fs/exec.c

   1 /*
   2  *  linux/fs/exec.c
   3  *
   4  *  Copyright (C) 1991, 1992  Linus Torvalds
   5  */
   6
   7 /*
   8  * #!-checking implemented by tytso.
   9  */
  10 /*
  11  * Demand-loading implemented 01.12.91 - no need to read anything but
  12  * the header into memory. The inode of the executable is put into
  13  * "current->executable", and page faults do the actual loading. Clean.
  14  *
  15  * Once more I can proudly say that linux stood up to being changed: it
  16  * was less than 2 hours work to get demand-loading completely implemented.
  17  *
  18  * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
  19  * current->executable is only used by the procfs.  This allows a dispatch
  20  * table to check for several different types  of binary formats.  We keep
  21  * trying until we recognize the file or we run out of supported binary
  22  * formats.
  23  */
  24
  25 #include <linux/fs.h>
  26 #include <linux/sched.h>
  27 #include <linux/kernel.h>
  28 #include <linux/mm.h>
  29 #include <linux/slab.h>
  30 #include <linux/file.h>
  31 #include <linux/mman.h>
  32 #include <linux/a.out.h>
  33 #include <linux/errno.h>
  34 #include <linux/signal.h>
  35 #include <linux/string.h>
  36 #include <linux/stat.h>
  37 #include <linux/fcntl.h>
  38 #include <linux/ptrace.h>
  39 #include <linux/user.h>
  40 #include <linux/binfmts.h>
  41 #include <linux/personality.h>
  42 #include <linux/smp.h>
  43 #include <linux/smp_lock.h>
  44 #include <linux/init.h>
  45
  46 #include <asm/system.h>
  47 #include <asm/uaccess.h>
  48 #include <asm/pgtable.h>
  49 #include <asm/mmu_context.h>
  50
  51 #include <linux/config.h>
  52
  53 #ifdef CONFIG_KMOD
  54 #include <linux/kmod.h>
  55 #endif
  56
  57 asmlinkage int sys_exit(int exit_code);
  58 asmlinkage int sys_brk(unsigned long);
  59
  60 /*
  61  * Here are the actual binaries that will be accepted:
  62  * add more with "register_binfmt()" if using modules...
  63  *
  64  * These are defined again for the 'real' modules if you are using a
  65  * module definition for these routines.
  66  */
  67
  68 static struct linux_binfmt *formats = (struct linux_binfmt *) NULL;
  69
  70 __initfunc(void binfmt_setup(void))
  71 {
  72 #ifdef CONFIG_BINFMT_MISC
  73         init_misc_binfmt();
  74 #endif
  75
  76 #ifdef CONFIG_BINFMT_ELF
  77         init_elf_binfmt();
  78 #endif
  79
  80 #ifdef CONFIG_BINFMT_ELF32
  81         init_elf32_binfmt();
  82 #endif
  83
  84 #ifdef CONFIG_BINFMT_AOUT
  85         init_aout_binfmt();
  86 #endif
  87
  88 #ifdef CONFIG_BINFMT_AOUT32
  89         init_aout32_binfmt();
  90 #endif
  91
  92 #ifdef CONFIG_BINFMT_JAVA
  93         init_java_binfmt();
  94 #endif
  95
  96 #ifdef CONFIG_BINFMT_EM86
  97         init_em86_binfmt();
  98 #endif
  99
 100         /* This cannot be configured out of the kernel */
 101         init_script_binfmt();
 102 }
 103
 104 int register_binfmt(struct linux_binfmt * fmt)
 105 {
 106         struct linux_binfmt ** tmp = &formats;
 107
 108         if (!fmt)
 109                 return -EINVAL;
 110         if (fmt->next)
 111                 return -EBUSY;
 112         while (*tmp) {
 113                 if (fmt == *tmp)
 114                         return -EBUSY;
 115                 tmp = &(*tmp)->next;
 116         }
 117         fmt->next = formats;
 118         formats = fmt;
 119         return 0;
 120 }
 121
 122 #ifdef CONFIG_MODULES
 123 int unregister_binfmt(struct linux_binfmt * fmt)
 124 {
 125         struct linux_binfmt ** tmp = &formats;
 126
 127         while (*tmp) {
 128                 if (fmt == *tmp) {
 129                         *tmp = fmt->next;
 130                         return 0;
 131                 }
 132                 tmp = &(*tmp)->next;
 133         }
 134         return -EINVAL;
 135 }
 136 #endif  /* CONFIG_MODULES */
 137
 138 /* N.B. Error returns must be < 0 */
 139 int open_dentry(struct dentry * dentry, int mode)
 140 {
 141         struct inode * inode = dentry->d_inode;
 142         struct file * f;
 143         int fd, error;
 144
 145         error = -EINVAL;
 146         if (!inode->i_op || !inode->i_op->default_file_ops)
 147                 goto out;
 148         fd = get_unused_fd();
 149         if (fd >= 0) {
 150                 error = -ENFILE;
 151                 f = get_empty_filp();
 152                 if (!f)
 153                         goto out_fd;
 154                 f->f_flags = mode;
 155                 f->f_mode = (mode+1) & O_ACCMODE;
 156                 f->f_dentry = dentry;
 157                 f->f_pos = 0;
 158                 f->f_reada = 0;
 159                 f->f_op = inode->i_op->default_file_ops;
 160                 if (f->f_op->open) {
 161                         error = f->f_op->open(inode,f);
 162                         if (error)
 163                                 goto out_filp;
 164                 }
 165                 fd_install(fd, f);
 166                 dget(dentry);
 167         }
 168         return fd;
 169
 170 out_filp:
 171         if (error > 0)
 172                 error = -EIO;
 173         put_filp(f);
 174 out_fd:
 175         put_unused_fd(fd);
 176 out:
 177         return error;
 178 }
 179
 180 /*
 181  * Note that a shared library must be both readable and executable due to
 182  * security reasons.
 183  *
 184  * Also note that we take the address to load from from the file itself.
 185  */
 186 asmlinkage int sys_uselib(const char * library)
 187 {
 188         int fd, retval;
 189         struct file * file;
 190         struct linux_binfmt * fmt;
 191
 192         lock_kernel();
 193         fd = sys_open(library, 0, 0);
 194         retval = fd;
 195         if (fd < 0)
 196                 goto out;
 197         file = fget(fd);
 198         retval = -ENOEXEC;
 199         if (file && file->f_dentry && file->f_op && file->f_op->read) {
 200                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 201                         int (*fn)(int) = fmt->load_shlib;
 202                         if (!fn)
 203                                 continue;
 204                         /* N.B. Should use file instead of fd */
 205                         retval = fn(fd);
 206                         if (retval != -ENOEXEC)
 207                                 break;
 208                 }
 209         }
 210         fput(file);
 211         sys_close(fd);
 212 out:
 213         unlock_kernel();
 214         return retval;
 215 }
 216
 217 /*
 218  * count() counts the number of arguments/envelopes
 219  */
 220 static int count(char ** argv)
 221 {
 222         int i = 0;
 223
 224         if (argv != NULL) {
 225                 for (;;) {
 226                         char * p;
 227                         int error;
 228
 229                         error = get_user(p,argv);
 230                         if (error)
 231                                 return error;
 232                         if (!p)
 233                                 break;
 234                         argv++;
 235                         i++;
 236                 }
 237         }
 238         return i;
 239 }
 240
 241 /*
 242  * 'copy_string()' copies argument/envelope strings from user
 243  * memory to free pages in kernel mem. These are in a format ready
 244  * to be put directly into the top of new user memory.
 245  *
 246  * Modified by TYT, 11/24/91 to add the from_kmem argument, which specifies
 247  * whether the string and the string array are from user or kernel segments:
 248  *
 249  * from_kmem     argv *        argv **
 250  *    0          user space    user space
 251  *    1          kernel space  user space
 252  *    2          kernel space  kernel space
 253  *
 254  * We do this by playing games with the fs segment register.  Since it
 255  * is expensive to load a segment register, we try to avoid calling
 256  * set_fs() unless we absolutely have to.
 257  */
 258 unsigned long copy_strings(int argc,char ** argv,unsigned long *page,
 259                 unsigned long p, int from_kmem)
 260 {
 261         char *str;
 262         mm_segment_t old_fs;
 263
 264         if (!p)
 265                 return 0;       /* bullet-proofing */
 266         old_fs = get_fs();
 267         if (from_kmem==2)
 268                 set_fs(KERNEL_DS);
 269         while (argc-- > 0) {
 270                 int len;
 271                 unsigned long pos;
 272
 273                 if (from_kmem == 1)
 274                         set_fs(KERNEL_DS);
 275                 get_user(str, argv+argc);
 276                 if (!str)
 277                         panic("VFS: argc is wrong");
 278                 if (from_kmem == 1)
 279                         set_fs(old_fs);
 280                 len = strlen_user(str); /* includes the '\0' */
 281                 if (p < len) {  /* this shouldn't happen - 128kB */
 282                         set_fs(old_fs);
 283                         return 0;
 284                 }
 285                 p -= len;
 286                 pos = p;
 287                 while (len) {
 288                         char *pag;
 289                         int offset, bytes_to_copy;
 290
 291                         offset = pos % PAGE_SIZE;
 292                         if (!(pag = (char *) page[pos/PAGE_SIZE]) &&
 293                             !(pag = (char *) page[pos/PAGE_SIZE] =
 294                               (unsigned long *) get_free_page(GFP_USER))) {
 295                                 if (from_kmem==2)
 296                                         set_fs(old_fs);
 297                                 return 0;
 298                         }
 299                         bytes_to_copy = PAGE_SIZE - offset;
 300                         if (bytes_to_copy > len)
 301                                 bytes_to_copy = len;
 302                         copy_from_user(pag + offset, str, bytes_to_copy);
 303                         pos += bytes_to_copy;
 304                         str += bytes_to_copy;
 305                         len -= bytes_to_copy;
 306                 }
 307         }
 308         if (from_kmem==2)
 309                 set_fs(old_fs);
 310         return p;
 311 }
 312
 313 unsigned long setup_arg_pages(unsigned long p, struct linux_binprm * bprm)
 314 {
 315         unsigned long stack_base;
 316         struct vm_area_struct *mpnt;
 317         int i;
 318
 319         stack_base = STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE;
 320
 321         p += stack_base;
 322         if (bprm->loader)
 323                 bprm->loader += stack_base;
 324         bprm->exec += stack_base;
 325
 326         mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 327         if (mpnt) {
 328                 mpnt->vm_mm = current->mm;
 329                 mpnt->vm_start = PAGE_MASK & (unsigned long) p;
 330                 mpnt->vm_end = STACK_TOP;
 331                 mpnt->vm_page_prot = PAGE_COPY;
 332                 mpnt->vm_flags = VM_STACK_FLAGS;
 333                 mpnt->vm_ops = NULL;
 334                 mpnt->vm_offset = 0;
 335                 mpnt->vm_file = NULL;
 336                 mpnt->vm_pte = 0;
 337                 insert_vm_struct(current->mm, mpnt);
 338                 current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 339         }
 340
 341         for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
 342                 if (bprm->page[i]) {
 343                         current->mm->rss++;
 344                         put_dirty_page(current,bprm->page[i],stack_base);
 345                 }
 346                 stack_base += PAGE_SIZE;
 347         }
 348         return p;
 349 }
 350
 351 /*
 352  * Read in the complete executable. This is used for "-N" files
 353  * that aren't on a block boundary, and for files on filesystems
 354  * without bmap support.
 355  */
 356 int read_exec(struct dentry *dentry, unsigned long offset,
 357         char * addr, unsigned long count, int to_kmem)
 358 {
 359         struct file file;
 360         struct inode * inode = dentry->d_inode;
 361         int result = -ENOEXEC;
 362
 363         if (!inode->i_op || !inode->i_op->default_file_ops)
 364                 goto end_readexec;
 365         if (init_private_file(&file, dentry, 1))
 366                 goto end_readexec;
 367         if (!file.f_op->read)
 368                 goto close_readexec;
 369         if (file.f_op->llseek) {
 370                 if (file.f_op->llseek(&file,offset,0) != offset)
 371                         goto close_readexec;
 372         } else
 373                 file.f_pos = offset;
 374         if (to_kmem) {
 375                 mm_segment_t old_fs = get_fs();
 376                 set_fs(get_ds());
 377                 result = file.f_op->read(&file, addr, count, &file.f_pos);
 378                 set_fs(old_fs);
 379         } else {
 380                 result = verify_area(VERIFY_WRITE, addr, count);
 381                 if (result)
 382                         goto close_readexec;
 383                 result = file.f_op->read(&file, addr, count, &file.f_pos);
 384         }
 385 close_readexec:
 386         if (file.f_op->release)
 387                 file.f_op->release(inode,&file);
 388 end_readexec:
 389         return result;
 390 }
 391
 392 static int exec_mmap(void)
 393 {
 394         struct mm_struct * mm, * old_mm;
 395         int retval, nr;
 396
 397         if (atomic_read(&current->mm->count) == 1) {
 398                 flush_cache_mm(current->mm);
 399                 exit_mmap(current->mm);
 400                 clear_page_tables(current);
 401                 flush_tlb_mm(current->mm);
 402                 return 0;
 403         }
 404
 405         /*
 406          * The clear_page_tables done later on exec does the right thing
 407          * to the page directory when shared, except for graceful abort
 408          * (the oom is wrong there, too, IMHO)
 409          */
 410         retval = -ENOMEM;
 411         mm = mm_alloc();
 412         if (!mm)
 413                 goto fail_nomem;
 414
 415         mm->cpu_vm_mask = (1UL << smp_processor_id());
 416         mm->total_vm = 0;
 417         mm->rss = 0;
 418         /*
 419          * Make sure we have a private ldt if needed ...
 420          */
 421         nr = current->tarray_ptr - &task[0];
 422         copy_segments(nr, current, mm);
 423
 424         old_mm = current->mm;
 425         current->mm = mm;
 426         retval = new_page_tables(current);
 427         if (retval)
 428                 goto fail_restore;
 429         activate_context(current);
 430         up(&mm->mmap_sem);
 431         mmput(old_mm);
 432         return 0;
 433
 434         /*
 435          * Failure ... restore the prior mm_struct.
 436          */
 437 fail_restore:
 438         /* The pgd belongs to the parent ... don't free it! */
 439         mm->pgd = NULL;
 440         current->mm = old_mm;
 441         /* restore the ldt for this task */
 442         copy_segments(nr, current, NULL);
 443         mmput(mm);
 444
 445 fail_nomem:
 446         return retval;
 447 }
 448
 449 /*
 450  * This function makes sure the current process has its own signal table,
 451  * so that flush_old_signals can later reset the signals without disturbing
 452  * other processes.  (Other processes might share the signal table via
 453  * the CLONE_SIGHAND option to clone().)
 454  */
 455
 456 static inline int make_private_signals(void)
 457 {
 458         struct signal_struct * newsig;
 459
 460         if (atomic_read(&current->sig->count) <= 1)
 461                 return 0;
 462         newsig = kmalloc(sizeof(*newsig), GFP_KERNEL);
 463         if (newsig == NULL)
 464                 return -ENOMEM;
 465         spin_lock_init(&newsig->siglock);
 466         atomic_set(&newsig->count, 1);
 467         memcpy(newsig->action, current->sig->action, sizeof(newsig->action));
 468         current->sig = newsig;
 469         return 0;
 470 }
 471
 472 /*
 473  * If make_private_signals() made a copy of the signal table, decrement the
 474  * refcount of the original table, and free it if necessary.
 475  * We don't do that in make_private_signals() so that we can back off
 476  * in flush_old_exec() if an error occurs after calling make_private_signals().
 477  */
 478
 479 static inline void release_old_signals(struct signal_struct * oldsig)
 480 {
 481         if (current->sig == oldsig)
 482                 return;
 483         if (atomic_dec_and_test(&oldsig->count))
 484                 kfree(oldsig);
 485 }
 486
 487 /*
 488  * These functions flushes out all traces of the currently running executable
 489  * so that a new one can be started
 490  */
 491
 492 static inline void flush_old_signals(struct task_struct *t)
 493 {
 494         flush_signals(t);
 495         flush_signal_handlers(t);
 496 }
 497
 498 static inline void flush_old_files(struct files_struct * files)
 499 {
 500         unsigned long j;
 501
 502         j = 0;
 503         for (;;) {
 504                 unsigned long set, i;
 505
 506                 i = j * __NFDBITS;
 507                 if (i >= files->max_fds)
 508                         break;
 509                 set = files->close_on_exec.fds_bits[j];
 510                 files->close_on_exec.fds_bits[j] = 0;
 511                 j++;
 512                 for ( ; set ; i++,set >>= 1) {
 513                         if (set & 1)
 514                                 sys_close(i);
 515                 }
 516         }
 517 }
 518
 519 int flush_old_exec(struct linux_binprm * bprm)
 520 {
 521         char * name;
 522         int i, ch, retval;
 523         struct signal_struct * oldsig;
 524
 525         /*
 526          * Make sure we have a private signal table
 527          */
 528         oldsig = current->sig;
 529         retval = make_private_signals();
 530         if (retval) goto flush_failed;
 531
 532         /*
 533          * Release all of the old mmap stuff
 534          */
 535         retval = exec_mmap();
 536         if (retval) goto mmap_failed;
 537
 538         /* This is the point of no return */
 539         release_old_signals(oldsig);
 540
 541         if (current->euid == current->uid && current->egid == current->gid)
 542                 current->dumpable = 1;
 543         name = bprm->filename;
 544         for (i=0; (ch = *(name++)) != '\0';) {
 545                 if (ch == '/')
 546                         i = 0;
 547                 else
 548                         if (i < 15)
 549                                 current->comm[i++] = ch;
 550         }
 551         current->comm[i] = '\0';
 552
 553         flush_thread();
 554
 555         if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
 556             permission(bprm->dentry->d_inode,MAY_READ))
 557                 current->dumpable = 0;
 558
 559         flush_old_signals(current);
 560         flush_old_files(current->files);
 561
 562         return 0;
 563
 564 mmap_failed:
 565         if (current->sig != oldsig)
 566                 kfree(current->sig);
 567 flush_failed:
 568         current->sig = oldsig;
 569         return retval;
 570 }
 571
 572 /*
 573  * Fill the binprm structure from the inode.
 574  * Check permissions, then read the first 512 bytes
 575  */
 576 int prepare_binprm(struct linux_binprm *bprm)
 577 {
 578         int mode;
 579         int retval,id_change,cap_raised;
 580         struct inode * inode = bprm->dentry->d_inode;
 581
 582         mode = inode->i_mode;
 583         if (!S_ISREG(mode))                     /* must be regular file */
 584                 return -EACCES;
 585         if (!(mode & 0111))                     /* with at least _one_ execute bit set */
 586                 return -EACCES;
 587         if (IS_NOEXEC(inode))                   /* FS mustn't be mounted noexec */
 588                 return -EACCES;
 589         if (!inode->i_sb)
 590                 return -EACCES;
 591         if ((retval = permission(inode, MAY_EXEC)) != 0)
 592                 return retval;
 593         /* better not execute files which are being written to */
 594         if (inode->i_writecount > 0)
 595                 return -ETXTBSY;
 596
 597         bprm->e_uid = current->euid;
 598         bprm->e_gid = current->egid;
 599         id_change = cap_raised = 0;
 600
 601         /* Set-uid? */
 602         if (mode & S_ISUID) {
 603                 bprm->e_uid = inode->i_uid;
 604                 if (bprm->e_uid != current->euid)
 605                         id_change = 1;
 606         }
 607
 608         /* Set-gid? */
 609         /*
 610          * If setgid is set but no group execute bit then this
 611          * is a candidate for mandatory locking, not a setgid
 612          * executable.
 613          */
 614         if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
 615                 bprm->e_gid = inode->i_gid;
 616                 if (!in_group_p(bprm->e_gid))
 617                         id_change = 1;
 618         }
 619
 620         /* We don't have VFS support for capabilities yet */
 621         cap_clear(bprm->cap_inheritable);
 622         cap_clear(bprm->cap_permitted);
 623         cap_clear(bprm->cap_effective);
 624
 625         /*  To support inheritance of root-permissions and suid-root
 626          *  executables under compatibility mode, we raise the
 627          *  effective and inherited bitmasks of the executable file
 628          *  (translation: we set the executable "capability dumb" and
 629          *  set the allowed set to maximum). We don't set any forced
 630          *  bits.
 631          *
 632          *  If only the real uid is 0, we only raise the inheritable
 633          *  bitmask of the executable file (translation: we set the
 634          *  allowed set to maximum and the application to "capability
 635          *  smart").
 636          */
 637
 638         if (!issecure(SECURE_NOROOT)) {
 639                 if (bprm->e_uid == 0 || current->uid == 0)
 640                         cap_set_full(bprm->cap_inheritable);
 641                 if (bprm->e_uid == 0)
 642                         cap_set_full(bprm->cap_effective);
 643         }
 644
 645         /* Only if pP' is _not_ a subset of pP, do we consider there
 646          * has been a capability related "change of capability".  In
 647          * such cases, we need to check that the elevation of
 648          * privilege does not go against other system constraints.
 649          * The new Permitted set is defined below -- see (***). */
 650         {
 651                 kernel_cap_t working =
 652                         cap_combine(bprm->cap_permitted,
 653                                     cap_intersect(bprm->cap_inheritable,
 654                                                   current->cap_inheritable));
 655                 if (!cap_issubset(working, current->cap_permitted)) {
 656                         cap_raised = 1;
 657                 }
 658         }
 659
 660
 661
 662
 663         if (id_change || cap_raised) {
 664                 /* We can't suid-execute if we're sharing parts of the executable */
 665                 /* or if we're being traced (or if suid execs are not allowed)    */
 666                 /* (current->mm->count > 1 is ok, as we'll get a new mm anyway)   */
 667                 if (IS_NOSUID(inode)
 668                     || (current->flags & PF_PTRACED)
 669                     || (atomic_read(&current->fs->count) > 1)
 670                     || (atomic_read(&current->sig->count) > 1)
 671                     || (atomic_read(&current->files->count) > 1)) {
 672                         if (id_change && !capable(CAP_SETUID))
 673                                 return -EPERM;
 674                         if (cap_raised && !capable(CAP_SETPCAP))
 675                                 return -EPERM;
 676                 }
 677         }
 678
 679         memset(bprm->buf,0,sizeof(bprm->buf));
 680         return read_exec(bprm->dentry,0,bprm->buf,128,1);
 681 }
 682
 683 /*
 684  * This function is used to produce the new IDs and capabilities
 685  * from the old ones and the file's capabilities.
 686  *
 687  * The formula used for evolving capabilities is:
 688  *
 689  *       pI' = pI
 690  * (***) pP' = fP | (fI & pI)
 691  *       pE' = pP' & fE          [NB. fE is 0 or ~0]
 692  *
 693  * I=Inheritable, P=Permitted, E=Effective // p=process, f=file
 694  * ' indicates post-exec().
 695  */
 696
 697 void compute_creds(struct linux_binprm *bprm)
 698 {
 699         /* For init, we want to retain the capabilities set
 700          * in the init_task struct. Thus we skip the usual
 701          * capability rules */
 702         if (current->pid != 1) {
 703                 int new_permitted = bprm->cap_permitted.cap |
 704                         (bprm->cap_inheritable.cap &
 705                         current->cap_inheritable.cap);
 706
 707                 current->cap_permitted.cap = new_permitted;
 708                 current->cap_effective.cap = new_permitted &
 709                                                 bprm->cap_effective.cap;
 710         }
 711
 712         /* AUD: Audit candidate if current->cap_effective is set */
 713
 714         current->suid = current->euid = current->fsuid = bprm->e_uid;
 715         current->sgid = current->egid = current->fsgid = bprm->e_gid;
 716         if (current->euid != current->uid || current->egid != current->gid ||
 717             !cap_isclear(current->cap_permitted))
 718                 current->dumpable = 0;
 719 }
 720
 721
 722 void remove_arg_zero(struct linux_binprm *bprm)
 723 {
 724         if (bprm->argc) {
 725                 unsigned long offset;
 726                 char * page;
 727                 offset = bprm->p % PAGE_SIZE;
 728                 page = (char*)bprm->page[bprm->p/PAGE_SIZE];
 729                 while(bprm->p++,*(page+offset++))
 730                         if(offset==PAGE_SIZE){
 731                                 offset=0;
 732                                 page = (char*)bprm->page[bprm->p/PAGE_SIZE];
 733                         }
 734                 bprm->argc--;
 735         }
 736 }
 737
 738 /*
 739  * cycle the list of binary formats handler, until one recognizes the image
 740  */
 741 int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 742 {
 743         int try,retval=0;
 744         struct linux_binfmt *fmt;
 745 #ifdef __alpha__
 746         /* handle /sbin/loader.. */
 747         {
 748             struct exec * eh = (struct exec *) bprm->buf;
 749
 750             if (!bprm->loader && eh->fh.f_magic == 0x183 &&
 751                 (eh->fh.f_flags & 0x3000) == 0x3000)
 752             {
 753                 char * dynloader[] = { "/sbin/loader" };
 754                 struct dentry * dentry;
 755
 756                 dput(bprm->dentry);
 757                 bprm->dentry = NULL;
 758                 remove_arg_zero(bprm);
 759                 bprm->p = copy_strings(1, dynloader, bprm->page, bprm->p, 2);
 760                 bprm->argc++;
 761                 bprm->loader = bprm->p;
 762                 dentry = open_namei(dynloader[0], 0, 0);
 763                 retval = PTR_ERR(dentry);
 764                 if (IS_ERR(dentry))
 765                         return retval;
 766                 bprm->dentry = dentry;
 767                 retval = prepare_binprm(bprm);
 768                 if (retval<0)
 769                         return retval;
 770                 /* should call search_binary_handler recursively here,
 771                    but it does not matter */
 772             }
 773         }
 774 #endif
 775         for (try=0; try<2; try++) {
 776                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 777                         int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
 778                         if (!fn)
 779                                 continue;
 780                         retval = fn(bprm, regs);
 781                         if (retval >= 0) {
 782                                 if (bprm->dentry)
 783                                         dput(bprm->dentry);
 784                                 bprm->dentry = NULL;
 785                                 current->did_exec = 1;
 786                                 return retval;
 787                         }
 788                         if (retval != -ENOEXEC)
 789                                 break;
 790                         if (!bprm->dentry) /* We don't have the dentry anymore */
 791                                 return retval;
 792                 }
 793                 if (retval != -ENOEXEC) {
 794                         break;
 795 #ifdef CONFIG_KMOD
 796                 }else{
 797 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
 798                         char modname[20];
 799                         if (printable(bprm->buf[0]) &&
 800                             printable(bprm->buf[1]) &&
 801                             printable(bprm->buf[2]) &&
 802                             printable(bprm->buf[3]))
 803                                 break; /* -ENOEXEC */
 804                         sprintf(modname, "binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
 805                         request_module(modname);
 806 #endif
 807                 }
 808         }
 809         return retval;
 810 }
 811
 812
 813 /*
 814  * sys_execve() executes a new program.
 815  */
 816 int do_execve(char * filename, char ** argv, char ** envp, struct pt_regs * regs)
 817 {
 818         struct linux_binprm bprm;
 819         struct dentry * dentry;
 820         int retval;
 821         int i;
 822
 823         bprm.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 824         for (i=0 ; i<MAX_ARG_PAGES ; i++)       /* clear page-table */
 825                 bprm.page[i] = 0;
 826
 827         dentry = open_namei(filename, 0, 0);
 828         retval = PTR_ERR(dentry);
 829         if (IS_ERR(dentry))
 830                 return retval;
 831
 832         bprm.dentry = dentry;
 833         bprm.filename = filename;
 834         bprm.sh_bang = 0;
 835         bprm.java = 0;
 836         bprm.loader = 0;
 837         bprm.exec = 0;
 838         if ((bprm.argc = count(argv)) < 0) {
 839                 dput(dentry);
 840                 return bprm.argc;
 841         }
 842
 843         if ((bprm.envc = count(envp)) < 0) {
 844                 dput(dentry);
 845                 return bprm.envc;
 846         }
 847
 848         retval = prepare_binprm(&bprm);
 849
 850         if (retval >= 0) {
 851                 bprm.p = copy_strings(1, &bprm.filename, bprm.page, bprm.p, 2);
 852                 bprm.exec = bprm.p;
 853                 bprm.p = copy_strings(bprm.envc,envp,bprm.page,bprm.p,0);
 854                 bprm.p = copy_strings(bprm.argc,argv,bprm.page,bprm.p,0);
 855                 if (!bprm.p)
 856                         retval = -E2BIG;
 857         }
 858
 859         if (retval >= 0)
 860                 retval = search_binary_handler(&bprm,regs);
 861         if (retval >= 0)
 862                 /* execve success */
 863                 return retval;
 864
 865         /* Something went wrong, return the inode and free the argument pages*/
 866         if (bprm.dentry)
 867                 dput(bprm.dentry);
 868
 869         for (i=0 ; i<MAX_ARG_PAGES ; i++)
 870                 free_page(bprm.page[i]);
 871
 872         return retval;
 873 }