projects/linux·blob master · refs

2146 lines · 57.1 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * linux/fs/binfmt_elf.c
4 *
5 * These are the functions used to load ELF format executables as used
6 * on SVr4 machines. Information on the format may be found in the book
7 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
8 * Tools".
9 *
10 * Copyright 1993, 1994: Eric Youngdale ([email protected]).
11 */
12
13#include <linux/module.h>
14#include <linux/kernel.h>
15#include <linux/fs.h>
16#include <linux/log2.h>
17#include <linux/mm.h>
18#include <linux/mman.h>
19#include <linux/errno.h>
20#include <linux/signal.h>
21#include <linux/binfmts.h>
22#include <linux/string.h>
23#include <linux/file.h>
24#include <linux/slab.h>
25#include <linux/personality.h>
26#include <linux/elfcore.h>
27#include <linux/init.h>
28#include <linux/highuid.h>
29#include <linux/compiler.h>
30#include <linux/highmem.h>
31#include <linux/hugetlb.h>
32#include <linux/pagemap.h>
33#include <linux/vmalloc.h>
34#include <linux/security.h>
35#include <linux/random.h>
36#include <linux/elf.h>
37#include <linux/elf-randomize.h>
38#include <linux/utsname.h>
39#include <linux/coredump.h>
40#include <linux/sched.h>
41#include <linux/sched/coredump.h>
42#include <linux/sched/task_stack.h>
43#include <linux/sched/cputime.h>
44#include <linux/sizes.h>
45#include <linux/types.h>
46#include <linux/cred.h>
47#include <linux/dax.h>
48#include <linux/uaccess.h>
49#include <uapi/linux/rseq.h>
50#include <linux/rseq.h>
51#include <asm/param.h>
52#include <asm/page.h>
53
54#ifndef ELF_COMPAT
55#define ELF_COMPAT 0
56#endif
57
58#ifndef user_long_t
59#define user_long_t long
60#endif
61#ifndef user_siginfo_t
62#define user_siginfo_t siginfo_t
63#endif
64
65/* That's for binfmt_elf_fdpic to deal with */
66#ifndef elf_check_fdpic
67#define elf_check_fdpic(ex) false
68#endif
69
70static int load_elf_binary(struct linux_binprm *bprm);
71
72/*
73 * If we don't support core dumping, then supply a NULL so we
74 * don't even try.
75 */
76#ifdef CONFIG_ELF_CORE
77static bool elf_core_dump(struct coredump_params *cprm);
78#else
79#define elf_core_dump NULL
80#endif
81
82#if ELF_EXEC_PAGESIZE > PAGE_SIZE
83#define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
84#else
85#define ELF_MIN_ALIGN PAGE_SIZE
86#endif
87
88#ifndef ELF_CORE_EFLAGS
89#define ELF_CORE_EFLAGS 0
90#endif
91
92#define ELF_PAGESTART(_v) ((_v) & ~(int)(ELF_MIN_ALIGN-1))
93#define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
94#define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
95
96static struct linux_binfmt elf_format = {
97 .module = THIS_MODULE,
98 .load_binary = load_elf_binary,
99#ifdef CONFIG_COREDUMP
100 .core_dump = elf_core_dump,
101 .min_coredump = ELF_EXEC_PAGESIZE,
102#endif
103};
104
105#define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE))
106
107static inline void elf_coredump_set_mm_eflags(struct mm_struct *mm, u32 flags)
108{
109#ifdef CONFIG_ARCH_HAS_ELF_CORE_EFLAGS
110 mm->saved_e_flags = flags;
111#endif
112}
113
114static inline u32 elf_coredump_get_mm_eflags(struct mm_struct *mm, u32 flags)
115{
116#ifdef CONFIG_ARCH_HAS_ELF_CORE_EFLAGS
117 flags = mm->saved_e_flags;
118#endif
119 return flags;
120}
121
122/*
123 * We need to explicitly zero any trailing portion of the page that follows
124 * p_filesz when it ends before the page ends (e.g. bss), otherwise this
125 * memory will contain the junk from the file that should not be present.
126 */
127static int padzero(unsigned long address)
128{
129 unsigned long nbyte;
130
131 nbyte = ELF_PAGEOFFSET(address);
132 if (nbyte) {
133 nbyte = ELF_MIN_ALIGN - nbyte;
134 if (clear_user((void __user *)address, nbyte))
135 return -EFAULT;
136 }
137 return 0;
138}
139
140/* Let's use some macros to make this stack manipulation a little clearer */
141#ifdef CONFIG_STACK_GROWSUP
142#define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
143#define STACK_ROUND(sp, items) \
144 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
145#define STACK_ALLOC(sp, len) ({ \
146 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
147 old_sp; })
148#else
149#define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
150#define STACK_ROUND(sp, items) \
151 (((unsigned long) (sp - items)) &~ 15UL)
152#define STACK_ALLOC(sp, len) (sp -= len)
153#endif
154
155#ifndef ELF_BASE_PLATFORM
156/*
157 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
158 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
159 * will be copied to the user stack in the same manner as AT_PLATFORM.
160 */
161#define ELF_BASE_PLATFORM NULL
162#endif
163
164static int
165create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
166 unsigned long interp_load_addr,
167 unsigned long e_entry, unsigned long phdr_addr)
168{
169 struct mm_struct *mm = current->mm;
170 unsigned long p = bprm->p;
171 int argc = bprm->argc;
172 int envc = bprm->envc;
173 elf_addr_t __user *sp;
174 elf_addr_t __user *u_platform;
175 elf_addr_t __user *u_base_platform;
176 elf_addr_t __user *u_rand_bytes;
177 const char *k_platform = ELF_PLATFORM;
178 const char *k_base_platform = ELF_BASE_PLATFORM;
179 unsigned char k_rand_bytes[16];
180 int items;
181 elf_addr_t *elf_info;
182 int ei_index;
183 const struct cred *cred = current_cred();
184 struct vm_area_struct *vma;
185
186 /*
187 * In some cases (e.g. Hyper-Threading), we want to avoid L1
188 * evictions by the processes running on the same package. One
189 * thing we can do is to shuffle the initial stack for them.
190 */
191
192 p = arch_align_stack(p);
193
194 /*
195 * If this architecture has a platform capability string, copy it
196 * to userspace. In some cases (Sparc), this info is impossible
197 * for userspace to get any other way, in others (i386) it is
198 * merely difficult.
199 */
200 u_platform = NULL;
201 if (k_platform) {
202 size_t len = strlen(k_platform) + 1;
203
204 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
205 if (copy_to_user(u_platform, k_platform, len))
206 return -EFAULT;
207 }
208
209 /*
210 * If this architecture has a "base" platform capability
211 * string, copy it to userspace.
212 */
213 u_base_platform = NULL;
214 if (k_base_platform) {
215 size_t len = strlen(k_base_platform) + 1;
216
217 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
218 if (copy_to_user(u_base_platform, k_base_platform, len))
219 return -EFAULT;
220 }
221
222 /*
223 * Generate 16 random bytes for userspace PRNG seeding.
224 */
225 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
226 u_rand_bytes = (elf_addr_t __user *)
227 STACK_ALLOC(p, sizeof(k_rand_bytes));
228 if (copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
229 return -EFAULT;
230
231 /* Create the ELF interpreter info */
232 elf_info = (elf_addr_t *)mm->saved_auxv;
233 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
234#define NEW_AUX_ENT(id, val) \
235 do { \
236 *elf_info++ = id; \
237 *elf_info++ = val; \
238 } while (0)
239
240#ifdef ARCH_DLINFO
241 /*
242 * ARCH_DLINFO must come first so PPC can do its special alignment of
243 * AUXV.
244 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
245 * ARCH_DLINFO changes
246 */
247 ARCH_DLINFO;
248#endif
249 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
250 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
251 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
252 NEW_AUX_ENT(AT_PHDR, phdr_addr);
253 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
254 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
255 NEW_AUX_ENT(AT_BASE, interp_load_addr);
256 NEW_AUX_ENT(AT_FLAGS, bprm_at_flags(bprm));
257 NEW_AUX_ENT(AT_ENTRY, e_entry);
258 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
259 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
260 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
261 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
262 NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
263 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
264#ifdef ELF_HWCAP2
265 NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
266#endif
267#ifdef ELF_HWCAP3
268 NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3);
269#endif
270#ifdef ELF_HWCAP4
271 NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4);
272#endif
273 NEW_AUX_ENT(AT_EXECFN, bprm->exec);
274 if (k_platform) {
275 NEW_AUX_ENT(AT_PLATFORM,
276 (elf_addr_t)(unsigned long)u_platform);
277 }
278 if (k_base_platform) {
279 NEW_AUX_ENT(AT_BASE_PLATFORM,
280 (elf_addr_t)(unsigned long)u_base_platform);
281 }
282 if (bprm->have_execfd) {
283 NEW_AUX_ENT(AT_EXECFD, bprm->execfd);
284 }
285#ifdef CONFIG_RSEQ
286 NEW_AUX_ENT(AT_RSEQ_FEATURE_SIZE, offsetof(struct rseq, end));
287 NEW_AUX_ENT(AT_RSEQ_ALIGN, rseq_alloc_align());
288#endif
289#undef NEW_AUX_ENT
290 /* AT_NULL is zero; clear the rest too */
291 memset(elf_info, 0, (char *)mm->saved_auxv +
292 sizeof(mm->saved_auxv) - (char *)elf_info);
293
294 /* And advance past the AT_NULL entry. */
295 elf_info += 2;
296
297 ei_index = elf_info - (elf_addr_t *)mm->saved_auxv;
298 sp = STACK_ADD(p, ei_index);
299
300 items = (argc + 1) + (envc + 1) + 1;
301 bprm->p = STACK_ROUND(sp, items);
302
303 /* Point sp at the lowest address on the stack */
304#ifdef CONFIG_STACK_GROWSUP
305 sp = (elf_addr_t __user *)bprm->p - items - ei_index;
306 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
307#else
308 sp = (elf_addr_t __user *)bprm->p;
309#endif
310
311
312 /*
313 * Grow the stack manually; some architectures have a limit on how
314 * far ahead a user-space access may be in order to grow the stack.
315 */
316 if (mmap_write_lock_killable(mm))
317 return -EINTR;
318 vma = find_extend_vma_locked(mm, bprm->p);
319 mmap_write_unlock(mm);
320 if (!vma)
321 return -EFAULT;
322
323 /* Now, let's put argc (and argv, envp if appropriate) on the stack */
324 if (put_user(argc, sp++))
325 return -EFAULT;
326
327 /* Populate list of argv pointers back to argv strings. */
328 p = mm->arg_end = mm->arg_start;
329 while (argc-- > 0) {
330 size_t len;
331 if (put_user((elf_addr_t)p, sp++))
332 return -EFAULT;
333 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
334 if (!len || len > MAX_ARG_STRLEN)
335 return -EINVAL;
336 p += len;
337 }
338 if (put_user(0, sp++))
339 return -EFAULT;
340 mm->arg_end = p;
341
342 /* Populate list of envp pointers back to envp strings. */
343 mm->env_end = mm->env_start = p;
344 while (envc-- > 0) {
345 size_t len;
346 if (put_user((elf_addr_t)p, sp++))
347 return -EFAULT;
348 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
349 if (!len || len > MAX_ARG_STRLEN)
350 return -EINVAL;
351 p += len;
352 }
353 if (put_user(0, sp++))
354 return -EFAULT;
355 mm->env_end = p;
356
357 /* Put the elf_info on the stack in the right place. */
358 if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t)))
359 return -EFAULT;
360 return 0;
361}
362
363/*
364 * Map "eppnt->p_filesz" bytes from "filep" offset "eppnt->p_offset"
365 * into memory at "addr". (Note that p_filesz is rounded up to the
366 * next page, so any extra bytes from the file must be wiped.)
367 */
368static unsigned long elf_map(struct file *filep, unsigned long addr,
369 const struct elf_phdr *eppnt, int prot, int type,
370 unsigned long total_size)
371{
372 unsigned long map_addr;
373 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
374 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
375 addr = ELF_PAGESTART(addr);
376 size = ELF_PAGEALIGN(size);
377
378 /* mmap() will return -EINVAL if given a zero size, but a
379 * segment with zero filesize is perfectly valid */
380 if (!size)
381 return addr;
382
383 /*
384 * total_size is the size of the ELF (interpreter) image.
385 * The _first_ mmap needs to know the full size, otherwise
386 * randomization might put this image into an overlapping
387 * position with the ELF binary image. (since size < total_size)
388 * So we first map the 'big' image - and unmap the remainder at
389 * the end. (which unmap is needed for ELF images with holes.)
390 */
391 if (total_size) {
392 total_size = ELF_PAGEALIGN(total_size);
393 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
394 if (!BAD_ADDR(map_addr))
395 vm_munmap(map_addr+size, total_size-size);
396 } else
397 map_addr = vm_mmap(filep, addr, size, prot, type, off);
398
399 if ((type & MAP_FIXED_NOREPLACE) &&
400 PTR_ERR((void *)map_addr) == -EEXIST)
401 pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n",
402 task_pid_nr(current), current->comm, (void *)addr);
403
404 return(map_addr);
405}
406
407/*
408 * Map "eppnt->p_filesz" bytes from "filep" offset "eppnt->p_offset"
409 * into memory at "addr". Memory from "p_filesz" through "p_memsz"
410 * rounded up to the next page is zeroed.
411 */
412static unsigned long elf_load(struct file *filep, unsigned long addr,
413 const struct elf_phdr *eppnt, int prot, int type,
414 unsigned long total_size)
415{
416 unsigned long zero_start, zero_end;
417 unsigned long map_addr;
418
419 if (eppnt->p_filesz) {
420 map_addr = elf_map(filep, addr, eppnt, prot, type, total_size);
421 if (BAD_ADDR(map_addr))
422 return map_addr;
423 if (eppnt->p_memsz > eppnt->p_filesz) {
424 zero_start = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) +
425 eppnt->p_filesz;
426 zero_end = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) +
427 eppnt->p_memsz;
428
429 /*
430 * Zero the end of the last mapped page but ignore
431 * any errors if the segment isn't writable.
432 */
433 if (padzero(zero_start) && (prot & PROT_WRITE))
434 return -EFAULT;
435 }
436 } else {
437 map_addr = zero_start = ELF_PAGESTART(addr);
438 zero_end = zero_start + ELF_PAGEOFFSET(eppnt->p_vaddr) +
439 eppnt->p_memsz;
440 }
441 if (eppnt->p_memsz > eppnt->p_filesz) {
442 /*
443 * Map the last of the segment.
444 * If the header is requesting these pages to be
445 * executable, honour that (ppc32 needs this).
446 */
447 int error;
448
449 zero_start = ELF_PAGEALIGN(zero_start);
450 zero_end = ELF_PAGEALIGN(zero_end);
451
452 error = vm_brk_flags(zero_start, zero_end - zero_start,
453 prot & PROT_EXEC);
454 if (error)
455 map_addr = error;
456 }
457 return map_addr;
458}
459
460static unsigned long total_mapping_size(const struct elf_phdr *phdr, int nr)
461{
462 elf_addr_t min_addr = -1;
463 elf_addr_t max_addr = 0;
464 bool pt_load = false;
465 int i;
466
467 for (i = 0; i < nr; i++) {
468 if (phdr[i].p_type == PT_LOAD) {
469 min_addr = min(min_addr, ELF_PAGESTART(phdr[i].p_vaddr));
470 max_addr = max(max_addr, phdr[i].p_vaddr + phdr[i].p_memsz);
471 pt_load = true;
472 }
473 }
474 return pt_load ? (max_addr - min_addr) : 0;
475}
476
477static int elf_read(struct file *file, void *buf, size_t len, loff_t pos)
478{
479 ssize_t rv;
480
481 rv = kernel_read(file, buf, len, &pos);
482 if (unlikely(rv != len)) {
483 return (rv < 0) ? rv : -EIO;
484 }
485 return 0;
486}
487
488static unsigned long maximum_alignment(struct elf_phdr *cmds, int nr)
489{
490 unsigned long alignment = 0;
491 int i;
492
493 for (i = 0; i < nr; i++) {
494 if (cmds[i].p_type == PT_LOAD) {
495 unsigned long p_align = cmds[i].p_align;
496
497 /* skip non-power of two alignments as invalid */
498 if (!is_power_of_2(p_align))
499 continue;
500 alignment = max(alignment, p_align);
501 }
502 }
503
504 /* ensure we align to at least one page */
505 return ELF_PAGEALIGN(alignment);
506}
507
508/**
509 * load_elf_phdrs() - load ELF program headers
510 * @elf_ex: ELF header of the binary whose program headers should be loaded
511 * @elf_file: the opened ELF binary file
512 *
513 * Loads ELF program headers from the binary file elf_file, which has the ELF
514 * header pointed to by elf_ex, into a newly allocated array. The caller is
515 * responsible for freeing the allocated data. Returns NULL upon failure.
516 */
517static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
518 struct file *elf_file)
519{
520 struct elf_phdr *elf_phdata = NULL;
521 int retval = -1;
522 unsigned int size;
523
524 /*
525 * If the size of this structure has changed, then punt, since
526 * we will be doing the wrong thing.
527 */
528 if (elf_ex->e_phentsize != sizeof(struct elf_phdr))
529 goto out;
530
531 /* Sanity check the number of program headers... */
532 /* ...and their total size. */
533 size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
534 if (size == 0 || size > 65536)
535 goto out;
536
537 elf_phdata = kmalloc(size, GFP_KERNEL);
538 if (!elf_phdata)
539 goto out;
540
541 /* Read in the program headers */
542 retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff);
543
544out:
545 if (retval) {
546 kfree(elf_phdata);
547 elf_phdata = NULL;
548 }
549 return elf_phdata;
550}
551
552#ifndef CONFIG_ARCH_BINFMT_ELF_STATE
553
554/**
555 * struct arch_elf_state - arch-specific ELF loading state
556 *
557 * This structure is used to preserve architecture specific data during
558 * the loading of an ELF file, throughout the checking of architecture
559 * specific ELF headers & through to the point where the ELF load is
560 * known to be proceeding (ie. SET_PERSONALITY).
561 *
562 * This implementation is a dummy for architectures which require no
563 * specific state.
564 */
565struct arch_elf_state {
566};
567
568#define INIT_ARCH_ELF_STATE {}
569
570/**
571 * arch_elf_pt_proc() - check a PT_LOPROC..PT_HIPROC ELF program header
572 * @ehdr: The main ELF header
573 * @phdr: The program header to check
574 * @elf: The open ELF file
575 * @is_interp: True if the phdr is from the interpreter of the ELF being
576 * loaded, else false.
577 * @state: Architecture-specific state preserved throughout the process
578 * of loading the ELF.
579 *
580 * Inspects the program header phdr to validate its correctness and/or
581 * suitability for the system. Called once per ELF program header in the
582 * range PT_LOPROC to PT_HIPROC, for both the ELF being loaded and its
583 * interpreter.
584 *
585 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
586 * with that return code.
587 */
588static inline int arch_elf_pt_proc(struct elfhdr *ehdr,
589 struct elf_phdr *phdr,
590 struct file *elf, bool is_interp,
591 struct arch_elf_state *state)
592{
593 /* Dummy implementation, always proceed */
594 return 0;
595}
596
597/**
598 * arch_check_elf() - check an ELF executable
599 * @ehdr: The main ELF header
600 * @has_interp: True if the ELF has an interpreter, else false.
601 * @interp_ehdr: The interpreter's ELF header
602 * @state: Architecture-specific state preserved throughout the process
603 * of loading the ELF.
604 *
605 * Provides a final opportunity for architecture code to reject the loading
606 * of the ELF & cause an exec syscall to return an error. This is called after
607 * all program headers to be checked by arch_elf_pt_proc have been.
608 *
609 * Return: Zero to proceed with the ELF load, non-zero to fail the ELF load
610 * with that return code.
611 */
612static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp,
613 struct elfhdr *interp_ehdr,
614 struct arch_elf_state *state)
615{
616 /* Dummy implementation, always proceed */
617 return 0;
618}
619
620#endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */
621
622static inline int make_prot(u32 p_flags, struct arch_elf_state *arch_state,
623 bool has_interp, bool is_interp)
624{
625 int prot = 0;
626
627 if (p_flags & PF_R)
628 prot |= PROT_READ;
629 if (p_flags & PF_W)
630 prot |= PROT_WRITE;
631 if (p_flags & PF_X)
632 prot |= PROT_EXEC;
633
634 return arch_elf_adjust_prot(prot, arch_state, has_interp, is_interp);
635}
636
637/* This is much more generalized than the library routine read function,
638 so we keep this separate. Technically the library read function
639 is only provided so that we can read a.out libraries that have
640 an ELF header */
641
642static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
643 struct file *interpreter,
644 unsigned long no_base, struct elf_phdr *interp_elf_phdata,
645 struct arch_elf_state *arch_state)
646{
647 struct elf_phdr *eppnt;
648 unsigned long load_addr = 0;
649 int load_addr_set = 0;
650 unsigned long error = ~0UL;
651 unsigned long total_size;
652 int i;
653
654 /* First of all, some simple consistency checks */
655 if (interp_elf_ex->e_type != ET_EXEC &&
656 interp_elf_ex->e_type != ET_DYN)
657 goto out;
658 if (!elf_check_arch(interp_elf_ex) ||
659 elf_check_fdpic(interp_elf_ex))
660 goto out;
661 if (!can_mmap_file(interpreter))
662 goto out;
663
664 total_size = total_mapping_size(interp_elf_phdata,
665 interp_elf_ex->e_phnum);
666 if (!total_size) {
667 error = -EINVAL;
668 goto out;
669 }
670
671 eppnt = interp_elf_phdata;
672 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
673 if (eppnt->p_type == PT_LOAD) {
674 int elf_type = MAP_PRIVATE;
675 int elf_prot = make_prot(eppnt->p_flags, arch_state,
676 true, true);
677 unsigned long vaddr = 0;
678 unsigned long k, map_addr;
679
680 vaddr = eppnt->p_vaddr;
681 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
682 elf_type |= MAP_FIXED;
683 else if (no_base && interp_elf_ex->e_type == ET_DYN)
684 load_addr = -vaddr;
685
686 map_addr = elf_load(interpreter, load_addr + vaddr,
687 eppnt, elf_prot, elf_type, total_size);
688 total_size = 0;
689 error = map_addr;
690 if (BAD_ADDR(map_addr))
691 goto out;
692
693 if (!load_addr_set &&
694 interp_elf_ex->e_type == ET_DYN) {
695 load_addr = map_addr - ELF_PAGESTART(vaddr);
696 load_addr_set = 1;
697 }
698
699 /*
700 * Check to see if the section's size will overflow the
701 * allowed task size. Note that p_filesz must always be
702 * <= p_memsize so it's only necessary to check p_memsz.
703 */
704 k = load_addr + eppnt->p_vaddr;
705 if (BAD_ADDR(k) ||
706 eppnt->p_filesz > eppnt->p_memsz ||
707 eppnt->p_memsz > TASK_SIZE ||
708 TASK_SIZE - eppnt->p_memsz < k) {
709 error = -ENOMEM;
710 goto out;
711 }
712 }
713 }
714
715 error = load_addr;
716out:
717 return error;
718}
719
720/*
721 * These are the functions used to load ELF style executables and shared
722 * libraries. There is no binary dependent code anywhere else.
723 */
724
725static int parse_elf_property(const char *data, size_t *off, size_t datasz,
726 struct arch_elf_state *arch,
727 bool have_prev_type, u32 *prev_type)
728{
729 size_t o, step;
730 const struct gnu_property *pr;
731 int ret;
732
733 if (*off == datasz)
734 return -ENOENT;
735
736 if (WARN_ON_ONCE(*off > datasz || *off % ELF_GNU_PROPERTY_ALIGN))
737 return -EIO;
738 o = *off;
739 datasz -= *off;
740
741 if (datasz < sizeof(*pr))
742 return -ENOEXEC;
743 pr = (const struct gnu_property *)(data + o);
744 o += sizeof(*pr);
745 datasz -= sizeof(*pr);
746
747 if (pr->pr_datasz > datasz)
748 return -ENOEXEC;
749
750 WARN_ON_ONCE(o % ELF_GNU_PROPERTY_ALIGN);
751 step = round_up(pr->pr_datasz, ELF_GNU_PROPERTY_ALIGN);
752 if (step > datasz)
753 return -ENOEXEC;
754
755 /* Properties are supposed to be unique and sorted on pr_type: */
756 if (have_prev_type && pr->pr_type <= *prev_type)
757 return -ENOEXEC;
758 *prev_type = pr->pr_type;
759
760 ret = arch_parse_elf_property(pr->pr_type, data + o,
761 pr->pr_datasz, ELF_COMPAT, arch);
762 if (ret)
763 return ret;
764
765 *off = o + step;
766 return 0;
767}
768
769#define NOTE_DATA_SZ SZ_1K
770#define NOTE_NAME_SZ (sizeof(NN_GNU_PROPERTY_TYPE_0))
771
772static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr,
773 struct arch_elf_state *arch)
774{
775 union {
776 struct elf_note nhdr;
777 char data[NOTE_DATA_SZ];
778 } note;
779 loff_t pos;
780 ssize_t n;
781 size_t off, datasz;
782 int ret;
783 bool have_prev_type;
784 u32 prev_type;
785
786 if (!IS_ENABLED(CONFIG_ARCH_USE_GNU_PROPERTY) || !phdr)
787 return 0;
788
789 /* load_elf_binary() shouldn't call us unless this is true... */
790 if (WARN_ON_ONCE(phdr->p_type != PT_GNU_PROPERTY))
791 return -ENOEXEC;
792
793 /* If the properties are crazy large, that's too bad (for now): */
794 if (phdr->p_filesz > sizeof(note))
795 return -ENOEXEC;
796
797 pos = phdr->p_offset;
798 n = kernel_read(f, &note, phdr->p_filesz, &pos);
799
800 BUILD_BUG_ON(sizeof(note) < sizeof(note.nhdr) + NOTE_NAME_SZ);
801 if (n < 0 || n < sizeof(note.nhdr) + NOTE_NAME_SZ)
802 return -EIO;
803
804 if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 ||
805 note.nhdr.n_namesz != NOTE_NAME_SZ ||
806 strncmp(note.data + sizeof(note.nhdr),
807 NN_GNU_PROPERTY_TYPE_0, n - sizeof(note.nhdr)))
808 return -ENOEXEC;
809
810 off = round_up(sizeof(note.nhdr) + NOTE_NAME_SZ,
811 ELF_GNU_PROPERTY_ALIGN);
812 if (off > n)
813 return -ENOEXEC;
814
815 if (note.nhdr.n_descsz > n - off)
816 return -ENOEXEC;
817 datasz = off + note.nhdr.n_descsz;
818
819 have_prev_type = false;
820 do {
821 ret = parse_elf_property(note.data, &off, datasz, arch,
822 have_prev_type, &prev_type);
823 have_prev_type = true;
824 } while (!ret);
825
826 return ret == -ENOENT ? 0 : ret;
827}
828
829static int load_elf_binary(struct linux_binprm *bprm)
830{
831 struct file *interpreter = NULL; /* to shut gcc up */
832 unsigned long load_bias = 0, phdr_addr = 0;
833 int first_pt_load = 1;
834 unsigned long error;
835 struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
836 struct elf_phdr *elf_property_phdata = NULL;
837 unsigned long elf_brk;
838 bool brk_moved = false;
839 int retval, i;
840 unsigned long elf_entry;
841 unsigned long e_entry;
842 unsigned long interp_load_addr = 0;
843 unsigned long start_code, end_code, start_data, end_data;
844 unsigned long reloc_func_desc __maybe_unused = 0;
845 int executable_stack = EXSTACK_DEFAULT;
846 struct elfhdr *elf_ex = (struct elfhdr *)bprm->buf;
847 struct elfhdr *interp_elf_ex = NULL;
848 struct arch_elf_state arch_state = INIT_ARCH_ELF_STATE;
849 struct mm_struct *mm;
850 struct pt_regs *regs;
851
852 retval = -ENOEXEC;
853 /* First of all, some simple consistency checks */
854 if (memcmp(elf_ex->e_ident, ELFMAG, SELFMAG) != 0)
855 goto out;
856
857 if (elf_ex->e_type != ET_EXEC && elf_ex->e_type != ET_DYN)
858 goto out;
859 if (!elf_check_arch(elf_ex))
860 goto out;
861 if (elf_check_fdpic(elf_ex))
862 goto out;
863 if (!can_mmap_file(bprm->file))
864 goto out;
865
866 elf_phdata = load_elf_phdrs(elf_ex, bprm->file);
867 if (!elf_phdata)
868 goto out;
869
870 elf_ppnt = elf_phdata;
871 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) {
872 char *elf_interpreter;
873
874 if (elf_ppnt->p_type == PT_GNU_PROPERTY) {
875 elf_property_phdata = elf_ppnt;
876 continue;
877 }
878
879 if (elf_ppnt->p_type != PT_INTERP)
880 continue;
881
882 /*
883 * This is the program interpreter used for shared libraries -
884 * for now assume that this is an a.out format binary.
885 */
886 retval = -ENOEXEC;
887 if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2)
888 goto out_free_ph;
889
890 retval = -ENOMEM;
891 elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL);
892 if (!elf_interpreter)
893 goto out_free_ph;
894
895 retval = elf_read(bprm->file, elf_interpreter, elf_ppnt->p_filesz,
896 elf_ppnt->p_offset);
897 if (retval < 0)
898 goto out_free_interp;
899 /* make sure path is NULL terminated */
900 retval = -ENOEXEC;
901 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
902 goto out_free_interp;
903
904 interpreter = bprm_open_interpreter(bprm, elf_interpreter);
905 kfree(elf_interpreter);
906 retval = PTR_ERR(interpreter);
907 if (IS_ERR(interpreter))
908 goto out_free_ph;
909
910 /*
911 * If the binary is not readable then enforce mm->dumpable = 0
912 * regardless of the interpreter's permissions.
913 */
914 would_dump(bprm, interpreter);
915
916 interp_elf_ex = kmalloc_obj(*interp_elf_ex);
917 if (!interp_elf_ex) {
918 retval = -ENOMEM;
919 goto out_free_file;
920 }
921
922 /* Get the exec headers */
923 retval = elf_read(interpreter, interp_elf_ex,
924 sizeof(*interp_elf_ex), 0);
925 if (retval < 0)
926 goto out_free_dentry;
927
928 break;
929
930out_free_interp:
931 kfree(elf_interpreter);
932 goto out_free_ph;
933 }
934
935 /* No PT_INTERP to substitute for: the override does not apply. */
936 bprm_drop_loader(bprm);
937
938 elf_ppnt = elf_phdata;
939 for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++)
940 switch (elf_ppnt->p_type) {
941 case PT_GNU_STACK:
942 if (elf_ppnt->p_flags & PF_X)
943 executable_stack = EXSTACK_ENABLE_X;
944 else
945 executable_stack = EXSTACK_DISABLE_X;
946 break;
947
948 case PT_LOPROC ... PT_HIPROC:
949 retval = arch_elf_pt_proc(elf_ex, elf_ppnt,
950 bprm->file, false,
951 &arch_state);
952 if (retval)
953 goto out_free_dentry;
954 break;
955 }
956
957 /* Some simple consistency checks for the interpreter */
958 if (interpreter) {
959 retval = -ELIBBAD;
960 /* Not an ELF interpreter */
961 if (memcmp(interp_elf_ex->e_ident, ELFMAG, SELFMAG) != 0)
962 goto out_free_dentry;
963 /* Verify the interpreter has a valid arch */
964 if (!elf_check_arch(interp_elf_ex) ||
965 elf_check_fdpic(interp_elf_ex))
966 goto out_free_dentry;
967
968 /* Load the interpreter program headers */
969 interp_elf_phdata = load_elf_phdrs(interp_elf_ex,
970 interpreter);
971 if (!interp_elf_phdata)
972 goto out_free_dentry;
973
974 /* Pass PT_LOPROC..PT_HIPROC headers to arch code */
975 elf_property_phdata = NULL;
976 elf_ppnt = interp_elf_phdata;
977 for (i = 0; i < interp_elf_ex->e_phnum; i++, elf_ppnt++)
978 switch (elf_ppnt->p_type) {
979 case PT_GNU_PROPERTY:
980 elf_property_phdata = elf_ppnt;
981 break;
982
983 case PT_LOPROC ... PT_HIPROC:
984 retval = arch_elf_pt_proc(interp_elf_ex,
985 elf_ppnt, interpreter,
986 true, &arch_state);
987 if (retval)
988 goto out_free_dentry;
989 break;
990 }
991 }
992
993 retval = parse_elf_properties(interpreter ?: bprm->file,
994 elf_property_phdata, &arch_state);
995 if (retval)
996 goto out_free_dentry;
997
998 /*
999 * Allow arch code to reject the ELF at this point, whilst it's
1000 * still possible to return an error to the code that invoked
1001 * the exec syscall.
1002 */
1003 retval = arch_check_elf(elf_ex,
1004 !!interpreter, interp_elf_ex,
1005 &arch_state);
1006 if (retval)
1007 goto out_free_dentry;
1008
1009 /* Flush all traces of the currently running executable */
1010 retval = begin_new_exec(bprm);
1011 if (retval)
1012 goto out_free_dentry;
1013
1014 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
1015 may depend on the personality. */
1016 SET_PERSONALITY2(*elf_ex, &arch_state);
1017 if (elf_read_implies_exec(*elf_ex, executable_stack))
1018 current->personality |= READ_IMPLIES_EXEC;
1019
1020 const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
1021 if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space)
1022 current->flags |= PF_RANDOMIZE;
1023
1024 setup_new_exec(bprm);
1025
1026 /* Do this so that we can load the interpreter, if need be. We will
1027 change some of these later */
1028 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
1029 executable_stack);
1030 if (retval < 0)
1031 goto out_free_dentry;
1032
1033 elf_brk = 0;
1034
1035 start_code = ~0UL;
1036 end_code = 0;
1037 start_data = 0;
1038 end_data = 0;
1039
1040 /* Now we do a little grungy work by mmapping the ELF image into
1041 the correct location in memory. */
1042 for(i = 0, elf_ppnt = elf_phdata;
1043 i < elf_ex->e_phnum; i++, elf_ppnt++) {
1044 int elf_prot, elf_flags;
1045 unsigned long k, vaddr;
1046 unsigned long total_size = 0;
1047 unsigned long alignment;
1048
1049 if (elf_ppnt->p_type != PT_LOAD)
1050 continue;
1051
1052 elf_prot = make_prot(elf_ppnt->p_flags, &arch_state,
1053 !!interpreter, false);
1054
1055 elf_flags = MAP_PRIVATE;
1056
1057 vaddr = elf_ppnt->p_vaddr;
1058 /*
1059 * The first time through the loop, first_pt_load is true:
1060 * layout will be calculated. Once set, use MAP_FIXED since
1061 * we know we've already safely mapped the entire region with
1062 * MAP_FIXED_NOREPLACE in the once-per-binary logic following.
1063 */
1064 if (!first_pt_load) {
1065 elf_flags |= MAP_FIXED;
1066 } else if (elf_ex->e_type == ET_EXEC) {
1067 /*
1068 * This logic is run once for the first LOAD Program
1069 * Header for ET_EXEC binaries. No special handling
1070 * is needed.
1071 */
1072 elf_flags |= MAP_FIXED_NOREPLACE;
1073 } else if (elf_ex->e_type == ET_DYN) {
1074 /*
1075 * This logic is run once for the first LOAD Program
1076 * Header for ET_DYN binaries to calculate the
1077 * randomization (load_bias) for all the LOAD
1078 * Program Headers.
1079 */
1080
1081 /*
1082 * Calculate the entire size of the ELF mapping
1083 * (total_size), used for the initial mapping,
1084 * due to load_addr_set which is set to true later
1085 * once the initial mapping is performed.
1086 *
1087 * Note that this is only sensible when the LOAD
1088 * segments are contiguous (or overlapping). If
1089 * used for LOADs that are far apart, this would
1090 * cause the holes between LOADs to be mapped,
1091 * running the risk of having the mapping fail,
1092 * as it would be larger than the ELF file itself.
1093 *
1094 * As a result, only ET_DYN does this, since
1095 * some ET_EXEC (e.g. ia64) may have large virtual
1096 * memory holes between LOADs.
1097 *
1098 */
1099 total_size = total_mapping_size(elf_phdata,
1100 elf_ex->e_phnum);
1101 if (!total_size) {
1102 retval = -EINVAL;
1103 goto out_free_dentry;
1104 }
1105
1106 /* Calculate any requested alignment. */
1107 alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum);
1108
1109 /**
1110 * DOC: PIE handling
1111 *
1112 * There are effectively two types of ET_DYN ELF
1113 * binaries: programs (i.e. PIE: ET_DYN with
1114 * PT_INTERP) and loaders (i.e. static PIE: ET_DYN
1115 * without PT_INTERP, usually the ELF interpreter
1116 * itself). Loaders must be loaded away from programs
1117 * since the program may otherwise collide with the
1118 * loader (especially for ET_EXEC which does not have
1119 * a randomized position).
1120 *
1121 * For example, to handle invocations of
1122 * "./ld.so someprog" to test out a new version of
1123 * the loader, the subsequent program that the
1124 * loader loads must avoid the loader itself, so
1125 * they cannot share the same load range. Sufficient
1126 * room for the brk must be allocated with the
1127 * loader as well, since brk must be available with
1128 * the loader.
1129 *
1130 * Therefore, programs are loaded offset from
1131 * ELF_ET_DYN_BASE and loaders are loaded into the
1132 * independently randomized mmap region (0 load_bias
1133 * without MAP_FIXED nor MAP_FIXED_NOREPLACE).
1134 *
1135 * See below for "brk" handling details, which is
1136 * also affected by program vs loader and ASLR.
1137 */
1138 if (interpreter) {
1139 /* On ET_DYN with PT_INTERP, we do the ASLR. */
1140 load_bias = ELF_ET_DYN_BASE;
1141 if (current->flags & PF_RANDOMIZE)
1142 load_bias += arch_mmap_rnd();
1143 /* Adjust alignment as requested. */
1144 if (alignment)
1145 load_bias &= ~(alignment - 1);
1146 elf_flags |= MAP_FIXED_NOREPLACE;
1147 } else {
1148 /*
1149 * For ET_DYN without PT_INTERP, we rely on
1150 * the architectures's (potentially ASLR) mmap
1151 * base address (via a load_bias of 0).
1152 *
1153 * When a large alignment is requested, we
1154 * must do the allocation at address "0" right
1155 * now to discover where things will load so
1156 * that we can adjust the resulting alignment.
1157 * In this case (load_bias != 0), we can use
1158 * MAP_FIXED_NOREPLACE to make sure the mapping
1159 * doesn't collide with anything.
1160 */
1161 if (alignment > ELF_MIN_ALIGN) {
1162 load_bias = elf_load(bprm->file, 0, elf_ppnt,
1163 elf_prot, elf_flags, total_size);
1164 if (BAD_ADDR(load_bias)) {
1165 retval = IS_ERR_VALUE(load_bias) ?
1166 PTR_ERR((void*)load_bias) : -EINVAL;
1167 goto out_free_dentry;
1168 }
1169 vm_munmap(load_bias, total_size);
1170 /* Adjust alignment as requested. */
1171 if (alignment)
1172 load_bias &= ~(alignment - 1);
1173 elf_flags |= MAP_FIXED_NOREPLACE;
1174 } else
1175 load_bias = 0;
1176 }
1177
1178 /*
1179 * Since load_bias is used for all subsequent loading
1180 * calculations, we must lower it by the first vaddr
1181 * so that the remaining calculations based on the
1182 * ELF vaddrs will be correctly offset. The result
1183 * is then page aligned.
1184 */
1185 load_bias = ELF_PAGESTART(load_bias - vaddr);
1186 }
1187
1188 error = elf_load(bprm->file, load_bias + vaddr, elf_ppnt,
1189 elf_prot, elf_flags, total_size);
1190 if (BAD_ADDR(error)) {
1191 retval = IS_ERR_VALUE(error) ?
1192 PTR_ERR((void*)error) : -EINVAL;
1193 goto out_free_dentry;
1194 }
1195
1196 if (first_pt_load) {
1197 first_pt_load = 0;
1198 if (elf_ex->e_type == ET_DYN) {
1199 load_bias += error -
1200 ELF_PAGESTART(load_bias + vaddr);
1201 reloc_func_desc = load_bias;
1202 }
1203 }
1204
1205 /*
1206 * Figure out which segment in the file contains the Program
1207 * Header table, and map to the associated memory address.
1208 */
1209 if (elf_ppnt->p_offset <= elf_ex->e_phoff &&
1210 elf_ex->e_phoff < elf_ppnt->p_offset + elf_ppnt->p_filesz) {
1211 phdr_addr = elf_ex->e_phoff - elf_ppnt->p_offset +
1212 elf_ppnt->p_vaddr;
1213 }
1214
1215 k = elf_ppnt->p_vaddr;
1216 if ((elf_ppnt->p_flags & PF_X) && k < start_code)
1217 start_code = k;
1218 if (start_data < k)
1219 start_data = k;
1220
1221 /*
1222 * Check to see if the section's size will overflow the
1223 * allowed task size. Note that p_filesz must always be
1224 * <= p_memsz so it is only necessary to check p_memsz.
1225 */
1226 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
1227 elf_ppnt->p_memsz > TASK_SIZE ||
1228 TASK_SIZE - elf_ppnt->p_memsz < k) {
1229 /* set_brk can never work. Avoid overflows. */
1230 retval = -EINVAL;
1231 goto out_free_dentry;
1232 }
1233
1234 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
1235
1236 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
1237 end_code = k;
1238 if (end_data < k)
1239 end_data = k;
1240 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
1241 if (k > elf_brk)
1242 elf_brk = k;
1243 }
1244
1245 e_entry = elf_ex->e_entry + load_bias;
1246 phdr_addr += load_bias;
1247 elf_brk += load_bias;
1248 start_code += load_bias;
1249 end_code += load_bias;
1250 start_data += load_bias;
1251 end_data += load_bias;
1252
1253 if (interpreter) {
1254 elf_entry = load_elf_interp(interp_elf_ex,
1255 interpreter,
1256 load_bias, interp_elf_phdata,
1257 &arch_state);
1258 if (!IS_ERR_VALUE(elf_entry)) {
1259 /*
1260 * load_elf_interp() returns relocation
1261 * adjustment
1262 */
1263 interp_load_addr = elf_entry;
1264 elf_entry += interp_elf_ex->e_entry;
1265 }
1266 if (BAD_ADDR(elf_entry)) {
1267 retval = IS_ERR_VALUE(elf_entry) ?
1268 (int)elf_entry : -EINVAL;
1269 goto out_free_dentry;
1270 }
1271 reloc_func_desc = interp_load_addr;
1272
1273 exe_file_allow_write_access(interpreter);
1274 fput(interpreter);
1275
1276 kfree(interp_elf_ex);
1277 kfree(interp_elf_phdata);
1278 } else {
1279 elf_entry = e_entry;
1280 if (BAD_ADDR(elf_entry)) {
1281 retval = -EINVAL;
1282 goto out_free_dentry;
1283 }
1284 }
1285
1286 kfree(elf_phdata);
1287
1288 set_binfmt(&elf_format);
1289
1290#ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
1291 retval = ARCH_SETUP_ADDITIONAL_PAGES(bprm, elf_ex, !!interpreter);
1292 if (retval < 0)
1293 goto out;
1294#endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
1295
1296 retval = create_elf_tables(bprm, elf_ex, interp_load_addr,
1297 e_entry, phdr_addr);
1298 if (retval < 0)
1299 goto out;
1300
1301 mm = current->mm;
1302 mm->end_code = end_code;
1303 mm->start_code = start_code;
1304 mm->start_data = start_data;
1305 mm->end_data = end_data;
1306 mm->start_stack = bprm->p;
1307
1308 elf_coredump_set_mm_eflags(mm, elf_ex->e_flags);
1309
1310 /**
1311 * DOC: "brk" handling
1312 *
1313 * For architectures with ELF randomization, when executing a
1314 * loader directly (i.e. static PIE: ET_DYN without PT_INTERP),
1315 * move the brk area out of the mmap region and into the unused
1316 * ELF_ET_DYN_BASE region. Since "brk" grows up it may collide
1317 * early with the stack growing down or other regions being put
1318 * into the mmap region by the kernel (e.g. vdso).
1319 *
1320 * In the CONFIG_COMPAT_BRK case, though, everything is turned
1321 * off because we're not allowed to move the brk at all.
1322 */
1323 if (!IS_ENABLED(CONFIG_COMPAT_BRK) &&
1324 IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
1325 elf_ex->e_type == ET_DYN && !interpreter) {
1326 elf_brk = ELF_ET_DYN_BASE;
1327 /* This counts as moving the brk, so let brk(2) know. */
1328 brk_moved = true;
1329 }
1330 mm->start_brk = mm->brk = ELF_PAGEALIGN(elf_brk);
1331
1332 if ((current->flags & PF_RANDOMIZE) && snapshot_randomize_va_space > 1) {
1333 /*
1334 * If we didn't move the brk to ELF_ET_DYN_BASE (above),
1335 * leave a gap between .bss and brk.
1336 */
1337 if (!brk_moved)
1338 mm->brk = mm->start_brk = mm->brk + PAGE_SIZE;
1339
1340 mm->brk = mm->start_brk = arch_randomize_brk(mm);
1341 brk_moved = true;
1342 }
1343
1344#ifdef compat_brk_randomized
1345 if (brk_moved)
1346 current->brk_randomized = 1;
1347#endif
1348
1349 if (current->personality & MMAP_PAGE_ZERO) {
1350 /* Why this, you ask??? Well SVr4 maps page 0 as read-only,
1351 and some applications "depend" upon this behavior.
1352 Since we do not have the power to recompile these, we
1353 emulate the SVr4 behavior. Sigh. */
1354 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
1355 MAP_FIXED | MAP_PRIVATE, 0);
1356 if (!error)
1357 mseal_mmap_page_zero();
1358 }
1359
1360 regs = current_pt_regs();
1361#ifdef ELF_PLAT_INIT
1362 /*
1363 * The ABI may specify that certain registers be set up in special
1364 * ways (on i386 %edx is the address of a DT_FINI function, for
1365 * example. In addition, it may also specify (eg, PowerPC64 ELF)
1366 * that the e_entry field is the address of the function descriptor
1367 * for the startup routine, rather than the address of the startup
1368 * routine itself. This macro performs whatever initialization to
1369 * the regs structure is required as well as any relocations to the
1370 * function descriptor entries when executing dynamically links apps.
1371 */
1372 ELF_PLAT_INIT(regs, reloc_func_desc);
1373#endif
1374
1375 finalize_exec(bprm);
1376 START_THREAD(elf_ex, regs, elf_entry, bprm->p);
1377 retval = 0;
1378out:
1379 return retval;
1380
1381 /* error cleanup */
1382out_free_dentry:
1383 kfree(interp_elf_ex);
1384 kfree(interp_elf_phdata);
1385out_free_file:
1386 exe_file_allow_write_access(interpreter);
1387 if (interpreter)
1388 fput(interpreter);
1389out_free_ph:
1390 kfree(elf_phdata);
1391 goto out;
1392}
1393
1394#ifdef CONFIG_ELF_CORE
1395/*
1396 * ELF core dumper
1397 *
1398 * Modelled on fs/exec.c:aout_core_dump()
1399 * Jeremy Fitzhardinge <[email protected]>
1400 */
1401
1402/* An ELF note in memory */
1403struct memelfnote
1404{
1405 const char *name;
1406 int type;
1407 unsigned int datasz;
1408 void *data;
1409};
1410
1411static int notesize(struct memelfnote *en)
1412{
1413 int sz;
1414
1415 sz = sizeof(struct elf_note);
1416 sz += roundup(strlen(en->name) + 1, 4);
1417 sz += roundup(en->datasz, 4);
1418
1419 return sz;
1420}
1421
1422static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1423{
1424 struct elf_note en;
1425 en.n_namesz = strlen(men->name) + 1;
1426 en.n_descsz = men->datasz;
1427 en.n_type = men->type;
1428
1429 return dump_emit(cprm, &en, sizeof(en)) &&
1430 dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
1431 dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1432}
1433
1434static void fill_elf_header(struct elfhdr *elf, int segs,
1435 u16 machine, u32 flags)
1436{
1437 memset(elf, 0, sizeof(*elf));
1438
1439 memcpy(elf->e_ident, ELFMAG, SELFMAG);
1440 elf->e_ident[EI_CLASS] = ELF_CLASS;
1441 elf->e_ident[EI_DATA] = ELF_DATA;
1442 elf->e_ident[EI_VERSION] = EV_CURRENT;
1443 elf->e_ident[EI_OSABI] = ELF_OSABI;
1444
1445 elf->e_type = ET_CORE;
1446 elf->e_machine = machine;
1447 elf->e_version = EV_CURRENT;
1448 elf->e_phoff = sizeof(struct elfhdr);
1449 elf->e_flags = flags;
1450 elf->e_ehsize = sizeof(struct elfhdr);
1451 elf->e_phentsize = sizeof(struct elf_phdr);
1452 elf->e_phnum = segs;
1453}
1454
1455static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1456{
1457 phdr->p_type = PT_NOTE;
1458 phdr->p_offset = offset;
1459 phdr->p_vaddr = 0;
1460 phdr->p_paddr = 0;
1461 phdr->p_filesz = sz;
1462 phdr->p_memsz = 0;
1463 phdr->p_flags = 0;
1464 phdr->p_align = 4;
1465}
1466
1467static void __fill_note(struct memelfnote *note, const char *name, int type,
1468 unsigned int sz, void *data)
1469{
1470 note->name = name;
1471 note->type = type;
1472 note->datasz = sz;
1473 note->data = data;
1474}
1475
1476#define fill_note(note, type, sz, data) \
1477 __fill_note(note, NN_ ## type, NT_ ## type, sz, data)
1478
1479/*
1480 * fill up all the fields in prstatus from the given task struct, except
1481 * registers which need to be filled up separately.
1482 */
1483static void fill_prstatus(struct elf_prstatus_common *prstatus,
1484 struct task_struct *p, long signr)
1485{
1486 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1487 prstatus->pr_sigpend = p->pending.signal.sig[0];
1488 prstatus->pr_sighold = p->blocked.sig[0];
1489 rcu_read_lock();
1490 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1491 rcu_read_unlock();
1492 prstatus->pr_pid = task_pid_vnr(p);
1493 prstatus->pr_pgrp = task_pgrp_vnr(p);
1494 prstatus->pr_sid = task_session_vnr(p);
1495 if (thread_group_leader(p)) {
1496 struct task_cputime cputime;
1497
1498 /*
1499 * This is the record for the group leader. It shows the
1500 * group-wide total, not its individual thread total.
1501 */
1502 thread_group_cputime(p, &cputime);
1503 prstatus->pr_utime = ns_to_kernel_old_timeval(cputime.utime);
1504 prstatus->pr_stime = ns_to_kernel_old_timeval(cputime.stime);
1505 } else {
1506 u64 utime, stime;
1507
1508 task_cputime(p, &utime, &stime);
1509 prstatus->pr_utime = ns_to_kernel_old_timeval(utime);
1510 prstatus->pr_stime = ns_to_kernel_old_timeval(stime);
1511 }
1512
1513 prstatus->pr_cutime = ns_to_kernel_old_timeval(p->signal->cutime);
1514 prstatus->pr_cstime = ns_to_kernel_old_timeval(p->signal->cstime);
1515}
1516
1517static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1518 struct mm_struct *mm)
1519{
1520 const struct cred *cred;
1521 unsigned int i, len;
1522 unsigned int state;
1523
1524 /* first copy the parameters from user space */
1525 memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1526
1527 len = mm->arg_end - mm->arg_start;
1528 if (len >= ELF_PRARGSZ)
1529 len = ELF_PRARGSZ-1;
1530 if (copy_from_user(&psinfo->pr_psargs,
1531 (const char __user *)mm->arg_start, len))
1532 return -EFAULT;
1533 for(i = 0; i < len; i++)
1534 if (psinfo->pr_psargs[i] == 0)
1535 psinfo->pr_psargs[i] = ' ';
1536 psinfo->pr_psargs[len] = 0;
1537
1538 rcu_read_lock();
1539 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1540 rcu_read_unlock();
1541 psinfo->pr_pid = task_pid_vnr(p);
1542 psinfo->pr_pgrp = task_pgrp_vnr(p);
1543 psinfo->pr_sid = task_session_vnr(p);
1544
1545 state = READ_ONCE(p->__state);
1546 i = state ? ffz(~state) + 1 : 0;
1547 psinfo->pr_state = i;
1548 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1549 psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1550 psinfo->pr_nice = task_nice(p);
1551 psinfo->pr_flag = p->flags;
1552 rcu_read_lock();
1553 cred = __task_cred(p);
1554 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1555 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1556 rcu_read_unlock();
1557 get_task_comm(psinfo->pr_fname, p);
1558
1559 return 0;
1560}
1561
1562static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1563{
1564 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1565 int i = 0;
1566 do
1567 i += 2;
1568 while (auxv[i - 2] != AT_NULL);
1569 fill_note(note, AUXV, i * sizeof(elf_addr_t), auxv);
1570}
1571
1572static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
1573 const kernel_siginfo_t *siginfo)
1574{
1575 copy_siginfo_to_external(csigdata, siginfo);
1576 fill_note(note, SIGINFO, sizeof(*csigdata), csigdata);
1577}
1578
1579/*
1580 * Format of NT_FILE note:
1581 *
1582 * long count -- how many files are mapped
1583 * long page_size -- units for file_ofs
1584 * array of [COUNT] elements of
1585 * long start
1586 * long end
1587 * long file_ofs
1588 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
1589 */
1590static int fill_files_note(struct memelfnote *note, struct coredump_params *cprm)
1591{
1592 unsigned count, size, names_ofs, remaining, n;
1593 user_long_t *data;
1594 user_long_t *start_end_ofs;
1595 char *name_base, *name_curpos;
1596 int i;
1597
1598 /* *Estimated* file count and total data size needed */
1599 count = cprm->vma_count;
1600 if (count > UINT_MAX / 64)
1601 return -EINVAL;
1602 size = count * 64;
1603
1604 names_ofs = (2 + 3 * count) * sizeof(data[0]);
1605 alloc:
1606 /* paranoia check */
1607 if (size >= core_file_note_size_limit) {
1608 pr_warn_once("coredump Note size too large: %u (does kernel.core_file_note_size_limit sysctl need adjustment?\n",
1609 size);
1610 return -EINVAL;
1611 }
1612 size = round_up(size, PAGE_SIZE);
1613 /*
1614 * "size" can be 0 here legitimately.
1615 * Let it ENOMEM and omit NT_FILE section which will be empty anyway.
1616 */
1617 data = kvmalloc(size, GFP_KERNEL);
1618 if (ZERO_OR_NULL_PTR(data))
1619 return -ENOMEM;
1620
1621 start_end_ofs = data + 2;
1622 name_base = name_curpos = ((char *)data) + names_ofs;
1623 remaining = size - names_ofs;
1624 count = 0;
1625 for (i = 0; i < cprm->vma_count; i++) {
1626 struct core_vma_metadata *m = &cprm->vma_meta[i];
1627 struct file *file;
1628 const char *filename;
1629
1630 file = m->file;
1631 if (!file)
1632 continue;
1633 filename = file_path(file, name_curpos, remaining);
1634 if (IS_ERR(filename)) {
1635 if (PTR_ERR(filename) == -ENAMETOOLONG) {
1636 kvfree(data);
1637 size = size * 5 / 4;
1638 goto alloc;
1639 }
1640 continue;
1641 }
1642
1643 /* file_path() fills at the end, move name down */
1644 /* n = strlen(filename) + 1: */
1645 n = (name_curpos + remaining) - filename;
1646 remaining = filename - name_curpos;
1647 memmove(name_curpos, filename, n);
1648 name_curpos += n;
1649
1650 *start_end_ofs++ = m->start;
1651 *start_end_ofs++ = m->end;
1652 *start_end_ofs++ = m->pgoff;
1653 count++;
1654 }
1655
1656 /* Now we know exact count of files, can store it */
1657 data[0] = count;
1658 data[1] = PAGE_SIZE;
1659 /*
1660 * Count usually is less than mm->map_count,
1661 * we need to move filenames down.
1662 */
1663 n = cprm->vma_count - count;
1664 if (n != 0) {
1665 unsigned shift_bytes = n * 3 * sizeof(data[0]);
1666 memmove(name_base - shift_bytes, name_base,
1667 name_curpos - name_base);
1668 name_curpos -= shift_bytes;
1669 }
1670
1671 size = name_curpos - (char *)data;
1672 fill_note(note, FILE, size, data);
1673 return 0;
1674}
1675
1676#include <linux/regset.h>
1677
1678struct elf_thread_core_info {
1679 struct elf_thread_core_info *next;
1680 struct task_struct *task;
1681 struct elf_prstatus prstatus;
1682 struct memelfnote notes[];
1683};
1684
1685struct elf_note_info {
1686 struct elf_thread_core_info *thread;
1687 struct memelfnote psinfo;
1688 struct memelfnote signote;
1689 struct memelfnote auxv;
1690 struct memelfnote files;
1691 user_siginfo_t csigdata;
1692 size_t size;
1693 int thread_notes;
1694};
1695
1696#ifdef CORE_DUMP_USE_REGSET
1697/*
1698 * When a regset has a writeback hook, we call it on each thread before
1699 * dumping user memory. On register window machines, this makes sure the
1700 * user memory backing the register data is up to date before we read it.
1701 */
1702static void do_thread_regset_writeback(struct task_struct *task,
1703 const struct user_regset *regset)
1704{
1705 if (regset->writeback)
1706 regset->writeback(task, regset, 1);
1707}
1708
1709#ifndef PRSTATUS_SIZE
1710#define PRSTATUS_SIZE sizeof(struct elf_prstatus)
1711#endif
1712
1713#ifndef SET_PR_FPVALID
1714#define SET_PR_FPVALID(S) ((S)->pr_fpvalid = 1)
1715#endif
1716
1717static int fill_thread_core_info(struct elf_thread_core_info *t,
1718 const struct user_regset_view *view,
1719 long signr, struct elf_note_info *info)
1720{
1721 unsigned int note_iter, view_iter;
1722
1723 /*
1724 * NT_PRSTATUS is the one special case, because the regset data
1725 * goes into the pr_reg field inside the note contents, rather
1726 * than being the whole note contents. We fill the regset in here.
1727 * We assume that regset 0 is NT_PRSTATUS.
1728 */
1729 fill_prstatus(&t->prstatus.common, t->task, signr);
1730 regset_get(t->task, &view->regsets[0],
1731 sizeof(t->prstatus.pr_reg), &t->prstatus.pr_reg);
1732
1733 fill_note(&t->notes[0], PRSTATUS, PRSTATUS_SIZE, &t->prstatus);
1734 info->size += notesize(&t->notes[0]);
1735
1736 do_thread_regset_writeback(t->task, &view->regsets[0]);
1737
1738 /*
1739 * Each other regset might generate a note too. For each regset
1740 * that has no core_note_type or is inactive, skip it.
1741 */
1742 note_iter = 1;
1743 for (view_iter = 1; view_iter < view->n; ++view_iter) {
1744 const struct user_regset *regset = &view->regsets[view_iter];
1745 int note_type = regset->core_note_type;
1746 const char *note_name = regset->core_note_name;
1747 bool is_fpreg = note_type == NT_PRFPREG;
1748 void *data;
1749 int ret;
1750
1751 do_thread_regset_writeback(t->task, regset);
1752 if (!note_type) // not for coredumps
1753 continue;
1754 if (regset->active && regset->active(t->task, regset) <= 0)
1755 continue;
1756
1757 ret = regset_get_alloc(t->task, regset, ~0U, &data);
1758 if (ret < 0)
1759 continue;
1760
1761 if (WARN_ON_ONCE(note_iter >= info->thread_notes))
1762 break;
1763
1764 if (is_fpreg)
1765 SET_PR_FPVALID(&t->prstatus);
1766
1767 /* There should be a note name, but if not, guess: */
1768 if (WARN_ON_ONCE(!note_name))
1769 note_name = "LINUX";
1770 else
1771 /* Warn on non-legacy-compatible names, for now. */
1772 WARN_ON_ONCE(strcmp(note_name,
1773 is_fpreg ? "CORE" : "LINUX"));
1774
1775 __fill_note(&t->notes[note_iter], note_name, note_type,
1776 ret, data);
1777
1778 info->size += notesize(&t->notes[note_iter]);
1779 note_iter++;
1780 }
1781
1782 return 1;
1783}
1784#else
1785static int fill_thread_core_info(struct elf_thread_core_info *t,
1786 const struct user_regset_view *view,
1787 long signr, struct elf_note_info *info)
1788{
1789 struct task_struct *p = t->task;
1790 elf_fpregset_t *fpu;
1791
1792 fill_prstatus(&t->prstatus.common, p, signr);
1793 elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1794
1795 fill_note(&t->notes[0], PRSTATUS, sizeof(t->prstatus), &t->prstatus);
1796 info->size += notesize(&t->notes[0]);
1797
1798 fpu = kzalloc_obj(elf_fpregset_t);
1799 if (!fpu || !elf_core_copy_task_fpregs(p, fpu)) {
1800 kfree(fpu);
1801 return 1;
1802 }
1803
1804 t->prstatus.pr_fpvalid = 1;
1805 fill_note(&t->notes[1], PRFPREG, sizeof(*fpu), fpu);
1806 info->size += notesize(&t->notes[1]);
1807
1808 return 1;
1809}
1810#endif
1811
1812static int fill_note_info(struct elfhdr *elf, int phdrs,
1813 struct elf_note_info *info,
1814 struct coredump_params *cprm)
1815{
1816 struct task_struct *dump_task = current;
1817 const struct user_regset_view *view;
1818 struct elf_thread_core_info *t;
1819 struct elf_prpsinfo *psinfo;
1820 struct core_thread *ct;
1821 u16 machine;
1822 u32 flags;
1823
1824 psinfo = kmalloc_obj(*psinfo);
1825 if (!psinfo)
1826 return 0;
1827 fill_note(&info->psinfo, PRPSINFO, sizeof(*psinfo), psinfo);
1828
1829#ifdef CORE_DUMP_USE_REGSET
1830 view = task_user_regset_view(dump_task);
1831
1832 /*
1833 * Figure out how many notes we're going to need for each thread.
1834 */
1835 info->thread_notes = 0;
1836 for (int i = 0; i < view->n; ++i)
1837 if (view->regsets[i].core_note_type != 0)
1838 ++info->thread_notes;
1839
1840 /*
1841 * Sanity check. We rely on regset 0 being in NT_PRSTATUS,
1842 * since it is our one special case.
1843 */
1844 if (unlikely(info->thread_notes == 0) ||
1845 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1846 WARN_ON(1);
1847 return 0;
1848 }
1849
1850 machine = view->e_machine;
1851 flags = view->e_flags;
1852#else
1853 view = NULL;
1854 info->thread_notes = 2;
1855 machine = ELF_ARCH;
1856 flags = ELF_CORE_EFLAGS;
1857#endif
1858
1859 /*
1860 * Override ELF e_flags with value taken from process,
1861 * if arch needs that.
1862 */
1863 flags = elf_coredump_get_mm_eflags(dump_task->mm, flags);
1864
1865 /*
1866 * Initialize the ELF file header.
1867 */
1868 fill_elf_header(elf, phdrs, machine, flags);
1869
1870 /*
1871 * Allocate a structure for each thread.
1872 */
1873 info->thread = kzalloc_flex(*info->thread, notes, info->thread_notes);
1874 if (unlikely(!info->thread))
1875 return 0;
1876
1877 info->thread->task = dump_task;
1878 for (ct = dump_task->signal->core_state->tasks; ct; ct = ct->next) {
1879 t = kzalloc_flex(*t, notes, info->thread_notes);
1880 if (unlikely(!t))
1881 return 0;
1882
1883 t->task = ct->task;
1884 t->next = info->thread->next;
1885 info->thread->next = t;
1886 }
1887
1888 /*
1889 * Now fill in each thread's information.
1890 */
1891 for (t = info->thread; t != NULL; t = t->next)
1892 if (!fill_thread_core_info(t, view, cprm->siginfo->si_signo, info))
1893 return 0;
1894
1895 /*
1896 * Fill in the two process-wide notes.
1897 */
1898 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1899 info->size += notesize(&info->psinfo);
1900
1901 fill_siginfo_note(&info->signote, &info->csigdata, cprm->siginfo);
1902 info->size += notesize(&info->signote);
1903
1904 fill_auxv_note(&info->auxv, current->mm);
1905 info->size += notesize(&info->auxv);
1906
1907 if (fill_files_note(&info->files, cprm) == 0)
1908 info->size += notesize(&info->files);
1909
1910 return 1;
1911}
1912
1913/*
1914 * Write all the notes for each thread. When writing the first thread, the
1915 * process-wide notes are interleaved after the first thread-specific note.
1916 */
1917static int write_note_info(struct elf_note_info *info,
1918 struct coredump_params *cprm)
1919{
1920 bool first = true;
1921 struct elf_thread_core_info *t = info->thread;
1922
1923 do {
1924 int i;
1925
1926 if (!writenote(&t->notes[0], cprm))
1927 return 0;
1928
1929 if (first && !writenote(&info->psinfo, cprm))
1930 return 0;
1931 if (first && !writenote(&info->signote, cprm))
1932 return 0;
1933 if (first && !writenote(&info->auxv, cprm))
1934 return 0;
1935 if (first && info->files.data &&
1936 !writenote(&info->files, cprm))
1937 return 0;
1938
1939 for (i = 1; i < info->thread_notes; ++i)
1940 if (t->notes[i].data &&
1941 !writenote(&t->notes[i], cprm))
1942 return 0;
1943
1944 first = false;
1945 t = t->next;
1946 } while (t);
1947
1948 return 1;
1949}
1950
1951static void free_note_info(struct elf_note_info *info)
1952{
1953 struct elf_thread_core_info *threads = info->thread;
1954 while (threads) {
1955 unsigned int i;
1956 struct elf_thread_core_info *t = threads;
1957 threads = t->next;
1958 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1959 for (i = 1; i < info->thread_notes; ++i)
1960 kvfree(t->notes[i].data);
1961 kfree(t);
1962 }
1963 kfree(info->psinfo.data);
1964 kvfree(info->files.data);
1965}
1966
1967static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
1968 elf_addr_t e_shoff, int segs)
1969{
1970 elf->e_shoff = e_shoff;
1971 elf->e_shentsize = sizeof(*shdr4extnum);
1972 elf->e_shnum = 1;
1973 elf->e_shstrndx = SHN_UNDEF;
1974
1975 memset(shdr4extnum, 0, sizeof(*shdr4extnum));
1976
1977 shdr4extnum->sh_type = SHT_NULL;
1978 shdr4extnum->sh_size = elf->e_shnum;
1979 shdr4extnum->sh_link = elf->e_shstrndx;
1980 shdr4extnum->sh_info = segs;
1981}
1982
1983/*
1984 * Actual dumper
1985 *
1986 * This is a two-pass process; first we find the offsets of the bits,
1987 * and then they are actually written out. If we run out of core limit
1988 * we just truncate.
1989 */
1990static bool elf_core_dump(struct coredump_params *cprm)
1991{
1992 bool ret = false;
1993 int segs, i;
1994 struct elfhdr elf;
1995 loff_t offset = 0, dataoff;
1996 struct elf_note_info info = { };
1997 struct elf_phdr *phdr4note = NULL;
1998 struct elf_shdr *shdr4extnum = NULL;
1999 Elf_Half e_phnum;
2000 elf_addr_t e_shoff;
2001
2002 /*
2003 * The number of segs are recored into ELF header as 16bit value.
2004 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
2005 */
2006 segs = cprm->vma_count + elf_core_extra_phdrs(cprm);
2007
2008 /* for notes section */
2009 segs++;
2010
2011 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
2012 * this, kernel supports extended numbering. Have a look at
2013 * include/linux/elf.h for further information. */
2014 e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
2015
2016 /*
2017 * Collect all the non-memory information about the process for the
2018 * notes. This also sets up the file header.
2019 */
2020 if (!fill_note_info(&elf, e_phnum, &info, cprm))
2021 goto end_coredump;
2022
2023 cprm->state |= COREDUMP_STATE_STARTED;
2024
2025 offset += sizeof(elf); /* ELF header */
2026 offset += segs * sizeof(struct elf_phdr); /* Program headers */
2027
2028 /* Write notes phdr entry */
2029 {
2030 size_t sz = info.size;
2031
2032 /* For x86 xstate */
2033 sz += elf_coredump_extra_notes_size();
2034
2035 phdr4note = kmalloc_obj(*phdr4note);
2036 if (!phdr4note)
2037 goto end_coredump;
2038
2039 fill_elf_note_phdr(phdr4note, sz, offset);
2040 offset += sz;
2041 }
2042
2043 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2044
2045 offset += cprm->vma_data_size;
2046 offset += elf_core_extra_data_size(cprm);
2047 e_shoff = offset;
2048
2049 if (e_phnum == PN_XNUM) {
2050 shdr4extnum = kmalloc_obj(*shdr4extnum);
2051 if (!shdr4extnum)
2052 goto end_coredump;
2053 fill_extnum_info(&elf, shdr4extnum, e_shoff, segs);
2054 }
2055
2056 offset = dataoff;
2057
2058 if (!dump_emit(cprm, &elf, sizeof(elf)))
2059 goto end_coredump;
2060
2061 if (!dump_emit(cprm, phdr4note, sizeof(*phdr4note)))
2062 goto end_coredump;
2063
2064 /* Write program headers for segments dump */
2065 for (i = 0; i < cprm->vma_count; i++) {
2066 struct core_vma_metadata *meta = cprm->vma_meta + i;
2067 struct elf_phdr phdr;
2068
2069 phdr.p_type = PT_LOAD;
2070 phdr.p_offset = offset;
2071 phdr.p_vaddr = meta->start;
2072 phdr.p_paddr = 0;
2073 phdr.p_filesz = meta->dump_size;
2074 phdr.p_memsz = meta->end - meta->start;
2075 offset += phdr.p_filesz;
2076 phdr.p_flags = 0;
2077 if (meta->flags & VM_READ)
2078 phdr.p_flags |= PF_R;
2079 if (meta->flags & VM_WRITE)
2080 phdr.p_flags |= PF_W;
2081 if (meta->flags & VM_EXEC)
2082 phdr.p_flags |= PF_X;
2083 phdr.p_align = ELF_EXEC_PAGESIZE;
2084
2085 if (!dump_emit(cprm, &phdr, sizeof(phdr)))
2086 goto end_coredump;
2087 }
2088
2089 if (!elf_core_write_extra_phdrs(cprm, offset))
2090 goto end_coredump;
2091
2092 /* write out the notes section */
2093 if (!write_note_info(&info, cprm))
2094 goto end_coredump;
2095
2096 /* For x86 xstate */
2097 if (elf_coredump_extra_notes_write(cprm))
2098 goto end_coredump;
2099
2100 /* Align to page */
2101 dump_skip_to(cprm, dataoff);
2102
2103 for (i = 0; i < cprm->vma_count; i++) {
2104 struct core_vma_metadata *meta = cprm->vma_meta + i;
2105
2106 if (!dump_user_range(cprm, meta->start, meta->dump_size))
2107 goto end_coredump;
2108 }
2109
2110 if (!elf_core_write_extra_data(cprm))
2111 goto end_coredump;
2112
2113 if (e_phnum == PN_XNUM) {
2114 if (!dump_emit(cprm, shdr4extnum, sizeof(*shdr4extnum)))
2115 goto end_coredump;
2116 }
2117
2118 ret = true;
2119
2120end_coredump:
2121 free_note_info(&info);
2122 kfree(shdr4extnum);
2123 kfree(phdr4note);
2124 return ret;
2125}
2126
2127#endif /* CONFIG_ELF_CORE */
2128
2129static int __init init_elf_binfmt(void)
2130{
2131 register_binfmt(&elf_format);
2132 return 0;
2133}
2134
2135static void __exit exit_elf_binfmt(void)
2136{
2137 /* Remove the COFF and ELF loaders. */
2138 unregister_binfmt(&elf_format);
2139}
2140
2141core_initcall(init_elf_binfmt);
2142module_exit(exit_elf_binfmt);
2143
2144#ifdef CONFIG_BINFMT_ELF_KUNIT_TEST
2145#include "tests/binfmt_elf_kunit.c"
2146#endif