fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/stat.h>
  16 #include <linux/time.h>
  17 #include <linux/mm.h>
  18 #include <linux/mman.h>
  19 #include <linux/a.out.h>
  20 #include <linux/errno.h>
  21 #include <linux/signal.h>
  22 #include <linux/binfmts.h>
  23 #include <linux/string.h>
  24 #include <linux/file.h>
  25 #include <linux/fcntl.h>
  26 #include <linux/ptrace.h>
  27 #include <linux/slab.h>
  28 #include <linux/shm.h>
  29 #include <linux/personality.h>
  30 #include <linux/elfcore.h>
  31 #include <linux/init.h>
  32 #include <linux/highuid.h>
  33 #include <linux/smp.h>
  34 #include <linux/compiler.h>
  35 #include <linux/highmem.h>
  36 #include <linux/pagemap.h>
  37 #include <linux/security.h>
  38 #include <linux/syscalls.h>
  39 #include <linux/random.h>
  40 #include <linux/elf.h>
  41 #include <linux/utsname.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/param.h>
  44 #include <asm/page.h>
  45
  46 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
  47 static int load_elf_library(struct file *);
  48 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  49                                 int, int, unsigned long);
  50
  51 /*
  52  * If we don't support core dumping, then supply a NULL so we
  53  * don't even try.
  54  */
  55 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
  56 static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
  57 #else
  58 #define elf_core_dump   NULL
  59 #endif
  60
  61 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  62 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  63 #else
  64 #define ELF_MIN_ALIGN   PAGE_SIZE
  65 #endif
  66
  67 #ifndef ELF_CORE_EFLAGS
  68 #define ELF_CORE_EFLAGS 0
  69 #endif
  70
  71 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  72 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  73 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  74
  75 static struct linux_binfmt elf_format = {
  76                 .module         = THIS_MODULE,
  77                 .load_binary    = load_elf_binary,
  78                 .load_shlib     = load_elf_library,
  79                 .core_dump      = elf_core_dump,
  80                 .min_coredump   = ELF_EXEC_PAGESIZE,
  81                 .hasvdso        = 1
  82 };
  83
  84 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  85
  86 static int set_brk(unsigned long start, unsigned long end)
  87 {
  88         start = ELF_PAGEALIGN(start);
  89         end = ELF_PAGEALIGN(end);
  90         if (end > start) {
  91                 unsigned long addr;
  92                 down_write(&current->mm->mmap_sem);
  93                 addr = do_brk(start, end - start);
  94                 up_write(&current->mm->mmap_sem);
  95                 if (BAD_ADDR(addr))
  96                         return addr;
  97         }
  98         current->mm->start_brk = current->mm->brk = end;
  99         return 0;
 100 }
 101
 102 /* We need to explicitly zero any fractional pages
 103    after the data section (i.e. bss).  This would
 104    contain the junk from the file that should not
 105    be in memory
 106  */
 107 static int padzero(unsigned long elf_bss)
 108 {
 109         unsigned long nbyte;
 110
 111         nbyte = ELF_PAGEOFFSET(elf_bss);
 112         if (nbyte) {
 113                 nbyte = ELF_MIN_ALIGN - nbyte;
 114                 if (clear_user((void __user *) elf_bss, nbyte))
 115                         return -EFAULT;
 116         }
 117         return 0;
 118 }
 119
 120 /* Let's use some macros to make this stack manipulation a little clearer */
 121 #ifdef CONFIG_STACK_GROWSUP
 122 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 123 #define STACK_ROUND(sp, items) \
 124         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 125 #define STACK_ALLOC(sp, len) ({ \
 126         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 127         old_sp; })
 128 #else
 129 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 130 #define STACK_ROUND(sp, items) \
 131         (((unsigned long) (sp - items)) &~ 15UL)
 132 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 133 #endif
 134
 135 static int
 136 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 137                 unsigned long load_addr, unsigned long interp_load_addr)
 138 {
 139         unsigned long p = bprm->p;
 140         int argc = bprm->argc;
 141         int envc = bprm->envc;
 142         elf_addr_t __user *argv;
 143         elf_addr_t __user *envp;
 144         elf_addr_t __user *sp;
 145         elf_addr_t __user *u_platform;
 146         const char *k_platform = ELF_PLATFORM;
 147         int items;
 148         elf_addr_t *elf_info;
 149         int ei_index = 0;
 150         struct task_struct *tsk = current;
 151         struct vm_area_struct *vma;
 152
 153         /*
 154          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 155          * evictions by the processes running on the same package. One
 156          * thing we can do is to shuffle the initial stack for them.
 157          */
 158
 159         p = arch_align_stack(p);
 160
 161         /*
 162          * If this architecture has a platform capability string, copy it
 163          * to userspace.  In some cases (Sparc), this info is impossible
 164          * for userspace to get any other way, in others (i386) it is
 165          * merely difficult.
 166          */
 167         u_platform = NULL;
 168         if (k_platform) {
 169                 size_t len = strlen(k_platform) + 1;
 170
 171                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 172                 if (__copy_to_user(u_platform, k_platform, len))
 173                         return -EFAULT;
 174         }
 175
 176         /* Create the ELF interpreter info */
 177         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 178         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 179 #define NEW_AUX_ENT(id, val) \
 180         do { \
 181                 elf_info[ei_index++] = id; \
 182                 elf_info[ei_index++] = val; \
 183         } while (0)
 184
 185 #ifdef ARCH_DLINFO
 186         /*
 187          * ARCH_DLINFO must come first so PPC can do its special alignment of
 188          * AUXV.
 189          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 190          * ARCH_DLINFO changes
 191          */
 192         ARCH_DLINFO;
 193 #endif
 194         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 195         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 196         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 197         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 198         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 199         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 200         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 201         NEW_AUX_ENT(AT_FLAGS, 0);
 202         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 203         NEW_AUX_ENT(AT_UID, tsk->uid);
 204         NEW_AUX_ENT(AT_EUID, tsk->euid);
 205         NEW_AUX_ENT(AT_GID, tsk->gid);
 206         NEW_AUX_ENT(AT_EGID, tsk->egid);
 207         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 208         if (k_platform) {
 209                 NEW_AUX_ENT(AT_PLATFORM,
 210                             (elf_addr_t)(unsigned long)u_platform);
 211         }
 212         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 213                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 214         }
 215 #undef NEW_AUX_ENT
 216         /* AT_NULL is zero; clear the rest too */
 217         memset(&elf_info[ei_index], 0,
 218                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 219
 220         /* And advance past the AT_NULL entry.  */
 221         ei_index += 2;
 222
 223         sp = STACK_ADD(p, ei_index);
 224
 225         items = (argc + 1) + (envc + 1) + 1;
 226         bprm->p = STACK_ROUND(sp, items);
 227
 228         /* Point sp at the lowest address on the stack */
 229 #ifdef CONFIG_STACK_GROWSUP
 230         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 231         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 232 #else
 233         sp = (elf_addr_t __user *)bprm->p;
 234 #endif
 235
 236
 237         /*
 238          * Grow the stack manually; some architectures have a limit on how
 239          * far ahead a user-space access may be in order to grow the stack.
 240          */
 241         vma = find_extend_vma(current->mm, bprm->p);
 242         if (!vma)
 243                 return -EFAULT;
 244
 245         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 246         if (__put_user(argc, sp++))
 247                 return -EFAULT;
 248         argv = sp;
 249         envp = argv + argc + 1;
 250
 251         /* Populate argv and envp */
 252         p = current->mm->arg_end = current->mm->arg_start;
 253         while (argc-- > 0) {
 254                 size_t len;
 255                 if (__put_user((elf_addr_t)p, argv++))
 256                         return -EFAULT;
 257                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 258                 if (!len || len > MAX_ARG_STRLEN)
 259                         return 0;
 260                 p += len;
 261         }
 262         if (__put_user(0, argv))
 263                 return -EFAULT;
 264         current->mm->arg_end = current->mm->env_start = p;
 265         while (envc-- > 0) {
 266                 size_t len;
 267                 if (__put_user((elf_addr_t)p, envp++))
 268                         return -EFAULT;
 269                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 270                 if (!len || len > MAX_ARG_STRLEN)
 271                         return 0;
 272                 p += len;
 273         }
 274         if (__put_user(0, envp))
 275                 return -EFAULT;
 276         current->mm->env_end = p;
 277
 278         /* Put the elf_info on the stack in the right place.  */
 279         sp = (elf_addr_t __user *)envp + 1;
 280         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 281                 return -EFAULT;
 282         return 0;
 283 }
 284
 285 #ifndef elf_map
 286
 287 static unsigned long elf_map(struct file *filep, unsigned long addr,
 288                 struct elf_phdr *eppnt, int prot, int type,
 289                 unsigned long total_size)
 290 {
 291         unsigned long map_addr;
 292         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 293         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 294         addr = ELF_PAGESTART(addr);
 295         size = ELF_PAGEALIGN(size);
 296
 297         /* mmap() will return -EINVAL if given a zero size, but a
 298          * segment with zero filesize is perfectly valid */
 299         if (!size)
 300                 return addr;
 301
 302         down_write(&current->mm->mmap_sem);
 303         /*
 304         * total_size is the size of the ELF (interpreter) image.
 305         * The _first_ mmap needs to know the full size, otherwise
 306         * randomization might put this image into an overlapping
 307         * position with the ELF binary image. (since size < total_size)
 308         * So we first map the 'big' image - and unmap the remainder at
 309         * the end. (which unmap is needed for ELF images with holes.)
 310         */
 311         if (total_size) {
 312                 total_size = ELF_PAGEALIGN(total_size);
 313                 map_addr = do_mmap(filep, addr, total_size, prot, type, off);
 314                 if (!BAD_ADDR(map_addr))
 315                         do_munmap(current->mm, map_addr+size, total_size-size);
 316         } else
 317                 map_addr = do_mmap(filep, addr, size, prot, type, off);
 318
 319         up_write(&current->mm->mmap_sem);
 320         return(map_addr);
 321 }
 322
 323 #endif /* !elf_map */
 324
 325 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 326 {
 327         int i, first_idx = -1, last_idx = -1;
 328
 329         for (i = 0; i < nr; i++) {
 330                 if (cmds[i].p_type == PT_LOAD) {
 331                         last_idx = i;
 332                         if (first_idx == -1)
 333                                 first_idx = i;
 334                 }
 335         }
 336         if (first_idx == -1)
 337                 return 0;
 338
 339         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 340                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 341 }
 342
 343
 344 /* This is much more generalized than the library routine read function,
 345    so we keep this separate.  Technically the library read function
 346    is only provided so that we can read a.out libraries that have
 347    an ELF header */
 348
 349 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 350                 struct file *interpreter, unsigned long *interp_map_addr,
 351                 unsigned long no_base)
 352 {
 353         struct elf_phdr *elf_phdata;
 354         struct elf_phdr *eppnt;
 355         unsigned long load_addr = 0;
 356         int load_addr_set = 0;
 357         unsigned long last_bss = 0, elf_bss = 0;
 358         unsigned long error = ~0UL;
 359         unsigned long total_size;
 360         int retval, i, size;
 361
 362         /* First of all, some simple consistency checks */
 363         if (interp_elf_ex->e_type != ET_EXEC &&
 364             interp_elf_ex->e_type != ET_DYN)
 365                 goto out;
 366         if (!elf_check_arch(interp_elf_ex))
 367                 goto out;
 368         if (!interpreter->f_op || !interpreter->f_op->mmap)
 369                 goto out;
 370
 371         /*
 372          * If the size of this structure has changed, then punt, since
 373          * we will be doing the wrong thing.
 374          */
 375         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 376                 goto out;
 377         if (interp_elf_ex->e_phnum < 1 ||
 378                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 379                 goto out;
 380
 381         /* Now read in all of the header information */
 382         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 383         if (size > ELF_MIN_ALIGN)
 384                 goto out;
 385         elf_phdata = kmalloc(size, GFP_KERNEL);
 386         if (!elf_phdata)
 387                 goto out;
 388
 389         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 390                              (char *)elf_phdata,size);
 391         error = -EIO;
 392         if (retval != size) {
 393                 if (retval < 0)
 394                         error = retval;
 395                 goto out_close;
 396         }
 397
 398         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 399         if (!total_size) {
 400                 error = -EINVAL;
 401                 goto out_close;
 402         }
 403
 404         eppnt = elf_phdata;
 405         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 406                 if (eppnt->p_type == PT_LOAD) {
 407                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 408                         int elf_prot = 0;
 409                         unsigned long vaddr = 0;
 410                         unsigned long k, map_addr;
 411
 412                         if (eppnt->p_flags & PF_R)
 413                                 elf_prot = PROT_READ;
 414                         if (eppnt->p_flags & PF_W)
 415                                 elf_prot |= PROT_WRITE;
 416                         if (eppnt->p_flags & PF_X)
 417                                 elf_prot |= PROT_EXEC;
 418                         vaddr = eppnt->p_vaddr;
 419                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 420                                 elf_type |= MAP_FIXED;
 421                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 422                                 load_addr = -vaddr;
 423
 424                         map_addr = elf_map(interpreter, load_addr + vaddr,
 425                                         eppnt, elf_prot, elf_type, total_size);
 426                         total_size = 0;
 427                         if (!*interp_map_addr)
 428                                 *interp_map_addr = map_addr;
 429                         error = map_addr;
 430                         if (BAD_ADDR(map_addr))
 431                                 goto out_close;
 432
 433                         if (!load_addr_set &&
 434                             interp_elf_ex->e_type == ET_DYN) {
 435                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 436                                 load_addr_set = 1;
 437                         }
 438
 439                         /*
 440                          * Check to see if the section's size will overflow the
 441                          * allowed task size. Note that p_filesz must always be
 442                          * <= p_memsize so it's only necessary to check p_memsz.
 443                          */
 444                         k = load_addr + eppnt->p_vaddr;
 445                         if (BAD_ADDR(k) ||
 446                             eppnt->p_filesz > eppnt->p_memsz ||
 447                             eppnt->p_memsz > TASK_SIZE ||
 448                             TASK_SIZE - eppnt->p_memsz < k) {
 449                                 error = -ENOMEM;
 450                                 goto out_close;
 451                         }
 452
 453                         /*
 454                          * Find the end of the file mapping for this phdr, and
 455                          * keep track of the largest address we see for this.
 456                          */
 457                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 458                         if (k > elf_bss)
 459                                 elf_bss = k;
 460
 461                         /*
 462                          * Do the same thing for the memory mapping - between
 463                          * elf_bss and last_bss is the bss section.
 464                          */
 465                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 466                         if (k > last_bss)
 467                                 last_bss = k;
 468                 }
 469         }
 470
 471         /*
 472          * Now fill out the bss section.  First pad the last page up
 473          * to the page boundary, and then perform a mmap to make sure
 474          * that there are zero-mapped pages up to and including the
 475          * last bss page.
 476          */
 477         if (padzero(elf_bss)) {
 478                 error = -EFAULT;
 479                 goto out_close;
 480         }
 481
 482         /* What we have mapped so far */
 483         elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 484
 485         /* Map the last of the bss segment */
 486         if (last_bss > elf_bss) {
 487                 down_write(&current->mm->mmap_sem);
 488                 error = do_brk(elf_bss, last_bss - elf_bss);
 489                 up_write(&current->mm->mmap_sem);
 490                 if (BAD_ADDR(error))
 491                         goto out_close;
 492         }
 493
 494         error = load_addr;
 495
 496 out_close:
 497         kfree(elf_phdata);
 498 out:
 499         return error;
 500 }
 501
 502 /*
 503  * These are the functions used to load ELF style executables and shared
 504  * libraries.  There is no binary dependent code anywhere else.
 505  */
 506
 507 #define INTERPRETER_NONE 0
 508 #define INTERPRETER_ELF 2
 509
 510 #ifndef STACK_RND_MASK
 511 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 512 #endif
 513
 514 static unsigned long randomize_stack_top(unsigned long stack_top)
 515 {
 516         unsigned int random_variable = 0;
 517
 518         if ((current->flags & PF_RANDOMIZE) &&
 519                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 520                 random_variable = get_random_int() & STACK_RND_MASK;
 521                 random_variable <<= PAGE_SHIFT;
 522         }
 523 #ifdef CONFIG_STACK_GROWSUP
 524         return PAGE_ALIGN(stack_top) + random_variable;
 525 #else
 526         return PAGE_ALIGN(stack_top) - random_variable;
 527 #endif
 528 }
 529
 530 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 531 {
 532         struct file *interpreter = NULL; /* to shut gcc up */
 533         unsigned long load_addr = 0, load_bias = 0;
 534         int load_addr_set = 0;
 535         char * elf_interpreter = NULL;
 536         unsigned long error;
 537         struct elf_phdr *elf_ppnt, *elf_phdata;
 538         unsigned long elf_bss, elf_brk;
 539         int elf_exec_fileno;
 540         int retval, i;
 541         unsigned int size;
 542         unsigned long elf_entry;
 543         unsigned long interp_load_addr = 0;
 544         unsigned long start_code, end_code, start_data, end_data;
 545         unsigned long reloc_func_desc = 0;
 546         int executable_stack = EXSTACK_DEFAULT;
 547         unsigned long def_flags = 0;
 548         struct {
 549                 struct elfhdr elf_ex;
 550                 struct elfhdr interp_elf_ex;
 551                 struct exec interp_ex;
 552         } *loc;
 553
 554         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 555         if (!loc) {
 556                 retval = -ENOMEM;
 557                 goto out_ret;
 558         }
 559
 560         /* Get the exec-header */
 561         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 562
 563         retval = -ENOEXEC;
 564         /* First of all, some simple consistency checks */
 565         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 566                 goto out;
 567
 568         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 569                 goto out;
 570         if (!elf_check_arch(&loc->elf_ex))
 571                 goto out;
 572         if (!bprm->file->f_op||!bprm->file->f_op->mmap)
 573                 goto out;
 574
 575         /* Now read in all of the header information */
 576         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 577                 goto out;
 578         if (loc->elf_ex.e_phnum < 1 ||
 579                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 580                 goto out;
 581         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 582         retval = -ENOMEM;
 583         elf_phdata = kmalloc(size, GFP_KERNEL);
 584         if (!elf_phdata)
 585                 goto out;
 586
 587         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 588                              (char *)elf_phdata, size);
 589         if (retval != size) {
 590                 if (retval >= 0)
 591                         retval = -EIO;
 592                 goto out_free_ph;
 593         }
 594
 595         retval = get_unused_fd();
 596         if (retval < 0)
 597                 goto out_free_ph;
 598         get_file(bprm->file);
 599         fd_install(elf_exec_fileno = retval, bprm->file);
 600
 601         elf_ppnt = elf_phdata;
 602         elf_bss = 0;
 603         elf_brk = 0;
 604
 605         start_code = ~0UL;
 606         end_code = 0;
 607         start_data = 0;
 608         end_data = 0;
 609
 610         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 611                 if (elf_ppnt->p_type == PT_INTERP) {
 612                         /* This is the program interpreter used for
 613                          * shared libraries - for now assume that this
 614                          * is an a.out format binary
 615                          */
 616                         retval = -ENOEXEC;
 617                         if (elf_ppnt->p_filesz > PATH_MAX ||
 618                             elf_ppnt->p_filesz < 2)
 619                                 goto out_free_file;
 620
 621                         retval = -ENOMEM;
 622                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 623                                                   GFP_KERNEL);
 624                         if (!elf_interpreter)
 625                                 goto out_free_file;
 626
 627                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 628                                              elf_interpreter,
 629                                              elf_ppnt->p_filesz);
 630                         if (retval != elf_ppnt->p_filesz) {
 631                                 if (retval >= 0)
 632                                         retval = -EIO;
 633                                 goto out_free_interp;
 634                         }
 635                         /* make sure path is NULL terminated */
 636                         retval = -ENOEXEC;
 637                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 638                                 goto out_free_interp;
 639
 640                         /*
 641                          * The early SET_PERSONALITY here is so that the lookup
 642                          * for the interpreter happens in the namespace of the
 643                          * to-be-execed image.  SET_PERSONALITY can select an
 644                          * alternate root.
 645                          *
 646                          * However, SET_PERSONALITY is NOT allowed to switch
 647                          * this task into the new images's memory mapping
 648                          * policy - that is, TASK_SIZE must still evaluate to
 649                          * that which is appropriate to the execing application.
 650                          * This is because exit_mmap() needs to have TASK_SIZE
 651                          * evaluate to the size of the old image.
 652                          *
 653                          * So if (say) a 64-bit application is execing a 32-bit
 654                          * application it is the architecture's responsibility
 655                          * to defer changing the value of TASK_SIZE until the
 656                          * switch really is going to happen - do this in
 657                          * flush_thread().      - akpm
 658                          */
 659                         SET_PERSONALITY(loc->elf_ex, 0);
 660
 661                         interpreter = open_exec(elf_interpreter);
 662                         retval = PTR_ERR(interpreter);
 663                         if (IS_ERR(interpreter))
 664                                 goto out_free_interp;
 665
 666                         /*
 667                          * If the binary is not readable then enforce
 668                          * mm->dumpable = 0 regardless of the interpreter's
 669                          * permissions.
 670                          */
 671                         if (file_permission(interpreter, MAY_READ) < 0)
 672                                 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
 673
 674                         retval = kernel_read(interpreter, 0, bprm->buf,
 675                                              BINPRM_BUF_SIZE);
 676                         if (retval != BINPRM_BUF_SIZE) {
 677                                 if (retval >= 0)
 678                                         retval = -EIO;
 679                                 goto out_free_dentry;
 680                         }
 681
 682                         /* Get the exec headers */
 683                         loc->interp_ex = *((struct exec *)bprm->buf);
 684                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 685                         break;
 686                 }
 687                 elf_ppnt++;
 688         }
 689
 690         elf_ppnt = elf_phdata;
 691         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 692                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 693                         if (elf_ppnt->p_flags & PF_X)
 694                                 executable_stack = EXSTACK_ENABLE_X;
 695                         else
 696                                 executable_stack = EXSTACK_DISABLE_X;
 697                         break;
 698                 }
 699
 700         /* Some simple consistency checks for the interpreter */
 701         if (elf_interpreter) {
 702                 retval = -ELIBBAD;
 703                 /* Not an ELF interpreter */
 704                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 705                         goto out_free_dentry;
 706                 /* Verify the interpreter has a valid arch */
 707                 if (!elf_check_arch(&loc->interp_elf_ex))
 708                         goto out_free_dentry;
 709         } else {
 710                 /* Executables without an interpreter also need a personality  */
 711                 SET_PERSONALITY(loc->elf_ex, 0);
 712         }
 713
 714         /* Flush all traces of the currently running executable */
 715         retval = flush_old_exec(bprm);
 716         if (retval)
 717                 goto out_free_dentry;
 718
 719         /* OK, This is the point of no return */
 720         current->flags &= ~PF_FORKNOEXEC;
 721         current->mm->def_flags = def_flags;
 722
 723         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 724            may depend on the personality.  */
 725         SET_PERSONALITY(loc->elf_ex, 0);
 726         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 727                 current->personality |= READ_IMPLIES_EXEC;
 728
 729         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 730                 current->flags |= PF_RANDOMIZE;
 731         arch_pick_mmap_layout(current->mm);
 732
 733         /* Do this so that we can load the interpreter, if need be.  We will
 734            change some of these later */
 735         current->mm->free_area_cache = current->mm->mmap_base;
 736         current->mm->cached_hole_size = 0;
 737         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 738                                  executable_stack);
 739         if (retval < 0) {
 740                 send_sig(SIGKILL, current, 0);
 741                 goto out_free_dentry;
 742         }
 743
 744         current->mm->start_stack = bprm->p;
 745
 746         /* Now we do a little grungy work by mmaping the ELF image into
 747            the correct location in memory. */
 748         for(i = 0, elf_ppnt = elf_phdata;
 749             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 750                 int elf_prot = 0, elf_flags;
 751                 unsigned long k, vaddr;
 752
 753                 if (elf_ppnt->p_type != PT_LOAD)
 754                         continue;
 755
 756                 if (unlikely (elf_brk > elf_bss)) {
 757                         unsigned long nbyte;
 758
 759                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 760                            before this one. Map anonymous pages, if needed,
 761                            and clear the area.  */
 762                         retval = set_brk (elf_bss + load_bias,
 763                                           elf_brk + load_bias);
 764                         if (retval) {
 765                                 send_sig(SIGKILL, current, 0);
 766                                 goto out_free_dentry;
 767                         }
 768                         nbyte = ELF_PAGEOFFSET(elf_bss);
 769                         if (nbyte) {
 770                                 nbyte = ELF_MIN_ALIGN - nbyte;
 771                                 if (nbyte > elf_brk - elf_bss)
 772                                         nbyte = elf_brk - elf_bss;
 773                                 if (clear_user((void __user *)elf_bss +
 774                                                         load_bias, nbyte)) {
 775                                         /*
 776                                          * This bss-zeroing can fail if the ELF
 777                                          * file specifies odd protections. So
 778                                          * we don't check the return value
 779                                          */
 780                                 }
 781                         }
 782                 }
 783
 784                 if (elf_ppnt->p_flags & PF_R)
 785                         elf_prot |= PROT_READ;
 786                 if (elf_ppnt->p_flags & PF_W)
 787                         elf_prot |= PROT_WRITE;
 788                 if (elf_ppnt->p_flags & PF_X)
 789                         elf_prot |= PROT_EXEC;
 790
 791                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 792
 793                 vaddr = elf_ppnt->p_vaddr;
 794                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 795                         elf_flags |= MAP_FIXED;
 796                 } else if (loc->elf_ex.e_type == ET_DYN) {
 797                         /* Try and get dynamic programs out of the way of the
 798                          * default mmap base, as well as whatever program they
 799                          * might try to exec.  This is because the brk will
 800                          * follow the loader, and is not movable.  */
 801 #ifdef CONFIG_X86
 802                         load_bias = 0;
 803 #else
 804                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 805 #endif
 806                 }
 807
 808                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 809                                 elf_prot, elf_flags, 0);
 810                 if (BAD_ADDR(error)) {
 811                         send_sig(SIGKILL, current, 0);
 812                         retval = IS_ERR((void *)error) ?
 813                                 PTR_ERR((void*)error) : -EINVAL;
 814                         goto out_free_dentry;
 815                 }
 816
 817                 if (!load_addr_set) {
 818                         load_addr_set = 1;
 819                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 820                         if (loc->elf_ex.e_type == ET_DYN) {
 821                                 load_bias += error -
 822                                              ELF_PAGESTART(load_bias + vaddr);
 823                                 load_addr += load_bias;
 824                                 reloc_func_desc = load_bias;
 825                         }
 826                 }
 827                 k = elf_ppnt->p_vaddr;
 828                 if (k < start_code)
 829                         start_code = k;
 830                 if (start_data < k)
 831                         start_data = k;
 832
 833                 /*
 834                  * Check to see if the section's size will overflow the
 835                  * allowed task size. Note that p_filesz must always be
 836                  * <= p_memsz so it is only necessary to check p_memsz.
 837                  */
 838                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 839                     elf_ppnt->p_memsz > TASK_SIZE ||
 840                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 841                         /* set_brk can never work. Avoid overflows. */
 842                         send_sig(SIGKILL, current, 0);
 843                         retval = -EINVAL;
 844                         goto out_free_dentry;
 845                 }
 846
 847                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 848
 849                 if (k > elf_bss)
 850                         elf_bss = k;
 851                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 852                         end_code = k;
 853                 if (end_data < k)
 854                         end_data = k;
 855                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 856                 if (k > elf_brk)
 857                         elf_brk = k;
 858         }
 859
 860         loc->elf_ex.e_entry += load_bias;
 861         elf_bss += load_bias;
 862         elf_brk += load_bias;
 863         start_code += load_bias;
 864         end_code += load_bias;
 865         start_data += load_bias;
 866         end_data += load_bias;
 867
 868         /* Calling set_brk effectively mmaps the pages that we need
 869          * for the bss and break sections.  We must do this before
 870          * mapping in the interpreter, to make sure it doesn't wind
 871          * up getting placed where the bss needs to go.
 872          */
 873         retval = set_brk(elf_bss, elf_brk);
 874         if (retval) {
 875                 send_sig(SIGKILL, current, 0);
 876                 goto out_free_dentry;
 877         }
 878         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 879                 send_sig(SIGSEGV, current, 0);
 880                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 881                 goto out_free_dentry;
 882         }
 883
 884         if (elf_interpreter) {
 885                 unsigned long uninitialized_var(interp_map_addr);
 886
 887                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 888                                             interpreter,
 889                                             &interp_map_addr,
 890                                             load_bias);
 891                 if (!IS_ERR((void *)elf_entry)) {
 892                         /*
 893                          * load_elf_interp() returns relocation
 894                          * adjustment
 895                          */
 896                         interp_load_addr = elf_entry;
 897                         elf_entry += loc->interp_elf_ex.e_entry;
 898                 }
 899                 if (BAD_ADDR(elf_entry)) {
 900                         force_sig(SIGSEGV, current);
 901                         retval = IS_ERR((void *)elf_entry) ?
 902                                         (int)elf_entry : -EINVAL;
 903                         goto out_free_dentry;
 904                 }
 905                 reloc_func_desc = interp_load_addr;
 906
 907                 allow_write_access(interpreter);
 908                 fput(interpreter);
 909                 kfree(elf_interpreter);
 910         } else {
 911                 elf_entry = loc->elf_ex.e_entry;
 912                 if (BAD_ADDR(elf_entry)) {
 913                         force_sig(SIGSEGV, current);
 914                         retval = -EINVAL;
 915                         goto out_free_dentry;
 916                 }
 917         }
 918
 919         kfree(elf_phdata);
 920
 921         sys_close(elf_exec_fileno);
 922
 923         set_binfmt(&elf_format);
 924
 925 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 926         retval = arch_setup_additional_pages(bprm, executable_stack);
 927         if (retval < 0) {
 928                 send_sig(SIGKILL, current, 0);
 929                 goto out;
 930         }
 931 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 932
 933         compute_creds(bprm);
 934         current->flags &= ~PF_FORKNOEXEC;
 935         retval = create_elf_tables(bprm, &loc->elf_ex,
 936                           load_addr, interp_load_addr);
 937         if (retval < 0) {
 938                 send_sig(SIGKILL, current, 0);
 939                 goto out;
 940         }
 941         /* N.B. passed_fileno might not be initialized? */
 942         current->mm->end_code = end_code;
 943         current->mm->start_code = start_code;
 944         current->mm->start_data = start_data;
 945         current->mm->end_data = end_data;
 946         current->mm->start_stack = bprm->p;
 947
 948 #ifdef arch_randomize_brk
 949         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1))
 950                 current->mm->brk = current->mm->start_brk =
 951                         arch_randomize_brk(current->mm);
 952 #endif
 953
 954         if (current->personality & MMAP_PAGE_ZERO) {
 955                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 956                    and some applications "depend" upon this behavior.
 957                    Since we do not have the power to recompile these, we
 958                    emulate the SVr4 behavior. Sigh. */
 959                 down_write(&current->mm->mmap_sem);
 960                 error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 961                                 MAP_FIXED | MAP_PRIVATE, 0);
 962                 up_write(&current->mm->mmap_sem);
 963         }
 964
 965 #ifdef ELF_PLAT_INIT
 966         /*
 967          * The ABI may specify that certain registers be set up in special
 968          * ways (on i386 %edx is the address of a DT_FINI function, for
 969          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 970          * that the e_entry field is the address of the function descriptor
 971          * for the startup routine, rather than the address of the startup
 972          * routine itself.  This macro performs whatever initialization to
 973          * the regs structure is required as well as any relocations to the
 974          * function descriptor entries when executing dynamically links apps.
 975          */
 976         ELF_PLAT_INIT(regs, reloc_func_desc);
 977 #endif
 978
 979         start_thread(regs, elf_entry, bprm->p);
 980         if (unlikely(current->ptrace & PT_PTRACED)) {
 981                 if (current->ptrace & PT_TRACE_EXEC)
 982                         ptrace_notify ((PTRACE_EVENT_EXEC << 8) | SIGTRAP);
 983                 else
 984                         send_sig(SIGTRAP, current, 0);
 985         }
 986         retval = 0;
 987 out:
 988         kfree(loc);
 989 out_ret:
 990         return retval;
 991
 992         /* error cleanup */
 993 out_free_dentry:
 994         allow_write_access(interpreter);
 995         if (interpreter)
 996                 fput(interpreter);
 997 out_free_interp:
 998         kfree(elf_interpreter);
 999 out_free_file:
1000         sys_close(elf_exec_fileno);
1001 out_free_ph:
1002         kfree(elf_phdata);
1003         goto out;
1004 }
1005
1006 /* This is really simpleminded and specialized - we are loading an
1007    a.out library that is given an ELF header. */
1008 static int load_elf_library(struct file *file)
1009 {
1010         struct elf_phdr *elf_phdata;
1011         struct elf_phdr *eppnt;
1012         unsigned long elf_bss, bss, len;
1013         int retval, error, i, j;
1014         struct elfhdr elf_ex;
1015
1016         error = -ENOEXEC;
1017         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1018         if (retval != sizeof(elf_ex))
1019                 goto out;
1020
1021         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1022                 goto out;
1023
1024         /* First of all, some simple consistency checks */
1025         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1026             !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1027                 goto out;
1028
1029         /* Now read in all of the header information */
1030
1031         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1032         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1033
1034         error = -ENOMEM;
1035         elf_phdata = kmalloc(j, GFP_KERNEL);
1036         if (!elf_phdata)
1037                 goto out;
1038
1039         eppnt = elf_phdata;
1040         error = -ENOEXEC;
1041         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1042         if (retval != j)
1043                 goto out_free_ph;
1044
1045         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1046                 if ((eppnt + i)->p_type == PT_LOAD)
1047                         j++;
1048         if (j != 1)
1049                 goto out_free_ph;
1050
1051         while (eppnt->p_type != PT_LOAD)
1052                 eppnt++;
1053
1054         /* Now use mmap to map the library into memory. */
1055         down_write(&current->mm->mmap_sem);
1056         error = do_mmap(file,
1057                         ELF_PAGESTART(eppnt->p_vaddr),
1058                         (eppnt->p_filesz +
1059                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1060                         PROT_READ | PROT_WRITE | PROT_EXEC,
1061                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1062                         (eppnt->p_offset -
1063                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1064         up_write(&current->mm->mmap_sem);
1065         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1066                 goto out_free_ph;
1067
1068         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1069         if (padzero(elf_bss)) {
1070                 error = -EFAULT;
1071                 goto out_free_ph;
1072         }
1073
1074         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1075                             ELF_MIN_ALIGN - 1);
1076         bss = eppnt->p_memsz + eppnt->p_vaddr;
1077         if (bss > len) {
1078                 down_write(&current->mm->mmap_sem);
1079                 do_brk(len, bss - len);
1080                 up_write(&current->mm->mmap_sem);
1081         }
1082         error = 0;
1083
1084 out_free_ph:
1085         kfree(elf_phdata);
1086 out:
1087         return error;
1088 }
1089
1090 /*
1091  * Note that some platforms still use traditional core dumps and not
1092  * the ELF core dump.  Each platform can select it as appropriate.
1093  */
1094 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
1095
1096 /*
1097  * ELF core dumper
1098  *
1099  * Modelled on fs/exec.c:aout_core_dump()
1100  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1101  */
1102 /*
1103  * These are the only things you should do on a core-file: use only these
1104  * functions to write out all the necessary info.
1105  */
1106 static int dump_write(struct file *file, const void *addr, int nr)
1107 {
1108         return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
1109 }
1110
1111 static int dump_seek(struct file *file, loff_t off)
1112 {
1113         if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
1114                 if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
1115                         return 0;
1116         } else {
1117                 char *buf = (char *)get_zeroed_page(GFP_KERNEL);
1118                 if (!buf)
1119                         return 0;
1120                 while (off > 0) {
1121                         unsigned long n = off;
1122                         if (n > PAGE_SIZE)
1123                                 n = PAGE_SIZE;
1124                         if (!dump_write(file, buf, n))
1125                                 return 0;
1126                         off -= n;
1127                 }
1128                 free_page((unsigned long)buf);
1129         }
1130         return 1;
1131 }
1132
1133 /*
1134  * Decide what to dump of a segment, part, all or none.
1135  */
1136 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1137                                    unsigned long mm_flags)
1138 {
1139         /* The vma can be set up to tell us the answer directly.  */
1140         if (vma->vm_flags & VM_ALWAYSDUMP)
1141                 goto whole;
1142
1143         /* Do not dump I/O mapped devices or special mappings */
1144         if (vma->vm_flags & (VM_IO | VM_RESERVED))
1145                 return 0;
1146
1147 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1148
1149         /* By default, dump shared memory if mapped from an anonymous file. */
1150         if (vma->vm_flags & VM_SHARED) {
1151                 if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
1152                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1153                         goto whole;
1154                 return 0;
1155         }
1156
1157         /* Dump segments that have been written to.  */
1158         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1159                 goto whole;
1160         if (vma->vm_file == NULL)
1161                 return 0;
1162
1163         if (FILTER(MAPPED_PRIVATE))
1164                 goto whole;
1165
1166         /*
1167          * If this looks like the beginning of a DSO or executable mapping,
1168          * check for an ELF header.  If we find one, dump the first page to
1169          * aid in determining what was mapped here.
1170          */
1171         if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
1172                 u32 __user *header = (u32 __user *) vma->vm_start;
1173                 u32 word;
1174                 /*
1175                  * Doing it this way gets the constant folded by GCC.
1176                  */
1177                 union {
1178                         u32 cmp;
1179                         char elfmag[SELFMAG];
1180                 } magic;
1181                 BUILD_BUG_ON(SELFMAG != sizeof word);
1182                 magic.elfmag[EI_MAG0] = ELFMAG0;
1183                 magic.elfmag[EI_MAG1] = ELFMAG1;
1184                 magic.elfmag[EI_MAG2] = ELFMAG2;
1185                 magic.elfmag[EI_MAG3] = ELFMAG3;
1186                 if (get_user(word, header) == 0 && word == magic.cmp)
1187                         return PAGE_SIZE;
1188         }
1189
1190 #undef  FILTER
1191
1192         return 0;
1193
1194 whole:
1195         return vma->vm_end - vma->vm_start;
1196 }
1197
1198 /* An ELF note in memory */
1199 struct memelfnote
1200 {
1201         const char *name;
1202         int type;
1203         unsigned int datasz;
1204         void *data;
1205 };
1206
1207 static int notesize(struct memelfnote *en)
1208 {
1209         int sz;
1210
1211         sz = sizeof(struct elf_note);
1212         sz += roundup(strlen(en->name) + 1, 4);
1213         sz += roundup(en->datasz, 4);
1214
1215         return sz;
1216 }
1217
1218 #define DUMP_WRITE(addr, nr, foffset)   \
1219         do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
1220
1221 static int alignfile(struct file *file, loff_t *foffset)
1222 {
1223         static const char buf[4] = { 0, };
1224         DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
1225         return 1;
1226 }
1227
1228 static int writenote(struct memelfnote *men, struct file *file,
1229                         loff_t *foffset)
1230 {
1231         struct elf_note en;
1232         en.n_namesz = strlen(men->name) + 1;
1233         en.n_descsz = men->datasz;
1234         en.n_type = men->type;
1235
1236         DUMP_WRITE(&en, sizeof(en), foffset);
1237         DUMP_WRITE(men->name, en.n_namesz, foffset);
1238         if (!alignfile(file, foffset))
1239                 return 0;
1240         DUMP_WRITE(men->data, men->datasz, foffset);
1241         if (!alignfile(file, foffset))
1242                 return 0;
1243
1244         return 1;
1245 }
1246 #undef DUMP_WRITE
1247
1248 #define DUMP_WRITE(addr, nr)    \
1249         if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
1250                 goto end_coredump;
1251 #define DUMP_SEEK(off)  \
1252         if (!dump_seek(file, (off))) \
1253                 goto end_coredump;
1254
1255 static void fill_elf_header(struct elfhdr *elf, int segs,
1256                             u16 machine, u32 flags, u8 osabi)
1257 {
1258         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1259         elf->e_ident[EI_CLASS] = ELF_CLASS;
1260         elf->e_ident[EI_DATA] = ELF_DATA;
1261         elf->e_ident[EI_VERSION] = EV_CURRENT;
1262         elf->e_ident[EI_OSABI] = ELF_OSABI;
1263         memset(elf->e_ident+EI_PAD, 0, EI_NIDENT-EI_PAD);
1264
1265         elf->e_type = ET_CORE;
1266         elf->e_machine = machine;
1267         elf->e_version = EV_CURRENT;
1268         elf->e_entry = 0;
1269         elf->e_phoff = sizeof(struct elfhdr);
1270         elf->e_shoff = 0;
1271         elf->e_flags = flags;
1272         elf->e_ehsize = sizeof(struct elfhdr);
1273         elf->e_phentsize = sizeof(struct elf_phdr);
1274         elf->e_phnum = segs;
1275         elf->e_shentsize = 0;
1276         elf->e_shnum = 0;
1277         elf->e_shstrndx = 0;
1278         return;
1279 }
1280
1281 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1282 {
1283         phdr->p_type = PT_NOTE;
1284         phdr->p_offset = offset;
1285         phdr->p_vaddr = 0;
1286         phdr->p_paddr = 0;
1287         phdr->p_filesz = sz;
1288         phdr->p_memsz = 0;
1289         phdr->p_flags = 0;
1290         phdr->p_align = 0;
1291         return;
1292 }
1293
1294 static void fill_note(struct memelfnote *note, const char *name, int type,
1295                 unsigned int sz, void *data)
1296 {
1297         note->name = name;
1298         note->type = type;
1299         note->datasz = sz;
1300         note->data = data;
1301         return;
1302 }
1303
1304 /*
1305  * fill up all the fields in prstatus from the given task struct, except
1306  * registers which need to be filled up separately.
1307  */
1308 static void fill_prstatus(struct elf_prstatus *prstatus,
1309                 struct task_struct *p, long signr)
1310 {
1311         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1312         prstatus->pr_sigpend = p->pending.signal.sig[0];
1313         prstatus->pr_sighold = p->blocked.sig[0];
1314         prstatus->pr_pid = task_pid_vnr(p);
1315         prstatus->pr_ppid = task_pid_vnr(p->real_parent);
1316         prstatus->pr_pgrp = task_pgrp_vnr(p);
1317         prstatus->pr_sid = task_session_vnr(p);
1318         if (thread_group_leader(p)) {
1319                 /*
1320                  * This is the record for the group leader.  Add in the
1321                  * cumulative times of previous dead threads.  This total
1322                  * won't include the time of each live thread whose state
1323                  * is included in the core dump.  The final total reported
1324                  * to our parent process when it calls wait4 will include
1325                  * those sums as well as the little bit more time it takes
1326                  * this and each other thread to finish dying after the
1327                  * core dump synchronization phase.
1328                  */
1329                 cputime_to_timeval(cputime_add(p->utime, p->signal->utime),
1330                                    &prstatus->pr_utime);
1331                 cputime_to_timeval(cputime_add(p->stime, p->signal->stime),
1332                                    &prstatus->pr_stime);
1333         } else {
1334                 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1335                 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1336         }
1337         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1338         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1339 }
1340
1341 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1342                        struct mm_struct *mm)
1343 {
1344         unsigned int i, len;
1345
1346         /* first copy the parameters from user space */
1347         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1348
1349         len = mm->arg_end - mm->arg_start;
1350         if (len >= ELF_PRARGSZ)
1351                 len = ELF_PRARGSZ-1;
1352         if (copy_from_user(&psinfo->pr_psargs,
1353                            (const char __user *)mm->arg_start, len))
1354                 return -EFAULT;
1355         for(i = 0; i < len; i++)
1356                 if (psinfo->pr_psargs[i] == 0)
1357                         psinfo->pr_psargs[i] = ' ';
1358         psinfo->pr_psargs[len] = 0;
1359
1360         psinfo->pr_pid = task_pid_vnr(p);
1361         psinfo->pr_ppid = task_pid_vnr(p->real_parent);
1362         psinfo->pr_pgrp = task_pgrp_vnr(p);
1363         psinfo->pr_sid = task_session_vnr(p);
1364
1365         i = p->state ? ffz(~p->state) + 1 : 0;
1366         psinfo->pr_state = i;
1367         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1368         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1369         psinfo->pr_nice = task_nice(p);
1370         psinfo->pr_flag = p->flags;
1371         SET_UID(psinfo->pr_uid, p->uid);
1372         SET_GID(psinfo->pr_gid, p->gid);
1373         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1374
1375         return 0;
1376 }
1377
1378 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1379 {
1380         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1381         int i = 0;
1382         do
1383                 i += 2;
1384         while (auxv[i - 2] != AT_NULL);
1385         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1386 }
1387
1388 #ifdef CORE_DUMP_USE_REGSET
1389 #include <linux/regset.h>
1390
1391 struct elf_thread_core_info {
1392         struct elf_thread_core_info *next;
1393         struct task_struct *task;
1394         struct elf_prstatus prstatus;
1395         struct memelfnote notes[0];
1396 };
1397
1398 struct elf_note_info {
1399         struct elf_thread_core_info *thread;
1400         struct memelfnote psinfo;
1401         struct memelfnote auxv;
1402         size_t size;
1403         int thread_notes;
1404 };
1405
1406 /*
1407  * When a regset has a writeback hook, we call it on each thread before
1408  * dumping user memory.  On register window machines, this makes sure the
1409  * user memory backing the register data is up to date before we read it.
1410  */
1411 static void do_thread_regset_writeback(struct task_struct *task,
1412                                        const struct user_regset *regset)
1413 {
1414         if (regset->writeback)
1415                 regset->writeback(task, regset, 1);
1416 }
1417
1418 static int fill_thread_core_info(struct elf_thread_core_info *t,
1419                                  const struct user_regset_view *view,
1420                                  long signr, size_t *total)
1421 {
1422         unsigned int i;
1423
1424         /*
1425          * NT_PRSTATUS is the one special case, because the regset data
1426          * goes into the pr_reg field inside the note contents, rather
1427          * than being the whole note contents.  We fill the reset in here.
1428          * We assume that regset 0 is NT_PRSTATUS.
1429          */
1430         fill_prstatus(&t->prstatus, t->task, signr);
1431         (void) view->regsets[0].get(t->task, &view->regsets[0],
1432                                     0, sizeof(t->prstatus.pr_reg),
1433                                     &t->prstatus.pr_reg, NULL);
1434
1435         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1436                   sizeof(t->prstatus), &t->prstatus);
1437         *total += notesize(&t->notes[0]);
1438
1439         do_thread_regset_writeback(t->task, &view->regsets[0]);
1440
1441         /*
1442          * Each other regset might generate a note too.  For each regset
1443          * that has no core_note_type or is inactive, we leave t->notes[i]
1444          * all zero and we'll know to skip writing it later.
1445          */
1446         for (i = 1; i < view->n; ++i) {
1447                 const struct user_regset *regset = &view->regsets[i];
1448                 do_thread_regset_writeback(t->task, regset);
1449                 if (regset->core_note_type &&
1450                     (!regset->active || regset->active(t->task, regset))) {
1451                         int ret;
1452                         size_t size = regset->n * regset->size;
1453                         void *data = kmalloc(size, GFP_KERNEL);
1454                         if (unlikely(!data))
1455                                 return 0;
1456                         ret = regset->get(t->task, regset,
1457                                           0, size, data, NULL);
1458                         if (unlikely(ret))
1459                                 kfree(data);
1460                         else {
1461                                 if (regset->core_note_type != NT_PRFPREG)
1462                                         fill_note(&t->notes[i], "LINUX",
1463                                                   regset->core_note_type,
1464                                                   size, data);
1465                                 else {
1466                                         t->prstatus.pr_fpvalid = 1;
1467                                         fill_note(&t->notes[i], "CORE",
1468                                                   NT_PRFPREG, size, data);
1469                                 }
1470                                 *total += notesize(&t->notes[i]);
1471                         }
1472                 }
1473         }
1474
1475         return 1;
1476 }
1477
1478 static int fill_note_info(struct elfhdr *elf, int phdrs,
1479                           struct elf_note_info *info,
1480                           long signr, struct pt_regs *regs)
1481 {
1482         struct task_struct *dump_task = current;
1483         const struct user_regset_view *view = task_user_regset_view(dump_task);
1484         struct elf_thread_core_info *t;
1485         struct elf_prpsinfo *psinfo;
1486         struct task_struct *g, *p;
1487         unsigned int i;
1488
1489         info->size = 0;
1490         info->thread = NULL;
1491
1492         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1493         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1494
1495         if (psinfo == NULL)
1496                 return 0;
1497
1498         /*
1499          * Figure out how many notes we're going to need for each thread.
1500          */
1501         info->thread_notes = 0;
1502         for (i = 0; i < view->n; ++i)
1503                 if (view->regsets[i].core_note_type != 0)
1504                         ++info->thread_notes;
1505
1506         /*
1507          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1508          * since it is our one special case.
1509          */
1510         if (unlikely(info->thread_notes == 0) ||
1511             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1512                 WARN_ON(1);
1513                 return 0;
1514         }
1515
1516         /*
1517          * Initialize the ELF file header.
1518          */
1519         fill_elf_header(elf, phdrs,
1520                         view->e_machine, view->e_flags, view->ei_osabi);
1521
1522         /*
1523          * Allocate a structure for each thread.
1524          */
1525         rcu_read_lock();
1526         do_each_thread(g, p)
1527                 if (p->mm == dump_task->mm) {
1528                         t = kzalloc(offsetof(struct elf_thread_core_info,
1529                                              notes[info->thread_notes]),
1530                                     GFP_ATOMIC);
1531                         if (unlikely(!t)) {
1532                                 rcu_read_unlock();
1533                                 return 0;
1534                         }
1535                         t->task = p;
1536                         if (p == dump_task || !info->thread) {
1537                                 t->next = info->thread;
1538                                 info->thread = t;
1539                         } else {
1540                                 /*
1541                                  * Make sure to keep the original task at
1542                                  * the head of the list.
1543                                  */
1544                                 t->next = info->thread->next;
1545                                 info->thread->next = t;
1546                         }
1547                 }
1548         while_each_thread(g, p);
1549         rcu_read_unlock();
1550
1551         /*
1552          * Now fill in each thread's information.
1553          */
1554         for (t = info->thread; t != NULL; t = t->next)
1555                 if (!fill_thread_core_info(t, view, signr, &info->size))
1556                         return 0;
1557
1558         /*
1559          * Fill in the two process-wide notes.
1560          */
1561         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1562         info->size += notesize(&info->psinfo);
1563
1564         fill_auxv_note(&info->auxv, current->mm);
1565         info->size += notesize(&info->auxv);
1566
1567         return 1;
1568 }
1569
1570 static size_t get_note_info_size(struct elf_note_info *info)
1571 {
1572         return info->size;
1573 }
1574
1575 /*
1576  * Write all the notes for each thread.  When writing the first thread, the
1577  * process-wide notes are interleaved after the first thread-specific note.
1578  */
1579 static int write_note_info(struct elf_note_info *info,
1580                            struct file *file, loff_t *foffset)
1581 {
1582         bool first = 1;
1583         struct elf_thread_core_info *t = info->thread;
1584
1585         do {
1586                 int i;
1587
1588                 if (!writenote(&t->notes[0], file, foffset))
1589                         return 0;
1590
1591                 if (first && !writenote(&info->psinfo, file, foffset))
1592                         return 0;
1593                 if (first && !writenote(&info->auxv, file, foffset))
1594                         return 0;
1595
1596                 for (i = 1; i < info->thread_notes; ++i)
1597                         if (t->notes[i].data &&
1598                             !writenote(&t->notes[i], file, foffset))
1599                                 return 0;
1600
1601                 first = 0;
1602                 t = t->next;
1603         } while (t);
1604
1605         return 1;
1606 }
1607
1608 static void free_note_info(struct elf_note_info *info)
1609 {
1610         struct elf_thread_core_info *threads = info->thread;
1611         while (threads) {
1612                 unsigned int i;
1613                 struct elf_thread_core_info *t = threads;
1614                 threads = t->next;
1615                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1616                 for (i = 1; i < info->thread_notes; ++i)
1617                         kfree(t->notes[i].data);
1618                 kfree(t);
1619         }
1620         kfree(info->psinfo.data);
1621 }
1622
1623 #else
1624
1625 /* Here is the structure in which status of each thread is captured. */
1626 struct elf_thread_status
1627 {
1628         struct list_head list;
1629         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1630         elf_fpregset_t fpu;             /* NT_PRFPREG */
1631         struct task_struct *thread;
1632 #ifdef ELF_CORE_COPY_XFPREGS
1633         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1634 #endif
1635         struct memelfnote notes[3];
1636         int num_notes;
1637 };
1638
1639 /*
1640  * In order to add the specific thread information for the elf file format,
1641  * we need to keep a linked list of every threads pr_status and then create
1642  * a single section for them in the final core file.
1643  */
1644 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1645 {
1646         int sz = 0;
1647         struct task_struct *p = t->thread;
1648         t->num_notes = 0;
1649
1650         fill_prstatus(&t->prstatus, p, signr);
1651         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1652
1653         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1654                   &(t->prstatus));
1655         t->num_notes++;
1656         sz += notesize(&t->notes[0]);
1657
1658         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1659                                                                 &t->fpu))) {
1660                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1661                           &(t->fpu));
1662                 t->num_notes++;
1663                 sz += notesize(&t->notes[1]);
1664         }
1665
1666 #ifdef ELF_CORE_COPY_XFPREGS
1667         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1668                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1669                           sizeof(t->xfpu), &t->xfpu);
1670                 t->num_notes++;
1671                 sz += notesize(&t->notes[2]);
1672         }
1673 #endif
1674         return sz;
1675 }
1676
1677 struct elf_note_info {
1678         struct memelfnote *notes;
1679         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1680         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1681         struct list_head thread_list;
1682         elf_fpregset_t *fpu;
1683 #ifdef ELF_CORE_COPY_XFPREGS
1684         elf_fpxregset_t *xfpu;
1685 #endif
1686         int thread_status_size;
1687         int numnote;
1688 };
1689
1690 static int fill_note_info(struct elfhdr *elf, int phdrs,
1691                           struct elf_note_info *info,
1692                           long signr, struct pt_regs *regs)
1693 {
1694 #define NUM_NOTES       6
1695         struct list_head *t;
1696         struct task_struct *g, *p;
1697
1698         info->notes = NULL;
1699         info->prstatus = NULL;
1700         info->psinfo = NULL;
1701         info->fpu = NULL;
1702 #ifdef ELF_CORE_COPY_XFPREGS
1703         info->xfpu = NULL;
1704 #endif
1705         INIT_LIST_HEAD(&info->thread_list);
1706
1707         info->notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote),
1708                               GFP_KERNEL);
1709         if (!info->notes)
1710                 return 0;
1711         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1712         if (!info->psinfo)
1713                 return 0;
1714         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1715         if (!info->prstatus)
1716                 return 0;
1717         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1718         if (!info->fpu)
1719                 return 0;
1720 #ifdef ELF_CORE_COPY_XFPREGS
1721         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1722         if (!info->xfpu)
1723                 return 0;
1724 #endif
1725
1726         info->thread_status_size = 0;
1727         if (signr) {
1728                 struct elf_thread_status *tmp;
1729                 rcu_read_lock();
1730                 do_each_thread(g, p)
1731                         if (current->mm == p->mm && current != p) {
1732                                 tmp = kzalloc(sizeof(*tmp), GFP_ATOMIC);
1733                                 if (!tmp) {
1734                                         rcu_read_unlock();
1735                                         return 0;
1736                                 }
1737                                 tmp->thread = p;
1738                                 list_add(&tmp->list, &info->thread_list);
1739                         }
1740                 while_each_thread(g, p);
1741                 rcu_read_unlock();
1742                 list_for_each(t, &info->thread_list) {
1743                         struct elf_thread_status *tmp;
1744                         int sz;
1745
1746                         tmp = list_entry(t, struct elf_thread_status, list);
1747                         sz = elf_dump_thread_status(signr, tmp);
1748                         info->thread_status_size += sz;
1749                 }
1750         }
1751         /* now collect the dump for the current */
1752         memset(info->prstatus, 0, sizeof(*info->prstatus));
1753         fill_prstatus(info->prstatus, current, signr);
1754         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1755
1756         /* Set up header */
1757         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
1758
1759         /*
1760          * Set up the notes in similar form to SVR4 core dumps made
1761          * with info from their /proc.
1762          */
1763
1764         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1765                   sizeof(*info->prstatus), info->prstatus);
1766         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1767         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1768                   sizeof(*info->psinfo), info->psinfo);
1769
1770         info->numnote = 2;
1771
1772         fill_auxv_note(&info->notes[info->numnote++], current->mm);
1773
1774         /* Try to dump the FPU. */
1775         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1776                                                                info->fpu);
1777         if (info->prstatus->pr_fpvalid)
1778                 fill_note(info->notes + info->numnote++,
1779                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1780 #ifdef ELF_CORE_COPY_XFPREGS
1781         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1782                 fill_note(info->notes + info->numnote++,
1783                           "LINUX", ELF_CORE_XFPREG_TYPE,
1784                           sizeof(*info->xfpu), info->xfpu);
1785 #endif
1786
1787         return 1;
1788
1789 #undef NUM_NOTES
1790 }
1791
1792 static size_t get_note_info_size(struct elf_note_info *info)
1793 {
1794         int sz = 0;
1795         int i;
1796
1797         for (i = 0; i < info->numnote; i++)
1798                 sz += notesize(info->notes + i);
1799
1800         sz += info->thread_status_size;
1801
1802         return sz;
1803 }
1804
1805 static int write_note_info(struct elf_note_info *info,
1806                            struct file *file, loff_t *foffset)
1807 {
1808         int i;
1809         struct list_head *t;
1810
1811         for (i = 0; i < info->numnote; i++)
1812                 if (!writenote(info->notes + i, file, foffset))
1813                         return 0;
1814
1815         /* write out the thread status notes section */
1816         list_for_each(t, &info->thread_list) {
1817                 struct elf_thread_status *tmp =
1818                                 list_entry(t, struct elf_thread_status, list);
1819
1820                 for (i = 0; i < tmp->num_notes; i++)
1821                         if (!writenote(&tmp->notes[i], file, foffset))
1822                                 return 0;
1823         }
1824
1825         return 1;
1826 }
1827
1828 static void free_note_info(struct elf_note_info *info)
1829 {
1830         while (!list_empty(&info->thread_list)) {
1831                 struct list_head *tmp = info->thread_list.next;
1832                 list_del(tmp);
1833                 kfree(list_entry(tmp, struct elf_thread_status, list));
1834         }
1835
1836         kfree(info->prstatus);
1837         kfree(info->psinfo);
1838         kfree(info->notes);
1839         kfree(info->fpu);
1840 #ifdef ELF_CORE_COPY_XFPREGS
1841         kfree(info->xfpu);
1842 #endif
1843 }
1844
1845 #endif
1846
1847 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1848                                         struct vm_area_struct *gate_vma)
1849 {
1850         struct vm_area_struct *ret = tsk->mm->mmap;
1851
1852         if (ret)
1853                 return ret;
1854         return gate_vma;
1855 }
1856 /*
1857  * Helper function for iterating across a vma list.  It ensures that the caller
1858  * will visit `gate_vma' prior to terminating the search.
1859  */
1860 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1861                                         struct vm_area_struct *gate_vma)
1862 {
1863         struct vm_area_struct *ret;
1864
1865         ret = this_vma->vm_next;
1866         if (ret)
1867                 return ret;
1868         if (this_vma == gate_vma)
1869                 return NULL;
1870         return gate_vma;
1871 }
1872
1873 /*
1874  * Actual dumper
1875  *
1876  * This is a two-pass process; first we find the offsets of the bits,
1877  * and then they are actually written out.  If we run out of core limit
1878  * we just truncate.
1879  */
1880 static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
1881 {
1882         int has_dumped = 0;
1883         mm_segment_t fs;
1884         int segs;
1885         size_t size = 0;
1886         struct vm_area_struct *vma, *gate_vma;
1887         struct elfhdr *elf = NULL;
1888         loff_t offset = 0, dataoff, foffset;
1889         unsigned long mm_flags;
1890         struct elf_note_info info;
1891
1892         /*
1893          * We no longer stop all VM operations.
1894          *
1895          * This is because those proceses that could possibly change map_count
1896          * or the mmap / vma pages are now blocked in do_exit on current
1897          * finishing this core dump.
1898          *
1899          * Only ptrace can touch these memory addresses, but it doesn't change
1900          * the map_count or the pages allocated. So no possibility of crashing
1901          * exists while dumping the mm->vm_next areas to the core file.
1902          */
1903
1904         /* alloc memory for large data structures: too large to be on stack */
1905         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1906         if (!elf)
1907                 goto cleanup;
1908
1909         segs = current->mm->map_count;
1910 #ifdef ELF_CORE_EXTRA_PHDRS
1911         segs += ELF_CORE_EXTRA_PHDRS;
1912 #endif
1913
1914         gate_vma = get_gate_vma(current);
1915         if (gate_vma != NULL)
1916                 segs++;
1917
1918         /*
1919          * Collect all the non-memory information about the process for the
1920          * notes.  This also sets up the file header.
1921          */
1922         if (!fill_note_info(elf, segs + 1, /* including notes section */
1923                             &info, signr, regs))
1924                 goto cleanup;
1925
1926         has_dumped = 1;
1927         current->flags |= PF_DUMPCORE;
1928
1929         fs = get_fs();
1930         set_fs(KERNEL_DS);
1931
1932         DUMP_WRITE(elf, sizeof(*elf));
1933         offset += sizeof(*elf);                         /* Elf header */
1934         offset += (segs + 1) * sizeof(struct elf_phdr); /* Program headers */
1935         foffset = offset;
1936
1937         /* Write notes phdr entry */
1938         {
1939                 struct elf_phdr phdr;
1940                 size_t sz = get_note_info_size(&info);
1941
1942                 sz += elf_coredump_extra_notes_size();
1943
1944                 fill_elf_note_phdr(&phdr, sz, offset);
1945                 offset += sz;
1946                 DUMP_WRITE(&phdr, sizeof(phdr));
1947         }
1948
1949         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
1950
1951         /*
1952          * We must use the same mm->flags while dumping core to avoid
1953          * inconsistency between the program headers and bodies, otherwise an
1954          * unusable core file can be generated.
1955          */
1956         mm_flags = current->mm->flags;
1957
1958         /* Write program headers for segments dump */
1959         for (vma = first_vma(current, gate_vma); vma != NULL;
1960                         vma = next_vma(vma, gate_vma)) {
1961                 struct elf_phdr phdr;
1962
1963                 phdr.p_type = PT_LOAD;
1964                 phdr.p_offset = offset;
1965                 phdr.p_vaddr = vma->vm_start;
1966                 phdr.p_paddr = 0;
1967                 phdr.p_filesz = vma_dump_size(vma, mm_flags);
1968                 phdr.p_memsz = vma->vm_end - vma->vm_start;
1969                 offset += phdr.p_filesz;
1970                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
1971                 if (vma->vm_flags & VM_WRITE)
1972                         phdr.p_flags |= PF_W;
1973                 if (vma->vm_flags & VM_EXEC)
1974                         phdr.p_flags |= PF_X;
1975                 phdr.p_align = ELF_EXEC_PAGESIZE;
1976
1977                 DUMP_WRITE(&phdr, sizeof(phdr));
1978         }
1979
1980 #ifdef ELF_CORE_WRITE_EXTRA_PHDRS
1981         ELF_CORE_WRITE_EXTRA_PHDRS;
1982 #endif
1983
1984         /* write out the notes section */
1985         if (!write_note_info(&info, file, &foffset))
1986                 goto end_coredump;
1987
1988         if (elf_coredump_extra_notes_write(file, &foffset))
1989                 goto end_coredump;
1990
1991         /* Align to page */
1992         DUMP_SEEK(dataoff - foffset);
1993
1994         for (vma = first_vma(current, gate_vma); vma != NULL;
1995                         vma = next_vma(vma, gate_vma)) {
1996                 unsigned long addr;
1997                 unsigned long end;
1998
1999                 end = vma->vm_start + vma_dump_size(vma, mm_flags);
2000
2001                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2002                         struct page *page;
2003                         struct vm_area_struct *vma;
2004
2005                         if (get_user_pages(current, current->mm, addr, 1, 0, 1,
2006                                                 &page, &vma) <= 0) {
2007                                 DUMP_SEEK(PAGE_SIZE);
2008                         } else {
2009                                 if (page == ZERO_PAGE(0)) {
2010                                         if (!dump_seek(file, PAGE_SIZE)) {
2011                                                 page_cache_release(page);
2012                                                 goto end_coredump;
2013                                         }
2014                                 } else {
2015                                         void *kaddr;
2016                                         flush_cache_page(vma, addr,
2017                                                          page_to_pfn(page));
2018                                         kaddr = kmap(page);
2019                                         if ((size += PAGE_SIZE) > limit ||
2020                                             !dump_write(file, kaddr,
2021                                             PAGE_SIZE)) {
2022                                                 kunmap(page);
2023                                                 page_cache_release(page);
2024                                                 goto end_coredump;
2025                                         }
2026                                         kunmap(page);
2027                                 }
2028                                 page_cache_release(page);
2029                         }
2030                 }
2031         }
2032
2033 #ifdef ELF_CORE_WRITE_EXTRA_DATA
2034         ELF_CORE_WRITE_EXTRA_DATA;
2035 #endif
2036
2037 end_coredump:
2038         set_fs(fs);
2039
2040 cleanup:
2041         kfree(elf);
2042         free_note_info(&info);
2043         return has_dumped;
2044 }
2045
2046 #endif          /* USE_ELF_CORE_DUMP */
2047
2048 static int __init init_elf_binfmt(void)
2049 {
2050         return register_binfmt(&elf_format);
2051 }
2052
2053 static void __exit exit_elf_binfmt(void)
2054 {
2055         /* Remove the COFF and ELF loaders. */
2056         unregister_binfmt(&elf_format);
2057 }
2058
2059 core_initcall(init_elf_binfmt);
2060 module_exit(exit_elf_binfmt);
2061 MODULE_LICENSE("GPL");