KVM: MMU: use page array in unsync walk

[safe/jmp/linux-2.6] / fs / binfmt_aout.c

diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index dd9baab..f1f3f41 100644 (file)
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -28,12 +28,11 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
+#include <asm/a.out-core.h>
 
 static int load_aout_binary(struct linux_binprm *, struct pt_regs * regs);
 static int load_aout_library(struct file*);
-static int aout_core_dump(long signr, struct pt_regs * regs, struct file *file);
-
-extern void dump_thread(struct pt_regs *, struct user *);
+static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
 
 static struct linux_binfmt aout_format = {
        .module         = THIS_MODULE,
@@ -90,7 +89,7 @@ if (file->f_op->llseek) { \
  * dumping of the process results in another error..
  */
 
-static int aout_core_dump(long signr, struct pt_regs * regs, struct file *file)
+static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
 {
        mm_segment_t fs;
        int has_dumped = 0;
@@ -117,31 +116,27 @@ static int aout_core_dump(long signr, struct pt_regs * regs, struct file *file)
        current->flags |= PF_DUMPCORE;
                strncpy(dump.u_comm, current->comm, sizeof(dump.u_comm));
 #ifndef __sparc__
-       dump.u_ar0 = (void *)(((unsigned long)(&dump.regs)) - ((unsigned long)(&dump)));
+       dump.u_ar0 = offsetof(struct user, regs);
 #endif
        dump.signal = signr;
-       dump_thread(regs, &dump);
+       aout_dump_thread(regs, &dump);
 
 /* If the size of the dump file exceeds the rlimit, then see what would happen
    if we wrote the stack, but not the data area.  */
 #ifdef __sparc__
-       if ((dump.u_dsize+dump.u_ssize) >
-           current->signal->rlim[RLIMIT_CORE].rlim_cur)
+       if ((dump.u_dsize + dump.u_ssize) > limit)
                dump.u_dsize = 0;
 #else
-       if ((dump.u_dsize+dump.u_ssize+1) * PAGE_SIZE >
-           current->signal->rlim[RLIMIT_CORE].rlim_cur)
+       if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
                dump.u_dsize = 0;
 #endif
 
 /* Make sure we have enough room to write the stack and data areas. */
 #ifdef __sparc__
-       if ((dump.u_ssize) >
-           current->signal->rlim[RLIMIT_CORE].rlim_cur)
+       if (dump.u_ssize > limit)
                dump.u_ssize = 0;
 #else
-       if ((dump.u_ssize+1) * PAGE_SIZE >
-           current->signal->rlim[RLIMIT_CORE].rlim_cur)
+       if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
                dump.u_ssize = 0;
 #endif
 
@@ -276,10 +271,17 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
        if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != OMAGIC &&
             N_MAGIC(ex) != QMAGIC && N_MAGIC(ex) != NMAGIC) ||
            N_TRSIZE(ex) || N_DRSIZE(ex) ||
-           i_size_read(bprm->file->f_dentry->d_inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) {
+           i_size_read(bprm->file->f_path.dentry->d_inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) {
                return -ENOEXEC;
        }
 
+       /*
+        * Requires a mmap handler. This prevents people from using a.out
+        * as part of an exploit attack against /proc-related vulnerabilities.
+        */
+       if (!bprm->file->f_op || !bprm->file->f_op->mmap)
+               return -ENOEXEC;
+
        fd_offset = N_TXTOFF(ex);
 
        /* Check initial limits. This avoids letting people circumvent
@@ -318,9 +320,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
        current->mm->free_area_cache = current->mm->mmap_base;
        current->mm->cached_hole_size = 0;
 
-       set_mm_counter(current->mm, rss, 0);
-       current->mm->mmap = NULL;
-       compute_creds(bprm);
+       install_exec_creds(bprm);
        current->flags &= ~PF_FORKNOEXEC;
 #ifdef __sparc__
        if (N_MAGIC(ex) == NMAGIC) {
@@ -372,21 +372,17 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
                         
                flush_icache_range(text_addr, text_addr+ex.a_text+ex.a_data);
        } else {
-               static unsigned long error_time, error_time2;
                if ((ex.a_text & 0xfff || ex.a_data & 0xfff) &&
-                   (N_MAGIC(ex) != NMAGIC) && (jiffies-error_time2) > 5*HZ)
+                   (N_MAGIC(ex) != NMAGIC) && printk_ratelimit())
                {
                        printk(KERN_NOTICE "executable not page aligned\n");
-                       error_time2 = jiffies;
                }
 
-               if ((fd_offset & ~PAGE_MASK) != 0 &&
-                   (jiffies-error_time) > 5*HZ)
+               if ((fd_offset & ~PAGE_MASK) != 0 && printk_ratelimit())
                {
                        printk(KERN_WARNING 
                               "fd_offset is not page aligned. Please convert program: %s\n",
-                              bprm->file->f_dentry->d_name.name);
-                       error_time = jiffies;
+                              bprm->file->f_path.dentry->d_name.name);
                }
 
                if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
@@ -448,12 +444,6 @@ beyond_if:
        regs->gp = ex.a_gpvalue;
 #endif
        start_thread(regs, ex.a_entry, current->mm->start_stack);
-       if (unlikely(current->ptrace & PT_PTRACED)) {
-               if (current->ptrace & PT_TRACE_EXEC)
-                       ptrace_notify ((PTRACE_EVENT_EXEC << 8) | SIGTRAP);
-               else
-                       send_sig(SIGTRAP, current, 0);
-       }
        return 0;
 }
 
@@ -465,7 +455,7 @@ static int load_aout_library(struct file *file)
        int retval;
        struct exec ex;
 
-       inode = file->f_dentry->d_inode;
+       inode = file->f_path.dentry->d_inode;
 
        retval = -ENOEXEC;
        error = kernel_read(file, 0, (char *) &ex, sizeof(ex));
@@ -479,6 +469,13 @@ static int load_aout_library(struct file *file)
                goto out;
        }
 
+       /*
+        * Requires a mmap handler. This prevents people from using a.out
+        * as part of an exploit attack against /proc-related vulnerabilities.
+        */
+       if (!file->f_op || !file->f_op->mmap)
+               goto out;
+
        if (N_FLAGS(ex))
                goto out;
 
@@ -488,15 +485,13 @@ static int load_aout_library(struct file *file)
        start_addr =  ex.a_entry & 0xfffff000;
 
        if ((N_TXTOFF(ex) & ~PAGE_MASK) != 0) {
-               static unsigned long error_time;
                loff_t pos = N_TXTOFF(ex);
 
-               if ((jiffies-error_time) > 5*HZ)
+               if (printk_ratelimit())
                {
                        printk(KERN_WARNING 
                               "N_TXTOFF is not page aligned. Please convert library: %s\n",
-                              file->f_dentry->d_name.name);
-                       error_time = jiffies;
+                              file->f_path.dentry->d_name.name);
                }
                down_write(&current->mm->mmap_sem);
                do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);