fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/mm.h>
  16 #include <linux/mman.h>
  17 #include <linux/errno.h>
  18 #include <linux/signal.h>
  19 #include <linux/binfmts.h>
  20 #include <linux/string.h>
  21 #include <linux/file.h>
  22 #include <linux/slab.h>
  23 #include <linux/personality.h>
  24 #include <linux/elfcore.h>
  25 #include <linux/init.h>
  26 #include <linux/highuid.h>
  27 #include <linux/compiler.h>
  28 #include <linux/highmem.h>
  29 #include <linux/pagemap.h>
  30 #include <linux/vmalloc.h>
  31 #include <linux/security.h>
  32 #include <linux/random.h>
  33 #include <linux/elf.h>
  34 #include <linux/utsname.h>
  35 #include <linux/coredump.h>
  36 #include <asm/uaccess.h>
  37 #include <asm/param.h>
  38 #include <asm/page.h>
  39
  40 #ifndef user_long_t
  41 #define user_long_t long
  42 #endif
  43 #ifndef user_siginfo_t
  44 #define user_siginfo_t siginfo_t
  45 #endif
  46
  47 static int load_elf_binary(struct linux_binprm *bprm);
  48 static int load_elf_library(struct file *);
  49 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  50                                 int, int, unsigned long);
  51
  52 /*
  53  * If we don't support core dumping, then supply a NULL so we
  54  * don't even try.
  55  */
  56 #ifdef CONFIG_ELF_CORE
  57 static int elf_core_dump(struct coredump_params *cprm);
  58 #else
  59 #define elf_core_dump   NULL
  60 #endif
  61
  62 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  63 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  64 #else
  65 #define ELF_MIN_ALIGN   PAGE_SIZE
  66 #endif
  67
  68 #ifndef ELF_CORE_EFLAGS
  69 #define ELF_CORE_EFLAGS 0
  70 #endif
  71
  72 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  73 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  74 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  75
  76 static struct linux_binfmt elf_format = {
  77         .module         = THIS_MODULE,
  78         .load_binary    = load_elf_binary,
  79         .load_shlib     = load_elf_library,
  80         .core_dump      = elf_core_dump,
  81         .min_coredump   = ELF_EXEC_PAGESIZE,
  82 };
  83
  84 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  85
  86 static int set_brk(unsigned long start, unsigned long end)
  87 {
  88         start = ELF_PAGEALIGN(start);
  89         end = ELF_PAGEALIGN(end);
  90         if (end > start) {
  91                 unsigned long addr;
  92                 addr = vm_brk(start, end - start);
  93                 if (BAD_ADDR(addr))
  94                         return addr;
  95         }
  96         current->mm->start_brk = current->mm->brk = end;
  97         return 0;
  98 }
  99
 100 /* We need to explicitly zero any fractional pages
 101    after the data section (i.e. bss).  This would
 102    contain the junk from the file that should not
 103    be in memory
 104  */
 105 static int padzero(unsigned long elf_bss)
 106 {
 107         unsigned long nbyte;
 108
 109         nbyte = ELF_PAGEOFFSET(elf_bss);
 110         if (nbyte) {
 111                 nbyte = ELF_MIN_ALIGN - nbyte;
 112                 if (clear_user((void __user *) elf_bss, nbyte))
 113                         return -EFAULT;
 114         }
 115         return 0;
 116 }
 117
 118 /* Let's use some macros to make this stack manipulation a little clearer */
 119 #ifdef CONFIG_STACK_GROWSUP
 120 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 121 #define STACK_ROUND(sp, items) \
 122         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 123 #define STACK_ALLOC(sp, len) ({ \
 124         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 125         old_sp; })
 126 #else
 127 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 128 #define STACK_ROUND(sp, items) \
 129         (((unsigned long) (sp - items)) &~ 15UL)
 130 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 131 #endif
 132
 133 #ifndef ELF_BASE_PLATFORM
 134 /*
 135  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 136  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 137  * will be copied to the user stack in the same manner as AT_PLATFORM.
 138  */
 139 #define ELF_BASE_PLATFORM NULL
 140 #endif
 141
 142 static int
 143 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 144                 unsigned long load_addr, unsigned long interp_load_addr)
 145 {
 146         unsigned long p = bprm->p;
 147         int argc = bprm->argc;
 148         int envc = bprm->envc;
 149         elf_addr_t __user *argv;
 150         elf_addr_t __user *envp;
 151         elf_addr_t __user *sp;
 152         elf_addr_t __user *u_platform;
 153         elf_addr_t __user *u_base_platform;
 154         elf_addr_t __user *u_rand_bytes;
 155         const char *k_platform = ELF_PLATFORM;
 156         const char *k_base_platform = ELF_BASE_PLATFORM;
 157         unsigned char k_rand_bytes[16];
 158         int items;
 159         elf_addr_t *elf_info;
 160         int ei_index = 0;
 161         const struct cred *cred = current_cred();
 162         struct vm_area_struct *vma;
 163
 164         /*
 165          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 166          * evictions by the processes running on the same package. One
 167          * thing we can do is to shuffle the initial stack for them.
 168          */
 169
 170         p = arch_align_stack(p);
 171
 172         /*
 173          * If this architecture has a platform capability string, copy it
 174          * to userspace.  In some cases (Sparc), this info is impossible
 175          * for userspace to get any other way, in others (i386) it is
 176          * merely difficult.
 177          */
 178         u_platform = NULL;
 179         if (k_platform) {
 180                 size_t len = strlen(k_platform) + 1;
 181
 182                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 183                 if (__copy_to_user(u_platform, k_platform, len))
 184                         return -EFAULT;
 185         }
 186
 187         /*
 188          * If this architecture has a "base" platform capability
 189          * string, copy it to userspace.
 190          */
 191         u_base_platform = NULL;
 192         if (k_base_platform) {
 193                 size_t len = strlen(k_base_platform) + 1;
 194
 195                 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 196                 if (__copy_to_user(u_base_platform, k_base_platform, len))
 197                         return -EFAULT;
 198         }
 199
 200         /*
 201          * Generate 16 random bytes for userspace PRNG seeding.
 202          */
 203         get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
 204         u_rand_bytes = (elf_addr_t __user *)
 205                        STACK_ALLOC(p, sizeof(k_rand_bytes));
 206         if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
 207                 return -EFAULT;
 208
 209         /* Create the ELF interpreter info */
 210         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 211         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 212 #define NEW_AUX_ENT(id, val) \
 213         do { \
 214                 elf_info[ei_index++] = id; \
 215                 elf_info[ei_index++] = val; \
 216         } while (0)
 217
 218 #ifdef ARCH_DLINFO
 219         /*
 220          * ARCH_DLINFO must come first so PPC can do its special alignment of
 221          * AUXV.
 222          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 223          * ARCH_DLINFO changes
 224          */
 225         ARCH_DLINFO;
 226 #endif
 227         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 228         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 229         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 230         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 231         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 232         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 233         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 234         NEW_AUX_ENT(AT_FLAGS, 0);
 235         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 236         NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
 237         NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
 238         NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
 239         NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
 240         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 241         NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
 242         NEW_AUX_ENT(AT_EXECFN, bprm->exec);
 243         if (k_platform) {
 244                 NEW_AUX_ENT(AT_PLATFORM,
 245                             (elf_addr_t)(unsigned long)u_platform);
 246         }
 247         if (k_base_platform) {
 248                 NEW_AUX_ENT(AT_BASE_PLATFORM,
 249                             (elf_addr_t)(unsigned long)u_base_platform);
 250         }
 251         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 252                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 253         }
 254 #undef NEW_AUX_ENT
 255         /* AT_NULL is zero; clear the rest too */
 256         memset(&elf_info[ei_index], 0,
 257                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 258
 259         /* And advance past the AT_NULL entry.  */
 260         ei_index += 2;
 261
 262         sp = STACK_ADD(p, ei_index);
 263
 264         items = (argc + 1) + (envc + 1) + 1;
 265         bprm->p = STACK_ROUND(sp, items);
 266
 267         /* Point sp at the lowest address on the stack */
 268 #ifdef CONFIG_STACK_GROWSUP
 269         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 270         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 271 #else
 272         sp = (elf_addr_t __user *)bprm->p;
 273 #endif
 274
 275
 276         /*
 277          * Grow the stack manually; some architectures have a limit on how
 278          * far ahead a user-space access may be in order to grow the stack.
 279          */
 280         vma = find_extend_vma(current->mm, bprm->p);
 281         if (!vma)
 282                 return -EFAULT;
 283
 284         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 285         if (__put_user(argc, sp++))
 286                 return -EFAULT;
 287         argv = sp;
 288         envp = argv + argc + 1;
 289
 290         /* Populate argv and envp */
 291         p = current->mm->arg_end = current->mm->arg_start;
 292         while (argc-- > 0) {
 293                 size_t len;
 294                 if (__put_user((elf_addr_t)p, argv++))
 295                         return -EFAULT;
 296                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 297                 if (!len || len > MAX_ARG_STRLEN)
 298                         return -EINVAL;
 299                 p += len;
 300         }
 301         if (__put_user(0, argv))
 302                 return -EFAULT;
 303         current->mm->arg_end = current->mm->env_start = p;
 304         while (envc-- > 0) {
 305                 size_t len;
 306                 if (__put_user((elf_addr_t)p, envp++))
 307                         return -EFAULT;
 308                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 309                 if (!len || len > MAX_ARG_STRLEN)
 310                         return -EINVAL;
 311                 p += len;
 312         }
 313         if (__put_user(0, envp))
 314                 return -EFAULT;
 315         current->mm->env_end = p;
 316
 317         /* Put the elf_info on the stack in the right place.  */
 318         sp = (elf_addr_t __user *)envp + 1;
 319         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 320                 return -EFAULT;
 321         return 0;
 322 }
 323
 324 static unsigned long elf_map(struct file *filep, unsigned long addr,
 325                 struct elf_phdr *eppnt, int prot, int type,
 326                 unsigned long total_size)
 327 {
 328         unsigned long map_addr;
 329         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 330         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 331         addr = ELF_PAGESTART(addr);
 332         size = ELF_PAGEALIGN(size);
 333
 334         /* mmap() will return -EINVAL if given a zero size, but a
 335          * segment with zero filesize is perfectly valid */
 336         if (!size)
 337                 return addr;
 338
 339         /*
 340         * total_size is the size of the ELF (interpreter) image.
 341         * The _first_ mmap needs to know the full size, otherwise
 342         * randomization might put this image into an overlapping
 343         * position with the ELF binary image. (since size < total_size)
 344         * So we first map the 'big' image - and unmap the remainder at
 345         * the end. (which unmap is needed for ELF images with holes.)
 346         */
 347         if (total_size) {
 348                 total_size = ELF_PAGEALIGN(total_size);
 349                 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
 350                 if (!BAD_ADDR(map_addr))
 351                         vm_munmap(map_addr+size, total_size-size);
 352         } else
 353                 map_addr = vm_mmap(filep, addr, size, prot, type, off);
 354
 355         return(map_addr);
 356 }
 357
 358 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 359 {
 360         int i, first_idx = -1, last_idx = -1;
 361
 362         for (i = 0; i < nr; i++) {
 363                 if (cmds[i].p_type == PT_LOAD) {
 364                         last_idx = i;
 365                         if (first_idx == -1)
 366                                 first_idx = i;
 367                 }
 368         }
 369         if (first_idx == -1)
 370                 return 0;
 371
 372         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 373                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 374 }
 375
 376
 377 /* This is much more generalized than the library routine read function,
 378    so we keep this separate.  Technically the library read function
 379    is only provided so that we can read a.out libraries that have
 380    an ELF header */
 381
 382 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 383                 struct file *interpreter, unsigned long *interp_map_addr,
 384                 unsigned long no_base)
 385 {
 386         struct elf_phdr *elf_phdata;
 387         struct elf_phdr *eppnt;
 388         unsigned long load_addr = 0;
 389         int load_addr_set = 0;
 390         unsigned long last_bss = 0, elf_bss = 0;
 391         unsigned long error = ~0UL;
 392         unsigned long total_size;
 393         int retval, i, size;
 394
 395         /* First of all, some simple consistency checks */
 396         if (interp_elf_ex->e_type != ET_EXEC &&
 397             interp_elf_ex->e_type != ET_DYN)
 398                 goto out;
 399         if (!elf_check_arch(interp_elf_ex))
 400                 goto out;
 401         if (!interpreter->f_op || !interpreter->f_op->mmap)
 402                 goto out;
 403
 404         /*
 405          * If the size of this structure has changed, then punt, since
 406          * we will be doing the wrong thing.
 407          */
 408         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 409                 goto out;
 410         if (interp_elf_ex->e_phnum < 1 ||
 411                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 412                 goto out;
 413
 414         /* Now read in all of the header information */
 415         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 416         if (size > ELF_MIN_ALIGN)
 417                 goto out;
 418         elf_phdata = kmalloc(size, GFP_KERNEL);
 419         if (!elf_phdata)
 420                 goto out;
 421
 422         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 423                              (char *)elf_phdata, size);
 424         error = -EIO;
 425         if (retval != size) {
 426                 if (retval < 0)
 427                         error = retval;
 428                 goto out_close;
 429         }
 430
 431         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 432         if (!total_size) {
 433                 error = -EINVAL;
 434                 goto out_close;
 435         }
 436
 437         eppnt = elf_phdata;
 438         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 439                 if (eppnt->p_type == PT_LOAD) {
 440                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 441                         int elf_prot = 0;
 442                         unsigned long vaddr = 0;
 443                         unsigned long k, map_addr;
 444
 445                         if (eppnt->p_flags & PF_R)
 446                                 elf_prot = PROT_READ;
 447                         if (eppnt->p_flags & PF_W)
 448                                 elf_prot |= PROT_WRITE;
 449                         if (eppnt->p_flags & PF_X)
 450                                 elf_prot |= PROT_EXEC;
 451                         vaddr = eppnt->p_vaddr;
 452                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 453                                 elf_type |= MAP_FIXED;
 454                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 455                                 load_addr = -vaddr;
 456
 457                         map_addr = elf_map(interpreter, load_addr + vaddr,
 458                                         eppnt, elf_prot, elf_type, total_size);
 459                         total_size = 0;
 460                         if (!*interp_map_addr)
 461                                 *interp_map_addr = map_addr;
 462                         error = map_addr;
 463                         if (BAD_ADDR(map_addr))
 464                                 goto out_close;
 465
 466                         if (!load_addr_set &&
 467                             interp_elf_ex->e_type == ET_DYN) {
 468                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 469                                 load_addr_set = 1;
 470                         }
 471
 472                         /*
 473                          * Check to see if the section's size will overflow the
 474                          * allowed task size. Note that p_filesz must always be
 475                          * <= p_memsize so it's only necessary to check p_memsz.
 476                          */
 477                         k = load_addr + eppnt->p_vaddr;
 478                         if (BAD_ADDR(k) ||
 479                             eppnt->p_filesz > eppnt->p_memsz ||
 480                             eppnt->p_memsz > TASK_SIZE ||
 481                             TASK_SIZE - eppnt->p_memsz < k) {
 482                                 error = -ENOMEM;
 483                                 goto out_close;
 484                         }
 485
 486                         /*
 487                          * Find the end of the file mapping for this phdr, and
 488                          * keep track of the largest address we see for this.
 489                          */
 490                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 491                         if (k > elf_bss)
 492                                 elf_bss = k;
 493
 494                         /*
 495                          * Do the same thing for the memory mapping - between
 496                          * elf_bss and last_bss is the bss section.
 497                          */
 498                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 499                         if (k > last_bss)
 500                                 last_bss = k;
 501                 }
 502         }
 503
 504         if (last_bss > elf_bss) {
 505                 /*
 506                  * Now fill out the bss section.  First pad the last page up
 507                  * to the page boundary, and then perform a mmap to make sure
 508                  * that there are zero-mapped pages up to and including the
 509                  * last bss page.
 510                  */
 511                 if (padzero(elf_bss)) {
 512                         error = -EFAULT;
 513                         goto out_close;
 514                 }
 515
 516                 /* What we have mapped so far */
 517                 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 518
 519                 /* Map the last of the bss segment */
 520                 error = vm_brk(elf_bss, last_bss - elf_bss);
 521                 if (BAD_ADDR(error))
 522                         goto out_close;
 523         }
 524
 525         error = load_addr;
 526
 527 out_close:
 528         kfree(elf_phdata);
 529 out:
 530         return error;
 531 }
 532
 533 /*
 534  * These are the functions used to load ELF style executables and shared
 535  * libraries.  There is no binary dependent code anywhere else.
 536  */
 537
 538 #define INTERPRETER_NONE 0
 539 #define INTERPRETER_ELF 2
 540
 541 #ifndef STACK_RND_MASK
 542 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 543 #endif
 544
 545 static unsigned long randomize_stack_top(unsigned long stack_top)
 546 {
 547         unsigned int random_variable = 0;
 548
 549         if ((current->flags & PF_RANDOMIZE) &&
 550                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 551                 random_variable = get_random_int() & STACK_RND_MASK;
 552                 random_variable <<= PAGE_SHIFT;
 553         }
 554 #ifdef CONFIG_STACK_GROWSUP
 555         return PAGE_ALIGN(stack_top) + random_variable;
 556 #else
 557         return PAGE_ALIGN(stack_top) - random_variable;
 558 #endif
 559 }
 560
 561 static int load_elf_binary(struct linux_binprm *bprm)
 562 {
 563         struct file *interpreter = NULL; /* to shut gcc up */
 564         unsigned long load_addr = 0, load_bias = 0;
 565         int load_addr_set = 0;
 566         char * elf_interpreter = NULL;
 567         unsigned long error;
 568         struct elf_phdr *elf_ppnt, *elf_phdata;
 569         unsigned long elf_bss, elf_brk;
 570         int retval, i;
 571         unsigned int size;
 572         unsigned long elf_entry;
 573         unsigned long interp_load_addr = 0;
 574         unsigned long start_code, end_code, start_data, end_data;
 575         unsigned long reloc_func_desc __maybe_unused = 0;
 576         int executable_stack = EXSTACK_DEFAULT;
 577         unsigned long def_flags = 0;
 578         struct pt_regs *regs = current_pt_regs();
 579         struct {
 580                 struct elfhdr elf_ex;
 581                 struct elfhdr interp_elf_ex;
 582         } *loc;
 583
 584         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 585         if (!loc) {
 586                 retval = -ENOMEM;
 587                 goto out_ret;
 588         }
 589
 590         /* Get the exec-header */
 591         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 592
 593         retval = -ENOEXEC;
 594         /* First of all, some simple consistency checks */
 595         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 596                 goto out;
 597
 598         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 599                 goto out;
 600         if (!elf_check_arch(&loc->elf_ex))
 601                 goto out;
 602         if (!bprm->file->f_op || !bprm->file->f_op->mmap)
 603                 goto out;
 604
 605         /* Now read in all of the header information */
 606         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 607                 goto out;
 608         if (loc->elf_ex.e_phnum < 1 ||
 609                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 610                 goto out;
 611         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 612         retval = -ENOMEM;
 613         elf_phdata = kmalloc(size, GFP_KERNEL);
 614         if (!elf_phdata)
 615                 goto out;
 616
 617         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 618                              (char *)elf_phdata, size);
 619         if (retval != size) {
 620                 if (retval >= 0)
 621                         retval = -EIO;
 622                 goto out_free_ph;
 623         }
 624
 625         elf_ppnt = elf_phdata;
 626         elf_bss = 0;
 627         elf_brk = 0;
 628
 629         start_code = ~0UL;
 630         end_code = 0;
 631         start_data = 0;
 632         end_data = 0;
 633
 634         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 635                 if (elf_ppnt->p_type == PT_INTERP) {
 636                         /* This is the program interpreter used for
 637                          * shared libraries - for now assume that this
 638                          * is an a.out format binary
 639                          */
 640                         retval = -ENOEXEC;
 641                         if (elf_ppnt->p_filesz > PATH_MAX ||
 642                             elf_ppnt->p_filesz < 2)
 643                                 goto out_free_ph;
 644
 645                         retval = -ENOMEM;
 646                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 647                                                   GFP_KERNEL);
 648                         if (!elf_interpreter)
 649                                 goto out_free_ph;
 650
 651                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 652                                              elf_interpreter,
 653                                              elf_ppnt->p_filesz);
 654                         if (retval != elf_ppnt->p_filesz) {
 655                                 if (retval >= 0)
 656                                         retval = -EIO;
 657                                 goto out_free_interp;
 658                         }
 659                         /* make sure path is NULL terminated */
 660                         retval = -ENOEXEC;
 661                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 662                                 goto out_free_interp;
 663
 664                         interpreter = open_exec(elf_interpreter);
 665                         retval = PTR_ERR(interpreter);
 666                         if (IS_ERR(interpreter))
 667                                 goto out_free_interp;
 668
 669                         /*
 670                          * If the binary is not readable then enforce
 671                          * mm->dumpable = 0 regardless of the interpreter's
 672                          * permissions.
 673                          */
 674                         would_dump(bprm, interpreter);
 675
 676                         retval = kernel_read(interpreter, 0, bprm->buf,
 677                                              BINPRM_BUF_SIZE);
 678                         if (retval != BINPRM_BUF_SIZE) {
 679                                 if (retval >= 0)
 680                                         retval = -EIO;
 681                                 goto out_free_dentry;
 682                         }
 683
 684                         /* Get the exec headers */
 685                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 686                         break;
 687                 }
 688                 elf_ppnt++;
 689         }
 690
 691         elf_ppnt = elf_phdata;
 692         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 693                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 694                         if (elf_ppnt->p_flags & PF_X)
 695                                 executable_stack = EXSTACK_ENABLE_X;
 696                         else
 697                                 executable_stack = EXSTACK_DISABLE_X;
 698                         break;
 699                 }
 700
 701         /* Some simple consistency checks for the interpreter */
 702         if (elf_interpreter) {
 703                 retval = -ELIBBAD;
 704                 /* Not an ELF interpreter */
 705                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 706                         goto out_free_dentry;
 707                 /* Verify the interpreter has a valid arch */
 708                 if (!elf_check_arch(&loc->interp_elf_ex))
 709                         goto out_free_dentry;
 710         }
 711
 712         /* Flush all traces of the currently running executable */
 713         retval = flush_old_exec(bprm);
 714         if (retval)
 715                 goto out_free_dentry;
 716
 717         /* OK, This is the point of no return */
 718         current->mm->def_flags = def_flags;
 719
 720         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 721            may depend on the personality.  */
 722         SET_PERSONALITY(loc->elf_ex);
 723         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 724                 current->personality |= READ_IMPLIES_EXEC;
 725
 726         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 727                 current->flags |= PF_RANDOMIZE;
 728
 729         setup_new_exec(bprm);
 730
 731         /* Do this so that we can load the interpreter, if need be.  We will
 732            change some of these later */
 733         current->mm->free_area_cache = current->mm->mmap_base;
 734         current->mm->cached_hole_size = 0;
 735         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 736                                  executable_stack);
 737         if (retval < 0) {
 738                 send_sig(SIGKILL, current, 0);
 739                 goto out_free_dentry;
 740         }
 741
 742         current->mm->start_stack = bprm->p;
 743
 744         /* Now we do a little grungy work by mmapping the ELF image into
 745            the correct location in memory. */
 746         for(i = 0, elf_ppnt = elf_phdata;
 747             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 748                 int elf_prot = 0, elf_flags;
 749                 unsigned long k, vaddr;
 750
 751                 if (elf_ppnt->p_type != PT_LOAD)
 752                         continue;
 753
 754                 if (unlikely (elf_brk > elf_bss)) {
 755                         unsigned long nbyte;
 756
 757                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 758                            before this one. Map anonymous pages, if needed,
 759                            and clear the area.  */
 760                         retval = set_brk(elf_bss + load_bias,
 761                                          elf_brk + load_bias);
 762                         if (retval) {
 763                                 send_sig(SIGKILL, current, 0);
 764                                 goto out_free_dentry;
 765                         }
 766                         nbyte = ELF_PAGEOFFSET(elf_bss);
 767                         if (nbyte) {
 768                                 nbyte = ELF_MIN_ALIGN - nbyte;
 769                                 if (nbyte > elf_brk - elf_bss)
 770                                         nbyte = elf_brk - elf_bss;
 771                                 if (clear_user((void __user *)elf_bss +
 772                                                         load_bias, nbyte)) {
 773                                         /*
 774                                          * This bss-zeroing can fail if the ELF
 775                                          * file specifies odd protections. So
 776                                          * we don't check the return value
 777                                          */
 778                                 }
 779                         }
 780                 }
 781
 782                 if (elf_ppnt->p_flags & PF_R)
 783                         elf_prot |= PROT_READ;
 784                 if (elf_ppnt->p_flags & PF_W)
 785                         elf_prot |= PROT_WRITE;
 786                 if (elf_ppnt->p_flags & PF_X)
 787                         elf_prot |= PROT_EXEC;
 788
 789                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 790
 791                 vaddr = elf_ppnt->p_vaddr;
 792                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 793                         elf_flags |= MAP_FIXED;
 794                 } else if (loc->elf_ex.e_type == ET_DYN) {
 795                         /* Try and get dynamic programs out of the way of the
 796                          * default mmap base, as well as whatever program they
 797                          * might try to exec.  This is because the brk will
 798                          * follow the loader, and is not movable.  */
 799 #ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
 800                         /* Memory randomization might have been switched off
 801                          * in runtime via sysctl.
 802                          * If that is the case, retain the original non-zero
 803                          * load_bias value in order to establish proper
 804                          * non-randomized mappings.
 805                          */
 806                         if (current->flags & PF_RANDOMIZE)
 807                                 load_bias = 0;
 808                         else
 809                                 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 810 #else
 811                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 812 #endif
 813                 }
 814
 815                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 816                                 elf_prot, elf_flags, 0);
 817                 if (BAD_ADDR(error)) {
 818                         send_sig(SIGKILL, current, 0);
 819                         retval = IS_ERR((void *)error) ?
 820                                 PTR_ERR((void*)error) : -EINVAL;
 821                         goto out_free_dentry;
 822                 }
 823
 824                 if (!load_addr_set) {
 825                         load_addr_set = 1;
 826                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 827                         if (loc->elf_ex.e_type == ET_DYN) {
 828                                 load_bias += error -
 829                                              ELF_PAGESTART(load_bias + vaddr);
 830                                 load_addr += load_bias;
 831                                 reloc_func_desc = load_bias;
 832                         }
 833                 }
 834                 k = elf_ppnt->p_vaddr;
 835                 if (k < start_code)
 836                         start_code = k;
 837                 if (start_data < k)
 838                         start_data = k;
 839
 840                 /*
 841                  * Check to see if the section's size will overflow the
 842                  * allowed task size. Note that p_filesz must always be
 843                  * <= p_memsz so it is only necessary to check p_memsz.
 844                  */
 845                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 846                     elf_ppnt->p_memsz > TASK_SIZE ||
 847                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 848                         /* set_brk can never work. Avoid overflows. */
 849                         send_sig(SIGKILL, current, 0);
 850                         retval = -EINVAL;
 851                         goto out_free_dentry;
 852                 }
 853
 854                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 855
 856                 if (k > elf_bss)
 857                         elf_bss = k;
 858                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 859                         end_code = k;
 860                 if (end_data < k)
 861                         end_data = k;
 862                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 863                 if (k > elf_brk)
 864                         elf_brk = k;
 865         }
 866
 867         loc->elf_ex.e_entry += load_bias;
 868         elf_bss += load_bias;
 869         elf_brk += load_bias;
 870         start_code += load_bias;
 871         end_code += load_bias;
 872         start_data += load_bias;
 873         end_data += load_bias;
 874
 875         /* Calling set_brk effectively mmaps the pages that we need
 876          * for the bss and break sections.  We must do this before
 877          * mapping in the interpreter, to make sure it doesn't wind
 878          * up getting placed where the bss needs to go.
 879          */
 880         retval = set_brk(elf_bss, elf_brk);
 881         if (retval) {
 882                 send_sig(SIGKILL, current, 0);
 883                 goto out_free_dentry;
 884         }
 885         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 886                 send_sig(SIGSEGV, current, 0);
 887                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 888                 goto out_free_dentry;
 889         }
 890
 891         if (elf_interpreter) {
 892                 unsigned long interp_map_addr = 0;
 893
 894                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 895                                             interpreter,
 896                                             &interp_map_addr,
 897                                             load_bias);
 898                 if (!IS_ERR((void *)elf_entry)) {
 899                         /*
 900                          * load_elf_interp() returns relocation
 901                          * adjustment
 902                          */
 903                         interp_load_addr = elf_entry;
 904                         elf_entry += loc->interp_elf_ex.e_entry;
 905                 }
 906                 if (BAD_ADDR(elf_entry)) {
 907                         force_sig(SIGSEGV, current);
 908                         retval = IS_ERR((void *)elf_entry) ?
 909                                         (int)elf_entry : -EINVAL;
 910                         goto out_free_dentry;
 911                 }
 912                 reloc_func_desc = interp_load_addr;
 913
 914                 allow_write_access(interpreter);
 915                 fput(interpreter);
 916                 kfree(elf_interpreter);
 917         } else {
 918                 elf_entry = loc->elf_ex.e_entry;
 919                 if (BAD_ADDR(elf_entry)) {
 920                         force_sig(SIGSEGV, current);
 921                         retval = -EINVAL;
 922                         goto out_free_dentry;
 923                 }
 924         }
 925
 926         kfree(elf_phdata);
 927
 928         set_binfmt(&elf_format);
 929
 930 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 931         retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
 932         if (retval < 0) {
 933                 send_sig(SIGKILL, current, 0);
 934                 goto out;
 935         }
 936 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 937
 938         install_exec_creds(bprm);
 939         retval = create_elf_tables(bprm, &loc->elf_ex,
 940                           load_addr, interp_load_addr);
 941         if (retval < 0) {
 942                 send_sig(SIGKILL, current, 0);
 943                 goto out;
 944         }
 945         /* N.B. passed_fileno might not be initialized? */
 946         current->mm->end_code = end_code;
 947         current->mm->start_code = start_code;
 948         current->mm->start_data = start_data;
 949         current->mm->end_data = end_data;
 950         current->mm->start_stack = bprm->p;
 951
 952 #ifdef arch_randomize_brk
 953         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
 954                 current->mm->brk = current->mm->start_brk =
 955                         arch_randomize_brk(current->mm);
 956 #ifdef CONFIG_COMPAT_BRK
 957                 current->brk_randomized = 1;
 958 #endif
 959         }
 960 #endif
 961
 962         if (current->personality & MMAP_PAGE_ZERO) {
 963                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 964                    and some applications "depend" upon this behavior.
 965                    Since we do not have the power to recompile these, we
 966                    emulate the SVr4 behavior. Sigh. */
 967                 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 968                                 MAP_FIXED | MAP_PRIVATE, 0);
 969         }
 970
 971 #ifdef ELF_PLAT_INIT
 972         /*
 973          * The ABI may specify that certain registers be set up in special
 974          * ways (on i386 %edx is the address of a DT_FINI function, for
 975          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 976          * that the e_entry field is the address of the function descriptor
 977          * for the startup routine, rather than the address of the startup
 978          * routine itself.  This macro performs whatever initialization to
 979          * the regs structure is required as well as any relocations to the
 980          * function descriptor entries when executing dynamically links apps.
 981          */
 982         ELF_PLAT_INIT(regs, reloc_func_desc);
 983 #endif
 984
 985         start_thread(regs, elf_entry, bprm->p);
 986         retval = 0;
 987 out:
 988         kfree(loc);
 989 out_ret:
 990         return retval;
 991
 992         /* error cleanup */
 993 out_free_dentry:
 994         allow_write_access(interpreter);
 995         if (interpreter)
 996                 fput(interpreter);
 997 out_free_interp:
 998         kfree(elf_interpreter);
 999 out_free_ph:
1000         kfree(elf_phdata);
1001         goto out;
1002 }
1003
1004 /* This is really simpleminded and specialized - we are loading an
1005    a.out library that is given an ELF header. */
1006 static int load_elf_library(struct file *file)
1007 {
1008         struct elf_phdr *elf_phdata;
1009         struct elf_phdr *eppnt;
1010         unsigned long elf_bss, bss, len;
1011         int retval, error, i, j;
1012         struct elfhdr elf_ex;
1013
1014         error = -ENOEXEC;
1015         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1016         if (retval != sizeof(elf_ex))
1017                 goto out;
1018
1019         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1020                 goto out;
1021
1022         /* First of all, some simple consistency checks */
1023         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1024             !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1025                 goto out;
1026
1027         /* Now read in all of the header information */
1028
1029         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1030         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1031
1032         error = -ENOMEM;
1033         elf_phdata = kmalloc(j, GFP_KERNEL);
1034         if (!elf_phdata)
1035                 goto out;
1036
1037         eppnt = elf_phdata;
1038         error = -ENOEXEC;
1039         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1040         if (retval != j)
1041                 goto out_free_ph;
1042
1043         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1044                 if ((eppnt + i)->p_type == PT_LOAD)
1045                         j++;
1046         if (j != 1)
1047                 goto out_free_ph;
1048
1049         while (eppnt->p_type != PT_LOAD)
1050                 eppnt++;
1051
1052         /* Now use mmap to map the library into memory. */
1053         error = vm_mmap(file,
1054                         ELF_PAGESTART(eppnt->p_vaddr),
1055                         (eppnt->p_filesz +
1056                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1057                         PROT_READ | PROT_WRITE | PROT_EXEC,
1058                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1059                         (eppnt->p_offset -
1060                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1061         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1062                 goto out_free_ph;
1063
1064         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1065         if (padzero(elf_bss)) {
1066                 error = -EFAULT;
1067                 goto out_free_ph;
1068         }
1069
1070         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1071                             ELF_MIN_ALIGN - 1);
1072         bss = eppnt->p_memsz + eppnt->p_vaddr;
1073         if (bss > len)
1074                 vm_brk(len, bss - len);
1075         error = 0;
1076
1077 out_free_ph:
1078         kfree(elf_phdata);
1079 out:
1080         return error;
1081 }
1082
1083 #ifdef CONFIG_ELF_CORE
1084 /*
1085  * ELF core dumper
1086  *
1087  * Modelled on fs/exec.c:aout_core_dump()
1088  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1089  */
1090
1091 /*
1092  * The purpose of always_dump_vma() is to make sure that special kernel mappings
1093  * that are useful for post-mortem analysis are included in every core dump.
1094  * In that way we ensure that the core dump is fully interpretable later
1095  * without matching up the same kernel and hardware config to see what PC values
1096  * meant. These special mappings include - vDSO, vsyscall, and other
1097  * architecture specific mappings
1098  */
1099 static bool always_dump_vma(struct vm_area_struct *vma)
1100 {
1101         /* Any vsyscall mappings? */
1102         if (vma == get_gate_vma(vma->vm_mm))
1103                 return true;
1104         /*
1105          * arch_vma_name() returns non-NULL for special architecture mappings,
1106          * such as vDSO sections.
1107          */
1108         if (arch_vma_name(vma))
1109                 return true;
1110
1111         return false;
1112 }
1113
1114 /*
1115  * Decide what to dump of a segment, part, all or none.
1116  */
1117 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1118                                    unsigned long mm_flags)
1119 {
1120 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1121
1122         /* always dump the vdso and vsyscall sections */
1123         if (always_dump_vma(vma))
1124                 goto whole;
1125
1126         if (vma->vm_flags & VM_DONTDUMP)
1127                 return 0;
1128
1129         /* Hugetlb memory check */
1130         if (vma->vm_flags & VM_HUGETLB) {
1131                 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1132                         goto whole;
1133                 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1134                         goto whole;
1135         }
1136
1137         /* Do not dump I/O mapped devices or special mappings */
1138         if (vma->vm_flags & VM_IO)
1139                 return 0;
1140
1141         /* By default, dump shared memory if mapped from an anonymous file. */
1142         if (vma->vm_flags & VM_SHARED) {
1143                 if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
1144                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1145                         goto whole;
1146                 return 0;
1147         }
1148
1149         /* Dump segments that have been written to.  */
1150         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1151                 goto whole;
1152         if (vma->vm_file == NULL)
1153                 return 0;
1154
1155         if (FILTER(MAPPED_PRIVATE))
1156                 goto whole;
1157
1158         /*
1159          * If this looks like the beginning of a DSO or executable mapping,
1160          * check for an ELF header.  If we find one, dump the first page to
1161          * aid in determining what was mapped here.
1162          */
1163         if (FILTER(ELF_HEADERS) &&
1164             vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1165                 u32 __user *header = (u32 __user *) vma->vm_start;
1166                 u32 word;
1167                 mm_segment_t fs = get_fs();
1168                 /*
1169                  * Doing it this way gets the constant folded by GCC.
1170                  */
1171                 union {
1172                         u32 cmp;
1173                         char elfmag[SELFMAG];
1174                 } magic;
1175                 BUILD_BUG_ON(SELFMAG != sizeof word);
1176                 magic.elfmag[EI_MAG0] = ELFMAG0;
1177                 magic.elfmag[EI_MAG1] = ELFMAG1;
1178                 magic.elfmag[EI_MAG2] = ELFMAG2;
1179                 magic.elfmag[EI_MAG3] = ELFMAG3;
1180                 /*
1181                  * Switch to the user "segment" for get_user(),
1182                  * then put back what elf_core_dump() had in place.
1183                  */
1184                 set_fs(USER_DS);
1185                 if (unlikely(get_user(word, header)))
1186                         word = 0;
1187                 set_fs(fs);
1188                 if (word == magic.cmp)
1189                         return PAGE_SIZE;
1190         }
1191
1192 #undef  FILTER
1193
1194         return 0;
1195
1196 whole:
1197         return vma->vm_end - vma->vm_start;
1198 }
1199
1200 /* An ELF note in memory */
1201 struct memelfnote
1202 {
1203         const char *name;
1204         int type;
1205         unsigned int datasz;
1206         void *data;
1207 };
1208
1209 static int notesize(struct memelfnote *en)
1210 {
1211         int sz;
1212
1213         sz = sizeof(struct elf_note);
1214         sz += roundup(strlen(en->name) + 1, 4);
1215         sz += roundup(en->datasz, 4);
1216
1217         return sz;
1218 }
1219
1220 #define DUMP_WRITE(addr, nr, foffset)   \
1221         do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
1222
1223 static int alignfile(struct file *file, loff_t *foffset)
1224 {
1225         static const char buf[4] = { 0, };
1226         DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
1227         return 1;
1228 }
1229
1230 static int writenote(struct memelfnote *men, struct file *file,
1231                         loff_t *foffset)
1232 {
1233         struct elf_note en;
1234         en.n_namesz = strlen(men->name) + 1;
1235         en.n_descsz = men->datasz;
1236         en.n_type = men->type;
1237
1238         DUMP_WRITE(&en, sizeof(en), foffset);
1239         DUMP_WRITE(men->name, en.n_namesz, foffset);
1240         if (!alignfile(file, foffset))
1241                 return 0;
1242         DUMP_WRITE(men->data, men->datasz, foffset);
1243         if (!alignfile(file, foffset))
1244                 return 0;
1245
1246         return 1;
1247 }
1248 #undef DUMP_WRITE
1249
1250 static void fill_elf_header(struct elfhdr *elf, int segs,
1251                             u16 machine, u32 flags, u8 osabi)
1252 {
1253         memset(elf, 0, sizeof(*elf));
1254
1255         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1256         elf->e_ident[EI_CLASS] = ELF_CLASS;
1257         elf->e_ident[EI_DATA] = ELF_DATA;
1258         elf->e_ident[EI_VERSION] = EV_CURRENT;
1259         elf->e_ident[EI_OSABI] = ELF_OSABI;
1260
1261         elf->e_type = ET_CORE;
1262         elf->e_machine = machine;
1263         elf->e_version = EV_CURRENT;
1264         elf->e_phoff = sizeof(struct elfhdr);
1265         elf->e_flags = flags;
1266         elf->e_ehsize = sizeof(struct elfhdr);
1267         elf->e_phentsize = sizeof(struct elf_phdr);
1268         elf->e_phnum = segs;
1269
1270         return;
1271 }
1272
1273 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1274 {
1275         phdr->p_type = PT_NOTE;
1276         phdr->p_offset = offset;
1277         phdr->p_vaddr = 0;
1278         phdr->p_paddr = 0;
1279         phdr->p_filesz = sz;
1280         phdr->p_memsz = 0;
1281         phdr->p_flags = 0;
1282         phdr->p_align = 0;
1283         return;
1284 }
1285
1286 static void fill_note(struct memelfnote *note, const char *name, int type,
1287                 unsigned int sz, void *data)
1288 {
1289         note->name = name;
1290         note->type = type;
1291         note->datasz = sz;
1292         note->data = data;
1293         return;
1294 }
1295
1296 /*
1297  * fill up all the fields in prstatus from the given task struct, except
1298  * registers which need to be filled up separately.
1299  */
1300 static void fill_prstatus(struct elf_prstatus *prstatus,
1301                 struct task_struct *p, long signr)
1302 {
1303         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1304         prstatus->pr_sigpend = p->pending.signal.sig[0];
1305         prstatus->pr_sighold = p->blocked.sig[0];
1306         rcu_read_lock();
1307         prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1308         rcu_read_unlock();
1309         prstatus->pr_pid = task_pid_vnr(p);
1310         prstatus->pr_pgrp = task_pgrp_vnr(p);
1311         prstatus->pr_sid = task_session_vnr(p);
1312         if (thread_group_leader(p)) {
1313                 struct task_cputime cputime;
1314
1315                 /*
1316                  * This is the record for the group leader.  It shows the
1317                  * group-wide total, not its individual thread total.
1318                  */
1319                 thread_group_cputime(p, &cputime);
1320                 cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1321                 cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1322         } else {
1323                 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1324                 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1325         }
1326         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1327         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1328 }
1329
1330 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1331                        struct mm_struct *mm)
1332 {
1333         const struct cred *cred;
1334         unsigned int i, len;
1335
1336         /* first copy the parameters from user space */
1337         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1338
1339         len = mm->arg_end - mm->arg_start;
1340         if (len >= ELF_PRARGSZ)
1341                 len = ELF_PRARGSZ-1;
1342         if (copy_from_user(&psinfo->pr_psargs,
1343                            (const char __user *)mm->arg_start, len))
1344                 return -EFAULT;
1345         for(i = 0; i < len; i++)
1346                 if (psinfo->pr_psargs[i] == 0)
1347                         psinfo->pr_psargs[i] = ' ';
1348         psinfo->pr_psargs[len] = 0;
1349
1350         rcu_read_lock();
1351         psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1352         rcu_read_unlock();
1353         psinfo->pr_pid = task_pid_vnr(p);
1354         psinfo->pr_pgrp = task_pgrp_vnr(p);
1355         psinfo->pr_sid = task_session_vnr(p);
1356
1357         i = p->state ? ffz(~p->state) + 1 : 0;
1358         psinfo->pr_state = i;
1359         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1360         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1361         psinfo->pr_nice = task_nice(p);
1362         psinfo->pr_flag = p->flags;
1363         rcu_read_lock();
1364         cred = __task_cred(p);
1365         SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1366         SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1367         rcu_read_unlock();
1368         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1369
1370         return 0;
1371 }
1372
1373 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1374 {
1375         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1376         int i = 0;
1377         do
1378                 i += 2;
1379         while (auxv[i - 2] != AT_NULL);
1380         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1381 }
1382
1383 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1384                 siginfo_t *siginfo)
1385 {
1386         mm_segment_t old_fs = get_fs();
1387         set_fs(KERNEL_DS);
1388         copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo);
1389         set_fs(old_fs);
1390         fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1391 }
1392
1393 #define MAX_FILE_NOTE_SIZE (4*1024*1024)
1394 /*
1395  * Format of NT_FILE note:
1396  *
1397  * long count     -- how many files are mapped
1398  * long page_size -- units for file_ofs
1399  * array of [COUNT] elements of
1400  *   long start
1401  *   long end
1402  *   long file_ofs
1403  * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1404  */
1405 static void fill_files_note(struct memelfnote *note)
1406 {
1407         struct vm_area_struct *vma;
1408         unsigned count, size, names_ofs, remaining, n;
1409         user_long_t *data;
1410         user_long_t *start_end_ofs;
1411         char *name_base, *name_curpos;
1412
1413         /* *Estimated* file count and total data size needed */
1414         count = current->mm->map_count;
1415         size = count * 64;
1416
1417         names_ofs = (2 + 3 * count) * sizeof(data[0]);
1418  alloc:
1419         if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
1420                 goto err;
1421         size = round_up(size, PAGE_SIZE);
1422         data = vmalloc(size);
1423         if (!data)
1424                 goto err;
1425
1426         start_end_ofs = data + 2;
1427         name_base = name_curpos = ((char *)data) + names_ofs;
1428         remaining = size - names_ofs;
1429         count = 0;
1430         for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1431                 struct file *file;
1432                 const char *filename;
1433
1434                 file = vma->vm_file;
1435                 if (!file)
1436                         continue;
1437                 filename = d_path(&file->f_path, name_curpos, remaining);
1438                 if (IS_ERR(filename)) {
1439                         if (PTR_ERR(filename) == -ENAMETOOLONG) {
1440                                 vfree(data);
1441                                 size = size * 5 / 4;
1442                                 goto alloc;
1443                         }
1444                         continue;
1445                 }
1446
1447                 /* d_path() fills at the end, move name down */
1448                 /* n = strlen(filename) + 1: */
1449                 n = (name_curpos + remaining) - filename;
1450                 remaining = filename - name_curpos;
1451                 memmove(name_curpos, filename, n);
1452                 name_curpos += n;
1453
1454                 *start_end_ofs++ = vma->vm_start;
1455                 *start_end_ofs++ = vma->vm_end;
1456                 *start_end_ofs++ = vma->vm_pgoff;
1457                 count++;
1458         }
1459
1460         /* Now we know exact count of files, can store it */
1461         data[0] = count;
1462         data[1] = PAGE_SIZE;
1463         /*
1464          * Count usually is less than current->mm->map_count,
1465          * we need to move filenames down.
1466          */
1467         n = current->mm->map_count - count;
1468         if (n != 0) {
1469                 unsigned shift_bytes = n * 3 * sizeof(data[0]);
1470                 memmove(name_base - shift_bytes, name_base,
1471                         name_curpos - name_base);
1472                 name_curpos -= shift_bytes;
1473         }
1474
1475         size = name_curpos - (char *)data;
1476         fill_note(note, "CORE", NT_FILE, size, data);
1477  err: ;
1478 }
1479
1480 #ifdef CORE_DUMP_USE_REGSET
1481 #include <linux/regset.h>
1482
1483 struct elf_thread_core_info {
1484         struct elf_thread_core_info *next;
1485         struct task_struct *task;
1486         struct elf_prstatus prstatus;
1487         struct memelfnote notes[0];
1488 };
1489
1490 struct elf_note_info {
1491         struct elf_thread_core_info *thread;
1492         struct memelfnote psinfo;
1493         struct memelfnote signote;
1494         struct memelfnote auxv;
1495         struct memelfnote files;
1496         user_siginfo_t csigdata;
1497         size_t size;
1498         int thread_notes;
1499 };
1500
1501 /*
1502  * When a regset has a writeback hook, we call it on each thread before
1503  * dumping user memory.  On register window machines, this makes sure the
1504  * user memory backing the register data is up to date before we read it.
1505  */
1506 static void do_thread_regset_writeback(struct task_struct *task,
1507                                        const struct user_regset *regset)
1508 {
1509         if (regset->writeback)
1510                 regset->writeback(task, regset, 1);
1511 }
1512
1513 #ifndef PR_REG_SIZE
1514 #define PR_REG_SIZE(S) sizeof(S)
1515 #endif
1516
1517 #ifndef PRSTATUS_SIZE
1518 #define PRSTATUS_SIZE(S) sizeof(S)
1519 #endif
1520
1521 #ifndef PR_REG_PTR
1522 #define PR_REG_PTR(S) (&((S)->pr_reg))
1523 #endif
1524
1525 #ifndef SET_PR_FPVALID
1526 #define SET_PR_FPVALID(S, V) ((S)->pr_fpvalid = (V))
1527 #endif
1528
1529 static int fill_thread_core_info(struct elf_thread_core_info *t,
1530                                  const struct user_regset_view *view,
1531                                  long signr, size_t *total)
1532 {
1533         unsigned int i;
1534
1535         /*
1536          * NT_PRSTATUS is the one special case, because the regset data
1537          * goes into the pr_reg field inside the note contents, rather
1538          * than being the whole note contents.  We fill the reset in here.
1539          * We assume that regset 0 is NT_PRSTATUS.
1540          */
1541         fill_prstatus(&t->prstatus, t->task, signr);
1542         (void) view->regsets[0].get(t->task, &view->regsets[0],
1543                                     0, PR_REG_SIZE(t->prstatus.pr_reg),
1544                                     PR_REG_PTR(&t->prstatus), NULL);
1545
1546         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1547                   PRSTATUS_SIZE(t->prstatus), &t->prstatus);
1548         *total += notesize(&t->notes[0]);
1549
1550         do_thread_regset_writeback(t->task, &view->regsets[0]);
1551
1552         /*
1553          * Each other regset might generate a note too.  For each regset
1554          * that has no core_note_type or is inactive, we leave t->notes[i]
1555          * all zero and we'll know to skip writing it later.
1556          */
1557         for (i = 1; i < view->n; ++i) {
1558                 const struct user_regset *regset = &view->regsets[i];
1559                 do_thread_regset_writeback(t->task, regset);
1560                 if (regset->core_note_type && regset->get &&
1561                     (!regset->active || regset->active(t->task, regset))) {
1562                         int ret;
1563                         size_t size = regset->n * regset->size;
1564                         void *data = kmalloc(size, GFP_KERNEL);
1565                         if (unlikely(!data))
1566                                 return 0;
1567                         ret = regset->get(t->task, regset,
1568                                           0, size, data, NULL);
1569                         if (unlikely(ret))
1570                                 kfree(data);
1571                         else {
1572                                 if (regset->core_note_type != NT_PRFPREG)
1573                                         fill_note(&t->notes[i], "LINUX",
1574                                                   regset->core_note_type,
1575                                                   size, data);
1576                                 else {
1577                                         SET_PR_FPVALID(&t->prstatus, 1);
1578                                         fill_note(&t->notes[i], "CORE",
1579                                                   NT_PRFPREG, size, data);
1580                                 }
1581                                 *total += notesize(&t->notes[i]);
1582                         }
1583                 }
1584         }
1585
1586         return 1;
1587 }
1588
1589 static int fill_note_info(struct elfhdr *elf, int phdrs,
1590                           struct elf_note_info *info,
1591                           siginfo_t *siginfo, struct pt_regs *regs)
1592 {
1593         struct task_struct *dump_task = current;
1594         const struct user_regset_view *view = task_user_regset_view(dump_task);
1595         struct elf_thread_core_info *t;
1596         struct elf_prpsinfo *psinfo;
1597         struct core_thread *ct;
1598         unsigned int i;
1599
1600         info->size = 0;
1601         info->thread = NULL;
1602
1603         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1604         if (psinfo == NULL)
1605                 return 0;
1606
1607         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1608
1609         /*
1610          * Figure out how many notes we're going to need for each thread.
1611          */
1612         info->thread_notes = 0;
1613         for (i = 0; i < view->n; ++i)
1614                 if (view->regsets[i].core_note_type != 0)
1615                         ++info->thread_notes;
1616
1617         /*
1618          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1619          * since it is our one special case.
1620          */
1621         if (unlikely(info->thread_notes == 0) ||
1622             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1623                 WARN_ON(1);
1624                 return 0;
1625         }
1626
1627         /*
1628          * Initialize the ELF file header.
1629          */
1630         fill_elf_header(elf, phdrs,
1631                         view->e_machine, view->e_flags, view->ei_osabi);
1632
1633         /*
1634          * Allocate a structure for each thread.
1635          */
1636         for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1637                 t = kzalloc(offsetof(struct elf_thread_core_info,
1638                                      notes[info->thread_notes]),
1639                             GFP_KERNEL);
1640                 if (unlikely(!t))
1641                         return 0;
1642
1643                 t->task = ct->task;
1644                 if (ct->task == dump_task || !info->thread) {
1645                         t->next = info->thread;
1646                         info->thread = t;
1647                 } else {
1648                         /*
1649                          * Make sure to keep the original task at
1650                          * the head of the list.
1651                          */
1652                         t->next = info->thread->next;
1653                         info->thread->next = t;
1654                 }
1655         }
1656
1657         /*
1658          * Now fill in each thread's information.
1659          */
1660         for (t = info->thread; t != NULL; t = t->next)
1661                 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size))
1662                         return 0;
1663
1664         /*
1665          * Fill in the two process-wide notes.
1666          */
1667         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1668         info->size += notesize(&info->psinfo);
1669
1670         fill_siginfo_note(&info->signote, &info->csigdata, siginfo);
1671         info->size += notesize(&info->signote);
1672
1673         fill_auxv_note(&info->auxv, current->mm);
1674         info->size += notesize(&info->auxv);
1675
1676         fill_files_note(&info->files);
1677         info->size += notesize(&info->files);
1678
1679         return 1;
1680 }
1681
1682 static size_t get_note_info_size(struct elf_note_info *info)
1683 {
1684         return info->size;
1685 }
1686
1687 /*
1688  * Write all the notes for each thread.  When writing the first thread, the
1689  * process-wide notes are interleaved after the first thread-specific note.
1690  */
1691 static int write_note_info(struct elf_note_info *info,
1692                            struct file *file, loff_t *foffset)
1693 {
1694         bool first = 1;
1695         struct elf_thread_core_info *t = info->thread;
1696
1697         do {
1698                 int i;
1699
1700                 if (!writenote(&t->notes[0], file, foffset))
1701                         return 0;
1702
1703                 if (first && !writenote(&info->psinfo, file, foffset))
1704                         return 0;
1705                 if (first && !writenote(&info->signote, file, foffset))
1706                         return 0;
1707                 if (first && !writenote(&info->auxv, file, foffset))
1708                         return 0;
1709                 if (first && !writenote(&info->files, file, foffset))
1710                         return 0;
1711
1712                 for (i = 1; i < info->thread_notes; ++i)
1713                         if (t->notes[i].data &&
1714                             !writenote(&t->notes[i], file, foffset))
1715                                 return 0;
1716
1717                 first = 0;
1718                 t = t->next;
1719         } while (t);
1720
1721         return 1;
1722 }
1723
1724 static void free_note_info(struct elf_note_info *info)
1725 {
1726         struct elf_thread_core_info *threads = info->thread;
1727         while (threads) {
1728                 unsigned int i;
1729                 struct elf_thread_core_info *t = threads;
1730                 threads = t->next;
1731                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1732                 for (i = 1; i < info->thread_notes; ++i)
1733                         kfree(t->notes[i].data);
1734                 kfree(t);
1735         }
1736         kfree(info->psinfo.data);
1737         vfree(info->files.data);
1738 }
1739
1740 #else
1741
1742 /* Here is the structure in which status of each thread is captured. */
1743 struct elf_thread_status
1744 {
1745         struct list_head list;
1746         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1747         elf_fpregset_t fpu;             /* NT_PRFPREG */
1748         struct task_struct *thread;
1749 #ifdef ELF_CORE_COPY_XFPREGS
1750         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1751 #endif
1752         struct memelfnote notes[3];
1753         int num_notes;
1754 };
1755
1756 /*
1757  * In order to add the specific thread information for the elf file format,
1758  * we need to keep a linked list of every threads pr_status and then create
1759  * a single section for them in the final core file.
1760  */
1761 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1762 {
1763         int sz = 0;
1764         struct task_struct *p = t->thread;
1765         t->num_notes = 0;
1766
1767         fill_prstatus(&t->prstatus, p, signr);
1768         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1769
1770         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1771                   &(t->prstatus));
1772         t->num_notes++;
1773         sz += notesize(&t->notes[0]);
1774
1775         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1776                                                                 &t->fpu))) {
1777                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1778                           &(t->fpu));
1779                 t->num_notes++;
1780                 sz += notesize(&t->notes[1]);
1781         }
1782
1783 #ifdef ELF_CORE_COPY_XFPREGS
1784         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1785                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1786                           sizeof(t->xfpu), &t->xfpu);
1787                 t->num_notes++;
1788                 sz += notesize(&t->notes[2]);
1789         }
1790 #endif
1791         return sz;
1792 }
1793
1794 struct elf_note_info {
1795         struct memelfnote *notes;
1796         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1797         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1798         struct list_head thread_list;
1799         elf_fpregset_t *fpu;
1800 #ifdef ELF_CORE_COPY_XFPREGS
1801         elf_fpxregset_t *xfpu;
1802 #endif
1803         user_siginfo_t csigdata;
1804         int thread_status_size;
1805         int numnote;
1806 };
1807
1808 static int elf_note_info_init(struct elf_note_info *info)
1809 {
1810         memset(info, 0, sizeof(*info));
1811         INIT_LIST_HEAD(&info->thread_list);
1812
1813         /* Allocate space for ELF notes */
1814         info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL);
1815         if (!info->notes)
1816                 return 0;
1817         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1818         if (!info->psinfo)
1819                 return 0;
1820         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1821         if (!info->prstatus)
1822                 return 0;
1823         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1824         if (!info->fpu)
1825                 return 0;
1826 #ifdef ELF_CORE_COPY_XFPREGS
1827         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1828         if (!info->xfpu)
1829                 return 0;
1830 #endif
1831         return 1;
1832 }
1833
1834 static int fill_note_info(struct elfhdr *elf, int phdrs,
1835                           struct elf_note_info *info,
1836                           siginfo_t *siginfo, struct pt_regs *regs)
1837 {
1838         struct list_head *t;
1839
1840         if (!elf_note_info_init(info))
1841                 return 0;
1842
1843         if (siginfo->si_signo) {
1844                 struct core_thread *ct;
1845                 struct elf_thread_status *ets;
1846
1847                 for (ct = current->mm->core_state->dumper.next;
1848                                                 ct; ct = ct->next) {
1849                         ets = kzalloc(sizeof(*ets), GFP_KERNEL);
1850                         if (!ets)
1851                                 return 0;
1852
1853                         ets->thread = ct->task;
1854                         list_add(&ets->list, &info->thread_list);
1855                 }
1856
1857                 list_for_each(t, &info->thread_list) {
1858                         int sz;
1859
1860                         ets = list_entry(t, struct elf_thread_status, list);
1861                         sz = elf_dump_thread_status(siginfo->si_signo, ets);
1862                         info->thread_status_size += sz;
1863                 }
1864         }
1865         /* now collect the dump for the current */
1866         memset(info->prstatus, 0, sizeof(*info->prstatus));
1867         fill_prstatus(info->prstatus, current, siginfo->si_signo);
1868         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1869
1870         /* Set up header */
1871         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
1872
1873         /*
1874          * Set up the notes in similar form to SVR4 core dumps made
1875          * with info from their /proc.
1876          */
1877
1878         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1879                   sizeof(*info->prstatus), info->prstatus);
1880         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1881         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1882                   sizeof(*info->psinfo), info->psinfo);
1883
1884         fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
1885         fill_auxv_note(info->notes + 3, current->mm);
1886         fill_files_note(info->notes + 4);
1887
1888         info->numnote = 5;
1889
1890         /* Try to dump the FPU. */
1891         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1892                                                                info->fpu);
1893         if (info->prstatus->pr_fpvalid)
1894                 fill_note(info->notes + info->numnote++,
1895                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1896 #ifdef ELF_CORE_COPY_XFPREGS
1897         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1898                 fill_note(info->notes + info->numnote++,
1899                           "LINUX", ELF_CORE_XFPREG_TYPE,
1900                           sizeof(*info->xfpu), info->xfpu);
1901 #endif
1902
1903         return 1;
1904 }
1905
1906 static size_t get_note_info_size(struct elf_note_info *info)
1907 {
1908         int sz = 0;
1909         int i;
1910
1911         for (i = 0; i < info->numnote; i++)
1912                 sz += notesize(info->notes + i);
1913
1914         sz += info->thread_status_size;
1915
1916         return sz;
1917 }
1918
1919 static int write_note_info(struct elf_note_info *info,
1920                            struct file *file, loff_t *foffset)
1921 {
1922         int i;
1923         struct list_head *t;
1924
1925         for (i = 0; i < info->numnote; i++)
1926                 if (!writenote(info->notes + i, file, foffset))
1927                         return 0;
1928
1929         /* write out the thread status notes section */
1930         list_for_each(t, &info->thread_list) {
1931                 struct elf_thread_status *tmp =
1932                                 list_entry(t, struct elf_thread_status, list);
1933
1934                 for (i = 0; i < tmp->num_notes; i++)
1935                         if (!writenote(&tmp->notes[i], file, foffset))
1936                                 return 0;
1937         }
1938
1939         return 1;
1940 }
1941
1942 static void free_note_info(struct elf_note_info *info)
1943 {
1944         while (!list_empty(&info->thread_list)) {
1945                 struct list_head *tmp = info->thread_list.next;
1946                 list_del(tmp);
1947                 kfree(list_entry(tmp, struct elf_thread_status, list));
1948         }
1949
1950         /* Free data allocated by fill_files_note(): */
1951         vfree(info->notes[4].data);
1952
1953         kfree(info->prstatus);
1954         kfree(info->psinfo);
1955         kfree(info->notes);
1956         kfree(info->fpu);
1957 #ifdef ELF_CORE_COPY_XFPREGS
1958         kfree(info->xfpu);
1959 #endif
1960 }
1961
1962 #endif
1963
1964 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1965                                         struct vm_area_struct *gate_vma)
1966 {
1967         struct vm_area_struct *ret = tsk->mm->mmap;
1968
1969         if (ret)
1970                 return ret;
1971         return gate_vma;
1972 }
1973 /*
1974  * Helper function for iterating across a vma list.  It ensures that the caller
1975  * will visit `gate_vma' prior to terminating the search.
1976  */
1977 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1978                                         struct vm_area_struct *gate_vma)
1979 {
1980         struct vm_area_struct *ret;
1981
1982         ret = this_vma->vm_next;
1983         if (ret)
1984                 return ret;
1985         if (this_vma == gate_vma)
1986                 return NULL;
1987         return gate_vma;
1988 }
1989
1990 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
1991                              elf_addr_t e_shoff, int segs)
1992 {
1993         elf->e_shoff = e_shoff;
1994         elf->e_shentsize = sizeof(*shdr4extnum);
1995         elf->e_shnum = 1;
1996         elf->e_shstrndx = SHN_UNDEF;
1997
1998         memset(shdr4extnum, 0, sizeof(*shdr4extnum));
1999
2000         shdr4extnum->sh_type = SHT_NULL;
2001         shdr4extnum->sh_size = elf->e_shnum;
2002         shdr4extnum->sh_link = elf->e_shstrndx;
2003         shdr4extnum->sh_info = segs;
2004 }
2005
2006 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
2007                                      unsigned long mm_flags)
2008 {
2009         struct vm_area_struct *vma;
2010         size_t size = 0;
2011
2012         for (vma = first_vma(current, gate_vma); vma != NULL;
2013              vma = next_vma(vma, gate_vma))
2014                 size += vma_dump_size(vma, mm_flags);
2015         return size;
2016 }
2017
2018 /*
2019  * Actual dumper
2020  *
2021  * This is a two-pass process; first we find the offsets of the bits,
2022  * and then they are actually written out.  If we run out of core limit
2023  * we just truncate.
2024  */
2025 static int elf_core_dump(struct coredump_params *cprm)
2026 {
2027         int has_dumped = 0;
2028         mm_segment_t fs;
2029         int segs;
2030         size_t size = 0;
2031         struct vm_area_struct *vma, *gate_vma;
2032         struct elfhdr *elf = NULL;
2033         loff_t offset = 0, dataoff, foffset;
2034         struct elf_note_info info;
2035         struct elf_phdr *phdr4note = NULL;
2036         struct elf_shdr *shdr4extnum = NULL;
2037         Elf_Half e_phnum;
2038         elf_addr_t e_shoff;
2039
2040         /*
2041          * We no longer stop all VM operations.
2042          *
2043          * This is because those proceses that could possibly change map_count
2044          * or the mmap / vma pages are now blocked in do_exit on current
2045          * finishing this core dump.
2046          *
2047          * Only ptrace can touch these memory addresses, but it doesn't change
2048          * the map_count or the pages allocated. So no possibility of crashing
2049          * exists while dumping the mm->vm_next areas to the core file.
2050          */
2051
2052         /* alloc memory for large data structures: too large to be on stack */
2053         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
2054         if (!elf)
2055                 goto out;
2056         /*
2057          * The number of segs are recored into ELF header as 16bit value.
2058          * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2059          */
2060         segs = current->mm->map_count;
2061         segs += elf_core_extra_phdrs();
2062
2063         gate_vma = get_gate_vma(current->mm);
2064         if (gate_vma != NULL)
2065                 segs++;
2066
2067         /* for notes section */
2068         segs++;
2069
2070         /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2071          * this, kernel supports extended numbering. Have a look at
2072          * include/linux/elf.h for further information. */
2073         e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2074
2075         /*
2076          * Collect all the non-memory information about the process for the
2077          * notes.  This also sets up the file header.
2078          */
2079         if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs))
2080                 goto cleanup;
2081
2082         has_dumped = 1;
2083         current->flags |= PF_DUMPCORE;
2084
2085         fs = get_fs();
2086         set_fs(KERNEL_DS);
2087
2088         offset += sizeof(*elf);                         /* Elf header */
2089         offset += segs * sizeof(struct elf_phdr);       /* Program headers */
2090         foffset = offset;
2091
2092         /* Write notes phdr entry */
2093         {
2094                 size_t sz = get_note_info_size(&info);
2095
2096                 sz += elf_coredump_extra_notes_size();
2097
2098                 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2099                 if (!phdr4note)
2100                         goto end_coredump;
2101
2102                 fill_elf_note_phdr(phdr4note, sz, offset);
2103                 offset += sz;
2104         }
2105
2106         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2107
2108         offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
2109         offset += elf_core_extra_data_size();
2110         e_shoff = offset;
2111
2112         if (e_phnum == PN_XNUM) {
2113                 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2114                 if (!shdr4extnum)
2115                         goto end_coredump;
2116                 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2117         }
2118
2119         offset = dataoff;
2120
2121         size += sizeof(*elf);
2122         if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
2123                 goto end_coredump;
2124
2125         size += sizeof(*phdr4note);
2126         if (size > cprm->limit
2127             || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
2128                 goto end_coredump;
2129
2130         /* Write program headers for segments dump */
2131         for (vma = first_vma(current, gate_vma); vma != NULL;
2132                         vma = next_vma(vma, gate_vma)) {
2133                 struct elf_phdr phdr;
2134
2135                 phdr.p_type = PT_LOAD;
2136                 phdr.p_offset = offset;
2137                 phdr.p_vaddr = vma->vm_start;
2138                 phdr.p_paddr = 0;
2139                 phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
2140                 phdr.p_memsz = vma->vm_end - vma->vm_start;
2141                 offset += phdr.p_filesz;
2142                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2143                 if (vma->vm_flags & VM_WRITE)
2144                         phdr.p_flags |= PF_W;
2145                 if (vma->vm_flags & VM_EXEC)
2146                         phdr.p_flags |= PF_X;
2147                 phdr.p_align = ELF_EXEC_PAGESIZE;
2148
2149                 size += sizeof(phdr);
2150                 if (size > cprm->limit
2151                     || !dump_write(cprm->file, &phdr, sizeof(phdr)))
2152                         goto end_coredump;
2153         }
2154
2155         if (!elf_core_write_extra_phdrs(cprm->file, offset, &size, cprm->limit))
2156                 goto end_coredump;
2157
2158         /* write out the notes section */
2159         if (!write_note_info(&info, cprm->file, &foffset))
2160                 goto end_coredump;
2161
2162         if (elf_coredump_extra_notes_write(cprm->file, &foffset))
2163                 goto end_coredump;
2164
2165         /* Align to page */
2166         if (!dump_seek(cprm->file, dataoff - foffset))
2167                 goto end_coredump;
2168
2169         for (vma = first_vma(current, gate_vma); vma != NULL;
2170                         vma = next_vma(vma, gate_vma)) {
2171                 unsigned long addr;
2172                 unsigned long end;
2173
2174                 end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
2175
2176                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2177                         struct page *page;
2178                         int stop;
2179
2180                         page = get_dump_page(addr);
2181                         if (page) {
2182                                 void *kaddr = kmap(page);
2183                                 stop = ((size += PAGE_SIZE) > cprm->limit) ||
2184                                         !dump_write(cprm->file, kaddr,
2185                                                     PAGE_SIZE);
2186                                 kunmap(page);
2187                                 page_cache_release(page);
2188                         } else
2189                                 stop = !dump_seek(cprm->file, PAGE_SIZE);
2190                         if (stop)
2191                                 goto end_coredump;
2192                 }
2193         }
2194
2195         if (!elf_core_write_extra_data(cprm->file, &size, cprm->limit))
2196                 goto end_coredump;
2197
2198         if (e_phnum == PN_XNUM) {
2199                 size += sizeof(*shdr4extnum);
2200                 if (size > cprm->limit
2201                     || !dump_write(cprm->file, shdr4extnum,
2202                                    sizeof(*shdr4extnum)))
2203                         goto end_coredump;
2204         }
2205
2206 end_coredump:
2207         set_fs(fs);
2208
2209 cleanup:
2210         free_note_info(&info);
2211         kfree(shdr4extnum);
2212         kfree(phdr4note);
2213         kfree(elf);
2214 out:
2215         return has_dumped;
2216 }
2217
2218 #endif          /* CONFIG_ELF_CORE */
2219
2220 static int __init init_elf_binfmt(void)
2221 {
2222         register_binfmt(&elf_format);
2223         return 0;
2224 }
2225
2226 static void __exit exit_elf_binfmt(void)
2227 {
2228         /* Remove the COFF and ELF loaders. */
2229         unregister_binfmt(&elf_format);
2230 }
2231
2232 core_initcall(init_elf_binfmt);
2233 module_exit(exit_elf_binfmt);
2234 MODULE_LICENSE("GPL");