/* *  linux/fs/exec.c * *  Copyright (C) 1991, 1992  Linus Torvalds */ /* * #!-checking implemented by tytso. *//* * Demand-loading implemented 01.12.91 - no need to read anything but * the header into memory. The inode of the executable is put into * "current->executable", and page faults do the actual loading. Clean. * * Once more I can proudly say that linux stood up to being changed: it * was less than 2 hours work to get demand-loading completely implemented. * * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead, * current->executable is only used by the procfs.  This allows a dispatch * table to check for several different types  of binary formats.  We keep * trying until we recognize the file or we run out of supported binary * formats.  */ #include <linux/slab.h>#include <linux/file.h>#include <linux/fdtable.h>#include <linux/mm.h>#include <linux/stat.h>#include <linux/fcntl.h>#include <linux/smp_lock.h>#include <linux/swap.h>#include <linux/string.h>#include <linux/init.h>#include <linux/pagemap.h>#include <linux/highmem.h>#include <linux/spinlock.h>#include <linux/key.h>#include <linux/personality.h>#include <linux/binfmts.h>#include <linux/utsname.h>#include <linux/pid_namespace.h>#include <linux/module.h>#include <linux/namei.h>#include <linux/proc_fs.h>#include <linux/mount.h>#include <linux/security.h>#include <linux/ima.h>#include <linux/syscalls.h>#include <linux/tsacct_kern.h>#include <linux/cn_proc.h>#include <linux/audit.h>#include <linux/tracehook.h>#include <linux/kmod.h>#include <linux/fsnotify.h>#include <linux/fs_struct.h> #include <asm/uaccess.h>#include <asm/mmu_context.h>#include <asm/tlb.h>#include "internal.h" int core_uses_pid;char core_pattern[CORENAME_MAX_SIZE] = "core";int suid_dumpable = 0; /* The maximal length of core_pattern is also specified in sysctl.c */ static LIST_HEAD(formats);static DEFINE_RWLOCK(binfmt_lock); int __register_binfmt(struct linux_binfmt * fmt, int insert){	if (!fmt)		return -EINVAL;	write_lock(&binfmt_lock);	insert ? list_add(&fmt->lh, &formats) :		 list_add_tail(&fmt->lh, &formats);	write_unlock(&binfmt_lock);	return 0;	} EXPORT_SYMBOL(__register_binfmt); void unregister_binfmt(struct linux_binfmt * fmt){	write_lock(&binfmt_lock);	list_del(&fmt->lh);	write_unlock(&binfmt_lock);} EXPORT_SYMBOL(unregister_binfmt); static inline void put_binfmt(struct linux_binfmt * fmt){	module_put(fmt->module);} /* * Note that a shared library must be both readable and executable due to * security reasons. * * Also note that we take the address to load from from the file itself. */SYSCALL_DEFINE1(uselib, const char __user *, library){	struct file *file;	char *tmp = getname(library);	int error = PTR_ERR(tmp); 	if (IS_ERR(tmp))		goto out; 	file = do_filp_open(AT_FDCWD, tmp,				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,				MAY_READ | MAY_EXEC | MAY_OPEN);	putname(tmp);	error = PTR_ERR(file);	if (IS_ERR(file))		goto out; 	error = -EINVAL;	if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))		goto exit; 	error = -EACCES;	if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)		goto exit; 	fsnotify_open(file->f_path.dentry); 	error = -ENOEXEC;	if(file->f_op) {		struct linux_binfmt * fmt; 		read_lock(&binfmt_lock);		list_for_each_entry(fmt, &formats, lh) {			if (!fmt->load_shlib)				continue;			if (!try_module_get(fmt->module))				continue;			read_unlock(&binfmt_lock);			error = fmt->load_shlib(file);			read_lock(&binfmt_lock);			put_binfmt(fmt);			if (error != -ENOEXEC)				break;		}		read_unlock(&binfmt_lock);	}exit:	fput(file);out:  	return error;} #ifdef CONFIG_MMU static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,		int write){	struct page *page;	int ret; #ifdef CONFIG_STACK_GROWSUP	if (write) {		ret = expand_stack_downwards(bprm->vma, pos);		if (ret < 0)			return NULL;	}#endif	ret = get_user_pages(current, bprm->mm, pos,			1, write, 1, &page, NULL);	if (ret <= 0)		return NULL; 	if (write) {		unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;		struct rlimit *rlim; 		/*		 * We've historically supported up to 32 pages (ARG_MAX)		 * of argument strings even with small stacks		 */		if (size <= ARG_MAX)			return page; 		/*		 * Limit to 1/4-th the stack size for the argv+env strings.		 * This ensures that:		 *  - the remaining binfmt code will not run out of stack space,		 *  - the program will have a reasonable amount of stack left		 *    to work from.		 */		rlim = current->signal->rlim;		if (size > rlim[RLIMIT_STACK].rlim_cur / 4) {			put_page(page);			return NULL;		}	} 	return page;} static void put_arg_page(struct page *page){	put_page(page);} static void free_arg_page(struct linux_binprm *bprm, int i){} static void free_arg_pages(struct linux_binprm *bprm){} static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,		struct page *page){	flush_cache_page(bprm->vma, pos, page_to_pfn(page));} static int __bprm_mm_init(struct linux_binprm *bprm){	int err;	struct vm_area_struct *vma = NULL;	struct mm_struct *mm = bprm->mm; 	bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);	if (!vma)		return -ENOMEM; 	down_write(&mm->mmap_sem);	vma->vm_mm = mm; 	/*	 * Place the stack at the largest stack address the architecture	 * supports. Later, we'll move this to an appropriate place. We don't	 * use STACK_TOP because that can depend on attributes which aren't	 * configured yet.	 */	vma->vm_end = STACK_TOP_MAX;	vma->vm_start = vma->vm_end - PAGE_SIZE;	vma->vm_flags = VM_STACK_FLAGS;	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);	err = insert_vm_struct(mm, vma);	if (err)		goto err; 	mm->stack_vm = mm->total_vm = 1;	up_write(&mm->mmap_sem);	bprm->p = vma->vm_end - sizeof(void *);	return 0;err:	up_write(&mm->mmap_sem);	bprm->vma = NULL;	kmem_cache_free(vm_area_cachep, vma);	return err;} static bool valid_arg_len(struct linux_binprm *bprm, long len){	return len <= MAX_ARG_STRLEN;} #else static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,		int write){	struct page *page; 	page = bprm->page[pos / PAGE_SIZE];	if (!page && write) {		page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);		if (!page)			return NULL;		bprm->page[pos / PAGE_SIZE] = page;	} 	return page;} static void put_arg_page(struct page *page){} static void free_arg_page(struct linux_binprm *bprm, int i){	if (bprm->page[i]) {		__free_page(bprm->page[i]);		bprm->page[i] = NULL;	}} static void free_arg_pages(struct linux_binprm *bprm){	int i; 	for (i = 0; i < MAX_ARG_PAGES; i++)		free_arg_page(bprm, i);} static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,		struct page *page){} static int __bprm_mm_init(struct linux_binprm *bprm){	bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);	return 0;} static bool valid_arg_len(struct linux_binprm *bprm, long len){	return len <= bprm->p;} #endif /* CONFIG_MMU */ /* * Create a new mm_struct and populate it with a temporary stack * vm_area_struct.  We don't have enough context at this point to set the stack * flags, permissions, and offset, so we use temporary values.  We'll update * them later in setup_arg_pages(). */int bprm_mm_init(struct linux_binprm *bprm){	int err;	struct mm_struct *mm = NULL; 	bprm->mm = mm = mm_alloc();	err = -ENOMEM;	if (!mm)		goto err; 	err = init_new_context(current, mm);	if (err)		goto err; 	err = __bprm_mm_init(bprm);	if (err)		goto err; 	return 0; err:	if (mm) {		bprm->mm = NULL;		mmdrop(mm);	} 	return err;} /* * count() counts the number of strings in array ARGV. */static int count(char __user * __user * argv, int max){	int i = 0; 	if (argv != NULL) {		for (;;) {			char __user * p; 			if (get_user(p, argv))				return -EFAULT;			if (!p)				break;			argv++;			if (i++ >= max)				return -E2BIG;			cond_resched();		}	}	return i;} /* * 'copy_strings()' copies argument/environment strings from the old * processes's memory to the new process's stack.  The call to get_user_pages() * ensures the destination page is created and not swapped out. */static int copy_strings(int argc, char __user * __user * argv,			struct linux_binprm *bprm){	struct page *kmapped_page = NULL;	char *kaddr = NULL;	unsigned long kpos = 0;	int ret; 	while (argc-- > 0) {		char __user *str;		int len;		unsigned long pos; 		if (get_user(str, argv+argc) ||				!(len = strnlen_user(str, MAX_ARG_STRLEN))) {			ret = -EFAULT;			goto out;		} 		if (!valid_arg_len(bprm, len)) {			ret = -E2BIG;			goto out;		} 		/* We're going to work our way backwords. */		pos = bprm->p;		str += len;		bprm->p -= len; 		while (len > 0) {			int offset, bytes_to_copy; 			offset = pos % PAGE_SIZE;			if (offset == 0)				offset = PAGE_SIZE; 			bytes_to_copy = offset;			if (bytes_to_copy > len)				bytes_to_copy = len; 			offset -= bytes_to_copy;			pos -= bytes_to_copy;			str -= bytes_to_copy;			len -= bytes_to_copy; 			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {				struct page *page; 				page = get_arg_page(bprm, pos, 1);				if (!page) {					ret = -E2BIG;					goto out;				} 				if (kmapped_page) {					flush_kernel_dcache_page(kmapped_page);					kunmap(kmapped_page);					put_arg_page(kmapped_page);				}				kmapped_page = page;				kaddr = kmap(kmapped_page);				kpos = pos & PAGE_MASK;				flush_arg_page(bprm, kpos, kmapped_page);			}			if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {				ret = -EFAULT;				goto out;			}		}	}	ret = 0;out:	if (kmapped_page) {		flush_kernel_dcache_page(kmapped_page);		kunmap(kmapped_page);		put_arg_page(kmapped_page);	}	return ret;} /* * Like copy_strings, but get argv and its values from kernel memory. */int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm){	int r;	mm_segment_t oldfs = get_fs();	set_fs(KERNEL_DS);	r = copy_strings(argc, (char __user * __user *)argv, bprm);	set_fs(oldfs);	return r;}EXPORT_SYMBOL(copy_strings_kernel); #ifdef CONFIG_MMU /* * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX.  Once * the binfmt code determines where the new stack should reside, we shift it to * its final location.  The process proceeds as follows: * * 1) Use shift to calculate the new vma endpoints. * 2) Extend vma to cover both the old and new ranges.  This ensures the *    arguments passed to subsequent functions are consistent. * 3) Move vma's page tables to the new range. * 4) Free up any cleared pgd range. * 5) Shrink the vma to cover only the new range. */static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift){	struct mm_struct *mm = vma->vm_mm;	unsigned long old_start = vma->vm_start;	unsigned long old_end = vma->vm_end;	unsigned long length = old_end - old_start;

Lines 1–500 of 1861. Load more