fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/mm.h>
  16 #include <linux/mman.h>
  17 #include <linux/errno.h>
  18 #include <linux/signal.h>
  19 #include <linux/binfmts.h>
  20 #include <linux/string.h>
  21 #include <linux/file.h>
  22 #include <linux/slab.h>
  23 #include <linux/personality.h>
  24 #include <linux/elfcore.h>
  25 #include <linux/init.h>
  26 #include <linux/highuid.h>
  27 #include <linux/compiler.h>
  28 #include <linux/highmem.h>
  29 #include <linux/pagemap.h>
  30 #include <linux/security.h>
  31 #include <linux/random.h>
  32 #include <linux/elf.h>
  33 #include <linux/utsname.h>
  34 #include <linux/coredump.h>
  35 #include <asm/uaccess.h>
  36 #include <asm/param.h>
  37 #include <asm/page.h>
  38
  39 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
  40 static int load_elf_library(struct file *);
  41 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  42                                 int, int, unsigned long);
  43
  44 /*
  45  * If we don't support core dumping, then supply a NULL so we
  46  * don't even try.
  47  */
  48 #ifdef CONFIG_ELF_CORE
  49 static int elf_core_dump(struct coredump_params *cprm);
  50 #else
  51 #define elf_core_dump   NULL
  52 #endif
  53
  54 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  55 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  56 #else
  57 #define ELF_MIN_ALIGN   PAGE_SIZE
  58 #endif
  59
  60 #ifndef ELF_CORE_EFLAGS
  61 #define ELF_CORE_EFLAGS 0
  62 #endif
  63
  64 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  65 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  66 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  67
  68 static struct linux_binfmt elf_format = {
  69         .module         = THIS_MODULE,
  70         .load_binary    = load_elf_binary,
  71         .load_shlib     = load_elf_library,
  72         .core_dump      = elf_core_dump,
  73         .min_coredump   = ELF_EXEC_PAGESIZE,
  74 };
  75
  76 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  77
  78 static int set_brk(unsigned long start, unsigned long end)
  79 {
  80         start = ELF_PAGEALIGN(start);
  81         end = ELF_PAGEALIGN(end);
  82         if (end > start) {
  83                 unsigned long addr;
  84                 down_write(&current->mm->mmap_sem);
  85                 addr = do_brk(start, end - start);
  86                 up_write(&current->mm->mmap_sem);
  87                 if (BAD_ADDR(addr))
  88                         return addr;
  89         }
  90         current->mm->start_brk = current->mm->brk = end;
  91         return 0;
  92 }
  93
  94 /* We need to explicitly zero any fractional pages
  95    after the data section (i.e. bss).  This would
  96    contain the junk from the file that should not
  97    be in memory
  98  */
  99 static int padzero(unsigned long elf_bss)
 100 {
 101         unsigned long nbyte;
 102
 103         nbyte = ELF_PAGEOFFSET(elf_bss);
 104         if (nbyte) {
 105                 nbyte = ELF_MIN_ALIGN - nbyte;
 106                 if (clear_user((void __user *) elf_bss, nbyte))
 107                         return -EFAULT;
 108         }
 109         return 0;
 110 }
 111
 112 /* Let's use some macros to make this stack manipulation a little clearer */
 113 #ifdef CONFIG_STACK_GROWSUP
 114 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 115 #define STACK_ROUND(sp, items) \
 116         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 117 #define STACK_ALLOC(sp, len) ({ \
 118         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 119         old_sp; })
 120 #else
 121 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 122 #define STACK_ROUND(sp, items) \
 123         (((unsigned long) (sp - items)) &~ 15UL)
 124 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 125 #endif
 126
 127 #ifndef ELF_BASE_PLATFORM
 128 /*
 129  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 130  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 131  * will be copied to the user stack in the same manner as AT_PLATFORM.
 132  */
 133 #define ELF_BASE_PLATFORM NULL
 134 #endif
 135
 136 static int
 137 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 138                 unsigned long load_addr, unsigned long interp_load_addr)
 139 {
 140         unsigned long p = bprm->p;
 141         int argc = bprm->argc;
 142         int envc = bprm->envc;
 143         elf_addr_t __user *argv;
 144         elf_addr_t __user *envp;
 145         elf_addr_t __user *sp;
 146         elf_addr_t __user *u_platform;
 147         elf_addr_t __user *u_base_platform;
 148         elf_addr_t __user *u_rand_bytes;
 149         const char *k_platform = ELF_PLATFORM;
 150         const char *k_base_platform = ELF_BASE_PLATFORM;
 151         unsigned char k_rand_bytes[16];
 152         int items;
 153         elf_addr_t *elf_info;
 154         int ei_index = 0;
 155         const struct cred *cred = current_cred();
 156         struct vm_area_struct *vma;
 157
 158         /*
 159          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 160          * evictions by the processes running on the same package. One
 161          * thing we can do is to shuffle the initial stack for them.
 162          */
 163
 164         p = arch_align_stack(p);
 165
 166         /*
 167          * If this architecture has a platform capability string, copy it
 168          * to userspace.  In some cases (Sparc), this info is impossible
 169          * for userspace to get any other way, in others (i386) it is
 170          * merely difficult.
 171          */
 172         u_platform = NULL;
 173         if (k_platform) {
 174                 size_t len = strlen(k_platform) + 1;
 175
 176                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 177                 if (__copy_to_user(u_platform, k_platform, len))
 178                         return -EFAULT;
 179         }
 180
 181         /*
 182          * If this architecture has a "base" platform capability
 183          * string, copy it to userspace.
 184          */
 185         u_base_platform = NULL;
 186         if (k_base_platform) {
 187                 size_t len = strlen(k_base_platform) + 1;
 188
 189                 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 190                 if (__copy_to_user(u_base_platform, k_base_platform, len))
 191                         return -EFAULT;
 192         }
 193
 194         /*
 195          * Generate 16 random bytes for userspace PRNG seeding.
 196          */
 197         get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
 198         u_rand_bytes = (elf_addr_t __user *)
 199                        STACK_ALLOC(p, sizeof(k_rand_bytes));
 200         if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
 201                 return -EFAULT;
 202
 203         /* Create the ELF interpreter info */
 204         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 205         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 206 #define NEW_AUX_ENT(id, val) \
 207         do { \
 208                 elf_info[ei_index++] = id; \
 209                 elf_info[ei_index++] = val; \
 210         } while (0)
 211
 212 #ifdef ARCH_DLINFO
 213         /*
 214          * ARCH_DLINFO must come first so PPC can do its special alignment of
 215          * AUXV.
 216          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 217          * ARCH_DLINFO changes
 218          */
 219         ARCH_DLINFO;
 220 #endif
 221         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 222         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 223         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 224         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 225         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 226         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 227         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 228         NEW_AUX_ENT(AT_FLAGS, 0);
 229         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 230         NEW_AUX_ENT(AT_UID, cred->uid);
 231         NEW_AUX_ENT(AT_EUID, cred->euid);
 232         NEW_AUX_ENT(AT_GID, cred->gid);
 233         NEW_AUX_ENT(AT_EGID, cred->egid);
 234         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 235         NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
 236         NEW_AUX_ENT(AT_EXECFN, bprm->exec);
 237         if (k_platform) {
 238                 NEW_AUX_ENT(AT_PLATFORM,
 239                             (elf_addr_t)(unsigned long)u_platform);
 240         }
 241         if (k_base_platform) {
 242                 NEW_AUX_ENT(AT_BASE_PLATFORM,
 243                             (elf_addr_t)(unsigned long)u_base_platform);
 244         }
 245         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 246                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 247         }
 248 #undef NEW_AUX_ENT
 249         /* AT_NULL is zero; clear the rest too */
 250         memset(&elf_info[ei_index], 0,
 251                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 252
 253         /* And advance past the AT_NULL entry.  */
 254         ei_index += 2;
 255
 256         sp = STACK_ADD(p, ei_index);
 257
 258         items = (argc + 1) + (envc + 1) + 1;
 259         bprm->p = STACK_ROUND(sp, items);
 260
 261         /* Point sp at the lowest address on the stack */
 262 #ifdef CONFIG_STACK_GROWSUP
 263         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 264         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 265 #else
 266         sp = (elf_addr_t __user *)bprm->p;
 267 #endif
 268
 269
 270         /*
 271          * Grow the stack manually; some architectures have a limit on how
 272          * far ahead a user-space access may be in order to grow the stack.
 273          */
 274         vma = find_extend_vma(current->mm, bprm->p);
 275         if (!vma)
 276                 return -EFAULT;
 277
 278         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 279         if (__put_user(argc, sp++))
 280                 return -EFAULT;
 281         argv = sp;
 282         envp = argv + argc + 1;
 283
 284         /* Populate argv and envp */
 285         p = current->mm->arg_end = current->mm->arg_start;
 286         while (argc-- > 0) {
 287                 size_t len;
 288                 if (__put_user((elf_addr_t)p, argv++))
 289                         return -EFAULT;
 290                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 291                 if (!len || len > MAX_ARG_STRLEN)
 292                         return -EINVAL;
 293                 p += len;
 294         }
 295         if (__put_user(0, argv))
 296                 return -EFAULT;
 297         current->mm->arg_end = current->mm->env_start = p;
 298         while (envc-- > 0) {
 299                 size_t len;
 300                 if (__put_user((elf_addr_t)p, envp++))
 301                         return -EFAULT;
 302                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 303                 if (!len || len > MAX_ARG_STRLEN)
 304                         return -EINVAL;
 305                 p += len;
 306         }
 307         if (__put_user(0, envp))
 308                 return -EFAULT;
 309         current->mm->env_end = p;
 310
 311         /* Put the elf_info on the stack in the right place.  */
 312         sp = (elf_addr_t __user *)envp + 1;
 313         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 314                 return -EFAULT;
 315         return 0;
 316 }
 317
 318 static unsigned long elf_map(struct file *filep, unsigned long addr,
 319                 struct elf_phdr *eppnt, int prot, int type,
 320                 unsigned long total_size)
 321 {
 322         unsigned long map_addr;
 323         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 324         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 325         addr = ELF_PAGESTART(addr);
 326         size = ELF_PAGEALIGN(size);
 327
 328         /* mmap() will return -EINVAL if given a zero size, but a
 329          * segment with zero filesize is perfectly valid */
 330         if (!size)
 331                 return addr;
 332
 333         down_write(&current->mm->mmap_sem);
 334         /*
 335         * total_size is the size of the ELF (interpreter) image.
 336         * The _first_ mmap needs to know the full size, otherwise
 337         * randomization might put this image into an overlapping
 338         * position with the ELF binary image. (since size < total_size)
 339         * So we first map the 'big' image - and unmap the remainder at
 340         * the end. (which unmap is needed for ELF images with holes.)
 341         */
 342         if (total_size) {
 343                 total_size = ELF_PAGEALIGN(total_size);
 344                 map_addr = do_mmap(filep, addr, total_size, prot, type, off);
 345                 if (!BAD_ADDR(map_addr))
 346                         do_munmap(current->mm, map_addr+size, total_size-size);
 347         } else
 348                 map_addr = do_mmap(filep, addr, size, prot, type, off);
 349
 350         up_write(&current->mm->mmap_sem);
 351         return(map_addr);
 352 }
 353
 354 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 355 {
 356         int i, first_idx = -1, last_idx = -1;
 357
 358         for (i = 0; i < nr; i++) {
 359                 if (cmds[i].p_type == PT_LOAD) {
 360                         last_idx = i;
 361                         if (first_idx == -1)
 362                                 first_idx = i;
 363                 }
 364         }
 365         if (first_idx == -1)
 366                 return 0;
 367
 368         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 369                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 370 }
 371
 372
 373 /* This is much more generalized than the library routine read function,
 374    so we keep this separate.  Technically the library read function
 375    is only provided so that we can read a.out libraries that have
 376    an ELF header */
 377
 378 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 379                 struct file *interpreter, unsigned long *interp_map_addr,
 380                 unsigned long no_base)
 381 {
 382         struct elf_phdr *elf_phdata;
 383         struct elf_phdr *eppnt;
 384         unsigned long load_addr = 0;
 385         int load_addr_set = 0;
 386         unsigned long last_bss = 0, elf_bss = 0;
 387         unsigned long error = ~0UL;
 388         unsigned long total_size;
 389         int retval, i, size;
 390
 391         /* First of all, some simple consistency checks */
 392         if (interp_elf_ex->e_type != ET_EXEC &&
 393             interp_elf_ex->e_type != ET_DYN)
 394                 goto out;
 395         if (!elf_check_arch(interp_elf_ex))
 396                 goto out;
 397         if (!interpreter->f_op || !interpreter->f_op->mmap)
 398                 goto out;
 399
 400         /*
 401          * If the size of this structure has changed, then punt, since
 402          * we will be doing the wrong thing.
 403          */
 404         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 405                 goto out;
 406         if (interp_elf_ex->e_phnum < 1 ||
 407                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 408                 goto out;
 409
 410         /* Now read in all of the header information */
 411         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 412         if (size > ELF_MIN_ALIGN)
 413                 goto out;
 414         elf_phdata = kmalloc(size, GFP_KERNEL);
 415         if (!elf_phdata)
 416                 goto out;
 417
 418         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 419                              (char *)elf_phdata, size);
 420         error = -EIO;
 421         if (retval != size) {
 422                 if (retval < 0)
 423                         error = retval;
 424                 goto out_close;
 425         }
 426
 427         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 428         if (!total_size) {
 429                 error = -EINVAL;
 430                 goto out_close;
 431         }
 432
 433         eppnt = elf_phdata;
 434         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 435                 if (eppnt->p_type == PT_LOAD) {
 436                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 437                         int elf_prot = 0;
 438                         unsigned long vaddr = 0;
 439                         unsigned long k, map_addr;
 440
 441                         if (eppnt->p_flags & PF_R)
 442                                 elf_prot = PROT_READ;
 443                         if (eppnt->p_flags & PF_W)
 444                                 elf_prot |= PROT_WRITE;
 445                         if (eppnt->p_flags & PF_X)
 446                                 elf_prot |= PROT_EXEC;
 447                         vaddr = eppnt->p_vaddr;
 448                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 449                                 elf_type |= MAP_FIXED;
 450                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 451                                 load_addr = -vaddr;
 452
 453                         map_addr = elf_map(interpreter, load_addr + vaddr,
 454                                         eppnt, elf_prot, elf_type, total_size);
 455                         total_size = 0;
 456                         if (!*interp_map_addr)
 457                                 *interp_map_addr = map_addr;
 458                         error = map_addr;
 459                         if (BAD_ADDR(map_addr))
 460                                 goto out_close;
 461
 462                         if (!load_addr_set &&
 463                             interp_elf_ex->e_type == ET_DYN) {
 464                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 465                                 load_addr_set = 1;
 466                         }
 467
 468                         /*
 469                          * Check to see if the section's size will overflow the
 470                          * allowed task size. Note that p_filesz must always be
 471                          * <= p_memsize so it's only necessary to check p_memsz.
 472                          */
 473                         k = load_addr + eppnt->p_vaddr;
 474                         if (BAD_ADDR(k) ||
 475                             eppnt->p_filesz > eppnt->p_memsz ||
 476                             eppnt->p_memsz > TASK_SIZE ||
 477                             TASK_SIZE - eppnt->p_memsz < k) {
 478                                 error = -ENOMEM;
 479                                 goto out_close;
 480                         }
 481
 482                         /*
 483                          * Find the end of the file mapping for this phdr, and
 484                          * keep track of the largest address we see for this.
 485                          */
 486                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 487                         if (k > elf_bss)
 488                                 elf_bss = k;
 489
 490                         /*
 491                          * Do the same thing for the memory mapping - between
 492                          * elf_bss and last_bss is the bss section.
 493                          */
 494                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 495                         if (k > last_bss)
 496                                 last_bss = k;
 497                 }
 498         }
 499
 500         if (last_bss > elf_bss) {
 501                 /*
 502                  * Now fill out the bss section.  First pad the last page up
 503                  * to the page boundary, and then perform a mmap to make sure
 504                  * that there are zero-mapped pages up to and including the
 505                  * last bss page.
 506                  */
 507                 if (padzero(elf_bss)) {
 508                         error = -EFAULT;
 509                         goto out_close;
 510                 }
 511
 512                 /* What we have mapped so far */
 513                 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 514
 515                 /* Map the last of the bss segment */
 516                 down_write(&current->mm->mmap_sem);
 517                 error = do_brk(elf_bss, last_bss - elf_bss);
 518                 up_write(&current->mm->mmap_sem);
 519                 if (BAD_ADDR(error))
 520                         goto out_close;
 521         }
 522
 523         error = load_addr;
 524
 525 out_close:
 526         kfree(elf_phdata);
 527 out:
 528         return error;
 529 }
 530
 531 /*
 532  * These are the functions used to load ELF style executables and shared
 533  * libraries.  There is no binary dependent code anywhere else.
 534  */
 535
 536 #define INTERPRETER_NONE 0
 537 #define INTERPRETER_ELF 2
 538
 539 #ifndef STACK_RND_MASK
 540 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 541 #endif
 542
 543 static unsigned long randomize_stack_top(unsigned long stack_top)
 544 {
 545         unsigned int random_variable = 0;
 546
 547         if ((current->flags & PF_RANDOMIZE) &&
 548                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 549                 random_variable = get_random_int() & STACK_RND_MASK;
 550                 random_variable <<= PAGE_SHIFT;
 551         }
 552 #ifdef CONFIG_STACK_GROWSUP
 553         return PAGE_ALIGN(stack_top) + random_variable;
 554 #else
 555         return PAGE_ALIGN(stack_top) - random_variable;
 556 #endif
 557 }
 558
 559 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 560 {
 561         struct file *interpreter = NULL; /* to shut gcc up */
 562         unsigned long load_addr = 0, load_bias = 0;
 563         int load_addr_set = 0;
 564         char * elf_interpreter = NULL;
 565         unsigned long error;
 566         struct elf_phdr *elf_ppnt, *elf_phdata;
 567         unsigned long elf_bss, elf_brk;
 568         int retval, i;
 569         unsigned int size;
 570         unsigned long elf_entry;
 571         unsigned long interp_load_addr = 0;
 572         unsigned long start_code, end_code, start_data, end_data;
 573         unsigned long reloc_func_desc __maybe_unused = 0;
 574         int executable_stack = EXSTACK_DEFAULT;
 575         unsigned long def_flags = 0;
 576         struct {
 577                 struct elfhdr elf_ex;
 578                 struct elfhdr interp_elf_ex;
 579         } *loc;
 580
 581         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 582         if (!loc) {
 583                 retval = -ENOMEM;
 584                 goto out_ret;
 585         }
 586
 587         /* Get the exec-header */
 588         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 589
 590         retval = -ENOEXEC;
 591         /* First of all, some simple consistency checks */
 592         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 593                 goto out;
 594
 595         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 596                 goto out;
 597         if (!elf_check_arch(&loc->elf_ex))
 598                 goto out;
 599         if (!bprm->file->f_op || !bprm->file->f_op->mmap)
 600                 goto out;
 601
 602         /* Now read in all of the header information */
 603         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 604                 goto out;
 605         if (loc->elf_ex.e_phnum < 1 ||
 606                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 607                 goto out;
 608         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 609         retval = -ENOMEM;
 610         elf_phdata = kmalloc(size, GFP_KERNEL);
 611         if (!elf_phdata)
 612                 goto out;
 613
 614         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 615                              (char *)elf_phdata, size);
 616         if (retval != size) {
 617                 if (retval >= 0)
 618                         retval = -EIO;
 619                 goto out_free_ph;
 620         }
 621
 622         elf_ppnt = elf_phdata;
 623         elf_bss = 0;
 624         elf_brk = 0;
 625
 626         start_code = ~0UL;
 627         end_code = 0;
 628         start_data = 0;
 629         end_data = 0;
 630
 631         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 632                 if (elf_ppnt->p_type == PT_INTERP) {
 633                         /* This is the program interpreter used for
 634                          * shared libraries - for now assume that this
 635                          * is an a.out format binary
 636                          */
 637                         retval = -ENOEXEC;
 638                         if (elf_ppnt->p_filesz > PATH_MAX ||
 639                             elf_ppnt->p_filesz < 2)
 640                                 goto out_free_ph;
 641
 642                         retval = -ENOMEM;
 643                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 644                                                   GFP_KERNEL);
 645                         if (!elf_interpreter)
 646                                 goto out_free_ph;
 647
 648                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 649                                              elf_interpreter,
 650                                              elf_ppnt->p_filesz);
 651                         if (retval != elf_ppnt->p_filesz) {
 652                                 if (retval >= 0)
 653                                         retval = -EIO;
 654                                 goto out_free_interp;
 655                         }
 656                         /* make sure path is NULL terminated */
 657                         retval = -ENOEXEC;
 658                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 659                                 goto out_free_interp;
 660
 661                         interpreter = open_exec(elf_interpreter);
 662                         retval = PTR_ERR(interpreter);
 663                         if (IS_ERR(interpreter))
 664                                 goto out_free_interp;
 665
 666                         /*
 667                          * If the binary is not readable then enforce
 668                          * mm->dumpable = 0 regardless of the interpreter's
 669                          * permissions.
 670                          */
 671                         would_dump(bprm, interpreter);
 672
 673                         retval = kernel_read(interpreter, 0, bprm->buf,
 674                                              BINPRM_BUF_SIZE);
 675                         if (retval != BINPRM_BUF_SIZE) {
 676                                 if (retval >= 0)
 677                                         retval = -EIO;
 678                                 goto out_free_dentry;
 679                         }
 680
 681                         /* Get the exec headers */
 682                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 683                         break;
 684                 }
 685                 elf_ppnt++;
 686         }
 687
 688         elf_ppnt = elf_phdata;
 689         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 690                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 691                         if (elf_ppnt->p_flags & PF_X)
 692                                 executable_stack = EXSTACK_ENABLE_X;
 693                         else
 694                                 executable_stack = EXSTACK_DISABLE_X;
 695                         break;
 696                 }
 697
 698         /* Some simple consistency checks for the interpreter */
 699         if (elf_interpreter) {
 700                 retval = -ELIBBAD;
 701                 /* Not an ELF interpreter */
 702                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 703                         goto out_free_dentry;
 704                 /* Verify the interpreter has a valid arch */
 705                 if (!elf_check_arch(&loc->interp_elf_ex))
 706                         goto out_free_dentry;
 707         }
 708
 709         /* Flush all traces of the currently running executable */
 710         retval = flush_old_exec(bprm);
 711         if (retval)
 712                 goto out_free_dentry;
 713
 714         /* OK, This is the point of no return */
 715         current->flags &= ~PF_FORKNOEXEC;
 716         current->mm->def_flags = def_flags;
 717
 718         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 719            may depend on the personality.  */
 720         SET_PERSONALITY(loc->elf_ex);
 721         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 722                 current->personality |= READ_IMPLIES_EXEC;
 723
 724         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 725                 current->flags |= PF_RANDOMIZE;
 726
 727         setup_new_exec(bprm);
 728
 729         /* Do this so that we can load the interpreter, if need be.  We will
 730            change some of these later */
 731         current->mm->free_area_cache = current->mm->mmap_base;
 732         current->mm->cached_hole_size = 0;
 733         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 734                                  executable_stack);
 735         if (retval < 0) {
 736                 send_sig(SIGKILL, current, 0);
 737                 goto out_free_dentry;
 738         }
 739
 740         current->mm->start_stack = bprm->p;
 741
 742         /* Now we do a little grungy work by mmapping the ELF image into
 743            the correct location in memory. */
 744         for(i = 0, elf_ppnt = elf_phdata;
 745             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 746                 int elf_prot = 0, elf_flags;
 747                 unsigned long k, vaddr;
 748
 749                 if (elf_ppnt->p_type != PT_LOAD)
 750                         continue;
 751
 752                 if (unlikely (elf_brk > elf_bss)) {
 753                         unsigned long nbyte;
 754
 755                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 756                            before this one. Map anonymous pages, if needed,
 757                            and clear the area.  */
 758                         retval = set_brk(elf_bss + load_bias,
 759                                          elf_brk + load_bias);
 760                         if (retval) {
 761                                 send_sig(SIGKILL, current, 0);
 762                                 goto out_free_dentry;
 763                         }
 764                         nbyte = ELF_PAGEOFFSET(elf_bss);
 765                         if (nbyte) {
 766                                 nbyte = ELF_MIN_ALIGN - nbyte;
 767                                 if (nbyte > elf_brk - elf_bss)
 768                                         nbyte = elf_brk - elf_bss;
 769                                 if (clear_user((void __user *)elf_bss +
 770                                                         load_bias, nbyte)) {
 771                                         /*
 772                                          * This bss-zeroing can fail if the ELF
 773                                          * file specifies odd protections. So
 774                                          * we don't check the return value
 775                                          */
 776                                 }
 777                         }
 778                 }
 779
 780                 if (elf_ppnt->p_flags & PF_R)
 781                         elf_prot |= PROT_READ;
 782                 if (elf_ppnt->p_flags & PF_W)
 783                         elf_prot |= PROT_WRITE;
 784                 if (elf_ppnt->p_flags & PF_X)
 785                         elf_prot |= PROT_EXEC;
 786
 787                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 788
 789                 vaddr = elf_ppnt->p_vaddr;
 790                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 791                         elf_flags |= MAP_FIXED;
 792                 } else if (loc->elf_ex.e_type == ET_DYN) {
 793                         /* Try and get dynamic programs out of the way of the
 794                          * default mmap base, as well as whatever program they
 795                          * might try to exec.  This is because the brk will
 796                          * follow the loader, and is not movable.  */
 797 #if defined(CONFIG_X86) || defined(CONFIG_ARM)
 798                         load_bias = 0;
 799 #else
 800                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 801 #endif
 802                 }
 803
 804                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 805                                 elf_prot, elf_flags, 0);
 806                 if (BAD_ADDR(error)) {
 807                         send_sig(SIGKILL, current, 0);
 808                         retval = IS_ERR((void *)error) ?
 809                                 PTR_ERR((void*)error) : -EINVAL;
 810                         goto out_free_dentry;
 811                 }
 812
 813                 if (!load_addr_set) {
 814                         load_addr_set = 1;
 815                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 816                         if (loc->elf_ex.e_type == ET_DYN) {
 817                                 load_bias += error -
 818                                              ELF_PAGESTART(load_bias + vaddr);
 819                                 load_addr += load_bias;
 820                                 reloc_func_desc = load_bias;
 821                         }
 822                 }
 823                 k = elf_ppnt->p_vaddr;
 824                 if (k < start_code)
 825                         start_code = k;
 826                 if (start_data < k)
 827                         start_data = k;
 828
 829                 /*
 830                  * Check to see if the section's size will overflow the
 831                  * allowed task size. Note that p_filesz must always be
 832                  * <= p_memsz so it is only necessary to check p_memsz.
 833                  */
 834                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 835                     elf_ppnt->p_memsz > TASK_SIZE ||
 836                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 837                         /* set_brk can never work. Avoid overflows. */
 838                         send_sig(SIGKILL, current, 0);
 839                         retval = -EINVAL;
 840                         goto out_free_dentry;
 841                 }
 842
 843                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 844
 845                 if (k > elf_bss)
 846                         elf_bss = k;
 847                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 848                         end_code = k;
 849                 if (end_data < k)
 850                         end_data = k;
 851                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 852                 if (k > elf_brk)
 853                         elf_brk = k;
 854         }
 855
 856         loc->elf_ex.e_entry += load_bias;
 857         elf_bss += load_bias;
 858         elf_brk += load_bias;
 859         start_code += load_bias;
 860         end_code += load_bias;
 861         start_data += load_bias;
 862         end_data += load_bias;
 863
 864         /* Calling set_brk effectively mmaps the pages that we need
 865          * for the bss and break sections.  We must do this before
 866          * mapping in the interpreter, to make sure it doesn't wind
 867          * up getting placed where the bss needs to go.
 868          */
 869         retval = set_brk(elf_bss, elf_brk);
 870         if (retval) {
 871                 send_sig(SIGKILL, current, 0);
 872                 goto out_free_dentry;
 873         }
 874         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 875                 send_sig(SIGSEGV, current, 0);
 876                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 877                 goto out_free_dentry;
 878         }
 879
 880         if (elf_interpreter) {
 881                 unsigned long uninitialized_var(interp_map_addr);
 882
 883                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 884                                             interpreter,
 885                                             &interp_map_addr,
 886                                             load_bias);
 887                 if (!IS_ERR((void *)elf_entry)) {
 888                         /*
 889                          * load_elf_interp() returns relocation
 890                          * adjustment
 891                          */
 892                         interp_load_addr = elf_entry;
 893                         elf_entry += loc->interp_elf_ex.e_entry;
 894                 }
 895                 if (BAD_ADDR(elf_entry)) {
 896                         force_sig(SIGSEGV, current);
 897                         retval = IS_ERR((void *)elf_entry) ?
 898                                         (int)elf_entry : -EINVAL;
 899                         goto out_free_dentry;
 900                 }
 901                 reloc_func_desc = interp_load_addr;
 902
 903                 allow_write_access(interpreter);
 904                 fput(interpreter);
 905                 kfree(elf_interpreter);
 906         } else {
 907                 elf_entry = loc->elf_ex.e_entry;
 908                 if (BAD_ADDR(elf_entry)) {
 909                         force_sig(SIGSEGV, current);
 910                         retval = -EINVAL;
 911                         goto out_free_dentry;
 912                 }
 913         }
 914
 915         kfree(elf_phdata);
 916
 917         set_binfmt(&elf_format);
 918
 919 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 920         retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
 921         if (retval < 0) {
 922                 send_sig(SIGKILL, current, 0);
 923                 goto out;
 924         }
 925 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 926
 927         install_exec_creds(bprm);
 928         current->flags &= ~PF_FORKNOEXEC;
 929         retval = create_elf_tables(bprm, &loc->elf_ex,
 930                           load_addr, interp_load_addr);
 931         if (retval < 0) {
 932                 send_sig(SIGKILL, current, 0);
 933                 goto out;
 934         }
 935         /* N.B. passed_fileno might not be initialized? */
 936         current->mm->end_code = end_code;
 937         current->mm->start_code = start_code;
 938         current->mm->start_data = start_data;
 939         current->mm->end_data = end_data;
 940         current->mm->start_stack = bprm->p;
 941
 942 #ifdef arch_randomize_brk
 943         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
 944                 current->mm->brk = current->mm->start_brk =
 945                         arch_randomize_brk(current->mm);
 946 #ifdef CONFIG_COMPAT_BRK
 947                 current->brk_randomized = 1;
 948 #endif
 949         }
 950 #endif
 951
 952         if (current->personality & MMAP_PAGE_ZERO) {
 953                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 954                    and some applications "depend" upon this behavior.
 955                    Since we do not have the power to recompile these, we
 956                    emulate the SVr4 behavior. Sigh. */
 957                 down_write(&current->mm->mmap_sem);
 958                 error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 959                                 MAP_FIXED | MAP_PRIVATE, 0);
 960                 up_write(&current->mm->mmap_sem);
 961         }
 962
 963 #ifdef ELF_PLAT_INIT
 964         /*
 965          * The ABI may specify that certain registers be set up in special
 966          * ways (on i386 %edx is the address of a DT_FINI function, for
 967          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 968          * that the e_entry field is the address of the function descriptor
 969          * for the startup routine, rather than the address of the startup
 970          * routine itself.  This macro performs whatever initialization to
 971          * the regs structure is required as well as any relocations to the
 972          * function descriptor entries when executing dynamically links apps.
 973          */
 974         ELF_PLAT_INIT(regs, reloc_func_desc);
 975 #endif
 976
 977         start_thread(regs, elf_entry, bprm->p);
 978         retval = 0;
 979 out:
 980         kfree(loc);
 981 out_ret:
 982         return retval;
 983
 984         /* error cleanup */
 985 out_free_dentry:
 986         allow_write_access(interpreter);
 987         if (interpreter)
 988                 fput(interpreter);
 989 out_free_interp:
 990         kfree(elf_interpreter);
 991 out_free_ph:
 992         kfree(elf_phdata);
 993         goto out;
 994 }
 995
 996 /* This is really simpleminded and specialized - we are loading an
 997    a.out library that is given an ELF header. */
 998 static int load_elf_library(struct file *file)
 999 {
1000         struct elf_phdr *elf_phdata;
1001         struct elf_phdr *eppnt;
1002         unsigned long elf_bss, bss, len;
1003         int retval, error, i, j;
1004         struct elfhdr elf_ex;
1005
1006         error = -ENOEXEC;
1007         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1008         if (retval != sizeof(elf_ex))
1009                 goto out;
1010
1011         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1012                 goto out;
1013
1014         /* First of all, some simple consistency checks */
1015         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1016             !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1017                 goto out;
1018
1019         /* Now read in all of the header information */
1020
1021         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1022         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1023
1024         error = -ENOMEM;
1025         elf_phdata = kmalloc(j, GFP_KERNEL);
1026         if (!elf_phdata)
1027                 goto out;
1028
1029         eppnt = elf_phdata;
1030         error = -ENOEXEC;
1031         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1032         if (retval != j)
1033                 goto out_free_ph;
1034
1035         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1036                 if ((eppnt + i)->p_type == PT_LOAD)
1037                         j++;
1038         if (j != 1)
1039                 goto out_free_ph;
1040
1041         while (eppnt->p_type != PT_LOAD)
1042                 eppnt++;
1043
1044         /* Now use mmap to map the library into memory. */
1045         down_write(&current->mm->mmap_sem);
1046         error = do_mmap(file,
1047                         ELF_PAGESTART(eppnt->p_vaddr),
1048                         (eppnt->p_filesz +
1049                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1050                         PROT_READ | PROT_WRITE | PROT_EXEC,
1051                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1052                         (eppnt->p_offset -
1053                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1054         up_write(&current->mm->mmap_sem);
1055         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1056                 goto out_free_ph;
1057
1058         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1059         if (padzero(elf_bss)) {
1060                 error = -EFAULT;
1061                 goto out_free_ph;
1062         }
1063
1064         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1065                             ELF_MIN_ALIGN - 1);
1066         bss = eppnt->p_memsz + eppnt->p_vaddr;
1067         if (bss > len) {
1068                 down_write(&current->mm->mmap_sem);
1069                 do_brk(len, bss - len);
1070                 up_write(&current->mm->mmap_sem);
1071         }
1072         error = 0;
1073
1074 out_free_ph:
1075         kfree(elf_phdata);
1076 out:
1077         return error;
1078 }
1079
1080 #ifdef CONFIG_ELF_CORE
1081 /*
1082  * ELF core dumper
1083  *
1084  * Modelled on fs/exec.c:aout_core_dump()
1085  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1086  */
1087
1088 /*
1089  * Decide what to dump of a segment, part, all or none.
1090  */
1091 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1092                                    unsigned long mm_flags)
1093 {
1094 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1095
1096         /* The vma can be set up to tell us the answer directly.  */
1097         if (vma->vm_flags & VM_ALWAYSDUMP)
1098                 goto whole;
1099
1100         /* Hugetlb memory check */
1101         if (vma->vm_flags & VM_HUGETLB) {
1102                 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1103                         goto whole;
1104                 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1105                         goto whole;
1106         }
1107
1108         /* Do not dump I/O mapped devices or special mappings */
1109         if (vma->vm_flags & (VM_IO | VM_RESERVED))
1110                 return 0;
1111
1112         /* By default, dump shared memory if mapped from an anonymous file. */
1113         if (vma->vm_flags & VM_SHARED) {
1114                 if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
1115                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1116                         goto whole;
1117                 return 0;
1118         }
1119
1120         /* Dump segments that have been written to.  */
1121         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1122                 goto whole;
1123         if (vma->vm_file == NULL)
1124                 return 0;
1125
1126         if (FILTER(MAPPED_PRIVATE))
1127                 goto whole;
1128
1129         /*
1130          * If this looks like the beginning of a DSO or executable mapping,
1131          * check for an ELF header.  If we find one, dump the first page to
1132          * aid in determining what was mapped here.
1133          */
1134         if (FILTER(ELF_HEADERS) &&
1135             vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1136                 u32 __user *header = (u32 __user *) vma->vm_start;
1137                 u32 word;
1138                 mm_segment_t fs = get_fs();
1139                 /*
1140                  * Doing it this way gets the constant folded by GCC.
1141                  */
1142                 union {
1143                         u32 cmp;
1144                         char elfmag[SELFMAG];
1145                 } magic;
1146                 BUILD_BUG_ON(SELFMAG != sizeof word);
1147                 magic.elfmag[EI_MAG0] = ELFMAG0;
1148                 magic.elfmag[EI_MAG1] = ELFMAG1;
1149                 magic.elfmag[EI_MAG2] = ELFMAG2;
1150                 magic.elfmag[EI_MAG3] = ELFMAG3;
1151                 /*
1152                  * Switch to the user "segment" for get_user(),
1153                  * then put back what elf_core_dump() had in place.
1154                  */
1155                 set_fs(USER_DS);
1156                 if (unlikely(get_user(word, header)))
1157                         word = 0;
1158                 set_fs(fs);
1159                 if (word == magic.cmp)
1160                         return PAGE_SIZE;
1161         }
1162
1163 #undef  FILTER
1164
1165         return 0;
1166
1167 whole:
1168         return vma->vm_end - vma->vm_start;
1169 }
1170
1171 /* An ELF note in memory */
1172 struct memelfnote
1173 {
1174         const char *name;
1175         int type;
1176         unsigned int datasz;
1177         void *data;
1178 };
1179
1180 static int notesize(struct memelfnote *en)
1181 {
1182         int sz;
1183
1184         sz = sizeof(struct elf_note);
1185         sz += roundup(strlen(en->name) + 1, 4);
1186         sz += roundup(en->datasz, 4);
1187
1188         return sz;
1189 }
1190
1191 #define DUMP_WRITE(addr, nr, foffset)   \
1192         do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
1193
1194 static int alignfile(struct file *file, loff_t *foffset)
1195 {
1196         static const char buf[4] = { 0, };
1197         DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
1198         return 1;
1199 }
1200
1201 static int writenote(struct memelfnote *men, struct file *file,
1202                         loff_t *foffset)
1203 {
1204         struct elf_note en;
1205         en.n_namesz = strlen(men->name) + 1;
1206         en.n_descsz = men->datasz;
1207         en.n_type = men->type;
1208
1209         DUMP_WRITE(&en, sizeof(en), foffset);
1210         DUMP_WRITE(men->name, en.n_namesz, foffset);
1211         if (!alignfile(file, foffset))
1212                 return 0;
1213         DUMP_WRITE(men->data, men->datasz, foffset);
1214         if (!alignfile(file, foffset))
1215                 return 0;
1216
1217         return 1;
1218 }
1219 #undef DUMP_WRITE
1220
1221 static void fill_elf_header(struct elfhdr *elf, int segs,
1222                             u16 machine, u32 flags, u8 osabi)
1223 {
1224         memset(elf, 0, sizeof(*elf));
1225
1226         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1227         elf->e_ident[EI_CLASS] = ELF_CLASS;
1228         elf->e_ident[EI_DATA] = ELF_DATA;
1229         elf->e_ident[EI_VERSION] = EV_CURRENT;
1230         elf->e_ident[EI_OSABI] = ELF_OSABI;
1231
1232         elf->e_type = ET_CORE;
1233         elf->e_machine = machine;
1234         elf->e_version = EV_CURRENT;
1235         elf->e_phoff = sizeof(struct elfhdr);
1236         elf->e_flags = flags;
1237         elf->e_ehsize = sizeof(struct elfhdr);
1238         elf->e_phentsize = sizeof(struct elf_phdr);
1239         elf->e_phnum = segs;
1240
1241         return;
1242 }
1243
1244 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1245 {
1246         phdr->p_type = PT_NOTE;
1247         phdr->p_offset = offset;
1248         phdr->p_vaddr = 0;
1249         phdr->p_paddr = 0;
1250         phdr->p_filesz = sz;
1251         phdr->p_memsz = 0;
1252         phdr->p_flags = 0;
1253         phdr->p_align = 0;
1254         return;
1255 }
1256
1257 static void fill_note(struct memelfnote *note, const char *name, int type,
1258                 unsigned int sz, void *data)
1259 {
1260         note->name = name;
1261         note->type = type;
1262         note->datasz = sz;
1263         note->data = data;
1264         return;
1265 }
1266
1267 /*
1268  * fill up all the fields in prstatus from the given task struct, except
1269  * registers which need to be filled up separately.
1270  */
1271 static void fill_prstatus(struct elf_prstatus *prstatus,
1272                 struct task_struct *p, long signr)
1273 {
1274         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1275         prstatus->pr_sigpend = p->pending.signal.sig[0];
1276         prstatus->pr_sighold = p->blocked.sig[0];
1277         rcu_read_lock();
1278         prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1279         rcu_read_unlock();
1280         prstatus->pr_pid = task_pid_vnr(p);
1281         prstatus->pr_pgrp = task_pgrp_vnr(p);
1282         prstatus->pr_sid = task_session_vnr(p);
1283         if (thread_group_leader(p)) {
1284                 struct task_cputime cputime;
1285
1286                 /*
1287                  * This is the record for the group leader.  It shows the
1288                  * group-wide total, not its individual thread total.
1289                  */
1290                 thread_group_cputime(p, &cputime);
1291                 cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1292                 cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1293         } else {
1294                 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1295                 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1296         }
1297         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1298         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1299 }
1300
1301 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1302                        struct mm_struct *mm)
1303 {
1304         const struct cred *cred;
1305         unsigned int i, len;
1306
1307         /* first copy the parameters from user space */
1308         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1309
1310         len = mm->arg_end - mm->arg_start;
1311         if (len >= ELF_PRARGSZ)
1312                 len = ELF_PRARGSZ-1;
1313         if (copy_from_user(&psinfo->pr_psargs,
1314                            (const char __user *)mm->arg_start, len))
1315                 return -EFAULT;
1316         for(i = 0; i < len; i++)
1317                 if (psinfo->pr_psargs[i] == 0)
1318                         psinfo->pr_psargs[i] = ' ';
1319         psinfo->pr_psargs[len] = 0;
1320
1321         rcu_read_lock();
1322         psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1323         rcu_read_unlock();
1324         psinfo->pr_pid = task_pid_vnr(p);
1325         psinfo->pr_pgrp = task_pgrp_vnr(p);
1326         psinfo->pr_sid = task_session_vnr(p);
1327
1328         i = p->state ? ffz(~p->state) + 1 : 0;
1329         psinfo->pr_state = i;
1330         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1331         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1332         psinfo->pr_nice = task_nice(p);
1333         psinfo->pr_flag = p->flags;
1334         rcu_read_lock();
1335         cred = __task_cred(p);
1336         SET_UID(psinfo->pr_uid, cred->uid);
1337         SET_GID(psinfo->pr_gid, cred->gid);
1338         rcu_read_unlock();
1339         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1340
1341         return 0;
1342 }
1343
1344 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1345 {
1346         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1347         int i = 0;
1348         do
1349                 i += 2;
1350         while (auxv[i - 2] != AT_NULL);
1351         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1352 }
1353
1354 #ifdef CORE_DUMP_USE_REGSET
1355 #include <linux/regset.h>
1356
1357 struct elf_thread_core_info {
1358         struct elf_thread_core_info *next;
1359         struct task_struct *task;
1360         struct elf_prstatus prstatus;
1361         struct memelfnote notes[0];
1362 };
1363
1364 struct elf_note_info {
1365         struct elf_thread_core_info *thread;
1366         struct memelfnote psinfo;
1367         struct memelfnote auxv;
1368         size_t size;
1369         int thread_notes;
1370 };
1371
1372 /*
1373  * When a regset has a writeback hook, we call it on each thread before
1374  * dumping user memory.  On register window machines, this makes sure the
1375  * user memory backing the register data is up to date before we read it.
1376  */
1377 static void do_thread_regset_writeback(struct task_struct *task,
1378                                        const struct user_regset *regset)
1379 {
1380         if (regset->writeback)
1381                 regset->writeback(task, regset, 1);
1382 }
1383
1384 static int fill_thread_core_info(struct elf_thread_core_info *t,
1385                                  const struct user_regset_view *view,
1386                                  long signr, size_t *total)
1387 {
1388         unsigned int i;
1389
1390         /*
1391          * NT_PRSTATUS is the one special case, because the regset data
1392          * goes into the pr_reg field inside the note contents, rather
1393          * than being the whole note contents.  We fill the reset in here.
1394          * We assume that regset 0 is NT_PRSTATUS.
1395          */
1396         fill_prstatus(&t->prstatus, t->task, signr);
1397         (void) view->regsets[0].get(t->task, &view->regsets[0],
1398                                     0, sizeof(t->prstatus.pr_reg),
1399                                     &t->prstatus.pr_reg, NULL);
1400
1401         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1402                   sizeof(t->prstatus), &t->prstatus);
1403         *total += notesize(&t->notes[0]);
1404
1405         do_thread_regset_writeback(t->task, &view->regsets[0]);
1406
1407         /*
1408          * Each other regset might generate a note too.  For each regset
1409          * that has no core_note_type or is inactive, we leave t->notes[i]
1410          * all zero and we'll know to skip writing it later.
1411          */
1412         for (i = 1; i < view->n; ++i) {
1413                 const struct user_regset *regset = &view->regsets[i];
1414                 do_thread_regset_writeback(t->task, regset);
1415                 if (regset->core_note_type &&
1416                     (!regset->active || regset->active(t->task, regset))) {
1417                         int ret;
1418                         size_t size = regset->n * regset->size;
1419                         void *data = kmalloc(size, GFP_KERNEL);
1420                         if (unlikely(!data))
1421                                 return 0;
1422                         ret = regset->get(t->task, regset,
1423                                           0, size, data, NULL);
1424                         if (unlikely(ret))
1425                                 kfree(data);
1426                         else {
1427                                 if (regset->core_note_type != NT_PRFPREG)
1428                                         fill_note(&t->notes[i], "LINUX",
1429                                                   regset->core_note_type,
1430                                                   size, data);
1431                                 else {
1432                                         t->prstatus.pr_fpvalid = 1;
1433                                         fill_note(&t->notes[i], "CORE",
1434                                                   NT_PRFPREG, size, data);
1435                                 }
1436                                 *total += notesize(&t->notes[i]);
1437                         }
1438                 }
1439         }
1440
1441         return 1;
1442 }
1443
1444 static int fill_note_info(struct elfhdr *elf, int phdrs,
1445                           struct elf_note_info *info,
1446                           long signr, struct pt_regs *regs)
1447 {
1448         struct task_struct *dump_task = current;
1449         const struct user_regset_view *view = task_user_regset_view(dump_task);
1450         struct elf_thread_core_info *t;
1451         struct elf_prpsinfo *psinfo;
1452         struct core_thread *ct;
1453         unsigned int i;
1454
1455         info->size = 0;
1456         info->thread = NULL;
1457
1458         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1459         if (psinfo == NULL)
1460                 return 0;
1461
1462         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1463
1464         /*
1465          * Figure out how many notes we're going to need for each thread.
1466          */
1467         info->thread_notes = 0;
1468         for (i = 0; i < view->n; ++i)
1469                 if (view->regsets[i].core_note_type != 0)
1470                         ++info->thread_notes;
1471
1472         /*
1473          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1474          * since it is our one special case.
1475          */
1476         if (unlikely(info->thread_notes == 0) ||
1477             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1478                 WARN_ON(1);
1479                 return 0;
1480         }
1481
1482         /*
1483          * Initialize the ELF file header.
1484          */
1485         fill_elf_header(elf, phdrs,
1486                         view->e_machine, view->e_flags, view->ei_osabi);
1487
1488         /*
1489          * Allocate a structure for each thread.
1490          */
1491         for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1492                 t = kzalloc(offsetof(struct elf_thread_core_info,
1493                                      notes[info->thread_notes]),
1494                             GFP_KERNEL);
1495                 if (unlikely(!t))
1496                         return 0;
1497
1498                 t->task = ct->task;
1499                 if (ct->task == dump_task || !info->thread) {
1500                         t->next = info->thread;
1501                         info->thread = t;
1502                 } else {
1503                         /*
1504                          * Make sure to keep the original task at
1505                          * the head of the list.
1506                          */
1507                         t->next = info->thread->next;
1508                         info->thread->next = t;
1509                 }
1510         }
1511
1512         /*
1513          * Now fill in each thread's information.
1514          */
1515         for (t = info->thread; t != NULL; t = t->next)
1516                 if (!fill_thread_core_info(t, view, signr, &info->size))
1517                         return 0;
1518
1519         /*
1520          * Fill in the two process-wide notes.
1521          */
1522         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1523         info->size += notesize(&info->psinfo);
1524
1525         fill_auxv_note(&info->auxv, current->mm);
1526         info->size += notesize(&info->auxv);
1527
1528         return 1;
1529 }
1530
1531 static size_t get_note_info_size(struct elf_note_info *info)
1532 {
1533         return info->size;
1534 }
1535
1536 /*
1537  * Write all the notes for each thread.  When writing the first thread, the
1538  * process-wide notes are interleaved after the first thread-specific note.
1539  */
1540 static int write_note_info(struct elf_note_info *info,
1541                            struct file *file, loff_t *foffset)
1542 {
1543         bool first = 1;
1544         struct elf_thread_core_info *t = info->thread;
1545
1546         do {
1547                 int i;
1548
1549                 if (!writenote(&t->notes[0], file, foffset))
1550                         return 0;
1551
1552                 if (first && !writenote(&info->psinfo, file, foffset))
1553                         return 0;
1554                 if (first && !writenote(&info->auxv, file, foffset))
1555                         return 0;
1556
1557                 for (i = 1; i < info->thread_notes; ++i)
1558                         if (t->notes[i].data &&
1559                             !writenote(&t->notes[i], file, foffset))
1560                                 return 0;
1561
1562                 first = 0;
1563                 t = t->next;
1564         } while (t);
1565
1566         return 1;
1567 }
1568
1569 static void free_note_info(struct elf_note_info *info)
1570 {
1571         struct elf_thread_core_info *threads = info->thread;
1572         while (threads) {
1573                 unsigned int i;
1574                 struct elf_thread_core_info *t = threads;
1575                 threads = t->next;
1576                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1577                 for (i = 1; i < info->thread_notes; ++i)
1578                         kfree(t->notes[i].data);
1579                 kfree(t);
1580         }
1581         kfree(info->psinfo.data);
1582 }
1583
1584 #else
1585
1586 /* Here is the structure in which status of each thread is captured. */
1587 struct elf_thread_status
1588 {
1589         struct list_head list;
1590         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1591         elf_fpregset_t fpu;             /* NT_PRFPREG */
1592         struct task_struct *thread;
1593 #ifdef ELF_CORE_COPY_XFPREGS
1594         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1595 #endif
1596         struct memelfnote notes[3];
1597         int num_notes;
1598 };
1599
1600 /*
1601  * In order to add the specific thread information for the elf file format,
1602  * we need to keep a linked list of every threads pr_status and then create
1603  * a single section for them in the final core file.
1604  */
1605 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1606 {
1607         int sz = 0;
1608         struct task_struct *p = t->thread;
1609         t->num_notes = 0;
1610
1611         fill_prstatus(&t->prstatus, p, signr);
1612         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1613
1614         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1615                   &(t->prstatus));
1616         t->num_notes++;
1617         sz += notesize(&t->notes[0]);
1618
1619         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1620                                                                 &t->fpu))) {
1621                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1622                           &(t->fpu));
1623                 t->num_notes++;
1624                 sz += notesize(&t->notes[1]);
1625         }
1626
1627 #ifdef ELF_CORE_COPY_XFPREGS
1628         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1629                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1630                           sizeof(t->xfpu), &t->xfpu);
1631                 t->num_notes++;
1632                 sz += notesize(&t->notes[2]);
1633         }
1634 #endif
1635         return sz;
1636 }
1637
1638 struct elf_note_info {
1639         struct memelfnote *notes;
1640         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1641         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1642         struct list_head thread_list;
1643         elf_fpregset_t *fpu;
1644 #ifdef ELF_CORE_COPY_XFPREGS
1645         elf_fpxregset_t *xfpu;
1646 #endif
1647         int thread_status_size;
1648         int numnote;
1649 };
1650
1651 static int elf_note_info_init(struct elf_note_info *info)
1652 {
1653         memset(info, 0, sizeof(*info));
1654         INIT_LIST_HEAD(&info->thread_list);
1655
1656         /* Allocate space for six ELF notes */
1657         info->notes = kmalloc(6 * sizeof(struct memelfnote), GFP_KERNEL);
1658         if (!info->notes)
1659                 return 0;
1660         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1661         if (!info->psinfo)
1662                 goto notes_free;
1663         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1664         if (!info->prstatus)
1665                 goto psinfo_free;
1666         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1667         if (!info->fpu)
1668                 goto prstatus_free;
1669 #ifdef ELF_CORE_COPY_XFPREGS
1670         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1671         if (!info->xfpu)
1672                 goto fpu_free;
1673 #endif
1674         return 1;
1675 #ifdef ELF_CORE_COPY_XFPREGS
1676  fpu_free:
1677         kfree(info->fpu);
1678 #endif
1679  prstatus_free:
1680         kfree(info->prstatus);
1681  psinfo_free:
1682         kfree(info->psinfo);
1683  notes_free:
1684         kfree(info->notes);
1685         return 0;
1686 }
1687
1688 static int fill_note_info(struct elfhdr *elf, int phdrs,
1689                           struct elf_note_info *info,
1690                           long signr, struct pt_regs *regs)
1691 {
1692         struct list_head *t;
1693
1694         if (!elf_note_info_init(info))
1695                 return 0;
1696
1697         if (signr) {
1698                 struct core_thread *ct;
1699                 struct elf_thread_status *ets;
1700
1701                 for (ct = current->mm->core_state->dumper.next;
1702                                                 ct; ct = ct->next) {
1703                         ets = kzalloc(sizeof(*ets), GFP_KERNEL);
1704                         if (!ets)
1705                                 return 0;
1706
1707                         ets->thread = ct->task;
1708                         list_add(&ets->list, &info->thread_list);
1709                 }
1710
1711                 list_for_each(t, &info->thread_list) {
1712                         int sz;
1713
1714                         ets = list_entry(t, struct elf_thread_status, list);
1715                         sz = elf_dump_thread_status(signr, ets);
1716                         info->thread_status_size += sz;
1717                 }
1718         }
1719         /* now collect the dump for the current */
1720         memset(info->prstatus, 0, sizeof(*info->prstatus));
1721         fill_prstatus(info->prstatus, current, signr);
1722         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1723
1724         /* Set up header */
1725         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
1726
1727         /*
1728          * Set up the notes in similar form to SVR4 core dumps made
1729          * with info from their /proc.
1730          */
1731
1732         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1733                   sizeof(*info->prstatus), info->prstatus);
1734         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1735         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1736                   sizeof(*info->psinfo), info->psinfo);
1737
1738         info->numnote = 2;
1739
1740         fill_auxv_note(&info->notes[info->numnote++], current->mm);
1741
1742         /* Try to dump the FPU. */
1743         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1744                                                                info->fpu);
1745         if (info->prstatus->pr_fpvalid)
1746                 fill_note(info->notes + info->numnote++,
1747                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1748 #ifdef ELF_CORE_COPY_XFPREGS
1749         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1750                 fill_note(info->notes + info->numnote++,
1751                           "LINUX", ELF_CORE_XFPREG_TYPE,
1752                           sizeof(*info->xfpu), info->xfpu);
1753 #endif
1754
1755         return 1;
1756 }
1757
1758 static size_t get_note_info_size(struct elf_note_info *info)
1759 {
1760         int sz = 0;
1761         int i;
1762
1763         for (i = 0; i < info->numnote; i++)
1764                 sz += notesize(info->notes + i);
1765
1766         sz += info->thread_status_size;
1767
1768         return sz;
1769 }
1770
1771 static int write_note_info(struct elf_note_info *info,
1772                            struct file *file, loff_t *foffset)
1773 {
1774         int i;
1775         struct list_head *t;
1776
1777         for (i = 0; i < info->numnote; i++)
1778                 if (!writenote(info->notes + i, file, foffset))
1779                         return 0;
1780
1781         /* write out the thread status notes section */
1782         list_for_each(t, &info->thread_list) {
1783                 struct elf_thread_status *tmp =
1784                                 list_entry(t, struct elf_thread_status, list);
1785
1786                 for (i = 0; i < tmp->num_notes; i++)
1787                         if (!writenote(&tmp->notes[i], file, foffset))
1788                                 return 0;
1789         }
1790
1791         return 1;
1792 }
1793
1794 static void free_note_info(struct elf_note_info *info)
1795 {
1796         while (!list_empty(&info->thread_list)) {
1797                 struct list_head *tmp = info->thread_list.next;
1798                 list_del(tmp);
1799                 kfree(list_entry(tmp, struct elf_thread_status, list));
1800         }
1801
1802         kfree(info->prstatus);
1803         kfree(info->psinfo);
1804         kfree(info->notes);
1805         kfree(info->fpu);
1806 #ifdef ELF_CORE_COPY_XFPREGS
1807         kfree(info->xfpu);
1808 #endif
1809 }
1810
1811 #endif
1812
1813 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1814                                         struct vm_area_struct *gate_vma)
1815 {
1816         struct vm_area_struct *ret = tsk->mm->mmap;
1817
1818         if (ret)
1819                 return ret;
1820         return gate_vma;
1821 }
1822 /*
1823  * Helper function for iterating across a vma list.  It ensures that the caller
1824  * will visit `gate_vma' prior to terminating the search.
1825  */
1826 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1827                                         struct vm_area_struct *gate_vma)
1828 {
1829         struct vm_area_struct *ret;
1830
1831         ret = this_vma->vm_next;
1832         if (ret)
1833                 return ret;
1834         if (this_vma == gate_vma)
1835                 return NULL;
1836         return gate_vma;
1837 }
1838
1839 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
1840                              elf_addr_t e_shoff, int segs)
1841 {
1842         elf->e_shoff = e_shoff;
1843         elf->e_shentsize = sizeof(*shdr4extnum);
1844         elf->e_shnum = 1;
1845         elf->e_shstrndx = SHN_UNDEF;
1846
1847         memset(shdr4extnum, 0, sizeof(*shdr4extnum));
1848
1849         shdr4extnum->sh_type = SHT_NULL;
1850         shdr4extnum->sh_size = elf->e_shnum;
1851         shdr4extnum->sh_link = elf->e_shstrndx;
1852         shdr4extnum->sh_info = segs;
1853 }
1854
1855 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
1856                                      unsigned long mm_flags)
1857 {
1858         struct vm_area_struct *vma;
1859         size_t size = 0;
1860
1861         for (vma = first_vma(current, gate_vma); vma != NULL;
1862              vma = next_vma(vma, gate_vma))
1863                 size += vma_dump_size(vma, mm_flags);
1864         return size;
1865 }
1866
1867 /*
1868  * Actual dumper
1869  *
1870  * This is a two-pass process; first we find the offsets of the bits,
1871  * and then they are actually written out.  If we run out of core limit
1872  * we just truncate.
1873  */
1874 static int elf_core_dump(struct coredump_params *cprm)
1875 {
1876         int has_dumped = 0;
1877         mm_segment_t fs;
1878         int segs;
1879         size_t size = 0;
1880         struct vm_area_struct *vma, *gate_vma;
1881         struct elfhdr *elf = NULL;
1882         loff_t offset = 0, dataoff, foffset;
1883         struct elf_note_info info;
1884         struct elf_phdr *phdr4note = NULL;
1885         struct elf_shdr *shdr4extnum = NULL;
1886         Elf_Half e_phnum;
1887         elf_addr_t e_shoff;
1888
1889         /*
1890          * We no longer stop all VM operations.
1891          *
1892          * This is because those proceses that could possibly change map_count
1893          * or the mmap / vma pages are now blocked in do_exit on current
1894          * finishing this core dump.
1895          *
1896          * Only ptrace can touch these memory addresses, but it doesn't change
1897          * the map_count or the pages allocated. So no possibility of crashing
1898          * exists while dumping the mm->vm_next areas to the core file.
1899          */
1900
1901         /* alloc memory for large data structures: too large to be on stack */
1902         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1903         if (!elf)
1904                 goto out;
1905         /*
1906          * The number of segs are recored into ELF header as 16bit value.
1907          * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
1908          */
1909         segs = current->mm->map_count;
1910         segs += elf_core_extra_phdrs();
1911
1912         gate_vma = get_gate_vma(current->mm);
1913         if (gate_vma != NULL)
1914                 segs++;
1915
1916         /* for notes section */
1917         segs++;
1918
1919         /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
1920          * this, kernel supports extended numbering. Have a look at
1921          * include/linux/elf.h for further information. */
1922         e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
1923
1924         /*
1925          * Collect all the non-memory information about the process for the
1926          * notes.  This also sets up the file header.
1927          */
1928         if (!fill_note_info(elf, e_phnum, &info, cprm->signr, cprm->regs))
1929                 goto cleanup;
1930
1931         has_dumped = 1;
1932         current->flags |= PF_DUMPCORE;
1933
1934         fs = get_fs();
1935         set_fs(KERNEL_DS);
1936
1937         offset += sizeof(*elf);                         /* Elf header */
1938         offset += segs * sizeof(struct elf_phdr);       /* Program headers */
1939         foffset = offset;
1940
1941         /* Write notes phdr entry */
1942         {
1943                 size_t sz = get_note_info_size(&info);
1944
1945                 sz += elf_coredump_extra_notes_size();
1946
1947                 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
1948                 if (!phdr4note)
1949                         goto end_coredump;
1950
1951                 fill_elf_note_phdr(phdr4note, sz, offset);
1952                 offset += sz;
1953         }
1954
1955         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
1956
1957         offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
1958         offset += elf_core_extra_data_size();
1959         e_shoff = offset;
1960
1961         if (e_phnum == PN_XNUM) {
1962                 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
1963                 if (!shdr4extnum)
1964                         goto end_coredump;
1965                 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
1966         }
1967
1968         offset = dataoff;
1969
1970         size += sizeof(*elf);
1971         if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
1972                 goto end_coredump;
1973
1974         size += sizeof(*phdr4note);
1975         if (size > cprm->limit
1976             || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
1977                 goto end_coredump;
1978
1979         /* Write program headers for segments dump */
1980         for (vma = first_vma(current, gate_vma); vma != NULL;
1981                         vma = next_vma(vma, gate_vma)) {
1982                 struct elf_phdr phdr;
1983
1984                 phdr.p_type = PT_LOAD;
1985                 phdr.p_offset = offset;
1986                 phdr.p_vaddr = vma->vm_start;
1987                 phdr.p_paddr = 0;
1988                 phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
1989                 phdr.p_memsz = vma->vm_end - vma->vm_start;
1990                 offset += phdr.p_filesz;
1991                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
1992                 if (vma->vm_flags & VM_WRITE)
1993                         phdr.p_flags |= PF_W;
1994                 if (vma->vm_flags & VM_EXEC)
1995                         phdr.p_flags |= PF_X;
1996                 phdr.p_align = ELF_EXEC_PAGESIZE;
1997
1998                 size += sizeof(phdr);
1999                 if (size > cprm->limit
2000                     || !dump_write(cprm->file, &phdr, sizeof(phdr)))
2001                         goto end_coredump;
2002         }
2003
2004         if (!elf_core_write_extra_phdrs(cprm->file, offset, &size, cprm->limit))
2005                 goto end_coredump;
2006
2007         /* write out the notes section */
2008         if (!write_note_info(&info, cprm->file, &foffset))
2009                 goto end_coredump;
2010
2011         if (elf_coredump_extra_notes_write(cprm->file, &foffset))
2012                 goto end_coredump;
2013
2014         /* Align to page */
2015         if (!dump_seek(cprm->file, dataoff - foffset))
2016                 goto end_coredump;
2017
2018         for (vma = first_vma(current, gate_vma); vma != NULL;
2019                         vma = next_vma(vma, gate_vma)) {
2020                 unsigned long addr;
2021                 unsigned long end;
2022
2023                 end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
2024
2025                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2026                         struct page *page;
2027                         int stop;
2028
2029                         page = get_dump_page(addr);
2030                         if (page) {
2031                                 void *kaddr = kmap(page);
2032                                 stop = ((size += PAGE_SIZE) > cprm->limit) ||
2033                                         !dump_write(cprm->file, kaddr,
2034                                                     PAGE_SIZE);
2035                                 kunmap(page);
2036                                 page_cache_release(page);
2037                         } else
2038                                 stop = !dump_seek(cprm->file, PAGE_SIZE);
2039                         if (stop)
2040                                 goto end_coredump;
2041                 }
2042         }
2043
2044         if (!elf_core_write_extra_data(cprm->file, &size, cprm->limit))
2045                 goto end_coredump;
2046
2047         if (e_phnum == PN_XNUM) {
2048                 size += sizeof(*shdr4extnum);
2049                 if (size > cprm->limit
2050                     || !dump_write(cprm->file, shdr4extnum,
2051                                    sizeof(*shdr4extnum)))
2052                         goto end_coredump;
2053         }
2054
2055 end_coredump:
2056         set_fs(fs);
2057
2058 cleanup:
2059         free_note_info(&info);
2060         kfree(shdr4extnum);
2061         kfree(phdr4note);
2062         kfree(elf);
2063 out:
2064         return has_dumped;
2065 }
2066
2067 #endif          /* CONFIG_ELF_CORE */
2068
2069 static int __init init_elf_binfmt(void)
2070 {
2071         return register_binfmt(&elf_format);
2072 }
2073
2074 static void __exit exit_elf_binfmt(void)
2075 {
2076         /* Remove the COFF and ELF loaders. */
2077         unregister_binfmt(&elf_format);
2078 }
2079
2080 core_initcall(init_elf_binfmt);
2081 module_exit(exit_elf_binfmt);
2082 MODULE_LICENSE("GPL");