fs/exec.c

   1 /*
   2  *  linux/fs/exec.c
   3  *
   4  *  Copyright (C) 1991, 1992  Linus Torvalds
   5  */
   6
   7 /*
   8  * #!-checking implemented by tytso.
   9  */
  10 /*
  11  * Demand-loading implemented 01.12.91 - no need to read anything but
  12  * the header into memory. The inode of the executable is put into
  13  * "current->executable", and page faults do the actual loading. Clean.
  14  *
  15  * Once more I can proudly say that linux stood up to being changed: it
  16  * was less than 2 hours work to get demand-loading completely implemented.
  17  *
  18  * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
  19  * current->executable is only used by the procfs.  This allows a dispatch
  20  * table to check for several different types  of binary formats.  We keep
  21  * trying until we recognize the file or we run out of supported binary
  22  * formats.
  23  */
  24
  25 #include <linux/config.h>
  26 #include <linux/slab.h>
  27 #include <linux/file.h>
  28 #include <linux/mman.h>
  29 #include <linux/a.out.h>
  30 #include <linux/stat.h>
  31 #include <linux/fcntl.h>
  32 #include <linux/smp_lock.h>
  33 #include <linux/init.h>
  34
  35 #include <asm/uaccess.h>
  36 #include <asm/pgtable.h>
  37 #include <asm/mmu_context.h>
  38
  39 #ifdef CONFIG_KMOD
  40 #include <linux/kmod.h>
  41 #endif
  42
  43 /*
  44  * Here are the actual binaries that will be accepted:
  45  * add more with "register_binfmt()" if using modules...
  46  *
  47  * These are defined again for the 'real' modules if you are using a
  48  * module definition for these routines.
  49  */
  50
  51 static struct linux_binfmt *formats = (struct linux_binfmt *) NULL;
  52
  53 void __init binfmt_setup(void)
  54 {
  55 #ifdef CONFIG_BINFMT_MISC
  56         init_misc_binfmt();
  57 #endif
  58
  59 #ifdef CONFIG_BINFMT_ELF
  60         init_elf_binfmt();
  61 #endif
  62
  63 #ifdef CONFIG_BINFMT_ELF32
  64         init_elf32_binfmt();
  65 #endif
  66
  67 #ifdef CONFIG_BINFMT_AOUT
  68         init_aout_binfmt();
  69 #endif
  70
  71 #ifdef CONFIG_BINFMT_AOUT32
  72         init_aout32_binfmt();
  73 #endif
  74
  75 #ifdef CONFIG_BINFMT_EM86
  76         init_em86_binfmt();
  77 #endif
  78
  79         /* This cannot be configured out of the kernel */
  80         init_script_binfmt();
  81 }
  82
  83 int register_binfmt(struct linux_binfmt * fmt)
  84 {
  85         struct linux_binfmt ** tmp = &formats;
  86
  87         if (!fmt)
  88                 return -EINVAL;
  89         if (fmt->next)
  90                 return -EBUSY;
  91         while (*tmp) {
  92                 if (fmt == *tmp)
  93                         return -EBUSY;
  94                 tmp = &(*tmp)->next;
  95         }
  96         fmt->next = formats;
  97         formats = fmt;
  98         return 0;
  99 }
 100
 101 #ifdef CONFIG_MODULES
 102 int unregister_binfmt(struct linux_binfmt * fmt)
 103 {
 104         struct linux_binfmt ** tmp = &formats;
 105
 106         while (*tmp) {
 107                 if (fmt == *tmp) {
 108                         *tmp = fmt->next;
 109                         return 0;
 110                 }
 111                 tmp = &(*tmp)->next;
 112         }
 113         return -EINVAL;
 114 }
 115 #endif  /* CONFIG_MODULES */
 116
 117 /* N.B. Error returns must be < 0 */
 118 int open_dentry(struct dentry * dentry, int mode)
 119 {
 120         struct inode * inode = dentry->d_inode;
 121         struct file * f;
 122         struct list_head * l = NULL;
 123         int fd, error;
 124
 125         if (inode->i_sb)
 126                 l = &inode->i_sb->s_files;
 127
 128         error = -EINVAL;
 129         if (!inode->i_op || !inode->i_op->default_file_ops)
 130                 goto out;
 131         fd = get_unused_fd();
 132         if (fd >= 0) {
 133                 error = -ENFILE;
 134                 f = get_empty_filp();
 135                 if (!f)
 136                         goto out_fd;
 137                 f->f_flags = mode;
 138                 f->f_mode = (mode+1) & O_ACCMODE;
 139                 f->f_dentry = dentry;
 140                 f->f_pos = 0;
 141                 f->f_reada = 0;
 142                 f->f_op = inode->i_op->default_file_ops;
 143                 if (f->f_op->open) {
 144                         error = f->f_op->open(inode,f);
 145                         if (error)
 146                                 goto out_filp;
 147                 }
 148                 file_move(f, l);
 149                 fd_install(fd, f);
 150                 dget(dentry);
 151         }
 152         return fd;
 153
 154 out_filp:
 155         if (error > 0)
 156                 error = -EIO;
 157         put_filp(f);
 158 out_fd:
 159         put_unused_fd(fd);
 160 out:
 161         return error;
 162 }
 163
 164 /*
 165  * Note that a shared library must be both readable and executable due to
 166  * security reasons.
 167  *
 168  * Also note that we take the address to load from from the file itself.
 169  */
 170 asmlinkage int sys_uselib(const char * library)
 171 {
 172         int fd, retval;
 173         struct file * file;
 174         struct linux_binfmt * fmt;
 175
 176         lock_kernel();
 177         fd = sys_open(library, 0, 0);
 178         retval = fd;
 179         if (fd < 0)
 180                 goto out;
 181         file = fget(fd);
 182         retval = -ENOEXEC;
 183         if (file && file->f_dentry && file->f_op && file->f_op->read) {
 184                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 185                         int (*fn)(int) = fmt->load_shlib;
 186                         if (!fn)
 187                                 continue;
 188                         /* N.B. Should use file instead of fd */
 189                         retval = fn(fd);
 190                         if (retval != -ENOEXEC)
 191                                 break;
 192                 }
 193         }
 194         fput(file);
 195         sys_close(fd);
 196 out:
 197         unlock_kernel();
 198         return retval;
 199 }
 200
 201 /*
 202  * count() counts the number of arguments/envelopes
 203  */
 204 static int count(char ** argv)
 205 {
 206         int i = 0;
 207
 208         if (argv != NULL) {
 209                 for (;;) {
 210                         char * p;
 211                         int error;
 212
 213                         error = get_user(p,argv);
 214                         if (error)
 215                                 return error;
 216                         if (!p)
 217                                 break;
 218                         argv++;
 219                         i++;
 220                 }
 221         }
 222         return i;
 223 }
 224
 225 /*
 226  * 'copy_strings()' copies argument/envelope strings from user
 227  * memory to free pages in kernel mem. These are in a format ready
 228  * to be put directly into the top of new user memory.
 229  */
 230 int copy_strings(int argc,char ** argv, struct linux_binprm *bprm)
 231 {
 232         while (argc-- > 0) {
 233                 char *str;
 234                 int len;
 235                 unsigned long pos;
 236
 237                 if (get_user(str, argv+argc) || !str || !(len = strlen_user(str)))
 238                         return -EFAULT;
 239                 if (bprm->p < len)
 240                         return -E2BIG;
 241
 242                 bprm->p -= len;
 243                 /* XXX: add architecture specific overflow check here. */
 244
 245                 pos = bprm->p;
 246                 while (len) {
 247                         char *pag;
 248                         int offset, bytes_to_copy;
 249
 250                         offset = pos % PAGE_SIZE;
 251                         if (!(pag = (char *) bprm->page[pos/PAGE_SIZE]) &&
 252                             !(pag = (char *) bprm->page[pos/PAGE_SIZE] =
 253                               (unsigned long *) get_free_page(GFP_USER)))
 254                                 return -ENOMEM;
 255
 256                         bytes_to_copy = PAGE_SIZE - offset;
 257                         if (bytes_to_copy > len)
 258                                 bytes_to_copy = len;
 259                         if (copy_from_user(pag + offset, str, bytes_to_copy))
 260                                 return -EFAULT;
 261
 262                         pos += bytes_to_copy;
 263                         str += bytes_to_copy;
 264                         len -= bytes_to_copy;
 265                 }
 266         }
 267         return 0;
 268 }
 269
 270 /*
 271  * Like copy_strings, but get argv and its values from kernel memory.
 272  */
 273 int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
 274 {
 275         int r;
 276         mm_segment_t oldfs = get_fs();
 277         set_fs(KERNEL_DS);
 278         r = copy_strings(argc, argv, bprm);
 279         set_fs(oldfs);
 280         return r;
 281 }
 282
 283 int setup_arg_pages(struct linux_binprm *bprm)
 284 {
 285         unsigned long stack_base;
 286         struct vm_area_struct *mpnt;
 287         int i;
 288
 289         stack_base = STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE;
 290
 291         bprm->p += stack_base;
 292         if (bprm->loader)
 293                 bprm->loader += stack_base;
 294         bprm->exec += stack_base;
 295
 296         mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 297         if (!mpnt)
 298                 return -ENOMEM;
 299
 300         {
 301                 mpnt->vm_mm = current->mm;
 302                 mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
 303                 mpnt->vm_end = STACK_TOP;
 304                 mpnt->vm_page_prot = PAGE_COPY;
 305                 mpnt->vm_flags = VM_STACK_FLAGS;
 306                 mpnt->vm_ops = NULL;
 307                 mpnt->vm_offset = 0;
 308                 mpnt->vm_file = NULL;
 309                 mpnt->vm_pte = 0;
 310                 insert_vm_struct(current->mm, mpnt);
 311                 current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 312         }
 313
 314         for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
 315                 if (bprm->page[i]) {
 316                         current->mm->rss++;
 317                         put_dirty_page(current,bprm->page[i],stack_base);
 318                 }
 319                 stack_base += PAGE_SIZE;
 320         }
 321
 322         return 0;
 323 }
 324
 325 /*
 326  * Read in the complete executable. This is used for "-N" files
 327  * that aren't on a block boundary, and for files on filesystems
 328  * without get_block support.
 329  */
 330 int read_exec(struct dentry *dentry, unsigned long offset,
 331         char * addr, unsigned long count, int to_kmem)
 332 {
 333         struct file file;
 334         struct inode * inode = dentry->d_inode;
 335         int result = -ENOEXEC;
 336
 337         if (!inode->i_op || !inode->i_op->default_file_ops)
 338                 goto end_readexec;
 339         if (init_private_file(&file, dentry, 1))
 340                 goto end_readexec;
 341         if (!file.f_op->read)
 342                 goto close_readexec;
 343         if (file.f_op->llseek) {
 344                 if (file.f_op->llseek(&file,offset,0) != offset)
 345                         goto close_readexec;
 346         } else
 347                 file.f_pos = offset;
 348         if (to_kmem) {
 349                 mm_segment_t old_fs = get_fs();
 350                 set_fs(get_ds());
 351                 result = file.f_op->read(&file, addr, count, &file.f_pos);
 352                 set_fs(old_fs);
 353         } else {
 354                 result = verify_area(VERIFY_WRITE, addr, count);
 355                 if (result)
 356                         goto close_readexec;
 357                 result = file.f_op->read(&file, addr, count, &file.f_pos);
 358         }
 359 close_readexec:
 360         if (file.f_op->release)
 361                 file.f_op->release(inode,&file);
 362 end_readexec:
 363         return result;
 364 }
 365
 366 static int exec_mmap(void)
 367 {
 368         struct mm_struct * mm, * old_mm;
 369
 370         old_mm = current->mm;
 371         if (old_mm && atomic_read(&old_mm->mm_users) == 1) {
 372                 flush_cache_mm(old_mm);
 373                 mm_release();
 374                 release_segments(old_mm);
 375                 exit_mmap(old_mm);
 376                 flush_tlb_mm(old_mm);
 377                 return 0;
 378         }
 379
 380         mm = mm_alloc();
 381         if (mm) {
 382                 mm->cpu_vm_mask = (1UL << smp_processor_id());
 383                 mm->total_vm = 0;
 384                 mm->rss = 0;
 385                 mm->pgd = pgd_alloc();
 386                 if (mm->pgd) {
 387                         struct mm_struct *active_mm = current->active_mm;
 388
 389                         current->mm = mm;
 390                         current->active_mm = mm;
 391                         activate_context();
 392                         mm_release();
 393                         if (old_mm) {
 394                                 mmput(old_mm);
 395                                 return 0;
 396                         }
 397                         mmdrop(active_mm);
 398                         return 0;
 399                 }
 400                 kmem_cache_free(mm_cachep, mm);
 401         }
 402         return -ENOMEM;
 403 }
 404
 405 /*
 406  * This function makes sure the current process has its own signal table,
 407  * so that flush_signal_handlers can later reset the handlers without
 408  * disturbing other processes.  (Other processes might share the signal
 409  * table via the CLONE_SIGHAND option to clone().)
 410  */
 411
 412 static inline int make_private_signals(void)
 413 {
 414         struct signal_struct * newsig;
 415
 416         if (atomic_read(&current->sig->count) <= 1)
 417                 return 0;
 418         newsig = kmalloc(sizeof(*newsig), GFP_KERNEL);
 419         if (newsig == NULL)
 420                 return -ENOMEM;
 421         spin_lock_init(&newsig->siglock);
 422         atomic_set(&newsig->count, 1);
 423         memcpy(newsig->action, current->sig->action, sizeof(newsig->action));
 424         current->sig = newsig;
 425         return 0;
 426 }
 427
 428 /*
 429  * If make_private_signals() made a copy of the signal table, decrement the
 430  * refcount of the original table, and free it if necessary.
 431  * We don't do that in make_private_signals() so that we can back off
 432  * in flush_old_exec() if an error occurs after calling make_private_signals().
 433  */
 434
 435 static inline void release_old_signals(struct signal_struct * oldsig)
 436 {
 437         if (current->sig == oldsig)
 438                 return;
 439         if (atomic_dec_and_test(&oldsig->count))
 440                 kfree(oldsig);
 441 }
 442
 443 /*
 444  * These functions flushes out all traces of the currently running executable
 445  * so that a new one can be started
 446  */
 447
 448 static inline void flush_old_files(struct files_struct * files)
 449 {
 450         unsigned long j;
 451
 452         j = 0;
 453         for (;;) {
 454                 unsigned long set, i;
 455
 456                 i = j * __NFDBITS;
 457                 if (i >= files->max_fds)
 458                         break;
 459                 set = xchg(&files->close_on_exec.fds_bits[j], 0);
 460                 j++;
 461                 for ( ; set ; i++,set >>= 1) {
 462                         if (set & 1)
 463                                 sys_close(i);
 464                 }
 465         }
 466 }
 467
 468 int flush_old_exec(struct linux_binprm * bprm)
 469 {
 470         char * name;
 471         int i, ch, retval;
 472         struct signal_struct * oldsig;
 473
 474         /*
 475          * Make sure we have a private signal table
 476          */
 477         oldsig = current->sig;
 478         retval = make_private_signals();
 479         if (retval) goto flush_failed;
 480
 481         /*
 482          * Release all of the old mmap stuff
 483          */
 484         retval = exec_mmap();
 485         if (retval) goto mmap_failed;
 486
 487         /* This is the point of no return */
 488         release_old_signals(oldsig);
 489
 490         if (current->euid == current->uid && current->egid == current->gid)
 491                 current->dumpable = 1;
 492         name = bprm->filename;
 493         for (i=0; (ch = *(name++)) != '\0';) {
 494                 if (ch == '/')
 495                         i = 0;
 496                 else
 497                         if (i < 15)
 498                                 current->comm[i++] = ch;
 499         }
 500         current->comm[i] = '\0';
 501
 502         flush_thread();
 503
 504         if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
 505             permission(bprm->dentry->d_inode,MAY_READ))
 506                 current->dumpable = 0;
 507
 508         flush_signal_handlers(current);
 509         flush_old_files(current->files);
 510
 511         return 0;
 512
 513 mmap_failed:
 514         if (current->sig != oldsig)
 515                 kfree(current->sig);
 516 flush_failed:
 517         current->sig = oldsig;
 518         return retval;
 519 }
 520
 521 /*
 522  * We mustn't allow tracing of suid binaries, unless
 523  * the tracer has the capability to trace anything..
 524  */
 525 static inline int must_not_trace_exec(struct task_struct * p)
 526 {
 527         return (p->flags & PF_PTRACED) && !cap_raised(p->p_pptr->cap_effective, CAP_SYS_PTRACE);
 528 }
 529
 530 /*
 531  * Fill the binprm structure from the inode.
 532  * Check permissions, then read the first 512 bytes
 533  */
 534 int prepare_binprm(struct linux_binprm *bprm)
 535 {
 536         int mode;
 537         int retval,id_change,cap_raised;
 538         struct inode * inode = bprm->dentry->d_inode;
 539
 540         mode = inode->i_mode;
 541         if (!S_ISREG(mode))                     /* must be regular file */
 542                 return -EACCES;
 543         if (!(mode & 0111))                     /* with at least _one_ execute bit set */
 544                 return -EACCES;
 545         if (IS_NOEXEC(inode))                   /* FS mustn't be mounted noexec */
 546                 return -EACCES;
 547         if (!inode->i_sb)
 548                 return -EACCES;
 549         if ((retval = permission(inode, MAY_EXEC)) != 0)
 550                 return retval;
 551         /* better not execute files which are being written to */
 552         if (atomic_read(&inode->i_writecount) > 0)
 553                 return -ETXTBSY;
 554
 555         bprm->e_uid = current->euid;
 556         bprm->e_gid = current->egid;
 557         id_change = cap_raised = 0;
 558
 559         /* Set-uid? */
 560         if (mode & S_ISUID) {
 561                 bprm->e_uid = inode->i_uid;
 562                 if (bprm->e_uid != current->euid)
 563                         id_change = 1;
 564         }
 565
 566         /* Set-gid? */
 567         /*
 568          * If setgid is set but no group execute bit then this
 569          * is a candidate for mandatory locking, not a setgid
 570          * executable.
 571          */
 572         if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
 573                 bprm->e_gid = inode->i_gid;
 574                 if (!in_group_p(bprm->e_gid))
 575                         id_change = 1;
 576         }
 577
 578         /* We don't have VFS support for capabilities yet */
 579         cap_clear(bprm->cap_inheritable);
 580         cap_clear(bprm->cap_permitted);
 581         cap_clear(bprm->cap_effective);
 582
 583         /*  To support inheritance of root-permissions and suid-root
 584          *  executables under compatibility mode, we raise the
 585          *  effective and inherited bitmasks of the executable file
 586          *  (translation: we set the executable "capability dumb" and
 587          *  set the allowed set to maximum). We don't set any forced
 588          *  bits.
 589          *
 590          *  If only the real uid is 0, we only raise the inheritable
 591          *  bitmask of the executable file (translation: we set the
 592          *  allowed set to maximum and the application to "capability
 593          *  smart").
 594          */
 595
 596         if (!issecure(SECURE_NOROOT)) {
 597                 if (bprm->e_uid == 0 || current->uid == 0)
 598                         cap_set_full(bprm->cap_inheritable);
 599                 if (bprm->e_uid == 0)
 600                         cap_set_full(bprm->cap_effective);
 601         }
 602
 603         /* Only if pP' is _not_ a subset of pP, do we consider there
 604          * has been a capability related "change of capability".  In
 605          * such cases, we need to check that the elevation of
 606          * privilege does not go against other system constraints.
 607          * The new Permitted set is defined below -- see (***). */
 608         {
 609                 kernel_cap_t working =
 610                         cap_combine(bprm->cap_permitted,
 611                                     cap_intersect(bprm->cap_inheritable,
 612                                                   current->cap_inheritable));
 613                 if (!cap_issubset(working, current->cap_permitted)) {
 614                         cap_raised = 1;
 615                 }
 616         }
 617
 618         if (id_change || cap_raised) {
 619                 /* We can't suid-execute if we're sharing parts of the executable */
 620                 /* or if we're being traced (or if suid execs are not allowed)    */
 621                 /* (current->mm->mm_users > 1 is ok, as we'll get a new mm anyway)   */
 622                 if (IS_NOSUID(inode)
 623                     || must_not_trace_exec(current)
 624                     || (atomic_read(&current->fs->count) > 1)
 625                     || (atomic_read(&current->sig->count) > 1)
 626                     || (atomic_read(&current->files->count) > 1)) {
 627                         if (id_change && !capable(CAP_SETUID))
 628                                 return -EPERM;
 629                         if (cap_raised && !capable(CAP_SETPCAP))
 630                                 return -EPERM;
 631                 }
 632         }
 633
 634         memset(bprm->buf,0,sizeof(bprm->buf));
 635         return read_exec(bprm->dentry,0,bprm->buf,128,1);
 636 }
 637
 638 /*
 639  * This function is used to produce the new IDs and capabilities
 640  * from the old ones and the file's capabilities.
 641  *
 642  * The formula used for evolving capabilities is:
 643  *
 644  *       pI' = pI
 645  * (***) pP' = fP | (fI & pI)
 646  *       pE' = pP' & fE          [NB. fE is 0 or ~0]
 647  *
 648  * I=Inheritable, P=Permitted, E=Effective // p=process, f=file
 649  * ' indicates post-exec().
 650  */
 651
 652 void compute_creds(struct linux_binprm *bprm)
 653 {
 654         int new_permitted = cap_t(bprm->cap_permitted) |
 655                 (cap_t(bprm->cap_inheritable) &
 656                  cap_t(current->cap_inheritable));
 657
 658         /* For init, we want to retain the capabilities set
 659          * in the init_task struct. Thus we skip the usual
 660          * capability rules */
 661         if (current->pid != 1) {
 662                 cap_t(current->cap_permitted) = new_permitted;
 663                 cap_t(current->cap_effective) = new_permitted &
 664                                                 cap_t(bprm->cap_effective);
 665         }
 666
 667         /* AUD: Audit candidate if current->cap_effective is set */
 668
 669         current->suid = current->euid = current->fsuid = bprm->e_uid;
 670         current->sgid = current->egid = current->fsgid = bprm->e_gid;
 671         if (current->euid != current->uid || current->egid != current->gid ||
 672             !cap_issubset(new_permitted, current->cap_permitted))
 673                 current->dumpable = 0;
 674 }
 675
 676
 677 void remove_arg_zero(struct linux_binprm *bprm)
 678 {
 679         if (bprm->argc) {
 680                 unsigned long offset;
 681                 char * page;
 682                 offset = bprm->p % PAGE_SIZE;
 683                 page = (char*)bprm->page[bprm->p/PAGE_SIZE];
 684                 while(bprm->p++,*(page+offset++))
 685                         if(offset==PAGE_SIZE){
 686                                 offset=0;
 687                                 page = (char*)bprm->page[bprm->p/PAGE_SIZE];
 688                         }
 689                 bprm->argc--;
 690         }
 691 }
 692
 693 /*
 694  * cycle the list of binary formats handler, until one recognizes the image
 695  */
 696 int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 697 {
 698         int try,retval=0;
 699         struct linux_binfmt *fmt;
 700 #ifdef __alpha__
 701         /* handle /sbin/loader.. */
 702         {
 703             struct exec * eh = (struct exec *) bprm->buf;
 704             struct linux_binprm bprm_loader;
 705
 706             if (!bprm->loader && eh->fh.f_magic == 0x183 &&
 707                 (eh->fh.f_flags & 0x3000) == 0x3000)
 708             {
 709                 int i;
 710                 char * dynloader[] = { "/sbin/loader" };
 711                 struct dentry * dentry;
 712
 713                 dput(bprm->dentry);
 714                 bprm->dentry = NULL;
 715
 716                 bprm_loader.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 717                 for (i=0 ; i<MAX_ARG_PAGES ; i++)       /* clear page-table */
 718                     bprm_loader.page[i] = 0;
 719
 720                 dentry = open_namei(dynloader[0], 0, 0);
 721                 retval = PTR_ERR(dentry);
 722                 if (IS_ERR(dentry))
 723                         return retval;
 724                 bprm->dentry = dentry;
 725                 bprm->loader = bprm_loader.p;
 726                 retval = prepare_binprm(bprm);
 727                 if (retval<0)
 728                         return retval;
 729                 /* should call search_binary_handler recursively here,
 730                    but it does not matter */
 731             }
 732         }
 733 #endif
 734         for (try=0; try<2; try++) {
 735                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 736                         int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
 737                         if (!fn)
 738                                 continue;
 739                         retval = fn(bprm, regs);
 740                         if (retval >= 0) {
 741                                 if (bprm->dentry)
 742                                         dput(bprm->dentry);
 743                                 bprm->dentry = NULL;
 744                                 current->did_exec = 1;
 745                                 return retval;
 746                         }
 747                         if (retval != -ENOEXEC)
 748                                 break;
 749                         if (!bprm->dentry) /* We don't have the dentry anymore */
 750                                 return retval;
 751                 }
 752                 if (retval != -ENOEXEC) {
 753                         break;
 754 #ifdef CONFIG_KMOD
 755                 }else{
 756 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
 757                         char modname[20];
 758                         if (printable(bprm->buf[0]) &&
 759                             printable(bprm->buf[1]) &&
 760                             printable(bprm->buf[2]) &&
 761                             printable(bprm->buf[3]))
 762                                 break; /* -ENOEXEC */
 763                         sprintf(modname, "binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
 764                         request_module(modname);
 765 #endif
 766                 }
 767         }
 768         return retval;
 769 }
 770
 771
 772 /*
 773  * sys_execve() executes a new program.
 774  */
 775 int do_execve(char * filename, char ** argv, char ** envp, struct pt_regs * regs)
 776 {
 777         struct linux_binprm bprm;
 778         struct dentry * dentry;
 779         int retval;
 780         int i;
 781
 782         bprm.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 783         memset(bprm.page, 0, MAX_ARG_PAGES*sizeof(bprm.page[0]));
 784
 785         dentry = open_namei(filename, 0, 0);
 786         retval = PTR_ERR(dentry);
 787         if (IS_ERR(dentry))
 788                 return retval;
 789
 790         bprm.dentry = dentry;
 791         bprm.filename = filename;
 792         bprm.sh_bang = 0;
 793         bprm.loader = 0;
 794         bprm.exec = 0;
 795         if ((bprm.argc = count(argv)) < 0) {
 796                 dput(dentry);
 797                 return bprm.argc;
 798         }
 799
 800         if ((bprm.envc = count(envp)) < 0) {
 801                 dput(dentry);
 802                 return bprm.envc;
 803         }
 804
 805         retval = prepare_binprm(&bprm);
 806         if (retval < 0)
 807                 goto out;
 808
 809         retval = copy_strings_kernel(1, &bprm.filename, &bprm);
 810         if (retval < 0)
 811                 goto out;
 812
 813         bprm.exec = bprm.p;
 814         retval = copy_strings(bprm.envc, envp, &bprm);
 815         if (retval < 0)
 816                 goto out;
 817
 818         retval = copy_strings(bprm.argc, argv, &bprm);
 819         if (retval < 0)
 820                 goto out;
 821
 822         retval = search_binary_handler(&bprm,regs);
 823         if (retval >= 0)
 824                 /* execve success */
 825                 return retval;
 826
 827 out:
 828         /* Something went wrong, return the inode and free the argument pages*/
 829         if (bprm.dentry)
 830                 dput(bprm.dentry);
 831
 832         /* Assumes that free_page() can take a NULL argument. */
 833         /* I hope this is ok for all architectures */
 834         for (i=0 ; i<MAX_ARG_PAGES ; i++)
 835                 free_page(bprm.page[i]);
 836
 837         return retval;
 838 }
 839
 840 int do_coredump(long signr, struct pt_regs * regs)
 841 {
 842         struct linux_binfmt * binfmt;
 843         char corename[6+sizeof(current->comm)];
 844         struct file * file;
 845         struct dentry * dentry;
 846         struct inode * inode;
 847
 848         lock_kernel();
 849         binfmt = current->binfmt;
 850         if (!binfmt || !binfmt->core_dump)
 851                 goto fail;
 852         if (!current->dumpable || atomic_read(&current->mm->mm_users) != 1)
 853         current->dumpable = 0;
 854         if (current->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
 855                 goto fail;
 856
 857         memcpy(corename,"core.", 5);
 858 #if 0
 859         memcpy(corename+5,current->comm,sizeof(current->comm));
 860 #else
 861         corename[4] = '\0';
 862 #endif
 863         file = filp_open(corename, O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600);
 864         if (IS_ERR(file))
 865                 goto fail;
 866         dentry = file->f_dentry;
 867         inode = dentry->d_inode;
 868         if (inode->i_nlink > 1)
 869                 goto close_fail;        /* multiple links - don't dump */
 870
 871         if (!S_ISREG(inode->i_mode))
 872                 goto close_fail;
 873         if (!inode->i_op || !inode->i_op->default_file_ops)
 874                 goto close_fail;
 875         if (!file->f_op->write)
 876                 goto close_fail;
 877         if (!binfmt->core_dump(signr, regs, file))
 878                 goto close_fail;
 879         filp_close(file, NULL);
 880         unlock_kernel();
 881         return 1;
 882
 883 close_fail:
 884         filp_close(file, NULL);
 885 fail:
 886         unlock_kernel();
 887         return 0;
 888 }