]>
git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - fs/binfmt_aout.c
2 * linux/fs/binfmt_aout.c
4 * Copyright (C) 1991, 1992, 1996 Linus Torvalds
7 #include <linux/module.h>
9 #include <linux/time.h>
10 #include <linux/kernel.h>
12 #include <linux/mman.h>
13 #include <linux/a.out.h>
14 #include <linux/errno.h>
15 #include <linux/signal.h>
16 #include <linux/string.h>
18 #include <linux/file.h>
19 #include <linux/stat.h>
20 #include <linux/fcntl.h>
21 #include <linux/ptrace.h>
22 #include <linux/user.h>
23 #include <linux/slab.h>
24 #include <linux/binfmts.h>
25 #include <linux/personality.h>
26 #include <linux/init.h>
28 #include <asm/system.h>
29 #include <asm/uaccess.h>
30 #include <asm/cacheflush.h>
31 #include <asm/a.out-core.h>
33 static int load_aout_binary(struct linux_binprm
*, struct pt_regs
* regs
);
34 static int load_aout_library(struct file
*);
35 static int aout_core_dump(long signr
, struct pt_regs
*regs
, struct file
*file
, unsigned long limit
);
37 static struct linux_binfmt aout_format
= {
38 .module
= THIS_MODULE
,
39 .load_binary
= load_aout_binary
,
40 .load_shlib
= load_aout_library
,
41 .core_dump
= aout_core_dump
,
42 .min_coredump
= PAGE_SIZE
45 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
47 static int set_brk(unsigned long start
, unsigned long end
)
49 start
= PAGE_ALIGN(start
);
50 end
= PAGE_ALIGN(end
);
53 down_write(¤t
->mm
->mmap_sem
);
54 addr
= do_brk(start
, end
- start
);
55 up_write(¤t
->mm
->mmap_sem
);
63 * These are the only things you should do on a core-file: use only these
64 * macros to write out all the necessary info.
67 static int dump_write(struct file
*file
, const void *addr
, int nr
)
69 return file
->f_op
->write(file
, addr
, nr
, &file
->f_pos
) == nr
;
72 #define DUMP_WRITE(addr, nr) \
73 if (!dump_write(file, (void *)(addr), (nr))) \
76 #define DUMP_SEEK(offset) \
77 if (file->f_op->llseek) { \
78 if (file->f_op->llseek(file,(offset),0) != (offset)) \
80 } else file->f_pos = (offset)
83 * Routine writes a core dump image in the current directory.
84 * Currently only a stub-function.
86 * Note that setuid/setgid files won't make a core-dump if the uid/gid
87 * changed due to the set[u|g]id. It's enforced by the "current->mm->dumpable"
88 * field, which also makes sure the core-dumps won't be recursive if the
89 * dumping of the process results in another error..
92 static int aout_core_dump(long signr
, struct pt_regs
*regs
, struct file
*file
, unsigned long limit
)
96 unsigned long dump_start
, dump_size
;
98 #if defined(__alpha__)
99 # define START_DATA(u) (u.start_data)
100 #elif defined(__arm__)
101 # define START_DATA(u) ((u.u_tsize << PAGE_SHIFT) + u.start_code)
102 #elif defined(__sparc__)
103 # define START_DATA(u) (u.u_tsize)
104 #elif defined(__i386__) || defined(__mc68000__) || defined(__arch_um__)
105 # define START_DATA(u) (u.u_tsize << PAGE_SHIFT)
108 # define START_STACK(u) ((regs->u_regs[UREG_FP]) & ~(PAGE_SIZE - 1))
110 # define START_STACK(u) (u.start_stack)
116 current
->flags
|= PF_DUMPCORE
;
117 strncpy(dump
.u_comm
, current
->comm
, sizeof(dump
.u_comm
));
119 dump
.u_ar0
= offsetof(struct user
, regs
);
122 aout_dump_thread(regs
, &dump
);
124 /* If the size of the dump file exceeds the rlimit, then see what would happen
125 if we wrote the stack, but not the data area. */
127 if ((dump
.u_dsize
+ dump
.u_ssize
) > limit
)
130 if ((dump
.u_dsize
+ dump
.u_ssize
+1) * PAGE_SIZE
> limit
)
134 /* Make sure we have enough room to write the stack and data areas. */
136 if (dump
.u_ssize
> limit
)
139 if ((dump
.u_ssize
+ 1) * PAGE_SIZE
> limit
)
143 /* make sure we actually have a data and stack area to dump */
146 if (!access_ok(VERIFY_READ
, (void __user
*)START_DATA(dump
), dump
.u_dsize
))
148 if (!access_ok(VERIFY_READ
, (void __user
*)START_STACK(dump
), dump
.u_ssize
))
151 if (!access_ok(VERIFY_READ
, (void __user
*)START_DATA(dump
), dump
.u_dsize
<< PAGE_SHIFT
))
153 if (!access_ok(VERIFY_READ
, (void __user
*)START_STACK(dump
), dump
.u_ssize
<< PAGE_SHIFT
))
159 DUMP_WRITE(&dump
,sizeof(dump
));
160 /* Now dump all of the user data. Include malloced stuff as well */
162 DUMP_SEEK(PAGE_SIZE
);
164 /* now we start writing out the user space info */
166 /* Dump the data area */
167 if (dump
.u_dsize
!= 0) {
168 dump_start
= START_DATA(dump
);
170 dump_size
= dump
.u_dsize
;
172 dump_size
= dump
.u_dsize
<< PAGE_SHIFT
;
174 DUMP_WRITE(dump_start
,dump_size
);
176 /* Now prepare to dump the stack area */
177 if (dump
.u_ssize
!= 0) {
178 dump_start
= START_STACK(dump
);
180 dump_size
= dump
.u_ssize
;
182 dump_size
= dump
.u_ssize
<< PAGE_SHIFT
;
184 DUMP_WRITE(dump_start
,dump_size
);
186 /* Finally dump the task struct. Not be used by gdb, but could be useful */
188 DUMP_WRITE(current
,sizeof(*current
));
195 * create_aout_tables() parses the env- and arg-strings in new user
196 * memory and creates the pointer tables from them, and puts their
197 * addresses on the "stack", returning the new stack pointer value.
199 static unsigned long __user
*create_aout_tables(char __user
*p
, struct linux_binprm
* bprm
)
201 char __user
* __user
*argv
;
202 char __user
* __user
*envp
;
203 unsigned long __user
*sp
;
204 int argc
= bprm
->argc
;
205 int envc
= bprm
->envc
;
207 sp
= (void __user
*)((-(unsigned long)sizeof(char *)) & (unsigned long) p
);
209 /* This imposes the proper stack alignment for a new process. */
210 sp
= (void __user
*) (((unsigned long) sp
) & ~7);
211 if ((envc
+argc
+3)&1) --sp
;
214 /* whee.. test-programs are so much fun. */
219 put_user(0x3eb, --sp
);
220 put_user(bprm
->loader
, --sp
);
221 put_user(0x3ea, --sp
);
223 put_user(bprm
->exec
, --sp
);
224 put_user(0x3e9, --sp
);
227 envp
= (char __user
* __user
*) sp
;
229 argv
= (char __user
* __user
*) sp
;
230 #if defined(__i386__) || defined(__mc68000__) || defined(__arm__) || defined(__arch_um__)
231 put_user((unsigned long) envp
,--sp
);
232 put_user((unsigned long) argv
,--sp
);
235 current
->mm
->arg_start
= (unsigned long) p
;
244 current
->mm
->arg_end
= current
->mm
->env_start
= (unsigned long) p
;
253 current
->mm
->env_end
= (unsigned long) p
;
258 * These are the functions used to load a.out style executables and shared
259 * libraries. There is no binary dependent code anywhere else.
262 static int load_aout_binary(struct linux_binprm
* bprm
, struct pt_regs
* regs
)
266 unsigned long fd_offset
;
270 ex
= *((struct exec
*) bprm
->buf
); /* exec-header */
271 if ((N_MAGIC(ex
) != ZMAGIC
&& N_MAGIC(ex
) != OMAGIC
&&
272 N_MAGIC(ex
) != QMAGIC
&& N_MAGIC(ex
) != NMAGIC
) ||
273 N_TRSIZE(ex
) || N_DRSIZE(ex
) ||
274 i_size_read(bprm
->file
->f_path
.dentry
->d_inode
) < ex
.a_text
+ex
.a_data
+N_SYMSIZE(ex
)+N_TXTOFF(ex
)) {
279 * Requires a mmap handler. This prevents people from using a.out
280 * as part of an exploit attack against /proc-related vulnerabilities.
282 if (!bprm
->file
->f_op
|| !bprm
->file
->f_op
->mmap
)
285 fd_offset
= N_TXTOFF(ex
);
287 /* Check initial limits. This avoids letting people circumvent
288 * size limits imposed on them by creating programs with large
289 * arrays in the data or bss.
291 rlim
= current
->signal
->rlim
[RLIMIT_DATA
].rlim_cur
;
292 if (rlim
>= RLIM_INFINITY
)
294 if (ex
.a_data
+ ex
.a_bss
> rlim
)
297 /* Flush all traces of the currently running executable */
298 retval
= flush_old_exec(bprm
);
302 /* OK, This is the point of no return */
303 #if defined(__alpha__)
304 SET_AOUT_PERSONALITY(bprm
, ex
);
305 #elif defined(__sparc__)
306 set_personality(PER_SUNOS
);
307 #if !defined(__sparc_v9__)
308 memcpy(¤t
->thread
.core_exec
, &ex
, sizeof(struct exec
));
311 set_personality(PER_LINUX
);
314 current
->mm
->end_code
= ex
.a_text
+
315 (current
->mm
->start_code
= N_TXTADDR(ex
));
316 current
->mm
->end_data
= ex
.a_data
+
317 (current
->mm
->start_data
= N_DATADDR(ex
));
318 current
->mm
->brk
= ex
.a_bss
+
319 (current
->mm
->start_brk
= N_BSSADDR(ex
));
320 current
->mm
->free_area_cache
= current
->mm
->mmap_base
;
321 current
->mm
->cached_hole_size
= 0;
324 current
->flags
&= ~PF_FORKNOEXEC
;
326 if (N_MAGIC(ex
) == NMAGIC
) {
327 loff_t pos
= fd_offset
;
328 /* Fuck me plenty... */
330 down_write(¤t
->mm
->mmap_sem
);
331 error
= do_brk(N_TXTADDR(ex
), ex
.a_text
);
332 up_write(¤t
->mm
->mmap_sem
);
333 bprm
->file
->f_op
->read(bprm
->file
, (char *) N_TXTADDR(ex
),
335 down_write(¤t
->mm
->mmap_sem
);
336 error
= do_brk(N_DATADDR(ex
), ex
.a_data
);
337 up_write(¤t
->mm
->mmap_sem
);
338 bprm
->file
->f_op
->read(bprm
->file
, (char *) N_DATADDR(ex
),
344 if (N_MAGIC(ex
) == OMAGIC
) {
345 unsigned long text_addr
, map_size
;
348 text_addr
= N_TXTADDR(ex
);
350 #if defined(__alpha__) || defined(__sparc__)
352 map_size
= ex
.a_text
+ex
.a_data
+ PAGE_SIZE
- 1;
355 map_size
= ex
.a_text
+ex
.a_data
;
357 down_write(¤t
->mm
->mmap_sem
);
358 error
= do_brk(text_addr
& PAGE_MASK
, map_size
);
359 up_write(¤t
->mm
->mmap_sem
);
360 if (error
!= (text_addr
& PAGE_MASK
)) {
361 send_sig(SIGKILL
, current
, 0);
365 error
= bprm
->file
->f_op
->read(bprm
->file
,
366 (char __user
*)text_addr
,
367 ex
.a_text
+ex
.a_data
, &pos
);
368 if ((signed long)error
< 0) {
369 send_sig(SIGKILL
, current
, 0);
373 flush_icache_range(text_addr
, text_addr
+ex
.a_text
+ex
.a_data
);
375 if ((ex
.a_text
& 0xfff || ex
.a_data
& 0xfff) &&
376 (N_MAGIC(ex
) != NMAGIC
) && printk_ratelimit())
378 printk(KERN_NOTICE
"executable not page aligned\n");
381 if ((fd_offset
& ~PAGE_MASK
) != 0 && printk_ratelimit())
384 "fd_offset is not page aligned. Please convert program: %s\n",
385 bprm
->file
->f_path
.dentry
->d_name
.name
);
388 if (!bprm
->file
->f_op
->mmap
||((fd_offset
& ~PAGE_MASK
) != 0)) {
389 loff_t pos
= fd_offset
;
390 down_write(¤t
->mm
->mmap_sem
);
391 do_brk(N_TXTADDR(ex
), ex
.a_text
+ex
.a_data
);
392 up_write(¤t
->mm
->mmap_sem
);
393 bprm
->file
->f_op
->read(bprm
->file
,
394 (char __user
*)N_TXTADDR(ex
),
395 ex
.a_text
+ex
.a_data
, &pos
);
396 flush_icache_range((unsigned long) N_TXTADDR(ex
),
397 (unsigned long) N_TXTADDR(ex
) +
398 ex
.a_text
+ex
.a_data
);
402 down_write(¤t
->mm
->mmap_sem
);
403 error
= do_mmap(bprm
->file
, N_TXTADDR(ex
), ex
.a_text
,
404 PROT_READ
| PROT_EXEC
,
405 MAP_FIXED
| MAP_PRIVATE
| MAP_DENYWRITE
| MAP_EXECUTABLE
,
407 up_write(¤t
->mm
->mmap_sem
);
409 if (error
!= N_TXTADDR(ex
)) {
410 send_sig(SIGKILL
, current
, 0);
414 down_write(¤t
->mm
->mmap_sem
);
415 error
= do_mmap(bprm
->file
, N_DATADDR(ex
), ex
.a_data
,
416 PROT_READ
| PROT_WRITE
| PROT_EXEC
,
417 MAP_FIXED
| MAP_PRIVATE
| MAP_DENYWRITE
| MAP_EXECUTABLE
,
418 fd_offset
+ ex
.a_text
);
419 up_write(¤t
->mm
->mmap_sem
);
420 if (error
!= N_DATADDR(ex
)) {
421 send_sig(SIGKILL
, current
, 0);
426 set_binfmt(&aout_format
);
428 retval
= set_brk(current
->mm
->start_brk
, current
->mm
->brk
);
430 send_sig(SIGKILL
, current
, 0);
434 retval
= setup_arg_pages(bprm
, STACK_TOP
, EXSTACK_DEFAULT
);
436 /* Someone check-me: is this error path enough? */
437 send_sig(SIGKILL
, current
, 0);
441 current
->mm
->start_stack
=
442 (unsigned long) create_aout_tables((char __user
*) bprm
->p
, bprm
);
444 regs
->gp
= ex
.a_gpvalue
;
446 start_thread(regs
, ex
.a_entry
, current
->mm
->start_stack
);
450 static int load_aout_library(struct file
*file
)
452 struct inode
* inode
;
453 unsigned long bss
, start_addr
, len
;
458 inode
= file
->f_path
.dentry
->d_inode
;
461 error
= kernel_read(file
, 0, (char *) &ex
, sizeof(ex
));
462 if (error
!= sizeof(ex
))
465 /* We come in here for the regular a.out style of shared libraries */
466 if ((N_MAGIC(ex
) != ZMAGIC
&& N_MAGIC(ex
) != QMAGIC
) || N_TRSIZE(ex
) ||
467 N_DRSIZE(ex
) || ((ex
.a_entry
& 0xfff) && N_MAGIC(ex
) == ZMAGIC
) ||
468 i_size_read(inode
) < ex
.a_text
+ex
.a_data
+N_SYMSIZE(ex
)+N_TXTOFF(ex
)) {
473 * Requires a mmap handler. This prevents people from using a.out
474 * as part of an exploit attack against /proc-related vulnerabilities.
476 if (!file
->f_op
|| !file
->f_op
->mmap
)
482 /* For QMAGIC, the starting address is 0x20 into the page. We mask
483 this off to get the starting address for the page */
485 start_addr
= ex
.a_entry
& 0xfffff000;
487 if ((N_TXTOFF(ex
) & ~PAGE_MASK
) != 0) {
488 loff_t pos
= N_TXTOFF(ex
);
490 if (printk_ratelimit())
493 "N_TXTOFF is not page aligned. Please convert library: %s\n",
494 file
->f_path
.dentry
->d_name
.name
);
496 down_write(¤t
->mm
->mmap_sem
);
497 do_brk(start_addr
, ex
.a_text
+ ex
.a_data
+ ex
.a_bss
);
498 up_write(¤t
->mm
->mmap_sem
);
500 file
->f_op
->read(file
, (char __user
*)start_addr
,
501 ex
.a_text
+ ex
.a_data
, &pos
);
502 flush_icache_range((unsigned long) start_addr
,
503 (unsigned long) start_addr
+ ex
.a_text
+ ex
.a_data
);
508 /* Now use mmap to map the library into memory. */
509 down_write(¤t
->mm
->mmap_sem
);
510 error
= do_mmap(file
, start_addr
, ex
.a_text
+ ex
.a_data
,
511 PROT_READ
| PROT_WRITE
| PROT_EXEC
,
512 MAP_FIXED
| MAP_PRIVATE
| MAP_DENYWRITE
,
514 up_write(¤t
->mm
->mmap_sem
);
516 if (error
!= start_addr
)
519 len
= PAGE_ALIGN(ex
.a_text
+ ex
.a_data
);
520 bss
= ex
.a_text
+ ex
.a_data
+ ex
.a_bss
;
522 down_write(¤t
->mm
->mmap_sem
);
523 error
= do_brk(start_addr
+ len
, bss
- len
);
524 up_write(¤t
->mm
->mmap_sem
);
526 if (error
!= start_addr
+ len
)
534 static int __init
init_aout_binfmt(void)
536 return register_binfmt(&aout_format
);
539 static void __exit
exit_aout_binfmt(void)
541 unregister_binfmt(&aout_format
);
544 core_initcall(init_aout_binfmt
);
545 module_exit(exit_aout_binfmt
);
546 MODULE_LICENSE("GPL");