binfmt_flat.c 27.7 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
Linus Torvalds's avatar
Linus Torvalds committed
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
/****************************************************************************/
/*
 *  linux/fs/binfmt_flat.c
 *
 *	Copyright (C) 2000-2003 David McCullough <davidm@snapgear.com>
 *	Copyright (C) 2002 Greg Ungerer <gerg@snapgear.com>
 *	Copyright (C) 2002 SnapGear, by Paul Dale <pauli@snapgear.com>
 *	Copyright (C) 2000, 2001 Lineo, by David McCullough <davidm@lineo.com>
 *  based heavily on:
 *
 *  linux/fs/binfmt_aout.c:
 *      Copyright (C) 1991, 1992, 1996  Linus Torvalds
 *  linux/fs/binfmt_flat.c for 2.0 kernel
 *	    Copyright (C) 1998  Kenneth Albanowski <kjahds@kjahds.com>
 *	JAN/99 -- coded full program relocation (gerg@snapgear.com)
 */

19 20
#define pr_fmt(fmt)	KBUILD_MODNAME ": " fmt

Linus Torvalds's avatar
Linus Torvalds committed
21 22
#include <linux/kernel.h>
#include <linux/sched.h>
23
#include <linux/sched/task_stack.h>
Linus Torvalds's avatar
Linus Torvalds committed
24 25 26 27 28 29 30 31 32 33 34 35 36 37
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/errno.h>
#include <linux/signal.h>
#include <linux/string.h>
#include <linux/fs.h>
#include <linux/file.h>
#include <linux/ptrace.h>
#include <linux/user.h>
#include <linux/slab.h>
#include <linux/binfmts.h>
#include <linux/personality.h>
#include <linux/init.h>
#include <linux/flat.h>
38
#include <linux/uaccess.h>
39
#include <linux/vmalloc.h>
Linus Torvalds's avatar
Linus Torvalds committed
40 41 42 43

#include <asm/byteorder.h>
#include <asm/unaligned.h>
#include <asm/cacheflush.h>
44
#include <asm/page.h>
Linus Torvalds's avatar
Linus Torvalds committed
45 46 47

/****************************************************************************/

48
/*
49 50 51 52 53 54 55 56 57 58 59
 * User data (data section and bss) needs to be aligned.
 * We pick 0x20 here because it is the max value elf2flt has always
 * used in producing FLAT files, and because it seems to be large
 * enough to make all the gcc alignment related tests happy.
 */
#define FLAT_DATA_ALIGN	(0x20)

/*
 * User data (stack) also needs to be aligned.
 * Here we can be a bit looser than the data sections since this
 * needs to only meet arch ABI requirements.
60
 */
61
#define FLAT_STACK_ALIGN	max_t(unsigned long, sizeof(void *), ARCH_SLAB_MINALIGN)
62

Linus Torvalds's avatar
Linus Torvalds committed
63 64 65 66 67 68 69 70 71 72 73
#define RELOC_FAILED 0xff00ff01		/* Relocation incorrect somewhere */
#define UNLOADED_LIB 0x7ff000ff		/* Placeholder for unused library */

struct lib_info {
	struct {
		unsigned long start_code;		/* Start of text segment */
		unsigned long start_data;		/* Start of data segment */
		unsigned long start_brk;		/* End of data segment */
		unsigned long text_len;			/* Length of text segment */
		unsigned long entry;			/* Start address for this module */
		unsigned long build_date;		/* When this one was compiled */
74
		bool loaded;				/* Has this library been loaded? */
Linus Torvalds's avatar
Linus Torvalds committed
75 76 77 78 79 80 81
	} lib_list[MAX_SHARED_LIBS];
};

#ifdef CONFIG_BINFMT_SHARED_FLAT
static int load_flat_shared_library(int id, struct lib_info *p);
#endif

82
static int load_flat_binary(struct linux_binprm *);
83
static int flat_core_dump(struct coredump_params *cprm);
Linus Torvalds's avatar
Linus Torvalds committed
84 85 86 87 88 89 90 91 92 93 94 95 96 97

static struct linux_binfmt flat_format = {
	.module		= THIS_MODULE,
	.load_binary	= load_flat_binary,
	.core_dump	= flat_core_dump,
	.min_coredump	= PAGE_SIZE
};

/****************************************************************************/
/*
 * Routine writes a core dump image in the current directory.
 * Currently only a stub-function.
 */

98
static int flat_core_dump(struct coredump_params *cprm)
Linus Torvalds's avatar
Linus Torvalds committed
99
{
100 101
	pr_warn("Process %s:%d received signr %d and should have core dumped\n",
		current->comm, current->pid, cprm->siginfo->si_signo);
102
	return 1;
Linus Torvalds's avatar
Linus Torvalds committed
103 104 105 106 107 108
}

/****************************************************************************/
/*
 * create_flat_tables() parses the env- and arg-strings in new user
 * memory and creates the pointer tables from them, and puts their
109
 * addresses on the "stack", recording the new stack pointer value.
Linus Torvalds's avatar
Linus Torvalds committed
110 111
 */

112
static int create_flat_tables(struct linux_binprm *bprm, unsigned long arg_start)
Linus Torvalds's avatar
Linus Torvalds committed
113
{
114 115 116
	char __user *p;
	unsigned long __user *sp;
	long i, len;
Linus Torvalds's avatar
Linus Torvalds committed
117

118 119 120 121 122 123 124 125 126 127 128 129
	p = (char __user *)arg_start;
	sp = (unsigned long __user *)current->mm->start_stack;

	sp -= bprm->envc + 1;
	sp -= bprm->argc + 1;
	sp -= flat_argvp_envp_on_stack() ? 2 : 0;
	sp -= 1;  /* &argc */

	current->mm->start_stack = (unsigned long)sp & -FLAT_STACK_ALIGN;
	sp = (unsigned long __user *)current->mm->start_stack;

	__put_user(bprm->argc, sp++);
Linus Torvalds's avatar
Linus Torvalds committed
130
	if (flat_argvp_envp_on_stack()) {
131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160
		unsigned long argv, envp;
		argv = (unsigned long)(sp + 2);
		envp = (unsigned long)(sp + 2 + bprm->argc + 1);
		__put_user(argv, sp++);
		__put_user(envp, sp++);
	}

	current->mm->arg_start = (unsigned long)p;
	for (i = bprm->argc; i > 0; i--) {
		__put_user((unsigned long)p, sp++);
		len = strnlen_user(p, MAX_ARG_STRLEN);
		if (!len || len > MAX_ARG_STRLEN)
			return -EINVAL;
		p += len;
	}
	__put_user(0, sp++);
	current->mm->arg_end = (unsigned long)p;

	current->mm->env_start = (unsigned long) p;
	for (i = bprm->envc; i > 0; i--) {
		__put_user((unsigned long)p, sp++);
		len = strnlen_user(p, MAX_ARG_STRLEN);
		if (!len || len > MAX_ARG_STRLEN)
			return -EINVAL;
		p += len;
	}
	__put_user(0, sp++);
	current->mm->env_end = (unsigned long)p;

	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179
}

/****************************************************************************/

#ifdef CONFIG_BINFMT_ZFLAT

#include <linux/zlib.h>

#define LBUFSIZE	4000

/* gzip flag byte */
#define ASCII_FLAG   0x01 /* bit 0 set: file probably ASCII text */
#define CONTINUATION 0x02 /* bit 1 set: continuation of multi-part gzip file */
#define EXTRA_FIELD  0x04 /* bit 2 set: extra field present */
#define ORIG_NAME    0x08 /* bit 3 set: original file name present */
#define COMMENT      0x10 /* bit 4 set: file comment present */
#define ENCRYPTED    0x20 /* bit 5 set: file is encrypted */
#define RESERVED     0xC0 /* bit 6,7:   reserved */

180 181
static int decompress_exec(struct linux_binprm *bprm, loff_t fpos, char *dst,
		long len, int fd)
Linus Torvalds's avatar
Linus Torvalds committed
182 183 184 185 186
{
	unsigned char *buf;
	z_stream strm;
	int ret, retval;

187
	pr_debug("decompress_exec(offset=%llx,buf=%p,len=%lx)\n", fpos, dst, len);
Linus Torvalds's avatar
Linus Torvalds committed
188 189 190

	memset(&strm, 0, sizeof(strm));
	strm.workspace = kmalloc(zlib_inflate_workspacesize(), GFP_KERNEL);
191
	if (!strm.workspace)
Linus Torvalds's avatar
Linus Torvalds committed
192
		return -ENOMEM;
193

Linus Torvalds's avatar
Linus Torvalds committed
194
	buf = kmalloc(LBUFSIZE, GFP_KERNEL);
195
	if (!buf) {
Linus Torvalds's avatar
Linus Torvalds committed
196 197 198 199 200
		retval = -ENOMEM;
		goto out_free;
	}

	/* Read in first chunk of data and parse gzip header. */
201
	ret = kernel_read(bprm->file, buf, LBUFSIZE, &fpos);
Linus Torvalds's avatar
Linus Torvalds committed
202 203 204 205 206 207 208 209 210

	strm.next_in = buf;
	strm.avail_in = ret;
	strm.total_in = 0;

	retval = -ENOEXEC;

	/* Check minimum size -- gzip header */
	if (ret < 10) {
211
		pr_debug("file too small?\n");
Linus Torvalds's avatar
Linus Torvalds committed
212 213 214 215 216
		goto out_free_buf;
	}

	/* Check gzip magic number */
	if ((buf[0] != 037) || ((buf[1] != 0213) && (buf[1] != 0236))) {
217
		pr_debug("unknown compression magic?\n");
Linus Torvalds's avatar
Linus Torvalds committed
218 219 220 221 222
		goto out_free_buf;
	}

	/* Check gzip method */
	if (buf[2] != 8) {
223
		pr_debug("unknown compression method?\n");
Linus Torvalds's avatar
Linus Torvalds committed
224 225 226 227 228
		goto out_free_buf;
	}
	/* Check gzip flags */
	if ((buf[3] & ENCRYPTED) || (buf[3] & CONTINUATION) ||
	    (buf[3] & RESERVED)) {
229
		pr_debug("unknown flags?\n");
Linus Torvalds's avatar
Linus Torvalds committed
230 231 232 233 234 235
		goto out_free_buf;
	}

	ret = 10;
	if (buf[3] & EXTRA_FIELD) {
		ret += 2 + buf[10] + (buf[11] << 8);
236
		if (unlikely(ret >= LBUFSIZE)) {
237
			pr_debug("buffer overflow (EXTRA)?\n");
Linus Torvalds's avatar
Linus Torvalds committed
238 239 240 241
			goto out_free_buf;
		}
	}
	if (buf[3] & ORIG_NAME) {
242
		while (ret < LBUFSIZE && buf[ret++] != 0)
Linus Torvalds's avatar
Linus Torvalds committed
243
			;
244
		if (unlikely(ret == LBUFSIZE)) {
245
			pr_debug("buffer overflow (ORIG_NAME)?\n");
Linus Torvalds's avatar
Linus Torvalds committed
246 247 248 249
			goto out_free_buf;
		}
	}
	if (buf[3] & COMMENT) {
250
		while (ret < LBUFSIZE && buf[ret++] != 0)
Linus Torvalds's avatar
Linus Torvalds committed
251
			;
252
		if (unlikely(ret == LBUFSIZE)) {
253
			pr_debug("buffer overflow (COMMENT)?\n");
Linus Torvalds's avatar
Linus Torvalds committed
254 255 256 257 258 259 260 261 262 263 264 265
			goto out_free_buf;
		}
	}

	strm.next_in += ret;
	strm.avail_in -= ret;

	strm.next_out = dst;
	strm.avail_out = len;
	strm.total_out = 0;

	if (zlib_inflateInit2(&strm, -MAX_WBITS) != Z_OK) {
266
		pr_debug("zlib init failed?\n");
Linus Torvalds's avatar
Linus Torvalds committed
267 268 269 270
		goto out_free_buf;
	}

	while ((ret = zlib_inflate(&strm, Z_NO_FLUSH)) == Z_OK) {
271
		ret = kernel_read(bprm->file, buf, LBUFSIZE, &fpos);
Linus Torvalds's avatar
Linus Torvalds committed
272 273 274 275 276 277 278 279 280 281
		if (ret <= 0)
			break;
		len -= ret;

		strm.next_in = buf;
		strm.avail_in = ret;
		strm.total_in = 0;
	}

	if (ret < 0) {
282
		pr_debug("decompression failed (%d), %s\n",
Linus Torvalds's avatar
Linus Torvalds committed
283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318
			ret, strm.msg);
		goto out_zlib;
	}

	retval = 0;
out_zlib:
	zlib_inflateEnd(&strm);
out_free_buf:
	kfree(buf);
out_free:
	kfree(strm.workspace);
	return retval;
}

#endif /* CONFIG_BINFMT_ZFLAT */

/****************************************************************************/

static unsigned long
calc_reloc(unsigned long r, struct lib_info *p, int curid, int internalp)
{
	unsigned long addr;
	int id;
	unsigned long start_brk;
	unsigned long start_data;
	unsigned long text_len;
	unsigned long start_code;

#ifdef CONFIG_BINFMT_SHARED_FLAT
	if (r == 0)
		id = curid;	/* Relocs of 0 are always self referring */
	else {
		id = (r >> 24) & 0xff;	/* Find ID for this reloc */
		r &= 0x00ffffff;	/* Trim ID off here */
	}
	if (id >= MAX_SHARED_LIBS) {
319
		pr_err("reference 0x%lx to shared library %d", r, id);
Linus Torvalds's avatar
Linus Torvalds committed
320 321 322 323
		goto failed;
	}
	if (curid != id) {
		if (internalp) {
324 325
			pr_err("reloc address 0x%lx not in same module "
			       "(%d != %d)", r, curid, id);
Linus Torvalds's avatar
Linus Torvalds committed
326
			goto failed;
327 328
		} else if (!p->lib_list[id].loaded &&
			   load_flat_shared_library(id, p) < 0) {
329
			pr_err("failed to load library %d", id);
Linus Torvalds's avatar
Linus Torvalds committed
330 331 332 333 334
			goto failed;
		}
		/* Check versioning information (i.e. time stamps) */
		if (p->lib_list[id].build_date && p->lib_list[curid].build_date &&
				p->lib_list[curid].build_date < p->lib_list[id].build_date) {
335
			pr_err("library %d is younger than %d", id, curid);
Linus Torvalds's avatar
Linus Torvalds committed
336 337 338 339 340 341 342 343 344 345 346 347 348
			goto failed;
		}
	}
#else
	id = 0;
#endif

	start_brk = p->lib_list[id].start_brk;
	start_data = p->lib_list[id].start_data;
	start_code = p->lib_list[id].start_code;
	text_len = p->lib_list[id].text_len;

	if (!flat_reloc_valid(r, start_brk - start_data + text_len)) {
349
		pr_err("reloc outside program 0x%lx (0 - 0x%lx/0x%lx)",
350
		       r, start_brk-start_data+text_len, text_len);
Linus Torvalds's avatar
Linus Torvalds committed
351 352 353 354 355 356 357 358 359
		goto failed;
	}

	if (r < text_len)			/* In text segment */
		addr = r + start_code;
	else					/* In data segment */
		addr = r - text_len + start_data;

	/* Range checked already above so doing the range tests is redundant...*/
360
	return addr;
Linus Torvalds's avatar
Linus Torvalds committed
361 362

failed:
363
	pr_cont(", killing %s!\n", current->comm);
Linus Torvalds's avatar
Linus Torvalds committed
364 365 366 367 368 369 370
	send_sig(SIGSEGV, current, 0);

	return RELOC_FAILED;
}

/****************************************************************************/

371
static void old_reloc(unsigned long rl)
Linus Torvalds's avatar
Linus Torvalds committed
372
{
373
	static const char *segment[] = { "TEXT", "DATA", "BSS", "*UNKNOWN*" };
Linus Torvalds's avatar
Linus Torvalds committed
374
	flat_v2_reloc_t	r;
375 376
	unsigned long __user *ptr;
	unsigned long val;
377

Linus Torvalds's avatar
Linus Torvalds committed
378 379
	r.value = rl;
#if defined(CONFIG_COLDFIRE)
380
	ptr = (unsigned long __user *)(current->mm->start_code + r.reloc.offset);
Linus Torvalds's avatar
Linus Torvalds committed
381
#else
382
	ptr = (unsigned long __user *)(current->mm->start_data + r.reloc.offset);
Linus Torvalds's avatar
Linus Torvalds committed
383
#endif
384
	get_user(val, ptr);
Linus Torvalds's avatar
Linus Torvalds committed
385

386 387
	pr_debug("Relocation of variable at DATASEG+%x "
		 "(address %p, currently %lx) into segment %s\n",
388
		 r.reloc.offset, ptr, val, segment[r.reloc.type]);
389

Linus Torvalds's avatar
Linus Torvalds committed
390 391
	switch (r.reloc.type) {
	case OLD_FLAT_RELOC_TYPE_TEXT:
392
		val += current->mm->start_code;
Linus Torvalds's avatar
Linus Torvalds committed
393 394
		break;
	case OLD_FLAT_RELOC_TYPE_DATA:
395
		val += current->mm->start_data;
Linus Torvalds's avatar
Linus Torvalds committed
396 397
		break;
	case OLD_FLAT_RELOC_TYPE_BSS:
398
		val += current->mm->end_data;
Linus Torvalds's avatar
Linus Torvalds committed
399 400
		break;
	default:
401
		pr_err("Unknown relocation type=%x\n", r.reloc.type);
Linus Torvalds's avatar
Linus Torvalds committed
402 403
		break;
	}
404
	put_user(val, ptr);
Linus Torvalds's avatar
Linus Torvalds committed
405

406
	pr_debug("Relocation became %lx\n", val);
407
}
Linus Torvalds's avatar
Linus Torvalds committed
408 409 410

/****************************************************************************/

411
static int load_flat_file(struct linux_binprm *bprm,
Linus Torvalds's avatar
Linus Torvalds committed
412 413
		struct lib_info *libinfo, int id, unsigned long *extra_stack)
{
414 415
	struct flat_hdr *hdr;
	unsigned long textpos, datapos, realdatastart;
416
	u32 text_len, data_len, bss_len, stack_len, full_data, flags;
417
	unsigned long len, memp, memp_size, extra, rlim;
418
	u32 __user *reloc, *rp;
Linus Torvalds's avatar
Linus Torvalds committed
419
	struct inode *inode;
420
	int i, rev, relocs;
Linus Torvalds's avatar
Linus Torvalds committed
421 422
	loff_t fpos;
	unsigned long start_code, end_code;
423
	ssize_t result;
424
	int ret;
Linus Torvalds's avatar
Linus Torvalds committed
425 426

	hdr = ((struct flat_hdr *) bprm->buf);		/* exec-header */
Al Viro's avatar
Al Viro committed
427
	inode = file_inode(bprm->file);
Linus Torvalds's avatar
Linus Torvalds committed
428 429 430 431 432 433 434 435 436 437 438 439

	text_len  = ntohl(hdr->data_start);
	data_len  = ntohl(hdr->data_end) - ntohl(hdr->data_start);
	bss_len   = ntohl(hdr->bss_end) - ntohl(hdr->data_end);
	stack_len = ntohl(hdr->stack_size);
	if (extra_stack) {
		stack_len += *extra_stack;
		*extra_stack = stack_len;
	}
	relocs    = ntohl(hdr->reloc_count);
	flags     = ntohl(hdr->flags);
	rev       = ntohl(hdr->rev);
Al Viro's avatar
Al Viro committed
440
	full_data = data_len + relocs * sizeof(unsigned long);
Linus Torvalds's avatar
Linus Torvalds committed
441

442
	if (strncmp(hdr->magic, "bFLT", 4)) {
Linus Torvalds's avatar
Linus Torvalds committed
443
		/*
444 445 446 447
		 * Previously, here was a printk to tell people
		 *   "BINFMT_FLAT: bad header magic".
		 * But for the kernel which also use ELF FD-PIC format, this
		 * error message is confusing.
Linus Torvalds's avatar
Linus Torvalds committed
448 449
		 * because a lot of people do not manage to produce good
		 */
450 451
		ret = -ENOEXEC;
		goto err;
452 453 454
	}

	if (flags & FLAT_FLAG_KTRACE)
455
		pr_info("Loading file: %s\n", bprm->filename);
456 457

	if (rev != FLAT_VERSION && rev != OLD_FLAT_VERSION) {
458 459
		pr_err("bad flat file version 0x%x (supported 0x%lx and 0x%lx)\n",
		       rev, FLAT_VERSION, OLD_FLAT_VERSION);
460 461
		ret = -ENOEXEC;
		goto err;
Linus Torvalds's avatar
Linus Torvalds committed
462
	}
463

Linus Torvalds's avatar
Linus Torvalds committed
464 465
	/* Don't allow old format executables to use shared libraries */
	if (rev == OLD_FLAT_VERSION && id != 0) {
466 467
		pr_err("shared libraries are not available before rev 0x%lx\n",
		       FLAT_VERSION);
468 469
		ret = -ENOEXEC;
		goto err;
Linus Torvalds's avatar
Linus Torvalds committed
470 471
	}

472 473 474 475 476 477 478 479 480 481 482
	/*
	 * Make sure the header params are sane.
	 * 28 bits (256 MB) is way more than reasonable in this case.
	 * If some top bits are set we have probable binary corruption.
	*/
	if ((text_len | data_len | bss_len | stack_len | full_data) >> 28) {
		pr_err("bad header\n");
		ret = -ENOEXEC;
		goto err;
	}

Linus Torvalds's avatar
Linus Torvalds committed
483 484 485 486 487 488 489 490 491
	/*
	 * fix up the flags for the older format,  there were all kinds
	 * of endian hacks,  this only works for the simple cases
	 */
	if (rev == OLD_FLAT_VERSION && flat_old_ram_flag(flags))
		flags = FLAT_FLAG_RAM;

#ifndef CONFIG_BINFMT_ZFLAT
	if (flags & (FLAT_FLAG_GZIP|FLAT_FLAG_GZDATA)) {
492
		pr_err("Support for ZFLAT executables is not enabled.\n");
493 494
		ret = -ENOEXEC;
		goto err;
Linus Torvalds's avatar
Linus Torvalds committed
495 496 497 498 499 500 501 502
	}
#endif

	/*
	 * Check initial limits. This avoids letting people circumvent
	 * size limits imposed on them by creating programs with large
	 * arrays in the data or bss.
	 */
Jiri Slaby's avatar
Jiri Slaby committed
503
	rlim = rlimit(RLIMIT_DATA);
Linus Torvalds's avatar
Linus Torvalds committed
504 505
	if (rlim >= RLIM_INFINITY)
		rlim = ~0;
506 507 508 509 510
	if (data_len + bss_len > rlim) {
		ret = -ENOMEM;
		goto err;
	}

Linus Torvalds's avatar
Linus Torvalds committed
511 512
	/* Flush all traces of the currently running executable */
	if (id == 0) {
513 514
		ret = flush_old_exec(bprm);
		if (ret)
515
			goto err;
Linus Torvalds's avatar
Linus Torvalds committed
516 517

		/* OK, This is the point of no return */
518
		set_personality(PER_LINUX_32BIT);
519
		setup_new_exec(bprm);
Linus Torvalds's avatar
Linus Torvalds committed
520 521 522 523 524
	}

	/*
	 * calculate the extra space we need to map in
	 */
525 526
	extra = max_t(unsigned long, bss_len + stack_len,
			relocs * sizeof(unsigned long));
Linus Torvalds's avatar
Linus Torvalds committed
527 528 529 530 531 532

	/*
	 * there are a couple of cases here,  the separate code/data
	 * case,  and then the fully copied to RAM case which lumps
	 * it all together.
	 */
533
	if (!IS_ENABLED(CONFIG_MMU) && !(flags & (FLAT_FLAG_RAM|FLAT_FLAG_GZIP))) {
Linus Torvalds's avatar
Linus Torvalds committed
534 535 536 537
		/*
		 * this should give us a ROM ptr,  but if it doesn't we don't
		 * really care
		 */
538
		pr_debug("ROM mapping of file (we hope)\n");
Linus Torvalds's avatar
Linus Torvalds committed
539

540
		textpos = vm_mmap(bprm->file, 0, text_len, PROT_READ|PROT_EXEC,
Matt Helsley's avatar
Matt Helsley committed
541
				  MAP_PRIVATE|MAP_EXECUTABLE, 0);
542
		if (!textpos || IS_ERR_VALUE(textpos)) {
543
			ret = textpos;
544 545
			if (!textpos)
				ret = -ENOMEM;
546
			pr_err("Unable to mmap process text, errno %d\n", ret);
547
			goto err;
Linus Torvalds's avatar
Linus Torvalds committed
548 549
		}

550
		len = data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long);
551
		len = PAGE_ALIGN(len);
552
		realdatastart = vm_mmap(NULL, 0, len,
553
			PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
Linus Torvalds's avatar
Linus Torvalds committed
554

555
		if (realdatastart == 0 || IS_ERR_VALUE(realdatastart)) {
556
			ret = realdatastart;
Linus Torvalds's avatar
Linus Torvalds committed
557
			if (!realdatastart)
558
				ret = -ENOMEM;
559
			pr_err("Unable to allocate RAM for process data, "
560
			       "errno %d\n", ret);
561
			vm_munmap(textpos, text_len);
562
			goto err;
Linus Torvalds's avatar
Linus Torvalds committed
563
		}
564 565 566
		datapos = ALIGN(realdatastart +
				MAX_SHARED_LIBS * sizeof(unsigned long),
				FLAT_DATA_ALIGN);
Linus Torvalds's avatar
Linus Torvalds committed
567

568
		pr_debug("Allocated data+bss+stack (%u bytes): %lx\n",
569
			 data_len + bss_len + stack_len, datapos);
Linus Torvalds's avatar
Linus Torvalds committed
570 571 572 573

		fpos = ntohl(hdr->data_start);
#ifdef CONFIG_BINFMT_ZFLAT
		if (flags & FLAT_FLAG_GZDATA) {
574
			result = decompress_exec(bprm, fpos, (char *)datapos,
Al Viro's avatar
Al Viro committed
575
						 full_data, 0);
Linus Torvalds's avatar
Linus Torvalds committed
576 577 578
		} else
#endif
		{
Al Viro's avatar
Al Viro committed
579 580
			result = read_code(bprm->file, datapos, fpos,
					full_data);
Linus Torvalds's avatar
Linus Torvalds committed
581
		}
582
		if (IS_ERR_VALUE(result)) {
583
			ret = result;
584
			pr_err("Unable to read data+bss, errno %d\n", ret);
585 586
			vm_munmap(textpos, text_len);
			vm_munmap(realdatastart, len);
587
			goto err;
Linus Torvalds's avatar
Linus Torvalds committed
588 589
		}

590
		reloc = (u32 __user *)
591
			(datapos + (ntohl(hdr->reloc_start) - text_len));
Linus Torvalds's avatar
Linus Torvalds committed
592
		memp = realdatastart;
593
		memp_size = len;
Linus Torvalds's avatar
Linus Torvalds committed
594 595
	} else {

596
		len = text_len + data_len + extra + MAX_SHARED_LIBS * sizeof(u32);
597
		len = PAGE_ALIGN(len);
598
		textpos = vm_mmap(NULL, 0, len,
599 600
			PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);

601
		if (!textpos || IS_ERR_VALUE(textpos)) {
602
			ret = textpos;
603 604
			if (!textpos)
				ret = -ENOMEM;
605
			pr_err("Unable to allocate RAM for process text/data, "
606
			       "errno %d\n", ret);
607
			goto err;
Linus Torvalds's avatar
Linus Torvalds committed
608 609 610
		}

		realdatastart = textpos + ntohl(hdr->data_start);
611
		datapos = ALIGN(realdatastart +
612
				MAX_SHARED_LIBS * sizeof(u32),
613 614
				FLAT_DATA_ALIGN);

615
		reloc = (u32 __user *)
616
			(datapos + (ntohl(hdr->reloc_start) - text_len));
Linus Torvalds's avatar
Linus Torvalds committed
617
		memp = textpos;
618
		memp_size = len;
Linus Torvalds's avatar
Linus Torvalds committed
619 620 621 622 623
#ifdef CONFIG_BINFMT_ZFLAT
		/*
		 * load it all in and treat it like a RAM load from now on
		 */
		if (flags & FLAT_FLAG_GZIP) {
624
#ifndef CONFIG_MMU
625 626
			result = decompress_exec(bprm, sizeof(struct flat_hdr),
					 (((char *)textpos) + sizeof(struct flat_hdr)),
Al Viro's avatar
Al Viro committed
627
					 (text_len + full_data
628
						  - sizeof(struct flat_hdr)),
Linus Torvalds's avatar
Linus Torvalds committed
629 630
					 0);
			memmove((void *) datapos, (void *) realdatastart,
Al Viro's avatar
Al Viro committed
631
					full_data);
632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653
#else
			/*
			 * This is used on MMU systems mainly for testing.
			 * Let's use a kernel buffer to simplify things.
			 */
			long unz_text_len = text_len - sizeof(struct flat_hdr);
			long unz_len = unz_text_len + full_data;
			char *unz_data = vmalloc(unz_len);
			if (!unz_data) {
				result = -ENOMEM;
			} else {
				result = decompress_exec(bprm, sizeof(struct flat_hdr),
							 unz_data, unz_len, 0);
				if (result == 0 &&
				    (copy_to_user((void __user *)textpos + sizeof(struct flat_hdr),
						  unz_data, unz_text_len) ||
				     copy_to_user((void __user *)datapos,
						  unz_data + unz_text_len, full_data)))
					result = -EFAULT;
				vfree(unz_data);
			}
#endif
Linus Torvalds's avatar
Linus Torvalds committed
654
		} else if (flags & FLAT_FLAG_GZDATA) {
Al Viro's avatar
Al Viro committed
655
			result = read_code(bprm->file, textpos, 0, text_len);
656 657
			if (!IS_ERR_VALUE(result)) {
#ifndef CONFIG_MMU
Linus Torvalds's avatar
Linus Torvalds committed
658
				result = decompress_exec(bprm, text_len, (char *) datapos,
Al Viro's avatar
Al Viro committed
659
						 full_data, 0);
660 661 662 663 664 665 666 667 668 669 670 671 672
#else
				char *unz_data = vmalloc(full_data);
				if (!unz_data) {
					result = -ENOMEM;
				} else {
					result = decompress_exec(bprm, text_len,
						       unz_data, full_data, 0);
					if (result == 0 &&
					    copy_to_user((void __user *)datapos,
							 unz_data, full_data))
						result = -EFAULT;
					vfree(unz_data);
				}
Linus Torvalds's avatar
Linus Torvalds committed
673
#endif
674 675 676
			}
		} else
#endif /* CONFIG_BINFMT_ZFLAT */
Linus Torvalds's avatar
Linus Torvalds committed
677
		{
Al Viro's avatar
Al Viro committed
678 679 680 681 682
			result = read_code(bprm->file, textpos, 0, text_len);
			if (!IS_ERR_VALUE(result))
				result = read_code(bprm->file, datapos,
						   ntohl(hdr->data_start),
						   full_data);
Linus Torvalds's avatar
Linus Torvalds committed
683
		}
684
		if (IS_ERR_VALUE(result)) {
685
			ret = result;
686
			pr_err("Unable to read code+data+bss, errno %d\n", ret);
687
			vm_munmap(textpos, text_len + data_len + extra +
688
				MAX_SHARED_LIBS * sizeof(u32));
689
			goto err;
Linus Torvalds's avatar
Linus Torvalds committed
690 691 692
		}
	}

693 694 695
	start_code = textpos + sizeof(struct flat_hdr);
	end_code = textpos + text_len;
	text_len -= sizeof(struct flat_hdr); /* the real code len */
Linus Torvalds's avatar
Linus Torvalds committed
696 697 698 699 700 701 702 703 704 705 706

	/* The main program needs a little extra setup in the task structure */
	if (id == 0) {
		current->mm->start_code = start_code;
		current->mm->end_code = end_code;
		current->mm->start_data = datapos;
		current->mm->end_data = datapos + data_len;
		/*
		 * set up the brk stuff, uses any slack left in data/bss/stack
		 * allocation.  We put the brk after the bss (between the bss
		 * and stack) like other platforms.
707 708
		 * Userspace code relies on the stack pointer starting out at
		 * an address right at the end of a page.
Linus Torvalds's avatar
Linus Torvalds committed
709 710 711
		 */
		current->mm->start_brk = datapos + data_len + bss_len;
		current->mm->brk = (current->mm->start_brk + 3) & ~3;
712
#ifndef CONFIG_MMU
713
		current->mm->context.end_brk = memp + memp_size - stack_len;
714
#endif
Linus Torvalds's avatar
Linus Torvalds committed
715 716
	}

717
	if (flags & FLAT_FLAG_KTRACE) {
718 719 720 721 722 723
		pr_info("Mapping is %lx, Entry point is %x, data_start is %x\n",
			textpos, 0x00ffffff&ntohl(hdr->entry), ntohl(hdr->data_start));
		pr_info("%s %s: TEXT=%lx-%lx DATA=%lx-%lx BSS=%lx-%lx\n",
			id ? "Lib" : "Load", bprm->filename,
			start_code, end_code, datapos, datapos + data_len,
			datapos + data_len, (datapos + data_len + bss_len + 3) & ~3);
724
	}
Linus Torvalds's avatar
Linus Torvalds committed
725 726 727 728 729 730 731 732 733

	/* Store the current module values into the global library structure */
	libinfo->lib_list[id].start_code = start_code;
	libinfo->lib_list[id].start_data = datapos;
	libinfo->lib_list[id].start_brk = datapos + data_len + bss_len;
	libinfo->lib_list[id].text_len = text_len;
	libinfo->lib_list[id].loaded = 1;
	libinfo->lib_list[id].entry = (0x00ffffff & ntohl(hdr->entry)) + textpos;
	libinfo->lib_list[id].build_date = ntohl(hdr->build_date);
734

Linus Torvalds's avatar
Linus Torvalds committed
735 736 737 738 739
	/*
	 * We just load the allocations into some temporary memory to
	 * help simplify all this mumbo jumbo
	 *
	 * We've got two different sections of relocation entries.
740
	 * The first is the GOT which resides at the beginning of the data segment
Linus Torvalds's avatar
Linus Torvalds committed
741 742 743 744 745 746 747
	 * and is terminated with a -1.  This one can be relocated in place.
	 * The second is the extra relocation entries tacked after the image's
	 * data segment. These require a little more processing as the entry is
	 * really an offset into the image which contains an offset into the
	 * image.
	 */
	if (flags & FLAT_FLAG_GOTPIC) {
748 749
		for (rp = (u32 __user *)datapos; ; rp++) {
			u32 addr, rp_val;
750 751 752 753 754 755
			if (get_user(rp_val, rp))
				return -EFAULT;
			if (rp_val == 0xffffffff)
				break;
			if (rp_val) {
				addr = calc_reloc(rp_val, libinfo, id, 0);
756 757
				if (addr == RELOC_FAILED) {
					ret = -ENOEXEC;
758
					goto err;
759
				}
760 761
				if (put_user(addr, rp))
					return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777
			}
		}
	}

	/*
	 * Now run through the relocation entries.
	 * We've got to be careful here as C++ produces relocatable zero
	 * entries in the constructor and destructor tables which are then
	 * tested for being not zero (which will always occur unless we're
	 * based from address zero).  This causes an endless loop as __start
	 * is at zero.  The solution used is to not relocate zero addresses.
	 * This has the negative side effect of not allowing a global data
	 * reference to be statically initialised to _stext (I've moved
	 * __start to address 4 so that is okay).
	 */
	if (rev > OLD_FLAT_VERSION) {
778
		u32 __maybe_unused persistent = 0;
779
		for (i = 0; i < relocs; i++) {
780
			u32 addr, relval;
Linus Torvalds's avatar
Linus Torvalds committed
781

782 783 784 785 786
			/*
			 * Get the address of the pointer to be
			 * relocated (of course, the address has to be
			 * relocated first).
			 */
787 788 789
			if (get_user(relval, reloc + i))
				return -EFAULT;
			relval = ntohl(relval);
790
			if (flat_set_persistent(relval, &persistent))
791
				continue;
Linus Torvalds's avatar
Linus Torvalds committed
792
			addr = flat_get_relocate_addr(relval);
793 794
			rp = (u32 __user *)calc_reloc(addr, libinfo, id, 1);
			if (rp == (u32 __user *)RELOC_FAILED) {
795
				ret = -ENOEXEC;
796
				goto err;
797
			}
Linus Torvalds's avatar
Linus Torvalds committed
798 799

			/* Get the pointer's value.  */
800 801 802 803 804
			ret = flat_get_addr_from_rp(rp, relval, flags,
							&addr, &persistent);
			if (unlikely(ret))
				goto err;

Linus Torvalds's avatar
Linus Torvalds committed
805 806 807 808 809 810 811 812
			if (addr != 0) {
				/*
				 * Do the relocation.  PIC relocs in the data section are
				 * already in target order
				 */
				if ((flags & FLAT_FLAG_GOTPIC) == 0)
					addr = ntohl(addr);
				addr = calc_reloc(addr, libinfo, id, 0);
813 814
				if (addr == RELOC_FAILED) {
					ret = -ENOEXEC;
815
					goto err;
816
				}
Linus Torvalds's avatar
Linus Torvalds committed
817 818

				/* Write back the relocated pointer.  */
819 820 821
				ret = flat_put_addr_at_rp(rp, addr, relval);
				if (unlikely(ret))
					goto err;
Linus Torvalds's avatar
Linus Torvalds committed
822 823 824
			}
		}
	} else {
825
		for (i = 0; i < relocs; i++) {
826
			u32 relval;
827 828 829 830 831
			if (get_user(relval, reloc + i))
				return -EFAULT;
			relval = ntohl(relval);
			old_reloc(relval);
		}
Linus Torvalds's avatar
Linus Torvalds committed
832
	}
833

Linus Torvalds's avatar
Linus Torvalds committed
834 835 836
	flush_icache_range(start_code, end_code);

	/* zero the BSS,  BRK and stack areas */
837 838 839 840 841
	if (clear_user((void __user *)(datapos + data_len), bss_len +
		       (memp + memp_size - stack_len -		/* end brk */
		       libinfo->lib_list[id].start_brk) +	/* start brk */
		       stack_len))
		return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
842 843

	return 0;
844 845
err:
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862
}


/****************************************************************************/
#ifdef CONFIG_BINFMT_SHARED_FLAT

/*
 * Load a shared library into memory.  The library gets its own data
 * segment (including bss) but not argv/argc/environ.
 */

static int load_flat_shared_library(int id, struct lib_info *libs)
{
	struct linux_binprm bprm;
	int res;
	char buf[16];

863 864
	memset(&bprm, 0, sizeof(bprm));

Linus Torvalds's avatar
Linus Torvalds committed
865 866 867 868 869 870 871 872 873 874
	/* Create the file name */
	sprintf(buf, "/lib/lib%d.so", id);

	/* Open the file up */
	bprm.filename = buf;
	bprm.file = open_exec(bprm.filename);
	res = PTR_ERR(bprm.file);
	if (IS_ERR(bprm.file))
		return res;

875 876 877 878 879
	bprm.cred = prepare_exec_creds();
	res = -ENOMEM;
	if (!bprm.cred)
		goto out;

880 881 882 883
	/* We don't really care about recalculating credentials at this point
	 * as we're past the point of no return and are dealing with shared
	 * libraries.
	 */
884
	bprm.called_set_creds = 1;
885

Linus Torvalds's avatar
Linus Torvalds committed
886 887
	res = prepare_binprm(&bprm);

888
	if (!res)
Linus Torvalds's avatar
Linus Torvalds committed
889
		res = load_flat_file(&bprm, libs, id, NULL);
890 891 892 893 894 895 896

	abort_creds(bprm.cred);

out:
	allow_write_access(bprm.file);
	fput(bprm.file);

897
	return res;
Linus Torvalds's avatar
Linus Torvalds committed
898 899 900 901 902 903 904 905 906 907
}

#endif /* CONFIG_BINFMT_SHARED_FLAT */
/****************************************************************************/

/*
 * These are the functions used to load flat style executables and shared
 * libraries.  There is no binary dependent code anywhere else.
 */

908
static int load_flat_binary(struct linux_binprm *bprm)
Linus Torvalds's avatar
Linus Torvalds committed
909 910
{
	struct lib_info libinfo;
911
	struct pt_regs *regs = current_pt_regs();
912
	unsigned long stack_len = 0;
Linus Torvalds's avatar
Linus Torvalds committed
913 914 915 916 917
	unsigned long start_addr;
	int res;
	int i, j;

	memset(&libinfo, 0, sizeof(libinfo));
918

Linus Torvalds's avatar
Linus Torvalds committed
919 920 921 922 923 924 925
	/*
	 * We have to add the size of our arguments to our stack size
	 * otherwise it's too easy for users to create stack overflows
	 * by passing in a huge argument list.  And yes,  we have to be
	 * pedantic and include space for the argv/envp array as it may have
	 * a lot of entries.
	 */
926 927 928
#ifndef CONFIG_MMU
	stack_len += PAGE_SIZE * MAX_ARG_PAGES - bprm->p; /* the strings */
#endif
929 930 931
	stack_len += (bprm->argc + 1) * sizeof(char *);   /* the argv array */
	stack_len += (bprm->envc + 1) * sizeof(char *);   /* the envp array */
	stack_len = ALIGN(stack_len, FLAT_STACK_ALIGN);
932

Linus Torvalds's avatar
Linus Torvalds committed
933
	res = load_flat_file(bprm, &libinfo, 0, &stack_len);
934
	if (res < 0)
Linus Torvalds's avatar
Linus Torvalds committed
935
		return res;
936

Linus Torvalds's avatar
Linus Torvalds committed
937
	/* Update data segment pointers for all libraries */
938 939 940 941 942 943 944 945 946 947 948 949 950
	for (i = 0; i < MAX_SHARED_LIBS; i++) {
		if (!libinfo.lib_list[i].loaded)
			continue;
		for (j = 0; j < MAX_SHARED_LIBS; j++) {
			unsigned long val = libinfo.lib_list[j].loaded ?
				libinfo.lib_list[j].start_data : UNLOADED_LIB;
			unsigned long __user *p = (unsigned long __user *)
				libinfo.lib_list[i].start_data;
			p -= j + 1;
			if (put_user(val, p))
				return -EFAULT;
		}
	}
Linus Torvalds's avatar
Linus Torvalds committed
951

952
	install_exec_creds(bprm);
Linus Torvalds's avatar
Linus Torvalds committed
953 954 955

	set_binfmt(&flat_format);

956 957 958 959 960
#ifdef CONFIG_MMU
	res = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
	if (!res)
		res = create_flat_tables(bprm, bprm->p);
#else
961 962 963 964
	/* Stash our initial stack pointer into the mm structure */
	current->mm->start_stack =
		((current->mm->context.end_brk + stack_len + 3) & ~3) - 4;
	pr_debug("sp=%lx\n", current->mm->start_stack);
Linus Torvalds's avatar
Linus Torvalds committed
965

966
	/* copy the arg pages onto the stack */
967 968 969
	res = transfer_args_to_stack(bprm, &current->mm->start_stack);
	if (!res)
		res = create_flat_tables(bprm, current->mm->start_stack);
970
#endif
971 972
	if (res)
		return res;
Linus Torvalds's avatar
Linus Torvalds committed
973 974 975 976 977 978 979 980

	/* Fake some return addresses to ensure the call chain will
	 * initialise library in order for us.  We are required to call
	 * lib 1 first, then 2, ... and finally the main program (id 0).
	 */
	start_addr = libinfo.lib_list[0].entry;

#ifdef CONFIG_BINFMT_SHARED_FLAT
981
	for (i = MAX_SHARED_LIBS-1; i > 0; i--) {
Linus Torvalds's avatar
Linus Torvalds committed
982 983
		if (libinfo.lib_list[i].loaded) {
			/* Push previos first to call address */
984 985 986 987
			unsigned long __user *sp;
			current->mm->start_stack -= sizeof(unsigned long);
			sp = (unsigned long __user *)current->mm->start_stack;
			__put_user(start_addr, sp);
Linus Torvalds's avatar
Linus Torvalds committed
988 989 990 991
			start_addr = libinfo.lib_list[i].entry;
		}
	}
#endif
992

993 994 995
#ifdef FLAT_PLAT_INIT
	FLAT_PLAT_INIT(regs);
#endif
996

997
	finalize_exec(bprm);
998 999
	pr_debug("start_thread(regs=0x%p, entry=0x%lx, start_stack=0x%lx)\n",
		 regs, start_addr, current->mm->start_stack);
Linus Torvalds's avatar
Linus Torvalds committed
1000 1001 1002 1003 1004 1005 1006 1007 1008
	start_thread(regs, start_addr, current->mm->start_stack);

	return 0;
}

/****************************************************************************/

static int __init init_flat_binfmt(void)
{
Al Viro's avatar
Al Viro committed
1009 1010
	register_binfmt(&flat_format);
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
1011 1012 1013 1014
}
core_initcall(init_flat_binfmt);

/****************************************************************************/