1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * linux/fs/binfmt_elf.c
4 *
5 * These are the functions used to load ELF format executables as used
6 * on SVr4 machines. Information on the format may be found in the book
7 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
8 * Tools".
9 *
10 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
11 */
12
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/fs.h>
16 #include <linux/mm.h>
17 #include <linux/mman.h>
18 #include <linux/errno.h>
19 #include <linux/signal.h>
20 #include <linux/binfmts.h>
21 #include <linux/string.h>
22 #include <linux/file.h>
23 #include <linux/slab.h>
24 #include <linux/personality.h>
25 #include <linux/elfcore.h>
26 #include <linux/init.h>
27 #include <linux/highuid.h>
28 #include <linux/compiler.h>
29 #include <linux/highmem.h>
30 #include <linux/pagemap.h>
31 #include <linux/vmalloc.h>
32 #include <linux/security.h>
33 #include <linux/random.h>
34 #include <linux/elf.h>
35 #include <linux/elf-randomize.h>
36 #include <linux/utsname.h>
37 #include <linux/coredump.h>
38 #include <linux/sched.h>
39 #include <linux/sched/coredump.h>
40 #include <linux/sched/task_stack.h>
41 #include <linux/sched/cputime.h>
42 #include <linux/cred.h>
43 #include <linux/dax.h>
44 #include <linux/uaccess.h>
45 #include <asm/param.h>
46 #include <asm/page.h>
47
48 #ifndef user_long_t
49 #define user_long_t long
50 #endif
51 #ifndef user_siginfo_t
52 #define user_siginfo_t siginfo_t
53 #endif
54
55 /* That's for binfmt_elf_fdpic to deal with */
56 #ifndef elf_check_fdpic
57 #define elf_check_fdpic(ex) false
58 #endif
59
60 static int load_elf_binary(struct linux_binprm *bprm);
61
62 #ifdef CONFIG_USELIB
63 static int load_elf_library(struct file *);
64 #else
65 #define load_elf_library NULL
66 #endif
67
68 /*
69 * If we don't support core dumping, then supply a NULL so we
70 * don't even try.
71 */
72 #ifdef CONFIG_ELF_CORE
73 static int elf_core_dump(struct coredump_params *cprm);
74 #else
75 #define elf_core_dump NULL
76 #endif
77
78 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
79 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
80 #else
81 #define ELF_MIN_ALIGN PAGE_SIZE
82 #endif
83
84 #ifndef ELF_CORE_EFLAGS
85 #define ELF_CORE_EFLAGS 0
86 #endif
87
88 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
89 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
90 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
91
92 static struct linux_binfmt elf_format = {
93 .module = THIS_MODULE,
94 .load_binary = load_elf_binary,
95 .load_shlib = load_elf_library,
96 .core_dump = elf_core_dump,
97 .min_coredump = ELF_EXEC_PAGESIZE,
98 };
99
100 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
101
set_brk(unsigned long start,unsigned long end,int prot)102 static int set_brk(unsigned long start, unsigned long end, int prot)
103 {
104 start = ELF_PAGEALIGN(start);
105 end = ELF_PAGEALIGN(end);
106 if (end > start) {
107 /*
108 * Map the last of the bss segment.
109 * If the header is requesting these pages to be
110 * executable, honour that (ppc32 needs this).
111 */
112 int error = vm_brk_flags(start, end - start,
113 prot & PROT_EXEC ? VM_EXEC : 0);
114 if (error)
115 return error;
116 }
117 current->mm->start_brk = current->mm->brk = end;
118 return 0;
119 }
120
121 /* We need to explicitly zero any fractional pages
122 after the data section (i.e. bss). This would
123 contain the junk from the file that should not
124 be in memory
125 */
padzero(unsigned long elf_bss)126 static int padzero(unsigned long elf_bss)
127 {
128 unsigned long nbyte;
129
130 nbyte = ELF_PAGEOFFSET(elf_bss);
131 if (nbyte) {
132 nbyte = ELF_MIN_ALIGN - nbyte;
133 if (clear_user((void __user *) elf_bss, nbyte))
134 return -EFAULT;
135 }
136 return 0;
137 }
138
139 /* Let's use some macros to make this stack manipulation a little clearer */
140 #ifdef CONFIG_STACK_GROWSUP
141 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
142 #define STACK_ROUND(sp, items) \
143 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
144 #define STACK_ALLOC(sp, len) ({ \
145 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
146 old_sp; })
147 #else
148 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
149 #define STACK_ROUND(sp, items) \
150 (((unsigned long) (sp - items)) &~ 15UL)
151 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
152 #endif
153
154 #ifndef ELF_BASE_PLATFORM
155 /*
156 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
157 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
158 * will be copied to the user stack in the same manner as AT_PLATFORM.
159 */
160 #define ELF_BASE_PLATFORM NULL
161 #endif
162
163 static int
create_elf_tables(struct linux_binprm * bprm,struct elfhdr * exec,unsigned long load_addr,unsigned long interp_load_addr)164 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
165 unsigned long load_addr, unsigned long interp_load_addr)
166 {
167 unsigned long p = bprm->p;
168 int argc = bprm->argc;
169 int envc = bprm->envc;
170 elf_addr_t __user *sp;
171 elf_addr_t __user *u_platform;
172 elf_addr_t __user *u_base_platform;
173 elf_addr_t __user *u_rand_bytes;
174 const char *k_platform = ELF_PLATFORM;
175 const char *k_base_platform = ELF_BASE_PLATFORM;
176 unsigned char k_rand_bytes[16];
177 int items;
178 elf_addr_t *elf_info;
179 int ei_index = 0;
180 const struct cred *cred = current_cred();
181 struct vm_area_struct *vma;
182
183 /*
184 * In some cases (e.g. Hyper-Threading), we want to avoid L1
185 * evictions by the processes running on the same package. One
186 * thing we can do is to shuffle the initial stack for them.
187 */
188
189 p = arch_align_stack(p);
190
191 /*
192 * If this architecture has a platform capability string, copy it
193 * to userspace. In some cases (Sparc), this info is impossible
194 * for userspace to get any other way, in others (i386) it is
195 * merely difficult.
196 */
197 u_platform = NULL;
198 if (k_platform) {
199 size_t len = strlen(k_platform) + 1;
200
201 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
202 if (__copy_to_user(u_platform, k_platform, len))
203 return -EFAULT;
204 }
205
206 /*
207 * If this architecture has a "base" platform capability
208 * string, copy it to userspace.
209 */
210 u_base_platform = NULL;
211 if (k_base_platform) {
212 size_t len = strlen(k_base_platform) + 1;
213
214 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
215 if (__copy_to_user(u_base_platform, k_base_platform, len))
216 return -EFAULT;
217 }
218
219 /*
220 * Generate 16 random bytes for userspace PRNG seeding.
221 */
222 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
223 u_rand_bytes = (elf_addr_t __user *)
224 STACK_ALLOC(p, sizeof(k_rand_bytes));
225 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
226 return -EFAULT;
227
228 /* Create the ELF interpreter info */
229 elf_info = (elf_addr_t *)current->mm->saved_auxv;
230 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
231 #define NEW_AUX_ENT(id, val) \
232 do { \
233 elf_info[ei_index++] = id; \
234 elf_info[ei_index++] = val; \
235 } while (0)
236
237 #ifdef ARCH_DLINFO
238 /*
239 * ARCH_DLINFO must come first so PPC can do its special alignment of
240 * AUXV.
241 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
242 * ARCH_DLINFO changes
243 */
244 ARCH_DLINFO;
245 #endif
246 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
247 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
248 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
249 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
250 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
251 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
252 NEW_AUX_ENT(AT_BASE, interp_load_addr);
253 NEW_AUX_ENT(AT_FLAGS, 0);
254 NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
255 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
256 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
257 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
258 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
259 NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
260 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
261 #ifdef ELF_HWCAP2
262 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
263 #endif
264 NEW_AUX_ENT(AT_EXECFN, bprm->exec);
265 if (k_platform) {
266 NEW_AUX_ENT(AT_PLATFORM,
267 (elf_addr_t)(unsigned long)u_platform);
268 }
269 if (k_base_platform) {
270 NEW_AUX_ENT(AT_BASE_PLATFORM,
271 (elf_addr_t)(unsigned long)u_base_platform);
272 }
273 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
274 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
275 }
276 #undef NEW_AUX_ENT
277 /* AT_NULL is zero; clear the rest too */
278 memset(&elf_info[ei_index], 0,
279 sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
280
281 /* And advance past the AT_NULL entry. */
282 ei_index += 2;
283
284 sp = STACK_ADD(p, ei_index);
285
286 items = (argc + 1) + (envc + 1) + 1;
287 bprm->p = STACK_ROUND(sp, items);
288
289 /* Point sp at the lowest address on the stack */
290 #ifdef CONFIG_STACK_GROWSUP
291 sp = (elf_addr_t __user *)bprm->p - items - ei_index;
292 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
293 #else
294 sp = (elf_addr_t __user *)bprm->p;
295 #endif
296
297
298 /*
299 * Grow the stack manually; some architectures have a limit on how
300 * far ahead a user-space access may be in order to grow the stack.
301 */
302 vma = find_extend_vma(current->mm, bprm->p);
303 if (!vma)
304 return -EFAULT;
305
306 /* Now, let's put argc (and argv, envp if appropriate) on the stack */
307 if (__put_user(argc, sp++))
308 return -EFAULT;
309
310 /* Populate list of argv pointers back to argv strings. */
311 p = current->mm->arg_end = current->mm->arg_start;
312 while (argc-- > 0) {
313 size_t len;
314 if (__put_user((elf_addr_t)p, sp++))
315 return -EFAULT;
316 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
317 if (!len || len > MAX_ARG_STRLEN)
318 return -EINVAL;
319 p += len;
320 }
321 if (__put_user(0, sp++))
322 return -EFAULT;
323 current->mm->arg_end = p;
324
325 /* Populate list of envp pointers back to envp strings. */
326 current->mm->env_end = current->mm->env_start = p;
327 while (envc-- > 0) {
328 size_t len;
329 if (__put_user((elf_addr_t)p, sp++))
330 return -EFAULT;
331 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
332 if (!len || len > MAX_ARG_STRLEN)
333 return -EINVAL;
334 p += len;
335 }
336 if (__put_user(0, sp++))
337 return -EFAULT;
338 current->mm->env_end = p;
339
340 /* Put the elf_info on the stack in the right place. */
341 if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
342 return -EFAULT;
343 return 0;
344 }
345
346 #ifndef elf_map
347
elf_map(struct file * filep,unsigned long addr,const struct elf_phdr * eppnt,int prot,int type,unsigned long total_size)348 static unsigned long elf_map(struct file *filep, unsigned long addr,
349 const struct elf_phdr *eppnt, int prot, int type,
350 unsigned long total_size)
351 {
352 unsigned long map_addr;
353 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
354 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
355 addr = ELF_PAGESTART(addr);
356 size = ELF_PAGEALIGN(size);
357
358 /* mmap() will return -EINVAL if given a zero size, but a
359 * segment with zero filesize is perfectly valid */
360 if (!size)
361 return addr;
362
363 /*
364 * total_size is the size of the ELF (interpreter) image.
365 * The _first_ mmap needs to know the full size, otherwise
366 * randomization might put this image into an overlapping
367 * position with the ELF binary image. (since size < total_size)
368 * So we first map the 'big' image - and unmap the remainder at
369 * the end. (which unmap is needed for ELF images with holes.)
370 */
371 if (total_size) {
372 total_size = ELF_PAGEALIGN(total_size);
373 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
374 if (!BAD_ADDR(map_addr))
375 vm_munmap(map_addr+size, total_size-size);
376 } else
377 map_addr = vm_mmap(filep, addr, size, prot, type, off);
378
379 if ((type & MAP_FIXED_NOREPLACE) &&
380 PTR_ERR((void *)map_addr) == -EEXIST)
381 pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n",
382 task_pid_nr(current), current->comm, (void *)addr);
383
384 return(map_addr);
385 }
386
387 #endif /* !elf_map */
388
total_mapping_size(const struct elf_phdr * cmds,int nr)389 static unsigned long total_mapping_size(const struct elf_phdr *cmds, int nr)
390 {
391 int i, first_idx = -1, last_idx = -1;
392
393 for (i = 0; i < nr; i++) {
394 if (cmds[i].p_type == PT_LOAD) {
395 last_idx = i;
396 if (first_idx == -1)
397 first_idx = i;
398 }
399 }
400 if (first_idx == -1)
401 return 0;
402
403 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
404 ELF_PAGESTART(cmds[first_idx].p_vaddr);
405 }
406
407 /**
408 * load_elf_phdrs() - load ELF program headers
409 * @elf_ex: ELF header of the binary whose program headers should be loaded
410 * @elf_file: the opened ELF binary file
411 *
412 * Loads ELF program headers from the binary file elf_file, which has the ELF
413 * header pointed to by elf_ex, into a newly allocated array. The caller is
414 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure.
415 */
load_elf_phdrs(const struct elfhdr * elf_ex,struct file * elf_file)416 static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
417 struct file *elf_file)
418 {
419 struct elf_phdr *elf_phdata = NULL;
420 int retval, err = -1;
421 loff_t pos = elf_ex->e_phoff;
422 unsigned int size;
423
424 /*
425 * If the size of this structure has changed, then punt, since
426 * we will be doing the wrong thing.
427 */
428 if (elf_ex->e_phentsize != sizeof(struct elf_phdr))
429 goto out;
430
431 /* Sanity check the number of program headers... */
432 /* ...and their total size. */
433 size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
434 if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN)
435 goto out;
436
437 elf_phdata = kmalloc(size, GFP_KERNEL);
438 if (!elf_phdata)
439 goto out;
440
441 /* Read in the program headers */
442 retval = kernel_read(elf_file, elf_phdata, size, &pos);
443 if (retval != size) {
444 err = (retval < 0) ? retval : -EIO;
445 goto out;
446 }
447
448 /* Success! */
449 err = 0;
450 out:
451 if (err) {
452 kfree(elf_phdata);
453 elf_phdata = NULL;
454 }
455 return elf_phdata;
456 }
457
458 #ifndef CONFIG_ARCH_BINFMT_ELF_STATE
459
460 /**
461 * struct arch_elf_state - arch-specific ELF loading state
462 *
463 * This structure is used to preserve architecture specific data during
464 * the loading of an ELF file, throughout the checking of architecture
465 * specific ELF headers & through to the point where the ELF load is
466 * known to be proceeding (ie. SET_PERSONALITY).
467 *
468 * This implementation is a dummy for architectures which require no
469 * specific state.
470 */
471 struct arch_elf_state {
472 };
473
474 #define INIT_ARCH_ELF_STATE {}
475
476 /**
477 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header
478 * @ehdr: The main ELF header
479 * @phdr: The program header to check
480 * @elf: The open ELF file
481 * @is_interp: True if the phdr is from the interpreter of the ELF being
482 * loaded, else false.
483 * @state: Architecture-specific state preserved throughout the process
484 * of loading the ELF.
485 *
486 * Inspects the program header phdr to validate its correctness and/or
487 * suitability for the system. Called once per ELF program header in the
488 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its
489 * interpreter.
490 *
491 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
492 * with that return code.
493 */
arch_elf_pt_proc(struct elfhdr * ehdr,struct elf_phdr * phdr,struct file * elf,bool is_interp,struct arch_elf_state * state)494 static inline int arch_elf_pt_proc(struct elfhdr *ehdr,
495 struct elf_phdr *phdr,
496 struct file *elf, bool is_interp,
497 struct arch_elf_state *state)
498 {
499 /* Dummy implementation, always proceed */
500 return 0;
501 }
502
503 /**
504 * arch_check_elf() - check an ELF executable
505 * @ehdr: The main ELF header
506 * @has_interp: True if the ELF has an interpreter, else false.
507 * @interp_ehdr: The interpreter's ELF header
508 * @state: Architecture-specific state preserved throughout the process
509 * of loading the ELF.
510 *
511 * Provides a final opportunity for architecture code to reject the loading
512 * of the ELF & cause an exec syscall to return an error. This is called after
513 * all program headers to be checked by arch_elf_pt_proc have been.
514 *
515 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
516 * with that return code.
517 */
arch_check_elf(struct elfhdr * ehdr,bool has_interp,struct elfhdr * interp_ehdr,struct arch_elf_state * state)518 static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp,
519 struct elfhdr *interp_ehdr,
520 struct arch_elf_state *state)
521 {
522 /* Dummy implementation, always proceed */
523 return 0;
524 }
525
526 #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */
527
make_prot(u32 p_flags)528 static inline int make_prot(u32 p_flags)
529 {
530 int prot = 0;
531
532 if (p_flags & PF_R)
533 prot |= PROT_READ;
534 if (p_flags & PF_W)
535 prot |= PROT_WRITE;
536 if (p_flags & PF_X)
537 prot |= PROT_EXEC;
538 return prot;
539 }
540
541 /* This is much more generalized than the library routine read function,
542 so we keep this separate. Technically the library read function
543 is only provided so that we can read a.out libraries that have
544 an ELF header */
545
load_elf_interp(struct elfhdr * interp_elf_ex,struct file * interpreter,unsigned long * interp_map_addr,unsigned long no_base,struct elf_phdr * interp_elf_phdata)546 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
547 struct file *interpreter, unsigned long *interp_map_addr,
548 unsigned long no_base, struct elf_phdr *interp_elf_phdata)
549 {
550 struct elf_phdr *eppnt;
551 unsigned long load_addr = 0;
552 int load_addr_set = 0;
553 unsigned long last_bss = 0, elf_bss = 0;
554 int bss_prot = 0;
555 unsigned long error = ~0UL;
556 unsigned long total_size;
557 int i;
558
559 /* First of all, some simple consistency checks */
560 if (interp_elf_ex->e_type != ET_EXEC &&
561 interp_elf_ex->e_type != ET_DYN)
562 goto out;
563 if (!elf_check_arch(interp_elf_ex) ||
564 elf_check_fdpic(interp_elf_ex))
565 goto out;
566 if (!interpreter->f_op->mmap)
567 goto out;
568
569 total_size = total_mapping_size(interp_elf_phdata,
570 interp_elf_ex->e_phnum);
571 if (!total_size) {
572 error = -EINVAL;
573 goto out;
574 }
575
576 eppnt = interp_elf_phdata;
577 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
578 if (eppnt->p_type == PT_LOAD) {
579 int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
580 int elf_prot = make_prot(eppnt->p_flags);
581 unsigned long vaddr = 0;
582 unsigned long k, map_addr;
583
584 vaddr = eppnt->p_vaddr;
585 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
586 elf_type |= MAP_FIXED_NOREPLACE;
587 else if (no_base && interp_elf_ex->e_type == ET_DYN)
588 load_addr = -vaddr;
589
590 map_addr = elf_map(interpreter, load_addr + vaddr,
591 eppnt, elf_prot, elf_type, total_size);
592 total_size = 0;
593 if (!*interp_map_addr)
594 *interp_map_addr = map_addr;
595 error = map_addr;
596 if (BAD_ADDR(map_addr))
597 goto out;
598
599 if (!load_addr_set &&
600 interp_elf_ex->e_type == ET_DYN) {
601 load_addr = map_addr - ELF_PAGESTART(vaddr);
602 load_addr_set = 1;
603 }
604
605 /*
606 * Check to see if the section's size will overflow the
607 * allowed task size. Note that p_filesz must always be
608 * <= p_memsize so it's only necessary to check p_memsz.
609 */
610 k = load_addr + eppnt->p_vaddr;
611 if (BAD_ADDR(k) ||
612 eppnt->p_filesz > eppnt->p_memsz ||
613 eppnt->p_memsz > TASK_SIZE ||
614 TASK_SIZE - eppnt->p_memsz < k) {
615 error = -ENOMEM;
616 goto out;
617 }
618
619 /*
620 * Find the end of the file mapping for this phdr, and
621 * keep track of the largest address we see for this.
622 */
623 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
624 if (k > elf_bss)
625 elf_bss = k;
626
627 /*
628 * Do the same thing for the memory mapping - between
629 * elf_bss and last_bss is the bss section.
630 */
631 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz;
632 if (k > last_bss) {
633 last_bss = k;
634 bss_prot = elf_prot;
635 }
636 }
637 }
638
639 /*
640 * Now fill out the bss section: first pad the last page from
641 * the file up to the page boundary, and zero it from elf_bss
642 * up to the end of the page.
643 */
644 if (padzero(elf_bss)) {
645 error = -EFAULT;
646 goto out;
647 }
648 /*
649 * Next, align both the file and mem bss up to the page size,
650 * since this is where elf_bss was just zeroed up to, and where
651 * last_bss will end after the vm_brk_flags() below.
652 */
653 elf_bss = ELF_PAGEALIGN(elf_bss);
654 last_bss = ELF_PAGEALIGN(last_bss);
655 /* Finally, if there is still more bss to allocate, do it. */
656 if (last_bss > elf_bss) {
657 error = vm_brk_flags(elf_bss, last_bss - elf_bss,
658 bss_prot & PROT_EXEC ? VM_EXEC : 0);
659 if (error)
660 goto out;
661 }
662
663 error = load_addr;
664 out:
665 return error;
666 }
667
668 /*
669 * These are the functions used to load ELF style executables and shared
670 * libraries. There is no binary dependent code anywhere else.
671 */
672
load_elf_binary(struct linux_binprm * bprm)673 static int load_elf_binary(struct linux_binprm *bprm)
674 {
675 struct file *interpreter = NULL; /* to shut gcc up */
676 unsigned long load_addr = 0, load_bias = 0;
677 int load_addr_set = 0;
678 unsigned long error;
679 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
680 unsigned long elf_bss, elf_brk;
681 int bss_prot = 0;
682 int retval, i;
683 unsigned long elf_entry;
684 unsigned long interp_load_addr = 0;
685 unsigned long start_code, end_code, start_data, end_data;
686 unsigned long reloc_func_desc __maybe_unused = 0;
687 int executable_stack = EXSTACK_DEFAULT;
688 struct {
689 struct elfhdr elf_ex;
690 struct elfhdr interp_elf_ex;
691 } *loc;
692 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
693 struct pt_regs *regs;
694
695 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
696 if (!loc) {
697 retval = -ENOMEM;
698 goto out_ret;
699 }
700
701 /* Get the exec-header */
702 loc->elf_ex = *((struct elfhdr *)bprm->buf);
703
704 retval = -ENOEXEC;
705 /* First of all, some simple consistency checks */
706 if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
707 goto out;
708
709 if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
710 goto out;
711 if (!elf_check_arch(&loc->elf_ex))
712 goto out;
713 if (elf_check_fdpic(&loc->elf_ex))
714 goto out;
715 if (!bprm->file->f_op->mmap)
716 goto out;
717
718 elf_phdata = load_elf_phdrs(&loc->elf_ex, bprm->file);
719 if (!elf_phdata)
720 goto out;
721
722 elf_ppnt = elf_phdata;
723 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
724 char *elf_interpreter;
725 loff_t pos;
726
727 if (elf_ppnt->p_type != PT_INTERP)
728 continue;
729
730 /*
731 * This is the program interpreter used for shared libraries -
732 * for now assume that this is an a.out format binary.
733 */
734 retval = -ENOEXEC;
735 if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2)
736 goto out_free_ph;
737
738 retval = -ENOMEM;
739 elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL);
740 if (!elf_interpreter)
741 goto out_free_ph;
742
743 pos = elf_ppnt->p_offset;
744 retval = kernel_read(bprm->file, elf_interpreter,
745 elf_ppnt->p_filesz, &pos);
746 if (retval != elf_ppnt->p_filesz) {
747 if (retval >= 0)
748 retval = -EIO;
749 goto out_free_interp;
750 }
751 /* make sure path is NULL terminated */
752 retval = -ENOEXEC;
753 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
754 goto out_free_interp;
755
756 interpreter = open_exec(elf_interpreter);
757 kfree(elf_interpreter);
758 retval = PTR_ERR(interpreter);
759 if (IS_ERR(interpreter))
760 goto out_free_ph;
761
762 /*
763 * If the binary is not readable then enforce mm->dumpable = 0
764 * regardless of the interpreter's permissions.
765 */
766 would_dump(bprm, interpreter);
767
768 /* Get the exec headers */
769 pos = 0;
770 retval = kernel_read(interpreter, &loc->interp_elf_ex,
771 sizeof(loc->interp_elf_ex), &pos);
772 if (retval != sizeof(loc->interp_elf_ex)) {
773 if (retval >= 0)
774 retval = -EIO;
775 goto out_free_dentry;
776 }
777
778 break;
779
780 out_free_interp:
781 kfree(elf_interpreter);
782 goto out_free_ph;
783 }
784
785 elf_ppnt = elf_phdata;
786 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
787 switch (elf_ppnt->p_type) {
788 case PT_GNU_STACK:
789 if (elf_ppnt->p_flags & PF_X)
790 executable_stack = EXSTACK_ENABLE_X;
791 else
792 executable_stack = EXSTACK_DISABLE_X;
793 break;
794
795 case PT_LOPROC ... PT_HIPROC:
796 retval = arch_elf_pt_proc(&loc->elf_ex, elf_ppnt,
797 bprm->file, false,
798 &arch_state);
799 if (retval)
800 goto out_free_dentry;
801 break;
802 }
803
804 /* Some simple consistency checks for the interpreter */
805 if (interpreter) {
806 retval = -ELIBBAD;
807 /* Not an ELF interpreter */
808 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
809 goto out_free_dentry;
810 /* Verify the interpreter has a valid arch */
811 if (!elf_check_arch(&loc->interp_elf_ex) ||
812 elf_check_fdpic(&loc->interp_elf_ex))
813 goto out_free_dentry;
814
815 /* Load the interpreter program headers */
816 interp_elf_phdata = load_elf_phdrs(&loc->interp_elf_ex,
817 interpreter);
818 if (!interp_elf_phdata)
819 goto out_free_dentry;
820
821 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */
822 elf_ppnt = interp_elf_phdata;
823 for (i = 0; i < loc->interp_elf_ex.e_phnum; i++, elf_ppnt++)
824 switch (elf_ppnt->p_type) {
825 case PT_LOPROC ... PT_HIPROC:
826 retval = arch_elf_pt_proc(&loc->interp_elf_ex,
827 elf_ppnt, interpreter,
828 true, &arch_state);
829 if (retval)
830 goto out_free_dentry;
831 break;
832 }
833 }
834
835 /*
836 * Allow arch code to reject the ELF at this point, whilst it's
837 * still possible to return an error to the code that invoked
838 * the exec syscall.
839 */
840 retval = arch_check_elf(&loc->elf_ex,
841 !!interpreter, &loc->interp_elf_ex,
842 &arch_state);
843 if (retval)
844 goto out_free_dentry;
845
846 /* Flush all traces of the currently running executable */
847 retval = flush_old_exec(bprm);
848 if (retval)
849 goto out_free_dentry;
850
851 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
852 may depend on the personality. */
853 SET_PERSONALITY2(loc->elf_ex, &arch_state);
854 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
855 current->personality |= READ_IMPLIES_EXEC;
856
857 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
858 current->flags |= PF_RANDOMIZE;
859
860 setup_new_exec(bprm);
861 install_exec_creds(bprm);
862
863 /* Do this so that we can load the interpreter, if need be. We will
864 change some of these later */
865 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
866 executable_stack);
867 if (retval < 0)
868 goto out_free_dentry;
869
870 elf_bss = 0;
871 elf_brk = 0;
872
873 start_code = ~0UL;
874 end_code = 0;
875 start_data = 0;
876 end_data = 0;
877
878 /* Now we do a little grungy work by mmapping the ELF image into
879 the correct location in memory. */
880 for(i = 0, elf_ppnt = elf_phdata;
881 i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
882 int elf_prot, elf_flags;
883 unsigned long k, vaddr;
884 unsigned long total_size = 0;
885
886 if (elf_ppnt->p_type != PT_LOAD)
887 continue;
888
889 if (unlikely (elf_brk > elf_bss)) {
890 unsigned long nbyte;
891
892 /* There was a PT_LOAD segment with p_memsz > p_filesz
893 before this one. Map anonymous pages, if needed,
894 and clear the area. */
895 retval = set_brk(elf_bss + load_bias,
896 elf_brk + load_bias,
897 bss_prot);
898 if (retval)
899 goto out_free_dentry;
900 nbyte = ELF_PAGEOFFSET(elf_bss);
901 if (nbyte) {
902 nbyte = ELF_MIN_ALIGN - nbyte;
903 if (nbyte > elf_brk - elf_bss)
904 nbyte = elf_brk - elf_bss;
905 if (clear_user((void __user *)elf_bss +
906 load_bias, nbyte)) {
907 /*
908 * This bss-zeroing can fail if the ELF
909 * file specifies odd protections. So
910 * we don't check the return value
911 */
912 }
913 }
914 }
915
916 elf_prot = make_prot(elf_ppnt->p_flags);
917
918 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
919
920 vaddr = elf_ppnt->p_vaddr;
921 /*
922 * If we are loading ET_EXEC or we have already performed
923 * the ET_DYN load_addr calculations, proceed normally.
924 */
925 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
926 elf_flags |= MAP_FIXED;
927 } else if (loc->elf_ex.e_type == ET_DYN) {
928 /*
929 * This logic is run once for the first LOAD Program
930 * Header for ET_DYN binaries to calculate the
931 * randomization (load_bias) for all the LOAD
932 * Program Headers, and to calculate the entire
933 * size of the ELF mapping (total_size). (Note that
934 * load_addr_set is set to true later once the
935 * initial mapping is performed.)
936 *
937 * There are effectively two types of ET_DYN
938 * binaries: programs (i.e. PIE: ET_DYN with INTERP)
939 * and loaders (ET_DYN without INTERP, since they
940 * _are_ the ELF interpreter). The loaders must
941 * be loaded away from programs since the program
942 * may otherwise collide with the loader (especially
943 * for ET_EXEC which does not have a randomized
944 * position). For example to handle invocations of
945 * "./ld.so someprog" to test out a new version of
946 * the loader, the subsequent program that the
947 * loader loads must avoid the loader itself, so
948 * they cannot share the same load range. Sufficient
949 * room for the brk must be allocated with the
950 * loader as well, since brk must be available with
951 * the loader.
952 *
953 * Therefore, programs are loaded offset from
954 * ELF_ET_DYN_BASE and loaders are loaded into the
955 * independently randomized mmap region (0 load_bias
956 * without MAP_FIXED).
957 */
958 if (interpreter) {
959 load_bias = ELF_ET_DYN_BASE;
960 if (current->flags & PF_RANDOMIZE)
961 load_bias += arch_mmap_rnd();
962 elf_flags |= MAP_FIXED;
963 } else
964 load_bias = 0;
965
966 /*
967 * Since load_bias is used for all subsequent loading
968 * calculations, we must lower it by the first vaddr
969 * so that the remaining calculations based on the
970 * ELF vaddrs will be correctly offset. The result
971 * is then page aligned.
972 */
973 load_bias = ELF_PAGESTART(load_bias - vaddr);
974
975 total_size = total_mapping_size(elf_phdata,
976 loc->elf_ex.e_phnum);
977 if (!total_size) {
978 retval = -EINVAL;
979 goto out_free_dentry;
980 }
981 }
982
983 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
984 elf_prot, elf_flags, total_size);
985 if (BAD_ADDR(error)) {
986 retval = IS_ERR((void *)error) ?
987 PTR_ERR((void*)error) : -EINVAL;
988 goto out_free_dentry;
989 }
990
991 if (!load_addr_set) {
992 load_addr_set = 1;
993 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
994 if (loc->elf_ex.e_type == ET_DYN) {
995 load_bias += error -
996 ELF_PAGESTART(load_bias + vaddr);
997 load_addr += load_bias;
998 reloc_func_desc = load_bias;
999 }
1000 }
1001 k = elf_ppnt->p_vaddr;
1002 if (k < start_code)
1003 start_code = k;
1004 if (start_data < k)
1005 start_data = k;
1006
1007 /*
1008 * Check to see if the section's size will overflow the
1009 * allowed task size. Note that p_filesz must always be
1010 * <= p_memsz so it is only necessary to check p_memsz.
1011 */
1012 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
1013 elf_ppnt->p_memsz > TASK_SIZE ||
1014 TASK_SIZE - elf_ppnt->p_memsz < k) {
1015 /* set_brk can never work. Avoid overflows. */
1016 retval = -EINVAL;
1017 goto out_free_dentry;
1018 }
1019
1020 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
1021
1022 if (k > elf_bss)
1023 elf_bss = k;
1024 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
1025 end_code = k;
1026 if (end_data < k)
1027 end_data = k;
1028 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
1029 if (k > elf_brk) {
1030 bss_prot = elf_prot;
1031 elf_brk = k;
1032 }
1033 }
1034
1035 loc->elf_ex.e_entry += load_bias;
1036 elf_bss += load_bias;
1037 elf_brk += load_bias;
1038 start_code += load_bias;
1039 end_code += load_bias;
1040 start_data += load_bias;
1041 end_data += load_bias;
1042
1043 /* Calling set_brk effectively mmaps the pages that we need
1044 * for the bss and break sections. We must do this before
1045 * mapping in the interpreter, to make sure it doesn't wind
1046 * up getting placed where the bss needs to go.
1047 */
1048 retval = set_brk(elf_bss, elf_brk, bss_prot);
1049 if (retval)
1050 goto out_free_dentry;
1051 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
1052 retval = -EFAULT; /* Nobody gets to see this, but.. */
1053 goto out_free_dentry;
1054 }
1055
1056 if (interpreter) {
1057 unsigned long interp_map_addr = 0;
1058
1059 elf_entry = load_elf_interp(&loc->interp_elf_ex,
1060 interpreter,
1061 &interp_map_addr,
1062 load_bias, interp_elf_phdata);
1063 if (!IS_ERR((void *)elf_entry)) {
1064 /*
1065 * load_elf_interp() returns relocation
1066 * adjustment
1067 */
1068 interp_load_addr = elf_entry;
1069 elf_entry += loc->interp_elf_ex.e_entry;
1070 }
1071 if (BAD_ADDR(elf_entry)) {
1072 retval = IS_ERR((void *)elf_entry) ?
1073 (int)elf_entry : -EINVAL;
1074 goto out_free_dentry;
1075 }
1076 reloc_func_desc = interp_load_addr;
1077
1078 allow_write_access(interpreter);
1079 fput(interpreter);
1080 } else {
1081 elf_entry = loc->elf_ex.e_entry;
1082 if (BAD_ADDR(elf_entry)) {
1083 retval = -EINVAL;
1084 goto out_free_dentry;
1085 }
1086 }
1087
1088 kfree(interp_elf_phdata);
1089 kfree(elf_phdata);
1090
1091 set_binfmt(&elf_format);
1092
1093 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
1094 retval = arch_setup_additional_pages(bprm, !!interpreter);
1095 if (retval < 0)
1096 goto out;
1097 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
1098
1099 retval = create_elf_tables(bprm, &loc->elf_ex,
1100 load_addr, interp_load_addr);
1101 if (retval < 0)
1102 goto out;
1103 current->mm->end_code = end_code;
1104 current->mm->start_code = start_code;
1105 current->mm->start_data = start_data;
1106 current->mm->end_data = end_data;
1107 current->mm->start_stack = bprm->p;
1108
1109 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
1110 /*
1111 * For architectures with ELF randomization, when executing
1112 * a loader directly (i.e. no interpreter listed in ELF
1113 * headers), move the brk area out of the mmap region
1114 * (since it grows up, and may collide early with the stack
1115 * growing down), and into the unused ELF_ET_DYN_BASE region.
1116 */
1117 if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
1118 loc->elf_ex.e_type == ET_DYN && !interpreter)
1119 current->mm->brk = current->mm->start_brk =
1120 ELF_ET_DYN_BASE;
1121
1122 current->mm->brk = current->mm->start_brk =
1123 arch_randomize_brk(current->mm);
1124 #ifdef compat_brk_randomized
1125 current->brk_randomized = 1;
1126 #endif
1127 }
1128
1129 if (current->personality & MMAP_PAGE_ZERO) {
1130 /* Why this, you ask??? Well SVr4 maps page 0 as read-only,
1131 and some applications "depend" upon this behavior.
1132 Since we do not have the power to recompile these, we
1133 emulate the SVr4 behavior. Sigh. */
1134 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
1135 MAP_FIXED | MAP_PRIVATE, 0);
1136 }
1137
1138 regs = current_pt_regs();
1139 #ifdef ELF_PLAT_INIT
1140 /*
1141 * The ABI may specify that certain registers be set up in special
1142 * ways (on i386 %edx is the address of a DT_FINI function, for
1143 * example. In addition, it may also specify (eg, PowerPC64 ELF)
1144 * that the e_entry field is the address of the function descriptor
1145 * for the startup routine, rather than the address of the startup
1146 * routine itself. This macro performs whatever initialization to
1147 * the regs structure is required as well as any relocations to the
1148 * function descriptor entries when executing dynamically links apps.
1149 */
1150 ELF_PLAT_INIT(regs, reloc_func_desc);
1151 #endif
1152
1153 finalize_exec(bprm);
1154 start_thread(regs, elf_entry, bprm->p);
1155 retval = 0;
1156 out:
1157 kfree(loc);
1158 out_ret:
1159 return retval;
1160
1161 /* error cleanup */
1162 out_free_dentry:
1163 kfree(interp_elf_phdata);
1164 allow_write_access(interpreter);
1165 if (interpreter)
1166 fput(interpreter);
1167 out_free_ph:
1168 kfree(elf_phdata);
1169 goto out;
1170 }
1171
1172 #ifdef CONFIG_USELIB
1173 /* This is really simpleminded and specialized - we are loading an
1174 a.out library that is given an ELF header. */
load_elf_library(struct file * file)1175 static int load_elf_library(struct file *file)
1176 {
1177 struct elf_phdr *elf_phdata;
1178 struct elf_phdr *eppnt;
1179 unsigned long elf_bss, bss, len;
1180 int retval, error, i, j;
1181 struct elfhdr elf_ex;
1182 loff_t pos = 0;
1183
1184 error = -ENOEXEC;
1185 retval = kernel_read(file, &elf_ex, sizeof(elf_ex), &pos);
1186 if (retval != sizeof(elf_ex))
1187 goto out;
1188
1189 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1190 goto out;
1191
1192 /* First of all, some simple consistency checks */
1193 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1194 !elf_check_arch(&elf_ex) || !file->f_op->mmap)
1195 goto out;
1196 if (elf_check_fdpic(&elf_ex))
1197 goto out;
1198
1199 /* Now read in all of the header information */
1200
1201 j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1202 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1203
1204 error = -ENOMEM;
1205 elf_phdata = kmalloc(j, GFP_KERNEL);
1206 if (!elf_phdata)
1207 goto out;
1208
1209 eppnt = elf_phdata;
1210 error = -ENOEXEC;
1211 pos = elf_ex.e_phoff;
1212 retval = kernel_read(file, eppnt, j, &pos);
1213 if (retval != j)
1214 goto out_free_ph;
1215
1216 for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1217 if ((eppnt + i)->p_type == PT_LOAD)
1218 j++;
1219 if (j != 1)
1220 goto out_free_ph;
1221
1222 while (eppnt->p_type != PT_LOAD)
1223 eppnt++;
1224
1225 /* Now use mmap to map the library into memory. */
1226 error = vm_mmap(file,
1227 ELF_PAGESTART(eppnt->p_vaddr),
1228 (eppnt->p_filesz +
1229 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1230 PROT_READ | PROT_WRITE | PROT_EXEC,
1231 MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_DENYWRITE,
1232 (eppnt->p_offset -
1233 ELF_PAGEOFFSET(eppnt->p_vaddr)));
1234 if (error != ELF_PAGESTART(eppnt->p_vaddr))
1235 goto out_free_ph;
1236
1237 elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1238 if (padzero(elf_bss)) {
1239 error = -EFAULT;
1240 goto out_free_ph;
1241 }
1242
1243 len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr);
1244 bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr);
1245 if (bss > len) {
1246 error = vm_brk(len, bss - len);
1247 if (error)
1248 goto out_free_ph;
1249 }
1250 error = 0;
1251
1252 out_free_ph:
1253 kfree(elf_phdata);
1254 out:
1255 return error;
1256 }
1257 #endif /* #ifdef CONFIG_USELIB */
1258
1259 #ifdef CONFIG_ELF_CORE
1260 /*
1261 * ELF core dumper
1262 *
1263 * Modelled on fs/exec.c:aout_core_dump()
1264 * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1265 */
1266
1267 /*
1268 * The purpose of always_dump_vma() is to make sure that special kernel mappings
1269 * that are useful for post-mortem analysis are included in every core dump.
1270 * In that way we ensure that the core dump is fully interpretable later
1271 * without matching up the same kernel and hardware config to see what PC values
1272 * meant. These special mappings include - vDSO, vsyscall, and other
1273 * architecture specific mappings
1274 */
always_dump_vma(struct vm_area_struct * vma)1275 static bool always_dump_vma(struct vm_area_struct *vma)
1276 {
1277 /* Any vsyscall mappings? */
1278 if (vma == get_gate_vma(vma->vm_mm))
1279 return true;
1280
1281 /*
1282 * Assume that all vmas with a .name op should always be dumped.
1283 * If this changes, a new vm_ops field can easily be added.
1284 */
1285 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma))
1286 return true;
1287
1288 /*
1289 * arch_vma_name() returns non-NULL for special architecture mappings,
1290 * such as vDSO sections.
1291 */
1292 if (arch_vma_name(vma))
1293 return true;
1294
1295 return false;
1296 }
1297
1298 /*
1299 * Decide what to dump of a segment, part, all or none.
1300 */
vma_dump_size(struct vm_area_struct * vma,unsigned long mm_flags)1301 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1302 unsigned long mm_flags)
1303 {
1304 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
1305
1306 /* always dump the vdso and vsyscall sections */
1307 if (always_dump_vma(vma))
1308 goto whole;
1309
1310 if (vma->vm_flags & VM_DONTDUMP)
1311 return 0;
1312
1313 /* support for DAX */
1314 if (vma_is_dax(vma)) {
1315 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED))
1316 goto whole;
1317 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE))
1318 goto whole;
1319 return 0;
1320 }
1321
1322 /* Hugetlb memory check */
1323 if (vma->vm_flags & VM_HUGETLB) {
1324 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1325 goto whole;
1326 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1327 goto whole;
1328 return 0;
1329 }
1330
1331 /* Do not dump I/O mapped devices or special mappings */
1332 if (vma->vm_flags & VM_IO)
1333 return 0;
1334
1335 /* By default, dump shared memory if mapped from an anonymous file. */
1336 if (vma->vm_flags & VM_SHARED) {
1337 if (file_inode(vma->vm_file)->i_nlink == 0 ?
1338 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1339 goto whole;
1340 return 0;
1341 }
1342
1343 /* Dump segments that have been written to. */
1344 if (vma->anon_vma && FILTER(ANON_PRIVATE))
1345 goto whole;
1346 if (vma->vm_file == NULL)
1347 return 0;
1348
1349 if (FILTER(MAPPED_PRIVATE))
1350 goto whole;
1351
1352 /*
1353 * If this looks like the beginning of a DSO or executable mapping,
1354 * check for an ELF header. If we find one, dump the first page to
1355 * aid in determining what was mapped here.
1356 */
1357 if (FILTER(ELF_HEADERS) &&
1358 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1359 u32 __user *header = (u32 __user *) vma->vm_start;
1360 u32 word;
1361 mm_segment_t fs = get_fs();
1362 /*
1363 * Doing it this way gets the constant folded by GCC.
1364 */
1365 union {
1366 u32 cmp;
1367 char elfmag[SELFMAG];
1368 } magic;
1369 BUILD_BUG_ON(SELFMAG != sizeof word);
1370 magic.elfmag[EI_MAG0] = ELFMAG0;
1371 magic.elfmag[EI_MAG1] = ELFMAG1;
1372 magic.elfmag[EI_MAG2] = ELFMAG2;
1373 magic.elfmag[EI_MAG3] = ELFMAG3;
1374 /*
1375 * Switch to the user "segment" for get_user(),
1376 * then put back what elf_core_dump() had in place.
1377 */
1378 set_fs(USER_DS);
1379 if (unlikely(get_user(word, header)))
1380 word = 0;
1381 set_fs(fs);
1382 if (word == magic.cmp)
1383 return PAGE_SIZE;
1384 }
1385
1386 #undef FILTER
1387
1388 return 0;
1389
1390 whole:
1391 return vma->vm_end - vma->vm_start;
1392 }
1393
1394 /* An ELF note in memory */
1395 struct memelfnote
1396 {
1397 const char *name;
1398 int type;
1399 unsigned int datasz;
1400 void *data;
1401 };
1402
notesize(struct memelfnote * en)1403 static int notesize(struct memelfnote *en)
1404 {
1405 int sz;
1406
1407 sz = sizeof(struct elf_note);
1408 sz += roundup(strlen(en->name) + 1, 4);
1409 sz += roundup(en->datasz, 4);
1410
1411 return sz;
1412 }
1413
writenote(struct memelfnote * men,struct coredump_params * cprm)1414 static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1415 {
1416 struct elf_note en;
1417 en.n_namesz = strlen(men->name) + 1;
1418 en.n_descsz = men->datasz;
1419 en.n_type = men->type;
1420
1421 return dump_emit(cprm, &en, sizeof(en)) &&
1422 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1423 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1424 }
1425
fill_elf_header(struct elfhdr * elf,int segs,u16 machine,u32 flags)1426 static void fill_elf_header(struct elfhdr *elf, int segs,
1427 u16 machine, u32 flags)
1428 {
1429 memset(elf, 0, sizeof(*elf));
1430
1431 memcpy(elf->e_ident, ELFMAG, SELFMAG);
1432 elf->e_ident[EI_CLASS] = ELF_CLASS;
1433 elf->e_ident[EI_DATA] = ELF_DATA;
1434 elf->e_ident[EI_VERSION] = EV_CURRENT;
1435 elf->e_ident[EI_OSABI] = ELF_OSABI;
1436
1437 elf->e_type = ET_CORE;
1438 elf->e_machine = machine;
1439 elf->e_version = EV_CURRENT;
1440 elf->e_phoff = sizeof(struct elfhdr);
1441 elf->e_flags = flags;
1442 elf->e_ehsize = sizeof(struct elfhdr);
1443 elf->e_phentsize = sizeof(struct elf_phdr);
1444 elf->e_phnum = segs;
1445 }
1446
fill_elf_note_phdr(struct elf_phdr * phdr,int sz,loff_t offset)1447 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1448 {
1449 phdr->p_type = PT_NOTE;
1450 phdr->p_offset = offset;
1451 phdr->p_vaddr = 0;
1452 phdr->p_paddr = 0;
1453 phdr->p_filesz = sz;
1454 phdr->p_memsz = 0;
1455 phdr->p_flags = 0;
1456 phdr->p_align = 0;
1457 }
1458
fill_note(struct memelfnote * note,const char * name,int type,unsigned int sz,void * data)1459 static void fill_note(struct memelfnote *note, const char *name, int type,
1460 unsigned int sz, void *data)
1461 {
1462 note->name = name;
1463 note->type = type;
1464 note->datasz = sz;
1465 note->data = data;
1466 }
1467
1468 /*
1469 * fill up all the fields in prstatus from the given task struct, except
1470 * registers which need to be filled up separately.
1471 */
fill_prstatus(struct elf_prstatus * prstatus,struct task_struct * p,long signr)1472 static void fill_prstatus(struct elf_prstatus *prstatus,
1473 struct task_struct *p, long signr)
1474 {
1475 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1476 prstatus->pr_sigpend = p->pending.signal.sig[0];
1477 prstatus->pr_sighold = p->blocked.sig[0];
1478 rcu_read_lock();
1479 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1480 rcu_read_unlock();
1481 prstatus->pr_pid = task_pid_vnr(p);
1482 prstatus->pr_pgrp = task_pgrp_vnr(p);
1483 prstatus->pr_sid = task_session_vnr(p);
1484 if (thread_group_leader(p)) {
1485 struct task_cputime cputime;
1486
1487 /*
1488 * This is the record for the group leader. It shows the
1489 * group-wide total, not its individual thread total.
1490 */
1491 thread_group_cputime(p, &cputime);
1492 prstatus->pr_utime = ns_to_timeval(cputime.utime);
1493 prstatus->pr_stime = ns_to_timeval(cputime.stime);
1494 } else {
1495 u64 utime, stime;
1496
1497 task_cputime(p, &utime, &stime);
1498 prstatus->pr_utime = ns_to_timeval(utime);
1499 prstatus->pr_stime = ns_to_timeval(stime);
1500 }
1501
1502 prstatus->pr_cutime = ns_to_timeval(p->signal->cutime);
1503 prstatus->pr_cstime = ns_to_timeval(p->signal->cstime);
1504 }
1505
fill_psinfo(struct elf_prpsinfo * psinfo,struct task_struct * p,struct mm_struct * mm)1506 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1507 struct mm_struct *mm)
1508 {
1509 const struct cred *cred;
1510 unsigned int i, len;
1511
1512 /* first copy the parameters from user space */
1513 memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1514
1515 len = mm->arg_end - mm->arg_start;
1516 if (len >= ELF_PRARGSZ)
1517 len = ELF_PRARGSZ-1;
1518 if (copy_from_user(&psinfo->pr_psargs,
1519 (const char __user *)mm->arg_start, len))
1520 return -EFAULT;
1521 for(i = 0; i < len; i++)
1522 if (psinfo->pr_psargs[i] == 0)
1523 psinfo->pr_psargs[i] = ' ';
1524 psinfo->pr_psargs[len] = 0;
1525
1526 rcu_read_lock();
1527 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1528 rcu_read_unlock();
1529 psinfo->pr_pid = task_pid_vnr(p);
1530 psinfo->pr_pgrp = task_pgrp_vnr(p);
1531 psinfo->pr_sid = task_session_vnr(p);
1532
1533 i = p->state ? ffz(~p->state) + 1 : 0;
1534 psinfo->pr_state = i;
1535 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1536 psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1537 psinfo->pr_nice = task_nice(p);
1538 psinfo->pr_flag = p->flags;
1539 rcu_read_lock();
1540 cred = __task_cred(p);
1541 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1542 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1543 rcu_read_unlock();
1544 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1545
1546 return 0;
1547 }
1548
fill_auxv_note(struct memelfnote * note,struct mm_struct * mm)1549 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1550 {
1551 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1552 int i = 0;
1553 do
1554 i += 2;
1555 while (auxv[i - 2] != AT_NULL);
1556 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1557 }
1558
fill_siginfo_note(struct memelfnote * note,user_siginfo_t * csigdata,const kernel_siginfo_t * siginfo)1559 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1560 const kernel_siginfo_t *siginfo)
1561 {
1562 mm_segment_t old_fs = get_fs();
1563 set_fs(KERNEL_DS);
1564 copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo);
1565 set_fs(old_fs);
1566 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1567 }
1568
1569 #define MAX_FILE_NOTE_SIZE (4*1024*1024)
1570 /*
1571 * Format of NT_FILE note:
1572 *
1573 * long count -- how many files are mapped
1574 * long page_size -- units for file_ofs
1575 * array of [COUNT] elements of
1576 * long start
1577 * long end
1578 * long file_ofs
1579 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1580 */
fill_files_note(struct memelfnote * note)1581 static int fill_files_note(struct memelfnote *note)
1582 {
1583 struct vm_area_struct *vma;
1584 unsigned count, size, names_ofs, remaining, n;
1585 user_long_t *data;
1586 user_long_t *start_end_ofs;
1587 char *name_base, *name_curpos;
1588
1589 /* *Estimated* file count and total data size needed */
1590 count = current->mm->map_count;
1591 if (count > UINT_MAX / 64)
1592 return -EINVAL;
1593 size = count * 64;
1594
1595 names_ofs = (2 + 3 * count) * sizeof(data[0]);
1596 alloc:
1597 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
1598 return -EINVAL;
1599 size = round_up(size, PAGE_SIZE);
1600 data = kvmalloc(size, GFP_KERNEL);
1601 if (ZERO_OR_NULL_PTR(data))
1602 return -ENOMEM;
1603
1604 start_end_ofs = data + 2;
1605 name_base = name_curpos = ((char *)data) + names_ofs;
1606 remaining = size - names_ofs;
1607 count = 0;
1608 for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1609 struct file *file;
1610 const char *filename;
1611
1612 file = vma->vm_file;
1613 if (!file)
1614 continue;
1615 filename = file_path(file, name_curpos, remaining);
1616 if (IS_ERR(filename)) {
1617 if (PTR_ERR(filename) == -ENAMETOOLONG) {
1618 kvfree(data);
1619 size = size * 5 / 4;
1620 goto alloc;
1621 }
1622 continue;
1623 }
1624
1625 /* file_path() fills at the end, move name down */
1626 /* n = strlen(filename) + 1: */
1627 n = (name_curpos + remaining) - filename;
1628 remaining = filename - name_curpos;
1629 memmove(name_curpos, filename, n);
1630 name_curpos += n;
1631
1632 *start_end_ofs++ = vma->vm_start;
1633 *start_end_ofs++ = vma->vm_end;
1634 *start_end_ofs++ = vma->vm_pgoff;
1635 count++;
1636 }
1637
1638 /* Now we know exact count of files, can store it */
1639 data[0] = count;
1640 data[1] = PAGE_SIZE;
1641 /*
1642 * Count usually is less than current->mm->map_count,
1643 * we need to move filenames down.
1644 */
1645 n = current->mm->map_count - count;
1646 if (n != 0) {
1647 unsigned shift_bytes = n * 3 * sizeof(data[0]);
1648 memmove(name_base - shift_bytes, name_base,
1649 name_curpos - name_base);
1650 name_curpos -= shift_bytes;
1651 }
1652
1653 size = name_curpos - (char *)data;
1654 fill_note(note, "CORE", NT_FILE, size, data);
1655 return 0;
1656 }
1657
1658 #ifdef CORE_DUMP_USE_REGSET
1659 #include <linux/regset.h>
1660
1661 struct elf_thread_core_info {
1662 struct elf_thread_core_info *next;
1663 struct task_struct *task;
1664 struct elf_prstatus prstatus;
1665 struct memelfnote notes[0];
1666 };
1667
1668 struct elf_note_info {
1669 struct elf_thread_core_info *thread;
1670 struct memelfnote psinfo;
1671 struct memelfnote signote;
1672 struct memelfnote auxv;
1673 struct memelfnote files;
1674 user_siginfo_t csigdata;
1675 size_t size;
1676 int thread_notes;
1677 };
1678
1679 /*
1680 * When a regset has a writeback hook, we call it on each thread before
1681 * dumping user memory. On register window machines, this makes sure the
1682 * user memory backing the register data is up to date before we read it.
1683 */
do_thread_regset_writeback(struct task_struct * task,const struct user_regset * regset)1684 static void do_thread_regset_writeback(struct task_struct *task,
1685 const struct user_regset *regset)
1686 {
1687 if (regset->writeback)
1688 regset->writeback(task, regset, 1);
1689 }
1690
1691 #ifndef PRSTATUS_SIZE
1692 #define PRSTATUS_SIZE(S, R) sizeof(S)
1693 #endif
1694
1695 #ifndef SET_PR_FPVALID
1696 #define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V))
1697 #endif
1698
fill_thread_core_info(struct elf_thread_core_info * t,const struct user_regset_view * view,long signr,size_t * total)1699 static int fill_thread_core_info(struct elf_thread_core_info *t,
1700 const struct user_regset_view *view,
1701 long signr, size_t *total)
1702 {
1703 unsigned int i;
1704 unsigned int regset0_size = regset_size(t->task, &view->regsets[0]);
1705
1706 /*
1707 * NT_PRSTATUS is the one special case, because the regset data
1708 * goes into the pr_reg field inside the note contents, rather
1709 * than being the whole note contents. We fill the reset in here.
1710 * We assume that regset 0 is NT_PRSTATUS.
1711 */
1712 fill_prstatus(&t->prstatus, t->task, signr);
1713 (void) view->regsets[0].get(t->task, &view->regsets[0], 0, regset0_size,
1714 &t->prstatus.pr_reg, NULL);
1715
1716 fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1717 PRSTATUS_SIZE(t->prstatus, regset0_size), &t->prstatus);
1718 *total += notesize(&t->notes[0]);
1719
1720 do_thread_regset_writeback(t->task, &view->regsets[0]);
1721
1722 /*
1723 * Each other regset might generate a note too. For each regset
1724 * that has no core_note_type or is inactive, we leave t->notes[i]
1725 * all zero and we'll know to skip writing it later.
1726 */
1727 for (i = 1; i < view->n; ++i) {
1728 const struct user_regset *regset = &view->regsets[i];
1729 do_thread_regset_writeback(t->task, regset);
1730 if (regset->core_note_type && regset->get &&
1731 (!regset->active || regset->active(t->task, regset) > 0)) {
1732 int ret;
1733 size_t size = regset_size(t->task, regset);
1734 void *data = kmalloc(size, GFP_KERNEL);
1735 if (unlikely(!data))
1736 return 0;
1737 ret = regset->get(t->task, regset,
1738 0, size, data, NULL);
1739 if (unlikely(ret))
1740 kfree(data);
1741 else {
1742 if (regset->core_note_type != NT_PRFPREG)
1743 fill_note(&t->notes[i], "LINUX",
1744 regset->core_note_type,
1745 size, data);
1746 else {
1747 SET_PR_FPVALID(&t->prstatus,
1748 1, regset0_size);
1749 fill_note(&t->notes[i], "CORE",
1750 NT_PRFPREG, size, data);
1751 }
1752 *total += notesize(&t->notes[i]);
1753 }
1754 }
1755 }
1756
1757 return 1;
1758 }
1759
fill_note_info(struct elfhdr * elf,int phdrs,struct elf_note_info * info,const kernel_siginfo_t * siginfo,struct pt_regs * regs)1760 static int fill_note_info(struct elfhdr *elf, int phdrs,
1761 struct elf_note_info *info,
1762 const kernel_siginfo_t *siginfo, struct pt_regs *regs)
1763 {
1764 struct task_struct *dump_task = current;
1765 const struct user_regset_view *view = task_user_regset_view(dump_task);
1766 struct elf_thread_core_info *t;
1767 struct elf_prpsinfo *psinfo;
1768 struct core_thread *ct;
1769 unsigned int i;
1770
1771 info->size = 0;
1772 info->thread = NULL;
1773
1774 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1775 if (psinfo == NULL) {
1776 info->psinfo.data = NULL; /* So we don't free this wrongly */
1777 return 0;
1778 }
1779
1780 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1781
1782 /*
1783 * Figure out how many notes we're going to need for each thread.
1784 */
1785 info->thread_notes = 0;
1786 for (i = 0; i < view->n; ++i)
1787 if (view->regsets[i].core_note_type != 0)
1788 ++info->thread_notes;
1789
1790 /*
1791 * Sanity check. We rely on regset 0 being in NT_PRSTATUS,
1792 * since it is our one special case.
1793 */
1794 if (unlikely(info->thread_notes == 0) ||
1795 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1796 WARN_ON(1);
1797 return 0;
1798 }
1799
1800 /*
1801 * Initialize the ELF file header.
1802 */
1803 fill_elf_header(elf, phdrs,
1804 view->e_machine, view->e_flags);
1805
1806 /*
1807 * Allocate a structure for each thread.
1808 */
1809 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1810 t = kzalloc(offsetof(struct elf_thread_core_info,
1811 notes[info->thread_notes]),
1812 GFP_KERNEL);
1813 if (unlikely(!t))
1814 return 0;
1815
1816 t->task = ct->task;
1817 if (ct->task == dump_task || !info->thread) {
1818 t->next = info->thread;
1819 info->thread = t;
1820 } else {
1821 /*
1822 * Make sure to keep the original task at
1823 * the head of the list.
1824 */
1825 t->next = info->thread->next;
1826 info->thread->next = t;
1827 }
1828 }
1829
1830 /*
1831 * Now fill in each thread's information.
1832 */
1833 for (t = info->thread; t != NULL; t = t->next)
1834 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size))
1835 return 0;
1836
1837 /*
1838 * Fill in the two process-wide notes.
1839 */
1840 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1841 info->size += notesize(&info->psinfo);
1842
1843 fill_siginfo_note(&info->signote, &info->csigdata, siginfo);
1844 info->size += notesize(&info->signote);
1845
1846 fill_auxv_note(&info->auxv, current->mm);
1847 info->size += notesize(&info->auxv);
1848
1849 if (fill_files_note(&info->files) == 0)
1850 info->size += notesize(&info->files);
1851
1852 return 1;
1853 }
1854
get_note_info_size(struct elf_note_info * info)1855 static size_t get_note_info_size(struct elf_note_info *info)
1856 {
1857 return info->size;
1858 }
1859
1860 /*
1861 * Write all the notes for each thread. When writing the first thread, the
1862 * process-wide notes are interleaved after the first thread-specific note.
1863 */
write_note_info(struct elf_note_info * info,struct coredump_params * cprm)1864 static int write_note_info(struct elf_note_info *info,
1865 struct coredump_params *cprm)
1866 {
1867 bool first = true;
1868 struct elf_thread_core_info *t = info->thread;
1869
1870 do {
1871 int i;
1872
1873 if (!writenote(&t->notes[0], cprm))
1874 return 0;
1875
1876 if (first && !writenote(&info->psinfo, cprm))
1877 return 0;
1878 if (first && !writenote(&info->signote, cprm))
1879 return 0;
1880 if (first && !writenote(&info->auxv, cprm))
1881 return 0;
1882 if (first && info->files.data &&
1883 !writenote(&info->files, cprm))
1884 return 0;
1885
1886 for (i = 1; i < info->thread_notes; ++i)
1887 if (t->notes[i].data &&
1888 !writenote(&t->notes[i], cprm))
1889 return 0;
1890
1891 first = false;
1892 t = t->next;
1893 } while (t);
1894
1895 return 1;
1896 }
1897
free_note_info(struct elf_note_info * info)1898 static void free_note_info(struct elf_note_info *info)
1899 {
1900 struct elf_thread_core_info *threads = info->thread;
1901 while (threads) {
1902 unsigned int i;
1903 struct elf_thread_core_info *t = threads;
1904 threads = t->next;
1905 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1906 for (i = 1; i < info->thread_notes; ++i)
1907 kfree(t->notes[i].data);
1908 kfree(t);
1909 }
1910 kfree(info->psinfo.data);
1911 kvfree(info->files.data);
1912 }
1913
1914 #else
1915
1916 /* Here is the structure in which status of each thread is captured. */
1917 struct elf_thread_status
1918 {
1919 struct list_head list;
1920 struct elf_prstatus prstatus; /* NT_PRSTATUS */
1921 elf_fpregset_t fpu; /* NT_PRFPREG */
1922 struct task_struct *thread;
1923 #ifdef ELF_CORE_COPY_XFPREGS
1924 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */
1925 #endif
1926 struct memelfnote notes[3];
1927 int num_notes;
1928 };
1929
1930 /*
1931 * In order to add the specific thread information for the elf file format,
1932 * we need to keep a linked list of every threads pr_status and then create
1933 * a single section for them in the final core file.
1934 */
elf_dump_thread_status(long signr,struct elf_thread_status * t)1935 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1936 {
1937 int sz = 0;
1938 struct task_struct *p = t->thread;
1939 t->num_notes = 0;
1940
1941 fill_prstatus(&t->prstatus, p, signr);
1942 elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1943
1944 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1945 &(t->prstatus));
1946 t->num_notes++;
1947 sz += notesize(&t->notes[0]);
1948
1949 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1950 &t->fpu))) {
1951 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1952 &(t->fpu));
1953 t->num_notes++;
1954 sz += notesize(&t->notes[1]);
1955 }
1956
1957 #ifdef ELF_CORE_COPY_XFPREGS
1958 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1959 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1960 sizeof(t->xfpu), &t->xfpu);
1961 t->num_notes++;
1962 sz += notesize(&t->notes[2]);
1963 }
1964 #endif
1965 return sz;
1966 }
1967
1968 struct elf_note_info {
1969 struct memelfnote *notes;
1970 struct memelfnote *notes_files;
1971 struct elf_prstatus *prstatus; /* NT_PRSTATUS */
1972 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */
1973 struct list_head thread_list;
1974 elf_fpregset_t *fpu;
1975 #ifdef ELF_CORE_COPY_XFPREGS
1976 elf_fpxregset_t *xfpu;
1977 #endif
1978 user_siginfo_t csigdata;
1979 int thread_status_size;
1980 int numnote;
1981 };
1982
elf_note_info_init(struct elf_note_info * info)1983 static int elf_note_info_init(struct elf_note_info *info)
1984 {
1985 memset(info, 0, sizeof(*info));
1986 INIT_LIST_HEAD(&info->thread_list);
1987
1988 /* Allocate space for ELF notes */
1989 info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL);
1990 if (!info->notes)
1991 return 0;
1992 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1993 if (!info->psinfo)
1994 return 0;
1995 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1996 if (!info->prstatus)
1997 return 0;
1998 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1999 if (!info->fpu)
2000 return 0;
2001 #ifdef ELF_CORE_COPY_XFPREGS
2002 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
2003 if (!info->xfpu)
2004 return 0;
2005 #endif
2006 return 1;
2007 }
2008
fill_note_info(struct elfhdr * elf,int phdrs,struct elf_note_info * info,const kernel_siginfo_t * siginfo,struct pt_regs * regs)2009 static int fill_note_info(struct elfhdr *elf, int phdrs,
2010 struct elf_note_info *info,
2011 const kernel_siginfo_t *siginfo, struct pt_regs *regs)
2012 {
2013 struct core_thread *ct;
2014 struct elf_thread_status *ets;
2015
2016 if (!elf_note_info_init(info))
2017 return 0;
2018
2019 for (ct = current->mm->core_state->dumper.next;
2020 ct; ct = ct->next) {
2021 ets = kzalloc(sizeof(*ets), GFP_KERNEL);
2022 if (!ets)
2023 return 0;
2024
2025 ets->thread = ct->task;
2026 list_add(&ets->list, &info->thread_list);
2027 }
2028
2029 list_for_each_entry(ets, &info->thread_list, list) {
2030 int sz;
2031
2032 sz = elf_dump_thread_status(siginfo->si_signo, ets);
2033 info->thread_status_size += sz;
2034 }
2035 /* now collect the dump for the current */
2036 memset(info->prstatus, 0, sizeof(*info->prstatus));
2037 fill_prstatus(info->prstatus, current, siginfo->si_signo);
2038 elf_core_copy_regs(&info->prstatus->pr_reg, regs);
2039
2040 /* Set up header */
2041 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS);
2042
2043 /*
2044 * Set up the notes in similar form to SVR4 core dumps made
2045 * with info from their /proc.
2046 */
2047
2048 fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
2049 sizeof(*info->prstatus), info->prstatus);
2050 fill_psinfo(info->psinfo, current->group_leader, current->mm);
2051 fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
2052 sizeof(*info->psinfo), info->psinfo);
2053
2054 fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
2055 fill_auxv_note(info->notes + 3, current->mm);
2056 info->numnote = 4;
2057
2058 if (fill_files_note(info->notes + info->numnote) == 0) {
2059 info->notes_files = info->notes + info->numnote;
2060 info->numnote++;
2061 }
2062
2063 /* Try to dump the FPU. */
2064 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
2065 info->fpu);
2066 if (info->prstatus->pr_fpvalid)
2067 fill_note(info->notes + info->numnote++,
2068 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
2069 #ifdef ELF_CORE_COPY_XFPREGS
2070 if (elf_core_copy_task_xfpregs(current, info->xfpu))
2071 fill_note(info->notes + info->numnote++,
2072 "LINUX", ELF_CORE_XFPREG_TYPE,
2073 sizeof(*info->xfpu), info->xfpu);
2074 #endif
2075
2076 return 1;
2077 }
2078
get_note_info_size(struct elf_note_info * info)2079 static size_t get_note_info_size(struct elf_note_info *info)
2080 {
2081 int sz = 0;
2082 int i;
2083
2084 for (i = 0; i < info->numnote; i++)
2085 sz += notesize(info->notes + i);
2086
2087 sz += info->thread_status_size;
2088
2089 return sz;
2090 }
2091
write_note_info(struct elf_note_info * info,struct coredump_params * cprm)2092 static int write_note_info(struct elf_note_info *info,
2093 struct coredump_params *cprm)
2094 {
2095 struct elf_thread_status *ets;
2096 int i;
2097
2098 for (i = 0; i < info->numnote; i++)
2099 if (!writenote(info->notes + i, cprm))
2100 return 0;
2101
2102 /* write out the thread status notes section */
2103 list_for_each_entry(ets, &info->thread_list, list) {
2104 for (i = 0; i < ets->num_notes; i++)
2105 if (!writenote(&ets->notes[i], cprm))
2106 return 0;
2107 }
2108
2109 return 1;
2110 }
2111
free_note_info(struct elf_note_info * info)2112 static void free_note_info(struct elf_note_info *info)
2113 {
2114 while (!list_empty(&info->thread_list)) {
2115 struct list_head *tmp = info->thread_list.next;
2116 list_del(tmp);
2117 kfree(list_entry(tmp, struct elf_thread_status, list));
2118 }
2119
2120 /* Free data possibly allocated by fill_files_note(): */
2121 if (info->notes_files)
2122 kvfree(info->notes_files->data);
2123
2124 kfree(info->prstatus);
2125 kfree(info->psinfo);
2126 kfree(info->notes);
2127 kfree(info->fpu);
2128 #ifdef ELF_CORE_COPY_XFPREGS
2129 kfree(info->xfpu);
2130 #endif
2131 }
2132
2133 #endif
2134
first_vma(struct task_struct * tsk,struct vm_area_struct * gate_vma)2135 static struct vm_area_struct *first_vma(struct task_struct *tsk,
2136 struct vm_area_struct *gate_vma)
2137 {
2138 struct vm_area_struct *ret = tsk->mm->mmap;
2139
2140 if (ret)
2141 return ret;
2142 return gate_vma;
2143 }
2144 /*
2145 * Helper function for iterating across a vma list. It ensures that the caller
2146 * will visit `gate_vma' prior to terminating the search.
2147 */
next_vma(struct vm_area_struct * this_vma,struct vm_area_struct * gate_vma)2148 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
2149 struct vm_area_struct *gate_vma)
2150 {
2151 struct vm_area_struct *ret;
2152
2153 ret = this_vma->vm_next;
2154 if (ret)
2155 return ret;
2156 if (this_vma == gate_vma)
2157 return NULL;
2158 return gate_vma;
2159 }
2160
fill_extnum_info(struct elfhdr * elf,struct elf_shdr * shdr4extnum,elf_addr_t e_shoff,int segs)2161 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
2162 elf_addr_t e_shoff, int segs)
2163 {
2164 elf->e_shoff = e_shoff;
2165 elf->e_shentsize = sizeof(*shdr4extnum);
2166 elf->e_shnum = 1;
2167 elf->e_shstrndx = SHN_UNDEF;
2168
2169 memset(shdr4extnum, 0, sizeof(*shdr4extnum));
2170
2171 shdr4extnum->sh_type = SHT_NULL;
2172 shdr4extnum->sh_size = elf->e_shnum;
2173 shdr4extnum->sh_link = elf->e_shstrndx;
2174 shdr4extnum->sh_info = segs;
2175 }
2176
2177 /*
2178 * Actual dumper
2179 *
2180 * This is a two-pass process; first we find the offsets of the bits,
2181 * and then they are actually written out. If we run out of core limit
2182 * we just truncate.
2183 */
elf_core_dump(struct coredump_params * cprm)2184 static int elf_core_dump(struct coredump_params *cprm)
2185 {
2186 int has_dumped = 0;
2187 mm_segment_t fs;
2188 int segs, i;
2189 size_t vma_data_size = 0;
2190 struct vm_area_struct *vma, *gate_vma;
2191 struct elfhdr *elf = NULL;
2192 loff_t offset = 0, dataoff;
2193 struct elf_note_info info = { };
2194 struct elf_phdr *phdr4note = NULL;
2195 struct elf_shdr *shdr4extnum = NULL;
2196 Elf_Half e_phnum;
2197 elf_addr_t e_shoff;
2198 elf_addr_t *vma_filesz = NULL;
2199
2200 /*
2201 * We no longer stop all VM operations.
2202 *
2203 * This is because those proceses that could possibly change map_count
2204 * or the mmap / vma pages are now blocked in do_exit on current
2205 * finishing this core dump.
2206 *
2207 * Only ptrace can touch these memory addresses, but it doesn't change
2208 * the map_count or the pages allocated. So no possibility of crashing
2209 * exists while dumping the mm->vm_next areas to the core file.
2210 */
2211
2212 /* alloc memory for large data structures: too large to be on stack */
2213 elf = kmalloc(sizeof(*elf), GFP_KERNEL);
2214 if (!elf)
2215 goto out;
2216 /*
2217 * The number of segs are recored into ELF header as 16bit value.
2218 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2219 */
2220 segs = current->mm->map_count;
2221 segs += elf_core_extra_phdrs();
2222
2223 gate_vma = get_gate_vma(current->mm);
2224 if (gate_vma != NULL)
2225 segs++;
2226
2227 /* for notes section */
2228 segs++;
2229
2230 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2231 * this, kernel supports extended numbering. Have a look at
2232 * include/linux/elf.h for further information. */
2233 e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2234
2235 /*
2236 * Collect all the non-memory information about the process for the
2237 * notes. This also sets up the file header.
2238 */
2239 if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs))
2240 goto cleanup;
2241
2242 has_dumped = 1;
2243
2244 fs = get_fs();
2245 set_fs(KERNEL_DS);
2246
2247 offset += sizeof(*elf); /* Elf header */
2248 offset += segs * sizeof(struct elf_phdr); /* Program headers */
2249
2250 /* Write notes phdr entry */
2251 {
2252 size_t sz = get_note_info_size(&info);
2253
2254 sz += elf_coredump_extra_notes_size();
2255
2256 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2257 if (!phdr4note)
2258 goto end_coredump;
2259
2260 fill_elf_note_phdr(phdr4note, sz, offset);
2261 offset += sz;
2262 }
2263
2264 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2265
2266 if (segs - 1 > ULONG_MAX / sizeof(*vma_filesz))
2267 goto end_coredump;
2268 vma_filesz = kvmalloc(array_size(sizeof(*vma_filesz), (segs - 1)),
2269 GFP_KERNEL);
2270 if (ZERO_OR_NULL_PTR(vma_filesz))
2271 goto end_coredump;
2272
2273 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2274 vma = next_vma(vma, gate_vma)) {
2275 unsigned long dump_size;
2276
2277 dump_size = vma_dump_size(vma, cprm->mm_flags);
2278 vma_filesz[i++] = dump_size;
2279 vma_data_size += dump_size;
2280 }
2281
2282 offset += vma_data_size;
2283 offset += elf_core_extra_data_size();
2284 e_shoff = offset;
2285
2286 if (e_phnum == PN_XNUM) {
2287 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2288 if (!shdr4extnum)
2289 goto end_coredump;
2290 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2291 }
2292
2293 offset = dataoff;
2294
2295 if (!dump_emit(cprm, elf, sizeof(*elf)))
2296 goto end_coredump;
2297
2298 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
2299 goto end_coredump;
2300
2301 /* Write program headers for segments dump */
2302 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2303 vma = next_vma(vma, gate_vma)) {
2304 struct elf_phdr phdr;
2305
2306 phdr.p_type = PT_LOAD;
2307 phdr.p_offset = offset;
2308 phdr.p_vaddr = vma->vm_start;
2309 phdr.p_paddr = 0;
2310 phdr.p_filesz = vma_filesz[i++];
2311 phdr.p_memsz = vma->vm_end - vma->vm_start;
2312 offset += phdr.p_filesz;
2313 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2314 if (vma->vm_flags & VM_WRITE)
2315 phdr.p_flags |= PF_W;
2316 if (vma->vm_flags & VM_EXEC)
2317 phdr.p_flags |= PF_X;
2318 phdr.p_align = ELF_EXEC_PAGESIZE;
2319
2320 if (!dump_emit(cprm, &phdr, sizeof(phdr)))
2321 goto end_coredump;
2322 }
2323
2324 if (!elf_core_write_extra_phdrs(cprm, offset))
2325 goto end_coredump;
2326
2327 /* write out the notes section */
2328 if (!write_note_info(&info, cprm))
2329 goto end_coredump;
2330
2331 if (elf_coredump_extra_notes_write(cprm))
2332 goto end_coredump;
2333
2334 /* Align to page */
2335 if (!dump_skip(cprm, dataoff - cprm->pos))
2336 goto end_coredump;
2337
2338 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
2339 vma = next_vma(vma, gate_vma)) {
2340 unsigned long addr;
2341 unsigned long end;
2342
2343 end = vma->vm_start + vma_filesz[i++];
2344
2345 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2346 struct page *page;
2347 int stop;
2348
2349 page = get_dump_page(addr);
2350 if (page) {
2351 void *kaddr = kmap(page);
2352 stop = !dump_emit(cprm, kaddr, PAGE_SIZE);
2353 kunmap(page);
2354 put_page(page);
2355 } else
2356 stop = !dump_skip(cprm, PAGE_SIZE);
2357 if (stop)
2358 goto end_coredump;
2359 }
2360 }
2361 dump_truncate(cprm);
2362
2363 if (!elf_core_write_extra_data(cprm))
2364 goto end_coredump;
2365
2366 if (e_phnum == PN_XNUM) {
2367 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
2368 goto end_coredump;
2369 }
2370
2371 end_coredump:
2372 set_fs(fs);
2373
2374 cleanup:
2375 free_note_info(&info);
2376 kfree(shdr4extnum);
2377 kvfree(vma_filesz);
2378 kfree(phdr4note);
2379 kfree(elf);
2380 out:
2381 return has_dumped;
2382 }
2383
2384 #endif /* CONFIG_ELF_CORE */
2385
init_elf_binfmt(void)2386 static int __init init_elf_binfmt(void)
2387 {
2388 register_binfmt(&elf_format);
2389 return 0;
2390 }
2391
exit_elf_binfmt(void)2392 static void __exit exit_elf_binfmt(void)
2393 {
2394 /* Remove the COFF and ELF loaders. */
2395 unregister_binfmt(&elf_format);
2396 }
2397
2398 core_initcall(init_elf_binfmt);
2399 module_exit(exit_elf_binfmt);
2400 MODULE_LICENSE("GPL");
2401
