fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/mm.h>
  16 #include <linux/mman.h>
  17 #include <linux/errno.h>
  18 #include <linux/signal.h>
  19 #include <linux/binfmts.h>
  20 #include <linux/string.h>
  21 #include <linux/file.h>
  22 #include <linux/slab.h>
  23 #include <linux/personality.h>
  24 #include <linux/elfcore.h>
  25 #include <linux/init.h>
  26 #include <linux/highuid.h>
  27 #include <linux/compiler.h>
  28 #include <linux/highmem.h>
  29 #include <linux/pagemap.h>
  30 #include <linux/security.h>
  31 #include <linux/random.h>
  32 #include <linux/elf.h>
  33 #include <linux/utsname.h>
  34 #include <linux/coredump.h>
  35 #include <asm/uaccess.h>
  36 #include <asm/param.h>
  37 #include <asm/page.h>
  38 #include <asm/exec.h>
  39
  40 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
  41 static int load_elf_library(struct file *);
  42 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  43                                 int, int, unsigned long);
  44
  45 /*
  46  * If we don't support core dumping, then supply a NULL so we
  47  * don't even try.
  48  */
  49 #ifdef CONFIG_ELF_CORE
  50 static int elf_core_dump(struct coredump_params *cprm);
  51 #else
  52 #define elf_core_dump   NULL
  53 #endif
  54
  55 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  56 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  57 #else
  58 #define ELF_MIN_ALIGN   PAGE_SIZE
  59 #endif
  60
  61 #ifndef ELF_CORE_EFLAGS
  62 #define ELF_CORE_EFLAGS 0
  63 #endif
  64
  65 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  66 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  67 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  68
  69 static struct linux_binfmt elf_format = {
  70         .module         = THIS_MODULE,
  71         .load_binary    = load_elf_binary,
  72         .load_shlib     = load_elf_library,
  73         .core_dump      = elf_core_dump,
  74         .min_coredump   = ELF_EXEC_PAGESIZE,
  75 };
  76
  77 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  78
  79 static int set_brk(unsigned long start, unsigned long end)
  80 {
  81         start = ELF_PAGEALIGN(start);
  82         end = ELF_PAGEALIGN(end);
  83         if (end > start) {
  84                 unsigned long addr;
  85                 down_write(&current->mm->mmap_sem);
  86                 addr = do_brk(start, end - start);
  87                 up_write(&current->mm->mmap_sem);
  88                 if (BAD_ADDR(addr))
  89                         return addr;
  90         }
  91         current->mm->start_brk = current->mm->brk = end;
  92         return 0;
  93 }
  94
  95 /* We need to explicitly zero any fractional pages
  96    after the data section (i.e. bss).  This would
  97    contain the junk from the file that should not
  98    be in memory
  99  */
 100 static int padzero(unsigned long elf_bss)
 101 {
 102         unsigned long nbyte;
 103
 104         nbyte = ELF_PAGEOFFSET(elf_bss);
 105         if (nbyte) {
 106                 nbyte = ELF_MIN_ALIGN - nbyte;
 107                 if (clear_user((void __user *) elf_bss, nbyte))
 108                         return -EFAULT;
 109         }
 110         return 0;
 111 }
 112
 113 /* Let's use some macros to make this stack manipulation a little clearer */
 114 #ifdef CONFIG_STACK_GROWSUP
 115 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 116 #define STACK_ROUND(sp, items) \
 117         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 118 #define STACK_ALLOC(sp, len) ({ \
 119         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 120         old_sp; })
 121 #else
 122 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 123 #define STACK_ROUND(sp, items) \
 124         (((unsigned long) (sp - items)) &~ 15UL)
 125 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 126 #endif
 127
 128 #ifndef ELF_BASE_PLATFORM
 129 /*
 130  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 131  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 132  * will be copied to the user stack in the same manner as AT_PLATFORM.
 133  */
 134 #define ELF_BASE_PLATFORM NULL
 135 #endif
 136
 137 static int
 138 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 139                 unsigned long load_addr, unsigned long interp_load_addr)
 140 {
 141         unsigned long p = bprm->p;
 142         int argc = bprm->argc;
 143         int envc = bprm->envc;
 144         elf_addr_t __user *argv;
 145         elf_addr_t __user *envp;
 146         elf_addr_t __user *sp;
 147         elf_addr_t __user *u_platform;
 148         elf_addr_t __user *u_base_platform;
 149         elf_addr_t __user *u_rand_bytes;
 150         const char *k_platform = ELF_PLATFORM;
 151         const char *k_base_platform = ELF_BASE_PLATFORM;
 152         unsigned char k_rand_bytes[16];
 153         int items;
 154         elf_addr_t *elf_info;
 155         int ei_index = 0;
 156         const struct cred *cred = current_cred();
 157         struct vm_area_struct *vma;
 158
 159         /*
 160          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 161          * evictions by the processes running on the same package. One
 162          * thing we can do is to shuffle the initial stack for them.
 163          */
 164
 165         p = arch_align_stack(p);
 166
 167         /*
 168          * If this architecture has a platform capability string, copy it
 169          * to userspace.  In some cases (Sparc), this info is impossible
 170          * for userspace to get any other way, in others (i386) it is
 171          * merely difficult.
 172          */
 173         u_platform = NULL;
 174         if (k_platform) {
 175                 size_t len = strlen(k_platform) + 1;
 176
 177                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 178                 if (__copy_to_user(u_platform, k_platform, len))
 179                         return -EFAULT;
 180         }
 181
 182         /*
 183          * If this architecture has a "base" platform capability
 184          * string, copy it to userspace.
 185          */
 186         u_base_platform = NULL;
 187         if (k_base_platform) {
 188                 size_t len = strlen(k_base_platform) + 1;
 189
 190                 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 191                 if (__copy_to_user(u_base_platform, k_base_platform, len))
 192                         return -EFAULT;
 193         }
 194
 195         /*
 196          * Generate 16 random bytes for userspace PRNG seeding.
 197          */
 198         get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
 199         u_rand_bytes = (elf_addr_t __user *)
 200                        STACK_ALLOC(p, sizeof(k_rand_bytes));
 201         if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
 202                 return -EFAULT;
 203
 204         /* Create the ELF interpreter info */
 205         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 206         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 207 #define NEW_AUX_ENT(id, val) \
 208         do { \
 209                 elf_info[ei_index++] = id; \
 210                 elf_info[ei_index++] = val; \
 211         } while (0)
 212
 213 #ifdef ARCH_DLINFO
 214         /*
 215          * ARCH_DLINFO must come first so PPC can do its special alignment of
 216          * AUXV.
 217          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 218          * ARCH_DLINFO changes
 219          */
 220         ARCH_DLINFO;
 221 #endif
 222         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 223         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 224         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 225         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 226         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 227         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 228         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 229         NEW_AUX_ENT(AT_FLAGS, 0);
 230         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 231         NEW_AUX_ENT(AT_UID, cred->uid);
 232         NEW_AUX_ENT(AT_EUID, cred->euid);
 233         NEW_AUX_ENT(AT_GID, cred->gid);
 234         NEW_AUX_ENT(AT_EGID, cred->egid);
 235         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 236         NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
 237         NEW_AUX_ENT(AT_EXECFN, bprm->exec);
 238         if (k_platform) {
 239                 NEW_AUX_ENT(AT_PLATFORM,
 240                             (elf_addr_t)(unsigned long)u_platform);
 241         }
 242         if (k_base_platform) {
 243                 NEW_AUX_ENT(AT_BASE_PLATFORM,
 244                             (elf_addr_t)(unsigned long)u_base_platform);
 245         }
 246         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 247                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 248         }
 249 #undef NEW_AUX_ENT
 250         /* AT_NULL is zero; clear the rest too */
 251         memset(&elf_info[ei_index], 0,
 252                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 253
 254         /* And advance past the AT_NULL entry.  */
 255         ei_index += 2;
 256
 257         sp = STACK_ADD(p, ei_index);
 258
 259         items = (argc + 1) + (envc + 1) + 1;
 260         bprm->p = STACK_ROUND(sp, items);
 261
 262         /* Point sp at the lowest address on the stack */
 263 #ifdef CONFIG_STACK_GROWSUP
 264         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 265         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 266 #else
 267         sp = (elf_addr_t __user *)bprm->p;
 268 #endif
 269
 270
 271         /*
 272          * Grow the stack manually; some architectures have a limit on how
 273          * far ahead a user-space access may be in order to grow the stack.
 274          */
 275         vma = find_extend_vma(current->mm, bprm->p);
 276         if (!vma)
 277                 return -EFAULT;
 278
 279         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 280         if (__put_user(argc, sp++))
 281                 return -EFAULT;
 282         argv = sp;
 283         envp = argv + argc + 1;
 284
 285         /* Populate argv and envp */
 286         p = current->mm->arg_end = current->mm->arg_start;
 287         while (argc-- > 0) {
 288                 size_t len;
 289                 if (__put_user((elf_addr_t)p, argv++))
 290                         return -EFAULT;
 291                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 292                 if (!len || len > MAX_ARG_STRLEN)
 293                         return -EINVAL;
 294                 p += len;
 295         }
 296         if (__put_user(0, argv))
 297                 return -EFAULT;
 298         current->mm->arg_end = current->mm->env_start = p;
 299         while (envc-- > 0) {
 300                 size_t len;
 301                 if (__put_user((elf_addr_t)p, envp++))
 302                         return -EFAULT;
 303                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 304                 if (!len || len > MAX_ARG_STRLEN)
 305                         return -EINVAL;
 306                 p += len;
 307         }
 308         if (__put_user(0, envp))
 309                 return -EFAULT;
 310         current->mm->env_end = p;
 311
 312         /* Put the elf_info on the stack in the right place.  */
 313         sp = (elf_addr_t __user *)envp + 1;
 314         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 315                 return -EFAULT;
 316         return 0;
 317 }
 318
 319 static unsigned long elf_map(struct file *filep, unsigned long addr,
 320                 struct elf_phdr *eppnt, int prot, int type,
 321                 unsigned long total_size)
 322 {
 323         unsigned long map_addr;
 324         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 325         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 326         addr = ELF_PAGESTART(addr);
 327         size = ELF_PAGEALIGN(size);
 328
 329         /* mmap() will return -EINVAL if given a zero size, but a
 330          * segment with zero filesize is perfectly valid */
 331         if (!size)
 332                 return addr;
 333
 334         down_write(&current->mm->mmap_sem);
 335         /*
 336         * total_size is the size of the ELF (interpreter) image.
 337         * The _first_ mmap needs to know the full size, otherwise
 338         * randomization might put this image into an overlapping
 339         * position with the ELF binary image. (since size < total_size)
 340         * So we first map the 'big' image - and unmap the remainder at
 341         * the end. (which unmap is needed for ELF images with holes.)
 342         */
 343         if (total_size) {
 344                 total_size = ELF_PAGEALIGN(total_size);
 345                 map_addr = do_mmap(filep, addr, total_size, prot, type, off);
 346                 if (!BAD_ADDR(map_addr))
 347                         do_munmap(current->mm, map_addr+size, total_size-size);
 348         } else
 349                 map_addr = do_mmap(filep, addr, size, prot, type, off);
 350
 351         up_write(&current->mm->mmap_sem);
 352         return(map_addr);
 353 }
 354
 355 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 356 {
 357         int i, first_idx = -1, last_idx = -1;
 358
 359         for (i = 0; i < nr; i++) {
 360                 if (cmds[i].p_type == PT_LOAD) {
 361                         last_idx = i;
 362                         if (first_idx == -1)
 363                                 first_idx = i;
 364                 }
 365         }
 366         if (first_idx == -1)
 367                 return 0;
 368
 369         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 370                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 371 }
 372
 373
 374 /* This is much more generalized than the library routine read function,
 375    so we keep this separate.  Technically the library read function
 376    is only provided so that we can read a.out libraries that have
 377    an ELF header */
 378
 379 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 380                 struct file *interpreter, unsigned long *interp_map_addr,
 381                 unsigned long no_base)
 382 {
 383         struct elf_phdr *elf_phdata;
 384         struct elf_phdr *eppnt;
 385         unsigned long load_addr = 0;
 386         int load_addr_set = 0;
 387         unsigned long last_bss = 0, elf_bss = 0;
 388         unsigned long error = ~0UL;
 389         unsigned long total_size;
 390         int retval, i, size;
 391
 392         /* First of all, some simple consistency checks */
 393         if (interp_elf_ex->e_type != ET_EXEC &&
 394             interp_elf_ex->e_type != ET_DYN)
 395                 goto out;
 396         if (!elf_check_arch(interp_elf_ex))
 397                 goto out;
 398         if (!interpreter->f_op || !interpreter->f_op->mmap)
 399                 goto out;
 400
 401         /*
 402          * If the size of this structure has changed, then punt, since
 403          * we will be doing the wrong thing.
 404          */
 405         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 406                 goto out;
 407         if (interp_elf_ex->e_phnum < 1 ||
 408                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 409                 goto out;
 410
 411         /* Now read in all of the header information */
 412         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 413         if (size > ELF_MIN_ALIGN)
 414                 goto out;
 415         elf_phdata = kmalloc(size, GFP_KERNEL);
 416         if (!elf_phdata)
 417                 goto out;
 418
 419         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 420                              (char *)elf_phdata, size);
 421         error = -EIO;
 422         if (retval != size) {
 423                 if (retval < 0)
 424                         error = retval;
 425                 goto out_close;
 426         }
 427
 428         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 429         if (!total_size) {
 430                 error = -EINVAL;
 431                 goto out_close;
 432         }
 433
 434         eppnt = elf_phdata;
 435         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 436                 if (eppnt->p_type == PT_LOAD) {
 437                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 438                         int elf_prot = 0;
 439                         unsigned long vaddr = 0;
 440                         unsigned long k, map_addr;
 441
 442                         if (eppnt->p_flags & PF_R)
 443                                 elf_prot = PROT_READ;
 444                         if (eppnt->p_flags & PF_W)
 445                                 elf_prot |= PROT_WRITE;
 446                         if (eppnt->p_flags & PF_X)
 447                                 elf_prot |= PROT_EXEC;
 448                         vaddr = eppnt->p_vaddr;
 449                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 450                                 elf_type |= MAP_FIXED;
 451                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 452                                 load_addr = -vaddr;
 453
 454                         map_addr = elf_map(interpreter, load_addr + vaddr,
 455                                         eppnt, elf_prot, elf_type, total_size);
 456                         total_size = 0;
 457                         if (!*interp_map_addr)
 458                                 *interp_map_addr = map_addr;
 459                         error = map_addr;
 460                         if (BAD_ADDR(map_addr))
 461                                 goto out_close;
 462
 463                         if (!load_addr_set &&
 464                             interp_elf_ex->e_type == ET_DYN) {
 465                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 466                                 load_addr_set = 1;
 467                         }
 468
 469                         /*
 470                          * Check to see if the section's size will overflow the
 471                          * allowed task size. Note that p_filesz must always be
 472                          * <= p_memsize so it's only necessary to check p_memsz.
 473                          */
 474                         k = load_addr + eppnt->p_vaddr;
 475                         if (BAD_ADDR(k) ||
 476                             eppnt->p_filesz > eppnt->p_memsz ||
 477                             eppnt->p_memsz > TASK_SIZE ||
 478                             TASK_SIZE - eppnt->p_memsz < k) {
 479                                 error = -ENOMEM;
 480                                 goto out_close;
 481                         }
 482
 483                         /*
 484                          * Find the end of the file mapping for this phdr, and
 485                          * keep track of the largest address we see for this.
 486                          */
 487                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 488                         if (k > elf_bss)
 489                                 elf_bss = k;
 490
 491                         /*
 492                          * Do the same thing for the memory mapping - between
 493                          * elf_bss and last_bss is the bss section.
 494                          */
 495                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 496                         if (k > last_bss)
 497                                 last_bss = k;
 498                 }
 499         }
 500
 501         if (last_bss > elf_bss) {
 502                 /*
 503                  * Now fill out the bss section.  First pad the last page up
 504                  * to the page boundary, and then perform a mmap to make sure
 505                  * that there are zero-mapped pages up to and including the
 506                  * last bss page.
 507                  */
 508                 if (padzero(elf_bss)) {
 509                         error = -EFAULT;
 510                         goto out_close;
 511                 }
 512
 513                 /* What we have mapped so far */
 514                 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 515
 516                 /* Map the last of the bss segment */
 517                 down_write(&current->mm->mmap_sem);
 518                 error = do_brk(elf_bss, last_bss - elf_bss);
 519                 up_write(&current->mm->mmap_sem);
 520                 if (BAD_ADDR(error))
 521                         goto out_close;
 522         }
 523
 524         error = load_addr;
 525
 526 out_close:
 527         kfree(elf_phdata);
 528 out:
 529         return error;
 530 }
 531
 532 /*
 533  * These are the functions used to load ELF style executables and shared
 534  * libraries.  There is no binary dependent code anywhere else.
 535  */
 536
 537 #define INTERPRETER_NONE 0
 538 #define INTERPRETER_ELF 2
 539
 540 #ifndef STACK_RND_MASK
 541 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 542 #endif
 543
 544 static unsigned long randomize_stack_top(unsigned long stack_top)
 545 {
 546         unsigned int random_variable = 0;
 547
 548         if ((current->flags & PF_RANDOMIZE) &&
 549                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 550                 random_variable = get_random_int() & STACK_RND_MASK;
 551                 random_variable <<= PAGE_SHIFT;
 552         }
 553 #ifdef CONFIG_STACK_GROWSUP
 554         return PAGE_ALIGN(stack_top) + random_variable;
 555 #else
 556         return PAGE_ALIGN(stack_top) - random_variable;
 557 #endif
 558 }
 559
 560 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 561 {
 562         struct file *interpreter = NULL; /* to shut gcc up */
 563         unsigned long load_addr = 0, load_bias = 0;
 564         int load_addr_set = 0;
 565         char * elf_interpreter = NULL;
 566         unsigned long error;
 567         struct elf_phdr *elf_ppnt, *elf_phdata;
 568         unsigned long elf_bss, elf_brk;
 569         int retval, i;
 570         unsigned int size;
 571         unsigned long elf_entry;
 572         unsigned long interp_load_addr = 0;
 573         unsigned long start_code, end_code, start_data, end_data;
 574         unsigned long reloc_func_desc __maybe_unused = 0;
 575         int executable_stack = EXSTACK_DEFAULT;
 576         unsigned long def_flags = 0;
 577         struct {
 578                 struct elfhdr elf_ex;
 579                 struct elfhdr interp_elf_ex;
 580         } *loc;
 581
 582         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 583         if (!loc) {
 584                 retval = -ENOMEM;
 585                 goto out_ret;
 586         }
 587
 588         /* Get the exec-header */
 589         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 590
 591         retval = -ENOEXEC;
 592         /* First of all, some simple consistency checks */
 593         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 594                 goto out;
 595
 596         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 597                 goto out;
 598         if (!elf_check_arch(&loc->elf_ex))
 599                 goto out;
 600         if (!bprm->file->f_op || !bprm->file->f_op->mmap)
 601                 goto out;
 602
 603         /* Now read in all of the header information */
 604         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 605                 goto out;
 606         if (loc->elf_ex.e_phnum < 1 ||
 607                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 608                 goto out;
 609         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 610         retval = -ENOMEM;
 611         elf_phdata = kmalloc(size, GFP_KERNEL);
 612         if (!elf_phdata)
 613                 goto out;
 614
 615         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 616                              (char *)elf_phdata, size);
 617         if (retval != size) {
 618                 if (retval >= 0)
 619                         retval = -EIO;
 620                 goto out_free_ph;
 621         }
 622
 623         elf_ppnt = elf_phdata;
 624         elf_bss = 0;
 625         elf_brk = 0;
 626
 627         start_code = ~0UL;
 628         end_code = 0;
 629         start_data = 0;
 630         end_data = 0;
 631
 632         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 633                 if (elf_ppnt->p_type == PT_INTERP) {
 634                         /* This is the program interpreter used for
 635                          * shared libraries - for now assume that this
 636                          * is an a.out format binary
 637                          */
 638                         retval = -ENOEXEC;
 639                         if (elf_ppnt->p_filesz > PATH_MAX ||
 640                             elf_ppnt->p_filesz < 2)
 641                                 goto out_free_ph;
 642
 643                         retval = -ENOMEM;
 644                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 645                                                   GFP_KERNEL);
 646                         if (!elf_interpreter)
 647                                 goto out_free_ph;
 648
 649                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 650                                              elf_interpreter,
 651                                              elf_ppnt->p_filesz);
 652                         if (retval != elf_ppnt->p_filesz) {
 653                                 if (retval >= 0)
 654                                         retval = -EIO;
 655                                 goto out_free_interp;
 656                         }
 657                         /* make sure path is NULL terminated */
 658                         retval = -ENOEXEC;
 659                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 660                                 goto out_free_interp;
 661
 662                         interpreter = open_exec(elf_interpreter);
 663                         retval = PTR_ERR(interpreter);
 664                         if (IS_ERR(interpreter))
 665                                 goto out_free_interp;
 666
 667                         /*
 668                          * If the binary is not readable then enforce
 669                          * mm->dumpable = 0 regardless of the interpreter's
 670                          * permissions.
 671                          */
 672                         would_dump(bprm, interpreter);
 673
 674                         retval = kernel_read(interpreter, 0, bprm->buf,
 675                                              BINPRM_BUF_SIZE);
 676                         if (retval != BINPRM_BUF_SIZE) {
 677                                 if (retval >= 0)
 678                                         retval = -EIO;
 679                                 goto out_free_dentry;
 680                         }
 681
 682                         /* Get the exec headers */
 683                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 684                         break;
 685                 }
 686                 elf_ppnt++;
 687         }
 688
 689         elf_ppnt = elf_phdata;
 690         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 691                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 692                         if (elf_ppnt->p_flags & PF_X)
 693                                 executable_stack = EXSTACK_ENABLE_X;
 694                         else
 695                                 executable_stack = EXSTACK_DISABLE_X;
 696                         break;
 697                 }
 698
 699         /* Some simple consistency checks for the interpreter */
 700         if (elf_interpreter) {
 701                 retval = -ELIBBAD;
 702                 /* Not an ELF interpreter */
 703                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 704                         goto out_free_dentry;
 705                 /* Verify the interpreter has a valid arch */
 706                 if (!elf_check_arch(&loc->interp_elf_ex))
 707                         goto out_free_dentry;
 708         }
 709
 710         /* Flush all traces of the currently running executable */
 711         retval = flush_old_exec(bprm);
 712         if (retval)
 713                 goto out_free_dentry;
 714
 715         /* OK, This is the point of no return */
 716         current->mm->def_flags = def_flags;
 717
 718         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 719            may depend on the personality.  */
 720         SET_PERSONALITY(loc->elf_ex);
 721         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 722                 current->personality |= READ_IMPLIES_EXEC;
 723
 724         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 725                 current->flags |= PF_RANDOMIZE;
 726
 727         setup_new_exec(bprm);
 728
 729         /* Do this so that we can load the interpreter, if need be.  We will
 730            change some of these later */
 731         current->mm->free_area_cache = current->mm->mmap_base;
 732         current->mm->cached_hole_size = 0;
 733         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 734                                  executable_stack);
 735         if (retval < 0) {
 736                 send_sig(SIGKILL, current, 0);
 737                 goto out_free_dentry;
 738         }
 739
 740         current->mm->start_stack = bprm->p;
 741
 742         /* Now we do a little grungy work by mmapping the ELF image into
 743            the correct location in memory. */
 744         for(i = 0, elf_ppnt = elf_phdata;
 745             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 746                 int elf_prot = 0, elf_flags;
 747                 unsigned long k, vaddr;
 748
 749                 if (elf_ppnt->p_type != PT_LOAD)
 750                         continue;
 751
 752                 if (unlikely (elf_brk > elf_bss)) {
 753                         unsigned long nbyte;
 754
 755                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 756                            before this one. Map anonymous pages, if needed,
 757                            and clear the area.  */
 758                         retval = set_brk(elf_bss + load_bias,
 759                                          elf_brk + load_bias);
 760                         if (retval) {
 761                                 send_sig(SIGKILL, current, 0);
 762                                 goto out_free_dentry;
 763                         }
 764                         nbyte = ELF_PAGEOFFSET(elf_bss);
 765                         if (nbyte) {
 766                                 nbyte = ELF_MIN_ALIGN - nbyte;
 767                                 if (nbyte > elf_brk - elf_bss)
 768                                         nbyte = elf_brk - elf_bss;
 769                                 if (clear_user((void __user *)elf_bss +
 770                                                         load_bias, nbyte)) {
 771                                         /*
 772                                          * This bss-zeroing can fail if the ELF
 773                                          * file specifies odd protections. So
 774                                          * we don't check the return value
 775                                          */
 776                                 }
 777                         }
 778                 }
 779
 780                 if (elf_ppnt->p_flags & PF_R)
 781                         elf_prot |= PROT_READ;
 782                 if (elf_ppnt->p_flags & PF_W)
 783                         elf_prot |= PROT_WRITE;
 784                 if (elf_ppnt->p_flags & PF_X)
 785                         elf_prot |= PROT_EXEC;
 786
 787                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 788
 789                 vaddr = elf_ppnt->p_vaddr;
 790                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 791                         elf_flags |= MAP_FIXED;
 792                 } else if (loc->elf_ex.e_type == ET_DYN) {
 793                         /* Try and get dynamic programs out of the way of the
 794                          * default mmap base, as well as whatever program they
 795                          * might try to exec.  This is because the brk will
 796                          * follow the loader, and is not movable.  */
 797 #ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
 798                         /* Memory randomization might have been switched off
 799                          * in runtime via sysctl.
 800                          * If that is the case, retain the original non-zero
 801                          * load_bias value in order to establish proper
 802                          * non-randomized mappings.
 803                          */
 804                         if (current->flags & PF_RANDOMIZE)
 805                                 load_bias = 0;
 806                         else
 807                                 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 808 #else
 809                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 810 #endif
 811                 }
 812
 813                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 814                                 elf_prot, elf_flags, 0);
 815                 if (BAD_ADDR(error)) {
 816                         send_sig(SIGKILL, current, 0);
 817                         retval = IS_ERR((void *)error) ?
 818                                 PTR_ERR((void*)error) : -EINVAL;
 819                         goto out_free_dentry;
 820                 }
 821
 822                 if (!load_addr_set) {
 823                         load_addr_set = 1;
 824                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 825                         if (loc->elf_ex.e_type == ET_DYN) {
 826                                 load_bias += error -
 827                                              ELF_PAGESTART(load_bias + vaddr);
 828                                 load_addr += load_bias;
 829                                 reloc_func_desc = load_bias;
 830                         }
 831                 }
 832                 k = elf_ppnt->p_vaddr;
 833                 if (k < start_code)
 834                         start_code = k;
 835                 if (start_data < k)
 836                         start_data = k;
 837
 838                 /*
 839                  * Check to see if the section's size will overflow the
 840                  * allowed task size. Note that p_filesz must always be
 841                  * <= p_memsz so it is only necessary to check p_memsz.
 842                  */
 843                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 844                     elf_ppnt->p_memsz > TASK_SIZE ||
 845                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 846                         /* set_brk can never work. Avoid overflows. */
 847                         send_sig(SIGKILL, current, 0);
 848                         retval = -EINVAL;
 849                         goto out_free_dentry;
 850                 }
 851
 852                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 853
 854                 if (k > elf_bss)
 855                         elf_bss = k;
 856                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 857                         end_code = k;
 858                 if (end_data < k)
 859                         end_data = k;
 860                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 861                 if (k > elf_brk)
 862                         elf_brk = k;
 863         }
 864
 865         loc->elf_ex.e_entry += load_bias;
 866         elf_bss += load_bias;
 867         elf_brk += load_bias;
 868         start_code += load_bias;
 869         end_code += load_bias;
 870         start_data += load_bias;
 871         end_data += load_bias;
 872
 873         /* Calling set_brk effectively mmaps the pages that we need
 874          * for the bss and break sections.  We must do this before
 875          * mapping in the interpreter, to make sure it doesn't wind
 876          * up getting placed where the bss needs to go.
 877          */
 878         retval = set_brk(elf_bss, elf_brk);
 879         if (retval) {
 880                 send_sig(SIGKILL, current, 0);
 881                 goto out_free_dentry;
 882         }
 883         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 884                 send_sig(SIGSEGV, current, 0);
 885                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 886                 goto out_free_dentry;
 887         }
 888
 889         if (elf_interpreter) {
 890                 unsigned long uninitialized_var(interp_map_addr);
 891
 892                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 893                                             interpreter,
 894                                             &interp_map_addr,
 895                                             load_bias);
 896                 if (!IS_ERR((void *)elf_entry)) {
 897                         /*
 898                          * load_elf_interp() returns relocation
 899                          * adjustment
 900                          */
 901                         interp_load_addr = elf_entry;
 902                         elf_entry += loc->interp_elf_ex.e_entry;
 903                 }
 904                 if (BAD_ADDR(elf_entry)) {
 905                         force_sig(SIGSEGV, current);
 906                         retval = IS_ERR((void *)elf_entry) ?
 907                                         (int)elf_entry : -EINVAL;
 908                         goto out_free_dentry;
 909                 }
 910                 reloc_func_desc = interp_load_addr;
 911
 912                 allow_write_access(interpreter);
 913                 fput(interpreter);
 914                 kfree(elf_interpreter);
 915         } else {
 916                 elf_entry = loc->elf_ex.e_entry;
 917                 if (BAD_ADDR(elf_entry)) {
 918                         force_sig(SIGSEGV, current);
 919                         retval = -EINVAL;
 920                         goto out_free_dentry;
 921                 }
 922         }
 923
 924         kfree(elf_phdata);
 925
 926         set_binfmt(&elf_format);
 927
 928 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 929         retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
 930         if (retval < 0) {
 931                 send_sig(SIGKILL, current, 0);
 932                 goto out;
 933         }
 934 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 935
 936         install_exec_creds(bprm);
 937         retval = create_elf_tables(bprm, &loc->elf_ex,
 938                           load_addr, interp_load_addr);
 939         if (retval < 0) {
 940                 send_sig(SIGKILL, current, 0);
 941                 goto out;
 942         }
 943         /* N.B. passed_fileno might not be initialized? */
 944         current->mm->end_code = end_code;
 945         current->mm->start_code = start_code;
 946         current->mm->start_data = start_data;
 947         current->mm->end_data = end_data;
 948         current->mm->start_stack = bprm->p;
 949
 950 #ifdef arch_randomize_brk
 951         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
 952                 current->mm->brk = current->mm->start_brk =
 953                         arch_randomize_brk(current->mm);
 954 #ifdef CONFIG_COMPAT_BRK
 955                 current->brk_randomized = 1;
 956 #endif
 957         }
 958 #endif
 959
 960         if (current->personality & MMAP_PAGE_ZERO) {
 961                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 962                    and some applications "depend" upon this behavior.
 963                    Since we do not have the power to recompile these, we
 964                    emulate the SVr4 behavior. Sigh. */
 965                 down_write(&current->mm->mmap_sem);
 966                 error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 967                                 MAP_FIXED | MAP_PRIVATE, 0);
 968                 up_write(&current->mm->mmap_sem);
 969         }
 970
 971 #ifdef ELF_PLAT_INIT
 972         /*
 973          * The ABI may specify that certain registers be set up in special
 974          * ways (on i386 %edx is the address of a DT_FINI function, for
 975          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 976          * that the e_entry field is the address of the function descriptor
 977          * for the startup routine, rather than the address of the startup
 978          * routine itself.  This macro performs whatever initialization to
 979          * the regs structure is required as well as any relocations to the
 980          * function descriptor entries when executing dynamically links apps.
 981          */
 982         ELF_PLAT_INIT(regs, reloc_func_desc);
 983 #endif
 984
 985         start_thread(regs, elf_entry, bprm->p);
 986         retval = 0;
 987 out:
 988         kfree(loc);
 989 out_ret:
 990         return retval;
 991
 992         /* error cleanup */
 993 out_free_dentry:
 994         allow_write_access(interpreter);
 995         if (interpreter)
 996                 fput(interpreter);
 997 out_free_interp:
 998         kfree(elf_interpreter);
 999 out_free_ph:
1000         kfree(elf_phdata);
1001         goto out;
1002 }
1003
1004 /* This is really simpleminded and specialized - we are loading an
1005    a.out library that is given an ELF header. */
1006 static int load_elf_library(struct file *file)
1007 {
1008         struct elf_phdr *elf_phdata;
1009         struct elf_phdr *eppnt;
1010         unsigned long elf_bss, bss, len;
1011         int retval, error, i, j;
1012         struct elfhdr elf_ex;
1013
1014         error = -ENOEXEC;
1015         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1016         if (retval != sizeof(elf_ex))
1017                 goto out;
1018
1019         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1020                 goto out;
1021
1022         /* First of all, some simple consistency checks */
1023         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1024             !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1025                 goto out;
1026
1027         /* Now read in all of the header information */
1028
1029         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1030         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1031
1032         error = -ENOMEM;
1033         elf_phdata = kmalloc(j, GFP_KERNEL);
1034         if (!elf_phdata)
1035                 goto out;
1036
1037         eppnt = elf_phdata;
1038         error = -ENOEXEC;
1039         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1040         if (retval != j)
1041                 goto out_free_ph;
1042
1043         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1044                 if ((eppnt + i)->p_type == PT_LOAD)
1045                         j++;
1046         if (j != 1)
1047                 goto out_free_ph;
1048
1049         while (eppnt->p_type != PT_LOAD)
1050                 eppnt++;
1051
1052         /* Now use mmap to map the library into memory. */
1053         down_write(&current->mm->mmap_sem);
1054         error = do_mmap(file,
1055                         ELF_PAGESTART(eppnt->p_vaddr),
1056                         (eppnt->p_filesz +
1057                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1058                         PROT_READ | PROT_WRITE | PROT_EXEC,
1059                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1060                         (eppnt->p_offset -
1061                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1062         up_write(&current->mm->mmap_sem);
1063         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1064                 goto out_free_ph;
1065
1066         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1067         if (padzero(elf_bss)) {
1068                 error = -EFAULT;
1069                 goto out_free_ph;
1070         }
1071
1072         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1073                             ELF_MIN_ALIGN - 1);
1074         bss = eppnt->p_memsz + eppnt->p_vaddr;
1075         if (bss > len) {
1076                 down_write(&current->mm->mmap_sem);
1077                 do_brk(len, bss - len);
1078                 up_write(&current->mm->mmap_sem);
1079         }
1080         error = 0;
1081
1082 out_free_ph:
1083         kfree(elf_phdata);
1084 out:
1085         return error;
1086 }
1087
1088 #ifdef CONFIG_ELF_CORE
1089 /*
1090  * ELF core dumper
1091  *
1092  * Modelled on fs/exec.c:aout_core_dump()
1093  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1094  */
1095
1096 /*
1097  * The purpose of always_dump_vma() is to make sure that special kernel mappings
1098  * that are useful for post-mortem analysis are included in every core dump.
1099  * In that way we ensure that the core dump is fully interpretable later
1100  * without matching up the same kernel and hardware config to see what PC values
1101  * meant. These special mappings include - vDSO, vsyscall, and other
1102  * architecture specific mappings
1103  */
1104 static bool always_dump_vma(struct vm_area_struct *vma)
1105 {
1106         /* Any vsyscall mappings? */
1107         if (vma == get_gate_vma(vma->vm_mm))
1108                 return true;
1109         /*
1110          * arch_vma_name() returns non-NULL for special architecture mappings,
1111          * such as vDSO sections.
1112          */
1113         if (arch_vma_name(vma))
1114                 return true;
1115
1116         return false;
1117 }
1118
1119 /*
1120  * Decide what to dump of a segment, part, all or none.
1121  */
1122 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1123                                    unsigned long mm_flags)
1124 {
1125 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1126
1127         /* always dump the vdso and vsyscall sections */
1128         if (always_dump_vma(vma))
1129                 goto whole;
1130
1131         if (vma->vm_flags & VM_NODUMP)
1132                 return 0;
1133
1134         /* Hugetlb memory check */
1135         if (vma->vm_flags & VM_HUGETLB) {
1136                 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1137                         goto whole;
1138                 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1139                         goto whole;
1140         }
1141
1142         /* Do not dump I/O mapped devices or special mappings */
1143         if (vma->vm_flags & (VM_IO | VM_RESERVED))
1144                 return 0;
1145
1146         /* By default, dump shared memory if mapped from an anonymous file. */
1147         if (vma->vm_flags & VM_SHARED) {
1148                 if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
1149                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1150                         goto whole;
1151                 return 0;
1152         }
1153
1154         /* Dump segments that have been written to.  */
1155         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1156                 goto whole;
1157         if (vma->vm_file == NULL)
1158                 return 0;
1159
1160         if (FILTER(MAPPED_PRIVATE))
1161                 goto whole;
1162
1163         /*
1164          * If this looks like the beginning of a DSO or executable mapping,
1165          * check for an ELF header.  If we find one, dump the first page to
1166          * aid in determining what was mapped here.
1167          */
1168         if (FILTER(ELF_HEADERS) &&
1169             vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1170                 u32 __user *header = (u32 __user *) vma->vm_start;
1171                 u32 word;
1172                 mm_segment_t fs = get_fs();
1173                 /*
1174                  * Doing it this way gets the constant folded by GCC.
1175                  */
1176                 union {
1177                         u32 cmp;
1178                         char elfmag[SELFMAG];
1179                 } magic;
1180                 BUILD_BUG_ON(SELFMAG != sizeof word);
1181                 magic.elfmag[EI_MAG0] = ELFMAG0;
1182                 magic.elfmag[EI_MAG1] = ELFMAG1;
1183                 magic.elfmag[EI_MAG2] = ELFMAG2;
1184                 magic.elfmag[EI_MAG3] = ELFMAG3;
1185                 /*
1186                  * Switch to the user "segment" for get_user(),
1187                  * then put back what elf_core_dump() had in place.
1188                  */
1189                 set_fs(USER_DS);
1190                 if (unlikely(get_user(word, header)))
1191                         word = 0;
1192                 set_fs(fs);
1193                 if (word == magic.cmp)
1194                         return PAGE_SIZE;
1195         }
1196
1197 #undef  FILTER
1198
1199         return 0;
1200
1201 whole:
1202         return vma->vm_end - vma->vm_start;
1203 }
1204
1205 /* An ELF note in memory */
1206 struct memelfnote
1207 {
1208         const char *name;
1209         int type;
1210         unsigned int datasz;
1211         void *data;
1212 };
1213
1214 static int notesize(struct memelfnote *en)
1215 {
1216         int sz;
1217
1218         sz = sizeof(struct elf_note);
1219         sz += roundup(strlen(en->name) + 1, 4);
1220         sz += roundup(en->datasz, 4);
1221
1222         return sz;
1223 }
1224
1225 #define DUMP_WRITE(addr, nr, foffset)   \
1226         do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
1227
1228 static int alignfile(struct file *file, loff_t *foffset)
1229 {
1230         static const char buf[4] = { 0, };
1231         DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
1232         return 1;
1233 }
1234
1235 static int writenote(struct memelfnote *men, struct file *file,
1236                         loff_t *foffset)
1237 {
1238         struct elf_note en;
1239         en.n_namesz = strlen(men->name) + 1;
1240         en.n_descsz = men->datasz;
1241         en.n_type = men->type;
1242
1243         DUMP_WRITE(&en, sizeof(en), foffset);
1244         DUMP_WRITE(men->name, en.n_namesz, foffset);
1245         if (!alignfile(file, foffset))
1246                 return 0;
1247         DUMP_WRITE(men->data, men->datasz, foffset);
1248         if (!alignfile(file, foffset))
1249                 return 0;
1250
1251         return 1;
1252 }
1253 #undef DUMP_WRITE
1254
1255 static void fill_elf_header(struct elfhdr *elf, int segs,
1256                             u16 machine, u32 flags, u8 osabi)
1257 {
1258         memset(elf, 0, sizeof(*elf));
1259
1260         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1261         elf->e_ident[EI_CLASS] = ELF_CLASS;
1262         elf->e_ident[EI_DATA] = ELF_DATA;
1263         elf->e_ident[EI_VERSION] = EV_CURRENT;
1264         elf->e_ident[EI_OSABI] = ELF_OSABI;
1265
1266         elf->e_type = ET_CORE;
1267         elf->e_machine = machine;
1268         elf->e_version = EV_CURRENT;
1269         elf->e_phoff = sizeof(struct elfhdr);
1270         elf->e_flags = flags;
1271         elf->e_ehsize = sizeof(struct elfhdr);
1272         elf->e_phentsize = sizeof(struct elf_phdr);
1273         elf->e_phnum = segs;
1274
1275         return;
1276 }
1277
1278 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1279 {
1280         phdr->p_type = PT_NOTE;
1281         phdr->p_offset = offset;
1282         phdr->p_vaddr = 0;
1283         phdr->p_paddr = 0;
1284         phdr->p_filesz = sz;
1285         phdr->p_memsz = 0;
1286         phdr->p_flags = 0;
1287         phdr->p_align = 0;
1288         return;
1289 }
1290
1291 static void fill_note(struct memelfnote *note, const char *name, int type,
1292                 unsigned int sz, void *data)
1293 {
1294         note->name = name;
1295         note->type = type;
1296         note->datasz = sz;
1297         note->data = data;
1298         return;
1299 }
1300
1301 /*
1302  * fill up all the fields in prstatus from the given task struct, except
1303  * registers which need to be filled up separately.
1304  */
1305 static void fill_prstatus(struct elf_prstatus *prstatus,
1306                 struct task_struct *p, long signr)
1307 {
1308         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1309         prstatus->pr_sigpend = p->pending.signal.sig[0];
1310         prstatus->pr_sighold = p->blocked.sig[0];
1311         rcu_read_lock();
1312         prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1313         rcu_read_unlock();
1314         prstatus->pr_pid = task_pid_vnr(p);
1315         prstatus->pr_pgrp = task_pgrp_vnr(p);
1316         prstatus->pr_sid = task_session_vnr(p);
1317         if (thread_group_leader(p)) {
1318                 struct task_cputime cputime;
1319
1320                 /*
1321                  * This is the record for the group leader.  It shows the
1322                  * group-wide total, not its individual thread total.
1323                  */
1324                 thread_group_cputime(p, &cputime);
1325                 cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1326                 cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1327         } else {
1328                 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1329                 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1330         }
1331         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1332         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1333 }
1334
1335 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1336                        struct mm_struct *mm)
1337 {
1338         const struct cred *cred;
1339         unsigned int i, len;
1340
1341         /* first copy the parameters from user space */
1342         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1343
1344         len = mm->arg_end - mm->arg_start;
1345         if (len >= ELF_PRARGSZ)
1346                 len = ELF_PRARGSZ-1;
1347         if (copy_from_user(&psinfo->pr_psargs,
1348                            (const char __user *)mm->arg_start, len))
1349                 return -EFAULT;
1350         for(i = 0; i < len; i++)
1351                 if (psinfo->pr_psargs[i] == 0)
1352                         psinfo->pr_psargs[i] = ' ';
1353         psinfo->pr_psargs[len] = 0;
1354
1355         rcu_read_lock();
1356         psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1357         rcu_read_unlock();
1358         psinfo->pr_pid = task_pid_vnr(p);
1359         psinfo->pr_pgrp = task_pgrp_vnr(p);
1360         psinfo->pr_sid = task_session_vnr(p);
1361
1362         i = p->state ? ffz(~p->state) + 1 : 0;
1363         psinfo->pr_state = i;
1364         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1365         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1366         psinfo->pr_nice = task_nice(p);
1367         psinfo->pr_flag = p->flags;
1368         rcu_read_lock();
1369         cred = __task_cred(p);
1370         SET_UID(psinfo->pr_uid, cred->uid);
1371         SET_GID(psinfo->pr_gid, cred->gid);
1372         rcu_read_unlock();
1373         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1374
1375         return 0;
1376 }
1377
1378 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1379 {
1380         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1381         int i = 0;
1382         do
1383                 i += 2;
1384         while (auxv[i - 2] != AT_NULL);
1385         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1386 }
1387
1388 #ifdef CORE_DUMP_USE_REGSET
1389 #include <linux/regset.h>
1390
1391 struct elf_thread_core_info {
1392         struct elf_thread_core_info *next;
1393         struct task_struct *task;
1394         struct elf_prstatus prstatus;
1395         struct memelfnote notes[0];
1396 };
1397
1398 struct elf_note_info {
1399         struct elf_thread_core_info *thread;
1400         struct memelfnote psinfo;
1401         struct memelfnote auxv;
1402         size_t size;
1403         int thread_notes;
1404 };
1405
1406 /*
1407  * When a regset has a writeback hook, we call it on each thread before
1408  * dumping user memory.  On register window machines, this makes sure the
1409  * user memory backing the register data is up to date before we read it.
1410  */
1411 static void do_thread_regset_writeback(struct task_struct *task,
1412                                        const struct user_regset *regset)
1413 {
1414         if (regset->writeback)
1415                 regset->writeback(task, regset, 1);
1416 }
1417
1418 static int fill_thread_core_info(struct elf_thread_core_info *t,
1419                                  const struct user_regset_view *view,
1420                                  long signr, size_t *total)
1421 {
1422         unsigned int i;
1423
1424         /*
1425          * NT_PRSTATUS is the one special case, because the regset data
1426          * goes into the pr_reg field inside the note contents, rather
1427          * than being the whole note contents.  We fill the reset in here.
1428          * We assume that regset 0 is NT_PRSTATUS.
1429          */
1430         fill_prstatus(&t->prstatus, t->task, signr);
1431         (void) view->regsets[0].get(t->task, &view->regsets[0],
1432                                     0, sizeof(t->prstatus.pr_reg),
1433                                     &t->prstatus.pr_reg, NULL);
1434
1435         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1436                   sizeof(t->prstatus), &t->prstatus);
1437         *total += notesize(&t->notes[0]);
1438
1439         do_thread_regset_writeback(t->task, &view->regsets[0]);
1440
1441         /*
1442          * Each other regset might generate a note too.  For each regset
1443          * that has no core_note_type or is inactive, we leave t->notes[i]
1444          * all zero and we'll know to skip writing it later.
1445          */
1446         for (i = 1; i < view->n; ++i) {
1447                 const struct user_regset *regset = &view->regsets[i];
1448                 do_thread_regset_writeback(t->task, regset);
1449                 if (regset->core_note_type && regset->get &&
1450                     (!regset->active || regset->active(t->task, regset))) {
1451                         int ret;
1452                         size_t size = regset->n * regset->size;
1453                         void *data = kmalloc(size, GFP_KERNEL);
1454                         if (unlikely(!data))
1455                                 return 0;
1456                         ret = regset->get(t->task, regset,
1457                                           0, size, data, NULL);
1458                         if (unlikely(ret))
1459                                 kfree(data);
1460                         else {
1461                                 if (regset->core_note_type != NT_PRFPREG)
1462                                         fill_note(&t->notes[i], "LINUX",
1463                                                   regset->core_note_type,
1464                                                   size, data);
1465                                 else {
1466                                         t->prstatus.pr_fpvalid = 1;
1467                                         fill_note(&t->notes[i], "CORE",
1468                                                   NT_PRFPREG, size, data);
1469                                 }
1470                                 *total += notesize(&t->notes[i]);
1471                         }
1472                 }
1473         }
1474
1475         return 1;
1476 }
1477
1478 static int fill_note_info(struct elfhdr *elf, int phdrs,
1479                           struct elf_note_info *info,
1480                           long signr, struct pt_regs *regs)
1481 {
1482         struct task_struct *dump_task = current;
1483         const struct user_regset_view *view = task_user_regset_view(dump_task);
1484         struct elf_thread_core_info *t;
1485         struct elf_prpsinfo *psinfo;
1486         struct core_thread *ct;
1487         unsigned int i;
1488
1489         info->size = 0;
1490         info->thread = NULL;
1491
1492         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1493         if (psinfo == NULL)
1494                 return 0;
1495
1496         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1497
1498         /*
1499          * Figure out how many notes we're going to need for each thread.
1500          */
1501         info->thread_notes = 0;
1502         for (i = 0; i < view->n; ++i)
1503                 if (view->regsets[i].core_note_type != 0)
1504                         ++info->thread_notes;
1505
1506         /*
1507          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1508          * since it is our one special case.
1509          */
1510         if (unlikely(info->thread_notes == 0) ||
1511             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1512                 WARN_ON(1);
1513                 return 0;
1514         }
1515
1516         /*
1517          * Initialize the ELF file header.
1518          */
1519         fill_elf_header(elf, phdrs,
1520                         view->e_machine, view->e_flags, view->ei_osabi);
1521
1522         /*
1523          * Allocate a structure for each thread.
1524          */
1525         for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1526                 t = kzalloc(offsetof(struct elf_thread_core_info,
1527                                      notes[info->thread_notes]),
1528                             GFP_KERNEL);
1529                 if (unlikely(!t))
1530                         return 0;
1531
1532                 t->task = ct->task;
1533                 if (ct->task == dump_task || !info->thread) {
1534                         t->next = info->thread;
1535                         info->thread = t;
1536                 } else {
1537                         /*
1538                          * Make sure to keep the original task at
1539                          * the head of the list.
1540                          */
1541                         t->next = info->thread->next;
1542                         info->thread->next = t;
1543                 }
1544         }
1545
1546         /*
1547          * Now fill in each thread's information.
1548          */
1549         for (t = info->thread; t != NULL; t = t->next)
1550                 if (!fill_thread_core_info(t, view, signr, &info->size))
1551                         return 0;
1552
1553         /*
1554          * Fill in the two process-wide notes.
1555          */
1556         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1557         info->size += notesize(&info->psinfo);
1558
1559         fill_auxv_note(&info->auxv, current->mm);
1560         info->size += notesize(&info->auxv);
1561
1562         return 1;
1563 }
1564
1565 static size_t get_note_info_size(struct elf_note_info *info)
1566 {
1567         return info->size;
1568 }
1569
1570 /*
1571  * Write all the notes for each thread.  When writing the first thread, the
1572  * process-wide notes are interleaved after the first thread-specific note.
1573  */
1574 static int write_note_info(struct elf_note_info *info,
1575                            struct file *file, loff_t *foffset)
1576 {
1577         bool first = 1;
1578         struct elf_thread_core_info *t = info->thread;
1579
1580         do {
1581                 int i;
1582
1583                 if (!writenote(&t->notes[0], file, foffset))
1584                         return 0;
1585
1586                 if (first && !writenote(&info->psinfo, file, foffset))
1587                         return 0;
1588                 if (first && !writenote(&info->auxv, file, foffset))
1589                         return 0;
1590
1591                 for (i = 1; i < info->thread_notes; ++i)
1592                         if (t->notes[i].data &&
1593                             !writenote(&t->notes[i], file, foffset))
1594                                 return 0;
1595
1596                 first = 0;
1597                 t = t->next;
1598         } while (t);
1599
1600         return 1;
1601 }
1602
1603 static void free_note_info(struct elf_note_info *info)
1604 {
1605         struct elf_thread_core_info *threads = info->thread;
1606         while (threads) {
1607                 unsigned int i;
1608                 struct elf_thread_core_info *t = threads;
1609                 threads = t->next;
1610                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1611                 for (i = 1; i < info->thread_notes; ++i)
1612                         kfree(t->notes[i].data);
1613                 kfree(t);
1614         }
1615         kfree(info->psinfo.data);
1616 }
1617
1618 #else
1619
1620 /* Here is the structure in which status of each thread is captured. */
1621 struct elf_thread_status
1622 {
1623         struct list_head list;
1624         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1625         elf_fpregset_t fpu;             /* NT_PRFPREG */
1626         struct task_struct *thread;
1627 #ifdef ELF_CORE_COPY_XFPREGS
1628         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1629 #endif
1630         struct memelfnote notes[3];
1631         int num_notes;
1632 };
1633
1634 /*
1635  * In order to add the specific thread information for the elf file format,
1636  * we need to keep a linked list of every threads pr_status and then create
1637  * a single section for them in the final core file.
1638  */
1639 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1640 {
1641         int sz = 0;
1642         struct task_struct *p = t->thread;
1643         t->num_notes = 0;
1644
1645         fill_prstatus(&t->prstatus, p, signr);
1646         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1647
1648         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1649                   &(t->prstatus));
1650         t->num_notes++;
1651         sz += notesize(&t->notes[0]);
1652
1653         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1654                                                                 &t->fpu))) {
1655                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1656                           &(t->fpu));
1657                 t->num_notes++;
1658                 sz += notesize(&t->notes[1]);
1659         }
1660
1661 #ifdef ELF_CORE_COPY_XFPREGS
1662         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1663                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1664                           sizeof(t->xfpu), &t->xfpu);
1665                 t->num_notes++;
1666                 sz += notesize(&t->notes[2]);
1667         }
1668 #endif
1669         return sz;
1670 }
1671
1672 struct elf_note_info {
1673         struct memelfnote *notes;
1674         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1675         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1676         struct list_head thread_list;
1677         elf_fpregset_t *fpu;
1678 #ifdef ELF_CORE_COPY_XFPREGS
1679         elf_fpxregset_t *xfpu;
1680 #endif
1681         int thread_status_size;
1682         int numnote;
1683 };
1684
1685 static int elf_note_info_init(struct elf_note_info *info)
1686 {
1687         memset(info, 0, sizeof(*info));
1688         INIT_LIST_HEAD(&info->thread_list);
1689
1690         /* Allocate space for six ELF notes */
1691         info->notes = kmalloc(6 * sizeof(struct memelfnote), GFP_KERNEL);
1692         if (!info->notes)
1693                 return 0;
1694         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1695         if (!info->psinfo)
1696                 goto notes_free;
1697         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1698         if (!info->prstatus)
1699                 goto psinfo_free;
1700         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1701         if (!info->fpu)
1702                 goto prstatus_free;
1703 #ifdef ELF_CORE_COPY_XFPREGS
1704         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1705         if (!info->xfpu)
1706                 goto fpu_free;
1707 #endif
1708         return 1;
1709 #ifdef ELF_CORE_COPY_XFPREGS
1710  fpu_free:
1711         kfree(info->fpu);
1712 #endif
1713  prstatus_free:
1714         kfree(info->prstatus);
1715  psinfo_free:
1716         kfree(info->psinfo);
1717  notes_free:
1718         kfree(info->notes);
1719         return 0;
1720 }
1721
1722 static int fill_note_info(struct elfhdr *elf, int phdrs,
1723                           struct elf_note_info *info,
1724                           long signr, struct pt_regs *regs)
1725 {
1726         struct list_head *t;
1727
1728         if (!elf_note_info_init(info))
1729                 return 0;
1730
1731         if (signr) {
1732                 struct core_thread *ct;
1733                 struct elf_thread_status *ets;
1734
1735                 for (ct = current->mm->core_state->dumper.next;
1736                                                 ct; ct = ct->next) {
1737                         ets = kzalloc(sizeof(*ets), GFP_KERNEL);
1738                         if (!ets)
1739                                 return 0;
1740
1741                         ets->thread = ct->task;
1742                         list_add(&ets->list, &info->thread_list);
1743                 }
1744
1745                 list_for_each(t, &info->thread_list) {
1746                         int sz;
1747
1748                         ets = list_entry(t, struct elf_thread_status, list);
1749                         sz = elf_dump_thread_status(signr, ets);
1750                         info->thread_status_size += sz;
1751                 }
1752         }
1753         /* now collect the dump for the current */
1754         memset(info->prstatus, 0, sizeof(*info->prstatus));
1755         fill_prstatus(info->prstatus, current, signr);
1756         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1757
1758         /* Set up header */
1759         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
1760
1761         /*
1762          * Set up the notes in similar form to SVR4 core dumps made
1763          * with info from their /proc.
1764          */
1765
1766         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1767                   sizeof(*info->prstatus), info->prstatus);
1768         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1769         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1770                   sizeof(*info->psinfo), info->psinfo);
1771
1772         info->numnote = 2;
1773
1774         fill_auxv_note(&info->notes[info->numnote++], current->mm);
1775
1776         /* Try to dump the FPU. */
1777         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1778                                                                info->fpu);
1779         if (info->prstatus->pr_fpvalid)
1780                 fill_note(info->notes + info->numnote++,
1781                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1782 #ifdef ELF_CORE_COPY_XFPREGS
1783         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1784                 fill_note(info->notes + info->numnote++,
1785                           "LINUX", ELF_CORE_XFPREG_TYPE,
1786                           sizeof(*info->xfpu), info->xfpu);
1787 #endif
1788
1789         return 1;
1790 }
1791
1792 static size_t get_note_info_size(struct elf_note_info *info)
1793 {
1794         int sz = 0;
1795         int i;
1796
1797         for (i = 0; i < info->numnote; i++)
1798                 sz += notesize(info->notes + i);
1799
1800         sz += info->thread_status_size;
1801
1802         return sz;
1803 }
1804
1805 static int write_note_info(struct elf_note_info *info,
1806                            struct file *file, loff_t *foffset)
1807 {
1808         int i;
1809         struct list_head *t;
1810
1811         for (i = 0; i < info->numnote; i++)
1812                 if (!writenote(info->notes + i, file, foffset))
1813                         return 0;
1814
1815         /* write out the thread status notes section */
1816         list_for_each(t, &info->thread_list) {
1817                 struct elf_thread_status *tmp =
1818                                 list_entry(t, struct elf_thread_status, list);
1819
1820                 for (i = 0; i < tmp->num_notes; i++)
1821                         if (!writenote(&tmp->notes[i], file, foffset))
1822                                 return 0;
1823         }
1824
1825         return 1;
1826 }
1827
1828 static void free_note_info(struct elf_note_info *info)
1829 {
1830         while (!list_empty(&info->thread_list)) {
1831                 struct list_head *tmp = info->thread_list.next;
1832                 list_del(tmp);
1833                 kfree(list_entry(tmp, struct elf_thread_status, list));
1834         }
1835
1836         kfree(info->prstatus);
1837         kfree(info->psinfo);
1838         kfree(info->notes);
1839         kfree(info->fpu);
1840 #ifdef ELF_CORE_COPY_XFPREGS
1841         kfree(info->xfpu);
1842 #endif
1843 }
1844
1845 #endif
1846
1847 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1848                                         struct vm_area_struct *gate_vma)
1849 {
1850         struct vm_area_struct *ret = tsk->mm->mmap;
1851
1852         if (ret)
1853                 return ret;
1854         return gate_vma;
1855 }
1856 /*
1857  * Helper function for iterating across a vma list.  It ensures that the caller
1858  * will visit `gate_vma' prior to terminating the search.
1859  */
1860 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1861                                         struct vm_area_struct *gate_vma)
1862 {
1863         struct vm_area_struct *ret;
1864
1865         ret = this_vma->vm_next;
1866         if (ret)
1867                 return ret;
1868         if (this_vma == gate_vma)
1869                 return NULL;
1870         return gate_vma;
1871 }
1872
1873 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
1874                              elf_addr_t e_shoff, int segs)
1875 {
1876         elf->e_shoff = e_shoff;
1877         elf->e_shentsize = sizeof(*shdr4extnum);
1878         elf->e_shnum = 1;
1879         elf->e_shstrndx = SHN_UNDEF;
1880
1881         memset(shdr4extnum, 0, sizeof(*shdr4extnum));
1882
1883         shdr4extnum->sh_type = SHT_NULL;
1884         shdr4extnum->sh_size = elf->e_shnum;
1885         shdr4extnum->sh_link = elf->e_shstrndx;
1886         shdr4extnum->sh_info = segs;
1887 }
1888
1889 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
1890                                      unsigned long mm_flags)
1891 {
1892         struct vm_area_struct *vma;
1893         size_t size = 0;
1894
1895         for (vma = first_vma(current, gate_vma); vma != NULL;
1896              vma = next_vma(vma, gate_vma))
1897                 size += vma_dump_size(vma, mm_flags);
1898         return size;
1899 }
1900
1901 /*
1902  * Actual dumper
1903  *
1904  * This is a two-pass process; first we find the offsets of the bits,
1905  * and then they are actually written out.  If we run out of core limit
1906  * we just truncate.
1907  */
1908 static int elf_core_dump(struct coredump_params *cprm)
1909 {
1910         int has_dumped = 0;
1911         mm_segment_t fs;
1912         int segs;
1913         size_t size = 0;
1914         struct vm_area_struct *vma, *gate_vma;
1915         struct elfhdr *elf = NULL;
1916         loff_t offset = 0, dataoff, foffset;
1917         struct elf_note_info info;
1918         struct elf_phdr *phdr4note = NULL;
1919         struct elf_shdr *shdr4extnum = NULL;
1920         Elf_Half e_phnum;
1921         elf_addr_t e_shoff;
1922
1923         /*
1924          * We no longer stop all VM operations.
1925          *
1926          * This is because those proceses that could possibly change map_count
1927          * or the mmap / vma pages are now blocked in do_exit on current
1928          * finishing this core dump.
1929          *
1930          * Only ptrace can touch these memory addresses, but it doesn't change
1931          * the map_count or the pages allocated. So no possibility of crashing
1932          * exists while dumping the mm->vm_next areas to the core file.
1933          */
1934
1935         /* alloc memory for large data structures: too large to be on stack */
1936         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1937         if (!elf)
1938                 goto out;
1939         /*
1940          * The number of segs are recored into ELF header as 16bit value.
1941          * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
1942          */
1943         segs = current->mm->map_count;
1944         segs += elf_core_extra_phdrs();
1945
1946         gate_vma = get_gate_vma(current->mm);
1947         if (gate_vma != NULL)
1948                 segs++;
1949
1950         /* for notes section */
1951         segs++;
1952
1953         /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
1954          * this, kernel supports extended numbering. Have a look at
1955          * include/linux/elf.h for further information. */
1956         e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
1957
1958         /*
1959          * Collect all the non-memory information about the process for the
1960          * notes.  This also sets up the file header.
1961          */
1962         if (!fill_note_info(elf, e_phnum, &info, cprm->signr, cprm->regs))
1963                 goto cleanup;
1964
1965         has_dumped = 1;
1966         current->flags |= PF_DUMPCORE;
1967
1968         fs = get_fs();
1969         set_fs(KERNEL_DS);
1970
1971         offset += sizeof(*elf);                         /* Elf header */
1972         offset += segs * sizeof(struct elf_phdr);       /* Program headers */
1973         foffset = offset;
1974
1975         /* Write notes phdr entry */
1976         {
1977                 size_t sz = get_note_info_size(&info);
1978
1979                 sz += elf_coredump_extra_notes_size();
1980
1981                 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
1982                 if (!phdr4note)
1983                         goto end_coredump;
1984
1985                 fill_elf_note_phdr(phdr4note, sz, offset);
1986                 offset += sz;
1987         }
1988
1989         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
1990
1991         offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
1992         offset += elf_core_extra_data_size();
1993         e_shoff = offset;
1994
1995         if (e_phnum == PN_XNUM) {
1996                 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
1997                 if (!shdr4extnum)
1998                         goto end_coredump;
1999                 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2000         }
2001
2002         offset = dataoff;
2003
2004         size += sizeof(*elf);
2005         if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
2006                 goto end_coredump;
2007
2008         size += sizeof(*phdr4note);
2009         if (size > cprm->limit
2010             || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
2011                 goto end_coredump;
2012
2013         /* Write program headers for segments dump */
2014         for (vma = first_vma(current, gate_vma); vma != NULL;
2015                         vma = next_vma(vma, gate_vma)) {
2016                 struct elf_phdr phdr;
2017
2018                 phdr.p_type = PT_LOAD;
2019                 phdr.p_offset = offset;
2020                 phdr.p_vaddr = vma->vm_start;
2021                 phdr.p_paddr = 0;
2022                 phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
2023                 phdr.p_memsz = vma->vm_end - vma->vm_start;
2024                 offset += phdr.p_filesz;
2025                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2026                 if (vma->vm_flags & VM_WRITE)
2027                         phdr.p_flags |= PF_W;
2028                 if (vma->vm_flags & VM_EXEC)
2029                         phdr.p_flags |= PF_X;
2030                 phdr.p_align = ELF_EXEC_PAGESIZE;
2031
2032                 size += sizeof(phdr);
2033                 if (size > cprm->limit
2034                     || !dump_write(cprm->file, &phdr, sizeof(phdr)))
2035                         goto end_coredump;
2036         }
2037
2038         if (!elf_core_write_extra_phdrs(cprm->file, offset, &size, cprm->limit))
2039                 goto end_coredump;
2040
2041         /* write out the notes section */
2042         if (!write_note_info(&info, cprm->file, &foffset))
2043                 goto end_coredump;
2044
2045         if (elf_coredump_extra_notes_write(cprm->file, &foffset))
2046                 goto end_coredump;
2047
2048         /* Align to page */
2049         if (!dump_seek(cprm->file, dataoff - foffset))
2050                 goto end_coredump;
2051
2052         for (vma = first_vma(current, gate_vma); vma != NULL;
2053                         vma = next_vma(vma, gate_vma)) {
2054                 unsigned long addr;
2055                 unsigned long end;
2056
2057                 end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
2058
2059                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2060                         struct page *page;
2061                         int stop;
2062
2063                         page = get_dump_page(addr);
2064                         if (page) {
2065                                 void *kaddr = kmap(page);
2066                                 stop = ((size += PAGE_SIZE) > cprm->limit) ||
2067                                         !dump_write(cprm->file, kaddr,
2068                                                     PAGE_SIZE);
2069                                 kunmap(page);
2070                                 page_cache_release(page);
2071                         } else
2072                                 stop = !dump_seek(cprm->file, PAGE_SIZE);
2073                         if (stop)
2074                                 goto end_coredump;
2075                 }
2076         }
2077
2078         if (!elf_core_write_extra_data(cprm->file, &size, cprm->limit))
2079                 goto end_coredump;
2080
2081         if (e_phnum == PN_XNUM) {
2082                 size += sizeof(*shdr4extnum);
2083                 if (size > cprm->limit
2084                     || !dump_write(cprm->file, shdr4extnum,
2085                                    sizeof(*shdr4extnum)))
2086                         goto end_coredump;
2087         }
2088
2089 end_coredump:
2090         set_fs(fs);
2091
2092 cleanup:
2093         free_note_info(&info);
2094         kfree(shdr4extnum);
2095         kfree(phdr4note);
2096         kfree(elf);
2097 out:
2098         return has_dumped;
2099 }
2100
2101 #endif          /* CONFIG_ELF_CORE */
2102
2103 static int __init init_elf_binfmt(void)
2104 {
2105         register_binfmt(&elf_format);
2106         return 0;
2107 }
2108
2109 static void __exit exit_elf_binfmt(void)
2110 {
2111         /* Remove the COFF and ELF loaders. */
2112         unregister_binfmt(&elf_format);
2113 }
2114
2115 core_initcall(init_elf_binfmt);
2116 module_exit(exit_elf_binfmt);
2117 MODULE_LICENSE("GPL");