blob: 50e76cc633c4baec0aa90240436c46f63c9a0e32 [file] [log] [blame]
Thomas Gleixner457c8992019-05-19 13:08:55 +01001// SPDX-License-Identifier: GPL-2.0-only
Linus Torvalds1da177e2005-04-16 15:20:36 -07002/*
3 * linux/fs/exec.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 */
7
8/*
9 * #!-checking implemented by tytso.
10 */
11/*
12 * Demand-loading implemented 01.12.91 - no need to read anything but
13 * the header into memory. The inode of the executable is put into
14 * "current->executable", and page faults do the actual loading. Clean.
15 *
16 * Once more I can proudly say that linux stood up to being changed: it
17 * was less than 2 hours work to get demand-loading completely implemented.
18 *
19 * Demand loading changed July 1993 by Eric Youngdale. Use mmap instead,
20 * current->executable is only used by the procfs. This allows a dispatch
21 * table to check for several different types of binary formats. We keep
22 * trying until we recognize the file or we run out of supported binary
Aleksa Sarai613cc2b2016-12-21 16:26:24 +110023 * formats.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Scott Brandenb89999d02020-10-02 10:38:15 -070026#include <linux/kernel_read_file.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/slab.h>
28#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040029#include <linux/fdtable.h>
Hugh Dickinsba92a432008-07-25 01:45:43 -070030#include <linux/mm.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/stat.h>
32#include <linux/fcntl.h>
Hugh Dickinsba92a432008-07-25 01:45:43 -070033#include <linux/swap.h>
Neil Horman74aadce2007-10-16 23:26:35 -070034#include <linux/string.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/init.h>
Ingo Molnar6e84f312017-02-08 18:51:29 +010036#include <linux/sched/mm.h>
Ingo Molnarf7ccbae2017-02-08 18:51:30 +010037#include <linux/sched/coredump.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010038#include <linux/sched/signal.h>
Ingo Molnar6a3827d2017-02-08 18:51:31 +010039#include <linux/sched/numa_balancing.h>
Ingo Molnar29930022017-02-08 18:51:36 +010040#include <linux/sched/task.h>
Hugh Dickinsca5b1722008-07-28 15:46:18 -070041#include <linux/pagemap.h>
Ingo Molnarcdd6c482009-09-21 12:02:48 +020042#include <linux/perf_event.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/highmem.h>
44#include <linux/spinlock.h>
45#include <linux/key.h>
46#include <linux/personality.h>
47#include <linux/binfmts.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070048#include <linux/utsname.h>
Sukadev Bhattiprolu84d73782006-12-08 02:38:01 -080049#include <linux/pid_namespace.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070050#include <linux/module.h>
51#include <linux/namei.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070052#include <linux/mount.h>
53#include <linux/security.h>
54#include <linux/syscalls.h>
Jay Lan8f0ab512006-09-30 23:28:59 -070055#include <linux/tsacct_kern.h>
Matt Helsley9f460802005-11-07 00:59:16 -080056#include <linux/cn_proc.h>
Al Viro473ae302006-04-26 14:04:08 -040057#include <linux/audit.h>
Johannes Berg5f4123b2008-07-09 10:28:40 +020058#include <linux/kmod.h>
Eric Paris6110e3a2008-12-17 13:53:20 -050059#include <linux/fsnotify.h>
Al Viro5ad4e532009-03-29 19:50:06 -040060#include <linux/fs_struct.h>
Ying Han3d5992d2010-10-26 14:21:23 -070061#include <linux/oom.h>
Oleg Nesterov0e028462011-03-06 18:02:54 +010062#include <linux/compat.h>
Mimi Zoharb44a7df2015-12-28 16:02:29 -050063#include <linux/vmalloc.h>
Jens Axboe0f212202020-09-13 13:09:39 -060064#include <linux/io_uring.h>
Gabriel Krisman Bertazi1446e1d2020-11-27 14:32:34 -050065#include <linux/syscall_user_dispatch.h>
Luis Chamberlain66ad3982022-01-21 22:13:17 -080066#include <linux/coredump.h>
Andrei Vagin2b5f9da2022-09-20 17:31:19 -070067#include <linux/time_namespace.h>
Beau Belgravefd593512023-03-28 16:52:09 -070068#include <linux/user_events.h>
Kent Overstreet932562a2023-12-15 15:58:20 -050069#include <linux/rseq.h>
Jinjiang Tu3a9e5672024-03-28 19:10:08 +080070#include <linux/ksm.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070071
Linus Torvalds7c0f6ba2016-12-24 11:46:01 -080072#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070073#include <asm/mmu_context.h>
Ollie Wildb6a2fea2007-07-19 01:48:16 -070074#include <asm/tlb.h>
KAMEZAWA Hiroyuki43d2b112012-01-10 15:08:09 -080075
76#include <trace/events/task.h>
David Howellsa6f76f22008-11-14 10:39:24 +110077#include "internal.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070078
David Smith4ff16c22012-02-07 10:11:05 -060079#include <trace/events/sched.h>
80
Eric W. Biederman56305aa2020-05-29 22:00:54 -050081static int bprm_creds_from_file(struct linux_binprm *bprm);
82
Alan Coxd6e71142005-06-23 00:09:43 -070083int suid_dumpable = 0;
84
Alexey Dobriyane4dc1b12007-10-16 23:26:03 -070085static LIST_HEAD(formats);
Linus Torvalds1da177e2005-04-16 15:20:36 -070086static DEFINE_RWLOCK(binfmt_lock);
87
Al Viro8fc3dc52012-03-17 03:05:16 -040088void __register_binfmt(struct linux_binfmt * fmt, int insert)
Linus Torvalds1da177e2005-04-16 15:20:36 -070089{
Linus Torvalds1da177e2005-04-16 15:20:36 -070090 write_lock(&binfmt_lock);
Ivan Kokshaysky74641f52009-04-30 15:08:49 -070091 insert ? list_add(&fmt->lh, &formats) :
92 list_add_tail(&fmt->lh, &formats);
Linus Torvalds1da177e2005-04-16 15:20:36 -070093 write_unlock(&binfmt_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -070094}
95
Ivan Kokshaysky74641f52009-04-30 15:08:49 -070096EXPORT_SYMBOL(__register_binfmt);
Linus Torvalds1da177e2005-04-16 15:20:36 -070097
Alexey Dobriyanf6b450d2007-10-16 23:26:04 -070098void unregister_binfmt(struct linux_binfmt * fmt)
Linus Torvalds1da177e2005-04-16 15:20:36 -070099{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700100 write_lock(&binfmt_lock);
Alexey Dobriyane4dc1b12007-10-16 23:26:03 -0700101 list_del(&fmt->lh);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102 write_unlock(&binfmt_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103}
104
105EXPORT_SYMBOL(unregister_binfmt);
106
107static inline void put_binfmt(struct linux_binfmt * fmt)
108{
109 module_put(fmt->module);
110}
111
Eric W. Biederman90f85722015-06-29 14:42:03 -0500112bool path_noexec(const struct path *path)
113{
114 return (path->mnt->mnt_flags & MNT_NOEXEC) ||
115 (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC);
116}
117
Josh Triplett69369a72014-04-03 14:48:27 -0700118#ifdef CONFIG_USELIB
Linus Torvalds1da177e2005-04-16 15:20:36 -0700119/*
120 * Note that a shared library must be both readable and executable due to
121 * security reasons.
122 *
Tom Rixb4527222022-02-11 08:09:40 -0800123 * Also note that we take the address to load from the file itself.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700124 */
Heiko Carstens1e7bfb22009-01-14 14:14:29 +0100125SYSCALL_DEFINE1(uselib, const char __user *, library)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700126{
Al Viro72c2d532013-09-22 16:27:52 -0400127 struct linux_binfmt *fmt;
Al Viro964bd182008-07-26 03:33:14 -0400128 struct file *file;
Jeff Layton91a27b22012-10-10 15:25:28 -0400129 struct filename *tmp = getname(library);
Al Viro964bd182008-07-26 03:33:14 -0400130 int error = PTR_ERR(tmp);
Al Viro47c805d2011-02-23 17:44:09 -0500131 static const struct open_flags uselib_flags = {
Linus Torvalds3eab8302024-01-24 13:12:20 -0800132 .open_flag = O_LARGEFILE | O_RDONLY,
Al Viro62fb4a12015-12-26 22:33:24 -0500133 .acc_mode = MAY_READ | MAY_EXEC,
Al Virof9652e12013-06-11 08:23:01 +0400134 .intent = LOOKUP_OPEN,
135 .lookup_flags = LOOKUP_FOLLOW,
Al Viro47c805d2011-02-23 17:44:09 -0500136 };
Linus Torvalds1da177e2005-04-16 15:20:36 -0700137
Al Viro6e8341a2009-04-06 11:16:22 -0400138 if (IS_ERR(tmp))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700139 goto out;
140
Al Virof9652e12013-06-11 08:23:01 +0400141 file = do_filp_open(AT_FDCWD, tmp, &uselib_flags);
Al Viro6e8341a2009-04-06 11:16:22 -0400142 putname(tmp);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700143 error = PTR_ERR(file);
144 if (IS_ERR(file))
145 goto out;
146
Kees Cook633fb6a2020-08-11 18:36:26 -0700147 /*
148 * may_open() has already checked for this, so it should be
149 * impossible to trip now. But we need to be extra cautious
150 * and check again at the very end too.
151 */
Kees Cookdb19c912020-08-11 18:36:23 -0700152 error = -EACCES;
Kees Cook0fd338b2020-08-11 18:36:30 -0700153 if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) ||
154 path_noexec(&file->f_path)))
Al Viro6e8341a2009-04-06 11:16:22 -0400155 goto exit;
156
Linus Torvalds1da177e2005-04-16 15:20:36 -0700157 error = -ENOEXEC;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700158
Al Viro72c2d532013-09-22 16:27:52 -0400159 read_lock(&binfmt_lock);
160 list_for_each_entry(fmt, &formats, lh) {
161 if (!fmt->load_shlib)
162 continue;
163 if (!try_module_get(fmt->module))
164 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700165 read_unlock(&binfmt_lock);
Al Viro72c2d532013-09-22 16:27:52 -0400166 error = fmt->load_shlib(file);
167 read_lock(&binfmt_lock);
168 put_binfmt(fmt);
169 if (error != -ENOEXEC)
170 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700171 }
Al Viro72c2d532013-09-22 16:27:52 -0400172 read_unlock(&binfmt_lock);
Al Viro6e8341a2009-04-06 11:16:22 -0400173exit:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174 fput(file);
175out:
Kees Cook8f6e3f92022-10-18 00:14:20 -0700176 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700177}
Josh Triplett69369a72014-04-03 14:48:27 -0700178#endif /* #ifdef CONFIG_USELIB */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700179
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700180#ifdef CONFIG_MMU
Oleg Nesterovae6b5852011-03-06 18:03:11 +0100181/*
182 * The nascent bprm->mm is not visible until exec_mmap() but it can
183 * use a lot of memory, account these pages in current->mm temporary
184 * for oom_badness()->get_mm_rss(). Once exec succeeds or fails, we
185 * change the counter back via acct_arg_size(0).
186 */
Oleg Nesterov0e028462011-03-06 18:02:54 +0100187static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
Oleg Nesterov3c77f842010-11-30 20:55:34 +0100188{
189 struct mm_struct *mm = current->mm;
190 long diff = (long)(pages - bprm->vma_pages);
191
192 if (!mm || !diff)
193 return;
194
195 bprm->vma_pages = pages;
Oleg Nesterov3c77f842010-11-30 20:55:34 +0100196 add_mm_counter(mm, MM_ANONPAGES, diff);
Oleg Nesterov3c77f842010-11-30 20:55:34 +0100197}
198
Oleg Nesterov0e028462011-03-06 18:02:54 +0100199static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700200 int write)
201{
202 struct page *page;
Linus Torvaldsf313c512023-06-19 11:34:15 -0700203 struct vm_area_struct *vma = bprm->vma;
204 struct mm_struct *mm = bprm->mm;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700205 int ret;
206
Linus Torvaldsf313c512023-06-19 11:34:15 -0700207 /*
208 * Avoid relying on expanding the stack down in GUP (which
209 * does not work for STACK_GROWSUP anyway), and just do it
210 * by hand ahead of time.
211 */
212 if (write && pos < vma->vm_start) {
213 mmap_write_lock(mm);
Linus Torvalds8d7071a2023-06-24 13:45:51 -0700214 ret = expand_downwards(vma, pos);
Linus Torvaldsf313c512023-06-19 11:34:15 -0700215 if (unlikely(ret < 0)) {
216 mmap_write_unlock(mm);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700217 return NULL;
Linus Torvaldsf313c512023-06-19 11:34:15 -0700218 }
219 mmap_write_downgrade(mm);
220 } else
221 mmap_read_lock(mm);
Lorenzo Stoakes9beae1e2016-10-13 01:20:17 +0100222
Dave Hansen1e987792016-02-12 13:01:54 -0800223 /*
224 * We are doing an exec(). 'current' is the process
Linus Torvaldsf313c512023-06-19 11:34:15 -0700225 * doing the exec and 'mm' is the new process's mm.
Dave Hansen1e987792016-02-12 13:01:54 -0800226 */
Linus Torvaldsf313c512023-06-19 11:34:15 -0700227 ret = get_user_pages_remote(mm, pos, 1,
228 write ? FOLL_WRITE : 0,
Lorenzo Stoakesca5e8632023-05-17 20:25:39 +0100229 &page, NULL);
Linus Torvaldsf313c512023-06-19 11:34:15 -0700230 mmap_read_unlock(mm);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700231 if (ret <= 0)
232 return NULL;
233
Oleg Nesterov655c16a2019-01-03 15:28:11 -0800234 if (write)
Linus Torvaldsf313c512023-06-19 11:34:15 -0700235 acct_arg_size(bprm, vma_pages(vma));
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700236
237 return page;
238}
239
240static void put_arg_page(struct page *page)
241{
242 put_page(page);
243}
244
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700245static void free_arg_pages(struct linux_binprm *bprm)
246{
247}
248
249static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
250 struct page *page)
251{
252 flush_cache_page(bprm->vma, pos, page_to_pfn(page));
253}
254
255static int __bprm_mm_init(struct linux_binprm *bprm)
256{
Luiz Fernando N. Capitulinoeaccbfa2009-01-06 14:40:44 -0800257 int err;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700258 struct vm_area_struct *vma = NULL;
259 struct mm_struct *mm = bprm->mm;
260
Linus Torvalds490fc052018-07-21 15:24:03 -0700261 bprm->vma = vma = vm_area_alloc(mm);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700262 if (!vma)
Luiz Fernando N. Capitulinoeaccbfa2009-01-06 14:40:44 -0800263 return -ENOMEM;
Kirill A. Shutemovbfd40ea2018-07-26 16:37:35 -0700264 vma_set_anonymous(vma);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700265
Michel Lespinassed8ed45c2020-06-08 21:33:25 -0700266 if (mmap_write_lock_killable(mm)) {
Michal Hockof268dfe2016-05-23 16:26:02 -0700267 err = -EINTR;
268 goto err_free;
269 }
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700270
271 /*
Jinjiang Tu3a9e5672024-03-28 19:10:08 +0800272 * Need to be called with mmap write lock
273 * held, to avoid race with ksmd.
274 */
275 err = ksm_execve(mm);
276 if (err)
277 goto err_ksm;
278
279 /*
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700280 * Place the stack at the largest stack address the architecture
281 * supports. Later, we'll move this to an appropriate place. We don't
282 * use STACK_TOP because that can depend on attributes which aren't
283 * configured yet.
284 */
Michal Hockoaacb3d12011-07-26 16:08:40 -0700285 BUILD_BUG_ON(VM_STACK_FLAGS & VM_STACK_INCOMPLETE_SETUP);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700286 vma->vm_end = STACK_TOP_MAX;
287 vma->vm_start = vma->vm_end - PAGE_SIZE;
Suren Baghdasaryan1c712222023-01-26 11:37:49 -0800288 vm_flags_init(vma, VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP);
Coly Li3ed75eb2007-10-18 23:39:15 -0700289 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
Tavis Ormandy462e635e2010-12-09 15:29:42 +0100290
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700291 err = insert_vm_struct(mm, vma);
Luiz Fernando N. Capitulinoeaccbfa2009-01-06 14:40:44 -0800292 if (err)
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700293 goto err;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700294
295 mm->stack_vm = mm->total_vm = 1;
Michel Lespinassed8ed45c2020-06-08 21:33:25 -0700296 mmap_write_unlock(mm);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700297 bprm->p = vma->vm_end - sizeof(void *);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700298 return 0;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700299err:
Jinjiang Tu3a9e5672024-03-28 19:10:08 +0800300 ksm_exit(mm);
301err_ksm:
Michel Lespinassed8ed45c2020-06-08 21:33:25 -0700302 mmap_write_unlock(mm);
Michal Hockof268dfe2016-05-23 16:26:02 -0700303err_free:
Luiz Fernando N. Capitulinoeaccbfa2009-01-06 14:40:44 -0800304 bprm->vma = NULL;
Linus Torvalds3928d4f2018-07-21 13:48:51 -0700305 vm_area_free(vma);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700306 return err;
307}
308
309static bool valid_arg_len(struct linux_binprm *bprm, long len)
310{
311 return len <= MAX_ARG_STRLEN;
312}
313
314#else
315
Oleg Nesterov0e028462011-03-06 18:02:54 +0100316static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
Oleg Nesterov3c77f842010-11-30 20:55:34 +0100317{
318}
319
Oleg Nesterov0e028462011-03-06 18:02:54 +0100320static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700321 int write)
322{
323 struct page *page;
324
325 page = bprm->page[pos / PAGE_SIZE];
326 if (!page && write) {
327 page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
328 if (!page)
329 return NULL;
330 bprm->page[pos / PAGE_SIZE] = page;
331 }
332
333 return page;
334}
335
336static void put_arg_page(struct page *page)
337{
338}
339
340static void free_arg_page(struct linux_binprm *bprm, int i)
341{
342 if (bprm->page[i]) {
343 __free_page(bprm->page[i]);
344 bprm->page[i] = NULL;
345 }
346}
347
348static void free_arg_pages(struct linux_binprm *bprm)
349{
350 int i;
351
352 for (i = 0; i < MAX_ARG_PAGES; i++)
353 free_arg_page(bprm, i);
354}
355
356static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
357 struct page *page)
358{
359}
360
361static int __bprm_mm_init(struct linux_binprm *bprm)
362{
363 bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
364 return 0;
365}
366
367static bool valid_arg_len(struct linux_binprm *bprm, long len)
368{
369 return len <= bprm->p;
370}
371
372#endif /* CONFIG_MMU */
373
374/*
375 * Create a new mm_struct and populate it with a temporary stack
376 * vm_area_struct. We don't have enough context at this point to set the stack
377 * flags, permissions, and offset, so we use temporary values. We'll update
378 * them later in setup_arg_pages().
379 */
Yuanhan Liu9cc64ce2013-02-20 13:16:01 +1100380static int bprm_mm_init(struct linux_binprm *bprm)
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700381{
382 int err;
383 struct mm_struct *mm = NULL;
384
385 bprm->mm = mm = mm_alloc();
386 err = -ENOMEM;
387 if (!mm)
388 goto err;
389
Kees Cookc31dbb142018-04-10 16:35:01 -0700390 /* Save current stack limit for all calculations made during exec. */
391 task_lock(current->group_leader);
392 bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];
393 task_unlock(current->group_leader);
394
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700395 err = __bprm_mm_init(bprm);
396 if (err)
397 goto err;
398
399 return 0;
400
401err:
402 if (mm) {
403 bprm->mm = NULL;
404 mmdrop(mm);
405 }
406
407 return err;
408}
409
Oleg Nesterovba2d01622011-03-06 18:02:37 +0100410struct user_arg_ptr {
Oleg Nesterov0e028462011-03-06 18:02:54 +0100411#ifdef CONFIG_COMPAT
412 bool is_compat;
413#endif
414 union {
415 const char __user *const __user *native;
416#ifdef CONFIG_COMPAT
Al Viro38b983b2012-09-30 13:38:55 -0400417 const compat_uptr_t __user *compat;
Oleg Nesterov0e028462011-03-06 18:02:54 +0100418#endif
419 } ptr;
Oleg Nesterovba2d01622011-03-06 18:02:37 +0100420};
421
422static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100423{
Oleg Nesterov0e028462011-03-06 18:02:54 +0100424 const char __user *native;
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100425
Oleg Nesterov0e028462011-03-06 18:02:54 +0100426#ifdef CONFIG_COMPAT
427 if (unlikely(argv.is_compat)) {
428 compat_uptr_t compat;
429
430 if (get_user(compat, argv.ptr.compat + nr))
431 return ERR_PTR(-EFAULT);
432
433 return compat_ptr(compat);
434 }
435#endif
436
437 if (get_user(native, argv.ptr.native + nr))
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100438 return ERR_PTR(-EFAULT);
439
Oleg Nesterov0e028462011-03-06 18:02:54 +0100440 return native;
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100441}
442
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443/*
444 * count() counts the number of strings in array ARGV.
445 */
Oleg Nesterovba2d01622011-03-06 18:02:37 +0100446static int count(struct user_arg_ptr argv, int max)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700447{
448 int i = 0;
449
Oleg Nesterov0e028462011-03-06 18:02:54 +0100450 if (argv.ptr.native != NULL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700451 for (;;) {
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100452 const char __user *p = get_user_arg_ptr(argv, i);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700453
Linus Torvalds1da177e2005-04-16 15:20:36 -0700454 if (!p)
455 break;
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100456
457 if (IS_ERR(p))
458 return -EFAULT;
459
Xi Wang6d92d4f2013-01-11 14:31:48 -0800460 if (i >= max)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700461 return -E2BIG;
Xi Wang6d92d4f2013-01-11 14:31:48 -0800462 ++i;
Roland McGrath9aea5a62010-09-07 19:37:06 -0700463
464 if (fatal_signal_pending(current))
465 return -ERESTARTNOHAND;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700466 cond_resched();
467 }
468 }
469 return i;
470}
471
Eric W. Biedermanbe619f72020-07-13 12:06:48 -0500472static int count_strings_kernel(const char *const *argv)
473{
474 int i;
475
476 if (!argv)
477 return 0;
478
479 for (i = 0; argv[i]; ++i) {
480 if (i >= MAX_ARG_STRINGS)
481 return -E2BIG;
482 if (fatal_signal_pending(current))
483 return -ERESTARTNOHAND;
484 cond_resched();
485 }
486 return i;
487}
488
Kees Cook084ebf72024-06-21 13:50:43 -0700489static inline int bprm_set_stack_limit(struct linux_binprm *bprm,
490 unsigned long limit)
491{
492#ifdef CONFIG_MMU
Kees Cook21f93102024-06-21 13:50:44 -0700493 /* Avoid a pathological bprm->p. */
494 if (bprm->p < limit)
495 return -E2BIG;
Kees Cook084ebf72024-06-21 13:50:43 -0700496 bprm->argmin = bprm->p - limit;
497#endif
498 return 0;
499}
500static inline bool bprm_hit_stack_limit(struct linux_binprm *bprm)
501{
502#ifdef CONFIG_MMU
503 return bprm->p < bprm->argmin;
504#else
505 return false;
506#endif
507}
508
Kees Cook60371f42024-05-19 17:17:59 -0700509/*
510 * Calculate bprm->argmin from:
511 * - _STK_LIM
512 * - ARG_MAX
513 * - bprm->rlim_stack.rlim_cur
514 * - bprm->argc
515 * - bprm->envc
516 * - bprm->p
517 */
Eric W. Biedermand8b9cd52020-07-12 08:23:54 -0500518static int bprm_stack_limits(struct linux_binprm *bprm)
Oleg Nesterov655c16a2019-01-03 15:28:11 -0800519{
520 unsigned long limit, ptr_size;
521
Oleg Nesterov655c16a2019-01-03 15:28:11 -0800522 /*
523 * Limit to 1/4 of the max stack size or 3/4 of _STK_LIM
524 * (whichever is smaller) for the argv+env strings.
525 * This ensures that:
526 * - the remaining binfmt code will not run out of stack space,
527 * - the program will have a reasonable amount of stack left
528 * to work from.
529 */
530 limit = _STK_LIM / 4 * 3;
531 limit = min(limit, bprm->rlim_stack.rlim_cur / 4);
532 /*
533 * We've historically supported up to 32 pages (ARG_MAX)
534 * of argument strings even with small stacks
535 */
536 limit = max_t(unsigned long, limit, ARG_MAX);
Kees Cook21f93102024-06-21 13:50:44 -0700537 /* Reject totally pathological counts. */
538 if (bprm->argc < 0 || bprm->envc < 0)
539 return -E2BIG;
Oleg Nesterov655c16a2019-01-03 15:28:11 -0800540 /*
541 * We must account for the size of all the argv and envp pointers to
542 * the argv and envp strings, since they will also take up space in
543 * the stack. They aren't stored until much later when we can't
544 * signal to the parent that the child has run out of stack space.
545 * Instead, calculate it here so it's possible to fail gracefully.
Kees Cookdcd46d82022-01-31 16:09:47 -0800546 *
547 * In the case of argc = 0, make sure there is space for adding a
548 * empty string (which will bump argc to 1), to ensure confused
549 * userspace programs don't start processing from argv[1], thinking
550 * argc can never be 0, to keep them from walking envp by accident.
551 * See do_execveat_common().
Oleg Nesterov655c16a2019-01-03 15:28:11 -0800552 */
Kees Cook21f93102024-06-21 13:50:44 -0700553 if (check_add_overflow(max(bprm->argc, 1), bprm->envc, &ptr_size) ||
554 check_mul_overflow(ptr_size, sizeof(void *), &ptr_size))
555 return -E2BIG;
Oleg Nesterov655c16a2019-01-03 15:28:11 -0800556 if (limit <= ptr_size)
557 return -E2BIG;
558 limit -= ptr_size;
559
Kees Cook084ebf72024-06-21 13:50:43 -0700560 return bprm_set_stack_limit(bprm, limit);
Oleg Nesterov655c16a2019-01-03 15:28:11 -0800561}
562
Linus Torvalds1da177e2005-04-16 15:20:36 -0700563/*
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700564 * 'copy_strings()' copies argument/environment strings from the old
565 * processes's memory to the new process's stack. The call to get_user_pages()
566 * ensures the destination page is created and not swapped out.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700567 */
Oleg Nesterovba2d01622011-03-06 18:02:37 +0100568static int copy_strings(int argc, struct user_arg_ptr argv,
Adrian Bunk75c96f82005-05-05 16:16:09 -0700569 struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700570{
571 struct page *kmapped_page = NULL;
572 char *kaddr = NULL;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700573 unsigned long kpos = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700574 int ret;
575
576 while (argc-- > 0) {
David Howellsd7627462010-08-17 23:52:56 +0100577 const char __user *str;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700578 int len;
579 unsigned long pos;
580
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100581 ret = -EFAULT;
582 str = get_user_arg_ptr(argv, argc);
583 if (IS_ERR(str))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700584 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100586 len = strnlen_user(str, MAX_ARG_STRLEN);
587 if (!len)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700588 goto out;
Oleg Nesterov1d1dbf82011-03-06 18:02:21 +0100589
590 ret = -E2BIG;
591 if (!valid_arg_len(bprm, len))
592 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700593
Tom Rixb4527222022-02-11 08:09:40 -0800594 /* We're going to work our way backwards. */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700595 pos = bprm->p;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700596 str += len;
597 bprm->p -= len;
Kees Cook084ebf72024-06-21 13:50:43 -0700598 if (bprm_hit_stack_limit(bprm))
Oleg Nesterov655c16a2019-01-03 15:28:11 -0800599 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700600
601 while (len > 0) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700602 int offset, bytes_to_copy;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700603
Roland McGrath9aea5a62010-09-07 19:37:06 -0700604 if (fatal_signal_pending(current)) {
605 ret = -ERESTARTNOHAND;
606 goto out;
607 }
Roland McGrath7993bc12010-09-07 19:36:28 -0700608 cond_resched();
609
Linus Torvalds1da177e2005-04-16 15:20:36 -0700610 offset = pos % PAGE_SIZE;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700611 if (offset == 0)
612 offset = PAGE_SIZE;
613
614 bytes_to_copy = offset;
615 if (bytes_to_copy > len)
616 bytes_to_copy = len;
617
618 offset -= bytes_to_copy;
619 pos -= bytes_to_copy;
620 str -= bytes_to_copy;
621 len -= bytes_to_copy;
622
623 if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
624 struct page *page;
625
626 page = get_arg_page(bprm, pos, 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700627 if (!page) {
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700628 ret = -E2BIG;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700629 goto out;
630 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700631
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700632 if (kmapped_page) {
Christoph Hellwigf358afc2021-09-02 14:56:36 -0700633 flush_dcache_page(kmapped_page);
Fabio M. De Francesco3a608cf2022-08-03 20:28:56 +0200634 kunmap_local(kaddr);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700635 put_arg_page(kmapped_page);
636 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700637 kmapped_page = page;
Fabio M. De Francesco3a608cf2022-08-03 20:28:56 +0200638 kaddr = kmap_local_page(kmapped_page);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700639 kpos = pos & PAGE_MASK;
640 flush_arg_page(bprm, kpos, kmapped_page);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700641 }
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700642 if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700643 ret = -EFAULT;
644 goto out;
645 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700646 }
647 }
648 ret = 0;
649out:
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700650 if (kmapped_page) {
Christoph Hellwigf358afc2021-09-02 14:56:36 -0700651 flush_dcache_page(kmapped_page);
Fabio M. De Francesco3a608cf2022-08-03 20:28:56 +0200652 kunmap_local(kaddr);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700653 put_arg_page(kmapped_page);
654 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700655 return ret;
656}
657
658/*
Christoph Hellwig986db2d2020-06-04 16:51:14 -0700659 * Copy and argument/environment string from the kernel to the processes stack.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700660 */
Christoph Hellwig986db2d2020-06-04 16:51:14 -0700661int copy_string_kernel(const char *arg, struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700662{
Christoph Hellwig762a3af2020-06-04 16:51:18 -0700663 int len = strnlen(arg, MAX_ARG_STRLEN) + 1 /* terminating NUL */;
664 unsigned long pos = bprm->p;
Oleg Nesterovba2d01622011-03-06 18:02:37 +0100665
Christoph Hellwig762a3af2020-06-04 16:51:18 -0700666 if (len == 0)
667 return -EFAULT;
668 if (!valid_arg_len(bprm, len))
669 return -E2BIG;
Oleg Nesterovba2d01622011-03-06 18:02:37 +0100670
Christoph Hellwig762a3af2020-06-04 16:51:18 -0700671 /* We're going to work our way backwards. */
672 arg += len;
673 bprm->p -= len;
Kees Cook084ebf72024-06-21 13:50:43 -0700674 if (bprm_hit_stack_limit(bprm))
Christoph Hellwig762a3af2020-06-04 16:51:18 -0700675 return -E2BIG;
676
677 while (len > 0) {
678 unsigned int bytes_to_copy = min_t(unsigned int, len,
679 min_not_zero(offset_in_page(pos), PAGE_SIZE));
680 struct page *page;
Christoph Hellwig762a3af2020-06-04 16:51:18 -0700681
682 pos -= bytes_to_copy;
683 arg -= bytes_to_copy;
684 len -= bytes_to_copy;
685
686 page = get_arg_page(bprm, pos, 1);
687 if (!page)
688 return -E2BIG;
Christoph Hellwig762a3af2020-06-04 16:51:18 -0700689 flush_arg_page(bprm, pos & PAGE_MASK, page);
Fabio M. De Francescoc6e8e362022-07-24 23:25:23 +0200690 memcpy_to_page(page, offset_in_page(pos), arg, bytes_to_copy);
Christoph Hellwig762a3af2020-06-04 16:51:18 -0700691 put_arg_page(page);
692 }
693
694 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700695}
Christoph Hellwig986db2d2020-06-04 16:51:14 -0700696EXPORT_SYMBOL(copy_string_kernel);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700697
Eric W. Biedermanbe619f72020-07-13 12:06:48 -0500698static int copy_strings_kernel(int argc, const char *const *argv,
699 struct linux_binprm *bprm)
700{
701 while (argc-- > 0) {
702 int ret = copy_string_kernel(argv[argc], bprm);
703 if (ret < 0)
704 return ret;
705 if (fatal_signal_pending(current))
706 return -ERESTARTNOHAND;
707 cond_resched();
708 }
709 return 0;
710}
711
Linus Torvalds1da177e2005-04-16 15:20:36 -0700712#ifdef CONFIG_MMU
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700713
Linus Torvalds1da177e2005-04-16 15:20:36 -0700714/*
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700715 * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX. Once
716 * the binfmt code determines where the new stack should reside, we shift it to
717 * its final location. The process proceeds as follows:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700718 *
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700719 * 1) Use shift to calculate the new vma endpoints.
720 * 2) Extend vma to cover both the old and new ranges. This ensures the
721 * arguments passed to subsequent functions are consistent.
722 * 3) Move vma's page tables to the new range.
723 * 4) Free up any cleared pgd range.
724 * 5) Shrink the vma to cover only the new range.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700725 */
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700726static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700727{
728 struct mm_struct *mm = vma->vm_mm;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700729 unsigned long old_start = vma->vm_start;
730 unsigned long old_end = vma->vm_end;
731 unsigned long length = old_end - old_start;
732 unsigned long new_start = old_start - shift;
733 unsigned long new_end = old_end - shift;
Matthew Wilcox (Oracle)19066e52022-09-06 19:48:56 +0000734 VMA_ITERATOR(vmi, mm, new_start);
735 struct vm_area_struct *next;
Peter Zijlstrad16dfc52011-05-24 17:11:45 -0700736 struct mmu_gather tlb;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700737
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700738 BUG_ON(new_start > new_end);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700739
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700740 /*
741 * ensure there are no vmas between where we want to go
742 * and where we are
743 */
Matthew Wilcox (Oracle)19066e52022-09-06 19:48:56 +0000744 if (vma != vma_next(&vmi))
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700745 return -EFAULT;
746
Liam R. Howlettb5df0922023-07-24 14:31:52 -0400747 vma_iter_prev_range(&vmi);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700748 /*
749 * cover the whole range: [new_start, old_end)
750 */
Liam R. Howlettcf51e862023-01-20 11:26:46 -0500751 if (vma_expand(&vmi, vma, new_start, old_end, vma->vm_pgoff, NULL))
Rik van Riel5beb4932010-03-05 13:42:07 -0800752 return -ENOMEM;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700753
754 /*
755 * move the page tables downwards, on failure we rely on
756 * process cleanup to remove whatever mess we made.
757 */
758 if (length != move_page_tables(vma, old_start,
Joel Fernandes (Google)b1e5a3d2023-09-03 15:13:23 +0000759 vma, new_start, length, false, true))
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700760 return -ENOMEM;
761
762 lru_add_drain();
Will Deacona72afd82021-01-27 23:53:45 +0000763 tlb_gather_mmu(&tlb, mm);
Matthew Wilcox (Oracle)19066e52022-09-06 19:48:56 +0000764 next = vma_next(&vmi);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700765 if (new_end > old_start) {
766 /*
767 * when the old and new regions overlap clear from new_end.
768 */
Peter Zijlstrad16dfc52011-05-24 17:11:45 -0700769 free_pgd_range(&tlb, new_end, old_end, new_end,
Matthew Wilcox (Oracle)19066e52022-09-06 19:48:56 +0000770 next ? next->vm_start : USER_PGTABLES_CEILING);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700771 } else {
772 /*
773 * otherwise, clean from old_start; this is done to not touch
774 * the address space in [new_end, old_start) some architectures
775 * have constraints on va-space that make this illegal (IA64) -
776 * for the others its just a little faster.
777 */
Peter Zijlstrad16dfc52011-05-24 17:11:45 -0700778 free_pgd_range(&tlb, old_start, old_end, new_end,
Matthew Wilcox (Oracle)19066e52022-09-06 19:48:56 +0000779 next ? next->vm_start : USER_PGTABLES_CEILING);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700780 }
Will Deaconae8eba82021-01-27 23:53:43 +0000781 tlb_finish_mmu(&tlb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700782
Liam R. Howlettb3730372023-01-20 11:26:37 -0500783 vma_prev(&vmi);
784 /* Shrink the vma to just the new range */
Liam R. Howlettcf51e862023-01-20 11:26:46 -0500785 return vma_shrink(&vmi, vma, new_start, new_end, vma->vm_pgoff);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700786}
787
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700788/*
789 * Finalizes the stack vm_area_struct. The flags and permissions are updated,
790 * the stack is optionally relocated, and some extra space is added.
791 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700792int setup_arg_pages(struct linux_binprm *bprm,
793 unsigned long stack_top,
794 int executable_stack)
795{
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700796 unsigned long ret;
797 unsigned long stack_shift;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700798 struct mm_struct *mm = current->mm;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700799 struct vm_area_struct *vma = bprm->vma;
800 struct vm_area_struct *prev = NULL;
801 unsigned long vm_flags;
802 unsigned long stack_base;
Michael Neuling803bf5e2010-02-10 13:56:42 -0800803 unsigned long stack_size;
804 unsigned long stack_expand;
805 unsigned long rlim_stack;
Nadav Amit4a184192022-05-09 18:20:50 -0700806 struct mmu_gather tlb;
Liam R. Howlett2286a692023-01-20 11:26:18 -0500807 struct vma_iterator vmi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700808
809#ifdef CONFIG_STACK_GROWSUP
James Hogand71f2902014-05-13 23:58:24 +0100810 /* Limit stack size */
Kees Cookc31dbb142018-04-10 16:35:01 -0700811 stack_base = bprm->rlim_stack.rlim_max;
Helge Deller22ee3ea2020-11-06 19:41:36 +0100812
813 stack_base = calc_max_stack_size(stack_base);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700814
Helge Dellerd045c772015-05-11 22:01:27 +0200815 /* Add space for stack randomization. */
816 stack_base += (STACK_RND_MASK << PAGE_SHIFT);
817
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700818 /* Make sure we didn't let the argument array grow too large. */
819 if (vma->vm_end - vma->vm_start > stack_base)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700820 return -ENOMEM;
821
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700822 stack_base = PAGE_ALIGN(stack_top - stack_base);
823
824 stack_shift = vma->vm_start - stack_base;
825 mm->arg_start = bprm->p - stack_shift;
826 bprm->p = vma->vm_end - stack_shift;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700827#else
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700828 stack_top = arch_align_stack(stack_top);
829 stack_top = PAGE_ALIGN(stack_top);
Roland McGrath1b528182010-09-07 19:35:49 -0700830
831 if (unlikely(stack_top < mmap_min_addr) ||
832 unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
833 return -ENOMEM;
834
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700835 stack_shift = vma->vm_end - stack_top;
836
837 bprm->p -= stack_shift;
838 mm->arg_start = bprm->p;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700839#endif
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700840
841 if (bprm->loader)
842 bprm->loader -= stack_shift;
843 bprm->exec -= stack_shift;
844
Michel Lespinassed8ed45c2020-06-08 21:33:25 -0700845 if (mmap_write_lock_killable(mm))
Michal Hockof268dfe2016-05-23 16:26:02 -0700846 return -EINTR;
847
Hugh Dickins96a8e132008-07-10 21:19:20 +0100848 vm_flags = VM_STACK_FLAGS;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700849
850 /*
851 * Adjust stack execute permissions; explicitly enable for
852 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
853 * (arch default) otherwise.
854 */
855 if (unlikely(executable_stack == EXSTACK_ENABLE_X))
856 vm_flags |= VM_EXEC;
857 else if (executable_stack == EXSTACK_DISABLE_X)
858 vm_flags &= ~VM_EXEC;
859 vm_flags |= mm->def_flags;
Mel Gormana8bef8ff2010-05-24 14:32:24 -0700860 vm_flags |= VM_STACK_INCOMPLETE_SETUP;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700861
Liam R. Howlett2286a692023-01-20 11:26:18 -0500862 vma_iter_init(&vmi, mm, vma->vm_start);
863
Nadav Amit4a184192022-05-09 18:20:50 -0700864 tlb_gather_mmu(&tlb, mm);
Liam R. Howlett2286a692023-01-20 11:26:18 -0500865 ret = mprotect_fixup(&vmi, &tlb, vma, &prev, vma->vm_start, vma->vm_end,
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700866 vm_flags);
Nadav Amit4a184192022-05-09 18:20:50 -0700867 tlb_finish_mmu(&tlb);
868
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700869 if (ret)
870 goto out_unlock;
871 BUG_ON(prev != vma);
872
Alexey Dobriyan47a2ebb2020-01-30 22:17:29 -0800873 if (unlikely(vm_flags & VM_EXEC)) {
874 pr_warn_once("process '%pD4' started with executable stack\n",
875 bprm->file);
876 }
877
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700878 /* Move stack pages down in memory. */
879 if (stack_shift) {
880 ret = shift_arg_pages(vma, stack_shift);
Anton Blanchardfc63cf22009-11-11 14:26:48 -0800881 if (ret)
882 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700883 }
884
Mel Gormana8bef8ff2010-05-24 14:32:24 -0700885 /* mprotect_fixup is overkill to remove the temporary stack flags */
Suren Baghdasaryan1c712222023-01-26 11:37:49 -0800886 vm_flags_clear(vma, VM_STACK_INCOMPLETE_SETUP);
Mel Gormana8bef8ff2010-05-24 14:32:24 -0700887
Michael Neuling5ef097dd2010-03-05 13:42:57 -0800888 stack_expand = 131072UL; /* randomly 32*4k (or 2*64k) pages */
Michael Neuling803bf5e2010-02-10 13:56:42 -0800889 stack_size = vma->vm_end - vma->vm_start;
890 /*
891 * Align this down to a page boundary as expand_stack
892 * will align it up.
893 */
Kees Cookc31dbb142018-04-10 16:35:01 -0700894 rlim_stack = bprm->rlim_stack.rlim_cur & PAGE_MASK;
Rolf Eike Beerbfb4a2b2022-10-19 09:32:35 +0200895
896 stack_expand = min(rlim_stack, stack_size + stack_expand);
897
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700898#ifdef CONFIG_STACK_GROWSUP
Rolf Eike Beerbfb4a2b2022-10-19 09:32:35 +0200899 stack_base = vma->vm_start + stack_expand;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700900#else
Rolf Eike Beerbfb4a2b2022-10-19 09:32:35 +0200901 stack_base = vma->vm_end - stack_expand;
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700902#endif
Eric B Munson3af9e852010-05-18 15:30:49 +0100903 current->mm->start_stack = bprm->p;
Linus Torvalds8d7071a2023-06-24 13:45:51 -0700904 ret = expand_stack_locked(vma, stack_base);
Ollie Wildb6a2fea2007-07-19 01:48:16 -0700905 if (ret)
906 ret = -EFAULT;
907
908out_unlock:
Michel Lespinassed8ed45c2020-06-08 21:33:25 -0700909 mmap_write_unlock(mm);
Anton Blanchardfc63cf22009-11-11 14:26:48 -0800910 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700911}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700912EXPORT_SYMBOL(setup_arg_pages);
913
Nicolas Pitre7e7ec6a2016-07-24 11:30:18 -0400914#else
915
916/*
917 * Transfer the program arguments and environment from the holding pages
918 * onto the stack. The provided stack pointer is adjusted accordingly.
919 */
920int transfer_args_to_stack(struct linux_binprm *bprm,
921 unsigned long *sp_location)
922{
923 unsigned long index, stop, sp;
924 int ret = 0;
925
926 stop = bprm->p >> PAGE_SHIFT;
927 sp = *sp_location;
928
929 for (index = MAX_ARG_PAGES - 1; index >= stop; index--) {
930 unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0;
Fabio M. De Francesco3a608cf2022-08-03 20:28:56 +0200931 char *src = kmap_local_page(bprm->page[index]) + offset;
Nicolas Pitre7e7ec6a2016-07-24 11:30:18 -0400932 sp -= PAGE_SIZE - offset;
933 if (copy_to_user((void *) sp, src, PAGE_SIZE - offset) != 0)
934 ret = -EFAULT;
Fabio M. De Francesco3a608cf2022-08-03 20:28:56 +0200935 kunmap_local(src);
Nicolas Pitre7e7ec6a2016-07-24 11:30:18 -0400936 if (ret)
937 goto out;
938 }
939
Max Filippov2aea94a2024-03-20 11:26:07 -0700940 bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
Nicolas Pitre7e7ec6a2016-07-24 11:30:18 -0400941 *sp_location = sp;
942
943out:
944 return ret;
945}
946EXPORT_SYMBOL(transfer_args_to_stack);
947
Linus Torvalds1da177e2005-04-16 15:20:36 -0700948#endif /* CONFIG_MMU */
949
Kees Cookbdd8f622022-09-16 17:11:18 -0700950/*
951 * On success, caller must call do_close_execat() on the returned
952 * struct file to close it.
953 */
David Drysdale51f39a12014-12-12 16:57:29 -0800954static struct file *do_open_execat(int fd, struct filename *name, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700955{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700956 struct file *file;
Christoph Hellwige56b6a52008-05-19 07:53:34 +0200957 int err;
David Drysdale51f39a12014-12-12 16:57:29 -0800958 struct open_flags open_exec_flags = {
Al Viro47c805d2011-02-23 17:44:09 -0500959 .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
Al Viro62fb4a12015-12-26 22:33:24 -0500960 .acc_mode = MAY_EXEC,
Al Virof9652e12013-06-11 08:23:01 +0400961 .intent = LOOKUP_OPEN,
962 .lookup_flags = LOOKUP_FOLLOW,
Al Viro47c805d2011-02-23 17:44:09 -0500963 };
Linus Torvalds1da177e2005-04-16 15:20:36 -0700964
David Drysdale51f39a12014-12-12 16:57:29 -0800965 if ((flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
966 return ERR_PTR(-EINVAL);
967 if (flags & AT_SYMLINK_NOFOLLOW)
968 open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW;
969 if (flags & AT_EMPTY_PATH)
970 open_exec_flags.lookup_flags |= LOOKUP_EMPTY;
971
972 file = do_filp_open(fd, name, &open_exec_flags);
Al Viro6e8341a2009-04-06 11:16:22 -0400973 if (IS_ERR(file))
Christoph Hellwige56b6a52008-05-19 07:53:34 +0200974 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700975
Kees Cook633fb6a2020-08-11 18:36:26 -0700976 /*
977 * may_open() has already checked for this, so it should be
978 * impossible to trip now. But we need to be extra cautious
979 * and check again at the very end too.
980 */
Christoph Hellwige56b6a52008-05-19 07:53:34 +0200981 err = -EACCES;
Kees Cook0fd338b2020-08-11 18:36:30 -0700982 if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) ||
983 path_noexec(&file->f_path)))
Al Viro6e8341a2009-04-06 11:16:22 -0400984 goto exit;
Christoph Hellwige56b6a52008-05-19 07:53:34 +0200985
Al Viro6e8341a2009-04-06 11:16:22 -0400986out:
Christoph Hellwige56b6a52008-05-19 07:53:34 +0200987 return file;
988
Al Viro6e8341a2009-04-06 11:16:22 -0400989exit:
990 fput(file);
Christoph Hellwige56b6a52008-05-19 07:53:34 +0200991 return ERR_PTR(err);
992}
Linus Torvaldsc4ad8f92014-02-05 12:54:53 -0800993
Kees Cookbdd8f622022-09-16 17:11:18 -0700994/**
995 * open_exec - Open a path name for execution
996 *
997 * @name: path name to open with the intent of executing it.
998 *
999 * Returns ERR_PTR on failure or allocated struct file on success.
1000 *
Christian Brauner2a010c42024-05-31 15:01:43 +02001001 * As this is a wrapper for the internal do_open_execat(). Also see
Kees Cookbdd8f622022-09-16 17:11:18 -07001002 * do_close_execat().
1003 */
Linus Torvaldsc4ad8f92014-02-05 12:54:53 -08001004struct file *open_exec(const char *name)
1005{
Paul Moore51689102015-01-22 00:00:03 -05001006 struct filename *filename = getname_kernel(name);
1007 struct file *f = ERR_CAST(filename);
1008
1009 if (!IS_ERR(filename)) {
1010 f = do_open_execat(AT_FDCWD, filename, 0);
1011 putname(filename);
1012 }
1013 return f;
Linus Torvaldsc4ad8f92014-02-05 12:54:53 -08001014}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001015EXPORT_SYMBOL(open_exec);
1016
Eric W. Biederman987f20a2022-09-26 17:15:32 -05001017#if defined(CONFIG_BINFMT_FLAT) || defined(CONFIG_BINFMT_ELF_FDPIC)
Al Viro3dc20cb2013-04-13 20:31:37 -04001018ssize_t read_code(struct file *file, unsigned long addr, loff_t pos, size_t len)
1019{
Al Viroec695572014-02-04 19:08:21 -05001020 ssize_t res = vfs_read(file, (void __user *)addr, len, &pos);
Al Viro3dc20cb2013-04-13 20:31:37 -04001021 if (res > 0)
Christoph Hellwigbce2b682020-06-07 21:42:43 -07001022 flush_icache_user_range(addr, addr + len);
Al Viro3dc20cb2013-04-13 20:31:37 -04001023 return res;
1024}
1025EXPORT_SYMBOL(read_code);
Christoph Hellwig48304f72020-06-07 21:42:40 -07001026#endif
Al Viro3dc20cb2013-04-13 20:31:37 -04001027
Eric W. Biedermaneea96732020-03-25 10:03:36 -05001028/*
1029 * Maps the mm_struct mm into the current task struct.
Eric W. Biedermanf7cfd872020-12-03 14:12:00 -06001030 * On success, this function returns with exec_update_lock
1031 * held for writing.
Eric W. Biedermaneea96732020-03-25 10:03:36 -05001032 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001033static int exec_mmap(struct mm_struct *mm)
1034{
1035 struct task_struct *tsk;
Davidlohr Bueso615d6e82014-04-07 15:37:25 -07001036 struct mm_struct *old_mm, *active_mm;
Eric W. Biedermaneea96732020-03-25 10:03:36 -05001037 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001038
1039 /* Notify parent that we're no longer interested in the old VM */
1040 tsk = current;
1041 old_mm = current->mm;
Thomas Gleixner4610ba72019-11-06 22:55:38 +01001042 exec_mm_release(tsk, old_mm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001043
Eric W. Biedermanf7cfd872020-12-03 14:12:00 -06001044 ret = down_write_killable(&tsk->signal->exec_update_lock);
Eric W. Biedermaneea96732020-03-25 10:03:36 -05001045 if (ret)
1046 return ret;
1047
Linus Torvalds1da177e2005-04-16 15:20:36 -07001048 if (old_mm) {
1049 /*
Eric W. Biederman7e3c4fb2021-09-03 10:26:05 -05001050 * If there is a pending fatal signal perhaps a signal
1051 * whose default action is to create a coredump get
1052 * out and die instead of going through with the exec.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001053 */
Eric W. Biederman7e3c4fb2021-09-03 10:26:05 -05001054 ret = mmap_read_lock_killable(old_mm);
1055 if (ret) {
Eric W. Biedermanf7cfd872020-12-03 14:12:00 -06001056 up_write(&tsk->signal->exec_update_lock);
Eric W. Biederman7e3c4fb2021-09-03 10:26:05 -05001057 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001058 }
1059 }
Eric W. Biedermaneea96732020-03-25 10:03:36 -05001060
Linus Torvalds1da177e2005-04-16 15:20:36 -07001061 task_lock(tsk);
Mathieu Desnoyers227a4aa2019-09-19 13:37:02 -04001062 membarrier_exec_mmap(mm);
Nicholas Piggind53c3df2020-09-14 14:52:16 +10001063
1064 local_irq_disable();
1065 active_mm = tsk->active_mm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001066 tsk->active_mm = mm;
Nicholas Piggind53c3df2020-09-14 14:52:16 +10001067 tsk->mm = mm;
Mathieu Desnoyersaf7f5882022-11-22 15:39:09 -05001068 mm_init_cid(mm);
Nicholas Piggind53c3df2020-09-14 14:52:16 +10001069 /*
1070 * This prevents preemption while active_mm is being loaded and
1071 * it and mm are being updated, which could cause problems for
1072 * lazy tlb mm refcounting when these are updated by context
1073 * switches. Not all architectures can handle irqs off over
1074 * activate_mm yet.
1075 */
1076 if (!IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
1077 local_irq_enable();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001078 activate_mm(active_mm, mm);
Nicholas Piggind53c3df2020-09-14 14:52:16 +10001079 if (IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
1080 local_irq_enable();
Sebastian Andrzej Siewiordda1c412022-10-26 15:48:30 +02001081 lru_gen_add_mm(mm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001082 task_unlock(tsk);
Yu Zhaobd74fda2022-09-18 02:00:05 -06001083 lru_gen_use_mm(mm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001084 if (old_mm) {
Michel Lespinassed8ed45c2020-06-08 21:33:25 -07001085 mmap_read_unlock(old_mm);
Eric Sesterhenn7dddb122006-04-01 01:13:38 +02001086 BUG_ON(active_mm != old_mm);
Oleg Nesterov701085b22012-03-19 17:04:01 +01001087 setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm);
Balbir Singh31a78f22008-09-28 23:09:31 +01001088 mm_update_next_owner(old_mm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001089 mmput(old_mm);
1090 return 0;
1091 }
Nicholas Pigginaa464ba2023-02-03 17:18:34 +10001092 mmdrop_lazy_tlb(active_mm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001093 return 0;
1094}
1095
Arjan van de Ven858119e2006-01-14 13:20:43 -08001096static int de_thread(struct task_struct *tsk)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001097{
1098 struct signal_struct *sig = tsk->signal;
Oleg Nesterovb2c903b2007-10-16 23:27:22 -07001099 struct sighand_struct *oldsighand = tsk->sighand;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001100 spinlock_t *lock = &oldsighand->siglock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001101
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -07001102 if (thread_group_empty(tsk))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001103 goto no_thread_group;
1104
1105 /*
1106 * Kill all other threads in the thread group.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001107 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001108 spin_lock_irq(lock);
Eric W. Biederman49697332021-06-24 02:14:30 -05001109 if ((sig->flags & SIGNAL_GROUP_EXIT) || sig->group_exec_task) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001110 /*
1111 * Another group action in progress, just
1112 * return so that the signal is processed.
1113 */
1114 spin_unlock_irq(lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001115 return -EAGAIN;
1116 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001117
Eric W. Biederman60700e32021-06-06 13:47:53 -05001118 sig->group_exec_task = tsk;
Oleg Nesterovd3441932010-05-26 14:43:11 -07001119 sig->notify_count = zap_other_threads(tsk);
1120 if (!thread_group_leader(tsk))
1121 sig->notify_count--;
1122
1123 while (sig->notify_count) {
Oleg Nesterovd5bbd432012-10-08 19:13:01 +02001124 __set_current_state(TASK_KILLABLE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001125 spin_unlock_irq(lock);
Rafael J. Wysockia72173e2018-12-03 13:04:18 +01001126 schedule();
Davidlohr Bueso08d405c2019-01-03 15:28:58 -08001127 if (__fatal_signal_pending(tsk))
Oleg Nesterovd5bbd432012-10-08 19:13:01 +02001128 goto killed;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001129 spin_lock_irq(lock);
1130 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001131 spin_unlock_irq(lock);
1132
1133 /*
1134 * At this point all other threads have exited, all we have to
1135 * do is to wait for the thread group leader to become inactive,
1136 * and to assume its PID:
1137 */
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -07001138 if (!thread_group_leader(tsk)) {
Oleg Nesterov81879262008-12-01 14:18:16 -08001139 struct task_struct *leader = tsk->group_leader;
Oleg Nesterov6db840f2007-10-16 23:27:23 -07001140
Oleg Nesterov6db840f2007-10-16 23:27:23 -07001141 for (;;) {
Ingo Molnar780de9d2017-02-02 11:50:56 +01001142 cgroup_threadgroup_change_begin(tsk);
Oleg Nesterov6db840f2007-10-16 23:27:23 -07001143 write_lock_irq(&tasklist_lock);
Kirill Tkhaidfcce792015-04-16 12:48:01 -07001144 /*
1145 * Do this under tasklist_lock to ensure that
Eric W. Biederman60700e32021-06-06 13:47:53 -05001146 * exit_notify() can't miss ->group_exec_task
Kirill Tkhaidfcce792015-04-16 12:48:01 -07001147 */
1148 sig->notify_count = -1;
Oleg Nesterov6db840f2007-10-16 23:27:23 -07001149 if (likely(leader->exit_state))
1150 break;
Oleg Nesterovd5bbd432012-10-08 19:13:01 +02001151 __set_current_state(TASK_KILLABLE);
Oleg Nesterov6db840f2007-10-16 23:27:23 -07001152 write_unlock_irq(&tasklist_lock);
Ingo Molnar780de9d2017-02-02 11:50:56 +01001153 cgroup_threadgroup_change_end(tsk);
Rafael J. Wysockia72173e2018-12-03 13:04:18 +01001154 schedule();
Davidlohr Bueso08d405c2019-01-03 15:28:58 -08001155 if (__fatal_signal_pending(tsk))
Oleg Nesterovd5bbd432012-10-08 19:13:01 +02001156 goto killed;
Oleg Nesterov6db840f2007-10-16 23:27:23 -07001157 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001158
Roland McGrathf5e90282006-04-10 22:54:16 -07001159 /*
1160 * The only record we have of the real-time age of a
1161 * process, regardless of execs it's done, is start_time.
1162 * All the past CPU time is accumulated in signal_struct
1163 * from sister threads now dead. But in this non-leader
1164 * exec, nothing survives from the original leader thread,
1165 * whose birth marks the true age of this process now.
1166 * When we take on its identity by switching to its PID, we
1167 * also take its birthdate (always earlier than our own).
1168 */
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -07001169 tsk->start_time = leader->start_time;
Peter Zijlstracf25e242019-11-07 11:07:58 +01001170 tsk->start_boottime = leader->start_boottime;
Roland McGrathf5e90282006-04-10 22:54:16 -07001171
Pavel Emelyanovbac0abd2007-10-18 23:40:18 -07001172 BUG_ON(!same_thread_group(leader, tsk));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001173 /*
1174 * An exec() starts a new thread group with the
1175 * TGID of the previous thread group. Rehash the
1176 * two threads with a switched PID, and release
1177 * the former thread group leader:
1178 */
Eric W. Biedermand73d6522006-03-28 16:11:03 -08001179
1180 /* Become a process group leader with the old leader's pid.
Eric W. Biedermanc18258c2006-09-27 01:51:06 -07001181 * The old leader becomes a thread of the this thread group.
Eric W. Biedermand73d6522006-03-28 16:11:03 -08001182 */
Eric W. Biederman6b03d132020-04-19 06:35:02 -05001183 exchange_tids(tsk, leader);
Eric W. Biederman6883f812017-06-04 04:32:13 -05001184 transfer_pid(leader, tsk, PIDTYPE_TGID);
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -07001185 transfer_pid(leader, tsk, PIDTYPE_PGID);
1186 transfer_pid(leader, tsk, PIDTYPE_SID);
Oleg Nesterov9cd80bb2009-12-17 15:27:15 -08001187
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -07001188 list_replace_rcu(&leader->tasks, &tsk->tasks);
Oleg Nesterov9cd80bb2009-12-17 15:27:15 -08001189 list_replace_init(&leader->sibling, &tsk->sibling);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001190
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -07001191 tsk->group_leader = tsk;
1192 leader->group_leader = tsk;
Eric W. Biedermande12a782006-04-10 17:16:49 -06001193
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -07001194 tsk->exit_signal = SIGCHLD;
Oleg Nesterov087806b2011-06-22 23:10:26 +02001195 leader->exit_signal = -1;
Oleg Nesterov962b5642005-11-23 13:37:43 -08001196
1197 BUG_ON(leader->exit_state != EXIT_ZOMBIE);
1198 leader->exit_state = EXIT_DEAD;
Oleg Nesteroveac1b5e2011-07-21 20:00:43 +02001199 /*
1200 * We are going to release_task()->ptrace_unlink() silently,
1201 * the tracer can sleep in do_wait(). EXIT_DEAD guarantees
Zhang Jiaming50367932022-06-29 15:29:32 +08001202 * the tracer won't block again waiting for this thread.
Oleg Nesteroveac1b5e2011-07-21 20:00:43 +02001203 */
1204 if (unlikely(leader->ptrace))
1205 __wake_up_parent(leader, leader->parent);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001206 write_unlock_irq(&tasklist_lock);
Ingo Molnar780de9d2017-02-02 11:50:56 +01001207 cgroup_threadgroup_change_end(tsk);
Oleg Nesterov81879262008-12-01 14:18:16 -08001208
1209 release_task(leader);
Oleg Nesteroved5d2ca2008-02-04 22:27:24 -08001210 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001211
Eric W. Biederman60700e32021-06-06 13:47:53 -05001212 sig->group_exec_task = NULL;
Oleg Nesterov6db840f2007-10-16 23:27:23 -07001213 sig->notify_count = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001214
1215no_thread_group:
Oleg Nesterove6368252012-03-19 17:03:22 +01001216 /* we have changed execution domain */
1217 tsk->exit_signal = SIGCHLD;
1218
Eric W. Biederman02169152020-03-25 10:00:21 -05001219 BUG_ON(!thread_group_leader(tsk));
1220 return 0;
1221
1222killed:
1223 /* protects against exit_notify() and __exit_signal() */
1224 read_lock(&tasklist_lock);
Eric W. Biederman60700e32021-06-06 13:47:53 -05001225 sig->group_exec_task = NULL;
Eric W. Biederman02169152020-03-25 10:00:21 -05001226 sig->notify_count = 0;
1227 read_unlock(&tasklist_lock);
1228 return -EAGAIN;
1229}
1230
1231
Eric W. Biederman7a60ef42020-03-08 12:04:44 -05001232/*
1233 * This function makes sure the current process has its own signal table,
1234 * so that flush_signal_handlers can later reset the handlers without
1235 * disturbing other processes. (Other processes might share the signal
1236 * table via the CLONE_SIGHAND option to clone().)
1237 */
Eric W. Biederman02169152020-03-25 10:00:21 -05001238static int unshare_sighand(struct task_struct *me)
1239{
1240 struct sighand_struct *oldsighand = me->sighand;
Oleg Nesterov329f7db2005-11-07 21:12:43 +03001241
Elena Reshetovad036bda2019-01-18 14:27:26 +02001242 if (refcount_read(&oldsighand->count) != 1) {
Oleg Nesterovb2c903b2007-10-16 23:27:22 -07001243 struct sighand_struct *newsighand;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001244 /*
Oleg Nesterovb2c903b2007-10-16 23:27:22 -07001245 * This ->sighand is shared with the CLONE_SIGHAND
1246 * but not CLONE_THREAD task, switch to the new one.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001247 */
Oleg Nesterovb2c903b2007-10-16 23:27:22 -07001248 newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
1249 if (!newsighand)
1250 return -ENOMEM;
1251
Elena Reshetovad036bda2019-01-18 14:27:26 +02001252 refcount_set(&newsighand->count, 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001253
1254 write_lock_irq(&tasklist_lock);
1255 spin_lock(&oldsighand->siglock);
Bernd Edlinger5bf2fed2021-06-07 15:54:27 +02001256 memcpy(newsighand->action, oldsighand->action,
1257 sizeof(newsighand->action));
Eric W. Biederman02169152020-03-25 10:00:21 -05001258 rcu_assign_pointer(me->sighand, newsighand);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001259 spin_unlock(&oldsighand->siglock);
1260 write_unlock_irq(&tasklist_lock);
1261
Davide Libenzifba2afa2007-05-10 22:23:13 -07001262 __cleanup_sighand(oldsighand);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001263 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001264 return 0;
1265}
Oleg Nesterov0840a902007-10-16 23:27:22 -07001266
Arnd Bergmann3756f642017-12-14 15:32:41 -08001267char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001268{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001269 task_lock(tsk);
Yafang Shao503471a2022-01-19 18:08:22 -08001270 /* Always NUL terminated and zero-padded */
1271 strscpy_pad(buf, tsk->comm, buf_size);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001272 task_unlock(tsk);
Andrew Morton59714d62008-02-04 22:27:21 -08001273 return buf;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001274}
Arnd Bergmann3756f642017-12-14 15:32:41 -08001275EXPORT_SYMBOL_GPL(__get_task_comm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001276
Al Viro6a6d27d2012-08-21 09:56:33 -04001277/*
1278 * These functions flushes out all traces of the currently running executable
1279 * so that a new one can be started
1280 */
1281
Adrian Hunter82b89772014-05-28 11:45:04 +03001282void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001283{
1284 task_lock(tsk);
KAMEZAWA Hiroyuki43d2b112012-01-10 15:08:09 -08001285 trace_task_rename(tsk, buf);
Yafang Shao06c50882022-01-19 18:08:19 -08001286 strscpy_pad(tsk->comm, buf, sizeof(tsk->comm));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001287 task_unlock(tsk);
Adrian Hunter82b89772014-05-28 11:45:04 +03001288 perf_event_comm(tsk, exec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001289}
1290
Kees Cooka9208e42017-07-18 15:25:30 -07001291/*
1292 * Calling this is the point of no return. None of the failures will be
1293 * seen by userspace since either the process is already taking a fatal
1294 * signal (via de_thread() or coredump), or will have SEGV raised
Eric W. Biederman13c432b2020-03-19 17:16:12 -05001295 * (after exec_mmap()) by search_binary_handler (see below).
Kees Cooka9208e42017-07-18 15:25:30 -07001296 */
Eric W. Biederman23887772020-05-03 07:54:10 -05001297int begin_new_exec(struct linux_binprm * bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001298{
Eric W. Biederman2ca7be72020-03-25 10:00:07 -05001299 struct task_struct *me = current;
Linus Torvalds221af7f2010-01-28 22:14:42 -08001300 int retval;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001301
Eric W. Biederman56305aa2020-05-29 22:00:54 -05001302 /* Once we are committed compute the creds */
1303 retval = bprm_creds_from_file(bprm);
1304 if (retval)
1305 return retval;
1306
Linus Torvalds1da177e2005-04-16 15:20:36 -07001307 /*
Marco Elverc8238992024-04-11 12:20:57 +02001308 * This tracepoint marks the point before flushing the old exec where
1309 * the current task is still unchanged, but errors are fatal (point of
1310 * no return). The later "sched_process_exec" tracepoint is called after
1311 * the current task has successfully switched to the new exec.
1312 */
1313 trace_sched_prepare_exec(current, bprm);
1314
1315 /*
Eric W. Biederman6834e0b2020-04-04 12:01:37 -05001316 * Ensure all future errors are fatal.
1317 */
1318 bprm->point_of_no_return = true;
1319
Linus Torvalds1da177e2005-04-16 15:20:36 -07001320 /*
Eric W. Biederman02169152020-03-25 10:00:21 -05001321 * Make this the only thread in the thread group.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001322 */
Eric W. Biederman2ca7be72020-03-25 10:00:07 -05001323 retval = de_thread(me);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001324 if (retval)
1325 goto out;
1326
Davidlohr Bueso6e399cd2015-04-16 12:47:59 -07001327 /*
Eric W. Biederman9ee12062020-11-30 16:58:46 -06001328 * Cancel any io_uring activity across execve
1329 */
1330 io_uring_task_cancel();
1331
Eric W. Biedermanb6043502020-11-20 17:14:18 -06001332 /* Ensure the files table is not shared. */
Eric W. Biederman1f7026032020-11-20 17:14:19 -06001333 retval = unshare_files();
Eric W. Biedermanb6043502020-11-20 17:14:18 -06001334 if (retval)
1335 goto out;
Eric W. Biedermanb6043502020-11-20 17:14:18 -06001336
Davidlohr Bueso6e399cd2015-04-16 12:47:59 -07001337 /*
1338 * Must be called _before_ exec_mmap() as bprm->mm is
Mateusz Guzika7031f12023-08-14 19:21:40 +02001339 * not visible until then. Doing it here also ensures
1340 * we don't race against replace_mm_exe_file().
Davidlohr Bueso6e399cd2015-04-16 12:47:59 -07001341 */
David Hildenbrandfe69d562021-04-23 10:29:59 +02001342 retval = set_mm_exe_file(bprm->mm, bprm->file);
1343 if (retval)
1344 goto out;
Davidlohr Bueso6e399cd2015-04-16 12:47:59 -07001345
Eric W. Biedermanb8a61c92020-05-14 15:17:40 -05001346 /* If the binary is not readable then enforce mm->dumpable=0 */
Eric W. Biedermanf87d1c92020-05-16 16:29:20 -05001347 would_dump(bprm, bprm->file);
Eric W. Biedermanb8a61c92020-05-14 15:17:40 -05001348 if (bprm->have_execfd)
1349 would_dump(bprm, bprm->executable);
Eric W. Biedermanf87d1c92020-05-16 16:29:20 -05001350
Linus Torvalds1da177e2005-04-16 15:20:36 -07001351 /*
Linus Torvalds1da177e2005-04-16 15:20:36 -07001352 * Release all of the old mmap stuff
1353 */
Oleg Nesterov3c77f842010-11-30 20:55:34 +01001354 acct_arg_size(bprm, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001355 retval = exec_mmap(bprm->mm);
1356 if (retval)
Al Virofd8328b2008-04-22 05:11:59 -04001357 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001358
Kees Cooka9208e42017-07-18 15:25:30 -07001359 bprm->mm = NULL;
Linus Torvalds7ab02af2010-02-02 12:37:44 -08001360
Andrei Vagin2b5f9da2022-09-20 17:31:19 -07001361 retval = exec_task_namespaces();
1362 if (retval)
1363 goto out_unlock;
1364
Eric W. Biedermanccf0fa62020-03-25 10:03:21 -05001365#ifdef CONFIG_POSIX_TIMERS
Thadeu Lima de Souza Cascardoe3623592022-08-09 14:07:51 -03001366 spin_lock_irq(&me->sighand->siglock);
1367 posix_cpu_timers_exit(me);
1368 spin_unlock_irq(&me->sighand->siglock);
Oleg Nesterovd5b36a42022-07-11 18:16:25 +02001369 exit_itimers(me);
Eric W. Biedermanccf0fa62020-03-25 10:03:21 -05001370 flush_itimer_signals();
1371#endif
1372
1373 /*
1374 * Make the signal table private.
1375 */
1376 retval = unshare_sighand(me);
1377 if (retval)
Eric W. Biederman89826cc2020-04-02 18:04:54 -05001378 goto out_unlock;
Eric W. Biedermanccf0fa62020-03-25 10:03:21 -05001379
Eric W. Biederman1b2552c2022-04-11 14:15:54 -05001380 me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC |
Zhang Yib88fae62014-01-23 15:55:57 -08001381 PF_NOFREEZE | PF_NO_SETAFFINITY);
Linus Torvalds7ab02af2010-02-02 12:37:44 -08001382 flush_thread();
Eric W. Biederman2ca7be72020-03-25 10:00:07 -05001383 me->personality &= ~bprm->per_clear;
Linus Torvalds7ab02af2010-02-02 12:37:44 -08001384
Gabriel Krisman Bertazi1446e1d2020-11-27 14:32:34 -05001385 clear_syscall_work_syscall_user_dispatch(me);
1386
Aleksa Sarai613cc2b2016-12-21 16:26:24 +11001387 /*
1388 * We have to apply CLOEXEC before we change whether the process is
1389 * dumpable (in setup_new_exec) to avoid a race with a process in userspace
1390 * trying to access the should-be-closed file descriptors of a process
1391 * undergoing exec(2).
1392 */
Eric W. Biederman2ca7be72020-03-25 10:00:07 -05001393 do_close_on_exec(me->files);
Eric W. Biedermandf9e4d22020-05-03 07:15:28 -05001394
Eric W. Biedermandf9e4d22020-05-03 07:15:28 -05001395 if (bprm->secureexec) {
1396 /* Make sure parent cannot signal privileged process. */
1397 me->pdeath_signal = 0;
1398
1399 /*
1400 * For secureexec, reset the stack limit to sane default to
1401 * avoid bad behavior from the prior rlimits. This has to
1402 * happen before arch_pick_mmap_layout(), which examines
1403 * RLIMIT_STACK, but after the point of no return to avoid
1404 * needing to clean up the change on failure.
1405 */
1406 if (bprm->rlim_stack.rlim_cur > _STK_LIM)
1407 bprm->rlim_stack.rlim_cur = _STK_LIM;
1408 }
1409
1410 me->sas_ss_sp = me->sas_ss_size = 0;
1411
1412 /*
1413 * Figure out dumpability. Note that this checking only of current
1414 * is wrong, but userspace depends on it. This should be testing
1415 * bprm->secureexec instead.
1416 */
1417 if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||
1418 !(uid_eq(current_euid(), current_uid()) &&
1419 gid_eq(current_egid(), current_gid())))
1420 set_dumpable(current->mm, suid_dumpable);
1421 else
1422 set_dumpable(current->mm, SUID_DUMP_USER);
1423
1424 perf_event_exec();
1425 __set_task_comm(me, kbasename(bprm->filename), true);
1426
1427 /* An exec changes our domain. We are no longer part of the thread
1428 group */
1429 WRITE_ONCE(me->self_exec_id, me->self_exec_id + 1);
1430 flush_signal_handlers(me, 0);
1431
Alexey Gladkov905ae012021-04-22 14:27:09 +02001432 retval = set_cred_ucounts(bprm->cred);
1433 if (retval < 0)
1434 goto out_unlock;
1435
Eric W. Biedermandf9e4d22020-05-03 07:15:28 -05001436 /*
1437 * install the new credentials for this executable
1438 */
1439 security_bprm_committing_creds(bprm);
1440
1441 commit_creds(bprm->cred);
1442 bprm->cred = NULL;
1443
1444 /*
1445 * Disable monitoring for regular users
1446 * when executing setuid binaries. Must
1447 * wait until new credentials are committed
1448 * by commit_creds() above
1449 */
1450 if (get_dumpable(me->mm) != SUID_DUMP_USER)
1451 perf_event_exit_task(me);
1452 /*
1453 * cred_guard_mutex must be held at least to this point to prevent
1454 * ptrace_attach() from altering our determination of the task's
1455 * credentials; any time after this it may be unlocked.
1456 */
1457 security_bprm_committed_creds(bprm);
Eric W. Biedermanb8a61c92020-05-14 15:17:40 -05001458
1459 /* Pass the opened binary to the interpreter. */
1460 if (bprm->have_execfd) {
1461 retval = get_unused_fd_flags(0);
1462 if (retval < 0)
1463 goto out_unlock;
1464 fd_install(retval, bprm->executable);
1465 bprm->executable = NULL;
1466 bprm->execfd = retval;
1467 }
Linus Torvalds221af7f2010-01-28 22:14:42 -08001468 return 0;
1469
Eric W. Biederman89826cc2020-04-02 18:04:54 -05001470out_unlock:
Eric W. Biedermanf7cfd872020-12-03 14:12:00 -06001471 up_write(&me->signal->exec_update_lock);
Bernd Edlinger84c39ec52024-01-22 19:34:21 +01001472 if (!bprm->cred)
1473 mutex_unlock(&me->signal->cred_guard_mutex);
1474
Linus Torvalds221af7f2010-01-28 22:14:42 -08001475out:
1476 return retval;
1477}
Eric W. Biederman23887772020-05-03 07:54:10 -05001478EXPORT_SYMBOL(begin_new_exec);
Linus Torvalds221af7f2010-01-28 22:14:42 -08001479
Al Viro1b5d7832011-06-19 12:49:47 -04001480void would_dump(struct linux_binprm *bprm, struct file *file)
1481{
Eric W. Biedermanf84df2a2016-11-16 22:06:51 -06001482 struct inode *inode = file_inode(file);
Christian Brauner4609e1f2023-01-13 12:49:22 +01001483 struct mnt_idmap *idmap = file_mnt_idmap(file);
Christian Brauner4609e1f2023-01-13 12:49:22 +01001484 if (inode_permission(idmap, inode, MAY_READ) < 0) {
Eric W. Biedermanf84df2a2016-11-16 22:06:51 -06001485 struct user_namespace *old, *user_ns;
Al Viro1b5d7832011-06-19 12:49:47 -04001486 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
Eric W. Biedermanf84df2a2016-11-16 22:06:51 -06001487
1488 /* Ensure mm->user_ns contains the executable */
1489 user_ns = old = bprm->mm->user_ns;
1490 while ((user_ns != &init_user_ns) &&
Christian Brauner9452e932023-01-13 12:49:27 +01001491 !privileged_wrt_inode_uidgid(user_ns, idmap, inode))
Eric W. Biedermanf84df2a2016-11-16 22:06:51 -06001492 user_ns = user_ns->parent;
1493
1494 if (old != user_ns) {
1495 bprm->mm->user_ns = get_user_ns(user_ns);
1496 put_user_ns(old);
1497 }
1498 }
Al Viro1b5d7832011-06-19 12:49:47 -04001499}
1500EXPORT_SYMBOL(would_dump);
1501
Linus Torvalds221af7f2010-01-28 22:14:42 -08001502void setup_new_exec(struct linux_binprm * bprm)
1503{
Eric W. Biedermandf9e4d22020-05-03 07:15:28 -05001504 /* Setup things that can depend upon the personality */
Eric W. Biederman7d503fe2020-04-02 18:35:14 -05001505 struct task_struct *me = current;
Kees Cook46d98eb2017-07-18 15:25:27 -07001506
Eric W. Biederman7d503fe2020-04-02 18:35:14 -05001507 arch_pick_mmap_layout(me->mm, &bprm->rlim_stack);
Alan Coxd6e71142005-06-23 00:09:43 -07001508
Kyle Hueye9ea1e72017-03-20 01:16:26 -07001509 arch_setup_new_exec();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001510
Benjamin Herrenschmidt0551fbd2006-02-28 16:59:19 -08001511 /* Set the new mm task size. We have to do that late because it may
1512 * depend on TIF_32BIT which is only updated in flush_thread() on
1513 * some architectures like powerpc
1514 */
Eric W. Biederman7d503fe2020-04-02 18:35:14 -05001515 me->mm->task_size = TASK_SIZE;
Eric W. Biedermanf7cfd872020-12-03 14:12:00 -06001516 up_write(&me->signal->exec_update_lock);
Eric W. Biederman7d503fe2020-04-02 18:35:14 -05001517 mutex_unlock(&me->signal->cred_guard_mutex);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001518}
Linus Torvalds221af7f2010-01-28 22:14:42 -08001519EXPORT_SYMBOL(setup_new_exec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001520
Kees Cookb8383832018-04-10 16:34:57 -07001521/* Runs immediately before start_thread() takes over. */
1522void finalize_exec(struct linux_binprm *bprm)
1523{
Kees Cookc31dbb142018-04-10 16:35:01 -07001524 /* Store any stack rlimit changes before starting thread. */
1525 task_lock(current->group_leader);
1526 current->signal->rlim[RLIMIT_STACK] = bprm->rlim_stack;
1527 task_unlock(current->group_leader);
Kees Cookb8383832018-04-10 16:34:57 -07001528}
1529EXPORT_SYMBOL(finalize_exec);
1530
David Howellsa6f76f22008-11-14 10:39:24 +11001531/*
Oleg Nesterova2a84742009-09-05 11:17:13 -07001532 * Prepare credentials and lock ->cred_guard_mutex.
Eric W. Biederman96ecee22020-05-03 06:48:17 -05001533 * setup_new_exec() commits the new creds and drops the lock.
Randy Dunlap3d742d42021-02-24 12:00:48 -08001534 * Or, if exec fails before, free_bprm() should release ->cred
Oleg Nesterova2a84742009-09-05 11:17:13 -07001535 * and unlock.
1536 */
Chanho Min4addd262018-12-10 16:49:54 +09001537static int prepare_bprm_creds(struct linux_binprm *bprm)
Oleg Nesterova2a84742009-09-05 11:17:13 -07001538{
KOSAKI Motohiro9b1bf122010-10-27 15:34:08 -07001539 if (mutex_lock_interruptible(&current->signal->cred_guard_mutex))
Oleg Nesterova2a84742009-09-05 11:17:13 -07001540 return -ERESTARTNOINTR;
1541
1542 bprm->cred = prepare_exec_creds();
1543 if (likely(bprm->cred))
1544 return 0;
1545
KOSAKI Motohiro9b1bf122010-10-27 15:34:08 -07001546 mutex_unlock(&current->signal->cred_guard_mutex);
Oleg Nesterova2a84742009-09-05 11:17:13 -07001547 return -ENOMEM;
1548}
1549
Kees Cookbdd8f622022-09-16 17:11:18 -07001550/* Matches do_open_execat() */
1551static void do_close_execat(struct file *file)
1552{
Christian Brauner2a010c42024-05-31 15:01:43 +02001553 if (file)
1554 fput(file);
Kees Cookbdd8f622022-09-16 17:11:18 -07001555}
1556
Linus Torvaldsc4ad8f92014-02-05 12:54:53 -08001557static void free_bprm(struct linux_binprm *bprm)
Oleg Nesterova2a84742009-09-05 11:17:13 -07001558{
Eric W. Biedermanf18ac552020-07-10 15:54:54 -05001559 if (bprm->mm) {
1560 acct_arg_size(bprm, 0);
1561 mmput(bprm->mm);
1562 }
Oleg Nesterova2a84742009-09-05 11:17:13 -07001563 free_arg_pages(bprm);
1564 if (bprm->cred) {
KOSAKI Motohiro9b1bf122010-10-27 15:34:08 -07001565 mutex_unlock(&current->signal->cred_guard_mutex);
Oleg Nesterova2a84742009-09-05 11:17:13 -07001566 abort_creds(bprm->cred);
1567 }
Kees Cookbdd8f622022-09-16 17:11:18 -07001568 do_close_execat(bprm->file);
Eric W. Biedermanb8a61c92020-05-14 15:17:40 -05001569 if (bprm->executable)
1570 fput(bprm->executable);
Kees Cookb66c5982012-12-20 15:05:16 -08001571 /* If a binfmt changed the interp, free it. */
1572 if (bprm->interp != bprm->filename)
1573 kfree(bprm->interp);
Eric W. Biederman60d9ad12020-07-11 08:16:15 -05001574 kfree(bprm->fdpath);
Oleg Nesterova2a84742009-09-05 11:17:13 -07001575 kfree(bprm);
1576}
1577
Linus Torvalds978ffcb2024-01-08 16:43:04 -08001578static struct linux_binprm *alloc_bprm(int fd, struct filename *filename, int flags)
Eric W. Biederman0a8f36e2020-07-10 15:39:45 -05001579{
Linus Torvalds978ffcb2024-01-08 16:43:04 -08001580 struct linux_binprm *bprm;
1581 struct file *file;
Eric W. Biederman60d9ad12020-07-11 08:16:15 -05001582 int retval = -ENOMEM;
Linus Torvalds978ffcb2024-01-08 16:43:04 -08001583
1584 file = do_open_execat(fd, filename, flags);
1585 if (IS_ERR(file))
1586 return ERR_CAST(file);
1587
1588 bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
1589 if (!bprm) {
Kees Cookbdd8f622022-09-16 17:11:18 -07001590 do_close_execat(file);
Linus Torvalds978ffcb2024-01-08 16:43:04 -08001591 return ERR_PTR(-ENOMEM);
1592 }
1593
1594 bprm->file = file;
Eric W. Biederman60d9ad12020-07-11 08:16:15 -05001595
1596 if (fd == AT_FDCWD || filename->name[0] == '/') {
1597 bprm->filename = filename->name;
1598 } else {
1599 if (filename->name[0] == '\0')
1600 bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd);
1601 else
1602 bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s",
1603 fd, filename->name);
1604 if (!bprm->fdpath)
1605 goto out_free;
1606
Linus Torvalds978ffcb2024-01-08 16:43:04 -08001607 /*
1608 * Record that a name derived from an O_CLOEXEC fd will be
1609 * inaccessible after exec. This allows the code in exec to
1610 * choose to fail when the executable is not mmaped into the
1611 * interpreter and an open file descriptor is not passed to
1612 * the interpreter. This makes for a better user experience
1613 * than having the interpreter start and then immediately fail
1614 * when it finds the executable is inaccessible.
1615 */
1616 if (get_close_on_exec(fd))
1617 bprm->interp_flags |= BINPRM_FLAGS_PATH_INACCESSIBLE;
1618
Eric W. Biederman60d9ad12020-07-11 08:16:15 -05001619 bprm->filename = bprm->fdpath;
1620 }
1621 bprm->interp = bprm->filename;
Eric W. Biedermanf18ac552020-07-10 15:54:54 -05001622
1623 retval = bprm_mm_init(bprm);
Linus Torvalds978ffcb2024-01-08 16:43:04 -08001624 if (!retval)
1625 return bprm;
Eric W. Biederman60d9ad12020-07-11 08:16:15 -05001626
1627out_free:
1628 free_bprm(bprm);
Eric W. Biederman60d9ad12020-07-11 08:16:15 -05001629 return ERR_PTR(retval);
Eric W. Biederman0a8f36e2020-07-10 15:39:45 -05001630}
1631
Oleg Nesterovc2315c12017-10-03 16:15:42 -07001632int bprm_change_interp(const char *interp, struct linux_binprm *bprm)
Kees Cookb66c5982012-12-20 15:05:16 -08001633{
1634 /* If a binfmt changed the interp, free it first. */
1635 if (bprm->interp != bprm->filename)
1636 kfree(bprm->interp);
1637 bprm->interp = kstrdup(interp, GFP_KERNEL);
1638 if (!bprm->interp)
1639 return -ENOMEM;
1640 return 0;
1641}
1642EXPORT_SYMBOL(bprm_change_interp);
1643
Oleg Nesterova2a84742009-09-05 11:17:13 -07001644/*
David Howellsa6f76f22008-11-14 10:39:24 +11001645 * determine how safe it is to execute the proposed program
KOSAKI Motohiro9b1bf122010-10-27 15:34:08 -07001646 * - the caller must hold ->cred_guard_mutex to protect against
Kees Cookc2e1f2e2014-06-05 00:23:17 -07001647 * PTRACE_ATTACH or seccomp thread-sync
David Howellsa6f76f22008-11-14 10:39:24 +11001648 */
Oleg Nesterov9e00cdb2014-01-23 15:55:50 -08001649static void check_unsafe_exec(struct linux_binprm *bprm)
David Howellsa6f76f22008-11-14 10:39:24 +11001650{
David Howells0bf2f3a2009-02-06 11:45:46 +00001651 struct task_struct *p = current, *t;
Al Virof1191b52009-03-30 07:35:18 -04001652 unsigned n_fs;
David Howellsa6f76f22008-11-14 10:39:24 +11001653
Eric W. Biederman9227dd22017-01-23 17:26:31 +13001654 if (p->ptrace)
1655 bprm->unsafe |= LSM_UNSAFE_PTRACE;
David Howellsa6f76f22008-11-14 10:39:24 +11001656
Andy Lutomirski259e5e62012-04-12 16:47:50 -05001657 /*
1658 * This isn't strictly necessary, but it makes it harder for LSMs to
1659 * mess up.
1660 */
Kees Cook1d4457f2014-05-21 15:23:46 -07001661 if (task_no_new_privs(current))
Andy Lutomirski259e5e62012-04-12 16:47:50 -05001662 bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;
1663
Kees Cook275498a2022-10-18 00:17:24 -07001664 /*
1665 * If another task is sharing our fs, we cannot safely
1666 * suid exec because the differently privileged task
1667 * will be able to manipulate the current directory, etc.
1668 * It would be nice to force an unshare instead...
1669 */
David Howells0bf2f3a2009-02-06 11:45:46 +00001670 n_fs = 1;
Nick Piggin2a4419b2010-08-18 04:37:33 +10001671 spin_lock(&p->fs->lock);
Oleg Nesterov437f7fd2009-04-24 01:02:45 +02001672 rcu_read_lock();
Oleg Nesterov61a7a5e2023-10-30 16:57:10 +01001673 for_other_threads(p, t) {
David Howells0bf2f3a2009-02-06 11:45:46 +00001674 if (t->fs == p->fs)
1675 n_fs++;
David Howells0bf2f3a2009-02-06 11:45:46 +00001676 }
Oleg Nesterov437f7fd2009-04-24 01:02:45 +02001677 rcu_read_unlock();
David Howells0bf2f3a2009-02-06 11:45:46 +00001678
Kees Cook90383cc2024-01-24 11:15:33 -08001679 /* "users" and "in_exec" locked for copy_fs() */
Oleg Nesterov9e00cdb2014-01-23 15:55:50 -08001680 if (p->fs->users > n_fs)
David Howellsa6f76f22008-11-14 10:39:24 +11001681 bprm->unsafe |= LSM_UNSAFE_SHARE;
Oleg Nesterov9e00cdb2014-01-23 15:55:50 -08001682 else
1683 p->fs->in_exec = 1;
Nick Piggin2a4419b2010-08-18 04:37:33 +10001684 spin_unlock(&p->fs->lock);
David Howellsa6f76f22008-11-14 10:39:24 +11001685}
1686
Eric W. Biederman56305aa2020-05-29 22:00:54 -05001687static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file)
Jann Horn8b01fc82015-04-19 02:48:39 +02001688{
Eric W. Biederman56305aa2020-05-29 22:00:54 -05001689 /* Handle suid and sgid on files */
Christian Braunere67fe632023-01-13 12:49:30 +01001690 struct mnt_idmap *idmap;
Al Viroe6ae4382022-08-20 11:46:10 -04001691 struct inode *inode = file_inode(file);
Jann Horn8b01fc82015-04-19 02:48:39 +02001692 unsigned int mode;
Christian Braunera2bd0962022-06-22 22:12:16 +02001693 vfsuid_t vfsuid;
1694 vfsgid_t vfsgid;
Kees Cookf50733b2024-08-08 11:39:08 -07001695 int err;
Jann Horn8b01fc82015-04-19 02:48:39 +02001696
Eric W. Biederman56305aa2020-05-29 22:00:54 -05001697 if (!mnt_may_suid(file->f_path.mnt))
Jann Horn8b01fc82015-04-19 02:48:39 +02001698 return;
1699
1700 if (task_no_new_privs(current))
1701 return;
1702
Jann Horn8b01fc82015-04-19 02:48:39 +02001703 mode = READ_ONCE(inode->i_mode);
1704 if (!(mode & (S_ISUID|S_ISGID)))
1705 return;
1706
Christian Braunere67fe632023-01-13 12:49:30 +01001707 idmap = file_mnt_idmap(file);
Christian Brauner1ab29962021-01-21 14:19:42 +01001708
Jann Horn8b01fc82015-04-19 02:48:39 +02001709 /* Be careful if suid/sgid is set */
Al Viro59551022016-01-22 15:40:57 -05001710 inode_lock(inode);
Jann Horn8b01fc82015-04-19 02:48:39 +02001711
Kees Cookf50733b2024-08-08 11:39:08 -07001712 /* Atomically reload and check mode/uid/gid now that lock held. */
Jann Horn8b01fc82015-04-19 02:48:39 +02001713 mode = inode->i_mode;
Christian Braunere67fe632023-01-13 12:49:30 +01001714 vfsuid = i_uid_into_vfsuid(idmap, inode);
1715 vfsgid = i_gid_into_vfsgid(idmap, inode);
Kees Cookf50733b2024-08-08 11:39:08 -07001716 err = inode_permission(idmap, inode, MAY_EXEC);
Al Viro59551022016-01-22 15:40:57 -05001717 inode_unlock(inode);
Jann Horn8b01fc82015-04-19 02:48:39 +02001718
Kees Cookf50733b2024-08-08 11:39:08 -07001719 /* Did the exec bit vanish out from under us? Give up. */
1720 if (err)
1721 return;
1722
Jann Horn8b01fc82015-04-19 02:48:39 +02001723 /* We ignore suid/sgid if there are no mappings for them in the ns */
Christian Braunera2bd0962022-06-22 22:12:16 +02001724 if (!vfsuid_has_mapping(bprm->cred->user_ns, vfsuid) ||
1725 !vfsgid_has_mapping(bprm->cred->user_ns, vfsgid))
Jann Horn8b01fc82015-04-19 02:48:39 +02001726 return;
1727
1728 if (mode & S_ISUID) {
1729 bprm->per_clear |= PER_CLEAR_ON_SETID;
Christian Braunera2bd0962022-06-22 22:12:16 +02001730 bprm->cred->euid = vfsuid_into_kuid(vfsuid);
Jann Horn8b01fc82015-04-19 02:48:39 +02001731 }
1732
1733 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
1734 bprm->per_clear |= PER_CLEAR_ON_SETID;
Christian Braunera2bd0962022-06-22 22:12:16 +02001735 bprm->cred->egid = vfsgid_into_kgid(vfsgid);
Jann Horn8b01fc82015-04-19 02:48:39 +02001736 }
1737}
1738
Oleg Nesterov9e00cdb2014-01-23 15:55:50 -08001739/*
Eric W. Biederman56305aa2020-05-29 22:00:54 -05001740 * Compute brpm->cred based upon the final binary.
1741 */
1742static int bprm_creds_from_file(struct linux_binprm *bprm)
1743{
1744 /* Compute creds based on which file? */
1745 struct file *file = bprm->execfd_creds ? bprm->executable : bprm->file;
1746
1747 bprm_fill_uid(bprm, file);
1748 return security_bprm_creds_from_file(bprm, file);
1749}
1750
1751/*
Oleg Nesterov9e00cdb2014-01-23 15:55:50 -08001752 * Fill the binprm structure from the inode.
Eric W. Biederman56305aa2020-05-29 22:00:54 -05001753 * Read the first BINPRM_BUF_SIZE bytes
David Howellsa6f76f22008-11-14 10:39:24 +11001754 *
1755 * This may be called multiple times for binary chains (scripts for example).
Linus Torvalds1da177e2005-04-16 15:20:36 -07001756 */
Eric W. Biederman8b72ca92020-05-13 22:25:20 -05001757static int prepare_binprm(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001758{
Christoph Hellwigbdd1d2d2017-09-01 17:39:13 +02001759 loff_t pos = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001760
David Howellsa6f76f22008-11-14 10:39:24 +11001761 memset(bprm->buf, 0, BINPRM_BUF_SIZE);
Christoph Hellwigbdd1d2d2017-09-01 17:39:13 +02001762 return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001763}
1764
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001765/*
1766 * Arguments are '\0' separated strings found at the location bprm->p
1767 * points to; chop off the first by relocating brpm->p to right after
1768 * the first '\0' encountered.
1769 */
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001770int remove_arg_zero(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001771{
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001772 unsigned long offset;
1773 char *kaddr;
1774 struct page *page;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001775
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001776 if (!bprm->argc)
1777 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001778
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001779 do {
1780 offset = bprm->p & ~PAGE_MASK;
1781 page = get_arg_page(bprm, bprm->p, 0);
Kees Cook725d5022024-03-09 13:46:30 -08001782 if (!page)
1783 return -EFAULT;
Fabio M. De Francesco3a608cf2022-08-03 20:28:56 +02001784 kaddr = kmap_local_page(page);
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001785
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001786 for (; offset < PAGE_SIZE && kaddr[offset];
1787 offset++, bprm->p++)
1788 ;
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001789
Fabio M. De Francesco3a608cf2022-08-03 20:28:56 +02001790 kunmap_local(kaddr);
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001791 put_arg_page(page);
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001792 } while (offset == PAGE_SIZE);
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001793
Ollie Wildb6a2fea2007-07-19 01:48:16 -07001794 bprm->p++;
1795 bprm->argc--;
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001796
Kees Cook725d5022024-03-09 13:46:30 -08001797 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001798}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001799EXPORT_SYMBOL(remove_arg_zero);
1800
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001801#define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001802/*
1803 * cycle the list of binary formats handler, until one recognizes the image
1804 */
Eric W. Biedermanbc2bf332020-05-18 18:43:20 -05001805static int search_binary_handler(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001806{
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001807 bool need_retry = IS_ENABLED(CONFIG_MODULES);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001808 struct linux_binfmt *fmt;
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001809 int retval;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001810
Eric W. Biederman8b72ca92020-05-13 22:25:20 -05001811 retval = prepare_binprm(bprm);
1812 if (retval < 0)
1813 return retval;
Kees Cookd7402692012-12-17 16:03:20 -08001814
Linus Torvalds1da177e2005-04-16 15:20:36 -07001815 retval = security_bprm_check(bprm);
1816 if (retval)
1817 return retval;
1818
Linus Torvalds1da177e2005-04-16 15:20:36 -07001819 retval = -ENOENT;
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001820 retry:
1821 read_lock(&binfmt_lock);
1822 list_for_each_entry(fmt, &formats, lh) {
1823 if (!try_module_get(fmt->module))
1824 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001825 read_unlock(&binfmt_lock);
Alexey Dobriyand53ddd02019-05-14 15:44:37 -07001826
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001827 retval = fmt->load_binary(bprm);
Alexey Dobriyand53ddd02019-05-14 15:44:37 -07001828
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001829 read_lock(&binfmt_lock);
1830 put_binfmt(fmt);
Eric W. Biedermanbc2bf332020-05-18 18:43:20 -05001831 if (bprm->point_of_no_return || (retval != -ENOEXEC)) {
Al Viro19d860a2014-05-04 20:11:36 -04001832 read_unlock(&binfmt_lock);
1833 return retval;
1834 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001835 }
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001836 read_unlock(&binfmt_lock);
1837
Al Viro19d860a2014-05-04 20:11:36 -04001838 if (need_retry) {
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001839 if (printable(bprm->buf[0]) && printable(bprm->buf[1]) &&
1840 printable(bprm->buf[2]) && printable(bprm->buf[3]))
1841 return retval;
Oleg Nesterov4e0621a2013-09-11 14:24:45 -07001842 if (request_module("binfmt-%04x", *(ushort *)(bprm->buf + 2)) < 0)
1843 return retval;
Oleg Nesterovcb7b6b12013-09-11 14:24:44 -07001844 need_retry = false;
1845 goto retry;
1846 }
1847
Linus Torvalds1da177e2005-04-16 15:20:36 -07001848 return retval;
1849}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001850
Kees Cook275498a2022-10-18 00:17:24 -07001851/* binfmt handlers will call back into begin_new_exec() on success. */
Oleg Nesterov5d1baf32013-09-11 14:24:38 -07001852static int exec_binprm(struct linux_binprm *bprm)
1853{
1854 pid_t old_pid, old_vpid;
Eric W. Biedermanbc2bf332020-05-18 18:43:20 -05001855 int ret, depth;
Oleg Nesterov5d1baf32013-09-11 14:24:38 -07001856
1857 /* Need to fetch pid before load_binary changes it */
1858 old_pid = current->pid;
1859 rcu_read_lock();
1860 old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
1861 rcu_read_unlock();
1862
Eric W. Biedermanbc2bf332020-05-18 18:43:20 -05001863 /* This allows 4 levels of binfmt rewrites before failing hard. */
1864 for (depth = 0;; depth++) {
1865 struct file *exec;
1866 if (depth > 5)
1867 return -ELOOP;
1868
1869 ret = search_binary_handler(bprm);
1870 if (ret < 0)
1871 return ret;
1872 if (!bprm->interpreter)
1873 break;
1874
1875 exec = bprm->file;
1876 bprm->file = bprm->interpreter;
1877 bprm->interpreter = NULL;
1878
Eric W. Biedermanbc2bf332020-05-18 18:43:20 -05001879 if (unlikely(bprm->have_execfd)) {
1880 if (bprm->executable) {
1881 fput(exec);
1882 return -ENOEXEC;
1883 }
1884 bprm->executable = exec;
1885 } else
1886 fput(exec);
Oleg Nesterov5d1baf32013-09-11 14:24:38 -07001887 }
1888
Eric W. Biedermanbc2bf332020-05-18 18:43:20 -05001889 audit_bprm(bprm);
1890 trace_sched_process_exec(current, old_pid, bprm);
1891 ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
1892 proc_exec_connector(current);
1893 return 0;
Oleg Nesterov5d1baf32013-09-11 14:24:38 -07001894}
1895
Linus Torvalds978ffcb2024-01-08 16:43:04 -08001896static int bprm_execve(struct linux_binprm *bprm)
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001897{
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001898 int retval;
1899
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001900 retval = prepare_bprm_creds(bprm);
1901 if (retval)
Eric W. Biedermanb6043502020-11-20 17:14:18 -06001902 return retval;
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001903
Kees Cook275498a2022-10-18 00:17:24 -07001904 /*
1905 * Check for unsafe execution states before exec_binprm(), which
1906 * will call back into begin_new_exec(), into bprm_creds_from_file(),
1907 * where setuid-ness is evaluated.
1908 */
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001909 check_unsafe_exec(bprm);
1910 current->in_execve = 1;
Mathieu Desnoyersaf7f5882022-11-22 15:39:09 -05001911 sched_mm_cid_before_execve(current);
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001912
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001913 sched_exec();
1914
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001915 /* Set the unchanging part of bprm->cred */
1916 retval = security_bprm_creds_for_exec(bprm);
1917 if (retval)
1918 goto out;
1919
1920 retval = exec_binprm(bprm);
1921 if (retval < 0)
1922 goto out;
1923
Mathieu Desnoyersaf7f5882022-11-22 15:39:09 -05001924 sched_mm_cid_after_execve(current);
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001925 /* execve succeeded */
1926 current->fs->in_exec = 0;
1927 current->in_execve = 0;
1928 rseq_execve(current);
Beau Belgravefd593512023-03-28 16:52:09 -07001929 user_events_execve(current);
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001930 acct_update_integrals(current);
1931 task_numa_free(current, false);
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001932 return retval;
1933
1934out:
1935 /*
Randy Dunlap3d742d42021-02-24 12:00:48 -08001936 * If past the point of no return ensure the code never
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001937 * returns to the userspace process. Use an existing fatal
1938 * signal if present otherwise terminate the process with
1939 * SIGSEGV.
1940 */
1941 if (bprm->point_of_no_return && !fatal_signal_pending(current))
Eric W. Biedermane21294a2021-10-25 10:50:57 -05001942 force_fatal_sig(SIGSEGV);
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001943
Mathieu Desnoyersaf7f5882022-11-22 15:39:09 -05001944 sched_mm_cid_after_execve(current);
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001945 current->fs->in_exec = 0;
1946 current->in_execve = 0;
1947
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001948 return retval;
1949}
1950
Eric W. Biederman25cf3362020-06-25 13:56:40 -05001951static int do_execveat_common(int fd, struct filename *filename,
1952 struct user_arg_ptr argv,
1953 struct user_arg_ptr envp,
1954 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001955{
1956 struct linux_binprm *bprm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001957 int retval;
Vasiliy Kulikov72fa5992011-08-08 19:02:04 +04001958
Linus Torvaldsc4ad8f92014-02-05 12:54:53 -08001959 if (IS_ERR(filename))
1960 return PTR_ERR(filename);
1961
Vasiliy Kulikov72fa5992011-08-08 19:02:04 +04001962 /*
1963 * We move the actual failure in case of RLIMIT_NPROC excess from
1964 * set*uid() to execve() because too many poorly written programs
1965 * don't check setuid() return code. Here we additionally recheck
1966 * whether NPROC limit is still exceeded.
1967 */
1968 if ((current->flags & PF_NPROC_EXCEEDED) &&
Alexey Gladkovde399232022-05-18 19:17:30 +02001969 is_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
Vasiliy Kulikov72fa5992011-08-08 19:02:04 +04001970 retval = -EAGAIN;
1971 goto out_ret;
1972 }
1973
1974 /* We're below the limit (still or again), so we don't want to make
1975 * further execve() calls fail. */
1976 current->flags &= ~PF_NPROC_EXCEEDED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001977
Linus Torvalds978ffcb2024-01-08 16:43:04 -08001978 bprm = alloc_bprm(fd, filename, flags);
Eric W. Biederman0a8f36e2020-07-10 15:39:45 -05001979 if (IS_ERR(bprm)) {
1980 retval = PTR_ERR(bprm);
1981 goto out_ret;
1982 }
1983
Eric W. Biedermand8b9cd52020-07-12 08:23:54 -05001984 retval = count(argv, MAX_ARG_STRINGS);
Kees Cookdcd46d82022-01-31 16:09:47 -08001985 if (retval == 0)
1986 pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",
1987 current->comm, bprm->filename);
Eric W. Biedermand8b9cd52020-07-12 08:23:54 -05001988 if (retval < 0)
1989 goto out_free;
1990 bprm->argc = retval;
1991
1992 retval = count(envp, MAX_ARG_STRINGS);
1993 if (retval < 0)
1994 goto out_free;
1995 bprm->envc = retval;
1996
1997 retval = bprm_stack_limits(bprm);
Oleg Nesterov655c16a2019-01-03 15:28:11 -08001998 if (retval < 0)
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05001999 goto out_free;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002000
Christoph Hellwig986db2d2020-06-04 16:51:14 -07002001 retval = copy_string_kernel(bprm->filename, bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002002 if (retval < 0)
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05002003 goto out_free;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002004 bprm->exec = bprm->p;
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05002005
Linus Torvalds1da177e2005-04-16 15:20:36 -07002006 retval = copy_strings(bprm->envc, envp, bprm);
2007 if (retval < 0)
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05002008 goto out_free;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002009
2010 retval = copy_strings(bprm->argc, argv, bprm);
2011 if (retval < 0)
Eric W. Biederman0c9cdff2020-07-12 07:17:50 -05002012 goto out_free;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002013
Kees Cookdcd46d82022-01-31 16:09:47 -08002014 /*
2015 * When argv is empty, add an empty string ("") as argv[0] to
2016 * ensure confused userspace programs that start processing
2017 * from argv[1] won't end up walking envp. See also
2018 * bprm_stack_limits().
2019 */
2020 if (bprm->argc == 0) {
2021 retval = copy_string_kernel("", bprm);
2022 if (retval < 0)
2023 goto out_free;
2024 bprm->argc = 1;
2025 }
2026
Linus Torvalds978ffcb2024-01-08 16:43:04 -08002027 retval = bprm_execve(bprm);
David Howellsa6f76f22008-11-14 10:39:24 +11002028out_free:
Al Viro08a6fac2008-05-10 16:38:25 -04002029 free_bprm(bprm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002030
2031out_ret:
Eric W. Biederman25cf3362020-06-25 13:56:40 -05002032 putname(filename);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002033 return retval;
2034}
2035
Eric W. Biedermanbe619f72020-07-13 12:06:48 -05002036int kernel_execve(const char *kernel_filename,
2037 const char *const *argv, const char *const *envp)
2038{
2039 struct filename *filename;
2040 struct linux_binprm *bprm;
2041 int fd = AT_FDCWD;
2042 int retval;
2043
Eric W. Biederman1b2552c2022-04-11 14:15:54 -05002044 /* It is non-sense for kernel threads to call execve */
2045 if (WARN_ON_ONCE(current->flags & PF_KTHREAD))
Eric W. Biederman343f4c42022-04-11 11:40:14 -05002046 return -EINVAL;
2047
Eric W. Biedermanbe619f72020-07-13 12:06:48 -05002048 filename = getname_kernel(kernel_filename);
2049 if (IS_ERR(filename))
2050 return PTR_ERR(filename);
2051
Linus Torvalds978ffcb2024-01-08 16:43:04 -08002052 bprm = alloc_bprm(fd, filename, 0);
Eric W. Biedermanbe619f72020-07-13 12:06:48 -05002053 if (IS_ERR(bprm)) {
2054 retval = PTR_ERR(bprm);
2055 goto out_ret;
2056 }
2057
2058 retval = count_strings_kernel(argv);
Kees Cookdcd46d82022-01-31 16:09:47 -08002059 if (WARN_ON_ONCE(retval == 0))
2060 retval = -EINVAL;
Eric W. Biedermanbe619f72020-07-13 12:06:48 -05002061 if (retval < 0)
2062 goto out_free;
2063 bprm->argc = retval;
2064
2065 retval = count_strings_kernel(envp);
2066 if (retval < 0)
2067 goto out_free;
2068 bprm->envc = retval;
2069
2070 retval = bprm_stack_limits(bprm);
2071 if (retval < 0)
2072 goto out_free;
2073
2074 retval = copy_string_kernel(bprm->filename, bprm);
2075 if (retval < 0)
2076 goto out_free;
2077 bprm->exec = bprm->p;
2078
2079 retval = copy_strings_kernel(bprm->envc, envp, bprm);
2080 if (retval < 0)
2081 goto out_free;
2082
2083 retval = copy_strings_kernel(bprm->argc, argv, bprm);
2084 if (retval < 0)
2085 goto out_free;
2086
Linus Torvalds978ffcb2024-01-08 16:43:04 -08002087 retval = bprm_execve(bprm);
Eric W. Biedermanbe619f72020-07-13 12:06:48 -05002088out_free:
2089 free_bprm(bprm);
2090out_ret:
2091 putname(filename);
2092 return retval;
2093}
2094
2095static int do_execve(struct filename *filename,
Oleg Nesterovba2d01622011-03-06 18:02:37 +01002096 const char __user *const __user *__argv,
Al Viroda3d4c52012-10-20 21:49:33 -04002097 const char __user *const __user *__envp)
Oleg Nesterovba2d01622011-03-06 18:02:37 +01002098{
Oleg Nesterov0e028462011-03-06 18:02:54 +01002099 struct user_arg_ptr argv = { .ptr.native = __argv };
2100 struct user_arg_ptr envp = { .ptr.native = __envp };
David Drysdale51f39a12014-12-12 16:57:29 -08002101 return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
2102}
2103
Eric W. Biedermanbe619f72020-07-13 12:06:48 -05002104static int do_execveat(int fd, struct filename *filename,
David Drysdale51f39a12014-12-12 16:57:29 -08002105 const char __user *const __user *__argv,
2106 const char __user *const __user *__envp,
2107 int flags)
2108{
2109 struct user_arg_ptr argv = { .ptr.native = __argv };
2110 struct user_arg_ptr envp = { .ptr.native = __envp };
2111
2112 return do_execveat_common(fd, filename, argv, envp, flags);
Oleg Nesterovba2d01622011-03-06 18:02:37 +01002113}
2114
Oleg Nesterov0e028462011-03-06 18:02:54 +01002115#ifdef CONFIG_COMPAT
Linus Torvaldsc4ad8f92014-02-05 12:54:53 -08002116static int compat_do_execve(struct filename *filename,
Al Viro38b983b2012-09-30 13:38:55 -04002117 const compat_uptr_t __user *__argv,
Al Virod03d26e2012-10-20 21:46:25 -04002118 const compat_uptr_t __user *__envp)
Oleg Nesterov0e028462011-03-06 18:02:54 +01002119{
2120 struct user_arg_ptr argv = {
2121 .is_compat = true,
2122 .ptr.compat = __argv,
2123 };
2124 struct user_arg_ptr envp = {
2125 .is_compat = true,
2126 .ptr.compat = __envp,
2127 };
David Drysdale51f39a12014-12-12 16:57:29 -08002128 return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
2129}
2130
2131static int compat_do_execveat(int fd, struct filename *filename,
2132 const compat_uptr_t __user *__argv,
2133 const compat_uptr_t __user *__envp,
2134 int flags)
2135{
2136 struct user_arg_ptr argv = {
2137 .is_compat = true,
2138 .ptr.compat = __argv,
2139 };
2140 struct user_arg_ptr envp = {
2141 .is_compat = true,
2142 .ptr.compat = __envp,
2143 };
2144 return do_execveat_common(fd, filename, argv, envp, flags);
Oleg Nesterov0e028462011-03-06 18:02:54 +01002145}
2146#endif
2147
Oleg Nesterov964ee7d2009-09-23 15:56:59 -07002148void set_binfmt(struct linux_binfmt *new)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002149{
Hiroshi Shimamoto801460d2009-09-23 15:57:41 -07002150 struct mm_struct *mm = current->mm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002151
Hiroshi Shimamoto801460d2009-09-23 15:57:41 -07002152 if (mm->binfmt)
2153 module_put(mm->binfmt->module);
2154
2155 mm->binfmt = new;
Oleg Nesterov964ee7d2009-09-23 15:56:59 -07002156 if (new)
2157 __module_get(new->module);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002158}
Linus Torvalds1da177e2005-04-16 15:20:36 -07002159EXPORT_SYMBOL(set_binfmt);
2160
Kawai, Hidehiro6c5d5232007-07-19 01:48:27 -07002161/*
Oleg Nesterov7288e112014-01-23 15:55:32 -08002162 * set_dumpable stores three-value SUID_DUMP_* into mm->flags.
Kawai, Hidehiro6c5d5232007-07-19 01:48:27 -07002163 */
2164void set_dumpable(struct mm_struct *mm, int value)
2165{
Oleg Nesterov7288e112014-01-23 15:55:32 -08002166 if (WARN_ON((unsigned)value > SUID_DUMP_ROOT))
2167 return;
2168
Vineet Gupta26e15222019-03-07 16:29:23 -08002169 set_mask_bits(&mm->flags, MMF_DUMPABLE_MASK, value);
Kawai, Hidehiro6c5d5232007-07-19 01:48:27 -07002170}
Kawai, Hidehiro6c5d5232007-07-19 01:48:27 -07002171
Al Viro38b983b2012-09-30 13:38:55 -04002172SYSCALL_DEFINE3(execve,
2173 const char __user *, filename,
2174 const char __user *const __user *, argv,
2175 const char __user *const __user *, envp)
2176{
Linus Torvaldsc4ad8f92014-02-05 12:54:53 -08002177 return do_execve(getname(filename), argv, envp);
Al Viro38b983b2012-09-30 13:38:55 -04002178}
David Drysdale51f39a12014-12-12 16:57:29 -08002179
2180SYSCALL_DEFINE5(execveat,
2181 int, fd, const char __user *, filename,
2182 const char __user *const __user *, argv,
2183 const char __user *const __user *, envp,
2184 int, flags)
2185{
David Drysdale51f39a12014-12-12 16:57:29 -08002186 return do_execveat(fd,
Dmitry Kadashev8228e2c2021-07-08 13:34:42 +07002187 getname_uflags(filename, flags),
David Drysdale51f39a12014-12-12 16:57:29 -08002188 argv, envp, flags);
2189}
2190
Al Viro38b983b2012-09-30 13:38:55 -04002191#ifdef CONFIG_COMPAT
Heiko Carstens625b1d72014-03-04 10:53:50 +01002192COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename,
2193 const compat_uptr_t __user *, argv,
2194 const compat_uptr_t __user *, envp)
Al Viro38b983b2012-09-30 13:38:55 -04002195{
Linus Torvaldsc4ad8f92014-02-05 12:54:53 -08002196 return compat_do_execve(getname(filename), argv, envp);
Al Viro38b983b2012-09-30 13:38:55 -04002197}
David Drysdale51f39a12014-12-12 16:57:29 -08002198
2199COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
2200 const char __user *, filename,
2201 const compat_uptr_t __user *, argv,
2202 const compat_uptr_t __user *, envp,
2203 int, flags)
2204{
David Drysdale51f39a12014-12-12 16:57:29 -08002205 return compat_do_execveat(fd,
Dmitry Kadashev8228e2c2021-07-08 13:34:42 +07002206 getname_uflags(filename, flags),
David Drysdale51f39a12014-12-12 16:57:29 -08002207 argv, envp, flags);
2208}
Al Viro38b983b2012-09-30 13:38:55 -04002209#endif
Luis Chamberlain66ad3982022-01-21 22:13:17 -08002210
2211#ifdef CONFIG_SYSCTL
2212
Joel Granados78eb4ea2024-07-24 20:59:29 +02002213static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int write,
Luis Chamberlain66ad3982022-01-21 22:13:17 -08002214 void *buffer, size_t *lenp, loff_t *ppos)
2215{
2216 int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
2217
2218 if (!error)
2219 validate_coredump_safety();
2220 return error;
2221}
2222
2223static struct ctl_table fs_exec_sysctls[] = {
2224 {
2225 .procname = "suid_dumpable",
2226 .data = &suid_dumpable,
2227 .maxlen = sizeof(int),
2228 .mode = 0644,
2229 .proc_handler = proc_dointvec_minmax_coredump,
2230 .extra1 = SYSCTL_ZERO,
2231 .extra2 = SYSCTL_TWO,
2232 },
Luis Chamberlain66ad3982022-01-21 22:13:17 -08002233};
2234
Luis Chamberlain66ad3982022-01-21 22:13:17 -08002235static int __init init_fs_exec_sysctls(void)
2236{
2237 register_sysctl_init("fs", fs_exec_sysctls);
Luis Chamberlain66ad3982022-01-21 22:13:17 -08002238 return 0;
2239}
2240
2241fs_initcall(init_fs_exec_sysctls);
2242#endif /* CONFIG_SYSCTL */
Kees Cook60371f42024-05-19 17:17:59 -07002243
2244#ifdef CONFIG_EXEC_KUNIT_TEST
Kees Cookb6f5ee42024-07-20 10:03:14 -07002245#include "tests/exec_kunit.c"
Kees Cook60371f42024-05-19 17:17:59 -07002246#endif