SAFE public projects git trees. - safe/jmp/linux-2.6/blob - fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/stat.h>
  16 #include <linux/time.h>
  17 #include <linux/mm.h>
  18 #include <linux/mman.h>
  19 #include <linux/errno.h>
  20 #include <linux/signal.h>
  21 #include <linux/binfmts.h>
  22 #include <linux/string.h>
  23 #include <linux/file.h>
  24 #include <linux/fcntl.h>
  25 #include <linux/ptrace.h>
  26 #include <linux/slab.h>
  27 #include <linux/shm.h>
  28 #include <linux/personality.h>
  29 #include <linux/elfcore.h>
  30 #include <linux/init.h>
  31 #include <linux/highuid.h>
  32 #include <linux/smp.h>
  33 #include <linux/compiler.h>
  34 #include <linux/highmem.h>
  35 #include <linux/pagemap.h>
  36 #include <linux/security.h>
  37 #include <linux/syscalls.h>
  38 #include <linux/random.h>
  39 #include <linux/elf.h>
  40 #include <linux/utsname.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/param.h>
  43 #include <asm/page.h>
  44
  45 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
  46 static int load_elf_library(struct file *);
  47 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  48                                 int, int, unsigned long);
  49
  50 /*
  51  * If we don't support core dumping, then supply a NULL so we
  52  * don't even try.
  53  */
  54 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
  55 static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
  56 #else
  57 #define elf_core_dump   NULL
  58 #endif
  59
  60 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  61 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  62 #else
  63 #define ELF_MIN_ALIGN   PAGE_SIZE
  64 #endif
  65
  66 #ifndef ELF_CORE_EFLAGS
  67 #define ELF_CORE_EFLAGS 0
  68 #endif
  69
  70 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  71 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  72 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  73
  74 static struct linux_binfmt elf_format = {
  75                 .module         = THIS_MODULE,
  76                 .load_binary    = load_elf_binary,
  77                 .load_shlib     = load_elf_library,
  78                 .core_dump      = elf_core_dump,
  79                 .min_coredump   = ELF_EXEC_PAGESIZE,
  80                 .hasvdso        = 1
  81 };
  82
  83 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  84
  85 static int set_brk(unsigned long start, unsigned long end)
  86 {
  87         start = ELF_PAGEALIGN(start);
  88         end = ELF_PAGEALIGN(end);
  89         if (end > start) {
  90                 unsigned long addr;
  91                 down_write(&current->mm->mmap_sem);
  92                 addr = do_brk(start, end - start);
  93                 up_write(&current->mm->mmap_sem);
  94                 if (BAD_ADDR(addr))
  95                         return addr;
  96         }
  97         current->mm->start_brk = current->mm->brk = end;
  98         return 0;
  99 }
 100
 101 /* We need to explicitly zero any fractional pages
 102    after the data section (i.e. bss).  This would
 103    contain the junk from the file that should not
 104    be in memory
 105  */
 106 static int padzero(unsigned long elf_bss)
 107 {
 108         unsigned long nbyte;
 109
 110         nbyte = ELF_PAGEOFFSET(elf_bss);
 111         if (nbyte) {
 112                 nbyte = ELF_MIN_ALIGN - nbyte;
 113                 if (clear_user((void __user *) elf_bss, nbyte))
 114                         return -EFAULT;
 115         }
 116         return 0;
 117 }
 118
 119 /* Let's use some macros to make this stack manipulation a little clearer */
 120 #ifdef CONFIG_STACK_GROWSUP
 121 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 122 #define STACK_ROUND(sp, items) \
 123         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 124 #define STACK_ALLOC(sp, len) ({ \
 125         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 126         old_sp; })
 127 #else
 128 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 129 #define STACK_ROUND(sp, items) \
 130         (((unsigned long) (sp - items)) &~ 15UL)
 131 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 132 #endif
 133
 134 #ifndef ELF_BASE_PLATFORM
 135 /*
 136  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 137  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 138  * will be copied to the user stack in the same manner as AT_PLATFORM.
 139  */
 140 #define ELF_BASE_PLATFORM NULL
 141 #endif
 142
 143 static int
 144 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 145                 unsigned long load_addr, unsigned long interp_load_addr)
 146 {
 147         unsigned long p = bprm->p;
 148         int argc = bprm->argc;
 149         int envc = bprm->envc;
 150         elf_addr_t __user *argv;
 151         elf_addr_t __user *envp;
 152         elf_addr_t __user *sp;
 153         elf_addr_t __user *u_platform;
 154         elf_addr_t __user *u_base_platform;
 155         const char *k_platform = ELF_PLATFORM;
 156         const char *k_base_platform = ELF_BASE_PLATFORM;
 157         int items;
 158         elf_addr_t *elf_info;
 159         int ei_index = 0;
 160         struct task_struct *tsk = current;
 161         struct vm_area_struct *vma;
 162
 163         /*
 164          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 165          * evictions by the processes running on the same package. One
 166          * thing we can do is to shuffle the initial stack for them.
 167          */
 168
 169         p = arch_align_stack(p);
 170
 171         /*
 172          * If this architecture has a platform capability string, copy it
 173          * to userspace.  In some cases (Sparc), this info is impossible
 174          * for userspace to get any other way, in others (i386) it is
 175          * merely difficult.
 176          */
 177         u_platform = NULL;
 178         if (k_platform) {
 179                 size_t len = strlen(k_platform) + 1;
 180
 181                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 182                 if (__copy_to_user(u_platform, k_platform, len))
 183                         return -EFAULT;
 184         }
 185
 186         /*
 187          * If this architecture has a "base" platform capability
 188          * string, copy it to userspace.
 189          */
 190         u_base_platform = NULL;
 191         if (k_base_platform) {
 192                 size_t len = strlen(k_base_platform) + 1;
 193
 194                 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 195                 if (__copy_to_user(u_base_platform, k_base_platform, len))
 196                         return -EFAULT;
 197         }
 198
 199         /* Create the ELF interpreter info */
 200         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 201         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 202 #define NEW_AUX_ENT(id, val) \
 203         do { \
 204                 elf_info[ei_index++] = id; \
 205                 elf_info[ei_index++] = val; \
 206         } while (0)
 207
 208 #ifdef ARCH_DLINFO
 209         /*
 210          * ARCH_DLINFO must come first so PPC can do its special alignment of
 211          * AUXV.
 212          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 213          * ARCH_DLINFO changes
 214          */
 215         ARCH_DLINFO;
 216 #endif
 217         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 218         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 219         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 220         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 221         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 222         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 223         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 224         NEW_AUX_ENT(AT_FLAGS, 0);
 225         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 226         NEW_AUX_ENT(AT_UID, tsk->uid);
 227         NEW_AUX_ENT(AT_EUID, tsk->euid);
 228         NEW_AUX_ENT(AT_GID, tsk->gid);
 229         NEW_AUX_ENT(AT_EGID, tsk->egid);
 230         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 231         NEW_AUX_ENT(AT_EXECFN, bprm->exec);
 232         if (k_platform) {
 233                 NEW_AUX_ENT(AT_PLATFORM,
 234                             (elf_addr_t)(unsigned long)u_platform);
 235         }
 236         if (k_base_platform) {
 237                 NEW_AUX_ENT(AT_BASE_PLATFORM,
 238                             (elf_addr_t)(unsigned long)u_base_platform);
 239         }
 240         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 241                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 242         }
 243 #undef NEW_AUX_ENT
 244         /* AT_NULL is zero; clear the rest too */
 245         memset(&elf_info[ei_index], 0,
 246                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 247
 248         /* And advance past the AT_NULL entry.  */
 249         ei_index += 2;
 250
 251         sp = STACK_ADD(p, ei_index);
 252
 253         items = (argc + 1) + (envc + 1) + 1;
 254         bprm->p = STACK_ROUND(sp, items);
 255
 256         /* Point sp at the lowest address on the stack */
 257 #ifdef CONFIG_STACK_GROWSUP
 258         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 259         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 260 #else
 261         sp = (elf_addr_t __user *)bprm->p;
 262 #endif
 263
 264
 265         /*
 266          * Grow the stack manually; some architectures have a limit on how
 267          * far ahead a user-space access may be in order to grow the stack.
 268          */
 269         vma = find_extend_vma(current->mm, bprm->p);
 270         if (!vma)
 271                 return -EFAULT;
 272
 273         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 274         if (__put_user(argc, sp++))
 275                 return -EFAULT;
 276         argv = sp;
 277         envp = argv + argc + 1;
 278
 279         /* Populate argv and envp */
 280         p = current->mm->arg_end = current->mm->arg_start;
 281         while (argc-- > 0) {
 282                 size_t len;
 283                 if (__put_user((elf_addr_t)p, argv++))
 284                         return -EFAULT;
 285                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 286                 if (!len || len > MAX_ARG_STRLEN)
 287                         return -EINVAL;
 288                 p += len;
 289         }
 290         if (__put_user(0, argv))
 291                 return -EFAULT;
 292         current->mm->arg_end = current->mm->env_start = p;
 293         while (envc-- > 0) {
 294                 size_t len;
 295                 if (__put_user((elf_addr_t)p, envp++))
 296                         return -EFAULT;
 297                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 298                 if (!len || len > MAX_ARG_STRLEN)
 299                         return -EINVAL;
 300                 p += len;
 301         }
 302         if (__put_user(0, envp))
 303                 return -EFAULT;
 304         current->mm->env_end = p;
 305
 306         /* Put the elf_info on the stack in the right place.  */
 307         sp = (elf_addr_t __user *)envp + 1;
 308         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 309                 return -EFAULT;
 310         return 0;
 311 }
 312
 313 #ifndef elf_map
 314
 315 static unsigned long elf_map(struct file *filep, unsigned long addr,
 316                 struct elf_phdr *eppnt, int prot, int type,
 317                 unsigned long total_size)
 318 {
 319         unsigned long map_addr;
 320         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 321         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 322         addr = ELF_PAGESTART(addr);
 323         size = ELF_PAGEALIGN(size);
 324
 325         /* mmap() will return -EINVAL if given a zero size, but a
 326          * segment with zero filesize is perfectly valid */
 327         if (!size)
 328                 return addr;
 329
 330         down_write(&current->mm->mmap_sem);
 331         /*
 332         * total_size is the size of the ELF (interpreter) image.
 333         * The _first_ mmap needs to know the full size, otherwise
 334         * randomization might put this image into an overlapping
 335         * position with the ELF binary image. (since size < total_size)
 336         * So we first map the 'big' image - and unmap the remainder at
 337         * the end. (which unmap is needed for ELF images with holes.)
 338         */
 339         if (total_size) {
 340                 total_size = ELF_PAGEALIGN(total_size);
 341                 map_addr = do_mmap(filep, addr, total_size, prot, type, off);
 342                 if (!BAD_ADDR(map_addr))
 343                         do_munmap(current->mm, map_addr+size, total_size-size);
 344         } else
 345                 map_addr = do_mmap(filep, addr, size, prot, type, off);
 346
 347         up_write(&current->mm->mmap_sem);
 348         return(map_addr);
 349 }
 350
 351 #endif /* !elf_map */
 352
 353 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 354 {
 355         int i, first_idx = -1, last_idx = -1;
 356
 357         for (i = 0; i < nr; i++) {
 358                 if (cmds[i].p_type == PT_LOAD) {
 359                         last_idx = i;
 360                         if (first_idx == -1)
 361                                 first_idx = i;
 362                 }
 363         }
 364         if (first_idx == -1)
 365                 return 0;
 366
 367         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 368                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 369 }
 370
 371
 372 /* This is much more generalized than the library routine read function,
 373    so we keep this separate.  Technically the library read function
 374    is only provided so that we can read a.out libraries that have
 375    an ELF header */
 376
 377 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 378                 struct file *interpreter, unsigned long *interp_map_addr,
 379                 unsigned long no_base)
 380 {
 381         struct elf_phdr *elf_phdata;
 382         struct elf_phdr *eppnt;
 383         unsigned long load_addr = 0;
 384         int load_addr_set = 0;
 385         unsigned long last_bss = 0, elf_bss = 0;
 386         unsigned long error = ~0UL;
 387         unsigned long total_size;
 388         int retval, i, size;
 389
 390         /* First of all, some simple consistency checks */
 391         if (interp_elf_ex->e_type != ET_EXEC &&
 392             interp_elf_ex->e_type != ET_DYN)
 393                 goto out;
 394         if (!elf_check_arch(interp_elf_ex))
 395                 goto out;
 396         if (!interpreter->f_op || !interpreter->f_op->mmap)
 397                 goto out;
 398
 399         /*
 400          * If the size of this structure has changed, then punt, since
 401          * we will be doing the wrong thing.
 402          */
 403         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 404                 goto out;
 405         if (interp_elf_ex->e_phnum < 1 ||
 406                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 407                 goto out;
 408
 409         /* Now read in all of the header information */
 410         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 411         if (size > ELF_MIN_ALIGN)
 412                 goto out;
 413         elf_phdata = kmalloc(size, GFP_KERNEL);
 414         if (!elf_phdata)
 415                 goto out;
 416
 417         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 418                              (char *)elf_phdata,size);
 419         error = -EIO;
 420         if (retval != size) {
 421                 if (retval < 0)
 422                         error = retval;
 423                 goto out_close;
 424         }
 425
 426         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 427         if (!total_size) {
 428                 error = -EINVAL;
 429                 goto out_close;
 430         }
 431
 432         eppnt = elf_phdata;
 433         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 434                 if (eppnt->p_type == PT_LOAD) {
 435                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 436                         int elf_prot = 0;
 437                         unsigned long vaddr = 0;
 438                         unsigned long k, map_addr;
 439
 440                         if (eppnt->p_flags & PF_R)
 441                                 elf_prot = PROT_READ;
 442                         if (eppnt->p_flags & PF_W)
 443                                 elf_prot |= PROT_WRITE;
 444                         if (eppnt->p_flags & PF_X)
 445                                 elf_prot |= PROT_EXEC;
 446                         vaddr = eppnt->p_vaddr;
 447                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 448                                 elf_type |= MAP_FIXED;
 449                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 450                                 load_addr = -vaddr;
 451
 452                         map_addr = elf_map(interpreter, load_addr + vaddr,
 453                                         eppnt, elf_prot, elf_type, total_size);
 454                         total_size = 0;
 455                         if (!*interp_map_addr)
 456                                 *interp_map_addr = map_addr;
 457                         error = map_addr;
 458                         if (BAD_ADDR(map_addr))
 459                                 goto out_close;
 460
 461                         if (!load_addr_set &&
 462                             interp_elf_ex->e_type == ET_DYN) {
 463                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 464                                 load_addr_set = 1;
 465                         }
 466
 467                         /*
 468                          * Check to see if the section's size will overflow the
 469                          * allowed task size. Note that p_filesz must always be
 470                          * <= p_memsize so it's only necessary to check p_memsz.
 471                          */
 472                         k = load_addr + eppnt->p_vaddr;
 473                         if (BAD_ADDR(k) ||
 474                             eppnt->p_filesz > eppnt->p_memsz ||
 475                             eppnt->p_memsz > TASK_SIZE ||
 476                             TASK_SIZE - eppnt->p_memsz < k) {
 477                                 error = -ENOMEM;
 478                                 goto out_close;
 479                         }
 480
 481                         /*
 482                          * Find the end of the file mapping for this phdr, and
 483                          * keep track of the largest address we see for this.
 484                          */
 485                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 486                         if (k > elf_bss)
 487                                 elf_bss = k;
 488
 489                         /*
 490                          * Do the same thing for the memory mapping - between
 491                          * elf_bss and last_bss is the bss section.
 492                          */
 493                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 494                         if (k > last_bss)
 495                                 last_bss = k;
 496                 }
 497         }
 498
 499         /*
 500          * Now fill out the bss section.  First pad the last page up
 501          * to the page boundary, and then perform a mmap to make sure
 502          * that there are zero-mapped pages up to and including the
 503          * last bss page.
 504          */
 505         if (padzero(elf_bss)) {
 506                 error = -EFAULT;
 507                 goto out_close;
 508         }
 509
 510         /* What we have mapped so far */
 511         elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 512
 513         /* Map the last of the bss segment */
 514         if (last_bss > elf_bss) {
 515                 down_write(&current->mm->mmap_sem);
 516                 error = do_brk(elf_bss, last_bss - elf_bss);
 517                 up_write(&current->mm->mmap_sem);
 518                 if (BAD_ADDR(error))
 519                         goto out_close;
 520         }
 521
 522         error = load_addr;
 523
 524 out_close:
 525         kfree(elf_phdata);
 526 out:
 527         return error;
 528 }
 529
 530 /*
 531  * These are the functions used to load ELF style executables and shared
 532  * libraries.  There is no binary dependent code anywhere else.
 533  */
 534
 535 #define INTERPRETER_NONE 0
 536 #define INTERPRETER_ELF 2
 537
 538 #ifndef STACK_RND_MASK
 539 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 540 #endif
 541
 542 static unsigned long randomize_stack_top(unsigned long stack_top)
 543 {
 544         unsigned int random_variable = 0;
 545
 546         if ((current->flags & PF_RANDOMIZE) &&
 547                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 548                 random_variable = get_random_int() & STACK_RND_MASK;
 549                 random_variable <<= PAGE_SHIFT;
 550         }
 551 #ifdef CONFIG_STACK_GROWSUP
 552         return PAGE_ALIGN(stack_top) + random_variable;
 553 #else
 554         return PAGE_ALIGN(stack_top) - random_variable;
 555 #endif
 556 }
 557
 558 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 559 {
 560         struct file *interpreter = NULL; /* to shut gcc up */
 561         unsigned long load_addr = 0, load_bias = 0;
 562         int load_addr_set = 0;
 563         char * elf_interpreter = NULL;
 564         unsigned long error;
 565         struct elf_phdr *elf_ppnt, *elf_phdata;
 566         unsigned long elf_bss, elf_brk;
 567         int elf_exec_fileno;
 568         int retval, i;
 569         unsigned int size;
 570         unsigned long elf_entry;
 571         unsigned long interp_load_addr = 0;
 572         unsigned long start_code, end_code, start_data, end_data;
 573         unsigned long reloc_func_desc = 0;
 574         int executable_stack = EXSTACK_DEFAULT;
 575         unsigned long def_flags = 0;
 576         struct {
 577                 struct elfhdr elf_ex;
 578                 struct elfhdr interp_elf_ex;
 579         } *loc;
 580
 581         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 582         if (!loc) {
 583                 retval = -ENOMEM;
 584                 goto out_ret;
 585         }
 586
 587         /* Get the exec-header */
 588         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 589
 590         retval = -ENOEXEC;
 591         /* First of all, some simple consistency checks */
 592         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 593                 goto out;
 594
 595         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 596                 goto out;
 597         if (!elf_check_arch(&loc->elf_ex))
 598                 goto out;
 599         if (!bprm->file->f_op||!bprm->file->f_op->mmap)
 600                 goto out;
 601
 602         /* Now read in all of the header information */
 603         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 604                 goto out;
 605         if (loc->elf_ex.e_phnum < 1 ||
 606                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 607                 goto out;
 608         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 609         retval = -ENOMEM;
 610         elf_phdata = kmalloc(size, GFP_KERNEL);
 611         if (!elf_phdata)
 612                 goto out;
 613
 614         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 615                              (char *)elf_phdata, size);
 616         if (retval != size) {
 617                 if (retval >= 0)
 618                         retval = -EIO;
 619                 goto out_free_ph;
 620         }
 621
 622         retval = get_unused_fd();
 623         if (retval < 0)
 624                 goto out_free_ph;
 625         get_file(bprm->file);
 626         fd_install(elf_exec_fileno = retval, bprm->file);
 627
 628         elf_ppnt = elf_phdata;
 629         elf_bss = 0;
 630         elf_brk = 0;
 631
 632         start_code = ~0UL;
 633         end_code = 0;
 634         start_data = 0;
 635         end_data = 0;
 636
 637         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 638                 if (elf_ppnt->p_type == PT_INTERP) {
 639                         /* This is the program interpreter used for
 640                          * shared libraries - for now assume that this
 641                          * is an a.out format binary
 642                          */
 643                         retval = -ENOEXEC;
 644                         if (elf_ppnt->p_filesz > PATH_MAX ||
 645                             elf_ppnt->p_filesz < 2)
 646                                 goto out_free_file;
 647
 648                         retval = -ENOMEM;
 649                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 650                                                   GFP_KERNEL);
 651                         if (!elf_interpreter)
 652                                 goto out_free_file;
 653
 654                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 655                                              elf_interpreter,
 656                                              elf_ppnt->p_filesz);
 657                         if (retval != elf_ppnt->p_filesz) {
 658                                 if (retval >= 0)
 659                                         retval = -EIO;
 660                                 goto out_free_interp;
 661                         }
 662                         /* make sure path is NULL terminated */
 663                         retval = -ENOEXEC;
 664                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 665                                 goto out_free_interp;
 666
 667                         /*
 668                          * The early SET_PERSONALITY here is so that the lookup
 669                          * for the interpreter happens in the namespace of the
 670                          * to-be-execed image.  SET_PERSONALITY can select an
 671                          * alternate root.
 672                          *
 673                          * However, SET_PERSONALITY is NOT allowed to switch
 674                          * this task into the new images's memory mapping
 675                          * policy - that is, TASK_SIZE must still evaluate to
 676                          * that which is appropriate to the execing application.
 677                          * This is because exit_mmap() needs to have TASK_SIZE
 678                          * evaluate to the size of the old image.
 679                          *
 680                          * So if (say) a 64-bit application is execing a 32-bit
 681                          * application it is the architecture's responsibility
 682                          * to defer changing the value of TASK_SIZE until the
 683                          * switch really is going to happen - do this in
 684                          * flush_thread().      - akpm
 685                          */
 686                         SET_PERSONALITY(loc->elf_ex, 0);
 687
 688                         interpreter = open_exec(elf_interpreter);
 689                         retval = PTR_ERR(interpreter);
 690                         if (IS_ERR(interpreter))
 691                                 goto out_free_interp;
 692
 693                         /*
 694                          * If the binary is not readable then enforce
 695                          * mm->dumpable = 0 regardless of the interpreter's
 696                          * permissions.
 697                          */
 698                         if (file_permission(interpreter, MAY_READ) < 0)
 699                                 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
 700
 701                         retval = kernel_read(interpreter, 0, bprm->buf,
 702                                              BINPRM_BUF_SIZE);
 703                         if (retval != BINPRM_BUF_SIZE) {
 704                                 if (retval >= 0)
 705                                         retval = -EIO;
 706                                 goto out_free_dentry;
 707                         }
 708
 709                         /* Get the exec headers */
 710                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 711                         break;
 712                 }
 713                 elf_ppnt++;
 714         }
 715
 716         elf_ppnt = elf_phdata;
 717         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 718                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 719                         if (elf_ppnt->p_flags & PF_X)
 720                                 executable_stack = EXSTACK_ENABLE_X;
 721                         else
 722                                 executable_stack = EXSTACK_DISABLE_X;
 723                         break;
 724                 }
 725
 726         /* Some simple consistency checks for the interpreter */
 727         if (elf_interpreter) {
 728                 retval = -ELIBBAD;
 729                 /* Not an ELF interpreter */
 730                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 731                         goto out_free_dentry;
 732                 /* Verify the interpreter has a valid arch */
 733                 if (!elf_check_arch(&loc->interp_elf_ex))
 734                         goto out_free_dentry;
 735         } else {
 736                 /* Executables without an interpreter also need a personality  */
 737                 SET_PERSONALITY(loc->elf_ex, 0);
 738         }
 739
 740         /* Flush all traces of the currently running executable */
 741         retval = flush_old_exec(bprm);
 742         if (retval)
 743                 goto out_free_dentry;
 744
 745         /* OK, This is the point of no return */
 746         current->flags &= ~PF_FORKNOEXEC;
 747         current->mm->def_flags = def_flags;
 748
 749         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 750            may depend on the personality.  */
 751         SET_PERSONALITY(loc->elf_ex, 0);
 752         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 753                 current->personality |= READ_IMPLIES_EXEC;
 754
 755         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 756                 current->flags |= PF_RANDOMIZE;
 757         arch_pick_mmap_layout(current->mm);
 758
 759         /* Do this so that we can load the interpreter, if need be.  We will
 760            change some of these later */
 761         current->mm->free_area_cache = current->mm->mmap_base;
 762         current->mm->cached_hole_size = 0;
 763         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 764                                  executable_stack);
 765         if (retval < 0) {
 766                 send_sig(SIGKILL, current, 0);
 767                 goto out_free_dentry;
 768         }
 769
 770         current->mm->start_stack = bprm->p;
 771
 772         /* Now we do a little grungy work by mmaping the ELF image into
 773            the correct location in memory. */
 774         for(i = 0, elf_ppnt = elf_phdata;
 775             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 776                 int elf_prot = 0, elf_flags;
 777                 unsigned long k, vaddr;
 778
 779                 if (elf_ppnt->p_type != PT_LOAD)
 780                         continue;
 781
 782                 if (unlikely (elf_brk > elf_bss)) {
 783                         unsigned long nbyte;
 784
 785                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 786                            before this one. Map anonymous pages, if needed,
 787                            and clear the area.  */
 788                         retval = set_brk (elf_bss + load_bias,
 789                                           elf_brk + load_bias);
 790                         if (retval) {
 791                                 send_sig(SIGKILL, current, 0);
 792                                 goto out_free_dentry;
 793                         }
 794                         nbyte = ELF_PAGEOFFSET(elf_bss);
 795                         if (nbyte) {
 796                                 nbyte = ELF_MIN_ALIGN - nbyte;
 797                                 if (nbyte > elf_brk - elf_bss)
 798                                         nbyte = elf_brk - elf_bss;
 799                                 if (clear_user((void __user *)elf_bss +
 800                                                         load_bias, nbyte)) {
 801                                         /*
 802                                          * This bss-zeroing can fail if the ELF
 803                                          * file specifies odd protections. So
 804                                          * we don't check the return value
 805                                          */
 806                                 }
 807                         }
 808                 }
 809
 810                 if (elf_ppnt->p_flags & PF_R)
 811                         elf_prot |= PROT_READ;
 812                 if (elf_ppnt->p_flags & PF_W)
 813                         elf_prot |= PROT_WRITE;
 814                 if (elf_ppnt->p_flags & PF_X)
 815                         elf_prot |= PROT_EXEC;
 816
 817                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 818
 819                 vaddr = elf_ppnt->p_vaddr;
 820                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 821                         elf_flags |= MAP_FIXED;
 822                 } else if (loc->elf_ex.e_type == ET_DYN) {
 823                         /* Try and get dynamic programs out of the way of the
 824                          * default mmap base, as well as whatever program they
 825                          * might try to exec.  This is because the brk will
 826                          * follow the loader, and is not movable.  */
 827 #ifdef CONFIG_X86
 828                         load_bias = 0;
 829 #else
 830                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 831 #endif
 832                 }
 833
 834                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 835                                 elf_prot, elf_flags, 0);
 836                 if (BAD_ADDR(error)) {
 837                         send_sig(SIGKILL, current, 0);
 838                         retval = IS_ERR((void *)error) ?
 839                                 PTR_ERR((void*)error) : -EINVAL;
 840                         goto out_free_dentry;
 841                 }
 842
 843                 if (!load_addr_set) {
 844                         load_addr_set = 1;
 845                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 846                         if (loc->elf_ex.e_type == ET_DYN) {
 847                                 load_bias += error -
 848                                              ELF_PAGESTART(load_bias + vaddr);
 849                                 load_addr += load_bias;
 850                                 reloc_func_desc = load_bias;
 851                         }
 852                 }
 853                 k = elf_ppnt->p_vaddr;
 854                 if (k < start_code)
 855                         start_code = k;
 856                 if (start_data < k)
 857                         start_data = k;
 858
 859                 /*
 860                  * Check to see if the section's size will overflow the
 861                  * allowed task size. Note that p_filesz must always be
 862                  * <= p_memsz so it is only necessary to check p_memsz.
 863                  */
 864                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 865                     elf_ppnt->p_memsz > TASK_SIZE ||
 866                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 867                         /* set_brk can never work. Avoid overflows. */
 868                         send_sig(SIGKILL, current, 0);
 869                         retval = -EINVAL;
 870                         goto out_free_dentry;
 871                 }
 872
 873                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 874
 875                 if (k > elf_bss)
 876                         elf_bss = k;
 877                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 878                         end_code = k;
 879                 if (end_data < k)
 880                         end_data = k;
 881                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 882                 if (k > elf_brk)
 883                         elf_brk = k;
 884         }
 885
 886         loc->elf_ex.e_entry += load_bias;
 887         elf_bss += load_bias;
 888         elf_brk += load_bias;
 889         start_code += load_bias;
 890         end_code += load_bias;
 891         start_data += load_bias;
 892         end_data += load_bias;
 893
 894         /* Calling set_brk effectively mmaps the pages that we need
 895          * for the bss and break sections.  We must do this before
 896          * mapping in the interpreter, to make sure it doesn't wind
 897          * up getting placed where the bss needs to go.
 898          */
 899         retval = set_brk(elf_bss, elf_brk);
 900         if (retval) {
 901                 send_sig(SIGKILL, current, 0);
 902                 goto out_free_dentry;
 903         }
 904         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 905                 send_sig(SIGSEGV, current, 0);
 906                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 907                 goto out_free_dentry;
 908         }
 909
 910         if (elf_interpreter) {
 911                 unsigned long uninitialized_var(interp_map_addr);
 912
 913                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 914                                             interpreter,
 915                                             &interp_map_addr,
 916                                             load_bias);
 917                 if (!IS_ERR((void *)elf_entry)) {
 918                         /*
 919                          * load_elf_interp() returns relocation
 920                          * adjustment
 921                          */
 922                         interp_load_addr = elf_entry;
 923                         elf_entry += loc->interp_elf_ex.e_entry;
 924                 }
 925                 if (BAD_ADDR(elf_entry)) {
 926                         force_sig(SIGSEGV, current);
 927                         retval = IS_ERR((void *)elf_entry) ?
 928                                         (int)elf_entry : -EINVAL;
 929                         goto out_free_dentry;
 930                 }
 931                 reloc_func_desc = interp_load_addr;
 932
 933                 allow_write_access(interpreter);
 934                 fput(interpreter);
 935                 kfree(elf_interpreter);
 936         } else {
 937                 elf_entry = loc->elf_ex.e_entry;
 938                 if (BAD_ADDR(elf_entry)) {
 939                         force_sig(SIGSEGV, current);
 940                         retval = -EINVAL;
 941                         goto out_free_dentry;
 942                 }
 943         }
 944
 945         kfree(elf_phdata);
 946
 947         sys_close(elf_exec_fileno);
 948
 949         set_binfmt(&elf_format);
 950
 951 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 952         retval = arch_setup_additional_pages(bprm, executable_stack);
 953         if (retval < 0) {
 954                 send_sig(SIGKILL, current, 0);
 955                 goto out;
 956         }
 957 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 958
 959         compute_creds(bprm);
 960         current->flags &= ~PF_FORKNOEXEC;
 961         retval = create_elf_tables(bprm, &loc->elf_ex,
 962                           load_addr, interp_load_addr);
 963         if (retval < 0) {
 964                 send_sig(SIGKILL, current, 0);
 965                 goto out;
 966         }
 967         /* N.B. passed_fileno might not be initialized? */
 968         current->mm->end_code = end_code;
 969         current->mm->start_code = start_code;
 970         current->mm->start_data = start_data;
 971         current->mm->end_data = end_data;
 972         current->mm->start_stack = bprm->p;
 973
 974 #ifdef arch_randomize_brk
 975         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1))
 976                 current->mm->brk = current->mm->start_brk =
 977                         arch_randomize_brk(current->mm);
 978 #endif
 979
 980         if (current->personality & MMAP_PAGE_ZERO) {
 981                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 982                    and some applications "depend" upon this behavior.
 983                    Since we do not have the power to recompile these, we
 984                    emulate the SVr4 behavior. Sigh. */
 985                 down_write(&current->mm->mmap_sem);
 986                 error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 987                                 MAP_FIXED | MAP_PRIVATE, 0);
 988                 up_write(&current->mm->mmap_sem);
 989         }
 990
 991 #ifdef ELF_PLAT_INIT
 992         /*
 993          * The ABI may specify that certain registers be set up in special
 994          * ways (on i386 %edx is the address of a DT_FINI function, for
 995          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 996          * that the e_entry field is the address of the function descriptor
 997          * for the startup routine, rather than the address of the startup
 998          * routine itself.  This macro performs whatever initialization to
 999          * the regs structure is required as well as any relocations to the
1000          * function descriptor entries when executing dynamically links apps.
1001          */
1002         ELF_PLAT_INIT(regs, reloc_func_desc);
1003 #endif
1004
1005         start_thread(regs, elf_entry, bprm->p);
1006         if (unlikely(current->ptrace & PT_PTRACED)) {
1007                 if (current->ptrace & PT_TRACE_EXEC)
1008                         ptrace_notify ((PTRACE_EVENT_EXEC << 8) | SIGTRAP);
1009                 else
1010                         send_sig(SIGTRAP, current, 0);
1011         }
1012         retval = 0;
1013 out:
1014         kfree(loc);
1015 out_ret:
1016         return retval;
1017
1018         /* error cleanup */
1019 out_free_dentry:
1020         allow_write_access(interpreter);
1021         if (interpreter)
1022                 fput(interpreter);
1023 out_free_interp:
1024         kfree(elf_interpreter);
1025 out_free_file:
1026         sys_close(elf_exec_fileno);
1027 out_free_ph:
1028         kfree(elf_phdata);
1029         goto out;
1030 }
1031
1032 /* This is really simpleminded and specialized - we are loading an
1033    a.out library that is given an ELF header. */
1034 static int load_elf_library(struct file *file)
1035 {
1036         struct elf_phdr *elf_phdata;
1037         struct elf_phdr *eppnt;
1038         unsigned long elf_bss, bss, len;
1039         int retval, error, i, j;
1040         struct elfhdr elf_ex;
1041
1042         error = -ENOEXEC;
1043         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1044         if (retval != sizeof(elf_ex))
1045                 goto out;
1046
1047         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1048                 goto out;
1049
1050         /* First of all, some simple consistency checks */
1051         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1052             !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1053                 goto out;
1054
1055         /* Now read in all of the header information */
1056
1057         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1058         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1059
1060         error = -ENOMEM;
1061         elf_phdata = kmalloc(j, GFP_KERNEL);
1062         if (!elf_phdata)
1063                 goto out;
1064
1065         eppnt = elf_phdata;
1066         error = -ENOEXEC;
1067         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1068         if (retval != j)
1069                 goto out_free_ph;
1070
1071         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1072                 if ((eppnt + i)->p_type == PT_LOAD)
1073                         j++;
1074         if (j != 1)
1075                 goto out_free_ph;
1076
1077         while (eppnt->p_type != PT_LOAD)
1078                 eppnt++;
1079
1080         /* Now use mmap to map the library into memory. */
1081         down_write(&current->mm->mmap_sem);
1082         error = do_mmap(file,
1083                         ELF_PAGESTART(eppnt->p_vaddr),
1084                         (eppnt->p_filesz +
1085                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1086                         PROT_READ | PROT_WRITE | PROT_EXEC,
1087                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1088                         (eppnt->p_offset -
1089                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1090         up_write(&current->mm->mmap_sem);
1091         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1092                 goto out_free_ph;
1093
1094         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1095         if (padzero(elf_bss)) {
1096                 error = -EFAULT;
1097                 goto out_free_ph;
1098         }
1099
1100         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1101                             ELF_MIN_ALIGN - 1);
1102         bss = eppnt->p_memsz + eppnt->p_vaddr;
1103         if (bss > len) {
1104                 down_write(&current->mm->mmap_sem);
1105                 do_brk(len, bss - len);
1106                 up_write(&current->mm->mmap_sem);
1107         }
1108         error = 0;
1109
1110 out_free_ph:
1111         kfree(elf_phdata);
1112 out:
1113         return error;
1114 }
1115
1116 /*
1117  * Note that some platforms still use traditional core dumps and not
1118  * the ELF core dump.  Each platform can select it as appropriate.
1119  */
1120 #if defined(USE_ELF_CORE_DUMP) && defined(CONFIG_ELF_CORE)
1121
1122 /*
1123  * ELF core dumper
1124  *
1125  * Modelled on fs/exec.c:aout_core_dump()
1126  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1127  */
1128 /*
1129  * These are the only things you should do on a core-file: use only these
1130  * functions to write out all the necessary info.
1131  */
1132 static int dump_write(struct file *file, const void *addr, int nr)
1133 {
1134         return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
1135 }
1136
1137 static int dump_seek(struct file *file, loff_t off)
1138 {
1139         if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
1140                 if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
1141                         return 0;
1142         } else {
1143                 char *buf = (char *)get_zeroed_page(GFP_KERNEL);
1144                 if (!buf)
1145                         return 0;
1146                 while (off > 0) {
1147                         unsigned long n = off;
1148                         if (n > PAGE_SIZE)
1149                                 n = PAGE_SIZE;
1150                         if (!dump_write(file, buf, n))
1151                                 return 0;
1152                         off -= n;
1153                 }
1154                 free_page((unsigned long)buf);
1155         }
1156         return 1;
1157 }
1158
1159 /*
1160  * Decide what to dump of a segment, part, all or none.
1161  */
1162 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1163                                    unsigned long mm_flags)
1164 {
1165         /* The vma can be set up to tell us the answer directly.  */
1166         if (vma->vm_flags & VM_ALWAYSDUMP)
1167                 goto whole;
1168
1169         /* Do not dump I/O mapped devices or special mappings */
1170         if (vma->vm_flags & (VM_IO | VM_RESERVED))
1171                 return 0;
1172
1173 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1174
1175         /* By default, dump shared memory if mapped from an anonymous file. */
1176         if (vma->vm_flags & VM_SHARED) {
1177                 if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
1178                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1179                         goto whole;
1180                 return 0;
1181         }
1182
1183         /* Dump segments that have been written to.  */
1184         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1185                 goto whole;
1186         if (vma->vm_file == NULL)
1187                 return 0;
1188
1189         if (FILTER(MAPPED_PRIVATE))
1190                 goto whole;
1191
1192         /*
1193          * If this looks like the beginning of a DSO or executable mapping,
1194          * check for an ELF header.  If we find one, dump the first page to
1195          * aid in determining what was mapped here.
1196          */
1197         if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
1198                 u32 __user *header = (u32 __user *) vma->vm_start;
1199                 u32 word;
1200                 /*
1201                  * Doing it this way gets the constant folded by GCC.
1202                  */
1203                 union {
1204                         u32 cmp;
1205                         char elfmag[SELFMAG];
1206                 } magic;
1207                 BUILD_BUG_ON(SELFMAG != sizeof word);
1208                 magic.elfmag[EI_MAG0] = ELFMAG0;
1209                 magic.elfmag[EI_MAG1] = ELFMAG1;
1210                 magic.elfmag[EI_MAG2] = ELFMAG2;
1211                 magic.elfmag[EI_MAG3] = ELFMAG3;
1212                 if (get_user(word, header) == 0 && word == magic.cmp)
1213                         return PAGE_SIZE;
1214         }
1215
1216 #undef  FILTER
1217
1218         return 0;
1219
1220 whole:
1221         return vma->vm_end - vma->vm_start;
1222 }
1223
1224 /* An ELF note in memory */
1225 struct memelfnote
1226 {
1227         const char *name;
1228         int type;
1229         unsigned int datasz;
1230         void *data;
1231 };
1232
1233 static int notesize(struct memelfnote *en)
1234 {
1235         int sz;
1236
1237         sz = sizeof(struct elf_note);
1238         sz += roundup(strlen(en->name) + 1, 4);
1239         sz += roundup(en->datasz, 4);
1240
1241         return sz;
1242 }
1243
1244 #define DUMP_WRITE(addr, nr, foffset)   \
1245         do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
1246
1247 static int alignfile(struct file *file, loff_t *foffset)
1248 {
1249         static const char buf[4] = { 0, };
1250         DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
1251         return 1;
1252 }
1253
1254 static int writenote(struct memelfnote *men, struct file *file,
1255                         loff_t *foffset)
1256 {
1257         struct elf_note en;
1258         en.n_namesz = strlen(men->name) + 1;
1259         en.n_descsz = men->datasz;
1260         en.n_type = men->type;
1261
1262         DUMP_WRITE(&en, sizeof(en), foffset);
1263         DUMP_WRITE(men->name, en.n_namesz, foffset);
1264         if (!alignfile(file, foffset))
1265                 return 0;
1266         DUMP_WRITE(men->data, men->datasz, foffset);
1267         if (!alignfile(file, foffset))
1268                 return 0;
1269
1270         return 1;
1271 }
1272 #undef DUMP_WRITE
1273
1274 #define DUMP_WRITE(addr, nr)    \
1275         if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
1276                 goto end_coredump;
1277 #define DUMP_SEEK(off)  \
1278         if (!dump_seek(file, (off))) \
1279                 goto end_coredump;
1280
1281 static void fill_elf_header(struct elfhdr *elf, int segs,
1282                             u16 machine, u32 flags, u8 osabi)
1283 {
1284         memset(elf, 0, sizeof(*elf));
1285
1286         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1287         elf->e_ident[EI_CLASS] = ELF_CLASS;
1288         elf->e_ident[EI_DATA] = ELF_DATA;
1289         elf->e_ident[EI_VERSION] = EV_CURRENT;
1290         elf->e_ident[EI_OSABI] = ELF_OSABI;
1291
1292         elf->e_type = ET_CORE;
1293         elf->e_machine = machine;
1294         elf->e_version = EV_CURRENT;
1295         elf->e_phoff = sizeof(struct elfhdr);
1296         elf->e_flags = flags;
1297         elf->e_ehsize = sizeof(struct elfhdr);
1298         elf->e_phentsize = sizeof(struct elf_phdr);
1299         elf->e_phnum = segs;
1300
1301         return;
1302 }
1303
1304 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1305 {
1306         phdr->p_type = PT_NOTE;
1307         phdr->p_offset = offset;
1308         phdr->p_vaddr = 0;
1309         phdr->p_paddr = 0;
1310         phdr->p_filesz = sz;
1311         phdr->p_memsz = 0;
1312         phdr->p_flags = 0;
1313         phdr->p_align = 0;
1314         return;
1315 }
1316
1317 static void fill_note(struct memelfnote *note, const char *name, int type,
1318                 unsigned int sz, void *data)
1319 {
1320         note->name = name;
1321         note->type = type;
1322         note->datasz = sz;
1323         note->data = data;
1324         return;
1325 }
1326
1327 /*
1328  * fill up all the fields in prstatus from the given task struct, except
1329  * registers which need to be filled up separately.
1330  */
1331 static void fill_prstatus(struct elf_prstatus *prstatus,
1332                 struct task_struct *p, long signr)
1333 {
1334         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1335         prstatus->pr_sigpend = p->pending.signal.sig[0];
1336         prstatus->pr_sighold = p->blocked.sig[0];
1337         prstatus->pr_pid = task_pid_vnr(p);
1338         prstatus->pr_ppid = task_pid_vnr(p->real_parent);
1339         prstatus->pr_pgrp = task_pgrp_vnr(p);
1340         prstatus->pr_sid = task_session_vnr(p);
1341         if (thread_group_leader(p)) {
1342                 /*
1343                  * This is the record for the group leader.  Add in the
1344                  * cumulative times of previous dead threads.  This total
1345                  * won't include the time of each live thread whose state
1346                  * is included in the core dump.  The final total reported
1347                  * to our parent process when it calls wait4 will include
1348                  * those sums as well as the little bit more time it takes
1349                  * this and each other thread to finish dying after the
1350                  * core dump synchronization phase.
1351                  */
1352                 cputime_to_timeval(cputime_add(p->utime, p->signal->utime),
1353                                    &prstatus->pr_utime);
1354                 cputime_to_timeval(cputime_add(p->stime, p->signal->stime),
1355                                    &prstatus->pr_stime);
1356         } else {
1357                 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1358                 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1359         }
1360         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1361         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1362 }
1363
1364 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1365                        struct mm_struct *mm)
1366 {
1367         unsigned int i, len;
1368
1369         /* first copy the parameters from user space */
1370         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1371
1372         len = mm->arg_end - mm->arg_start;
1373         if (len >= ELF_PRARGSZ)
1374                 len = ELF_PRARGSZ-1;
1375         if (copy_from_user(&psinfo->pr_psargs,
1376                            (const char __user *)mm->arg_start, len))
1377                 return -EFAULT;
1378         for(i = 0; i < len; i++)
1379                 if (psinfo->pr_psargs[i] == 0)
1380                         psinfo->pr_psargs[i] = ' ';
1381         psinfo->pr_psargs[len] = 0;
1382
1383         psinfo->pr_pid = task_pid_vnr(p);
1384         psinfo->pr_ppid = task_pid_vnr(p->real_parent);
1385         psinfo->pr_pgrp = task_pgrp_vnr(p);
1386         psinfo->pr_sid = task_session_vnr(p);
1387
1388         i = p->state ? ffz(~p->state) + 1 : 0;
1389         psinfo->pr_state = i;
1390         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1391         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1392         psinfo->pr_nice = task_nice(p);
1393         psinfo->pr_flag = p->flags;
1394         SET_UID(psinfo->pr_uid, p->uid);
1395         SET_GID(psinfo->pr_gid, p->gid);
1396         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1397
1398         return 0;
1399 }
1400
1401 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1402 {
1403         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1404         int i = 0;
1405         do
1406                 i += 2;
1407         while (auxv[i - 2] != AT_NULL);
1408         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1409 }
1410
1411 #ifdef CORE_DUMP_USE_REGSET
1412 #include <linux/regset.h>
1413
1414 struct elf_thread_core_info {
1415         struct elf_thread_core_info *next;
1416         struct task_struct *task;
1417         struct elf_prstatus prstatus;
1418         struct memelfnote notes[0];
1419 };
1420
1421 struct elf_note_info {
1422         struct elf_thread_core_info *thread;
1423         struct memelfnote psinfo;
1424         struct memelfnote auxv;
1425         size_t size;
1426         int thread_notes;
1427 };
1428
1429 /*
1430  * When a regset has a writeback hook, we call it on each thread before
1431  * dumping user memory.  On register window machines, this makes sure the
1432  * user memory backing the register data is up to date before we read it.
1433  */
1434 static void do_thread_regset_writeback(struct task_struct *task,
1435                                        const struct user_regset *regset)
1436 {
1437         if (regset->writeback)
1438                 regset->writeback(task, regset, 1);
1439 }
1440
1441 static int fill_thread_core_info(struct elf_thread_core_info *t,
1442                                  const struct user_regset_view *view,
1443                                  long signr, size_t *total)
1444 {
1445         unsigned int i;
1446
1447         /*
1448          * NT_PRSTATUS is the one special case, because the regset data
1449          * goes into the pr_reg field inside the note contents, rather
1450          * than being the whole note contents.  We fill the reset in here.
1451          * We assume that regset 0 is NT_PRSTATUS.
1452          */
1453         fill_prstatus(&t->prstatus, t->task, signr);
1454         (void) view->regsets[0].get(t->task, &view->regsets[0],
1455                                     0, sizeof(t->prstatus.pr_reg),
1456                                     &t->prstatus.pr_reg, NULL);
1457
1458         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1459                   sizeof(t->prstatus), &t->prstatus);
1460         *total += notesize(&t->notes[0]);
1461
1462         do_thread_regset_writeback(t->task, &view->regsets[0]);
1463
1464         /*
1465          * Each other regset might generate a note too.  For each regset
1466          * that has no core_note_type or is inactive, we leave t->notes[i]
1467          * all zero and we'll know to skip writing it later.
1468          */
1469         for (i = 1; i < view->n; ++i) {
1470                 const struct user_regset *regset = &view->regsets[i];
1471                 do_thread_regset_writeback(t->task, regset);
1472                 if (regset->core_note_type &&
1473                     (!regset->active || regset->active(t->task, regset))) {
1474                         int ret;
1475                         size_t size = regset->n * regset->size;
1476                         void *data = kmalloc(size, GFP_KERNEL);
1477                         if (unlikely(!data))
1478                                 return 0;
1479                         ret = regset->get(t->task, regset,
1480                                           0, size, data, NULL);
1481                         if (unlikely(ret))
1482                                 kfree(data);
1483                         else {
1484                                 if (regset->core_note_type != NT_PRFPREG)
1485                                         fill_note(&t->notes[i], "LINUX",
1486                                                   regset->core_note_type,
1487                                                   size, data);
1488                                 else {
1489                                         t->prstatus.pr_fpvalid = 1;
1490                                         fill_note(&t->notes[i], "CORE",
1491                                                   NT_PRFPREG, size, data);
1492                                 }
1493                                 *total += notesize(&t->notes[i]);
1494                         }
1495                 }
1496         }
1497
1498         return 1;
1499 }
1500
1501 static int fill_note_info(struct elfhdr *elf, int phdrs,
1502                           struct elf_note_info *info,
1503                           long signr, struct pt_regs *regs)
1504 {
1505         struct task_struct *dump_task = current;
1506         const struct user_regset_view *view = task_user_regset_view(dump_task);
1507         struct elf_thread_core_info *t;
1508         struct elf_prpsinfo *psinfo;
1509         struct task_struct *g, *p;
1510         unsigned int i;
1511
1512         info->size = 0;
1513         info->thread = NULL;
1514
1515         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1516         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1517
1518         if (psinfo == NULL)
1519                 return 0;
1520
1521         /*
1522          * Figure out how many notes we're going to need for each thread.
1523          */
1524         info->thread_notes = 0;
1525         for (i = 0; i < view->n; ++i)
1526                 if (view->regsets[i].core_note_type != 0)
1527                         ++info->thread_notes;
1528
1529         /*
1530          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1531          * since it is our one special case.
1532          */
1533         if (unlikely(info->thread_notes == 0) ||
1534             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1535                 WARN_ON(1);
1536                 return 0;
1537         }
1538
1539         /*
1540          * Initialize the ELF file header.
1541          */
1542         fill_elf_header(elf, phdrs,
1543                         view->e_machine, view->e_flags, view->ei_osabi);
1544
1545         /*
1546          * Allocate a structure for each thread.
1547          */
1548         rcu_read_lock();
1549         do_each_thread(g, p)
1550                 if (p->mm == dump_task->mm) {
1551                         t = kzalloc(offsetof(struct elf_thread_core_info,
1552                                              notes[info->thread_notes]),
1553                                     GFP_ATOMIC);
1554                         if (unlikely(!t)) {
1555                                 rcu_read_unlock();
1556                                 return 0;
1557                         }
1558                         t->task = p;
1559                         if (p == dump_task || !info->thread) {
1560                                 t->next = info->thread;
1561                                 info->thread = t;
1562                         } else {
1563                                 /*
1564                                  * Make sure to keep the original task at
1565                                  * the head of the list.
1566                                  */
1567                                 t->next = info->thread->next;
1568                                 info->thread->next = t;
1569                         }
1570                 }
1571         while_each_thread(g, p);
1572         rcu_read_unlock();
1573
1574         /*
1575          * Now fill in each thread's information.
1576          */
1577         for (t = info->thread; t != NULL; t = t->next)
1578                 if (!fill_thread_core_info(t, view, signr, &info->size))
1579                         return 0;
1580
1581         /*
1582          * Fill in the two process-wide notes.
1583          */
1584         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1585         info->size += notesize(&info->psinfo);
1586
1587         fill_auxv_note(&info->auxv, current->mm);
1588         info->size += notesize(&info->auxv);
1589
1590         return 1;
1591 }
1592
1593 static size_t get_note_info_size(struct elf_note_info *info)
1594 {
1595         return info->size;
1596 }
1597
1598 /*
1599  * Write all the notes for each thread.  When writing the first thread, the
1600  * process-wide notes are interleaved after the first thread-specific note.
1601  */
1602 static int write_note_info(struct elf_note_info *info,
1603                            struct file *file, loff_t *foffset)
1604 {
1605         bool first = 1;
1606         struct elf_thread_core_info *t = info->thread;
1607
1608         do {
1609                 int i;
1610
1611                 if (!writenote(&t->notes[0], file, foffset))
1612                         return 0;
1613
1614                 if (first && !writenote(&info->psinfo, file, foffset))
1615                         return 0;
1616                 if (first && !writenote(&info->auxv, file, foffset))
1617                         return 0;
1618
1619                 for (i = 1; i < info->thread_notes; ++i)
1620                         if (t->notes[i].data &&
1621                             !writenote(&t->notes[i], file, foffset))
1622                                 return 0;
1623
1624                 first = 0;
1625                 t = t->next;
1626         } while (t);
1627
1628         return 1;
1629 }
1630
1631 static void free_note_info(struct elf_note_info *info)
1632 {
1633         struct elf_thread_core_info *threads = info->thread;
1634         while (threads) {
1635                 unsigned int i;
1636                 struct elf_thread_core_info *t = threads;
1637                 threads = t->next;
1638                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1639                 for (i = 1; i < info->thread_notes; ++i)
1640                         kfree(t->notes[i].data);
1641                 kfree(t);
1642         }
1643         kfree(info->psinfo.data);
1644 }
1645
1646 #else
1647
1648 /* Here is the structure in which status of each thread is captured. */
1649 struct elf_thread_status
1650 {
1651         struct list_head list;
1652         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1653         elf_fpregset_t fpu;             /* NT_PRFPREG */
1654         struct task_struct *thread;
1655 #ifdef ELF_CORE_COPY_XFPREGS
1656         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1657 #endif
1658         struct memelfnote notes[3];
1659         int num_notes;
1660 };
1661
1662 /*
1663  * In order to add the specific thread information for the elf file format,
1664  * we need to keep a linked list of every threads pr_status and then create
1665  * a single section for them in the final core file.
1666  */
1667 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1668 {
1669         int sz = 0;
1670         struct task_struct *p = t->thread;
1671         t->num_notes = 0;
1672
1673         fill_prstatus(&t->prstatus, p, signr);
1674         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1675
1676         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1677                   &(t->prstatus));
1678         t->num_notes++;
1679         sz += notesize(&t->notes[0]);
1680
1681         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1682                                                                 &t->fpu))) {
1683                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1684                           &(t->fpu));
1685                 t->num_notes++;
1686                 sz += notesize(&t->notes[1]);
1687         }
1688
1689 #ifdef ELF_CORE_COPY_XFPREGS
1690         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1691                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1692                           sizeof(t->xfpu), &t->xfpu);
1693                 t->num_notes++;
1694                 sz += notesize(&t->notes[2]);
1695         }
1696 #endif
1697         return sz;
1698 }
1699
1700 struct elf_note_info {
1701         struct memelfnote *notes;
1702         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1703         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1704         struct list_head thread_list;
1705         elf_fpregset_t *fpu;
1706 #ifdef ELF_CORE_COPY_XFPREGS
1707         elf_fpxregset_t *xfpu;
1708 #endif
1709         int thread_status_size;
1710         int numnote;
1711 };
1712
1713 static int fill_note_info(struct elfhdr *elf, int phdrs,
1714                           struct elf_note_info *info,
1715                           long signr, struct pt_regs *regs)
1716 {
1717 #define NUM_NOTES       6
1718         struct list_head *t;
1719         struct task_struct *g, *p;
1720
1721         info->notes = NULL;
1722         info->prstatus = NULL;
1723         info->psinfo = NULL;
1724         info->fpu = NULL;
1725 #ifdef ELF_CORE_COPY_XFPREGS
1726         info->xfpu = NULL;
1727 #endif
1728         INIT_LIST_HEAD(&info->thread_list);
1729
1730         info->notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote),
1731                               GFP_KERNEL);
1732         if (!info->notes)
1733                 return 0;
1734         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1735         if (!info->psinfo)
1736                 return 0;
1737         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1738         if (!info->prstatus)
1739                 return 0;
1740         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1741         if (!info->fpu)
1742                 return 0;
1743 #ifdef ELF_CORE_COPY_XFPREGS
1744         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1745         if (!info->xfpu)
1746                 return 0;
1747 #endif
1748
1749         info->thread_status_size = 0;
1750         if (signr) {
1751                 struct elf_thread_status *ets;
1752                 rcu_read_lock();
1753                 do_each_thread(g, p)
1754                         if (current->mm == p->mm && current != p) {
1755                                 ets = kzalloc(sizeof(*ets), GFP_ATOMIC);
1756                                 if (!ets) {
1757                                         rcu_read_unlock();
1758                                         return 0;
1759                                 }
1760                                 ets->thread = p;
1761                                 list_add(&ets->list, &info->thread_list);
1762                         }
1763                 while_each_thread(g, p);
1764                 rcu_read_unlock();
1765                 list_for_each(t, &info->thread_list) {
1766                         int sz;
1767
1768                         ets = list_entry(t, struct elf_thread_status, list);
1769                         sz = elf_dump_thread_status(signr, ets);
1770                         info->thread_status_size += sz;
1771                 }
1772         }
1773         /* now collect the dump for the current */
1774         memset(info->prstatus, 0, sizeof(*info->prstatus));
1775         fill_prstatus(info->prstatus, current, signr);
1776         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1777
1778         /* Set up header */
1779         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
1780
1781         /*
1782          * Set up the notes in similar form to SVR4 core dumps made
1783          * with info from their /proc.
1784          */
1785
1786         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1787                   sizeof(*info->prstatus), info->prstatus);
1788         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1789         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1790                   sizeof(*info->psinfo), info->psinfo);
1791
1792         info->numnote = 2;
1793
1794         fill_auxv_note(&info->notes[info->numnote++], current->mm);
1795
1796         /* Try to dump the FPU. */
1797         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1798                                                                info->fpu);
1799         if (info->prstatus->pr_fpvalid)
1800                 fill_note(info->notes + info->numnote++,
1801                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1802 #ifdef ELF_CORE_COPY_XFPREGS
1803         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1804                 fill_note(info->notes + info->numnote++,
1805                           "LINUX", ELF_CORE_XFPREG_TYPE,
1806                           sizeof(*info->xfpu), info->xfpu);
1807 #endif
1808
1809         return 1;
1810
1811 #undef NUM_NOTES
1812 }
1813
1814 static size_t get_note_info_size(struct elf_note_info *info)
1815 {
1816         int sz = 0;
1817         int i;
1818
1819         for (i = 0; i < info->numnote; i++)
1820                 sz += notesize(info->notes + i);
1821
1822         sz += info->thread_status_size;
1823
1824         return sz;
1825 }
1826
1827 static int write_note_info(struct elf_note_info *info,
1828                            struct file *file, loff_t *foffset)
1829 {
1830         int i;
1831         struct list_head *t;
1832
1833         for (i = 0; i < info->numnote; i++)
1834                 if (!writenote(info->notes + i, file, foffset))
1835                         return 0;
1836
1837         /* write out the thread status notes section */
1838         list_for_each(t, &info->thread_list) {
1839                 struct elf_thread_status *tmp =
1840                                 list_entry(t, struct elf_thread_status, list);
1841
1842                 for (i = 0; i < tmp->num_notes; i++)
1843                         if (!writenote(&tmp->notes[i], file, foffset))
1844                                 return 0;
1845         }
1846
1847         return 1;
1848 }
1849
1850 static void free_note_info(struct elf_note_info *info)
1851 {
1852         while (!list_empty(&info->thread_list)) {
1853                 struct list_head *tmp = info->thread_list.next;
1854                 list_del(tmp);
1855                 kfree(list_entry(tmp, struct elf_thread_status, list));
1856         }
1857
1858         kfree(info->prstatus);
1859         kfree(info->psinfo);
1860         kfree(info->notes);
1861         kfree(info->fpu);
1862 #ifdef ELF_CORE_COPY_XFPREGS
1863         kfree(info->xfpu);
1864 #endif
1865 }
1866
1867 #endif
1868
1869 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1870                                         struct vm_area_struct *gate_vma)
1871 {
1872         struct vm_area_struct *ret = tsk->mm->mmap;
1873
1874         if (ret)
1875                 return ret;
1876         return gate_vma;
1877 }
1878 /*
1879  * Helper function for iterating across a vma list.  It ensures that the caller
1880  * will visit `gate_vma' prior to terminating the search.
1881  */
1882 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1883                                         struct vm_area_struct *gate_vma)
1884 {
1885         struct vm_area_struct *ret;
1886
1887         ret = this_vma->vm_next;
1888         if (ret)
1889                 return ret;
1890         if (this_vma == gate_vma)
1891                 return NULL;
1892         return gate_vma;
1893 }
1894
1895 /*
1896  * Actual dumper
1897  *
1898  * This is a two-pass process; first we find the offsets of the bits,
1899  * and then they are actually written out.  If we run out of core limit
1900  * we just truncate.
1901  */
1902 static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
1903 {
1904         int has_dumped = 0;
1905         mm_segment_t fs;
1906         int segs;
1907         size_t size = 0;
1908         struct vm_area_struct *vma, *gate_vma;
1909         struct elfhdr *elf = NULL;
1910         loff_t offset = 0, dataoff, foffset;
1911         unsigned long mm_flags;
1912         struct elf_note_info info;
1913
1914         /*
1915          * We no longer stop all VM operations.
1916          *
1917          * This is because those proceses that could possibly change map_count
1918          * or the mmap / vma pages are now blocked in do_exit on current
1919          * finishing this core dump.
1920          *
1921          * Only ptrace can touch these memory addresses, but it doesn't change
1922          * the map_count or the pages allocated. So no possibility of crashing
1923          * exists while dumping the mm->vm_next areas to the core file.
1924          */
1925
1926         /* alloc memory for large data structures: too large to be on stack */
1927         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1928         if (!elf)
1929                 goto out;
1930
1931         segs = current->mm->map_count;
1932 #ifdef ELF_CORE_EXTRA_PHDRS
1933         segs += ELF_CORE_EXTRA_PHDRS;
1934 #endif
1935
1936         gate_vma = get_gate_vma(current);
1937         if (gate_vma != NULL)
1938                 segs++;
1939
1940         /*
1941          * Collect all the non-memory information about the process for the
1942          * notes.  This also sets up the file header.
1943          */
1944         if (!fill_note_info(elf, segs + 1, /* including notes section */
1945                             &info, signr, regs))
1946                 goto cleanup;
1947
1948         has_dumped = 1;
1949         current->flags |= PF_DUMPCORE;
1950
1951         fs = get_fs();
1952         set_fs(KERNEL_DS);
1953
1954         DUMP_WRITE(elf, sizeof(*elf));
1955         offset += sizeof(*elf);                         /* Elf header */
1956         offset += (segs + 1) * sizeof(struct elf_phdr); /* Program headers */
1957         foffset = offset;
1958
1959         /* Write notes phdr entry */
1960         {
1961                 struct elf_phdr phdr;
1962                 size_t sz = get_note_info_size(&info);
1963
1964                 sz += elf_coredump_extra_notes_size();
1965
1966                 fill_elf_note_phdr(&phdr, sz, offset);
1967                 offset += sz;
1968                 DUMP_WRITE(&phdr, sizeof(phdr));
1969         }
1970
1971         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
1972
1973         /*
1974          * We must use the same mm->flags while dumping core to avoid
1975          * inconsistency between the program headers and bodies, otherwise an
1976          * unusable core file can be generated.
1977          */
1978         mm_flags = current->mm->flags;
1979
1980         /* Write program headers for segments dump */
1981         for (vma = first_vma(current, gate_vma); vma != NULL;
1982                         vma = next_vma(vma, gate_vma)) {
1983                 struct elf_phdr phdr;
1984
1985                 phdr.p_type = PT_LOAD;
1986                 phdr.p_offset = offset;
1987                 phdr.p_vaddr = vma->vm_start;
1988                 phdr.p_paddr = 0;
1989                 phdr.p_filesz = vma_dump_size(vma, mm_flags);
1990                 phdr.p_memsz = vma->vm_end - vma->vm_start;
1991                 offset += phdr.p_filesz;
1992                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
1993                 if (vma->vm_flags & VM_WRITE)
1994                         phdr.p_flags |= PF_W;
1995                 if (vma->vm_flags & VM_EXEC)
1996                         phdr.p_flags |= PF_X;
1997                 phdr.p_align = ELF_EXEC_PAGESIZE;
1998
1999                 DUMP_WRITE(&phdr, sizeof(phdr));
2000         }
2001
2002 #ifdef ELF_CORE_WRITE_EXTRA_PHDRS
2003         ELF_CORE_WRITE_EXTRA_PHDRS;
2004 #endif
2005
2006         /* write out the notes section */
2007         if (!write_note_info(&info, file, &foffset))
2008                 goto end_coredump;
2009
2010         if (elf_coredump_extra_notes_write(file, &foffset))
2011                 goto end_coredump;
2012
2013         /* Align to page */
2014         DUMP_SEEK(dataoff - foffset);
2015
2016         for (vma = first_vma(current, gate_vma); vma != NULL;
2017                         vma = next_vma(vma, gate_vma)) {
2018                 unsigned long addr;
2019                 unsigned long end;
2020
2021                 end = vma->vm_start + vma_dump_size(vma, mm_flags);
2022
2023                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2024                         struct page *page;
2025                         struct vm_area_struct *tmp_vma;
2026
2027                         if (get_user_pages(current, current->mm, addr, 1, 0, 1,
2028                                                 &page, &tmp_vma) <= 0) {
2029                                 DUMP_SEEK(PAGE_SIZE);
2030                         } else {
2031                                 if (page == ZERO_PAGE(0)) {
2032                                         if (!dump_seek(file, PAGE_SIZE)) {
2033                                                 page_cache_release(page);
2034                                                 goto end_coredump;
2035                                         }
2036                                 } else {
2037                                         void *kaddr;
2038                                         flush_cache_page(tmp_vma, addr,
2039                                                          page_to_pfn(page));
2040                                         kaddr = kmap(page);
2041                                         if ((size += PAGE_SIZE) > limit ||
2042                                             !dump_write(file, kaddr,
2043                                             PAGE_SIZE)) {
2044                                                 kunmap(page);
2045                                                 page_cache_release(page);
2046                                                 goto end_coredump;
2047                                         }
2048                                         kunmap(page);
2049                                 }
2050                                 page_cache_release(page);
2051                         }
2052                 }
2053         }
2054
2055 #ifdef ELF_CORE_WRITE_EXTRA_DATA
2056         ELF_CORE_WRITE_EXTRA_DATA;
2057 #endif
2058
2059 end_coredump:
2060         set_fs(fs);
2061
2062 cleanup:
2063         free_note_info(&info);
2064         kfree(elf);
2065 out:
2066         return has_dumped;
2067 }
2068
2069 #endif          /* USE_ELF_CORE_DUMP */
2070
2071 static int __init init_elf_binfmt(void)
2072 {
2073         return register_binfmt(&elf_format);
2074 }
2075
2076 static void __exit exit_elf_binfmt(void)
2077 {
2078         /* Remove the COFF and ELF loaders. */
2079         unregister_binfmt(&elf_format);
2080 }
2081
2082 core_initcall(init_elf_binfmt);
2083 module_exit(exit_elf_binfmt);
2084 MODULE_LICENSE("GPL");