2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* linux/fs/binfmt_elf.c
|
|
|
|
*
|
|
|
|
* These are the functions used to load ELF format executables as used
|
|
|
|
* on SVr4 machines. Information on the format may be found in the book
|
|
|
|
* "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
|
|
|
|
* Tools".
|
|
|
|
*
|
|
|
|
* Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#include <linux/stat.h>
|
|
|
|
#include <linux/time.h>
|
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/mman.h>
|
|
|
|
#include <linux/a.out.h>
|
|
|
|
#include <linux/errno.h>
|
|
|
|
#include <linux/signal.h>
|
|
|
|
#include <linux/binfmts.h>
|
|
|
|
#include <linux/string.h>
|
|
|
|
#include <linux/file.h>
|
|
|
|
#include <linux/fcntl.h>
|
|
|
|
#include <linux/ptrace.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/shm.h>
|
|
|
|
#include <linux/personality.h>
|
|
|
|
#include <linux/elfcore.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/highuid.h>
|
|
|
|
#include <linux/smp.h>
|
|
|
|
#include <linux/compiler.h>
|
|
|
|
#include <linux/highmem.h>
|
|
|
|
#include <linux/pagemap.h>
|
|
|
|
#include <linux/security.h>
|
|
|
|
#include <linux/syscalls.h>
|
|
|
|
#include <linux/random.h>
|
2006-06-23 03:05:35 -06:00
|
|
|
#include <linux/elf.h>
|
2007-05-08 01:28:59 -06:00
|
|
|
#include <linux/utsname.h>
|
2005-04-16 16:20:36 -06:00
|
|
|
#include <asm/uaccess.h>
|
|
|
|
#include <asm/param.h>
|
|
|
|
#include <asm/page.h>
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
|
|
|
|
static int load_elf_library(struct file *);
|
x86: PIE executable randomization, checkpatch fixes
#39: FILE: arch/ia64/ia32/binfmt_elf32.c:229:
+elf32_map (struct file *filep, unsigned long addr, struct elf_phdr *eppnt, int prot, int type, unsigned long unused)
WARNING: no space between function name and open parenthesis '('
#39: FILE: arch/ia64/ia32/binfmt_elf32.c:229:
+elf32_map (struct file *filep, unsigned long addr, struct elf_phdr *eppnt, int prot, int type, unsigned long unused)
WARNING: line over 80 characters
#67: FILE: arch/x86/kernel/sys_x86_64.c:80:
+ new_begin = randomize_range(*begin, *begin + 0x02000000, 0);
ERROR: use tabs not spaces
#110: FILE: arch/x86/kernel/sys_x86_64.c:185:
+ ^I mm->cached_hole_size = 0;$
ERROR: use tabs not spaces
#111: FILE: arch/x86/kernel/sys_x86_64.c:186:
+ ^I^Imm->free_area_cache = mm->mmap_base;$
ERROR: use tabs not spaces
#112: FILE: arch/x86/kernel/sys_x86_64.c:187:
+ ^I}$
ERROR: use tabs not spaces
#141: FILE: arch/x86/kernel/sys_x86_64.c:216:
+ ^I^I/* remember the largest hole we saw so far */$
ERROR: use tabs not spaces
#142: FILE: arch/x86/kernel/sys_x86_64.c:217:
+ ^I^Iif (addr + mm->cached_hole_size < vma->vm_start)$
ERROR: use tabs not spaces
#143: FILE: arch/x86/kernel/sys_x86_64.c:218:
+ ^I^I mm->cached_hole_size = vma->vm_start - addr;$
ERROR: use tabs not spaces
#157: FILE: arch/x86/kernel/sys_x86_64.c:232:
+ ^Imm->free_area_cache = TASK_UNMAPPED_BASE;$
ERROR: need a space before the open parenthesis '('
#291: FILE: arch/x86/mm/mmap_64.c:101:
+ } else if(mmap_is_legacy()) {
WARNING: braces {} are not necessary for single statement blocks
#302: FILE: arch/x86/mm/mmap_64.c:112:
+ if (current->flags & PF_RANDOMIZE) {
+ mm->mmap_base += ((long)rnd) << PAGE_SHIFT;
+ }
WARNING: line over 80 characters
#314: FILE: fs/binfmt_elf.c:48:
+static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int, unsigned long);
WARNING: no space between function name and open parenthesis '('
#314: FILE: fs/binfmt_elf.c:48:
+static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int, unsigned long);
WARNING: line over 80 characters
#429: FILE: fs/binfmt_elf.c:438:
+ eppnt, elf_prot, elf_type, total_size);
ERROR: need space after that ',' (ctx:VxV)
#480: FILE: fs/binfmt_elf.c:939:
+ elf_prot, elf_flags,0);
^
total: 9 errors, 7 warnings, 461 lines checked
Your patch has style problems, please review. If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
Please run checkpatch prior to sending patches
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2008-01-30 05:31:07 -07:00
|
|
|
static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
|
|
|
|
int, int, unsigned long);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If we don't support core dumping, then supply a NULL so we
|
|
|
|
* don't even try.
|
|
|
|
*/
|
2006-01-08 02:05:25 -07:00
|
|
|
#if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
|
2007-10-17 00:26:34 -06:00
|
|
|
static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
|
2005-04-16 16:20:36 -06:00
|
|
|
#else
|
|
|
|
#define elf_core_dump NULL
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if ELF_EXEC_PAGESIZE > PAGE_SIZE
|
2006-06-23 03:05:35 -06:00
|
|
|
#define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
|
2005-04-16 16:20:36 -06:00
|
|
|
#else
|
2006-06-23 03:05:35 -06:00
|
|
|
#define ELF_MIN_ALIGN PAGE_SIZE
|
2005-04-16 16:20:36 -06:00
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifndef ELF_CORE_EFLAGS
|
|
|
|
#define ELF_CORE_EFLAGS 0
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
|
|
|
|
#define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
|
|
|
|
#define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
|
|
|
|
|
|
|
|
static struct linux_binfmt elf_format = {
|
|
|
|
.module = THIS_MODULE,
|
|
|
|
.load_binary = load_elf_binary,
|
|
|
|
.load_shlib = load_elf_library,
|
|
|
|
.core_dump = elf_core_dump,
|
2007-02-13 05:26:26 -07:00
|
|
|
.min_coredump = ELF_EXEC_PAGESIZE,
|
|
|
|
.hasvdso = 1
|
2005-04-16 16:20:36 -06:00
|
|
|
};
|
|
|
|
|
2007-07-21 05:37:32 -06:00
|
|
|
#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
static int set_brk(unsigned long start, unsigned long end)
|
|
|
|
{
|
|
|
|
start = ELF_PAGEALIGN(start);
|
|
|
|
end = ELF_PAGEALIGN(end);
|
|
|
|
if (end > start) {
|
|
|
|
unsigned long addr;
|
|
|
|
down_write(¤t->mm->mmap_sem);
|
|
|
|
addr = do_brk(start, end - start);
|
|
|
|
up_write(¤t->mm->mmap_sem);
|
|
|
|
if (BAD_ADDR(addr))
|
|
|
|
return addr;
|
|
|
|
}
|
|
|
|
current->mm->start_brk = current->mm->brk = end;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* We need to explicitly zero any fractional pages
|
|
|
|
after the data section (i.e. bss). This would
|
|
|
|
contain the junk from the file that should not
|
2006-06-23 03:05:35 -06:00
|
|
|
be in memory
|
|
|
|
*/
|
2005-04-16 16:20:36 -06:00
|
|
|
static int padzero(unsigned long elf_bss)
|
|
|
|
{
|
|
|
|
unsigned long nbyte;
|
|
|
|
|
|
|
|
nbyte = ELF_PAGEOFFSET(elf_bss);
|
|
|
|
if (nbyte) {
|
|
|
|
nbyte = ELF_MIN_ALIGN - nbyte;
|
|
|
|
if (clear_user((void __user *) elf_bss, nbyte))
|
|
|
|
return -EFAULT;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-02-03 09:05:15 -07:00
|
|
|
/* Let's use some macros to make this stack manipulation a little clearer */
|
2005-04-16 16:20:36 -06:00
|
|
|
#ifdef CONFIG_STACK_GROWSUP
|
|
|
|
#define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
|
|
|
|
#define STACK_ROUND(sp, items) \
|
|
|
|
((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
|
2006-06-23 03:05:35 -06:00
|
|
|
#define STACK_ALLOC(sp, len) ({ \
|
|
|
|
elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
|
|
|
|
old_sp; })
|
2005-04-16 16:20:36 -06:00
|
|
|
#else
|
|
|
|
#define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
|
|
|
|
#define STACK_ROUND(sp, items) \
|
|
|
|
(((unsigned long) (sp - items)) &~ 15UL)
|
|
|
|
#define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static int
|
2006-06-23 03:05:35 -06:00
|
|
|
create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
|
2005-04-16 16:20:36 -06:00
|
|
|
int interp_aout, unsigned long load_addr,
|
|
|
|
unsigned long interp_load_addr)
|
|
|
|
{
|
|
|
|
unsigned long p = bprm->p;
|
|
|
|
int argc = bprm->argc;
|
|
|
|
int envc = bprm->envc;
|
|
|
|
elf_addr_t __user *argv;
|
|
|
|
elf_addr_t __user *envp;
|
|
|
|
elf_addr_t __user *sp;
|
|
|
|
elf_addr_t __user *u_platform;
|
|
|
|
const char *k_platform = ELF_PLATFORM;
|
|
|
|
int items;
|
|
|
|
elf_addr_t *elf_info;
|
|
|
|
int ei_index = 0;
|
|
|
|
struct task_struct *tsk = current;
|
2007-07-19 02:48:16 -06:00
|
|
|
struct vm_area_struct *vma;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-10-17 00:30:24 -06:00
|
|
|
/*
|
|
|
|
* In some cases (e.g. Hyper-Threading), we want to avoid L1
|
|
|
|
* evictions by the processes running on the same package. One
|
|
|
|
* thing we can do is to shuffle the initial stack for them.
|
|
|
|
*/
|
|
|
|
|
|
|
|
p = arch_align_stack(p);
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* If this architecture has a platform capability string, copy it
|
|
|
|
* to userspace. In some cases (Sparc), this info is impossible
|
|
|
|
* for userspace to get any other way, in others (i386) it is
|
|
|
|
* merely difficult.
|
|
|
|
*/
|
|
|
|
u_platform = NULL;
|
|
|
|
if (k_platform) {
|
|
|
|
size_t len = strlen(k_platform) + 1;
|
|
|
|
|
|
|
|
u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
|
|
|
|
if (__copy_to_user(u_platform, k_platform, len))
|
|
|
|
return -EFAULT;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Create the ELF interpreter info */
|
2006-06-23 03:05:35 -06:00
|
|
|
elf_info = (elf_addr_t *)current->mm->saved_auxv;
|
2007-10-17 00:30:12 -06:00
|
|
|
/* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
|
2005-04-16 16:20:36 -06:00
|
|
|
#define NEW_AUX_ENT(id, val) \
|
2006-06-23 03:05:35 -06:00
|
|
|
do { \
|
2006-06-23 03:05:35 -06:00
|
|
|
elf_info[ei_index++] = id; \
|
|
|
|
elf_info[ei_index++] = val; \
|
2006-06-23 03:05:35 -06:00
|
|
|
} while (0)
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
#ifdef ARCH_DLINFO
|
|
|
|
/*
|
|
|
|
* ARCH_DLINFO must come first so PPC can do its special alignment of
|
|
|
|
* AUXV.
|
2007-10-17 00:30:12 -06:00
|
|
|
* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
|
|
|
|
* ARCH_DLINFO changes
|
2005-04-16 16:20:36 -06:00
|
|
|
*/
|
|
|
|
ARCH_DLINFO;
|
|
|
|
#endif
|
|
|
|
NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
|
|
|
|
NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
|
|
|
|
NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
|
|
|
|
NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
|
2006-06-23 03:05:35 -06:00
|
|
|
NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
|
2005-04-16 16:20:36 -06:00
|
|
|
NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
|
|
|
|
NEW_AUX_ENT(AT_BASE, interp_load_addr);
|
|
|
|
NEW_AUX_ENT(AT_FLAGS, 0);
|
|
|
|
NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
|
2006-06-23 03:05:35 -06:00
|
|
|
NEW_AUX_ENT(AT_UID, tsk->uid);
|
|
|
|
NEW_AUX_ENT(AT_EUID, tsk->euid);
|
|
|
|
NEW_AUX_ENT(AT_GID, tsk->gid);
|
|
|
|
NEW_AUX_ENT(AT_EGID, tsk->egid);
|
|
|
|
NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
|
2005-04-16 16:20:36 -06:00
|
|
|
if (k_platform) {
|
2006-06-23 03:05:35 -06:00
|
|
|
NEW_AUX_ENT(AT_PLATFORM,
|
2006-06-23 03:05:35 -06:00
|
|
|
(elf_addr_t)(unsigned long)u_platform);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
|
2006-06-23 03:05:35 -06:00
|
|
|
NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
#undef NEW_AUX_ENT
|
|
|
|
/* AT_NULL is zero; clear the rest too */
|
|
|
|
memset(&elf_info[ei_index], 0,
|
|
|
|
sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
|
|
|
|
|
|
|
|
/* And advance past the AT_NULL entry. */
|
|
|
|
ei_index += 2;
|
|
|
|
|
|
|
|
sp = STACK_ADD(p, ei_index);
|
|
|
|
|
|
|
|
items = (argc + 1) + (envc + 1);
|
|
|
|
if (interp_aout) {
|
|
|
|
items += 3; /* a.out interpreters require argv & envp too */
|
|
|
|
} else {
|
|
|
|
items += 1; /* ELF interpreters only put argc on the stack */
|
|
|
|
}
|
|
|
|
bprm->p = STACK_ROUND(sp, items);
|
|
|
|
|
|
|
|
/* Point sp at the lowest address on the stack */
|
|
|
|
#ifdef CONFIG_STACK_GROWSUP
|
|
|
|
sp = (elf_addr_t __user *)bprm->p - items - ei_index;
|
2006-06-23 03:05:35 -06:00
|
|
|
bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
|
2005-04-16 16:20:36 -06:00
|
|
|
#else
|
|
|
|
sp = (elf_addr_t __user *)bprm->p;
|
|
|
|
#endif
|
|
|
|
|
2007-07-19 02:48:16 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Grow the stack manually; some architectures have a limit on how
|
|
|
|
* far ahead a user-space access may be in order to grow the stack.
|
|
|
|
*/
|
|
|
|
vma = find_extend_vma(current->mm, bprm->p);
|
|
|
|
if (!vma)
|
|
|
|
return -EFAULT;
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/* Now, let's put argc (and argv, envp if appropriate) on the stack */
|
|
|
|
if (__put_user(argc, sp++))
|
|
|
|
return -EFAULT;
|
|
|
|
if (interp_aout) {
|
|
|
|
argv = sp + 2;
|
|
|
|
envp = argv + argc + 1;
|
2006-12-06 21:36:35 -07:00
|
|
|
if (__put_user((elf_addr_t)(unsigned long)argv, sp++) ||
|
|
|
|
__put_user((elf_addr_t)(unsigned long)envp, sp++))
|
|
|
|
return -EFAULT;
|
2005-04-16 16:20:36 -06:00
|
|
|
} else {
|
|
|
|
argv = sp;
|
|
|
|
envp = argv + argc + 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Populate argv and envp */
|
2005-05-11 01:10:44 -06:00
|
|
|
p = current->mm->arg_end = current->mm->arg_start;
|
2005-04-16 16:20:36 -06:00
|
|
|
while (argc-- > 0) {
|
|
|
|
size_t len;
|
2006-12-06 21:36:35 -07:00
|
|
|
if (__put_user((elf_addr_t)p, argv++))
|
|
|
|
return -EFAULT;
|
2007-07-19 02:48:16 -06:00
|
|
|
len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
|
|
|
|
if (!len || len > MAX_ARG_STRLEN)
|
2005-04-16 16:20:36 -06:00
|
|
|
return 0;
|
|
|
|
p += len;
|
|
|
|
}
|
|
|
|
if (__put_user(0, argv))
|
|
|
|
return -EFAULT;
|
|
|
|
current->mm->arg_end = current->mm->env_start = p;
|
|
|
|
while (envc-- > 0) {
|
|
|
|
size_t len;
|
2006-12-06 21:36:35 -07:00
|
|
|
if (__put_user((elf_addr_t)p, envp++))
|
|
|
|
return -EFAULT;
|
2007-07-19 02:48:16 -06:00
|
|
|
len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
|
|
|
|
if (!len || len > MAX_ARG_STRLEN)
|
2005-04-16 16:20:36 -06:00
|
|
|
return 0;
|
|
|
|
p += len;
|
|
|
|
}
|
|
|
|
if (__put_user(0, envp))
|
|
|
|
return -EFAULT;
|
|
|
|
current->mm->env_end = p;
|
|
|
|
|
|
|
|
/* Put the elf_info on the stack in the right place. */
|
|
|
|
sp = (elf_addr_t __user *)envp + 1;
|
|
|
|
if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
|
|
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifndef elf_map
|
|
|
|
|
|
|
|
static unsigned long elf_map(struct file *filep, unsigned long addr,
|
2008-01-30 05:31:07 -07:00
|
|
|
struct elf_phdr *eppnt, int prot, int type,
|
|
|
|
unsigned long total_size)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
unsigned long map_addr;
|
2008-01-30 05:31:07 -07:00
|
|
|
unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
|
|
|
|
unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
|
|
|
|
addr = ELF_PAGESTART(addr);
|
|
|
|
size = ELF_PAGEALIGN(size);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2006-01-08 02:03:35 -07:00
|
|
|
/* mmap() will return -EINVAL if given a zero size, but a
|
|
|
|
* segment with zero filesize is perfectly valid */
|
2008-01-30 05:31:07 -07:00
|
|
|
if (!size)
|
|
|
|
return addr;
|
|
|
|
|
|
|
|
down_write(¤t->mm->mmap_sem);
|
|
|
|
/*
|
|
|
|
* total_size is the size of the ELF (interpreter) image.
|
|
|
|
* The _first_ mmap needs to know the full size, otherwise
|
|
|
|
* randomization might put this image into an overlapping
|
|
|
|
* position with the ELF binary image. (since size < total_size)
|
|
|
|
* So we first map the 'big' image - and unmap the remainder at
|
|
|
|
* the end. (which unmap is needed for ELF images with holes.)
|
|
|
|
*/
|
|
|
|
if (total_size) {
|
|
|
|
total_size = ELF_PAGEALIGN(total_size);
|
|
|
|
map_addr = do_mmap(filep, addr, total_size, prot, type, off);
|
|
|
|
if (!BAD_ADDR(map_addr))
|
|
|
|
do_munmap(current->mm, map_addr+size, total_size-size);
|
|
|
|
} else
|
|
|
|
map_addr = do_mmap(filep, addr, size, prot, type, off);
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
up_write(¤t->mm->mmap_sem);
|
|
|
|
return(map_addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif /* !elf_map */
|
|
|
|
|
2008-01-30 05:31:07 -07:00
|
|
|
static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
|
|
|
|
{
|
|
|
|
int i, first_idx = -1, last_idx = -1;
|
|
|
|
|
|
|
|
for (i = 0; i < nr; i++) {
|
|
|
|
if (cmds[i].p_type == PT_LOAD) {
|
|
|
|
last_idx = i;
|
|
|
|
if (first_idx == -1)
|
|
|
|
first_idx = i;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (first_idx == -1)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
|
|
|
|
ELF_PAGESTART(cmds[first_idx].p_vaddr);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/* This is much more generalized than the library routine read function,
|
|
|
|
so we keep this separate. Technically the library read function
|
|
|
|
is only provided so that we can read a.out libraries that have
|
|
|
|
an ELF header */
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
|
2008-01-30 05:31:07 -07:00
|
|
|
struct file *interpreter, unsigned long *interp_map_addr,
|
|
|
|
unsigned long no_base)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
struct elf_phdr *elf_phdata;
|
|
|
|
struct elf_phdr *eppnt;
|
|
|
|
unsigned long load_addr = 0;
|
|
|
|
int load_addr_set = 0;
|
|
|
|
unsigned long last_bss = 0, elf_bss = 0;
|
|
|
|
unsigned long error = ~0UL;
|
2008-01-30 05:31:07 -07:00
|
|
|
unsigned long total_size;
|
2005-04-16 16:20:36 -06:00
|
|
|
int retval, i, size;
|
|
|
|
|
|
|
|
/* First of all, some simple consistency checks */
|
|
|
|
if (interp_elf_ex->e_type != ET_EXEC &&
|
|
|
|
interp_elf_ex->e_type != ET_DYN)
|
|
|
|
goto out;
|
|
|
|
if (!elf_check_arch(interp_elf_ex))
|
|
|
|
goto out;
|
|
|
|
if (!interpreter->f_op || !interpreter->f_op->mmap)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the size of this structure has changed, then punt, since
|
|
|
|
* we will be doing the wrong thing.
|
|
|
|
*/
|
|
|
|
if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
|
|
|
|
goto out;
|
|
|
|
if (interp_elf_ex->e_phnum < 1 ||
|
|
|
|
interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* Now read in all of the header information */
|
|
|
|
size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
|
|
|
|
if (size > ELF_MIN_ALIGN)
|
|
|
|
goto out;
|
2006-06-23 03:05:35 -06:00
|
|
|
elf_phdata = kmalloc(size, GFP_KERNEL);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (!elf_phdata)
|
|
|
|
goto out;
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
|
|
|
|
(char *)elf_phdata,size);
|
2005-04-16 16:20:36 -06:00
|
|
|
error = -EIO;
|
|
|
|
if (retval != size) {
|
|
|
|
if (retval < 0)
|
|
|
|
error = retval;
|
|
|
|
goto out_close;
|
|
|
|
}
|
|
|
|
|
2008-01-30 05:31:07 -07:00
|
|
|
total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
|
|
|
|
if (!total_size) {
|
|
|
|
error = -EINVAL;
|
|
|
|
goto out_close;
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
eppnt = elf_phdata;
|
2006-06-23 03:05:35 -06:00
|
|
|
for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
|
|
|
|
if (eppnt->p_type == PT_LOAD) {
|
|
|
|
int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
|
|
|
|
int elf_prot = 0;
|
|
|
|
unsigned long vaddr = 0;
|
|
|
|
unsigned long k, map_addr;
|
|
|
|
|
|
|
|
if (eppnt->p_flags & PF_R)
|
|
|
|
elf_prot = PROT_READ;
|
|
|
|
if (eppnt->p_flags & PF_W)
|
|
|
|
elf_prot |= PROT_WRITE;
|
|
|
|
if (eppnt->p_flags & PF_X)
|
|
|
|
elf_prot |= PROT_EXEC;
|
|
|
|
vaddr = eppnt->p_vaddr;
|
|
|
|
if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
|
|
|
|
elf_type |= MAP_FIXED;
|
2008-01-30 05:31:07 -07:00
|
|
|
else if (no_base && interp_elf_ex->e_type == ET_DYN)
|
|
|
|
load_addr = -vaddr;
|
2006-06-23 03:05:35 -06:00
|
|
|
|
|
|
|
map_addr = elf_map(interpreter, load_addr + vaddr,
|
x86: PIE executable randomization, checkpatch fixes
#39: FILE: arch/ia64/ia32/binfmt_elf32.c:229:
+elf32_map (struct file *filep, unsigned long addr, struct elf_phdr *eppnt, int prot, int type, unsigned long unused)
WARNING: no space between function name and open parenthesis '('
#39: FILE: arch/ia64/ia32/binfmt_elf32.c:229:
+elf32_map (struct file *filep, unsigned long addr, struct elf_phdr *eppnt, int prot, int type, unsigned long unused)
WARNING: line over 80 characters
#67: FILE: arch/x86/kernel/sys_x86_64.c:80:
+ new_begin = randomize_range(*begin, *begin + 0x02000000, 0);
ERROR: use tabs not spaces
#110: FILE: arch/x86/kernel/sys_x86_64.c:185:
+ ^I mm->cached_hole_size = 0;$
ERROR: use tabs not spaces
#111: FILE: arch/x86/kernel/sys_x86_64.c:186:
+ ^I^Imm->free_area_cache = mm->mmap_base;$
ERROR: use tabs not spaces
#112: FILE: arch/x86/kernel/sys_x86_64.c:187:
+ ^I}$
ERROR: use tabs not spaces
#141: FILE: arch/x86/kernel/sys_x86_64.c:216:
+ ^I^I/* remember the largest hole we saw so far */$
ERROR: use tabs not spaces
#142: FILE: arch/x86/kernel/sys_x86_64.c:217:
+ ^I^Iif (addr + mm->cached_hole_size < vma->vm_start)$
ERROR: use tabs not spaces
#143: FILE: arch/x86/kernel/sys_x86_64.c:218:
+ ^I^I mm->cached_hole_size = vma->vm_start - addr;$
ERROR: use tabs not spaces
#157: FILE: arch/x86/kernel/sys_x86_64.c:232:
+ ^Imm->free_area_cache = TASK_UNMAPPED_BASE;$
ERROR: need a space before the open parenthesis '('
#291: FILE: arch/x86/mm/mmap_64.c:101:
+ } else if(mmap_is_legacy()) {
WARNING: braces {} are not necessary for single statement blocks
#302: FILE: arch/x86/mm/mmap_64.c:112:
+ if (current->flags & PF_RANDOMIZE) {
+ mm->mmap_base += ((long)rnd) << PAGE_SHIFT;
+ }
WARNING: line over 80 characters
#314: FILE: fs/binfmt_elf.c:48:
+static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int, unsigned long);
WARNING: no space between function name and open parenthesis '('
#314: FILE: fs/binfmt_elf.c:48:
+static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int, unsigned long);
WARNING: line over 80 characters
#429: FILE: fs/binfmt_elf.c:438:
+ eppnt, elf_prot, elf_type, total_size);
ERROR: need space after that ',' (ctx:VxV)
#480: FILE: fs/binfmt_elf.c:939:
+ elf_prot, elf_flags,0);
^
total: 9 errors, 7 warnings, 461 lines checked
Your patch has style problems, please review. If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
Please run checkpatch prior to sending patches
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2008-01-30 05:31:07 -07:00
|
|
|
eppnt, elf_prot, elf_type, total_size);
|
2008-01-30 05:31:07 -07:00
|
|
|
total_size = 0;
|
|
|
|
if (!*interp_map_addr)
|
|
|
|
*interp_map_addr = map_addr;
|
2006-06-23 03:05:35 -06:00
|
|
|
error = map_addr;
|
|
|
|
if (BAD_ADDR(map_addr))
|
|
|
|
goto out_close;
|
|
|
|
|
|
|
|
if (!load_addr_set &&
|
|
|
|
interp_elf_ex->e_type == ET_DYN) {
|
|
|
|
load_addr = map_addr - ELF_PAGESTART(vaddr);
|
|
|
|
load_addr_set = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check to see if the section's size will overflow the
|
|
|
|
* allowed task size. Note that p_filesz must always be
|
|
|
|
* <= p_memsize so it's only necessary to check p_memsz.
|
|
|
|
*/
|
|
|
|
k = load_addr + eppnt->p_vaddr;
|
[PATCH] binfmt_elf: fix checks for bad address
Fix check for bad address; use macro instead of open-coding two checks.
Taken from RHEL4 kernel update.
From: Ernie Petrides <petrides@redhat.com>
For background, the BAD_ADDR() macro should return TRUE if the address is
TASK_SIZE, because that's the lowest address that is *not* valid for
user-space mappings. The macro was correct in binfmt_aout.c but was wrong
for the "equal to" case in binfmt_elf.c. There were two in-line validations
of user-space addresses in binfmt_elf.c, which have been appropriately
converted to use the corrected BAD_ADDR() macro in the patch you posted
yesterday. Note that the size checks against TASK_SIZE are okay as coded.
The additional changes that I propose are below. These are in the error
paths for bad ELF entry addresses once load_elf_binary() has already
committed to exec'ing the new image (following the tearing down of the
task's original address space).
The 1st hunk deals with the interp-side of the outer "if". There were two
problems here. The printk() should be removed because this path can be
triggered at will by a bogus interpreter image created and used by a
malicious user. Further, the error code should not be ENOEXEC, because that
causes the loop in search_binary_handler() to continue trying other exec
handlers (twice, in fact). But it's too late for this to work correctly,
because the user address space has already been torn down, and an exec()
failure cannot be returned to the user code because the code no longer
exists. The only recovery is to force a SIGSEGV, but it's best to terminate
the search loop immediately. I somewhat arbitrarily chose EINVAL as a
fallback error code, but any error returned by load_elf_interp() will
override that (but this value will never be seen by user-space).
The 2nd hunk deals with the non-interp-side of the outer "if". There were
two problems here as well. The SIGSEGV needs to be forced, because a prior
sigaction() syscall might have set the associated disposition to SIG_IGN.
And the ENOEXEC should be changed to EINVAL as described above.
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: Ernie Petrides <petrides@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-03 01:24:14 -06:00
|
|
|
if (BAD_ADDR(k) ||
|
2006-06-23 03:05:35 -06:00
|
|
|
eppnt->p_filesz > eppnt->p_memsz ||
|
|
|
|
eppnt->p_memsz > TASK_SIZE ||
|
|
|
|
TASK_SIZE - eppnt->p_memsz < k) {
|
|
|
|
error = -ENOMEM;
|
|
|
|
goto out_close;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Find the end of the file mapping for this phdr, and
|
|
|
|
* keep track of the largest address we see for this.
|
|
|
|
*/
|
|
|
|
k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
|
|
|
|
if (k > elf_bss)
|
|
|
|
elf_bss = k;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Do the same thing for the memory mapping - between
|
|
|
|
* elf_bss and last_bss is the bss section.
|
|
|
|
*/
|
|
|
|
k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
|
|
|
|
if (k > last_bss)
|
|
|
|
last_bss = k;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Now fill out the bss section. First pad the last page up
|
|
|
|
* to the page boundary, and then perform a mmap to make sure
|
|
|
|
* that there are zero-mapped pages up to and including the
|
|
|
|
* last bss page.
|
|
|
|
*/
|
|
|
|
if (padzero(elf_bss)) {
|
|
|
|
error = -EFAULT;
|
|
|
|
goto out_close;
|
|
|
|
}
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
/* What we have mapped so far */
|
|
|
|
elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/* Map the last of the bss segment */
|
|
|
|
if (last_bss > elf_bss) {
|
|
|
|
down_write(¤t->mm->mmap_sem);
|
|
|
|
error = do_brk(elf_bss, last_bss - elf_bss);
|
|
|
|
up_write(¤t->mm->mmap_sem);
|
|
|
|
if (BAD_ADDR(error))
|
|
|
|
goto out_close;
|
|
|
|
}
|
|
|
|
|
2008-01-30 05:31:07 -07:00
|
|
|
error = load_addr;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
out_close:
|
|
|
|
kfree(elf_phdata);
|
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
static unsigned long load_aout_interp(struct exec *interp_ex,
|
|
|
|
struct file *interpreter)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
unsigned long text_data, elf_entry = ~0UL;
|
|
|
|
char __user * addr;
|
|
|
|
loff_t offset;
|
|
|
|
|
|
|
|
current->mm->end_code = interp_ex->a_text;
|
|
|
|
text_data = interp_ex->a_text + interp_ex->a_data;
|
|
|
|
current->mm->end_data = text_data;
|
|
|
|
current->mm->brk = interp_ex->a_bss + text_data;
|
|
|
|
|
|
|
|
switch (N_MAGIC(*interp_ex)) {
|
|
|
|
case OMAGIC:
|
|
|
|
offset = 32;
|
|
|
|
addr = (char __user *)0;
|
|
|
|
break;
|
|
|
|
case ZMAGIC:
|
|
|
|
case QMAGIC:
|
|
|
|
offset = N_TXTOFF(*interp_ex);
|
2006-06-23 03:05:35 -06:00
|
|
|
addr = (char __user *)N_TXTADDR(*interp_ex);
|
2005-04-16 16:20:36 -06:00
|
|
|
break;
|
|
|
|
default:
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
down_write(¤t->mm->mmap_sem);
|
|
|
|
do_brk(0, text_data);
|
|
|
|
up_write(¤t->mm->mmap_sem);
|
|
|
|
if (!interpreter->f_op || !interpreter->f_op->read)
|
|
|
|
goto out;
|
|
|
|
if (interpreter->f_op->read(interpreter, addr, text_data, &offset) < 0)
|
|
|
|
goto out;
|
|
|
|
flush_icache_range((unsigned long)addr,
|
|
|
|
(unsigned long)addr + text_data);
|
|
|
|
|
|
|
|
down_write(¤t->mm->mmap_sem);
|
|
|
|
do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
|
|
|
|
interp_ex->a_bss);
|
|
|
|
up_write(¤t->mm->mmap_sem);
|
|
|
|
elf_entry = interp_ex->a_entry;
|
|
|
|
|
|
|
|
out:
|
|
|
|
return elf_entry;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* These are the functions used to load ELF style executables and shared
|
|
|
|
* libraries. There is no binary dependent code anywhere else.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#define INTERPRETER_NONE 0
|
|
|
|
#define INTERPRETER_AOUT 1
|
|
|
|
#define INTERPRETER_ELF 2
|
|
|
|
|
2006-03-25 08:29:09 -07:00
|
|
|
#ifndef STACK_RND_MASK
|
2007-03-16 15:38:35 -06:00
|
|
|
#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */
|
2006-03-25 08:29:09 -07:00
|
|
|
#endif
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
static unsigned long randomize_stack_top(unsigned long stack_top)
|
|
|
|
{
|
|
|
|
unsigned int random_variable = 0;
|
|
|
|
|
2006-09-26 02:52:28 -06:00
|
|
|
if ((current->flags & PF_RANDOMIZE) &&
|
|
|
|
!(current->personality & ADDR_NO_RANDOMIZE)) {
|
2006-03-25 08:29:09 -07:00
|
|
|
random_variable = get_random_int() & STACK_RND_MASK;
|
|
|
|
random_variable <<= PAGE_SHIFT;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
#ifdef CONFIG_STACK_GROWSUP
|
2006-03-25 08:29:09 -07:00
|
|
|
return PAGE_ALIGN(stack_top) + random_variable;
|
2005-04-16 16:20:36 -06:00
|
|
|
#else
|
2006-03-25 08:29:09 -07:00
|
|
|
return PAGE_ALIGN(stack_top) - random_variable;
|
2005-04-16 16:20:36 -06:00
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
struct file *interpreter = NULL; /* to shut gcc up */
|
|
|
|
unsigned long load_addr = 0, load_bias = 0;
|
|
|
|
int load_addr_set = 0;
|
|
|
|
char * elf_interpreter = NULL;
|
|
|
|
unsigned int interpreter_type = INTERPRETER_NONE;
|
|
|
|
unsigned long error;
|
2006-06-23 03:05:35 -06:00
|
|
|
struct elf_phdr *elf_ppnt, *elf_phdata;
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long elf_bss, elf_brk;
|
|
|
|
int elf_exec_fileno;
|
|
|
|
int retval, i;
|
|
|
|
unsigned int size;
|
2008-01-30 05:31:07 -07:00
|
|
|
unsigned long elf_entry;
|
|
|
|
unsigned long interp_load_addr = 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long start_code, end_code, start_data, end_data;
|
|
|
|
unsigned long reloc_func_desc = 0;
|
|
|
|
char passed_fileno[6];
|
|
|
|
struct files_struct *files;
|
2006-12-06 21:40:16 -07:00
|
|
|
int executable_stack = EXSTACK_DEFAULT;
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long def_flags = 0;
|
|
|
|
struct {
|
|
|
|
struct elfhdr elf_ex;
|
|
|
|
struct elfhdr interp_elf_ex;
|
|
|
|
struct exec interp_ex;
|
|
|
|
} *loc;
|
|
|
|
|
|
|
|
loc = kmalloc(sizeof(*loc), GFP_KERNEL);
|
|
|
|
if (!loc) {
|
|
|
|
retval = -ENOMEM;
|
|
|
|
goto out_ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Get the exec-header */
|
2006-06-23 03:05:35 -06:00
|
|
|
loc->elf_ex = *((struct elfhdr *)bprm->buf);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
retval = -ENOEXEC;
|
|
|
|
/* First of all, some simple consistency checks */
|
|
|
|
if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
|
|
|
|
goto out;
|
|
|
|
if (!elf_check_arch(&loc->elf_ex))
|
|
|
|
goto out;
|
|
|
|
if (!bprm->file->f_op||!bprm->file->f_op->mmap)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* Now read in all of the header information */
|
|
|
|
if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
|
|
|
|
goto out;
|
|
|
|
if (loc->elf_ex.e_phnum < 1 ||
|
|
|
|
loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
|
|
|
|
goto out;
|
|
|
|
size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
|
|
|
|
retval = -ENOMEM;
|
2006-06-23 03:05:35 -06:00
|
|
|
elf_phdata = kmalloc(size, GFP_KERNEL);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (!elf_phdata)
|
|
|
|
goto out;
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
|
|
|
|
(char *)elf_phdata, size);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (retval != size) {
|
|
|
|
if (retval >= 0)
|
|
|
|
retval = -EIO;
|
|
|
|
goto out_free_ph;
|
|
|
|
}
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
files = current->files; /* Refcounted so ok */
|
2005-04-16 16:20:36 -06:00
|
|
|
retval = unshare_files();
|
|
|
|
if (retval < 0)
|
|
|
|
goto out_free_ph;
|
|
|
|
if (files == current->files) {
|
|
|
|
put_files_struct(files);
|
|
|
|
files = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* exec will make our files private anyway, but for the a.out
|
|
|
|
loader stuff we need to do it earlier */
|
|
|
|
retval = get_unused_fd();
|
|
|
|
if (retval < 0)
|
|
|
|
goto out_free_fh;
|
|
|
|
get_file(bprm->file);
|
|
|
|
fd_install(elf_exec_fileno = retval, bprm->file);
|
|
|
|
|
|
|
|
elf_ppnt = elf_phdata;
|
|
|
|
elf_bss = 0;
|
|
|
|
elf_brk = 0;
|
|
|
|
|
|
|
|
start_code = ~0UL;
|
|
|
|
end_code = 0;
|
|
|
|
start_data = 0;
|
|
|
|
end_data = 0;
|
|
|
|
|
|
|
|
for (i = 0; i < loc->elf_ex.e_phnum; i++) {
|
|
|
|
if (elf_ppnt->p_type == PT_INTERP) {
|
|
|
|
/* This is the program interpreter used for
|
|
|
|
* shared libraries - for now assume that this
|
|
|
|
* is an a.out format binary
|
|
|
|
*/
|
|
|
|
retval = -ENOEXEC;
|
|
|
|
if (elf_ppnt->p_filesz > PATH_MAX ||
|
|
|
|
elf_ppnt->p_filesz < 2)
|
|
|
|
goto out_free_file;
|
|
|
|
|
|
|
|
retval = -ENOMEM;
|
2006-01-09 21:54:45 -07:00
|
|
|
elf_interpreter = kmalloc(elf_ppnt->p_filesz,
|
2006-06-23 03:05:35 -06:00
|
|
|
GFP_KERNEL);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (!elf_interpreter)
|
|
|
|
goto out_free_file;
|
|
|
|
|
|
|
|
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
|
2006-06-23 03:05:35 -06:00
|
|
|
elf_interpreter,
|
|
|
|
elf_ppnt->p_filesz);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (retval != elf_ppnt->p_filesz) {
|
|
|
|
if (retval >= 0)
|
|
|
|
retval = -EIO;
|
|
|
|
goto out_free_interp;
|
|
|
|
}
|
|
|
|
/* make sure path is NULL terminated */
|
|
|
|
retval = -ENOEXEC;
|
|
|
|
if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
|
|
|
|
goto out_free_interp;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The early SET_PERSONALITY here is so that the lookup
|
|
|
|
* for the interpreter happens in the namespace of the
|
|
|
|
* to-be-execed image. SET_PERSONALITY can select an
|
|
|
|
* alternate root.
|
|
|
|
*
|
|
|
|
* However, SET_PERSONALITY is NOT allowed to switch
|
|
|
|
* this task into the new images's memory mapping
|
|
|
|
* policy - that is, TASK_SIZE must still evaluate to
|
|
|
|
* that which is appropriate to the execing application.
|
|
|
|
* This is because exit_mmap() needs to have TASK_SIZE
|
|
|
|
* evaluate to the size of the old image.
|
|
|
|
*
|
|
|
|
* So if (say) a 64-bit application is execing a 32-bit
|
|
|
|
* application it is the architecture's responsibility
|
|
|
|
* to defer changing the value of TASK_SIZE until the
|
|
|
|
* switch really is going to happen - do this in
|
|
|
|
* flush_thread(). - akpm
|
|
|
|
*/
|
2008-01-30 05:33:32 -07:00
|
|
|
SET_PERSONALITY(loc->elf_ex, 0);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
interpreter = open_exec(elf_interpreter);
|
|
|
|
retval = PTR_ERR(interpreter);
|
|
|
|
if (IS_ERR(interpreter))
|
|
|
|
goto out_free_interp;
|
2007-01-26 01:57:16 -07:00
|
|
|
|
|
|
|
/*
|
|
|
|
* If the binary is not readable then enforce
|
|
|
|
* mm->dumpable = 0 regardless of the interpreter's
|
|
|
|
* permissions.
|
|
|
|
*/
|
|
|
|
if (file_permission(interpreter, MAY_READ) < 0)
|
|
|
|
bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
retval = kernel_read(interpreter, 0, bprm->buf,
|
|
|
|
BINPRM_BUF_SIZE);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (retval != BINPRM_BUF_SIZE) {
|
|
|
|
if (retval >= 0)
|
|
|
|
retval = -EIO;
|
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Get the exec headers */
|
2006-06-23 03:05:35 -06:00
|
|
|
loc->interp_ex = *((struct exec *)bprm->buf);
|
|
|
|
loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
|
2005-04-16 16:20:36 -06:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
elf_ppnt++;
|
|
|
|
}
|
|
|
|
|
|
|
|
elf_ppnt = elf_phdata;
|
|
|
|
for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
|
|
|
|
if (elf_ppnt->p_type == PT_GNU_STACK) {
|
|
|
|
if (elf_ppnt->p_flags & PF_X)
|
|
|
|
executable_stack = EXSTACK_ENABLE_X;
|
|
|
|
else
|
|
|
|
executable_stack = EXSTACK_DISABLE_X;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Some simple consistency checks for the interpreter */
|
|
|
|
if (elf_interpreter) {
|
2007-10-17 00:26:48 -06:00
|
|
|
static int warn;
|
2005-04-16 16:20:36 -06:00
|
|
|
interpreter_type = INTERPRETER_ELF | INTERPRETER_AOUT;
|
|
|
|
|
|
|
|
/* Now figure out which format our binary is */
|
|
|
|
if ((N_MAGIC(loc->interp_ex) != OMAGIC) &&
|
|
|
|
(N_MAGIC(loc->interp_ex) != ZMAGIC) &&
|
|
|
|
(N_MAGIC(loc->interp_ex) != QMAGIC))
|
|
|
|
interpreter_type = INTERPRETER_ELF;
|
|
|
|
|
|
|
|
if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
|
|
|
|
interpreter_type &= ~INTERPRETER_ELF;
|
|
|
|
|
2007-10-17 00:26:48 -06:00
|
|
|
if (interpreter_type == INTERPRETER_AOUT && warn < 10) {
|
|
|
|
printk(KERN_WARNING "a.out ELF interpreter %s is "
|
|
|
|
"deprecated and will not be supported "
|
|
|
|
"after Linux 2.6.25\n", elf_interpreter);
|
|
|
|
warn++;
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
retval = -ELIBBAD;
|
|
|
|
if (!interpreter_type)
|
|
|
|
goto out_free_dentry;
|
|
|
|
|
|
|
|
/* Make sure only one type was selected */
|
|
|
|
if ((interpreter_type & INTERPRETER_ELF) &&
|
|
|
|
interpreter_type != INTERPRETER_ELF) {
|
|
|
|
// FIXME - ratelimit this before re-enabling
|
|
|
|
// printk(KERN_WARNING "ELF: Ambiguous type, using ELF\n");
|
|
|
|
interpreter_type = INTERPRETER_ELF;
|
|
|
|
}
|
|
|
|
/* Verify the interpreter has a valid arch */
|
|
|
|
if ((interpreter_type == INTERPRETER_ELF) &&
|
|
|
|
!elf_check_arch(&loc->interp_elf_ex))
|
|
|
|
goto out_free_dentry;
|
|
|
|
} else {
|
|
|
|
/* Executables without an interpreter also need a personality */
|
2008-01-30 05:33:32 -07:00
|
|
|
SET_PERSONALITY(loc->elf_ex, 0);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
/* OK, we are done with that, now set up the arg stuff,
|
|
|
|
and then start this sucker up */
|
|
|
|
if ((!bprm->sh_bang) && (interpreter_type == INTERPRETER_AOUT)) {
|
|
|
|
char *passed_p = passed_fileno;
|
|
|
|
sprintf(passed_fileno, "%d", elf_exec_fileno);
|
|
|
|
|
|
|
|
if (elf_interpreter) {
|
|
|
|
retval = copy_strings_kernel(1, &passed_p, bprm);
|
|
|
|
if (retval)
|
|
|
|
goto out_free_dentry;
|
|
|
|
bprm->argc++;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Flush all traces of the currently running executable */
|
|
|
|
retval = flush_old_exec(bprm);
|
|
|
|
if (retval)
|
|
|
|
goto out_free_dentry;
|
|
|
|
|
|
|
|
/* Discard our unneeded old files struct */
|
|
|
|
if (files) {
|
|
|
|
put_files_struct(files);
|
|
|
|
files = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* OK, This is the point of no return */
|
|
|
|
current->flags &= ~PF_FORKNOEXEC;
|
|
|
|
current->mm->def_flags = def_flags;
|
|
|
|
|
|
|
|
/* Do this immediately, since STACK_TOP as used in setup_arg_pages
|
|
|
|
may depend on the personality. */
|
2008-01-30 05:33:32 -07:00
|
|
|
SET_PERSONALITY(loc->elf_ex, 0);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (elf_read_implies_exec(loc->elf_ex, executable_stack))
|
|
|
|
current->personality |= READ_IMPLIES_EXEC;
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
|
2005-04-16 16:20:36 -06:00
|
|
|
current->flags |= PF_RANDOMIZE;
|
|
|
|
arch_pick_mmap_layout(current->mm);
|
|
|
|
|
|
|
|
/* Do this so that we can load the interpreter, if need be. We will
|
|
|
|
change some of these later */
|
|
|
|
current->mm->free_area_cache = current->mm->mmap_base;
|
2005-06-21 18:14:49 -06:00
|
|
|
current->mm->cached_hole_size = 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
|
|
|
|
executable_stack);
|
|
|
|
if (retval < 0) {
|
|
|
|
send_sig(SIGKILL, current, 0);
|
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
|
|
|
|
|
|
|
current->mm->start_stack = bprm->p;
|
|
|
|
|
|
|
|
/* Now we do a little grungy work by mmaping the ELF image into
|
2008-01-30 05:31:07 -07:00
|
|
|
the correct location in memory. */
|
2006-06-23 03:05:35 -06:00
|
|
|
for(i = 0, elf_ppnt = elf_phdata;
|
|
|
|
i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
|
2005-04-16 16:20:36 -06:00
|
|
|
int elf_prot = 0, elf_flags;
|
|
|
|
unsigned long k, vaddr;
|
|
|
|
|
|
|
|
if (elf_ppnt->p_type != PT_LOAD)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
if (unlikely (elf_brk > elf_bss)) {
|
|
|
|
unsigned long nbyte;
|
|
|
|
|
|
|
|
/* There was a PT_LOAD segment with p_memsz > p_filesz
|
|
|
|
before this one. Map anonymous pages, if needed,
|
|
|
|
and clear the area. */
|
|
|
|
retval = set_brk (elf_bss + load_bias,
|
|
|
|
elf_brk + load_bias);
|
|
|
|
if (retval) {
|
|
|
|
send_sig(SIGKILL, current, 0);
|
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
|
|
|
nbyte = ELF_PAGEOFFSET(elf_bss);
|
|
|
|
if (nbyte) {
|
|
|
|
nbyte = ELF_MIN_ALIGN - nbyte;
|
|
|
|
if (nbyte > elf_brk - elf_bss)
|
|
|
|
nbyte = elf_brk - elf_bss;
|
|
|
|
if (clear_user((void __user *)elf_bss +
|
|
|
|
load_bias, nbyte)) {
|
|
|
|
/*
|
|
|
|
* This bss-zeroing can fail if the ELF
|
2006-06-23 03:05:35 -06:00
|
|
|
* file specifies odd protections. So
|
2005-04-16 16:20:36 -06:00
|
|
|
* we don't check the return value
|
|
|
|
*/
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
if (elf_ppnt->p_flags & PF_R)
|
|
|
|
elf_prot |= PROT_READ;
|
|
|
|
if (elf_ppnt->p_flags & PF_W)
|
|
|
|
elf_prot |= PROT_WRITE;
|
|
|
|
if (elf_ppnt->p_flags & PF_X)
|
|
|
|
elf_prot |= PROT_EXEC;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
vaddr = elf_ppnt->p_vaddr;
|
|
|
|
if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
|
|
|
|
elf_flags |= MAP_FIXED;
|
|
|
|
} else if (loc->elf_ex.e_type == ET_DYN) {
|
2006-06-23 03:05:35 -06:00
|
|
|
/* Try and get dynamic programs out of the way of the
|
|
|
|
* default mmap base, as well as whatever program they
|
|
|
|
* might try to exec. This is because the brk will
|
|
|
|
* follow the loader, and is not movable. */
|
2008-01-30 05:31:07 -07:00
|
|
|
#ifdef CONFIG_X86
|
|
|
|
load_bias = 0;
|
|
|
|
#else
|
2007-01-06 14:28:21 -07:00
|
|
|
load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
|
2008-01-30 05:31:07 -07:00
|
|
|
#endif
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
|
x86: PIE executable randomization, checkpatch fixes
#39: FILE: arch/ia64/ia32/binfmt_elf32.c:229:
+elf32_map (struct file *filep, unsigned long addr, struct elf_phdr *eppnt, int prot, int type, unsigned long unused)
WARNING: no space between function name and open parenthesis '('
#39: FILE: arch/ia64/ia32/binfmt_elf32.c:229:
+elf32_map (struct file *filep, unsigned long addr, struct elf_phdr *eppnt, int prot, int type, unsigned long unused)
WARNING: line over 80 characters
#67: FILE: arch/x86/kernel/sys_x86_64.c:80:
+ new_begin = randomize_range(*begin, *begin + 0x02000000, 0);
ERROR: use tabs not spaces
#110: FILE: arch/x86/kernel/sys_x86_64.c:185:
+ ^I mm->cached_hole_size = 0;$
ERROR: use tabs not spaces
#111: FILE: arch/x86/kernel/sys_x86_64.c:186:
+ ^I^Imm->free_area_cache = mm->mmap_base;$
ERROR: use tabs not spaces
#112: FILE: arch/x86/kernel/sys_x86_64.c:187:
+ ^I}$
ERROR: use tabs not spaces
#141: FILE: arch/x86/kernel/sys_x86_64.c:216:
+ ^I^I/* remember the largest hole we saw so far */$
ERROR: use tabs not spaces
#142: FILE: arch/x86/kernel/sys_x86_64.c:217:
+ ^I^Iif (addr + mm->cached_hole_size < vma->vm_start)$
ERROR: use tabs not spaces
#143: FILE: arch/x86/kernel/sys_x86_64.c:218:
+ ^I^I mm->cached_hole_size = vma->vm_start - addr;$
ERROR: use tabs not spaces
#157: FILE: arch/x86/kernel/sys_x86_64.c:232:
+ ^Imm->free_area_cache = TASK_UNMAPPED_BASE;$
ERROR: need a space before the open parenthesis '('
#291: FILE: arch/x86/mm/mmap_64.c:101:
+ } else if(mmap_is_legacy()) {
WARNING: braces {} are not necessary for single statement blocks
#302: FILE: arch/x86/mm/mmap_64.c:112:
+ if (current->flags & PF_RANDOMIZE) {
+ mm->mmap_base += ((long)rnd) << PAGE_SHIFT;
+ }
WARNING: line over 80 characters
#314: FILE: fs/binfmt_elf.c:48:
+static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int, unsigned long);
WARNING: no space between function name and open parenthesis '('
#314: FILE: fs/binfmt_elf.c:48:
+static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int, unsigned long);
WARNING: line over 80 characters
#429: FILE: fs/binfmt_elf.c:438:
+ eppnt, elf_prot, elf_type, total_size);
ERROR: need space after that ',' (ctx:VxV)
#480: FILE: fs/binfmt_elf.c:939:
+ elf_prot, elf_flags,0);
^
total: 9 errors, 7 warnings, 461 lines checked
Your patch has style problems, please review. If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
Please run checkpatch prior to sending patches
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2008-01-30 05:31:07 -07:00
|
|
|
elf_prot, elf_flags, 0);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (BAD_ADDR(error)) {
|
|
|
|
send_sig(SIGKILL, current, 0);
|
2007-05-08 01:31:57 -06:00
|
|
|
retval = IS_ERR((void *)error) ?
|
|
|
|
PTR_ERR((void*)error) : -EINVAL;
|
2005-04-16 16:20:36 -06:00
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!load_addr_set) {
|
|
|
|
load_addr_set = 1;
|
|
|
|
load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
|
|
|
|
if (loc->elf_ex.e_type == ET_DYN) {
|
|
|
|
load_bias += error -
|
|
|
|
ELF_PAGESTART(load_bias + vaddr);
|
|
|
|
load_addr += load_bias;
|
|
|
|
reloc_func_desc = load_bias;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
k = elf_ppnt->p_vaddr;
|
2006-06-23 03:05:35 -06:00
|
|
|
if (k < start_code)
|
|
|
|
start_code = k;
|
|
|
|
if (start_data < k)
|
|
|
|
start_data = k;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Check to see if the section's size will overflow the
|
|
|
|
* allowed task size. Note that p_filesz must always be
|
|
|
|
* <= p_memsz so it is only necessary to check p_memsz.
|
|
|
|
*/
|
[PATCH] binfmt_elf: fix checks for bad address
Fix check for bad address; use macro instead of open-coding two checks.
Taken from RHEL4 kernel update.
From: Ernie Petrides <petrides@redhat.com>
For background, the BAD_ADDR() macro should return TRUE if the address is
TASK_SIZE, because that's the lowest address that is *not* valid for
user-space mappings. The macro was correct in binfmt_aout.c but was wrong
for the "equal to" case in binfmt_elf.c. There were two in-line validations
of user-space addresses in binfmt_elf.c, which have been appropriately
converted to use the corrected BAD_ADDR() macro in the patch you posted
yesterday. Note that the size checks against TASK_SIZE are okay as coded.
The additional changes that I propose are below. These are in the error
paths for bad ELF entry addresses once load_elf_binary() has already
committed to exec'ing the new image (following the tearing down of the
task's original address space).
The 1st hunk deals with the interp-side of the outer "if". There were two
problems here. The printk() should be removed because this path can be
triggered at will by a bogus interpreter image created and used by a
malicious user. Further, the error code should not be ENOEXEC, because that
causes the loop in search_binary_handler() to continue trying other exec
handlers (twice, in fact). But it's too late for this to work correctly,
because the user address space has already been torn down, and an exec()
failure cannot be returned to the user code because the code no longer
exists. The only recovery is to force a SIGSEGV, but it's best to terminate
the search loop immediately. I somewhat arbitrarily chose EINVAL as a
fallback error code, but any error returned by load_elf_interp() will
override that (but this value will never be seen by user-space).
The 2nd hunk deals with the non-interp-side of the outer "if". There were
two problems here as well. The SIGSEGV needs to be forced, because a prior
sigaction() syscall might have set the associated disposition to SIG_IGN.
And the ENOEXEC should be changed to EINVAL as described above.
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: Ernie Petrides <petrides@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-03 01:24:14 -06:00
|
|
|
if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
|
2005-04-16 16:20:36 -06:00
|
|
|
elf_ppnt->p_memsz > TASK_SIZE ||
|
|
|
|
TASK_SIZE - elf_ppnt->p_memsz < k) {
|
2006-06-23 03:05:35 -06:00
|
|
|
/* set_brk can never work. Avoid overflows. */
|
2005-04-16 16:20:36 -06:00
|
|
|
send_sig(SIGKILL, current, 0);
|
2007-05-08 01:31:57 -06:00
|
|
|
retval = -EINVAL;
|
2005-04-16 16:20:36 -06:00
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
|
|
|
|
|
|
|
k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
|
|
|
|
|
|
|
|
if (k > elf_bss)
|
|
|
|
elf_bss = k;
|
|
|
|
if ((elf_ppnt->p_flags & PF_X) && end_code < k)
|
|
|
|
end_code = k;
|
|
|
|
if (end_data < k)
|
|
|
|
end_data = k;
|
|
|
|
k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
|
|
|
|
if (k > elf_brk)
|
|
|
|
elf_brk = k;
|
|
|
|
}
|
|
|
|
|
|
|
|
loc->elf_ex.e_entry += load_bias;
|
|
|
|
elf_bss += load_bias;
|
|
|
|
elf_brk += load_bias;
|
|
|
|
start_code += load_bias;
|
|
|
|
end_code += load_bias;
|
|
|
|
start_data += load_bias;
|
|
|
|
end_data += load_bias;
|
|
|
|
|
|
|
|
/* Calling set_brk effectively mmaps the pages that we need
|
|
|
|
* for the bss and break sections. We must do this before
|
|
|
|
* mapping in the interpreter, to make sure it doesn't wind
|
|
|
|
* up getting placed where the bss needs to go.
|
|
|
|
*/
|
|
|
|
retval = set_brk(elf_bss, elf_brk);
|
|
|
|
if (retval) {
|
|
|
|
send_sig(SIGKILL, current, 0);
|
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
2005-10-11 09:29:08 -06:00
|
|
|
if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
|
2005-04-16 16:20:36 -06:00
|
|
|
send_sig(SIGSEGV, current, 0);
|
|
|
|
retval = -EFAULT; /* Nobody gets to see this, but.. */
|
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (elf_interpreter) {
|
2008-01-30 05:31:07 -07:00
|
|
|
if (interpreter_type == INTERPRETER_AOUT) {
|
2005-04-16 16:20:36 -06:00
|
|
|
elf_entry = load_aout_interp(&loc->interp_ex,
|
|
|
|
interpreter);
|
2008-01-30 05:31:07 -07:00
|
|
|
} else {
|
|
|
|
unsigned long uninitialized_var(interp_map_addr);
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
elf_entry = load_elf_interp(&loc->interp_elf_ex,
|
|
|
|
interpreter,
|
2008-01-30 05:31:07 -07:00
|
|
|
&interp_map_addr,
|
|
|
|
load_bias);
|
|
|
|
if (!IS_ERR((void *)elf_entry)) {
|
|
|
|
/*
|
|
|
|
* load_elf_interp() returns relocation
|
|
|
|
* adjustment
|
|
|
|
*/
|
|
|
|
interp_load_addr = elf_entry;
|
|
|
|
elf_entry += loc->interp_elf_ex.e_entry;
|
|
|
|
}
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
if (BAD_ADDR(elf_entry)) {
|
|
|
|
force_sig(SIGSEGV, current);
|
[PATCH] binfmt_elf: fix checks for bad address
Fix check for bad address; use macro instead of open-coding two checks.
Taken from RHEL4 kernel update.
From: Ernie Petrides <petrides@redhat.com>
For background, the BAD_ADDR() macro should return TRUE if the address is
TASK_SIZE, because that's the lowest address that is *not* valid for
user-space mappings. The macro was correct in binfmt_aout.c but was wrong
for the "equal to" case in binfmt_elf.c. There were two in-line validations
of user-space addresses in binfmt_elf.c, which have been appropriately
converted to use the corrected BAD_ADDR() macro in the patch you posted
yesterday. Note that the size checks against TASK_SIZE are okay as coded.
The additional changes that I propose are below. These are in the error
paths for bad ELF entry addresses once load_elf_binary() has already
committed to exec'ing the new image (following the tearing down of the
task's original address space).
The 1st hunk deals with the interp-side of the outer "if". There were two
problems here. The printk() should be removed because this path can be
triggered at will by a bogus interpreter image created and used by a
malicious user. Further, the error code should not be ENOEXEC, because that
causes the loop in search_binary_handler() to continue trying other exec
handlers (twice, in fact). But it's too late for this to work correctly,
because the user address space has already been torn down, and an exec()
failure cannot be returned to the user code because the code no longer
exists. The only recovery is to force a SIGSEGV, but it's best to terminate
the search loop immediately. I somewhat arbitrarily chose EINVAL as a
fallback error code, but any error returned by load_elf_interp() will
override that (but this value will never be seen by user-space).
The 2nd hunk deals with the non-interp-side of the outer "if". There were
two problems here as well. The SIGSEGV needs to be forced, because a prior
sigaction() syscall might have set the associated disposition to SIG_IGN.
And the ENOEXEC should be changed to EINVAL as described above.
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: Ernie Petrides <petrides@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-03 01:24:14 -06:00
|
|
|
retval = IS_ERR((void *)elf_entry) ?
|
|
|
|
(int)elf_entry : -EINVAL;
|
2005-04-16 16:20:36 -06:00
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
|
|
|
reloc_func_desc = interp_load_addr;
|
|
|
|
|
|
|
|
allow_write_access(interpreter);
|
|
|
|
fput(interpreter);
|
|
|
|
kfree(elf_interpreter);
|
|
|
|
} else {
|
|
|
|
elf_entry = loc->elf_ex.e_entry;
|
2006-02-25 20:18:28 -07:00
|
|
|
if (BAD_ADDR(elf_entry)) {
|
[PATCH] binfmt_elf: fix checks for bad address
Fix check for bad address; use macro instead of open-coding two checks.
Taken from RHEL4 kernel update.
From: Ernie Petrides <petrides@redhat.com>
For background, the BAD_ADDR() macro should return TRUE if the address is
TASK_SIZE, because that's the lowest address that is *not* valid for
user-space mappings. The macro was correct in binfmt_aout.c but was wrong
for the "equal to" case in binfmt_elf.c. There were two in-line validations
of user-space addresses in binfmt_elf.c, which have been appropriately
converted to use the corrected BAD_ADDR() macro in the patch you posted
yesterday. Note that the size checks against TASK_SIZE are okay as coded.
The additional changes that I propose are below. These are in the error
paths for bad ELF entry addresses once load_elf_binary() has already
committed to exec'ing the new image (following the tearing down of the
task's original address space).
The 1st hunk deals with the interp-side of the outer "if". There were two
problems here. The printk() should be removed because this path can be
triggered at will by a bogus interpreter image created and used by a
malicious user. Further, the error code should not be ENOEXEC, because that
causes the loop in search_binary_handler() to continue trying other exec
handlers (twice, in fact). But it's too late for this to work correctly,
because the user address space has already been torn down, and an exec()
failure cannot be returned to the user code because the code no longer
exists. The only recovery is to force a SIGSEGV, but it's best to terminate
the search loop immediately. I somewhat arbitrarily chose EINVAL as a
fallback error code, but any error returned by load_elf_interp() will
override that (but this value will never be seen by user-space).
The 2nd hunk deals with the non-interp-side of the outer "if". There were
two problems here as well. The SIGSEGV needs to be forced, because a prior
sigaction() syscall might have set the associated disposition to SIG_IGN.
And the ENOEXEC should be changed to EINVAL as described above.
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: Ernie Petrides <petrides@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-03 01:24:14 -06:00
|
|
|
force_sig(SIGSEGV, current);
|
|
|
|
retval = -EINVAL;
|
2006-02-25 20:18:28 -07:00
|
|
|
goto out_free_dentry;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
kfree(elf_phdata);
|
|
|
|
|
|
|
|
if (interpreter_type != INTERPRETER_AOUT)
|
|
|
|
sys_close(elf_exec_fileno);
|
|
|
|
|
|
|
|
set_binfmt(&elf_format);
|
|
|
|
|
2005-04-16 16:24:35 -06:00
|
|
|
#ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
|
|
|
|
retval = arch_setup_additional_pages(bprm, executable_stack);
|
|
|
|
if (retval < 0) {
|
|
|
|
send_sig(SIGKILL, current, 0);
|
2005-04-28 16:17:19 -06:00
|
|
|
goto out;
|
2005-04-16 16:24:35 -06:00
|
|
|
}
|
|
|
|
#endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
compute_creds(bprm);
|
|
|
|
current->flags &= ~PF_FORKNOEXEC;
|
2007-07-19 02:48:16 -06:00
|
|
|
retval = create_elf_tables(bprm, &loc->elf_ex,
|
2006-06-23 03:05:35 -06:00
|
|
|
(interpreter_type == INTERPRETER_AOUT),
|
|
|
|
load_addr, interp_load_addr);
|
2007-07-19 02:48:16 -06:00
|
|
|
if (retval < 0) {
|
|
|
|
send_sig(SIGKILL, current, 0);
|
|
|
|
goto out;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
/* N.B. passed_fileno might not be initialized? */
|
|
|
|
if (interpreter_type == INTERPRETER_AOUT)
|
|
|
|
current->mm->arg_start += strlen(passed_fileno) + 1;
|
|
|
|
current->mm->end_code = end_code;
|
|
|
|
current->mm->start_code = start_code;
|
|
|
|
current->mm->start_data = start_data;
|
|
|
|
current->mm->end_data = end_data;
|
|
|
|
current->mm->start_stack = bprm->p;
|
|
|
|
|
2008-01-30 05:30:40 -07:00
|
|
|
#ifdef arch_randomize_brk
|
|
|
|
if (current->flags & PF_RANDOMIZE)
|
|
|
|
current->mm->brk = current->mm->start_brk =
|
|
|
|
arch_randomize_brk(current->mm);
|
|
|
|
#endif
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
if (current->personality & MMAP_PAGE_ZERO) {
|
|
|
|
/* Why this, you ask??? Well SVr4 maps page 0 as read-only,
|
|
|
|
and some applications "depend" upon this behavior.
|
|
|
|
Since we do not have the power to recompile these, we
|
2006-06-23 03:05:35 -06:00
|
|
|
emulate the SVr4 behavior. Sigh. */
|
2005-04-16 16:20:36 -06:00
|
|
|
down_write(¤t->mm->mmap_sem);
|
|
|
|
error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
|
|
|
|
MAP_FIXED | MAP_PRIVATE, 0);
|
|
|
|
up_write(¤t->mm->mmap_sem);
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef ELF_PLAT_INIT
|
|
|
|
/*
|
|
|
|
* The ABI may specify that certain registers be set up in special
|
|
|
|
* ways (on i386 %edx is the address of a DT_FINI function, for
|
|
|
|
* example. In addition, it may also specify (eg, PowerPC64 ELF)
|
|
|
|
* that the e_entry field is the address of the function descriptor
|
|
|
|
* for the startup routine, rather than the address of the startup
|
|
|
|
* routine itself. This macro performs whatever initialization to
|
|
|
|
* the regs structure is required as well as any relocations to the
|
|
|
|
* function descriptor entries when executing dynamically links apps.
|
|
|
|
*/
|
|
|
|
ELF_PLAT_INIT(regs, reloc_func_desc);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
start_thread(regs, elf_entry, bprm->p);
|
|
|
|
if (unlikely(current->ptrace & PT_PTRACED)) {
|
|
|
|
if (current->ptrace & PT_TRACE_EXEC)
|
|
|
|
ptrace_notify ((PTRACE_EVENT_EXEC << 8) | SIGTRAP);
|
|
|
|
else
|
|
|
|
send_sig(SIGTRAP, current, 0);
|
|
|
|
}
|
|
|
|
retval = 0;
|
|
|
|
out:
|
|
|
|
kfree(loc);
|
|
|
|
out_ret:
|
|
|
|
return retval;
|
|
|
|
|
|
|
|
/* error cleanup */
|
|
|
|
out_free_dentry:
|
|
|
|
allow_write_access(interpreter);
|
|
|
|
if (interpreter)
|
|
|
|
fput(interpreter);
|
|
|
|
out_free_interp:
|
2005-11-07 02:01:34 -07:00
|
|
|
kfree(elf_interpreter);
|
2005-04-16 16:20:36 -06:00
|
|
|
out_free_file:
|
|
|
|
sys_close(elf_exec_fileno);
|
|
|
|
out_free_fh:
|
2006-09-29 03:00:05 -06:00
|
|
|
if (files)
|
|
|
|
reset_files_struct(current, files);
|
2005-04-16 16:20:36 -06:00
|
|
|
out_free_ph:
|
|
|
|
kfree(elf_phdata);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* This is really simpleminded and specialized - we are loading an
|
|
|
|
a.out library that is given an ELF header. */
|
|
|
|
static int load_elf_library(struct file *file)
|
|
|
|
{
|
|
|
|
struct elf_phdr *elf_phdata;
|
|
|
|
struct elf_phdr *eppnt;
|
|
|
|
unsigned long elf_bss, bss, len;
|
|
|
|
int retval, error, i, j;
|
|
|
|
struct elfhdr elf_ex;
|
|
|
|
|
|
|
|
error = -ENOEXEC;
|
2006-06-23 03:05:35 -06:00
|
|
|
retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
|
2005-04-16 16:20:36 -06:00
|
|
|
if (retval != sizeof(elf_ex))
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* First of all, some simple consistency checks */
|
|
|
|
if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
|
2006-06-23 03:05:35 -06:00
|
|
|
!elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
|
2005-04-16 16:20:36 -06:00
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* Now read in all of the header information */
|
|
|
|
|
|
|
|
j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
|
|
|
|
/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
|
|
|
|
|
|
|
|
error = -ENOMEM;
|
|
|
|
elf_phdata = kmalloc(j, GFP_KERNEL);
|
|
|
|
if (!elf_phdata)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
eppnt = elf_phdata;
|
|
|
|
error = -ENOEXEC;
|
|
|
|
retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
|
|
|
|
if (retval != j)
|
|
|
|
goto out_free_ph;
|
|
|
|
|
|
|
|
for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
|
|
|
|
if ((eppnt + i)->p_type == PT_LOAD)
|
|
|
|
j++;
|
|
|
|
if (j != 1)
|
|
|
|
goto out_free_ph;
|
|
|
|
|
|
|
|
while (eppnt->p_type != PT_LOAD)
|
|
|
|
eppnt++;
|
|
|
|
|
|
|
|
/* Now use mmap to map the library into memory. */
|
|
|
|
down_write(¤t->mm->mmap_sem);
|
|
|
|
error = do_mmap(file,
|
|
|
|
ELF_PAGESTART(eppnt->p_vaddr),
|
|
|
|
(eppnt->p_filesz +
|
|
|
|
ELF_PAGEOFFSET(eppnt->p_vaddr)),
|
|
|
|
PROT_READ | PROT_WRITE | PROT_EXEC,
|
|
|
|
MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
|
|
|
|
(eppnt->p_offset -
|
|
|
|
ELF_PAGEOFFSET(eppnt->p_vaddr)));
|
|
|
|
up_write(¤t->mm->mmap_sem);
|
|
|
|
if (error != ELF_PAGESTART(eppnt->p_vaddr))
|
|
|
|
goto out_free_ph;
|
|
|
|
|
|
|
|
elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
|
|
|
|
if (padzero(elf_bss)) {
|
|
|
|
error = -EFAULT;
|
|
|
|
goto out_free_ph;
|
|
|
|
}
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
|
|
|
|
ELF_MIN_ALIGN - 1);
|
2005-04-16 16:20:36 -06:00
|
|
|
bss = eppnt->p_memsz + eppnt->p_vaddr;
|
|
|
|
if (bss > len) {
|
|
|
|
down_write(¤t->mm->mmap_sem);
|
|
|
|
do_brk(len, bss - len);
|
|
|
|
up_write(¤t->mm->mmap_sem);
|
|
|
|
}
|
|
|
|
error = 0;
|
|
|
|
|
|
|
|
out_free_ph:
|
|
|
|
kfree(elf_phdata);
|
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Note that some platforms still use traditional core dumps and not
|
|
|
|
* the ELF core dump. Each platform can select it as appropriate.
|
|
|
|
*/
|
2006-01-08 02:05:25 -07:00
|
|
|
#if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* ELF core dumper
|
|
|
|
*
|
|
|
|
* Modelled on fs/exec.c:aout_core_dump()
|
|
|
|
* Jeremy Fitzhardinge <jeremy@sw.oz.au>
|
|
|
|
*/
|
|
|
|
/*
|
|
|
|
* These are the only things you should do on a core-file: use only these
|
|
|
|
* functions to write out all the necessary info.
|
|
|
|
*/
|
|
|
|
static int dump_write(struct file *file, const void *addr, int nr)
|
|
|
|
{
|
|
|
|
return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
|
|
|
|
}
|
|
|
|
|
2005-06-15 23:26:34 -06:00
|
|
|
static int dump_seek(struct file *file, loff_t off)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2006-10-01 00:29:28 -06:00
|
|
|
if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
|
2006-10-12 20:13:16 -06:00
|
|
|
if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
|
2005-04-16 16:20:36 -06:00
|
|
|
return 0;
|
2006-10-01 00:29:28 -06:00
|
|
|
} else {
|
|
|
|
char *buf = (char *)get_zeroed_page(GFP_KERNEL);
|
|
|
|
if (!buf)
|
|
|
|
return 0;
|
|
|
|
while (off > 0) {
|
|
|
|
unsigned long n = off;
|
|
|
|
if (n > PAGE_SIZE)
|
|
|
|
n = PAGE_SIZE;
|
|
|
|
if (!dump_write(file, buf, n))
|
|
|
|
return 0;
|
|
|
|
off -= n;
|
|
|
|
}
|
|
|
|
free_page((unsigned long)buf);
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2007-10-17 00:27:02 -06:00
|
|
|
* Decide what to dump of a segment, part, all or none.
|
2005-04-16 16:20:36 -06:00
|
|
|
*/
|
2007-10-17 00:27:02 -06:00
|
|
|
static unsigned long vma_dump_size(struct vm_area_struct *vma,
|
|
|
|
unsigned long mm_flags)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2007-01-26 01:56:48 -07:00
|
|
|
/* The vma can be set up to tell us the answer directly. */
|
|
|
|
if (vma->vm_flags & VM_ALWAYSDUMP)
|
2007-10-17 00:27:02 -06:00
|
|
|
goto whole;
|
2007-01-26 01:56:48 -07:00
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/* Do not dump I/O mapped devices or special mappings */
|
|
|
|
if (vma->vm_flags & (VM_IO | VM_RESERVED))
|
|
|
|
return 0;
|
|
|
|
|
2007-10-17 00:27:02 -06:00
|
|
|
#define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
|
|
|
|
|
2007-07-19 02:48:29 -06:00
|
|
|
/* By default, dump shared memory if mapped from an anonymous file. */
|
|
|
|
if (vma->vm_flags & VM_SHARED) {
|
2007-10-17 00:27:02 -06:00
|
|
|
if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
|
|
|
|
FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
|
|
|
|
goto whole;
|
|
|
|
return 0;
|
2007-07-19 02:48:29 -06:00
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-10-17 00:27:02 -06:00
|
|
|
/* Dump segments that have been written to. */
|
|
|
|
if (vma->anon_vma && FILTER(ANON_PRIVATE))
|
|
|
|
goto whole;
|
|
|
|
if (vma->vm_file == NULL)
|
|
|
|
return 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-10-17 00:27:02 -06:00
|
|
|
if (FILTER(MAPPED_PRIVATE))
|
|
|
|
goto whole;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If this looks like the beginning of a DSO or executable mapping,
|
|
|
|
* check for an ELF header. If we find one, dump the first page to
|
|
|
|
* aid in determining what was mapped here.
|
|
|
|
*/
|
|
|
|
if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
|
|
|
|
u32 __user *header = (u32 __user *) vma->vm_start;
|
|
|
|
u32 word;
|
|
|
|
/*
|
|
|
|
* Doing it this way gets the constant folded by GCC.
|
|
|
|
*/
|
|
|
|
union {
|
|
|
|
u32 cmp;
|
|
|
|
char elfmag[SELFMAG];
|
|
|
|
} magic;
|
|
|
|
BUILD_BUG_ON(SELFMAG != sizeof word);
|
|
|
|
magic.elfmag[EI_MAG0] = ELFMAG0;
|
|
|
|
magic.elfmag[EI_MAG1] = ELFMAG1;
|
|
|
|
magic.elfmag[EI_MAG2] = ELFMAG2;
|
|
|
|
magic.elfmag[EI_MAG3] = ELFMAG3;
|
|
|
|
if (get_user(word, header) == 0 && word == magic.cmp)
|
|
|
|
return PAGE_SIZE;
|
|
|
|
}
|
|
|
|
|
|
|
|
#undef FILTER
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
whole:
|
|
|
|
return vma->vm_end - vma->vm_start;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
/* An ELF note in memory */
|
|
|
|
struct memelfnote
|
|
|
|
{
|
|
|
|
const char *name;
|
|
|
|
int type;
|
|
|
|
unsigned int datasz;
|
|
|
|
void *data;
|
|
|
|
};
|
|
|
|
|
|
|
|
static int notesize(struct memelfnote *en)
|
|
|
|
{
|
|
|
|
int sz;
|
|
|
|
|
|
|
|
sz = sizeof(struct elf_note);
|
|
|
|
sz += roundup(strlen(en->name) + 1, 4);
|
|
|
|
sz += roundup(en->datasz, 4);
|
|
|
|
|
|
|
|
return sz;
|
|
|
|
}
|
|
|
|
|
2006-10-01 00:29:28 -06:00
|
|
|
#define DUMP_WRITE(addr, nr, foffset) \
|
|
|
|
do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2006-10-01 00:29:28 -06:00
|
|
|
static int alignfile(struct file *file, loff_t *foffset)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2006-10-13 10:42:07 -06:00
|
|
|
static const char buf[4] = { 0, };
|
2006-10-01 00:29:28 -06:00
|
|
|
DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
|
|
|
|
return 1;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2006-10-01 00:29:28 -06:00
|
|
|
static int writenote(struct memelfnote *men, struct file *file,
|
|
|
|
loff_t *foffset)
|
|
|
|
{
|
|
|
|
struct elf_note en;
|
2005-04-16 16:20:36 -06:00
|
|
|
en.n_namesz = strlen(men->name) + 1;
|
|
|
|
en.n_descsz = men->datasz;
|
|
|
|
en.n_type = men->type;
|
|
|
|
|
2006-10-01 00:29:28 -06:00
|
|
|
DUMP_WRITE(&en, sizeof(en), foffset);
|
|
|
|
DUMP_WRITE(men->name, en.n_namesz, foffset);
|
|
|
|
if (!alignfile(file, foffset))
|
|
|
|
return 0;
|
|
|
|
DUMP_WRITE(men->data, men->datasz, foffset);
|
|
|
|
if (!alignfile(file, foffset))
|
|
|
|
return 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
#undef DUMP_WRITE
|
|
|
|
|
|
|
|
#define DUMP_WRITE(addr, nr) \
|
|
|
|
if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
|
|
|
|
goto end_coredump;
|
|
|
|
#define DUMP_SEEK(off) \
|
|
|
|
if (!dump_seek(file, (off))) \
|
|
|
|
goto end_coredump;
|
|
|
|
|
2008-01-30 05:31:44 -07:00
|
|
|
static void fill_elf_header(struct elfhdr *elf, int segs,
|
|
|
|
u16 machine, u32 flags, u8 osabi)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
memcpy(elf->e_ident, ELFMAG, SELFMAG);
|
|
|
|
elf->e_ident[EI_CLASS] = ELF_CLASS;
|
|
|
|
elf->e_ident[EI_DATA] = ELF_DATA;
|
|
|
|
elf->e_ident[EI_VERSION] = EV_CURRENT;
|
|
|
|
elf->e_ident[EI_OSABI] = ELF_OSABI;
|
|
|
|
memset(elf->e_ident+EI_PAD, 0, EI_NIDENT-EI_PAD);
|
|
|
|
|
|
|
|
elf->e_type = ET_CORE;
|
2008-01-30 05:31:44 -07:00
|
|
|
elf->e_machine = machine;
|
2005-04-16 16:20:36 -06:00
|
|
|
elf->e_version = EV_CURRENT;
|
|
|
|
elf->e_entry = 0;
|
|
|
|
elf->e_phoff = sizeof(struct elfhdr);
|
|
|
|
elf->e_shoff = 0;
|
2008-01-30 05:31:44 -07:00
|
|
|
elf->e_flags = flags;
|
2005-04-16 16:20:36 -06:00
|
|
|
elf->e_ehsize = sizeof(struct elfhdr);
|
|
|
|
elf->e_phentsize = sizeof(struct elf_phdr);
|
|
|
|
elf->e_phnum = segs;
|
|
|
|
elf->e_shentsize = 0;
|
|
|
|
elf->e_shnum = 0;
|
|
|
|
elf->e_shstrndx = 0;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2006-09-26 00:32:04 -06:00
|
|
|
static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
phdr->p_type = PT_NOTE;
|
|
|
|
phdr->p_offset = offset;
|
|
|
|
phdr->p_vaddr = 0;
|
|
|
|
phdr->p_paddr = 0;
|
|
|
|
phdr->p_filesz = sz;
|
|
|
|
phdr->p_memsz = 0;
|
|
|
|
phdr->p_flags = 0;
|
|
|
|
phdr->p_align = 0;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void fill_note(struct memelfnote *note, const char *name, int type,
|
|
|
|
unsigned int sz, void *data)
|
|
|
|
{
|
|
|
|
note->name = name;
|
|
|
|
note->type = type;
|
|
|
|
note->datasz = sz;
|
|
|
|
note->data = data;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2006-06-23 03:05:35 -06:00
|
|
|
* fill up all the fields in prstatus from the given task struct, except
|
|
|
|
* registers which need to be filled up separately.
|
2005-04-16 16:20:36 -06:00
|
|
|
*/
|
|
|
|
static void fill_prstatus(struct elf_prstatus *prstatus,
|
2006-06-23 03:05:35 -06:00
|
|
|
struct task_struct *p, long signr)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
|
|
|
|
prstatus->pr_sigpend = p->pending.signal.sig[0];
|
|
|
|
prstatus->pr_sighold = p->blocked.sig[0];
|
2007-10-19 00:40:14 -06:00
|
|
|
prstatus->pr_pid = task_pid_vnr(p);
|
2008-01-07 15:22:44 -07:00
|
|
|
prstatus->pr_ppid = task_pid_vnr(p->real_parent);
|
2007-10-19 00:40:14 -06:00
|
|
|
prstatus->pr_pgrp = task_pgrp_vnr(p);
|
|
|
|
prstatus->pr_sid = task_session_vnr(p);
|
2005-04-16 16:20:36 -06:00
|
|
|
if (thread_group_leader(p)) {
|
|
|
|
/*
|
|
|
|
* This is the record for the group leader. Add in the
|
|
|
|
* cumulative times of previous dead threads. This total
|
|
|
|
* won't include the time of each live thread whose state
|
|
|
|
* is included in the core dump. The final total reported
|
|
|
|
* to our parent process when it calls wait4 will include
|
|
|
|
* those sums as well as the little bit more time it takes
|
|
|
|
* this and each other thread to finish dying after the
|
|
|
|
* core dump synchronization phase.
|
|
|
|
*/
|
|
|
|
cputime_to_timeval(cputime_add(p->utime, p->signal->utime),
|
|
|
|
&prstatus->pr_utime);
|
|
|
|
cputime_to_timeval(cputime_add(p->stime, p->signal->stime),
|
|
|
|
&prstatus->pr_stime);
|
|
|
|
} else {
|
|
|
|
cputime_to_timeval(p->utime, &prstatus->pr_utime);
|
|
|
|
cputime_to_timeval(p->stime, &prstatus->pr_stime);
|
|
|
|
}
|
|
|
|
cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
|
|
|
|
cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
|
|
|
|
struct mm_struct *mm)
|
|
|
|
{
|
2005-05-11 01:10:44 -06:00
|
|
|
unsigned int i, len;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/* first copy the parameters from user space */
|
|
|
|
memset(psinfo, 0, sizeof(struct elf_prpsinfo));
|
|
|
|
|
|
|
|
len = mm->arg_end - mm->arg_start;
|
|
|
|
if (len >= ELF_PRARGSZ)
|
|
|
|
len = ELF_PRARGSZ-1;
|
|
|
|
if (copy_from_user(&psinfo->pr_psargs,
|
|
|
|
(const char __user *)mm->arg_start, len))
|
|
|
|
return -EFAULT;
|
|
|
|
for(i = 0; i < len; i++)
|
|
|
|
if (psinfo->pr_psargs[i] == 0)
|
|
|
|
psinfo->pr_psargs[i] = ' ';
|
|
|
|
psinfo->pr_psargs[len] = 0;
|
|
|
|
|
2007-10-19 00:40:14 -06:00
|
|
|
psinfo->pr_pid = task_pid_vnr(p);
|
2008-01-07 15:22:44 -07:00
|
|
|
psinfo->pr_ppid = task_pid_vnr(p->real_parent);
|
2007-10-19 00:40:14 -06:00
|
|
|
psinfo->pr_pgrp = task_pgrp_vnr(p);
|
|
|
|
psinfo->pr_sid = task_session_vnr(p);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
i = p->state ? ffz(~p->state) + 1 : 0;
|
|
|
|
psinfo->pr_state = i;
|
2006-03-25 04:08:22 -07:00
|
|
|
psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
|
2005-04-16 16:20:36 -06:00
|
|
|
psinfo->pr_zomb = psinfo->pr_sname == 'Z';
|
|
|
|
psinfo->pr_nice = task_nice(p);
|
|
|
|
psinfo->pr_flag = p->flags;
|
|
|
|
SET_UID(psinfo->pr_uid, p->uid);
|
|
|
|
SET_GID(psinfo->pr_gid, p->gid);
|
|
|
|
strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-01-30 05:31:44 -07:00
|
|
|
static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
|
|
|
|
{
|
|
|
|
elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
|
|
|
|
int i = 0;
|
|
|
|
do
|
|
|
|
i += 2;
|
|
|
|
while (auxv[i - 2] != AT_NULL);
|
|
|
|
fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
|
|
|
|
}
|
|
|
|
|
2008-01-30 05:31:45 -07:00
|
|
|
#ifdef CORE_DUMP_USE_REGSET
|
|
|
|
#include <linux/regset.h>
|
|
|
|
|
|
|
|
struct elf_thread_core_info {
|
|
|
|
struct elf_thread_core_info *next;
|
|
|
|
struct task_struct *task;
|
|
|
|
struct elf_prstatus prstatus;
|
|
|
|
struct memelfnote notes[0];
|
|
|
|
};
|
|
|
|
|
|
|
|
struct elf_note_info {
|
|
|
|
struct elf_thread_core_info *thread;
|
|
|
|
struct memelfnote psinfo;
|
|
|
|
struct memelfnote auxv;
|
|
|
|
size_t size;
|
|
|
|
int thread_notes;
|
|
|
|
};
|
|
|
|
|
|
|
|
static int fill_thread_core_info(struct elf_thread_core_info *t,
|
|
|
|
const struct user_regset_view *view,
|
|
|
|
long signr, size_t *total)
|
|
|
|
{
|
|
|
|
unsigned int i;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* NT_PRSTATUS is the one special case, because the regset data
|
|
|
|
* goes into the pr_reg field inside the note contents, rather
|
|
|
|
* than being the whole note contents. We fill the reset in here.
|
|
|
|
* We assume that regset 0 is NT_PRSTATUS.
|
|
|
|
*/
|
|
|
|
fill_prstatus(&t->prstatus, t->task, signr);
|
|
|
|
(void) view->regsets[0].get(t->task, &view->regsets[0],
|
|
|
|
0, sizeof(t->prstatus.pr_reg),
|
|
|
|
&t->prstatus.pr_reg, NULL);
|
|
|
|
|
|
|
|
fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
|
|
|
|
sizeof(t->prstatus), &t->prstatus);
|
|
|
|
*total += notesize(&t->notes[0]);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Each other regset might generate a note too. For each regset
|
|
|
|
* that has no core_note_type or is inactive, we leave t->notes[i]
|
|
|
|
* all zero and we'll know to skip writing it later.
|
|
|
|
*/
|
|
|
|
for (i = 1; i < view->n; ++i) {
|
|
|
|
const struct user_regset *regset = &view->regsets[i];
|
|
|
|
if (regset->core_note_type &&
|
|
|
|
(!regset->active || regset->active(t->task, regset))) {
|
|
|
|
int ret;
|
|
|
|
size_t size = regset->n * regset->size;
|
|
|
|
void *data = kmalloc(size, GFP_KERNEL);
|
|
|
|
if (unlikely(!data))
|
|
|
|
return 0;
|
|
|
|
ret = regset->get(t->task, regset,
|
|
|
|
0, size, data, NULL);
|
|
|
|
if (unlikely(ret))
|
|
|
|
kfree(data);
|
|
|
|
else {
|
|
|
|
if (regset->core_note_type != NT_PRFPREG)
|
|
|
|
fill_note(&t->notes[i], "LINUX",
|
|
|
|
regset->core_note_type,
|
|
|
|
size, data);
|
|
|
|
else {
|
|
|
|
t->prstatus.pr_fpvalid = 1;
|
|
|
|
fill_note(&t->notes[i], "CORE",
|
|
|
|
NT_PRFPREG, size, data);
|
|
|
|
}
|
|
|
|
*total += notesize(&t->notes[i]);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int fill_note_info(struct elfhdr *elf, int phdrs,
|
|
|
|
struct elf_note_info *info,
|
|
|
|
long signr, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
struct task_struct *dump_task = current;
|
|
|
|
const struct user_regset_view *view = task_user_regset_view(dump_task);
|
|
|
|
struct elf_thread_core_info *t;
|
|
|
|
struct elf_prpsinfo *psinfo;
|
|
|
|
struct task_struct *g, *p;
|
|
|
|
unsigned int i;
|
|
|
|
|
|
|
|
info->size = 0;
|
|
|
|
info->thread = NULL;
|
|
|
|
|
|
|
|
psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
|
|
|
|
fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
|
|
|
|
|
|
|
|
if (psinfo == NULL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Figure out how many notes we're going to need for each thread.
|
|
|
|
*/
|
|
|
|
info->thread_notes = 0;
|
|
|
|
for (i = 0; i < view->n; ++i)
|
|
|
|
if (view->regsets[i].core_note_type != 0)
|
|
|
|
++info->thread_notes;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Sanity check. We rely on regset 0 being in NT_PRSTATUS,
|
|
|
|
* since it is our one special case.
|
|
|
|
*/
|
|
|
|
if (unlikely(info->thread_notes == 0) ||
|
|
|
|
unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
|
|
|
|
WARN_ON(1);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Initialize the ELF file header.
|
|
|
|
*/
|
|
|
|
fill_elf_header(elf, phdrs,
|
|
|
|
view->e_machine, view->e_flags, view->ei_osabi);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Allocate a structure for each thread.
|
|
|
|
*/
|
|
|
|
rcu_read_lock();
|
|
|
|
do_each_thread(g, p)
|
|
|
|
if (p->mm == dump_task->mm) {
|
|
|
|
t = kzalloc(offsetof(struct elf_thread_core_info,
|
|
|
|
notes[info->thread_notes]),
|
|
|
|
GFP_ATOMIC);
|
|
|
|
if (unlikely(!t)) {
|
|
|
|
rcu_read_unlock();
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
t->task = p;
|
|
|
|
if (p == dump_task || !info->thread) {
|
|
|
|
t->next = info->thread;
|
|
|
|
info->thread = t;
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* Make sure to keep the original task at
|
|
|
|
* the head of the list.
|
|
|
|
*/
|
|
|
|
t->next = info->thread->next;
|
|
|
|
info->thread->next = t;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
while_each_thread(g, p);
|
|
|
|
rcu_read_unlock();
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Now fill in each thread's information.
|
|
|
|
*/
|
|
|
|
for (t = info->thread; t != NULL; t = t->next)
|
|
|
|
if (!fill_thread_core_info(t, view, signr, &info->size))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Fill in the two process-wide notes.
|
|
|
|
*/
|
|
|
|
fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
|
|
|
|
info->size += notesize(&info->psinfo);
|
|
|
|
|
|
|
|
fill_auxv_note(&info->auxv, current->mm);
|
|
|
|
info->size += notesize(&info->auxv);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static size_t get_note_info_size(struct elf_note_info *info)
|
|
|
|
{
|
|
|
|
return info->size;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Write all the notes for each thread. When writing the first thread, the
|
|
|
|
* process-wide notes are interleaved after the first thread-specific note.
|
|
|
|
*/
|
|
|
|
static int write_note_info(struct elf_note_info *info,
|
|
|
|
struct file *file, loff_t *foffset)
|
|
|
|
{
|
|
|
|
bool first = 1;
|
|
|
|
struct elf_thread_core_info *t = info->thread;
|
|
|
|
|
|
|
|
do {
|
|
|
|
int i;
|
|
|
|
|
|
|
|
if (!writenote(&t->notes[0], file, foffset))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (first && !writenote(&info->psinfo, file, foffset))
|
|
|
|
return 0;
|
|
|
|
if (first && !writenote(&info->auxv, file, foffset))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
for (i = 1; i < info->thread_notes; ++i)
|
|
|
|
if (t->notes[i].data &&
|
|
|
|
!writenote(&t->notes[i], file, foffset))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
first = 0;
|
|
|
|
t = t->next;
|
|
|
|
} while (t);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void free_note_info(struct elf_note_info *info)
|
|
|
|
{
|
|
|
|
struct elf_thread_core_info *threads = info->thread;
|
|
|
|
while (threads) {
|
|
|
|
unsigned int i;
|
|
|
|
struct elf_thread_core_info *t = threads;
|
|
|
|
threads = t->next;
|
|
|
|
WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
|
|
|
|
for (i = 1; i < info->thread_notes; ++i)
|
|
|
|
kfree(t->notes[i].data);
|
|
|
|
kfree(t);
|
|
|
|
}
|
|
|
|
kfree(info->psinfo.data);
|
|
|
|
}
|
|
|
|
|
|
|
|
#else
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/* Here is the structure in which status of each thread is captured. */
|
|
|
|
struct elf_thread_status
|
|
|
|
{
|
|
|
|
struct list_head list;
|
|
|
|
struct elf_prstatus prstatus; /* NT_PRSTATUS */
|
|
|
|
elf_fpregset_t fpu; /* NT_PRFPREG */
|
|
|
|
struct task_struct *thread;
|
|
|
|
#ifdef ELF_CORE_COPY_XFPREGS
|
2007-10-17 00:25:39 -06:00
|
|
|
elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */
|
2005-04-16 16:20:36 -06:00
|
|
|
#endif
|
|
|
|
struct memelfnote notes[3];
|
|
|
|
int num_notes;
|
|
|
|
};
|
|
|
|
|
|
|
|
/*
|
|
|
|
* In order to add the specific thread information for the elf file format,
|
2006-06-23 03:05:35 -06:00
|
|
|
* we need to keep a linked list of every threads pr_status and then create
|
|
|
|
* a single section for them in the final core file.
|
2005-04-16 16:20:36 -06:00
|
|
|
*/
|
|
|
|
static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
|
|
|
|
{
|
|
|
|
int sz = 0;
|
|
|
|
struct task_struct *p = t->thread;
|
|
|
|
t->num_notes = 0;
|
|
|
|
|
|
|
|
fill_prstatus(&t->prstatus, p, signr);
|
|
|
|
elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
|
|
|
|
&(t->prstatus));
|
2005-04-16 16:20:36 -06:00
|
|
|
t->num_notes++;
|
|
|
|
sz += notesize(&t->notes[0]);
|
|
|
|
|
2006-06-23 03:05:35 -06:00
|
|
|
if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
|
|
|
|
&t->fpu))) {
|
|
|
|
fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
|
|
|
|
&(t->fpu));
|
2005-04-16 16:20:36 -06:00
|
|
|
t->num_notes++;
|
|
|
|
sz += notesize(&t->notes[1]);
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef ELF_CORE_COPY_XFPREGS
|
|
|
|
if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
|
2007-10-17 00:25:39 -06:00
|
|
|
fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
|
|
|
|
sizeof(t->xfpu), &t->xfpu);
|
2005-04-16 16:20:36 -06:00
|
|
|
t->num_notes++;
|
|
|
|
sz += notesize(&t->notes[2]);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
return sz;
|
|
|
|
}
|
|
|
|
|
2008-01-30 05:31:44 -07:00
|
|
|
struct elf_note_info {
|
|
|
|
struct memelfnote *notes;
|
|
|
|
struct elf_prstatus *prstatus; /* NT_PRSTATUS */
|
|
|
|
struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */
|
|
|
|
struct list_head thread_list;
|
|
|
|
elf_fpregset_t *fpu;
|
|
|
|
#ifdef ELF_CORE_COPY_XFPREGS
|
|
|
|
elf_fpxregset_t *xfpu;
|
|
|
|
#endif
|
|
|
|
int thread_status_size;
|
|
|
|
int numnote;
|
|
|
|
};
|
|
|
|
|
|
|
|
static int fill_note_info(struct elfhdr *elf, int phdrs,
|
|
|
|
struct elf_note_info *info,
|
|
|
|
long signr, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
#define NUM_NOTES 6
|
|
|
|
struct list_head *t;
|
|
|
|
struct task_struct *g, *p;
|
|
|
|
|
|
|
|
info->notes = NULL;
|
|
|
|
info->prstatus = NULL;
|
|
|
|
info->psinfo = NULL;
|
|
|
|
info->fpu = NULL;
|
|
|
|
#ifdef ELF_CORE_COPY_XFPREGS
|
|
|
|
info->xfpu = NULL;
|
|
|
|
#endif
|
|
|
|
INIT_LIST_HEAD(&info->thread_list);
|
|
|
|
|
|
|
|
info->notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote),
|
|
|
|
GFP_KERNEL);
|
|
|
|
if (!info->notes)
|
|
|
|
return 0;
|
|
|
|
info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
|
|
|
|
if (!info->psinfo)
|
|
|
|
return 0;
|
|
|
|
info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
|
|
|
|
if (!info->prstatus)
|
|
|
|
return 0;
|
|
|
|
info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
|
|
|
|
if (!info->fpu)
|
|
|
|
return 0;
|
|
|
|
#ifdef ELF_CORE_COPY_XFPREGS
|
|
|
|
info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
|
|
|
|
if (!info->xfpu)
|
|
|
|
return 0;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
info->thread_status_size = 0;
|
|
|
|
if (signr) {
|
|
|
|
struct elf_thread_status *tmp;
|
|
|
|
rcu_read_lock();
|
|
|
|
do_each_thread(g, p)
|
|
|
|
if (current->mm == p->mm && current != p) {
|
|
|
|
tmp = kzalloc(sizeof(*tmp), GFP_ATOMIC);
|
|
|
|
if (!tmp) {
|
|
|
|
rcu_read_unlock();
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
tmp->thread = p;
|
|
|
|
list_add(&tmp->list, &info->thread_list);
|
|
|
|
}
|
|
|
|
while_each_thread(g, p);
|
|
|
|
rcu_read_unlock();
|
|
|
|
list_for_each(t, &info->thread_list) {
|
|
|
|
struct elf_thread_status *tmp;
|
|
|
|
int sz;
|
|
|
|
|
|
|
|
tmp = list_entry(t, struct elf_thread_status, list);
|
|
|
|
sz = elf_dump_thread_status(signr, tmp);
|
|
|
|
info->thread_status_size += sz;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* now collect the dump for the current */
|
|
|
|
memset(info->prstatus, 0, sizeof(*info->prstatus));
|
|
|
|
fill_prstatus(info->prstatus, current, signr);
|
|
|
|
elf_core_copy_regs(&info->prstatus->pr_reg, regs);
|
|
|
|
|
|
|
|
/* Set up header */
|
|
|
|
fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Set up the notes in similar form to SVR4 core dumps made
|
|
|
|
* with info from their /proc.
|
|
|
|
*/
|
|
|
|
|
|
|
|
fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
|
|
|
|
sizeof(*info->prstatus), info->prstatus);
|
|
|
|
fill_psinfo(info->psinfo, current->group_leader, current->mm);
|
|
|
|
fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
|
|
|
|
sizeof(*info->psinfo), info->psinfo);
|
|
|
|
|
|
|
|
info->numnote = 2;
|
|
|
|
|
|
|
|
fill_auxv_note(&info->notes[info->numnote++], current->mm);
|
|
|
|
|
|
|
|
/* Try to dump the FPU. */
|
|
|
|
info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
|
|
|
|
info->fpu);
|
|
|
|
if (info->prstatus->pr_fpvalid)
|
|
|
|
fill_note(info->notes + info->numnote++,
|
|
|
|
"CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
|
|
|
|
#ifdef ELF_CORE_COPY_XFPREGS
|
|
|
|
if (elf_core_copy_task_xfpregs(current, info->xfpu))
|
|
|
|
fill_note(info->notes + info->numnote++,
|
|
|
|
"LINUX", ELF_CORE_XFPREG_TYPE,
|
|
|
|
sizeof(*info->xfpu), info->xfpu);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
#undef NUM_NOTES
|
|
|
|
}
|
|
|
|
|
|
|
|
static size_t get_note_info_size(struct elf_note_info *info)
|
|
|
|
{
|
|
|
|
int sz = 0;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
for (i = 0; i < info->numnote; i++)
|
|
|
|
sz += notesize(info->notes + i);
|
|
|
|
|
|
|
|
sz += info->thread_status_size;
|
|
|
|
|
|
|
|
return sz;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int write_note_info(struct elf_note_info *info,
|
|
|
|
struct file *file, loff_t *foffset)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
struct list_head *t;
|
|
|
|
|
|
|
|
for (i = 0; i < info->numnote; i++)
|
|
|
|
if (!writenote(info->notes + i, file, foffset))
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
/* write out the thread status notes section */
|
|
|
|
list_for_each(t, &info->thread_list) {
|
|
|
|
struct elf_thread_status *tmp =
|
|
|
|
list_entry(t, struct elf_thread_status, list);
|
|
|
|
|
|
|
|
for (i = 0; i < tmp->num_notes; i++)
|
|
|
|
if (!writenote(&tmp->notes[i], file, foffset))
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void free_note_info(struct elf_note_info *info)
|
|
|
|
{
|
|
|
|
while (!list_empty(&info->thread_list)) {
|
|
|
|
struct list_head *tmp = info->thread_list.next;
|
|
|
|
list_del(tmp);
|
|
|
|
kfree(list_entry(tmp, struct elf_thread_status, list));
|
|
|
|
}
|
|
|
|
|
|
|
|
kfree(info->prstatus);
|
|
|
|
kfree(info->psinfo);
|
|
|
|
kfree(info->notes);
|
|
|
|
kfree(info->fpu);
|
|
|
|
#ifdef ELF_CORE_COPY_XFPREGS
|
|
|
|
kfree(info->xfpu);
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2008-01-30 05:31:45 -07:00
|
|
|
#endif
|
|
|
|
|
2007-01-26 01:56:49 -07:00
|
|
|
static struct vm_area_struct *first_vma(struct task_struct *tsk,
|
|
|
|
struct vm_area_struct *gate_vma)
|
|
|
|
{
|
|
|
|
struct vm_area_struct *ret = tsk->mm->mmap;
|
|
|
|
|
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
return gate_vma;
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* Helper function for iterating across a vma list. It ensures that the caller
|
|
|
|
* will visit `gate_vma' prior to terminating the search.
|
|
|
|
*/
|
|
|
|
static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
|
|
|
|
struct vm_area_struct *gate_vma)
|
|
|
|
{
|
|
|
|
struct vm_area_struct *ret;
|
|
|
|
|
|
|
|
ret = this_vma->vm_next;
|
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
if (this_vma == gate_vma)
|
|
|
|
return NULL;
|
|
|
|
return gate_vma;
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* Actual dumper
|
|
|
|
*
|
|
|
|
* This is a two-pass process; first we find the offsets of the bits,
|
|
|
|
* and then they are actually written out. If we run out of core limit
|
|
|
|
* we just truncate.
|
|
|
|
*/
|
2007-10-17 00:26:34 -06:00
|
|
|
static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
int has_dumped = 0;
|
|
|
|
mm_segment_t fs;
|
|
|
|
int segs;
|
|
|
|
size_t size = 0;
|
2007-01-26 01:56:49 -07:00
|
|
|
struct vm_area_struct *vma, *gate_vma;
|
2005-04-16 16:20:36 -06:00
|
|
|
struct elfhdr *elf = NULL;
|
2006-10-01 00:29:28 -06:00
|
|
|
loff_t offset = 0, dataoff, foffset;
|
2007-07-19 02:48:29 -06:00
|
|
|
unsigned long mm_flags;
|
2008-01-30 05:31:44 -07:00
|
|
|
struct elf_note_info info;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* We no longer stop all VM operations.
|
|
|
|
*
|
2006-06-23 03:05:35 -06:00
|
|
|
* This is because those proceses that could possibly change map_count
|
|
|
|
* or the mmap / vma pages are now blocked in do_exit on current
|
|
|
|
* finishing this core dump.
|
2005-04-16 16:20:36 -06:00
|
|
|
*
|
|
|
|
* Only ptrace can touch these memory addresses, but it doesn't change
|
2006-06-23 03:05:35 -06:00
|
|
|
* the map_count or the pages allocated. So no possibility of crashing
|
2005-04-16 16:20:36 -06:00
|
|
|
* exists while dumping the mm->vm_next areas to the core file.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* alloc memory for large data structures: too large to be on stack */
|
|
|
|
elf = kmalloc(sizeof(*elf), GFP_KERNEL);
|
|
|
|
if (!elf)
|
|
|
|
goto cleanup;
|
|
|
|
|
|
|
|
segs = current->mm->map_count;
|
|
|
|
#ifdef ELF_CORE_EXTRA_PHDRS
|
|
|
|
segs += ELF_CORE_EXTRA_PHDRS;
|
|
|
|
#endif
|
|
|
|
|
2007-01-26 01:56:49 -07:00
|
|
|
gate_vma = get_gate_vma(current);
|
|
|
|
if (gate_vma != NULL)
|
|
|
|
segs++;
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
2008-01-30 05:31:44 -07:00
|
|
|
* Collect all the non-memory information about the process for the
|
|
|
|
* notes. This also sets up the file header.
|
2005-04-16 16:20:36 -06:00
|
|
|
*/
|
2008-01-30 05:31:44 -07:00
|
|
|
if (!fill_note_info(elf, segs + 1, /* including notes section */
|
|
|
|
&info, signr, regs))
|
|
|
|
goto cleanup;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-01-30 05:31:44 -07:00
|
|
|
has_dumped = 1;
|
|
|
|
current->flags |= PF_DUMPCORE;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
fs = get_fs();
|
|
|
|
set_fs(KERNEL_DS);
|
|
|
|
|
|
|
|
DUMP_WRITE(elf, sizeof(*elf));
|
|
|
|
offset += sizeof(*elf); /* Elf header */
|
2006-10-13 10:42:07 -06:00
|
|
|
offset += (segs + 1) * sizeof(struct elf_phdr); /* Program headers */
|
|
|
|
foffset = offset;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/* Write notes phdr entry */
|
|
|
|
{
|
|
|
|
struct elf_phdr phdr;
|
2008-01-30 05:31:44 -07:00
|
|
|
size_t sz = get_note_info_size(&info);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
[POWERPC] spufs: Cleanup ELF coredump extra notes logic
To start with, arch_notes_size() etc. is a little too ambiguous a name for
my liking, so change the function names to be more explicit.
Calling through macros is ugly, especially with hidden parameters, so don't
do that, call the routines directly.
Use ARCH_HAVE_EXTRA_ELF_NOTES as the only flag, and based on it decide
whether we want the extern declarations or the empty versions.
Since we have empty routines, actually use them in the coredump code to
save a few #ifdefs.
We want to change the handling of foffset so that the write routine updates
foffset as it goes, instead of using file->f_pos (so that writing to a pipe
works). So pass foffset to the write routine, and for now just set it to
file->f_pos at the end of writing.
It should also be possible for the write routine to fail, so change it to
return int and treat a non-zero return as failure.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
2007-09-18 22:38:12 -06:00
|
|
|
sz += elf_coredump_extra_notes_size();
|
[POWERPC] coredump: Add SPU elf notes to coredump.
This patch adds SPU elf notes to the coredump. It creates a separate note
for each of /regs, /fpcr, /lslr, /decr, /decr_status, /mem, /signal1,
/signal1_type, /signal2, /signal2_type, /event_mask, /event_status,
/mbox_info, /ibox_info, /wbox_info, /dma_info, /proxydma_info, /object-id.
A new macro, ARCH_HAVE_EXTRA_NOTES, was created for architectures to
specify they have extra elf core notes.
A new macro, ELF_CORE_EXTRA_NOTES_SIZE, was created so the size of the
additional notes could be calculated and added to the notes phdr entry.
A new macro, ELF_CORE_WRITE_EXTRA_NOTES, was created so the new notes
would be written after the existing notes.
The SPU coredump code resides in spufs. Stub functions are provided in the
kernel which are hooked into the spufs code which does the actual work via
register_arch_coredump_calls().
A new set of __spufs_<file>_read/get() functions was provided to allow the
coredump code to read from the spufs files without having to lock the
SPU context for each file read from.
Cc: <linux-arch@vger.kernel.org>
Signed-off-by: Dwayne Grant McConnell <decimal@us.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
2006-11-22 16:46:37 -07:00
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
fill_elf_note_phdr(&phdr, sz, offset);
|
|
|
|
offset += sz;
|
|
|
|
DUMP_WRITE(&phdr, sizeof(phdr));
|
|
|
|
}
|
|
|
|
|
|
|
|
dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
|
|
|
|
|
2007-07-19 02:48:29 -06:00
|
|
|
/*
|
|
|
|
* We must use the same mm->flags while dumping core to avoid
|
|
|
|
* inconsistency between the program headers and bodies, otherwise an
|
|
|
|
* unusable core file can be generated.
|
|
|
|
*/
|
|
|
|
mm_flags = current->mm->flags;
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/* Write program headers for segments dump */
|
2007-01-26 01:56:49 -07:00
|
|
|
for (vma = first_vma(current, gate_vma); vma != NULL;
|
|
|
|
vma = next_vma(vma, gate_vma)) {
|
2005-04-16 16:20:36 -06:00
|
|
|
struct elf_phdr phdr;
|
|
|
|
|
|
|
|
phdr.p_type = PT_LOAD;
|
|
|
|
phdr.p_offset = offset;
|
|
|
|
phdr.p_vaddr = vma->vm_start;
|
|
|
|
phdr.p_paddr = 0;
|
2007-10-17 00:27:02 -06:00
|
|
|
phdr.p_filesz = vma_dump_size(vma, mm_flags);
|
|
|
|
phdr.p_memsz = vma->vm_end - vma->vm_start;
|
2005-04-16 16:20:36 -06:00
|
|
|
offset += phdr.p_filesz;
|
|
|
|
phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
|
2006-06-23 03:05:35 -06:00
|
|
|
if (vma->vm_flags & VM_WRITE)
|
|
|
|
phdr.p_flags |= PF_W;
|
|
|
|
if (vma->vm_flags & VM_EXEC)
|
|
|
|
phdr.p_flags |= PF_X;
|
2005-04-16 16:20:36 -06:00
|
|
|
phdr.p_align = ELF_EXEC_PAGESIZE;
|
|
|
|
|
|
|
|
DUMP_WRITE(&phdr, sizeof(phdr));
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef ELF_CORE_WRITE_EXTRA_PHDRS
|
|
|
|
ELF_CORE_WRITE_EXTRA_PHDRS;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/* write out the notes section */
|
2008-01-30 05:31:44 -07:00
|
|
|
if (!write_note_info(&info, file, &foffset))
|
|
|
|
goto end_coredump;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
[POWERPC] spufs: Cleanup ELF coredump extra notes logic
To start with, arch_notes_size() etc. is a little too ambiguous a name for
my liking, so change the function names to be more explicit.
Calling through macros is ugly, especially with hidden parameters, so don't
do that, call the routines directly.
Use ARCH_HAVE_EXTRA_ELF_NOTES as the only flag, and based on it decide
whether we want the extern declarations or the empty versions.
Since we have empty routines, actually use them in the coredump code to
save a few #ifdefs.
We want to change the handling of foffset so that the write routine updates
foffset as it goes, instead of using file->f_pos (so that writing to a pipe
works). So pass foffset to the write routine, and for now just set it to
file->f_pos at the end of writing.
It should also be possible for the write routine to fail, so change it to
return int and treat a non-zero return as failure.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
2007-09-18 22:38:12 -06:00
|
|
|
if (elf_coredump_extra_notes_write(file, &foffset))
|
|
|
|
goto end_coredump;
|
[POWERPC] coredump: Add SPU elf notes to coredump.
This patch adds SPU elf notes to the coredump. It creates a separate note
for each of /regs, /fpcr, /lslr, /decr, /decr_status, /mem, /signal1,
/signal1_type, /signal2, /signal2_type, /event_mask, /event_status,
/mbox_info, /ibox_info, /wbox_info, /dma_info, /proxydma_info, /object-id.
A new macro, ARCH_HAVE_EXTRA_NOTES, was created for architectures to
specify they have extra elf core notes.
A new macro, ELF_CORE_EXTRA_NOTES_SIZE, was created so the size of the
additional notes could be calculated and added to the notes phdr entry.
A new macro, ELF_CORE_WRITE_EXTRA_NOTES, was created so the new notes
would be written after the existing notes.
The SPU coredump code resides in spufs. Stub functions are provided in the
kernel which are hooked into the spufs code which does the actual work via
register_arch_coredump_calls().
A new set of __spufs_<file>_read/get() functions was provided to allow the
coredump code to read from the spufs files without having to lock the
SPU context for each file read from.
Cc: <linux-arch@vger.kernel.org>
Signed-off-by: Dwayne Grant McConnell <decimal@us.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
2006-11-22 16:46:37 -07:00
|
|
|
|
2006-10-01 00:29:28 -06:00
|
|
|
/* Align to page */
|
|
|
|
DUMP_SEEK(dataoff - foffset);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-01-26 01:56:49 -07:00
|
|
|
for (vma = first_vma(current, gate_vma); vma != NULL;
|
|
|
|
vma = next_vma(vma, gate_vma)) {
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long addr;
|
2007-10-17 00:27:02 -06:00
|
|
|
unsigned long end;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-10-17 00:27:02 -06:00
|
|
|
end = vma->vm_start + vma_dump_size(vma, mm_flags);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-10-17 00:27:02 -06:00
|
|
|
for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
|
2006-06-23 03:05:35 -06:00
|
|
|
struct page *page;
|
2005-04-16 16:20:36 -06:00
|
|
|
struct vm_area_struct *vma;
|
|
|
|
|
|
|
|
if (get_user_pages(current, current->mm, addr, 1, 0, 1,
|
|
|
|
&page, &vma) <= 0) {
|
2006-10-01 00:29:28 -06:00
|
|
|
DUMP_SEEK(PAGE_SIZE);
|
2005-04-16 16:20:36 -06:00
|
|
|
} else {
|
remove ZERO_PAGE
The commit b5810039a54e5babf428e9a1e89fc1940fabff11 contains the note
A last caveat: the ZERO_PAGE is now refcounted and managed with rmap
(and thus mapcounted and count towards shared rss). These writes to
the struct page could cause excessive cacheline bouncing on big
systems. There are a number of ways this could be addressed if it is
an issue.
And indeed this cacheline bouncing has shown up on large SGI systems.
There was a situation where an Altix system was essentially livelocked
tearing down ZERO_PAGE pagetables when an HPC app aborted during startup.
This situation can be avoided in userspace, but it does highlight the
potential scalability problem with refcounting ZERO_PAGE, and corner
cases where it can really hurt (we don't want the system to livelock!).
There are several broad ways to fix this problem:
1. add back some special casing to avoid refcounting ZERO_PAGE
2. per-node or per-cpu ZERO_PAGES
3. remove the ZERO_PAGE completely
I will argue for 3. The others should also fix the problem, but they
result in more complex code than does 3, with little or no real benefit
that I can see.
Why? Inserting a ZERO_PAGE for anonymous read faults appears to be a
false optimisation: if an application is performance critical, it would
not be doing many read faults of new memory, or at least it could be
expected to write to that memory soon afterwards. If cache or memory use
is critical, it should not be working with a significant number of
ZERO_PAGEs anyway (a more compact representation of zeroes should be
used).
As a sanity check -- mesuring on my desktop system, there are never many
mappings to the ZERO_PAGE (eg. 2 or 3), thus memory usage here should not
increase much without it.
When running a make -j4 kernel compile on my dual core system, there are
about 1,000 mappings to the ZERO_PAGE created per second, but about 1,000
ZERO_PAGE COW faults per second (less than 1 ZERO_PAGE mapping per second
is torn down without being COWed). So removing ZERO_PAGE will save 1,000
page faults per second when running kbuild, while keeping it only saves
less than 1 page clearing operation per second. 1 page clear is cheaper
than a thousand faults, presumably, so there isn't an obvious loss.
Neither the logical argument nor these basic tests give a guarantee of no
regressions. However, this is a reasonable opportunity to try to remove
the ZERO_PAGE from the pagefault path. If it is found to cause regressions,
we can reintroduce it and just avoid refcounting it.
The /dev/zero ZERO_PAGE usage and TLB tricks also get nuked. I don't see
much use to them except on benchmarks. All other users of ZERO_PAGE are
converted just to use ZERO_PAGE(0) for simplicity. We can look at
replacing them all and maybe ripping out ZERO_PAGE completely when we are
more satisfied with this solution.
Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus "snif" Torvalds <torvalds@linux-foundation.org>
2007-10-16 02:24:40 -06:00
|
|
|
if (page == ZERO_PAGE(0)) {
|
2007-04-02 00:49:41 -06:00
|
|
|
if (!dump_seek(file, PAGE_SIZE)) {
|
|
|
|
page_cache_release(page);
|
|
|
|
goto end_coredump;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
} else {
|
|
|
|
void *kaddr;
|
2006-06-23 03:05:35 -06:00
|
|
|
flush_cache_page(vma, addr,
|
|
|
|
page_to_pfn(page));
|
2005-04-16 16:20:36 -06:00
|
|
|
kaddr = kmap(page);
|
|
|
|
if ((size += PAGE_SIZE) > limit ||
|
|
|
|
!dump_write(file, kaddr,
|
|
|
|
PAGE_SIZE)) {
|
|
|
|
kunmap(page);
|
|
|
|
page_cache_release(page);
|
|
|
|
goto end_coredump;
|
|
|
|
}
|
|
|
|
kunmap(page);
|
|
|
|
}
|
|
|
|
page_cache_release(page);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef ELF_CORE_WRITE_EXTRA_DATA
|
|
|
|
ELF_CORE_WRITE_EXTRA_DATA;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
end_coredump:
|
|
|
|
set_fs(fs);
|
|
|
|
|
|
|
|
cleanup:
|
|
|
|
kfree(elf);
|
2008-01-30 05:31:44 -07:00
|
|
|
free_note_info(&info);
|
2005-04-16 16:20:36 -06:00
|
|
|
return has_dumped;
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif /* USE_ELF_CORE_DUMP */
|
|
|
|
|
|
|
|
static int __init init_elf_binfmt(void)
|
|
|
|
{
|
|
|
|
return register_binfmt(&elf_format);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit exit_elf_binfmt(void)
|
|
|
|
{
|
|
|
|
/* Remove the COFF and ELF loaders. */
|
|
|
|
unregister_binfmt(&elf_format);
|
|
|
|
}
|
|
|
|
|
|
|
|
core_initcall(init_elf_binfmt);
|
|
|
|
module_exit(exit_elf_binfmt);
|
|
|
|
MODULE_LICENSE("GPL");
|