blob: 7d6f2f791fe975e33f43b169aa8fe7c0360fb839 [file] [log] [blame]
Thomas Gleixner09c434b2019-05-19 13:08:20 +01001// SPDX-License-Identifier: GPL-2.0-only
Linus Torvalds1da177e2005-04-16 15:20:36 -07002/*
3 * linux/fs/binfmt_elf.c
4 *
5 * These are the functions used to load ELF format executables as used
6 * on SVr4 machines. Information on the format may be found in the book
7 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
8 * Tools".
9 *
10 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
11 */
12
13#include <linux/module.h>
14#include <linux/kernel.h>
15#include <linux/fs.h>
Chris Kennellyce81bb22020-10-15 20:12:32 -070016#include <linux/log2.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070017#include <linux/mm.h>
18#include <linux/mman.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070019#include <linux/errno.h>
20#include <linux/signal.h>
21#include <linux/binfmts.h>
22#include <linux/string.h>
23#include <linux/file.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070024#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070025#include <linux/personality.h>
26#include <linux/elfcore.h>
27#include <linux/init.h>
28#include <linux/highuid.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/compiler.h>
30#include <linux/highmem.h>
Anshuman Khandual03911132020-04-06 20:03:51 -070031#include <linux/hugetlb.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070032#include <linux/pagemap.h>
Denys Vlasenko2aa362c2012-10-04 17:15:36 -070033#include <linux/vmalloc.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070034#include <linux/security.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/random.h>
Jesper Juhlf4e5cc22006-06-23 02:05:35 -070036#include <linux/elf.h>
Kees Cookd1fd8362015-04-14 15:48:07 -070037#include <linux/elf-randomize.h>
Alexey Dobriyan7e80d0d2007-05-08 00:28:59 -070038#include <linux/utsname.h>
Daisuke HATAYAMA088e7af2010-03-05 13:44:06 -080039#include <linux/coredump.h>
Frederic Weisbecker6fac4822012-11-13 14:20:55 +010040#include <linux/sched.h>
Ingo Molnarf7ccbae2017-02-08 18:51:30 +010041#include <linux/sched/coredump.h>
Ingo Molnar68db0cf2017-02-08 18:51:37 +010042#include <linux/sched/task_stack.h>
Ingo Molnar32ef5512017-02-05 11:48:36 +010043#include <linux/sched/cputime.h>
Dave Martin00e19ce2020-03-16 16:50:44 +000044#include <linux/sizes.h>
45#include <linux/types.h>
Ingo Molnar5b825c32017-02-02 17:54:15 +010046#include <linux/cred.h>
Ross Zwisler50378352015-10-05 16:33:36 -060047#include <linux/dax.h>
Linus Torvalds7c0f6ba2016-12-24 11:46:01 -080048#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <asm/param.h>
50#include <asm/page.h>
51
Dave Martin00e19ce2020-03-16 16:50:44 +000052#ifndef ELF_COMPAT
53#define ELF_COMPAT 0
54#endif
55
Denys Vlasenko2aa362c2012-10-04 17:15:36 -070056#ifndef user_long_t
57#define user_long_t long
58#endif
Denys Vlasenko49ae4d42012-10-04 17:15:35 -070059#ifndef user_siginfo_t
60#define user_siginfo_t siginfo_t
61#endif
62
Nicolas Pitre47552002017-08-16 16:05:13 -040063/* That's for binfmt_elf_fdpic to deal with */
64#ifndef elf_check_fdpic
65#define elf_check_fdpic(ex) false
66#endif
67
Al Viro71613c32012-10-20 22:00:48 -040068static int load_elf_binary(struct linux_binprm *bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -070069
Josh Triplett69369a72014-04-03 14:48:27 -070070#ifdef CONFIG_USELIB
71static int load_elf_library(struct file *);
72#else
73#define load_elf_library NULL
74#endif
75
Linus Torvalds1da177e2005-04-16 15:20:36 -070076/*
77 * If we don't support core dumping, then supply a NULL so we
78 * don't even try.
79 */
Christoph Hellwig698ba7b2009-12-15 16:47:37 -080080#ifdef CONFIG_ELF_CORE
Masami Hiramatsuf6151df2009-12-17 15:27:16 -080081static int elf_core_dump(struct coredump_params *cprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -070082#else
83#define elf_core_dump NULL
84#endif
85
86#if ELF_EXEC_PAGESIZE > PAGE_SIZE
Jesper Juhlf4e5cc22006-06-23 02:05:35 -070087#define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
Linus Torvalds1da177e2005-04-16 15:20:36 -070088#else
Jesper Juhlf4e5cc22006-06-23 02:05:35 -070089#define ELF_MIN_ALIGN PAGE_SIZE
Linus Torvalds1da177e2005-04-16 15:20:36 -070090#endif
91
92#ifndef ELF_CORE_EFLAGS
93#define ELF_CORE_EFLAGS 0
94#endif
95
96#define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
97#define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
98#define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
99
100static struct linux_binfmt elf_format = {
Mikael Petterssonf670d0e2011-01-12 17:00:02 -0800101 .module = THIS_MODULE,
102 .load_binary = load_elf_binary,
103 .load_shlib = load_elf_library,
104 .core_dump = elf_core_dump,
105 .min_coredump = ELF_EXEC_PAGESIZE,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700106};
107
Alexey Dobriyan18676ff2020-01-30 22:17:01 -0800108#define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109
Denys Vlasenko16e72e92017-02-22 15:45:16 -0800110static int set_brk(unsigned long start, unsigned long end, int prot)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700111{
112 start = ELF_PAGEALIGN(start);
113 end = ELF_PAGEALIGN(end);
114 if (end > start) {
Denys Vlasenko16e72e92017-02-22 15:45:16 -0800115 /*
116 * Map the last of the bss segment.
117 * If the header is requesting these pages to be
118 * executable, honour that (ppc32 needs this).
119 */
120 int error = vm_brk_flags(start, end - start,
121 prot & PROT_EXEC ? VM_EXEC : 0);
Linus Torvalds5d22fc22016-05-27 15:57:31 -0700122 if (error)
123 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700124 }
125 current->mm->start_brk = current->mm->brk = end;
126 return 0;
127}
128
Linus Torvalds1da177e2005-04-16 15:20:36 -0700129/* We need to explicitly zero any fractional pages
130 after the data section (i.e. bss). This would
131 contain the junk from the file that should not
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700132 be in memory
133 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700134static int padzero(unsigned long elf_bss)
135{
136 unsigned long nbyte;
137
138 nbyte = ELF_PAGEOFFSET(elf_bss);
139 if (nbyte) {
140 nbyte = ELF_MIN_ALIGN - nbyte;
141 if (clear_user((void __user *) elf_bss, nbyte))
142 return -EFAULT;
143 }
144 return 0;
145}
146
Ohad Ben-Cohen09c6dd32008-02-03 18:05:15 +0200147/* Let's use some macros to make this stack manipulation a little clearer */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700148#ifdef CONFIG_STACK_GROWSUP
149#define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
150#define STACK_ROUND(sp, items) \
151 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700152#define STACK_ALLOC(sp, len) ({ \
153 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
154 old_sp; })
Linus Torvalds1da177e2005-04-16 15:20:36 -0700155#else
156#define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
157#define STACK_ROUND(sp, items) \
158 (((unsigned long) (sp - items)) &~ 15UL)
159#define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
160#endif
161
Nathan Lynch483fad12008-07-22 04:48:46 +1000162#ifndef ELF_BASE_PLATFORM
163/*
164 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
165 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
166 * will be copied to the user stack in the same manner as AT_PLATFORM.
167 */
168#define ELF_BASE_PLATFORM NULL
169#endif
170
Linus Torvalds1da177e2005-04-16 15:20:36 -0700171static int
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800172create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
Akira Kawatadd85ed42022-01-27 21:40:16 +0900173 unsigned long interp_load_addr,
174 unsigned long e_entry, unsigned long phdr_addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700175{
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800176 struct mm_struct *mm = current->mm;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700177 unsigned long p = bprm->p;
178 int argc = bprm->argc;
179 int envc = bprm->envc;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700180 elf_addr_t __user *sp;
181 elf_addr_t __user *u_platform;
Nathan Lynch483fad12008-07-22 04:48:46 +1000182 elf_addr_t __user *u_base_platform;
Kees Cookf06295b2009-01-07 18:08:52 -0800183 elf_addr_t __user *u_rand_bytes;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700184 const char *k_platform = ELF_PLATFORM;
Nathan Lynch483fad12008-07-22 04:48:46 +1000185 const char *k_base_platform = ELF_BASE_PLATFORM;
Kees Cookf06295b2009-01-07 18:08:52 -0800186 unsigned char k_rand_bytes[16];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700187 int items;
188 elf_addr_t *elf_info;
Alexey Dobriyan1f83d802020-01-30 22:16:50 -0800189 int ei_index;
David Howells86a264a2008-11-14 10:39:18 +1100190 const struct cred *cred = current_cred();
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700191 struct vm_area_struct *vma;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700192
193 /*
Franck Bui-Huud68c9d62007-10-16 23:30:24 -0700194 * In some cases (e.g. Hyper-Threading), we want to avoid L1
195 * evictions by the processes running on the same package. One
196 * thing we can do is to shuffle the initial stack for them.
197 */
198
199 p = arch_align_stack(p);
200
201 /*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700202 * If this architecture has a platform capability string, copy it
203 * to userspace. In some cases (Sparc), this info is impossible
204 * for userspace to get any other way, in others (i386) it is
205 * merely difficult.
206 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700207 u_platform = NULL;
208 if (k_platform) {
209 size_t len = strlen(k_platform) + 1;
210
Linus Torvalds1da177e2005-04-16 15:20:36 -0700211 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
Al Viro646e84d2020-02-19 09:23:34 -0500212 if (copy_to_user(u_platform, k_platform, len))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213 return -EFAULT;
214 }
215
Nathan Lynch483fad12008-07-22 04:48:46 +1000216 /*
217 * If this architecture has a "base" platform capability
218 * string, copy it to userspace.
219 */
220 u_base_platform = NULL;
221 if (k_base_platform) {
222 size_t len = strlen(k_base_platform) + 1;
223
224 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
Al Viro646e84d2020-02-19 09:23:34 -0500225 if (copy_to_user(u_base_platform, k_base_platform, len))
Nathan Lynch483fad12008-07-22 04:48:46 +1000226 return -EFAULT;
227 }
228
Kees Cookf06295b2009-01-07 18:08:52 -0800229 /*
230 * Generate 16 random bytes for userspace PRNG seeding.
231 */
232 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
233 u_rand_bytes = (elf_addr_t __user *)
234 STACK_ALLOC(p, sizeof(k_rand_bytes));
Al Viro646e84d2020-02-19 09:23:34 -0500235 if (copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
Kees Cookf06295b2009-01-07 18:08:52 -0800236 return -EFAULT;
237
Linus Torvalds1da177e2005-04-16 15:20:36 -0700238 /* Create the ELF interpreter info */
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800239 elf_info = (elf_addr_t *)mm->saved_auxv;
Olaf Hering4f9a58d2007-10-16 23:30:12 -0700240 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700241#define NEW_AUX_ENT(id, val) \
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700242 do { \
Alexey Dobriyan1f83d802020-01-30 22:16:50 -0800243 *elf_info++ = id; \
244 *elf_info++ = val; \
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700245 } while (0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700246
247#ifdef ARCH_DLINFO
248 /*
249 * ARCH_DLINFO must come first so PPC can do its special alignment of
250 * AUXV.
Olaf Hering4f9a58d2007-10-16 23:30:12 -0700251 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
252 * ARCH_DLINFO changes
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 */
254 ARCH_DLINFO;
255#endif
256 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
257 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
258 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
Akira Kawatadd85ed42022-01-27 21:40:16 +0900259 NEW_AUX_ENT(AT_PHDR, phdr_addr);
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700260 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
262 NEW_AUX_ENT(AT_BASE, interp_load_addr);
263 NEW_AUX_ENT(AT_FLAGS, 0);
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800264 NEW_AUX_ENT(AT_ENTRY, e_entry);
Eric W. Biedermanebc887b2012-02-07 18:36:10 -0800265 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
266 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
267 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
268 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
Kees Cookc425e182017-07-18 15:25:22 -0700269 NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
Kees Cookf06295b2009-01-07 18:08:52 -0800270 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
Michael Neuling21713642013-04-17 17:33:11 +0000271#ifdef ELF_HWCAP2
272 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
273#endif
John Reiser65191082008-07-21 14:21:32 -0700274 NEW_AUX_ENT(AT_EXECFN, bprm->exec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700275 if (k_platform) {
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700276 NEW_AUX_ENT(AT_PLATFORM,
Jesper Juhl785d5572006-06-23 02:05:35 -0700277 (elf_addr_t)(unsigned long)u_platform);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278 }
Nathan Lynch483fad12008-07-22 04:48:46 +1000279 if (k_base_platform) {
280 NEW_AUX_ENT(AT_BASE_PLATFORM,
281 (elf_addr_t)(unsigned long)u_base_platform);
282 }
Eric W. Biedermanb8a61c92020-05-14 15:17:40 -0500283 if (bprm->have_execfd) {
284 NEW_AUX_ENT(AT_EXECFD, bprm->execfd);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700285 }
286#undef NEW_AUX_ENT
287 /* AT_NULL is zero; clear the rest too */
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800288 memset(elf_info, 0, (char *)mm->saved_auxv +
289 sizeof(mm->saved_auxv) - (char *)elf_info);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700290
291 /* And advance past the AT_NULL entry. */
Alexey Dobriyan1f83d802020-01-30 22:16:50 -0800292 elf_info += 2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700293
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800294 ei_index = elf_info - (elf_addr_t *)mm->saved_auxv;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700295 sp = STACK_ADD(p, ei_index);
296
Andi Kleend20894a2008-02-08 04:21:54 -0800297 items = (argc + 1) + (envc + 1) + 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700298 bprm->p = STACK_ROUND(sp, items);
299
300 /* Point sp at the lowest address on the stack */
301#ifdef CONFIG_STACK_GROWSUP
302 sp = (elf_addr_t __user *)bprm->p - items - ei_index;
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700303 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700304#else
305 sp = (elf_addr_t __user *)bprm->p;
306#endif
307
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700308
309 /*
310 * Grow the stack manually; some architectures have a limit on how
311 * far ahead a user-space access may be in order to grow the stack.
312 */
Jann Hornb2767d92020-10-17 16:14:15 -0700313 if (mmap_read_lock_killable(mm))
314 return -EINTR;
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800315 vma = find_extend_vma(mm, bprm->p);
Jann Hornb2767d92020-10-17 16:14:15 -0700316 mmap_read_unlock(mm);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700317 if (!vma)
318 return -EFAULT;
319
Linus Torvalds1da177e2005-04-16 15:20:36 -0700320 /* Now, let's put argc (and argv, envp if appropriate) on the stack */
Al Viro646e84d2020-02-19 09:23:34 -0500321 if (put_user(argc, sp++))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700322 return -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700323
Kees Cook67c67772017-07-10 15:52:54 -0700324 /* Populate list of argv pointers back to argv strings. */
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800325 p = mm->arg_end = mm->arg_start;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700326 while (argc-- > 0) {
327 size_t len;
Al Viro646e84d2020-02-19 09:23:34 -0500328 if (put_user((elf_addr_t)p, sp++))
Heiko Carstens841d5fb2006-12-06 20:36:35 -0800329 return -EFAULT;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700330 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
331 if (!len || len > MAX_ARG_STRLEN)
WANG Cong23c49712008-05-08 21:52:33 +0800332 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700333 p += len;
334 }
Al Viro646e84d2020-02-19 09:23:34 -0500335 if (put_user(0, sp++))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700336 return -EFAULT;
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800337 mm->arg_end = p;
Kees Cook67c67772017-07-10 15:52:54 -0700338
339 /* Populate list of envp pointers back to envp strings. */
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800340 mm->env_end = mm->env_start = p;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700341 while (envc-- > 0) {
342 size_t len;
Al Viro646e84d2020-02-19 09:23:34 -0500343 if (put_user((elf_addr_t)p, sp++))
Heiko Carstens841d5fb2006-12-06 20:36:35 -0800344 return -EFAULT;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700345 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
346 if (!len || len > MAX_ARG_STRLEN)
WANG Cong23c49712008-05-08 21:52:33 +0800347 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700348 p += len;
349 }
Al Viro646e84d2020-02-19 09:23:34 -0500350 if (put_user(0, sp++))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700351 return -EFAULT;
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800352 mm->env_end = p;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353
354 /* Put the elf_info on the stack in the right place. */
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800355 if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t)))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700356 return -EFAULT;
357 return 0;
358}
359
Linus Torvalds1da177e2005-04-16 15:20:36 -0700360static unsigned long elf_map(struct file *filep, unsigned long addr,
Alexey Dobriyan49ac9812019-03-07 16:29:03 -0800361 const struct elf_phdr *eppnt, int prot, int type,
Jiri Kosinacc503c12008-01-30 13:31:07 +0100362 unsigned long total_size)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700363{
364 unsigned long map_addr;
Jiri Kosinacc503c12008-01-30 13:31:07 +0100365 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
366 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
367 addr = ELF_PAGESTART(addr);
368 size = ELF_PAGEALIGN(size);
Jan Kratochvil60bfba72007-07-15 23:40:06 -0700369
Andrew Mortond4e3cc32007-07-21 04:37:32 -0700370 /* mmap() will return -EINVAL if given a zero size, but a
371 * segment with zero filesize is perfectly valid */
Jiri Kosinacc503c12008-01-30 13:31:07 +0100372 if (!size)
373 return addr;
374
Jiri Kosinacc503c12008-01-30 13:31:07 +0100375 /*
376 * total_size is the size of the ELF (interpreter) image.
377 * The _first_ mmap needs to know the full size, otherwise
378 * randomization might put this image into an overlapping
379 * position with the ELF binary image. (since size < total_size)
380 * So we first map the 'big' image - and unmap the remainder at
381 * the end. (which unmap is needed for ELF images with holes.)
382 */
383 if (total_size) {
384 total_size = ELF_PAGEALIGN(total_size);
Al Viro5a5e4c22012-05-30 01:49:38 -0400385 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
Jiri Kosinacc503c12008-01-30 13:31:07 +0100386 if (!BAD_ADDR(map_addr))
Al Viro5a5e4c22012-05-30 01:49:38 -0400387 vm_munmap(map_addr+size, total_size-size);
Jiri Kosinacc503c12008-01-30 13:31:07 +0100388 } else
Al Viro5a5e4c22012-05-30 01:49:38 -0400389 map_addr = vm_mmap(filep, addr, size, prot, type, off);
Jiri Kosinacc503c12008-01-30 13:31:07 +0100390
Tetsuo Handad23a61e2018-04-20 14:56:13 -0700391 if ((type & MAP_FIXED_NOREPLACE) &&
392 PTR_ERR((void *)map_addr) == -EEXIST)
393 pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n",
394 task_pid_nr(current), current->comm, (void *)addr);
Michal Hocko4ed28632018-04-10 16:36:01 -0700395
Linus Torvalds1da177e2005-04-16 15:20:36 -0700396 return(map_addr);
397}
398
Alexey Dobriyan49ac9812019-03-07 16:29:03 -0800399static unsigned long total_mapping_size(const struct elf_phdr *cmds, int nr)
Jiri Kosinacc503c12008-01-30 13:31:07 +0100400{
401 int i, first_idx = -1, last_idx = -1;
402
403 for (i = 0; i < nr; i++) {
404 if (cmds[i].p_type == PT_LOAD) {
405 last_idx = i;
406 if (first_idx == -1)
407 first_idx = i;
408 }
409 }
410 if (first_idx == -1)
411 return 0;
412
413 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
414 ELF_PAGESTART(cmds[first_idx].p_vaddr);
415}
416
Alexey Dobriyan658c0332019-12-04 16:52:25 -0800417static int elf_read(struct file *file, void *buf, size_t len, loff_t pos)
418{
419 ssize_t rv;
420
421 rv = kernel_read(file, buf, len, &pos);
422 if (unlikely(rv != len)) {
423 return (rv < 0) ? rv : -EIO;
424 }
425 return 0;
426}
427
Chris Kennellyce81bb22020-10-15 20:12:32 -0700428static unsigned long maximum_alignment(struct elf_phdr *cmds, int nr)
429{
430 unsigned long alignment = 0;
431 int i;
432
433 for (i = 0; i < nr; i++) {
434 if (cmds[i].p_type == PT_LOAD) {
435 unsigned long p_align = cmds[i].p_align;
436
437 /* skip non-power of two alignments as invalid */
438 if (!is_power_of_2(p_align))
439 continue;
440 alignment = max(alignment, p_align);
441 }
442 }
443
444 /* ensure we align to at least one page */
445 return ELF_PAGEALIGN(alignment);
446}
447
Paul Burton6a8d3892014-09-11 08:30:14 +0100448/**
449 * load_elf_phdrs() - load ELF program headers
450 * @elf_ex: ELF header of the binary whose program headers should be loaded
451 * @elf_file: the opened ELF binary file
452 *
453 * Loads ELF program headers from the binary file elf_file, which has the ELF
454 * header pointed to by elf_ex, into a newly allocated array. The caller is
455 * responsible for freeing the allocated data. Returns an ERR_PTR upon failure.
456 */
Alexey Dobriyan49ac9812019-03-07 16:29:03 -0800457static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
Paul Burton6a8d3892014-09-11 08:30:14 +0100458 struct file *elf_file)
459{
460 struct elf_phdr *elf_phdata = NULL;
Alexey Dobriyanfaf1c312019-03-07 16:28:56 -0800461 int retval, err = -1;
Alexey Dobriyanfaf1c312019-03-07 16:28:56 -0800462 unsigned int size;
Paul Burton6a8d3892014-09-11 08:30:14 +0100463
464 /*
465 * If the size of this structure has changed, then punt, since
466 * we will be doing the wrong thing.
467 */
468 if (elf_ex->e_phentsize != sizeof(struct elf_phdr))
469 goto out;
470
471 /* Sanity check the number of program headers... */
Paul Burton6a8d3892014-09-11 08:30:14 +0100472 /* ...and their total size. */
473 size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
Alexey Dobriyanfaf1c312019-03-07 16:28:56 -0800474 if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN)
Paul Burton6a8d3892014-09-11 08:30:14 +0100475 goto out;
476
477 elf_phdata = kmalloc(size, GFP_KERNEL);
478 if (!elf_phdata)
479 goto out;
480
481 /* Read in the program headers */
Alexey Dobriyan658c0332019-12-04 16:52:25 -0800482 retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff);
483 if (retval < 0) {
484 err = retval;
Paul Burton6a8d3892014-09-11 08:30:14 +0100485 goto out;
486 }
487
488 /* Success! */
489 err = 0;
490out:
491 if (err) {
492 kfree(elf_phdata);
493 elf_phdata = NULL;
494 }
495 return elf_phdata;
496}
Jiri Kosinacc503c12008-01-30 13:31:07 +0100497
Paul Burton774c1052014-09-11 08:30:16 +0100498#ifndef CONFIG_ARCH_BINFMT_ELF_STATE
499
500/**
501 * struct arch_elf_state - arch-specific ELF loading state
502 *
503 * This structure is used to preserve architecture specific data during
504 * the loading of an ELF file, throughout the checking of architecture
505 * specific ELF headers & through to the point where the ELF load is
506 * known to be proceeding (ie. SET_PERSONALITY).
507 *
508 * This implementation is a dummy for architectures which require no
509 * specific state.
510 */
511struct arch_elf_state {
512};
513
514#define INIT_ARCH_ELF_STATE {}
515
516/**
517 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header
518 * @ehdr: The main ELF header
519 * @phdr: The program header to check
520 * @elf: The open ELF file
521 * @is_interp: True if the phdr is from the interpreter of the ELF being
522 * loaded, else false.
523 * @state: Architecture-specific state preserved throughout the process
524 * of loading the ELF.
525 *
526 * Inspects the program header phdr to validate its correctness and/or
527 * suitability for the system. Called once per ELF program header in the
528 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its
529 * interpreter.
530 *
531 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
532 * with that return code.
533 */
534static inline int arch_elf_pt_proc(struct elfhdr *ehdr,
535 struct elf_phdr *phdr,
536 struct file *elf, bool is_interp,
537 struct arch_elf_state *state)
538{
539 /* Dummy implementation, always proceed */
540 return 0;
541}
542
543/**
Maciej W. Rozycki54d157142015-10-26 15:47:57 +0000544 * arch_check_elf() - check an ELF executable
Paul Burton774c1052014-09-11 08:30:16 +0100545 * @ehdr: The main ELF header
546 * @has_interp: True if the ELF has an interpreter, else false.
Maciej W. Rozyckieb4bc072015-11-13 00:47:48 +0000547 * @interp_ehdr: The interpreter's ELF header
Paul Burton774c1052014-09-11 08:30:16 +0100548 * @state: Architecture-specific state preserved throughout the process
549 * of loading the ELF.
550 *
551 * Provides a final opportunity for architecture code to reject the loading
552 * of the ELF & cause an exec syscall to return an error. This is called after
553 * all program headers to be checked by arch_elf_pt_proc have been.
554 *
555 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
556 * with that return code.
557 */
558static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp,
Maciej W. Rozyckieb4bc072015-11-13 00:47:48 +0000559 struct elfhdr *interp_ehdr,
Paul Burton774c1052014-09-11 08:30:16 +0100560 struct arch_elf_state *state)
561{
562 /* Dummy implementation, always proceed */
563 return 0;
564}
565
566#endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700567
Dave Martinfe0f6762020-03-16 16:50:46 +0000568static inline int make_prot(u32 p_flags, struct arch_elf_state *arch_state,
569 bool has_interp, bool is_interp)
Alexey Dobriyand8e7cb32019-05-14 15:43:51 -0700570{
571 int prot = 0;
572
573 if (p_flags & PF_R)
574 prot |= PROT_READ;
575 if (p_flags & PF_W)
576 prot |= PROT_WRITE;
577 if (p_flags & PF_X)
578 prot |= PROT_EXEC;
Dave Martinfe0f6762020-03-16 16:50:46 +0000579
580 return arch_elf_adjust_prot(prot, arch_state, has_interp, is_interp);
Alexey Dobriyand8e7cb32019-05-14 15:43:51 -0700581}
582
Linus Torvalds1da177e2005-04-16 15:20:36 -0700583/* This is much more generalized than the library routine read function,
584 so we keep this separate. Technically the library read function
585 is only provided so that we can read a.out libraries that have
586 an ELF header */
587
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700588static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
Alexey Dobriyan81696d52019-12-04 16:52:22 -0800589 struct file *interpreter,
Dave Martinfe0f6762020-03-16 16:50:46 +0000590 unsigned long no_base, struct elf_phdr *interp_elf_phdata,
591 struct arch_elf_state *arch_state)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700592{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700593 struct elf_phdr *eppnt;
594 unsigned long load_addr = 0;
595 int load_addr_set = 0;
596 unsigned long last_bss = 0, elf_bss = 0;
Denys Vlasenko16e72e92017-02-22 15:45:16 -0800597 int bss_prot = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700598 unsigned long error = ~0UL;
Jiri Kosinacc503c12008-01-30 13:31:07 +0100599 unsigned long total_size;
Paul Burton6a8d3892014-09-11 08:30:14 +0100600 int i;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700601
602 /* First of all, some simple consistency checks */
603 if (interp_elf_ex->e_type != ET_EXEC &&
604 interp_elf_ex->e_type != ET_DYN)
605 goto out;
Nicolas Pitre47552002017-08-16 16:05:13 -0400606 if (!elf_check_arch(interp_elf_ex) ||
607 elf_check_fdpic(interp_elf_ex))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700608 goto out;
Al Viro72c2d532013-09-22 16:27:52 -0400609 if (!interpreter->f_op->mmap)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700610 goto out;
611
Paul Burtona9d9ef12014-09-11 08:30:15 +0100612 total_size = total_mapping_size(interp_elf_phdata,
613 interp_elf_ex->e_phnum);
Jiri Kosinacc503c12008-01-30 13:31:07 +0100614 if (!total_size) {
615 error = -EINVAL;
Paul Burtona9d9ef12014-09-11 08:30:15 +0100616 goto out;
Jiri Kosinacc503c12008-01-30 13:31:07 +0100617 }
618
Paul Burtona9d9ef12014-09-11 08:30:15 +0100619 eppnt = interp_elf_phdata;
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700620 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
621 if (eppnt->p_type == PT_LOAD) {
622 int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
Dave Martinfe0f6762020-03-16 16:50:46 +0000623 int elf_prot = make_prot(eppnt->p_flags, arch_state,
624 true, true);
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700625 unsigned long vaddr = 0;
626 unsigned long k, map_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700627
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700628 vaddr = eppnt->p_vaddr;
629 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
Chen Jingwen15fd3952021-09-28 20:56:57 +0800630 elf_type |= MAP_FIXED;
Jiri Kosinacc503c12008-01-30 13:31:07 +0100631 else if (no_base && interp_elf_ex->e_type == ET_DYN)
632 load_addr = -vaddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700633
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700634 map_addr = elf_map(interpreter, load_addr + vaddr,
Andrew Mortonbb1ad822008-01-30 13:31:07 +0100635 eppnt, elf_prot, elf_type, total_size);
Jiri Kosinacc503c12008-01-30 13:31:07 +0100636 total_size = 0;
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700637 error = map_addr;
638 if (BAD_ADDR(map_addr))
Paul Burtona9d9ef12014-09-11 08:30:15 +0100639 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700640
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700641 if (!load_addr_set &&
642 interp_elf_ex->e_type == ET_DYN) {
643 load_addr = map_addr - ELF_PAGESTART(vaddr);
644 load_addr_set = 1;
645 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700646
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700647 /*
648 * Check to see if the section's size will overflow the
649 * allowed task size. Note that p_filesz must always be
650 * <= p_memsize so it's only necessary to check p_memsz.
651 */
652 k = load_addr + eppnt->p_vaddr;
Chuck Ebbertce510592006-07-03 00:24:14 -0700653 if (BAD_ADDR(k) ||
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700654 eppnt->p_filesz > eppnt->p_memsz ||
655 eppnt->p_memsz > TASK_SIZE ||
656 TASK_SIZE - eppnt->p_memsz < k) {
657 error = -ENOMEM;
Paul Burtona9d9ef12014-09-11 08:30:15 +0100658 goto out;
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700659 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700660
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700661 /*
662 * Find the end of the file mapping for this phdr, and
663 * keep track of the largest address we see for this.
664 */
665 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
666 if (k > elf_bss)
667 elf_bss = k;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700668
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700669 /*
670 * Do the same thing for the memory mapping - between
671 * elf_bss and last_bss is the bss section.
672 */
Kees Cook0036d1f2016-08-02 14:04:51 -0700673 k = load_addr + eppnt->p_vaddr + eppnt->p_memsz;
Denys Vlasenko16e72e92017-02-22 15:45:16 -0800674 if (k > last_bss) {
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700675 last_bss = k;
Denys Vlasenko16e72e92017-02-22 15:45:16 -0800676 bss_prot = elf_prot;
677 }
Jesper Juhlf4e5cc22006-06-23 02:05:35 -0700678 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700679 }
680
Kees Cook0036d1f2016-08-02 14:04:51 -0700681 /*
682 * Now fill out the bss section: first pad the last page from
683 * the file up to the page boundary, and zero it from elf_bss
684 * up to the end of the page.
685 */
686 if (padzero(elf_bss)) {
687 error = -EFAULT;
688 goto out;
689 }
690 /*
691 * Next, align both the file and mem bss up to the page size,
692 * since this is where elf_bss was just zeroed up to, and where
Denys Vlasenko16e72e92017-02-22 15:45:16 -0800693 * last_bss will end after the vm_brk_flags() below.
Kees Cook0036d1f2016-08-02 14:04:51 -0700694 */
695 elf_bss = ELF_PAGEALIGN(elf_bss);
696 last_bss = ELF_PAGEALIGN(last_bss);
697 /* Finally, if there is still more bss to allocate, do it. */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700698 if (last_bss > elf_bss) {
Denys Vlasenko16e72e92017-02-22 15:45:16 -0800699 error = vm_brk_flags(elf_bss, last_bss - elf_bss,
700 bss_prot & PROT_EXEC ? VM_EXEC : 0);
Linus Torvalds5d22fc22016-05-27 15:57:31 -0700701 if (error)
Paul Burtona9d9ef12014-09-11 08:30:15 +0100702 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700703 }
704
Jiri Kosinacc503c12008-01-30 13:31:07 +0100705 error = load_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700706out:
707 return error;
708}
709
Linus Torvalds1da177e2005-04-16 15:20:36 -0700710/*
711 * These are the functions used to load ELF style executables and shared
712 * libraries. There is no binary dependent code anywhere else.
713 */
714
Dave Martin00e19ce2020-03-16 16:50:44 +0000715static int parse_elf_property(const char *data, size_t *off, size_t datasz,
716 struct arch_elf_state *arch,
717 bool have_prev_type, u32 *prev_type)
718{
719 size_t o, step;
720 const struct gnu_property *pr;
721 int ret;
722
723 if (*off == datasz)
724 return -ENOENT;
725
726 if (WARN_ON_ONCE(*off > datasz || *off % ELF_GNU_PROPERTY_ALIGN))
727 return -EIO;
728 o = *off;
729 datasz -= *off;
730
731 if (datasz < sizeof(*pr))
732 return -ENOEXEC;
733 pr = (const struct gnu_property *)(data + o);
734 o += sizeof(*pr);
735 datasz -= sizeof(*pr);
736
737 if (pr->pr_datasz > datasz)
738 return -ENOEXEC;
739
740 WARN_ON_ONCE(o % ELF_GNU_PROPERTY_ALIGN);
741 step = round_up(pr->pr_datasz, ELF_GNU_PROPERTY_ALIGN);
742 if (step > datasz)
743 return -ENOEXEC;
744
745 /* Properties are supposed to be unique and sorted on pr_type: */
746 if (have_prev_type && pr->pr_type <= *prev_type)
747 return -ENOEXEC;
748 *prev_type = pr->pr_type;
749
750 ret = arch_parse_elf_property(pr->pr_type, data + o,
751 pr->pr_datasz, ELF_COMPAT, arch);
752 if (ret)
753 return ret;
754
755 *off = o + step;
756 return 0;
757}
758
759#define NOTE_DATA_SZ SZ_1K
760#define GNU_PROPERTY_TYPE_0_NAME "GNU"
761#define NOTE_NAME_SZ (sizeof(GNU_PROPERTY_TYPE_0_NAME))
762
763static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr,
764 struct arch_elf_state *arch)
765{
766 union {
767 struct elf_note nhdr;
768 char data[NOTE_DATA_SZ];
769 } note;
770 loff_t pos;
771 ssize_t n;
772 size_t off, datasz;
773 int ret;
774 bool have_prev_type;
775 u32 prev_type;
776
777 if (!IS_ENABLED(CONFIG_ARCH_USE_GNU_PROPERTY) || !phdr)
778 return 0;
779
780 /* load_elf_binary() shouldn't call us unless this is true... */
781 if (WARN_ON_ONCE(phdr->p_type != PT_GNU_PROPERTY))
782 return -ENOEXEC;
783
784 /* If the properties are crazy large, that's too bad (for now): */
785 if (phdr->p_filesz > sizeof(note))
786 return -ENOEXEC;
787
788 pos = phdr->p_offset;
789 n = kernel_read(f, &note, phdr->p_filesz, &pos);
790
791 BUILD_BUG_ON(sizeof(note) < sizeof(note.nhdr) + NOTE_NAME_SZ);
792 if (n < 0 || n < sizeof(note.nhdr) + NOTE_NAME_SZ)
793 return -EIO;
794
795 if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 ||
796 note.nhdr.n_namesz != NOTE_NAME_SZ ||
797 strncmp(note.data + sizeof(note.nhdr),
798 GNU_PROPERTY_TYPE_0_NAME, n - sizeof(note.nhdr)))
799 return -ENOEXEC;
800
801 off = round_up(sizeof(note.nhdr) + NOTE_NAME_SZ,
802 ELF_GNU_PROPERTY_ALIGN);
803 if (off > n)
804 return -ENOEXEC;
805
806 if (note.nhdr.n_descsz > n - off)
807 return -ENOEXEC;
808 datasz = off + note.nhdr.n_descsz;
809
810 have_prev_type = false;
811 do {
812 ret = parse_elf_property(note.data, &off, datasz, arch,
813 have_prev_type, &prev_type);
814 have_prev_type = true;
815 } while (!ret);
816
817 return ret == -ENOENT ? 0 : ret;
818}
819
Al Viro71613c32012-10-20 22:00:48 -0400820static int load_elf_binary(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700821{
822 struct file *interpreter = NULL; /* to shut gcc up */
Akira Kawatadd85ed42022-01-27 21:40:16 +0900823 unsigned long load_addr, load_bias = 0, phdr_addr = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700824 int load_addr_set = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700825 unsigned long error;
Paul Burtona9d9ef12014-09-11 08:30:15 +0100826 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
Dave Martin00e19ce2020-03-16 16:50:44 +0000827 struct elf_phdr *elf_property_phdata = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700828 unsigned long elf_bss, elf_brk;
Denys Vlasenko16e72e92017-02-22 15:45:16 -0800829 int bss_prot = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700830 int retval, i;
Jiri Kosinacc503c12008-01-30 13:31:07 +0100831 unsigned long elf_entry;
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800832 unsigned long e_entry;
Jiri Kosinacc503c12008-01-30 13:31:07 +0100833 unsigned long interp_load_addr = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700834 unsigned long start_code, end_code, start_data, end_data;
David Daney1a530a62011-03-22 16:34:48 -0700835 unsigned long reloc_func_desc __maybe_unused = 0;
David Rientjes8de61e62006-12-06 20:40:16 -0800836 int executable_stack = EXSTACK_DEFAULT;
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800837 struct elfhdr *elf_ex = (struct elfhdr *)bprm->buf;
Alexey Dobriyan0693ffe2020-04-06 20:11:29 -0700838 struct elfhdr *interp_elf_ex = NULL;
Paul Burton774c1052014-09-11 08:30:16 +0100839 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
Alexey Dobriyan03c6d722020-01-30 22:16:58 -0800840 struct mm_struct *mm;
Alexey Dobriyan249b08e2019-05-14 15:43:54 -0700841 struct pt_regs *regs;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700842
Linus Torvalds1da177e2005-04-16 15:20:36 -0700843 retval = -ENOEXEC;
844 /* First of all, some simple consistency checks */
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800845 if (memcmp(elf_ex->e_ident, ELFMAG, SELFMAG) != 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700846 goto out;
847
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800848 if (elf_ex->e_type != ET_EXEC && elf_ex->e_type != ET_DYN)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700849 goto out;
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800850 if (!elf_check_arch(elf_ex))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700851 goto out;
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800852 if (elf_check_fdpic(elf_ex))
Nicolas Pitre47552002017-08-16 16:05:13 -0400853 goto out;
Al Viro72c2d532013-09-22 16:27:52 -0400854 if (!bprm->file->f_op->mmap)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700855 goto out;
856
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800857 elf_phdata = load_elf_phdrs(elf_ex, bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700858 if (!elf_phdata)
859 goto out;
860
Linus Torvalds1da177e2005-04-16 15:20:36 -0700861 elf_ppnt = elf_phdata;
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800862 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) {
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700863 char *elf_interpreter;
Alexey Dobriyan5cf4a362019-05-14 15:43:36 -0700864
Dave Martin00e19ce2020-03-16 16:50:44 +0000865 if (elf_ppnt->p_type == PT_GNU_PROPERTY) {
866 elf_property_phdata = elf_ppnt;
867 continue;
868 }
869
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700870 if (elf_ppnt->p_type != PT_INTERP)
871 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700872
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700873 /*
874 * This is the program interpreter used for shared libraries -
875 * for now assume that this is an a.out format binary.
876 */
877 retval = -ENOEXEC;
878 if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2)
879 goto out_free_ph;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700880
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700881 retval = -ENOMEM;
882 elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL);
883 if (!elf_interpreter)
884 goto out_free_ph;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700885
Alexey Dobriyan658c0332019-12-04 16:52:25 -0800886 retval = elf_read(bprm->file, elf_interpreter, elf_ppnt->p_filesz,
887 elf_ppnt->p_offset);
888 if (retval < 0)
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700889 goto out_free_interp;
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700890 /* make sure path is NULL terminated */
891 retval = -ENOEXEC;
892 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
893 goto out_free_interp;
Alexey Dobriyan1fb84492007-01-26 00:57:16 -0800894
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700895 interpreter = open_exec(elf_interpreter);
896 kfree(elf_interpreter);
897 retval = PTR_ERR(interpreter);
898 if (IS_ERR(interpreter))
899 goto out_free_ph;
Alexey Dobriyan1fb84492007-01-26 00:57:16 -0800900
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700901 /*
902 * If the binary is not readable then enforce mm->dumpable = 0
903 * regardless of the interpreter's permissions.
904 */
905 would_dump(bprm, interpreter);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700906
Alexey Dobriyan0693ffe2020-04-06 20:11:29 -0700907 interp_elf_ex = kmalloc(sizeof(*interp_elf_ex), GFP_KERNEL);
908 if (!interp_elf_ex) {
909 retval = -ENOMEM;
910 goto out_free_ph;
911 }
912
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700913 /* Get the exec headers */
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -0700914 retval = elf_read(interpreter, interp_elf_ex,
915 sizeof(*interp_elf_ex), 0);
Alexey Dobriyan658c0332019-12-04 16:52:25 -0800916 if (retval < 0)
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700917 goto out_free_dentry;
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700918
919 break;
Alexey Dobriyancc338012019-05-14 15:43:39 -0700920
921out_free_interp:
Alexey Dobriyanbe0deb52019-05-14 15:43:45 -0700922 kfree(elf_interpreter);
923 goto out_free_ph;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700924 }
925
926 elf_ppnt = elf_phdata;
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800927 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++)
Paul Burton774c1052014-09-11 08:30:16 +0100928 switch (elf_ppnt->p_type) {
929 case PT_GNU_STACK:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700930 if (elf_ppnt->p_flags & PF_X)
931 executable_stack = EXSTACK_ENABLE_X;
932 else
933 executable_stack = EXSTACK_DISABLE_X;
934 break;
Paul Burton774c1052014-09-11 08:30:16 +0100935
936 case PT_LOPROC ... PT_HIPROC:
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800937 retval = arch_elf_pt_proc(elf_ex, elf_ppnt,
Paul Burton774c1052014-09-11 08:30:16 +0100938 bprm->file, false,
939 &arch_state);
940 if (retval)
941 goto out_free_dentry;
942 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700943 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700944
945 /* Some simple consistency checks for the interpreter */
Alexey Dobriyancc338012019-05-14 15:43:39 -0700946 if (interpreter) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700947 retval = -ELIBBAD;
Andi Kleend20894a2008-02-08 04:21:54 -0800948 /* Not an ELF interpreter */
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -0700949 if (memcmp(interp_elf_ex->e_ident, ELFMAG, SELFMAG) != 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700950 goto out_free_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700951 /* Verify the interpreter has a valid arch */
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -0700952 if (!elf_check_arch(interp_elf_ex) ||
953 elf_check_fdpic(interp_elf_ex))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700954 goto out_free_dentry;
Paul Burtona9d9ef12014-09-11 08:30:15 +0100955
956 /* Load the interpreter program headers */
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -0700957 interp_elf_phdata = load_elf_phdrs(interp_elf_ex,
Paul Burtona9d9ef12014-09-11 08:30:15 +0100958 interpreter);
959 if (!interp_elf_phdata)
960 goto out_free_dentry;
Paul Burton774c1052014-09-11 08:30:16 +0100961
962 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */
Dave Martin00e19ce2020-03-16 16:50:44 +0000963 elf_property_phdata = NULL;
Paul Burton774c1052014-09-11 08:30:16 +0100964 elf_ppnt = interp_elf_phdata;
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -0700965 for (i = 0; i < interp_elf_ex->e_phnum; i++, elf_ppnt++)
Paul Burton774c1052014-09-11 08:30:16 +0100966 switch (elf_ppnt->p_type) {
Dave Martin00e19ce2020-03-16 16:50:44 +0000967 case PT_GNU_PROPERTY:
968 elf_property_phdata = elf_ppnt;
969 break;
970
Paul Burton774c1052014-09-11 08:30:16 +0100971 case PT_LOPROC ... PT_HIPROC:
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -0700972 retval = arch_elf_pt_proc(interp_elf_ex,
Paul Burton774c1052014-09-11 08:30:16 +0100973 elf_ppnt, interpreter,
974 true, &arch_state);
975 if (retval)
976 goto out_free_dentry;
977 break;
978 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700979 }
980
Dave Martin00e19ce2020-03-16 16:50:44 +0000981 retval = parse_elf_properties(interpreter ?: bprm->file,
982 elf_property_phdata, &arch_state);
983 if (retval)
984 goto out_free_dentry;
985
Paul Burton774c1052014-09-11 08:30:16 +0100986 /*
987 * Allow arch code to reject the ELF at this point, whilst it's
988 * still possible to return an error to the code that invoked
989 * the exec syscall.
990 */
Alexey Dobriyana62c5b12020-01-30 22:16:55 -0800991 retval = arch_check_elf(elf_ex,
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -0700992 !!interpreter, interp_elf_ex,
Maciej W. Rozyckieb4bc072015-11-13 00:47:48 +0000993 &arch_state);
Paul Burton774c1052014-09-11 08:30:16 +0100994 if (retval)
995 goto out_free_dentry;
996
Linus Torvalds1da177e2005-04-16 15:20:36 -0700997 /* Flush all traces of the currently running executable */
Eric W. Biederman23887772020-05-03 07:54:10 -0500998 retval = begin_new_exec(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700999 if (retval)
1000 goto out_free_dentry;
1001
Linus Torvalds1da177e2005-04-16 15:20:36 -07001002 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
1003 may depend on the personality. */
Alexey Dobriyana62c5b12020-01-30 22:16:55 -08001004 SET_PERSONALITY2(*elf_ex, &arch_state);
1005 if (elf_read_implies_exec(*elf_ex, executable_stack))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001006 current->personality |= READ_IMPLIES_EXEC;
1007
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001008 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001009 current->flags |= PF_RANDOMIZE;
Linus Torvalds221af7f2010-01-28 22:14:42 -08001010
1011 setup_new_exec(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001012
1013 /* Do this so that we can load the interpreter, if need be. We will
1014 change some of these later */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001015 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
1016 executable_stack);
Al Viro19d860a2014-05-04 20:11:36 -04001017 if (retval < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001018 goto out_free_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001019
Alexey Dobriyan852643162019-05-14 15:43:48 -07001020 elf_bss = 0;
1021 elf_brk = 0;
1022
1023 start_code = ~0UL;
1024 end_code = 0;
1025 start_data = 0;
1026 end_data = 0;
1027
André Goddard Rosaaf901ca2009-11-14 13:09:05 -02001028 /* Now we do a little grungy work by mmapping the ELF image into
Jiri Kosinacc503c12008-01-30 13:31:07 +01001029 the correct location in memory. */
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001030 for(i = 0, elf_ppnt = elf_phdata;
Alexey Dobriyana62c5b12020-01-30 22:16:55 -08001031 i < elf_ex->e_phnum; i++, elf_ppnt++) {
Linus Torvaldsb2129212019-10-06 13:53:27 -07001032 int elf_prot, elf_flags;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001033 unsigned long k, vaddr;
Michael Davidsona87938b2015-04-14 15:47:38 -07001034 unsigned long total_size = 0;
Chris Kennellyce81bb22020-10-15 20:12:32 -07001035 unsigned long alignment;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001036
1037 if (elf_ppnt->p_type != PT_LOAD)
1038 continue;
1039
1040 if (unlikely (elf_brk > elf_bss)) {
1041 unsigned long nbyte;
1042
1043 /* There was a PT_LOAD segment with p_memsz > p_filesz
1044 before this one. Map anonymous pages, if needed,
1045 and clear the area. */
Mikael Petterssonf670d0e2011-01-12 17:00:02 -08001046 retval = set_brk(elf_bss + load_bias,
Denys Vlasenko16e72e92017-02-22 15:45:16 -08001047 elf_brk + load_bias,
1048 bss_prot);
Al Viro19d860a2014-05-04 20:11:36 -04001049 if (retval)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001050 goto out_free_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001051 nbyte = ELF_PAGEOFFSET(elf_bss);
1052 if (nbyte) {
1053 nbyte = ELF_MIN_ALIGN - nbyte;
1054 if (nbyte > elf_brk - elf_bss)
1055 nbyte = elf_brk - elf_bss;
1056 if (clear_user((void __user *)elf_bss +
1057 load_bias, nbyte)) {
1058 /*
1059 * This bss-zeroing can fail if the ELF
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001060 * file specifies odd protections. So
Linus Torvalds1da177e2005-04-16 15:20:36 -07001061 * we don't check the return value
1062 */
1063 }
1064 }
1065 }
1066
Dave Martinfe0f6762020-03-16 16:50:46 +00001067 elf_prot = make_prot(elf_ppnt->p_flags, &arch_state,
1068 !!interpreter, false);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001069
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001070 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001071
1072 vaddr = elf_ppnt->p_vaddr;
Kees Cookeab09532017-07-10 15:52:37 -07001073 /*
1074 * If we are loading ET_EXEC or we have already performed
1075 * the ET_DYN load_addr calculations, proceed normally.
1076 */
Alexey Dobriyana62c5b12020-01-30 22:16:55 -08001077 if (elf_ex->e_type == ET_EXEC || load_addr_set) {
Linus Torvaldsb2129212019-10-06 13:53:27 -07001078 elf_flags |= MAP_FIXED;
Alexey Dobriyana62c5b12020-01-30 22:16:55 -08001079 } else if (elf_ex->e_type == ET_DYN) {
Kees Cookeab09532017-07-10 15:52:37 -07001080 /*
1081 * This logic is run once for the first LOAD Program
1082 * Header for ET_DYN binaries to calculate the
1083 * randomization (load_bias) for all the LOAD
1084 * Program Headers, and to calculate the entire
1085 * size of the ELF mapping (total_size). (Note that
1086 * load_addr_set is set to true later once the
1087 * initial mapping is performed.)
1088 *
1089 * There are effectively two types of ET_DYN
1090 * binaries: programs (i.e. PIE: ET_DYN with INTERP)
1091 * and loaders (ET_DYN without INTERP, since they
1092 * _are_ the ELF interpreter). The loaders must
1093 * be loaded away from programs since the program
1094 * may otherwise collide with the loader (especially
1095 * for ET_EXEC which does not have a randomized
1096 * position). For example to handle invocations of
1097 * "./ld.so someprog" to test out a new version of
1098 * the loader, the subsequent program that the
1099 * loader loads must avoid the loader itself, so
1100 * they cannot share the same load range. Sufficient
1101 * room for the brk must be allocated with the
1102 * loader as well, since brk must be available with
1103 * the loader.
1104 *
1105 * Therefore, programs are loaded offset from
1106 * ELF_ET_DYN_BASE and loaders are loaded into the
1107 * independently randomized mmap region (0 load_bias
1108 * without MAP_FIXED).
1109 */
Alexey Dobriyancc338012019-05-14 15:43:39 -07001110 if (interpreter) {
Kees Cookeab09532017-07-10 15:52:37 -07001111 load_bias = ELF_ET_DYN_BASE;
1112 if (current->flags & PF_RANDOMIZE)
1113 load_bias += arch_mmap_rnd();
Chris Kennellyce81bb22020-10-15 20:12:32 -07001114 alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum);
1115 if (alignment)
1116 load_bias &= ~(alignment - 1);
Linus Torvaldsb2129212019-10-06 13:53:27 -07001117 elf_flags |= MAP_FIXED;
Kees Cookeab09532017-07-10 15:52:37 -07001118 } else
1119 load_bias = 0;
1120
1121 /*
1122 * Since load_bias is used for all subsequent loading
1123 * calculations, we must lower it by the first vaddr
1124 * so that the remaining calculations based on the
1125 * ELF vaddrs will be correctly offset. The result
1126 * is then page aligned.
1127 */
1128 load_bias = ELF_PAGESTART(load_bias - vaddr);
1129
Michael Davidsona87938b2015-04-14 15:47:38 -07001130 total_size = total_mapping_size(elf_phdata,
Alexey Dobriyana62c5b12020-01-30 22:16:55 -08001131 elf_ex->e_phnum);
Michael Davidsona87938b2015-04-14 15:47:38 -07001132 if (!total_size) {
Andrew Morton2b1d3ae2015-05-28 15:44:24 -07001133 retval = -EINVAL;
Michael Davidsona87938b2015-04-14 15:47:38 -07001134 goto out_free_dentry;
1135 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001136 }
1137
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001138 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
Michael Davidsona87938b2015-04-14 15:47:38 -07001139 elf_prot, elf_flags, total_size);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001140 if (BAD_ADDR(error)) {
Alexey Kuznetsovb140f2512007-05-08 00:31:57 -07001141 retval = IS_ERR((void *)error) ?
1142 PTR_ERR((void*)error) : -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001143 goto out_free_dentry;
1144 }
1145
1146 if (!load_addr_set) {
1147 load_addr_set = 1;
1148 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
Alexey Dobriyana62c5b12020-01-30 22:16:55 -08001149 if (elf_ex->e_type == ET_DYN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001150 load_bias += error -
1151 ELF_PAGESTART(load_bias + vaddr);
1152 load_addr += load_bias;
1153 reloc_func_desc = load_bias;
1154 }
1155 }
Akira Kawatadd85ed42022-01-27 21:40:16 +09001156
1157 /*
1158 * Figure out which segment in the file contains the Program
1159 * Header table, and map to the associated memory address.
1160 */
1161 if (elf_ppnt->p_offset <= elf_ex->e_phoff &&
1162 elf_ex->e_phoff < elf_ppnt->p_offset + elf_ppnt->p_filesz) {
1163 phdr_addr = elf_ex->e_phoff - elf_ppnt->p_offset +
1164 elf_ppnt->p_vaddr;
1165 }
1166
Linus Torvalds1da177e2005-04-16 15:20:36 -07001167 k = elf_ppnt->p_vaddr;
Alexey Dobriyanf67ef442020-01-30 22:16:52 -08001168 if ((elf_ppnt->p_flags & PF_X) && k < start_code)
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001169 start_code = k;
1170 if (start_data < k)
1171 start_data = k;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001172
1173 /*
1174 * Check to see if the section's size will overflow the
1175 * allowed task size. Note that p_filesz must always be
1176 * <= p_memsz so it is only necessary to check p_memsz.
1177 */
Chuck Ebbertce510592006-07-03 00:24:14 -07001178 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001179 elf_ppnt->p_memsz > TASK_SIZE ||
1180 TASK_SIZE - elf_ppnt->p_memsz < k) {
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001181 /* set_brk can never work. Avoid overflows. */
Alexey Kuznetsovb140f2512007-05-08 00:31:57 -07001182 retval = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001183 goto out_free_dentry;
1184 }
1185
1186 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
1187
1188 if (k > elf_bss)
1189 elf_bss = k;
1190 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
1191 end_code = k;
1192 if (end_data < k)
1193 end_data = k;
1194 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
Denys Vlasenko16e72e92017-02-22 15:45:16 -08001195 if (k > elf_brk) {
1196 bss_prot = elf_prot;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001197 elf_brk = k;
Denys Vlasenko16e72e92017-02-22 15:45:16 -08001198 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001199 }
1200
Alexey Dobriyana62c5b12020-01-30 22:16:55 -08001201 e_entry = elf_ex->e_entry + load_bias;
Akira Kawatadd85ed42022-01-27 21:40:16 +09001202 phdr_addr += load_bias;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001203 elf_bss += load_bias;
1204 elf_brk += load_bias;
1205 start_code += load_bias;
1206 end_code += load_bias;
1207 start_data += load_bias;
1208 end_data += load_bias;
1209
1210 /* Calling set_brk effectively mmaps the pages that we need
1211 * for the bss and break sections. We must do this before
1212 * mapping in the interpreter, to make sure it doesn't wind
1213 * up getting placed where the bss needs to go.
1214 */
Denys Vlasenko16e72e92017-02-22 15:45:16 -08001215 retval = set_brk(elf_bss, elf_brk, bss_prot);
Al Viro19d860a2014-05-04 20:11:36 -04001216 if (retval)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001217 goto out_free_dentry;
akpm@osdl.org6de50512005-10-11 08:29:08 -07001218 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001219 retval = -EFAULT; /* Nobody gets to see this, but.. */
1220 goto out_free_dentry;
1221 }
1222
Alexey Dobriyancc338012019-05-14 15:43:39 -07001223 if (interpreter) {
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -07001224 elf_entry = load_elf_interp(interp_elf_ex,
Andi Kleend20894a2008-02-08 04:21:54 -08001225 interpreter,
Dave Martinfe0f6762020-03-16 16:50:46 +00001226 load_bias, interp_elf_phdata,
1227 &arch_state);
Andi Kleend20894a2008-02-08 04:21:54 -08001228 if (!IS_ERR((void *)elf_entry)) {
1229 /*
1230 * load_elf_interp() returns relocation
1231 * adjustment
1232 */
1233 interp_load_addr = elf_entry;
Alexey Dobriyanc69bcc92020-04-06 20:11:26 -07001234 elf_entry += interp_elf_ex->e_entry;
Jiri Kosinacc503c12008-01-30 13:31:07 +01001235 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001236 if (BAD_ADDR(elf_entry)) {
Chuck Ebbertce510592006-07-03 00:24:14 -07001237 retval = IS_ERR((void *)elf_entry) ?
1238 (int)elf_entry : -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001239 goto out_free_dentry;
1240 }
1241 reloc_func_desc = interp_load_addr;
1242
1243 allow_write_access(interpreter);
1244 fput(interpreter);
Alexey Dobriyan0693ffe2020-04-06 20:11:29 -07001245
1246 kfree(interp_elf_ex);
Alexey Dobriyanaa0d1562020-04-06 20:11:32 -07001247 kfree(interp_elf_phdata);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001248 } else {
Alexey Dobriyana62c5b12020-01-30 22:16:55 -08001249 elf_entry = e_entry;
Suresh Siddha5342fba2006-02-26 04:18:28 +01001250 if (BAD_ADDR(elf_entry)) {
Chuck Ebbertce510592006-07-03 00:24:14 -07001251 retval = -EINVAL;
Suresh Siddha5342fba2006-02-26 04:18:28 +01001252 goto out_free_dentry;
1253 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001254 }
1255
1256 kfree(elf_phdata);
1257
Linus Torvalds1da177e2005-04-16 15:20:36 -07001258 set_binfmt(&elf_format);
1259
Benjamin Herrenschmidt547ee842005-04-16 15:24:35 -07001260#ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
Alexey Dobriyancc338012019-05-14 15:43:39 -07001261 retval = arch_setup_additional_pages(bprm, !!interpreter);
Al Viro19d860a2014-05-04 20:11:36 -04001262 if (retval < 0)
Roland McGrath18c8baff2005-04-28 15:17:19 -07001263 goto out;
Benjamin Herrenschmidt547ee842005-04-16 15:24:35 -07001264#endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
1265
Akira Kawatadd85ed42022-01-27 21:40:16 +09001266 retval = create_elf_tables(bprm, elf_ex, interp_load_addr,
1267 e_entry, phdr_addr);
Al Viro19d860a2014-05-04 20:11:36 -04001268 if (retval < 0)
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001269 goto out;
Alexey Dobriyan03c6d722020-01-30 22:16:58 -08001270
1271 mm = current->mm;
1272 mm->end_code = end_code;
1273 mm->start_code = start_code;
1274 mm->start_data = start_data;
1275 mm->end_data = end_data;
1276 mm->start_stack = bprm->p;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001277
Jiri Kosina4471a672011-04-14 15:22:09 -07001278 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
Kees Cookbbdc6072019-05-14 15:43:57 -07001279 /*
1280 * For architectures with ELF randomization, when executing
1281 * a loader directly (i.e. no interpreter listed in ELF
1282 * headers), move the brk area out of the mmap region
1283 * (since it grows up, and may collide early with the stack
1284 * growing down), and into the unused ELF_ET_DYN_BASE region.
1285 */
Kees Cook7be3cb02019-09-26 10:15:25 -07001286 if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
Alexey Dobriyan03c6d722020-01-30 22:16:58 -08001287 elf_ex->e_type == ET_DYN && !interpreter) {
1288 mm->brk = mm->start_brk = ELF_ET_DYN_BASE;
1289 }
Kees Cookbbdc6072019-05-14 15:43:57 -07001290
Alexey Dobriyan03c6d722020-01-30 22:16:58 -08001291 mm->brk = mm->start_brk = arch_randomize_brk(mm);
Kees Cook204db6e2015-04-14 15:48:12 -07001292#ifdef compat_brk_randomized
Jiri Kosina4471a672011-04-14 15:22:09 -07001293 current->brk_randomized = 1;
1294#endif
1295 }
Jiri Kosinac1d171a2008-01-30 13:30:40 +01001296
Linus Torvalds1da177e2005-04-16 15:20:36 -07001297 if (current->personality & MMAP_PAGE_ZERO) {
1298 /* Why this, you ask??? Well SVr4 maps page 0 as read-only,
1299 and some applications "depend" upon this behavior.
1300 Since we do not have the power to recompile these, we
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001301 emulate the SVr4 behavior. Sigh. */
Linus Torvalds6be5ceb2012-04-20 17:13:58 -07001302 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001303 MAP_FIXED | MAP_PRIVATE, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001304 }
1305
Alexey Dobriyan249b08e2019-05-14 15:43:54 -07001306 regs = current_pt_regs();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001307#ifdef ELF_PLAT_INIT
1308 /*
1309 * The ABI may specify that certain registers be set up in special
1310 * ways (on i386 %edx is the address of a DT_FINI function, for
1311 * example. In addition, it may also specify (eg, PowerPC64 ELF)
1312 * that the e_entry field is the address of the function descriptor
1313 * for the startup routine, rather than the address of the startup
1314 * routine itself. This macro performs whatever initialization to
1315 * the regs structure is required as well as any relocations to the
1316 * function descriptor entries when executing dynamically links apps.
1317 */
1318 ELF_PLAT_INIT(regs, reloc_func_desc);
1319#endif
1320
Kees Cookb8383832018-04-10 16:34:57 -07001321 finalize_exec(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001322 start_thread(regs, elf_entry, bprm->p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001323 retval = 0;
1324out:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001325 return retval;
1326
1327 /* error cleanup */
1328out_free_dentry:
Alexey Dobriyan0693ffe2020-04-06 20:11:29 -07001329 kfree(interp_elf_ex);
Paul Burtona9d9ef12014-09-11 08:30:15 +01001330 kfree(interp_elf_phdata);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001331 allow_write_access(interpreter);
1332 if (interpreter)
1333 fput(interpreter);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001334out_free_ph:
1335 kfree(elf_phdata);
1336 goto out;
1337}
1338
Josh Triplett69369a72014-04-03 14:48:27 -07001339#ifdef CONFIG_USELIB
Linus Torvalds1da177e2005-04-16 15:20:36 -07001340/* This is really simpleminded and specialized - we are loading an
1341 a.out library that is given an ELF header. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001342static int load_elf_library(struct file *file)
1343{
1344 struct elf_phdr *elf_phdata;
1345 struct elf_phdr *eppnt;
1346 unsigned long elf_bss, bss, len;
1347 int retval, error, i, j;
1348 struct elfhdr elf_ex;
1349
1350 error = -ENOEXEC;
Alexey Dobriyan658c0332019-12-04 16:52:25 -08001351 retval = elf_read(file, &elf_ex, sizeof(elf_ex), 0);
1352 if (retval < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001353 goto out;
1354
1355 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1356 goto out;
1357
1358 /* First of all, some simple consistency checks */
1359 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
Al Viro72c2d532013-09-22 16:27:52 -04001360 !elf_check_arch(&elf_ex) || !file->f_op->mmap)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001361 goto out;
Nicolas Pitre47552002017-08-16 16:05:13 -04001362 if (elf_check_fdpic(&elf_ex))
1363 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001364
1365 /* Now read in all of the header information */
1366
1367 j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1368 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1369
1370 error = -ENOMEM;
1371 elf_phdata = kmalloc(j, GFP_KERNEL);
1372 if (!elf_phdata)
1373 goto out;
1374
1375 eppnt = elf_phdata;
1376 error = -ENOEXEC;
Alexey Dobriyan658c0332019-12-04 16:52:25 -08001377 retval = elf_read(file, eppnt, j, elf_ex.e_phoff);
1378 if (retval < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001379 goto out_free_ph;
1380
1381 for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1382 if ((eppnt + i)->p_type == PT_LOAD)
1383 j++;
1384 if (j != 1)
1385 goto out_free_ph;
1386
1387 while (eppnt->p_type != PT_LOAD)
1388 eppnt++;
1389
1390 /* Now use mmap to map the library into memory. */
Linus Torvalds6be5ceb2012-04-20 17:13:58 -07001391 error = vm_mmap(file,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001392 ELF_PAGESTART(eppnt->p_vaddr),
1393 (eppnt->p_filesz +
1394 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1395 PROT_READ | PROT_WRITE | PROT_EXEC,
Michal Hocko4ed28632018-04-10 16:36:01 -07001396 MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_DENYWRITE,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001397 (eppnt->p_offset -
1398 ELF_PAGEOFFSET(eppnt->p_vaddr)));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001399 if (error != ELF_PAGESTART(eppnt->p_vaddr))
1400 goto out_free_ph;
1401
1402 elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1403 if (padzero(elf_bss)) {
1404 error = -EFAULT;
1405 goto out_free_ph;
1406 }
1407
Oscar Salvador24962af2018-07-13 16:59:13 -07001408 len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr);
1409 bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr);
Michal Hockoecc2bc82016-05-23 16:25:39 -07001410 if (bss > len) {
1411 error = vm_brk(len, bss - len);
Linus Torvalds5d22fc22016-05-27 15:57:31 -07001412 if (error)
Michal Hockoecc2bc82016-05-23 16:25:39 -07001413 goto out_free_ph;
1414 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001415 error = 0;
1416
1417out_free_ph:
1418 kfree(elf_phdata);
1419out:
1420 return error;
1421}
Josh Triplett69369a72014-04-03 14:48:27 -07001422#endif /* #ifdef CONFIG_USELIB */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001423
Christoph Hellwig698ba7b2009-12-15 16:47:37 -08001424#ifdef CONFIG_ELF_CORE
Linus Torvalds1da177e2005-04-16 15:20:36 -07001425/*
1426 * ELF core dumper
1427 *
1428 * Modelled on fs/exec.c:aout_core_dump()
1429 * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1430 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001431
Linus Torvalds1da177e2005-04-16 15:20:36 -07001432/* An ELF note in memory */
1433struct memelfnote
1434{
1435 const char *name;
1436 int type;
1437 unsigned int datasz;
1438 void *data;
1439};
1440
1441static int notesize(struct memelfnote *en)
1442{
1443 int sz;
1444
1445 sz = sizeof(struct elf_note);
1446 sz += roundup(strlen(en->name) + 1, 4);
1447 sz += roundup(en->datasz, 4);
1448
1449 return sz;
1450}
1451
Al Viroecc8c772013-10-05 15:32:35 -04001452static int writenote(struct memelfnote *men, struct coredump_params *cprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001453{
1454 struct elf_note en;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001455 en.n_namesz = strlen(men->name) + 1;
1456 en.n_descsz = men->datasz;
1457 en.n_type = men->type;
1458
Al Viroecc8c772013-10-05 15:32:35 -04001459 return dump_emit(cprm, &en, sizeof(en)) &&
Al Viro22a8cb82013-10-08 11:05:01 -04001460 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1461 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001462}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001463
Roland McGrath3aba4812008-01-30 13:31:44 +01001464static void fill_elf_header(struct elfhdr *elf, int segs,
Zhang Yanfeid3330cf2013-02-21 16:44:20 -08001465 u16 machine, u32 flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001466{
Cyrill Gorcunov6970c8e2008-04-29 01:01:18 -07001467 memset(elf, 0, sizeof(*elf));
1468
Linus Torvalds1da177e2005-04-16 15:20:36 -07001469 memcpy(elf->e_ident, ELFMAG, SELFMAG);
1470 elf->e_ident[EI_CLASS] = ELF_CLASS;
1471 elf->e_ident[EI_DATA] = ELF_DATA;
1472 elf->e_ident[EI_VERSION] = EV_CURRENT;
1473 elf->e_ident[EI_OSABI] = ELF_OSABI;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001474
1475 elf->e_type = ET_CORE;
Roland McGrath3aba4812008-01-30 13:31:44 +01001476 elf->e_machine = machine;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001477 elf->e_version = EV_CURRENT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001478 elf->e_phoff = sizeof(struct elfhdr);
Roland McGrath3aba4812008-01-30 13:31:44 +01001479 elf->e_flags = flags;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001480 elf->e_ehsize = sizeof(struct elfhdr);
1481 elf->e_phentsize = sizeof(struct elf_phdr);
1482 elf->e_phnum = segs;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001483}
1484
Andrew Morton8d6b5eee2006-09-25 23:32:04 -07001485static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001486{
1487 phdr->p_type = PT_NOTE;
1488 phdr->p_offset = offset;
1489 phdr->p_vaddr = 0;
1490 phdr->p_paddr = 0;
1491 phdr->p_filesz = sz;
1492 phdr->p_memsz = 0;
1493 phdr->p_flags = 0;
1494 phdr->p_align = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001495}
1496
1497static void fill_note(struct memelfnote *note, const char *name, int type,
1498 unsigned int sz, void *data)
1499{
1500 note->name = name;
1501 note->type = type;
1502 note->datasz = sz;
1503 note->data = data;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001504}
1505
1506/*
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001507 * fill up all the fields in prstatus from the given task struct, except
1508 * registers which need to be filled up separately.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001509 */
1510static void fill_prstatus(struct elf_prstatus *prstatus,
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001511 struct task_struct *p, long signr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001512{
1513 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1514 prstatus->pr_sigpend = p->pending.signal.sig[0];
1515 prstatus->pr_sighold = p->blocked.sig[0];
Oleg Nesterov3b34fc52009-06-17 16:27:38 -07001516 rcu_read_lock();
1517 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1518 rcu_read_unlock();
Pavel Emelyanovb4888932007-10-18 23:40:14 -07001519 prstatus->pr_pid = task_pid_vnr(p);
Pavel Emelyanovb4888932007-10-18 23:40:14 -07001520 prstatus->pr_pgrp = task_pgrp_vnr(p);
1521 prstatus->pr_sid = task_session_vnr(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001522 if (thread_group_leader(p)) {
Frederic Weisbeckercd19c362017-01-31 04:09:27 +01001523 struct task_cputime cputime;
Frank Mayharf06febc2008-09-12 09:54:39 -07001524
Linus Torvalds1da177e2005-04-16 15:20:36 -07001525 /*
Frank Mayharf06febc2008-09-12 09:54:39 -07001526 * This is the record for the group leader. It shows the
1527 * group-wide total, not its individual thread total.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001528 */
Frederic Weisbeckercd19c362017-01-31 04:09:27 +01001529 thread_group_cputime(p, &cputime);
Arnd Bergmanne2bb80d2017-11-23 13:46:33 +01001530 prstatus->pr_utime = ns_to_kernel_old_timeval(cputime.utime);
1531 prstatus->pr_stime = ns_to_kernel_old_timeval(cputime.stime);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001532 } else {
Frederic Weisbeckercd19c362017-01-31 04:09:27 +01001533 u64 utime, stime;
Frederic Weisbecker6fac4822012-11-13 14:20:55 +01001534
Frederic Weisbeckercd19c362017-01-31 04:09:27 +01001535 task_cputime(p, &utime, &stime);
Arnd Bergmanne2bb80d2017-11-23 13:46:33 +01001536 prstatus->pr_utime = ns_to_kernel_old_timeval(utime);
1537 prstatus->pr_stime = ns_to_kernel_old_timeval(stime);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001538 }
Frederic Weisbecker5613fda2017-01-31 04:09:23 +01001539
Arnd Bergmanne2bb80d2017-11-23 13:46:33 +01001540 prstatus->pr_cutime = ns_to_kernel_old_timeval(p->signal->cutime);
1541 prstatus->pr_cstime = ns_to_kernel_old_timeval(p->signal->cstime);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001542}
1543
1544static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1545 struct mm_struct *mm)
1546{
David Howellsc69e8d92008-11-14 10:39:19 +11001547 const struct cred *cred;
Greg Kroah-Hartmana84a5052005-05-11 00:10:44 -07001548 unsigned int i, len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001549
1550 /* first copy the parameters from user space */
1551 memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1552
1553 len = mm->arg_end - mm->arg_start;
1554 if (len >= ELF_PRARGSZ)
1555 len = ELF_PRARGSZ-1;
1556 if (copy_from_user(&psinfo->pr_psargs,
1557 (const char __user *)mm->arg_start, len))
1558 return -EFAULT;
1559 for(i = 0; i < len; i++)
1560 if (psinfo->pr_psargs[i] == 0)
1561 psinfo->pr_psargs[i] = ' ';
1562 psinfo->pr_psargs[len] = 0;
1563
Oleg Nesterov3b34fc52009-06-17 16:27:38 -07001564 rcu_read_lock();
1565 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1566 rcu_read_unlock();
Pavel Emelyanovb4888932007-10-18 23:40:14 -07001567 psinfo->pr_pid = task_pid_vnr(p);
Pavel Emelyanovb4888932007-10-18 23:40:14 -07001568 psinfo->pr_pgrp = task_pgrp_vnr(p);
1569 psinfo->pr_sid = task_session_vnr(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001570
1571 i = p->state ? ffz(~p->state) + 1 : 0;
1572 psinfo->pr_state = i;
Carsten Otte55148542006-03-25 03:08:22 -08001573 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
Linus Torvalds1da177e2005-04-16 15:20:36 -07001574 psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1575 psinfo->pr_nice = task_nice(p);
1576 psinfo->pr_flag = p->flags;
David Howellsc69e8d92008-11-14 10:39:19 +11001577 rcu_read_lock();
1578 cred = __task_cred(p);
Eric W. Biedermanebc887b2012-02-07 18:36:10 -08001579 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1580 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
David Howellsc69e8d92008-11-14 10:39:19 +11001581 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001582 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1583
1584 return 0;
1585}
1586
Roland McGrath3aba4812008-01-30 13:31:44 +01001587static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1588{
1589 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1590 int i = 0;
1591 do
1592 i += 2;
1593 while (auxv[i - 2] != AT_NULL);
1594 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1595}
1596
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07001597static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
Eric W. Biedermanae7795b2018-09-25 11:27:20 +02001598 const kernel_siginfo_t *siginfo)
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07001599{
Eric W. Biedermanfa4751f2020-05-05 12:12:54 +02001600 copy_siginfo_to_external(csigdata, siginfo);
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07001601 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1602}
1603
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001604#define MAX_FILE_NOTE_SIZE (4*1024*1024)
1605/*
1606 * Format of NT_FILE note:
1607 *
1608 * long count -- how many files are mapped
1609 * long page_size -- units for file_ofs
1610 * array of [COUNT] elements of
1611 * long start
1612 * long end
1613 * long file_ofs
1614 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1615 */
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02001616static int fill_files_note(struct memelfnote *note)
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001617{
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02001618 struct mm_struct *mm = current->mm;
1619 struct vm_area_struct *vma;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001620 unsigned count, size, names_ofs, remaining, n;
1621 user_long_t *data;
1622 user_long_t *start_end_ofs;
1623 char *name_base, *name_curpos;
1624
1625 /* *Estimated* file count and total data size needed */
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02001626 count = mm->map_count;
Alexey Dobriyan60c9d922018-02-06 15:39:13 -08001627 if (count > UINT_MAX / 64)
1628 return -EINVAL;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001629 size = count * 64;
1630
1631 names_ofs = (2 + 3 * count) * sizeof(data[0]);
1632 alloc:
1633 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
Dan Aloni72023652013-09-30 13:45:02 -07001634 return -EINVAL;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001635 size = round_up(size, PAGE_SIZE);
Alexey Dobriyan1fbede62020-01-30 22:17:10 -08001636 /*
1637 * "size" can be 0 here legitimately.
1638 * Let it ENOMEM and omit NT_FILE section which will be empty anyway.
1639 */
Alexey Dobriyan86a2bb52018-06-14 15:27:24 -07001640 data = kvmalloc(size, GFP_KERNEL);
1641 if (ZERO_OR_NULL_PTR(data))
Dan Aloni72023652013-09-30 13:45:02 -07001642 return -ENOMEM;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001643
1644 start_end_ofs = data + 2;
1645 name_base = name_curpos = ((char *)data) + names_ofs;
1646 remaining = size - names_ofs;
1647 count = 0;
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02001648 for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) {
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001649 struct file *file;
1650 const char *filename;
1651
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02001652 file = vma->vm_file;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001653 if (!file)
1654 continue;
Miklos Szeredi9bf39ab2015-06-19 10:29:13 +02001655 filename = file_path(file, name_curpos, remaining);
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001656 if (IS_ERR(filename)) {
1657 if (PTR_ERR(filename) == -ENAMETOOLONG) {
Alexey Dobriyan86a2bb52018-06-14 15:27:24 -07001658 kvfree(data);
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001659 size = size * 5 / 4;
1660 goto alloc;
1661 }
1662 continue;
1663 }
1664
Miklos Szeredi9bf39ab2015-06-19 10:29:13 +02001665 /* file_path() fills at the end, move name down */
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001666 /* n = strlen(filename) + 1: */
1667 n = (name_curpos + remaining) - filename;
1668 remaining = filename - name_curpos;
1669 memmove(name_curpos, filename, n);
1670 name_curpos += n;
1671
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02001672 *start_end_ofs++ = vma->vm_start;
1673 *start_end_ofs++ = vma->vm_end;
1674 *start_end_ofs++ = vma->vm_pgoff;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001675 count++;
1676 }
1677
1678 /* Now we know exact count of files, can store it */
1679 data[0] = count;
1680 data[1] = PAGE_SIZE;
1681 /*
Alexey Dobriyan03c6d722020-01-30 22:16:58 -08001682 * Count usually is less than mm->map_count,
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001683 * we need to move filenames down.
1684 */
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02001685 n = mm->map_count - count;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001686 if (n != 0) {
1687 unsigned shift_bytes = n * 3 * sizeof(data[0]);
1688 memmove(name_base - shift_bytes, name_base,
1689 name_curpos - name_base);
1690 name_curpos -= shift_bytes;
1691 }
1692
1693 size = name_curpos - (char *)data;
1694 fill_note(note, "CORE", NT_FILE, size, data);
Dan Aloni72023652013-09-30 13:45:02 -07001695 return 0;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001696}
1697
Roland McGrath4206d3a2008-01-30 13:31:45 +01001698#ifdef CORE_DUMP_USE_REGSET
1699#include <linux/regset.h>
1700
1701struct elf_thread_core_info {
1702 struct elf_thread_core_info *next;
1703 struct task_struct *task;
1704 struct elf_prstatus prstatus;
Gustavo A. R. Silva5e01fdf2020-08-31 08:25:42 -05001705 struct memelfnote notes[];
Roland McGrath4206d3a2008-01-30 13:31:45 +01001706};
1707
1708struct elf_note_info {
1709 struct elf_thread_core_info *thread;
1710 struct memelfnote psinfo;
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07001711 struct memelfnote signote;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001712 struct memelfnote auxv;
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001713 struct memelfnote files;
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07001714 user_siginfo_t csigdata;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001715 size_t size;
1716 int thread_notes;
1717};
1718
Roland McGrathd31472b2008-03-04 14:28:30 -08001719/*
1720 * When a regset has a writeback hook, we call it on each thread before
1721 * dumping user memory. On register window machines, this makes sure the
1722 * user memory backing the register data is up to date before we read it.
1723 */
1724static void do_thread_regset_writeback(struct task_struct *task,
1725 const struct user_regset *regset)
1726{
1727 if (regset->writeback)
1728 regset->writeback(task, regset, 1);
1729}
1730
H. J. Lu0953f65d2012-02-14 13:34:52 -08001731#ifndef PRSTATUS_SIZE
Dmitry Safonov90954e72016-09-05 16:33:06 +03001732#define PRSTATUS_SIZE(S, R) sizeof(S)
H. J. Lu0953f65d2012-02-14 13:34:52 -08001733#endif
1734
1735#ifndef SET_PR_FPVALID
Dmitry Safonov90954e72016-09-05 16:33:06 +03001736#define SET_PR_FPVALID(S, V, R) ((S)->pr_fpvalid = (V))
H. J. Lu0953f65d2012-02-14 13:34:52 -08001737#endif
1738
Roland McGrath4206d3a2008-01-30 13:31:45 +01001739static int fill_thread_core_info(struct elf_thread_core_info *t,
1740 const struct user_regset_view *view,
1741 long signr, size_t *total)
1742{
1743 unsigned int i;
Al Virob4e9c952020-06-01 19:42:40 -04001744 int regset0_size;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001745
1746 /*
1747 * NT_PRSTATUS is the one special case, because the regset data
1748 * goes into the pr_reg field inside the note contents, rather
1749 * than being the whole note contents. We fill the reset in here.
1750 * We assume that regset 0 is NT_PRSTATUS.
1751 */
1752 fill_prstatus(&t->prstatus, t->task, signr);
Al Virob4e9c952020-06-01 19:42:40 -04001753 regset0_size = regset_get(t->task, &view->regsets[0],
1754 sizeof(t->prstatus.pr_reg), &t->prstatus.pr_reg);
1755 if (regset0_size < 0)
1756 return 0;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001757
1758 fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
Dave Martin27e64b42017-10-31 15:50:53 +00001759 PRSTATUS_SIZE(t->prstatus, regset0_size), &t->prstatus);
Roland McGrath4206d3a2008-01-30 13:31:45 +01001760 *total += notesize(&t->notes[0]);
1761
Roland McGrathd31472b2008-03-04 14:28:30 -08001762 do_thread_regset_writeback(t->task, &view->regsets[0]);
1763
Roland McGrath4206d3a2008-01-30 13:31:45 +01001764 /*
1765 * Each other regset might generate a note too. For each regset
1766 * that has no core_note_type or is inactive, we leave t->notes[i]
1767 * all zero and we'll know to skip writing it later.
1768 */
1769 for (i = 1; i < view->n; ++i) {
1770 const struct user_regset *regset = &view->regsets[i];
Al Virob4e9c952020-06-01 19:42:40 -04001771 int note_type = regset->core_note_type;
1772 bool is_fpreg = note_type == NT_PRFPREG;
1773 void *data;
1774 int ret;
1775
Roland McGrathd31472b2008-03-04 14:28:30 -08001776 do_thread_regset_writeback(t->task, regset);
Al Virob4e9c952020-06-01 19:42:40 -04001777 if (!note_type) // not for coredumps
1778 continue;
1779 if (regset->active && regset->active(t->task, regset) <= 0)
1780 continue;
1781
1782 ret = regset_get_alloc(t->task, regset, ~0U, &data);
1783 if (ret < 0)
1784 continue;
1785
1786 if (is_fpreg)
1787 SET_PR_FPVALID(&t->prstatus, 1, regset0_size);
1788
1789 fill_note(&t->notes[i], is_fpreg ? "CORE" : "LINUX",
1790 note_type, ret, data);
1791
1792 *total += notesize(&t->notes[i]);
Roland McGrath4206d3a2008-01-30 13:31:45 +01001793 }
1794
1795 return 1;
1796}
1797
1798static int fill_note_info(struct elfhdr *elf, int phdrs,
1799 struct elf_note_info *info,
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06001800 struct coredump_params *cprm)
Roland McGrath4206d3a2008-01-30 13:31:45 +01001801{
1802 struct task_struct *dump_task = current;
1803 const struct user_regset_view *view = task_user_regset_view(dump_task);
1804 struct elf_thread_core_info *t;
1805 struct elf_prpsinfo *psinfo;
Oleg Nesterov83914442008-07-25 01:47:45 -07001806 struct core_thread *ct;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001807 unsigned int i;
1808
1809 info->size = 0;
1810 info->thread = NULL;
1811
1812 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
Alan Cox6899e922012-12-17 16:02:09 -08001813 if (psinfo == NULL) {
1814 info->psinfo.data = NULL; /* So we don't free this wrongly */
Roland McGrath4206d3a2008-01-30 13:31:45 +01001815 return 0;
Alan Cox6899e922012-12-17 16:02:09 -08001816 }
Roland McGrath4206d3a2008-01-30 13:31:45 +01001817
Amerigo Wange2dbe122009-07-01 01:06:26 -04001818 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1819
Roland McGrath4206d3a2008-01-30 13:31:45 +01001820 /*
1821 * Figure out how many notes we're going to need for each thread.
1822 */
1823 info->thread_notes = 0;
1824 for (i = 0; i < view->n; ++i)
1825 if (view->regsets[i].core_note_type != 0)
1826 ++info->thread_notes;
1827
1828 /*
1829 * Sanity check. We rely on regset 0 being in NT_PRSTATUS,
1830 * since it is our one special case.
1831 */
1832 if (unlikely(info->thread_notes == 0) ||
1833 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1834 WARN_ON(1);
1835 return 0;
1836 }
1837
1838 /*
1839 * Initialize the ELF file header.
1840 */
1841 fill_elf_header(elf, phdrs,
Zhang Yanfeid3330cf2013-02-21 16:44:20 -08001842 view->e_machine, view->e_flags);
Roland McGrath4206d3a2008-01-30 13:31:45 +01001843
1844 /*
1845 * Allocate a structure for each thread.
1846 */
Oleg Nesterov83914442008-07-25 01:47:45 -07001847 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1848 t = kzalloc(offsetof(struct elf_thread_core_info,
1849 notes[info->thread_notes]),
1850 GFP_KERNEL);
1851 if (unlikely(!t))
1852 return 0;
Oleg Nesterov24d52882008-07-25 01:47:40 -07001853
Oleg Nesterov83914442008-07-25 01:47:45 -07001854 t->task = ct->task;
1855 if (ct->task == dump_task || !info->thread) {
1856 t->next = info->thread;
1857 info->thread = t;
1858 } else {
1859 /*
1860 * Make sure to keep the original task at
1861 * the head of the list.
1862 */
1863 t->next = info->thread->next;
1864 info->thread->next = t;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001865 }
Oleg Nesterov83914442008-07-25 01:47:45 -07001866 }
Roland McGrath4206d3a2008-01-30 13:31:45 +01001867
1868 /*
1869 * Now fill in each thread's information.
1870 */
1871 for (t = info->thread; t != NULL; t = t->next)
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06001872 if (!fill_thread_core_info(t, view, cprm->siginfo->si_signo, &info->size))
Roland McGrath4206d3a2008-01-30 13:31:45 +01001873 return 0;
1874
1875 /*
1876 * Fill in the two process-wide notes.
1877 */
1878 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1879 info->size += notesize(&info->psinfo);
1880
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06001881 fill_siginfo_note(&info->signote, &info->csigdata, cprm->siginfo);
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07001882 info->size += notesize(&info->signote);
1883
Roland McGrath4206d3a2008-01-30 13:31:45 +01001884 fill_auxv_note(&info->auxv, current->mm);
1885 info->size += notesize(&info->auxv);
1886
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02001887 if (fill_files_note(&info->files) == 0)
Dan Aloni72023652013-09-30 13:45:02 -07001888 info->size += notesize(&info->files);
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001889
Roland McGrath4206d3a2008-01-30 13:31:45 +01001890 return 1;
1891}
1892
1893static size_t get_note_info_size(struct elf_note_info *info)
1894{
1895 return info->size;
1896}
1897
1898/*
1899 * Write all the notes for each thread. When writing the first thread, the
1900 * process-wide notes are interleaved after the first thread-specific note.
1901 */
1902static int write_note_info(struct elf_note_info *info,
Al Viroecc8c772013-10-05 15:32:35 -04001903 struct coredump_params *cprm)
Roland McGrath4206d3a2008-01-30 13:31:45 +01001904{
Fabian Frederickb219e252014-06-04 16:12:14 -07001905 bool first = true;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001906 struct elf_thread_core_info *t = info->thread;
1907
1908 do {
1909 int i;
1910
Al Viroecc8c772013-10-05 15:32:35 -04001911 if (!writenote(&t->notes[0], cprm))
Roland McGrath4206d3a2008-01-30 13:31:45 +01001912 return 0;
1913
Al Viroecc8c772013-10-05 15:32:35 -04001914 if (first && !writenote(&info->psinfo, cprm))
Roland McGrath4206d3a2008-01-30 13:31:45 +01001915 return 0;
Al Viroecc8c772013-10-05 15:32:35 -04001916 if (first && !writenote(&info->signote, cprm))
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07001917 return 0;
Al Viroecc8c772013-10-05 15:32:35 -04001918 if (first && !writenote(&info->auxv, cprm))
Roland McGrath4206d3a2008-01-30 13:31:45 +01001919 return 0;
Dan Aloni72023652013-09-30 13:45:02 -07001920 if (first && info->files.data &&
Al Viroecc8c772013-10-05 15:32:35 -04001921 !writenote(&info->files, cprm))
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07001922 return 0;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001923
1924 for (i = 1; i < info->thread_notes; ++i)
1925 if (t->notes[i].data &&
Al Viroecc8c772013-10-05 15:32:35 -04001926 !writenote(&t->notes[i], cprm))
Roland McGrath4206d3a2008-01-30 13:31:45 +01001927 return 0;
1928
Fabian Frederickb219e252014-06-04 16:12:14 -07001929 first = false;
Roland McGrath4206d3a2008-01-30 13:31:45 +01001930 t = t->next;
1931 } while (t);
1932
1933 return 1;
1934}
1935
1936static void free_note_info(struct elf_note_info *info)
1937{
1938 struct elf_thread_core_info *threads = info->thread;
1939 while (threads) {
1940 unsigned int i;
1941 struct elf_thread_core_info *t = threads;
1942 threads = t->next;
1943 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1944 for (i = 1; i < info->thread_notes; ++i)
1945 kfree(t->notes[i].data);
1946 kfree(t);
1947 }
1948 kfree(info->psinfo.data);
Alexey Dobriyan86a2bb52018-06-14 15:27:24 -07001949 kvfree(info->files.data);
Roland McGrath4206d3a2008-01-30 13:31:45 +01001950}
1951
1952#else
1953
Linus Torvalds1da177e2005-04-16 15:20:36 -07001954/* Here is the structure in which status of each thread is captured. */
1955struct elf_thread_status
1956{
1957 struct list_head list;
1958 struct elf_prstatus prstatus; /* NT_PRSTATUS */
1959 elf_fpregset_t fpu; /* NT_PRFPREG */
1960 struct task_struct *thread;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001961 struct memelfnote notes[3];
1962 int num_notes;
1963};
1964
1965/*
1966 * In order to add the specific thread information for the elf file format,
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001967 * we need to keep a linked list of every threads pr_status and then create
1968 * a single section for them in the final core file.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001969 */
1970static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1971{
1972 int sz = 0;
1973 struct task_struct *p = t->thread;
1974 t->num_notes = 0;
1975
1976 fill_prstatus(&t->prstatus, p, signr);
1977 elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1978
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001979 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1980 &(t->prstatus));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001981 t->num_notes++;
1982 sz += notesize(&t->notes[0]);
1983
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07001984 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1985 &t->fpu))) {
1986 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1987 &(t->fpu));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001988 t->num_notes++;
1989 sz += notesize(&t->notes[1]);
1990 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001991 return sz;
1992}
1993
Roland McGrath3aba4812008-01-30 13:31:44 +01001994struct elf_note_info {
1995 struct memelfnote *notes;
Dan Aloni72023652013-09-30 13:45:02 -07001996 struct memelfnote *notes_files;
Roland McGrath3aba4812008-01-30 13:31:44 +01001997 struct elf_prstatus *prstatus; /* NT_PRSTATUS */
1998 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */
1999 struct list_head thread_list;
2000 elf_fpregset_t *fpu;
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07002001 user_siginfo_t csigdata;
Roland McGrath3aba4812008-01-30 13:31:44 +01002002 int thread_status_size;
2003 int numnote;
2004};
2005
Amerigo Wang0cf062d2009-09-23 15:57:05 -07002006static int elf_note_info_init(struct elf_note_info *info)
Roland McGrath3aba4812008-01-30 13:31:44 +01002007{
Amerigo Wang0cf062d2009-09-23 15:57:05 -07002008 memset(info, 0, sizeof(*info));
Roland McGrath3aba4812008-01-30 13:31:44 +01002009 INIT_LIST_HEAD(&info->thread_list);
2010
Denys Vlasenko49ae4d42012-10-04 17:15:35 -07002011 /* Allocate space for ELF notes */
Kees Cook6da2ec52018-06-12 13:55:00 -07002012 info->notes = kmalloc_array(8, sizeof(struct memelfnote), GFP_KERNEL);
Roland McGrath3aba4812008-01-30 13:31:44 +01002013 if (!info->notes)
2014 return 0;
2015 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
2016 if (!info->psinfo)
Denys Vlasenkof34f9d12012-09-26 11:34:50 +10002017 return 0;
Roland McGrath3aba4812008-01-30 13:31:44 +01002018 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
2019 if (!info->prstatus)
Denys Vlasenkof34f9d12012-09-26 11:34:50 +10002020 return 0;
Roland McGrath3aba4812008-01-30 13:31:44 +01002021 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
2022 if (!info->fpu)
Denys Vlasenkof34f9d12012-09-26 11:34:50 +10002023 return 0;
Amerigo Wang0cf062d2009-09-23 15:57:05 -07002024 return 1;
Amerigo Wang0cf062d2009-09-23 15:57:05 -07002025}
Roland McGrath3aba4812008-01-30 13:31:44 +01002026
Amerigo Wang0cf062d2009-09-23 15:57:05 -07002027static int fill_note_info(struct elfhdr *elf, int phdrs,
2028 struct elf_note_info *info,
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06002029 struct coredump_params *cprm)
Amerigo Wang0cf062d2009-09-23 15:57:05 -07002030{
Al Viroafabada2013-10-14 07:39:56 -04002031 struct core_thread *ct;
2032 struct elf_thread_status *ets;
Amerigo Wang0cf062d2009-09-23 15:57:05 -07002033
2034 if (!elf_note_info_init(info))
2035 return 0;
2036
Al Viroafabada2013-10-14 07:39:56 -04002037 for (ct = current->mm->core_state->dumper.next;
2038 ct; ct = ct->next) {
2039 ets = kzalloc(sizeof(*ets), GFP_KERNEL);
2040 if (!ets)
2041 return 0;
Oleg Nesterov24d52882008-07-25 01:47:40 -07002042
Al Viroafabada2013-10-14 07:39:56 -04002043 ets->thread = ct->task;
2044 list_add(&ets->list, &info->thread_list);
2045 }
Oleg Nesterov83914442008-07-25 01:47:45 -07002046
Alexey Dobriyan93f044e2019-03-07 16:28:59 -08002047 list_for_each_entry(ets, &info->thread_list, list) {
Al Viroafabada2013-10-14 07:39:56 -04002048 int sz;
Oleg Nesterov83914442008-07-25 01:47:45 -07002049
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06002050 sz = elf_dump_thread_status(cprm->siginfo->si_signo, ets);
Al Viroafabada2013-10-14 07:39:56 -04002051 info->thread_status_size += sz;
Roland McGrath3aba4812008-01-30 13:31:44 +01002052 }
2053 /* now collect the dump for the current */
2054 memset(info->prstatus, 0, sizeof(*info->prstatus));
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06002055 fill_prstatus(info->prstatus, current, cprm->siginfo->si_signo);
2056 elf_core_copy_regs(&info->prstatus->pr_reg, cprm->regs);
Roland McGrath3aba4812008-01-30 13:31:44 +01002057
2058 /* Set up header */
Zhang Yanfeid3330cf2013-02-21 16:44:20 -08002059 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS);
Roland McGrath3aba4812008-01-30 13:31:44 +01002060
2061 /*
2062 * Set up the notes in similar form to SVR4 core dumps made
2063 * with info from their /proc.
2064 */
2065
2066 fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
2067 sizeof(*info->prstatus), info->prstatus);
2068 fill_psinfo(info->psinfo, current->group_leader, current->mm);
2069 fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
2070 sizeof(*info->psinfo), info->psinfo);
2071
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06002072 fill_siginfo_note(info->notes + 2, &info->csigdata, cprm->siginfo);
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07002073 fill_auxv_note(info->notes + 3, current->mm);
Dan Aloni72023652013-09-30 13:45:02 -07002074 info->numnote = 4;
Roland McGrath3aba4812008-01-30 13:31:44 +01002075
Greg Kroah-Hartman5f248942022-04-19 18:41:13 +02002076 if (fill_files_note(info->notes + info->numnote) == 0) {
Dan Aloni72023652013-09-30 13:45:02 -07002077 info->notes_files = info->notes + info->numnote;
2078 info->numnote++;
2079 }
Roland McGrath3aba4812008-01-30 13:31:44 +01002080
2081 /* Try to dump the FPU. */
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06002082 info->prstatus->pr_fpvalid =
2083 elf_core_copy_task_fpregs(current, cprm->regs, info->fpu);
Roland McGrath3aba4812008-01-30 13:31:44 +01002084 if (info->prstatus->pr_fpvalid)
2085 fill_note(info->notes + info->numnote++,
2086 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
Roland McGrath3aba4812008-01-30 13:31:44 +01002087 return 1;
Roland McGrath3aba4812008-01-30 13:31:44 +01002088}
2089
2090static size_t get_note_info_size(struct elf_note_info *info)
2091{
2092 int sz = 0;
2093 int i;
2094
2095 for (i = 0; i < info->numnote; i++)
2096 sz += notesize(info->notes + i);
2097
2098 sz += info->thread_status_size;
2099
2100 return sz;
2101}
2102
2103static int write_note_info(struct elf_note_info *info,
Al Viroecc8c772013-10-05 15:32:35 -04002104 struct coredump_params *cprm)
Roland McGrath3aba4812008-01-30 13:31:44 +01002105{
Alexey Dobriyan93f044e2019-03-07 16:28:59 -08002106 struct elf_thread_status *ets;
Roland McGrath3aba4812008-01-30 13:31:44 +01002107 int i;
Roland McGrath3aba4812008-01-30 13:31:44 +01002108
2109 for (i = 0; i < info->numnote; i++)
Al Viroecc8c772013-10-05 15:32:35 -04002110 if (!writenote(info->notes + i, cprm))
Roland McGrath3aba4812008-01-30 13:31:44 +01002111 return 0;
2112
2113 /* write out the thread status notes section */
Alexey Dobriyan93f044e2019-03-07 16:28:59 -08002114 list_for_each_entry(ets, &info->thread_list, list) {
2115 for (i = 0; i < ets->num_notes; i++)
2116 if (!writenote(&ets->notes[i], cprm))
Roland McGrath3aba4812008-01-30 13:31:44 +01002117 return 0;
2118 }
2119
2120 return 1;
2121}
2122
2123static void free_note_info(struct elf_note_info *info)
2124{
2125 while (!list_empty(&info->thread_list)) {
2126 struct list_head *tmp = info->thread_list.next;
2127 list_del(tmp);
2128 kfree(list_entry(tmp, struct elf_thread_status, list));
2129 }
2130
Dan Aloni72023652013-09-30 13:45:02 -07002131 /* Free data possibly allocated by fill_files_note(): */
2132 if (info->notes_files)
Alexey Dobriyan86a2bb52018-06-14 15:27:24 -07002133 kvfree(info->notes_files->data);
Denys Vlasenko2aa362c2012-10-04 17:15:36 -07002134
Roland McGrath3aba4812008-01-30 13:31:44 +01002135 kfree(info->prstatus);
2136 kfree(info->psinfo);
2137 kfree(info->notes);
2138 kfree(info->fpu);
Roland McGrath3aba4812008-01-30 13:31:44 +01002139}
2140
Roland McGrath4206d3a2008-01-30 13:31:45 +01002141#endif
2142
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002143static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
2144 elf_addr_t e_shoff, int segs)
2145{
2146 elf->e_shoff = e_shoff;
2147 elf->e_shentsize = sizeof(*shdr4extnum);
2148 elf->e_shnum = 1;
2149 elf->e_shstrndx = SHN_UNDEF;
2150
2151 memset(shdr4extnum, 0, sizeof(*shdr4extnum));
2152
2153 shdr4extnum->sh_type = SHT_NULL;
2154 shdr4extnum->sh_size = elf->e_shnum;
2155 shdr4extnum->sh_link = elf->e_shstrndx;
2156 shdr4extnum->sh_info = segs;
2157}
2158
Linus Torvalds1da177e2005-04-16 15:20:36 -07002159/*
2160 * Actual dumper
2161 *
2162 * This is a two-pass process; first we find the offsets of the bits,
2163 * and then they are actually written out. If we run out of core limit
2164 * we just truncate.
2165 */
Masami Hiramatsuf6151df2009-12-17 15:27:16 -08002166static int elf_core_dump(struct coredump_params *cprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002167{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002168 int has_dumped = 0;
Greg Kroah-Hartman8f4bd2a2022-04-19 18:41:47 +02002169 int vma_count, segs, i;
2170 size_t vma_data_size;
Alexey Dobriyan225a3f52020-01-30 22:17:04 -08002171 struct elfhdr elf;
Al Virocdc3d562013-10-05 22:24:29 -04002172 loff_t offset = 0, dataoff;
Dan Aloni72023652013-09-30 13:45:02 -07002173 struct elf_note_info info = { };
Daisuke HATAYAMA93eb2112010-03-05 13:44:09 -08002174 struct elf_phdr *phdr4note = NULL;
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002175 struct elf_shdr *shdr4extnum = NULL;
2176 Elf_Half e_phnum;
2177 elf_addr_t e_shoff;
Greg Kroah-Hartman8f4bd2a2022-04-19 18:41:47 +02002178 struct core_vma_metadata *vma_meta;
2179
2180 if (dump_vma_snapshot(cprm, &vma_count, &vma_meta, &vma_data_size))
2181 return 0;
Jann Horna07279c2020-10-15 20:12:54 -07002182
KAMEZAWA Hiroyuki341c87b2009-06-30 11:41:23 -07002183 /*
2184 * The number of segs are recored into ELF header as 16bit value.
2185 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2186 */
Greg Kroah-Hartman8f4bd2a2022-04-19 18:41:47 +02002187 segs = vma_count + elf_core_extra_phdrs();
Roland McGrathf47aef52007-01-26 00:56:49 -08002188
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002189 /* for notes section */
2190 segs++;
2191
2192 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2193 * this, kernel supports extended numbering. Have a look at
2194 * include/linux/elf.h for further information. */
2195 e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2196
Roland McGrath3aba4812008-01-30 13:31:44 +01002197 /*
2198 * Collect all the non-memory information about the process for the
2199 * notes. This also sets up the file header.
2200 */
Eric W. Biedermanb7933f12022-01-31 12:17:38 -06002201 if (!fill_note_info(&elf, e_phnum, &info, cprm))
Christoph Hellwigd2530b42020-05-05 12:12:55 +02002202 goto end_coredump;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002203
2204 has_dumped = 1;
Oleg Nesterov079148b2013-04-30 15:28:16 -07002205
Alexey Dobriyan225a3f52020-01-30 22:17:04 -08002206 offset += sizeof(elf); /* Elf header */
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002207 offset += segs * sizeof(struct elf_phdr); /* Program headers */
Linus Torvalds1da177e2005-04-16 15:20:36 -07002208
2209 /* Write notes phdr entry */
2210 {
Roland McGrath3aba4812008-01-30 13:31:44 +01002211 size_t sz = get_note_info_size(&info);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002212
Michael Ellermane5501492007-09-19 14:38:12 +10002213 sz += elf_coredump_extra_notes_size();
Dwayne Grant McConnellbf1ab972006-11-23 00:46:37 +01002214
Daisuke HATAYAMA93eb2112010-03-05 13:44:09 -08002215 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2216 if (!phdr4note)
Daisuke HATAYAMA088e7af2010-03-05 13:44:06 -08002217 goto end_coredump;
Daisuke HATAYAMA93eb2112010-03-05 13:44:09 -08002218
2219 fill_elf_note_phdr(phdr4note, sz, offset);
2220 offset += sz;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002221 }
2222
Linus Torvalds1da177e2005-04-16 15:20:36 -07002223 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2224
Greg Kroah-Hartman8f4bd2a2022-04-19 18:41:47 +02002225 offset += vma_data_size;
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002226 offset += elf_core_extra_data_size();
2227 e_shoff = offset;
2228
2229 if (e_phnum == PN_XNUM) {
2230 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2231 if (!shdr4extnum)
2232 goto end_coredump;
Alexey Dobriyan225a3f52020-01-30 22:17:04 -08002233 fill_extnum_info(&elf, shdr4extnum, e_shoff, segs);
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002234 }
2235
2236 offset = dataoff;
2237
Alexey Dobriyan225a3f52020-01-30 22:17:04 -08002238 if (!dump_emit(cprm, &elf, sizeof(elf)))
Daisuke HATAYAMA93eb2112010-03-05 13:44:09 -08002239 goto end_coredump;
2240
Al Viroecc8c772013-10-05 15:32:35 -04002241 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
Daisuke HATAYAMA93eb2112010-03-05 13:44:09 -08002242 goto end_coredump;
2243
Linus Torvalds1da177e2005-04-16 15:20:36 -07002244 /* Write program headers for segments dump */
Greg Kroah-Hartman8f4bd2a2022-04-19 18:41:47 +02002245 for (i = 0; i < vma_count; i++) {
2246 struct core_vma_metadata *meta = vma_meta + i;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002247 struct elf_phdr phdr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002248
2249 phdr.p_type = PT_LOAD;
2250 phdr.p_offset = offset;
Jann Horna07279c2020-10-15 20:12:54 -07002251 phdr.p_vaddr = meta->start;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002252 phdr.p_paddr = 0;
Jann Horna07279c2020-10-15 20:12:54 -07002253 phdr.p_filesz = meta->dump_size;
2254 phdr.p_memsz = meta->end - meta->start;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002255 offset += phdr.p_filesz;
Jann Horna07279c2020-10-15 20:12:54 -07002256 phdr.p_flags = 0;
2257 if (meta->flags & VM_READ)
2258 phdr.p_flags |= PF_R;
2259 if (meta->flags & VM_WRITE)
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07002260 phdr.p_flags |= PF_W;
Jann Horna07279c2020-10-15 20:12:54 -07002261 if (meta->flags & VM_EXEC)
Jesper Juhlf4e5cc22006-06-23 02:05:35 -07002262 phdr.p_flags |= PF_X;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002263 phdr.p_align = ELF_EXEC_PAGESIZE;
2264
Al Viroecc8c772013-10-05 15:32:35 -04002265 if (!dump_emit(cprm, &phdr, sizeof(phdr)))
Daisuke HATAYAMA088e7af2010-03-05 13:44:06 -08002266 goto end_coredump;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002267 }
2268
Al Viro506f21c2013-10-05 17:22:57 -04002269 if (!elf_core_write_extra_phdrs(cprm, offset))
Daisuke HATAYAMA1fcccba2010-03-05 13:44:07 -08002270 goto end_coredump;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002271
2272 /* write out the notes section */
Al Viroecc8c772013-10-05 15:32:35 -04002273 if (!write_note_info(&info, cprm))
Roland McGrath3aba4812008-01-30 13:31:44 +01002274 goto end_coredump;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002275
Al Virocdc3d562013-10-05 22:24:29 -04002276 if (elf_coredump_extra_notes_write(cprm))
Michael Ellermane5501492007-09-19 14:38:12 +10002277 goto end_coredump;
Dwayne Grant McConnellbf1ab972006-11-23 00:46:37 +01002278
Andi Kleend025c9d2006-09-30 23:29:28 -07002279 /* Align to page */
Mateusz Guzik1607f092016-06-05 23:14:14 +02002280 if (!dump_skip(cprm, dataoff - cprm->pos))
Hugh Dickinsf3e8fcc2009-09-21 17:03:25 -07002281 goto end_coredump;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002282
Greg Kroah-Hartman8f4bd2a2022-04-19 18:41:47 +02002283 for (i = 0; i < vma_count; i++) {
2284 struct core_vma_metadata *meta = vma_meta + i;
Jann Horna07279c2020-10-15 20:12:54 -07002285
2286 if (!dump_user_range(cprm, meta->start, meta->dump_size))
Jann Hornafc63a97b2020-10-15 20:12:46 -07002287 goto end_coredump;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002288 }
Dave Kleikamp4d22c752017-01-11 13:25:00 -06002289 dump_truncate(cprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002290
Al Viroaa3e7ea2013-10-05 17:50:15 -04002291 if (!elf_core_write_extra_data(cprm))
Daisuke HATAYAMA1fcccba2010-03-05 13:44:07 -08002292 goto end_coredump;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002293
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002294 if (e_phnum == PN_XNUM) {
Al Viro13046ec2013-10-05 18:08:47 -04002295 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002296 goto end_coredump;
2297 }
2298
Linus Torvalds1da177e2005-04-16 15:20:36 -07002299end_coredump:
Roland McGrath3aba4812008-01-30 13:31:44 +01002300 free_note_info(&info);
Daisuke HATAYAMA8d9032b2010-03-05 13:44:10 -08002301 kfree(shdr4extnum);
Greg Kroah-Hartman8f4bd2a2022-04-19 18:41:47 +02002302 kvfree(vma_meta);
Daisuke HATAYAMA93eb2112010-03-05 13:44:09 -08002303 kfree(phdr4note);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002304 return has_dumped;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002305}
2306
Christoph Hellwig698ba7b2009-12-15 16:47:37 -08002307#endif /* CONFIG_ELF_CORE */
Linus Torvalds1da177e2005-04-16 15:20:36 -07002308
2309static int __init init_elf_binfmt(void)
2310{
Al Viro8fc3dc52012-03-17 03:05:16 -04002311 register_binfmt(&elf_format);
2312 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002313}
2314
2315static void __exit exit_elf_binfmt(void)
2316{
2317 /* Remove the COFF and ELF loaders. */
2318 unregister_binfmt(&elf_format);
2319}
2320
2321core_initcall(init_elf_binfmt);
2322module_exit(exit_elf_binfmt);
2323MODULE_LICENSE("GPL");