Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * linux/fs/binfmt_aout.c |
| 3 | * |
| 4 | * Copyright (C) 1991, 1992, 1996 Linus Torvalds |
| 5 | */ |
| 6 | |
| 7 | #include <linux/module.h> |
| 8 | |
| 9 | #include <linux/time.h> |
| 10 | #include <linux/kernel.h> |
| 11 | #include <linux/mm.h> |
| 12 | #include <linux/mman.h> |
| 13 | #include <linux/a.out.h> |
| 14 | #include <linux/errno.h> |
| 15 | #include <linux/signal.h> |
| 16 | #include <linux/string.h> |
| 17 | #include <linux/fs.h> |
| 18 | #include <linux/file.h> |
| 19 | #include <linux/stat.h> |
| 20 | #include <linux/fcntl.h> |
| 21 | #include <linux/ptrace.h> |
| 22 | #include <linux/user.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 23 | #include <linux/binfmts.h> |
| 24 | #include <linux/personality.h> |
| 25 | #include <linux/init.h> |
Daisuke HATAYAMA | 088e7af | 2010-03-05 13:44:06 -0800 | [diff] [blame] | 26 | #include <linux/coredump.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 27 | #include <linux/slab.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 28 | |
| 29 | #include <asm/system.h> |
| 30 | #include <asm/uaccess.h> |
| 31 | #include <asm/cacheflush.h> |
David Howells | 7fa3031 | 2008-02-08 04:19:28 -0800 | [diff] [blame] | 32 | #include <asm/a.out-core.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 33 | |
| 34 | static int load_aout_binary(struct linux_binprm *, struct pt_regs * regs); |
| 35 | static int load_aout_library(struct file*); |
Masami Hiramatsu | f6151df | 2009-12-17 15:27:16 -0800 | [diff] [blame] | 36 | static int aout_core_dump(struct coredump_params *cprm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 37 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 38 | static struct linux_binfmt aout_format = { |
| 39 | .module = THIS_MODULE, |
| 40 | .load_binary = load_aout_binary, |
| 41 | .load_shlib = load_aout_library, |
| 42 | .core_dump = aout_core_dump, |
| 43 | .min_coredump = PAGE_SIZE |
| 44 | }; |
| 45 | |
| 46 | #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) |
| 47 | |
| 48 | static int set_brk(unsigned long start, unsigned long end) |
| 49 | { |
| 50 | start = PAGE_ALIGN(start); |
| 51 | end = PAGE_ALIGN(end); |
| 52 | if (end > start) { |
| 53 | unsigned long addr; |
| 54 | down_write(¤t->mm->mmap_sem); |
| 55 | addr = do_brk(start, end - start); |
| 56 | up_write(¤t->mm->mmap_sem); |
| 57 | if (BAD_ADDR(addr)) |
| 58 | return addr; |
| 59 | } |
| 60 | return 0; |
| 61 | } |
| 62 | |
| 63 | /* |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 64 | * Routine writes a core dump image in the current directory. |
| 65 | * Currently only a stub-function. |
| 66 | * |
| 67 | * Note that setuid/setgid files won't make a core-dump if the uid/gid |
| 68 | * changed due to the set[u|g]id. It's enforced by the "current->mm->dumpable" |
| 69 | * field, which also makes sure the core-dumps won't be recursive if the |
| 70 | * dumping of the process results in another error.. |
| 71 | */ |
| 72 | |
Masami Hiramatsu | f6151df | 2009-12-17 15:27:16 -0800 | [diff] [blame] | 73 | static int aout_core_dump(struct coredump_params *cprm) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 74 | { |
Masami Hiramatsu | f6151df | 2009-12-17 15:27:16 -0800 | [diff] [blame] | 75 | struct file *file = cprm->file; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 76 | mm_segment_t fs; |
| 77 | int has_dumped = 0; |
Borislav Petkov | 7731d9a | 2010-03-23 13:35:15 -0700 | [diff] [blame] | 78 | void __user *dump_start; |
| 79 | int dump_size; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 80 | struct user dump; |
Al Viro | 17580d7 | 2009-01-03 07:16:23 +0000 | [diff] [blame] | 81 | #ifdef __alpha__ |
Borislav Petkov | 7731d9a | 2010-03-23 13:35:15 -0700 | [diff] [blame] | 82 | # define START_DATA(u) ((void __user *)u.start_data) |
Al Viro | 17580d7 | 2009-01-03 07:16:23 +0000 | [diff] [blame] | 83 | #else |
Borislav Petkov | 7731d9a | 2010-03-23 13:35:15 -0700 | [diff] [blame] | 84 | # define START_DATA(u) ((void __user *)((u.u_tsize << PAGE_SHIFT) + \ |
| 85 | u.start_code)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 86 | #endif |
Borislav Petkov | 7731d9a | 2010-03-23 13:35:15 -0700 | [diff] [blame] | 87 | # define START_STACK(u) ((void __user *)u.start_stack) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 88 | |
| 89 | fs = get_fs(); |
| 90 | set_fs(KERNEL_DS); |
| 91 | has_dumped = 1; |
| 92 | current->flags |= PF_DUMPCORE; |
| 93 | strncpy(dump.u_comm, current->comm, sizeof(dump.u_comm)); |
H. Peter Anvin | 6e16d89 | 2008-02-07 00:15:57 -0800 | [diff] [blame] | 94 | dump.u_ar0 = offsetof(struct user, regs); |
Masami Hiramatsu | f6151df | 2009-12-17 15:27:16 -0800 | [diff] [blame] | 95 | dump.signal = cprm->signr; |
| 96 | aout_dump_thread(cprm->regs, &dump); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 97 | |
| 98 | /* If the size of the dump file exceeds the rlimit, then see what would happen |
| 99 | if we wrote the stack, but not the data area. */ |
Masami Hiramatsu | f6151df | 2009-12-17 15:27:16 -0800 | [diff] [blame] | 100 | if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 101 | dump.u_dsize = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 102 | |
| 103 | /* Make sure we have enough room to write the stack and data areas. */ |
Masami Hiramatsu | f6151df | 2009-12-17 15:27:16 -0800 | [diff] [blame] | 104 | if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 105 | dump.u_ssize = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 106 | |
| 107 | /* make sure we actually have a data and stack area to dump */ |
| 108 | set_fs(USER_DS); |
Borislav Petkov | 7731d9a | 2010-03-23 13:35:15 -0700 | [diff] [blame] | 109 | if (!access_ok(VERIFY_READ, START_DATA(dump), dump.u_dsize << PAGE_SHIFT)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 110 | dump.u_dsize = 0; |
Borislav Petkov | 7731d9a | 2010-03-23 13:35:15 -0700 | [diff] [blame] | 111 | if (!access_ok(VERIFY_READ, START_STACK(dump), dump.u_ssize << PAGE_SHIFT)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 112 | dump.u_ssize = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | |
| 114 | set_fs(KERNEL_DS); |
| 115 | /* struct user */ |
Daisuke HATAYAMA | 088e7af | 2010-03-05 13:44:06 -0800 | [diff] [blame] | 116 | if (!dump_write(file, &dump, sizeof(dump))) |
| 117 | goto end_coredump; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 118 | /* Now dump all of the user data. Include malloced stuff as well */ |
Daisuke HATAYAMA | 05f47fd | 2010-03-05 13:44:05 -0800 | [diff] [blame] | 119 | if (!dump_seek(cprm->file, PAGE_SIZE - sizeof(dump))) |
| 120 | goto end_coredump; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 121 | /* now we start writing out the user space info */ |
| 122 | set_fs(USER_DS); |
| 123 | /* Dump the data area */ |
| 124 | if (dump.u_dsize != 0) { |
| 125 | dump_start = START_DATA(dump); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 126 | dump_size = dump.u_dsize << PAGE_SHIFT; |
Daisuke HATAYAMA | 088e7af | 2010-03-05 13:44:06 -0800 | [diff] [blame] | 127 | if (!dump_write(file, dump_start, dump_size)) |
| 128 | goto end_coredump; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 129 | } |
| 130 | /* Now prepare to dump the stack area */ |
| 131 | if (dump.u_ssize != 0) { |
| 132 | dump_start = START_STACK(dump); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 133 | dump_size = dump.u_ssize << PAGE_SHIFT; |
Daisuke HATAYAMA | 088e7af | 2010-03-05 13:44:06 -0800 | [diff] [blame] | 134 | if (!dump_write(file, dump_start, dump_size)) |
| 135 | goto end_coredump; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 136 | } |
| 137 | /* Finally dump the task struct. Not be used by gdb, but could be useful */ |
| 138 | set_fs(KERNEL_DS); |
Daisuke HATAYAMA | 088e7af | 2010-03-05 13:44:06 -0800 | [diff] [blame] | 139 | if (!dump_write(file, current, sizeof(*current))) |
| 140 | goto end_coredump; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 141 | end_coredump: |
| 142 | set_fs(fs); |
| 143 | return has_dumped; |
| 144 | } |
| 145 | |
| 146 | /* |
| 147 | * create_aout_tables() parses the env- and arg-strings in new user |
| 148 | * memory and creates the pointer tables from them, and puts their |
| 149 | * addresses on the "stack", returning the new stack pointer value. |
| 150 | */ |
| 151 | static unsigned long __user *create_aout_tables(char __user *p, struct linux_binprm * bprm) |
| 152 | { |
| 153 | char __user * __user *argv; |
| 154 | char __user * __user *envp; |
| 155 | unsigned long __user *sp; |
| 156 | int argc = bprm->argc; |
| 157 | int envc = bprm->envc; |
| 158 | |
| 159 | sp = (void __user *)((-(unsigned long)sizeof(char *)) & (unsigned long) p); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 160 | #ifdef __alpha__ |
| 161 | /* whee.. test-programs are so much fun. */ |
| 162 | put_user(0, --sp); |
| 163 | put_user(0, --sp); |
| 164 | if (bprm->loader) { |
| 165 | put_user(0, --sp); |
Al Viro | 17580d7 | 2009-01-03 07:16:23 +0000 | [diff] [blame] | 166 | put_user(1003, --sp); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 167 | put_user(bprm->loader, --sp); |
Al Viro | 17580d7 | 2009-01-03 07:16:23 +0000 | [diff] [blame] | 168 | put_user(1002, --sp); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 169 | } |
| 170 | put_user(bprm->exec, --sp); |
Al Viro | 17580d7 | 2009-01-03 07:16:23 +0000 | [diff] [blame] | 171 | put_user(1001, --sp); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 172 | #endif |
| 173 | sp -= envc+1; |
| 174 | envp = (char __user * __user *) sp; |
| 175 | sp -= argc+1; |
| 176 | argv = (char __user * __user *) sp; |
Al Viro | 17580d7 | 2009-01-03 07:16:23 +0000 | [diff] [blame] | 177 | #ifndef __alpha__ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 178 | put_user((unsigned long) envp,--sp); |
| 179 | put_user((unsigned long) argv,--sp); |
| 180 | #endif |
| 181 | put_user(argc,--sp); |
| 182 | current->mm->arg_start = (unsigned long) p; |
| 183 | while (argc-->0) { |
| 184 | char c; |
| 185 | put_user(p,argv++); |
| 186 | do { |
| 187 | get_user(c,p++); |
| 188 | } while (c); |
| 189 | } |
| 190 | put_user(NULL,argv); |
| 191 | current->mm->arg_end = current->mm->env_start = (unsigned long) p; |
| 192 | while (envc-->0) { |
| 193 | char c; |
| 194 | put_user(p,envp++); |
| 195 | do { |
| 196 | get_user(c,p++); |
| 197 | } while (c); |
| 198 | } |
| 199 | put_user(NULL,envp); |
| 200 | current->mm->env_end = (unsigned long) p; |
| 201 | return sp; |
| 202 | } |
| 203 | |
| 204 | /* |
| 205 | * These are the functions used to load a.out style executables and shared |
| 206 | * libraries. There is no binary dependent code anywhere else. |
| 207 | */ |
| 208 | |
| 209 | static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs) |
| 210 | { |
| 211 | struct exec ex; |
| 212 | unsigned long error; |
| 213 | unsigned long fd_offset; |
| 214 | unsigned long rlim; |
| 215 | int retval; |
| 216 | |
| 217 | ex = *((struct exec *) bprm->buf); /* exec-header */ |
| 218 | if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != OMAGIC && |
| 219 | N_MAGIC(ex) != QMAGIC && N_MAGIC(ex) != NMAGIC) || |
| 220 | N_TRSIZE(ex) || N_DRSIZE(ex) || |
Josef "Jeff" Sipek | 0f7fc9e4 | 2006-12-08 02:36:35 -0800 | [diff] [blame] | 221 | i_size_read(bprm->file->f_path.dentry->d_inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 222 | return -ENOEXEC; |
| 223 | } |
| 224 | |
Eugene Teo | 8454aee | 2006-09-29 01:59:33 -0700 | [diff] [blame] | 225 | /* |
| 226 | * Requires a mmap handler. This prevents people from using a.out |
| 227 | * as part of an exploit attack against /proc-related vulnerabilities. |
| 228 | */ |
| 229 | if (!bprm->file->f_op || !bprm->file->f_op->mmap) |
| 230 | return -ENOEXEC; |
| 231 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 232 | fd_offset = N_TXTOFF(ex); |
| 233 | |
| 234 | /* Check initial limits. This avoids letting people circumvent |
| 235 | * size limits imposed on them by creating programs with large |
| 236 | * arrays in the data or bss. |
| 237 | */ |
Jiri Slaby | d554ed89 | 2010-03-05 13:42:42 -0800 | [diff] [blame] | 238 | rlim = rlimit(RLIMIT_DATA); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 239 | if (rlim >= RLIM_INFINITY) |
| 240 | rlim = ~0; |
| 241 | if (ex.a_data + ex.a_bss > rlim) |
| 242 | return -ENOMEM; |
| 243 | |
| 244 | /* Flush all traces of the currently running executable */ |
| 245 | retval = flush_old_exec(bprm); |
| 246 | if (retval) |
| 247 | return retval; |
| 248 | |
| 249 | /* OK, This is the point of no return */ |
Al Viro | 17580d7 | 2009-01-03 07:16:23 +0000 | [diff] [blame] | 250 | #ifdef __alpha__ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 251 | SET_AOUT_PERSONALITY(bprm, ex); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 252 | #else |
| 253 | set_personality(PER_LINUX); |
| 254 | #endif |
Linus Torvalds | 221af7f | 2010-01-28 22:14:42 -0800 | [diff] [blame] | 255 | setup_new_exec(bprm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 256 | |
| 257 | current->mm->end_code = ex.a_text + |
| 258 | (current->mm->start_code = N_TXTADDR(ex)); |
| 259 | current->mm->end_data = ex.a_data + |
| 260 | (current->mm->start_data = N_DATADDR(ex)); |
| 261 | current->mm->brk = ex.a_bss + |
| 262 | (current->mm->start_brk = N_BSSADDR(ex)); |
| 263 | current->mm->free_area_cache = current->mm->mmap_base; |
Wolfgang Wander | 1363c3c | 2005-06-21 17:14:49 -0700 | [diff] [blame] | 264 | current->mm->cached_hole_size = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 265 | |
David Howells | a6f76f2 | 2008-11-14 10:39:24 +1100 | [diff] [blame] | 266 | install_exec_creds(bprm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 267 | current->flags &= ~PF_FORKNOEXEC; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 268 | |
| 269 | if (N_MAGIC(ex) == OMAGIC) { |
| 270 | unsigned long text_addr, map_size; |
| 271 | loff_t pos; |
| 272 | |
| 273 | text_addr = N_TXTADDR(ex); |
| 274 | |
Al Viro | fe30af9 | 2009-01-03 07:16:13 +0000 | [diff] [blame] | 275 | #ifdef __alpha__ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 276 | pos = fd_offset; |
| 277 | map_size = ex.a_text+ex.a_data + PAGE_SIZE - 1; |
| 278 | #else |
| 279 | pos = 32; |
| 280 | map_size = ex.a_text+ex.a_data; |
| 281 | #endif |
| 282 | down_write(¤t->mm->mmap_sem); |
| 283 | error = do_brk(text_addr & PAGE_MASK, map_size); |
| 284 | up_write(¤t->mm->mmap_sem); |
| 285 | if (error != (text_addr & PAGE_MASK)) { |
| 286 | send_sig(SIGKILL, current, 0); |
| 287 | return error; |
| 288 | } |
| 289 | |
| 290 | error = bprm->file->f_op->read(bprm->file, |
| 291 | (char __user *)text_addr, |
| 292 | ex.a_text+ex.a_data, &pos); |
| 293 | if ((signed long)error < 0) { |
| 294 | send_sig(SIGKILL, current, 0); |
| 295 | return error; |
| 296 | } |
| 297 | |
| 298 | flush_icache_range(text_addr, text_addr+ex.a_text+ex.a_data); |
| 299 | } else { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 300 | if ((ex.a_text & 0xfff || ex.a_data & 0xfff) && |
S.Caglar Onur | 2e50b6c | 2008-04-29 00:59:26 -0700 | [diff] [blame] | 301 | (N_MAGIC(ex) != NMAGIC) && printk_ratelimit()) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 302 | { |
| 303 | printk(KERN_NOTICE "executable not page aligned\n"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 304 | } |
| 305 | |
S.Caglar Onur | 2e50b6c | 2008-04-29 00:59:26 -0700 | [diff] [blame] | 306 | if ((fd_offset & ~PAGE_MASK) != 0 && printk_ratelimit()) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 307 | { |
| 308 | printk(KERN_WARNING |
| 309 | "fd_offset is not page aligned. Please convert program: %s\n", |
Josef "Jeff" Sipek | 0f7fc9e4 | 2006-12-08 02:36:35 -0800 | [diff] [blame] | 310 | bprm->file->f_path.dentry->d_name.name); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 311 | } |
| 312 | |
| 313 | if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) { |
| 314 | loff_t pos = fd_offset; |
| 315 | down_write(¤t->mm->mmap_sem); |
| 316 | do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data); |
| 317 | up_write(¤t->mm->mmap_sem); |
| 318 | bprm->file->f_op->read(bprm->file, |
| 319 | (char __user *)N_TXTADDR(ex), |
| 320 | ex.a_text+ex.a_data, &pos); |
| 321 | flush_icache_range((unsigned long) N_TXTADDR(ex), |
| 322 | (unsigned long) N_TXTADDR(ex) + |
| 323 | ex.a_text+ex.a_data); |
| 324 | goto beyond_if; |
| 325 | } |
| 326 | |
| 327 | down_write(¤t->mm->mmap_sem); |
| 328 | error = do_mmap(bprm->file, N_TXTADDR(ex), ex.a_text, |
| 329 | PROT_READ | PROT_EXEC, |
| 330 | MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE, |
| 331 | fd_offset); |
| 332 | up_write(¤t->mm->mmap_sem); |
| 333 | |
| 334 | if (error != N_TXTADDR(ex)) { |
| 335 | send_sig(SIGKILL, current, 0); |
| 336 | return error; |
| 337 | } |
| 338 | |
| 339 | down_write(¤t->mm->mmap_sem); |
| 340 | error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data, |
| 341 | PROT_READ | PROT_WRITE | PROT_EXEC, |
| 342 | MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE, |
| 343 | fd_offset + ex.a_text); |
| 344 | up_write(¤t->mm->mmap_sem); |
| 345 | if (error != N_DATADDR(ex)) { |
| 346 | send_sig(SIGKILL, current, 0); |
| 347 | return error; |
| 348 | } |
| 349 | } |
| 350 | beyond_if: |
| 351 | set_binfmt(&aout_format); |
| 352 | |
| 353 | retval = set_brk(current->mm->start_brk, current->mm->brk); |
| 354 | if (retval < 0) { |
| 355 | send_sig(SIGKILL, current, 0); |
| 356 | return retval; |
| 357 | } |
| 358 | |
| 359 | retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT); |
| 360 | if (retval < 0) { |
| 361 | /* Someone check-me: is this error path enough? */ |
| 362 | send_sig(SIGKILL, current, 0); |
| 363 | return retval; |
| 364 | } |
| 365 | |
| 366 | current->mm->start_stack = |
| 367 | (unsigned long) create_aout_tables((char __user *) bprm->p, bprm); |
| 368 | #ifdef __alpha__ |
| 369 | regs->gp = ex.a_gpvalue; |
| 370 | #endif |
| 371 | start_thread(regs, ex.a_entry, current->mm->start_stack); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 372 | return 0; |
| 373 | } |
| 374 | |
| 375 | static int load_aout_library(struct file *file) |
| 376 | { |
| 377 | struct inode * inode; |
| 378 | unsigned long bss, start_addr, len; |
| 379 | unsigned long error; |
| 380 | int retval; |
| 381 | struct exec ex; |
| 382 | |
Josef "Jeff" Sipek | 0f7fc9e4 | 2006-12-08 02:36:35 -0800 | [diff] [blame] | 383 | inode = file->f_path.dentry->d_inode; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 384 | |
| 385 | retval = -ENOEXEC; |
| 386 | error = kernel_read(file, 0, (char *) &ex, sizeof(ex)); |
| 387 | if (error != sizeof(ex)) |
| 388 | goto out; |
| 389 | |
| 390 | /* We come in here for the regular a.out style of shared libraries */ |
| 391 | if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != QMAGIC) || N_TRSIZE(ex) || |
| 392 | N_DRSIZE(ex) || ((ex.a_entry & 0xfff) && N_MAGIC(ex) == ZMAGIC) || |
| 393 | i_size_read(inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) { |
| 394 | goto out; |
| 395 | } |
| 396 | |
Eugene Teo | 8454aee | 2006-09-29 01:59:33 -0700 | [diff] [blame] | 397 | /* |
| 398 | * Requires a mmap handler. This prevents people from using a.out |
| 399 | * as part of an exploit attack against /proc-related vulnerabilities. |
| 400 | */ |
| 401 | if (!file->f_op || !file->f_op->mmap) |
| 402 | goto out; |
| 403 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 404 | if (N_FLAGS(ex)) |
| 405 | goto out; |
| 406 | |
| 407 | /* For QMAGIC, the starting address is 0x20 into the page. We mask |
| 408 | this off to get the starting address for the page */ |
| 409 | |
| 410 | start_addr = ex.a_entry & 0xfffff000; |
| 411 | |
| 412 | if ((N_TXTOFF(ex) & ~PAGE_MASK) != 0) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 413 | loff_t pos = N_TXTOFF(ex); |
| 414 | |
S.Caglar Onur | 2e50b6c | 2008-04-29 00:59:26 -0700 | [diff] [blame] | 415 | if (printk_ratelimit()) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 416 | { |
| 417 | printk(KERN_WARNING |
| 418 | "N_TXTOFF is not page aligned. Please convert library: %s\n", |
Josef "Jeff" Sipek | 0f7fc9e4 | 2006-12-08 02:36:35 -0800 | [diff] [blame] | 419 | file->f_path.dentry->d_name.name); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 420 | } |
| 421 | down_write(¤t->mm->mmap_sem); |
| 422 | do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss); |
| 423 | up_write(¤t->mm->mmap_sem); |
| 424 | |
| 425 | file->f_op->read(file, (char __user *)start_addr, |
| 426 | ex.a_text + ex.a_data, &pos); |
| 427 | flush_icache_range((unsigned long) start_addr, |
| 428 | (unsigned long) start_addr + ex.a_text + ex.a_data); |
| 429 | |
| 430 | retval = 0; |
| 431 | goto out; |
| 432 | } |
| 433 | /* Now use mmap to map the library into memory. */ |
| 434 | down_write(¤t->mm->mmap_sem); |
| 435 | error = do_mmap(file, start_addr, ex.a_text + ex.a_data, |
| 436 | PROT_READ | PROT_WRITE | PROT_EXEC, |
| 437 | MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE, |
| 438 | N_TXTOFF(ex)); |
| 439 | up_write(¤t->mm->mmap_sem); |
| 440 | retval = error; |
| 441 | if (error != start_addr) |
| 442 | goto out; |
| 443 | |
| 444 | len = PAGE_ALIGN(ex.a_text + ex.a_data); |
| 445 | bss = ex.a_text + ex.a_data + ex.a_bss; |
| 446 | if (bss > len) { |
| 447 | down_write(¤t->mm->mmap_sem); |
| 448 | error = do_brk(start_addr + len, bss - len); |
| 449 | up_write(¤t->mm->mmap_sem); |
| 450 | retval = error; |
| 451 | if (error != start_addr + len) |
| 452 | goto out; |
| 453 | } |
| 454 | retval = 0; |
| 455 | out: |
| 456 | return retval; |
| 457 | } |
| 458 | |
| 459 | static int __init init_aout_binfmt(void) |
| 460 | { |
| 461 | return register_binfmt(&aout_format); |
| 462 | } |
| 463 | |
| 464 | static void __exit exit_aout_binfmt(void) |
| 465 | { |
| 466 | unregister_binfmt(&aout_format); |
| 467 | } |
| 468 | |
| 469 | core_initcall(init_aout_binfmt); |
| 470 | module_exit(exit_aout_binfmt); |
| 471 | MODULE_LICENSE("GPL"); |