fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/mm.h>
  16 #include <linux/mman.h>
  17 #include <linux/errno.h>
  18 #include <linux/signal.h>
  19 #include <linux/binfmts.h>
  20 #include <linux/string.h>
  21 #include <linux/file.h>
  22 #include <linux/slab.h>
  23 #include <linux/personality.h>
  24 #include <linux/elfcore.h>
  25 #include <linux/init.h>
  26 #include <linux/highuid.h>
  27 #include <linux/compiler.h>
  28 #include <linux/highmem.h>
  29 #include <linux/pagemap.h>
  30 #include <linux/vmalloc.h>
  31 #include <linux/security.h>
  32 #include <linux/random.h>
  33 #include <linux/elf.h>
  34 #include <linux/utsname.h>
  35 #include <linux/coredump.h>
  36 #include <linux/sched.h>
  37 #include <asm/uaccess.h>
  38 #include <asm/param.h>
  39 #include <asm/page.h>
  40
  41 #ifndef user_long_t
  42 #define user_long_t long
  43 #endif
  44 #ifndef user_siginfo_t
  45 #define user_siginfo_t siginfo_t
  46 #endif
  47
  48 static int load_elf_binary(struct linux_binprm *bprm);
  49 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  50                                 int, int, unsigned long);
  51
  52 #ifdef CONFIG_USELIB
  53 static int load_elf_library(struct file *);
  54 #else
  55 #define load_elf_library NULL
  56 #endif
  57
  58 /*
  59  * If we don't support core dumping, then supply a NULL so we
  60  * don't even try.
  61  */
  62 #ifdef CONFIG_ELF_CORE
  63 static int elf_core_dump(struct coredump_params *cprm);
  64 #else
  65 #define elf_core_dump   NULL
  66 #endif
  67
  68 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  69 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  70 #else
  71 #define ELF_MIN_ALIGN   PAGE_SIZE
  72 #endif
  73
  74 #ifndef ELF_CORE_EFLAGS
  75 #define ELF_CORE_EFLAGS 0
  76 #endif
  77
  78 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  79 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  80 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  81
  82 static struct linux_binfmt elf_format = {
  83         .module         = THIS_MODULE,
  84         .load_binary    = load_elf_binary,
  85         .load_shlib     = load_elf_library,
  86         .core_dump      = elf_core_dump,
  87         .min_coredump   = ELF_EXEC_PAGESIZE,
  88 };
  89
  90 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  91
  92 static int set_brk(unsigned long start, unsigned long end)
  93 {
  94         start = ELF_PAGEALIGN(start);
  95         end = ELF_PAGEALIGN(end);
  96         if (end > start) {
  97                 unsigned long addr;
  98                 addr = vm_brk(start, end - start);
  99                 if (BAD_ADDR(addr))
 100                         return addr;
 101         }
 102         current->mm->start_brk = current->mm->brk = end;
 103         return 0;
 104 }
 105
 106 /* We need to explicitly zero any fractional pages
 107    after the data section (i.e. bss).  This would
 108    contain the junk from the file that should not
 109    be in memory
 110  */
 111 static int padzero(unsigned long elf_bss)
 112 {
 113         unsigned long nbyte;
 114
 115         nbyte = ELF_PAGEOFFSET(elf_bss);
 116         if (nbyte) {
 117                 nbyte = ELF_MIN_ALIGN - nbyte;
 118                 if (clear_user((void __user *) elf_bss, nbyte))
 119                         return -EFAULT;
 120         }
 121         return 0;
 122 }
 123
 124 /* Let's use some macros to make this stack manipulation a little clearer */
 125 #ifdef CONFIG_STACK_GROWSUP
 126 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 127 #define STACK_ROUND(sp, items) \
 128         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 129 #define STACK_ALLOC(sp, len) ({ \
 130         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 131         old_sp; })
 132 #else
 133 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 134 #define STACK_ROUND(sp, items) \
 135         (((unsigned long) (sp - items)) &~ 15UL)
 136 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 137 #endif
 138
 139 #ifndef ELF_BASE_PLATFORM
 140 /*
 141  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 142  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 143  * will be copied to the user stack in the same manner as AT_PLATFORM.
 144  */
 145 #define ELF_BASE_PLATFORM NULL
 146 #endif
 147
 148 static int
 149 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 150                 unsigned long load_addr, unsigned long interp_load_addr)
 151 {
 152         unsigned long p = bprm->p;
 153         int argc = bprm->argc;
 154         int envc = bprm->envc;
 155         elf_addr_t __user *argv;
 156         elf_addr_t __user *envp;
 157         elf_addr_t __user *sp;
 158         elf_addr_t __user *u_platform;
 159         elf_addr_t __user *u_base_platform;
 160         elf_addr_t __user *u_rand_bytes;
 161         const char *k_platform = ELF_PLATFORM;
 162         const char *k_base_platform = ELF_BASE_PLATFORM;
 163         unsigned char k_rand_bytes[16];
 164         int items;
 165         elf_addr_t *elf_info;
 166         int ei_index = 0;
 167         const struct cred *cred = current_cred();
 168         struct vm_area_struct *vma;
 169
 170         /*
 171          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 172          * evictions by the processes running on the same package. One
 173          * thing we can do is to shuffle the initial stack for them.
 174          */
 175
 176         p = arch_align_stack(p);
 177
 178         /*
 179          * If this architecture has a platform capability string, copy it
 180          * to userspace.  In some cases (Sparc), this info is impossible
 181          * for userspace to get any other way, in others (i386) it is
 182          * merely difficult.
 183          */
 184         u_platform = NULL;
 185         if (k_platform) {
 186                 size_t len = strlen(k_platform) + 1;
 187
 188                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 189                 if (__copy_to_user(u_platform, k_platform, len))
 190                         return -EFAULT;
 191         }
 192
 193         /*
 194          * If this architecture has a "base" platform capability
 195          * string, copy it to userspace.
 196          */
 197         u_base_platform = NULL;
 198         if (k_base_platform) {
 199                 size_t len = strlen(k_base_platform) + 1;
 200
 201                 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 202                 if (__copy_to_user(u_base_platform, k_base_platform, len))
 203                         return -EFAULT;
 204         }
 205
 206         /*
 207          * Generate 16 random bytes for userspace PRNG seeding.
 208          */
 209         get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
 210         u_rand_bytes = (elf_addr_t __user *)
 211                        STACK_ALLOC(p, sizeof(k_rand_bytes));
 212         if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
 213                 return -EFAULT;
 214
 215         /* Create the ELF interpreter info */
 216         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 217         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 218 #define NEW_AUX_ENT(id, val) \
 219         do { \
 220                 elf_info[ei_index++] = id; \
 221                 elf_info[ei_index++] = val; \
 222         } while (0)
 223
 224 #ifdef ARCH_DLINFO
 225         /*
 226          * ARCH_DLINFO must come first so PPC can do its special alignment of
 227          * AUXV.
 228          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 229          * ARCH_DLINFO changes
 230          */
 231         ARCH_DLINFO;
 232 #endif
 233         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 234         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 235         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 236         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 237         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 238         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 239         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 240         NEW_AUX_ENT(AT_FLAGS, 0);
 241         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 242         NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
 243         NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
 244         NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
 245         NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
 246         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 247         NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
 248 #ifdef ELF_HWCAP2
 249         NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
 250 #endif
 251         NEW_AUX_ENT(AT_EXECFN, bprm->exec);
 252         if (k_platform) {
 253                 NEW_AUX_ENT(AT_PLATFORM,
 254                             (elf_addr_t)(unsigned long)u_platform);
 255         }
 256         if (k_base_platform) {
 257                 NEW_AUX_ENT(AT_BASE_PLATFORM,
 258                             (elf_addr_t)(unsigned long)u_base_platform);
 259         }
 260         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 261                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 262         }
 263 #undef NEW_AUX_ENT
 264         /* AT_NULL is zero; clear the rest too */
 265         memset(&elf_info[ei_index], 0,
 266                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 267
 268         /* And advance past the AT_NULL entry.  */
 269         ei_index += 2;
 270
 271         sp = STACK_ADD(p, ei_index);
 272
 273         items = (argc + 1) + (envc + 1) + 1;
 274         bprm->p = STACK_ROUND(sp, items);
 275
 276         /* Point sp at the lowest address on the stack */
 277 #ifdef CONFIG_STACK_GROWSUP
 278         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 279         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 280 #else
 281         sp = (elf_addr_t __user *)bprm->p;
 282 #endif
 283
 284
 285         /*
 286          * Grow the stack manually; some architectures have a limit on how
 287          * far ahead a user-space access may be in order to grow the stack.
 288          */
 289         vma = find_extend_vma(current->mm, bprm->p);
 290         if (!vma)
 291                 return -EFAULT;
 292
 293         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 294         if (__put_user(argc, sp++))
 295                 return -EFAULT;
 296         argv = sp;
 297         envp = argv + argc + 1;
 298
 299         /* Populate argv and envp */
 300         p = current->mm->arg_end = current->mm->arg_start;
 301         while (argc-- > 0) {
 302                 size_t len;
 303                 if (__put_user((elf_addr_t)p, argv++))
 304                         return -EFAULT;
 305                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 306                 if (!len || len > MAX_ARG_STRLEN)
 307                         return -EINVAL;
 308                 p += len;
 309         }
 310         if (__put_user(0, argv))
 311                 return -EFAULT;
 312         current->mm->arg_end = current->mm->env_start = p;
 313         while (envc-- > 0) {
 314                 size_t len;
 315                 if (__put_user((elf_addr_t)p, envp++))
 316                         return -EFAULT;
 317                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 318                 if (!len || len > MAX_ARG_STRLEN)
 319                         return -EINVAL;
 320                 p += len;
 321         }
 322         if (__put_user(0, envp))
 323                 return -EFAULT;
 324         current->mm->env_end = p;
 325
 326         /* Put the elf_info on the stack in the right place.  */
 327         sp = (elf_addr_t __user *)envp + 1;
 328         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 329                 return -EFAULT;
 330         return 0;
 331 }
 332
 333 #ifndef elf_map
 334
 335 static unsigned long elf_map(struct file *filep, unsigned long addr,
 336                 struct elf_phdr *eppnt, int prot, int type,
 337                 unsigned long total_size)
 338 {
 339         unsigned long map_addr;
 340         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 341         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 342         addr = ELF_PAGESTART(addr);
 343         size = ELF_PAGEALIGN(size);
 344
 345         /* mmap() will return -EINVAL if given a zero size, but a
 346          * segment with zero filesize is perfectly valid */
 347         if (!size)
 348                 return addr;
 349
 350         /*
 351         * total_size is the size of the ELF (interpreter) image.
 352         * The _first_ mmap needs to know the full size, otherwise
 353         * randomization might put this image into an overlapping
 354         * position with the ELF binary image. (since size < total_size)
 355         * So we first map the 'big' image - and unmap the remainder at
 356         * the end. (which unmap is needed for ELF images with holes.)
 357         */
 358         if (total_size) {
 359                 total_size = ELF_PAGEALIGN(total_size);
 360                 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
 361                 if (!BAD_ADDR(map_addr))
 362                         vm_munmap(map_addr+size, total_size-size);
 363         } else
 364                 map_addr = vm_mmap(filep, addr, size, prot, type, off);
 365
 366         return(map_addr);
 367 }
 368
 369 #endif /* !elf_map */
 370
 371 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 372 {
 373         int i, first_idx = -1, last_idx = -1;
 374
 375         for (i = 0; i < nr; i++) {
 376                 if (cmds[i].p_type == PT_LOAD) {
 377                         last_idx = i;
 378                         if (first_idx == -1)
 379                                 first_idx = i;
 380                 }
 381         }
 382         if (first_idx == -1)
 383                 return 0;
 384
 385         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 386                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 387 }
 388
 389
 390 /* This is much more generalized than the library routine read function,
 391    so we keep this separate.  Technically the library read function
 392    is only provided so that we can read a.out libraries that have
 393    an ELF header */
 394
 395 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 396                 struct file *interpreter, unsigned long *interp_map_addr,
 397                 unsigned long no_base)
 398 {
 399         struct elf_phdr *elf_phdata;
 400         struct elf_phdr *eppnt;
 401         unsigned long load_addr = 0;
 402         int load_addr_set = 0;
 403         unsigned long last_bss = 0, elf_bss = 0;
 404         unsigned long error = ~0UL;
 405         unsigned long total_size;
 406         int retval, i, size;
 407
 408         /* First of all, some simple consistency checks */
 409         if (interp_elf_ex->e_type != ET_EXEC &&
 410             interp_elf_ex->e_type != ET_DYN)
 411                 goto out;
 412         if (!elf_check_arch(interp_elf_ex))
 413                 goto out;
 414         if (!interpreter->f_op->mmap)
 415                 goto out;
 416
 417         /*
 418          * If the size of this structure has changed, then punt, since
 419          * we will be doing the wrong thing.
 420          */
 421         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 422                 goto out;
 423         if (interp_elf_ex->e_phnum < 1 ||
 424                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 425                 goto out;
 426
 427         /* Now read in all of the header information */
 428         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 429         if (size > ELF_MIN_ALIGN)
 430                 goto out;
 431         elf_phdata = kmalloc(size, GFP_KERNEL);
 432         if (!elf_phdata)
 433                 goto out;
 434
 435         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 436                              (char *)elf_phdata, size);
 437         error = -EIO;
 438         if (retval != size) {
 439                 if (retval < 0)
 440                         error = retval;
 441                 goto out_close;
 442         }
 443
 444         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 445         if (!total_size) {
 446                 error = -EINVAL;
 447                 goto out_close;
 448         }
 449
 450         eppnt = elf_phdata;
 451         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 452                 if (eppnt->p_type == PT_LOAD) {
 453                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 454                         int elf_prot = 0;
 455                         unsigned long vaddr = 0;
 456                         unsigned long k, map_addr;
 457
 458                         if (eppnt->p_flags & PF_R)
 459                                 elf_prot = PROT_READ;
 460                         if (eppnt->p_flags & PF_W)
 461                                 elf_prot |= PROT_WRITE;
 462                         if (eppnt->p_flags & PF_X)
 463                                 elf_prot |= PROT_EXEC;
 464                         vaddr = eppnt->p_vaddr;
 465                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 466                                 elf_type |= MAP_FIXED;
 467                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 468                                 load_addr = -vaddr;
 469
 470                         map_addr = elf_map(interpreter, load_addr + vaddr,
 471                                         eppnt, elf_prot, elf_type, total_size);
 472                         total_size = 0;
 473                         if (!*interp_map_addr)
 474                                 *interp_map_addr = map_addr;
 475                         error = map_addr;
 476                         if (BAD_ADDR(map_addr))
 477                                 goto out_close;
 478
 479                         if (!load_addr_set &&
 480                             interp_elf_ex->e_type == ET_DYN) {
 481                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 482                                 load_addr_set = 1;
 483                         }
 484
 485                         /*
 486                          * Check to see if the section's size will overflow the
 487                          * allowed task size. Note that p_filesz must always be
 488                          * <= p_memsize so it's only necessary to check p_memsz.
 489                          */
 490                         k = load_addr + eppnt->p_vaddr;
 491                         if (BAD_ADDR(k) ||
 492                             eppnt->p_filesz > eppnt->p_memsz ||
 493                             eppnt->p_memsz > TASK_SIZE ||
 494                             TASK_SIZE - eppnt->p_memsz < k) {
 495                                 error = -ENOMEM;
 496                                 goto out_close;
 497                         }
 498
 499                         /*
 500                          * Find the end of the file mapping for this phdr, and
 501                          * keep track of the largest address we see for this.
 502                          */
 503                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 504                         if (k > elf_bss)
 505                                 elf_bss = k;
 506
 507                         /*
 508                          * Do the same thing for the memory mapping - between
 509                          * elf_bss and last_bss is the bss section.
 510                          */
 511                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 512                         if (k > last_bss)
 513                                 last_bss = k;
 514                 }
 515         }
 516
 517         if (last_bss > elf_bss) {
 518                 /*
 519                  * Now fill out the bss section.  First pad the last page up
 520                  * to the page boundary, and then perform a mmap to make sure
 521                  * that there are zero-mapped pages up to and including the
 522                  * last bss page.
 523                  */
 524                 if (padzero(elf_bss)) {
 525                         error = -EFAULT;
 526                         goto out_close;
 527                 }
 528
 529                 /* What we have mapped so far */
 530                 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 531
 532                 /* Map the last of the bss segment */
 533                 error = vm_brk(elf_bss, last_bss - elf_bss);
 534                 if (BAD_ADDR(error))
 535                         goto out_close;
 536         }
 537
 538         error = load_addr;
 539
 540 out_close:
 541         kfree(elf_phdata);
 542 out:
 543         return error;
 544 }
 545
 546 /*
 547  * These are the functions used to load ELF style executables and shared
 548  * libraries.  There is no binary dependent code anywhere else.
 549  */
 550
 551 #ifndef STACK_RND_MASK
 552 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 553 #endif
 554
 555 static unsigned long randomize_stack_top(unsigned long stack_top)
 556 {
 557         unsigned long random_variable = 0;
 558
 559         if ((current->flags & PF_RANDOMIZE) &&
 560                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 561                 random_variable = (unsigned long) get_random_int();
 562                 random_variable &= STACK_RND_MASK;
 563                 random_variable <<= PAGE_SHIFT;
 564         }
 565 #ifdef CONFIG_STACK_GROWSUP
 566         return PAGE_ALIGN(stack_top) + random_variable;
 567 #else
 568         return PAGE_ALIGN(stack_top) - random_variable;
 569 #endif
 570 }
 571
 572 static int load_elf_binary(struct linux_binprm *bprm)
 573 {
 574         struct file *interpreter = NULL; /* to shut gcc up */
 575         unsigned long load_addr = 0, load_bias = 0;
 576         int load_addr_set = 0;
 577         char * elf_interpreter = NULL;
 578         unsigned long error;
 579         struct elf_phdr *elf_ppnt, *elf_phdata;
 580         unsigned long elf_bss, elf_brk;
 581         int retval, i;
 582         unsigned int size;
 583         unsigned long elf_entry;
 584         unsigned long interp_load_addr = 0;
 585         unsigned long start_code, end_code, start_data, end_data;
 586         unsigned long reloc_func_desc __maybe_unused = 0;
 587         int executable_stack = EXSTACK_DEFAULT;
 588         struct pt_regs *regs = current_pt_regs();
 589         struct {
 590                 struct elfhdr elf_ex;
 591                 struct elfhdr interp_elf_ex;
 592         } *loc;
 593
 594         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 595         if (!loc) {
 596                 retval = -ENOMEM;
 597                 goto out_ret;
 598         }
 599
 600         /* Get the exec-header */
 601         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 602
 603         retval = -ENOEXEC;
 604         /* First of all, some simple consistency checks */
 605         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 606                 goto out;
 607
 608         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 609                 goto out;
 610         if (!elf_check_arch(&loc->elf_ex))
 611                 goto out;
 612         if (!bprm->file->f_op->mmap)
 613                 goto out;
 614
 615         /* Now read in all of the header information */
 616         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 617                 goto out;
 618         if (loc->elf_ex.e_phnum < 1 ||
 619                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 620                 goto out;
 621         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 622         retval = -ENOMEM;
 623         elf_phdata = kmalloc(size, GFP_KERNEL);
 624         if (!elf_phdata)
 625                 goto out;
 626
 627         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 628                              (char *)elf_phdata, size);
 629         if (retval != size) {
 630                 if (retval >= 0)
 631                         retval = -EIO;
 632                 goto out_free_ph;
 633         }
 634
 635         elf_ppnt = elf_phdata;
 636         elf_bss = 0;
 637         elf_brk = 0;
 638
 639         start_code = ~0UL;
 640         end_code = 0;
 641         start_data = 0;
 642         end_data = 0;
 643
 644         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 645                 if (elf_ppnt->p_type == PT_INTERP) {
 646                         /* This is the program interpreter used for
 647                          * shared libraries - for now assume that this
 648                          * is an a.out format binary
 649                          */
 650                         retval = -ENOEXEC;
 651                         if (elf_ppnt->p_filesz > PATH_MAX ||
 652                             elf_ppnt->p_filesz < 2)
 653                                 goto out_free_ph;
 654
 655                         retval = -ENOMEM;
 656                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 657                                                   GFP_KERNEL);
 658                         if (!elf_interpreter)
 659                                 goto out_free_ph;
 660
 661                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 662                                              elf_interpreter,
 663                                              elf_ppnt->p_filesz);
 664                         if (retval != elf_ppnt->p_filesz) {
 665                                 if (retval >= 0)
 666                                         retval = -EIO;
 667                                 goto out_free_interp;
 668                         }
 669                         /* make sure path is NULL terminated */
 670                         retval = -ENOEXEC;
 671                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 672                                 goto out_free_interp;
 673
 674                         interpreter = open_exec(elf_interpreter);
 675                         retval = PTR_ERR(interpreter);
 676                         if (IS_ERR(interpreter))
 677                                 goto out_free_interp;
 678
 679                         /*
 680                          * If the binary is not readable then enforce
 681                          * mm->dumpable = 0 regardless of the interpreter's
 682                          * permissions.
 683                          */
 684                         would_dump(bprm, interpreter);
 685
 686                         retval = kernel_read(interpreter, 0, bprm->buf,
 687                                              BINPRM_BUF_SIZE);
 688                         if (retval != BINPRM_BUF_SIZE) {
 689                                 if (retval >= 0)
 690                                         retval = -EIO;
 691                                 goto out_free_dentry;
 692                         }
 693
 694                         /* Get the exec headers */
 695                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 696                         break;
 697                 }
 698                 elf_ppnt++;
 699         }
 700
 701         elf_ppnt = elf_phdata;
 702         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 703                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 704                         if (elf_ppnt->p_flags & PF_X)
 705                                 executable_stack = EXSTACK_ENABLE_X;
 706                         else
 707                                 executable_stack = EXSTACK_DISABLE_X;
 708                         break;
 709                 }
 710
 711         /* Some simple consistency checks for the interpreter */
 712         if (elf_interpreter) {
 713                 retval = -ELIBBAD;
 714                 /* Not an ELF interpreter */
 715                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 716                         goto out_free_dentry;
 717                 /* Verify the interpreter has a valid arch */
 718                 if (!elf_check_arch(&loc->interp_elf_ex))
 719                         goto out_free_dentry;
 720         }
 721
 722         /* Flush all traces of the currently running executable */
 723         retval = flush_old_exec(bprm);
 724         if (retval)
 725                 goto out_free_dentry;
 726
 727         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 728            may depend on the personality.  */
 729         SET_PERSONALITY(loc->elf_ex);
 730         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 731                 current->personality |= READ_IMPLIES_EXEC;
 732
 733         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 734                 current->flags |= PF_RANDOMIZE;
 735
 736         setup_new_exec(bprm);
 737
 738         /* Do this so that we can load the interpreter, if need be.  We will
 739            change some of these later */
 740         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 741                                  executable_stack);
 742         if (retval < 0)
 743                 goto out_free_dentry;
 744
 745         current->mm->start_stack = bprm->p;
 746
 747         /* Now we do a little grungy work by mmapping the ELF image into
 748            the correct location in memory. */
 749         for(i = 0, elf_ppnt = elf_phdata;
 750             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 751                 int elf_prot = 0, elf_flags;
 752                 unsigned long k, vaddr;
 753                 unsigned long total_size = 0;
 754
 755                 if (elf_ppnt->p_type != PT_LOAD)
 756                         continue;
 757
 758                 if (unlikely (elf_brk > elf_bss)) {
 759                         unsigned long nbyte;
 760
 761                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 762                            before this one. Map anonymous pages, if needed,
 763                            and clear the area.  */
 764                         retval = set_brk(elf_bss + load_bias,
 765                                          elf_brk + load_bias);
 766                         if (retval)
 767                                 goto out_free_dentry;
 768                         nbyte = ELF_PAGEOFFSET(elf_bss);
 769                         if (nbyte) {
 770                                 nbyte = ELF_MIN_ALIGN - nbyte;
 771                                 if (nbyte > elf_brk - elf_bss)
 772                                         nbyte = elf_brk - elf_bss;
 773                                 if (clear_user((void __user *)elf_bss +
 774                                                         load_bias, nbyte)) {
 775                                         /*
 776                                          * This bss-zeroing can fail if the ELF
 777                                          * file specifies odd protections. So
 778                                          * we don't check the return value
 779                                          */
 780                                 }
 781                         }
 782                 }
 783
 784                 if (elf_ppnt->p_flags & PF_R)
 785                         elf_prot |= PROT_READ;
 786                 if (elf_ppnt->p_flags & PF_W)
 787                         elf_prot |= PROT_WRITE;
 788                 if (elf_ppnt->p_flags & PF_X)
 789                         elf_prot |= PROT_EXEC;
 790
 791                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 792
 793                 vaddr = elf_ppnt->p_vaddr;
 794                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 795                         elf_flags |= MAP_FIXED;
 796                 } else if (loc->elf_ex.e_type == ET_DYN) {
 797                         /* Try and get dynamic programs out of the way of the
 798                          * default mmap base, as well as whatever program they
 799                          * might try to exec.  This is because the brk will
 800                          * follow the loader, and is not movable.  */
 801 #ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
 802                         /* Memory randomization might have been switched off
 803                          * in runtime via sysctl or explicit setting of
 804                          * personality flags.
 805                          * If that is the case, retain the original non-zero
 806                          * load_bias value in order to establish proper
 807                          * non-randomized mappings.
 808                          */
 809                         if (current->flags & PF_RANDOMIZE)
 810                                 load_bias = 0;
 811                         else
 812                                 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 813 #else
 814                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 815 #endif
 816                         total_size = total_mapping_size(elf_phdata,
 817                                                         loc->elf_ex.e_phnum);
 818                         if (!total_size) {
 819                                 retval = -EINVAL;
 820                                 goto out_free_dentry;
 821                         }
 822                 }
 823
 824                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 825                                 elf_prot, elf_flags, total_size);
 826                 if (BAD_ADDR(error)) {
 827                         retval = IS_ERR((void *)error) ?
 828                                 PTR_ERR((void*)error) : -EINVAL;
 829                         goto out_free_dentry;
 830                 }
 831
 832                 if (!load_addr_set) {
 833                         load_addr_set = 1;
 834                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 835                         if (loc->elf_ex.e_type == ET_DYN) {
 836                                 load_bias += error -
 837                                              ELF_PAGESTART(load_bias + vaddr);
 838                                 load_addr += load_bias;
 839                                 reloc_func_desc = load_bias;
 840                         }
 841                 }
 842                 k = elf_ppnt->p_vaddr;
 843                 if (k < start_code)
 844                         start_code = k;
 845                 if (start_data < k)
 846                         start_data = k;
 847
 848                 /*
 849                  * Check to see if the section's size will overflow the
 850                  * allowed task size. Note that p_filesz must always be
 851                  * <= p_memsz so it is only necessary to check p_memsz.
 852                  */
 853                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 854                     elf_ppnt->p_memsz > TASK_SIZE ||
 855                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 856                         /* set_brk can never work. Avoid overflows. */
 857                         retval = -EINVAL;
 858                         goto out_free_dentry;
 859                 }
 860
 861                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 862
 863                 if (k > elf_bss)
 864                         elf_bss = k;
 865                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 866                         end_code = k;
 867                 if (end_data < k)
 868                         end_data = k;
 869                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 870                 if (k > elf_brk)
 871                         elf_brk = k;
 872         }
 873
 874         loc->elf_ex.e_entry += load_bias;
 875         elf_bss += load_bias;
 876         elf_brk += load_bias;
 877         start_code += load_bias;
 878         end_code += load_bias;
 879         start_data += load_bias;
 880         end_data += load_bias;
 881
 882         /* Calling set_brk effectively mmaps the pages that we need
 883          * for the bss and break sections.  We must do this before
 884          * mapping in the interpreter, to make sure it doesn't wind
 885          * up getting placed where the bss needs to go.
 886          */
 887         retval = set_brk(elf_bss, elf_brk);
 888         if (retval)
 889                 goto out_free_dentry;
 890         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 891                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 892                 goto out_free_dentry;
 893         }
 894
 895         if (elf_interpreter) {
 896                 unsigned long interp_map_addr = 0;
 897
 898                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 899                                             interpreter,
 900                                             &interp_map_addr,
 901                                             load_bias);
 902                 if (!IS_ERR((void *)elf_entry)) {
 903                         /*
 904                          * load_elf_interp() returns relocation
 905                          * adjustment
 906                          */
 907                         interp_load_addr = elf_entry;
 908                         elf_entry += loc->interp_elf_ex.e_entry;
 909                 }
 910                 if (BAD_ADDR(elf_entry)) {
 911                         retval = IS_ERR((void *)elf_entry) ?
 912                                         (int)elf_entry : -EINVAL;
 913                         goto out_free_dentry;
 914                 }
 915                 reloc_func_desc = interp_load_addr;
 916
 917                 allow_write_access(interpreter);
 918                 fput(interpreter);
 919                 kfree(elf_interpreter);
 920         } else {
 921                 elf_entry = loc->elf_ex.e_entry;
 922                 if (BAD_ADDR(elf_entry)) {
 923                         retval = -EINVAL;
 924                         goto out_free_dentry;
 925                 }
 926         }
 927
 928         kfree(elf_phdata);
 929
 930         set_binfmt(&elf_format);
 931
 932 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 933         retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
 934         if (retval < 0)
 935                 goto out;
 936 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 937
 938         install_exec_creds(bprm);
 939         retval = create_elf_tables(bprm, &loc->elf_ex,
 940                           load_addr, interp_load_addr);
 941         if (retval < 0)
 942                 goto out;
 943         /* N.B. passed_fileno might not be initialized? */
 944         current->mm->end_code = end_code;
 945         current->mm->start_code = start_code;
 946         current->mm->start_data = start_data;
 947         current->mm->end_data = end_data;
 948         current->mm->start_stack = bprm->p;
 949
 950 #ifdef arch_randomize_brk
 951         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
 952                 current->mm->brk = current->mm->start_brk =
 953                         arch_randomize_brk(current->mm);
 954 #ifdef CONFIG_COMPAT_BRK
 955                 current->brk_randomized = 1;
 956 #endif
 957         }
 958 #endif
 959
 960         if (current->personality & MMAP_PAGE_ZERO) {
 961                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 962                    and some applications "depend" upon this behavior.
 963                    Since we do not have the power to recompile these, we
 964                    emulate the SVr4 behavior. Sigh. */
 965                 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 966                                 MAP_FIXED | MAP_PRIVATE, 0);
 967         }
 968
 969 #ifdef ELF_PLAT_INIT
 970         /*
 971          * The ABI may specify that certain registers be set up in special
 972          * ways (on i386 %edx is the address of a DT_FINI function, for
 973          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 974          * that the e_entry field is the address of the function descriptor
 975          * for the startup routine, rather than the address of the startup
 976          * routine itself.  This macro performs whatever initialization to
 977          * the regs structure is required as well as any relocations to the
 978          * function descriptor entries when executing dynamically links apps.
 979          */
 980         ELF_PLAT_INIT(regs, reloc_func_desc);
 981 #endif
 982
 983         start_thread(regs, elf_entry, bprm->p);
 984         retval = 0;
 985 out:
 986         kfree(loc);
 987 out_ret:
 988         return retval;
 989
 990         /* error cleanup */
 991 out_free_dentry:
 992         allow_write_access(interpreter);
 993         if (interpreter)
 994                 fput(interpreter);
 995 out_free_interp:
 996         kfree(elf_interpreter);
 997 out_free_ph:
 998         kfree(elf_phdata);
 999         goto out;
1000 }
1001
1002 #ifdef CONFIG_USELIB
1003 /* This is really simpleminded and specialized - we are loading an
1004    a.out library that is given an ELF header. */
1005 static int load_elf_library(struct file *file)
1006 {
1007         struct elf_phdr *elf_phdata;
1008         struct elf_phdr *eppnt;
1009         unsigned long elf_bss, bss, len;
1010         int retval, error, i, j;
1011         struct elfhdr elf_ex;
1012
1013         error = -ENOEXEC;
1014         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1015         if (retval != sizeof(elf_ex))
1016                 goto out;
1017
1018         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1019                 goto out;
1020
1021         /* First of all, some simple consistency checks */
1022         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1023             !elf_check_arch(&elf_ex) || !file->f_op->mmap)
1024                 goto out;
1025
1026         /* Now read in all of the header information */
1027
1028         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1029         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1030
1031         error = -ENOMEM;
1032         elf_phdata = kmalloc(j, GFP_KERNEL);
1033         if (!elf_phdata)
1034                 goto out;
1035
1036         eppnt = elf_phdata;
1037         error = -ENOEXEC;
1038         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1039         if (retval != j)
1040                 goto out_free_ph;
1041
1042         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1043                 if ((eppnt + i)->p_type == PT_LOAD)
1044                         j++;
1045         if (j != 1)
1046                 goto out_free_ph;
1047
1048         while (eppnt->p_type != PT_LOAD)
1049                 eppnt++;
1050
1051         /* Now use mmap to map the library into memory. */
1052         error = vm_mmap(file,
1053                         ELF_PAGESTART(eppnt->p_vaddr),
1054                         (eppnt->p_filesz +
1055                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1056                         PROT_READ | PROT_WRITE | PROT_EXEC,
1057                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1058                         (eppnt->p_offset -
1059                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1060         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1061                 goto out_free_ph;
1062
1063         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1064         if (padzero(elf_bss)) {
1065                 error = -EFAULT;
1066                 goto out_free_ph;
1067         }
1068
1069         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1070                             ELF_MIN_ALIGN - 1);
1071         bss = eppnt->p_memsz + eppnt->p_vaddr;
1072         if (bss > len)
1073                 vm_brk(len, bss - len);
1074         error = 0;
1075
1076 out_free_ph:
1077         kfree(elf_phdata);
1078 out:
1079         return error;
1080 }
1081 #endif /* #ifdef CONFIG_USELIB */
1082
1083 #ifdef CONFIG_ELF_CORE
1084 /*
1085  * ELF core dumper
1086  *
1087  * Modelled on fs/exec.c:aout_core_dump()
1088  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1089  */
1090
1091 /*
1092  * The purpose of always_dump_vma() is to make sure that special kernel mappings
1093  * that are useful for post-mortem analysis are included in every core dump.
1094  * In that way we ensure that the core dump is fully interpretable later
1095  * without matching up the same kernel and hardware config to see what PC values
1096  * meant. These special mappings include - vDSO, vsyscall, and other
1097  * architecture specific mappings
1098  */
1099 static bool always_dump_vma(struct vm_area_struct *vma)
1100 {
1101         /* Any vsyscall mappings? */
1102         if (vma == get_gate_vma(vma->vm_mm))
1103                 return true;
1104
1105         /*
1106          * Assume that all vmas with a .name op should always be dumped.
1107          * If this changes, a new vm_ops field can easily be added.
1108          */
1109         if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma))
1110                 return true;
1111
1112         /*
1113          * arch_vma_name() returns non-NULL for special architecture mappings,
1114          * such as vDSO sections.
1115          */
1116         if (arch_vma_name(vma))
1117                 return true;
1118
1119         return false;
1120 }
1121
1122 /*
1123  * Decide what to dump of a segment, part, all or none.
1124  */
1125 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1126                                    unsigned long mm_flags)
1127 {
1128 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1129
1130         /* always dump the vdso and vsyscall sections */
1131         if (always_dump_vma(vma))
1132                 goto whole;
1133
1134         if (vma->vm_flags & VM_DONTDUMP)
1135                 return 0;
1136
1137         /* Hugetlb memory check */
1138         if (vma->vm_flags & VM_HUGETLB) {
1139                 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1140                         goto whole;
1141                 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1142                         goto whole;
1143                 return 0;
1144         }
1145
1146         /* Do not dump I/O mapped devices or special mappings */
1147         if (vma->vm_flags & VM_IO)
1148                 return 0;
1149
1150         /* By default, dump shared memory if mapped from an anonymous file. */
1151         if (vma->vm_flags & VM_SHARED) {
1152                 if (file_inode(vma->vm_file)->i_nlink == 0 ?
1153                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1154                         goto whole;
1155                 return 0;
1156         }
1157
1158         /* Dump segments that have been written to.  */
1159         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1160                 goto whole;
1161         if (vma->vm_file == NULL)
1162                 return 0;
1163
1164         if (FILTER(MAPPED_PRIVATE))
1165                 goto whole;
1166
1167         /*
1168          * If this looks like the beginning of a DSO or executable mapping,
1169          * check for an ELF header.  If we find one, dump the first page to
1170          * aid in determining what was mapped here.
1171          */
1172         if (FILTER(ELF_HEADERS) &&
1173             vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1174                 u32 __user *header = (u32 __user *) vma->vm_start;
1175                 u32 word;
1176                 mm_segment_t fs = get_fs();
1177                 /*
1178                  * Doing it this way gets the constant folded by GCC.
1179                  */
1180                 union {
1181                         u32 cmp;
1182                         char elfmag[SELFMAG];
1183                 } magic;
1184                 BUILD_BUG_ON(SELFMAG != sizeof word);
1185                 magic.elfmag[EI_MAG0] = ELFMAG0;
1186                 magic.elfmag[EI_MAG1] = ELFMAG1;
1187                 magic.elfmag[EI_MAG2] = ELFMAG2;
1188                 magic.elfmag[EI_MAG3] = ELFMAG3;
1189                 /*
1190                  * Switch to the user "segment" for get_user(),
1191                  * then put back what elf_core_dump() had in place.
1192                  */
1193                 set_fs(USER_DS);
1194                 if (unlikely(get_user(word, header)))
1195                         word = 0;
1196                 set_fs(fs);
1197                 if (word == magic.cmp)
1198                         return PAGE_SIZE;
1199         }
1200
1201 #undef  FILTER
1202
1203         return 0;
1204
1205 whole:
1206         return vma->vm_end - vma->vm_start;
1207 }
1208
1209 /* An ELF note in memory */
1210 struct memelfnote
1211 {
1212         const char *name;
1213         int type;
1214         unsigned int datasz;
1215         void *data;
1216 };
1217
1218 static int notesize(struct memelfnote *en)
1219 {
1220         int sz;
1221
1222         sz = sizeof(struct elf_note);
1223         sz += roundup(strlen(en->name) + 1, 4);
1224         sz += roundup(en->datasz, 4);
1225
1226         return sz;
1227 }
1228
1229 static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1230 {
1231         struct elf_note en;
1232         en.n_namesz = strlen(men->name) + 1;
1233         en.n_descsz = men->datasz;
1234         en.n_type = men->type;
1235
1236         return dump_emit(cprm, &en, sizeof(en)) &&
1237             dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1238             dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1239 }
1240
1241 static void fill_elf_header(struct elfhdr *elf, int segs,
1242                             u16 machine, u32 flags)
1243 {
1244         memset(elf, 0, sizeof(*elf));
1245
1246         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1247         elf->e_ident[EI_CLASS] = ELF_CLASS;
1248         elf->e_ident[EI_DATA] = ELF_DATA;
1249         elf->e_ident[EI_VERSION] = EV_CURRENT;
1250         elf->e_ident[EI_OSABI] = ELF_OSABI;
1251
1252         elf->e_type = ET_CORE;
1253         elf->e_machine = machine;
1254         elf->e_version = EV_CURRENT;
1255         elf->e_phoff = sizeof(struct elfhdr);
1256         elf->e_flags = flags;
1257         elf->e_ehsize = sizeof(struct elfhdr);
1258         elf->e_phentsize = sizeof(struct elf_phdr);
1259         elf->e_phnum = segs;
1260
1261         return;
1262 }
1263
1264 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1265 {
1266         phdr->p_type = PT_NOTE;
1267         phdr->p_offset = offset;
1268         phdr->p_vaddr = 0;
1269         phdr->p_paddr = 0;
1270         phdr->p_filesz = sz;
1271         phdr->p_memsz = 0;
1272         phdr->p_flags = 0;
1273         phdr->p_align = 0;
1274         return;
1275 }
1276
1277 static void fill_note(struct memelfnote *note, const char *name, int type,
1278                 unsigned int sz, void *data)
1279 {
1280         note->name = name;
1281         note->type = type;
1282         note->datasz = sz;
1283         note->data = data;
1284         return;
1285 }
1286
1287 /*
1288  * fill up all the fields in prstatus from the given task struct, except
1289  * registers which need to be filled up separately.
1290  */
1291 static void fill_prstatus(struct elf_prstatus *prstatus,
1292                 struct task_struct *p, long signr)
1293 {
1294         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1295         prstatus->pr_sigpend = p->pending.signal.sig[0];
1296         prstatus->pr_sighold = p->blocked.sig[0];
1297         rcu_read_lock();
1298         prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1299         rcu_read_unlock();
1300         prstatus->pr_pid = task_pid_vnr(p);
1301         prstatus->pr_pgrp = task_pgrp_vnr(p);
1302         prstatus->pr_sid = task_session_vnr(p);
1303         if (thread_group_leader(p)) {
1304                 struct task_cputime cputime;
1305
1306                 /*
1307                  * This is the record for the group leader.  It shows the
1308                  * group-wide total, not its individual thread total.
1309                  */
1310                 thread_group_cputime(p, &cputime);
1311                 cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1312                 cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1313         } else {
1314                 cputime_t utime, stime;
1315
1316                 task_cputime(p, &utime, &stime);
1317                 cputime_to_timeval(utime, &prstatus->pr_utime);
1318                 cputime_to_timeval(stime, &prstatus->pr_stime);
1319         }
1320         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1321         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1322 }
1323
1324 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1325                        struct mm_struct *mm)
1326 {
1327         const struct cred *cred;
1328         unsigned int i, len;
1329
1330         /* first copy the parameters from user space */
1331         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1332
1333         len = mm->arg_end - mm->arg_start;
1334         if (len >= ELF_PRARGSZ)
1335                 len = ELF_PRARGSZ-1;
1336         if (copy_from_user(&psinfo->pr_psargs,
1337                            (const char __user *)mm->arg_start, len))
1338                 return -EFAULT;
1339         for(i = 0; i < len; i++)
1340                 if (psinfo->pr_psargs[i] == 0)
1341                         psinfo->pr_psargs[i] = ' ';
1342         psinfo->pr_psargs[len] = 0;
1343
1344         rcu_read_lock();
1345         psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1346         rcu_read_unlock();
1347         psinfo->pr_pid = task_pid_vnr(p);
1348         psinfo->pr_pgrp = task_pgrp_vnr(p);
1349         psinfo->pr_sid = task_session_vnr(p);
1350
1351         i = p->state ? ffz(~p->state) + 1 : 0;
1352         psinfo->pr_state = i;
1353         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1354         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1355         psinfo->pr_nice = task_nice(p);
1356         psinfo->pr_flag = p->flags;
1357         rcu_read_lock();
1358         cred = __task_cred(p);
1359         SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1360         SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1361         rcu_read_unlock();
1362         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1363
1364         return 0;
1365 }
1366
1367 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1368 {
1369         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1370         int i = 0;
1371         do
1372                 i += 2;
1373         while (auxv[i - 2] != AT_NULL);
1374         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1375 }
1376
1377 static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1378                 const siginfo_t *siginfo)
1379 {
1380         mm_segment_t old_fs = get_fs();
1381         set_fs(KERNEL_DS);
1382         copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo);
1383         set_fs(old_fs);
1384         fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
1385 }
1386
1387 #define MAX_FILE_NOTE_SIZE (4*1024*1024)
1388 /*
1389  * Format of NT_FILE note:
1390  *
1391  * long count     -- how many files are mapped
1392  * long page_size -- units for file_ofs
1393  * array of [COUNT] elements of
1394  *   long start
1395  *   long end
1396  *   long file_ofs
1397  * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1398  */
1399 static int fill_files_note(struct memelfnote *note)
1400 {
1401         struct vm_area_struct *vma;
1402         unsigned count, size, names_ofs, remaining, n;
1403         user_long_t *data;
1404         user_long_t *start_end_ofs;
1405         char *name_base, *name_curpos;
1406
1407         /* *Estimated* file count and total data size needed */
1408         count = current->mm->map_count;
1409         size = count * 64;
1410
1411         names_ofs = (2 + 3 * count) * sizeof(data[0]);
1412  alloc:
1413         if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
1414                 return -EINVAL;
1415         size = round_up(size, PAGE_SIZE);
1416         data = vmalloc(size);
1417         if (!data)
1418                 return -ENOMEM;
1419
1420         start_end_ofs = data + 2;
1421         name_base = name_curpos = ((char *)data) + names_ofs;
1422         remaining = size - names_ofs;
1423         count = 0;
1424         for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1425                 struct file *file;
1426                 const char *filename;
1427
1428                 file = vma->vm_file;
1429                 if (!file)
1430                         continue;
1431                 filename = d_path(&file->f_path, name_curpos, remaining);
1432                 if (IS_ERR(filename)) {
1433                         if (PTR_ERR(filename) == -ENAMETOOLONG) {
1434                                 vfree(data);
1435                                 size = size * 5 / 4;
1436                                 goto alloc;
1437                         }
1438                         continue;
1439                 }
1440
1441                 /* d_path() fills at the end, move name down */
1442                 /* n = strlen(filename) + 1: */
1443                 n = (name_curpos + remaining) - filename;
1444                 remaining = filename - name_curpos;
1445                 memmove(name_curpos, filename, n);
1446                 name_curpos += n;
1447
1448                 *start_end_ofs++ = vma->vm_start;
1449                 *start_end_ofs++ = vma->vm_end;
1450                 *start_end_ofs++ = vma->vm_pgoff;
1451                 count++;
1452         }
1453
1454         /* Now we know exact count of files, can store it */
1455         data[0] = count;
1456         data[1] = PAGE_SIZE;
1457         /*
1458          * Count usually is less than current->mm->map_count,
1459          * we need to move filenames down.
1460          */
1461         n = current->mm->map_count - count;
1462         if (n != 0) {
1463                 unsigned shift_bytes = n * 3 * sizeof(data[0]);
1464                 memmove(name_base - shift_bytes, name_base,
1465                         name_curpos - name_base);
1466                 name_curpos -= shift_bytes;
1467         }
1468
1469         size = name_curpos - (char *)data;
1470         fill_note(note, "CORE", NT_FILE, size, data);
1471         return 0;
1472 }
1473
1474 #ifdef CORE_DUMP_USE_REGSET
1475 #include <linux/regset.h>
1476
1477 struct elf_thread_core_info {
1478         struct elf_thread_core_info *next;
1479         struct task_struct *task;
1480         struct elf_prstatus prstatus;
1481         struct memelfnote notes[0];
1482 };
1483
1484 struct elf_note_info {
1485         struct elf_thread_core_info *thread;
1486         struct memelfnote psinfo;
1487         struct memelfnote signote;
1488         struct memelfnote auxv;
1489         struct memelfnote files;
1490         user_siginfo_t csigdata;
1491         size_t size;
1492         int thread_notes;
1493 };
1494
1495 /*
1496  * When a regset has a writeback hook, we call it on each thread before
1497  * dumping user memory.  On register window machines, this makes sure the
1498  * user memory backing the register data is up to date before we read it.
1499  */
1500 static void do_thread_regset_writeback(struct task_struct *task,
1501                                        const struct user_regset *regset)
1502 {
1503         if (regset->writeback)
1504                 regset->writeback(task, regset, 1);
1505 }
1506
1507 #ifndef PR_REG_SIZE
1508 #define PR_REG_SIZE(S) sizeof(S)
1509 #endif
1510
1511 #ifndef PRSTATUS_SIZE
1512 #define PRSTATUS_SIZE(S) sizeof(S)
1513 #endif
1514
1515 #ifndef PR_REG_PTR
1516 #define PR_REG_PTR(S) (&((S)->pr_reg))
1517 #endif
1518
1519 #ifndef SET_PR_FPVALID
1520 #define SET_PR_FPVALID(S, V) ((S)->pr_fpvalid = (V))
1521 #endif
1522
1523 static int fill_thread_core_info(struct elf_thread_core_info *t,
1524                                  const struct user_regset_view *view,
1525                                  long signr, size_t *total)
1526 {
1527         unsigned int i;
1528
1529         /*
1530          * NT_PRSTATUS is the one special case, because the regset data
1531          * goes into the pr_reg field inside the note contents, rather
1532          * than being the whole note contents.  We fill the reset in here.
1533          * We assume that regset 0 is NT_PRSTATUS.
1534          */
1535         fill_prstatus(&t->prstatus, t->task, signr);
1536         (void) view->regsets[0].get(t->task, &view->regsets[0],
1537                                     0, PR_REG_SIZE(t->prstatus.pr_reg),
1538                                     PR_REG_PTR(&t->prstatus), NULL);
1539
1540         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1541                   PRSTATUS_SIZE(t->prstatus), &t->prstatus);
1542         *total += notesize(&t->notes[0]);
1543
1544         do_thread_regset_writeback(t->task, &view->regsets[0]);
1545
1546         /*
1547          * Each other regset might generate a note too.  For each regset
1548          * that has no core_note_type or is inactive, we leave t->notes[i]
1549          * all zero and we'll know to skip writing it later.
1550          */
1551         for (i = 1; i < view->n; ++i) {
1552                 const struct user_regset *regset = &view->regsets[i];
1553                 do_thread_regset_writeback(t->task, regset);
1554                 if (regset->core_note_type && regset->get &&
1555                     (!regset->active || regset->active(t->task, regset))) {
1556                         int ret;
1557                         size_t size = regset->n * regset->size;
1558                         void *data = kmalloc(size, GFP_KERNEL);
1559                         if (unlikely(!data))
1560                                 return 0;
1561                         ret = regset->get(t->task, regset,
1562                                           0, size, data, NULL);
1563                         if (unlikely(ret))
1564                                 kfree(data);
1565                         else {
1566                                 if (regset->core_note_type != NT_PRFPREG)
1567                                         fill_note(&t->notes[i], "LINUX",
1568                                                   regset->core_note_type,
1569                                                   size, data);
1570                                 else {
1571                                         SET_PR_FPVALID(&t->prstatus, 1);
1572                                         fill_note(&t->notes[i], "CORE",
1573                                                   NT_PRFPREG, size, data);
1574                                 }
1575                                 *total += notesize(&t->notes[i]);
1576                         }
1577                 }
1578         }
1579
1580         return 1;
1581 }
1582
1583 static int fill_note_info(struct elfhdr *elf, int phdrs,
1584                           struct elf_note_info *info,
1585                           const siginfo_t *siginfo, struct pt_regs *regs)
1586 {
1587         struct task_struct *dump_task = current;
1588         const struct user_regset_view *view = task_user_regset_view(dump_task);
1589         struct elf_thread_core_info *t;
1590         struct elf_prpsinfo *psinfo;
1591         struct core_thread *ct;
1592         unsigned int i;
1593
1594         info->size = 0;
1595         info->thread = NULL;
1596
1597         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1598         if (psinfo == NULL) {
1599                 info->psinfo.data = NULL; /* So we don't free this wrongly */
1600                 return 0;
1601         }
1602
1603         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1604
1605         /*
1606          * Figure out how many notes we're going to need for each thread.
1607          */
1608         info->thread_notes = 0;
1609         for (i = 0; i < view->n; ++i)
1610                 if (view->regsets[i].core_note_type != 0)
1611                         ++info->thread_notes;
1612
1613         /*
1614          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1615          * since it is our one special case.
1616          */
1617         if (unlikely(info->thread_notes == 0) ||
1618             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1619                 WARN_ON(1);
1620                 return 0;
1621         }
1622
1623         /*
1624          * Initialize the ELF file header.
1625          */
1626         fill_elf_header(elf, phdrs,
1627                         view->e_machine, view->e_flags);
1628
1629         /*
1630          * Allocate a structure for each thread.
1631          */
1632         for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1633                 t = kzalloc(offsetof(struct elf_thread_core_info,
1634                                      notes[info->thread_notes]),
1635                             GFP_KERNEL);
1636                 if (unlikely(!t))
1637                         return 0;
1638
1639                 t->task = ct->task;
1640                 if (ct->task == dump_task || !info->thread) {
1641                         t->next = info->thread;
1642                         info->thread = t;
1643                 } else {
1644                         /*
1645                          * Make sure to keep the original task at
1646                          * the head of the list.
1647                          */
1648                         t->next = info->thread->next;
1649                         info->thread->next = t;
1650                 }
1651         }
1652
1653         /*
1654          * Now fill in each thread's information.
1655          */
1656         for (t = info->thread; t != NULL; t = t->next)
1657                 if (!fill_thread_core_info(t, view, siginfo->si_signo, &info->size))
1658                         return 0;
1659
1660         /*
1661          * Fill in the two process-wide notes.
1662          */
1663         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1664         info->size += notesize(&info->psinfo);
1665
1666         fill_siginfo_note(&info->signote, &info->csigdata, siginfo);
1667         info->size += notesize(&info->signote);
1668
1669         fill_auxv_note(&info->auxv, current->mm);
1670         info->size += notesize(&info->auxv);
1671
1672         if (fill_files_note(&info->files) == 0)
1673                 info->size += notesize(&info->files);
1674
1675         return 1;
1676 }
1677
1678 static size_t get_note_info_size(struct elf_note_info *info)
1679 {
1680         return info->size;
1681 }
1682
1683 /*
1684  * Write all the notes for each thread.  When writing the first thread, the
1685  * process-wide notes are interleaved after the first thread-specific note.
1686  */
1687 static int write_note_info(struct elf_note_info *info,
1688                            struct coredump_params *cprm)
1689 {
1690         bool first = true;
1691         struct elf_thread_core_info *t = info->thread;
1692
1693         do {
1694                 int i;
1695
1696                 if (!writenote(&t->notes[0], cprm))
1697                         return 0;
1698
1699                 if (first && !writenote(&info->psinfo, cprm))
1700                         return 0;
1701                 if (first && !writenote(&info->signote, cprm))
1702                         return 0;
1703                 if (first && !writenote(&info->auxv, cprm))
1704                         return 0;
1705                 if (first && info->files.data &&
1706                                 !writenote(&info->files, cprm))
1707                         return 0;
1708
1709                 for (i = 1; i < info->thread_notes; ++i)
1710                         if (t->notes[i].data &&
1711                             !writenote(&t->notes[i], cprm))
1712                                 return 0;
1713
1714                 first = false;
1715                 t = t->next;
1716         } while (t);
1717
1718         return 1;
1719 }
1720
1721 static void free_note_info(struct elf_note_info *info)
1722 {
1723         struct elf_thread_core_info *threads = info->thread;
1724         while (threads) {
1725                 unsigned int i;
1726                 struct elf_thread_core_info *t = threads;
1727                 threads = t->next;
1728                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1729                 for (i = 1; i < info->thread_notes; ++i)
1730                         kfree(t->notes[i].data);
1731                 kfree(t);
1732         }
1733         kfree(info->psinfo.data);
1734         vfree(info->files.data);
1735 }
1736
1737 #else
1738
1739 /* Here is the structure in which status of each thread is captured. */
1740 struct elf_thread_status
1741 {
1742         struct list_head list;
1743         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1744         elf_fpregset_t fpu;             /* NT_PRFPREG */
1745         struct task_struct *thread;
1746 #ifdef ELF_CORE_COPY_XFPREGS
1747         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1748 #endif
1749         struct memelfnote notes[3];
1750         int num_notes;
1751 };
1752
1753 /*
1754  * In order to add the specific thread information for the elf file format,
1755  * we need to keep a linked list of every threads pr_status and then create
1756  * a single section for them in the final core file.
1757  */
1758 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1759 {
1760         int sz = 0;
1761         struct task_struct *p = t->thread;
1762         t->num_notes = 0;
1763
1764         fill_prstatus(&t->prstatus, p, signr);
1765         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1766
1767         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1768                   &(t->prstatus));
1769         t->num_notes++;
1770         sz += notesize(&t->notes[0]);
1771
1772         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1773                                                                 &t->fpu))) {
1774                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1775                           &(t->fpu));
1776                 t->num_notes++;
1777                 sz += notesize(&t->notes[1]);
1778         }
1779
1780 #ifdef ELF_CORE_COPY_XFPREGS
1781         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1782                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1783                           sizeof(t->xfpu), &t->xfpu);
1784                 t->num_notes++;
1785                 sz += notesize(&t->notes[2]);
1786         }
1787 #endif
1788         return sz;
1789 }
1790
1791 struct elf_note_info {
1792         struct memelfnote *notes;
1793         struct memelfnote *notes_files;
1794         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1795         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1796         struct list_head thread_list;
1797         elf_fpregset_t *fpu;
1798 #ifdef ELF_CORE_COPY_XFPREGS
1799         elf_fpxregset_t *xfpu;
1800 #endif
1801         user_siginfo_t csigdata;
1802         int thread_status_size;
1803         int numnote;
1804 };
1805
1806 static int elf_note_info_init(struct elf_note_info *info)
1807 {
1808         memset(info, 0, sizeof(*info));
1809         INIT_LIST_HEAD(&info->thread_list);
1810
1811         /* Allocate space for ELF notes */
1812         info->notes = kmalloc(8 * sizeof(struct memelfnote), GFP_KERNEL);
1813         if (!info->notes)
1814                 return 0;
1815         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1816         if (!info->psinfo)
1817                 return 0;
1818         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1819         if (!info->prstatus)
1820                 return 0;
1821         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1822         if (!info->fpu)
1823                 return 0;
1824 #ifdef ELF_CORE_COPY_XFPREGS
1825         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1826         if (!info->xfpu)
1827                 return 0;
1828 #endif
1829         return 1;
1830 }
1831
1832 static int fill_note_info(struct elfhdr *elf, int phdrs,
1833                           struct elf_note_info *info,
1834                           const siginfo_t *siginfo, struct pt_regs *regs)
1835 {
1836         struct list_head *t;
1837         struct core_thread *ct;
1838         struct elf_thread_status *ets;
1839
1840         if (!elf_note_info_init(info))
1841                 return 0;
1842
1843         for (ct = current->mm->core_state->dumper.next;
1844                                         ct; ct = ct->next) {
1845                 ets = kzalloc(sizeof(*ets), GFP_KERNEL);
1846                 if (!ets)
1847                         return 0;
1848
1849                 ets->thread = ct->task;
1850                 list_add(&ets->list, &info->thread_list);
1851         }
1852
1853         list_for_each(t, &info->thread_list) {
1854                 int sz;
1855
1856                 ets = list_entry(t, struct elf_thread_status, list);
1857                 sz = elf_dump_thread_status(siginfo->si_signo, ets);
1858                 info->thread_status_size += sz;
1859         }
1860         /* now collect the dump for the current */
1861         memset(info->prstatus, 0, sizeof(*info->prstatus));
1862         fill_prstatus(info->prstatus, current, siginfo->si_signo);
1863         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1864
1865         /* Set up header */
1866         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS);
1867
1868         /*
1869          * Set up the notes in similar form to SVR4 core dumps made
1870          * with info from their /proc.
1871          */
1872
1873         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1874                   sizeof(*info->prstatus), info->prstatus);
1875         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1876         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1877                   sizeof(*info->psinfo), info->psinfo);
1878
1879         fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
1880         fill_auxv_note(info->notes + 3, current->mm);
1881         info->numnote = 4;
1882
1883         if (fill_files_note(info->notes + info->numnote) == 0) {
1884                 info->notes_files = info->notes + info->numnote;
1885                 info->numnote++;
1886         }
1887
1888         /* Try to dump the FPU. */
1889         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1890                                                                info->fpu);
1891         if (info->prstatus->pr_fpvalid)
1892                 fill_note(info->notes + info->numnote++,
1893                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1894 #ifdef ELF_CORE_COPY_XFPREGS
1895         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1896                 fill_note(info->notes + info->numnote++,
1897                           "LINUX", ELF_CORE_XFPREG_TYPE,
1898                           sizeof(*info->xfpu), info->xfpu);
1899 #endif
1900
1901         return 1;
1902 }
1903
1904 static size_t get_note_info_size(struct elf_note_info *info)
1905 {
1906         int sz = 0;
1907         int i;
1908
1909         for (i = 0; i < info->numnote; i++)
1910                 sz += notesize(info->notes + i);
1911
1912         sz += info->thread_status_size;
1913
1914         return sz;
1915 }
1916
1917 static int write_note_info(struct elf_note_info *info,
1918                            struct coredump_params *cprm)
1919 {
1920         int i;
1921         struct list_head *t;
1922
1923         for (i = 0; i < info->numnote; i++)
1924                 if (!writenote(info->notes + i, cprm))
1925                         return 0;
1926
1927         /* write out the thread status notes section */
1928         list_for_each(t, &info->thread_list) {
1929                 struct elf_thread_status *tmp =
1930                                 list_entry(t, struct elf_thread_status, list);
1931
1932                 for (i = 0; i < tmp->num_notes; i++)
1933                         if (!writenote(&tmp->notes[i], cprm))
1934                                 return 0;
1935         }
1936
1937         return 1;
1938 }
1939
1940 static void free_note_info(struct elf_note_info *info)
1941 {
1942         while (!list_empty(&info->thread_list)) {
1943                 struct list_head *tmp = info->thread_list.next;
1944                 list_del(tmp);
1945                 kfree(list_entry(tmp, struct elf_thread_status, list));
1946         }
1947
1948         /* Free data possibly allocated by fill_files_note(): */
1949         if (info->notes_files)
1950                 vfree(info->notes_files->data);
1951
1952         kfree(info->prstatus);
1953         kfree(info->psinfo);
1954         kfree(info->notes);
1955         kfree(info->fpu);
1956 #ifdef ELF_CORE_COPY_XFPREGS
1957         kfree(info->xfpu);
1958 #endif
1959 }
1960
1961 #endif
1962
1963 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1964                                         struct vm_area_struct *gate_vma)
1965 {
1966         struct vm_area_struct *ret = tsk->mm->mmap;
1967
1968         if (ret)
1969                 return ret;
1970         return gate_vma;
1971 }
1972 /*
1973  * Helper function for iterating across a vma list.  It ensures that the caller
1974  * will visit `gate_vma' prior to terminating the search.
1975  */
1976 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1977                                         struct vm_area_struct *gate_vma)
1978 {
1979         struct vm_area_struct *ret;
1980
1981         ret = this_vma->vm_next;
1982         if (ret)
1983                 return ret;
1984         if (this_vma == gate_vma)
1985                 return NULL;
1986         return gate_vma;
1987 }
1988
1989 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
1990                              elf_addr_t e_shoff, int segs)
1991 {
1992         elf->e_shoff = e_shoff;
1993         elf->e_shentsize = sizeof(*shdr4extnum);
1994         elf->e_shnum = 1;
1995         elf->e_shstrndx = SHN_UNDEF;
1996
1997         memset(shdr4extnum, 0, sizeof(*shdr4extnum));
1998
1999         shdr4extnum->sh_type = SHT_NULL;
2000         shdr4extnum->sh_size = elf->e_shnum;
2001         shdr4extnum->sh_link = elf->e_shstrndx;
2002         shdr4extnum->sh_info = segs;
2003 }
2004
2005 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
2006                                      unsigned long mm_flags)
2007 {
2008         struct vm_area_struct *vma;
2009         size_t size = 0;
2010
2011         for (vma = first_vma(current, gate_vma); vma != NULL;
2012              vma = next_vma(vma, gate_vma))
2013                 size += vma_dump_size(vma, mm_flags);
2014         return size;
2015 }
2016
2017 /*
2018  * Actual dumper
2019  *
2020  * This is a two-pass process; first we find the offsets of the bits,
2021  * and then they are actually written out.  If we run out of core limit
2022  * we just truncate.
2023  */
2024 static int elf_core_dump(struct coredump_params *cprm)
2025 {
2026         int has_dumped = 0;
2027         mm_segment_t fs;
2028         int segs;
2029         struct vm_area_struct *vma, *gate_vma;
2030         struct elfhdr *elf = NULL;
2031         loff_t offset = 0, dataoff;
2032         struct elf_note_info info = { };
2033         struct elf_phdr *phdr4note = NULL;
2034         struct elf_shdr *shdr4extnum = NULL;
2035         Elf_Half e_phnum;
2036         elf_addr_t e_shoff;
2037
2038         /*
2039          * We no longer stop all VM operations.
2040          *
2041          * This is because those proceses that could possibly change map_count
2042          * or the mmap / vma pages are now blocked in do_exit on current
2043          * finishing this core dump.
2044          *
2045          * Only ptrace can touch these memory addresses, but it doesn't change
2046          * the map_count or the pages allocated. So no possibility of crashing
2047          * exists while dumping the mm->vm_next areas to the core file.
2048          */
2049
2050         /* alloc memory for large data structures: too large to be on stack */
2051         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
2052         if (!elf)
2053                 goto out;
2054         /*
2055          * The number of segs are recored into ELF header as 16bit value.
2056          * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2057          */
2058         segs = current->mm->map_count;
2059         segs += elf_core_extra_phdrs();
2060
2061         gate_vma = get_gate_vma(current->mm);
2062         if (gate_vma != NULL)
2063                 segs++;
2064
2065         /* for notes section */
2066         segs++;
2067
2068         /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2069          * this, kernel supports extended numbering. Have a look at
2070          * include/linux/elf.h for further information. */
2071         e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2072
2073         /*
2074          * Collect all the non-memory information about the process for the
2075          * notes.  This also sets up the file header.
2076          */
2077         if (!fill_note_info(elf, e_phnum, &info, cprm->siginfo, cprm->regs))
2078                 goto cleanup;
2079
2080         has_dumped = 1;
2081
2082         fs = get_fs();
2083         set_fs(KERNEL_DS);
2084
2085         offset += sizeof(*elf);                         /* Elf header */
2086         offset += segs * sizeof(struct elf_phdr);       /* Program headers */
2087
2088         /* Write notes phdr entry */
2089         {
2090                 size_t sz = get_note_info_size(&info);
2091
2092                 sz += elf_coredump_extra_notes_size();
2093
2094                 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
2095                 if (!phdr4note)
2096                         goto end_coredump;
2097
2098                 fill_elf_note_phdr(phdr4note, sz, offset);
2099                 offset += sz;
2100         }
2101
2102         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2103
2104         offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
2105         offset += elf_core_extra_data_size();
2106         e_shoff = offset;
2107
2108         if (e_phnum == PN_XNUM) {
2109                 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2110                 if (!shdr4extnum)
2111                         goto end_coredump;
2112                 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2113         }
2114
2115         offset = dataoff;
2116
2117         if (!dump_emit(cprm, elf, sizeof(*elf)))
2118                 goto end_coredump;
2119
2120         if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
2121                 goto end_coredump;
2122
2123         /* Write program headers for segments dump */
2124         for (vma = first_vma(current, gate_vma); vma != NULL;
2125                         vma = next_vma(vma, gate_vma)) {
2126                 struct elf_phdr phdr;
2127
2128                 phdr.p_type = PT_LOAD;
2129                 phdr.p_offset = offset;
2130                 phdr.p_vaddr = vma->vm_start;
2131                 phdr.p_paddr = 0;
2132                 phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
2133                 phdr.p_memsz = vma->vm_end - vma->vm_start;
2134                 offset += phdr.p_filesz;
2135                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2136                 if (vma->vm_flags & VM_WRITE)
2137                         phdr.p_flags |= PF_W;
2138                 if (vma->vm_flags & VM_EXEC)
2139                         phdr.p_flags |= PF_X;
2140                 phdr.p_align = ELF_EXEC_PAGESIZE;
2141
2142                 if (!dump_emit(cprm, &phdr, sizeof(phdr)))
2143                         goto end_coredump;
2144         }
2145
2146         if (!elf_core_write_extra_phdrs(cprm, offset))
2147                 goto end_coredump;
2148
2149         /* write out the notes section */
2150         if (!write_note_info(&info, cprm))
2151                 goto end_coredump;
2152
2153         if (elf_coredump_extra_notes_write(cprm))
2154                 goto end_coredump;
2155
2156         /* Align to page */
2157         if (!dump_skip(cprm, dataoff - cprm->written))
2158                 goto end_coredump;
2159
2160         for (vma = first_vma(current, gate_vma); vma != NULL;
2161                         vma = next_vma(vma, gate_vma)) {
2162                 unsigned long addr;
2163                 unsigned long end;
2164
2165                 end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
2166
2167                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2168                         struct page *page;
2169                         int stop;
2170
2171                         page = get_dump_page(addr);
2172                         if (page) {
2173                                 void *kaddr = kmap(page);
2174                                 stop = !dump_emit(cprm, kaddr, PAGE_SIZE);
2175                                 kunmap(page);
2176                                 page_cache_release(page);
2177                         } else
2178                                 stop = !dump_skip(cprm, PAGE_SIZE);
2179                         if (stop)
2180                                 goto end_coredump;
2181                 }
2182         }
2183
2184         if (!elf_core_write_extra_data(cprm))
2185                 goto end_coredump;
2186
2187         if (e_phnum == PN_XNUM) {
2188                 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
2189                         goto end_coredump;
2190         }
2191
2192 end_coredump:
2193         set_fs(fs);
2194
2195 cleanup:
2196         free_note_info(&info);
2197         kfree(shdr4extnum);
2198         kfree(phdr4note);
2199         kfree(elf);
2200 out:
2201         return has_dumped;
2202 }
2203
2204 #endif          /* CONFIG_ELF_CORE */
2205
2206 static int __init init_elf_binfmt(void)
2207 {
2208         register_binfmt(&elf_format);
2209         return 0;
2210 }
2211
2212 static void __exit exit_elf_binfmt(void)
2213 {
2214         /* Remove the COFF and ELF loaders. */
2215         unregister_binfmt(&elf_format);
2216 }
2217
2218 core_initcall(init_elf_binfmt);
2219 module_exit(exit_elf_binfmt);
2220 MODULE_LICENSE("GPL");