fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/mm.h>
  16 #include <linux/mman.h>
  17 #include <linux/errno.h>
  18 #include <linux/signal.h>
  19 #include <linux/binfmts.h>
  20 #include <linux/string.h>
  21 #include <linux/file.h>
  22 #include <linux/slab.h>
  23 #include <linux/personality.h>
  24 #include <linux/elfcore.h>
  25 #include <linux/init.h>
  26 #include <linux/highuid.h>
  27 #include <linux/compiler.h>
  28 #include <linux/highmem.h>
  29 #include <linux/pagemap.h>
  30 #include <linux/security.h>
  31 #include <linux/random.h>
  32 #include <linux/elf.h>
  33 #include <linux/utsname.h>
  34 #include <linux/coredump.h>
  35 #include <asm/uaccess.h>
  36 #include <asm/param.h>
  37 #include <asm/page.h>
  38 #include <asm/exec.h>
  39
  40 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
  41 static int load_elf_library(struct file *);
  42 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
  43                                 int, int, unsigned long);
  44
  45 /*
  46  * If we don't support core dumping, then supply a NULL so we
  47  * don't even try.
  48  */
  49 #ifdef CONFIG_ELF_CORE
  50 static int elf_core_dump(struct coredump_params *cprm);
  51 #else
  52 #define elf_core_dump   NULL
  53 #endif
  54
  55 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  56 #define ELF_MIN_ALIGN   ELF_EXEC_PAGESIZE
  57 #else
  58 #define ELF_MIN_ALIGN   PAGE_SIZE
  59 #endif
  60
  61 #ifndef ELF_CORE_EFLAGS
  62 #define ELF_CORE_EFLAGS 0
  63 #endif
  64
  65 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  66 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  67 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  68
  69 static struct linux_binfmt elf_format = {
  70         .module         = THIS_MODULE,
  71         .load_binary    = load_elf_binary,
  72         .load_shlib     = load_elf_library,
  73         .core_dump      = elf_core_dump,
  74         .min_coredump   = ELF_EXEC_PAGESIZE,
  75 };
  76
  77 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  78
  79 static int set_brk(unsigned long start, unsigned long end)
  80 {
  81         start = ELF_PAGEALIGN(start);
  82         end = ELF_PAGEALIGN(end);
  83         if (end > start) {
  84                 unsigned long addr;
  85                 down_write(&current->mm->mmap_sem);
  86                 addr = do_brk(start, end - start);
  87                 up_write(&current->mm->mmap_sem);
  88                 if (BAD_ADDR(addr))
  89                         return addr;
  90         }
  91         current->mm->start_brk = current->mm->brk = end;
  92         return 0;
  93 }
  94
  95 /* We need to explicitly zero any fractional pages
  96    after the data section (i.e. bss).  This would
  97    contain the junk from the file that should not
  98    be in memory
  99  */
 100 static int padzero(unsigned long elf_bss)
 101 {
 102         unsigned long nbyte;
 103
 104         nbyte = ELF_PAGEOFFSET(elf_bss);
 105         if (nbyte) {
 106                 nbyte = ELF_MIN_ALIGN - nbyte;
 107                 if (clear_user((void __user *) elf_bss, nbyte))
 108                         return -EFAULT;
 109         }
 110         return 0;
 111 }
 112
 113 /* Let's use some macros to make this stack manipulation a little clearer */
 114 #ifdef CONFIG_STACK_GROWSUP
 115 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 116 #define STACK_ROUND(sp, items) \
 117         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 118 #define STACK_ALLOC(sp, len) ({ \
 119         elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
 120         old_sp; })
 121 #else
 122 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 123 #define STACK_ROUND(sp, items) \
 124         (((unsigned long) (sp - items)) &~ 15UL)
 125 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 126 #endif
 127
 128 #ifndef ELF_BASE_PLATFORM
 129 /*
 130  * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 131  * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 132  * will be copied to the user stack in the same manner as AT_PLATFORM.
 133  */
 134 #define ELF_BASE_PLATFORM NULL
 135 #endif
 136
 137 static int
 138 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 139                 unsigned long load_addr, unsigned long interp_load_addr)
 140 {
 141         unsigned long p = bprm->p;
 142         int argc = bprm->argc;
 143         int envc = bprm->envc;
 144         elf_addr_t __user *argv;
 145         elf_addr_t __user *envp;
 146         elf_addr_t __user *sp;
 147         elf_addr_t __user *u_platform;
 148         elf_addr_t __user *u_base_platform;
 149         elf_addr_t __user *u_rand_bytes;
 150         const char *k_platform = ELF_PLATFORM;
 151         const char *k_base_platform = ELF_BASE_PLATFORM;
 152         unsigned char k_rand_bytes[16];
 153         int items;
 154         elf_addr_t *elf_info;
 155         int ei_index = 0;
 156         const struct cred *cred = current_cred();
 157         struct vm_area_struct *vma;
 158
 159         /*
 160          * In some cases (e.g. Hyper-Threading), we want to avoid L1
 161          * evictions by the processes running on the same package. One
 162          * thing we can do is to shuffle the initial stack for them.
 163          */
 164
 165         p = arch_align_stack(p);
 166
 167         /*
 168          * If this architecture has a platform capability string, copy it
 169          * to userspace.  In some cases (Sparc), this info is impossible
 170          * for userspace to get any other way, in others (i386) it is
 171          * merely difficult.
 172          */
 173         u_platform = NULL;
 174         if (k_platform) {
 175                 size_t len = strlen(k_platform) + 1;
 176
 177                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 178                 if (__copy_to_user(u_platform, k_platform, len))
 179                         return -EFAULT;
 180         }
 181
 182         /*
 183          * If this architecture has a "base" platform capability
 184          * string, copy it to userspace.
 185          */
 186         u_base_platform = NULL;
 187         if (k_base_platform) {
 188                 size_t len = strlen(k_base_platform) + 1;
 189
 190                 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 191                 if (__copy_to_user(u_base_platform, k_base_platform, len))
 192                         return -EFAULT;
 193         }
 194
 195         /*
 196          * Generate 16 random bytes for userspace PRNG seeding.
 197          */
 198         get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
 199         u_rand_bytes = (elf_addr_t __user *)
 200                        STACK_ALLOC(p, sizeof(k_rand_bytes));
 201         if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
 202                 return -EFAULT;
 203
 204         /* Create the ELF interpreter info */
 205         elf_info = (elf_addr_t *)current->mm->saved_auxv;
 206         /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
 207 #define NEW_AUX_ENT(id, val) \
 208         do { \
 209                 elf_info[ei_index++] = id; \
 210                 elf_info[ei_index++] = val; \
 211         } while (0)
 212
 213 #ifdef ARCH_DLINFO
 214         /*
 215          * ARCH_DLINFO must come first so PPC can do its special alignment of
 216          * AUXV.
 217          * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
 218          * ARCH_DLINFO changes
 219          */
 220         ARCH_DLINFO;
 221 #endif
 222         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 223         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 224         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 225         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 226         NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 227         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 228         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 229         NEW_AUX_ENT(AT_FLAGS, 0);
 230         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 231         NEW_AUX_ENT(AT_UID, cred->uid);
 232         NEW_AUX_ENT(AT_EUID, cred->euid);
 233         NEW_AUX_ENT(AT_GID, cred->gid);
 234         NEW_AUX_ENT(AT_EGID, cred->egid);
 235         NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
 236         NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
 237         NEW_AUX_ENT(AT_EXECFN, bprm->exec);
 238         if (k_platform) {
 239                 NEW_AUX_ENT(AT_PLATFORM,
 240                             (elf_addr_t)(unsigned long)u_platform);
 241         }
 242         if (k_base_platform) {
 243                 NEW_AUX_ENT(AT_BASE_PLATFORM,
 244                             (elf_addr_t)(unsigned long)u_base_platform);
 245         }
 246         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 247                 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
 248         }
 249 #undef NEW_AUX_ENT
 250         /* AT_NULL is zero; clear the rest too */
 251         memset(&elf_info[ei_index], 0,
 252                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 253
 254         /* And advance past the AT_NULL entry.  */
 255         ei_index += 2;
 256
 257         sp = STACK_ADD(p, ei_index);
 258
 259         items = (argc + 1) + (envc + 1) + 1;
 260         bprm->p = STACK_ROUND(sp, items);
 261
 262         /* Point sp at the lowest address on the stack */
 263 #ifdef CONFIG_STACK_GROWSUP
 264         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 265         bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
 266 #else
 267         sp = (elf_addr_t __user *)bprm->p;
 268 #endif
 269
 270
 271         /*
 272          * Grow the stack manually; some architectures have a limit on how
 273          * far ahead a user-space access may be in order to grow the stack.
 274          */
 275         vma = find_extend_vma(current->mm, bprm->p);
 276         if (!vma)
 277                 return -EFAULT;
 278
 279         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 280         if (__put_user(argc, sp++))
 281                 return -EFAULT;
 282         argv = sp;
 283         envp = argv + argc + 1;
 284
 285         /* Populate argv and envp */
 286         p = current->mm->arg_end = current->mm->arg_start;
 287         while (argc-- > 0) {
 288                 size_t len;
 289                 if (__put_user((elf_addr_t)p, argv++))
 290                         return -EFAULT;
 291                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 292                 if (!len || len > MAX_ARG_STRLEN)
 293                         return -EINVAL;
 294                 p += len;
 295         }
 296         if (__put_user(0, argv))
 297                 return -EFAULT;
 298         current->mm->arg_end = current->mm->env_start = p;
 299         while (envc-- > 0) {
 300                 size_t len;
 301                 if (__put_user((elf_addr_t)p, envp++))
 302                         return -EFAULT;
 303                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
 304                 if (!len || len > MAX_ARG_STRLEN)
 305                         return -EINVAL;
 306                 p += len;
 307         }
 308         if (__put_user(0, envp))
 309                 return -EFAULT;
 310         current->mm->env_end = p;
 311
 312         /* Put the elf_info on the stack in the right place.  */
 313         sp = (elf_addr_t __user *)envp + 1;
 314         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 315                 return -EFAULT;
 316         return 0;
 317 }
 318
 319 static unsigned long elf_map(struct file *filep, unsigned long addr,
 320                 struct elf_phdr *eppnt, int prot, int type,
 321                 unsigned long total_size)
 322 {
 323         unsigned long map_addr;
 324         unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
 325         unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
 326         addr = ELF_PAGESTART(addr);
 327         size = ELF_PAGEALIGN(size);
 328
 329         /* mmap() will return -EINVAL if given a zero size, but a
 330          * segment with zero filesize is perfectly valid */
 331         if (!size)
 332                 return addr;
 333
 334         down_write(&current->mm->mmap_sem);
 335         /*
 336         * total_size is the size of the ELF (interpreter) image.
 337         * The _first_ mmap needs to know the full size, otherwise
 338         * randomization might put this image into an overlapping
 339         * position with the ELF binary image. (since size < total_size)
 340         * So we first map the 'big' image - and unmap the remainder at
 341         * the end. (which unmap is needed for ELF images with holes.)
 342         */
 343         if (total_size) {
 344                 total_size = ELF_PAGEALIGN(total_size);
 345                 map_addr = do_mmap(filep, addr, total_size, prot, type, off);
 346                 if (!BAD_ADDR(map_addr))
 347                         do_munmap(current->mm, map_addr+size, total_size-size);
 348         } else
 349                 map_addr = do_mmap(filep, addr, size, prot, type, off);
 350
 351         up_write(&current->mm->mmap_sem);
 352         return(map_addr);
 353 }
 354
 355 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
 356 {
 357         int i, first_idx = -1, last_idx = -1;
 358
 359         for (i = 0; i < nr; i++) {
 360                 if (cmds[i].p_type == PT_LOAD) {
 361                         last_idx = i;
 362                         if (first_idx == -1)
 363                                 first_idx = i;
 364                 }
 365         }
 366         if (first_idx == -1)
 367                 return 0;
 368
 369         return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
 370                                 ELF_PAGESTART(cmds[first_idx].p_vaddr);
 371 }
 372
 373
 374 /* This is much more generalized than the library routine read function,
 375    so we keep this separate.  Technically the library read function
 376    is only provided so that we can read a.out libraries that have
 377    an ELF header */
 378
 379 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 380                 struct file *interpreter, unsigned long *interp_map_addr,
 381                 unsigned long no_base)
 382 {
 383         struct elf_phdr *elf_phdata;
 384         struct elf_phdr *eppnt;
 385         unsigned long load_addr = 0;
 386         int load_addr_set = 0;
 387         unsigned long last_bss = 0, elf_bss = 0;
 388         unsigned long error = ~0UL;
 389         unsigned long total_size;
 390         int retval, i, size;
 391
 392         /* First of all, some simple consistency checks */
 393         if (interp_elf_ex->e_type != ET_EXEC &&
 394             interp_elf_ex->e_type != ET_DYN)
 395                 goto out;
 396         if (!elf_check_arch(interp_elf_ex))
 397                 goto out;
 398         if (!interpreter->f_op || !interpreter->f_op->mmap)
 399                 goto out;
 400
 401         /*
 402          * If the size of this structure has changed, then punt, since
 403          * we will be doing the wrong thing.
 404          */
 405         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 406                 goto out;
 407         if (interp_elf_ex->e_phnum < 1 ||
 408                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 409                 goto out;
 410
 411         /* Now read in all of the header information */
 412         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 413         if (size > ELF_MIN_ALIGN)
 414                 goto out;
 415         elf_phdata = kmalloc(size, GFP_KERNEL);
 416         if (!elf_phdata)
 417                 goto out;
 418
 419         retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
 420                              (char *)elf_phdata, size);
 421         error = -EIO;
 422         if (retval != size) {
 423                 if (retval < 0)
 424                         error = retval;
 425                 goto out_close;
 426         }
 427
 428         total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
 429         if (!total_size) {
 430                 error = -EINVAL;
 431                 goto out_close;
 432         }
 433
 434         eppnt = elf_phdata;
 435         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 436                 if (eppnt->p_type == PT_LOAD) {
 437                         int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 438                         int elf_prot = 0;
 439                         unsigned long vaddr = 0;
 440                         unsigned long k, map_addr;
 441
 442                         if (eppnt->p_flags & PF_R)
 443                                 elf_prot = PROT_READ;
 444                         if (eppnt->p_flags & PF_W)
 445                                 elf_prot |= PROT_WRITE;
 446                         if (eppnt->p_flags & PF_X)
 447                                 elf_prot |= PROT_EXEC;
 448                         vaddr = eppnt->p_vaddr;
 449                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 450                                 elf_type |= MAP_FIXED;
 451                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
 452                                 load_addr = -vaddr;
 453
 454                         map_addr = elf_map(interpreter, load_addr + vaddr,
 455                                         eppnt, elf_prot, elf_type, total_size);
 456                         total_size = 0;
 457                         if (!*interp_map_addr)
 458                                 *interp_map_addr = map_addr;
 459                         error = map_addr;
 460                         if (BAD_ADDR(map_addr))
 461                                 goto out_close;
 462
 463                         if (!load_addr_set &&
 464                             interp_elf_ex->e_type == ET_DYN) {
 465                                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 466                                 load_addr_set = 1;
 467                         }
 468
 469                         /*
 470                          * Check to see if the section's size will overflow the
 471                          * allowed task size. Note that p_filesz must always be
 472                          * <= p_memsize so it's only necessary to check p_memsz.
 473                          */
 474                         k = load_addr + eppnt->p_vaddr;
 475                         if (BAD_ADDR(k) ||
 476                             eppnt->p_filesz > eppnt->p_memsz ||
 477                             eppnt->p_memsz > TASK_SIZE ||
 478                             TASK_SIZE - eppnt->p_memsz < k) {
 479                                 error = -ENOMEM;
 480                                 goto out_close;
 481                         }
 482
 483                         /*
 484                          * Find the end of the file mapping for this phdr, and
 485                          * keep track of the largest address we see for this.
 486                          */
 487                         k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 488                         if (k > elf_bss)
 489                                 elf_bss = k;
 490
 491                         /*
 492                          * Do the same thing for the memory mapping - between
 493                          * elf_bss and last_bss is the bss section.
 494                          */
 495                         k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 496                         if (k > last_bss)
 497                                 last_bss = k;
 498                 }
 499         }
 500
 501         if (last_bss > elf_bss) {
 502                 /*
 503                  * Now fill out the bss section.  First pad the last page up
 504                  * to the page boundary, and then perform a mmap to make sure
 505                  * that there are zero-mapped pages up to and including the
 506                  * last bss page.
 507                  */
 508                 if (padzero(elf_bss)) {
 509                         error = -EFAULT;
 510                         goto out_close;
 511                 }
 512
 513                 /* What we have mapped so far */
 514                 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 515
 516                 /* Map the last of the bss segment */
 517                 down_write(&current->mm->mmap_sem);
 518                 error = do_brk(elf_bss, last_bss - elf_bss);
 519                 up_write(&current->mm->mmap_sem);
 520                 if (BAD_ADDR(error))
 521                         goto out_close;
 522         }
 523
 524         error = load_addr;
 525
 526 out_close:
 527         kfree(elf_phdata);
 528 out:
 529         return error;
 530 }
 531
 532 /*
 533  * These are the functions used to load ELF style executables and shared
 534  * libraries.  There is no binary dependent code anywhere else.
 535  */
 536
 537 #define INTERPRETER_NONE 0
 538 #define INTERPRETER_ELF 2
 539
 540 #ifndef STACK_RND_MASK
 541 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 542 #endif
 543
 544 static unsigned long randomize_stack_top(unsigned long stack_top)
 545 {
 546         unsigned int random_variable = 0;
 547
 548         if ((current->flags & PF_RANDOMIZE) &&
 549                 !(current->personality & ADDR_NO_RANDOMIZE)) {
 550                 random_variable = get_random_int() & STACK_RND_MASK;
 551                 random_variable <<= PAGE_SHIFT;
 552         }
 553 #ifdef CONFIG_STACK_GROWSUP
 554         return PAGE_ALIGN(stack_top) + random_variable;
 555 #else
 556         return PAGE_ALIGN(stack_top) - random_variable;
 557 #endif
 558 }
 559
 560 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 561 {
 562         struct file *interpreter = NULL; /* to shut gcc up */
 563         unsigned long load_addr = 0, load_bias = 0;
 564         int load_addr_set = 0;
 565         char * elf_interpreter = NULL;
 566         unsigned long error;
 567         struct elf_phdr *elf_ppnt, *elf_phdata;
 568         unsigned long elf_bss, elf_brk;
 569         int retval, i;
 570         unsigned int size;
 571         unsigned long elf_entry;
 572         unsigned long interp_load_addr = 0;
 573         unsigned long start_code, end_code, start_data, end_data;
 574         unsigned long reloc_func_desc __maybe_unused = 0;
 575         int executable_stack = EXSTACK_DEFAULT;
 576         unsigned long def_flags = 0;
 577         struct {
 578                 struct elfhdr elf_ex;
 579                 struct elfhdr interp_elf_ex;
 580         } *loc;
 581
 582         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 583         if (!loc) {
 584                 retval = -ENOMEM;
 585                 goto out_ret;
 586         }
 587
 588         /* Get the exec-header */
 589         loc->elf_ex = *((struct elfhdr *)bprm->buf);
 590
 591         retval = -ENOEXEC;
 592         /* First of all, some simple consistency checks */
 593         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 594                 goto out;
 595
 596         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 597                 goto out;
 598         if (!elf_check_arch(&loc->elf_ex))
 599                 goto out;
 600         if (!bprm->file->f_op || !bprm->file->f_op->mmap)
 601                 goto out;
 602
 603         /* Now read in all of the header information */
 604         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 605                 goto out;
 606         if (loc->elf_ex.e_phnum < 1 ||
 607                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 608                 goto out;
 609         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 610         retval = -ENOMEM;
 611         elf_phdata = kmalloc(size, GFP_KERNEL);
 612         if (!elf_phdata)
 613                 goto out;
 614
 615         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
 616                              (char *)elf_phdata, size);
 617         if (retval != size) {
 618                 if (retval >= 0)
 619                         retval = -EIO;
 620                 goto out_free_ph;
 621         }
 622
 623         elf_ppnt = elf_phdata;
 624         elf_bss = 0;
 625         elf_brk = 0;
 626
 627         start_code = ~0UL;
 628         end_code = 0;
 629         start_data = 0;
 630         end_data = 0;
 631
 632         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 633                 if (elf_ppnt->p_type == PT_INTERP) {
 634                         /* This is the program interpreter used for
 635                          * shared libraries - for now assume that this
 636                          * is an a.out format binary
 637                          */
 638                         retval = -ENOEXEC;
 639                         if (elf_ppnt->p_filesz > PATH_MAX ||
 640                             elf_ppnt->p_filesz < 2)
 641                                 goto out_free_ph;
 642
 643                         retval = -ENOMEM;
 644                         elf_interpreter = kmalloc(elf_ppnt->p_filesz,
 645                                                   GFP_KERNEL);
 646                         if (!elf_interpreter)
 647                                 goto out_free_ph;
 648
 649                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 650                                              elf_interpreter,
 651                                              elf_ppnt->p_filesz);
 652                         if (retval != elf_ppnt->p_filesz) {
 653                                 if (retval >= 0)
 654                                         retval = -EIO;
 655                                 goto out_free_interp;
 656                         }
 657                         /* make sure path is NULL terminated */
 658                         retval = -ENOEXEC;
 659                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 660                                 goto out_free_interp;
 661
 662                         interpreter = open_exec(elf_interpreter);
 663                         retval = PTR_ERR(interpreter);
 664                         if (IS_ERR(interpreter))
 665                                 goto out_free_interp;
 666
 667                         /*
 668                          * If the binary is not readable then enforce
 669                          * mm->dumpable = 0 regardless of the interpreter's
 670                          * permissions.
 671                          */
 672                         would_dump(bprm, interpreter);
 673
 674                         retval = kernel_read(interpreter, 0, bprm->buf,
 675                                              BINPRM_BUF_SIZE);
 676                         if (retval != BINPRM_BUF_SIZE) {
 677                                 if (retval >= 0)
 678                                         retval = -EIO;
 679                                 goto out_free_dentry;
 680                         }
 681
 682                         /* Get the exec headers */
 683                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 684                         break;
 685                 }
 686                 elf_ppnt++;
 687         }
 688
 689         elf_ppnt = elf_phdata;
 690         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 691                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 692                         if (elf_ppnt->p_flags & PF_X)
 693                                 executable_stack = EXSTACK_ENABLE_X;
 694                         else
 695                                 executable_stack = EXSTACK_DISABLE_X;
 696                         break;
 697                 }
 698
 699         /* Some simple consistency checks for the interpreter */
 700         if (elf_interpreter) {
 701                 retval = -ELIBBAD;
 702                 /* Not an ELF interpreter */
 703                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 704                         goto out_free_dentry;
 705                 /* Verify the interpreter has a valid arch */
 706                 if (!elf_check_arch(&loc->interp_elf_ex))
 707                         goto out_free_dentry;
 708         }
 709
 710         /* Flush all traces of the currently running executable */
 711         retval = flush_old_exec(bprm);
 712         if (retval)
 713                 goto out_free_dentry;
 714
 715         /* OK, This is the point of no return */
 716         current->mm->def_flags = def_flags;
 717
 718         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 719            may depend on the personality.  */
 720         SET_PERSONALITY(loc->elf_ex);
 721         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 722                 current->personality |= READ_IMPLIES_EXEC;
 723
 724         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 725                 current->flags |= PF_RANDOMIZE;
 726
 727         setup_new_exec(bprm);
 728
 729         /* Do this so that we can load the interpreter, if need be.  We will
 730            change some of these later */
 731         current->mm->free_area_cache = current->mm->mmap_base;
 732         current->mm->cached_hole_size = 0;
 733         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 734                                  executable_stack);
 735         if (retval < 0) {
 736                 send_sig(SIGKILL, current, 0);
 737                 goto out_free_dentry;
 738         }
 739
 740         current->mm->start_stack = bprm->p;
 741
 742         /* Now we do a little grungy work by mmapping the ELF image into
 743            the correct location in memory. */
 744         for(i = 0, elf_ppnt = elf_phdata;
 745             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 746                 int elf_prot = 0, elf_flags;
 747                 unsigned long k, vaddr;
 748
 749                 if (elf_ppnt->p_type != PT_LOAD)
 750                         continue;
 751
 752                 if (unlikely (elf_brk > elf_bss)) {
 753                         unsigned long nbyte;
 754
 755                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 756                            before this one. Map anonymous pages, if needed,
 757                            and clear the area.  */
 758                         retval = set_brk(elf_bss + load_bias,
 759                                          elf_brk + load_bias);
 760                         if (retval) {
 761                                 send_sig(SIGKILL, current, 0);
 762                                 goto out_free_dentry;
 763                         }
 764                         nbyte = ELF_PAGEOFFSET(elf_bss);
 765                         if (nbyte) {
 766                                 nbyte = ELF_MIN_ALIGN - nbyte;
 767                                 if (nbyte > elf_brk - elf_bss)
 768                                         nbyte = elf_brk - elf_bss;
 769                                 if (clear_user((void __user *)elf_bss +
 770                                                         load_bias, nbyte)) {
 771                                         /*
 772                                          * This bss-zeroing can fail if the ELF
 773                                          * file specifies odd protections. So
 774                                          * we don't check the return value
 775                                          */
 776                                 }
 777                         }
 778                 }
 779
 780                 if (elf_ppnt->p_flags & PF_R)
 781                         elf_prot |= PROT_READ;
 782                 if (elf_ppnt->p_flags & PF_W)
 783                         elf_prot |= PROT_WRITE;
 784                 if (elf_ppnt->p_flags & PF_X)
 785                         elf_prot |= PROT_EXEC;
 786
 787                 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
 788
 789                 vaddr = elf_ppnt->p_vaddr;
 790                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 791                         elf_flags |= MAP_FIXED;
 792                 } else if (loc->elf_ex.e_type == ET_DYN) {
 793                         /* Try and get dynamic programs out of the way of the
 794                          * default mmap base, as well as whatever program they
 795                          * might try to exec.  This is because the brk will
 796                          * follow the loader, and is not movable.  */
 797 #ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
 798                         /* Memory randomization might have been switched off
 799                          * in runtime via sysctl.
 800                          * If that is the case, retain the original non-zero
 801                          * load_bias value in order to establish proper
 802                          * non-randomized mappings.
 803                          */
 804                         if (current->flags & PF_RANDOMIZE)
 805                                 load_bias = 0;
 806                         else
 807                                 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 808 #else
 809                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 810 #endif
 811                 }
 812
 813                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
 814                                 elf_prot, elf_flags, 0);
 815                 if (BAD_ADDR(error)) {
 816                         send_sig(SIGKILL, current, 0);
 817                         retval = IS_ERR((void *)error) ?
 818                                 PTR_ERR((void*)error) : -EINVAL;
 819                         goto out_free_dentry;
 820                 }
 821
 822                 if (!load_addr_set) {
 823                         load_addr_set = 1;
 824                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 825                         if (loc->elf_ex.e_type == ET_DYN) {
 826                                 load_bias += error -
 827                                              ELF_PAGESTART(load_bias + vaddr);
 828                                 load_addr += load_bias;
 829                                 reloc_func_desc = load_bias;
 830                         }
 831                 }
 832                 k = elf_ppnt->p_vaddr;
 833                 if (k < start_code)
 834                         start_code = k;
 835                 if (start_data < k)
 836                         start_data = k;
 837
 838                 /*
 839                  * Check to see if the section's size will overflow the
 840                  * allowed task size. Note that p_filesz must always be
 841                  * <= p_memsz so it is only necessary to check p_memsz.
 842                  */
 843                 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 844                     elf_ppnt->p_memsz > TASK_SIZE ||
 845                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 846                         /* set_brk can never work. Avoid overflows. */
 847                         send_sig(SIGKILL, current, 0);
 848                         retval = -EINVAL;
 849                         goto out_free_dentry;
 850                 }
 851
 852                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 853
 854                 if (k > elf_bss)
 855                         elf_bss = k;
 856                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 857                         end_code = k;
 858                 if (end_data < k)
 859                         end_data = k;
 860                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 861                 if (k > elf_brk)
 862                         elf_brk = k;
 863         }
 864
 865         loc->elf_ex.e_entry += load_bias;
 866         elf_bss += load_bias;
 867         elf_brk += load_bias;
 868         start_code += load_bias;
 869         end_code += load_bias;
 870         start_data += load_bias;
 871         end_data += load_bias;
 872
 873         /* Calling set_brk effectively mmaps the pages that we need
 874          * for the bss and break sections.  We must do this before
 875          * mapping in the interpreter, to make sure it doesn't wind
 876          * up getting placed where the bss needs to go.
 877          */
 878         retval = set_brk(elf_bss, elf_brk);
 879         if (retval) {
 880                 send_sig(SIGKILL, current, 0);
 881                 goto out_free_dentry;
 882         }
 883         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 884                 send_sig(SIGSEGV, current, 0);
 885                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 886                 goto out_free_dentry;
 887         }
 888
 889         if (elf_interpreter) {
 890                 unsigned long uninitialized_var(interp_map_addr);
 891
 892                 elf_entry = load_elf_interp(&loc->interp_elf_ex,
 893                                             interpreter,
 894                                             &interp_map_addr,
 895                                             load_bias);
 896                 if (!IS_ERR((void *)elf_entry)) {
 897                         /*
 898                          * load_elf_interp() returns relocation
 899                          * adjustment
 900                          */
 901                         interp_load_addr = elf_entry;
 902                         elf_entry += loc->interp_elf_ex.e_entry;
 903                 }
 904                 if (BAD_ADDR(elf_entry)) {
 905                         force_sig(SIGSEGV, current);
 906                         retval = IS_ERR((void *)elf_entry) ?
 907                                         (int)elf_entry : -EINVAL;
 908                         goto out_free_dentry;
 909                 }
 910                 reloc_func_desc = interp_load_addr;
 911
 912                 allow_write_access(interpreter);
 913                 fput(interpreter);
 914                 kfree(elf_interpreter);
 915         } else {
 916                 elf_entry = loc->elf_ex.e_entry;
 917                 if (BAD_ADDR(elf_entry)) {
 918                         force_sig(SIGSEGV, current);
 919                         retval = -EINVAL;
 920                         goto out_free_dentry;
 921                 }
 922         }
 923
 924         kfree(elf_phdata);
 925
 926         set_binfmt(&elf_format);
 927
 928 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 929         retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
 930         if (retval < 0) {
 931                 send_sig(SIGKILL, current, 0);
 932                 goto out;
 933         }
 934 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 935
 936         install_exec_creds(bprm);
 937         retval = create_elf_tables(bprm, &loc->elf_ex,
 938                           load_addr, interp_load_addr);
 939         if (retval < 0) {
 940                 send_sig(SIGKILL, current, 0);
 941                 goto out;
 942         }
 943         /* N.B. passed_fileno might not be initialized? */
 944         current->mm->end_code = end_code;
 945         current->mm->start_code = start_code;
 946         current->mm->start_data = start_data;
 947         current->mm->end_data = end_data;
 948         current->mm->start_stack = bprm->p;
 949
 950 #ifdef arch_randomize_brk
 951         if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
 952                 current->mm->brk = current->mm->start_brk =
 953                         arch_randomize_brk(current->mm);
 954 #ifdef CONFIG_COMPAT_BRK
 955                 current->brk_randomized = 1;
 956 #endif
 957         }
 958 #endif
 959
 960         if (current->personality & MMAP_PAGE_ZERO) {
 961                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 962                    and some applications "depend" upon this behavior.
 963                    Since we do not have the power to recompile these, we
 964                    emulate the SVr4 behavior. Sigh. */
 965                 down_write(&current->mm->mmap_sem);
 966                 error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 967                                 MAP_FIXED | MAP_PRIVATE, 0);
 968                 up_write(&current->mm->mmap_sem);
 969         }
 970
 971 #ifdef ELF_PLAT_INIT
 972         /*
 973          * The ABI may specify that certain registers be set up in special
 974          * ways (on i386 %edx is the address of a DT_FINI function, for
 975          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 976          * that the e_entry field is the address of the function descriptor
 977          * for the startup routine, rather than the address of the startup
 978          * routine itself.  This macro performs whatever initialization to
 979          * the regs structure is required as well as any relocations to the
 980          * function descriptor entries when executing dynamically links apps.
 981          */
 982         ELF_PLAT_INIT(regs, reloc_func_desc);
 983 #endif
 984
 985         start_thread(regs, elf_entry, bprm->p);
 986         retval = 0;
 987 out:
 988         kfree(loc);
 989 out_ret:
 990         return retval;
 991
 992         /* error cleanup */
 993 out_free_dentry:
 994         allow_write_access(interpreter);
 995         if (interpreter)
 996                 fput(interpreter);
 997 out_free_interp:
 998         kfree(elf_interpreter);
 999 out_free_ph:
1000         kfree(elf_phdata);
1001         goto out;
1002 }
1003
1004 /* This is really simpleminded and specialized - we are loading an
1005    a.out library that is given an ELF header. */
1006 static int load_elf_library(struct file *file)
1007 {
1008         struct elf_phdr *elf_phdata;
1009         struct elf_phdr *eppnt;
1010         unsigned long elf_bss, bss, len;
1011         int retval, error, i, j;
1012         struct elfhdr elf_ex;
1013
1014         error = -ENOEXEC;
1015         retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1016         if (retval != sizeof(elf_ex))
1017                 goto out;
1018
1019         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1020                 goto out;
1021
1022         /* First of all, some simple consistency checks */
1023         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1024             !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1025                 goto out;
1026
1027         /* Now read in all of the header information */
1028
1029         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1030         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1031
1032         error = -ENOMEM;
1033         elf_phdata = kmalloc(j, GFP_KERNEL);
1034         if (!elf_phdata)
1035                 goto out;
1036
1037         eppnt = elf_phdata;
1038         error = -ENOEXEC;
1039         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1040         if (retval != j)
1041                 goto out_free_ph;
1042
1043         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1044                 if ((eppnt + i)->p_type == PT_LOAD)
1045                         j++;
1046         if (j != 1)
1047                 goto out_free_ph;
1048
1049         while (eppnt->p_type != PT_LOAD)
1050                 eppnt++;
1051
1052         /* Now use mmap to map the library into memory. */
1053         down_write(&current->mm->mmap_sem);
1054         error = do_mmap(file,
1055                         ELF_PAGESTART(eppnt->p_vaddr),
1056                         (eppnt->p_filesz +
1057                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1058                         PROT_READ | PROT_WRITE | PROT_EXEC,
1059                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1060                         (eppnt->p_offset -
1061                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1062         up_write(&current->mm->mmap_sem);
1063         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1064                 goto out_free_ph;
1065
1066         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1067         if (padzero(elf_bss)) {
1068                 error = -EFAULT;
1069                 goto out_free_ph;
1070         }
1071
1072         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1073                             ELF_MIN_ALIGN - 1);
1074         bss = eppnt->p_memsz + eppnt->p_vaddr;
1075         if (bss > len) {
1076                 down_write(&current->mm->mmap_sem);
1077                 do_brk(len, bss - len);
1078                 up_write(&current->mm->mmap_sem);
1079         }
1080         error = 0;
1081
1082 out_free_ph:
1083         kfree(elf_phdata);
1084 out:
1085         return error;
1086 }
1087
1088 #ifdef CONFIG_ELF_CORE
1089 /*
1090  * ELF core dumper
1091  *
1092  * Modelled on fs/exec.c:aout_core_dump()
1093  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1094  */
1095
1096 /*
1097  * The purpose of always_dump_vma() is to make sure that special kernel mappings
1098  * that are useful for post-mortem analysis are included in every core dump.
1099  * In that way we ensure that the core dump is fully interpretable later
1100  * without matching up the same kernel and hardware config to see what PC values
1101  * meant. These special mappings include - vDSO, vsyscall, and other
1102  * architecture specific mappings
1103  */
1104 static bool always_dump_vma(struct vm_area_struct *vma)
1105 {
1106         /* Any vsyscall mappings? */
1107         if (vma == get_gate_vma(vma->vm_mm))
1108                 return true;
1109         /*
1110          * arch_vma_name() returns non-NULL for special architecture mappings,
1111          * such as vDSO sections.
1112          */
1113         if (arch_vma_name(vma))
1114                 return true;
1115
1116         return false;
1117 }
1118
1119 /*
1120  * Decide what to dump of a segment, part, all or none.
1121  */
1122 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1123                                    unsigned long mm_flags)
1124 {
1125 #define FILTER(type)    (mm_flags & (1UL << MMF_DUMP_##type))
1126
1127         /* always dump the vdso and vsyscall sections */
1128         if (always_dump_vma(vma))
1129                 goto whole;
1130
1131         if (vma->vm_flags & VM_NODUMP)
1132                 return 0;
1133
1134         /* Hugetlb memory check */
1135         if (vma->vm_flags & VM_HUGETLB) {
1136                 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1137                         goto whole;
1138                 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1139                         goto whole;
1140         }
1141
1142         /* Do not dump I/O mapped devices or special mappings */
1143         if (vma->vm_flags & (VM_IO | VM_RESERVED))
1144                 return 0;
1145
1146         /* By default, dump shared memory if mapped from an anonymous file. */
1147         if (vma->vm_flags & VM_SHARED) {
1148                 if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
1149                     FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1150                         goto whole;
1151                 return 0;
1152         }
1153
1154         /* Dump segments that have been written to.  */
1155         if (vma->anon_vma && FILTER(ANON_PRIVATE))
1156                 goto whole;
1157         if (vma->vm_file == NULL)
1158                 return 0;
1159
1160         if (FILTER(MAPPED_PRIVATE))
1161                 goto whole;
1162
1163         /*
1164          * If this looks like the beginning of a DSO or executable mapping,
1165          * check for an ELF header.  If we find one, dump the first page to
1166          * aid in determining what was mapped here.
1167          */
1168         if (FILTER(ELF_HEADERS) &&
1169             vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1170                 u32 __user *header = (u32 __user *) vma->vm_start;
1171                 u32 word;
1172                 mm_segment_t fs = get_fs();
1173                 /*
1174                  * Doing it this way gets the constant folded by GCC.
1175                  */
1176                 union {
1177                         u32 cmp;
1178                         char elfmag[SELFMAG];
1179                 } magic;
1180                 BUILD_BUG_ON(SELFMAG != sizeof word);
1181                 magic.elfmag[EI_MAG0] = ELFMAG0;
1182                 magic.elfmag[EI_MAG1] = ELFMAG1;
1183                 magic.elfmag[EI_MAG2] = ELFMAG2;
1184                 magic.elfmag[EI_MAG3] = ELFMAG3;
1185                 /*
1186                  * Switch to the user "segment" for get_user(),
1187                  * then put back what elf_core_dump() had in place.
1188                  */
1189                 set_fs(USER_DS);
1190                 if (unlikely(get_user(word, header)))
1191                         word = 0;
1192                 set_fs(fs);
1193                 if (word == magic.cmp)
1194                         return PAGE_SIZE;
1195         }
1196
1197 #undef  FILTER
1198
1199         return 0;
1200
1201 whole:
1202         return vma->vm_end - vma->vm_start;
1203 }
1204
1205 /* An ELF note in memory */
1206 struct memelfnote
1207 {
1208         const char *name;
1209         int type;
1210         unsigned int datasz;
1211         void *data;
1212 };
1213
1214 static int notesize(struct memelfnote *en)
1215 {
1216         int sz;
1217
1218         sz = sizeof(struct elf_note);
1219         sz += roundup(strlen(en->name) + 1, 4);
1220         sz += roundup(en->datasz, 4);
1221
1222         return sz;
1223 }
1224
1225 #define DUMP_WRITE(addr, nr, foffset)   \
1226         do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
1227
1228 static int alignfile(struct file *file, loff_t *foffset)
1229 {
1230         static const char buf[4] = { 0, };
1231         DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
1232         return 1;
1233 }
1234
1235 static int writenote(struct memelfnote *men, struct file *file,
1236                         loff_t *foffset)
1237 {
1238         struct elf_note en;
1239         en.n_namesz = strlen(men->name) + 1;
1240         en.n_descsz = men->datasz;
1241         en.n_type = men->type;
1242
1243         DUMP_WRITE(&en, sizeof(en), foffset);
1244         DUMP_WRITE(men->name, en.n_namesz, foffset);
1245         if (!alignfile(file, foffset))
1246                 return 0;
1247         DUMP_WRITE(men->data, men->datasz, foffset);
1248         if (!alignfile(file, foffset))
1249                 return 0;
1250
1251         return 1;
1252 }
1253 #undef DUMP_WRITE
1254
1255 static void fill_elf_header(struct elfhdr *elf, int segs,
1256                             u16 machine, u32 flags, u8 osabi)
1257 {
1258         memset(elf, 0, sizeof(*elf));
1259
1260         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1261         elf->e_ident[EI_CLASS] = ELF_CLASS;
1262         elf->e_ident[EI_DATA] = ELF_DATA;
1263         elf->e_ident[EI_VERSION] = EV_CURRENT;
1264         elf->e_ident[EI_OSABI] = ELF_OSABI;
1265
1266         elf->e_type = ET_CORE;
1267         elf->e_machine = machine;
1268         elf->e_version = EV_CURRENT;
1269         elf->e_phoff = sizeof(struct elfhdr);
1270         elf->e_flags = flags;
1271         elf->e_ehsize = sizeof(struct elfhdr);
1272         elf->e_phentsize = sizeof(struct elf_phdr);
1273         elf->e_phnum = segs;
1274
1275         return;
1276 }
1277
1278 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1279 {
1280         phdr->p_type = PT_NOTE;
1281         phdr->p_offset = offset;
1282         phdr->p_vaddr = 0;
1283         phdr->p_paddr = 0;
1284         phdr->p_filesz = sz;
1285         phdr->p_memsz = 0;
1286         phdr->p_flags = 0;
1287         phdr->p_align = 0;
1288         return;
1289 }
1290
1291 static void fill_note(struct memelfnote *note, const char *name, int type,
1292                 unsigned int sz, void *data)
1293 {
1294         note->name = name;
1295         note->type = type;
1296         note->datasz = sz;
1297         note->data = data;
1298         return;
1299 }
1300
1301 /*
1302  * fill up all the fields in prstatus from the given task struct, except
1303  * registers which need to be filled up separately.
1304  */
1305 static void fill_prstatus(struct elf_prstatus *prstatus,
1306                 struct task_struct *p, long signr)
1307 {
1308         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1309         prstatus->pr_sigpend = p->pending.signal.sig[0];
1310         prstatus->pr_sighold = p->blocked.sig[0];
1311         rcu_read_lock();
1312         prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1313         rcu_read_unlock();
1314         prstatus->pr_pid = task_pid_vnr(p);
1315         prstatus->pr_pgrp = task_pgrp_vnr(p);
1316         prstatus->pr_sid = task_session_vnr(p);
1317         if (thread_group_leader(p)) {
1318                 struct task_cputime cputime;
1319
1320                 /*
1321                  * This is the record for the group leader.  It shows the
1322                  * group-wide total, not its individual thread total.
1323                  */
1324                 thread_group_cputime(p, &cputime);
1325                 cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1326                 cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1327         } else {
1328                 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1329                 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1330         }
1331         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1332         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1333 }
1334
1335 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1336                        struct mm_struct *mm)
1337 {
1338         const struct cred *cred;
1339         unsigned int i, len;
1340
1341         /* first copy the parameters from user space */
1342         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1343
1344         len = mm->arg_end - mm->arg_start;
1345         if (len >= ELF_PRARGSZ)
1346                 len = ELF_PRARGSZ-1;
1347         if (copy_from_user(&psinfo->pr_psargs,
1348                            (const char __user *)mm->arg_start, len))
1349                 return -EFAULT;
1350         for(i = 0; i < len; i++)
1351                 if (psinfo->pr_psargs[i] == 0)
1352                         psinfo->pr_psargs[i] = ' ';
1353         psinfo->pr_psargs[len] = 0;
1354
1355         rcu_read_lock();
1356         psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1357         rcu_read_unlock();
1358         psinfo->pr_pid = task_pid_vnr(p);
1359         psinfo->pr_pgrp = task_pgrp_vnr(p);
1360         psinfo->pr_sid = task_session_vnr(p);
1361
1362         i = p->state ? ffz(~p->state) + 1 : 0;
1363         psinfo->pr_state = i;
1364         psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1365         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1366         psinfo->pr_nice = task_nice(p);
1367         psinfo->pr_flag = p->flags;
1368         rcu_read_lock();
1369         cred = __task_cred(p);
1370         SET_UID(psinfo->pr_uid, cred->uid);
1371         SET_GID(psinfo->pr_gid, cred->gid);
1372         rcu_read_unlock();
1373         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1374
1375         return 0;
1376 }
1377
1378 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1379 {
1380         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1381         int i = 0;
1382         do
1383                 i += 2;
1384         while (auxv[i - 2] != AT_NULL);
1385         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1386 }
1387
1388 #ifdef CORE_DUMP_USE_REGSET
1389 #include <linux/regset.h>
1390
1391 struct elf_thread_core_info {
1392         struct elf_thread_core_info *next;
1393         struct task_struct *task;
1394         struct elf_prstatus prstatus;
1395         struct memelfnote notes[0];
1396 };
1397
1398 struct elf_note_info {
1399         struct elf_thread_core_info *thread;
1400         struct memelfnote psinfo;
1401         struct memelfnote auxv;
1402         size_t size;
1403         int thread_notes;
1404 };
1405
1406 /*
1407  * When a regset has a writeback hook, we call it on each thread before
1408  * dumping user memory.  On register window machines, this makes sure the
1409  * user memory backing the register data is up to date before we read it.
1410  */
1411 static void do_thread_regset_writeback(struct task_struct *task,
1412                                        const struct user_regset *regset)
1413 {
1414         if (regset->writeback)
1415                 regset->writeback(task, regset, 1);
1416 }
1417
1418 #ifndef PR_REG_SIZE
1419 #define PR_REG_SIZE(S) sizeof(S)
1420 #endif
1421
1422 #ifndef PRSTATUS_SIZE
1423 #define PRSTATUS_SIZE(S) sizeof(S)
1424 #endif
1425
1426 #ifndef PR_REG_PTR
1427 #define PR_REG_PTR(S) (&((S)->pr_reg))
1428 #endif
1429
1430 #ifndef SET_PR_FPVALID
1431 #define SET_PR_FPVALID(S, V) ((S)->pr_fpvalid = (V))
1432 #endif
1433
1434 static int fill_thread_core_info(struct elf_thread_core_info *t,
1435                                  const struct user_regset_view *view,
1436                                  long signr, size_t *total)
1437 {
1438         unsigned int i;
1439
1440         /*
1441          * NT_PRSTATUS is the one special case, because the regset data
1442          * goes into the pr_reg field inside the note contents, rather
1443          * than being the whole note contents.  We fill the reset in here.
1444          * We assume that regset 0 is NT_PRSTATUS.
1445          */
1446         fill_prstatus(&t->prstatus, t->task, signr);
1447         (void) view->regsets[0].get(t->task, &view->regsets[0],
1448                                     0, PR_REG_SIZE(t->prstatus.pr_reg),
1449                                     PR_REG_PTR(&t->prstatus), NULL);
1450
1451         fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1452                   PRSTATUS_SIZE(t->prstatus), &t->prstatus);
1453         *total += notesize(&t->notes[0]);
1454
1455         do_thread_regset_writeback(t->task, &view->regsets[0]);
1456
1457         /*
1458          * Each other regset might generate a note too.  For each regset
1459          * that has no core_note_type or is inactive, we leave t->notes[i]
1460          * all zero and we'll know to skip writing it later.
1461          */
1462         for (i = 1; i < view->n; ++i) {
1463                 const struct user_regset *regset = &view->regsets[i];
1464                 do_thread_regset_writeback(t->task, regset);
1465                 if (regset->core_note_type && regset->get &&
1466                     (!regset->active || regset->active(t->task, regset))) {
1467                         int ret;
1468                         size_t size = regset->n * regset->size;
1469                         void *data = kmalloc(size, GFP_KERNEL);
1470                         if (unlikely(!data))
1471                                 return 0;
1472                         ret = regset->get(t->task, regset,
1473                                           0, size, data, NULL);
1474                         if (unlikely(ret))
1475                                 kfree(data);
1476                         else {
1477                                 if (regset->core_note_type != NT_PRFPREG)
1478                                         fill_note(&t->notes[i], "LINUX",
1479                                                   regset->core_note_type,
1480                                                   size, data);
1481                                 else {
1482                                         SET_PR_FPVALID(&t->prstatus, 1);
1483                                         fill_note(&t->notes[i], "CORE",
1484                                                   NT_PRFPREG, size, data);
1485                                 }
1486                                 *total += notesize(&t->notes[i]);
1487                         }
1488                 }
1489         }
1490
1491         return 1;
1492 }
1493
1494 static int fill_note_info(struct elfhdr *elf, int phdrs,
1495                           struct elf_note_info *info,
1496                           long signr, struct pt_regs *regs)
1497 {
1498         struct task_struct *dump_task = current;
1499         const struct user_regset_view *view = task_user_regset_view(dump_task);
1500         struct elf_thread_core_info *t;
1501         struct elf_prpsinfo *psinfo;
1502         struct core_thread *ct;
1503         unsigned int i;
1504
1505         info->size = 0;
1506         info->thread = NULL;
1507
1508         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1509         if (psinfo == NULL)
1510                 return 0;
1511
1512         fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1513
1514         /*
1515          * Figure out how many notes we're going to need for each thread.
1516          */
1517         info->thread_notes = 0;
1518         for (i = 0; i < view->n; ++i)
1519                 if (view->regsets[i].core_note_type != 0)
1520                         ++info->thread_notes;
1521
1522         /*
1523          * Sanity check.  We rely on regset 0 being in NT_PRSTATUS,
1524          * since it is our one special case.
1525          */
1526         if (unlikely(info->thread_notes == 0) ||
1527             unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1528                 WARN_ON(1);
1529                 return 0;
1530         }
1531
1532         /*
1533          * Initialize the ELF file header.
1534          */
1535         fill_elf_header(elf, phdrs,
1536                         view->e_machine, view->e_flags, view->ei_osabi);
1537
1538         /*
1539          * Allocate a structure for each thread.
1540          */
1541         for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1542                 t = kzalloc(offsetof(struct elf_thread_core_info,
1543                                      notes[info->thread_notes]),
1544                             GFP_KERNEL);
1545                 if (unlikely(!t))
1546                         return 0;
1547
1548                 t->task = ct->task;
1549                 if (ct->task == dump_task || !info->thread) {
1550                         t->next = info->thread;
1551                         info->thread = t;
1552                 } else {
1553                         /*
1554                          * Make sure to keep the original task at
1555                          * the head of the list.
1556                          */
1557                         t->next = info->thread->next;
1558                         info->thread->next = t;
1559                 }
1560         }
1561
1562         /*
1563          * Now fill in each thread's information.
1564          */
1565         for (t = info->thread; t != NULL; t = t->next)
1566                 if (!fill_thread_core_info(t, view, signr, &info->size))
1567                         return 0;
1568
1569         /*
1570          * Fill in the two process-wide notes.
1571          */
1572         fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1573         info->size += notesize(&info->psinfo);
1574
1575         fill_auxv_note(&info->auxv, current->mm);
1576         info->size += notesize(&info->auxv);
1577
1578         return 1;
1579 }
1580
1581 static size_t get_note_info_size(struct elf_note_info *info)
1582 {
1583         return info->size;
1584 }
1585
1586 /*
1587  * Write all the notes for each thread.  When writing the first thread, the
1588  * process-wide notes are interleaved after the first thread-specific note.
1589  */
1590 static int write_note_info(struct elf_note_info *info,
1591                            struct file *file, loff_t *foffset)
1592 {
1593         bool first = 1;
1594         struct elf_thread_core_info *t = info->thread;
1595
1596         do {
1597                 int i;
1598
1599                 if (!writenote(&t->notes[0], file, foffset))
1600                         return 0;
1601
1602                 if (first && !writenote(&info->psinfo, file, foffset))
1603                         return 0;
1604                 if (first && !writenote(&info->auxv, file, foffset))
1605                         return 0;
1606
1607                 for (i = 1; i < info->thread_notes; ++i)
1608                         if (t->notes[i].data &&
1609                             !writenote(&t->notes[i], file, foffset))
1610                                 return 0;
1611
1612                 first = 0;
1613                 t = t->next;
1614         } while (t);
1615
1616         return 1;
1617 }
1618
1619 static void free_note_info(struct elf_note_info *info)
1620 {
1621         struct elf_thread_core_info *threads = info->thread;
1622         while (threads) {
1623                 unsigned int i;
1624                 struct elf_thread_core_info *t = threads;
1625                 threads = t->next;
1626                 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1627                 for (i = 1; i < info->thread_notes; ++i)
1628                         kfree(t->notes[i].data);
1629                 kfree(t);
1630         }
1631         kfree(info->psinfo.data);
1632 }
1633
1634 #else
1635
1636 /* Here is the structure in which status of each thread is captured. */
1637 struct elf_thread_status
1638 {
1639         struct list_head list;
1640         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1641         elf_fpregset_t fpu;             /* NT_PRFPREG */
1642         struct task_struct *thread;
1643 #ifdef ELF_CORE_COPY_XFPREGS
1644         elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
1645 #endif
1646         struct memelfnote notes[3];
1647         int num_notes;
1648 };
1649
1650 /*
1651  * In order to add the specific thread information for the elf file format,
1652  * we need to keep a linked list of every threads pr_status and then create
1653  * a single section for them in the final core file.
1654  */
1655 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1656 {
1657         int sz = 0;
1658         struct task_struct *p = t->thread;
1659         t->num_notes = 0;
1660
1661         fill_prstatus(&t->prstatus, p, signr);
1662         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1663
1664         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1665                   &(t->prstatus));
1666         t->num_notes++;
1667         sz += notesize(&t->notes[0]);
1668
1669         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1670                                                                 &t->fpu))) {
1671                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1672                           &(t->fpu));
1673                 t->num_notes++;
1674                 sz += notesize(&t->notes[1]);
1675         }
1676
1677 #ifdef ELF_CORE_COPY_XFPREGS
1678         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1679                 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1680                           sizeof(t->xfpu), &t->xfpu);
1681                 t->num_notes++;
1682                 sz += notesize(&t->notes[2]);
1683         }
1684 #endif
1685         return sz;
1686 }
1687
1688 struct elf_note_info {
1689         struct memelfnote *notes;
1690         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
1691         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
1692         struct list_head thread_list;
1693         elf_fpregset_t *fpu;
1694 #ifdef ELF_CORE_COPY_XFPREGS
1695         elf_fpxregset_t *xfpu;
1696 #endif
1697         int thread_status_size;
1698         int numnote;
1699 };
1700
1701 static int elf_note_info_init(struct elf_note_info *info)
1702 {
1703         memset(info, 0, sizeof(*info));
1704         INIT_LIST_HEAD(&info->thread_list);
1705
1706         /* Allocate space for six ELF notes */
1707         info->notes = kmalloc(6 * sizeof(struct memelfnote), GFP_KERNEL);
1708         if (!info->notes)
1709                 return 0;
1710         info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1711         if (!info->psinfo)
1712                 goto notes_free;
1713         info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1714         if (!info->prstatus)
1715                 goto psinfo_free;
1716         info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1717         if (!info->fpu)
1718                 goto prstatus_free;
1719 #ifdef ELF_CORE_COPY_XFPREGS
1720         info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1721         if (!info->xfpu)
1722                 goto fpu_free;
1723 #endif
1724         return 1;
1725 #ifdef ELF_CORE_COPY_XFPREGS
1726  fpu_free:
1727         kfree(info->fpu);
1728 #endif
1729  prstatus_free:
1730         kfree(info->prstatus);
1731  psinfo_free:
1732         kfree(info->psinfo);
1733  notes_free:
1734         kfree(info->notes);
1735         return 0;
1736 }
1737
1738 static int fill_note_info(struct elfhdr *elf, int phdrs,
1739                           struct elf_note_info *info,
1740                           long signr, struct pt_regs *regs)
1741 {
1742         struct list_head *t;
1743
1744         if (!elf_note_info_init(info))
1745                 return 0;
1746
1747         if (signr) {
1748                 struct core_thread *ct;
1749                 struct elf_thread_status *ets;
1750
1751                 for (ct = current->mm->core_state->dumper.next;
1752                                                 ct; ct = ct->next) {
1753                         ets = kzalloc(sizeof(*ets), GFP_KERNEL);
1754                         if (!ets)
1755                                 return 0;
1756
1757                         ets->thread = ct->task;
1758                         list_add(&ets->list, &info->thread_list);
1759                 }
1760
1761                 list_for_each(t, &info->thread_list) {
1762                         int sz;
1763
1764                         ets = list_entry(t, struct elf_thread_status, list);
1765                         sz = elf_dump_thread_status(signr, ets);
1766                         info->thread_status_size += sz;
1767                 }
1768         }
1769         /* now collect the dump for the current */
1770         memset(info->prstatus, 0, sizeof(*info->prstatus));
1771         fill_prstatus(info->prstatus, current, signr);
1772         elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1773
1774         /* Set up header */
1775         fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
1776
1777         /*
1778          * Set up the notes in similar form to SVR4 core dumps made
1779          * with info from their /proc.
1780          */
1781
1782         fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1783                   sizeof(*info->prstatus), info->prstatus);
1784         fill_psinfo(info->psinfo, current->group_leader, current->mm);
1785         fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1786                   sizeof(*info->psinfo), info->psinfo);
1787
1788         info->numnote = 2;
1789
1790         fill_auxv_note(&info->notes[info->numnote++], current->mm);
1791
1792         /* Try to dump the FPU. */
1793         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1794                                                                info->fpu);
1795         if (info->prstatus->pr_fpvalid)
1796                 fill_note(info->notes + info->numnote++,
1797                           "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1798 #ifdef ELF_CORE_COPY_XFPREGS
1799         if (elf_core_copy_task_xfpregs(current, info->xfpu))
1800                 fill_note(info->notes + info->numnote++,
1801                           "LINUX", ELF_CORE_XFPREG_TYPE,
1802                           sizeof(*info->xfpu), info->xfpu);
1803 #endif
1804
1805         return 1;
1806 }
1807
1808 static size_t get_note_info_size(struct elf_note_info *info)
1809 {
1810         int sz = 0;
1811         int i;
1812
1813         for (i = 0; i < info->numnote; i++)
1814                 sz += notesize(info->notes + i);
1815
1816         sz += info->thread_status_size;
1817
1818         return sz;
1819 }
1820
1821 static int write_note_info(struct elf_note_info *info,
1822                            struct file *file, loff_t *foffset)
1823 {
1824         int i;
1825         struct list_head *t;
1826
1827         for (i = 0; i < info->numnote; i++)
1828                 if (!writenote(info->notes + i, file, foffset))
1829                         return 0;
1830
1831         /* write out the thread status notes section */
1832         list_for_each(t, &info->thread_list) {
1833                 struct elf_thread_status *tmp =
1834                                 list_entry(t, struct elf_thread_status, list);
1835
1836                 for (i = 0; i < tmp->num_notes; i++)
1837                         if (!writenote(&tmp->notes[i], file, foffset))
1838                                 return 0;
1839         }
1840
1841         return 1;
1842 }
1843
1844 static void free_note_info(struct elf_note_info *info)
1845 {
1846         while (!list_empty(&info->thread_list)) {
1847                 struct list_head *tmp = info->thread_list.next;
1848                 list_del(tmp);
1849                 kfree(list_entry(tmp, struct elf_thread_status, list));
1850         }
1851
1852         kfree(info->prstatus);
1853         kfree(info->psinfo);
1854         kfree(info->notes);
1855         kfree(info->fpu);
1856 #ifdef ELF_CORE_COPY_XFPREGS
1857         kfree(info->xfpu);
1858 #endif
1859 }
1860
1861 #endif
1862
1863 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1864                                         struct vm_area_struct *gate_vma)
1865 {
1866         struct vm_area_struct *ret = tsk->mm->mmap;
1867
1868         if (ret)
1869                 return ret;
1870         return gate_vma;
1871 }
1872 /*
1873  * Helper function for iterating across a vma list.  It ensures that the caller
1874  * will visit `gate_vma' prior to terminating the search.
1875  */
1876 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1877                                         struct vm_area_struct *gate_vma)
1878 {
1879         struct vm_area_struct *ret;
1880
1881         ret = this_vma->vm_next;
1882         if (ret)
1883                 return ret;
1884         if (this_vma == gate_vma)
1885                 return NULL;
1886         return gate_vma;
1887 }
1888
1889 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
1890                              elf_addr_t e_shoff, int segs)
1891 {
1892         elf->e_shoff = e_shoff;
1893         elf->e_shentsize = sizeof(*shdr4extnum);
1894         elf->e_shnum = 1;
1895         elf->e_shstrndx = SHN_UNDEF;
1896
1897         memset(shdr4extnum, 0, sizeof(*shdr4extnum));
1898
1899         shdr4extnum->sh_type = SHT_NULL;
1900         shdr4extnum->sh_size = elf->e_shnum;
1901         shdr4extnum->sh_link = elf->e_shstrndx;
1902         shdr4extnum->sh_info = segs;
1903 }
1904
1905 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
1906                                      unsigned long mm_flags)
1907 {
1908         struct vm_area_struct *vma;
1909         size_t size = 0;
1910
1911         for (vma = first_vma(current, gate_vma); vma != NULL;
1912              vma = next_vma(vma, gate_vma))
1913                 size += vma_dump_size(vma, mm_flags);
1914         return size;
1915 }
1916
1917 /*
1918  * Actual dumper
1919  *
1920  * This is a two-pass process; first we find the offsets of the bits,
1921  * and then they are actually written out.  If we run out of core limit
1922  * we just truncate.
1923  */
1924 static int elf_core_dump(struct coredump_params *cprm)
1925 {
1926         int has_dumped = 0;
1927         mm_segment_t fs;
1928         int segs;
1929         size_t size = 0;
1930         struct vm_area_struct *vma, *gate_vma;
1931         struct elfhdr *elf = NULL;
1932         loff_t offset = 0, dataoff, foffset;
1933         struct elf_note_info info;
1934         struct elf_phdr *phdr4note = NULL;
1935         struct elf_shdr *shdr4extnum = NULL;
1936         Elf_Half e_phnum;
1937         elf_addr_t e_shoff;
1938
1939         /*
1940          * We no longer stop all VM operations.
1941          *
1942          * This is because those proceses that could possibly change map_count
1943          * or the mmap / vma pages are now blocked in do_exit on current
1944          * finishing this core dump.
1945          *
1946          * Only ptrace can touch these memory addresses, but it doesn't change
1947          * the map_count or the pages allocated. So no possibility of crashing
1948          * exists while dumping the mm->vm_next areas to the core file.
1949          */
1950
1951         /* alloc memory for large data structures: too large to be on stack */
1952         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1953         if (!elf)
1954                 goto out;
1955         /*
1956          * The number of segs are recored into ELF header as 16bit value.
1957          * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
1958          */
1959         segs = current->mm->map_count;
1960         segs += elf_core_extra_phdrs();
1961
1962         gate_vma = get_gate_vma(current->mm);
1963         if (gate_vma != NULL)
1964                 segs++;
1965
1966         /* for notes section */
1967         segs++;
1968
1969         /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
1970          * this, kernel supports extended numbering. Have a look at
1971          * include/linux/elf.h for further information. */
1972         e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
1973
1974         /*
1975          * Collect all the non-memory information about the process for the
1976          * notes.  This also sets up the file header.
1977          */
1978         if (!fill_note_info(elf, e_phnum, &info, cprm->signr, cprm->regs))
1979                 goto cleanup;
1980
1981         has_dumped = 1;
1982         current->flags |= PF_DUMPCORE;
1983
1984         fs = get_fs();
1985         set_fs(KERNEL_DS);
1986
1987         offset += sizeof(*elf);                         /* Elf header */
1988         offset += segs * sizeof(struct elf_phdr);       /* Program headers */
1989         foffset = offset;
1990
1991         /* Write notes phdr entry */
1992         {
1993                 size_t sz = get_note_info_size(&info);
1994
1995                 sz += elf_coredump_extra_notes_size();
1996
1997                 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
1998                 if (!phdr4note)
1999                         goto end_coredump;
2000
2001                 fill_elf_note_phdr(phdr4note, sz, offset);
2002                 offset += sz;
2003         }
2004
2005         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
2006
2007         offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
2008         offset += elf_core_extra_data_size();
2009         e_shoff = offset;
2010
2011         if (e_phnum == PN_XNUM) {
2012                 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2013                 if (!shdr4extnum)
2014                         goto end_coredump;
2015                 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2016         }
2017
2018         offset = dataoff;
2019
2020         size += sizeof(*elf);
2021         if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
2022                 goto end_coredump;
2023
2024         size += sizeof(*phdr4note);
2025         if (size > cprm->limit
2026             || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
2027                 goto end_coredump;
2028
2029         /* Write program headers for segments dump */
2030         for (vma = first_vma(current, gate_vma); vma != NULL;
2031                         vma = next_vma(vma, gate_vma)) {
2032                 struct elf_phdr phdr;
2033
2034                 phdr.p_type = PT_LOAD;
2035                 phdr.p_offset = offset;
2036                 phdr.p_vaddr = vma->vm_start;
2037                 phdr.p_paddr = 0;
2038                 phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
2039                 phdr.p_memsz = vma->vm_end - vma->vm_start;
2040                 offset += phdr.p_filesz;
2041                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2042                 if (vma->vm_flags & VM_WRITE)
2043                         phdr.p_flags |= PF_W;
2044                 if (vma->vm_flags & VM_EXEC)
2045                         phdr.p_flags |= PF_X;
2046                 phdr.p_align = ELF_EXEC_PAGESIZE;
2047
2048                 size += sizeof(phdr);
2049                 if (size > cprm->limit
2050                     || !dump_write(cprm->file, &phdr, sizeof(phdr)))
2051                         goto end_coredump;
2052         }
2053
2054         if (!elf_core_write_extra_phdrs(cprm->file, offset, &size, cprm->limit))
2055                 goto end_coredump;
2056
2057         /* write out the notes section */
2058         if (!write_note_info(&info, cprm->file, &foffset))
2059                 goto end_coredump;
2060
2061         if (elf_coredump_extra_notes_write(cprm->file, &foffset))
2062                 goto end_coredump;
2063
2064         /* Align to page */
2065         if (!dump_seek(cprm->file, dataoff - foffset))
2066                 goto end_coredump;
2067
2068         for (vma = first_vma(current, gate_vma); vma != NULL;
2069                         vma = next_vma(vma, gate_vma)) {
2070                 unsigned long addr;
2071                 unsigned long end;
2072
2073                 end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
2074
2075                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2076                         struct page *page;
2077                         int stop;
2078
2079                         page = get_dump_page(addr);
2080                         if (page) {
2081                                 void *kaddr = kmap(page);
2082                                 stop = ((size += PAGE_SIZE) > cprm->limit) ||
2083                                         !dump_write(cprm->file, kaddr,
2084                                                     PAGE_SIZE);
2085                                 kunmap(page);
2086                                 page_cache_release(page);
2087                         } else
2088                                 stop = !dump_seek(cprm->file, PAGE_SIZE);
2089                         if (stop)
2090                                 goto end_coredump;
2091                 }
2092         }
2093
2094         if (!elf_core_write_extra_data(cprm->file, &size, cprm->limit))
2095                 goto end_coredump;
2096
2097         if (e_phnum == PN_XNUM) {
2098                 size += sizeof(*shdr4extnum);
2099                 if (size > cprm->limit
2100                     || !dump_write(cprm->file, shdr4extnum,
2101                                    sizeof(*shdr4extnum)))
2102                         goto end_coredump;
2103         }
2104
2105 end_coredump:
2106         set_fs(fs);
2107
2108 cleanup:
2109         free_note_info(&info);
2110         kfree(shdr4extnum);
2111         kfree(phdr4note);
2112         kfree(elf);
2113 out:
2114         return has_dumped;
2115 }
2116
2117 #endif          /* CONFIG_ELF_CORE */
2118
2119 static int __init init_elf_binfmt(void)
2120 {
2121         register_binfmt(&elf_format);
2122         return 0;
2123 }
2124
2125 static void __exit exit_elf_binfmt(void)
2126 {
2127         /* Remove the COFF and ELF loaders. */
2128         unregister_binfmt(&elf_format);
2129 }
2130
2131 core_initcall(init_elf_binfmt);
2132 module_exit(exit_elf_binfmt);
2133 MODULE_LICENSE("GPL");