1 /*
2 * linux/fs/binfmt_elf.c
3 *
4 * These are the functions used to load ELF format executables as used
5 * on SVr4 machines. Information on the format may be found in the book
6 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
7 * Tools".
8 *
9 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
10 */
11
12 #include <linux/module.h>
13 #include <linux/kernel.h>
14 #include <linux/fs.h>
15 #include <linux/mm.h>
16 #include <linux/mman.h>
17 #include <linux/errno.h>
18 #include <linux/signal.h>
19 #include <linux/binfmts.h>
20 #include <linux/string.h>
21 #include <linux/file.h>
22 #include <linux/slab.h>
23 #include <linux/personality.h>
24 #include <linux/elfcore.h>
25 #include <linux/init.h>
26 #include <linux/highuid.h>
27 #include <linux/compiler.h>
28 #include <linux/highmem.h>
29 #include <linux/pagemap.h>
30 #include <linux/vmalloc.h>
31 #include <linux/security.h>
32 #include <linux/random.h>
33 #include <linux/elf.h>
34 #include <linux/elf-randomize.h>
35 #include <linux/utsname.h>
36 #include <linux/coredump.h>
37 #include <linux/sched.h>
38 #include <linux/dax.h>
39 #include <asm/uaccess.h>
40 #include <asm/param.h>
41 #include <asm/page.h>
42
43 #ifndef user_long_t
44 #define user_long_t long
45 #endif
46 #ifndef user_siginfo_t
47 #define user_siginfo_t siginfo_t
48 #endif
49
50 static int load_elf_binary(struct linux_binprm *bprm);
51 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
52 int, int, unsigned long);
53
54 #ifdef CONFIG_USELIB
55 static int load_elf_library(struct file *);
56 #else
57 #define load_elf_library NULL
58 #endif
59
60 /*
61 * If we don't support core dumping, then supply a NULL so we
62 * don't even try.
63 */
64 #ifdef CONFIG_ELF_CORE
65 static int elf_core_dump(struct coredump_params *cprm);
66 #else
67 #define elf_core_dump NULL
68 #endif
69
70 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
71 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
72 #else
73 #define ELF_MIN_ALIGN PAGE_SIZE
74 #endif
75
76 #ifndef ELF_CORE_EFLAGS
77 #define ELF_CORE_EFLAGS 0
78 #endif
79
80 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
81 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
82 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
83
84 static struct linux_binfmt elf_format = {
85 .module = THIS_MODULE,
86 .load_binary = load_elf_binary,
87 .load_shlib = load_elf_library,
88 .core_dump = elf_core_dump,
89 .min_coredump = ELF_EXEC_PAGESIZE,
90 };
91
92 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
93
set_brk(unsigned long start,unsigned long end)94 static int set_brk(unsigned long start, unsigned long end)
95 {
96 start = ELF_PAGEALIGN(start);
97 end = ELF_PAGEALIGN(end);
98 if (end > start) {
99 int error = vm_brk(start, end - start);
100 if (error)
101 return error;
102 }
103 current->mm->start_brk = current->mm->brk = end;
104 return 0;
105 }
106
107 /* We need to explicitly zero any fractional pages
108 after the data section (i.e. bss). This would
109 contain the junk from the file that should not
110 be in memory
111 */
padzero(unsigned long elf_bss)112 static int padzero(unsigned long elf_bss)
113 {
114 unsigned long nbyte;
115
116 nbyte = ELF_PAGEOFFSET(elf_bss);
117 if (nbyte) {
118 nbyte = ELF_MIN_ALIGN - nbyte;
119 if (clear_user((void __user *) elf_bss, nbyte))
120 return -EFAULT;
121 }
122 return 0;
123 }
124
125 /* Let's use some macros to make this stack manipulation a little clearer */
126 #ifdef CONFIG_STACK_GROWSUP
127 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
128 #define STACK_ROUND(sp, items) \
129 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
130 #define STACK_ALLOC(sp, len) ({ \
131 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
132 old_sp; })
133 #else
134 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
135 #define STACK_ROUND(sp, items) \
136 (((unsigned long) (sp - items)) &~ 15UL)
137 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
138 #endif
139
140 #ifndef ELF_BASE_PLATFORM
141 /*
142 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
143 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
144 * will be copied to the user stack in the same manner as AT_PLATFORM.
145 */
146 #define ELF_BASE_PLATFORM NULL
147 #endif
148
149 static int
create_elf_tables(struct linux_binprm * bprm,struct elfhdr * exec,unsigned long load_addr,unsigned long interp_load_addr)150 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
151 unsigned long load_addr, unsigned long interp_load_addr)
152 {
153 unsigned long p = bprm->p;
154 int argc = bprm->argc;
155 int envc = bprm->envc;
156 elf_addr_t __user *argv;
157 elf_addr_t __user *envp;
158 elf_addr_t __user *sp;
159 elf_addr_t __user *u_platform;
160 elf_addr_t __user *u_base_platform;
161 elf_addr_t __user *u_rand_bytes;
162 const char *k_platform = ELF_PLATFORM;
163 const char *k_base_platform = ELF_BASE_PLATFORM;
164 unsigned char k_rand_bytes[16];
165 int items;
166 elf_addr_t *elf_info;
167 int ei_index = 0;
168 const struct cred *cred = current_cred();
169 struct vm_area_struct *vma;
170
171 /*
172 * In some cases (e.g. Hyper-Threading), we want to avoid L1
173 * evictions by the processes running on the same package. One
174 * thing we can do is to shuffle the initial stack for them.
175 */
176
177 p = arch_align_stack(p);
178
179 /*
180 * If this architecture has a platform capability string, copy it
181 * to userspace. In some cases (Sparc), this info is impossible
182 * for userspace to get any other way, in others (i386) it is
183 * merely difficult.
184 */
185 u_platform = NULL;
186 if (k_platform) {
187 size_t len = strlen(k_platform) + 1;
188
189 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
190 if (__copy_to_user(u_platform, k_platform, len))
191 return -EFAULT;
192 }
193
194 /*
195 * If this architecture has a "base" platform capability
196 * string, copy it to userspace.
197 */
198 u_base_platform = NULL;
199 if (k_base_platform) {
200 size_t len = strlen(k_base_platform) + 1;
201
202 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
203 if (__copy_to_user(u_base_platform, k_base_platform, len))
204 return -EFAULT;
205 }
206
207 /*
208 * Generate 16 random bytes for userspace PRNG seeding.
209 */
210 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
211 u_rand_bytes = (elf_addr_t __user *)
212 STACK_ALLOC(p, sizeof(k_rand_bytes));
213 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
214 return -EFAULT;
215
216 /* Create the ELF interpreter info */
217 elf_info = (elf_addr_t *)current->mm->saved_auxv;
218 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
219 #define NEW_AUX_ENT(id, val) \
220 do { \
221 elf_info[ei_index++] = id; \
222 elf_info[ei_index++] = val; \
223 } while (0)
224
225 #ifdef ARCH_DLINFO
226 /*
227 * ARCH_DLINFO must come first so PPC can do its special alignment of
228 * AUXV.
229 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
230 * ARCH_DLINFO changes
231 */
232 ARCH_DLINFO;
233 #endif
234 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
235 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
236 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
237 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
238 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
239 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
240 NEW_AUX_ENT(AT_BASE, interp_load_addr);
241 NEW_AUX_ENT(AT_FLAGS, 0);
242 NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
243 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
244 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
245 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
246 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
247 NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
248 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
249 #ifdef ELF_HWCAP2
250 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
251 #endif
252 NEW_AUX_ENT(AT_EXECFN, bprm->exec);
253 if (k_platform) {
254 NEW_AUX_ENT(AT_PLATFORM,
255 (elf_addr_t)(unsigned long)u_platform);
256 }
257 if (k_base_platform) {
258 NEW_AUX_ENT(AT_BASE_PLATFORM,
259 (elf_addr_t)(unsigned long)u_base_platform);
260 }
261 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
262 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
263 }
264 #undef NEW_AUX_ENT
265 /* AT_NULL is zero; clear the rest too */
266 memset(&elf_info[ei_index], 0,
267 sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
268
269 /* And advance past the AT_NULL entry. */
270 ei_index += 2;
271
272 sp = STACK_ADD(p, ei_index);
273
274 items = (argc + 1) + (envc + 1) + 1;
275 bprm->p = STACK_ROUND(sp, items);
276
277 /* Point sp at the lowest address on the stack */
278 #ifdef CONFIG_STACK_GROWSUP
279 sp = (elf_addr_t __user *)bprm->p - items - ei_index;
280 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
281 #else
282 sp = (elf_addr_t __user *)bprm->p;
283 #endif
284
285
286 /*
287 * Grow the stack manually; some architectures have a limit on how
288 * far ahead a user-space access may be in order to grow the stack.
289 */
290 vma = find_extend_vma(current->mm, bprm->p);
291 if (!vma)
292 return -EFAULT;
293
294 /* Now, let's put argc (and argv, envp if appropriate) on the stack */
295 if (__put_user(argc, sp++))
296 return -EFAULT;
297 argv = sp;
298 envp = argv + argc + 1;
299
300 /* Populate argv and envp */
301 p = current->mm->arg_end = current->mm->arg_start;
302 while (argc-- > 0) {
303 size_t len;
304 if (__put_user((elf_addr_t)p, argv++))
305 return -EFAULT;
306 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
307 if (!len || len > MAX_ARG_STRLEN)
308 return -EINVAL;
309 p += len;
310 }
311 if (__put_user(0, argv))
312 return -EFAULT;
313 current->mm->arg_end = current->mm->env_start = p;
314 while (envc-- > 0) {
315 size_t len;
316 if (__put_user((elf_addr_t)p, envp++))
317 return -EFAULT;
318 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
319 if (!len || len > MAX_ARG_STRLEN)
320 return -EINVAL;
321 p += len;
322 }
323 if (__put_user(0, envp))
324 return -EFAULT;
325 current->mm->env_end = p;
326
327 /* Put the elf_info on the stack in the right place. */
328 sp = (elf_addr_t __user *)envp + 1;
329 if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
330 return -EFAULT;
331 return 0;
332 }
333
334 #ifndef elf_map
335
elf_map(struct file * filep,unsigned long addr,struct elf_phdr * eppnt,int prot,int type,unsigned long total_size)336 static unsigned long elf_map(struct file *filep, unsigned long addr,
337 struct elf_phdr *eppnt, int prot, int type,
338 unsigned long total_size)
339 {
340 unsigned long map_addr;
341 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
342 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
343 addr = ELF_PAGESTART(addr);
344 size = ELF_PAGEALIGN(size);
345
346 /* mmap() will return -EINVAL if given a zero size, but a
347 * segment with zero filesize is perfectly valid */
348 if (!size)
349 return addr;
350
351 /*
352 * total_size is the size of the ELF (interpreter) image.
353 * The _first_ mmap needs to know the full size, otherwise
354 * randomization might put this image into an overlapping
355 * position with the ELF binary image. (since size < total_size)
356 * So we first map the 'big' image - and unmap the remainder at
357 * the end. (which unmap is needed for ELF images with holes.)
358 */
359 if (total_size) {
360 total_size = ELF_PAGEALIGN(total_size);
361 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
362 if (!BAD_ADDR(map_addr))
363 vm_munmap(map_addr+size, total_size-size);
364 } else
365 map_addr = vm_mmap(filep, addr, size, prot, type, off);
366
367 return(map_addr);
368 }
369
370 #endif /* !elf_map */
371
total_mapping_size(struct elf_phdr * cmds,int nr)372 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
373 {
374 int i, first_idx = -1, last_idx = -1;
375
376 for (i = 0; i < nr; i++) {
377 if (cmds[i].p_type == PT_LOAD) {
378 last_idx = i;
379 if (first_idx == -1)
380 first_idx = i;
381 }
382 }
383 if (first_idx == -1)
384 return 0;
385
386 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
387 ELF_PAGESTART(cmds[first_idx].p_vaddr);
388 }
389
390 /**
391 * load_elf_phdrs() - load ELF program headers
392 * @elf_ex: ELF header of the binary whose program headers should be loaded
393 * @elf_file: the opened ELF binary file
394 *
395 * Loads ELF program headers from the binary file elf_file, which has the ELF
396 * header pointed to by elf_ex, into a newly allocated array. The caller is
397 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure.
398 */
load_elf_phdrs(struct elfhdr * elf_ex,struct file * elf_file)399 static struct elf_phdr *load_elf_phdrs(struct elfhdr *elf_ex,
400 struct file *elf_file)
401 {
402 struct elf_phdr *elf_phdata = NULL;
403 int retval, size, err = -1;
404
405 /*
406 * If the size of this structure has changed, then punt, since
407 * we will be doing the wrong thing.
408 */
409 if (elf_ex->e_phentsize != sizeof(struct elf_phdr))
410 goto out;
411
412 /* Sanity check the number of program headers... */
413 if (elf_ex->e_phnum < 1 ||
414 elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
415 goto out;
416
417 /* ...and their total size. */
418 size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
419 if (size > ELF_MIN_ALIGN)
420 goto out;
421
422 elf_phdata = kmalloc(size, GFP_KERNEL);
423 if (!elf_phdata)
424 goto out;
425
426 /* Read in the program headers */
427 retval = kernel_read(elf_file, elf_ex->e_phoff,
428 (char *)elf_phdata, size);
429 if (retval != size) {
430 err = (retval < 0) ? retval : -EIO;
431 goto out;
432 }
433
434 /* Success! */
435 err = 0;
436 out:
437 if (err) {
438 kfree(elf_phdata);
439 elf_phdata = NULL;
440 }
441 return elf_phdata;
442 }
443
444 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE
445
446 /**
447 * struct arch_elf_state - arch-specific ELF loading state
448 *
449 * This structure is used to preserve architecture specific data during
450 * the loading of an ELF file, throughout the checking of architecture
451 * specific ELF headers & through to the point where the ELF load is
452 * known to be proceeding (ie. SET_PERSONALITY).
453 *
454 * This implementation is a dummy for architectures which require no
455 * specific state.
456 */
457 struct arch_elf_state {
458 };
459
460 #define INIT_ARCH_ELF_STATE {}
461
462 /**
463 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header
464 * @ehdr: The main ELF header
465 * @phdr: The program header to check
466 * @elf: The open ELF file
467 * @is_interp: True if the phdr is from the interpreter of the ELF being
468 * loaded, else false.
469 * @state: Architecture-specific state preserved throughout the process
470 * of loading the ELF.
471 *
472 * Inspects the program header phdr to validate its correctness and/or
473 * suitability for the system. Called once per ELF program header in the
474 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its
475 * interpreter.
476 *
477 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
478 * with that return code.
479 */
arch_elf_pt_proc(struct elfhdr * ehdr,struct elf_phdr * phdr,struct file * elf,bool is_interp,struct arch_elf_state * state)480 static inline int arch_elf_pt_proc(struct elfhdr *ehdr,
481 struct elf_phdr *phdr,
482 struct file *elf, bool is_interp,
483 struct arch_elf_state *state)
484 {
485 /* Dummy implementation, always proceed */
486 return 0;
487 }
488
489 /**
490 * arch_check_elf() - check an ELF executable
491 * @ehdr: The main ELF header
492 * @has_interp: True if the ELF has an interpreter, else false.
493 * @interp_ehdr: The interpreter's ELF header
494 * @state: Architecture-specific state preserved throughout the process
495 * of loading the ELF.
496 *
497 * Provides a final opportunity for architecture code to reject the loading
498 * of the ELF & cause an exec syscall to return an error. This is called after
499 * all program headers to be checked by arch_elf_pt_proc have been.
500 *
501 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
502 * with that return code.
503 */
arch_check_elf(struct elfhdr * ehdr,bool has_interp,struct elfhdr * interp_ehdr,struct arch_elf_state * state)504 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp,
505 struct elfhdr *interp_ehdr,
506 struct arch_elf_state *state)
507 {
508 /* Dummy implementation, always proceed */
509 return 0;
510 }
511
512 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */
513
514 /* This is much more generalized than the library routine read function,
515 so we keep this separate. Technically the library read function
516 is only provided so that we can read a.out libraries that have
517 an ELF header */
518
load_elf_interp(struct elfhdr * interp_elf_ex,struct file * interpreter,unsigned long * interp_map_addr,unsigned long no_base,struct elf_phdr * interp_elf_phdata)519 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
520 struct file *interpreter, unsigned long *interp_map_addr,
521 unsigned long no_base, struct elf_phdr *interp_elf_phdata)
522 {
523 struct elf_phdr *eppnt;
524 unsigned long load_addr = 0;
525 int load_addr_set = 0;
526 unsigned long last_bss = 0, elf_bss = 0;
527 unsigned long error = ~0UL;
528 unsigned long total_size;
529 int i;
530
531 /* First of all, some simple consistency checks */
532 if (interp_elf_ex->e_type != ET_EXEC &&
533 interp_elf_ex->e_type != ET_DYN)
534 goto out;
535 if (!elf_check_arch(interp_elf_ex))
536 goto out;
537 if (!interpreter->f_op->mmap)
538 goto out;
539
540 total_size = total_mapping_size(interp_elf_phdata,
541 interp_elf_ex->e_phnum);
542 if (!total_size) {
543 error = -EINVAL;
544 goto out;
545 }
546
547 eppnt = interp_elf_phdata;
548 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
549 if (eppnt->p_type == PT_LOAD) {
550 int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
551 int elf_prot = 0;
552 unsigned long vaddr = 0;
553 unsigned long k, map_addr;
554
555 if (eppnt->p_flags & PF_R)
556 elf_prot = PROT_READ;
557 if (eppnt->p_flags & PF_W)
558 elf_prot |= PROT_WRITE;
559 if (eppnt->p_flags & PF_X)
560 elf_prot |= PROT_EXEC;
561 vaddr = eppnt->p_vaddr;
562 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
563 elf_type |= MAP_FIXED;
564 else if (no_base && interp_elf_ex->e_type == ET_DYN)
565 load_addr = -vaddr;
566
567 map_addr = elf_map(interpreter, load_addr + vaddr,
568 eppnt, elf_prot, elf_type, total_size);
569 total_size = 0;
570 if (!*interp_map_addr)
571 *interp_map_addr = map_addr;
572 error = map_addr;
573 if (BAD_ADDR(map_addr))
574 goto out;
575
576 if (!load_addr_set &&
577 interp_elf_ex->e_type == ET_DYN) {
578 load_addr = map_addr - ELF_PAGESTART(vaddr);
579 load_addr_set = 1;
580 }
581
582 /*
583 * Check to see if the section's size will overflow the
584 * allowed task size. Note that p_filesz must always be
585 * <= p_memsize so it's only necessary to check p_memsz.
586 */
587 k = load_addr + eppnt->p_vaddr;
588 if (BAD_ADDR(k) ||
589 eppnt->p_filesz > eppnt->p_memsz ||
590 eppnt->p_memsz > TASK_SIZE ||
591 TASK_SIZE - eppnt->p_memsz < k) {
592 error = -ENOMEM;
593 goto out;
594 }
595
596 /*
597 * Find the end of the file mapping for this phdr, and
598 * keep track of the largest address we see for this.
599 */
600 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
601 if (k > elf_bss)
602 elf_bss = k;
603
604 /*
605 * Do the same thing for the memory mapping - between
606 * elf_bss and last_bss is the bss section.
607 */
608 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz;
609 if (k > last_bss)
610 last_bss = k;
611 }
612 }
613
614 /*
615 * Now fill out the bss section: first pad the last page from
616 * the file up to the page boundary, and zero it from elf_bss
617 * up to the end of the page.
618 */
619 if (padzero(elf_bss)) {
620 error = -EFAULT;
621 goto out;
622 }
623 /*
624 * Next, align both the file and mem bss up to the page size,
625 * since this is where elf_bss was just zeroed up to, and where
626 * last_bss will end after the vm_brk() below.
627 */
628 elf_bss = ELF_PAGEALIGN(elf_bss);
629 last_bss = ELF_PAGEALIGN(last_bss);
630 /* Finally, if there is still more bss to allocate, do it. */
631 if (last_bss > elf_bss) {
632 error = vm_brk(elf_bss, last_bss - elf_bss);
633 if (error)
634 goto out;
635 }
636
637 error = load_addr;
638 out:
639 return error;
640 }
641
642 /*
643 * These are the functions used to load ELF style executables and shared
644 * libraries. There is no binary dependent code anywhere else.
645 */
646
647 #ifndef STACK_RND_MASK
648 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */
649 #endif
650
randomize_stack_top(unsigned long stack_top)651 static unsigned long randomize_stack_top(unsigned long stack_top)
652 {
653 unsigned long random_variable = 0;
654
655 if ((current->flags & PF_RANDOMIZE) &&
656 !(current->personality & ADDR_NO_RANDOMIZE)) {
657 random_variable = get_random_long();
658 random_variable &= STACK_RND_MASK;
659 random_variable <<= PAGE_SHIFT;
660 }
661 #ifdef CONFIG_STACK_GROWSUP
662 return PAGE_ALIGN(stack_top) + random_variable;
663 #else
664 return PAGE_ALIGN(stack_top) - random_variable;
665 #endif
666 }
667
load_elf_binary(struct linux_binprm * bprm)668 static int load_elf_binary(struct linux_binprm *bprm)
669 {
670 struct file *interpreter = NULL; /* to shut gcc up */
671 unsigned long load_addr = 0, load_bias = 0;
672 int load_addr_set = 0;
673 char * elf_interpreter = NULL;
674 unsigned long error;
675 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
676 unsigned long elf_bss, elf_brk;
677 int retval, i;
678 unsigned long elf_entry;
679 unsigned long interp_load_addr = 0;
680 unsigned long start_code, end_code, start_data, end_data;
681 unsigned long reloc_func_desc __maybe_unused = 0;
682 int executable_stack = EXSTACK_DEFAULT;
683 struct pt_regs *regs = current_pt_regs();
684 struct {
685 struct elfhdr elf_ex;
686 struct elfhdr interp_elf_ex;
687 } *loc;
688 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
689
690 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
691 if (!loc) {
692 retval = -ENOMEM;
693 goto out_ret;
694 }
695
696 /* Get the exec-header */
697 loc->elf_ex = *((struct elfhdr *)bprm->buf);
698
699 retval = -ENOEXEC;
700 /* First of all, some simple consistency checks */
701 if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
702 goto out;
703
704 if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
705 goto out;
706 if (!elf_check_arch(&loc->elf_ex))
707 goto out;
708 if (!bprm->file->f_op->mmap)
709 goto out;
710
711 elf_phdata = load_elf_phdrs(&loc->elf_ex, bprm->file);
712 if (!elf_phdata)
713 goto out;
714
715 elf_ppnt = elf_phdata;
716 elf_bss = 0;
717 elf_brk = 0;
718
719 start_code = ~0UL;
720 end_code = 0;
721 start_data = 0;
722 end_data = 0;
723
724 for (i = 0; i < loc->elf_ex.e_phnum; i++) {
725 if (elf_ppnt->p_type == PT_INTERP) {
726 /* This is the program interpreter used for
727 * shared libraries - for now assume that this
728 * is an a.out format binary
729 */
730 retval = -ENOEXEC;
731 if (elf_ppnt->p_filesz > PATH_MAX ||
732 elf_ppnt->p_filesz < 2)
733 goto out_free_ph;
734
735 retval = -ENOMEM;
736 elf_interpreter = kmalloc(elf_ppnt->p_filesz,
737 GFP_KERNEL);
738 if (!elf_interpreter)
739 goto out_free_ph;
740
741 retval = kernel_read(bprm->file, elf_ppnt->p_offset,
742 elf_interpreter,
743 elf_ppnt->p_filesz);
744 if (retval != elf_ppnt->p_filesz) {
745 if (retval >= 0)
746 retval = -EIO;
747 goto out_free_interp;
748 }
749 /* make sure path is NULL terminated */
750 retval = -ENOEXEC;
751 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
752 goto out_free_interp;
753
754 interpreter = open_exec(elf_interpreter);
755 retval = PTR_ERR(interpreter);
756 if (IS_ERR(interpreter))
757 goto out_free_interp;
758
759 /*
760 * If the binary is not readable then enforce
761 * mm->dumpable = 0 regardless of the interpreter's
762 * permissions.
763 */
764 would_dump(bprm, interpreter);
765
766 /* Get the exec headers */
767 retval = kernel_read(interpreter, 0,
768 (void *)&loc->interp_elf_ex,
769 sizeof(loc->interp_elf_ex));
770 if (retval != sizeof(loc->interp_elf_ex)) {
771 if (retval >= 0)
772 retval = -EIO;
773 goto out_free_dentry;
774 }
775
776 break;
777 }
778 elf_ppnt++;
779 }
780
781 elf_ppnt = elf_phdata;
782 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
783 switch (elf_ppnt->p_type) {
784 case PT_GNU_STACK:
785 if (elf_ppnt->p_flags & PF_X)
786 executable_stack = EXSTACK_ENABLE_X;
787 else
788 executable_stack = EXSTACK_DISABLE_X;
789 break;
790
791 case PT_LOPROC ... PT_HIPROC:
792 retval = arch_elf_pt_proc(&loc->elf_ex, elf_ppnt,
793 bprm->file, false,
794 &arch_state);
795 if (retval)
796 goto out_free_dentry;
797 break;
798 }
799
800 /* Some simple consistency checks for the interpreter */
801 if (elf_interpreter) {
802 retval = -ELIBBAD;
803 /* Not an ELF interpreter */
804 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
805 goto out_free_dentry;
806 /* Verify the interpreter has a valid arch */
807 if (!elf_check_arch(&loc->interp_elf_ex))
808 goto out_free_dentry;
809
810 /* Load the interpreter program headers */
811 interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex,
812 interpreter);
813 if (!interp_elf_phdata)
814 goto out_free_dentry;
815
816 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */
817 elf_ppnt = interp_elf_phdata;
818 for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++)
819 switch (elf_ppnt->p_type) {
820 case PT_LOPROC ... PT_HIPROC:
821 retval = arch_elf_pt_proc(&loc->interp_elf_ex,
822 elf_ppnt, interpreter,
823 true, &arch_state);
824 if (retval)
825 goto out_free_dentry;
826 break;
827 }
828 }
829
830 /*
831 * Allow arch code to reject the ELF at this point, whilst it's
832 * still possible to return an error to the code that invoked
833 * the exec syscall.
834 */
835 retval = arch_check_elf(&loc->elf_ex,
836 !!interpreter, &loc->interp_elf_ex,
837 &arch_state);
838 if (retval)
839 goto out_free_dentry;
840
841 /* Flush all traces of the currently running executable */
842 retval = flush_old_exec(bprm);
843 if (retval)
844 goto out_free_dentry;
845
846 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
847 may depend on the personality. */
848 SET_PERSONALITY2(loc->elf_ex, &arch_state);
849 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
850 current->personality |= READ_IMPLIES_EXEC;
851
852 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
853 current->flags |= PF_RANDOMIZE;
854
855 setup_new_exec(bprm);
856 install_exec_creds(bprm);
857
858 /* Do this so that we can load the interpreter, if need be. We will
859 change some of these later */
860 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
861 executable_stack);
862 if (retval < 0)
863 goto out_free_dentry;
864
865 current->mm->start_stack = bprm->p;
866
867 /* Now we do a little grungy work by mmapping the ELF image into
868 the correct location in memory. */
869 for(i = 0, elf_ppnt = elf_phdata;
870 i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
871 int elf_prot = 0, elf_flags;
872 unsigned long k, vaddr;
873 unsigned long total_size = 0;
874
875 if (elf_ppnt->p_type != PT_LOAD)
876 continue;
877
878 if (unlikely (elf_brk > elf_bss)) {
879 unsigned long nbyte;
880
881 /* There was a PT_LOAD segment with p_memsz > p_filesz
882 before this one. Map anonymous pages, if needed,
883 and clear the area. */
884 retval = set_brk(elf_bss + load_bias,
885 elf_brk + load_bias);
886 if (retval)
887 goto out_free_dentry;
888 nbyte = ELF_PAGEOFFSET(elf_bss);
889 if (nbyte) {
890 nbyte = ELF_MIN_ALIGN - nbyte;
891 if (nbyte > elf_brk - elf_bss)
892 nbyte = elf_brk - elf_bss;
893 if (clear_user((void __user *)elf_bss +
894 load_bias, nbyte)) {
895 /*
896 * This bss-zeroing can fail if the ELF
897 * file specifies odd protections. So
898 * we don't check the return value
899 */
900 }
901 }
902 }
903
904 if (elf_ppnt->p_flags & PF_R)
905 elf_prot |= PROT_READ;
906 if (elf_ppnt->p_flags & PF_W)
907 elf_prot |= PROT_WRITE;
908 if (elf_ppnt->p_flags & PF_X)
909 elf_prot |= PROT_EXEC;
910
911 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
912
913 vaddr = elf_ppnt->p_vaddr;
914 /*
915 * If we are loading ET_EXEC or we have already performed
916 * the ET_DYN load_addr calculations, proceed normally.
917 */
918 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
919 elf_flags |= MAP_FIXED;
920 } else if (loc->elf_ex.e_type == ET_DYN) {
921 /*
922 * This logic is run once for the first LOAD Program
923 * Header for ET_DYN binaries to calculate the
924 * randomization (load_bias) for all the LOAD
925 * Program Headers, and to calculate the entire
926 * size of the ELF mapping (total_size). (Note that
927 * load_addr_set is set to true later once the
928 * initial mapping is performed.)
929 *
930 * There are effectively two types of ET_DYN
931 * binaries: programs (i.e. PIE: ET_DYN with INTERP)
932 * and loaders (ET_DYN without INTERP, since they
933 * _are_ the ELF interpreter). The loaders must
934 * be loaded away from programs since the program
935 * may otherwise collide with the loader (especially
936 * for ET_EXEC which does not have a randomized
937 * position). For example to handle invocations of
938 * "./ld.so someprog" to test out a new version of
939 * the loader, the subsequent program that the
940 * loader loads must avoid the loader itself, so
941 * they cannot share the same load range. Sufficient
942 * room for the brk must be allocated with the
943 * loader as well, since brk must be available with
944 * the loader.
945 *
946 * Therefore, programs are loaded offset from
947 * ELF_ET_DYN_BASE and loaders are loaded into the
948 * independently randomized mmap region (0 load_bias
949 * without MAP_FIXED).
950 */
951 if (elf_interpreter) {
952 load_bias = ELF_ET_DYN_BASE;
953 if (current->flags & PF_RANDOMIZE)
954 load_bias += arch_mmap_rnd();
955 elf_flags |= MAP_FIXED;
956 } else
957 load_bias = 0;
958
959 /*
960 * Since load_bias is used for all subsequent loading
961 * calculations, we must lower it by the first vaddr
962 * so that the remaining calculations based on the
963 * ELF vaddrs will be correctly offset. The result
964 * is then page aligned.
965 */
966 load_bias = ELF_PAGESTART(load_bias - vaddr);
967
968 total_size = total_mapping_size(elf_phdata,
969 loc->elf_ex.e_phnum);
970 if (!total_size) {
971 retval = -EINVAL;
972 goto out_free_dentry;
973 }
974 }
975
976 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
977 elf_prot, elf_flags, total_size);
978 if (BAD_ADDR(error)) {
979 retval = IS_ERR((void *)error) ?
980 PTR_ERR((void*)error) : -EINVAL;
981 goto out_free_dentry;
982 }
983
984 if (!load_addr_set) {
985 load_addr_set = 1;
986 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
987 if (loc->elf_ex.e_type == ET_DYN) {
988 load_bias += error -
989 ELF_PAGESTART(load_bias + vaddr);
990 load_addr += load_bias;
991 reloc_func_desc = load_bias;
992 }
993 }
994 k = elf_ppnt->p_vaddr;
995 if (k < start_code)
996 start_code = k;
997 if (start_data < k)
998 start_data = k;
999
1000 /*
1001 * Check to see if the section's size will overflow the
1002 * allowed task size. Note that p_filesz must always be
1003 * <= p_memsz so it is only necessary to check p_memsz.
1004 */
1005 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
1006 elf_ppnt->p_memsz > TASK_SIZE ||
1007 TASK_SIZE - elf_ppnt->p_memsz < k) {
1008 /* set_brk can never work. Avoid overflows. */
1009 retval = -EINVAL;
1010 goto out_free_dentry;
1011 }
1012
1013 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
1014
1015 if (k > elf_bss)
1016 elf_bss = k;
1017 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
1018 end_code = k;
1019 if (end_data < k)
1020 end_data = k;
1021 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
1022 if (k > elf_brk)
1023 elf_brk = k;
1024 }
1025
1026 loc->elf_ex.e_entry += load_bias;
1027 elf_bss += load_bias;
1028 elf_brk += load_bias;
1029 start_code += load_bias;
1030 end_code += load_bias;
1031 start_data += load_bias;
1032 end_data += load_bias;
1033
1034 /* Calling set_brk effectively mmaps the pages that we need
1035 * for the bss and break sections. We must do this before
1036 * mapping in the interpreter, to make sure it doesn't wind
1037 * up getting placed where the bss needs to go.
1038 */
1039 retval = set_brk(elf_bss, elf_brk);
1040 if (retval)
1041 goto out_free_dentry;
1042 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
1043 retval = -EFAULT; /* Nobody gets to see this, but.. */
1044 goto out_free_dentry;
1045 }
1046
1047 if (elf_interpreter) {
1048 unsigned long interp_map_addr = 0;
1049
1050 elf_entry = load_elf_interp(&loc->interp_elf_ex,
1051 interpreter,
1052 &interp_map_addr,
1053 load_bias, interp_elf_phdata);
1054 if (!IS_ERR((void *)elf_entry)) {
1055 /*
1056 * load_elf_interp() returns relocation
1057 * adjustment
1058 */
1059 interp_load_addr = elf_entry;
1060 elf_entry += loc->interp_elf_ex.e_entry;
1061 }
1062 if (BAD_ADDR(elf_entry)) {
1063 retval = IS_ERR((void *)elf_entry) ?
1064 (int)elf_entry : -EINVAL;
1065 goto out_free_dentry;
1066 }
1067 reloc_func_desc = interp_load_addr;
1068
1069 allow_write_access(interpreter);
1070 fput(interpreter);
1071 kfree(elf_interpreter);
1072 } else {
1073 elf_entry = loc->elf_ex.e_entry;
1074 if (BAD_ADDR(elf_entry)) {
1075 retval = -EINVAL;
1076 goto out_free_dentry;
1077 }
1078 }
1079
1080 kfree(interp_elf_phdata);
1081 kfree(elf_phdata);
1082
1083 set_binfmt(&elf_format);
1084
1085 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
1086 retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
1087 if (retval < 0)
1088 goto out;
1089 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
1090
1091 retval = create_elf_tables(bprm, &loc->elf_ex,
1092 load_addr, interp_load_addr);
1093 if (retval < 0)
1094 goto out;
1095 /* N.B. passed_fileno might not be initialized? */
1096 current->mm->end_code = end_code;
1097 current->mm->start_code = start_code;
1098 current->mm->start_data = start_data;
1099 current->mm->end_data = end_data;
1100 current->mm->start_stack = bprm->p;
1101
1102 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
1103 current->mm->brk = current->mm->start_brk =
1104 arch_randomize_brk(current->mm);
1105 #ifdef compat_brk_randomized
1106 current->brk_randomized = 1;
1107 #endif
1108 }
1109
1110 if (current->personality & MMAP_PAGE_ZERO) {
1111 /* Why this, you ask??? Well SVr4 maps page 0 as read-only,
1112 and some applications "depend" upon this behavior.
1113 Since we do not have the power to recompile these, we
1114 emulate the SVr4 behavior. Sigh. */
1115 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
1116 MAP_FIXED | MAP_PRIVATE, 0);
1117 }
1118
1119 #ifdef ELF_PLAT_INIT
1120 /*
1121 * The ABI may specify that certain registers be set up in special
1122 * ways (on i386 %edx is the address of a DT_FINI function, for
1123 * example. In addition, it may also specify (eg, PowerPC64 ELF)
1124 * that the e_entry field is the address of the function descriptor
1125 * for the startup routine, rather than the address of the startup
1126 * routine itself. This macro performs whatever initialization to
1127 * the regs structure is required as well as any relocations to the
1128 * function descriptor entries when executing dynamically links apps.
1129 */
1130 ELF_PLAT_INIT(regs, reloc_func_desc);
1131 #endif
1132
1133 start_thread(regs, elf_entry, bprm->p);
1134 retval = 0;
1135 out:
1136 kfree(loc);
1137 out_ret:
1138 return retval;
1139
1140 /* error cleanup */
1141 out_free_dentry:
1142 kfree(interp_elf_phdata);
1143 allow_write_access(interpreter);
1144 if (interpreter)
1145 fput(interpreter);
1146 out_free_interp:
1147 kfree(elf_interpreter);
1148 out_free_ph:
1149 kfree(elf_phdata);
1150 goto out;
1151 }
1152
1153 #ifdef CONFIG_USELIB
1154 /* This is really simpleminded and specialized - we are loading an
1155 a.out library that is given an ELF header. */
load_elf_library(struct file * file)1156 static int load_elf_library(struct file *file)
1157 {
1158 struct elf_phdr *elf_phdata;
1159 struct elf_phdr *eppnt;
1160 unsigned long elf_bss, bss, len;
1161 int retval, error, i, j;
1162 struct elfhdr elf_ex;
1163
1164 error = -ENOEXEC;
1165 retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1166 if (retval != sizeof(elf_ex))
1167 goto out;
1168
1169 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1170 goto out;
1171
1172 /* First of all, some simple consistency checks */
1173 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1174 !elf_check_arch(&elf_ex) || !file->f_op->mmap)
1175 goto out;
1176
1177 /* Now read in all of the header information */
1178
1179 j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1180 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1181
1182 error = -ENOMEM;
1183 elf_phdata = kmalloc(j, GFP_KERNEL);
1184 if (!elf_phdata)
1185 goto out;
1186
1187 eppnt = elf_phdata;
1188 error = -ENOEXEC;
1189 retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1190 if (retval != j)
1191 goto out_free_ph;
1192
1193 for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1194 if ((eppnt + i)->p_type == PT_LOAD)
1195 j++;
1196 if (j != 1)
1197 goto out_free_ph;
1198
1199 while (eppnt->p_type != PT_LOAD)
1200 eppnt++;
1201
1202 /* Now use mmap to map the library into memory. */
1203 error = vm_mmap(file,
1204 ELF_PAGESTART(eppnt->p_vaddr),
1205 (eppnt->p_filesz +
1206 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1207 PROT_READ | PROT_WRITE | PROT_EXEC,
1208 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1209 (eppnt->p_offset -
1210 ELF_PAGEOFFSET(eppnt->p_vaddr)));
1211 if (error != ELF_PAGESTART(eppnt->p_vaddr))
1212 goto out_free_ph;
1213
1214 elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1215 if (padzero(elf_bss)) {
1216 error = -EFAULT;
1217 goto out_free_ph;
1218 }
1219
1220 len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1221 ELF_MIN_ALIGN - 1);
1222 bss = eppnt->p_memsz + eppnt->p_vaddr;
1223 if (bss > len) {
1224 error = vm_brk(len, bss - len);
1225 if (error)
1226 goto out_free_ph;
1227 }
1228 error = 0;
1229
1230 out_free_ph:
1231 kfree(elf_phdata);
1232 out:
1233 return error;
1234 }
1235 #endif /* #ifdef CONFIG_USELIB */
1236
1237 #ifdef CONFIG_ELF_CORE
1238 /*
1239 * ELF core dumper
1240 *
1241 * Modelled on fs/exec.c:aout_core_dump()
1242 * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1243 */
1244
1245 /*
1246 * The purpose of always_dump_vma() is to make sure that special kernel mappings
1247 * that are useful for post-mortem analysis are included in every core dump.
1248 * In that way we ensure that the core dump is fully interpretable later
1249 * without matching up the same kernel and hardware config to see what PC values
1250 * meant. These special mappings include - vDSO, vsyscall, and other
1251 * architecture specific mappings
1252 */
always_dump_vma(struct vm_area_struct * vma)1253 static bool always_dump_vma(struct vm_area_struct *vma)
1254 {
1255 /* Any vsyscall mappings? */
1256 if (vma == get_gate_vma(vma->vm_mm))
1257 return true;
1258
1259 /*
1260 * Assume that all vmas with a .name op should always be dumped.
1261 * If this changes, a new vm_ops field can easily be added.
1262 */
1263 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma))
1264 return true;
1265
1266 /*
1267 * arch_vma_name() returns non-NULL for special architecture mappings,
1268 * such as vDSO sections.
1269 */
1270 if (arch_vma_name(vma))
1271 return true;
1272
1273 return false;
1274 }
1275
1276 /*
1277 * Decide what to dump of a segment, part, all or none.
1278 */
vma_dump_size(struct vm_area_struct * vma,unsigned long mm_flags)1279 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1280 unsigned long mm_flags)
1281 {
1282 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
1283
1284 /* always dump the vdso and vsyscall sections */
1285 if (always_dump_vma(vma))
1286 goto whole;
1287
1288 if (vma->vm_flags & VM_DONTDUMP)
1289 return 0;
1290
1291 /* support for DAX */
1292 if (vma_is_dax(vma)) {
1293 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED))
1294 goto whole;
1295 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE))
1296 goto whole;
1297 return 0;
1298 }
1299
1300 /* Hugetlb memory check */
1301 if (vma->vm_flags & VM_HUGETLB) {
1302 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1303 goto whole;
1304 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1305 goto whole;
1306 return 0;
1307 }
1308
1309 /* Do not dump I/O mapped devices or special mappings */
1310 if (vma->vm_flags & VM_IO)
1311 return 0;
1312
1313 /* By default, dump shared memory if mapped from an anonymous file. */
1314 if (vma->vm_flags & VM_SHARED) {
1315 if (file_inode(vma->vm_file)->i_nlink == 0 ?
1316 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1317 goto whole;
1318 return 0;
1319 }
1320
1321 /* Dump segments that have been written to. */
1322 if (vma->anon_vma && FILTER(ANON_PRIVATE))
1323 goto whole;
1324 if (vma->vm_file == NULL)
1325 return 0;
1326
1327 if (FILTER(MAPPED_PRIVATE))
1328 goto whole;
1329
1330 /*
1331 * If this looks like the beginning of a DSO or executable mapping,
1332 * check for an ELF header. If we find one, dump the first page to
1333 * aid in determining what was mapped here.
1334 */
1335 if (FILTER(ELF_HEADERS) &&
1336 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1337 u32 __user *header = (u32 __user *) vma->vm_start;
1338 u32 word;
1339 mm_segment_t fs = get_fs();
1340 /*
1341 * Doing it this way gets the constant folded by GCC.
1342 */
1343 union {
1344 u32 cmp;
1345 char elfmag[SELFMAG];
1346 } magic;
1347 BUILD_BUG_ON(SELFMAG != sizeof word);
1348 magic.elfmag[EI_MAG0] = ELFMAG0;
1349 magic.elfmag[EI_MAG1] = ELFMAG1;
1350 magic.elfmag[EI_MAG2] = ELFMAG2;
1351 magic.elfmag[EI_MAG3] = ELFMAG3;
1352 /*
1353 * Switch to the user "segment" for get_user(),
1354 * then put back what elf_core_dump() had in place.
1355 */
1356 set_fs(USER_DS);
1357 if (unlikely(get_user(word, header)))
1358 word = 0;
1359 set_fs(fs);
1360 if (word == magic.cmp)
1361 return PAGE_SIZE;
1362 }
1363
1364 #undef FILTER
1365
1366 return 0;
1367
1368 whole:
1369 return vma->vm_end - vma->vm_start;
1370 }
1371
1372 /* An ELF note in memory */
1373 struct memelfnote
1374 {
1375 const char *name;
1376 int type;
1377 unsigned int datasz;
1378 void *data;
1379 };
1380
notesize(struct memelfnote * en)1381 static int notesize(struct memelfnote *en)
1382 {
1383 int sz;
1384
1385 sz = sizeof(struct elf_note);
1386 sz += roundup(strlen(en->name) + 1, 4);
1387 sz += roundup(en->datasz, 4);
1388
1389 return sz;
1390 }
1391
writenote(struct memelfnote * men,struct coredump_params * cprm)1392 static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1393 {
1394 struct elf_note en;
1395 en.n_namesz = strlen(men->name) + 1;
1396 en.n_descsz = men->datasz;
1397 en.n_type = men->type;
1398
1399 return dump_emit(cprm, &en, sizeof(en)) &&
1400 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1401 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1402 }
1403
fill_elf_header(struct elfhdr * elf,int segs,u16 machine,u32 flags)1404 static void fill_elf_header(struct elfhdr *elf, int segs,
1405 u16 machine, u32 flags)
1406 {
1407 memset(elf, 0, sizeof(*elf));
1408
1409 memcpy(elf->e_ident, ELFMAG, SELFMAG);
1410 elf->e_ident[EI_CLASS] = ELF_CLASS;
1411 elf->e_ident[EI_DATA] = ELF_DATA;
1412 elf->e_ident[EI_VERSION] = EV_CURRENT;
1413 elf->e_ident[EI_OSABI] = ELF_OSABI;
1414
1415 elf->e_type = ET_CORE;
1416 elf->e_machine = machine;
1417 elf->e_version = EV_CURRENT;
1418 elf->e_phoff = sizeof(struct elfhdr);
1419 elf->e_flags = flags;
1420 elf->e_ehsize = sizeof(struct elfhdr);
1421 elf->e_phentsize = sizeof(struct elf_phdr);
1422 elf->e_phnum = segs;
1423
1424 return;
1425 }
1426
fill_elf_note_phdr(struct elf_phdr * phdr,int sz,loff_t offset)1427 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1428 {
1429 phdr->p_type = PT_NOTE;
1430 phdr->p_offset = offset;
1431 phdr->p_vaddr = 0;
1432 phdr->p_paddr = 0;
1433 phdr->p_filesz = sz;
1434 phdr->p_memsz = 0;
1435 phdr->p_flags = 0;
1436 phdr->p_align = 0;
1437 return;
1438 }
1439
fill_note(struct memelfnote * note,const char * name,int type,unsigned int sz,void * data)1440 static void fill_note(struct memelfnote *note, const char *name, int type,
1441 unsigned int sz, void *data)
1442 {
1443 note->name = name;
1444 note->type = type;
1445 note->datasz = sz;
1446 note->data = data;
1447 return;
1448 }
1449
1450 /*
1451 * fill up all the fields in prstatus from the given task struct, except
1452 * registers which need to be filled up separately.
1453 */
fill_prstatus(struct elf_prstatus * prstatus,struct task_struct * p,long signr)1454 static void fill_prstatus(struct elf_prstatus *prstatus,
1455 struct task_struct *p, long signr)
1456 {
1457 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1458 prstatus->pr_sigpend = p->pending.signal.sig[0];
1459 prstatus->pr_sighold = p->blocked.sig[0];
1460 rcu_read_lock();
1461 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1462 rcu_read_unlock();
1463 prstatus->pr_pid = task_pid_vnr(p);
1464 prstatus->pr_pgrp = task_pgrp_vnr(p);
1465 prstatus->pr_sid = task_session_vnr(p);
1466 if (thread_group_leader(p)) {
1467 struct task_cputime cputime;
1468
1469 /*
1470 * This is the record for the group leader. It shows the
1471 * group-wide total, not its individual thread total.
1472 */
1473 thread_group_cputime(p, &cputime);
1474 cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1475 cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1476 } else {
1477 cputime_t utime, stime;
1478
1479 task_cputime(p, &utime, &stime);
1480 cputime_to_timeval(utime, &prstatus->pr_utime);
1481 cputime_to_timeval(stime, &prstatus->pr_stime);
1482 }
1483 cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1484 cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1485 }
1486
fill_psinfo(struct elf_prpsinfo * psinfo,struct task_struct * p,struct mm_struct * mm)1487 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1488 struct mm_struct *mm)
1489 {
1490 const struct cred *cred;
1491 unsigned int i, len;
1492
1493 /* first copy the parameters from user space */
1494 memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1495
1496 len = mm->arg_end - mm->arg_start;
1497 if (len >= ELF_PRARGSZ)
1498 len = ELF_PRARGSZ-1;
1499 if (copy_from_user(&psinfo->pr_psargs,
1500 (const char __user *)mm->arg_start, len))
1501 return -EFAULT;
1502 for(i = 0; i < len; i++)
1503 if (psinfo->pr_psargs[i] == 0)
1504 psinfo->pr_psargs[i] = ' ';
1505 psinfo->pr_psargs[len] = 0;
1506
1507 rcu_read_lock();
1508 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1509 rcu_read_unlock();
1510 psinfo->pr_pid = task_pid_vnr(p);
1511 psinfo->pr_pgrp = task_pgrp_vnr(p);
1512 psinfo->pr_sid = task_session_vnr(p);
1513
1514 i = p->state ? ffz(~p->state) + 1 : 0;
1515 psinfo->pr_state = i;
1516 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1517 psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1518 psinfo->pr_nice = task_nice(p);
1519 psinfo->pr_flag = p->flags;
1520 rcu_read_lock();
1521 cred = __task_cred(p);
1522 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1523 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1524 rcu_read_unlock();
1525 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1526
1527 return 0;
1528 }
1529
fill_auxv_note(struct memelfnote * note,struct mm_struct * mm)1530 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1531 {
1532 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1533 int i = 0;
1534 do
1535 i += 2;
1536 while (auxv[i - 2] != AT_NULL);
1537 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1538 }
1539
fill_siginfo_note(struct memelfnote * note,user_siginfo_t * csigdata,const siginfo_t * siginfo)1540 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1541 const siginfo_t *siginfo)
1542 {
1543 mm_segment_t old_fs = get_fs();
1544 set_fs(KERNEL_DS);
1545 copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo);
1546 set_fs(old_fs);
1547 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1548 }
1549
1550 #define MAX_FILE_NOTE_SIZE (4*1024*1024)
1551 /*
1552 * Format of NT_FILE note:
1553 *
1554 * long count -- how many files are mapped
1555 * long page_size -- units for file_ofs
1556 * array of [COUNT] elements of
1557 * long start
1558 * long end
1559 * long file_ofs
1560 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1561 */
fill_files_note(struct memelfnote * note)1562 static int fill_files_note(struct memelfnote *note)
1563 {
1564 struct vm_area_struct *vma;
1565 unsigned count, size, names_ofs, remaining, n;
1566 user_long_t *data;
1567 user_long_t *start_end_ofs;
1568 char *name_base, *name_curpos;
1569
1570 /* *Estimated* file count and total data size needed */
1571 count = current->mm->map_count;
1572 size = count * 64;
1573
1574 names_ofs = (2 + 3 * count) * sizeof(data[0]);
1575 alloc:
1576 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
1577 return -EINVAL;
1578 size = round_up(size, PAGE_SIZE);
1579 data = vmalloc(size);
1580 if (!data)
1581 return -ENOMEM;
1582
1583 start_end_ofs = data + 2;
1584 name_base = name_curpos = ((char *)data) + names_ofs;
1585 remaining = size - names_ofs;
1586 count = 0;
1587 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1588 struct file *file;
1589 const char *filename;
1590
1591 file = vma->vm_file;
1592 if (!file)
1593 continue;
1594 filename = file_path(file, name_curpos, remaining);
1595 if (IS_ERR(filename)) {
1596 if (PTR_ERR(filename) == -ENAMETOOLONG) {
1597 vfree(data);
1598 size = size * 5 / 4;
1599 goto alloc;
1600 }
1601 continue;
1602 }
1603
1604 /* file_path() fills at the end, move name down */
1605 /* n = strlen(filename) + 1: */
1606 n = (name_curpos + remaining) - filename;
1607 remaining = filename - name_curpos;
1608 memmove(name_curpos, filename, n);
1609 name_curpos += n;
1610
1611 *start_end_ofs++ = vma->vm_start;
1612 *start_end_ofs++ = vma->vm_end;
1613 *start_end_ofs++ = vma->vm_pgoff;
1614 count++;
1615 }
1616
1617 /* Now we know exact count of files, can store it */
1618 data[0] = count;
1619 data[1] = PAGE_SIZE;
1620 /*
1621 * Count usually is less than current->mm->map_count,
1622 * we need to move filenames down.
1623 */
1624 n = current->mm->map_count - count;
1625 if (n != 0) {
1626 unsigned shift_bytes = n * 3 * sizeof(data[0]);
1627 memmove(name_base - shift_bytes, name_base,
1628 name_curpos - name_base);
1629 name_curpos -= shift_bytes;
1630 }
1631
1632 size = name_curpos - (char *)data;
1633 fill_note(note, "CORE", NT_FILE, size, data);
1634 return 0;
1635 }
1636
1637 #ifdef CORE_DUMP_USE_REGSET
1638 #include <linux/regset.h>
1639
1640 struct elf_thread_core_info {
1641 struct elf_thread_core_info *next;
1642 struct task_struct *task;
1643 struct elf_prstatus prstatus;
1644 struct memelfnote notes[0];
1645 };
1646
1647 struct elf_note_info {
1648 struct elf_thread_core_info *thread;
1649 struct memelfnote psinfo;
1650 struct memelfnote signote;
1651 struct memelfnote auxv;
1652 struct memelfnote files;
1653 user_siginfo_t csigdata;
1654 size_t size;
1655 int thread_notes;
1656 };
1657
1658 /*
1659 * When a regset has a writeback hook, we call it on each thread before
1660 * dumping user memory. On register window machines, this makes sure the
1661 * user memory backing the register data is up to date before we read it.
1662 */
do_thread_regset_writeback(struct task_struct * task,const struct user_regset * regset)1663 static void do_thread_regset_writeback(struct task_struct *task,
1664 const struct user_regset *regset)
1665 {
1666 if (regset->writeback)
1667 regset->writeback(task, regset, 1);
1668 }
1669
1670 #ifndef PRSTATUS_SIZE
1671 #define PRSTATUS_SIZE(S, R) sizeof(S)
1672 #endif
1673
1674 #ifndef SET_PR_FPVALID
1675 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V))
1676 #endif
1677
fill_thread_core_info(struct elf_thread_core_info * t,const struct user_regset_view * view,long signr,size_t * total)1678 static int fill_thread_core_info(struct elf_thread_core_info *t,
1679 const struct user_regset_view *view,
1680 long signr, size_t *total)
1681 {
1682 unsigned int i;
1683 unsigned int regset_size = view->regsets[0].n * view->regsets[0].size;
1684
1685 /*
1686 * NT_PRSTATUS is the one special case, because the regset data
1687 * goes into the pr_reg field inside the note contents, rather
1688 * than being the whole note contents. We fill the reset in here.
1689 * We assume that regset 0 is NT_PRSTATUS.
1690 */
1691 fill_prstatus(&t->prstatus, t->task, signr);
1692 (void) view->regsets[0].get(t->task, &view->regsets[0], 0, regset_size,
1693 &t->prstatus.pr_reg, NULL);
1694
1695 fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1696 PRSTATUS_SIZE(t->prstatus, regset_size), &t->prstatus);
1697 *total += notesize(&t->notes[0]);
1698
1699 do_thread_regset_writeback(t->task, &view->regsets[0]);
1700
1701 /*
1702 * Each other regset might generate a note too. For each regset
1703 * that has no core_note_type or is inactive, we leave t->notes[i]
1704 * all zero and we'll know to skip writing it later.
1705 */
1706 for (i = 1; i < view->n; ++i) {
1707 const struct user_regset *regset = &view->regsets[i];
1708 do_thread_regset_writeback(t->task, regset);
1709 if (regset->core_note_type && regset->get &&
1710 (!regset->active || regset->active(t->task, regset))) {
1711 int ret;
1712 size_t size = regset->n * regset->size;
1713 void *data = kmalloc(size, GFP_KERNEL);
1714 if (unlikely(!data))
1715 return 0;
1716 ret = regset->get(t->task, regset,
1717 0, size, data, NULL);
1718 if (unlikely(ret))
1719 kfree(data);
1720 else {
1721 if (regset->core_note_type != NT_PRFPREG)
1722 fill_note(&t->notes[i], "LINUX",
1723 regset->core_note_type,
1724 size, data);
1725 else {
1726 SET_PR_FPVALID(&t->prstatus,
1727 1, regset_size);
1728 fill_note(&t->notes[i], "CORE",
1729 NT_PRFPREG, size, data);
1730 }
1731 *total += notesize(&t->notes[i]);
1732 }
1733 }
1734 }
1735
1736 return 1;
1737 }
1738
fill_note_info(struct elfhdr * elf,int phdrs,struct elf_note_info * info,const siginfo_t * siginfo,struct pt_regs * regs)1739 static int fill_note_info(struct elfhdr *elf, int phdrs,
1740 struct elf_note_info *info,
1741 const siginfo_t *siginfo, struct pt_regs *regs)
1742 {
1743 struct task_struct *dump_task = current;
1744 const struct user_regset_view *view = task_user_regset_view(dump_task);
1745 struct elf_thread_core_info *t;
1746 struct elf_prpsinfo *psinfo;
1747 struct core_thread *ct;
1748 unsigned int i;
1749
1750 info->size = 0;
1751 info->thread = NULL;
1752
1753 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1754 if (psinfo == NULL) {
1755 info->psinfo.data = NULL; /* So we don't free this wrongly */
1756 return 0;
1757 }
1758
1759 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1760
1761 /*
1762 * Figure out how many notes we're going to need for each thread.
1763 */
1764 info->thread_notes = 0;
1765 for (i = 0; i < view->n; ++i)
1766 if (view->regsets[i].core_note_type != 0)
1767 ++info->thread_notes;
1768
1769 /*
1770 * Sanity check. We rely on regset 0 being in NT_PRSTATUS,
1771 * since it is our one special case.
1772 */
1773 if (unlikely(info->thread_notes == 0) ||
1774 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1775 WARN_ON(1);
1776 return 0;
1777 }
1778
1779 /*
1780 * Initialize the ELF file header.
1781 */
1782 fill_elf_header(elf, phdrs,
1783 view->e_machine, view->e_flags);
1784
1785 /*
1786 * Allocate a structure for each thread.
1787 */
1788 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1789 t = kzalloc(offsetof(struct elf_thread_core_info,
1790 notes[info->thread_notes]),
1791 GFP_KERNEL);
1792 if (unlikely(!t))
1793 return 0;
1794
1795 t->task = ct->task;
1796 if (ct->task == dump_task || !info->thread) {
1797 t->next = info->thread;
1798 info->thread = t;
1799 } else {
1800 /*
1801 * Make sure to keep the original task at
1802 * the head of the list.
1803 */
1804 t->next = info->thread->next;
1805 info->thread->next = t;
1806 }
1807 }
1808
1809 /*
1810 * Now fill in each thread's information.
1811 */
1812 for (t = info->thread; t != NULL; t = t->next)
1813 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size))
1814 return 0;
1815
1816 /*
1817 * Fill in the two process-wide notes.
1818 */
1819 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1820 info->size += notesize(&info->psinfo);
1821
1822 fill_siginfo_note(&info->signote, &info->csigdata, siginfo);
1823 info->size += notesize(&info->signote);
1824
1825 fill_auxv_note(&info->auxv, current->mm);
1826 info->size += notesize(&info->auxv);
1827
1828 if (fill_files_note(&info->files) == 0)
1829 info->size += notesize(&info->files);
1830
1831 return 1;
1832 }
1833
get_note_info_size(struct elf_note_info * info)1834 static size_t get_note_info_size(struct elf_note_info *info)
1835 {
1836 return info->size;
1837 }
1838
1839 /*
1840 * Write all the notes for each thread. When writing the first thread, the
1841 * process-wide notes are interleaved after the first thread-specific note.
1842 */
write_note_info(struct elf_note_info * info,struct coredump_params * cprm)1843 static int write_note_info(struct elf_note_info *info,
1844 struct coredump_params *cprm)
1845 {
1846 bool first = true;
1847 struct elf_thread_core_info *t = info->thread;
1848
1849 do {
1850 int i;
1851
1852 if (!writenote(&t->notes[0], cprm))
1853 return 0;
1854
1855 if (first && !writenote(&info->psinfo, cprm))
1856 return 0;
1857 if (first && !writenote(&info->signote, cprm))
1858 return 0;
1859 if (first && !writenote(&info->auxv, cprm))
1860 return 0;
1861 if (first && info->files.data &&
1862 !writenote(&info->files, cprm))
1863 return 0;
1864
1865 for (i = 1; i < info->thread_notes; ++i)
1866 if (t->notes[i].data &&
1867 !writenote(&t->notes[i], cprm))
1868 return 0;
1869
1870 first = false;
1871 t = t->next;
1872 } while (t);
1873
1874 return 1;
1875 }
1876
free_note_info(struct elf_note_info * info)1877 static void free_note_info(struct elf_note_info *info)
1878 {
1879 struct elf_thread_core_info *threads = info->thread;
1880 while (threads) {
1881 unsigned int i;
1882 struct elf_thread_core_info *t = threads;
1883 threads = t->next;
1884 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1885 for (i = 1; i < info->thread_notes; ++i)
1886 kfree(t->notes[i].data);
1887 kfree(t);
1888 }
1889 kfree(info->psinfo.data);
1890 vfree(info->files.data);
1891 }
1892
1893 #else
1894
1895 /* Here is the structure in which status of each thread is captured. */
1896 struct elf_thread_status
1897 {
1898 struct list_head list;
1899 struct elf_prstatus prstatus; /* NT_PRSTATUS */
1900 elf_fpregset_t fpu; /* NT_PRFPREG */
1901 struct task_struct *thread;
1902 #ifdef ELF_CORE_COPY_XFPREGS
1903 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */
1904 #endif
1905 struct memelfnote notes[3];
1906 int num_notes;
1907 };
1908
1909 /*
1910 * In order to add the specific thread information for the elf file format,
1911 * we need to keep a linked list of every threads pr_status and then create
1912 * a single section for them in the final core file.
1913 */
elf_dump_thread_status(long signr,struct elf_thread_status * t)1914 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1915 {
1916 int sz = 0;
1917 struct task_struct *p = t->thread;
1918 t->num_notes = 0;
1919
1920 fill_prstatus(&t->prstatus, p, signr);
1921 elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1922
1923 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1924 &(t->prstatus));
1925 t->num_notes++;
1926 sz += notesize(&t->notes[0]);
1927
1928 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1929 &t->fpu))) {
1930 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1931 &(t->fpu));
1932 t->num_notes++;
1933 sz += notesize(&t->notes[1]);
1934 }
1935
1936 #ifdef ELF_CORE_COPY_XFPREGS
1937 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1938 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1939 sizeof(t->xfpu), &t->xfpu);
1940 t->num_notes++;
1941 sz += notesize(&t->notes[2]);
1942 }
1943 #endif
1944 return sz;
1945 }
1946
1947 struct elf_note_info {
1948 struct memelfnote *notes;
1949 struct memelfnote *notes_files;
1950 struct elf_prstatus *prstatus; /* NT_PRSTATUS */
1951 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */
1952 struct list_head thread_list;
1953 elf_fpregset_t *fpu;
1954 #ifdef ELF_CORE_COPY_XFPREGS
1955 elf_fpxregset_t *xfpu;
1956 #endif
1957 user_siginfo_t csigdata;
1958 int thread_status_size;
1959 int numnote;
1960 };
1961
elf_note_info_init(struct elf_note_info * info)1962 static int elf_note_info_init(struct elf_note_info *info)
1963 {
1964 memset(info, 0, sizeof(*info));
1965 INIT_LIST_HEAD(&info->thread_list);
1966
1967 /* Allocate space for ELF notes */
1968 info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL);
1969 if (!info->notes)
1970 return 0;
1971 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1972 if (!info->psinfo)
1973 return 0;
1974 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1975 if (!info->prstatus)
1976 return 0;
1977 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1978 if (!info->fpu)
1979 return 0;
1980 #ifdef ELF_CORE_COPY_XFPREGS
1981 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1982 if (!info->xfpu)
1983 return 0;
1984 #endif
1985 return 1;
1986 }
1987
fill_note_info(struct elfhdr * elf,int phdrs,struct elf_note_info * info,const siginfo_t * siginfo,struct pt_regs * regs)1988 static int fill_note_info(struct elfhdr *elf, int phdrs,
1989 struct elf_note_info *info,
1990 const siginfo_t *siginfo, struct pt_regs *regs)
1991 {
1992 struct list_head *t;
1993 struct core_thread *ct;
1994 struct elf_thread_status *ets;
1995
1996 if (!elf_note_info_init(info))
1997 return 0;
1998
1999 for (ct = current->mm->core_state->dumper.next;
2000 ct; ct = ct->next) {
2001 ets = kzalloc(sizeof(*ets), GFP_KERNEL);
2002 if (!ets)
2003 return 0;
2004
2005 ets->thread = ct->task;
2006 list_add(&ets->list, &info->thread_list);
2007 }
2008
2009 list_for_each(t, &info->thread_list) {
2010 int sz;
2011
2012 ets = list_entry(t, struct elf_thread_status, list);
2013 sz = elf_dump_thread_status(siginfo->si_signo, ets);
2014 info->thread_status_size += sz;
2015 }
2016 /* now collect the dump for the current */
2017 memset(info->prstatus, 0, sizeof(*info->prstatus));
2018 fill_prstatus(info->prstatus, current, siginfo->si_signo);
2019 elf_core_copy_regs(&info->prstatus->pr_reg, regs);
2020
2021 /* Set up header */
2022 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS);
2023
2024 /*
2025 * Set up the notes in similar form to SVR4 core dumps made
2026 * with info from their /proc.
2027 */
2028
2029 fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
2030 sizeof(*info->prstatus), info->prstatus);
2031 fill_psinfo(info->psinfo, current->group_leader, current->mm);
2032 fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
2033 sizeof(*info->psinfo), info->psinfo);
2034
2035 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
2036 fill_auxv_note(info->notes + 3, current->mm);
2037 info->numnote = 4;
2038
2039 if (fill_files_note(info->notes + info->numnote) == 0) {
2040 info->notes_files = info->notes + info->numnote;
2041 info->numnote++;
2042 }
2043
2044 /* Try to dump the FPU. */
2045 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
2046 info->fpu);
2047 if (info->prstatus->pr_fpvalid)
2048 fill_note(info->notes + info->numnote++,
2049 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
2050 #ifdef ELF_CORE_COPY_XFPREGS
2051 if (elf_core_copy_task_xfpregs(current, info->xfpu))
2052 fill_note(info->notes + info->numnote++,
2053 "LINUX", ELF_CORE_XFPREG_TYPE,
2054 sizeof(*info->xfpu), info->xfpu);
2055 #endif
2056
2057 return 1;
2058 }
2059
get_note_info_size(struct elf_note_info * info)2060 static size_t get_note_info_size(struct elf_note_info *info)
2061 {
2062 int sz = 0;
2063 int i;
2064
2065 for (i = 0; i < info->numnote; i++)
2066 sz += notesize(info->notes + i);
2067
2068 sz += info->thread_status_size;
2069
2070 return sz;
2071 }
2072
write_note_info(struct elf_note_info * info,struct coredump_params * cprm)2073 static int write_note_info(struct elf_note_info *info,
2074 struct coredump_params *cprm)
2075 {
2076 int i;
2077 struct list_head *t;
2078
2079 for (i = 0; i < info->numnote; i++)
2080 if (!writenote(info->notes + i, cprm))
2081 return 0;
2082
2083 /* write out the thread status notes section */
2084 list_for_each(t, &info->thread_list) {
2085 struct elf_thread_status *tmp =
2086 list_entry(t, struct elf_thread_status, list);
2087
2088 for (i = 0; i < tmp->num_notes; i++)
2089 if (!writenote(&tmp->notes[i], cprm))
2090 return 0;
2091 }
2092
2093 return 1;
2094 }
2095
free_note_info(struct elf_note_info * info)2096 static void free_note_info(struct elf_note_info *info)
2097 {
2098 while (!list_empty(&info->thread_list)) {
2099 struct list_head *tmp = info->thread_list.next;
2100 list_del(tmp);
2101 kfree(list_entry(tmp, struct elf_thread_status, list));
2102 }
2103
2104 /* Free data possibly allocated by fill_files_note(): */
2105 if (info->notes_files)
2106 vfree(info->notes_files->data);
2107
2108 kfree(info->prstatus);
2109 kfree(info->psinfo);
2110 kfree(info->notes);
2111 kfree(info->fpu);
2112 #ifdef ELF_CORE_COPY_XFPREGS
2113 kfree(info->xfpu);
2114 #endif
2115 }
2116
2117 #endif
2118
first_vma(struct task_struct * tsk,struct vm_area_struct * gate_vma)2119 static struct vm_area_struct *first_vma(struct task_struct *tsk,
2120 struct vm_area_struct *gate_vma)
2121 {
2122 struct vm_area_struct *ret = tsk->mm->mmap;
2123
2124 if (ret)
2125 return ret;
2126 return gate_vma;
2127 }
2128 /*
2129 * Helper function for iterating across a vma list. It ensures that the caller
2130 * will visit `gate_vma' prior to terminating the search.
2131 */
next_vma(struct vm_area_struct * this_vma,struct vm_area_struct * gate_vma)2132 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
2133 struct vm_area_struct *gate_vma)
2134 {
2135 struct vm_area_struct *ret;
2136
2137 ret = this_vma->vm_next;
2138 if (ret)
2139 return ret;
2140 if (this_vma == gate_vma)
2141 return NULL;
2142 return gate_vma;
2143 }
2144
fill_extnum_info(struct elfhdr * elf,struct elf_shdr * shdr4extnum,elf_addr_t e_shoff,int segs)2145 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
2146 elf_addr_t e_shoff, int segs)
2147 {
2148 elf->e_shoff = e_shoff;
2149 elf->e_shentsize = sizeof(*shdr4extnum);
2150 elf->e_shnum = 1;
2151 elf->e_shstrndx = SHN_UNDEF;
2152
2153 memset(shdr4extnum, 0, sizeof(*shdr4extnum));
2154
2155 shdr4extnum->sh_type = SHT_NULL;
2156 shdr4extnum->sh_size = elf->e_shnum;
2157 shdr4extnum->sh_link = elf->e_shstrndx;
2158 shdr4extnum->sh_info = segs;
2159 }
2160
2161 /*
2162 * Actual dumper
2163 *
2164 * This is a two-pass process; first we find the offsets of the bits,
2165 * and then they are actually written out. If we run out of core limit
2166 * we just truncate.
2167 */
elf_core_dump(struct coredump_params * cprm)2168 static int elf_core_dump(struct coredump_params *cprm)
2169 {
2170 int has_dumped = 0;
2171 mm_segment_t fs;
2172 int segs, i;
2173 size_t vma_data_size = 0;
2174 struct vm_area_struct *vma, *gate_vma;
2175 struct elfhdr *elf = NULL;
2176 loff_t offset = 0, dataoff;
2177 struct elf_note_info info = { };
2178 struct elf_phdr *phdr4note = NULL;
2179 struct elf_shdr *shdr4extnum = NULL;
2180 Elf_Half e_phnum;
2181 elf_addr_t e_shoff;
2182 elf_addr_t *vma_filesz = NULL;
2183
2184 /*
2185 * We no longer stop all VM operations.
2186 *
2187 * This is because those proceses that could possibly change map_count
2188 * or the mmap / vma pages are now blocked in do_exit on current
2189 * finishing this core dump.
2190 *
2191 * Only ptrace can touch these memory addresses, but it doesn't change
2192 * the map_count or the pages allocated. So no possibility of crashing
2193 * exists while dumping the mm->vm_next areas to the core file.
2194 */
2195
2196 /* alloc memory for large data structures: too large to be on stack */
2197 elf = kmalloc(sizeof(*elf), GFP_KERNEL);
2198 if (!elf)
2199 goto out;
2200 /*
2201 * The number of segs are recored into ELF header as 16bit value.
2202 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2203 */
2204 segs = current->mm->map_count;
2205 segs += elf_core_extra_phdrs();
2206
2207 gate_vma = get_gate_vma(current->mm);
2208 if (gate_vma != NULL)
2209 segs++;
2210
2211 /* for notes section */
2212 segs++;
2213
2214 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2215 * this, kernel supports extended numbering. Have a look at
2216 * include/linux/elf.h for further information. */
2217 e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2218
2219 /*
2220 * Collect all the non-memory information about the process for the
2221 * notes. This also sets up the file header.
2222 */
2223 if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs))
2224 goto cleanup;
2225
2226 has_dumped = 1;
2227
2228 fs = get_fs();
2229 set_fs(KERNEL_DS);
2230
2231 offset += sizeof(*elf); /* Elf header */
2232 offset += segs * sizeof(struct elf_phdr); /* Program headers */
2233
2234 /* Write notes phdr entry */
2235 {
2236 size_t sz = get_note_info_size(&info);
2237
2238 sz += elf_coredump_extra_notes_size();
2239
2240 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2241 if (!phdr4note)
2242 goto end_coredump;
2243
2244 fill_elf_note_phdr(phdr4note, sz, offset);
2245 offset += sz;
2246 }
2247
2248 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2249
2250 vma_filesz = kmalloc_array(segs - 1, sizeof(*vma_filesz), GFP_KERNEL);
2251 if (!vma_filesz)
2252 goto end_coredump;
2253
2254 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2255 vma = next_vma(vma, gate_vma)) {
2256 unsigned long dump_size;
2257
2258 dump_size = vma_dump_size(vma, cprm->mm_flags);
2259 vma_filesz[i++] = dump_size;
2260 vma_data_size += dump_size;
2261 }
2262
2263 offset += vma_data_size;
2264 offset += elf_core_extra_data_size();
2265 e_shoff = offset;
2266
2267 if (e_phnum == PN_XNUM) {
2268 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2269 if (!shdr4extnum)
2270 goto end_coredump;
2271 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2272 }
2273
2274 offset = dataoff;
2275
2276 if (!dump_emit(cprm, elf, sizeof(*elf)))
2277 goto end_coredump;
2278
2279 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
2280 goto end_coredump;
2281
2282 /* Write program headers for segments dump */
2283 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2284 vma = next_vma(vma, gate_vma)) {
2285 struct elf_phdr phdr;
2286
2287 phdr.p_type = PT_LOAD;
2288 phdr.p_offset = offset;
2289 phdr.p_vaddr = vma->vm_start;
2290 phdr.p_paddr = 0;
2291 phdr.p_filesz = vma_filesz[i++];
2292 phdr.p_memsz = vma->vm_end - vma->vm_start;
2293 offset += phdr.p_filesz;
2294 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2295 if (vma->vm_flags & VM_WRITE)
2296 phdr.p_flags |= PF_W;
2297 if (vma->vm_flags & VM_EXEC)
2298 phdr.p_flags |= PF_X;
2299 phdr.p_align = ELF_EXEC_PAGESIZE;
2300
2301 if (!dump_emit(cprm, &phdr, sizeof(phdr)))
2302 goto end_coredump;
2303 }
2304
2305 if (!elf_core_write_extra_phdrs(cprm, offset))
2306 goto end_coredump;
2307
2308 /* write out the notes section */
2309 if (!write_note_info(&info, cprm))
2310 goto end_coredump;
2311
2312 if (elf_coredump_extra_notes_write(cprm))
2313 goto end_coredump;
2314
2315 /* Align to page */
2316 if (!dump_skip(cprm, dataoff - cprm->pos))
2317 goto end_coredump;
2318
2319 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2320 vma = next_vma(vma, gate_vma)) {
2321 unsigned long addr;
2322 unsigned long end;
2323
2324 end = vma->vm_start + vma_filesz[i++];
2325
2326 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2327 struct page *page;
2328 int stop;
2329
2330 page = get_dump_page(addr);
2331 if (page) {
2332 void *kaddr = kmap(page);
2333 stop = !dump_emit(cprm, kaddr, PAGE_SIZE);
2334 kunmap(page);
2335 put_page(page);
2336 } else
2337 stop = !dump_skip(cprm, PAGE_SIZE);
2338 if (stop)
2339 goto end_coredump;
2340 }
2341 }
2342 dump_truncate(cprm);
2343
2344 if (!elf_core_write_extra_data(cprm))
2345 goto end_coredump;
2346
2347 if (e_phnum == PN_XNUM) {
2348 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
2349 goto end_coredump;
2350 }
2351
2352 end_coredump:
2353 set_fs(fs);
2354
2355 cleanup:
2356 free_note_info(&info);
2357 kfree(shdr4extnum);
2358 kfree(vma_filesz);
2359 kfree(phdr4note);
2360 kfree(elf);
2361 out:
2362 return has_dumped;
2363 }
2364
2365 #endif /* CONFIG_ELF_CORE */
2366
init_elf_binfmt(void)2367 static int __init init_elf_binfmt(void)
2368 {
2369 register_binfmt(&elf_format);
2370 return 0;
2371 }
2372
exit_elf_binfmt(void)2373 static void __exit exit_elf_binfmt(void)
2374 {
2375 /* Remove the COFF and ELF loaders. */
2376 unregister_binfmt(&elf_format);
2377 }
2378
2379 core_initcall(init_elf_binfmt);
2380 module_exit(exit_elf_binfmt);
2381 MODULE_LICENSE("GPL");
2382