1/* 2 * linux/fs/binfmt_aout.c 3 * 4 * Copyright (C) 1991, 1992, 1996 Linus Torvalds 5 */ 6 7#include <linux/module.h> 8 9#include <linux/time.h> 10#include <linux/kernel.h> 11#include <linux/mm.h> 12#include <linux/mman.h> 13#include <linux/a.out.h> 14#include <linux/errno.h> 15#include <linux/signal.h> 16#include <linux/string.h> 17#include <linux/fs.h> 18#include <linux/file.h> 19#include <linux/stat.h> 20#include <linux/fcntl.h> 21#include <linux/ptrace.h> 22#include <linux/user.h> 23#include <linux/binfmts.h> 24#include <linux/personality.h> 25#include <linux/init.h> 26#include <linux/coredump.h> 27#include <linux/slab.h> 28 29#include <asm/system.h> 30#include <asm/uaccess.h> 31#include <asm/cacheflush.h> 32#include <asm/a.out-core.h> 33 34static int load_aout_binary(struct linux_binprm *, struct pt_regs * regs); 35static int load_aout_library(struct file*); 36static int aout_core_dump(struct coredump_params *cprm); 37 38static struct linux_binfmt aout_format = { 39 .module = THIS_MODULE, 40 .load_binary = load_aout_binary, 41 .load_shlib = load_aout_library, 42 .core_dump = aout_core_dump, 43 .min_coredump = PAGE_SIZE 44}; 45 46#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) 47 48static int set_brk(unsigned long start, unsigned long end) 49{ 50 start = PAGE_ALIGN(start); 51 end = PAGE_ALIGN(end); 52 if (end > start) { 53 unsigned long addr; 54 down_write(¤t->mm->mmap_sem); 55 addr = do_brk(start, end - start); 56 up_write(¤t->mm->mmap_sem); 57 if (BAD_ADDR(addr)) 58 return addr; 59 } 60 return 0; 61} 62 63/* 64 * Routine writes a core dump image in the current directory. 65 * Currently only a stub-function. 66 * 67 * Note that setuid/setgid files won't make a core-dump if the uid/gid 68 * changed due to the set[u|g]id. It's enforced by the "current->mm->dumpable" 69 * field, which also makes sure the core-dumps won't be recursive if the 70 * dumping of the process results in another error.. 71 */ 72 73static int aout_core_dump(struct coredump_params *cprm) 74{ 75 struct file *file = cprm->file; 76 mm_segment_t fs; 77 int has_dumped = 0; 78 void __user *dump_start; 79 int dump_size; 80 struct user dump; 81#ifdef __alpha__ 82# define START_DATA(u) ((void __user *)u.start_data) 83#else 84# define START_DATA(u) ((void __user *)((u.u_tsize << PAGE_SHIFT) + \ 85 u.start_code)) 86#endif 87# define START_STACK(u) ((void __user *)u.start_stack) 88 89 fs = get_fs(); 90 set_fs(KERNEL_DS); 91 has_dumped = 1; 92 current->flags |= PF_DUMPCORE; 93 strncpy(dump.u_comm, current->comm, sizeof(dump.u_comm)); 94 dump.u_ar0 = offsetof(struct user, regs); 95 dump.signal = cprm->signr; 96 aout_dump_thread(cprm->regs, &dump); 97 98/* If the size of the dump file exceeds the rlimit, then see what would happen 99 if we wrote the stack, but not the data area. */ 100 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit) 101 dump.u_dsize = 0; 102 103/* Make sure we have enough room to write the stack and data areas. */ 104 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit) 105 dump.u_ssize = 0; 106 107/* make sure we actually have a data and stack area to dump */ 108 set_fs(USER_DS); 109 if (!access_ok(VERIFY_READ, START_DATA(dump), dump.u_dsize << PAGE_SHIFT)) 110 dump.u_dsize = 0; 111 if (!access_ok(VERIFY_READ, START_STACK(dump), dump.u_ssize << PAGE_SHIFT)) 112 dump.u_ssize = 0; 113 114 set_fs(KERNEL_DS); 115/* struct user */ 116 if (!dump_write(file, &dump, sizeof(dump))) 117 goto end_coredump; 118/* Now dump all of the user data. Include malloced stuff as well */ 119 if (!dump_seek(cprm->file, PAGE_SIZE - sizeof(dump))) 120 goto end_coredump; 121/* now we start writing out the user space info */ 122 set_fs(USER_DS); 123/* Dump the data area */ 124 if (dump.u_dsize != 0) { 125 dump_start = START_DATA(dump); 126 dump_size = dump.u_dsize << PAGE_SHIFT; 127 if (!dump_write(file, dump_start, dump_size)) 128 goto end_coredump; 129 } 130/* Now prepare to dump the stack area */ 131 if (dump.u_ssize != 0) { 132 dump_start = START_STACK(dump); 133 dump_size = dump.u_ssize << PAGE_SHIFT; 134 if (!dump_write(file, dump_start, dump_size)) 135 goto end_coredump; 136 } 137end_coredump: 138 set_fs(fs); 139 return has_dumped; 140} 141 142/* 143 * create_aout_tables() parses the env- and arg-strings in new user 144 * memory and creates the pointer tables from them, and puts their 145 * addresses on the "stack", returning the new stack pointer value. 146 */ 147static unsigned long __user *create_aout_tables(char __user *p, struct linux_binprm * bprm) 148{ 149 char __user * __user *argv; 150 char __user * __user *envp; 151 unsigned long __user *sp; 152 int argc = bprm->argc; 153 int envc = bprm->envc; 154 155 sp = (void __user *)((-(unsigned long)sizeof(char *)) & (unsigned long) p); 156#ifdef __alpha__ 157/* whee.. test-programs are so much fun. */ 158 put_user(0, --sp); 159 put_user(0, --sp); 160 if (bprm->loader) { 161 put_user(0, --sp); 162 put_user(1003, --sp); 163 put_user(bprm->loader, --sp); 164 put_user(1002, --sp); 165 } 166 put_user(bprm->exec, --sp); 167 put_user(1001, --sp); 168#endif 169 sp -= envc+1; 170 envp = (char __user * __user *) sp; 171 sp -= argc+1; 172 argv = (char __user * __user *) sp; 173#ifndef __alpha__ 174 put_user((unsigned long) envp,--sp); 175 put_user((unsigned long) argv,--sp); 176#endif 177 put_user(argc,--sp); 178 current->mm->arg_start = (unsigned long) p; 179 while (argc-->0) { 180 char c; 181 put_user(p,argv++); 182 do { 183 get_user(c,p++); 184 } while (c); 185 } 186 put_user(NULL,argv); 187 current->mm->arg_end = current->mm->env_start = (unsigned long) p; 188 while (envc-->0) { 189 char c; 190 put_user(p,envp++); 191 do { 192 get_user(c,p++); 193 } while (c); 194 } 195 put_user(NULL,envp); 196 current->mm->env_end = (unsigned long) p; 197 return sp; 198} 199 200/* 201 * These are the functions used to load a.out style executables and shared 202 * libraries. There is no binary dependent code anywhere else. 203 */ 204 205static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs) 206{ 207 struct exec ex; 208 unsigned long error; 209 unsigned long fd_offset; 210 unsigned long rlim; 211 int retval; 212 213 ex = *((struct exec *) bprm->buf); /* exec-header */ 214 if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != OMAGIC && 215 N_MAGIC(ex) != QMAGIC && N_MAGIC(ex) != NMAGIC) || 216 N_TRSIZE(ex) || N_DRSIZE(ex) || 217 i_size_read(bprm->file->f_path.dentry->d_inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) { 218 return -ENOEXEC; 219 } 220 221 /* 222 * Requires a mmap handler. This prevents people from using a.out 223 * as part of an exploit attack against /proc-related vulnerabilities. 224 */ 225 if (!bprm->file->f_op || !bprm->file->f_op->mmap) 226 return -ENOEXEC; 227 228 fd_offset = N_TXTOFF(ex); 229 230 /* Check initial limits. This avoids letting people circumvent 231 * size limits imposed on them by creating programs with large 232 * arrays in the data or bss. 233 */ 234 rlim = rlimit(RLIMIT_DATA); 235 if (rlim >= RLIM_INFINITY) 236 rlim = ~0; 237 if (ex.a_data + ex.a_bss > rlim) 238 return -ENOMEM; 239 240 /* Flush all traces of the currently running executable */ 241 retval = flush_old_exec(bprm); 242 if (retval) 243 return retval; 244 245 /* OK, This is the point of no return */ 246#ifdef __alpha__ 247 SET_AOUT_PERSONALITY(bprm, ex); 248#else 249 set_personality(PER_LINUX); 250#endif 251 setup_new_exec(bprm); 252 253 current->mm->end_code = ex.a_text + 254 (current->mm->start_code = N_TXTADDR(ex)); 255 current->mm->end_data = ex.a_data + 256 (current->mm->start_data = N_DATADDR(ex)); 257 current->mm->brk = ex.a_bss + 258 (current->mm->start_brk = N_BSSADDR(ex)); 259 current->mm->free_area_cache = current->mm->mmap_base; 260 current->mm->cached_hole_size = 0; 261 262 install_exec_creds(bprm); 263 current->flags &= ~PF_FORKNOEXEC; 264 265 if (N_MAGIC(ex) == OMAGIC) { 266 unsigned long text_addr, map_size; 267 loff_t pos; 268 269 text_addr = N_TXTADDR(ex); 270 271#ifdef __alpha__ 272 pos = fd_offset; 273 map_size = ex.a_text+ex.a_data + PAGE_SIZE - 1; 274#else 275 pos = 32; 276 map_size = ex.a_text+ex.a_data; 277#endif 278 down_write(¤t->mm->mmap_sem); 279 error = do_brk(text_addr & PAGE_MASK, map_size); 280 up_write(¤t->mm->mmap_sem); 281 if (error != (text_addr & PAGE_MASK)) { 282 send_sig(SIGKILL, current, 0); 283 return error; 284 } 285 286 error = bprm->file->f_op->read(bprm->file, 287 (char __user *)text_addr, 288 ex.a_text+ex.a_data, &pos); 289 if ((signed long)error < 0) { 290 send_sig(SIGKILL, current, 0); 291 return error; 292 } 293 294 flush_icache_range(text_addr, text_addr+ex.a_text+ex.a_data); 295 } else { 296 if ((ex.a_text & 0xfff || ex.a_data & 0xfff) && 297 (N_MAGIC(ex) != NMAGIC) && printk_ratelimit()) 298 { 299 printk(KERN_NOTICE "executable not page aligned\n"); 300 } 301 302 if ((fd_offset & ~PAGE_MASK) != 0 && printk_ratelimit()) 303 { 304 printk(KERN_WARNING 305 "fd_offset is not page aligned. Please convert program: %s\n", 306 bprm->file->f_path.dentry->d_name.name); 307 } 308 309 if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) { 310 loff_t pos = fd_offset; 311 down_write(¤t->mm->mmap_sem); 312 do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data); 313 up_write(¤t->mm->mmap_sem); 314 bprm->file->f_op->read(bprm->file, 315 (char __user *)N_TXTADDR(ex), 316 ex.a_text+ex.a_data, &pos); 317 flush_icache_range((unsigned long) N_TXTADDR(ex), 318 (unsigned long) N_TXTADDR(ex) + 319 ex.a_text+ex.a_data); 320 goto beyond_if; 321 } 322 323 down_write(¤t->mm->mmap_sem); 324 error = do_mmap(bprm->file, N_TXTADDR(ex), ex.a_text, 325 PROT_READ | PROT_EXEC, 326 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE, 327 fd_offset); 328 up_write(¤t->mm->mmap_sem); 329 330 if (error != N_TXTADDR(ex)) { 331 send_sig(SIGKILL, current, 0); 332 return error; 333 } 334 335 down_write(¤t->mm->mmap_sem); 336 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data, 337 PROT_READ | PROT_WRITE | PROT_EXEC, 338 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE, 339 fd_offset + ex.a_text); 340 up_write(¤t->mm->mmap_sem); 341 if (error != N_DATADDR(ex)) { 342 send_sig(SIGKILL, current, 0); 343 return error; 344 } 345 } 346beyond_if: 347 set_binfmt(&aout_format); 348 349 retval = set_brk(current->mm->start_brk, current->mm->brk); 350 if (retval < 0) { 351 send_sig(SIGKILL, current, 0); 352 return retval; 353 } 354 355 retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT); 356 if (retval < 0) { 357 /* Someone check-me: is this error path enough? */ 358 send_sig(SIGKILL, current, 0); 359 return retval; 360 } 361 362 current->mm->start_stack = 363 (unsigned long) create_aout_tables((char __user *) bprm->p, bprm); 364#ifdef __alpha__ 365 regs->gp = ex.a_gpvalue; 366#endif 367 start_thread(regs, ex.a_entry, current->mm->start_stack); 368 return 0; 369} 370 371static int load_aout_library(struct file *file) 372{ 373 struct inode * inode; 374 unsigned long bss, start_addr, len; 375 unsigned long error; 376 int retval; 377 struct exec ex; 378 379 inode = file->f_path.dentry->d_inode; 380 381 retval = -ENOEXEC; 382 error = kernel_read(file, 0, (char *) &ex, sizeof(ex)); 383 if (error != sizeof(ex)) 384 goto out; 385 386 /* We come in here for the regular a.out style of shared libraries */ 387 if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != QMAGIC) || N_TRSIZE(ex) || 388 N_DRSIZE(ex) || ((ex.a_entry & 0xfff) && N_MAGIC(ex) == ZMAGIC) || 389 i_size_read(inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) { 390 goto out; 391 } 392 393 /* 394 * Requires a mmap handler. This prevents people from using a.out 395 * as part of an exploit attack against /proc-related vulnerabilities. 396 */ 397 if (!file->f_op || !file->f_op->mmap) 398 goto out; 399 400 if (N_FLAGS(ex)) 401 goto out; 402 403 /* For QMAGIC, the starting address is 0x20 into the page. We mask 404 this off to get the starting address for the page */ 405 406 start_addr = ex.a_entry & 0xfffff000; 407 408 if ((N_TXTOFF(ex) & ~PAGE_MASK) != 0) { 409 loff_t pos = N_TXTOFF(ex); 410 411 if (printk_ratelimit()) 412 { 413 printk(KERN_WARNING 414 "N_TXTOFF is not page aligned. Please convert library: %s\n", 415 file->f_path.dentry->d_name.name); 416 } 417 down_write(¤t->mm->mmap_sem); 418 do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss); 419 up_write(¤t->mm->mmap_sem); 420 421 file->f_op->read(file, (char __user *)start_addr, 422 ex.a_text + ex.a_data, &pos); 423 flush_icache_range((unsigned long) start_addr, 424 (unsigned long) start_addr + ex.a_text + ex.a_data); 425 426 retval = 0; 427 goto out; 428 } 429 /* Now use mmap to map the library into memory. */ 430 down_write(¤t->mm->mmap_sem); 431 error = do_mmap(file, start_addr, ex.a_text + ex.a_data, 432 PROT_READ | PROT_WRITE | PROT_EXEC, 433 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE, 434 N_TXTOFF(ex)); 435 up_write(¤t->mm->mmap_sem); 436 retval = error; 437 if (error != start_addr) 438 goto out; 439 440 len = PAGE_ALIGN(ex.a_text + ex.a_data); 441 bss = ex.a_text + ex.a_data + ex.a_bss; 442 if (bss > len) { 443 down_write(¤t->mm->mmap_sem); 444 error = do_brk(start_addr + len, bss - len); 445 up_write(¤t->mm->mmap_sem); 446 retval = error; 447 if (error != start_addr + len) 448 goto out; 449 } 450 retval = 0; 451out: 452 return retval; 453} 454 455static int __init init_aout_binfmt(void) 456{ 457 return register_binfmt(&aout_format); 458} 459 460static void __exit exit_aout_binfmt(void) 461{ 462 unregister_binfmt(&aout_format); 463} 464 465core_initcall(init_aout_binfmt); 466module_exit(exit_aout_binfmt); 467MODULE_LICENSE("GPL"); 468