1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * linux/fs/binfmt_elf.c
4 *
5 * These are the functions used to load ELF format executables as used
6 * on SVr4 machines. Information on the format may be found in the book
7 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
8 * Tools".
9 *
10 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
11 */
12
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/fs.h>
16 #include <linux/log2.h>
17 #include <linux/mm.h>
18 #include <linux/mman.h>
19 #include <linux/errno.h>
20 #include <linux/signal.h>
21 #include <linux/binfmts.h>
22 #include <linux/string.h>
23 #include <linux/file.h>
24 #include <linux/slab.h>
25 #include <linux/personality.h>
26 #include <linux/elfcore.h>
27 #include <linux/init.h>
28 #include <linux/highuid.h>
29 #include <linux/compiler.h>
30 #include <linux/highmem.h>
31 #include <linux/hugetlb.h>
32 #include <linux/pagemap.h>
33 #include <linux/vmalloc.h>
34 #include <linux/security.h>
35 #include <linux/random.h>
36 #include <linux/elf.h>
37 #include <linux/elf-randomize.h>
38 #include <linux/utsname.h>
39 #include <linux/coredump.h>
40 #include <linux/sched.h>
41 #include <linux/sched/coredump.h>
42 #include <linux/sched/task_stack.h>
43 #include <linux/sched/cputime.h>
44 #include <linux/sizes.h>
45 #include <linux/types.h>
46 #include <linux/cred.h>
47 #include <linux/dax.h>
48 #include <linux/uaccess.h>
49 #include <asm/param.h>
50 #include <asm/page.h>
51
52 #ifndef ELF_COMPAT
53 #define ELF_COMPAT 0
54 #endif
55
56 #ifndef user_long_t
57 #define user_long_t long
58 #endif
59 #ifndef user_siginfo_t
60 #define user_siginfo_t siginfo_t
61 #endif
62
63 /* That's for binfmt_elf_fdpic to deal with */
64 #ifndef elf_check_fdpic
65 #define elf_check_fdpic(ex) false
66 #endif
67
68 static int load_elf_binary(struct linux_binprm *bprm);
69
70 #ifdef CONFIG_USELIB
71 static int load_elf_library(struct file *);
72 #else
73 #define load_elf_library NULL
74 #endif
75
76 /*
77 * If we don't support core dumping, then supply a NULL so we
78 * don't even try.
79 */
80 #ifdef CONFIG_ELF_CORE
81 static int elf_core_dump(struct coredump_params *cprm);
82 #else
83 #define elf_core_dump NULL
84 #endif
85
86 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
87 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
88 #else
89 #define ELF_MIN_ALIGN PAGE_SIZE
90 #endif
91
92 #ifndef ELF_CORE_EFLAGS
93 #define ELF_CORE_EFLAGS 0
94 #endif
95
96 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
97 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
98 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
99
100 static struct linux_binfmt elf_format = {
101 .module = THIS_MODULE,
102 .load_binary = load_elf_binary,
103 .load_shlib = load_elf_library,
104 .core_dump = elf_core_dump,
105 .min_coredump = ELF_EXEC_PAGESIZE,
106 };
107
108 #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE))
109
set_brk(unsigned long start,unsigned long end,int prot)110 static int set_brk(unsigned long start, unsigned long end, int prot)
111 {
112 start = ELF_PAGEALIGN(start);
113 end = ELF_PAGEALIGN(end);
114 if (end > start) {
115 /*
116 * Map the last of the bss segment.
117 * If the header is requesting these pages to be
118 * executable, honour that (ppc32 needs this).
119 */
120 int error = vm_brk_flags(start, end - start,
121 prot & PROT_EXEC ? VM_EXEC : 0);
122 if (error)
123 return error;
124 }
125 current->mm->start_brk = current->mm->brk = end;
126 return 0;
127 }
128
129 /* We need to explicitly zero any fractional pages
130 after the data section (i.e. bss). This would
131 contain the junk from the file that should not
132 be in memory
133 */
padzero(unsigned long elf_bss)134 static int padzero(unsigned long elf_bss)
135 {
136 unsigned long nbyte;
137
138 nbyte = ELF_PAGEOFFSET(elf_bss);
139 if (nbyte) {
140 nbyte = ELF_MIN_ALIGN - nbyte;
141 if (clear_user((void __user *) elf_bss, nbyte))
142 return -EFAULT;
143 }
144 return 0;
145 }
146
147 /* Let's use some macros to make this stack manipulation a little clearer */
148 #ifdef CONFIG_STACK_GROWSUP
149 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
150 #define STACK_ROUND(sp, items) \
151 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
152 #define STACK_ALLOC(sp, len) ({ \
153 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
154 old_sp; })
155 #else
156 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
157 #define STACK_ROUND(sp, items) \
158 (((unsigned long) (sp - items)) &~ 15UL)
159 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
160 #endif
161
162 #ifndef ELF_BASE_PLATFORM
163 /*
164 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
165 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
166 * will be copied to the user stack in the same manner as AT_PLATFORM.
167 */
168 #define ELF_BASE_PLATFORM NULL
169 #endif
170
171 static int
create_elf_tables(struct linux_binprm * bprm,const struct elfhdr * exec,unsigned long load_addr,unsigned long interp_load_addr,unsigned long e_entry)172 create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
173 unsigned long load_addr, unsigned long interp_load_addr,
174 unsigned long e_entry)
175 {
176 struct mm_struct *mm = current->mm;
177 unsigned long p = bprm->p;
178 int argc = bprm->argc;
179 int envc = bprm->envc;
180 elf_addr_t __user *sp;
181 elf_addr_t __user *u_platform;
182 elf_addr_t __user *u_base_platform;
183 elf_addr_t __user *u_rand_bytes;
184 const char *k_platform = ELF_PLATFORM;
185 const char *k_base_platform = ELF_BASE_PLATFORM;
186 unsigned char k_rand_bytes[16];
187 int items;
188 elf_addr_t *elf_info;
189 int ei_index;
190 const struct cred *cred = current_cred();
191 struct vm_area_struct *vma;
192
193 /*
194 * In some cases (e.g. Hyper-Threading), we want to avoid L1
195 * evictions by the processes running on the same package. One
196 * thing we can do is to shuffle the initial stack for them.
197 */
198
199 p = arch_align_stack(p);
200
201 /*
202 * If this architecture has a platform capability string, copy it
203 * to userspace. In some cases (Sparc), this info is impossible
204 * for userspace to get any other way, in others (i386) it is
205 * merely difficult.
206 */
207 u_platform = NULL;
208 if (k_platform) {
209 size_t len = strlen(k_platform) + 1;
210
211 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
212 if (copy_to_user(u_platform, k_platform, len))
213 return -EFAULT;
214 }
215
216 /*
217 * If this architecture has a "base" platform capability
218 * string, copy it to userspace.
219 */
220 u_base_platform = NULL;
221 if (k_base_platform) {
222 size_t len = strlen(k_base_platform) + 1;
223
224 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
225 if (copy_to_user(u_base_platform, k_base_platform, len))
226 return -EFAULT;
227 }
228
229 /*
230 * Generate 16 random bytes for userspace PRNG seeding.
231 */
232 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
233 u_rand_bytes = (elf_addr_t __user *)
234 STACK_ALLOC(p, sizeof(k_rand_bytes));
235 if (copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
236 return -EFAULT;
237
238 /* Create the ELF interpreter info */
239 elf_info = (elf_addr_t *)mm->saved_auxv;
240 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
241 #define NEW_AUX_ENT(id, val) \
242 do { \
243 *elf_info++ = id; \
244 *elf_info++ = val; \
245 } while (0)
246
247 #ifdef ARCH_DLINFO
248 /*
249 * ARCH_DLINFO must come first so PPC can do its special alignment of
250 * AUXV.
251 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
252 * ARCH_DLINFO changes
253 */
254 ARCH_DLINFO;
255 #endif
256 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
257 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
258 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
259 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
260 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
261 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
262 NEW_AUX_ENT(AT_BASE, interp_load_addr);
263 NEW_AUX_ENT(AT_FLAGS, 0);
264 NEW_AUX_ENT(AT_ENTRY, e_entry);
265 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
266 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
267 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
268 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
269 NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
270 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
271 #ifdef ELF_HWCAP2
272 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
273 #endif
274 NEW_AUX_ENT(AT_EXECFN, bprm->exec);
275 if (k_platform) {
276 NEW_AUX_ENT(AT_PLATFORM,
277 (elf_addr_t)(unsigned long)u_platform);
278 }
279 if (k_base_platform) {
280 NEW_AUX_ENT(AT_BASE_PLATFORM,
281 (elf_addr_t)(unsigned long)u_base_platform);
282 }
283 if (bprm->have_execfd) {
284 NEW_AUX_ENT(AT_EXECFD, bprm->execfd);
285 }
286 #undef NEW_AUX_ENT
287 /* AT_NULL is zero; clear the rest too */
288 memset(elf_info, 0, (char *)mm->saved_auxv +
289 sizeof(mm->saved_auxv) - (char *)elf_info);
290
291 /* And advance past the AT_NULL entry. */
292 elf_info += 2;
293
294 ei_index = elf_info - (elf_addr_t *)mm->saved_auxv;
295 sp = STACK_ADD(p, ei_index);
296
297 items = (argc + 1) + (envc + 1) + 1;
298 bprm->p = STACK_ROUND(sp, items);
299
300 /* Point sp at the lowest address on the stack */
301 #ifdef CONFIG_STACK_GROWSUP
302 sp = (elf_addr_t __user *)bprm->p - items - ei_index;
303 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
304 #else
305 sp = (elf_addr_t __user *)bprm->p;
306 #endif
307
308
309 /*
310 * Grow the stack manually; some architectures have a limit on how
311 * far ahead a user-space access may be in order to grow the stack.
312 */
313 if (mmap_read_lock_killable(mm))
314 return -EINTR;
315 vma = find_extend_vma(mm, bprm->p);
316 mmap_read_unlock(mm);
317 if (!vma)
318 return -EFAULT;
319
320 /* Now, let's put argc (and argv, envp if appropriate) on the stack */
321 if (put_user(argc, sp++))
322 return -EFAULT;
323
324 /* Populate list of argv pointers back to argv strings. */
325 p = mm->arg_end = mm->arg_start;
326 while (argc-- > 0) {
327 size_t len;
328 if (put_user((elf_addr_t)p, sp++))
329 return -EFAULT;
330 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
331 if (!len || len > MAX_ARG_STRLEN)
332 return -EINVAL;
333 p += len;
334 }
335 if (put_user(0, sp++))
336 return -EFAULT;
337 mm->arg_end = p;
338
339 /* Populate list of envp pointers back to envp strings. */
340 mm->env_end = mm->env_start = p;
341 while (envc-- > 0) {
342 size_t len;
343 if (put_user((elf_addr_t)p, sp++))
344 return -EFAULT;
345 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
346 if (!len || len > MAX_ARG_STRLEN)
347 return -EINVAL;
348 p += len;
349 }
350 if (put_user(0, sp++))
351 return -EFAULT;
352 mm->env_end = p;
353
354 /* Put the elf_info on the stack in the right place. */
355 if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t)))
356 return -EFAULT;
357 return 0;
358 }
359
elf_map(struct file * filep,unsigned long addr,const struct elf_phdr * eppnt,int prot,int type,unsigned long total_size)360 static unsigned long elf_map(struct file *filep, unsigned long addr,
361 const struct elf_phdr *eppnt, int prot, int type,
362 unsigned long total_size)
363 {
364 unsigned long map_addr;
365 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
366 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
367 addr = ELF_PAGESTART(addr);
368 size = ELF_PAGEALIGN(size);
369
370 /* mmap() will return -EINVAL if given a zero size, but a
371 * segment with zero filesize is perfectly valid */
372 if (!size)
373 return addr;
374
375 /*
376 * total_size is the size of the ELF (interpreter) image.
377 * The _first_ mmap needs to know the full size, otherwise
378 * randomization might put this image into an overlapping
379 * position with the ELF binary image. (since size < total_size)
380 * So we first map the 'big' image - and unmap the remainder at
381 * the end. (which unmap is needed for ELF images with holes.)
382 */
383 if (total_size) {
384 total_size = ELF_PAGEALIGN(total_size);
385 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
386 if (!BAD_ADDR(map_addr))
387 vm_munmap(map_addr+size, total_size-size);
388 } else
389 map_addr = vm_mmap(filep, addr, size, prot, type, off);
390
391 if ((type & MAP_FIXED_NOREPLACE) &&
392 PTR_ERR((void *)map_addr) == -EEXIST)
393 pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n",
394 task_pid_nr(current), current->comm, (void *)addr);
395
396 return(map_addr);
397 }
398
total_mapping_size(const struct elf_phdr * cmds,int nr)399 static unsigned long total_mapping_size(const struct elf_phdr *cmds, int nr)
400 {
401 int i, first_idx = -1, last_idx = -1;
402
403 for (i = 0; i < nr; i++) {
404 if (cmds[i].p_type == PT_LOAD) {
405 last_idx = i;
406 if (first_idx == -1)
407 first_idx = i;
408 }
409 }
410 if (first_idx == -1)
411 return 0;
412
413 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
414 ELF_PAGESTART(cmds[first_idx].p_vaddr);
415 }
416
elf_read(struct file * file,void * buf,size_t len,loff_t pos)417 static int elf_read(struct file *file, void *buf, size_t len, loff_t pos)
418 {
419 ssize_t rv;
420
421 rv = kernel_read(file, buf, len, &pos);
422 if (unlikely(rv != len)) {
423 return (rv < 0) ? rv : -EIO;
424 }
425 return 0;
426 }
427
maximum_alignment(struct elf_phdr * cmds,int nr)428 static unsigned long maximum_alignment(struct elf_phdr *cmds, int nr)
429 {
430 unsigned long alignment = 0;
431 int i;
432
433 for (i = 0; i < nr; i++) {
434 if (cmds[i].p_type == PT_LOAD) {
435 unsigned long p_align = cmds[i].p_align;
436
437 /* skip non-power of two alignments as invalid */
438 if (!is_power_of_2(p_align))
439 continue;
440 alignment = max(alignment, p_align);
441 }
442 }
443
444 /* ensure we align to at least one page */
445 return ELF_PAGEALIGN(alignment);
446 }
447
448 /**
449 * load_elf_phdrs() - load ELF program headers
450 * @elf_ex: ELF header of the binary whose program headers should be loaded
451 * @elf_file: the opened ELF binary file
452 *
453 * Loads ELF program headers from the binary file elf_file, which has the ELF
454 * header pointed to by elf_ex, into a newly allocated array. The caller is
455 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure.
456 */
load_elf_phdrs(const struct elfhdr * elf_ex,struct file * elf_file)457 static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
458 struct file *elf_file)
459 {
460 struct elf_phdr *elf_phdata = NULL;
461 int retval, err = -1;
462 unsigned int size;
463
464 /*
465 * If the size of this structure has changed, then punt, since
466 * we will be doing the wrong thing.
467 */
468 if (elf_ex->e_phentsize != sizeof(struct elf_phdr))
469 goto out;
470
471 /* Sanity check the number of program headers... */
472 /* ...and their total size. */
473 size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
474 if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN)
475 goto out;
476
477 elf_phdata = kmalloc(size, GFP_KERNEL);
478 if (!elf_phdata)
479 goto out;
480
481 /* Read in the program headers */
482 retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff);
483 if (retval < 0) {
484 err = retval;
485 goto out;
486 }
487
488 /* Success! */
489 err = 0;
490 out:
491 if (err) {
492 kfree(elf_phdata);
493 elf_phdata = NULL;
494 }
495 return elf_phdata;
496 }
497
498 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE
499
500 /**
501 * struct arch_elf_state - arch-specific ELF loading state
502 *
503 * This structure is used to preserve architecture specific data during
504 * the loading of an ELF file, throughout the checking of architecture
505 * specific ELF headers & through to the point where the ELF load is
506 * known to be proceeding (ie. SET_PERSONALITY).
507 *
508 * This implementation is a dummy for architectures which require no
509 * specific state.
510 */
511 struct arch_elf_state {
512 };
513
514 #define INIT_ARCH_ELF_STATE {}
515
516 /**
517 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header
518 * @ehdr: The main ELF header
519 * @phdr: The program header to check
520 * @elf: The open ELF file
521 * @is_interp: True if the phdr is from the interpreter of the ELF being
522 * loaded, else false.
523 * @state: Architecture-specific state preserved throughout the process
524 * of loading the ELF.
525 *
526 * Inspects the program header phdr to validate its correctness and/or
527 * suitability for the system. Called once per ELF program header in the
528 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its
529 * interpreter.
530 *
531 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
532 * with that return code.
533 */
arch_elf_pt_proc(struct elfhdr * ehdr,struct elf_phdr * phdr,struct file * elf,bool is_interp,struct arch_elf_state * state)534 static inline int arch_elf_pt_proc(struct elfhdr *ehdr,
535 struct elf_phdr *phdr,
536 struct file *elf, bool is_interp,
537 struct arch_elf_state *state)
538 {
539 /* Dummy implementation, always proceed */
540 return 0;
541 }
542
543 /**
544 * arch_check_elf() - check an ELF executable
545 * @ehdr: The main ELF header
546 * @has_interp: True if the ELF has an interpreter, else false.
547 * @interp_ehdr: The interpreter's ELF header
548 * @state: Architecture-specific state preserved throughout the process
549 * of loading the ELF.
550 *
551 * Provides a final opportunity for architecture code to reject the loading
552 * of the ELF & cause an exec syscall to return an error. This is called after
553 * all program headers to be checked by arch_elf_pt_proc have been.
554 *
555 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
556 * with that return code.
557 */
arch_check_elf(struct elfhdr * ehdr,bool has_interp,struct elfhdr * interp_ehdr,struct arch_elf_state * state)558 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp,
559 struct elfhdr *interp_ehdr,
560 struct arch_elf_state *state)
561 {
562 /* Dummy implementation, always proceed */
563 return 0;
564 }
565
566 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */
567
make_prot(u32 p_flags,struct arch_elf_state * arch_state,bool has_interp,bool is_interp)568 static inline int make_prot(u32 p_flags, struct arch_elf_state *arch_state,
569 bool has_interp, bool is_interp)
570 {
571 int prot = 0;
572
573 if (p_flags & PF_R)
574 prot |= PROT_READ;
575 if (p_flags & PF_W)
576 prot |= PROT_WRITE;
577 if (p_flags & PF_X)
578 prot |= PROT_EXEC;
579
580 return arch_elf_adjust_prot(prot, arch_state, has_interp, is_interp);
581 }
582
583 /* This is much more generalized than the library routine read function,
584 so we keep this separate. Technically the library read function
585 is only provided so that we can read a.out libraries that have
586 an ELF header */
587
load_elf_interp(struct elfhdr * interp_elf_ex,struct file * interpreter,unsigned long no_base,struct elf_phdr * interp_elf_phdata,struct arch_elf_state * arch_state)588 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
589 struct file *interpreter,
590 unsigned long no_base, struct elf_phdr *interp_elf_phdata,
591 struct arch_elf_state *arch_state)
592 {
593 struct elf_phdr *eppnt;
594 unsigned long load_addr = 0;
595 int load_addr_set = 0;
596 unsigned long last_bss = 0, elf_bss = 0;
597 int bss_prot = 0;
598 unsigned long error = ~0UL;
599 unsigned long total_size;
600 int i;
601
602 /* First of all, some simple consistency checks */
603 if (interp_elf_ex->e_type != ET_EXEC &&
604 interp_elf_ex->e_type != ET_DYN)
605 goto out;
606 if (!elf_check_arch(interp_elf_ex) ||
607 elf_check_fdpic(interp_elf_ex))
608 goto out;
609 if (!interpreter->f_op->mmap)
610 goto out;
611
612 total_size = total_mapping_size(interp_elf_phdata,
613 interp_elf_ex->e_phnum);
614 if (!total_size) {
615 error = -EINVAL;
616 goto out;
617 }
618
619 eppnt = interp_elf_phdata;
620 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
621 if (eppnt->p_type == PT_LOAD) {
622 int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
623 int elf_prot = make_prot(eppnt->p_flags, arch_state,
624 true, true);
625 unsigned long vaddr = 0;
626 unsigned long k, map_addr;
627
628 vaddr = eppnt->p_vaddr;
629 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
630 elf_type |= MAP_FIXED;
631 else if (no_base && interp_elf_ex->e_type == ET_DYN)
632 load_addr = -vaddr;
633
634 map_addr = elf_map(interpreter, load_addr + vaddr,
635 eppnt, elf_prot, elf_type, total_size);
636 total_size = 0;
637 error = map_addr;
638 if (BAD_ADDR(map_addr))
639 goto out;
640
641 if (!load_addr_set &&
642 interp_elf_ex->e_type == ET_DYN) {
643 load_addr = map_addr - ELF_PAGESTART(vaddr);
644 load_addr_set = 1;
645 }
646
647 /*
648 * Check to see if the section's size will overflow the
649 * allowed task size. Note that p_filesz must always be
650 * <= p_memsize so it's only necessary to check p_memsz.
651 */
652 k = load_addr + eppnt->p_vaddr;
653 if (BAD_ADDR(k) ||
654 eppnt->p_filesz > eppnt->p_memsz ||
655 eppnt->p_memsz > TASK_SIZE ||
656 TASK_SIZE - eppnt->p_memsz < k) {
657 error = -ENOMEM;
658 goto out;
659 }
660
661 /*
662 * Find the end of the file mapping for this phdr, and
663 * keep track of the largest address we see for this.
664 */
665 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
666 if (k > elf_bss)
667 elf_bss = k;
668
669 /*
670 * Do the same thing for the memory mapping - between
671 * elf_bss and last_bss is the bss section.
672 */
673 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz;
674 if (k > last_bss) {
675 last_bss = k;
676 bss_prot = elf_prot;
677 }
678 }
679 }
680
681 /*
682 * Now fill out the bss section: first pad the last page from
683 * the file up to the page boundary, and zero it from elf_bss
684 * up to the end of the page.
685 */
686 if (padzero(elf_bss)) {
687 error = -EFAULT;
688 goto out;
689 }
690 /*
691 * Next, align both the file and mem bss up to the page size,
692 * since this is where elf_bss was just zeroed up to, and where
693 * last_bss will end after the vm_brk_flags() below.
694 */
695 elf_bss = ELF_PAGEALIGN(elf_bss);
696 last_bss = ELF_PAGEALIGN(last_bss);
697 /* Finally, if there is still more bss to allocate, do it. */
698 if (last_bss > elf_bss) {
699 error = vm_brk_flags(elf_bss, last_bss - elf_bss,
700 bss_prot & PROT_EXEC ? VM_EXEC : 0);
701 if (error)
702 goto out;
703 }
704
705 error = load_addr;
706 out:
707 return error;
708 }
709
710 /*
711 * These are the functions used to load ELF style executables and shared
712 * libraries. There is no binary dependent code anywhere else.
713 */
714
parse_elf_property(const char * data,size_t * off,size_t datasz,struct arch_elf_state * arch,bool have_prev_type,u32 * prev_type)715 static int parse_elf_property(const char *data, size_t *off, size_t datasz,
716 struct arch_elf_state *arch,
717 bool have_prev_type, u32 *prev_type)
718 {
719 size_t o, step;
720 const struct gnu_property *pr;
721 int ret;
722
723 if (*off == datasz)
724 return -ENOENT;
725
726 if (WARN_ON_ONCE(*off > datasz || *off % ELF_GNU_PROPERTY_ALIGN))
727 return -EIO;
728 o = *off;
729 datasz -= *off;
730
731 if (datasz < sizeof(*pr))
732 return -ENOEXEC;
733 pr = (const struct gnu_property *)(data + o);
734 o += sizeof(*pr);
735 datasz -= sizeof(*pr);
736
737 if (pr->pr_datasz > datasz)
738 return -ENOEXEC;
739
740 WARN_ON_ONCE(o % ELF_GNU_PROPERTY_ALIGN);
741 step = round_up(pr->pr_datasz, ELF_GNU_PROPERTY_ALIGN);
742 if (step > datasz)
743 return -ENOEXEC;
744
745 /* Properties are supposed to be unique and sorted on pr_type: */
746 if (have_prev_type && pr->pr_type <= *prev_type)
747 return -ENOEXEC;
748 *prev_type = pr->pr_type;
749
750 ret = arch_parse_elf_property(pr->pr_type, data + o,
751 pr->pr_datasz, ELF_COMPAT, arch);
752 if (ret)
753 return ret;
754
755 *off = o + step;
756 return 0;
757 }
758
759 #define NOTE_DATA_SZ SZ_1K
760 #define GNU_PROPERTY_TYPE_0_NAME "GNU"
761 #define NOTE_NAME_SZ (sizeof(GNU_PROPERTY_TYPE_0_NAME))
762
parse_elf_properties(struct file * f,const struct elf_phdr * phdr,struct arch_elf_state * arch)763 static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr,
764 struct arch_elf_state *arch)
765 {
766 union {
767 struct elf_note nhdr;
768 char data[NOTE_DATA_SZ];
769 } note;
770 loff_t pos;
771 ssize_t n;
772 size_t off, datasz;
773 int ret;
774 bool have_prev_type;
775 u32 prev_type;
776
777 if (!IS_ENABLED(CONFIG_ARCH_USE_GNU_PROPERTY) || !phdr)
778 return 0;
779
780 /* load_elf_binary() shouldn't call us unless this is true... */
781 if (WARN_ON_ONCE(phdr->p_type != PT_GNU_PROPERTY))
782 return -ENOEXEC;
783
784 /* If the properties are crazy large, that's too bad (for now): */
785 if (phdr->p_filesz > sizeof(note))
786 return -ENOEXEC;
787
788 pos = phdr->p_offset;
789 n = kernel_read(f, ¬e, phdr->p_filesz, &pos);
790
791 BUILD_BUG_ON(sizeof(note) < sizeof(note.nhdr) + NOTE_NAME_SZ);
792 if (n < 0 || n < sizeof(note.nhdr) + NOTE_NAME_SZ)
793 return -EIO;
794
795 if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 ||
796 note.nhdr.n_namesz != NOTE_NAME_SZ ||
797 strncmp(note.data + sizeof(note.nhdr),
798 GNU_PROPERTY_TYPE_0_NAME, n - sizeof(note.nhdr)))
799 return -ENOEXEC;
800
801 off = round_up(sizeof(note.nhdr) + NOTE_NAME_SZ,
802 ELF_GNU_PROPERTY_ALIGN);
803 if (off > n)
804 return -ENOEXEC;
805
806 if (note.nhdr.n_descsz > n - off)
807 return -ENOEXEC;
808 datasz = off + note.nhdr.n_descsz;
809
810 have_prev_type = false;
811 do {
812 ret = parse_elf_property(note.data, &off, datasz, arch,
813 have_prev_type, &prev_type);
814 have_prev_type = true;
815 } while (!ret);
816
817 return ret == -ENOENT ? 0 : ret;
818 }
819
load_elf_binary(struct linux_binprm * bprm)820 static int load_elf_binary(struct linux_binprm *bprm)
821 {
822 struct file *interpreter = NULL; /* to shut gcc up */
823 unsigned long load_addr = 0, load_bias = 0;
824 int load_addr_set = 0;
825 unsigned long error;
826 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
827 struct elf_phdr *elf_property_phdata = NULL;
828 unsigned long elf_bss, elf_brk;
829 int bss_prot = 0;
830 int retval, i;
831 unsigned long elf_entry;
832 unsigned long e_entry;
833 unsigned long interp_load_addr = 0;
834 unsigned long start_code, end_code, start_data, end_data;
835 unsigned long reloc_func_desc __maybe_unused = 0;
836 int executable_stack = EXSTACK_DEFAULT;
837 struct elfhdr *elf_ex = (struct elfhdr *)bprm->buf;
838 struct elfhdr *interp_elf_ex = NULL;
839 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
840 struct mm_struct *mm;
841 struct pt_regs *regs;
842
843 retval = -ENOEXEC;
844 /* First of all, some simple consistency checks */
845 if (memcmp(elf_ex->e_ident, ELFMAG, SELFMAG) != 0)
846 goto out;
847
848 if (elf_ex->e_type != ET_EXEC && elf_ex->e_type != ET_DYN)
849 goto out;
850 if (!elf_check_arch(elf_ex))
851 goto out;
852 if (elf_check_fdpic(elf_ex))
853 goto out;
854 if (!bprm->file->f_op->mmap)
855 goto out;
856
857 elf_phdata = load_elf_phdrs(elf_ex, bprm->file);
858 if (!elf_phdata)
859 goto out;
860
861 elf_ppnt = elf_phdata;
862 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) {
863 char *elf_interpreter;
864
865 if (elf_ppnt->p_type == PT_GNU_PROPERTY) {
866 elf_property_phdata = elf_ppnt;
867 continue;
868 }
869
870 if (elf_ppnt->p_type != PT_INTERP)
871 continue;
872
873 /*
874 * This is the program interpreter used for shared libraries -
875 * for now assume that this is an a.out format binary.
876 */
877 retval = -ENOEXEC;
878 if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2)
879 goto out_free_ph;
880
881 retval = -ENOMEM;
882 elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL);
883 if (!elf_interpreter)
884 goto out_free_ph;
885
886 retval = elf_read(bprm->file, elf_interpreter, elf_ppnt->p_filesz,
887 elf_ppnt->p_offset);
888 if (retval < 0)
889 goto out_free_interp;
890 /* make sure path is NULL terminated */
891 retval = -ENOEXEC;
892 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
893 goto out_free_interp;
894
895 interpreter = open_exec(elf_interpreter);
896 kfree(elf_interpreter);
897 retval = PTR_ERR(interpreter);
898 if (IS_ERR(interpreter))
899 goto out_free_ph;
900
901 /*
902 * If the binary is not readable then enforce mm->dumpable = 0
903 * regardless of the interpreter's permissions.
904 */
905 would_dump(bprm, interpreter);
906
907 interp_elf_ex = kmalloc(sizeof(*interp_elf_ex), GFP_KERNEL);
908 if (!interp_elf_ex) {
909 retval = -ENOMEM;
910 goto out_free_ph;
911 }
912
913 /* Get the exec headers */
914 retval = elf_read(interpreter, interp_elf_ex,
915 sizeof(*interp_elf_ex), 0);
916 if (retval < 0)
917 goto out_free_dentry;
918
919 break;
920
921 out_free_interp:
922 kfree(elf_interpreter);
923 goto out_free_ph;
924 }
925
926 elf_ppnt = elf_phdata;
927 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++)
928 switch (elf_ppnt->p_type) {
929 case PT_GNU_STACK:
930 if (elf_ppnt->p_flags & PF_X)
931 executable_stack = EXSTACK_ENABLE_X;
932 else
933 executable_stack = EXSTACK_DISABLE_X;
934 break;
935
936 case PT_LOPROC ... PT_HIPROC:
937 retval = arch_elf_pt_proc(elf_ex, elf_ppnt,
938 bprm->file, false,
939 &arch_state);
940 if (retval)
941 goto out_free_dentry;
942 break;
943 }
944
945 /* Some simple consistency checks for the interpreter */
946 if (interpreter) {
947 retval = -ELIBBAD;
948 /* Not an ELF interpreter */
949 if (memcmp(interp_elf_ex->e_ident, ELFMAG, SELFMAG) != 0)
950 goto out_free_dentry;
951 /* Verify the interpreter has a valid arch */
952 if (!elf_check_arch(interp_elf_ex) ||
953 elf_check_fdpic(interp_elf_ex))
954 goto out_free_dentry;
955
956 /* Load the interpreter program headers */
957 interp_elf_phdata = load_elf_phdrs(interp_elf_ex,
958 interpreter);
959 if (!interp_elf_phdata)
960 goto out_free_dentry;
961
962 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */
963 elf_property_phdata = NULL;
964 elf_ppnt = interp_elf_phdata;
965 for (i = 0; i < interp_elf_ex->e_phnum; i++, elf_ppnt++)
966 switch (elf_ppnt->p_type) {
967 case PT_GNU_PROPERTY:
968 elf_property_phdata = elf_ppnt;
969 break;
970
971 case PT_LOPROC ... PT_HIPROC:
972 retval = arch_elf_pt_proc(interp_elf_ex,
973 elf_ppnt, interpreter,
974 true, &arch_state);
975 if (retval)
976 goto out_free_dentry;
977 break;
978 }
979 }
980
981 retval = parse_elf_properties(interpreter ?: bprm->file,
982 elf_property_phdata, &arch_state);
983 if (retval)
984 goto out_free_dentry;
985
986 /*
987 * Allow arch code to reject the ELF at this point, whilst it's
988 * still possible to return an error to the code that invoked
989 * the exec syscall.
990 */
991 retval = arch_check_elf(elf_ex,
992 !!interpreter, interp_elf_ex,
993 &arch_state);
994 if (retval)
995 goto out_free_dentry;
996
997 /* Flush all traces of the currently running executable */
998 retval = begin_new_exec(bprm);
999 if (retval)
1000 goto out_free_dentry;
1001
1002 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
1003 may depend on the personality. */
1004 SET_PERSONALITY2(*elf_ex, &arch_state);
1005 if (elf_read_implies_exec(*elf_ex, executable_stack))
1006 current->personality |= READ_IMPLIES_EXEC;
1007
1008 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1009 current->flags |= PF_RANDOMIZE;
1010
1011 setup_new_exec(bprm);
1012
1013 /* Do this so that we can load the interpreter, if need be. We will
1014 change some of these later */
1015 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
1016 executable_stack);
1017 if (retval < 0)
1018 goto out_free_dentry;
1019
1020 elf_bss = 0;
1021 elf_brk = 0;
1022
1023 start_code = ~0UL;
1024 end_code = 0;
1025 start_data = 0;
1026 end_data = 0;
1027
1028 /* Now we do a little grungy work by mmapping the ELF image into
1029 the correct location in memory. */
1030 for(i = 0, elf_ppnt = elf_phdata;
1031 i < elf_ex->e_phnum; i++, elf_ppnt++) {
1032 int elf_prot, elf_flags;
1033 unsigned long k, vaddr;
1034 unsigned long total_size = 0;
1035 unsigned long alignment;
1036
1037 if (elf_ppnt->p_type == PT_OHOS_RANDOMDATA) {
1038 get_random_bytes((void *)(elf_ppnt->p_vaddr + load_bias), (int)elf_ppnt->p_memsz);
1039 continue;
1040 }
1041
1042 if (elf_ppnt->p_type != PT_LOAD)
1043 continue;
1044
1045 if (unlikely (elf_brk > elf_bss)) {
1046 unsigned long nbyte;
1047
1048 /* There was a PT_LOAD segment with p_memsz > p_filesz
1049 before this one. Map anonymous pages, if needed,
1050 and clear the area. */
1051 retval = set_brk(elf_bss + load_bias,
1052 elf_brk + load_bias,
1053 bss_prot);
1054 if (retval)
1055 goto out_free_dentry;
1056 nbyte = ELF_PAGEOFFSET(elf_bss);
1057 if (nbyte) {
1058 nbyte = ELF_MIN_ALIGN - nbyte;
1059 if (nbyte > elf_brk - elf_bss)
1060 nbyte = elf_brk - elf_bss;
1061 if (clear_user((void __user *)elf_bss +
1062 load_bias, nbyte)) {
1063 /*
1064 * This bss-zeroing can fail if the ELF
1065 * file specifies odd protections. So
1066 * we don't check the return value
1067 */
1068 }
1069 }
1070 }
1071
1072 elf_prot = make_prot(elf_ppnt->p_flags, &arch_state,
1073 !!interpreter, false);
1074
1075 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
1076
1077 vaddr = elf_ppnt->p_vaddr;
1078 /*
1079 * If we are loading ET_EXEC or we have already performed
1080 * the ET_DYN load_addr calculations, proceed normally.
1081 */
1082 if (elf_ex->e_type == ET_EXEC || load_addr_set) {
1083 elf_flags |= MAP_FIXED;
1084 } else if (elf_ex->e_type == ET_DYN) {
1085 /*
1086 * This logic is run once for the first LOAD Program
1087 * Header for ET_DYN binaries to calculate the
1088 * randomization (load_bias) for all the LOAD
1089 * Program Headers, and to calculate the entire
1090 * size of the ELF mapping (total_size). (Note that
1091 * load_addr_set is set to true later once the
1092 * initial mapping is performed.)
1093 *
1094 * There are effectively two types of ET_DYN
1095 * binaries: programs (i.e. PIE: ET_DYN with INTERP)
1096 * and loaders (ET_DYN without INTERP, since they
1097 * _are_ the ELF interpreter). The loaders must
1098 * be loaded away from programs since the program
1099 * may otherwise collide with the loader (especially
1100 * for ET_EXEC which does not have a randomized
1101 * position). For example to handle invocations of
1102 * "./ld.so someprog" to test out a new version of
1103 * the loader, the subsequent program that the
1104 * loader loads must avoid the loader itself, so
1105 * they cannot share the same load range. Sufficient
1106 * room for the brk must be allocated with the
1107 * loader as well, since brk must be available with
1108 * the loader.
1109 *
1110 * Therefore, programs are loaded offset from
1111 * ELF_ET_DYN_BASE and loaders are loaded into the
1112 * independently randomized mmap region (0 load_bias
1113 * without MAP_FIXED).
1114 */
1115 if (interpreter) {
1116 load_bias = ELF_ET_DYN_BASE;
1117 if (current->flags & PF_RANDOMIZE)
1118 load_bias += arch_mmap_rnd();
1119 alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum);
1120 if (alignment)
1121 load_bias &= ~(alignment - 1);
1122 elf_flags |= MAP_FIXED;
1123 } else
1124 load_bias = 0;
1125
1126 /*
1127 * Since load_bias is used for all subsequent loading
1128 * calculations, we must lower it by the first vaddr
1129 * so that the remaining calculations based on the
1130 * ELF vaddrs will be correctly offset. The result
1131 * is then page aligned.
1132 */
1133 load_bias = ELF_PAGESTART(load_bias - vaddr);
1134
1135 total_size = total_mapping_size(elf_phdata,
1136 elf_ex->e_phnum);
1137 if (!total_size) {
1138 retval = -EINVAL;
1139 goto out_free_dentry;
1140 }
1141 }
1142
1143 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
1144 elf_prot, elf_flags, total_size);
1145 if (BAD_ADDR(error)) {
1146 retval = IS_ERR((void *)error) ?
1147 PTR_ERR((void*)error) : -EINVAL;
1148 goto out_free_dentry;
1149 }
1150
1151 if (!load_addr_set) {
1152 load_addr_set = 1;
1153 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
1154 if (elf_ex->e_type == ET_DYN) {
1155 load_bias += error -
1156 ELF_PAGESTART(load_bias + vaddr);
1157 load_addr += load_bias;
1158 reloc_func_desc = load_bias;
1159 }
1160 }
1161 k = elf_ppnt->p_vaddr;
1162 if ((elf_ppnt->p_flags & PF_X) && k < start_code)
1163 start_code = k;
1164 if (start_data < k)
1165 start_data = k;
1166
1167 /*
1168 * Check to see if the section's size will overflow the
1169 * allowed task size. Note that p_filesz must always be
1170 * <= p_memsz so it is only necessary to check p_memsz.
1171 */
1172 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
1173 elf_ppnt->p_memsz > TASK_SIZE ||
1174 TASK_SIZE - elf_ppnt->p_memsz < k) {
1175 /* set_brk can never work. Avoid overflows. */
1176 retval = -EINVAL;
1177 goto out_free_dentry;
1178 }
1179
1180 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
1181
1182 if (k > elf_bss)
1183 elf_bss = k;
1184 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
1185 end_code = k;
1186 if (end_data < k)
1187 end_data = k;
1188 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
1189 if (k > elf_brk) {
1190 bss_prot = elf_prot;
1191 elf_brk = k;
1192 }
1193 }
1194
1195 e_entry = elf_ex->e_entry + load_bias;
1196 elf_bss += load_bias;
1197 elf_brk += load_bias;
1198 start_code += load_bias;
1199 end_code += load_bias;
1200 start_data += load_bias;
1201 end_data += load_bias;
1202
1203 /* Calling set_brk effectively mmaps the pages that we need
1204 * for the bss and break sections. We must do this before
1205 * mapping in the interpreter, to make sure it doesn't wind
1206 * up getting placed where the bss needs to go.
1207 */
1208 retval = set_brk(elf_bss, elf_brk, bss_prot);
1209 if (retval)
1210 goto out_free_dentry;
1211 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
1212 retval = -EFAULT; /* Nobody gets to see this, but.. */
1213 goto out_free_dentry;
1214 }
1215
1216 if (interpreter) {
1217 elf_entry = load_elf_interp(interp_elf_ex,
1218 interpreter,
1219 load_bias, interp_elf_phdata,
1220 &arch_state);
1221 if (!IS_ERR((void *)elf_entry)) {
1222 /*
1223 * load_elf_interp() returns relocation
1224 * adjustment
1225 */
1226 interp_load_addr = elf_entry;
1227 elf_entry += interp_elf_ex->e_entry;
1228 }
1229 if (BAD_ADDR(elf_entry)) {
1230 retval = IS_ERR((void *)elf_entry) ?
1231 (int)elf_entry : -EINVAL;
1232 goto out_free_dentry;
1233 }
1234 reloc_func_desc = interp_load_addr;
1235
1236 allow_write_access(interpreter);
1237 fput(interpreter);
1238
1239 kfree(interp_elf_ex);
1240 kfree(interp_elf_phdata);
1241 } else {
1242 elf_entry = e_entry;
1243 if (BAD_ADDR(elf_entry)) {
1244 retval = -EINVAL;
1245 goto out_free_dentry;
1246 }
1247 }
1248
1249 kfree(elf_phdata);
1250
1251 set_binfmt(&elf_format);
1252
1253 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
1254 retval = arch_setup_additional_pages(bprm, !!interpreter);
1255 if (retval < 0)
1256 goto out;
1257 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
1258
1259 retval = create_elf_tables(bprm, elf_ex,
1260 load_addr, interp_load_addr, e_entry);
1261 if (retval < 0)
1262 goto out;
1263
1264 mm = current->mm;
1265 mm->end_code = end_code;
1266 mm->start_code = start_code;
1267 mm->start_data = start_data;
1268 mm->end_data = end_data;
1269 mm->start_stack = bprm->p;
1270
1271 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
1272 /*
1273 * For architectures with ELF randomization, when executing
1274 * a loader directly (i.e. no interpreter listed in ELF
1275 * headers), move the brk area out of the mmap region
1276 * (since it grows up, and may collide early with the stack
1277 * growing down), and into the unused ELF_ET_DYN_BASE region.
1278 */
1279 if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
1280 elf_ex->e_type == ET_DYN && !interpreter) {
1281 mm->brk = mm->start_brk = ELF_ET_DYN_BASE;
1282 }
1283
1284 mm->brk = mm->start_brk = arch_randomize_brk(mm);
1285 #ifdef compat_brk_randomized
1286 current->brk_randomized = 1;
1287 #endif
1288 }
1289
1290 if (current->personality & MMAP_PAGE_ZERO) {
1291 /* Why this, you ask??? Well SVr4 maps page 0 as read-only,
1292 and some applications "depend" upon this behavior.
1293 Since we do not have the power to recompile these, we
1294 emulate the SVr4 behavior. Sigh. */
1295 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
1296 MAP_FIXED | MAP_PRIVATE, 0);
1297 }
1298
1299 regs = current_pt_regs();
1300 #ifdef ELF_PLAT_INIT
1301 /*
1302 * The ABI may specify that certain registers be set up in special
1303 * ways (on i386 %edx is the address of a DT_FINI function, for
1304 * example. In addition, it may also specify (eg, PowerPC64 ELF)
1305 * that the e_entry field is the address of the function descriptor
1306 * for the startup routine, rather than the address of the startup
1307 * routine itself. This macro performs whatever initialization to
1308 * the regs structure is required as well as any relocations to the
1309 * function descriptor entries when executing dynamically links apps.
1310 */
1311 ELF_PLAT_INIT(regs, reloc_func_desc);
1312 #endif
1313
1314 finalize_exec(bprm);
1315 start_thread(regs, elf_entry, bprm->p);
1316 retval = 0;
1317 out:
1318 return retval;
1319
1320 /* error cleanup */
1321 out_free_dentry:
1322 kfree(interp_elf_ex);
1323 kfree(interp_elf_phdata);
1324 allow_write_access(interpreter);
1325 if (interpreter)
1326 fput(interpreter);
1327 out_free_ph:
1328 kfree(elf_phdata);
1329 goto out;
1330 }
1331
1332 #ifdef CONFIG_USELIB
1333 /* This is really simpleminded and specialized - we are loading an
1334 a.out library that is given an ELF header. */
load_elf_library(struct file * file)1335 static int load_elf_library(struct file *file)
1336 {
1337 struct elf_phdr *elf_phdata;
1338 struct elf_phdr *eppnt;
1339 unsigned long elf_bss, bss, len;
1340 int retval, error, i, j;
1341 struct elfhdr elf_ex;
1342
1343 error = -ENOEXEC;
1344 retval = elf_read(file, &elf_ex, sizeof(elf_ex), 0);
1345 if (retval < 0)
1346 goto out;
1347
1348 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1349 goto out;
1350
1351 /* First of all, some simple consistency checks */
1352 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1353 !elf_check_arch(&elf_ex) || !file->f_op->mmap)
1354 goto out;
1355 if (elf_check_fdpic(&elf_ex))
1356 goto out;
1357
1358 /* Now read in all of the header information */
1359
1360 j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1361 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1362
1363 error = -ENOMEM;
1364 elf_phdata = kmalloc(j, GFP_KERNEL);
1365 if (!elf_phdata)
1366 goto out;
1367
1368 eppnt = elf_phdata;
1369 error = -ENOEXEC;
1370 retval = elf_read(file, eppnt, j, elf_ex.e_phoff);
1371 if (retval < 0)
1372 goto out_free_ph;
1373
1374 for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1375 if ((eppnt + i)->p_type == PT_LOAD)
1376 j++;
1377 if (j != 1)
1378 goto out_free_ph;
1379
1380 while (eppnt->p_type != PT_LOAD)
1381 eppnt++;
1382
1383 /* Now use mmap to map the library into memory. */
1384 error = vm_mmap(file,
1385 ELF_PAGESTART(eppnt->p_vaddr),
1386 (eppnt->p_filesz +
1387 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1388 PROT_READ | PROT_WRITE | PROT_EXEC,
1389 MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_DENYWRITE,
1390 (eppnt->p_offset -
1391 ELF_PAGEOFFSET(eppnt->p_vaddr)));
1392 if (error != ELF_PAGESTART(eppnt->p_vaddr))
1393 goto out_free_ph;
1394
1395 elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1396 if (padzero(elf_bss)) {
1397 error = -EFAULT;
1398 goto out_free_ph;
1399 }
1400
1401 len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr);
1402 bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr);
1403 if (bss > len) {
1404 error = vm_brk(len, bss - len);
1405 if (error)
1406 goto out_free_ph;
1407 }
1408 error = 0;
1409
1410 out_free_ph:
1411 kfree(elf_phdata);
1412 out:
1413 return error;
1414 }
1415 #endif /* #ifdef CONFIG_USELIB */
1416
1417 #ifdef CONFIG_ELF_CORE
1418 /*
1419 * ELF core dumper
1420 *
1421 * Modelled on fs/exec.c:aout_core_dump()
1422 * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1423 */
1424
1425 /* An ELF note in memory */
1426 struct memelfnote
1427 {
1428 const char *name;
1429 int type;
1430 unsigned int datasz;
1431 void *data;
1432 };
1433
notesize(struct memelfnote * en)1434 static int notesize(struct memelfnote *en)
1435 {
1436 int sz;
1437
1438 sz = sizeof(struct elf_note);
1439 sz += roundup(strlen(en->name) + 1, 4);
1440 sz += roundup(en->datasz, 4);
1441
1442 return sz;
1443 }
1444
writenote(struct memelfnote * men,struct coredump_params * cprm)1445 static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1446 {
1447 struct elf_note en;
1448 en.n_namesz = strlen(men->name) + 1;
1449 en.n_descsz = men->datasz;
1450 en.n_type = men->type;
1451
1452 return dump_emit(cprm, &en, sizeof(en)) &&
1453 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1454 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1455 }
1456
fill_elf_header(struct elfhdr * elf,int segs,u16 machine,u32 flags)1457 static void fill_elf_header(struct elfhdr *elf, int segs,
1458 u16 machine, u32 flags)
1459 {
1460 memset(elf, 0, sizeof(*elf));
1461
1462 memcpy(elf->e_ident, ELFMAG, SELFMAG);
1463 elf->e_ident[EI_CLASS] = ELF_CLASS;
1464 elf->e_ident[EI_DATA] = ELF_DATA;
1465 elf->e_ident[EI_VERSION] = EV_CURRENT;
1466 elf->e_ident[EI_OSABI] = ELF_OSABI;
1467
1468 elf->e_type = ET_CORE;
1469 elf->e_machine = machine;
1470 elf->e_version = EV_CURRENT;
1471 elf->e_phoff = sizeof(struct elfhdr);
1472 elf->e_flags = flags;
1473 elf->e_ehsize = sizeof(struct elfhdr);
1474 elf->e_phentsize = sizeof(struct elf_phdr);
1475 elf->e_phnum = segs;
1476 }
1477
fill_elf_note_phdr(struct elf_phdr * phdr,int sz,loff_t offset)1478 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1479 {
1480 phdr->p_type = PT_NOTE;
1481 phdr->p_offset = offset;
1482 phdr->p_vaddr = 0;
1483 phdr->p_paddr = 0;
1484 phdr->p_filesz = sz;
1485 phdr->p_memsz = 0;
1486 phdr->p_flags = 0;
1487 phdr->p_align = 0;
1488 }
1489
fill_note(struct memelfnote * note,const char * name,int type,unsigned int sz,void * data)1490 static void fill_note(struct memelfnote *note, const char *name, int type,
1491 unsigned int sz, void *data)
1492 {
1493 note->name = name;
1494 note->type = type;
1495 note->datasz = sz;
1496 note->data = data;
1497 }
1498
1499 /*
1500 * fill up all the fields in prstatus from the given task struct, except
1501 * registers which need to be filled up separately.
1502 */
fill_prstatus(struct elf_prstatus * prstatus,struct task_struct * p,long signr)1503 static void fill_prstatus(struct elf_prstatus *prstatus,
1504 struct task_struct *p, long signr)
1505 {
1506 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1507 prstatus->pr_sigpend = p->pending.signal.sig[0];
1508 prstatus->pr_sighold = p->blocked.sig[0];
1509 rcu_read_lock();
1510 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1511 rcu_read_unlock();
1512 prstatus->pr_pid = task_pid_vnr(p);
1513 prstatus->pr_pgrp = task_pgrp_vnr(p);
1514 prstatus->pr_sid = task_session_vnr(p);
1515 if (thread_group_leader(p)) {
1516 struct task_cputime cputime;
1517
1518 /*
1519 * This is the record for the group leader. It shows the
1520 * group-wide total, not its individual thread total.
1521 */
1522 thread_group_cputime(p, &cputime);
1523 prstatus->pr_utime = ns_to_kernel_old_timeval(cputime.utime);
1524 prstatus->pr_stime = ns_to_kernel_old_timeval(cputime.stime);
1525 } else {
1526 u64 utime, stime;
1527
1528 task_cputime(p, &utime, &stime);
1529 prstatus->pr_utime = ns_to_kernel_old_timeval(utime);
1530 prstatus->pr_stime = ns_to_kernel_old_timeval(stime);
1531 }
1532
1533 prstatus->pr_cutime = ns_to_kernel_old_timeval(p->signal->cutime);
1534 prstatus->pr_cstime = ns_to_kernel_old_timeval(p->signal->cstime);
1535 }
1536
fill_psinfo(struct elf_prpsinfo * psinfo,struct task_struct * p,struct mm_struct * mm)1537 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1538 struct mm_struct *mm)
1539 {
1540 const struct cred *cred;
1541 unsigned int i, len;
1542
1543 /* first copy the parameters from user space */
1544 memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1545
1546 len = mm->arg_end - mm->arg_start;
1547 if (len >= ELF_PRARGSZ)
1548 len = ELF_PRARGSZ-1;
1549 if (copy_from_user(&psinfo->pr_psargs,
1550 (const char __user *)mm->arg_start, len))
1551 return -EFAULT;
1552 for(i = 0; i < len; i++)
1553 if (psinfo->pr_psargs[i] == 0)
1554 psinfo->pr_psargs[i] = ' ';
1555 psinfo->pr_psargs[len] = 0;
1556
1557 rcu_read_lock();
1558 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1559 rcu_read_unlock();
1560 psinfo->pr_pid = task_pid_vnr(p);
1561 psinfo->pr_pgrp = task_pgrp_vnr(p);
1562 psinfo->pr_sid = task_session_vnr(p);
1563
1564 i = p->state ? ffz(~p->state) + 1 : 0;
1565 psinfo->pr_state = i;
1566 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1567 psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1568 psinfo->pr_nice = task_nice(p);
1569 psinfo->pr_flag = p->flags;
1570 rcu_read_lock();
1571 cred = __task_cred(p);
1572 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1573 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1574 rcu_read_unlock();
1575 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1576
1577 return 0;
1578 }
1579
fill_auxv_note(struct memelfnote * note,struct mm_struct * mm)1580 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1581 {
1582 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1583 int i = 0;
1584 do
1585 i += 2;
1586 while (auxv[i - 2] != AT_NULL);
1587 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1588 }
1589
fill_siginfo_note(struct memelfnote * note,user_siginfo_t * csigdata,const kernel_siginfo_t * siginfo)1590 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1591 const kernel_siginfo_t *siginfo)
1592 {
1593 copy_siginfo_to_external(csigdata, siginfo);
1594 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1595 }
1596
1597 #define MAX_FILE_NOTE_SIZE (4*1024*1024)
1598 /*
1599 * Format of NT_FILE note:
1600 *
1601 * long count -- how many files are mapped
1602 * long page_size -- units for file_ofs
1603 * array of [COUNT] elements of
1604 * long start
1605 * long end
1606 * long file_ofs
1607 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1608 */
fill_files_note(struct memelfnote * note)1609 static int fill_files_note(struct memelfnote *note)
1610 {
1611 struct mm_struct *mm = current->mm;
1612 struct vm_area_struct *vma;
1613 unsigned count, size, names_ofs, remaining, n;
1614 user_long_t *data;
1615 user_long_t *start_end_ofs;
1616 char *name_base, *name_curpos;
1617
1618 /* *Estimated* file count and total data size needed */
1619 count = mm->map_count;
1620 if (count > UINT_MAX / 64)
1621 return -EINVAL;
1622 size = count * 64;
1623
1624 names_ofs = (2 + 3 * count) * sizeof(data[0]);
1625 alloc:
1626 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
1627 return -EINVAL;
1628 size = round_up(size, PAGE_SIZE);
1629 /*
1630 * "size" can be 0 here legitimately.
1631 * Let it ENOMEM and omit NT_FILE section which will be empty anyway.
1632 */
1633 data = kvmalloc(size, GFP_KERNEL);
1634 if (ZERO_OR_NULL_PTR(data))
1635 return -ENOMEM;
1636
1637 start_end_ofs = data + 2;
1638 name_base = name_curpos = ((char *)data) + names_ofs;
1639 remaining = size - names_ofs;
1640 count = 0;
1641 for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) {
1642 struct file *file;
1643 const char *filename;
1644
1645 file = vma->vm_file;
1646 if (!file)
1647 continue;
1648 filename = file_path(file, name_curpos, remaining);
1649 if (IS_ERR(filename)) {
1650 if (PTR_ERR(filename) == -ENAMETOOLONG) {
1651 kvfree(data);
1652 size = size * 5 / 4;
1653 goto alloc;
1654 }
1655 continue;
1656 }
1657
1658 /* file_path() fills at the end, move name down */
1659 /* n = strlen(filename) + 1: */
1660 n = (name_curpos + remaining) - filename;
1661 remaining = filename - name_curpos;
1662 memmove(name_curpos, filename, n);
1663 name_curpos += n;
1664
1665 *start_end_ofs++ = vma->vm_start;
1666 *start_end_ofs++ = vma->vm_end;
1667 *start_end_ofs++ = vma->vm_pgoff;
1668 count++;
1669 }
1670
1671 /* Now we know exact count of files, can store it */
1672 data[0] = count;
1673 data[1] = PAGE_SIZE;
1674 /*
1675 * Count usually is less than mm->map_count,
1676 * we need to move filenames down.
1677 */
1678 n = mm->map_count - count;
1679 if (n != 0) {
1680 unsigned shift_bytes = n * 3 * sizeof(data[0]);
1681 memmove(name_base - shift_bytes, name_base,
1682 name_curpos - name_base);
1683 name_curpos -= shift_bytes;
1684 }
1685
1686 size = name_curpos - (char *)data;
1687 fill_note(note, "CORE", NT_FILE, size, data);
1688 return 0;
1689 }
1690
1691 #ifdef CORE_DUMP_USE_REGSET
1692 #include <linux/regset.h>
1693
1694 struct elf_thread_core_info {
1695 struct elf_thread_core_info *next;
1696 struct task_struct *task;
1697 struct elf_prstatus prstatus;
1698 struct memelfnote notes[];
1699 };
1700
1701 struct elf_note_info {
1702 struct elf_thread_core_info *thread;
1703 struct memelfnote psinfo;
1704 struct memelfnote signote;
1705 struct memelfnote auxv;
1706 struct memelfnote files;
1707 user_siginfo_t csigdata;
1708 size_t size;
1709 int thread_notes;
1710 };
1711
1712 /*
1713 * When a regset has a writeback hook, we call it on each thread before
1714 * dumping user memory. On register window machines, this makes sure the
1715 * user memory backing the register data is up to date before we read it.
1716 */
do_thread_regset_writeback(struct task_struct * task,const struct user_regset * regset)1717 static void do_thread_regset_writeback(struct task_struct *task,
1718 const struct user_regset *regset)
1719 {
1720 if (regset->writeback)
1721 regset->writeback(task, regset, 1);
1722 }
1723
1724 #ifndef PRSTATUS_SIZE
1725 #define PRSTATUS_SIZE(S, R) sizeof(S)
1726 #endif
1727
1728 #ifndef SET_PR_FPVALID
1729 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V))
1730 #endif
1731
fill_thread_core_info(struct elf_thread_core_info * t,const struct user_regset_view * view,long signr,size_t * total)1732 static int fill_thread_core_info(struct elf_thread_core_info *t,
1733 const struct user_regset_view *view,
1734 long signr, size_t *total)
1735 {
1736 unsigned int i;
1737 int regset0_size;
1738
1739 /*
1740 * NT_PRSTATUS is the one special case, because the regset data
1741 * goes into the pr_reg field inside the note contents, rather
1742 * than being the whole note contents. We fill the reset in here.
1743 * We assume that regset 0 is NT_PRSTATUS.
1744 */
1745 fill_prstatus(&t->prstatus, t->task, signr);
1746 regset0_size = regset_get(t->task, &view->regsets[0],
1747 sizeof(t->prstatus.pr_reg), &t->prstatus.pr_reg);
1748 if (regset0_size < 0)
1749 return 0;
1750
1751 fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1752 PRSTATUS_SIZE(t->prstatus, regset0_size), &t->prstatus);
1753 *total += notesize(&t->notes[0]);
1754
1755 do_thread_regset_writeback(t->task, &view->regsets[0]);
1756
1757 /*
1758 * Each other regset might generate a note too. For each regset
1759 * that has no core_note_type or is inactive, we leave t->notes[i]
1760 * all zero and we'll know to skip writing it later.
1761 */
1762 for (i = 1; i < view->n; ++i) {
1763 const struct user_regset *regset = &view->regsets[i];
1764 int note_type = regset->core_note_type;
1765 bool is_fpreg = note_type == NT_PRFPREG;
1766 void *data;
1767 int ret;
1768
1769 do_thread_regset_writeback(t->task, regset);
1770 if (!note_type) // not for coredumps
1771 continue;
1772 if (regset->active && regset->active(t->task, regset) <= 0)
1773 continue;
1774
1775 ret = regset_get_alloc(t->task, regset, ~0U, &data);
1776 if (ret < 0)
1777 continue;
1778
1779 if (is_fpreg)
1780 SET_PR_FPVALID(&t->prstatus, 1, regset0_size);
1781
1782 fill_note(&t->notes[i], is_fpreg ? "CORE" : "LINUX",
1783 note_type, ret, data);
1784
1785 *total += notesize(&t->notes[i]);
1786 }
1787
1788 return 1;
1789 }
1790
fill_note_info(struct elfhdr * elf,int phdrs,struct elf_note_info * info,const kernel_siginfo_t * siginfo,struct pt_regs * regs)1791 static int fill_note_info(struct elfhdr *elf, int phdrs,
1792 struct elf_note_info *info,
1793 const kernel_siginfo_t *siginfo, struct pt_regs *regs)
1794 {
1795 struct task_struct *dump_task = current;
1796 const struct user_regset_view *view = task_user_regset_view(dump_task);
1797 struct elf_thread_core_info *t;
1798 struct elf_prpsinfo *psinfo;
1799 struct core_thread *ct;
1800 unsigned int i;
1801
1802 info->size = 0;
1803 info->thread = NULL;
1804
1805 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1806 if (psinfo == NULL) {
1807 info->psinfo.data = NULL; /* So we don't free this wrongly */
1808 return 0;
1809 }
1810
1811 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1812
1813 /*
1814 * Figure out how many notes we're going to need for each thread.
1815 */
1816 info->thread_notes = 0;
1817 for (i = 0; i < view->n; ++i)
1818 if (view->regsets[i].core_note_type != 0)
1819 ++info->thread_notes;
1820
1821 /*
1822 * Sanity check. We rely on regset 0 being in NT_PRSTATUS,
1823 * since it is our one special case.
1824 */
1825 if (unlikely(info->thread_notes == 0) ||
1826 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1827 WARN_ON(1);
1828 return 0;
1829 }
1830
1831 /*
1832 * Initialize the ELF file header.
1833 */
1834 fill_elf_header(elf, phdrs,
1835 view->e_machine, view->e_flags);
1836
1837 /*
1838 * Allocate a structure for each thread.
1839 */
1840 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1841 t = kzalloc(offsetof(struct elf_thread_core_info,
1842 notes[info->thread_notes]),
1843 GFP_KERNEL);
1844 if (unlikely(!t))
1845 return 0;
1846
1847 t->task = ct->task;
1848 if (ct->task == dump_task || !info->thread) {
1849 t->next = info->thread;
1850 info->thread = t;
1851 } else {
1852 /*
1853 * Make sure to keep the original task at
1854 * the head of the list.
1855 */
1856 t->next = info->thread->next;
1857 info->thread->next = t;
1858 }
1859 }
1860
1861 /*
1862 * Now fill in each thread's information.
1863 */
1864 for (t = info->thread; t != NULL; t = t->next)
1865 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size))
1866 return 0;
1867
1868 /*
1869 * Fill in the two process-wide notes.
1870 */
1871 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1872 info->size += notesize(&info->psinfo);
1873
1874 fill_siginfo_note(&info->signote, &info->csigdata, siginfo);
1875 info->size += notesize(&info->signote);
1876
1877 fill_auxv_note(&info->auxv, current->mm);
1878 info->size += notesize(&info->auxv);
1879
1880 if (fill_files_note(&info->files) == 0)
1881 info->size += notesize(&info->files);
1882
1883 return 1;
1884 }
1885
get_note_info_size(struct elf_note_info * info)1886 static size_t get_note_info_size(struct elf_note_info *info)
1887 {
1888 return info->size;
1889 }
1890
1891 /*
1892 * Write all the notes for each thread. When writing the first thread, the
1893 * process-wide notes are interleaved after the first thread-specific note.
1894 */
write_note_info(struct elf_note_info * info,struct coredump_params * cprm)1895 static int write_note_info(struct elf_note_info *info,
1896 struct coredump_params *cprm)
1897 {
1898 bool first = true;
1899 struct elf_thread_core_info *t = info->thread;
1900
1901 do {
1902 int i;
1903
1904 if (!writenote(&t->notes[0], cprm))
1905 return 0;
1906
1907 if (first && !writenote(&info->psinfo, cprm))
1908 return 0;
1909 if (first && !writenote(&info->signote, cprm))
1910 return 0;
1911 if (first && !writenote(&info->auxv, cprm))
1912 return 0;
1913 if (first && info->files.data &&
1914 !writenote(&info->files, cprm))
1915 return 0;
1916
1917 for (i = 1; i < info->thread_notes; ++i)
1918 if (t->notes[i].data &&
1919 !writenote(&t->notes[i], cprm))
1920 return 0;
1921
1922 first = false;
1923 t = t->next;
1924 } while (t);
1925
1926 return 1;
1927 }
1928
free_note_info(struct elf_note_info * info)1929 static void free_note_info(struct elf_note_info *info)
1930 {
1931 struct elf_thread_core_info *threads = info->thread;
1932 while (threads) {
1933 unsigned int i;
1934 struct elf_thread_core_info *t = threads;
1935 threads = t->next;
1936 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1937 for (i = 1; i < info->thread_notes; ++i)
1938 kfree(t->notes[i].data);
1939 kfree(t);
1940 }
1941 kfree(info->psinfo.data);
1942 kvfree(info->files.data);
1943 }
1944
1945 #else
1946
1947 /* Here is the structure in which status of each thread is captured. */
1948 struct elf_thread_status
1949 {
1950 struct list_head list;
1951 struct elf_prstatus prstatus; /* NT_PRSTATUS */
1952 elf_fpregset_t fpu; /* NT_PRFPREG */
1953 struct task_struct *thread;
1954 struct memelfnote notes[3];
1955 int num_notes;
1956 };
1957
1958 /*
1959 * In order to add the specific thread information for the elf file format,
1960 * we need to keep a linked list of every threads pr_status and then create
1961 * a single section for them in the final core file.
1962 */
elf_dump_thread_status(long signr,struct elf_thread_status * t)1963 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1964 {
1965 int sz = 0;
1966 struct task_struct *p = t->thread;
1967 t->num_notes = 0;
1968
1969 fill_prstatus(&t->prstatus, p, signr);
1970 elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1971
1972 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1973 &(t->prstatus));
1974 t->num_notes++;
1975 sz += notesize(&t->notes[0]);
1976
1977 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1978 &t->fpu))) {
1979 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1980 &(t->fpu));
1981 t->num_notes++;
1982 sz += notesize(&t->notes[1]);
1983 }
1984 return sz;
1985 }
1986
1987 struct elf_note_info {
1988 struct memelfnote *notes;
1989 struct memelfnote *notes_files;
1990 struct elf_prstatus *prstatus; /* NT_PRSTATUS */
1991 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */
1992 struct list_head thread_list;
1993 elf_fpregset_t *fpu;
1994 user_siginfo_t csigdata;
1995 int thread_status_size;
1996 int numnote;
1997 };
1998
elf_note_info_init(struct elf_note_info * info)1999 static int elf_note_info_init(struct elf_note_info *info)
2000 {
2001 memset(info, 0, sizeof(*info));
2002 INIT_LIST_HEAD(&info->thread_list);
2003
2004 /* Allocate space for ELF notes */
2005 info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL);
2006 if (!info->notes)
2007 return 0;
2008 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
2009 if (!info->psinfo)
2010 return 0;
2011 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
2012 if (!info->prstatus)
2013 return 0;
2014 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
2015 if (!info->fpu)
2016 return 0;
2017 return 1;
2018 }
2019
fill_note_info(struct elfhdr * elf,int phdrs,struct elf_note_info * info,const kernel_siginfo_t * siginfo,struct pt_regs * regs)2020 static int fill_note_info(struct elfhdr *elf, int phdrs,
2021 struct elf_note_info *info,
2022 const kernel_siginfo_t *siginfo, struct pt_regs *regs)
2023 {
2024 struct core_thread *ct;
2025 struct elf_thread_status *ets;
2026
2027 if (!elf_note_info_init(info))
2028 return 0;
2029
2030 for (ct = current->mm->core_state->dumper.next;
2031 ct; ct = ct->next) {
2032 ets = kzalloc(sizeof(*ets), GFP_KERNEL);
2033 if (!ets)
2034 return 0;
2035
2036 ets->thread = ct->task;
2037 list_add(&ets->list, &info->thread_list);
2038 }
2039
2040 list_for_each_entry(ets, &info->thread_list, list) {
2041 int sz;
2042
2043 sz = elf_dump_thread_status(siginfo->si_signo, ets);
2044 info->thread_status_size += sz;
2045 }
2046 /* now collect the dump for the current */
2047 memset(info->prstatus, 0, sizeof(*info->prstatus));
2048 fill_prstatus(info->prstatus, current, siginfo->si_signo);
2049 elf_core_copy_regs(&info->prstatus->pr_reg, regs);
2050
2051 /* Set up header */
2052 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS);
2053
2054 /*
2055 * Set up the notes in similar form to SVR4 core dumps made
2056 * with info from their /proc.
2057 */
2058
2059 fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
2060 sizeof(*info->prstatus), info->prstatus);
2061 fill_psinfo(info->psinfo, current->group_leader, current->mm);
2062 fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
2063 sizeof(*info->psinfo), info->psinfo);
2064
2065 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
2066 fill_auxv_note(info->notes + 3, current->mm);
2067 info->numnote = 4;
2068
2069 if (fill_files_note(info->notes + info->numnote) == 0) {
2070 info->notes_files = info->notes + info->numnote;
2071 info->numnote++;
2072 }
2073
2074 /* Try to dump the FPU. */
2075 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
2076 info->fpu);
2077 if (info->prstatus->pr_fpvalid)
2078 fill_note(info->notes + info->numnote++,
2079 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
2080 return 1;
2081 }
2082
get_note_info_size(struct elf_note_info * info)2083 static size_t get_note_info_size(struct elf_note_info *info)
2084 {
2085 int sz = 0;
2086 int i;
2087
2088 for (i = 0; i < info->numnote; i++)
2089 sz += notesize(info->notes + i);
2090
2091 sz += info->thread_status_size;
2092
2093 return sz;
2094 }
2095
write_note_info(struct elf_note_info * info,struct coredump_params * cprm)2096 static int write_note_info(struct elf_note_info *info,
2097 struct coredump_params *cprm)
2098 {
2099 struct elf_thread_status *ets;
2100 int i;
2101
2102 for (i = 0; i < info->numnote; i++)
2103 if (!writenote(info->notes + i, cprm))
2104 return 0;
2105
2106 /* write out the thread status notes section */
2107 list_for_each_entry(ets, &info->thread_list, list) {
2108 for (i = 0; i < ets->num_notes; i++)
2109 if (!writenote(&ets->notes[i], cprm))
2110 return 0;
2111 }
2112
2113 return 1;
2114 }
2115
free_note_info(struct elf_note_info * info)2116 static void free_note_info(struct elf_note_info *info)
2117 {
2118 while (!list_empty(&info->thread_list)) {
2119 struct list_head *tmp = info->thread_list.next;
2120 list_del(tmp);
2121 kfree(list_entry(tmp, struct elf_thread_status, list));
2122 }
2123
2124 /* Free data possibly allocated by fill_files_note(): */
2125 if (info->notes_files)
2126 kvfree(info->notes_files->data);
2127
2128 kfree(info->prstatus);
2129 kfree(info->psinfo);
2130 kfree(info->notes);
2131 kfree(info->fpu);
2132 }
2133
2134 #endif
2135
fill_extnum_info(struct elfhdr * elf,struct elf_shdr * shdr4extnum,elf_addr_t e_shoff,int segs)2136 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
2137 elf_addr_t e_shoff, int segs)
2138 {
2139 elf->e_shoff = e_shoff;
2140 elf->e_shentsize = sizeof(*shdr4extnum);
2141 elf->e_shnum = 1;
2142 elf->e_shstrndx = SHN_UNDEF;
2143
2144 memset(shdr4extnum, 0, sizeof(*shdr4extnum));
2145
2146 shdr4extnum->sh_type = SHT_NULL;
2147 shdr4extnum->sh_size = elf->e_shnum;
2148 shdr4extnum->sh_link = elf->e_shstrndx;
2149 shdr4extnum->sh_info = segs;
2150 }
2151
2152 /*
2153 * Actual dumper
2154 *
2155 * This is a two-pass process; first we find the offsets of the bits,
2156 * and then they are actually written out. If we run out of core limit
2157 * we just truncate.
2158 */
elf_core_dump(struct coredump_params * cprm)2159 static int elf_core_dump(struct coredump_params *cprm)
2160 {
2161 int has_dumped = 0;
2162 int vma_count, segs, i;
2163 size_t vma_data_size;
2164 struct elfhdr elf;
2165 loff_t offset = 0, dataoff;
2166 struct elf_note_info info = { };
2167 struct elf_phdr *phdr4note = NULL;
2168 struct elf_shdr *shdr4extnum = NULL;
2169 Elf_Half e_phnum;
2170 elf_addr_t e_shoff;
2171 struct core_vma_metadata *vma_meta;
2172
2173 if (dump_vma_snapshot(cprm, &vma_count, &vma_meta, &vma_data_size))
2174 return 0;
2175
2176 /*
2177 * The number of segs are recored into ELF header as 16bit value.
2178 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2179 */
2180 segs = vma_count + elf_core_extra_phdrs();
2181
2182 /* for notes section */
2183 segs++;
2184
2185 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2186 * this, kernel supports extended numbering. Have a look at
2187 * include/linux/elf.h for further information. */
2188 e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2189
2190 /*
2191 * Collect all the non-memory information about the process for the
2192 * notes. This also sets up the file header.
2193 */
2194 if (!fill_note_info(&elf, e_phnum, &info, cprm->siginfo, cprm->regs))
2195 goto end_coredump;
2196
2197 has_dumped = 1;
2198
2199 offset += sizeof(elf); /* Elf header */
2200 offset += segs * sizeof(struct elf_phdr); /* Program headers */
2201
2202 /* Write notes phdr entry */
2203 {
2204 size_t sz = get_note_info_size(&info);
2205
2206 sz += elf_coredump_extra_notes_size();
2207
2208 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2209 if (!phdr4note)
2210 goto end_coredump;
2211
2212 fill_elf_note_phdr(phdr4note, sz, offset);
2213 offset += sz;
2214 }
2215
2216 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2217
2218 offset += vma_data_size;
2219 offset += elf_core_extra_data_size();
2220 e_shoff = offset;
2221
2222 if (e_phnum == PN_XNUM) {
2223 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2224 if (!shdr4extnum)
2225 goto end_coredump;
2226 fill_extnum_info(&elf, shdr4extnum, e_shoff, segs);
2227 }
2228
2229 offset = dataoff;
2230
2231 if (!dump_emit(cprm, &elf, sizeof(elf)))
2232 goto end_coredump;
2233
2234 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
2235 goto end_coredump;
2236
2237 /* Write program headers for segments dump */
2238 for (i = 0; i < vma_count; i++) {
2239 struct core_vma_metadata *meta = vma_meta + i;
2240 struct elf_phdr phdr;
2241
2242 phdr.p_type = PT_LOAD;
2243 phdr.p_offset = offset;
2244 phdr.p_vaddr = meta->start;
2245 phdr.p_paddr = 0;
2246 phdr.p_filesz = meta->dump_size;
2247 phdr.p_memsz = meta->end - meta->start;
2248 offset += phdr.p_filesz;
2249 phdr.p_flags = 0;
2250 if (meta->flags & VM_READ)
2251 phdr.p_flags |= PF_R;
2252 if (meta->flags & VM_WRITE)
2253 phdr.p_flags |= PF_W;
2254 if (meta->flags & VM_EXEC)
2255 phdr.p_flags |= PF_X;
2256 phdr.p_align = ELF_EXEC_PAGESIZE;
2257
2258 if (!dump_emit(cprm, &phdr, sizeof(phdr)))
2259 goto end_coredump;
2260 }
2261
2262 if (!elf_core_write_extra_phdrs(cprm, offset))
2263 goto end_coredump;
2264
2265 /* write out the notes section */
2266 if (!write_note_info(&info, cprm))
2267 goto end_coredump;
2268
2269 if (elf_coredump_extra_notes_write(cprm))
2270 goto end_coredump;
2271
2272 /* Align to page */
2273 if (!dump_skip(cprm, dataoff - cprm->pos))
2274 goto end_coredump;
2275
2276 for (i = 0; i < vma_count; i++) {
2277 struct core_vma_metadata *meta = vma_meta + i;
2278
2279 if (!dump_user_range(cprm, meta->start, meta->dump_size))
2280 goto end_coredump;
2281 }
2282 dump_truncate(cprm);
2283
2284 if (!elf_core_write_extra_data(cprm))
2285 goto end_coredump;
2286
2287 if (e_phnum == PN_XNUM) {
2288 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
2289 goto end_coredump;
2290 }
2291
2292 end_coredump:
2293 free_note_info(&info);
2294 kfree(shdr4extnum);
2295 kvfree(vma_meta);
2296 kfree(phdr4note);
2297 return has_dumped;
2298 }
2299
2300 #endif /* CONFIG_ELF_CORE */
2301
init_elf_binfmt(void)2302 static int __init init_elf_binfmt(void)
2303 {
2304 register_binfmt(&elf_format);
2305 return 0;
2306 }
2307
exit_elf_binfmt(void)2308 static void __exit exit_elf_binfmt(void)
2309 {
2310 /* Remove the COFF and ELF loaders. */
2311 unregister_binfmt(&elf_format);
2312 }
2313
2314 core_initcall(init_elf_binfmt);
2315 module_exit(exit_elf_binfmt);
2316 MODULE_LICENSE("GPL");
2317