack in the right place. */ 328 sp = (elf_addr_t __user *)envp + 1; 329 if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t))) 330 return -EFAULT; 331 return 0; 332 } 333 334 #ifndef elf_map 335 336 static unsigned long elf_map(struct file *filep, unsigned long addr, 337 struct elf_phdr *eppnt, int prot, int type, 338 unsigned long total_size) 339 { 340 unsigned long map_addr; 341 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr); 342 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr); 343 addr = ELF_PAGESTART(addr); 344 size = ELF_PAGEALIGN(size); 345 346 /* mmap() will return -EINVAL if given a zero size, but a 347 * segment with zero filesize is perfectly valid */ 348 if (!size) 349 return addr; 350 351 /* 352 * total_size is the size of the ELF (interpreter) image. 353 * The _first_ mmap needs to know the full size, otherwise 354 * randomization might put this image into an overlapping 355 * position with the ELF binary image. (since size < total_size) 356 * So we first map the 'big' image - and unmap the remainder at 357 * the end. (which unmap is needed for ELF images with holes.) 358 */ 359 if (total_size) { 360 total_size = ELF_PAGEALIGN(total_size); 361 map_addr = vm_mmap(filep, addr, total_size, prot, type, off); 362 if (!BAD_ADDR(map_addr)) 363 vm_munmap(map_addr+size, total_size-size); 364 } else 365 map_addr = vm_mmap(filep, addr, size, prot, type, off); 366 367 return(map_addr); 368 } 369 370 #endif /* !elf_map */ 371 372 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr) 373 { 374 int i, first_idx = -1, last_idx = -1; 375 376 for (i = 0; i < nr; i++) { 377 if (cmds[i].p_type == PT_LOAD) { 378 last_idx = i; 379 if (first_idx == -1) 380 first_idx = i; 381 } 382 } 383 if (first_idx == -1) 384 return 0; 385 386 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz - 387 ELF_PAGESTART(cmds[first_idx].p_vaddr); 388 } 389 390 /** 391 * load_elf_phdrs() - load ELF program headers 392 * @elf_ex: ELF header of the binary whose program headers should be loaded 393 * @elf_file: the opened ELF binary file 394 * 395 * Loads ELF program headers from the binary file elf_file, which has the ELF 396 * header pointed to by elf_ex, into a newly allocated array. The caller is 397 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure. 398 */ 399 static struct elf_phdr *load_elf_phdrs(struct elfhdr *elf_ex, 400 struct file *elf_file) 401 { 402 struct elf_phdr *elf_phdata = NULL; 403 int retval, size, err = -1; 404 405 /* 406 * If the size of this structure has changed, then punt, since 407 * we will be doing the wrong thing. 408 */ 409 if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) 410 goto out; 411 412 /* Sanity check the number of program headers... */ 413 if (elf_ex->e_phnum < 1 || 414 elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr)) 415 goto out; 416 417 /* ...and their total size. */ 418 size = sizeof(struct elf_phdr) * elf_ex->e_phnum; 419 if (size > ELF_MIN_ALIGN) 420 goto out; 421 422 elf_phdata = kmalloc(size, GFP_KERNEL); 423 if (!elf_phdata) 424 goto out; 425 426 /* Read in the program headers */ 427 retval = kernel_read(elf_file, elf_ex->e_phoff, 428 (char *)elf_phdata, size); 429 if (retval != size) { 430 err = (retval < 0) ? retval : -EIO; 431 goto out; 432 } 433 434 /* Success! */ 435 err = 0; 436 out: 437 if (err) { 438 kfree(elf_phdata); 439 elf_phdata = NULL; 440 } 441 return elf_phdata; 442 } 443 444 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE 445 446 /** 447 * struct arch_elf_state - arch-specific ELF loading state 448 * 449 * This structure is used to preserve architecture specific data during 450 * the loading of an ELF file, throughout the checking of architecture 451 * specific ELF headers & through to the point where the ELF load is 452 * known to be proceeding (ie. SET_PERSONALITY). 453 * 454 * This implementation is a dummy for architectures which require no 455 * specific state. 456 */ 457 struct arch_elf_state { 458 }; 459 460 #define INIT_ARCH_ELF_STATE {} 461 462 /** 463 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header 464 * @ehdr: The main ELF header 465 * @phdr: The program header to check 466 * @elf: The open ELF file 467 * @is_interp: True if the phdr is from the interpreter of the ELF being 468 * loaded, else false. 469 * @state: Architecture-specific state preserved throughout the process 470 * of loading the ELF. 471 * 472 * Inspects the program header phdr to validate its correctness and/or 473 * suitability for the system. Called once per ELF program header in the 474 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its 475 * interpreter. 476 * 477 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 478 * with that return code. 479 */ 480 static inline int arch_elf_pt_proc(struct elfhdr *ehdr, 481 struct elf_phdr *phdr, 482 struct file *elf, bool is_interp, 483 struct arch_elf_state *state) 484 { 485 /* Dummy implementation, always proceed */ 486 return 0; 487 } 488 489 /** 490 * arch_check_elf() - check an ELF executable 491 * @ehdr: The main ELF header 492 * @has_interp: True if the ELF has an interpreter, else false. 493 * @interp_ehdr: The interpreter's ELF header 494 * @state: Architecture-specific state preserved throughout the process 495 * of loading the ELF. 496 * 497 * Provides a final opportunity for architecture code to reject the loading 498 * of the ELF & cause an exec syscall to return an error. This is called after 499 * all program headers to be checked by arch_elf_pt_proc have been. 500 * 501 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 502 * with that return code. 503 */ 504 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, 505 struct elfhdr *interp_ehdr, 506 struct arch_elf_state *state) 507 { 508 /* Dummy implementation, always proceed */ 509 return 0; 510 } 511 512 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ 513 514 /* This is much more generalized than the library routine read function, 515 so we keep this separate. Technically the library read function 516 is only provided so that we can read a.out libraries that have 517 an ELF header */ 518 519 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, 520 struct file *interpreter, unsigned long *interp_map_addr, 521 unsigned long no_base, struct elf_phdr *interp_elf_phdata) 522 { 523 struct elf_phdr *eppnt; 524 unsigned long load_addr = 0; 525 int load_addr_set = 0; 526 unsigned long last_bss = 0, elf_bss = 0; 527 unsigned long error = ~0UL; 528 unsigned long total_size; 529 int i; 530 531 /* First of all, some simple consistency checks */ 532 if (interp_elf_ex->e_type != ET_EXEC && 533 interp_elf_ex->e_type != ET_DYN) 534 goto out; 535 if (!elf_check_arch(interp_elf_ex)) 536 goto out; 537 if (!interpreter->f_op->mmap) 538 goto out; 539 540 total_size = total_mapping_size(interp_elf_phdata, 541 interp_elf_ex->e_phnum); 542 if (!total_size) { 543 error = -EINVAL; 544 goto out; 545 } 546 547 eppnt = interp_elf_phdata; 548 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { 549 if (eppnt->p_type == PT_LOAD) { 550 int elf_type = MAP_PRIVATE | MAP_DENYWRITE; 551 int elf_prot = 0; 552 unsigned long vaddr = 0; 553 unsigned long k, map_addr; 554 555 if (eppnt->p_flags & PF_R) 556 elf_prot = PROT_READ; 557 if (eppnt->p_flags & PF_W) 558 elf_prot |= PROT_WRITE; 559 if (eppnt->p_flags & PF_X) 560 elf_prot |= PROT_EXEC; 561 vaddr = eppnt->p_vaddr; 562 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) 563 elf_type |= MAP_FIXED; 564 else if (no_base && interp_elf_ex->e_type == ET_DYN) 565 load_addr = -vaddr; 566 567 map_addr = elf_map(interpreter, load_addr + vaddr, 568 eppnt, elf_prot, elf_type, total_size); 569 total_size = 0; 570 if (!*interp_map_addr) 571 *interp_map_addr = map_addr; 572 error = map_addr; 573 if (BAD_ADDR(map_addr)) 574 goto out; 575 576 if (!load_addr_set && 577 interp_elf_ex->e_type == ET_DYN) { 578 load_addr = map_addr - ELF_PAGESTART(vaddr); 579 load_addr_set = 1; 580 } 581 582 /* 583 * Check to see if the section's size will overflow the 584 * allowed task size. Note that p_filesz must always be 585 * <= p_memsize so it's only necessary to check p_memsz. 586 */ 587 k = load_addr + eppnt->p_vaddr; 588 if (BAD_ADDR(k) || 589 eppnt->p_filesz > eppnt->p_memsz || 590 eppnt->p_memsz > TASK_SIZE || 591 TASK_SIZE - eppnt->p_memsz < k) { 592 error = -ENOMEM; 593 goto out; 594 } 595 596 /* 597 * Find the end of the file mapping for this phdr, and 598 * keep track of the largest address we see for this. 599 */ 600 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz; 601 if (k > elf_bss) 602 elf_bss = k; 603 604 /* 605 * Do the same thing for the memory mapping - between 606 * elf_bss and last_bss is the bss section. 607 */ 608 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz; 609 if (k > last_bss) 610 last_bss = k; 611 } 612 } 613 614 /* 615 * Now fill out the bss section: first pad the last page from 616 * the file up to the page boundary, and zero it from elf_bss 617 * up to the end of the page. 618 */ 619 if (padzero(elf_bss)) { 620 error = -EFAULT; 621 goto out; 622 } 623 /* 624 * Next, align both the file and mem bss up to the page size, 625 * since this is where elf_bss was just zeroed up to, and where 626 * last_bss will end after the vm_brk() below. 627 */ 628 elf_bss = ELF_PAGEALIGN(elf_bss); 629 last_bss = ELF_PAGEALIGN(last_bss); 630 /* Finally, if there is still more bss to allocate, do it. */ 631 if (last_bss > elf_bss) { 632 error = vm_brk(elf_bss, last_bss - elf_bss); 633 if (error) 634 goto out; 635 } 636 637 error = load_addr; 638 out: 639 return error; 640 } 641 642 /* 643 * These are the functions used to load ELF style executables and shared 644 * libraries. There is no binary dependent code anywhere else. 645 */ 646 647 #ifndef STACK_RND_MASK 648 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */ 649 #endif 650 651 static unsigned long randomize_stack_top(unsigned long stack_top) 652 { 653 unsigned long random_variable = 0; 654 655 if ((current->flags & PF_RANDOMIZE) && 656 !(current->personality & ADDR_NO_RANDOMIZE)) { 657 random_variable = get_random_long(); 658 random_variable &= STACK_RND_MASK; 659 random_variable <<= PAGE_SHIFT; 660 } 661 #ifdef CONFIG_STACK_GROWSUP 662 return PAGE_ALIGN(stack_top) + random_variable; 663 #else 664 return PAGE_ALIGN(stack_top) - random_variable; 665 #endif 666 } 667 668 static int load_elf_binary(struct linux_binprm *bprm) 669 { 670 struct file *interpreter = NULL; /* to shut gcc up */ 671 unsigned long load_addr = 0, load_bias = 0; 672 int load_addr_set = 0; 673 char * elf_interpreter = NULL; 674 unsigned long error; 675 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; 676 unsigned long elf_bss, elf_brk; 677 int retval, i; 678 unsigned long elf_entry; 679 unsigned long interp_load_addr = 0; 680 unsigned long start_code, end_code, start_data, end_data; 681 unsigned long reloc_func_desc __maybe_unused = 0; 682 int executable_stack = EXSTACK_DEFAULT; 683 struct pt_regs *regs = current_pt_regs(); 684 struct { 685 struct elfhdr elf_ex; 686 struct elfhdr interp_elf_ex; 687 } *loc; 688 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE; 689 690 loc = kmalloc(sizeof(*loc), GFP_KERNEL); 691 if (!loc) { 692 retval = -ENOMEM; 693 goto out_ret; 694 } 695 696 /* Get the exec-header */ 697 loc->elf_ex = *((struct elfhdr *)bprm->buf); 698 699 retval = -ENOEXEC; 700 /* First of all, some simple consistency checks */ 701 if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 702 goto out; 703 704 if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN) 705 goto out; 706 if (!elf_check_arch(&loc->elf_ex)) 707 goto out; 708 if (!bprm->file->f_op->mmap) 709 goto out; 710 711 elf_phdata = load_elf_phdrs(&loc->elf_ex, bprm->file); 712 if (!elf_phdata) 713 goto out; 714 715 elf_ppnt = elf_phdata; 716 elf_bss = 0; 717 elf_brk = 0; 718 719 start_code = ~0UL; 720 end_code = 0; 721 start_data = 0; 722 end_data = 0; 723 724 for (i = 0; i < loc->elf_ex.e_phnum; i++) { 725 if (elf_ppnt->p_type == PT_INTERP) { 726 /* This is the program interpreter used for 727 * shared libraries - for now assume that this 728 * is an a.out format binary 729 */ 730 retval = -ENOEXEC; 731 if (elf_ppnt->p_filesz > PATH_MAX || 732 elf_ppnt->p_filesz < 2) 733 goto out_free_ph; 734 735 retval = -ENOMEM; 736 elf_interpreter = kmalloc(elf_ppnt->p_filesz, 737 GFP_KERNEL); 738 if (!elf_interpreter) 739 goto out_free_ph; 740 741 retval = kernel_read(bprm->file, elf_ppnt->p_offset, 742 elf_interpreter, 743 elf_ppnt->p_filesz); 744 if (retval != elf_ppnt->p_filesz) { 745 if (retval >= 0) 746 retval = -EIO; 747 goto out_free_interp; 748 } 749 /* make sure path is NULL terminated */ 750 retval = -ENOEXEC; 751 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') 752 goto out_free_interp; 753 754 interpreter = open_exec(elf_interpreter); 755 retval = PTR_ERR(interpreter); 756 if (IS_ERR(interpreter)) 757 goto out_free_interp; 758 759 /* 760 * If the binary is not readable then enforce 761 * mm->dumpable = 0 regardless of the interpreter's 762 * permissions. 763 */ 764 would_dump(bprm, interpreter); 765 766 /* Get the exec headers */ 767 retval = kernel_read(interpreter, 0, 768 (void *)&loc->interp_elf_ex, 769 sizeof(loc->interp_elf_ex)); 770 if (retval != sizeof(loc->interp_elf_ex)) { 771 if (retval >= 0) 772 retval = -EIO; 773 goto out_free_dentry; 774 } 775 776 break; 777 } 778 elf_ppnt++; 779 } 780 781 elf_ppnt = elf_phdata; 782 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) 783 switch (elf_ppnt->p_type) { 784 case PT_GNU_STACK: 785 if (elf_ppnt->p_flags & PF_X) 786 executable_stack = EXSTACK_ENABLE_X; 787 else 788 executable_stack = EXSTACK_DISABLE_X; 789 break; 790 791 case PT_LOPROC ... PT_HIPROC: 792 retval = arch_elf_pt_proc(&loc->elf_ex, elf_ppnt, 793 bprm->file, false, 794 &arch_state); 795 if (retval) 796 goto out_free_dentry; 797 break; 798 } 799 800 /* Some simple consistency checks for the interpreter */ 801 if (elf_interpreter) { 802 retval = -ELIBBAD; 803 /* Not an ELF interpreter */ 804 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 805 goto out_free_dentry; 806 /* Verify the interpreter has a valid arch */ 807 if (!elf_check_arch(&loc->interp_elf_ex)) 808 goto out_free_dentry; 809 810 /* Load the interpreter program headers */ 811 interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex, 812 interpreter); 813 if (!interp_elf_phdata) 814 goto out_free_dentry; 815 816 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ 817 elf_ppnt = interp_elf_phdata; 818 for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++) 819 switch (elf_ppnt->p_type) { 820 case PT_LOPROC ... PT_HIPROC: 821 retval = arch_elf_pt_proc(&loc->interp_elf_ex, 822 elf_ppnt, interpreter, 823 true, &arch_state); 824 if (retval) 825 goto out_free_dentry; 826 break; 827 } 828 } 829 830 /* 831 * Allow arch code to reject the ELF at this point, whilst it's 832 * still possible to return an error to the code that invoked 833 * the exec syscall. 834 */ 835 retval = arch_check_elf(&loc->elf_ex, 836 !!interpreter, &loc->interp_elf_ex, 837 &arch_state); 838 if (retval) 839 goto out_free_dentry; 840 841 /* Flush all traces of the currently running executable */ 842 retval = flush_old_exec(bprm); 843 if (retval) 844 goto out_free_dentry; 845 846 /* Do this immediately, since STACK_TOP as used in setup_arg_pages 847 may depend on the personality. */ 848 SET_PERSONALITY2(loc->elf_ex, &arch_state); 849 if (elf_read_implies_exec(loc->elf_ex, executable_stack)) 850 current->personality |= READ_IMPLIES_EXEC; 851 852 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) 853 current->flags |= PF_RANDOMIZE; 854 855 setup_new_exec(bprm); 856 install_exec_creds(bprm); 857 858 /* Do this so that we can load the interpreter, if need be. We will 859 change some of these later */ 860 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), 861 executable_stack); 862 if (retval < 0) 863 goto out_free_dentry; 864 865 current->mm->start_stack = bprm->p; 866 867 /* Now we do a little grungy work by mmapping the ELF image into 868 the correct location in memory. */ 869 for(i = 0, elf_ppnt = elf_phdata; 870 i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { 871 int elf_prot = 0, elf_flags; 872 unsigned long k, vaddr; 873 unsigned long total_size = 0; 874 875 if (elf_ppnt->p_type != PT_LOAD) 876 continue; 877 878 if (unlikely (elf_brk > elf_bss)) { 879 unsigned long nbyte; 880 881 /* There was a PT_LOAD segment with p_memsz > p_filesz 882 before this one. Map anonymous pages, if needed, 883 and clear the area. */ 884 retval = set_brk(elf_bss + load_bias, 885 elf_brk + load_bias); 886 if (retval) 887 goto out_free_dentry; 888 nbyte = ELF_PAGEOFFSET(elf_bss); 889 if (nbyte) { 890 nbyte = ELF_MIN_ALIGN - nbyte; 891 if (nbyte > elf_brk - elf_bss) 892 nbyte = elf_brk - elf_bss; 893 if (clear_user((void __user *)elf_bss + 894 load_bias, nbyte)) { 895 /* 896 * This bss-zeroing can fail if the ELF 897 * file specifies odd protections. So 898 * we don't check the return value 899 */ 900 } 901 } 902 } 903 904 if (elf_ppnt->p_flags & PF_R) 905 elf_prot |= PROT_READ; 906 if (elf_ppnt->p_flags & PF_W) 907 elf_prot |= PROT_WRITE; 908 if (elf_ppnt->p_flags & PF_X) 909 elf_prot |= PROT_EXEC; 910 911 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE; 912 913 vaddr = elf_ppnt->p_vaddr; 914 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) { 915 elf_flags |= MAP_FIXED; 916 } else if (loc->elf_ex.e_type == ET_DYN) { 917 /* Try and get dynamic programs out of the way of the 918 * default mmap base, as well as whatever program they 919 * might try to exec. This is because the brk will 920 * follow the loader, and is not movable. */ 921 load_bias = ELF_ET_DYN_BASE - vaddr; 922 if (current->flags & PF_RANDOMIZE) 923 load_bias += arch_mmap_rnd(); 924 load_bias = ELF_PAGESTART(load_bias); 925 total_size = total_mapping_size(elf_phdata, 926 loc->elf_ex.e_phnum); 927 if (!total_size) { 928 retval = -EINVAL; 929 goto out_free_dentry; 930 } 931 } 932 933 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, 934 elf_prot, elf_flags, total_size); 935 if (BAD_ADDR(error)) { 936 retval = IS_ERR((void *)error) ? 937 PTR_ERR((void*)error) : -EINVAL; 938 goto out_free_dentry; 939 } 940 941 if (!load_addr_set) { 942 load_addr_set = 1; 943 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset); 944 if (loc->elf_ex.e_type == ET_DYN) { 945 load_bias += error - 946 ELF_PAGESTART(load_bias + vaddr); 947 load_addr += load_bias; 948 reloc_func_desc = load_bias; 949 } 950 } 951 k = elf_ppnt->p_vaddr; 952 if (k < start_code) 953 start_code = k; 954 if (start_data < k) 955 start_data = k; 956 957 /* 958 * Check to see if the section's size will overflow the 959 * allowed task size. Note that p_filesz must always be 960 * <= p_memsz so it is only necessary to check p_memsz. 961 */ 962 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || 963 elf_ppnt->p_memsz > TASK_SIZE || 964 TASK_SIZE - elf_ppnt->p_memsz < k) { 965 /* set_brk can never work. Avoid overflows. */ 966 retval = -EINVAL; 967 goto out_free_dentry; 968 } 969 970 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; 971 972 if (k > elf_bss) 973 elf_bss = k; 974 if ((elf_ppnt->p_flags & PF_X) && end_code < k) 975 end_code = k; 976 if (end_data < k) 977 end_data = k; 978 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; 979 if (k > elf_brk) 980 elf_brk = k; 981 } 982 983 loc->elf_ex.e_entry += load_bias; 984 elf_bss += load_bias; 985 elf_brk += load_bias; 986 start_code += load_bias; 987 end_code += load_bias; 988 start_data += load_bias; 989 end_data += load_bias; 990 991 /* Calling set_brk effectively mmaps the pages that we need 992 * for the bss and break sections. We must do this before 993 * mapping in the interpreter, to make sure it doesn't wind 994 * up getting placed where the bss needs to go. 995 */ 996 retval = set_brk(elf_bss, elf_brk); 997 if (retval) 998 goto out_free_dentry; 999 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { 1000 retval = -EFAULT; /* Nobody gets to see this, but.. */ 1001 goto out_free_dentry; 1002 } 1003 1004 if (elf_interpreter) { 1005 unsigned long interp_map_addr = 0; 1006 1007 elf_entry = load_elf_interp(&loc->interp_elf_ex, 1008 interpreter, 1009 &interp_map_addr, 1010 load_bias, interp_elf_phdata); 1011 if (!IS_ERR((void *)elf_entry)) { 1012 /* 1013 * load_elf_interp() returns relocation 1014 * adjustment 1015 */ 1016 interp_load_addr = elf_entry; 1017 elf_entry += loc->interp_elf_ex.e_entry; 1018 } 1019 if (BAD_ADDR(elf_entry)) { 1020 retval = IS_ERR((void *)elf_entry) ? 1021 (int)elf_entry : -EINVAL; 1022 goto out_free_dentry; 1023 } 1024 reloc_func_desc = interp_load_addr; 1025 1026 allow_write_access(interpreter); 1027 fput(interpreter); 1028 kfree(elf_interpreter); 1029 } else { 1030 elf_entry = loc->elf_ex.e_entry; 1031 if (BAD_ADDR(elf_entry)) { 1032 retval = -EINVAL; 1033 goto out_free_dentry; 1034 } 1035 } 1036 1037 kfree(interp_elf_phdata); 1038 kfree(elf_phdata); 1039 1040 set_binfmt(&elf_format); 1041 1042 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES 1043 retval = arch_setup_additional_pages(bprm, !!elf_interpreter); 1044 if (retval < 0) 1045 goto out; 1046 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ 1047 1048 retval = create_elf_tables(bprm, &loc->elf_ex, 1049 load_addr, interp_load_addr); 1050 if (retval < 0) 1051 goto out; 1052 /* N.B. passed_fileno might not be initialized? */ 1053 current->mm->end_code = end_code; 1054 current->mm->start_code = start_code; 1055 current->mm->start_data = start_data; 1056 current->mm->end_data = end_data; 1057 current->mm->start_stack = bprm->p; 1058 1059 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) { 1060 current->mm->brk = current->mm->start_brk = 1061 arch_randomize_brk(current->mm); 1062 #ifdef compat_brk_randomized 1063 current->brk_randomized = 1; 1064 #endif 1065 } 1066 1067 if (current->personality & MMAP_PAGE_ZERO) { 1068 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 1069 and some applications "depend" upon this behavior. 1070 Since we do not have the power to recompile these, we 1071 emulate the SVr4 behavior. Sigh. */ 1072 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, 1073 MAP_FIXED | MAP_PRIVATE, 0); 1074 } 1075 1076 #ifdef ELF_PLAT_INIT 1077 /* 1078 * The ABI may specify that certain registers be set up in special 1079 * ways (on i386 %edx is the address of a DT_FINI function, for 1080 * example. In addition, it may also specify (eg, PowerPC64 ELF) 1081 * that the e_entry field is the address of the function descriptor 1082 * for the startup routine, rather than the address of the startup 1083 * routine itself. This macro performs whatever initialization to 1084 * the regs structure is required as well as any relocations to the 1085 * function descriptor entries when executing dynamically links apps. 1086 */ 1087 ELF_PLAT_INIT(regs, reloc_func_desc); 1088 #endif 1089 1090 start_thread(regs, elf_entry, bprm->p); 1091 retval = 0; 1092 out: 1093 kfree(loc); 1094 out_ret: 1095 return retval; 1096 1097 /* error cleanup */ 1098 out_free_dentry: 1099 kfree(interp_elf_phdata); 1100 allow_write_access(interpreter); 1101 if (interpreter) 1102 fput(interpreter); 1103 out_free_interp: 1104 kfree(elf_interpreter); 1105 out_free_ph: 1106 kfree(elf_phdata); 1107 goto out; 1108 } 1109 1110 #ifdef CONFIG_USELIB 1111 /* This is really simpleminded and specialized - we are loading an 1112 a.out library that is given an ELF header. */ 1113 static int load_elf_library(struct file *file) 1114 { 1115 struct elf_phdr *elf_phdata; 1116 struct elf_phdr *eppnt; 1117 unsigned long elf_bss, bss, len; 1118 int retval, error, i, j; 1119 struct elfhdr elf_ex; 1120 1121 error = -ENOEXEC; 1122 retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex)); 1123 if (retval != sizeof(elf_ex)) 1124 goto out; 1125 1126 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 1127 goto out; 1128 1129 /* First of all, some simple consistency checks */ 1130 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 || 1131 !elf_check_arch(&elf_ex) || !file->f_op->mmap) 1132 goto out; 1133 1134 /* Now read in all of the header information */ 1135 1136 j = sizeof(struct elf_phdr) * elf_ex.e_phnum; 1137 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */ 1138 1139 error = -ENOMEM; 1140 elf_phdata = kmalloc(j, GFP_KERNEL); 1141 if (!elf_phdata) 1142 goto out; 1143 1144 eppnt = elf_phdata; 1145 error = -ENOEXEC; 1146 retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j); 1147 if (retval != j) 1148 goto out_free_ph; 1149 1150 for (j = 0, i = 0; i<elf_ex.e_phnum; i++) 1151 if ((eppnt + i)->p_type == PT_LOAD) 1152 j++; 1153 if (j != 1) 1154 goto out_free_ph; 1155 1156 while (eppnt->p_type != PT_LOAD) 1157 eppnt++; 1158 1159 /* Now use mmap to map the library into memory. */ 1160 error = vm_mmap(file, 1161 ELF_PAGESTART(eppnt->p_vaddr), 1162 (eppnt->p_filesz + 1163 ELF_PAGEOFFSET(eppnt->p_vaddr)), 1164 PROT_READ | PROT_WRITE | PROT_EXEC, 1165 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE, 1166 (eppnt->p_offset - 1167 ELF_PAGEOFFSET(eppnt->p_vaddr))); 1168 if (error != ELF_PAGESTART(eppnt->p_vaddr)) 1169 goto out_free_ph; 1170 1171 elf_bss = eppnt->p_vaddr + eppnt->p_filesz; 1172 if (padzero(elf_bss)) { 1173 error = -EFAULT; 1174 goto out_free_ph; 1175 } 1176 1177 len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + 1178 ELF_MIN_ALIGN - 1); 1179 bss = eppnt->p_memsz + eppnt->p_vaddr; 1180 if (bss > len) { 1181 error = vm_brk(len, bss - len); 1182 if (error) 1183 goto out_free_ph; 1184 } 1185 error = 0; 1186 1187 out_free_ph: 1188 kfree(elf_phdata); 1189 out: 1190 return error; 1191 } 1192 #endif /* #ifdef CONFIG_USELIB */ 1193 1194 #ifdef CONFIG_ELF_CORE 1195 /* 1196 * ELF core dumper 1197 * 1198 * Modelled on fs/exec.c:aout_core_dump() 1199 * Jeremy Fitzhardinge <jeremy@sw.oz.au> 1200 */ 1201 1202 /* 1203 * The purpose of always_dump_vma() is to make sure that special kernel mappings 1204 * that are useful for post-mortem analysis are included in every core dump. 1205 * In that way we ensure that the core dump is fully interpretable later 1206 * without matching up the same kernel and hardware config to see what PC values 1207 * meant. These special mappings include - vDSO, vsyscall, and other 1208 * architecture specific mappings 1209 */ 1210 static bool always_dump_vma(struct vm_area_struct *vma) 1211 { 1212 /* Any vsyscall mappings? */ 1213 if (vma == get_gate_vma(vma->vm_mm)) 1214 return true; 1215 1216 /* 1217 * Assume that all vmas with a .name op should always be dumped. 1218 * If this changes, a new vm_ops field can easily be added. 1219 */ 1220 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 1221 return true; 1222 1223 /* 1224 * arch_vma_name() returns non-NULL for special architecture mappings, 1225 * such as vDSO sections. 1226 */ 1227 if (arch_vma_name(vma)) 1228 return true; 1229 1230 return false; 1231 } 1232 1233 /* 1234 * Decide what to dump of a segment, part, all or none. 1235 */ 1236 static unsigned long vma_dump_size(struct vm_area_struct *vma, 1237 unsigned long mm_flags) 1238 { 1239 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) 1240 1241 /* always dump the vdso and vsyscall sections */ 1242 if (always_dump_vma(vma)) 1243 goto whole; 1244 1245 if (vma->vm_flags & VM_DONTDUMP) 1246 return 0; 1247 1248 /* support for DAX */ 1249 if (vma_is_dax(vma)) { 1250 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED)) 1251 goto whole; 1252 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE)) 1253 goto whole; 1254 return 0; 1255 } 1256 1257 /* Hugetlb memory check */ 1258 if (vma->vm_flags & VM_HUGETLB) { 1259 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED)) 1260 goto whole; 1261 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) 1262 goto whole; 1263 return 0; 1264 } 1265 1266 /* Do not dump I/O mapped devices or special mappings */ 1267 if (vma->vm_flags & VM_IO) 1268 return 0; 1269 1270 /* By default, dump shared memory if mapped from an anonymous file. */ 1271 if (vma->vm_flags & VM_SHARED) { 1272 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1273 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED)) 1274 goto whole; 1275 return 0; 1276 } 1277 1278 /* Dump segments that have been written to. */ 1279 if (vma->anon_vma && FILTER(ANON_PRIVATE)) 1280 goto whole; 1281 if (vma->vm_file == NULL) 1282 return 0; 1283 1284 if (FILTER(MAPPED_PRIVATE)) 1285 goto whole; 1286 1287 /* 1288 * If this looks like the beginning of a DSO or executable mapping, 1289 * check for an ELF header. If we find one, dump the first page to 1290 * aid in determining what was mapped here. 1291 */ 1292 if (FILTER(ELF_HEADERS) && 1293 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1294 u32 __user *header = (u32 __user *) vma->vm_start; 1295 u32 word; 1296 mm_segment_t fs = get_fs(); 1297 /* 1298 * Doing it this way gets the constant folded by GCC. 1299 */ 1300 union { 1301 u32 cmp; 1302 char elfmag[SELFMAG]; 1303 } magic; 1304 BUILD_BUG_ON(SELFMAG != sizeof word); 1305 magic.elfmag[EI_MAG0] = ELFMAG0; 1306 magic.elfmag[EI_MAG1] = ELFMAG1; 1307 magic.elfmag[EI_MAG2] = ELFMAG2; 1308 magic.elfmag[EI_MAG3] = ELFMAG3; 1309 /* 1310 * Switch to the user "segment" for get_user(), 1311 * then put back what elf_core_dump() had in place. 1312 */ 1313 set_fs(USER_DS); 1314 if (unlikely(get_user(word, header))) 1315 word = 0; 1316 set_fs(fs); 1317 if (word == magic.cmp) 1318 return PAGE_SIZE; 1319 } 1320 1321 #undef FILTER 1322 1323 return 0; 1324 1325 whole: 1326 return vma->vm_end - vma->vm_start; 1327 } 1328 1329 /* An ELF note in memory */ 1330 struct memelfnote 1331 { 1332 const char *name; 1333 int type; 1334 unsigned int datasz; 1335 void *data; 1336 }; 1337 1338 static int notesize(struct memelfnote *en) 1339 { 1340 int sz; 1341 1342 sz = sizeof(struct elf_note); 1343 sz += roundup(strlen(en->name) + 1, 4); 1344 sz += roundup(en->datasz, 4); 1345 1346 return sz; 1347 } 1348 1349 static int writenote(struct memelfnote *men, struct coredump_params *cprm) 1350 { 1351 struct elf_note en; 1352 en.n_namesz = strlen(men->name) + 1; 1353 en.n_descsz = men->datasz; 1354 en.n_type = men->type; 1355 1356 return dump_emit(cprm, &en, sizeof(en)) && 1357 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) && 1358 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4); 1359 } 1360 1361 static void fill_elf_header(struct elfhdr *elf, int segs, 1362 u16 machine, u32 flags) 1363 { 1364 memset(elf, 0, sizeof(*elf)); 1365 1366 memcpy(elf->e_ident, ELFMAG, SELFMAG); 1367 elf->e_ident[EI_CLASS] = ELF_CLASS; 1368 elf->e_ident[EI_DATA] = ELF_DATA; 1369 elf->e_ident[EI_VERSION] = EV_CURRENT; 1370 elf->e_ident[EI_OSABI] = ELF_OSABI; 1371 1372 elf->e_type = ET_CORE; 1373 elf->e_machine = machine; 1374 elf->e_version = EV_CURRENT; 1375 elf->e_phoff = sizeof(struct elfhdr); 1376 elf->e_flags = flags; 1377 elf->e_ehsize = sizeof(struct elfhdr); 1378 elf->e_phentsize = sizeof(struct elf_phdr); 1379 elf->e_phnum = segs; 1380 1381 return; 1382 } 1383 1384 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset) 1385 { 1386 phdr->p_type = PT_NOTE; 1387 phdr->p_offset = offset; 1388 phdr->p_vaddr = 0; 1389 phdr->p_paddr = 0; 1390 phdr->p_filesz = sz; 1391 phdr->p_memsz = 0; 1392 phdr->p_flags = 0; 1393 phdr->p_align = 0; 1394 return; 1395 } 1396 1397 static void fill_note(struct memelfnote *note, const char *name, int type, 1398 unsigned int sz, void *data) 1399 { 1400 note->name = name; 1401 note->type = type; 1402 note->datasz = sz; 1403 note->data = data; 1404 return; 1405 } 1406 1407 /* 1408 * fill up all the fields in prstatus from the given task struct, except 1409 * registers which need to be filled up separately. 1410 */ 1411 static void fill_prstatus(struct elf_prstatus *prstatus, 1412 struct task_struct *p, long signr) 1413 { 1414 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 1415 prstatus->pr_sigpend = p->pending.signal.sig[0]; 1416 prstatus->pr_sighold = p->blocked.sig[0]; 1417 rcu_read_lock(); 1418 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1419 rcu_read_unlock(); 1420 prstatus->pr_pid = task_pid_vnr(p); 1421 prstatus->pr_pgrp = task_pgrp_vnr(p); 1422 prstatus->pr_sid = task_session_vnr(p); 1423 if (thread_group_leader(p)) { 1424 struct task_cputime cputime; 1425 1426 /* 1427 * This is the record for the group leader. It shows the 1428 * group-wide total, not its individual thread total. 1429 */ 1430 thread_group_cputime(p, &cputime); 1431 prstatus->pr_utime = ns_to_timeval(cputime.utime); 1432 prstatus->pr_stime = ns_to_timeval(cputime.stime); 1433 } else { 1434 u64 utime, stime; 1435 1436 task_cputime(p, &utime, &stime); 1437 prstatus->pr_utime = ns_to_timeval(utime); 1438 prstatus->pr_stime = ns_to_timeval(stime); 1439 } 1440 1441 prstatus->pr_cutime = ns_to_timeval(p->signal->cutime); 1442 prstatus->pr_cstime = ns_to_timeval(p->signal->cstime); 1443 } 1444 1445 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, 1446 struct mm_struct *mm) 1447 { 1448 const struct cred *cred; 1449 unsigned int i, len; 1450 1451 /* first copy the parameters from user space */ 1452 memset(psinfo, 0, sizeof(struct elf_prpsinfo)); 1453 1454 len = mm->arg_end - mm->arg_start; 1455 if (len >= ELF_PRARGSZ) 1456 len = ELF_PRARGSZ-1; 1457 if (copy_from_user(&psinfo->pr_psargs, 1458 (const char __user *)mm->arg_start, len)) 1459 return -EFAULT; 1460 for(i = 0; i < len; i++) 1461 if (psinfo->pr_psargs[i] == 0) 1462 psinfo->pr_psargs[i] = ' '; 1463 psinfo->pr_psargs[len] = 0; 1464 1465 rcu_read_lock(); 1466 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1467 rcu_read_unlock(); 1468 psinfo->pr_pid = task_pid_vnr(p); 1469 psinfo->pr_pgrp = task_pgrp_vnr(p); 1470 psinfo->pr_sid = task_session_vnr(p); 1471 1472 i = p->state ? ffz(~p->state) + 1 : 0; 1473 psinfo->pr_state = i; 1474 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i]; 1475 psinfo->pr_zomb = psinfo->pr_sname == 'Z'; 1476 psinfo->pr_nice = task_nice(p); 1477 psinfo->pr_flag = p->flags; 1478 rcu_read_lock(); 1479 cred = __task_cred(p); 1480 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid)); 1481 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid)); 1482 rcu_read_unlock(); 1483 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname)); 1484 1485 return 0; 1486 } 1487 1488 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) 1489 { 1490 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; 1491 int i = 0; 1492 do 1493 i += 2; 1494 while (auxv[i - 2] != AT_NULL); 1495 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); 1496 } 1497 1498 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata, 1499 const siginfo_t *siginfo) 1500 { 1501 mm_segment_t old_fs = get_fs(); 1502 set_fs(KERNEL_DS); 1503 copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo); 1504 set_fs(old_fs); 1505 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata); 1506 } 1507 1508 #define MAX_FILE_NOTE_SIZE (4*1024*1024) 1509 /* 1510 * Format of NT_FILE note: 1511 * 1512 * long count -- how many files are mapped 1513 * long page_size -- units for file_ofs 1514 * array of [COUNT] elements of 1515 * long start 1516 * long end 1517 * long file_ofs 1518 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL... 1519 */ 1520 static int fill_files_note(struct memelfnote *note) 1521 { 1522 struct vm_area_struct *vma; 1523 unsigned count, size, names_ofs, remaining, n; 1524 user_long_t *data; 1525 user_long_t *start_end_ofs; 1526 char *name_base, *name_curpos; 1527 1528 /* *Estimated* file count and total data size needed */ 1529 count = current->mm->map_count; 1530 size = count * 64; 1531 1532 names_ofs = (2 + 3 * count) * sizeof(data[0]); 1533 alloc: 1534 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */ 1535 return -EINVAL; 1536 size = round_up(size, PAGE_SIZE); 1537 data = vmalloc(size); 1538 if (!data) 1539 return -ENOMEM; 1540 1541 start_end_ofs = data + 2; 1542 name_base = name_curpos = ((char *)data) + names_ofs; 1543 remaining = size - names_ofs; 1544 count = 0; 1545 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) { 1546 struct file *file; 1547 const char *filename; 1548 1549 file = vma->vm_file; 1550 if (!file) 1551 continue; 1552 filename = file_path(file, name_curpos, remaining); 1553 if (IS_ERR(filename)) { 1554 if (PTR_ERR(filename) == -ENAMETOOLONG) { 1555 vfree(data); 1556 size = size * 5 / 4; 1557 goto alloc; 1558 } 1559 continue; 1560 } 1561 1562 /* file_path() fills at the end, move name down */ 1563 /* n = strlen(filename) + 1: */ 1564 n = (name_curpos + remaining) - filename; 1565 remaining = filename - name_curpos; 1566 memmove(name_curpos, filename, n); 1567 name_curpos += n; 1568 1569 *start_end_ofs++ = vma->vm_start; 1570 *start_end_ofs++ = vma->vm_end; 1571 *start_end_ofs++ = vma->vm_pgoff; 1572 count++; 1573 } 1574 1575 /* Now we know exact count of files, can store it */ 1576 data[0] = count; 1577 data[1] = PAGE_SIZE; 1578 /* 1579 * Count usually is less than current->mm->map_count, 1580 * we need to move filenames down. 1581 */ 1582 n = current->mm->map_count - count; 1583 if (n != 0) { 1584 unsigned shift_bytes = n * 3 * sizeof(data[0]); 1585 memmove(name_base - shift_bytes, name_base, 1586 name_curpos - name_base); 1587 name_curpos -= shift_bytes; 1588 } 1589 1590 size = name_curpos - (char *)data; 1591 fill_note(note, "CORE", NT_FILE, size, data); 1592 return 0; 1593 } 1594 1595 #ifdef CORE_DUMP_USE_REGSET 1596 #include <linux/regset.h> 1597 1598 struct elf_thread_core_info { 1599 struct elf_thread_core_info *next; 1600 struct task_struct *task; 1601 struct elf_prstatus prstatus; 1602 struct memelfnote notes[0]; 1603 }; 1604 1605 struct elf_note_info { 1606 struct elf_thread_core_info *thread; 1607 struct memelfnote psinfo; 1608 struct memelfnote signote; 1609 struct memelfnote auxv; 1610 struct memelfnote files; 1611 user_siginfo_t csigdata; 1612 size_t size; 1613 int thread_notes; 1614 }; 1615 1616 /* 1617 * When a regset has a writeback hook, we call it on each thread before 1618 * dumping user memory. On register window machines, this makes sure the 1619 * user memory backing the register data is up to date before we read it. 1620 */ 1621 static void do_thread_regset_writeback(struct task_struct *task, 1622 const struct user_regset *regset) 1623 { 1624 if (regset->writeback) 1625 regset->writeback(task, regset, 1); 1626 } 1627 1628 #ifndef PRSTATUS_SIZE 1629 #define PRSTATUS_SIZE(S, R) sizeof(S) 1630 #endif 1631 1632 #ifndef SET_PR_FPVALID 1633 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V)) 1634 #endif 1635 1636 static int fill_thread_core_info(struct elf_thread_core_info *t, 1637 const struct user_regset_view *view, 1638 long signr, size_t *total) 1639 { 1640 unsigned int i; 1641 unsigned int regset_size = view->regsets[0].n * view->regsets[0].size; 1642 1643 /* 1644 * NT_PRSTATUS is the one special case, because the regset data 1645 * goes into the pr_reg field inside the note contents, rather 1646 * than being the whole note contents. We fill the reset in here. 1647 * We assume that regset 0 is NT_PRSTATUS. 1648 */ 1649 fill_prstatus(&t->prstatus, t->task, signr); 1650 (void) view->regsets[0].get(t->task, &view->regsets[0], 0, regset_size, 1651 &t->prstatus.pr_reg, NULL); 1652 1653 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, 1654 PRSTATUS_SIZE(t->prstatus, regset_size), &t->prstatus); 1655 *total += notesize(&t->notes[0]); 1656 1657 do_thread_regset_writeback(t->task, &view->regsets[0]); 1658 1659 /* 1660 * Each other regset might generate a note too. For each regset 1661 * that has no core_note_type or is inactive, we leave t->notes[i] 1662 * all zero and we'll know to skip writing it later. 1663 */ 1664 for (i = 1; i < view->n; ++i) { 1665 const struct user_regset *regset = &view->regsets[i]; 1666 do_thread_regset_writeback(t->task, regset); 1667 if (regset->core_note_type && regset->get && 1668 (!regset->active || regset->active(t->task, regset))) { 1669 int ret; 1670 size_t size = regset->n * regset->size; 1671 void *data = kmalloc(size, GFP_KERNEL); 1672 if (unlikely(!data)) 1673 return 0; 1674 ret = regset->get(t->task, regset, 1675 0, size, data, NULL); 1676 if (unlikely(ret)) 1677 kfree(data); 1678 else { 1679 if (regset->core_note_type != NT_PRFPREG) 1680 fill_note(&t->notes[i], "LINUX", 1681 regset->core_note_type, 1682 size, data); 1683 else { 1684 SET_PR_FPVALID(&t->prstatus, 1685 1, regset_size); 1686 fill_note(&t->notes[i], "CORE", 1687 NT_PRFPREG, size, data); 1688 } 1689 *total += notesize(&t->notes[i]); 1690 } 1691 } 1692 } 1693 1694 return 1; 1695 } 1696 1697 static int fill_note_info(struct elfhdr *elf, int phdrs, 1698 struct elf_note_info *info, 1699 const siginfo_t *siginfo, struct pt_regs *regs) 1700 { 1701 struct task_struct *dump_task = current; 1702 const struct user_regset_view *view = task_user_regset_view(dump_task); 1703 struct elf_thread_core_info *t; 1704 struct elf_prpsinfo *psinfo; 1705 struct core_thread *ct; 1706 unsigned int i; 1707 1708 info->size = 0; 1709 info->thread = NULL; 1710 1711 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1712 if (psinfo == NULL) { 1713 info->psinfo.data = NULL; /* So we don't free this wrongly */ 1714 return 0; 1715 } 1716 1717 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); 1718 1719 /* 1720 * Figure out how many notes we're going to need for each thread. 1721 */ 1722 info->thread_notes = 0; 1723 for (i = 0; i < view->n; ++i) 1724 if (view->regsets[i].core_note_type != 0) 1725 ++info->thread_notes; 1726 1727 /* 1728 * Sanity check. We rely on regset 0 being in NT_PRSTATUS, 1729 * since it is our one special case. 1730 */ 1731 if (unlikely(info->thread_notes == 0) || 1732 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) { 1733 WARN_ON(1); 1734 return 0; 1735 } 1736 1737 /* 1738 * Initialize the ELF file header. 1739 */ 1740 fill_elf_header(elf, phdrs, 1741 view->e_machine, view->e_flags); 1742 1743 /* 1744 * Allocate a structure for each thread. 1745 */ 1746 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) { 1747 t = kzalloc(offsetof(struct elf_thread_core_info, 1748 notes[info->thread_notes]), 1749 GFP_KERNEL); 1750 if (unlikely(!t)) 1751 return 0; 1752 1753 t->task = ct->task; 1754 if (ct->task == dump_task || !info->thread) { 1755 t->next = info->thread; 1756 info->thread = t; 1757 } else { 1758 /* 1759 * Make sure to keep the original task at 1760 * the head of the list. 1761 */ 1762 t->next = info->thread->next; 1763 info->thread->next = t; 1764 } 1765 } 1766 1767 /* 1768 * Now fill in each thread's information. 1769 */ 1770 for (t = info->thread; t != NULL; t = t->next) 1771 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size)) 1772 return 0; 1773 1774 /* 1775 * Fill in the two process-wide notes. 1776 */ 1777 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm); 1778 info->size += notesize(&info->psinfo); 1779 1780 fill_siginfo_note(&info->signote, &info->csigdata, siginfo); 1781 info->size += notesize(&info->signote); 1782 1783 fill_auxv_note(&info->auxv, current->mm); 1784 info->size += notesize(&info->auxv); 1785 1786 if (fill_files_note(&info->files) == 0) 1787 info->size += notesize(&info->files); 1788 1789 return 1; 1790 } 1791 1792 static size_t get_note_info_size(struct elf_note_info *info) 1793 { 1794 return info->size; 1795 } 1796 1797 /* 1798 * Write all the notes for each thread. When writing the first thread, the 1799 * process-wide notes are interleaved after the first thread-specific note. 1800 */ 1801 static int write_note_info(struct elf_note_info *info, 1802 struct coredump_params *cprm) 1803 { 1804 bool first = true; 1805 struct elf_thread_core_info *t = info->thread; 1806 1807 do { 1808 int i; 1809 1810 if (!writenote(&t->notes[0], cprm)) 1811 return 0; 1812 1813 if (first && !writenote(&info->psinfo, cprm)) 1814 return 0; 1815 if (first && !writenote(&info->signote, cprm)) 1816 return 0; 1817 if (first && !writenote(&info->auxv, cprm)) 1818 return 0; 1819 if (first && info->files.data && 1820 !writenote(&info->files, cprm)) 1821 return 0; 1822 1823 for (i = 1; i < info->thread_notes; ++i) 1824 if (t->notes[i].data && 1825 !writenote(&t->notes[i], cprm)) 1826 return 0; 1827 1828 first = false; 1829 t = t->next; 1830 } while (t); 1831 1832 return 1; 1833 } 1834 1835 static void free_note_info(struct elf_note_info *info) 1836 { 1837 struct elf_thread_core_info *threads = info->thread; 1838 while (threads) { 1839 unsigned int i; 1840 struct elf_thread_core_info *t = threads; 1841 threads = t->next; 1842 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus); 1843 for (i = 1; i < info->thread_notes; ++i) 1844 kfree(t->notes[i].data); 1845 kfree(t); 1846 } 1847 kfree(info->psinfo.data); 1848 vfree(info->files.data); 1849 } 1850 1851 #else 1852 1853 /* Here is the structure in which status of each thread is captured. */ 1854 struct elf_thread_status 1855 { 1856 struct list_head list; 1857 struct elf_prstatus prstatus; /* NT_PRSTATUS */ 1858 elf_fpregset_t fpu; /* NT_PRFPREG */ 1859 struct task_struct *thread; 1860 #ifdef ELF_CORE_COPY_XFPREGS 1861 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */ 1862 #endif 1863 struct memelfnote notes[3]; 1864 int num_notes; 1865 }; 1866 1867 /* 1868 * In order to add the specific thread information for the elf file format, 1869 * we need to keep a linked list of every threads pr_status and then create 1870 * a single section for them in the final core file. 1871 */ 1872 static int elf_dump_thread_status(long signr, struct elf_thread_status *t) 1873 { 1874 int sz = 0; 1875 struct task_struct *p = t->thread; 1876 t->num_notes = 0; 1877 1878 fill_prstatus(&t->prstatus, p, signr); 1879 elf_core_copy_task_regs(p, &t->prstatus.pr_reg); 1880 1881 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), 1882 &(t->prstatus)); 1883 t->num_notes++; 1884 sz += notesize(&t->notes[0]); 1885 1886 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, 1887 &t->fpu))) { 1888 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), 1889 &(t->fpu)); 1890 t->num_notes++; 1891 sz += notesize(&t->notes[1]); 1892 } 1893 1894 #ifdef ELF_CORE_COPY_XFPREGS 1895 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) { 1896 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE, 1897 sizeof(t->xfpu), &t->xfpu); 1898 t->num_notes++; 1899 sz += notesize(&t->notes[2]); 1900 } 1901 #endif 1902 return sz; 1903 } 1904 1905 struct elf_note_info { 1906 struct memelfnote *notes; 1907 struct memelfnote *notes_files; 1908 struct elf_prstatus *prstatus; /* NT_PRSTATUS */ 1909 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */ 1910 struct list_head thread_list; 1911 elf_fpregset_t *fpu; 1912 #ifdef ELF_CORE_COPY_XFPREGS 1913 elf_fpxregset_t *xfpu; 1914 #endif 1915 user_siginfo_t csigdata; 1916 int thread_status_size; 1917 int numnote; 1918 }; 1919 1920 static int elf_note_info_init(struct elf_note_info *info) 1921 { 1922 memset(info, 0, sizeof(*info)); 1923 INIT_LIST_HEAD(&info->thread_list); 1924 1925 /* Allocate space for ELF notes */ 1926 info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL); 1927 if (!info->notes) 1928 return 0; 1929 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL); 1930 if (!info->psinfo) 1931 return 0; 1932 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL); 1933 if (!info->prstatus) 1934 return 0; 1935 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL); 1936 if (!info->fpu) 1937 return 0; 1938 #ifdef ELF_CORE_COPY_XFPREGS 1939 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL); 1940 if (!info->xfpu) 1941 return 0; 1942 #endif 1943 return 1; 1944 } 1945 1946 static int fill_note_info(struct elfhdr *elf, int phdrs, 1947 struct elf_note_info *info, 1948 const siginfo_t *siginfo, struct pt_regs *regs) 1949 { 1950 struct list_head *t; 1951 struct core_thread *ct; 1952 struct elf_thread_status *ets; 1953 1954 if (!elf_note_info_init(info)) 1955 return 0; 1956 1957 for (ct = current->mm->core_state->dumper.next; 1958 ct; ct = ct->next) { 1959 ets = kzalloc(sizeof(*ets), GFP_KERNEL); 1960 if (!ets) 1961 return 0; 1962 1963 ets->thread = ct->task; 1964 list_add(&ets->list, &info->thread_list); 1965 } 1966 1967 list_for_each(t, &info->thread_list) { 1968 int sz; 1969 1970 ets = list_entry(t, struct elf_thread_status, list); 1971 sz = elf_dump_thread_status(siginfo->si_signo, ets); 1972 info->thread_status_size += sz; 1973 } 1974 /* now collect the dump for the current */ 1975 memset(info->prstatus, 0, sizeof(*info->prstatus)); 1976 fill_prstatus(info->prstatus, current, siginfo->si_signo); 1977 elf_core_copy_regs(&info->prstatus->pr_reg, regs); 1978 1979 /* Set up header */ 1980 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS); 1981 1982 /* 1983 * Set up the notes in similar form to SVR4 core dumps made 1984 * with info from their /proc. 1985 */ 1986 1987 fill_note(info->notes + 0, "CORE", NT_PRSTATUS, 1988 sizeof(*info->prstatus), info->prstatus); 1989 fill_psinfo(info->psinfo, current->group_leader, current->mm); 1990 fill_note(info->notes + 1, "CORE", NT_PRPSINFO, 1991 sizeof(*info->psinfo), info->psinfo); 1992 1993 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo); 1994 fill_auxv_note(info->notes + 3, current->mm); 1995 info->numnote = 4; 1996 1997 if (fill_files_note(info->notes + info->numnote) == 0) { 1998 info->notes_files = info->notes + info->numnote; 1999 info->numnote++; 2000 } 2001 2002 /* Try to dump the FPU. */ 2003 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, 2004 info->fpu); 2005 if (info->prstatus->pr_fpvalid) 2006 fill_note(info->notes + info->numnote++, 2007 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu); 2008 #ifdef ELF_CORE_COPY_XFPREGS 2009 if (elf_core_copy_task_xfpregs(current, info->xfpu)) 2010 fill_note(info->notes + info->numnote++, 2011 "LINUX", ELF_CORE_XFPREG_TYPE, 2012 sizeof(*info->xfpu), info->xfpu); 2013 #endif 2014 2015 return 1; 2016 } 2017 2018 static size_t get_note_info_size(struct elf_note_info *info) 2019 { 2020 int sz = 0; 2021 int i; 2022 2023 for (i = 0; i < info->numnote; i++) 2024 sz += notesize(info->notes + i); 2025 2026 sz += info->thread_status_size; 2027 2028 return sz; 2029 } 2030 2031 static int write_note_info(struct elf_note_info *info, 2032 struct coredump_params *cprm) 2033 { 2034 int i; 2035 struct list_head *t; 2036 2037 for (i = 0; i < info->numnote; i++) 2038 if (!writenote(info->notes + i, cprm)) 2039 return 0; 2040 2041 /* write out the thread status notes section */ 2042 list_for_each(t, &info->thread_list) { 2043 struct elf_thread_status *tmp = 2044 list_entry(t, struct elf_thread_status, list); 2045 2046 for (i = 0; i < tmp->num_notes; i++) 2047 if (!writenote(&tmp->notes[i], cprm)) 2048 return 0; 2049 } 2050 2051 return 1; 2052 } 2053 2054 static void free_note_info(struct elf_note_info *info) 2055 { 2056 while (!list_empty(&info->thread_list)) { 2057 struct list_head *tmp = info->thread_list.next; 2058 list_del(tmp); 2059 kfree(list_entry(tmp, struct elf_thread_status, list)); 2060 } 2061 2062 /* Free data possibly allocated by fill_files_note(): */ 2063 if (info->notes_files) 2064 vfree(info->notes_files->data); 2065 2066 kfree(info->prstatus); 2067 kfree(info->psinfo); 2068 kfree(info->notes); 2069 kfree(info->fpu); 2070 #ifdef ELF_CORE_COPY_XFPREGS 2071 kfree(info->xfpu); 2072 #endif 2073 } 2074 2075 #endif 2076 2077 static struct vm_area_struct *first_vma(struct task_struct *tsk, 2078 struct vm_area_struct *gate_vma) 2079 { 2080 struct vm_area_struct *ret = tsk->mm->mmap; 2081 2082 if (ret) 2083 return ret; 2084 return gate_vma; 2085 } 2086 /* 2087 * Helper function for iterating across a vma list. It ensures that the caller 2088 * will visit `gate_vma' prior to terminating the search. 2089 */ 2090 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma, 2091 struct vm_area_struct *gate_vma) 2092 { 2093 struct vm_area_struct *ret; 2094 2095 ret = this_vma->vm_next; 2096 if (ret) 2097 return ret; 2098 if (this_vma == gate_vma) 2099 return NULL; 2100 return gate_vma; 2101 } 2102 2103 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, 2104 elf_addr_t e_shoff, int segs) 2105 { 2106 elf->e_shoff = e_shoff; 2107 elf->e_shentsize = sizeof(*shdr4extnum); 2108 elf->e_shnum = 1; 2109 elf->e_shstrndx = SHN_UNDEF; 2110 2111 memset(shdr4extnum, 0, sizeof(*shdr4extnum)); 2112 2113 shdr4extnum->sh_type = SHT_NULL; 2114 shdr4extnum->sh_size = elf->e_shnum; 2115 shdr4extnum->sh_link = elf->e_shstrndx; 2116 shdr4extnum->sh_info = segs; 2117 } 2118 2119 /* 2120 * Actual dumper 2121 * 2122 * This is a two-pass process; first we find the offsets of the bits, 2123 * and then they are actually written out. If we run out of core limit 2124 * we just truncate. 2125 */ 2126 static int elf_core_dump(struct coredump_params *cprm) 2127 { 2128 int has_dumped = 0; 2129 mm_segment_t fs; 2130 int segs, i; 2131 size_t vma_data_size = 0; 2132 struct vm_area_struct *vma, *gate_vma; 2133 struct elfhdr *elf = NULL; 2134 loff_t offset = 0, dataoff; 2135 struct elf_note_info info = { }; 2136 struct elf_phdr *phdr4note = NULL; 2137 struct elf_shdr *shdr4extnum = NULL; 2138 Elf_Half e_phnum; 2139 elf_addr_t e_shoff; 2140 elf_addr_t *vma_filesz = NULL; 2141 2142 /* 2143 * We no longer stop all VM operations. 2144 * 2145 * This is because those proceses that could possibly change map_count 2146 * or the mmap / vma pages are now blocked in do_exit on current 2147 * finishing this core dump. 2148 * 2149 * Only ptrace can touch these memory addresses, but it doesn't change 2150 * the map_count or the pages allocated. So no possibility of crashing 2151 * exists while dumping the mm->vm_next areas to the core file. 2152 */ 2153 2154 /* alloc memory for large data structures: too large to be on stack */ 2155 elf = kmalloc(sizeof(*elf), GFP_KERNEL); 2156 if (!elf) 2157 goto out; 2158 /* 2159 * The number of segs are recored into ELF header as 16bit value. 2160 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. 2161 */ 2162 segs = current->mm->map_count; 2163 segs += elf_core_extra_phdrs(); 2164 2165 gate_vma = get_gate_vma(current->mm); 2166 if (gate_vma != NULL) 2167 segs++; 2168 2169 /* for notes section */ 2170 segs++; 2171 2172 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid 2173 * this, kernel supports extended numbering. Have a look at 2174 * include/linux/elf.h for further information. */ 2175 e_phnum = segs > PN_XNUM ? PN_XNUM : segs; 2176 2177 /* 2178 * Collect all the non-memory information about the process for the 2179 * notes. This also sets up the file header. 2180 */ 2181 if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs)) 2182 goto cleanup; 2183 2184 has_dumped = 1; 2185 2186 fs = get_fs(); 2187 set_fs(KERNEL_DS); 2188 2189 offset += sizeof(*elf); /* Elf header */ 2190 offset += segs * sizeof(struct elf_phdr); /* Program headers */ 2191 2192 /* Write notes phdr entry */ 2193 { 2194 size_t sz = get_note_info_size(&info); 2195 2196 sz += elf_coredump_extra_notes_size(); 2197 2198 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL); 2199 if (!phdr4note) 2200 goto end_coredump; 2201 2202 fill_elf_note_phdr(phdr4note, sz, offset); 2203 offset += sz; 2204 } 2205 2206 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); 2207 2208 if (segs - 1 > ULONG_MAX / sizeof(*vma_filesz)) 2209 goto end_coredump; 2210 vma_filesz = vmalloc((segs - 1) * sizeof(*vma_filesz)); 2211 if (!vma_filesz) 2212 goto end_coredump; 2213 2214 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2215 vma = next_vma(vma, gate_vma)) { 2216 unsigned long dump_size; 2217 2218 dump_size = vma_dump_size(vma, cprm->mm_flags); 2219 vma_filesz[i++] = dump_size; 2220 vma_data_size += dump_size; 2221 } 2222 2223 offset += vma_data_size; 2224 offset += elf_core_extra_data_size(); 2225 e_shoff = offset; 2226 2227 if (e_phnum == PN_XNUM) { 2228 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL); 2229 if (!shdr4extnum) 2230 goto end_coredump; 2231 fill_extnum_info(elf, shdr4extnum, e_shoff, segs); 2232 } 2233 2234 offset = dataoff; 2235 2236 if (!dump_emit(cprm, elf, sizeof(*elf))) 2237 goto end_coredump; 2238 2239 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note))) 2240 goto end_coredump; 2241 2242 /* Write program headers for segments dump */ 2243 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2244 vma = next_vma(vma, gate_vma)) { 2245 struct elf_phdr phdr; 2246 2247 phdr.p_type = PT_LOAD; 2248 phdr.p_offset = offset; 2249 phdr.p_vaddr = vma->vm_start; 2250 phdr.p_paddr = 0; 2251 phdr.p_filesz = vma_filesz[i++]; 2252 phdr.p_memsz = vma->vm_end - vma->vm_start; 2253 offset += phdr.p_filesz; 2254 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; 2255 if (vma->vm_flags & VM_WRITE) 2256 phdr.p_flags |= PF_W; 2257 if (vma->vm_flags & VM_EXEC) 2258 phdr.p_flags |= PF_X; 2259 phdr.p_align = ELF_EXEC_PAGESIZE; 2260 2261 if (!dump_emit(cprm, &phdr, sizeof(phdr))) 2262 goto end_coredump; 2263 } 2264 2265 if (!elf_core_write_extra_phdrs(cprm, offset)) 2266 goto end_coredump; 2267 2268 /* write out the notes section */ 2269 if (!write_note_info(&info, cprm)) 2270 goto end_coredump; 2271 2272 if (elf_coredump_extra_notes_write(cprm)) 2273 goto end_coredump; 2274 2275 /* Align to page */ 2276 if (!dump_skip(cprm, dataoff - cprm->pos)) 2277 goto end_coredump; 2278 2279 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 2280 vma = next_vma(vma, gate_vma)) { 2281 unsigned long addr; 2282 unsigned long end; 2283 2284 end = vma->vm_start + vma_filesz[i++]; 2285 2286 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) { 2287 struct page *page; 2288 int stop; 2289 2290 page = get_dump_page(addr); 2291 if (page) { 2292 void *kaddr = kmap(page); 2293 stop = !dump_emit(cprm, kaddr, PAGE_SIZE); 2294 kunmap(page); 2295 put_page(page); 2296 } else 2297 stop = !dump_skip(cprm, PAGE_SIZE); 2298 if (stop) 2299 goto end_coredump; 2300 } 2301 } 2302 dump_truncate(cprm); 2303 2304 if (!elf_core_write_extra_data(cprm)) 2305 goto end_coredump; 2306 2307 if (e_phnum == PN_XNUM) { 2308 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum))) 2309 goto end_coredump; 2310 } 2311 2312 end_coredump: 2313 set_fs(fs); 2314 2315 cleanup: 2316 free_note_info(&info); 2317 kfree(shdr4extnum); 2318 vfree(vma_filesz); 2319 kfree(phdr4note); 2320 kfree(elf); 2321 out: 2322 return has_dumped; 2323 } 2324 2325 #endif /* CONFIG_ELF_CORE */ 2326 2327 static int __init init_elf_binfmt(void) 2328 { 2329 register_binfmt(&elf_format); 2330 return 0; 2331 } 2332 2333 static void __exit exit_elf_binfmt(void) 2334 { 2335 /* Remove the COFF and ELF loaders. */ 2336 unregister_binfmt(&elf_format); 2337 } 2338 2339 core_initcall(init_elf_binfmt); 2340 module_exit(exit_elf_binfmt); 2341 MODULE_LICENSE("GPL"); 2342