fs/exec.c

   1 /*
   2  *  linux/fs/exec.c
   3  *
   4  *  Copyright (C) 1991, 1992  Linus Torvalds
   5  */
   6
   7 /*
   8  * #!-checking implemented by tytso.
   9  */
  10 /*
  11  * Demand-loading implemented 01.12.91 - no need to read anything but
  12  * the header into memory. The inode of the executable is put into
  13  * "current->executable", and page faults do the actual loading. Clean.
  14  *
  15  * Once more I can proudly say that linux stood up to being changed: it
  16  * was less than 2 hours work to get demand-loading completely implemented.
  17  *
  18  * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
  19  * current->executable is only used by the procfs.  This allows a dispatch
  20  * table to check for several different types  of binary formats.  We keep
  21  * trying until we recognize the file or we run out of supported binary
  22  * formats.
  23  */
  24
  25 #include <linux/config.h>
  26 #include <linux/slab.h>
  27 #include <linux/file.h>
  28 #include <linux/mman.h>
  29 #include <linux/a.out.h>
  30 #include <linux/stat.h>
  31 #include <linux/fcntl.h>
  32 #include <linux/smp_lock.h>
  33 #include <linux/init.h>
  34 #include <linux/pagemap.h>
  35 #include <linux/highmem.h>
  36
  37 #include <asm/uaccess.h>
  38 #include <asm/pgtable.h>
  39 #include <asm/mmu_context.h>
  40
  41 #ifdef CONFIG_KMOD
  42 #include <linux/kmod.h>
  43 #endif
  44
  45 /*
  46  * Here are the actual binaries that will be accepted:
  47  * add more with "register_binfmt()" if using modules...
  48  *
  49  * These are defined again for the 'real' modules if you are using a
  50  * module definition for these routines.
  51  */
  52
  53 static struct linux_binfmt *formats = (struct linux_binfmt *) NULL;
  54
  55 int register_binfmt(struct linux_binfmt * fmt)
  56 {
  57         struct linux_binfmt ** tmp = &formats;
  58
  59         if (!fmt)
  60                 return -EINVAL;
  61         if (fmt->next)
  62                 return -EBUSY;
  63         while (*tmp) {
  64                 if (fmt == *tmp)
  65                         return -EBUSY;
  66                 tmp = &(*tmp)->next;
  67         }
  68         fmt->next = formats;
  69         formats = fmt;
  70         return 0;
  71 }
  72
  73 int unregister_binfmt(struct linux_binfmt * fmt)
  74 {
  75         struct linux_binfmt ** tmp = &formats;
  76
  77         while (*tmp) {
  78                 if (fmt == *tmp) {
  79                         *tmp = fmt->next;
  80                         return 0;
  81                 }
  82                 tmp = &(*tmp)->next;
  83         }
  84         return -EINVAL;
  85 }
  86
  87 /* N.B. Error returns must be < 0 */
  88 int open_dentry(struct dentry * dentry, int mode)
  89 {
  90         struct inode * inode = dentry->d_inode;
  91         struct file * f;
  92         struct list_head * l = NULL;
  93         int fd, error;
  94
  95         if (inode->i_sb)
  96                 l = &inode->i_sb->s_files;
  97
  98         error = -EINVAL;
  99         if (!inode->i_op || !inode->i_op->default_file_ops)
 100                 goto out;
 101         fd = get_unused_fd();
 102         if (fd >= 0) {
 103                 error = -ENFILE;
 104                 f = get_empty_filp();
 105                 if (!f)
 106                         goto out_fd;
 107                 f->f_flags = mode;
 108                 f->f_mode = (mode+1) & O_ACCMODE;
 109                 f->f_dentry = dentry;
 110                 f->f_pos = 0;
 111                 f->f_reada = 0;
 112                 f->f_op = inode->i_op->default_file_ops;
 113                 if (f->f_op->open) {
 114                         error = f->f_op->open(inode,f);
 115                         if (error)
 116                                 goto out_filp;
 117                 }
 118                 file_move(f, l);
 119                 fd_install(fd, f);
 120                 dget(dentry);
 121         }
 122         return fd;
 123
 124 out_filp:
 125         if (error > 0)
 126                 error = -EIO;
 127         put_filp(f);
 128 out_fd:
 129         put_unused_fd(fd);
 130 out:
 131         return error;
 132 }
 133
 134 /*
 135  * Note that a shared library must be both readable and executable due to
 136  * security reasons.
 137  *
 138  * Also note that we take the address to load from from the file itself.
 139  */
 140 asmlinkage long sys_uselib(const char * library)
 141 {
 142         int fd, retval;
 143         struct file * file;
 144         struct linux_binfmt * fmt;
 145
 146         lock_kernel();
 147         fd = sys_open(library, 0, 0);
 148         retval = fd;
 149         if (fd < 0)
 150                 goto out;
 151         file = fget(fd);
 152         retval = -ENOEXEC;
 153         if (file && file->f_dentry && file->f_op && file->f_op->read) {
 154                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 155                         int (*fn)(int) = fmt->load_shlib;
 156                         if (!fn)
 157                                 continue;
 158                         /* N.B. Should use file instead of fd */
 159                         retval = fn(fd);
 160                         if (retval != -ENOEXEC)
 161                                 break;
 162                 }
 163         }
 164         fput(file);
 165         sys_close(fd);
 166 out:
 167         unlock_kernel();
 168         return retval;
 169 }
 170
 171 /*
 172  * count() counts the number of arguments/envelopes
 173  */
 174 static int count(char ** argv, int max)
 175 {
 176         int i = 0;
 177
 178         if (argv != NULL) {
 179                 for (;;) {
 180                         char * p;
 181                         int error;
 182
 183                         error = get_user(p,argv);
 184                         if (error)
 185                                 return error;
 186                         if (!p)
 187                                 break;
 188                         argv++;
 189                         if(++i > max)
 190                                 return -E2BIG;
 191                 }
 192         }
 193         return i;
 194 }
 195
 196 /*
 197  * 'copy_strings()' copies argument/envelope strings from user
 198  * memory to free pages in kernel mem. These are in a format ready
 199  * to be put directly into the top of new user memory.
 200  */
 201 int copy_strings(int argc,char ** argv, struct linux_binprm *bprm)
 202 {
 203         while (argc-- > 0) {
 204                 char *str;
 205                 int len;
 206                 unsigned long pos;
 207
 208                 if (get_user(str, argv+argc) || !str || !(len = strnlen_user(str, bprm->p)))
 209                         return -EFAULT;
 210                 if (bprm->p < len)
 211                         return -E2BIG;
 212
 213                 bprm->p -= len;
 214                 /* XXX: add architecture specific overflow check here. */
 215
 216                 pos = bprm->p;
 217                 while (len > 0) {
 218                         char *kaddr;
 219                         int i, new, err;
 220                         struct page *page;
 221                         int offset, bytes_to_copy;
 222
 223                         offset = pos % PAGE_SIZE;
 224                         i = pos/PAGE_SIZE;
 225                         page = bprm->page[i];
 226                         new = 0;
 227                         if (!page) {
 228                                 /*
 229                                  * Cannot yet use highmem page because
 230                                  * we cannot sleep with a kmap held.
 231                                  */
 232                                 page = __get_pages(GFP_USER, 0);
 233                                 bprm->page[i] = page;
 234                                 if (!page)
 235                                         return -ENOMEM;
 236                                 new = 1;
 237                         }
 238                         kaddr = (char *)kmap(page, KM_WRITE);
 239
 240                         if (new && offset)
 241                                 memset(kaddr, 0, offset);
 242                         bytes_to_copy = PAGE_SIZE - offset;
 243                         if (bytes_to_copy > len) {
 244                                 bytes_to_copy = len;
 245                                 if (new)
 246                                         memset(kaddr+offset+len, 0, PAGE_SIZE-offset-len);
 247                         }
 248                         err = copy_from_user(kaddr + offset, str, bytes_to_copy);
 249                         flush_page_to_ram(page);
 250                         kunmap((unsigned long)kaddr, KM_WRITE);
 251
 252                         if (err)
 253                                 return -EFAULT;
 254
 255                         pos += bytes_to_copy;
 256                         str += bytes_to_copy;
 257                         len -= bytes_to_copy;
 258                 }
 259         }
 260         return 0;
 261 }
 262
 263 /*
 264  * Like copy_strings, but get argv and its values from kernel memory.
 265  */
 266 int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
 267 {
 268         int r;
 269         mm_segment_t oldfs = get_fs();
 270         set_fs(KERNEL_DS);
 271         r = copy_strings(argc, argv, bprm);
 272         set_fs(oldfs);
 273         return r;
 274 }
 275
 276 int setup_arg_pages(struct linux_binprm *bprm)
 277 {
 278         unsigned long stack_base;
 279         struct vm_area_struct *mpnt;
 280         int i;
 281
 282         stack_base = STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE;
 283
 284         bprm->p += stack_base;
 285         if (bprm->loader)
 286                 bprm->loader += stack_base;
 287         bprm->exec += stack_base;
 288
 289         mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 290         if (!mpnt)
 291                 return -ENOMEM;
 292
 293         {
 294                 mpnt->vm_mm = current->mm;
 295                 mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
 296                 mpnt->vm_end = STACK_TOP;
 297                 mpnt->vm_page_prot = PAGE_COPY;
 298                 mpnt->vm_flags = VM_STACK_FLAGS;
 299                 mpnt->vm_ops = NULL;
 300                 mpnt->vm_pgoff = 0;
 301                 mpnt->vm_file = NULL;
 302                 mpnt->vm_private_data = (void *) 0;
 303                 vmlist_modify_lock(current->mm);
 304                 insert_vm_struct(current->mm, mpnt);
 305                 vmlist_modify_unlock(current->mm);
 306                 current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 307         }
 308
 309         for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
 310                 if (bprm->page[i]) {
 311                         current->mm->rss++;
 312                         put_dirty_page(current,bprm->page[i],stack_base);
 313                 }
 314                 stack_base += PAGE_SIZE;
 315         }
 316
 317         return 0;
 318 }
 319
 320 /*
 321  * Read in the complete executable. This is used for "-N" files
 322  * that aren't on a block boundary, and for files on filesystems
 323  * without get_block support.
 324  */
 325 int read_exec(struct dentry *dentry, unsigned long offset,
 326         char * addr, unsigned long count, int to_kmem)
 327 {
 328         struct file file;
 329         struct inode * inode = dentry->d_inode;
 330         int result = -ENOEXEC;
 331
 332         if (!inode->i_op || !inode->i_op->default_file_ops)
 333                 goto end_readexec;
 334         if (init_private_file(&file, dentry, 1))
 335                 goto end_readexec;
 336         if (!file.f_op->read)
 337                 goto close_readexec;
 338         if (file.f_op->llseek) {
 339                 if (file.f_op->llseek(&file,offset,0) != offset)
 340                         goto close_readexec;
 341         } else
 342                 file.f_pos = offset;
 343         if (to_kmem) {
 344                 mm_segment_t old_fs = get_fs();
 345                 set_fs(get_ds());
 346                 result = file.f_op->read(&file, addr, count, &file.f_pos);
 347                 set_fs(old_fs);
 348         } else {
 349                 result = verify_area(VERIFY_WRITE, addr, count);
 350                 if (result)
 351                         goto close_readexec;
 352                 result = file.f_op->read(&file, addr, count, &file.f_pos);
 353         }
 354 close_readexec:
 355         if (file.f_op->release)
 356                 file.f_op->release(inode,&file);
 357 end_readexec:
 358         return result;
 359 }
 360
 361 static int exec_mmap(void)
 362 {
 363         struct mm_struct * mm, * old_mm;
 364
 365         old_mm = current->mm;
 366         if (old_mm && atomic_read(&old_mm->mm_users) == 1) {
 367                 flush_cache_mm(old_mm);
 368                 mm_release();
 369                 exit_mmap(old_mm);
 370                 flush_tlb_mm(old_mm);
 371                 return 0;
 372         }
 373
 374         mm = mm_alloc();
 375         if (mm) {
 376                 struct mm_struct *active_mm = current->active_mm;
 377
 378                 current->mm = mm;
 379                 current->active_mm = mm;
 380                 activate_mm(active_mm, mm);
 381                 mm_release();
 382                 if (old_mm) {
 383                         if (active_mm != old_mm) BUG();
 384                         mmput(old_mm);
 385                         return 0;
 386                 }
 387                 mmdrop(active_mm);
 388                 return 0;
 389         }
 390         return -ENOMEM;
 391 }
 392
 393 /*
 394  * This function makes sure the current process has its own signal table,
 395  * so that flush_signal_handlers can later reset the handlers without
 396  * disturbing other processes.  (Other processes might share the signal
 397  * table via the CLONE_SIGHAND option to clone().)
 398  */
 399
 400 static inline int make_private_signals(void)
 401 {
 402         struct signal_struct * newsig;
 403
 404         if (atomic_read(&current->sig->count) <= 1)
 405                 return 0;
 406         newsig = kmalloc(sizeof(*newsig), GFP_KERNEL);
 407         if (newsig == NULL)
 408                 return -ENOMEM;
 409         spin_lock_init(&newsig->siglock);
 410         atomic_set(&newsig->count, 1);
 411         memcpy(newsig->action, current->sig->action, sizeof(newsig->action));
 412         current->sig = newsig;
 413         return 0;
 414 }
 415
 416 /*
 417  * If make_private_signals() made a copy of the signal table, decrement the
 418  * refcount of the original table, and free it if necessary.
 419  * We don't do that in make_private_signals() so that we can back off
 420  * in flush_old_exec() if an error occurs after calling make_private_signals().
 421  */
 422
 423 static inline void release_old_signals(struct signal_struct * oldsig)
 424 {
 425         if (current->sig == oldsig)
 426                 return;
 427         if (atomic_dec_and_test(&oldsig->count))
 428                 kfree(oldsig);
 429 }
 430
 431 /*
 432  * These functions flushes out all traces of the currently running executable
 433  * so that a new one can be started
 434  */
 435
 436 static inline void flush_old_files(struct files_struct * files)
 437 {
 438         unsigned long j;
 439
 440         j = 0;
 441         for (;;) {
 442                 unsigned long set, i;
 443
 444                 i = j * __NFDBITS;
 445                 if (i >= files->max_fds || i >= files->max_fdset)
 446                         break;
 447                 set = xchg(&files->close_on_exec->fds_bits[j], 0);
 448                 j++;
 449                 for ( ; set ; i++,set >>= 1) {
 450                         if (set & 1)
 451                                 sys_close(i);
 452                 }
 453         }
 454 }
 455
 456 int flush_old_exec(struct linux_binprm * bprm)
 457 {
 458         char * name;
 459         int i, ch, retval;
 460         struct signal_struct * oldsig;
 461
 462         /*
 463          * Make sure we have a private signal table
 464          */
 465         oldsig = current->sig;
 466         retval = make_private_signals();
 467         if (retval) goto flush_failed;
 468
 469         /*
 470          * Release all of the old mmap stuff
 471          */
 472         retval = exec_mmap();
 473         if (retval) goto mmap_failed;
 474
 475         /* This is the point of no return */
 476         release_old_signals(oldsig);
 477
 478         if (current->euid == current->uid && current->egid == current->gid)
 479                 current->dumpable = 1;
 480         name = bprm->filename;
 481         for (i=0; (ch = *(name++)) != '\0';) {
 482                 if (ch == '/')
 483                         i = 0;
 484                 else
 485                         if (i < 15)
 486                                 current->comm[i++] = ch;
 487         }
 488         current->comm[i] = '\0';
 489
 490         flush_thread();
 491
 492         if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
 493             permission(bprm->dentry->d_inode,MAY_READ))
 494                 current->dumpable = 0;
 495
 496         /* An exec changes our domain. We are no longer part of the thread
 497            group */
 498
 499         current->self_exec_id++;
 500
 501         flush_signal_handlers(current);
 502         flush_old_files(current->files);
 503
 504         return 0;
 505
 506 mmap_failed:
 507         if (current->sig != oldsig)
 508                 kfree(current->sig);
 509 flush_failed:
 510         current->sig = oldsig;
 511         return retval;
 512 }
 513
 514 /*
 515  * We mustn't allow tracing of suid binaries, unless
 516  * the tracer has the capability to trace anything..
 517  */
 518 static inline int must_not_trace_exec(struct task_struct * p)
 519 {
 520         return (p->flags & PF_PTRACED) && !cap_raised(p->p_pptr->cap_effective, CAP_SYS_PTRACE);
 521 }
 522
 523 /*
 524  * Fill the binprm structure from the inode.
 525  * Check permissions, then read the first 512 bytes
 526  */
 527 int prepare_binprm(struct linux_binprm *bprm)
 528 {
 529         int mode;
 530         int retval,id_change,cap_raised;
 531         struct inode * inode = bprm->dentry->d_inode;
 532
 533         mode = inode->i_mode;
 534         if (!S_ISREG(mode))                     /* must be regular file */
 535                 return -EACCES;
 536         if (!(mode & 0111))                     /* with at least _one_ execute bit set */
 537                 return -EACCES;
 538         if (IS_NOEXEC(inode))                   /* FS mustn't be mounted noexec */
 539                 return -EACCES;
 540         if (!inode->i_sb)
 541                 return -EACCES;
 542         if ((retval = permission(inode, MAY_EXEC)) != 0)
 543                 return retval;
 544         /* better not execute files which are being written to */
 545         if (atomic_read(&inode->i_writecount) > 0)
 546                 return -ETXTBSY;
 547
 548         bprm->e_uid = current->euid;
 549         bprm->e_gid = current->egid;
 550         id_change = cap_raised = 0;
 551
 552         /* Set-uid? */
 553         if (mode & S_ISUID) {
 554                 bprm->e_uid = inode->i_uid;
 555                 if (bprm->e_uid != current->euid)
 556                         id_change = 1;
 557         }
 558
 559         /* Set-gid? */
 560         /*
 561          * If setgid is set but no group execute bit then this
 562          * is a candidate for mandatory locking, not a setgid
 563          * executable.
 564          */
 565         if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
 566                 bprm->e_gid = inode->i_gid;
 567                 if (!in_group_p(bprm->e_gid))
 568                         id_change = 1;
 569         }
 570
 571         /* We don't have VFS support for capabilities yet */
 572         cap_clear(bprm->cap_inheritable);
 573         cap_clear(bprm->cap_permitted);
 574         cap_clear(bprm->cap_effective);
 575
 576         /*  To support inheritance of root-permissions and suid-root
 577          *  executables under compatibility mode, we raise the
 578          *  effective and inherited bitmasks of the executable file
 579          *  (translation: we set the executable "capability dumb" and
 580          *  set the allowed set to maximum). We don't set any forced
 581          *  bits.
 582          *
 583          *  If only the real uid is 0, we only raise the inheritable
 584          *  bitmask of the executable file (translation: we set the
 585          *  allowed set to maximum and the application to "capability
 586          *  smart").
 587          */
 588
 589         if (!issecure(SECURE_NOROOT)) {
 590                 if (bprm->e_uid == 0 || current->uid == 0)
 591                         cap_set_full(bprm->cap_inheritable);
 592                 if (bprm->e_uid == 0)
 593                         cap_set_full(bprm->cap_effective);
 594         }
 595
 596         /* Only if pP' is _not_ a subset of pP, do we consider there
 597          * has been a capability related "change of capability".  In
 598          * such cases, we need to check that the elevation of
 599          * privilege does not go against other system constraints.
 600          * The new Permitted set is defined below -- see (***). */
 601         {
 602                 kernel_cap_t working =
 603                         cap_combine(bprm->cap_permitted,
 604                                     cap_intersect(bprm->cap_inheritable,
 605                                                   current->cap_inheritable));
 606                 if (!cap_issubset(working, current->cap_permitted)) {
 607                         cap_raised = 1;
 608                 }
 609         }
 610
 611         if (id_change || cap_raised) {
 612                 /* We can't suid-execute if we're sharing parts of the executable */
 613                 /* or if we're being traced (or if suid execs are not allowed)    */
 614                 /* (current->mm->mm_users > 1 is ok, as we'll get a new mm anyway)   */
 615                 if (IS_NOSUID(inode)
 616                     || must_not_trace_exec(current)
 617                     || (atomic_read(&current->fs->count) > 1)
 618                     || (atomic_read(&current->sig->count) > 1)
 619                     || (atomic_read(&current->files->count) > 1)) {
 620                         if (id_change && !capable(CAP_SETUID))
 621                                 return -EPERM;
 622                         if (cap_raised && !capable(CAP_SETPCAP))
 623                                 return -EPERM;
 624                 }
 625         }
 626
 627         memset(bprm->buf,0,sizeof(bprm->buf));
 628         return read_exec(bprm->dentry,0,bprm->buf,128,1);
 629 }
 630
 631 /*
 632  * This function is used to produce the new IDs and capabilities
 633  * from the old ones and the file's capabilities.
 634  *
 635  * The formula used for evolving capabilities is:
 636  *
 637  *       pI' = pI
 638  * (***) pP' = fP | (fI & pI)
 639  *       pE' = pP' & fE          [NB. fE is 0 or ~0]
 640  *
 641  * I=Inheritable, P=Permitted, E=Effective // p=process, f=file
 642  * ' indicates post-exec().
 643  */
 644
 645 void compute_creds(struct linux_binprm *bprm)
 646 {
 647         int new_permitted = cap_t(bprm->cap_permitted) |
 648                 (cap_t(bprm->cap_inheritable) &
 649                  cap_t(current->cap_inheritable));
 650
 651         /* For init, we want to retain the capabilities set
 652          * in the init_task struct. Thus we skip the usual
 653          * capability rules */
 654         if (current->pid != 1) {
 655                 cap_t(current->cap_permitted) = new_permitted;
 656                 cap_t(current->cap_effective) = new_permitted &
 657                                                 cap_t(bprm->cap_effective);
 658         }
 659
 660         /* AUD: Audit candidate if current->cap_effective is set */
 661
 662         current->suid = current->euid = current->fsuid = bprm->e_uid;
 663         current->sgid = current->egid = current->fsgid = bprm->e_gid;
 664         if (current->euid != current->uid || current->egid != current->gid ||
 665             !cap_issubset(new_permitted, current->cap_permitted))
 666                 current->dumpable = 0;
 667 }
 668
 669
 670 void remove_arg_zero(struct linux_binprm *bprm)
 671 {
 672         if (bprm->argc) {
 673                 unsigned long offset;
 674                 char * kaddr;
 675                 struct page *page;
 676
 677                 offset = bprm->p % PAGE_SIZE;
 678                 goto inside;
 679
 680                 while (bprm->p++, *(kaddr+offset++)) {
 681                         if (offset != PAGE_SIZE)
 682                                 continue;
 683                         offset = 0;
 684                         kunmap((unsigned long)kaddr, KM_WRITE);
 685 inside:
 686                         page = bprm->page[bprm->p/PAGE_SIZE];
 687                         kaddr = (char *)kmap(page, KM_WRITE);
 688                 }
 689                 kunmap((unsigned long)kaddr, KM_WRITE);
 690                 bprm->argc--;
 691         }
 692 }
 693
 694 /*
 695  * cycle the list of binary formats handler, until one recognizes the image
 696  */
 697 int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 698 {
 699         int try,retval=0;
 700         struct linux_binfmt *fmt;
 701 #ifdef __alpha__
 702         /* handle /sbin/loader.. */
 703         {
 704             struct exec * eh = (struct exec *) bprm->buf;
 705             struct linux_binprm bprm_loader;
 706
 707             if (!bprm->loader && eh->fh.f_magic == 0x183 &&
 708                 (eh->fh.f_flags & 0x3000) == 0x3000)
 709             {
 710                 int i;
 711                 char * dynloader[] = { "/sbin/loader" };
 712                 struct dentry * dentry;
 713
 714                 dput(bprm->dentry);
 715                 bprm->dentry = NULL;
 716
 717                 bprm_loader.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 718                 for (i = 0 ; i < MAX_ARG_PAGES ; i++)   /* clear page-table */
 719                     bprm_loader.page[i] = NULL;
 720
 721                 dentry = open_namei(dynloader[0], 0, 0);
 722                 retval = PTR_ERR(dentry);
 723                 if (IS_ERR(dentry))
 724                         return retval;
 725                 bprm->dentry = dentry;
 726                 bprm->loader = bprm_loader.p;
 727                 retval = prepare_binprm(bprm);
 728                 if (retval<0)
 729                         return retval;
 730                 /* should call search_binary_handler recursively here,
 731                    but it does not matter */
 732             }
 733         }
 734 #endif
 735         for (try=0; try<2; try++) {
 736                 for (fmt = formats ; fmt ; fmt = fmt->next) {
 737                         int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
 738                         if (!fn)
 739                                 continue;
 740                         retval = fn(bprm, regs);
 741                         if (retval >= 0) {
 742                                 if (bprm->dentry)
 743                                         dput(bprm->dentry);
 744                                 bprm->dentry = NULL;
 745                                 current->did_exec = 1;
 746                                 return retval;
 747                         }
 748                         if (retval != -ENOEXEC)
 749                                 break;
 750                         if (!bprm->dentry) /* We don't have the dentry anymore */
 751                                 return retval;
 752                 }
 753                 if (retval != -ENOEXEC) {
 754                         break;
 755 #ifdef CONFIG_KMOD
 756                 }else{
 757 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
 758                         char modname[20];
 759                         if (printable(bprm->buf[0]) &&
 760                             printable(bprm->buf[1]) &&
 761                             printable(bprm->buf[2]) &&
 762                             printable(bprm->buf[3]))
 763                                 break; /* -ENOEXEC */
 764                         sprintf(modname, "binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
 765                         request_module(modname);
 766 #endif
 767                 }
 768         }
 769         return retval;
 770 }
 771
 772
 773 /*
 774  * sys_execve() executes a new program.
 775  */
 776 int do_execve(char * filename, char ** argv, char ** envp, struct pt_regs * regs)
 777 {
 778         struct linux_binprm bprm;
 779         struct dentry * dentry;
 780         int retval;
 781         int i;
 782
 783         bprm.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
 784         memset(bprm.page, 0, MAX_ARG_PAGES*sizeof(bprm.page[0]));
 785
 786         dentry = open_namei(filename, 0, 0);
 787         retval = PTR_ERR(dentry);
 788         if (IS_ERR(dentry))
 789                 return retval;
 790
 791         bprm.dentry = dentry;
 792         bprm.filename = filename;
 793         bprm.sh_bang = 0;
 794         bprm.loader = 0;
 795         bprm.exec = 0;
 796         if ((bprm.argc = count(argv, bprm.p / sizeof(void *))) < 0) {
 797                 dput(dentry);
 798                 return bprm.argc;
 799         }
 800
 801         if ((bprm.envc = count(envp, bprm.p / sizeof(void *))) < 0) {
 802                 dput(dentry);
 803                 return bprm.envc;
 804         }
 805
 806         retval = prepare_binprm(&bprm);
 807         if (retval < 0)
 808                 goto out;
 809
 810         retval = copy_strings_kernel(1, &bprm.filename, &bprm);
 811         if (retval < 0)
 812                 goto out;
 813
 814         bprm.exec = bprm.p;
 815         retval = copy_strings(bprm.envc, envp, &bprm);
 816         if (retval < 0)
 817                 goto out;
 818
 819         retval = copy_strings(bprm.argc, argv, &bprm);
 820         if (retval < 0)
 821                 goto out;
 822
 823         retval = search_binary_handler(&bprm,regs);
 824         if (retval >= 0)
 825                 /* execve success */
 826                 return retval;
 827
 828 out:
 829         /* Something went wrong, return the inode and free the argument pages*/
 830         if (bprm.dentry)
 831                 dput(bprm.dentry);
 832
 833         /* Assumes that free_page() can take a NULL argument. */
 834         /* I hope this is ok for all architectures */
 835         for (i = 0 ; i < MAX_ARG_PAGES ; i++)
 836                 if (bprm.page[i])
 837                         __free_page(bprm.page[i]);
 838
 839         return retval;
 840 }
 841
 842 int do_coredump(long signr, struct pt_regs * regs)
 843 {
 844         struct linux_binfmt * binfmt;
 845         char corename[6+sizeof(current->comm)];
 846         struct file * file;
 847         struct dentry * dentry;
 848         struct inode * inode;
 849
 850         lock_kernel();
 851         binfmt = current->binfmt;
 852         if (!binfmt || !binfmt->core_dump)
 853                 goto fail;
 854         if (!current->dumpable || atomic_read(&current->mm->mm_users) != 1)
 855                 goto fail;
 856         current->dumpable = 0;
 857         if (current->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
 858                 goto fail;
 859
 860         memcpy(corename,"core.", 5);
 861 #if 0
 862         memcpy(corename+5,current->comm,sizeof(current->comm));
 863 #else
 864         corename[4] = '\0';
 865 #endif
 866         file = filp_open(corename, O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600);
 867         if (IS_ERR(file))
 868                 goto fail;
 869         dentry = file->f_dentry;
 870         inode = dentry->d_inode;
 871         if (inode->i_nlink > 1)
 872                 goto close_fail;        /* multiple links - don't dump */
 873
 874         if (!S_ISREG(inode->i_mode))
 875                 goto close_fail;
 876         if (!inode->i_op || !inode->i_op->default_file_ops)
 877                 goto close_fail;
 878         if (!file->f_op->write)
 879                 goto close_fail;
 880         if (!binfmt->core_dump(signr, regs, file))
 881                 goto close_fail;
 882         filp_close(file, NULL);
 883         unlock_kernel();
 884         return 1;
 885
 886 close_fail:
 887         filp_close(file, NULL);
 888 fail:
 889         unlock_kernel();
 890         return 0;
 891 }