fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/mm.h>
  16 #include <linux/mman.h>
  17 #include <linux/errno.h>
  18 #include <linux/signal.h>
  19 #include <linux/binfmts.h>
  20 #include <linux/string.h>
  21 #include <linux/file.h>
  22 #include <linux/slab.h>
  23 #include <linux/personality.h>
  24 #include <linux/elfcore.h>
  25 #include <linux/init.h>
  26 #include <linux/highuid.h>
  27 #include <linux/compiler.h>
  28 #include <linux/highmem.h>
  29 #include <linux/pagemap.h>
  30 #include <linux/vmalloc.h>
  31 #include <linux/security.h>
  32 #include <linux/random.h>
  33 #include <linux/elf.h>
  34 #include <linux/utsname.h>
  35 #include <linux/coredump.h>
  36 #include <linux/sched.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/param.h>
  39 #include <asm/page.h>
  40
  41 #ifndef user_long_t
  42 #define user_long_t long
  43 #endif
  44 #ifndef user_siginfo_t
  45 #define user_siginfo_t siginfo_t
  46 #endif
  47
  48 static int load_elf_binary(struct linux_binprm *bprm);
  49 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  50                                 int, int, unsigned long);
  51
  52 #ifdef CONFIG_USELIB
  53 static int load_elf_library(struct file *);
  54 #else
  55 #define load_elf_library NULL
  56 #endif
  57
  58 /*
  59  * If we don't support core dumping, then supply a NULL so we
  60  * don't even try.
  61  */
  62 #ifdef CONFIG_ELF_CORE
  63 static int elf_core_dump(struct coredump_params *cprm);
  64 #else
  65 #define elf_core_dump   NULL
  66 #endif
  67
  68 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  69 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  70 #else
  71 #define ELF_MIN_ALIGN   PAGE_SIZE
  72 #endif
  73
  74 #ifndef ELF_CORE_EFLAGS
  75 #define ELF_CORE_EFLAGS 0
  76 #endif
  77
  78 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  79 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  80 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  81
  82 static struct linux_binfmt elf_format = {
  83         .module         = THIS_MODULE,
  84         .load_binary    = load_elf_binary,
  85         .load_shlib     = load_elf_library,
  86         .core_dump      = elf_core_dump,
  87         .min_coredump   = ELF_EXEC_PAGESIZE,
  88 };
  89
  90 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  91
  92 static int set_brk(unsigned long start, unsigned long end)
  93 {
  94         start = ELF_PAGEALIGN(start);
  95         end = ELF_PAGEALIGN(end);
  96         if (end > start) {
  97                 unsigned long addr;
  98                 addr = vm_brk(start, end - start);
  99                 if (BAD_ADDR(addr))
 100                         return addr;
 101         }
 102         current->mm->start_brk = current->mm->brk = end;
 103         return 0;
 104 }
 105
 106 /* We need to explicitly zero any fractional pages
 107    after the data section (i.e. bss).  This would
 108    contain the junk from the file that should not
 109    be in memory
 110  */
 111 static int padzero(unsigned long elf_bss)
 112 {
 113         unsigned long nbyte;
 114
 115         nbyte = ELF_PAGEOFFSET(elf_bss);
 116         if (nbyte) {
 117                 nbyte = ELF_MIN_ALIGN - nbyte;
 118                 if (clear_user((void __user *) elf_bss, nbyte))
 119                         return -EFAULT;
 120         }
 121         return 0;
 122 }
 123
 124 /* Let's use some macros to make this stack manipulation a little clearer */
 125 #ifdef CONFIG_STACK_GROWSUP
 126 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 127 #define STACK_ROUND(sp, items) \
 128         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 129 #define STACK_ALLOC(sp, len) ({ \
 130         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 131         old_sp; })
 132 #else
 133 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 134 #define STACK_ROUND(sp, items) \
 135         (((unsigned long) (sp - items)) &~ 15UL)
 136 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 137 #endif
 138
 139 #ifndef ELF_BASE_PLATFORM
 140 /*
 141  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 142  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 143  * will be copied to the user stack in the same manner as AT_PLATFORM.
 144  */
 145 #define ELF_BASE_PLATFORM NULL
 146 #endif
 147
 148 static int
 149 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 150                 unsigned long load_addr, unsigned long interp_load_addr)
 151 {
 152         unsigned long p = bprm->p;
 153         int argc = bprm->argc;
 154         int envc = bprm->envc;
 155         elf_addr_t __user *argv;
 156         elf_addr_t __user *envp;
 157         elf_addr_t __user *sp;
 158         elf_addr_t __user *u_platform;
 159         elf_addr_t __user *u_base_platform;
 160         elf_addr_t __user *u_rand_bytes;
 161         const char *k_platform = ELF_PLATFORM;
 162         const char *k_base_platform = ELF_BASE_PLATFORM;
 163         unsigned char k_rand_bytes[16];
 164         int items;
 165         elf_addr_t *elf_info;
 166         int ei_index = 0;
 167         const struct cred *cred = current_cred();
 168         struct vm_area_struct *vma;
 169
 170         /*
 171          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 172          * evictions by the processes running on the same package. One
 173          * thing we can do is to shuffle the initial stack for them.
 174          */
 175
 176         p = arch_align_stack(p);
 177
 178         /*
 179          * If this architecture has a platform capability string, copy it
 180          * to userspace.  In some cases (Sparc), this info is impossible
 181          * for userspace to get any other way, in others (i386) it is
 182          * merely difficult.
 183          */
 184         u_platform = NULL;
 185         if (k_platform) {
 186                 size_t len = strlen(k_platform) + 1;
 187
 188                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 189                 if (__copy_to_user(u_platform, k_platform, len))
 190                         return -EFAULT;
 191         }
 192
 193         /*
 194          * If this architecture has a "base" platform capability
 195          * string, copy it to userspace.
 196          */
 197         u_base_platform = NULL;
 198         if (k_base_platform) {
 199                 size_t len = strlen(k_base_platform) + 1;
 200
 201                 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 202                 if (__copy_to_user(u_base_platform, k_base_platform, len))
 203                         return -EFAULT;
 204         }
 205
 206         /*
 207          * Generate 16 random bytes for userspace PRNG seeding.
 208          */
 209         get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
 210         u_rand_bytes = (elf_addr_t __user *)
 211                        STACK_ALLOC(p, sizeof(k_rand_bytes));
 212         if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
 213                 return -EFAULT;
 214
 215         /* Create the ELF interpreter info */
 216         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 217         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 218 #define NEW_AUX_ENT(id, val) \
 219         do { \
 220                 elf_info[ei_index++] = id; \
 221                 elf_info[ei_index++] = val; \
 222         } while (0)
 223
 224 #ifdef ARCH_DLINFO
 225         /*
 226          * ARCH_DLINFO must come first so PPC can do its special alignment of
 227          * AUXV.
 228          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 229          * ARCH_DLINFO changes
 230          */
 231         ARCH_DLINFO;
 232 #endif
 233         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 234         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 235         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 236         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 237         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 238         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 239         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 240         NEW_AUX_ENT(AT_FLAGS, 0);
 241         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 242         NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
 243         NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
 244         NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
 245         NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
 246         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 247         NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
 248 #ifdef ELF_HWCAP2
 249         NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
 250 #endif
 251         NEW_AUX_ENT(AT_EXECFN, bprm->exec);
 252         if (k_platform) {
 253                 NEW_AUX_ENT(AT_PLATFORM,
 254                             (elf_addr_t)(unsigned long)u_platform);
 255         }
 256         if (k_base_platform) {
 257                 NEW_AUX_ENT(AT_BASE_PLATFORM,
 258                             (elf_addr_t)(unsigned long)u_base_platform);
 259         }
 260         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 261                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 262         }
 263 #undef NEW_AUX_ENT
 264         /* AT_NULL is zero; clear the rest too */
 265         memset(&elf_info[ei_index], 0,
 266                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 267
 268         /* And advance past the AT_NULL entry.  */
 269         ei_index += 2;
 270
 271         sp = STACK_ADD(p, ei_index);
 272
 273         items = (argc + 1) + (envc + 1) + 1;
 274         bprm->p = STACK_ROUND(sp, items);
 275
 276         /* Point sp at the lowest address on the stack */
 277 #ifdef CONFIG_STACK_GROWSUP
 278         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 279         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 280 #else
 281         sp = (elf_addr_t __user *)bprm->p;
 282 #endif
 283
 284
 285         /*
 286          * Grow the stack manually; some architectures have a limit on how
 287          * far ahead a user-space access may be in order to grow the stack.
 288          */
 289         vma = find_extend_vma(current->mm, bprm->p);
 290         if (!vma)
 291                 return -EFAULT;
 292
 293         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 294         if (__put_user(argc, sp++))
 295                 return -EFAULT;
 296         argv = sp;
 297         envp = argv + argc + 1;
 298
 299         /* Populate argv and envp */
 300         p = current->mm->arg_end = current->mm->arg_start;
 301         while (argc-- > 0) {
 302                 size_t len;
 303                 if (__put_user((elf_addr_t)p, argv++))
 304                         return -EFAULT;
 305                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 306                 if (!len || len > MAX_ARG_STRLEN)
 307                         return -EINVAL;
 308                 p += len;
 309         }
 310         if (__put_user(0, argv))
 311                 return -EFAULT;
 312         current->mm->arg_end = current->mm->env_start = p;
 313         while (envc-- > 0) {
 314                 size_t len;
 315                 if (__put_user((elf_addr_t)p, envp++))
 316                         return -EFAULT;
 317                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 318                 if (!len || len > MAX_ARG_STRLEN)
 319                         return -EINVAL;
 320                 p += len;
 321         }
 322         if (__put_user(0, envp))
 323                 return -EFAULT;
 324         current->mm->env_end = p;
 325
 326         /* Put the elf_info on the stack in the right place.  */
 327         sp = (elf_addr_t __user *)envp + 1;
 328         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 329                 return -EFAULT;
 330         return 0;
 331 }
 332
 333 #ifndef elf_map
 334
 335 static unsigned long elf_map(struct file *filep, unsigned long addr,
 336                 struct elf_phdr *eppnt, int prot, int type,
 337                 unsigned long total_size)
 338 {
 339         unsigned long map_addr;
 340         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 341         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 342         addr = ELF_PAGESTART(addr);
 343         size = ELF_PAGEALIGN(size);
 344
 345         /* mmap() will return -EINVAL if given a zero size, but a
 346          * segment with zero filesize is perfectly valid */
 347         if (!size)
 348                 return addr;
 349
 350         /*
 351         * total_size is the size of the ELF (interpreter) image.
 352         * The _first_ mmap needs to know the full size, otherwise
 353         * randomization might put this image into an overlapping
 354         * position with the ELF binary image. (since size < total_size)
 355         * So we first map the 'big' image - and unmap the remainder at
 356         * the end. (which unmap is needed for ELF images with holes.)
 357         */
 358         if (total_size) {
 359                 total_size = ELF_PAGEALIGN(total_size);
 360                 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
 361                 if (!BAD_ADDR(map_addr))
 362                         vm_munmap(map_addr+size, total_size-size);
 363         } else
 364                 map_addr = vm_mmap(filep, addr, size, prot, type, off);
 365
 366         return(map_addr);
 367 }
 368
 369 #endif /* !elf_map */
 370
 371 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 372 {
 373         int i, first_idx = -1, last_idx = -1;
 374
 375         for (i = 0; i < nr; i++) {
 376                 if (cmds[i].p_type == PT_LOAD) {
 377                         last_idx = i;
 378                         if (first_idx == -1)
 379                                 first_idx = i;
 380                 }
 381         }
 382         if (first_idx == -1)
 383                 return 0;
 384
 385         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 386                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 387 }
 388
 389
 390 /* This is much more generalized than the library routine read function,
 391    so we keep this separate.  Technically the library read function
 392    is only provided so that we can read a.out libraries that have
 393    an ELF header */
 394
 395 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 396                 struct file *interpreter, unsigned long *interp_map_addr,
 397                 unsigned long no_base)
 398 {
 399         struct elf_phdr *elf_phdata;
 400         struct elf_phdr *eppnt;
 401         unsigned long load_addr = 0;
 402         int load_addr_set = 0;
 403         unsigned long last_bss = 0, elf_bss = 0;
 404         unsigned long error = ~0UL;
 405         unsigned long total_size;
 406         int retval, i, size;
 407
 408         /* First of all, some simple consistency checks */
 409         if (interp_elf_ex->e_type != ET_EXEC &&
 410             interp_elf_ex->e_type != ET_DYN)
 411                 goto out;
 412         if (!elf_check_arch(interp_elf_ex))
 413                 goto out;
 414         if (!interpreter->f_op->mmap)
 415                 goto out;
 416
 417         /*
 418          * If the size of this structure has changed, then punt, since
 419          * we will be doing the wrong thing.
 420          */
 421         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 422                 goto out;
 423         if (interp_elf_ex->e_phnum < 1 ||
 424                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 425                 goto out;
 426
 427         /* Now read in all of the header information */
 428         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 429         if (size > ELF_MIN_ALIGN)
 430                 goto out;
 431         elf_phdata = kmalloc(size, GFP_KERNEL);
 432         if (!elf_phdata)
 433                 goto out;
 434
 435         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 436                              (char *)elf_phdata, size);
 437         error = -EIO;
 438         if (retval != size) {
 439                 if (retval < 0)
 440                         error = retval;
 441                 goto out_close;
 442         }
 443
 444         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 445         if (!total_size) {
 446                 error = -EINVAL;
 447                 goto out_close;
 448         }
 449
 450         eppnt = elf_phdata;
 451         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 452                 if (eppnt->p_type == PT_LOAD) {
 453                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 454                         int elf_prot = 0;
 455                         unsigned long vaddr = 0;
 456                         unsigned long k, map_addr;
 457
 458                         if (eppnt->p_flags & PF_R)
 459                                 elf_prot = PROT_READ;
 460                         if (eppnt->p_flags & PF_W)
 461                                 elf_prot |= PROT_WRITE;
 462                         if (eppnt->p_flags & PF_X)
 463                                 elf_prot |= PROT_EXEC;
 464                         vaddr = eppnt->p_vaddr;
 465                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 466                                 elf_type |= MAP_FIXED;
 467                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 468                                 load_addr = -vaddr;
 469
 470                         map_addr = elf_map(interpreter, load_addr + vaddr,
 471                                         eppnt, elf_prot, elf_type, total_size);
 472                         total_size = 0;
 473                         if (!*interp_map_addr)
 474                                 *interp_map_addr = map_addr;
 475                         error = map_addr;
 476                         if (BAD_ADDR(map_addr))
 477                                 goto out_close;
 478
 479                         if (!load_addr_set &&
 480                             interp_elf_ex->e_type == ET_DYN) {
 481                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 482                                 load_addr_set = 1;
 483                         }
 484
 485                         /*
 486                          * Check to see if the section's size will overflow the
 487                          * allowed task size. Note that p_filesz must always be
 488                          * <= p_memsize so it's only necessary to check p_memsz.
 489                          */
 490                         k = load_addr + eppnt->p_vaddr;
 491                         if (BAD_ADDR(k) ||
 492                             eppnt->p_filesz > eppnt->p_memsz ||
 493                             eppnt->p_memsz > TASK_SIZE ||
 494                             TASK_SIZE - eppnt->p_memsz < k) {
 495                                 error = -ENOMEM;
 496                                 goto out_close;
 497                         }
 498
 499                         /*
 500                          * Find the end of the file mapping for this phdr, and
 501                          * keep track of the largest address we see for this.
 502                          */
 503                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 504                         if (k > elf_bss)
 505                                 elf_bss = k;
 506
 507                         /*
 508                          * Do the same thing for the memory mapping - between
 509                          * elf_bss and last_bss is the bss section.
 510                          */
 511                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 512                         if (k > last_bss)
 513                                 last_bss = k;
 514                 }
 515         }
 516
 517         if (last_bss > elf_bss) {
 518                 /*
 519                  * Now fill out the bss section.  First pad the last page up
 520                  * to the page boundary, and then perform a mmap to make sure
 521                  * that there are zero-mapped pages up to and including the
 522                  * last bss page.
 523                  */
 524                 if (padzero(elf_bss)) {
 525                         error = -EFAULT;
 526                         goto out_close;
 527                 }
 528
 529                 /* What we have mapped so far */
 530                 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 531
 532                 /* Map the last of the bss segment */
 533                 error = vm_brk(elf_bss, last_bss - elf_bss);
 534                 if (BAD_ADDR(error))
 535                         goto out_close;
 536         }
 537
 538         error = load_addr;
 539
 540 out_close:
 541         kfree(elf_phdata);
 542 out:
 543         return error;
 544 }
 545
 546 /*
 547  * These are the functions used to load ELF style executables and shared
 548  * libraries.  There is no binary dependent code anywhere else.
 549  */
 550
 551 #ifndef STACK_RND_MASK
 552 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 553 #endif
 554
 555 static unsigned long randomize_stack_top(unsigned long stack_top)
 556 {
 557         unsigned long random_variable = 0;
 558
 559         if ((current->flags & PF_RANDOMIZE) &&
 560                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 561                 random_variable = (unsigned long) get_random_int();
 562                 random_variable &= STACK_RND_MASK;
 563                 random_variable <<= PAGE_SHIFT;
 564         }
 565 #ifdef CONFIG_STACK_GROWSUP
 566         return PAGE_ALIGN(stack_top) + random_variable;
 567 #else
 568         return PAGE_ALIGN(stack_top) - random_variable;
 569 #endif
 570 }
 571
 572 static int load_elf_binary(struct linux_binprm *bprm)
 573 {
 574         struct file *interpreter = NULL; /* to shut gcc up */
 575         unsigned long load_addr = 0, load_bias = 0;
 576         int load_addr_set = 0;
 577         char * elf_interpreter = NULL;
 578         unsigned long error;
 579         struct elf_phdr *elf_ppnt, *elf_phdata;
 580         unsigned long elf_bss, elf_brk;
 581         int retval, i;
 582         unsigned int size;
 583         unsigned long elf_entry;
 584         unsigned long interp_load_addr = 0;
 585         unsigned long start_code, end_code, start_data, end_data;
 586         unsigned long reloc_func_desc __maybe_unused = 0;
 587         int executable_stack = EXSTACK_DEFAULT;
 588         struct pt_regs *regs = current_pt_regs();
 589         struct {
 590                 struct elfhdr elf_ex;
 591                 struct elfhdr interp_elf_ex;
 592         } *loc;
 593
 594         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 595         if (!loc) {
 596                 retval = -ENOMEM;
 597                 goto out_ret;
 598         }
 599
 600         /* Get the exec-header */
 601         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 602
 603         retval = -ENOEXEC;
 604         /* First of all, some simple consistency checks */
 605         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 606                 goto out;
 607
 608         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 609                 goto out;
 610         if (!elf_check_arch(&loc->elf_ex))
 611                 goto out;
 612         if (!bprm->file->f_op->mmap)
 613                 goto out;
 614
 615         /* Now read in all of the header information */
 616         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 617                 goto out;
 618         if (loc->elf_ex.e_phnum < 1 ||
 619                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 620                 goto out;
 621         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 622         retval = -ENOMEM;
 623         elf_phdata = kmalloc(size, GFP_KERNEL);
 624         if (!elf_phdata)
 625                 goto out;
 626
 627         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 628                              (char *)elf_phdata, size);
 629         if (retval != size) {
 630                 if (retval >= 0)
 631                         retval = -EIO;
 632                 goto out_free_ph;
 633         }
 634
 635         elf_ppnt = elf_phdata;
 636         elf_bss = 0;
 637         elf_brk = 0;
 638
 639         start_code = ~0UL;
 640         end_code = 0;
 641         start_data = 0;
 642         end_data = 0;
 643
 644         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 645                 if (elf_ppnt->p_type == PT_INTERP) {
 646                         /* This is the program interpreter used for
 647                          * shared libraries - for now assume that this
 648                          * is an a.out format binary
 649                          */
 650                         retval = -ENOEXEC;
 651                         if (elf_ppnt->p_filesz > PATH_MAX ||
 652                             elf_ppnt->p_filesz < 2)
 653                                 goto out_free_ph;
 654
 655                         retval = -ENOMEM;
 656                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 657                                                   GFP_KERNEL);
 658                         if (!elf_interpreter)
 659                                 goto out_free_ph;
 660
 661                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 662                                              elf_interpreter,
 663                                              elf_ppnt->p_filesz);
 664                         if (retval != elf_ppnt->p_filesz) {
 665                                 if (retval >= 0)
 666                                         retval = -EIO;
 667                                 goto out_free_interp;
 668                         }
 669                         /* make sure path is NULL terminated */
 670                         retval = -ENOEXEC;
 671                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 672                                 goto out_free_interp;
 673
 674                         interpreter = open_exec(elf_interpreter);
 675                         retval = PTR_ERR(interpreter);
 676                         if (IS_ERR(interpreter))
 677                                 goto out_free_interp;
 678
 679                         /*
 680                          * If the binary is not readable then enforce
 681                          * mm->dumpable = 0 regardless of the interpreter's
 682                          * permissions.
 683                          */
 684                         would_dump(bprm, interpreter);
 685
 686                         /* Get the exec headers */
 687                         retval = kernel_read(interpreter, 0,
 688                                              (void *)&loc->interp_elf_ex,
 689                                              sizeof(loc->interp_elf_ex));
 690                         if (retval != sizeof(loc->interp_elf_ex)) {
 691                                 if (retval >= 0)
 692                                         retval = -EIO;
 693                                 goto out_free_dentry;
 694                         }
 695
 696                         break;
 697                 }
 698                 elf_ppnt++;
 699         }
 700
 701         elf_ppnt = elf_phdata;
 702         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 703                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 704                         if (elf_ppnt->p_flags & PF_X)
 705                                 executable_stack = EXSTACK_ENABLE_X;
 706                         else
 707                                 executable_stack = EXSTACK_DISABLE_X;
 708                         break;
 709                 }
 710
 711         /* Some simple consistency checks for the interpreter */
 712         if (elf_interpreter) {
 713                 retval = -ELIBBAD;
 714                 /* Not an ELF interpreter */
 715                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 716                         goto out_free_dentry;
 717                 /* Verify the interpreter has a valid arch */
 718                 if (!elf_check_arch(&loc->interp_elf_ex))
 719                         goto out_free_dentry;
 720         }
 721
 722         /* Flush all traces of the currently running executable */
 723         retval = flush_old_exec(bprm);
 724         if (retval)
 725                 goto out_free_dentry;
 726
 727         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 728            may depend on the personality.  */
 729         SET_PERSONALITY(loc->elf_ex);
 730         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 731                 current->personality |= READ_IMPLIES_EXEC;
 732
 733         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 734                 current->flags |= PF_RANDOMIZE;
 735
 736         setup_new_exec(bprm);
 737
 738         /* Do this so that we can load the interpreter, if need be.  We will
 739            change some of these later */
 740         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 741                                  executable_stack);
 742         if (retval < 0) {
 743                 send_sig(SIGKILL, current, 0);
 744                 goto out_free_dentry;
 745         }
 746
 747         current->mm->start_stack = bprm->p;
 748
 749         /* Now we do a little grungy work by mmapping the ELF image into
 750            the correct location in memory. */
 751         for(i = 0, elf_ppnt = elf_phdata;
 752             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 753                 int elf_prot = 0, elf_flags;
 754                 unsigned long k, vaddr;
 755                 unsigned long total_size = 0;
 756
 757                 if (elf_ppnt->p_type != PT_LOAD)
 758                         continue;
 759
 760                 if (unlikely (elf_brk > elf_bss)) {
 761                         unsigned long nbyte;
 762
 763                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 764                            before this one. Map anonymous pages, if needed,
 765                            and clear the area.  */
 766                         retval = set_brk(elf_bss + load_bias,
 767                                          elf_brk + load_bias);
 768                         if (retval) {
 769                                 send_sig(SIGKILL, current, 0);
 770                                 goto out_free_dentry;
 771                         }
 772                         nbyte = ELF_PAGEOFFSET(elf_bss);
 773                         if (nbyte) {
 774                                 nbyte = ELF_MIN_ALIGN - nbyte;
 775                                 if (nbyte > elf_brk - elf_bss)
 776                                         nbyte = elf_brk - elf_bss;
 777                                 if (clear_user((void __user *)elf_bss +
 778                                                         load_bias, nbyte)) {
 779                                         /*
 780                                          * This bss-zeroing can fail if the ELF
 781                                          * file specifies odd protections. So
 782                                          * we don't check the return value
 783                                          */
 784                                 }
 785                         }
 786                 }
 787
 788                 if (elf_ppnt->p_flags & PF_R)
 789                         elf_prot |= PROT_READ;
 790                 if (elf_ppnt->p_flags & PF_W)
 791                         elf_prot |= PROT_WRITE;
 792                 if (elf_ppnt->p_flags & PF_X)
 793                         elf_prot |= PROT_EXEC;
 794
 795                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 796
 797                 vaddr = elf_ppnt->p_vaddr;
 798                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 799                         elf_flags |= MAP_FIXED;
 800                 } else if (loc->elf_ex.e_type == ET_DYN) {
 801                         /* Try and get dynamic programs out of the way of the
 802                          * default mmap base, as well as whatever program they
 803                          * might try to exec.  This is because the brk will
 804                          * follow the loader, and is not movable.  */
 805 #ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
 806                         /* Memory randomization might have been switched off
 807                          * in runtime via sysctl or explicit setting of
 808                          * personality flags.
 809                          * If that is the case, retain the original non-zero
 810                          * load_bias value in order to establish proper
 811                          * non-randomized mappings.
 812                          */
 813                         if (current->flags & PF_RANDOMIZE)
 814                                 load_bias = 0;
 815                         else
 816                                 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 817 #else
 818                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 819 #endif
 820                         total_size = total_mapping_size(elf_phdata,
 821                                                         loc->elf_ex.e_phnum);
 822                         if (!total_size) {
 823                                 retval = -EINVAL;
 824                                 goto out_free_dentry;
 825                         }
 826                 }
 827
 828                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 829                                 elf_prot, elf_flags, total_size);
 830                 if (BAD_ADDR(error)) {
 831                         send_sig(SIGKILL, current, 0);
 832                         retval = IS_ERR((void *)error) ?
 833                                 PTR_ERR((void*)error) : -EINVAL;
 834                         goto out_free_dentry;
 835                 }
 836
 837                 if (!load_addr_set) {
 838                         load_addr_set = 1;
 839                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 840                         if (loc->elf_ex.e_type == ET_DYN) {
 841                                 load_bias += error -
 842                                              ELF_PAGESTART(load_bias + vaddr);
 843                                 load_addr += load_bias;
 844                                 reloc_func_desc = load_bias;
 845                         }
 846                 }
 847                 k = elf_ppnt->p_vaddr;
 848                 if (k < start_code)
 849                         start_code = k;
 850                 if (start_data < k)
 851                         start_data = k;
 852
 853                 /*
 854                  * Check to see if the section's size will overflow the
 855                  * allowed task size. Note that p_filesz must always be
 856                  * <= p_memsz so it is only necessary to check p_memsz.
 857                  */
 858                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 859                     elf_ppnt->p_memsz > TASK_SIZE ||
 860                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 861                         /* set_brk can never work. Avoid overflows. */
 862                         send_sig(SIGKILL, current, 0);
 863                         retval = -EINVAL;
 864                         goto out_free_dentry;
 865                 }
 866
 867                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 868
 869                 if (k > elf_bss)
 870                         elf_bss = k;
 871                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 872                         end_code = k;
 873                 if (end_data < k)
 874                         end_data = k;
 875                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 876                 if (k > elf_brk)
 877                         elf_brk = k;
 878         }
 879
 880         loc->elf_ex.e_entry += load_bias;
 881         elf_bss += load_bias;
 882         elf_brk += load_bias;
 883         start_code += load_bias;
 884         end_code += load_bias;
 885         start_data += load_bias;
 886         end_data += load_bias;
 887
 888         /* Calling set_brk effectively mmaps the pages that we need
 889          * for the bss and break sections.  We must do this before
 890          * mapping in the interpreter, to make sure it doesn't wind
 891          * up getting placed where the bss needs to go.
 892          */
 893         retval = set_brk(elf_bss, elf_brk);
 894         if (retval) {
 895                 send_sig(SIGKILL, current, 0);
 896                 goto out_free_dentry;
 897         }
 898         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 899                 send_sig(SIGSEGV, current, 0);
 900                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 901                 goto out_free_dentry;
 902         }
 903
 904         if (elf_interpreter) {
 905                 unsigned long interp_map_addr = 0;
 906
 907                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 908                                             interpreter,
 909                                             &interp_map_addr,
 910                                             load_bias);
 911                 if (!IS_ERR((void *)elf_entry)) {
 912                         /*
 913                          * load_elf_interp() returns relocation
 914                          * adjustment
 915                          */
 916                         interp_load_addr = elf_entry;
 917                         elf_entry += loc->interp_elf_ex.e_entry;
 918                 }
 919                 if (BAD_ADDR(elf_entry)) {
 920                         force_sig(SIGSEGV, current);
 921                         retval = IS_ERR((void *)elf_entry) ?
 922                                         (int)elf_entry : -EINVAL;
 923                         goto out_free_dentry;
 924                 }
 925                 reloc_func_desc = interp_load_addr;
 926
 927                 allow_write_access(interpreter);
 928                 fput(interpreter);
 929                 kfree(elf_interpreter);
 930         } else {
 931                 elf_entry = loc->elf_ex.e_entry;
 932                 if (BAD_ADDR(elf_entry)) {
 933                         force_sig(SIGSEGV, current);
 934                         retval = -EINVAL;
 935                         goto out_free_dentry;
 936                 }
 937         }
 938
 939         kfree(elf_phdata);
 940
 941         set_binfmt(&elf_format);
 942
 943 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 944         retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
 945         if (retval < 0) {
 946                 send_sig(SIGKILL, current, 0);
 947                 goto out;
 948         }
 949 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 950
 951         install_exec_creds(bprm);
 952         retval = create_elf_tables(bprm, &loc->elf_ex,
 953                           load_addr, interp_load_addr);
 954         if (retval < 0) {
 955                 send_sig(SIGKILL, current, 0);
 956                 goto out;
 957         }
 958         /* N.B. passed_fileno might not be initialized? */
 959         current->mm->end_code = end_code;
 960         current->mm->start_code = start_code;
 961         current->mm->start_data = start_data;
 962         current->mm->end_data = end_data;
 963         current->mm->start_stack = bprm->p;
 964
 965 #ifdef arch_randomize_brk
 966         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
 967                 current->mm->brk = current->mm->start_brk =
 968                         arch_randomize_brk(current->mm);
 969 #ifdef CONFIG_COMPAT_BRK
 970                 current->brk_randomized = 1;
 971 #endif
 972         }
 973 #endif
 974
 975         if (current->personality & MMAP_PAGE_ZERO) {
 976                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 977                    and some applications "depend" upon this behavior.
 978                    Since we do not have the power to recompile these, we
 979                    emulate the SVr4 behavior. Sigh. */
 980                 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 981                                 MAP_FIXED | MAP_PRIVATE, 0);
 982         }
 983
 984 #ifdef ELF_PLAT_INIT
 985         /*
 986          * The ABI may specify that certain registers be set up in special
 987          * ways (on i386 %edx is the address of a DT_FINI function, for
 988          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 989          * that the e_entry field is the address of the function descriptor
 990          * for the startup routine, rather than the address of the startup
 991          * routine itself.  This macro performs whatever initialization to
 992          * the regs structure is required as well as any relocations to the
 993          * function descriptor entries when executing dynamically links apps.
 994          */
 995         ELF_PLAT_INIT(regs, reloc_func_desc);
 996 #endif
 997
 998         start_thread(regs, elf_entry, bprm->p);
 999         retval = 0;
1000 out:
1001         kfree(loc);
1002 out_ret:
1003         return retval;
1004
1005         /* error cleanup */
1006 out_free_dentry:
1007         allow_write_access(interpreter);
1008         if (interpreter)
1009                 fput(interpreter);
1010 out_free_interp:
1011         kfree(elf_interpreter);
1012 out_free_ph:
1013         kfree(elf_phdata);
1014         goto out;
1015 }
1016
1017 #ifdef CONFIG_USELIB
1018 /* This is really simpleminded and specialized - we are loading an
1019    a.out library that is given an ELF header. */
1020 static int load_elf_library(struct file *file)
1021 {
1022         struct elf_phdr *elf_phdata;
1023         struct elf_phdr *eppnt;
1024         unsigned long elf_bss, bss, len;
1025         int retval, error, i, j;
1026         struct elfhdr elf_ex;
1027
1028         error = -ENOEXEC;
1029         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1030         if (retval != sizeof(elf_ex))
1031                 goto out;
1032
1033         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1034                 goto out;
1035
1036         /* First of all, some simple consistency checks */
1037         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1038             !elf_check_arch(&elf_ex) || !file->f_op->mmap)
1039                 goto out;
1040
1041         /* Now read in all of the header information */
1042
1043         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1044         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1045
1046         error = -ENOMEM;
1047         elf_phdata = kmalloc(j, GFP_KERNEL);
1048         if (!elf_phdata)
1049                 goto out;
1050
1051         eppnt = elf_phdata;
1052         error = -ENOEXEC;
1053         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1054         if (retval != j)
1055                 goto out_free_ph;
1056
1057         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1058                 if ((eppnt + i)->p_type == PT_LOAD)
1059                         j++;
1060         if (j != 1)
1061                 goto out_free_ph;
1062
1063         while (eppnt->p_type != PT_LOAD)
1064                 eppnt++;
1065
1066         /* Now use mmap to map the library into memory. */
1067         error = vm_mmap(file,
1068                         ELF_PAGESTART(eppnt->p_vaddr),
1069                         (eppnt->p_filesz +
1070                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1071                         PROT_READ | PROT_WRITE | PROT_EXEC,
1072                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1073                         (eppnt->p_offset -
1074                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1075         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1076                 goto out_free_ph;
1077
1078         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1079         if (padzero(elf_bss)) {
1080                 error = -EFAULT;
1081                 goto out_free_ph;
1082         }
1083
1084         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1085                             ELF_MIN_ALIGN - 1);
1086         bss = eppnt->p_memsz + eppnt->p_vaddr;
1087         if (bss > len)
1088                 vm_brk(len, bss - len);
1089         error = 0;
1090
1091 out_free_ph:
1092         kfree(elf_phdata);
1093 out:
1094         return error;
1095 }
1096 #endif /* #ifdef CONFIG_USELIB */
1097
1098 #ifdef CONFIG_ELF_CORE
1099 /*
1100  * ELF core dumper
1101  *
1102  * Modelled on fs/exec.c:aout_core_dump()
1103  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1104  */
1105
1106 /*
1107  * The purpose of always_dump_vma() is to make sure that special kernel mappings
1108  * that are useful for post-mortem analysis are included in every core dump.
1109  * In that way we ensure that the core dump is fully interpretable later
1110  * without matching up the same kernel and hardware config to see what PC values
1111  * meant. These special mappings include - vDSO, vsyscall, and other
1112  * architecture specific mappings
1113  */
1114 static bool always_dump_vma(struct vm_area_struct *vma)
1115 {
1116         /* Any vsyscall mappings? */
1117         if (vma == get_gate_vma(vma->vm_mm))
1118                 return true;
1119
1120         /*
1121          * Assume that all vmas with a .name op should always be dumped.
1122          * If this changes, a new vm_ops field can easily be added.
1123          */
1124         if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma))
1125                 return true;
1126
1127         /*
1128          * arch_vma_name() returns non-NULL for special architecture mappings,
1129          * such as vDSO sections.
1130          */
1131         if (arch_vma_name(vma))
1132                 return true;
1133
1134         return false;
1135 }
1136
1137 /*
1138  * Decide what to dump of a segment, part, all or none.
1139  */
1140 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1141                                    unsigned long mm_flags)
1142 {
1143 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1144
1145         /* always dump the vdso and vsyscall sections */
1146         if (always_dump_vma(vma))
1147                 goto whole;
1148
1149         if (vma->vm_flags & VM_DONTDUMP)
1150                 return 0;
1151
1152         /* Hugetlb memory check */
1153         if (vma->vm_flags & VM_HUGETLB) {
1154                 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1155                         goto whole;
1156                 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1157                         goto whole;
1158                 return 0;
1159         }
1160
1161         /* Do not dump I/O mapped devices or special mappings */
1162         if (vma->vm_flags & VM_IO)
1163                 return 0;
1164
1165         /* By default, dump shared memory if mapped from an anonymous file. */
1166         if (vma->vm_flags & VM_SHARED) {
1167                 if (file_inode(vma->vm_file)->i_nlink == 0 ?
1168                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1169                         goto whole;
1170                 return 0;
1171         }
1172
1173         /* Dump segments that have been written to.  */
1174         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1175                 goto whole;
1176         if (vma->vm_file == NULL)
1177                 return 0;
1178
1179         if (FILTER(MAPPED_PRIVATE))
1180                 goto whole;
1181
1182         /*
1183          * If this looks like the beginning of a DSO or executable mapping,
1184          * check for an ELF header.  If we find one, dump the first page to
1185          * aid in determining what was mapped here.
1186          */
1187         if (FILTER(ELF_HEADERS) &&
1188             vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1189                 u32 __user *header = (u32 __user *) vma->vm_start;
1190                 u32 word;
1191                 mm_segment_t fs = get_fs();
1192                 /*
1193                  * Doing it this way gets the constant folded by GCC.
1194                  */
1195                 union {
1196                         u32 cmp;
1197                         char elfmag[SELFMAG];
1198                 } magic;
1199                 BUILD_BUG_ON(SELFMAG != sizeof word);
1200                 magic.elfmag[EI_MAG0] = ELFMAG0;
1201                 magic.elfmag[EI_MAG1] = ELFMAG1;
1202                 magic.elfmag[EI_MAG2] = ELFMAG2;
1203                 magic.elfmag[EI_MAG3] = ELFMAG3;
1204                 /*
1205                  * Switch to the user "segment" for get_user(),
1206                  * then put back what elf_core_dump() had in place.
1207                  */
1208                 set_fs(USER_DS);
1209                 if (unlikely(get_user(word, header)))
1210                         word = 0;
1211                 set_fs(fs);
1212                 if (word == magic.cmp)
1213                         return PAGE_SIZE;
1214         }
1215
1216 #undef  FILTER
1217
1218         return 0;
1219
1220 whole:
1221         return vma->vm_end - vma->vm_start;
1222 }
1223
1224 /* An ELF note in memory */
1225 struct memelfnote
1226 {
1227         const char *name;
1228         int type;
1229         unsigned int datasz;
1230         void *data;
1231 };
1232
1233 static int notesize(struct memelfnote *en)
1234 {
1235         int sz;
1236
1237         sz = sizeof(struct elf_note);
1238         sz += roundup(strlen(en->name) + 1, 4);
1239         sz += roundup(en->datasz, 4);
1240
1241         return sz;
1242 }
1243
1244 static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1245 {
1246         struct elf_note en;
1247         en.n_namesz = strlen(men->name) + 1;
1248         en.n_descsz = men->datasz;
1249         en.n_type = men->type;
1250
1251         return dump_emit(cprm, &en, sizeof(en)) &&
1252             dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1253             dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1254 }
1255
1256 static void fill_elf_header(struct elfhdr *elf, int segs,
1257                             u16 machine, u32 flags)
1258 {
1259         memset(elf, 0, sizeof(*elf));
1260
1261         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1262         elf->e_ident[EI_CLASS] = ELF_CLASS;
1263         elf->e_ident[EI_DATA] = ELF_DATA;
1264         elf->e_ident[EI_VERSION] = EV_CURRENT;
1265         elf->e_ident[EI_OSABI] = ELF_OSABI;
1266
1267         elf->e_type = ET_CORE;
1268         elf->e_machine = machine;
1269         elf->e_version = EV_CURRENT;
1270         elf->e_phoff = sizeof(struct elfhdr);
1271         elf->e_flags = flags;
1272         elf->e_ehsize = sizeof(struct elfhdr);
1273         elf->e_phentsize = sizeof(struct elf_phdr);
1274         elf->e_phnum = segs;
1275
1276         return;
1277 }
1278
1279 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1280 {
1281         phdr->p_type = PT_NOTE;
1282         phdr->p_offset = offset;
1283         phdr->p_vaddr = 0;
1284         phdr->p_paddr = 0;
1285         phdr->p_filesz = sz;
1286         phdr->p_memsz = 0;
1287         phdr->p_flags = 0;
1288         phdr->p_align = 0;
1289         return;
1290 }
1291
1292 static void fill_note(struct memelfnote *note, const char *name, int type,
1293                 unsigned int sz, void *data)
1294 {
1295         note->name = name;
1296         note->type = type;
1297         note->datasz = sz;
1298         note->data = data;
1299         return;
1300 }
1301
1302 /*
1303  * fill up all the fields in prstatus from the given task struct, except
1304  * registers which need to be filled up separately.
1305  */
1306 static void fill_prstatus(struct elf_prstatus *prstatus,
1307                 struct task_struct *p, long signr)
1308 {
1309         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1310         prstatus->pr_sigpend = p->pending.signal.sig[0];
1311         prstatus->pr_sighold = p->blocked.sig[0];
1312         rcu_read_lock();
1313         prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1314         rcu_read_unlock();
1315         prstatus->pr_pid = task_pid_vnr(p);
1316         prstatus->pr_pgrp = task_pgrp_vnr(p);
1317         prstatus->pr_sid = task_session_vnr(p);
1318         if (thread_group_leader(p)) {
1319                 struct task_cputime cputime;
1320
1321                 /*
1322                  * This is the record for the group leader.  It shows the
1323                  * group-wide total, not its individual thread total.
1324                  */
1325                 thread_group_cputime(p, &cputime);
1326                 cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1327                 cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1328         } else {
1329                 cputime_t utime, stime;
1330
1331                 task_cputime(p, &utime, &stime);
1332                 cputime_to_timeval(utime, &prstatus->pr_utime);
1333                 cputime_to_timeval(stime, &prstatus->pr_stime);
1334         }
1335         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1336         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1337 }
1338
1339 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1340                        struct mm_struct *mm)
1341 {
1342         const struct cred *cred;
1343         unsigned int i, len;
1344
1345         /* first copy the parameters from user space */
1346         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1347
1348         len = mm->arg_end - mm->arg_start;
1349         if (len >= ELF_PRARGSZ)
1350                 len = ELF_PRARGSZ-1;
1351         if (copy_from_user(&psinfo->pr_psargs,
1352                            (const char __user *)mm->arg_start, len))
1353                 return -EFAULT;
1354         for(i = 0; i < len; i++)
1355                 if (psinfo->pr_psargs[i] == 0)
1356                         psinfo->pr_psargs[i] = ' ';
1357         psinfo->pr_psargs[len] = 0;
1358
1359         rcu_read_lock();
1360         psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1361         rcu_read_unlock();
1362         psinfo->pr_pid = task_pid_vnr(p);
1363         psinfo->pr_pgrp = task_pgrp_vnr(p);
1364         psinfo->pr_sid = task_session_vnr(p);
1365
1366         i = p->state ? ffz(~p->state) + 1 : 0;
1367         psinfo->pr_state = i;
1368         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1369         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1370         psinfo->pr_nice = task_nice(p);
1371         psinfo->pr_flag = p->flags;
1372         rcu_read_lock();
1373         cred = __task_cred(p);
1374         SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1375         SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1376         rcu_read_unlock();
1377         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1378
1379         return 0;
1380 }
1381
1382 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1383 {
1384         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1385         int i = 0;
1386         do
1387                 i += 2;
1388         while (auxv[i - 2] != AT_NULL);
1389         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1390 }
1391
1392 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1393                 const siginfo_t *siginfo)
1394 {
1395         mm_segment_t old_fs = get_fs();
1396         set_fs(KERNEL_DS);
1397         copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo);
1398         set_fs(old_fs);
1399         fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1400 }
1401
1402 #define MAX_FILE_NOTE_SIZE (4*1024*1024)
1403 /*
1404  * Format of NT_FILE note:
1405  *
1406  * long count     -- how many files are mapped
1407  * long page_size -- units for file_ofs
1408  * array of [COUNT] elements of
1409  *   long start
1410  *   long end
1411  *   long file_ofs
1412  * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1413  */
1414 static int fill_files_note(struct memelfnote *note)
1415 {
1416         struct vm_area_struct *vma;
1417         unsigned count, size, names_ofs, remaining, n;
1418         user_long_t *data;
1419         user_long_t *start_end_ofs;
1420         char *name_base, *name_curpos;
1421
1422         /* *Estimated* file count and total data size needed */
1423         count = current->mm->map_count;
1424         size = count * 64;
1425
1426         names_ofs = (2 + 3 * count) * sizeof(data[0]);
1427  alloc:
1428         if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
1429                 return -EINVAL;
1430         size = round_up(size, PAGE_SIZE);
1431         data = vmalloc(size);
1432         if (!data)
1433                 return -ENOMEM;
1434
1435         start_end_ofs = data + 2;
1436         name_base = name_curpos = ((char *)data) + names_ofs;
1437         remaining = size - names_ofs;
1438         count = 0;
1439         for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1440                 struct file *file;
1441                 const char *filename;
1442
1443                 file = vma->vm_file;
1444                 if (!file)
1445                         continue;
1446                 filename = d_path(&file->f_path, name_curpos, remaining);
1447                 if (IS_ERR(filename)) {
1448                         if (PTR_ERR(filename) == -ENAMETOOLONG) {
1449                                 vfree(data);
1450                                 size = size * 5 / 4;
1451                                 goto alloc;
1452                         }
1453                         continue;
1454                 }
1455
1456                 /* d_path() fills at the end, move name down */
1457                 /* n = strlen(filename) + 1: */
1458                 n = (name_curpos + remaining) - filename;
1459                 remaining = filename - name_curpos;
1460                 memmove(name_curpos, filename, n);
1461                 name_curpos += n;
1462
1463                 *start_end_ofs++ = vma->vm_start;
1464                 *start_end_ofs++ = vma->vm_end;
1465                 *start_end_ofs++ = vma->vm_pgoff;
1466                 count++;
1467         }
1468
1469         /* Now we know exact count of files, can store it */
1470         data[0] = count;
1471         data[1] = PAGE_SIZE;
1472         /*
1473          * Count usually is less than current->mm->map_count,
1474          * we need to move filenames down.
1475          */
1476         n = current->mm->map_count - count;
1477         if (n != 0) {
1478                 unsigned shift_bytes = n * 3 * sizeof(data[0]);
1479                 memmove(name_base - shift_bytes, name_base,
1480                         name_curpos - name_base);
1481                 name_curpos -= shift_bytes;
1482         }
1483
1484         size = name_curpos - (char *)data;
1485         fill_note(note, "CORE", NT_FILE, size, data);
1486         return 0;
1487 }
1488
1489 #ifdef CORE_DUMP_USE_REGSET
1490 #include <linux/regset.h>
1491
1492 struct elf_thread_core_info {
1493         struct elf_thread_core_info *next;
1494         struct task_struct *task;
1495         struct elf_prstatus prstatus;
1496         struct memelfnote notes[0];
1497 };
1498
1499 struct elf_note_info {
1500         struct elf_thread_core_info *thread;
1501         struct memelfnote psinfo;
1502         struct memelfnote signote;
1503         struct memelfnote auxv;
1504         struct memelfnote files;
1505         user_siginfo_t csigdata;
1506         size_t size;
1507         int thread_notes;
1508 };
1509
1510 /*
1511  * When a regset has a writeback hook, we call it on each thread before
1512  * dumping user memory.  On register window machines, this makes sure the
1513  * user memory backing the register data is up to date before we read it.
1514  */
1515 static void do_thread_regset_writeback(struct task_struct *task,
1516                                        const struct user_regset *regset)
1517 {
1518         if (regset->writeback)
1519                 regset->writeback(task, regset, 1);
1520 }
1521
1522 #ifndef PR_REG_SIZE
1523 #define PR_REG_SIZE(S) sizeof(S)
1524 #endif
1525
1526 #ifndef PRSTATUS_SIZE
1527 #define PRSTATUS_SIZE(S) sizeof(S)
1528 #endif
1529
1530 #ifndef PR_REG_PTR
1531 #define PR_REG_PTR(S) (&((S)->pr_reg))
1532 #endif
1533
1534 #ifndef SET_PR_FPVALID
1535 #define SET_PR_FPVALID(S, V) ((S)->pr_fpvalid = (V))
1536 #endif
1537
1538 static int fill_thread_core_info(struct elf_thread_core_info *t,
1539                                  const struct user_regset_view *view,
1540                                  long signr, size_t *total)
1541 {
1542         unsigned int i;
1543
1544         /*
1545          * NT_PRSTATUS is the one special case, because the regset data
1546          * goes into the pr_reg field inside the note contents, rather
1547          * than being the whole note contents.  We fill the reset in here.
1548          * We assume that regset 0 is NT_PRSTATUS.
1549          */
1550         fill_prstatus(&t->prstatus, t->task, signr);
1551         (void) view->regsets[0].get(t->task, &view->regsets[0],
1552                                     0, PR_REG_SIZE(t->prstatus.pr_reg),
1553                                     PR_REG_PTR(&t->prstatus), NULL);
1554
1555         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1556                   PRSTATUS_SIZE(t->prstatus), &t->prstatus);
1557         *total += notesize(&t->notes[0]);
1558
1559         do_thread_regset_writeback(t->task, &view->regsets[0]);
1560
1561         /*
1562          * Each other regset might generate a note too.  For each regset
1563          * that has no core_note_type or is inactive, we leave t->notes[i]
1564          * all zero and we'll know to skip writing it later.
1565          */
1566         for (i = 1; i < view->n; ++i) {
1567                 const struct user_regset *regset = &view->regsets[i];
1568                 do_thread_regset_writeback(t->task, regset);
1569                 if (regset->core_note_type && regset->get &&
1570                     (!regset->active || regset->active(t->task, regset))) {
1571                         int ret;
1572                         size_t size = regset->n * regset->size;
1573                         void *data = kmalloc(size, GFP_KERNEL);
1574                         if (unlikely(!data))
1575                                 return 0;
1576                         ret = regset->get(t->task, regset,
1577                                           0, size, data, NULL);
1578                         if (unlikely(ret))
1579                                 kfree(data);
1580                         else {
1581                                 if (regset->core_note_type != NT_PRFPREG)
1582                                         fill_note(&t->notes[i], "LINUX",
1583                                                   regset->core_note_type,
1584                                                   size, data);
1585                                 else {
1586                                         SET_PR_FPVALID(&t->prstatus, 1);
1587                                         fill_note(&t->notes[i], "CORE",
1588                                                   NT_PRFPREG, size, data);
1589                                 }
1590                                 *total += notesize(&t->notes[i]);
1591                         }
1592                 }
1593         }
1594
1595         return 1;
1596 }
1597
1598 static int fill_note_info(struct elfhdr *elf, int phdrs,
1599                           struct elf_note_info *info,
1600                           const siginfo_t *siginfo, struct pt_regs *regs)
1601 {
1602         struct task_struct *dump_task = current;
1603         const struct user_regset_view *view = task_user_regset_view(dump_task);
1604         struct elf_thread_core_info *t;
1605         struct elf_prpsinfo *psinfo;
1606         struct core_thread *ct;
1607         unsigned int i;
1608
1609         info->size = 0;
1610         info->thread = NULL;
1611
1612         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1613         if (psinfo == NULL) {
1614                 info->psinfo.data = NULL; /* So we don't free this wrongly */
1615                 return 0;
1616         }
1617
1618         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1619
1620         /*
1621          * Figure out how many notes we're going to need for each thread.
1622          */
1623         info->thread_notes = 0;
1624         for (i = 0; i < view->n; ++i)
1625                 if (view->regsets[i].core_note_type != 0)
1626                         ++info->thread_notes;
1627
1628         /*
1629          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1630          * since it is our one special case.
1631          */
1632         if (unlikely(info->thread_notes == 0) ||
1633             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1634                 WARN_ON(1);
1635                 return 0;
1636         }
1637
1638         /*
1639          * Initialize the ELF file header.
1640          */
1641         fill_elf_header(elf, phdrs,
1642                         view->e_machine, view->e_flags);
1643
1644         /*
1645          * Allocate a structure for each thread.
1646          */
1647         for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1648                 t = kzalloc(offsetof(struct elf_thread_core_info,
1649                                      notes[info->thread_notes]),
1650                             GFP_KERNEL);
1651                 if (unlikely(!t))
1652                         return 0;
1653
1654                 t->task = ct->task;
1655                 if (ct->task == dump_task || !info->thread) {
1656                         t->next = info->thread;
1657                         info->thread = t;
1658                 } else {
1659                         /*
1660                          * Make sure to keep the original task at
1661                          * the head of the list.
1662                          */
1663                         t->next = info->thread->next;
1664                         info->thread->next = t;
1665                 }
1666         }
1667
1668         /*
1669          * Now fill in each thread's information.
1670          */
1671         for (t = info->thread; t != NULL; t = t->next)
1672                 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size))
1673                         return 0;
1674
1675         /*
1676          * Fill in the two process-wide notes.
1677          */
1678         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1679         info->size += notesize(&info->psinfo);
1680
1681         fill_siginfo_note(&info->signote, &info->csigdata, siginfo);
1682         info->size += notesize(&info->signote);
1683
1684         fill_auxv_note(&info->auxv, current->mm);
1685         info->size += notesize(&info->auxv);
1686
1687         if (fill_files_note(&info->files) == 0)
1688                 info->size += notesize(&info->files);
1689
1690         return 1;
1691 }
1692
1693 static size_t get_note_info_size(struct elf_note_info *info)
1694 {
1695         return info->size;
1696 }
1697
1698 /*
1699  * Write all the notes for each thread.  When writing the first thread, the
1700  * process-wide notes are interleaved after the first thread-specific note.
1701  */
1702 static int write_note_info(struct elf_note_info *info,
1703                            struct coredump_params *cprm)
1704 {
1705         bool first = true;
1706         struct elf_thread_core_info *t = info->thread;
1707
1708         do {
1709                 int i;
1710
1711                 if (!writenote(&t->notes[0], cprm))
1712                         return 0;
1713
1714                 if (first && !writenote(&info->psinfo, cprm))
1715                         return 0;
1716                 if (first && !writenote(&info->signote, cprm))
1717                         return 0;
1718                 if (first && !writenote(&info->auxv, cprm))
1719                         return 0;
1720                 if (first && info->files.data &&
1721                                 !writenote(&info->files, cprm))
1722                         return 0;
1723
1724                 for (i = 1; i < info->thread_notes; ++i)
1725                         if (t->notes[i].data &&
1726                             !writenote(&t->notes[i], cprm))
1727                                 return 0;
1728
1729                 first = false;
1730                 t = t->next;
1731         } while (t);
1732
1733         return 1;
1734 }
1735
1736 static void free_note_info(struct elf_note_info *info)
1737 {
1738         struct elf_thread_core_info *threads = info->thread;
1739         while (threads) {
1740                 unsigned int i;
1741                 struct elf_thread_core_info *t = threads;
1742                 threads = t->next;
1743                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1744                 for (i = 1; i < info->thread_notes; ++i)
1745                         kfree(t->notes[i].data);
1746                 kfree(t);
1747         }
1748         kfree(info->psinfo.data);
1749         vfree(info->files.data);
1750 }
1751
1752 #else
1753
1754 /* Here is the structure in which status of each thread is captured. */
1755 struct elf_thread_status
1756 {
1757         struct list_head list;
1758         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1759         elf_fpregset_t fpu;             /* NT_PRFPREG */
1760         struct task_struct *thread;
1761 #ifdef ELF_CORE_COPY_XFPREGS
1762         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1763 #endif
1764         struct memelfnote notes[3];
1765         int num_notes;
1766 };
1767
1768 /*
1769  * In order to add the specific thread information for the elf file format,
1770  * we need to keep a linked list of every threads pr_status and then create
1771  * a single section for them in the final core file.
1772  */
1773 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1774 {
1775         int sz = 0;
1776         struct task_struct *p = t->thread;
1777         t->num_notes = 0;
1778
1779         fill_prstatus(&t->prstatus, p, signr);
1780         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1781
1782         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1783                   &(t->prstatus));
1784         t->num_notes++;
1785         sz += notesize(&t->notes[0]);
1786
1787         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1788                                                                 &t->fpu))) {
1789                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1790                           &(t->fpu));
1791                 t->num_notes++;
1792                 sz += notesize(&t->notes[1]);
1793         }
1794
1795 #ifdef ELF_CORE_COPY_XFPREGS
1796         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1797                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1798                           sizeof(t->xfpu), &t->xfpu);
1799                 t->num_notes++;
1800                 sz += notesize(&t->notes[2]);
1801         }
1802 #endif
1803         return sz;
1804 }
1805
1806 struct elf_note_info {
1807         struct memelfnote *notes;
1808         struct memelfnote *notes_files;
1809         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1810         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1811         struct list_head thread_list;
1812         elf_fpregset_t *fpu;
1813 #ifdef ELF_CORE_COPY_XFPREGS
1814         elf_fpxregset_t *xfpu;
1815 #endif
1816         user_siginfo_t csigdata;
1817         int thread_status_size;
1818         int numnote;
1819 };
1820
1821 static int elf_note_info_init(struct elf_note_info *info)
1822 {
1823         memset(info, 0, sizeof(*info));
1824         INIT_LIST_HEAD(&info->thread_list);
1825
1826         /* Allocate space for ELF notes */
1827         info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL);
1828         if (!info->notes)
1829                 return 0;
1830         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1831         if (!info->psinfo)
1832                 return 0;
1833         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1834         if (!info->prstatus)
1835                 return 0;
1836         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1837         if (!info->fpu)
1838                 return 0;
1839 #ifdef ELF_CORE_COPY_XFPREGS
1840         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1841         if (!info->xfpu)
1842                 return 0;
1843 #endif
1844         return 1;
1845 }
1846
1847 static int fill_note_info(struct elfhdr *elf, int phdrs,
1848                           struct elf_note_info *info,
1849                           const siginfo_t *siginfo, struct pt_regs *regs)
1850 {
1851         struct list_head *t;
1852         struct core_thread *ct;
1853         struct elf_thread_status *ets;
1854
1855         if (!elf_note_info_init(info))
1856                 return 0;
1857
1858         for (ct = current->mm->core_state->dumper.next;
1859                                         ct; ct = ct->next) {
1860                 ets = kzalloc(sizeof(*ets), GFP_KERNEL);
1861                 if (!ets)
1862                         return 0;
1863
1864                 ets->thread = ct->task;
1865                 list_add(&ets->list, &info->thread_list);
1866         }
1867
1868         list_for_each(t, &info->thread_list) {
1869                 int sz;
1870
1871                 ets = list_entry(t, struct elf_thread_status, list);
1872                 sz = elf_dump_thread_status(siginfo->si_signo, ets);
1873                 info->thread_status_size += sz;
1874         }
1875         /* now collect the dump for the current */
1876         memset(info->prstatus, 0, sizeof(*info->prstatus));
1877         fill_prstatus(info->prstatus, current, siginfo->si_signo);
1878         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1879
1880         /* Set up header */
1881         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS);
1882
1883         /*
1884          * Set up the notes in similar form to SVR4 core dumps made
1885          * with info from their /proc.
1886          */
1887
1888         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1889                   sizeof(*info->prstatus), info->prstatus);
1890         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1891         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1892                   sizeof(*info->psinfo), info->psinfo);
1893
1894         fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
1895         fill_auxv_note(info->notes + 3, current->mm);
1896         info->numnote = 4;
1897
1898         if (fill_files_note(info->notes + info->numnote) == 0) {
1899                 info->notes_files = info->notes + info->numnote;
1900                 info->numnote++;
1901         }
1902
1903         /* Try to dump the FPU. */
1904         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1905                                                                info->fpu);
1906         if (info->prstatus->pr_fpvalid)
1907                 fill_note(info->notes + info->numnote++,
1908                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1909 #ifdef ELF_CORE_COPY_XFPREGS
1910         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1911                 fill_note(info->notes + info->numnote++,
1912                           "LINUX", ELF_CORE_XFPREG_TYPE,
1913                           sizeof(*info->xfpu), info->xfpu);
1914 #endif
1915
1916         return 1;
1917 }
1918
1919 static size_t get_note_info_size(struct elf_note_info *info)
1920 {
1921         int sz = 0;
1922         int i;
1923
1924         for (i = 0; i < info->numnote; i++)
1925                 sz += notesize(info->notes + i);
1926
1927         sz += info->thread_status_size;
1928
1929         return sz;
1930 }
1931
1932 static int write_note_info(struct elf_note_info *info,
1933                            struct coredump_params *cprm)
1934 {
1935         int i;
1936         struct list_head *t;
1937
1938         for (i = 0; i < info->numnote; i++)
1939                 if (!writenote(info->notes + i, cprm))
1940                         return 0;
1941
1942         /* write out the thread status notes section */
1943         list_for_each(t, &info->thread_list) {
1944                 struct elf_thread_status *tmp =
1945                                 list_entry(t, struct elf_thread_status, list);
1946
1947                 for (i = 0; i < tmp->num_notes; i++)
1948                         if (!writenote(&tmp->notes[i], cprm))
1949                                 return 0;
1950         }
1951
1952         return 1;
1953 }
1954
1955 static void free_note_info(struct elf_note_info *info)
1956 {
1957         while (!list_empty(&info->thread_list)) {
1958                 struct list_head *tmp = info->thread_list.next;
1959                 list_del(tmp);
1960                 kfree(list_entry(tmp, struct elf_thread_status, list));
1961         }
1962
1963         /* Free data possibly allocated by fill_files_note(): */
1964         if (info->notes_files)
1965                 vfree(info->notes_files->data);
1966
1967         kfree(info->prstatus);
1968         kfree(info->psinfo);
1969         kfree(info->notes);
1970         kfree(info->fpu);
1971 #ifdef ELF_CORE_COPY_XFPREGS
1972         kfree(info->xfpu);
1973 #endif
1974 }
1975
1976 #endif
1977
1978 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1979                                         struct vm_area_struct *gate_vma)
1980 {
1981         struct vm_area_struct *ret = tsk->mm->mmap;
1982
1983         if (ret)
1984                 return ret;
1985         return gate_vma;
1986 }
1987 /*
1988  * Helper function for iterating across a vma list.  It ensures that the caller
1989  * will visit `gate_vma' prior to terminating the search.
1990  */
1991 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1992                                         struct vm_area_struct *gate_vma)
1993 {
1994         struct vm_area_struct *ret;
1995
1996         ret = this_vma->vm_next;
1997         if (ret)
1998                 return ret;
1999         if (this_vma == gate_vma)
2000                 return NULL;
2001         return gate_vma;
2002 }
2003
2004 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
2005                              elf_addr_t e_shoff, int segs)
2006 {
2007         elf->e_shoff = e_shoff;
2008         elf->e_shentsize = sizeof(*shdr4extnum);
2009         elf->e_shnum = 1;
2010         elf->e_shstrndx = SHN_UNDEF;
2011
2012         memset(shdr4extnum, 0, sizeof(*shdr4extnum));
2013
2014         shdr4extnum->sh_type = SHT_NULL;
2015         shdr4extnum->sh_size = elf->e_shnum;
2016         shdr4extnum->sh_link = elf->e_shstrndx;
2017         shdr4extnum->sh_info = segs;
2018 }
2019
2020 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
2021                                      unsigned long mm_flags)
2022 {
2023         struct vm_area_struct *vma;
2024         size_t size = 0;
2025
2026         for (vma = first_vma(current, gate_vma); vma != NULL;
2027              vma = next_vma(vma, gate_vma))
2028                 size += vma_dump_size(vma, mm_flags);
2029         return size;
2030 }
2031
2032 /*
2033  * Actual dumper
2034  *
2035  * This is a two-pass process; first we find the offsets of the bits,
2036  * and then they are actually written out.  If we run out of core limit
2037  * we just truncate.
2038  */
2039 static int elf_core_dump(struct coredump_params *cprm)
2040 {
2041         int has_dumped = 0;
2042         mm_segment_t fs;
2043         int segs;
2044         struct vm_area_struct *vma, *gate_vma;
2045         struct elfhdr *elf = NULL;
2046         loff_t offset = 0, dataoff;
2047         struct elf_note_info info = { };
2048         struct elf_phdr *phdr4note = NULL;
2049         struct elf_shdr *shdr4extnum = NULL;
2050         Elf_Half e_phnum;
2051         elf_addr_t e_shoff;
2052
2053         /*
2054          * We no longer stop all VM operations.
2055          *
2056          * This is because those proceses that could possibly change map_count
2057          * or the mmap / vma pages are now blocked in do_exit on current
2058          * finishing this core dump.
2059          *
2060          * Only ptrace can touch these memory addresses, but it doesn't change
2061          * the map_count or the pages allocated. So no possibility of crashing
2062          * exists while dumping the mm->vm_next areas to the core file.
2063          */
2064
2065         /* alloc memory for large data structures: too large to be on stack */
2066         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
2067         if (!elf)
2068                 goto out;
2069         /*
2070          * The number of segs are recored into ELF header as 16bit value.
2071          * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2072          */
2073         segs = current->mm->map_count;
2074         segs += elf_core_extra_phdrs();
2075
2076         gate_vma = get_gate_vma(current->mm);
2077         if (gate_vma != NULL)
2078                 segs++;
2079
2080         /* for notes section */
2081         segs++;
2082
2083         /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2084          * this, kernel supports extended numbering. Have a look at
2085          * include/linux/elf.h for further information. */
2086         e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2087
2088         /*
2089          * Collect all the non-memory information about the process for the
2090          * notes.  This also sets up the file header.
2091          */
2092         if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs))
2093                 goto cleanup;
2094
2095         has_dumped = 1;
2096
2097         fs = get_fs();
2098         set_fs(KERNEL_DS);
2099
2100         offset += sizeof(*elf);                         /* Elf header */
2101         offset += segs * sizeof(struct elf_phdr);       /* Program headers */
2102
2103         /* Write notes phdr entry */
2104         {
2105                 size_t sz = get_note_info_size(&info);
2106
2107                 sz += elf_coredump_extra_notes_size();
2108
2109                 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2110                 if (!phdr4note)
2111                         goto end_coredump;
2112
2113                 fill_elf_note_phdr(phdr4note, sz, offset);
2114                 offset += sz;
2115         }
2116
2117         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2118
2119         offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
2120         offset += elf_core_extra_data_size();
2121         e_shoff = offset;
2122
2123         if (e_phnum == PN_XNUM) {
2124                 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2125                 if (!shdr4extnum)
2126                         goto end_coredump;
2127                 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2128         }
2129
2130         offset = dataoff;
2131
2132         if (!dump_emit(cprm, elf, sizeof(*elf)))
2133                 goto end_coredump;
2134
2135         if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
2136                 goto end_coredump;
2137
2138         /* Write program headers for segments dump */
2139         for (vma = first_vma(current, gate_vma); vma != NULL;
2140                         vma = next_vma(vma, gate_vma)) {
2141                 struct elf_phdr phdr;
2142
2143                 phdr.p_type = PT_LOAD;
2144                 phdr.p_offset = offset;
2145                 phdr.p_vaddr = vma->vm_start;
2146                 phdr.p_paddr = 0;
2147                 phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
2148                 phdr.p_memsz = vma->vm_end - vma->vm_start;
2149                 offset += phdr.p_filesz;
2150                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2151                 if (vma->vm_flags & VM_WRITE)
2152                         phdr.p_flags |= PF_W;
2153                 if (vma->vm_flags & VM_EXEC)
2154                         phdr.p_flags |= PF_X;
2155                 phdr.p_align = ELF_EXEC_PAGESIZE;
2156
2157                 if (!dump_emit(cprm, &phdr, sizeof(phdr)))
2158                         goto end_coredump;
2159         }
2160
2161         if (!elf_core_write_extra_phdrs(cprm, offset))
2162                 goto end_coredump;
2163
2164         /* write out the notes section */
2165         if (!write_note_info(&info, cprm))
2166                 goto end_coredump;
2167
2168         if (elf_coredump_extra_notes_write(cprm))
2169                 goto end_coredump;
2170
2171         /* Align to page */
2172         if (!dump_skip(cprm, dataoff - cprm->written))
2173                 goto end_coredump;
2174
2175         for (vma = first_vma(current, gate_vma); vma != NULL;
2176                         vma = next_vma(vma, gate_vma)) {
2177                 unsigned long addr;
2178                 unsigned long end;
2179
2180                 end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
2181
2182                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2183                         struct page *page;
2184                         int stop;
2185
2186                         page = get_dump_page(addr);
2187                         if (page) {
2188                                 void *kaddr = kmap(page);
2189                                 stop = !dump_emit(cprm, kaddr, PAGE_SIZE);
2190                                 kunmap(page);
2191                                 page_cache_release(page);
2192                         } else
2193                                 stop = !dump_skip(cprm, PAGE_SIZE);
2194                         if (stop)
2195                                 goto end_coredump;
2196                 }
2197         }
2198
2199         if (!elf_core_write_extra_data(cprm))
2200                 goto end_coredump;
2201
2202         if (e_phnum == PN_XNUM) {
2203                 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
2204                         goto end_coredump;
2205         }
2206
2207 end_coredump:
2208         set_fs(fs);
2209
2210 cleanup:
2211         free_note_info(&info);
2212         kfree(shdr4extnum);
2213         kfree(phdr4note);
2214         kfree(elf);
2215 out:
2216         return has_dumped;
2217 }
2218
2219 #endif          /* CONFIG_ELF_CORE */
2220
2221 static int __init init_elf_binfmt(void)
2222 {
2223         register_binfmt(&elf_format);
2224         return 0;
2225 }
2226
2227 static void __exit exit_elf_binfmt(void)
2228 {
2229         /* Remove the COFF and ELF loaders. */
2230         unregister_binfmt(&elf_format);
2231 }
2232
2233 core_initcall(init_elf_binfmt);
2234 module_exit(exit_elf_binfmt);
2235 MODULE_LICENSE("GPL");