1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/fs/binfmt_elf.c 4 * 5 * These are the functions used to load ELF format executables as used 6 * on SVr4 machines. Information on the format may be found in the book 7 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support 8 * Tools". 9 * 10 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com). 11 */ 12 13 #include <linux/module.h> 14 #include <linux/kernel.h> 15 #include <linux/fs.h> 16 #include <linux/log2.h> 17 #include <linux/mm.h> 18 #include <linux/mman.h> 19 #include <linux/errno.h> 20 #include <linux/signal.h> 21 #include <linux/binfmts.h> 22 #include <linux/string.h> 23 #include <linux/file.h> 24 #include <linux/slab.h> 25 #include <linux/personality.h> 26 #include <linux/elfcore.h> 27 #include <linux/init.h> 28 #include <linux/highuid.h> 29 #include <linux/compiler.h> 30 #include <linux/highmem.h> 31 #include <linux/hugetlb.h> 32 #include <linux/pagemap.h> 33 #include <linux/vmalloc.h> 34 #include <linux/security.h> 35 #include <linux/random.h> 36 #include <linux/elf.h> 37 #include <linux/elf-randomize.h> 38 #include <linux/utsname.h> 39 #include <linux/coredump.h> 40 #include <linux/sched.h> 41 #include <linux/sched/coredump.h> 42 #include <linux/sched/task_stack.h> 43 #include <linux/sched/cputime.h> 44 #include <linux/sizes.h> 45 #include <linux/types.h> 46 #include <linux/cred.h> 47 #include <linux/dax.h> 48 #include <linux/uaccess.h> 49 #include <linux/rseq.h> 50 #include <asm/param.h> 51 #include <asm/page.h> 52 53 #ifndef ELF_COMPAT 54 #define ELF_COMPAT 0 55 #endif 56 57 #ifndef user_long_t 58 #define user_long_t long 59 #endif 60 #ifndef user_siginfo_t 61 #define user_siginfo_t siginfo_t 62 #endif 63 64 /* That's for binfmt_elf_fdpic to deal with */ 65 #ifndef elf_check_fdpic 66 #define elf_check_fdpic(ex) false 67 #endif 68 69 static int load_elf_binary(struct linux_binprm *bprm); 70 71 #ifdef CONFIG_USELIB 72 static int load_elf_library(struct file *); 73 #else 74 #define load_elf_library NULL 75 #endif 76 77 /* 78 * If we don't support core dumping, then supply a NULL so we 79 * don't even try. 80 */ 81 #ifdef CONFIG_ELF_CORE 82 static int elf_core_dump(struct coredump_params *cprm); 83 #else 84 #define elf_core_dump NULL 85 #endif 86 87 #if ELF_EXEC_PAGESIZE > PAGE_SIZE 88 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE 89 #else 90 #define ELF_MIN_ALIGN PAGE_SIZE 91 #endif 92 93 #ifndef ELF_CORE_EFLAGS 94 #define ELF_CORE_EFLAGS 0 95 #endif 96 97 #define ELF_PAGESTART(_v) ((_v) & ~(int)(ELF_MIN_ALIGN-1)) 98 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1)) 99 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1)) 100 101 static struct linux_binfmt elf_format = { 102 .module = THIS_MODULE, 103 .load_binary = load_elf_binary, 104 .load_shlib = load_elf_library, 105 #ifdef CONFIG_COREDUMP 106 .core_dump = elf_core_dump, 107 .min_coredump = ELF_EXEC_PAGESIZE, 108 #endif 109 }; 110 111 #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE)) 112 113 /* 114 * We need to explicitly zero any trailing portion of the page that follows 115 * p_filesz when it ends before the page ends (e.g. bss), otherwise this 116 * memory will contain the junk from the file that should not be present. 117 */ 118 static int padzero(unsigned long address) 119 { 120 unsigned long nbyte; 121 122 nbyte = ELF_PAGEOFFSET(address); 123 if (nbyte) { 124 nbyte = ELF_MIN_ALIGN - nbyte; 125 if (clear_user((void __user *)address, nbyte)) 126 return -EFAULT; 127 } 128 return 0; 129 } 130 131 /* Let's use some macros to make this stack manipulation a little clearer */ 132 #ifdef CONFIG_STACK_GROWSUP 133 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items)) 134 #define STACK_ROUND(sp, items) \ 135 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL) 136 #define STACK_ALLOC(sp, len) ({ \ 137 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \ 138 old_sp; }) 139 #else 140 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items)) 141 #define STACK_ROUND(sp, items) \ 142 (((unsigned long) (sp - items)) &~ 15UL) 143 #define STACK_ALLOC(sp, len) (sp -= len) 144 #endif 145 146 #ifndef ELF_BASE_PLATFORM 147 /* 148 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture. 149 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value 150 * will be copied to the user stack in the same manner as AT_PLATFORM. 151 */ 152 #define ELF_BASE_PLATFORM NULL 153 #endif 154 155 static int 156 create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, 157 unsigned long interp_load_addr, 158 unsigned long e_entry, unsigned long phdr_addr) 159 { 160 struct mm_struct *mm = current->mm; 161 unsigned long p = bprm->p; 162 int argc = bprm->argc; 163 int envc = bprm->envc; 164 elf_addr_t __user *sp; 165 elf_addr_t __user *u_platform; 166 elf_addr_t __user *u_base_platform; 167 elf_addr_t __user *u_rand_bytes; 168 const char *k_platform = ELF_PLATFORM; 169 const char *k_base_platform = ELF_BASE_PLATFORM; 170 unsigned char k_rand_bytes[16]; 171 int items; 172 elf_addr_t *elf_info; 173 elf_addr_t flags = 0; 174 int ei_index; 175 const struct cred *cred = current_cred(); 176 struct vm_area_struct *vma; 177 178 /* 179 * In some cases (e.g. Hyper-Threading), we want to avoid L1 180 * evictions by the processes running on the same package. One 181 * thing we can do is to shuffle the initial stack for them. 182 */ 183 184 p = arch_align_stack(p); 185 186 /* 187 * If this architecture has a platform capability string, copy it 188 * to userspace. In some cases (Sparc), this info is impossible 189 * for userspace to get any other way, in others (i386) it is 190 * merely difficult. 191 */ 192 u_platform = NULL; 193 if (k_platform) { 194 size_t len = strlen(k_platform) + 1; 195 196 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 197 if (copy_to_user(u_platform, k_platform, len)) 198 return -EFAULT; 199 } 200 201 /* 202 * If this architecture has a "base" platform capability 203 * string, copy it to userspace. 204 */ 205 u_base_platform = NULL; 206 if (k_base_platform) { 207 size_t len = strlen(k_base_platform) + 1; 208 209 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); 210 if (copy_to_user(u_base_platform, k_base_platform, len)) 211 return -EFAULT; 212 } 213 214 /* 215 * Generate 16 random bytes for userspace PRNG seeding. 216 */ 217 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes)); 218 u_rand_bytes = (elf_addr_t __user *) 219 STACK_ALLOC(p, sizeof(k_rand_bytes)); 220 if (copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes))) 221 return -EFAULT; 222 223 /* Create the ELF interpreter info */ 224 elf_info = (elf_addr_t *)mm->saved_auxv; 225 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ 226 #define NEW_AUX_ENT(id, val) \ 227 do { \ 228 *elf_info++ = id; \ 229 *elf_info++ = val; \ 230 } while (0) 231 232 #ifdef ARCH_DLINFO 233 /* 234 * ARCH_DLINFO must come first so PPC can do its special alignment of 235 * AUXV. 236 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in 237 * ARCH_DLINFO changes 238 */ 239 ARCH_DLINFO; 240 #endif 241 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); 242 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); 243 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); 244 NEW_AUX_ENT(AT_PHDR, phdr_addr); 245 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); 246 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); 247 NEW_AUX_ENT(AT_BASE, interp_load_addr); 248 if (bprm->interp_flags & BINPRM_FLAGS_PRESERVE_ARGV0) 249 flags |= AT_FLAGS_PRESERVE_ARGV0; 250 NEW_AUX_ENT(AT_FLAGS, flags); 251 NEW_AUX_ENT(AT_ENTRY, e_entry); 252 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid)); 253 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid)); 254 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid)); 255 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid)); 256 NEW_AUX_ENT(AT_SECURE, bprm->secureexec); 257 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes); 258 #ifdef ELF_HWCAP2 259 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2); 260 #endif 261 #ifdef ELF_HWCAP3 262 NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3); 263 #endif 264 #ifdef ELF_HWCAP4 265 NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4); 266 #endif 267 NEW_AUX_ENT(AT_EXECFN, bprm->exec); 268 if (k_platform) { 269 NEW_AUX_ENT(AT_PLATFORM, 270 (elf_addr_t)(unsigned long)u_platform); 271 } 272 if (k_base_platform) { 273 NEW_AUX_ENT(AT_BASE_PLATFORM, 274 (elf_addr_t)(unsigned long)u_base_platform); 275 } 276 if (bprm->have_execfd) { 277 NEW_AUX_ENT(AT_EXECFD, bprm->execfd); 278 } 279 #ifdef CONFIG_RSEQ 280 NEW_AUX_ENT(AT_RSEQ_FEATURE_SIZE, offsetof(struct rseq, end)); 281 NEW_AUX_ENT(AT_RSEQ_ALIGN, __alignof__(struct rseq)); 282 #endif 283 #undef NEW_AUX_ENT 284 /* AT_NULL is zero; clear the rest too */ 285 memset(elf_info, 0, (char *)mm->saved_auxv + 286 sizeof(mm->saved_auxv) - (char *)elf_info); 287 288 /* And advance past the AT_NULL entry. */ 289 elf_info += 2; 290 291 ei_index = elf_info - (elf_addr_t *)mm->saved_auxv; 292 sp = STACK_ADD(p, ei_index); 293 294 items = (argc + 1) + (envc + 1) + 1; 295 bprm->p = STACK_ROUND(sp, items); 296 297 /* Point sp at the lowest address on the stack */ 298 #ifdef CONFIG_STACK_GROWSUP 299 sp = (elf_addr_t __user *)bprm->p - items - ei_index; 300 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */ 301 #else 302 sp = (elf_addr_t __user *)bprm->p; 303 #endif 304 305 306 /* 307 * Grow the stack manually; some architectures have a limit on how 308 * far ahead a user-space access may be in order to grow the stack. 309 */ 310 if (mmap_write_lock_killable(mm)) 311 return -EINTR; 312 vma = find_extend_vma_locked(mm, bprm->p); 313 mmap_write_unlock(mm); 314 if (!vma) 315 return -EFAULT; 316 317 /* Now, let's put argc (and argv, envp if appropriate) on the stack */ 318 if (put_user(argc, sp++)) 319 return -EFAULT; 320 321 /* Populate list of argv pointers back to argv strings. */ 322 p = mm->arg_end = mm->arg_start; 323 while (argc-- > 0) { 324 size_t len; 325 if (put_user((elf_addr_t)p, sp++)) 326 return -EFAULT; 327 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 328 if (!len || len > MAX_ARG_STRLEN) 329 return -EINVAL; 330 p += len; 331 } 332 if (put_user(0, sp++)) 333 return -EFAULT; 334 mm->arg_end = p; 335 336 /* Populate list of envp pointers back to envp strings. */ 337 mm->env_end = mm->env_start = p; 338 while (envc-- > 0) { 339 size_t len; 340 if (put_user((elf_addr_t)p, sp++)) 341 return -EFAULT; 342 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN); 343 if (!len || len > MAX_ARG_STRLEN) 344 return -EINVAL; 345 p += len; 346 } 347 if (put_user(0, sp++)) 348 return -EFAULT; 349 mm->env_end = p; 350 351 /* Put the elf_info on the stack in the right place. */ 352 if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t))) 353 return -EFAULT; 354 return 0; 355 } 356 357 /* 358 * Map "eppnt->p_filesz" bytes from "filep" offset "eppnt->p_offset" 359 * into memory at "addr". (Note that p_filesz is rounded up to the 360 * next page, so any extra bytes from the file must be wiped.) 361 */ 362 static unsigned long elf_map(struct file *filep, unsigned long addr, 363 const struct elf_phdr *eppnt, int prot, int type, 364 unsigned long total_size) 365 { 366 unsigned long map_addr; 367 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr); 368 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr); 369 addr = ELF_PAGESTART(addr); 370 size = ELF_PAGEALIGN(size); 371 372 /* mmap() will return -EINVAL if given a zero size, but a 373 * segment with zero filesize is perfectly valid */ 374 if (!size) 375 return addr; 376 377 /* 378 * total_size is the size of the ELF (interpreter) image. 379 * The _first_ mmap needs to know the full size, otherwise 380 * randomization might put this image into an overlapping 381 * position with the ELF binary image. (since size < total_size) 382 * So we first map the 'big' image - and unmap the remainder at 383 * the end. (which unmap is needed for ELF images with holes.) 384 */ 385 if (total_size) { 386 total_size = ELF_PAGEALIGN(total_size); 387 map_addr = vm_mmap(filep, addr, total_size, prot, type, off); 388 if (!BAD_ADDR(map_addr)) 389 vm_munmap(map_addr+size, total_size-size); 390 } else 391 map_addr = vm_mmap(filep, addr, size, prot, type, off); 392 393 if ((type & MAP_FIXED_NOREPLACE) && 394 PTR_ERR((void *)map_addr) == -EEXIST) 395 pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n", 396 task_pid_nr(current), current->comm, (void *)addr); 397 398 return(map_addr); 399 } 400 401 /* 402 * Map "eppnt->p_filesz" bytes from "filep" offset "eppnt->p_offset" 403 * into memory at "addr". Memory from "p_filesz" through "p_memsz" 404 * rounded up to the next page is zeroed. 405 */ 406 static unsigned long elf_load(struct file *filep, unsigned long addr, 407 const struct elf_phdr *eppnt, int prot, int type, 408 unsigned long total_size) 409 { 410 unsigned long zero_start, zero_end; 411 unsigned long map_addr; 412 413 if (eppnt->p_filesz) { 414 map_addr = elf_map(filep, addr, eppnt, prot, type, total_size); 415 if (BAD_ADDR(map_addr)) 416 return map_addr; 417 if (eppnt->p_memsz > eppnt->p_filesz) { 418 zero_start = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + 419 eppnt->p_filesz; 420 zero_end = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + 421 eppnt->p_memsz; 422 423 /* 424 * Zero the end of the last mapped page but ignore 425 * any errors if the segment isn't writable. 426 */ 427 if (padzero(zero_start) && (prot & PROT_WRITE)) 428 return -EFAULT; 429 } 430 } else { 431 map_addr = zero_start = ELF_PAGESTART(addr); 432 zero_end = zero_start + ELF_PAGEOFFSET(eppnt->p_vaddr) + 433 eppnt->p_memsz; 434 } 435 if (eppnt->p_memsz > eppnt->p_filesz) { 436 /* 437 * Map the last of the segment. 438 * If the header is requesting these pages to be 439 * executable, honour that (ppc32 needs this). 440 */ 441 int error; 442 443 zero_start = ELF_PAGEALIGN(zero_start); 444 zero_end = ELF_PAGEALIGN(zero_end); 445 446 error = vm_brk_flags(zero_start, zero_end - zero_start, 447 prot & PROT_EXEC ? VM_EXEC : 0); 448 if (error) 449 map_addr = error; 450 } 451 return map_addr; 452 } 453 454 455 static unsigned long total_mapping_size(const struct elf_phdr *phdr, int nr) 456 { 457 elf_addr_t min_addr = -1; 458 elf_addr_t max_addr = 0; 459 bool pt_load = false; 460 int i; 461 462 for (i = 0; i < nr; i++) { 463 if (phdr[i].p_type == PT_LOAD) { 464 min_addr = min(min_addr, ELF_PAGESTART(phdr[i].p_vaddr)); 465 max_addr = max(max_addr, phdr[i].p_vaddr + phdr[i].p_memsz); 466 pt_load = true; 467 } 468 } 469 return pt_load ? (max_addr - min_addr) : 0; 470 } 471 472 static int elf_read(struct file *file, void *buf, size_t len, loff_t pos) 473 { 474 ssize_t rv; 475 476 rv = kernel_read(file, buf, len, &pos); 477 if (unlikely(rv != len)) { 478 return (rv < 0) ? rv : -EIO; 479 } 480 return 0; 481 } 482 483 static unsigned long maximum_alignment(struct elf_phdr *cmds, int nr) 484 { 485 unsigned long alignment = 0; 486 int i; 487 488 for (i = 0; i < nr; i++) { 489 if (cmds[i].p_type == PT_LOAD) { 490 unsigned long p_align = cmds[i].p_align; 491 492 /* skip non-power of two alignments as invalid */ 493 if (!is_power_of_2(p_align)) 494 continue; 495 alignment = max(alignment, p_align); 496 } 497 } 498 499 /* ensure we align to at least one page */ 500 return ELF_PAGEALIGN(alignment); 501 } 502 503 /** 504 * load_elf_phdrs() - load ELF program headers 505 * @elf_ex: ELF header of the binary whose program headers should be loaded 506 * @elf_file: the opened ELF binary file 507 * 508 * Loads ELF program headers from the binary file elf_file, which has the ELF 509 * header pointed to by elf_ex, into a newly allocated array. The caller is 510 * responsible for freeing the allocated data. Returns NULL upon failure. 511 */ 512 static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex, 513 struct file *elf_file) 514 { 515 struct elf_phdr *elf_phdata = NULL; 516 int retval = -1; 517 unsigned int size; 518 519 /* 520 * If the size of this structure has changed, then punt, since 521 * we will be doing the wrong thing. 522 */ 523 if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) 524 goto out; 525 526 /* Sanity check the number of program headers... */ 527 /* ...and their total size. */ 528 size = sizeof(struct elf_phdr) * elf_ex->e_phnum; 529 if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN) 530 goto out; 531 532 elf_phdata = kmalloc(size, GFP_KERNEL); 533 if (!elf_phdata) 534 goto out; 535 536 /* Read in the program headers */ 537 retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff); 538 539 out: 540 if (retval) { 541 kfree(elf_phdata); 542 elf_phdata = NULL; 543 } 544 return elf_phdata; 545 } 546 547 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE 548 549 /** 550 * struct arch_elf_state - arch-specific ELF loading state 551 * 552 * This structure is used to preserve architecture specific data during 553 * the loading of an ELF file, throughout the checking of architecture 554 * specific ELF headers & through to the point where the ELF load is 555 * known to be proceeding (ie. SET_PERSONALITY). 556 * 557 * This implementation is a dummy for architectures which require no 558 * specific state. 559 */ 560 struct arch_elf_state { 561 }; 562 563 #define INIT_ARCH_ELF_STATE {} 564 565 /** 566 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header 567 * @ehdr: The main ELF header 568 * @phdr: The program header to check 569 * @elf: The open ELF file 570 * @is_interp: True if the phdr is from the interpreter of the ELF being 571 * loaded, else false. 572 * @state: Architecture-specific state preserved throughout the process 573 * of loading the ELF. 574 * 575 * Inspects the program header phdr to validate its correctness and/or 576 * suitability for the system. Called once per ELF program header in the 577 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its 578 * interpreter. 579 * 580 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 581 * with that return code. 582 */ 583 static inline int arch_elf_pt_proc(struct elfhdr *ehdr, 584 struct elf_phdr *phdr, 585 struct file *elf, bool is_interp, 586 struct arch_elf_state *state) 587 { 588 /* Dummy implementation, always proceed */ 589 return 0; 590 } 591 592 /** 593 * arch_check_elf() - check an ELF executable 594 * @ehdr: The main ELF header 595 * @has_interp: True if the ELF has an interpreter, else false. 596 * @interp_ehdr: The interpreter's ELF header 597 * @state: Architecture-specific state preserved throughout the process 598 * of loading the ELF. 599 * 600 * Provides a final opportunity for architecture code to reject the loading 601 * of the ELF & cause an exec syscall to return an error. This is called after 602 * all program headers to be checked by arch_elf_pt_proc have been. 603 * 604 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load 605 * with that return code. 606 */ 607 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, 608 struct elfhdr *interp_ehdr, 609 struct arch_elf_state *state) 610 { 611 /* Dummy implementation, always proceed */ 612 return 0; 613 } 614 615 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ 616 617 static inline int make_prot(u32 p_flags, struct arch_elf_state *arch_state, 618 bool has_interp, bool is_interp) 619 { 620 int prot = 0; 621 622 if (p_flags & PF_R) 623 prot |= PROT_READ; 624 if (p_flags & PF_W) 625 prot |= PROT_WRITE; 626 if (p_flags & PF_X) 627 prot |= PROT_EXEC; 628 629 return arch_elf_adjust_prot(prot, arch_state, has_interp, is_interp); 630 } 631 632 /* This is much more generalized than the library routine read function, 633 so we keep this separate. Technically the library read function 634 is only provided so that we can read a.out libraries that have 635 an ELF header */ 636 637 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, 638 struct file *interpreter, 639 unsigned long no_base, struct elf_phdr *interp_elf_phdata, 640 struct arch_elf_state *arch_state) 641 { 642 struct elf_phdr *eppnt; 643 unsigned long load_addr = 0; 644 int load_addr_set = 0; 645 unsigned long error = ~0UL; 646 unsigned long total_size; 647 int i; 648 649 /* First of all, some simple consistency checks */ 650 if (interp_elf_ex->e_type != ET_EXEC && 651 interp_elf_ex->e_type != ET_DYN) 652 goto out; 653 if (!elf_check_arch(interp_elf_ex) || 654 elf_check_fdpic(interp_elf_ex)) 655 goto out; 656 if (!interpreter->f_op->mmap) 657 goto out; 658 659 total_size = total_mapping_size(interp_elf_phdata, 660 interp_elf_ex->e_phnum); 661 if (!total_size) { 662 error = -EINVAL; 663 goto out; 664 } 665 666 eppnt = interp_elf_phdata; 667 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { 668 if (eppnt->p_type == PT_LOAD) { 669 int elf_type = MAP_PRIVATE; 670 int elf_prot = make_prot(eppnt->p_flags, arch_state, 671 true, true); 672 unsigned long vaddr = 0; 673 unsigned long k, map_addr; 674 675 vaddr = eppnt->p_vaddr; 676 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set) 677 elf_type |= MAP_FIXED; 678 else if (no_base && interp_elf_ex->e_type == ET_DYN) 679 load_addr = -vaddr; 680 681 map_addr = elf_load(interpreter, load_addr + vaddr, 682 eppnt, elf_prot, elf_type, total_size); 683 total_size = 0; 684 error = map_addr; 685 if (BAD_ADDR(map_addr)) 686 goto out; 687 688 if (!load_addr_set && 689 interp_elf_ex->e_type == ET_DYN) { 690 load_addr = map_addr - ELF_PAGESTART(vaddr); 691 load_addr_set = 1; 692 } 693 694 /* 695 * Check to see if the section's size will overflow the 696 * allowed task size. Note that p_filesz must always be 697 * <= p_memsize so it's only necessary to check p_memsz. 698 */ 699 k = load_addr + eppnt->p_vaddr; 700 if (BAD_ADDR(k) || 701 eppnt->p_filesz > eppnt->p_memsz || 702 eppnt->p_memsz > TASK_SIZE || 703 TASK_SIZE - eppnt->p_memsz < k) { 704 error = -ENOMEM; 705 goto out; 706 } 707 } 708 } 709 710 error = load_addr; 711 out: 712 return error; 713 } 714 715 /* 716 * These are the functions used to load ELF style executables and shared 717 * libraries. There is no binary dependent code anywhere else. 718 */ 719 720 static int parse_elf_property(const char *data, size_t *off, size_t datasz, 721 struct arch_elf_state *arch, 722 bool have_prev_type, u32 *prev_type) 723 { 724 size_t o, step; 725 const struct gnu_property *pr; 726 int ret; 727 728 if (*off == datasz) 729 return -ENOENT; 730 731 if (WARN_ON_ONCE(*off > datasz || *off % ELF_GNU_PROPERTY_ALIGN)) 732 return -EIO; 733 o = *off; 734 datasz -= *off; 735 736 if (datasz < sizeof(*pr)) 737 return -ENOEXEC; 738 pr = (const struct gnu_property *)(data + o); 739 o += sizeof(*pr); 740 datasz -= sizeof(*pr); 741 742 if (pr->pr_datasz > datasz) 743 return -ENOEXEC; 744 745 WARN_ON_ONCE(o % ELF_GNU_PROPERTY_ALIGN); 746 step = round_up(pr->pr_datasz, ELF_GNU_PROPERTY_ALIGN); 747 if (step > datasz) 748 return -ENOEXEC; 749 750 /* Properties are supposed to be unique and sorted on pr_type: */ 751 if (have_prev_type && pr->pr_type <= *prev_type) 752 return -ENOEXEC; 753 *prev_type = pr->pr_type; 754 755 ret = arch_parse_elf_property(pr->pr_type, data + o, 756 pr->pr_datasz, ELF_COMPAT, arch); 757 if (ret) 758 return ret; 759 760 *off = o + step; 761 return 0; 762 } 763 764 #define NOTE_DATA_SZ SZ_1K 765 #define GNU_PROPERTY_TYPE_0_NAME "GNU" 766 #define NOTE_NAME_SZ (sizeof(GNU_PROPERTY_TYPE_0_NAME)) 767 768 static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr, 769 struct arch_elf_state *arch) 770 { 771 union { 772 struct elf_note nhdr; 773 char data[NOTE_DATA_SZ]; 774 } note; 775 loff_t pos; 776 ssize_t n; 777 size_t off, datasz; 778 int ret; 779 bool have_prev_type; 780 u32 prev_type; 781 782 if (!IS_ENABLED(CONFIG_ARCH_USE_GNU_PROPERTY) || !phdr) 783 return 0; 784 785 /* load_elf_binary() shouldn't call us unless this is true... */ 786 if (WARN_ON_ONCE(phdr->p_type != PT_GNU_PROPERTY)) 787 return -ENOEXEC; 788 789 /* If the properties are crazy large, that's too bad (for now): */ 790 if (phdr->p_filesz > sizeof(note)) 791 return -ENOEXEC; 792 793 pos = phdr->p_offset; 794 n = kernel_read(f, ¬e, phdr->p_filesz, &pos); 795 796 BUILD_BUG_ON(sizeof(note) < sizeof(note.nhdr) + NOTE_NAME_SZ); 797 if (n < 0 || n < sizeof(note.nhdr) + NOTE_NAME_SZ) 798 return -EIO; 799 800 if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 || 801 note.nhdr.n_namesz != NOTE_NAME_SZ || 802 strncmp(note.data + sizeof(note.nhdr), 803 GNU_PROPERTY_TYPE_0_NAME, n - sizeof(note.nhdr))) 804 return -ENOEXEC; 805 806 off = round_up(sizeof(note.nhdr) + NOTE_NAME_SZ, 807 ELF_GNU_PROPERTY_ALIGN); 808 if (off > n) 809 return -ENOEXEC; 810 811 if (note.nhdr.n_descsz > n - off) 812 return -ENOEXEC; 813 datasz = off + note.nhdr.n_descsz; 814 815 have_prev_type = false; 816 do { 817 ret = parse_elf_property(note.data, &off, datasz, arch, 818 have_prev_type, &prev_type); 819 have_prev_type = true; 820 } while (!ret); 821 822 return ret == -ENOENT ? 0 : ret; 823 } 824 825 static int load_elf_binary(struct linux_binprm *bprm) 826 { 827 struct file *interpreter = NULL; /* to shut gcc up */ 828 unsigned long load_bias = 0, phdr_addr = 0; 829 int first_pt_load = 1; 830 unsigned long error; 831 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; 832 struct elf_phdr *elf_property_phdata = NULL; 833 unsigned long elf_brk; 834 int retval, i; 835 unsigned long elf_entry; 836 unsigned long e_entry; 837 unsigned long interp_load_addr = 0; 838 unsigned long start_code, end_code, start_data, end_data; 839 unsigned long reloc_func_desc __maybe_unused = 0; 840 int executable_stack = EXSTACK_DEFAULT; 841 struct elfhdr *elf_ex = (struct elfhdr *)bprm->buf; 842 struct elfhdr *interp_elf_ex = NULL; 843 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE; 844 struct mm_struct *mm; 845 struct pt_regs *regs; 846 847 retval = -ENOEXEC; 848 /* First of all, some simple consistency checks */ 849 if (memcmp(elf_ex->e_ident, ELFMAG, SELFMAG) != 0) 850 goto out; 851 852 if (elf_ex->e_type != ET_EXEC && elf_ex->e_type != ET_DYN) 853 goto out; 854 if (!elf_check_arch(elf_ex)) 855 goto out; 856 if (elf_check_fdpic(elf_ex)) 857 goto out; 858 if (!bprm->file->f_op->mmap) 859 goto out; 860 861 elf_phdata = load_elf_phdrs(elf_ex, bprm->file); 862 if (!elf_phdata) 863 goto out; 864 865 elf_ppnt = elf_phdata; 866 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) { 867 char *elf_interpreter; 868 869 if (elf_ppnt->p_type == PT_GNU_PROPERTY) { 870 elf_property_phdata = elf_ppnt; 871 continue; 872 } 873 874 if (elf_ppnt->p_type != PT_INTERP) 875 continue; 876 877 /* 878 * This is the program interpreter used for shared libraries - 879 * for now assume that this is an a.out format binary. 880 */ 881 retval = -ENOEXEC; 882 if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2) 883 goto out_free_ph; 884 885 retval = -ENOMEM; 886 elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL); 887 if (!elf_interpreter) 888 goto out_free_ph; 889 890 retval = elf_read(bprm->file, elf_interpreter, elf_ppnt->p_filesz, 891 elf_ppnt->p_offset); 892 if (retval < 0) 893 goto out_free_interp; 894 /* make sure path is NULL terminated */ 895 retval = -ENOEXEC; 896 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') 897 goto out_free_interp; 898 899 interpreter = open_exec(elf_interpreter); 900 kfree(elf_interpreter); 901 retval = PTR_ERR(interpreter); 902 if (IS_ERR(interpreter)) 903 goto out_free_ph; 904 905 /* 906 * If the binary is not readable then enforce mm->dumpable = 0 907 * regardless of the interpreter's permissions. 908 */ 909 would_dump(bprm, interpreter); 910 911 interp_elf_ex = kmalloc(sizeof(*interp_elf_ex), GFP_KERNEL); 912 if (!interp_elf_ex) { 913 retval = -ENOMEM; 914 goto out_free_file; 915 } 916 917 /* Get the exec headers */ 918 retval = elf_read(interpreter, interp_elf_ex, 919 sizeof(*interp_elf_ex), 0); 920 if (retval < 0) 921 goto out_free_dentry; 922 923 break; 924 925 out_free_interp: 926 kfree(elf_interpreter); 927 goto out_free_ph; 928 } 929 930 elf_ppnt = elf_phdata; 931 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) 932 switch (elf_ppnt->p_type) { 933 case PT_GNU_STACK: 934 if (elf_ppnt->p_flags & PF_X) 935 executable_stack = EXSTACK_ENABLE_X; 936 else 937 executable_stack = EXSTACK_DISABLE_X; 938 break; 939 940 case PT_LOPROC ... PT_HIPROC: 941 retval = arch_elf_pt_proc(elf_ex, elf_ppnt, 942 bprm->file, false, 943 &arch_state); 944 if (retval) 945 goto out_free_dentry; 946 break; 947 } 948 949 /* Some simple consistency checks for the interpreter */ 950 if (interpreter) { 951 retval = -ELIBBAD; 952 /* Not an ELF interpreter */ 953 if (memcmp(interp_elf_ex->e_ident, ELFMAG, SELFMAG) != 0) 954 goto out_free_dentry; 955 /* Verify the interpreter has a valid arch */ 956 if (!elf_check_arch(interp_elf_ex) || 957 elf_check_fdpic(interp_elf_ex)) 958 goto out_free_dentry; 959 960 /* Load the interpreter program headers */ 961 interp_elf_phdata = load_elf_phdrs(interp_elf_ex, 962 interpreter); 963 if (!interp_elf_phdata) 964 goto out_free_dentry; 965 966 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ 967 elf_property_phdata = NULL; 968 elf_ppnt = interp_elf_phdata; 969 for (i = 0; i < interp_elf_ex->e_phnum; i++, elf_ppnt++) 970 switch (elf_ppnt->p_type) { 971 case PT_GNU_PROPERTY: 972 elf_property_phdata = elf_ppnt; 973 break; 974 975 case PT_LOPROC ... PT_HIPROC: 976 retval = arch_elf_pt_proc(interp_elf_ex, 977 elf_ppnt, interpreter, 978 true, &arch_state); 979 if (retval) 980 goto out_free_dentry; 981 break; 982 } 983 } 984 985 retval = parse_elf_properties(interpreter ?: bprm->file, 986 elf_property_phdata, &arch_state); 987 if (retval) 988 goto out_free_dentry; 989 990 /* 991 * Allow arch code to reject the ELF at this point, whilst it's 992 * still possible to return an error to the code that invoked 993 * the exec syscall. 994 */ 995 retval = arch_check_elf(elf_ex, 996 !!interpreter, interp_elf_ex, 997 &arch_state); 998 if (retval) 999 goto out_free_dentry; 1000 1001 /* Flush all traces of the currently running executable */ 1002 retval = begin_new_exec(bprm); 1003 if (retval) 1004 goto out_free_dentry; 1005 1006 /* Do this immediately, since STACK_TOP as used in setup_arg_pages 1007 may depend on the personality. */ 1008 SET_PERSONALITY2(*elf_ex, &arch_state); 1009 if (elf_read_implies_exec(*elf_ex, executable_stack)) 1010 current->personality |= READ_IMPLIES_EXEC; 1011 1012 const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space); 1013 if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space) 1014 current->flags |= PF_RANDOMIZE; 1015 1016 setup_new_exec(bprm); 1017 1018 /* Do this so that we can load the interpreter, if need be. We will 1019 change some of these later */ 1020 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), 1021 executable_stack); 1022 if (retval < 0) 1023 goto out_free_dentry; 1024 1025 elf_brk = 0; 1026 1027 start_code = ~0UL; 1028 end_code = 0; 1029 start_data = 0; 1030 end_data = 0; 1031 1032 /* Now we do a little grungy work by mmapping the ELF image into 1033 the correct location in memory. */ 1034 for(i = 0, elf_ppnt = elf_phdata; 1035 i < elf_ex->e_phnum; i++, elf_ppnt++) { 1036 int elf_prot, elf_flags; 1037 unsigned long k, vaddr; 1038 unsigned long total_size = 0; 1039 unsigned long alignment; 1040 1041 if (elf_ppnt->p_type != PT_LOAD) 1042 continue; 1043 1044 elf_prot = make_prot(elf_ppnt->p_flags, &arch_state, 1045 !!interpreter, false); 1046 1047 elf_flags = MAP_PRIVATE; 1048 1049 vaddr = elf_ppnt->p_vaddr; 1050 /* 1051 * The first time through the loop, first_pt_load is true: 1052 * layout will be calculated. Once set, use MAP_FIXED since 1053 * we know we've already safely mapped the entire region with 1054 * MAP_FIXED_NOREPLACE in the once-per-binary logic following. 1055 */ 1056 if (!first_pt_load) { 1057 elf_flags |= MAP_FIXED; 1058 } else if (elf_ex->e_type == ET_EXEC) { 1059 /* 1060 * This logic is run once for the first LOAD Program 1061 * Header for ET_EXEC binaries. No special handling 1062 * is needed. 1063 */ 1064 elf_flags |= MAP_FIXED_NOREPLACE; 1065 } else if (elf_ex->e_type == ET_DYN) { 1066 /* 1067 * This logic is run once for the first LOAD Program 1068 * Header for ET_DYN binaries to calculate the 1069 * randomization (load_bias) for all the LOAD 1070 * Program Headers. 1071 */ 1072 1073 /* 1074 * Calculate the entire size of the ELF mapping 1075 * (total_size), used for the initial mapping, 1076 * due to load_addr_set which is set to true later 1077 * once the initial mapping is performed. 1078 * 1079 * Note that this is only sensible when the LOAD 1080 * segments are contiguous (or overlapping). If 1081 * used for LOADs that are far apart, this would 1082 * cause the holes between LOADs to be mapped, 1083 * running the risk of having the mapping fail, 1084 * as it would be larger than the ELF file itself. 1085 * 1086 * As a result, only ET_DYN does this, since 1087 * some ET_EXEC (e.g. ia64) may have large virtual 1088 * memory holes between LOADs. 1089 * 1090 */ 1091 total_size = total_mapping_size(elf_phdata, 1092 elf_ex->e_phnum); 1093 if (!total_size) { 1094 retval = -EINVAL; 1095 goto out_free_dentry; 1096 } 1097 1098 /* Calculate any requested alignment. */ 1099 alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum); 1100 1101 /* 1102 * There are effectively two types of ET_DYN 1103 * binaries: programs (i.e. PIE: ET_DYN with PT_INTERP) 1104 * and loaders (ET_DYN without PT_INTERP, since they 1105 * _are_ the ELF interpreter). The loaders must 1106 * be loaded away from programs since the program 1107 * may otherwise collide with the loader (especially 1108 * for ET_EXEC which does not have a randomized 1109 * position). For example to handle invocations of 1110 * "./ld.so someprog" to test out a new version of 1111 * the loader, the subsequent program that the 1112 * loader loads must avoid the loader itself, so 1113 * they cannot share the same load range. Sufficient 1114 * room for the brk must be allocated with the 1115 * loader as well, since brk must be available with 1116 * the loader. 1117 * 1118 * Therefore, programs are loaded offset from 1119 * ELF_ET_DYN_BASE and loaders are loaded into the 1120 * independently randomized mmap region (0 load_bias 1121 * without MAP_FIXED nor MAP_FIXED_NOREPLACE). 1122 */ 1123 if (interpreter) { 1124 /* On ET_DYN with PT_INTERP, we do the ASLR. */ 1125 load_bias = ELF_ET_DYN_BASE; 1126 if (current->flags & PF_RANDOMIZE) 1127 load_bias += arch_mmap_rnd(); 1128 /* Adjust alignment as requested. */ 1129 if (alignment) 1130 load_bias &= ~(alignment - 1); 1131 elf_flags |= MAP_FIXED_NOREPLACE; 1132 } else { 1133 /* 1134 * For ET_DYN without PT_INTERP, we rely on 1135 * the architectures's (potentially ASLR) mmap 1136 * base address (via a load_bias of 0). 1137 * 1138 * When a large alignment is requested, we 1139 * must do the allocation at address "0" right 1140 * now to discover where things will load so 1141 * that we can adjust the resulting alignment. 1142 * In this case (load_bias != 0), we can use 1143 * MAP_FIXED_NOREPLACE to make sure the mapping 1144 * doesn't collide with anything. 1145 */ 1146 if (alignment > ELF_MIN_ALIGN) { 1147 load_bias = elf_load(bprm->file, 0, elf_ppnt, 1148 elf_prot, elf_flags, total_size); 1149 if (BAD_ADDR(load_bias)) { 1150 retval = IS_ERR_VALUE(load_bias) ? 1151 PTR_ERR((void*)load_bias) : -EINVAL; 1152 goto out_free_dentry; 1153 } 1154 vm_munmap(load_bias, total_size); 1155 /* Adjust alignment as requested. */ 1156 if (alignment) 1157 load_bias &= ~(alignment - 1); 1158 elf_flags |= MAP_FIXED_NOREPLACE; 1159 } else 1160 load_bias = 0; 1161 } 1162 1163 /* 1164 * Since load_bias is used for all subsequent loading 1165 * calculations, we must lower it by the first vaddr 1166 * so that the remaining calculations based on the 1167 * ELF vaddrs will be correctly offset. The result 1168 * is then page aligned. 1169 */ 1170 load_bias = ELF_PAGESTART(load_bias - vaddr); 1171 } 1172 1173 error = elf_load(bprm->file, load_bias + vaddr, elf_ppnt, 1174 elf_prot, elf_flags, total_size); 1175 if (BAD_ADDR(error)) { 1176 retval = IS_ERR_VALUE(error) ? 1177 PTR_ERR((void*)error) : -EINVAL; 1178 goto out_free_dentry; 1179 } 1180 1181 if (first_pt_load) { 1182 first_pt_load = 0; 1183 if (elf_ex->e_type == ET_DYN) { 1184 load_bias += error - 1185 ELF_PAGESTART(load_bias + vaddr); 1186 reloc_func_desc = load_bias; 1187 } 1188 } 1189 1190 /* 1191 * Figure out which segment in the file contains the Program 1192 * Header table, and map to the associated memory address. 1193 */ 1194 if (elf_ppnt->p_offset <= elf_ex->e_phoff && 1195 elf_ex->e_phoff < elf_ppnt->p_offset + elf_ppnt->p_filesz) { 1196 phdr_addr = elf_ex->e_phoff - elf_ppnt->p_offset + 1197 elf_ppnt->p_vaddr; 1198 } 1199 1200 k = elf_ppnt->p_vaddr; 1201 if ((elf_ppnt->p_flags & PF_X) && k < start_code) 1202 start_code = k; 1203 if (start_data < k) 1204 start_data = k; 1205 1206 /* 1207 * Check to see if the section's size will overflow the 1208 * allowed task size. Note that p_filesz must always be 1209 * <= p_memsz so it is only necessary to check p_memsz. 1210 */ 1211 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || 1212 elf_ppnt->p_memsz > TASK_SIZE || 1213 TASK_SIZE - elf_ppnt->p_memsz < k) { 1214 /* set_brk can never work. Avoid overflows. */ 1215 retval = -EINVAL; 1216 goto out_free_dentry; 1217 } 1218 1219 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz; 1220 1221 if ((elf_ppnt->p_flags & PF_X) && end_code < k) 1222 end_code = k; 1223 if (end_data < k) 1224 end_data = k; 1225 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; 1226 if (k > elf_brk) 1227 elf_brk = k; 1228 } 1229 1230 e_entry = elf_ex->e_entry + load_bias; 1231 phdr_addr += load_bias; 1232 elf_brk += load_bias; 1233 start_code += load_bias; 1234 end_code += load_bias; 1235 start_data += load_bias; 1236 end_data += load_bias; 1237 1238 current->mm->start_brk = current->mm->brk = ELF_PAGEALIGN(elf_brk); 1239 1240 if (interpreter) { 1241 elf_entry = load_elf_interp(interp_elf_ex, 1242 interpreter, 1243 load_bias, interp_elf_phdata, 1244 &arch_state); 1245 if (!IS_ERR_VALUE(elf_entry)) { 1246 /* 1247 * load_elf_interp() returns relocation 1248 * adjustment 1249 */ 1250 interp_load_addr = elf_entry; 1251 elf_entry += interp_elf_ex->e_entry; 1252 } 1253 if (BAD_ADDR(elf_entry)) { 1254 retval = IS_ERR_VALUE(elf_entry) ? 1255 (int)elf_entry : -EINVAL; 1256 goto out_free_dentry; 1257 } 1258 reloc_func_desc = interp_load_addr; 1259 1260 allow_write_access(interpreter); 1261 fput(interpreter); 1262 1263 kfree(interp_elf_ex); 1264 kfree(interp_elf_phdata); 1265 } else { 1266 elf_entry = e_entry; 1267 if (BAD_ADDR(elf_entry)) { 1268 retval = -EINVAL; 1269 goto out_free_dentry; 1270 } 1271 } 1272 1273 kfree(elf_phdata); 1274 1275 set_binfmt(&elf_format); 1276 1277 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES 1278 retval = ARCH_SETUP_ADDITIONAL_PAGES(bprm, elf_ex, !!interpreter); 1279 if (retval < 0) 1280 goto out; 1281 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ 1282 1283 retval = create_elf_tables(bprm, elf_ex, interp_load_addr, 1284 e_entry, phdr_addr); 1285 if (retval < 0) 1286 goto out; 1287 1288 mm = current->mm; 1289 mm->end_code = end_code; 1290 mm->start_code = start_code; 1291 mm->start_data = start_data; 1292 mm->end_data = end_data; 1293 mm->start_stack = bprm->p; 1294 1295 if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) { 1296 /* 1297 * For architectures with ELF randomization, when executing 1298 * a loader directly (i.e. no interpreter listed in ELF 1299 * headers), move the brk area out of the mmap region 1300 * (since it grows up, and may collide early with the stack 1301 * growing down), and into the unused ELF_ET_DYN_BASE region. 1302 */ 1303 if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && 1304 elf_ex->e_type == ET_DYN && !interpreter) { 1305 mm->brk = mm->start_brk = ELF_ET_DYN_BASE; 1306 } else { 1307 /* Otherwise leave a gap between .bss and brk. */ 1308 mm->brk = mm->start_brk = mm->brk + PAGE_SIZE; 1309 } 1310 1311 mm->brk = mm->start_brk = arch_randomize_brk(mm); 1312 #ifdef compat_brk_randomized 1313 current->brk_randomized = 1; 1314 #endif 1315 } 1316 1317 if (current->personality & MMAP_PAGE_ZERO) { 1318 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 1319 and some applications "depend" upon this behavior. 1320 Since we do not have the power to recompile these, we 1321 emulate the SVr4 behavior. Sigh. */ 1322 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, 1323 MAP_FIXED | MAP_PRIVATE, 0); 1324 1325 retval = do_mseal(0, PAGE_SIZE, 0); 1326 if (retval) 1327 pr_warn_ratelimited("pid=%d, couldn't seal address 0, ret=%d.\n", 1328 task_pid_nr(current), retval); 1329 } 1330 1331 regs = current_pt_regs(); 1332 #ifdef ELF_PLAT_INIT 1333 /* 1334 * The ABI may specify that certain registers be set up in special 1335 * ways (on i386 %edx is the address of a DT_FINI function, for 1336 * example. In addition, it may also specify (eg, PowerPC64 ELF) 1337 * that the e_entry field is the address of the function descriptor 1338 * for the startup routine, rather than the address of the startup 1339 * routine itself. This macro performs whatever initialization to 1340 * the regs structure is required as well as any relocations to the 1341 * function descriptor entries when executing dynamically links apps. 1342 */ 1343 ELF_PLAT_INIT(regs, reloc_func_desc); 1344 #endif 1345 1346 finalize_exec(bprm); 1347 START_THREAD(elf_ex, regs, elf_entry, bprm->p); 1348 retval = 0; 1349 out: 1350 return retval; 1351 1352 /* error cleanup */ 1353 out_free_dentry: 1354 kfree(interp_elf_ex); 1355 kfree(interp_elf_phdata); 1356 out_free_file: 1357 allow_write_access(interpreter); 1358 if (interpreter) 1359 fput(interpreter); 1360 out_free_ph: 1361 kfree(elf_phdata); 1362 goto out; 1363 } 1364 1365 #ifdef CONFIG_USELIB 1366 /* This is really simpleminded and specialized - we are loading an 1367 a.out library that is given an ELF header. */ 1368 static int load_elf_library(struct file *file) 1369 { 1370 struct elf_phdr *elf_phdata; 1371 struct elf_phdr *eppnt; 1372 int retval, error, i, j; 1373 struct elfhdr elf_ex; 1374 1375 error = -ENOEXEC; 1376 retval = elf_read(file, &elf_ex, sizeof(elf_ex), 0); 1377 if (retval < 0) 1378 goto out; 1379 1380 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0) 1381 goto out; 1382 1383 /* First of all, some simple consistency checks */ 1384 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 || 1385 !elf_check_arch(&elf_ex) || !file->f_op->mmap) 1386 goto out; 1387 if (elf_check_fdpic(&elf_ex)) 1388 goto out; 1389 1390 /* Now read in all of the header information */ 1391 1392 j = sizeof(struct elf_phdr) * elf_ex.e_phnum; 1393 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */ 1394 1395 error = -ENOMEM; 1396 elf_phdata = kmalloc(j, GFP_KERNEL); 1397 if (!elf_phdata) 1398 goto out; 1399 1400 eppnt = elf_phdata; 1401 error = -ENOEXEC; 1402 retval = elf_read(file, eppnt, j, elf_ex.e_phoff); 1403 if (retval < 0) 1404 goto out_free_ph; 1405 1406 for (j = 0, i = 0; i<elf_ex.e_phnum; i++) 1407 if ((eppnt + i)->p_type == PT_LOAD) 1408 j++; 1409 if (j != 1) 1410 goto out_free_ph; 1411 1412 while (eppnt->p_type != PT_LOAD) 1413 eppnt++; 1414 1415 /* Now use mmap to map the library into memory. */ 1416 error = elf_load(file, ELF_PAGESTART(eppnt->p_vaddr), 1417 eppnt, 1418 PROT_READ | PROT_WRITE | PROT_EXEC, 1419 MAP_FIXED_NOREPLACE | MAP_PRIVATE, 1420 0); 1421 1422 if (error != ELF_PAGESTART(eppnt->p_vaddr)) 1423 goto out_free_ph; 1424 1425 error = 0; 1426 1427 out_free_ph: 1428 kfree(elf_phdata); 1429 out: 1430 return error; 1431 } 1432 #endif /* #ifdef CONFIG_USELIB */ 1433 1434 #ifdef CONFIG_ELF_CORE 1435 /* 1436 * ELF core dumper 1437 * 1438 * Modelled on fs/exec.c:aout_core_dump() 1439 * Jeremy Fitzhardinge <jeremy@sw.oz.au> 1440 */ 1441 1442 /* An ELF note in memory */ 1443 struct memelfnote 1444 { 1445 const char *name; 1446 int type; 1447 unsigned int datasz; 1448 void *data; 1449 }; 1450 1451 static int notesize(struct memelfnote *en) 1452 { 1453 int sz; 1454 1455 sz = sizeof(struct elf_note); 1456 sz += roundup(strlen(en->name) + 1, 4); 1457 sz += roundup(en->datasz, 4); 1458 1459 return sz; 1460 } 1461 1462 static int writenote(struct memelfnote *men, struct coredump_params *cprm) 1463 { 1464 struct elf_note en; 1465 en.n_namesz = strlen(men->name) + 1; 1466 en.n_descsz = men->datasz; 1467 en.n_type = men->type; 1468 1469 return dump_emit(cprm, &en, sizeof(en)) && 1470 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) && 1471 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4); 1472 } 1473 1474 static void fill_elf_header(struct elfhdr *elf, int segs, 1475 u16 machine, u32 flags) 1476 { 1477 memset(elf, 0, sizeof(*elf)); 1478 1479 memcpy(elf->e_ident, ELFMAG, SELFMAG); 1480 elf->e_ident[EI_CLASS] = ELF_CLASS; 1481 elf->e_ident[EI_DATA] = ELF_DATA; 1482 elf->e_ident[EI_VERSION] = EV_CURRENT; 1483 elf->e_ident[EI_OSABI] = ELF_OSABI; 1484 1485 elf->e_type = ET_CORE; 1486 elf->e_machine = machine; 1487 elf->e_version = EV_CURRENT; 1488 elf->e_phoff = sizeof(struct elfhdr); 1489 elf->e_flags = flags; 1490 elf->e_ehsize = sizeof(struct elfhdr); 1491 elf->e_phentsize = sizeof(struct elf_phdr); 1492 elf->e_phnum = segs; 1493 } 1494 1495 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset) 1496 { 1497 phdr->p_type = PT_NOTE; 1498 phdr->p_offset = offset; 1499 phdr->p_vaddr = 0; 1500 phdr->p_paddr = 0; 1501 phdr->p_filesz = sz; 1502 phdr->p_memsz = 0; 1503 phdr->p_flags = 0; 1504 phdr->p_align = 4; 1505 } 1506 1507 static void fill_note(struct memelfnote *note, const char *name, int type, 1508 unsigned int sz, void *data) 1509 { 1510 note->name = name; 1511 note->type = type; 1512 note->datasz = sz; 1513 note->data = data; 1514 } 1515 1516 /* 1517 * fill up all the fields in prstatus from the given task struct, except 1518 * registers which need to be filled up separately. 1519 */ 1520 static void fill_prstatus(struct elf_prstatus_common *prstatus, 1521 struct task_struct *p, long signr) 1522 { 1523 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 1524 prstatus->pr_sigpend = p->pending.signal.sig[0]; 1525 prstatus->pr_sighold = p->blocked.sig[0]; 1526 rcu_read_lock(); 1527 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1528 rcu_read_unlock(); 1529 prstatus->pr_pid = task_pid_vnr(p); 1530 prstatus->pr_pgrp = task_pgrp_vnr(p); 1531 prstatus->pr_sid = task_session_vnr(p); 1532 if (thread_group_leader(p)) { 1533 struct task_cputime cputime; 1534 1535 /* 1536 * This is the record for the group leader. It shows the 1537 * group-wide total, not its individual thread total. 1538 */ 1539 thread_group_cputime(p, &cputime); 1540 prstatus->pr_utime = ns_to_kernel_old_timeval(cputime.utime); 1541 prstatus->pr_stime = ns_to_kernel_old_timeval(cputime.stime); 1542 } else { 1543 u64 utime, stime; 1544 1545 task_cputime(p, &utime, &stime); 1546 prstatus->pr_utime = ns_to_kernel_old_timeval(utime); 1547 prstatus->pr_stime = ns_to_kernel_old_timeval(stime); 1548 } 1549 1550 prstatus->pr_cutime = ns_to_kernel_old_timeval(p->signal->cutime); 1551 prstatus->pr_cstime = ns_to_kernel_old_timeval(p->signal->cstime); 1552 } 1553 1554 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, 1555 struct mm_struct *mm) 1556 { 1557 const struct cred *cred; 1558 unsigned int i, len; 1559 unsigned int state; 1560 1561 /* first copy the parameters from user space */ 1562 memset(psinfo, 0, sizeof(struct elf_prpsinfo)); 1563 1564 len = mm->arg_end - mm->arg_start; 1565 if (len >= ELF_PRARGSZ) 1566 len = ELF_PRARGSZ-1; 1567 if (copy_from_user(&psinfo->pr_psargs, 1568 (const char __user *)mm->arg_start, len)) 1569 return -EFAULT; 1570 for(i = 0; i < len; i++) 1571 if (psinfo->pr_psargs[i] == 0) 1572 psinfo->pr_psargs[i] = ' '; 1573 psinfo->pr_psargs[len] = 0; 1574 1575 rcu_read_lock(); 1576 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); 1577 rcu_read_unlock(); 1578 psinfo->pr_pid = task_pid_vnr(p); 1579 psinfo->pr_pgrp = task_pgrp_vnr(p); 1580 psinfo->pr_sid = task_session_vnr(p); 1581 1582 state = READ_ONCE(p->__state); 1583 i = state ? ffz(~state) + 1 : 0; 1584 psinfo->pr_state = i; 1585 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i]; 1586 psinfo->pr_zomb = psinfo->pr_sname == 'Z'; 1587 psinfo->pr_nice = task_nice(p); 1588 psinfo->pr_flag = p->flags; 1589 rcu_read_lock(); 1590 cred = __task_cred(p); 1591 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid)); 1592 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid)); 1593 rcu_read_unlock(); 1594 get_task_comm(psinfo->pr_fname, p); 1595 1596 return 0; 1597 } 1598 1599 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) 1600 { 1601 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; 1602 int i = 0; 1603 do 1604 i += 2; 1605 while (auxv[i - 2] != AT_NULL); 1606 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); 1607 } 1608 1609 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata, 1610 const kernel_siginfo_t *siginfo) 1611 { 1612 copy_siginfo_to_external(csigdata, siginfo); 1613 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata); 1614 } 1615 1616 /* 1617 * Format of NT_FILE note: 1618 * 1619 * long count -- how many files are mapped 1620 * long page_size -- units for file_ofs 1621 * array of [COUNT] elements of 1622 * long start 1623 * long end 1624 * long file_ofs 1625 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL... 1626 */ 1627 static int fill_files_note(struct memelfnote *note, struct coredump_params *cprm) 1628 { 1629 unsigned count, size, names_ofs, remaining, n; 1630 user_long_t *data; 1631 user_long_t *start_end_ofs; 1632 char *name_base, *name_curpos; 1633 int i; 1634 1635 /* *Estimated* file count and total data size needed */ 1636 count = cprm->vma_count; 1637 if (count > UINT_MAX / 64) 1638 return -EINVAL; 1639 size = count * 64; 1640 1641 names_ofs = (2 + 3 * count) * sizeof(data[0]); 1642 alloc: 1643 /* paranoia check */ 1644 if (size >= core_file_note_size_limit) { 1645 pr_warn_once("coredump Note size too large: %u (does kernel.core_file_note_size_limit sysctl need adjustment?\n", 1646 size); 1647 return -EINVAL; 1648 } 1649 size = round_up(size, PAGE_SIZE); 1650 /* 1651 * "size" can be 0 here legitimately. 1652 * Let it ENOMEM and omit NT_FILE section which will be empty anyway. 1653 */ 1654 data = kvmalloc(size, GFP_KERNEL); 1655 if (ZERO_OR_NULL_PTR(data)) 1656 return -ENOMEM; 1657 1658 start_end_ofs = data + 2; 1659 name_base = name_curpos = ((char *)data) + names_ofs; 1660 remaining = size - names_ofs; 1661 count = 0; 1662 for (i = 0; i < cprm->vma_count; i++) { 1663 struct core_vma_metadata *m = &cprm->vma_meta[i]; 1664 struct file *file; 1665 const char *filename; 1666 1667 file = m->file; 1668 if (!file) 1669 continue; 1670 filename = file_path(file, name_curpos, remaining); 1671 if (IS_ERR(filename)) { 1672 if (PTR_ERR(filename) == -ENAMETOOLONG) { 1673 kvfree(data); 1674 size = size * 5 / 4; 1675 goto alloc; 1676 } 1677 continue; 1678 } 1679 1680 /* file_path() fills at the end, move name down */ 1681 /* n = strlen(filename) + 1: */ 1682 n = (name_curpos + remaining) - filename; 1683 remaining = filename - name_curpos; 1684 memmove(name_curpos, filename, n); 1685 name_curpos += n; 1686 1687 *start_end_ofs++ = m->start; 1688 *start_end_ofs++ = m->end; 1689 *start_end_ofs++ = m->pgoff; 1690 count++; 1691 } 1692 1693 /* Now we know exact count of files, can store it */ 1694 data[0] = count; 1695 data[1] = PAGE_SIZE; 1696 /* 1697 * Count usually is less than mm->map_count, 1698 * we need to move filenames down. 1699 */ 1700 n = cprm->vma_count - count; 1701 if (n != 0) { 1702 unsigned shift_bytes = n * 3 * sizeof(data[0]); 1703 memmove(name_base - shift_bytes, name_base, 1704 name_curpos - name_base); 1705 name_curpos -= shift_bytes; 1706 } 1707 1708 size = name_curpos - (char *)data; 1709 fill_note(note, "CORE", NT_FILE, size, data); 1710 return 0; 1711 } 1712 1713 #include <linux/regset.h> 1714 1715 struct elf_thread_core_info { 1716 struct elf_thread_core_info *next; 1717 struct task_struct *task; 1718 struct elf_prstatus prstatus; 1719 struct memelfnote notes[]; 1720 }; 1721 1722 struct elf_note_info { 1723 struct elf_thread_core_info *thread; 1724 struct memelfnote psinfo; 1725 struct memelfnote signote; 1726 struct memelfnote auxv; 1727 struct memelfnote files; 1728 user_siginfo_t csigdata; 1729 size_t size; 1730 int thread_notes; 1731 }; 1732 1733 #ifdef CORE_DUMP_USE_REGSET 1734 /* 1735 * When a regset has a writeback hook, we call it on each thread before 1736 * dumping user memory. On register window machines, this makes sure the 1737 * user memory backing the register data is up to date before we read it. 1738 */ 1739 static void do_thread_regset_writeback(struct task_struct *task, 1740 const struct user_regset *regset) 1741 { 1742 if (regset->writeback) 1743 regset->writeback(task, regset, 1); 1744 } 1745 1746 #ifndef PRSTATUS_SIZE 1747 #define PRSTATUS_SIZE sizeof(struct elf_prstatus) 1748 #endif 1749 1750 #ifndef SET_PR_FPVALID 1751 #define SET_PR_FPVALID(S) ((S)->pr_fpvalid = 1) 1752 #endif 1753 1754 static int fill_thread_core_info(struct elf_thread_core_info *t, 1755 const struct user_regset_view *view, 1756 long signr, struct elf_note_info *info) 1757 { 1758 unsigned int note_iter, view_iter; 1759 1760 /* 1761 * NT_PRSTATUS is the one special case, because the regset data 1762 * goes into the pr_reg field inside the note contents, rather 1763 * than being the whole note contents. We fill the regset in here. 1764 * We assume that regset 0 is NT_PRSTATUS. 1765 */ 1766 fill_prstatus(&t->prstatus.common, t->task, signr); 1767 regset_get(t->task, &view->regsets[0], 1768 sizeof(t->prstatus.pr_reg), &t->prstatus.pr_reg); 1769 1770 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, 1771 PRSTATUS_SIZE, &t->prstatus); 1772 info->size += notesize(&t->notes[0]); 1773 1774 do_thread_regset_writeback(t->task, &view->regsets[0]); 1775 1776 /* 1777 * Each other regset might generate a note too. For each regset 1778 * that has no core_note_type or is inactive, skip it. 1779 */ 1780 note_iter = 1; 1781 for (view_iter = 1; view_iter < view->n; ++view_iter) { 1782 const struct user_regset *regset = &view->regsets[view_iter]; 1783 int note_type = regset->core_note_type; 1784 bool is_fpreg = note_type == NT_PRFPREG; 1785 void *data; 1786 int ret; 1787 1788 do_thread_regset_writeback(t->task, regset); 1789 if (!note_type) // not for coredumps 1790 continue; 1791 if (regset->active && regset->active(t->task, regset) <= 0) 1792 continue; 1793 1794 ret = regset_get_alloc(t->task, regset, ~0U, &data); 1795 if (ret < 0) 1796 continue; 1797 1798 if (WARN_ON_ONCE(note_iter >= info->thread_notes)) 1799 break; 1800 1801 if (is_fpreg) 1802 SET_PR_FPVALID(&t->prstatus); 1803 1804 fill_note(&t->notes[note_iter], is_fpreg ? "CORE" : "LINUX", 1805 note_type, ret, data); 1806 1807 info->size += notesize(&t->notes[note_iter]); 1808 note_iter++; 1809 } 1810 1811 return 1; 1812 } 1813 #else 1814 static int fill_thread_core_info(struct elf_thread_core_info *t, 1815 const struct user_regset_view *view, 1816 long signr, struct elf_note_info *info) 1817 { 1818 struct task_struct *p = t->task; 1819 elf_fpregset_t *fpu; 1820 1821 fill_prstatus(&t->prstatus.common, p, signr); 1822 elf_core_copy_task_regs(p, &t->prstatus.pr_reg); 1823 1824 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), 1825 &(t->prstatus)); 1826 info->size += notesize(&t->notes[0]); 1827 1828 fpu = kzalloc(sizeof(elf_fpregset_t), GFP_KERNEL); 1829 if (!fpu || !elf_core_copy_task_fpregs(p, fpu)) { 1830 kfree(fpu); 1831 return 1; 1832 } 1833 1834 t->prstatus.pr_fpvalid = 1; 1835 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(*fpu), fpu); 1836 info->size += notesize(&t->notes[1]); 1837 1838 return 1; 1839 } 1840 #endif 1841 1842 static int fill_note_info(struct elfhdr *elf, int phdrs, 1843 struct elf_note_info *info, 1844 struct coredump_params *cprm) 1845 { 1846 struct task_struct *dump_task = current; 1847 const struct user_regset_view *view; 1848 struct elf_thread_core_info *t; 1849 struct elf_prpsinfo *psinfo; 1850 struct core_thread *ct; 1851 1852 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); 1853 if (!psinfo) 1854 return 0; 1855 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); 1856 1857 #ifdef CORE_DUMP_USE_REGSET 1858 view = task_user_regset_view(dump_task); 1859 1860 /* 1861 * Figure out how many notes we're going to need for each thread. 1862 */ 1863 info->thread_notes = 0; 1864 for (int i = 0; i < view->n; ++i) 1865 if (view->regsets[i].core_note_type != 0) 1866 ++info->thread_notes; 1867 1868 /* 1869 * Sanity check. We rely on regset 0 being in NT_PRSTATUS, 1870 * since it is our one special case. 1871 */ 1872 if (unlikely(info->thread_notes == 0) || 1873 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) { 1874 WARN_ON(1); 1875 return 0; 1876 } 1877 1878 /* 1879 * Initialize the ELF file header. 1880 */ 1881 fill_elf_header(elf, phdrs, 1882 view->e_machine, view->e_flags); 1883 #else 1884 view = NULL; 1885 info->thread_notes = 2; 1886 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS); 1887 #endif 1888 1889 /* 1890 * Allocate a structure for each thread. 1891 */ 1892 info->thread = kzalloc(offsetof(struct elf_thread_core_info, 1893 notes[info->thread_notes]), 1894 GFP_KERNEL); 1895 if (unlikely(!info->thread)) 1896 return 0; 1897 1898 info->thread->task = dump_task; 1899 for (ct = dump_task->signal->core_state->dumper.next; ct; ct = ct->next) { 1900 t = kzalloc(offsetof(struct elf_thread_core_info, 1901 notes[info->thread_notes]), 1902 GFP_KERNEL); 1903 if (unlikely(!t)) 1904 return 0; 1905 1906 t->task = ct->task; 1907 t->next = info->thread->next; 1908 info->thread->next = t; 1909 } 1910 1911 /* 1912 * Now fill in each thread's information. 1913 */ 1914 for (t = info->thread; t != NULL; t = t->next) 1915 if (!fill_thread_core_info(t, view, cprm->siginfo->si_signo, info)) 1916 return 0; 1917 1918 /* 1919 * Fill in the two process-wide notes. 1920 */ 1921 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm); 1922 info->size += notesize(&info->psinfo); 1923 1924 fill_siginfo_note(&info->signote, &info->csigdata, cprm->siginfo); 1925 info->size += notesize(&info->signote); 1926 1927 fill_auxv_note(&info->auxv, current->mm); 1928 info->size += notesize(&info->auxv); 1929 1930 if (fill_files_note(&info->files, cprm) == 0) 1931 info->size += notesize(&info->files); 1932 1933 return 1; 1934 } 1935 1936 /* 1937 * Write all the notes for each thread. When writing the first thread, the 1938 * process-wide notes are interleaved after the first thread-specific note. 1939 */ 1940 static int write_note_info(struct elf_note_info *info, 1941 struct coredump_params *cprm) 1942 { 1943 bool first = true; 1944 struct elf_thread_core_info *t = info->thread; 1945 1946 do { 1947 int i; 1948 1949 if (!writenote(&t->notes[0], cprm)) 1950 return 0; 1951 1952 if (first && !writenote(&info->psinfo, cprm)) 1953 return 0; 1954 if (first && !writenote(&info->signote, cprm)) 1955 return 0; 1956 if (first && !writenote(&info->auxv, cprm)) 1957 return 0; 1958 if (first && info->files.data && 1959 !writenote(&info->files, cprm)) 1960 return 0; 1961 1962 for (i = 1; i < info->thread_notes; ++i) 1963 if (t->notes[i].data && 1964 !writenote(&t->notes[i], cprm)) 1965 return 0; 1966 1967 first = false; 1968 t = t->next; 1969 } while (t); 1970 1971 return 1; 1972 } 1973 1974 static void free_note_info(struct elf_note_info *info) 1975 { 1976 struct elf_thread_core_info *threads = info->thread; 1977 while (threads) { 1978 unsigned int i; 1979 struct elf_thread_core_info *t = threads; 1980 threads = t->next; 1981 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus); 1982 for (i = 1; i < info->thread_notes; ++i) 1983 kvfree(t->notes[i].data); 1984 kfree(t); 1985 } 1986 kfree(info->psinfo.data); 1987 kvfree(info->files.data); 1988 } 1989 1990 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, 1991 elf_addr_t e_shoff, int segs) 1992 { 1993 elf->e_shoff = e_shoff; 1994 elf->e_shentsize = sizeof(*shdr4extnum); 1995 elf->e_shnum = 1; 1996 elf->e_shstrndx = SHN_UNDEF; 1997 1998 memset(shdr4extnum, 0, sizeof(*shdr4extnum)); 1999 2000 shdr4extnum->sh_type = SHT_NULL; 2001 shdr4extnum->sh_size = elf->e_shnum; 2002 shdr4extnum->sh_link = elf->e_shstrndx; 2003 shdr4extnum->sh_info = segs; 2004 } 2005 2006 /* 2007 * Actual dumper 2008 * 2009 * This is a two-pass process; first we find the offsets of the bits, 2010 * and then they are actually written out. If we run out of core limit 2011 * we just truncate. 2012 */ 2013 static int elf_core_dump(struct coredump_params *cprm) 2014 { 2015 int has_dumped = 0; 2016 int segs, i; 2017 struct elfhdr elf; 2018 loff_t offset = 0, dataoff; 2019 struct elf_note_info info = { }; 2020 struct elf_phdr *phdr4note = NULL; 2021 struct elf_shdr *shdr4extnum = NULL; 2022 Elf_Half e_phnum; 2023 elf_addr_t e_shoff; 2024 2025 /* 2026 * The number of segs are recored into ELF header as 16bit value. 2027 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here. 2028 */ 2029 segs = cprm->vma_count + elf_core_extra_phdrs(cprm); 2030 2031 /* for notes section */ 2032 segs++; 2033 2034 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid 2035 * this, kernel supports extended numbering. Have a look at 2036 * include/linux/elf.h for further information. */ 2037 e_phnum = segs > PN_XNUM ? PN_XNUM : segs; 2038 2039 /* 2040 * Collect all the non-memory information about the process for the 2041 * notes. This also sets up the file header. 2042 */ 2043 if (!fill_note_info(&elf, e_phnum, &info, cprm)) 2044 goto end_coredump; 2045 2046 has_dumped = 1; 2047 2048 offset += sizeof(elf); /* ELF header */ 2049 offset += segs * sizeof(struct elf_phdr); /* Program headers */ 2050 2051 /* Write notes phdr entry */ 2052 { 2053 size_t sz = info.size; 2054 2055 /* For cell spufs and x86 xstate */ 2056 sz += elf_coredump_extra_notes_size(); 2057 2058 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL); 2059 if (!phdr4note) 2060 goto end_coredump; 2061 2062 fill_elf_note_phdr(phdr4note, sz, offset); 2063 offset += sz; 2064 } 2065 2066 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); 2067 2068 offset += cprm->vma_data_size; 2069 offset += elf_core_extra_data_size(cprm); 2070 e_shoff = offset; 2071 2072 if (e_phnum == PN_XNUM) { 2073 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL); 2074 if (!shdr4extnum) 2075 goto end_coredump; 2076 fill_extnum_info(&elf, shdr4extnum, e_shoff, segs); 2077 } 2078 2079 offset = dataoff; 2080 2081 if (!dump_emit(cprm, &elf, sizeof(elf))) 2082 goto end_coredump; 2083 2084 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note))) 2085 goto end_coredump; 2086 2087 /* Write program headers for segments dump */ 2088 for (i = 0; i < cprm->vma_count; i++) { 2089 struct core_vma_metadata *meta = cprm->vma_meta + i; 2090 struct elf_phdr phdr; 2091 2092 phdr.p_type = PT_LOAD; 2093 phdr.p_offset = offset; 2094 phdr.p_vaddr = meta->start; 2095 phdr.p_paddr = 0; 2096 phdr.p_filesz = meta->dump_size; 2097 phdr.p_memsz = meta->end - meta->start; 2098 offset += phdr.p_filesz; 2099 phdr.p_flags = 0; 2100 if (meta->flags & VM_READ) 2101 phdr.p_flags |= PF_R; 2102 if (meta->flags & VM_WRITE) 2103 phdr.p_flags |= PF_W; 2104 if (meta->flags & VM_EXEC) 2105 phdr.p_flags |= PF_X; 2106 phdr.p_align = ELF_EXEC_PAGESIZE; 2107 2108 if (!dump_emit(cprm, &phdr, sizeof(phdr))) 2109 goto end_coredump; 2110 } 2111 2112 if (!elf_core_write_extra_phdrs(cprm, offset)) 2113 goto end_coredump; 2114 2115 /* write out the notes section */ 2116 if (!write_note_info(&info, cprm)) 2117 goto end_coredump; 2118 2119 /* For cell spufs and x86 xstate */ 2120 if (elf_coredump_extra_notes_write(cprm)) 2121 goto end_coredump; 2122 2123 /* Align to page */ 2124 dump_skip_to(cprm, dataoff); 2125 2126 for (i = 0; i < cprm->vma_count; i++) { 2127 struct core_vma_metadata *meta = cprm->vma_meta + i; 2128 2129 if (!dump_user_range(cprm, meta->start, meta->dump_size)) 2130 goto end_coredump; 2131 } 2132 2133 if (!elf_core_write_extra_data(cprm)) 2134 goto end_coredump; 2135 2136 if (e_phnum == PN_XNUM) { 2137 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum))) 2138 goto end_coredump; 2139 } 2140 2141 end_coredump: 2142 free_note_info(&info); 2143 kfree(shdr4extnum); 2144 kfree(phdr4note); 2145 return has_dumped; 2146 } 2147 2148 #endif /* CONFIG_ELF_CORE */ 2149 2150 static int __init init_elf_binfmt(void) 2151 { 2152 register_binfmt(&elf_format); 2153 return 0; 2154 } 2155 2156 static void __exit exit_elf_binfmt(void) 2157 { 2158 /* Remove the COFF and ELF loaders. */ 2159 unregister_binfmt(&elf_format); 2160 } 2161 2162 core_initcall(init_elf_binfmt); 2163 module_exit(exit_elf_binfmt); 2164 2165 #ifdef CONFIG_BINFMT_ELF_KUNIT_TEST 2166 #include "tests/binfmt_elf_kunit.c" 2167 #endif 2168