fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/stat.h>
  16 #include <linux/time.h>
  17 #include <linux/mm.h>
  18 #include <linux/mman.h>
  19 #include <linux/a.out.h>
  20 #include <linux/errno.h>
  21 #include <linux/signal.h>
  22 #include <linux/binfmts.h>
  23 #include <linux/string.h>
  24 #include <linux/file.h>
  25 #include <linux/fcntl.h>
  26 #include <linux/ptrace.h>
  27 #include <linux/slab.h>
  28 #include <linux/shm.h>
  29 #include <linux/personality.h>
  30 #include <linux/elfcore.h>
  31 #include <linux/init.h>
  32 #include <linux/highuid.h>
  33 #include <linux/smp.h>
  34 #include <linux/compiler.h>
  35 #include <linux/highmem.h>
  36 #include <linux/pagemap.h>
  37 #include <linux/security.h>
  38 #include <linux/syscalls.h>
  39 #include <linux/random.h>
  40 #include <linux/elf.h>
  41 #include <linux/utsname.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/param.h>
  44 #include <asm/page.h>
  45
  46 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
  47 static int load_elf_library(struct file *);
  48 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  49                                 int, int, unsigned long);
  50
  51 /*
  52  * If we don't support core dumping, then supply a NULL so we
  53  * don't even try.
  54  */
  55 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
  56 static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
  57 #else
  58 #define elf_core_dump   NULL
  59 #endif
  60
  61 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  62 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  63 #else
  64 #define ELF_MIN_ALIGN   PAGE_SIZE
  65 #endif
  66
  67 #ifndef ELF_CORE_EFLAGS
  68 #define ELF_CORE_EFLAGS 0
  69 #endif
  70
  71 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  72 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  73 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  74
  75 static struct linux_binfmt elf_format = {
  76                 .module         = THIS_MODULE,
  77                 .load_binary    = load_elf_binary,
  78                 .load_shlib     = load_elf_library,
  79                 .core_dump      = elf_core_dump,
  80                 .min_coredump   = ELF_EXEC_PAGESIZE,
  81                 .hasvdso        = 1
  82 };
  83
  84 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  85
  86 static int set_brk(unsigned long start, unsigned long end)
  87 {
  88         start = ELF_PAGEALIGN(start);
  89         end = ELF_PAGEALIGN(end);
  90         if (end > start) {
  91                 unsigned long addr;
  92                 down_write(&current->mm->mmap_sem);
  93                 addr = do_brk(start, end - start);
  94                 up_write(&current->mm->mmap_sem);
  95                 if (BAD_ADDR(addr))
  96                         return addr;
  97         }
  98         current->mm->start_brk = current->mm->brk = end;
  99         return 0;
 100 }
 101
 102 /* We need to explicitly zero any fractional pages
 103    after the data section (i.e. bss).  This would
 104    contain the junk from the file that should not
 105    be in memory
 106  */
 107 static int padzero(unsigned long elf_bss)
 108 {
 109         unsigned long nbyte;
 110
 111         nbyte = ELF_PAGEOFFSET(elf_bss);
 112         if (nbyte) {
 113                 nbyte = ELF_MIN_ALIGN - nbyte;
 114                 if (clear_user((void __user *) elf_bss, nbyte))
 115                         return -EFAULT;
 116         }
 117         return 0;
 118 }
 119
 120 /* Let's use some macros to make this stack manipulation a little clearer */
 121 #ifdef CONFIG_STACK_GROWSUP
 122 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 123 #define STACK_ROUND(sp, items) \
 124         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 125 #define STACK_ALLOC(sp, len) ({ \
 126         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 127         old_sp; })
 128 #else
 129 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 130 #define STACK_ROUND(sp, items) \
 131         (((unsigned long) (sp - items)) &~ 15UL)
 132 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 133 #endif
 134
 135 static int
 136 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 137                 unsigned long load_addr, unsigned long interp_load_addr)
 138 {
 139         unsigned long p = bprm->p;
 140         int argc = bprm->argc;
 141         int envc = bprm->envc;
 142         elf_addr_t __user *argv;
 143         elf_addr_t __user *envp;
 144         elf_addr_t __user *sp;
 145         elf_addr_t __user *u_platform;
 146         const char *k_platform = ELF_PLATFORM;
 147         int items;
 148         elf_addr_t *elf_info;
 149         int ei_index = 0;
 150         struct task_struct *tsk = current;
 151         struct vm_area_struct *vma;
 152
 153         /*
 154          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 155          * evictions by the processes running on the same package. One
 156          * thing we can do is to shuffle the initial stack for them.
 157          */
 158
 159         p = arch_align_stack(p);
 160
 161         /*
 162          * If this architecture has a platform capability string, copy it
 163          * to userspace.  In some cases (Sparc), this info is impossible
 164          * for userspace to get any other way, in others (i386) it is
 165          * merely difficult.
 166          */
 167         u_platform = NULL;
 168         if (k_platform) {
 169                 size_t len = strlen(k_platform) + 1;
 170
 171                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 172                 if (__copy_to_user(u_platform, k_platform, len))
 173                         return -EFAULT;
 174         }
 175
 176         /* Create the ELF interpreter info */
 177         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 178         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 179 #define NEW_AUX_ENT(id, val) \
 180         do { \
 181                 elf_info[ei_index++] = id; \
 182                 elf_info[ei_index++] = val; \
 183         } while (0)
 184
 185 #ifdef ARCH_DLINFO
 186         /*
 187          * ARCH_DLINFO must come first so PPC can do its special alignment of
 188          * AUXV.
 189          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 190          * ARCH_DLINFO changes
 191          */
 192         ARCH_DLINFO;
 193 #endif
 194         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 195         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 196         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 197         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 198         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 199         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 200         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 201         NEW_AUX_ENT(AT_FLAGS, 0);
 202         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 203         NEW_AUX_ENT(AT_UID, tsk->uid);
 204         NEW_AUX_ENT(AT_EUID, tsk->euid);
 205         NEW_AUX_ENT(AT_GID, tsk->gid);
 206         NEW_AUX_ENT(AT_EGID, tsk->egid);
 207         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 208         if (k_platform) {
 209                 NEW_AUX_ENT(AT_PLATFORM,
 210                             (elf_addr_t)(unsigned long)u_platform);
 211         }
 212         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 213                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 214         }
 215 #undef NEW_AUX_ENT
 216         /* AT_NULL is zero; clear the rest too */
 217         memset(&elf_info[ei_index], 0,
 218                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 219
 220         /* And advance past the AT_NULL entry.  */
 221         ei_index += 2;
 222
 223         sp = STACK_ADD(p, ei_index);
 224
 225         items = (argc + 1) + (envc + 1) + 1;
 226         bprm->p = STACK_ROUND(sp, items);
 227
 228         /* Point sp at the lowest address on the stack */
 229 #ifdef CONFIG_STACK_GROWSUP
 230         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 231         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 232 #else
 233         sp = (elf_addr_t __user *)bprm->p;
 234 #endif
 235
 236
 237         /*
 238          * Grow the stack manually; some architectures have a limit on how
 239          * far ahead a user-space access may be in order to grow the stack.
 240          */
 241         vma = find_extend_vma(current->mm, bprm->p);
 242         if (!vma)
 243                 return -EFAULT;
 244
 245         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 246         if (__put_user(argc, sp++))
 247                 return -EFAULT;
 248         argv = sp;
 249         envp = argv + argc + 1;
 250
 251         /* Populate argv and envp */
 252         p = current->mm->arg_end = current->mm->arg_start;
 253         while (argc-- > 0) {
 254                 size_t len;
 255                 if (__put_user((elf_addr_t)p, argv++))
 256                         return -EFAULT;
 257                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 258                 if (!len || len > MAX_ARG_STRLEN)
 259                         return -EINVAL;
 260                 p += len;
 261         }
 262         if (__put_user(0, argv))
 263                 return -EFAULT;
 264         current->mm->arg_end = current->mm->env_start = p;
 265         while (envc-- > 0) {
 266                 size_t len;
 267                 if (__put_user((elf_addr_t)p, envp++))
 268                         return -EFAULT;
 269                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 270                 if (!len || len > MAX_ARG_STRLEN)
 271                         return -EINVAL;
 272                 p += len;
 273         }
 274         if (__put_user(0, envp))
 275                 return -EFAULT;
 276         current->mm->env_end = p;
 277
 278         /* Put the elf_info on the stack in the right place.  */
 279         sp = (elf_addr_t __user *)envp + 1;
 280         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 281                 return -EFAULT;
 282         return 0;
 283 }
 284
 285 #ifndef elf_map
 286
 287 static unsigned long elf_map(struct file *filep, unsigned long addr,
 288                 struct elf_phdr *eppnt, int prot, int type,
 289                 unsigned long total_size)
 290 {
 291         unsigned long map_addr;
 292         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 293         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 294         addr = ELF_PAGESTART(addr);
 295         size = ELF_PAGEALIGN(size);
 296
 297         /* mmap() will return -EINVAL if given a zero size, but a
 298          * segment with zero filesize is perfectly valid */
 299         if (!size)
 300                 return addr;
 301
 302         down_write(&current->mm->mmap_sem);
 303         /*
 304         * total_size is the size of the ELF (interpreter) image.
 305         * The _first_ mmap needs to know the full size, otherwise
 306         * randomization might put this image into an overlapping
 307         * position with the ELF binary image. (since size < total_size)
 308         * So we first map the 'big' image - and unmap the remainder at
 309         * the end. (which unmap is needed for ELF images with holes.)
 310         */
 311         if (total_size) {
 312                 total_size = ELF_PAGEALIGN(total_size);
 313                 map_addr = do_mmap(filep, addr, total_size, prot, type, off);
 314                 if (!BAD_ADDR(map_addr))
 315                         do_munmap(current->mm, map_addr+size, total_size-size);
 316         } else
 317                 map_addr = do_mmap(filep, addr, size, prot, type, off);
 318
 319         up_write(&current->mm->mmap_sem);
 320         return(map_addr);
 321 }
 322
 323 #endif /* !elf_map */
 324
 325 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 326 {
 327         int i, first_idx = -1, last_idx = -1;
 328
 329         for (i = 0; i < nr; i++) {
 330                 if (cmds[i].p_type == PT_LOAD) {
 331                         last_idx = i;
 332                         if (first_idx == -1)
 333                                 first_idx = i;
 334                 }
 335         }
 336         if (first_idx == -1)
 337                 return 0;
 338
 339         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 340                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 341 }
 342
 343
 344 /* This is much more generalized than the library routine read function,
 345    so we keep this separate.  Technically the library read function
 346    is only provided so that we can read a.out libraries that have
 347    an ELF header */
 348
 349 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 350                 struct file *interpreter, unsigned long *interp_map_addr,
 351                 unsigned long no_base)
 352 {
 353         struct elf_phdr *elf_phdata;
 354         struct elf_phdr *eppnt;
 355         unsigned long load_addr = 0;
 356         int load_addr_set = 0;
 357         unsigned long last_bss = 0, elf_bss = 0;
 358         unsigned long error = ~0UL;
 359         unsigned long total_size;
 360         int retval, i, size;
 361
 362         /* First of all, some simple consistency checks */
 363         if (interp_elf_ex->e_type != ET_EXEC &&
 364             interp_elf_ex->e_type != ET_DYN)
 365                 goto out;
 366         if (!elf_check_arch(interp_elf_ex))
 367                 goto out;
 368         if (!interpreter->f_op || !interpreter->f_op->mmap)
 369                 goto out;
 370
 371         /*
 372          * If the size of this structure has changed, then punt, since
 373          * we will be doing the wrong thing.
 374          */
 375         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 376                 goto out;
 377         if (interp_elf_ex->e_phnum < 1 ||
 378                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 379                 goto out;
 380
 381         /* Now read in all of the header information */
 382         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 383         if (size > ELF_MIN_ALIGN)
 384                 goto out;
 385         elf_phdata = kmalloc(size, GFP_KERNEL);
 386         if (!elf_phdata)
 387                 goto out;
 388
 389         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 390                              (char *)elf_phdata,size);
 391         error = -EIO;
 392         if (retval != size) {
 393                 if (retval < 0)
 394                         error = retval;
 395                 goto out_close;
 396         }
 397
 398         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 399         if (!total_size) {
 400                 error = -EINVAL;
 401                 goto out_close;
 402         }
 403
 404         eppnt = elf_phdata;
 405         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 406                 if (eppnt->p_type == PT_LOAD) {
 407                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 408                         int elf_prot = 0;
 409                         unsigned long vaddr = 0;
 410                         unsigned long k, map_addr;
 411
 412                         if (eppnt->p_flags & PF_R)
 413                                 elf_prot = PROT_READ;
 414                         if (eppnt->p_flags & PF_W)
 415                                 elf_prot |= PROT_WRITE;
 416                         if (eppnt->p_flags & PF_X)
 417                                 elf_prot |= PROT_EXEC;
 418                         vaddr = eppnt->p_vaddr;
 419                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 420                                 elf_type |= MAP_FIXED;
 421                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 422                                 load_addr = -vaddr;
 423
 424                         map_addr = elf_map(interpreter, load_addr + vaddr,
 425                                         eppnt, elf_prot, elf_type, total_size);
 426                         total_size = 0;
 427                         if (!*interp_map_addr)
 428                                 *interp_map_addr = map_addr;
 429                         error = map_addr;
 430                         if (BAD_ADDR(map_addr))
 431                                 goto out_close;
 432
 433                         if (!load_addr_set &&
 434                             interp_elf_ex->e_type == ET_DYN) {
 435                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 436                                 load_addr_set = 1;
 437                         }
 438
 439                         /*
 440                          * Check to see if the section's size will overflow the
 441                          * allowed task size. Note that p_filesz must always be
 442                          * <= p_memsize so it's only necessary to check p_memsz.
 443                          */
 444                         k = load_addr + eppnt->p_vaddr;
 445                         if (BAD_ADDR(k) ||
 446                             eppnt->p_filesz > eppnt->p_memsz ||
 447                             eppnt->p_memsz > TASK_SIZE ||
 448                             TASK_SIZE - eppnt->p_memsz < k) {
 449                                 error = -ENOMEM;
 450                                 goto out_close;
 451                         }
 452
 453                         /*
 454                          * Find the end of the file mapping for this phdr, and
 455                          * keep track of the largest address we see for this.
 456                          */
 457                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 458                         if (k > elf_bss)
 459                                 elf_bss = k;
 460
 461                         /*
 462                          * Do the same thing for the memory mapping - between
 463                          * elf_bss and last_bss is the bss section.
 464                          */
 465                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 466                         if (k > last_bss)
 467                                 last_bss = k;
 468                 }
 469         }
 470
 471         /*
 472          * Now fill out the bss section.  First pad the last page up
 473          * to the page boundary, and then perform a mmap to make sure
 474          * that there are zero-mapped pages up to and including the
 475          * last bss page.
 476          */
 477         if (padzero(elf_bss)) {
 478                 error = -EFAULT;
 479                 goto out_close;
 480         }
 481
 482         /* What we have mapped so far */
 483         elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 484
 485         /* Map the last of the bss segment */
 486         if (last_bss > elf_bss) {
 487                 down_write(&current->mm->mmap_sem);
 488                 error = do_brk(elf_bss, last_bss - elf_bss);
 489                 up_write(&current->mm->mmap_sem);
 490                 if (BAD_ADDR(error))
 491                         goto out_close;
 492         }
 493
 494         error = load_addr;
 495
 496 out_close:
 497         kfree(elf_phdata);
 498 out:
 499         return error;
 500 }
 501
 502 /*
 503  * These are the functions used to load ELF style executables and shared
 504  * libraries.  There is no binary dependent code anywhere else.
 505  */
 506
 507 #define INTERPRETER_NONE 0
 508 #define INTERPRETER_ELF 2
 509
 510 #ifndef STACK_RND_MASK
 511 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 512 #endif
 513
 514 static unsigned long randomize_stack_top(unsigned long stack_top)
 515 {
 516         unsigned int random_variable = 0;
 517
 518         if ((current->flags & PF_RANDOMIZE) &&
 519                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 520                 random_variable = get_random_int() & STACK_RND_MASK;
 521                 random_variable <<= PAGE_SHIFT;
 522         }
 523 #ifdef CONFIG_STACK_GROWSUP
 524         return PAGE_ALIGN(stack_top) + random_variable;
 525 #else
 526         return PAGE_ALIGN(stack_top) - random_variable;
 527 #endif
 528 }
 529
 530 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 531 {
 532         struct file *interpreter = NULL; /* to shut gcc up */
 533         unsigned long load_addr = 0, load_bias = 0;
 534         int load_addr_set = 0;
 535         char * elf_interpreter = NULL;
 536         unsigned long error;
 537         struct elf_phdr *elf_ppnt, *elf_phdata;
 538         unsigned long elf_bss, elf_brk;
 539         int elf_exec_fileno;
 540         int retval, i;
 541         unsigned int size;
 542         unsigned long elf_entry;
 543         unsigned long interp_load_addr = 0;
 544         unsigned long start_code, end_code, start_data, end_data;
 545         unsigned long reloc_func_desc = 0;
 546         int executable_stack = EXSTACK_DEFAULT;
 547         unsigned long def_flags = 0;
 548         struct {
 549                 struct elfhdr elf_ex;
 550                 struct elfhdr interp_elf_ex;
 551                 struct exec interp_ex;
 552         } *loc;
 553
 554         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 555         if (!loc) {
 556                 retval = -ENOMEM;
 557                 goto out_ret;
 558         }
 559
 560         /* Get the exec-header */
 561         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 562
 563         retval = -ENOEXEC;
 564         /* First of all, some simple consistency checks */
 565         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 566                 goto out;
 567
 568         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 569                 goto out;
 570         if (!elf_check_arch(&loc->elf_ex))
 571                 goto out;
 572         if (!bprm->file->f_op||!bprm->file->f_op->mmap)
 573                 goto out;
 574
 575         /* Now read in all of the header information */
 576         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 577                 goto out;
 578         if (loc->elf_ex.e_phnum < 1 ||
 579                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 580                 goto out;
 581         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 582         retval = -ENOMEM;
 583         elf_phdata = kmalloc(size, GFP_KERNEL);
 584         if (!elf_phdata)
 585                 goto out;
 586
 587         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 588                              (char *)elf_phdata, size);
 589         if (retval != size) {
 590                 if (retval >= 0)
 591                         retval = -EIO;
 592                 goto out_free_ph;
 593         }
 594
 595         retval = get_unused_fd();
 596         if (retval < 0)
 597                 goto out_free_ph;
 598         get_file(bprm->file);
 599         fd_install(elf_exec_fileno = retval, bprm->file);
 600
 601         elf_ppnt = elf_phdata;
 602         elf_bss = 0;
 603         elf_brk = 0;
 604
 605         start_code = ~0UL;
 606         end_code = 0;
 607         start_data = 0;
 608         end_data = 0;
 609
 610         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 611                 if (elf_ppnt->p_type == PT_INTERP) {
 612                         /* This is the program interpreter used for
 613                          * shared libraries - for now assume that this
 614                          * is an a.out format binary
 615                          */
 616                         retval = -ENOEXEC;
 617                         if (elf_ppnt->p_filesz > PATH_MAX ||
 618                             elf_ppnt->p_filesz < 2)
 619                                 goto out_free_file;
 620
 621                         retval = -ENOMEM;
 622                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 623                                                   GFP_KERNEL);
 624                         if (!elf_interpreter)
 625                                 goto out_free_file;
 626
 627                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 628                                              elf_interpreter,
 629                                              elf_ppnt->p_filesz);
 630                         if (retval != elf_ppnt->p_filesz) {
 631                                 if (retval >= 0)
 632                                         retval = -EIO;
 633                                 goto out_free_interp;
 634                         }
 635                         /* make sure path is NULL terminated */
 636                         retval = -ENOEXEC;
 637                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 638                                 goto out_free_interp;
 639
 640                         /*
 641                          * The early SET_PERSONALITY here is so that the lookup
 642                          * for the interpreter happens in the namespace of the
 643                          * to-be-execed image.  SET_PERSONALITY can select an
 644                          * alternate root.
 645                          *
 646                          * However, SET_PERSONALITY is NOT allowed to switch
 647                          * this task into the new images's memory mapping
 648                          * policy - that is, TASK_SIZE must still evaluate to
 649                          * that which is appropriate to the execing application.
 650                          * This is because exit_mmap() needs to have TASK_SIZE
 651                          * evaluate to the size of the old image.
 652                          *
 653                          * So if (say) a 64-bit application is execing a 32-bit
 654                          * application it is the architecture's responsibility
 655                          * to defer changing the value of TASK_SIZE until the
 656                          * switch really is going to happen - do this in
 657                          * flush_thread().      - akpm
 658                          */
 659                         SET_PERSONALITY(loc->elf_ex, 0);
 660
 661                         interpreter = open_exec(elf_interpreter);
 662                         retval = PTR_ERR(interpreter);
 663                         if (IS_ERR(interpreter))
 664                                 goto out_free_interp;
 665
 666                         /*
 667                          * If the binary is not readable then enforce
 668                          * mm->dumpable = 0 regardless of the interpreter's
 669                          * permissions.
 670                          */
 671                         if (file_permission(interpreter, MAY_READ) < 0)
 672                                 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
 673
 674                         retval = kernel_read(interpreter, 0, bprm->buf,
 675                                              BINPRM_BUF_SIZE);
 676                         if (retval != BINPRM_BUF_SIZE) {
 677                                 if (retval >= 0)
 678                                         retval = -EIO;
 679                                 goto out_free_dentry;
 680                         }
 681
 682                         /* Get the exec headers */
 683                         loc->interp_ex = *((struct exec *)bprm->buf);
 684                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 685                         break;
 686                 }
 687                 elf_ppnt++;
 688         }
 689
 690         elf_ppnt = elf_phdata;
 691         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 692                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 693                         if (elf_ppnt->p_flags & PF_X)
 694                                 executable_stack = EXSTACK_ENABLE_X;
 695                         else
 696                                 executable_stack = EXSTACK_DISABLE_X;
 697                         break;
 698                 }
 699
 700         /* Some simple consistency checks for the interpreter */
 701         if (elf_interpreter) {
 702                 retval = -ELIBBAD;
 703                 /* Not an ELF interpreter */
 704                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 705                         goto out_free_dentry;
 706                 /* Verify the interpreter has a valid arch */
 707                 if (!elf_check_arch(&loc->interp_elf_ex))
 708                         goto out_free_dentry;
 709         } else {
 710                 /* Executables without an interpreter also need a personality  */
 711                 SET_PERSONALITY(loc->elf_ex, 0);
 712         }
 713
 714         /* Flush all traces of the currently running executable */
 715         retval = flush_old_exec(bprm);
 716         if (retval)
 717                 goto out_free_dentry;
 718
 719         /* OK, This is the point of no return */
 720         current->flags &= ~PF_FORKNOEXEC;
 721         current->mm->def_flags = def_flags;
 722
 723         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 724            may depend on the personality.  */
 725         SET_PERSONALITY(loc->elf_ex, 0);
 726         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 727                 current->personality |= READ_IMPLIES_EXEC;
 728
 729         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 730                 current->flags |= PF_RANDOMIZE;
 731         arch_pick_mmap_layout(current->mm);
 732
 733         /* Do this so that we can load the interpreter, if need be.  We will
 734            change some of these later */
 735         current->mm->free_area_cache = current->mm->mmap_base;
 736         current->mm->cached_hole_size = 0;
 737         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 738                                  executable_stack);
 739         if (retval < 0) {
 740                 send_sig(SIGKILL, current, 0);
 741                 goto out_free_dentry;
 742         }
 743
 744         current->mm->start_stack = bprm->p;
 745
 746         /* Now we do a little grungy work by mmaping the ELF image into
 747            the correct location in memory. */
 748         for(i = 0, elf_ppnt = elf_phdata;
 749             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 750                 int elf_prot = 0, elf_flags;
 751                 unsigned long k, vaddr;
 752
 753                 if (elf_ppnt->p_type != PT_LOAD)
 754                         continue;
 755
 756                 if (unlikely (elf_brk > elf_bss)) {
 757                         unsigned long nbyte;
 758
 759                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 760                            before this one. Map anonymous pages, if needed,
 761                            and clear the area.  */
 762                         retval = set_brk (elf_bss + load_bias,
 763                                           elf_brk + load_bias);
 764                         if (retval) {
 765                                 send_sig(SIGKILL, current, 0);
 766                                 goto out_free_dentry;
 767                         }
 768                         nbyte = ELF_PAGEOFFSET(elf_bss);
 769                         if (nbyte) {
 770                                 nbyte = ELF_MIN_ALIGN - nbyte;
 771                                 if (nbyte > elf_brk - elf_bss)
 772                                         nbyte = elf_brk - elf_bss;
 773                                 if (clear_user((void __user *)elf_bss +
 774                                                         load_bias, nbyte)) {
 775                                         /*
 776                                          * This bss-zeroing can fail if the ELF
 777                                          * file specifies odd protections. So
 778                                          * we don't check the return value
 779                                          */
 780                                 }
 781                         }
 782                 }
 783
 784                 if (elf_ppnt->p_flags & PF_R)
 785                         elf_prot |= PROT_READ;
 786                 if (elf_ppnt->p_flags & PF_W)
 787                         elf_prot |= PROT_WRITE;
 788                 if (elf_ppnt->p_flags & PF_X)
 789                         elf_prot |= PROT_EXEC;
 790
 791                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 792
 793                 vaddr = elf_ppnt->p_vaddr;
 794                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 795                         elf_flags |= MAP_FIXED;
 796                 } else if (loc->elf_ex.e_type == ET_DYN) {
 797                         /* Try and get dynamic programs out of the way of the
 798                          * default mmap base, as well as whatever program they
 799                          * might try to exec.  This is because the brk will
 800                          * follow the loader, and is not movable.  */
 801 #ifdef CONFIG_X86
 802                         load_bias = 0;
 803 #else
 804                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 805 #endif
 806                 }
 807
 808                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 809                                 elf_prot, elf_flags, 0);
 810                 if (BAD_ADDR(error)) {
 811                         send_sig(SIGKILL, current, 0);
 812                         retval = IS_ERR((void *)error) ?
 813                                 PTR_ERR((void*)error) : -EINVAL;
 814                         goto out_free_dentry;
 815                 }
 816
 817                 if (!load_addr_set) {
 818                         load_addr_set = 1;
 819                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 820                         if (loc->elf_ex.e_type == ET_DYN) {
 821                                 load_bias += error -
 822                                              ELF_PAGESTART(load_bias + vaddr);
 823                                 load_addr += load_bias;
 824                                 reloc_func_desc = load_bias;
 825                         }
 826                 }
 827                 k = elf_ppnt->p_vaddr;
 828                 if (k < start_code)
 829                         start_code = k;
 830                 if (start_data < k)
 831                         start_data = k;
 832
 833                 /*
 834                  * Check to see if the section's size will overflow the
 835                  * allowed task size. Note that p_filesz must always be
 836                  * <= p_memsz so it is only necessary to check p_memsz.
 837                  */
 838                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 839                     elf_ppnt->p_memsz > TASK_SIZE ||
 840                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 841                         /* set_brk can never work. Avoid overflows. */
 842                         send_sig(SIGKILL, current, 0);
 843                         retval = -EINVAL;
 844                         goto out_free_dentry;
 845                 }
 846
 847                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 848
 849                 if (k > elf_bss)
 850                         elf_bss = k;
 851                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 852                         end_code = k;
 853                 if (end_data < k)
 854                         end_data = k;
 855                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 856                 if (k > elf_brk)
 857                         elf_brk = k;
 858         }
 859
 860         loc->elf_ex.e_entry += load_bias;
 861         elf_bss += load_bias;
 862         elf_brk += load_bias;
 863         start_code += load_bias;
 864         end_code += load_bias;
 865         start_data += load_bias;
 866         end_data += load_bias;
 867
 868         /* Calling set_brk effectively mmaps the pages that we need
 869          * for the bss and break sections.  We must do this before
 870          * mapping in the interpreter, to make sure it doesn't wind
 871          * up getting placed where the bss needs to go.
 872          */
 873         retval = set_brk(elf_bss, elf_brk);
 874         if (retval) {
 875                 send_sig(SIGKILL, current, 0);
 876                 goto out_free_dentry;
 877         }
 878         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 879                 send_sig(SIGSEGV, current, 0);
 880                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 881                 goto out_free_dentry;
 882         }
 883
 884         if (elf_interpreter) {
 885                 unsigned long uninitialized_var(interp_map_addr);
 886
 887                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 888                                             interpreter,
 889                                             &interp_map_addr,
 890                                             load_bias);
 891                 if (!IS_ERR((void *)elf_entry)) {
 892                         /*
 893                          * load_elf_interp() returns relocation
 894                          * adjustment
 895                          */
 896                         interp_load_addr = elf_entry;
 897                         elf_entry += loc->interp_elf_ex.e_entry;
 898                 }
 899                 if (BAD_ADDR(elf_entry)) {
 900                         force_sig(SIGSEGV, current);
 901                         retval = IS_ERR((void *)elf_entry) ?
 902                                         (int)elf_entry : -EINVAL;
 903                         goto out_free_dentry;
 904                 }
 905                 reloc_func_desc = interp_load_addr;
 906
 907                 allow_write_access(interpreter);
 908                 fput(interpreter);
 909                 kfree(elf_interpreter);
 910         } else {
 911                 elf_entry = loc->elf_ex.e_entry;
 912                 if (BAD_ADDR(elf_entry)) {
 913                         force_sig(SIGSEGV, current);
 914                         retval = -EINVAL;
 915                         goto out_free_dentry;
 916                 }
 917         }
 918
 919         kfree(elf_phdata);
 920
 921         sys_close(elf_exec_fileno);
 922
 923         set_binfmt(&elf_format);
 924
 925 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 926         retval = arch_setup_additional_pages(bprm, executable_stack);
 927         if (retval < 0) {
 928                 send_sig(SIGKILL, current, 0);
 929                 goto out;
 930         }
 931 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 932
 933         compute_creds(bprm);
 934         current->flags &= ~PF_FORKNOEXEC;
 935         retval = create_elf_tables(bprm, &loc->elf_ex,
 936                           load_addr, interp_load_addr);
 937         if (retval < 0) {
 938                 send_sig(SIGKILL, current, 0);
 939                 goto out;
 940         }
 941         /* N.B. passed_fileno might not be initialized? */
 942         current->mm->end_code = end_code;
 943         current->mm->start_code = start_code;
 944         current->mm->start_data = start_data;
 945         current->mm->end_data = end_data;
 946         current->mm->start_stack = bprm->p;
 947
 948 #ifdef arch_randomize_brk
 949         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1))
 950                 current->mm->brk = current->mm->start_brk =
 951                         arch_randomize_brk(current->mm);
 952 #endif
 953
 954         if (current->personality & MMAP_PAGE_ZERO) {
 955                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 956                    and some applications "depend" upon this behavior.
 957                    Since we do not have the power to recompile these, we
 958                    emulate the SVr4 behavior. Sigh. */
 959                 down_write(&current->mm->mmap_sem);
 960                 error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 961                                 MAP_FIXED | MAP_PRIVATE, 0);
 962                 up_write(&current->mm->mmap_sem);
 963         }
 964
 965 #ifdef ELF_PLAT_INIT
 966         /*
 967          * The ABI may specify that certain registers be set up in special
 968          * ways (on i386 %edx is the address of a DT_FINI function, for
 969          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 970          * that the e_entry field is the address of the function descriptor
 971          * for the startup routine, rather than the address of the startup
 972          * routine itself.  This macro performs whatever initialization to
 973          * the regs structure is required as well as any relocations to the
 974          * function descriptor entries when executing dynamically links apps.
 975          */
 976         ELF_PLAT_INIT(regs, reloc_func_desc);
 977 #endif
 978
 979         start_thread(regs, elf_entry, bprm->p);
 980         if (unlikely(current->ptrace & PT_PTRACED)) {
 981                 if (current->ptrace & PT_TRACE_EXEC)
 982                         ptrace_notify ((PTRACE_EVENT_EXEC << 8) | SIGTRAP);
 983                 else
 984                         send_sig(SIGTRAP, current, 0);
 985         }
 986         retval = 0;
 987 out:
 988         kfree(loc);
 989 out_ret:
 990         return retval;
 991
 992         /* error cleanup */
 993 out_free_dentry:
 994         allow_write_access(interpreter);
 995         if (interpreter)
 996                 fput(interpreter);
 997 out_free_interp:
 998         kfree(elf_interpreter);
 999 out_free_file:
1000         sys_close(elf_exec_fileno);
1001 out_free_ph:
1002         kfree(elf_phdata);
1003         goto out;
1004 }
1005
1006 /* This is really simpleminded and specialized - we are loading an
1007    a.out library that is given an ELF header. */
1008 static int load_elf_library(struct file *file)
1009 {
1010         struct elf_phdr *elf_phdata;
1011         struct elf_phdr *eppnt;
1012         unsigned long elf_bss, bss, len;
1013         int retval, error, i, j;
1014         struct elfhdr elf_ex;
1015
1016         error = -ENOEXEC;
1017         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1018         if (retval != sizeof(elf_ex))
1019                 goto out;
1020
1021         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1022                 goto out;
1023
1024         /* First of all, some simple consistency checks */
1025         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1026             !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1027                 goto out;
1028
1029         /* Now read in all of the header information */
1030
1031         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1032         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1033
1034         error = -ENOMEM;
1035         elf_phdata = kmalloc(j, GFP_KERNEL);
1036         if (!elf_phdata)
1037                 goto out;
1038
1039         eppnt = elf_phdata;
1040         error = -ENOEXEC;
1041         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1042         if (retval != j)
1043                 goto out_free_ph;
1044
1045         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1046                 if ((eppnt + i)->p_type == PT_LOAD)
1047                         j++;
1048         if (j != 1)
1049                 goto out_free_ph;
1050
1051         while (eppnt->p_type != PT_LOAD)
1052                 eppnt++;
1053
1054         /* Now use mmap to map the library into memory. */
1055         down_write(&current->mm->mmap_sem);
1056         error = do_mmap(file,
1057                         ELF_PAGESTART(eppnt->p_vaddr),
1058                         (eppnt->p_filesz +
1059                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1060                         PROT_READ | PROT_WRITE | PROT_EXEC,
1061                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1062                         (eppnt->p_offset -
1063                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1064         up_write(&current->mm->mmap_sem);
1065         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1066                 goto out_free_ph;
1067
1068         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1069         if (padzero(elf_bss)) {
1070                 error = -EFAULT;
1071                 goto out_free_ph;
1072         }
1073
1074         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1075                             ELF_MIN_ALIGN - 1);
1076         bss = eppnt->p_memsz + eppnt->p_vaddr;
1077         if (bss > len) {
1078                 down_write(&current->mm->mmap_sem);
1079                 do_brk(len, bss - len);
1080                 up_write(&current->mm->mmap_sem);
1081         }
1082         error = 0;
1083
1084 out_free_ph:
1085         kfree(elf_phdata);
1086 out:
1087         return error;
1088 }
1089
1090 /*
1091  * Note that some platforms still use traditional core dumps and not
1092  * the ELF core dump.  Each platform can select it as appropriate.
1093  */
1094 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
1095
1096 /*
1097  * ELF core dumper
1098  *
1099  * Modelled on fs/exec.c:aout_core_dump()
1100  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1101  */
1102 /*
1103  * These are the only things you should do on a core-file: use only these
1104  * functions to write out all the necessary info.
1105  */
1106 static int dump_write(struct file *file, const void *addr, int nr)
1107 {
1108         return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
1109 }
1110
1111 static int dump_seek(struct file *file, loff_t off)
1112 {
1113         if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
1114                 if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
1115                         return 0;
1116         } else {
1117                 char *buf = (char *)get_zeroed_page(GFP_KERNEL);
1118                 if (!buf)
1119                         return 0;
1120                 while (off > 0) {
1121                         unsigned long n = off;
1122                         if (n > PAGE_SIZE)
1123                                 n = PAGE_SIZE;
1124                         if (!dump_write(file, buf, n))
1125                                 return 0;
1126                         off -= n;
1127                 }
1128                 free_page((unsigned long)buf);
1129         }
1130         return 1;
1131 }
1132
1133 /*
1134  * Decide what to dump of a segment, part, all or none.
1135  */
1136 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1137                                    unsigned long mm_flags)
1138 {
1139         /* The vma can be set up to tell us the answer directly.  */
1140         if (vma->vm_flags & VM_ALWAYSDUMP)
1141                 goto whole;
1142
1143         /* Do not dump I/O mapped devices or special mappings */
1144         if (vma->vm_flags & (VM_IO | VM_RESERVED))
1145                 return 0;
1146
1147 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1148
1149         /* By default, dump shared memory if mapped from an anonymous file. */
1150         if (vma->vm_flags & VM_SHARED) {
1151                 if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
1152                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1153                         goto whole;
1154                 return 0;
1155         }
1156
1157         /* Dump segments that have been written to.  */
1158         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1159                 goto whole;
1160         if (vma->vm_file == NULL)
1161                 return 0;
1162
1163         if (FILTER(MAPPED_PRIVATE))
1164                 goto whole;
1165
1166         /*
1167          * If this looks like the beginning of a DSO or executable mapping,
1168          * check for an ELF header.  If we find one, dump the first page to
1169          * aid in determining what was mapped here.
1170          */
1171         if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
1172                 u32 __user *header = (u32 __user *) vma->vm_start;
1173                 u32 word;
1174                 /*
1175                  * Doing it this way gets the constant folded by GCC.
1176                  */
1177                 union {
1178                         u32 cmp;
1179                         char elfmag[SELFMAG];
1180                 } magic;
1181                 BUILD_BUG_ON(SELFMAG != sizeof word);
1182                 magic.elfmag[EI_MAG0] = ELFMAG0;
1183                 magic.elfmag[EI_MAG1] = ELFMAG1;
1184                 magic.elfmag[EI_MAG2] = ELFMAG2;
1185                 magic.elfmag[EI_MAG3] = ELFMAG3;
1186                 if (get_user(word, header) == 0 && word == magic.cmp)
1187                         return PAGE_SIZE;
1188         }
1189
1190 #undef  FILTER
1191
1192         return 0;
1193
1194 whole:
1195         return vma->vm_end - vma->vm_start;
1196 }
1197
1198 /* An ELF note in memory */
1199 struct memelfnote
1200 {
1201         const char *name;
1202         int type;
1203         unsigned int datasz;
1204         void *data;
1205 };
1206
1207 static int notesize(struct memelfnote *en)
1208 {
1209         int sz;
1210
1211         sz = sizeof(struct elf_note);
1212         sz += roundup(strlen(en->name) + 1, 4);
1213         sz += roundup(en->datasz, 4);
1214
1215         return sz;
1216 }
1217
1218 #define DUMP_WRITE(addr, nr, foffset)   \
1219         do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
1220
1221 static int alignfile(struct file *file, loff_t *foffset)
1222 {
1223         static const char buf[4] = { 0, };
1224         DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
1225         return 1;
1226 }
1227
1228 static int writenote(struct memelfnote *men, struct file *file,
1229                         loff_t *foffset)
1230 {
1231         struct elf_note en;
1232         en.n_namesz = strlen(men->name) + 1;
1233         en.n_descsz = men->datasz;
1234         en.n_type = men->type;
1235
1236         DUMP_WRITE(&en, sizeof(en), foffset);
1237         DUMP_WRITE(men->name, en.n_namesz, foffset);
1238         if (!alignfile(file, foffset))
1239                 return 0;
1240         DUMP_WRITE(men->data, men->datasz, foffset);
1241         if (!alignfile(file, foffset))
1242                 return 0;
1243
1244         return 1;
1245 }
1246 #undef DUMP_WRITE
1247
1248 #define DUMP_WRITE(addr, nr)    \
1249         if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
1250                 goto end_coredump;
1251 #define DUMP_SEEK(off)  \
1252         if (!dump_seek(file, (off))) \
1253                 goto end_coredump;
1254
1255 static void fill_elf_header(struct elfhdr *elf, int segs,
1256                             u16 machine, u32 flags, u8 osabi)
1257 {
1258         memset(elf, 0, sizeof(*elf));
1259
1260         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1261         elf->e_ident[EI_CLASS] = ELF_CLASS;
1262         elf->e_ident[EI_DATA] = ELF_DATA;
1263         elf->e_ident[EI_VERSION] = EV_CURRENT;
1264         elf->e_ident[EI_OSABI] = ELF_OSABI;
1265
1266         elf->e_type = ET_CORE;
1267         elf->e_machine = machine;
1268         elf->e_version = EV_CURRENT;
1269         elf->e_phoff = sizeof(struct elfhdr);
1270         elf->e_flags = flags;
1271         elf->e_ehsize = sizeof(struct elfhdr);
1272         elf->e_phentsize = sizeof(struct elf_phdr);
1273         elf->e_phnum = segs;
1274
1275         return;
1276 }
1277
1278 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1279 {
1280         phdr->p_type = PT_NOTE;
1281         phdr->p_offset = offset;
1282         phdr->p_vaddr = 0;
1283         phdr->p_paddr = 0;
1284         phdr->p_filesz = sz;
1285         phdr->p_memsz = 0;
1286         phdr->p_flags = 0;
1287         phdr->p_align = 0;
1288         return;
1289 }
1290
1291 static void fill_note(struct memelfnote *note, const char *name, int type,
1292                 unsigned int sz, void *data)
1293 {
1294         note->name = name;
1295         note->type = type;
1296         note->datasz = sz;
1297         note->data = data;
1298         return;
1299 }
1300
1301 /*
1302  * fill up all the fields in prstatus from the given task struct, except
1303  * registers which need to be filled up separately.
1304  */
1305 static void fill_prstatus(struct elf_prstatus *prstatus,
1306                 struct task_struct *p, long signr)
1307 {
1308         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1309         prstatus->pr_sigpend = p->pending.signal.sig[0];
1310         prstatus->pr_sighold = p->blocked.sig[0];
1311         prstatus->pr_pid = task_pid_vnr(p);
1312         prstatus->pr_ppid = task_pid_vnr(p->real_parent);
1313         prstatus->pr_pgrp = task_pgrp_vnr(p);
1314         prstatus->pr_sid = task_session_vnr(p);
1315         if (thread_group_leader(p)) {
1316                 /*
1317                  * This is the record for the group leader.  Add in the
1318                  * cumulative times of previous dead threads.  This total
1319                  * won't include the time of each live thread whose state
1320                  * is included in the core dump.  The final total reported
1321                  * to our parent process when it calls wait4 will include
1322                  * those sums as well as the little bit more time it takes
1323                  * this and each other thread to finish dying after the
1324                  * core dump synchronization phase.
1325                  */
1326                 cputime_to_timeval(cputime_add(p->utime, p->signal->utime),
1327                                    &prstatus->pr_utime);
1328                 cputime_to_timeval(cputime_add(p->stime, p->signal->stime),
1329                                    &prstatus->pr_stime);
1330         } else {
1331                 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1332                 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1333         }
1334         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1335         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1336 }
1337
1338 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1339                        struct mm_struct *mm)
1340 {
1341         unsigned int i, len;
1342
1343         /* first copy the parameters from user space */
1344         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1345
1346         len = mm->arg_end - mm->arg_start;
1347         if (len >= ELF_PRARGSZ)
1348                 len = ELF_PRARGSZ-1;
1349         if (copy_from_user(&psinfo->pr_psargs,
1350                            (const char __user *)mm->arg_start, len))
1351                 return -EFAULT;
1352         for(i = 0; i < len; i++)
1353                 if (psinfo->pr_psargs[i] == 0)
1354                         psinfo->pr_psargs[i] = ' ';
1355         psinfo->pr_psargs[len] = 0;
1356
1357         psinfo->pr_pid = task_pid_vnr(p);
1358         psinfo->pr_ppid = task_pid_vnr(p->real_parent);
1359         psinfo->pr_pgrp = task_pgrp_vnr(p);
1360         psinfo->pr_sid = task_session_vnr(p);
1361
1362         i = p->state ? ffz(~p->state) + 1 : 0;
1363         psinfo->pr_state = i;
1364         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1365         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1366         psinfo->pr_nice = task_nice(p);
1367         psinfo->pr_flag = p->flags;
1368         SET_UID(psinfo->pr_uid, p->uid);
1369         SET_GID(psinfo->pr_gid, p->gid);
1370         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1371
1372         return 0;
1373 }
1374
1375 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1376 {
1377         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1378         int i = 0;
1379         do
1380                 i += 2;
1381         while (auxv[i - 2] != AT_NULL);
1382         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1383 }
1384
1385 #ifdef CORE_DUMP_USE_REGSET
1386 #include <linux/regset.h>
1387
1388 struct elf_thread_core_info {
1389         struct elf_thread_core_info *next;
1390         struct task_struct *task;
1391         struct elf_prstatus prstatus;
1392         struct memelfnote notes[0];
1393 };
1394
1395 struct elf_note_info {
1396         struct elf_thread_core_info *thread;
1397         struct memelfnote psinfo;
1398         struct memelfnote auxv;
1399         size_t size;
1400         int thread_notes;
1401 };
1402
1403 /*
1404  * When a regset has a writeback hook, we call it on each thread before
1405  * dumping user memory.  On register window machines, this makes sure the
1406  * user memory backing the register data is up to date before we read it.
1407  */
1408 static void do_thread_regset_writeback(struct task_struct *task,
1409                                        const struct user_regset *regset)
1410 {
1411         if (regset->writeback)
1412                 regset->writeback(task, regset, 1);
1413 }
1414
1415 static int fill_thread_core_info(struct elf_thread_core_info *t,
1416                                  const struct user_regset_view *view,
1417                                  long signr, size_t *total)
1418 {
1419         unsigned int i;
1420
1421         /*
1422          * NT_PRSTATUS is the one special case, because the regset data
1423          * goes into the pr_reg field inside the note contents, rather
1424          * than being the whole note contents.  We fill the reset in here.
1425          * We assume that regset 0 is NT_PRSTATUS.
1426          */
1427         fill_prstatus(&t->prstatus, t->task, signr);
1428         (void) view->regsets[0].get(t->task, &view->regsets[0],
1429                                     0, sizeof(t->prstatus.pr_reg),
1430                                     &t->prstatus.pr_reg, NULL);
1431
1432         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1433                   sizeof(t->prstatus), &t->prstatus);
1434         *total += notesize(&t->notes[0]);
1435
1436         do_thread_regset_writeback(t->task, &view->regsets[0]);
1437
1438         /*
1439          * Each other regset might generate a note too.  For each regset
1440          * that has no core_note_type or is inactive, we leave t->notes[i]
1441          * all zero and we'll know to skip writing it later.
1442          */
1443         for (i = 1; i < view->n; ++i) {
1444                 const struct user_regset *regset = &view->regsets[i];
1445                 do_thread_regset_writeback(t->task, regset);
1446                 if (regset->core_note_type &&
1447                     (!regset->active || regset->active(t->task, regset))) {
1448                         int ret;
1449                         size_t size = regset->n * regset->size;
1450                         void *data = kmalloc(size, GFP_KERNEL);
1451                         if (unlikely(!data))
1452                                 return 0;
1453                         ret = regset->get(t->task, regset,
1454                                           0, size, data, NULL);
1455                         if (unlikely(ret))
1456                                 kfree(data);
1457                         else {
1458                                 if (regset->core_note_type != NT_PRFPREG)
1459                                         fill_note(&t->notes[i], "LINUX",
1460                                                   regset->core_note_type,
1461                                                   size, data);
1462                                 else {
1463                                         t->prstatus.pr_fpvalid = 1;
1464                                         fill_note(&t->notes[i], "CORE",
1465                                                   NT_PRFPREG, size, data);
1466                                 }
1467                                 *total += notesize(&t->notes[i]);
1468                         }
1469                 }
1470         }
1471
1472         return 1;
1473 }
1474
1475 static int fill_note_info(struct elfhdr *elf, int phdrs,
1476                           struct elf_note_info *info,
1477                           long signr, struct pt_regs *regs)
1478 {
1479         struct task_struct *dump_task = current;
1480         const struct user_regset_view *view = task_user_regset_view(dump_task);
1481         struct elf_thread_core_info *t;
1482         struct elf_prpsinfo *psinfo;
1483         struct task_struct *g, *p;
1484         unsigned int i;
1485
1486         info->size = 0;
1487         info->thread = NULL;
1488
1489         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1490         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1491
1492         if (psinfo == NULL)
1493                 return 0;
1494
1495         /*
1496          * Figure out how many notes we're going to need for each thread.
1497          */
1498         info->thread_notes = 0;
1499         for (i = 0; i < view->n; ++i)
1500                 if (view->regsets[i].core_note_type != 0)
1501                         ++info->thread_notes;
1502
1503         /*
1504          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1505          * since it is our one special case.
1506          */
1507         if (unlikely(info->thread_notes == 0) ||
1508             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1509                 WARN_ON(1);
1510                 return 0;
1511         }
1512
1513         /*
1514          * Initialize the ELF file header.
1515          */
1516         fill_elf_header(elf, phdrs,
1517                         view->e_machine, view->e_flags, view->ei_osabi);
1518
1519         /*
1520          * Allocate a structure for each thread.
1521          */
1522         rcu_read_lock();
1523         do_each_thread(g, p)
1524                 if (p->mm == dump_task->mm) {
1525                         t = kzalloc(offsetof(struct elf_thread_core_info,
1526                                              notes[info->thread_notes]),
1527                                     GFP_ATOMIC);
1528                         if (unlikely(!t)) {
1529                                 rcu_read_unlock();
1530                                 return 0;
1531                         }
1532                         t->task = p;
1533                         if (p == dump_task || !info->thread) {
1534                                 t->next = info->thread;
1535                                 info->thread = t;
1536                         } else {
1537                                 /*
1538                                  * Make sure to keep the original task at
1539                                  * the head of the list.
1540                                  */
1541                                 t->next = info->thread->next;
1542                                 info->thread->next = t;
1543                         }
1544                 }
1545         while_each_thread(g, p);
1546         rcu_read_unlock();
1547
1548         /*
1549          * Now fill in each thread's information.
1550          */
1551         for (t = info->thread; t != NULL; t = t->next)
1552                 if (!fill_thread_core_info(t, view, signr, &info->size))
1553                         return 0;
1554
1555         /*
1556          * Fill in the two process-wide notes.
1557          */
1558         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1559         info->size += notesize(&info->psinfo);
1560
1561         fill_auxv_note(&info->auxv, current->mm);
1562         info->size += notesize(&info->auxv);
1563
1564         return 1;
1565 }
1566
1567 static size_t get_note_info_size(struct elf_note_info *info)
1568 {
1569         return info->size;
1570 }
1571
1572 /*
1573  * Write all the notes for each thread.  When writing the first thread, the
1574  * process-wide notes are interleaved after the first thread-specific note.
1575  */
1576 static int write_note_info(struct elf_note_info *info,
1577                            struct file *file, loff_t *foffset)
1578 {
1579         bool first = 1;
1580         struct elf_thread_core_info *t = info->thread;
1581
1582         do {
1583                 int i;
1584
1585                 if (!writenote(&t->notes[0], file, foffset))
1586                         return 0;
1587
1588                 if (first && !writenote(&info->psinfo, file, foffset))
1589                         return 0;
1590                 if (first && !writenote(&info->auxv, file, foffset))
1591                         return 0;
1592
1593                 for (i = 1; i < info->thread_notes; ++i)
1594                         if (t->notes[i].data &&
1595                             !writenote(&t->notes[i], file, foffset))
1596                                 return 0;
1597
1598                 first = 0;
1599                 t = t->next;
1600         } while (t);
1601
1602         return 1;
1603 }
1604
1605 static void free_note_info(struct elf_note_info *info)
1606 {
1607         struct elf_thread_core_info *threads = info->thread;
1608         while (threads) {
1609                 unsigned int i;
1610                 struct elf_thread_core_info *t = threads;
1611                 threads = t->next;
1612                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1613                 for (i = 1; i < info->thread_notes; ++i)
1614                         kfree(t->notes[i].data);
1615                 kfree(t);
1616         }
1617         kfree(info->psinfo.data);
1618 }
1619
1620 #else
1621
1622 /* Here is the structure in which status of each thread is captured. */
1623 struct elf_thread_status
1624 {
1625         struct list_head list;
1626         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1627         elf_fpregset_t fpu;             /* NT_PRFPREG */
1628         struct task_struct *thread;
1629 #ifdef ELF_CORE_COPY_XFPREGS
1630         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1631 #endif
1632         struct memelfnote notes[3];
1633         int num_notes;
1634 };
1635
1636 /*
1637  * In order to add the specific thread information for the elf file format,
1638  * we need to keep a linked list of every threads pr_status and then create
1639  * a single section for them in the final core file.
1640  */
1641 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1642 {
1643         int sz = 0;
1644         struct task_struct *p = t->thread;
1645         t->num_notes = 0;
1646
1647         fill_prstatus(&t->prstatus, p, signr);
1648         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1649
1650         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1651                   &(t->prstatus));
1652         t->num_notes++;
1653         sz += notesize(&t->notes[0]);
1654
1655         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1656                                                                 &t->fpu))) {
1657                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1658                           &(t->fpu));
1659                 t->num_notes++;
1660                 sz += notesize(&t->notes[1]);
1661         }
1662
1663 #ifdef ELF_CORE_COPY_XFPREGS
1664         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1665                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1666                           sizeof(t->xfpu), &t->xfpu);
1667                 t->num_notes++;
1668                 sz += notesize(&t->notes[2]);
1669         }
1670 #endif
1671         return sz;
1672 }
1673
1674 struct elf_note_info {
1675         struct memelfnote *notes;
1676         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1677         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1678         struct list_head thread_list;
1679         elf_fpregset_t *fpu;
1680 #ifdef ELF_CORE_COPY_XFPREGS
1681         elf_fpxregset_t *xfpu;
1682 #endif
1683         int thread_status_size;
1684         int numnote;
1685 };
1686
1687 static int fill_note_info(struct elfhdr *elf, int phdrs,
1688                           struct elf_note_info *info,
1689                           long signr, struct pt_regs *regs)
1690 {
1691 #define NUM_NOTES       6
1692         struct list_head *t;
1693         struct task_struct *g, *p;
1694
1695         info->notes = NULL;
1696         info->prstatus = NULL;
1697         info->psinfo = NULL;
1698         info->fpu = NULL;
1699 #ifdef ELF_CORE_COPY_XFPREGS
1700         info->xfpu = NULL;
1701 #endif
1702         INIT_LIST_HEAD(&info->thread_list);
1703
1704         info->notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote),
1705                               GFP_KERNEL);
1706         if (!info->notes)
1707                 return 0;
1708         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1709         if (!info->psinfo)
1710                 return 0;
1711         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1712         if (!info->prstatus)
1713                 return 0;
1714         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1715         if (!info->fpu)
1716                 return 0;
1717 #ifdef ELF_CORE_COPY_XFPREGS
1718         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1719         if (!info->xfpu)
1720                 return 0;
1721 #endif
1722
1723         info->thread_status_size = 0;
1724         if (signr) {
1725                 struct elf_thread_status *ets;
1726                 rcu_read_lock();
1727                 do_each_thread(g, p)
1728                         if (current->mm == p->mm && current != p) {
1729                                 ets = kzalloc(sizeof(*ets), GFP_ATOMIC);
1730                                 if (!ets) {
1731                                         rcu_read_unlock();
1732                                         return 0;
1733                                 }
1734                                 ets->thread = p;
1735                                 list_add(&ets->list, &info->thread_list);
1736                         }
1737                 while_each_thread(g, p);
1738                 rcu_read_unlock();
1739                 list_for_each(t, &info->thread_list) {
1740                         int sz;
1741
1742                         ets = list_entry(t, struct elf_thread_status, list);
1743                         sz = elf_dump_thread_status(signr, ets);
1744                         info->thread_status_size += sz;
1745                 }
1746         }
1747         /* now collect the dump for the current */
1748         memset(info->prstatus, 0, sizeof(*info->prstatus));
1749         fill_prstatus(info->prstatus, current, signr);
1750         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1751
1752         /* Set up header */
1753         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
1754
1755         /*
1756          * Set up the notes in similar form to SVR4 core dumps made
1757          * with info from their /proc.
1758          */
1759
1760         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1761                   sizeof(*info->prstatus), info->prstatus);
1762         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1763         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1764                   sizeof(*info->psinfo), info->psinfo);
1765
1766         info->numnote = 2;
1767
1768         fill_auxv_note(&info->notes[info->numnote++], current->mm);
1769
1770         /* Try to dump the FPU. */
1771         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1772                                                                info->fpu);
1773         if (info->prstatus->pr_fpvalid)
1774                 fill_note(info->notes + info->numnote++,
1775                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1776 #ifdef ELF_CORE_COPY_XFPREGS
1777         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1778                 fill_note(info->notes + info->numnote++,
1779                           "LINUX", ELF_CORE_XFPREG_TYPE,
1780                           sizeof(*info->xfpu), info->xfpu);
1781 #endif
1782
1783         return 1;
1784
1785 #undef NUM_NOTES
1786 }
1787
1788 static size_t get_note_info_size(struct elf_note_info *info)
1789 {
1790         int sz = 0;
1791         int i;
1792
1793         for (i = 0; i < info->numnote; i++)
1794                 sz += notesize(info->notes + i);
1795
1796         sz += info->thread_status_size;
1797
1798         return sz;
1799 }
1800
1801 static int write_note_info(struct elf_note_info *info,
1802                            struct file *file, loff_t *foffset)
1803 {
1804         int i;
1805         struct list_head *t;
1806
1807         for (i = 0; i < info->numnote; i++)
1808                 if (!writenote(info->notes + i, file, foffset))
1809                         return 0;
1810
1811         /* write out the thread status notes section */
1812         list_for_each(t, &info->thread_list) {
1813                 struct elf_thread_status *tmp =
1814                                 list_entry(t, struct elf_thread_status, list);
1815
1816                 for (i = 0; i < tmp->num_notes; i++)
1817                         if (!writenote(&tmp->notes[i], file, foffset))
1818                                 return 0;
1819         }
1820
1821         return 1;
1822 }
1823
1824 static void free_note_info(struct elf_note_info *info)
1825 {
1826         while (!list_empty(&info->thread_list)) {
1827                 struct list_head *tmp = info->thread_list.next;
1828                 list_del(tmp);
1829                 kfree(list_entry(tmp, struct elf_thread_status, list));
1830         }
1831
1832         kfree(info->prstatus);
1833         kfree(info->psinfo);
1834         kfree(info->notes);
1835         kfree(info->fpu);
1836 #ifdef ELF_CORE_COPY_XFPREGS
1837         kfree(info->xfpu);
1838 #endif
1839 }
1840
1841 #endif
1842
1843 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1844                                         struct vm_area_struct *gate_vma)
1845 {
1846         struct vm_area_struct *ret = tsk->mm->mmap;
1847
1848         if (ret)
1849                 return ret;
1850         return gate_vma;
1851 }
1852 /*
1853  * Helper function for iterating across a vma list.  It ensures that the caller
1854  * will visit `gate_vma' prior to terminating the search.
1855  */
1856 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1857                                         struct vm_area_struct *gate_vma)
1858 {
1859         struct vm_area_struct *ret;
1860
1861         ret = this_vma->vm_next;
1862         if (ret)
1863                 return ret;
1864         if (this_vma == gate_vma)
1865                 return NULL;
1866         return gate_vma;
1867 }
1868
1869 /*
1870  * Actual dumper
1871  *
1872  * This is a two-pass process; first we find the offsets of the bits,
1873  * and then they are actually written out.  If we run out of core limit
1874  * we just truncate.
1875  */
1876 static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
1877 {
1878         int has_dumped = 0;
1879         mm_segment_t fs;
1880         int segs;
1881         size_t size = 0;
1882         struct vm_area_struct *vma, *gate_vma;
1883         struct elfhdr *elf = NULL;
1884         loff_t offset = 0, dataoff, foffset;
1885         unsigned long mm_flags;
1886         struct elf_note_info info;
1887
1888         /*
1889          * We no longer stop all VM operations.
1890          *
1891          * This is because those proceses that could possibly change map_count
1892          * or the mmap / vma pages are now blocked in do_exit on current
1893          * finishing this core dump.
1894          *
1895          * Only ptrace can touch these memory addresses, but it doesn't change
1896          * the map_count or the pages allocated. So no possibility of crashing
1897          * exists while dumping the mm->vm_next areas to the core file.
1898          */
1899
1900         /* alloc memory for large data structures: too large to be on stack */
1901         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1902         if (!elf)
1903                 goto out;
1904
1905         segs = current->mm->map_count;
1906 #ifdef ELF_CORE_EXTRA_PHDRS
1907         segs += ELF_CORE_EXTRA_PHDRS;
1908 #endif
1909
1910         gate_vma = get_gate_vma(current);
1911         if (gate_vma != NULL)
1912                 segs++;
1913
1914         /*
1915          * Collect all the non-memory information about the process for the
1916          * notes.  This also sets up the file header.
1917          */
1918         if (!fill_note_info(elf, segs + 1, /* including notes section */
1919                             &info, signr, regs))
1920                 goto cleanup;
1921
1922         has_dumped = 1;
1923         current->flags |= PF_DUMPCORE;
1924
1925         fs = get_fs();
1926         set_fs(KERNEL_DS);
1927
1928         DUMP_WRITE(elf, sizeof(*elf));
1929         offset += sizeof(*elf);                         /* Elf header */
1930         offset += (segs + 1) * sizeof(struct elf_phdr); /* Program headers */
1931         foffset = offset;
1932
1933         /* Write notes phdr entry */
1934         {
1935                 struct elf_phdr phdr;
1936                 size_t sz = get_note_info_size(&info);
1937
1938                 sz += elf_coredump_extra_notes_size();
1939
1940                 fill_elf_note_phdr(&phdr, sz, offset);
1941                 offset += sz;
1942                 DUMP_WRITE(&phdr, sizeof(phdr));
1943         }
1944
1945         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
1946
1947         /*
1948          * We must use the same mm->flags while dumping core to avoid
1949          * inconsistency between the program headers and bodies, otherwise an
1950          * unusable core file can be generated.
1951          */
1952         mm_flags = current->mm->flags;
1953
1954         /* Write program headers for segments dump */
1955         for (vma = first_vma(current, gate_vma); vma != NULL;
1956                         vma = next_vma(vma, gate_vma)) {
1957                 struct elf_phdr phdr;
1958
1959                 phdr.p_type = PT_LOAD;
1960                 phdr.p_offset = offset;
1961                 phdr.p_vaddr = vma->vm_start;
1962                 phdr.p_paddr = 0;
1963                 phdr.p_filesz = vma_dump_size(vma, mm_flags);
1964                 phdr.p_memsz = vma->vm_end - vma->vm_start;
1965                 offset += phdr.p_filesz;
1966                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
1967                 if (vma->vm_flags & VM_WRITE)
1968                         phdr.p_flags |= PF_W;
1969                 if (vma->vm_flags & VM_EXEC)
1970                         phdr.p_flags |= PF_X;
1971                 phdr.p_align = ELF_EXEC_PAGESIZE;
1972
1973                 DUMP_WRITE(&phdr, sizeof(phdr));
1974         }
1975
1976 #ifdef ELF_CORE_WRITE_EXTRA_PHDRS
1977         ELF_CORE_WRITE_EXTRA_PHDRS;
1978 #endif
1979
1980         /* write out the notes section */
1981         if (!write_note_info(&info, file, &foffset))
1982                 goto end_coredump;
1983
1984         if (elf_coredump_extra_notes_write(file, &foffset))
1985                 goto end_coredump;
1986
1987         /* Align to page */
1988         DUMP_SEEK(dataoff - foffset);
1989
1990         for (vma = first_vma(current, gate_vma); vma != NULL;
1991                         vma = next_vma(vma, gate_vma)) {
1992                 unsigned long addr;
1993                 unsigned long end;
1994
1995                 end = vma->vm_start + vma_dump_size(vma, mm_flags);
1996
1997                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
1998                         struct page *page;
1999                         struct vm_area_struct *tmp_vma;
2000
2001                         if (get_user_pages(current, current->mm, addr, 1, 0, 1,
2002                                                 &page, &tmp_vma) <= 0) {
2003                                 DUMP_SEEK(PAGE_SIZE);
2004                         } else {
2005                                 if (page == ZERO_PAGE(0)) {
2006                                         if (!dump_seek(file, PAGE_SIZE)) {
2007                                                 page_cache_release(page);
2008                                                 goto end_coredump;
2009                                         }
2010                                 } else {
2011                                         void *kaddr;
2012                                         flush_cache_page(tmp_vma, addr,
2013                                                          page_to_pfn(page));
2014                                         kaddr = kmap(page);
2015                                         if ((size += PAGE_SIZE) > limit ||
2016                                             !dump_write(file, kaddr,
2017                                             PAGE_SIZE)) {
2018                                                 kunmap(page);
2019                                                 page_cache_release(page);
2020                                                 goto end_coredump;
2021                                         }
2022                                         kunmap(page);
2023                                 }
2024                                 page_cache_release(page);
2025                         }
2026                 }
2027         }
2028
2029 #ifdef ELF_CORE_WRITE_EXTRA_DATA
2030         ELF_CORE_WRITE_EXTRA_DATA;
2031 #endif
2032
2033 end_coredump:
2034         set_fs(fs);
2035
2036 cleanup:
2037         free_note_info(&info);
2038         kfree(elf);
2039 out:
2040         return has_dumped;
2041 }
2042
2043 #endif          /* USE_ELF_CORE_DUMP */
2044
2045 static int __init init_elf_binfmt(void)
2046 {
2047         return register_binfmt(&elf_format);
2048 }
2049
2050 static void __exit exit_elf_binfmt(void)
2051 {
2052         /* Remove the COFF and ELF loaders. */
2053         unregister_binfmt(&elf_format);
2054 }
2055
2056 core_initcall(init_elf_binfmt);
2057 module_exit(exit_elf_binfmt);
2058 MODULE_LICENSE("GPL");