1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  linux/fs/exec.c
   4 *
   5 *  Copyright (C) 1991, 1992  Linus Torvalds
   6 */
   7
   8/*
   9 * #!-checking implemented by tytso.
  10 */
  11/*
  12 * Demand-loading implemented 01.12.91 - no need to read anything but
  13 * the header into memory. The inode of the executable is put into
  14 * "current->executable", and page faults do the actual loading. Clean.
  15 *
  16 * Once more I can proudly say that linux stood up to being changed: it
  17 * was less than 2 hours work to get demand-loading completely implemented.
  18 *
  19 * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
  20 * current->executable is only used by the procfs.  This allows a dispatch
  21 * table to check for several different types  of binary formats.  We keep
  22 * trying until we recognize the file or we run out of supported binary
  23 * formats.
  24 */
  25
  26#include <linux/kernel_read_file.h>
  27#include <linux/slab.h>
  28#include <linux/file.h>
  29#include <linux/fdtable.h>
  30#include <linux/mm.h>
  31#include <linux/stat.h>
  32#include <linux/fcntl.h>
  33#include <linux/swap.h>
  34#include <linux/string.h>
  35#include <linux/init.h>
  36#include <linux/sched/mm.h>
  37#include <linux/sched/coredump.h>
  38#include <linux/sched/signal.h>
  39#include <linux/sched/numa_balancing.h>
  40#include <linux/sched/task.h>
  41#include <linux/pagemap.h>
  42#include <linux/perf_event.h>
  43#include <linux/highmem.h>
  44#include <linux/spinlock.h>
  45#include <linux/key.h>
  46#include <linux/personality.h>
  47#include <linux/binfmts.h>
  48#include <linux/utsname.h>
  49#include <linux/pid_namespace.h>
  50#include <linux/module.h>
  51#include <linux/namei.h>
  52#include <linux/mount.h>
  53#include <linux/security.h>
  54#include <linux/syscalls.h>
  55#include <linux/tsacct_kern.h>
  56#include <linux/cn_proc.h>
  57#include <linux/audit.h>
 
  58#include <linux/kmod.h>
  59#include <linux/fsnotify.h>
  60#include <linux/fs_struct.h>
 
  61#include <linux/oom.h>
  62#include <linux/compat.h>
  63#include <linux/vmalloc.h>
  64#include <linux/io_uring.h>
  65#include <linux/syscall_user_dispatch.h>
  66#include <linux/coredump.h>
  67#include <linux/time_namespace.h>
  68#include <linux/user_events.h>
  69#include <linux/rseq.h>
  70#include <linux/ksm.h>
  71
  72#include <linux/uaccess.h>
  73#include <asm/mmu_context.h>
  74#include <asm/tlb.h>
  75
  76#include <trace/events/task.h>
  77#include "internal.h"
  78
  79#include <trace/events/sched.h>
 
 
 
  80
  81static int bprm_creds_from_file(struct linux_binprm *bprm);
 
 
 
 
  82
  83int suid_dumpable = 0;
  84
  85static LIST_HEAD(formats);
  86static DEFINE_RWLOCK(binfmt_lock);
  87
  88void __register_binfmt(struct linux_binfmt * fmt, int insert)
  89{
 
 
  90	write_lock(&binfmt_lock);
  91	insert ? list_add(&fmt->lh, &formats) :
  92		 list_add_tail(&fmt->lh, &formats);
  93	write_unlock(&binfmt_lock);
 
  94}
  95
  96EXPORT_SYMBOL(__register_binfmt);
  97
  98void unregister_binfmt(struct linux_binfmt * fmt)
  99{
 100	write_lock(&binfmt_lock);
 101	list_del(&fmt->lh);
 102	write_unlock(&binfmt_lock);
 103}
 104
 105EXPORT_SYMBOL(unregister_binfmt);
 106
 107static inline void put_binfmt(struct linux_binfmt * fmt)
 108{
 109	module_put(fmt->module);
 110}
 111
 112bool path_noexec(const struct path *path)
 113{
 114	return (path->mnt->mnt_flags & MNT_NOEXEC) ||
 115	       (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC);
 116}
 117
 118#ifdef CONFIG_USELIB
 119/*
 120 * Note that a shared library must be both readable and executable due to
 121 * security reasons.
 122 *
 123 * Also note that we take the address to load from the file itself.
 124 */
 125SYSCALL_DEFINE1(uselib, const char __user *, library)
 126{
 127	struct linux_binfmt *fmt;
 128	struct file *file;
 129	struct filename *tmp = getname(library);
 130	int error = PTR_ERR(tmp);
 131	static const struct open_flags uselib_flags = {
 132		.open_flag = O_LARGEFILE | O_RDONLY,
 133		.acc_mode = MAY_READ | MAY_EXEC,
 134		.intent = LOOKUP_OPEN,
 135		.lookup_flags = LOOKUP_FOLLOW,
 136	};
 137
 138	if (IS_ERR(tmp))
 139		goto out;
 140
 141	file = do_filp_open(AT_FDCWD, tmp, &uselib_flags);
 142	putname(tmp);
 143	error = PTR_ERR(file);
 144	if (IS_ERR(file))
 145		goto out;
 146
 147	/*
 148	 * Check do_open_execat() for an explanation.
 149	 */
 
 150	error = -EACCES;
 151	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) ||
 152	    path_noexec(&file->f_path))
 153		goto exit;
 154
 
 
 155	error = -ENOEXEC;
 
 
 156
 157	read_lock(&binfmt_lock);
 158	list_for_each_entry(fmt, &formats, lh) {
 159		if (!fmt->load_shlib)
 160			continue;
 161		if (!try_module_get(fmt->module))
 162			continue;
 163		read_unlock(&binfmt_lock);
 164		error = fmt->load_shlib(file);
 165		read_lock(&binfmt_lock);
 166		put_binfmt(fmt);
 167		if (error != -ENOEXEC)
 168			break;
 
 
 
 
 
 
 
 
 
 
 169	}
 170	read_unlock(&binfmt_lock);
 171exit:
 172	fput(file);
 173out:
 174	return error;
 175}
 176#endif /* #ifdef CONFIG_USELIB */
 177
 178#ifdef CONFIG_MMU
 179/*
 180 * The nascent bprm->mm is not visible until exec_mmap() but it can
 181 * use a lot of memory, account these pages in current->mm temporary
 182 * for oom_badness()->get_mm_rss(). Once exec succeeds or fails, we
 183 * change the counter back via acct_arg_size(0).
 184 */
 185static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
 186{
 187	struct mm_struct *mm = current->mm;
 188	long diff = (long)(pages - bprm->vma_pages);
 189
 190	if (!mm || !diff)
 191		return;
 192
 193	bprm->vma_pages = pages;
 194	add_mm_counter(mm, MM_ANONPAGES, diff);
 195}
 196
 197static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
 198		int write)
 199{
 200	struct page *page;
 201	struct vm_area_struct *vma = bprm->vma;
 202	struct mm_struct *mm = bprm->mm;
 203	int ret;
 204
 205	/*
 206	 * Avoid relying on expanding the stack down in GUP (which
 207	 * does not work for STACK_GROWSUP anyway), and just do it
 208	 * by hand ahead of time.
 209	 */
 210	if (write && pos < vma->vm_start) {
 211		mmap_write_lock(mm);
 212		ret = expand_downwards(vma, pos);
 213		if (unlikely(ret < 0)) {
 214			mmap_write_unlock(mm);
 215			return NULL;
 216		}
 217		mmap_write_downgrade(mm);
 218	} else
 219		mmap_read_lock(mm);
 220
 221	/*
 222	 * We are doing an exec().  'current' is the process
 223	 * doing the exec and 'mm' is the new process's mm.
 224	 */
 225	ret = get_user_pages_remote(mm, pos, 1,
 226			write ? FOLL_WRITE : 0,
 227			&page, NULL);
 228	mmap_read_unlock(mm);
 229	if (ret <= 0)
 230		return NULL;
 231
 232	if (write)
 233		acct_arg_size(bprm, vma_pages(vma));
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 234
 235	return page;
 236}
 237
 238static void put_arg_page(struct page *page)
 239{
 240	put_page(page);
 241}
 242
 
 
 
 
 243static void free_arg_pages(struct linux_binprm *bprm)
 244{
 245}
 246
 247static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
 248		struct page *page)
 249{
 250	flush_cache_page(bprm->vma, pos, page_to_pfn(page));
 251}
 252
 253static int __bprm_mm_init(struct linux_binprm *bprm)
 254{
 255	int err;
 256	struct vm_area_struct *vma = NULL;
 257	struct mm_struct *mm = bprm->mm;
 258
 259	bprm->vma = vma = vm_area_alloc(mm);
 260	if (!vma)
 261		return -ENOMEM;
 262	vma_set_anonymous(vma);
 263
 264	if (mmap_write_lock_killable(mm)) {
 265		err = -EINTR;
 266		goto err_free;
 267	}
 268
 269	/*
 270	 * Need to be called with mmap write lock
 271	 * held, to avoid race with ksmd.
 272	 */
 273	err = ksm_execve(mm);
 274	if (err)
 275		goto err_ksm;
 276
 277	/*
 278	 * Place the stack at the largest stack address the architecture
 279	 * supports. Later, we'll move this to an appropriate place. We don't
 280	 * use STACK_TOP because that can depend on attributes which aren't
 281	 * configured yet.
 282	 */
 283	BUILD_BUG_ON(VM_STACK_FLAGS & VM_STACK_INCOMPLETE_SETUP);
 284	vma->vm_end = STACK_TOP_MAX;
 285	vma->vm_start = vma->vm_end - PAGE_SIZE;
 286	vm_flags_init(vma, VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP);
 287	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
 
 
 
 
 
 288
 289	err = insert_vm_struct(mm, vma);
 290	if (err)
 291		goto err;
 292
 293	mm->stack_vm = mm->total_vm = 1;
 294	mmap_write_unlock(mm);
 295	bprm->p = vma->vm_end - sizeof(void *);
 296	return 0;
 297err:
 298	ksm_exit(mm);
 299err_ksm:
 300	mmap_write_unlock(mm);
 301err_free:
 302	bprm->vma = NULL;
 303	vm_area_free(vma);
 304	return err;
 305}
 306
 307static bool valid_arg_len(struct linux_binprm *bprm, long len)
 308{
 309	return len <= MAX_ARG_STRLEN;
 310}
 311
 312#else
 313
 314static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
 315{
 316}
 317
 318static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
 319		int write)
 320{
 321	struct page *page;
 322
 323	page = bprm->page[pos / PAGE_SIZE];
 324	if (!page && write) {
 325		page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
 326		if (!page)
 327			return NULL;
 328		bprm->page[pos / PAGE_SIZE] = page;
 329	}
 330
 331	return page;
 332}
 333
 334static void put_arg_page(struct page *page)
 335{
 336}
 337
 338static void free_arg_page(struct linux_binprm *bprm, int i)
 339{
 340	if (bprm->page[i]) {
 341		__free_page(bprm->page[i]);
 342		bprm->page[i] = NULL;
 343	}
 344}
 345
 346static void free_arg_pages(struct linux_binprm *bprm)
 347{
 348	int i;
 349
 350	for (i = 0; i < MAX_ARG_PAGES; i++)
 351		free_arg_page(bprm, i);
 352}
 353
 354static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
 355		struct page *page)
 356{
 357}
 358
 359static int __bprm_mm_init(struct linux_binprm *bprm)
 360{
 361	bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
 362	return 0;
 363}
 364
 365static bool valid_arg_len(struct linux_binprm *bprm, long len)
 366{
 367	return len <= bprm->p;
 368}
 369
 370#endif /* CONFIG_MMU */
 371
 372/*
 373 * Create a new mm_struct and populate it with a temporary stack
 374 * vm_area_struct.  We don't have enough context at this point to set the stack
 375 * flags, permissions, and offset, so we use temporary values.  We'll update
 376 * them later in setup_arg_pages().
 377 */
 378static int bprm_mm_init(struct linux_binprm *bprm)
 379{
 380	int err;
 381	struct mm_struct *mm = NULL;
 382
 383	bprm->mm = mm = mm_alloc();
 384	err = -ENOMEM;
 385	if (!mm)
 386		goto err;
 387
 388	/* Save current stack limit for all calculations made during exec. */
 389	task_lock(current->group_leader);
 390	bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];
 391	task_unlock(current->group_leader);
 392
 393	err = __bprm_mm_init(bprm);
 394	if (err)
 395		goto err;
 396
 397	return 0;
 398
 399err:
 400	if (mm) {
 401		bprm->mm = NULL;
 402		mmdrop(mm);
 403	}
 404
 405	return err;
 406}
 407
 408struct user_arg_ptr {
 409#ifdef CONFIG_COMPAT
 410	bool is_compat;
 411#endif
 412	union {
 413		const char __user *const __user *native;
 414#ifdef CONFIG_COMPAT
 415		const compat_uptr_t __user *compat;
 416#endif
 417	} ptr;
 418};
 419
 420static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
 421{
 422	const char __user *native;
 423
 424#ifdef CONFIG_COMPAT
 425	if (unlikely(argv.is_compat)) {
 426		compat_uptr_t compat;
 427
 428		if (get_user(compat, argv.ptr.compat + nr))
 429			return ERR_PTR(-EFAULT);
 430
 431		return compat_ptr(compat);
 432	}
 433#endif
 434
 435	if (get_user(native, argv.ptr.native + nr))
 436		return ERR_PTR(-EFAULT);
 437
 438	return native;
 439}
 440
 441/*
 442 * count() counts the number of strings in array ARGV.
 443 */
 444static int count(struct user_arg_ptr argv, int max)
 445{
 446	int i = 0;
 447
 448	if (argv.ptr.native != NULL) {
 449		for (;;) {
 450			const char __user *p = get_user_arg_ptr(argv, i);
 451
 452			if (!p)
 453				break;
 454
 455			if (IS_ERR(p))
 456				return -EFAULT;
 457
 458			if (i >= max)
 459				return -E2BIG;
 460			++i;
 461
 462			if (fatal_signal_pending(current))
 463				return -ERESTARTNOHAND;
 464			cond_resched();
 465		}
 466	}
 467	return i;
 468}
 469
 470static int count_strings_kernel(const char *const *argv)
 471{
 472	int i;
 473
 474	if (!argv)
 475		return 0;
 476
 477	for (i = 0; argv[i]; ++i) {
 478		if (i >= MAX_ARG_STRINGS)
 479			return -E2BIG;
 480		if (fatal_signal_pending(current))
 481			return -ERESTARTNOHAND;
 482		cond_resched();
 483	}
 484	return i;
 485}
 486
 487static inline int bprm_set_stack_limit(struct linux_binprm *bprm,
 488				       unsigned long limit)
 489{
 490#ifdef CONFIG_MMU
 491	/* Avoid a pathological bprm->p. */
 492	if (bprm->p < limit)
 493		return -E2BIG;
 494	bprm->argmin = bprm->p - limit;
 495#endif
 496	return 0;
 497}
 498static inline bool bprm_hit_stack_limit(struct linux_binprm *bprm)
 499{
 500#ifdef CONFIG_MMU
 501	return bprm->p < bprm->argmin;
 502#else
 503	return false;
 504#endif
 505}
 506
 507/*
 508 * Calculate bprm->argmin from:
 509 * - _STK_LIM
 510 * - ARG_MAX
 511 * - bprm->rlim_stack.rlim_cur
 512 * - bprm->argc
 513 * - bprm->envc
 514 * - bprm->p
 515 */
 516static int bprm_stack_limits(struct linux_binprm *bprm)
 517{
 518	unsigned long limit, ptr_size;
 519
 520	/*
 521	 * Limit to 1/4 of the max stack size or 3/4 of _STK_LIM
 522	 * (whichever is smaller) for the argv+env strings.
 523	 * This ensures that:
 524	 *  - the remaining binfmt code will not run out of stack space,
 525	 *  - the program will have a reasonable amount of stack left
 526	 *    to work from.
 527	 */
 528	limit = _STK_LIM / 4 * 3;
 529	limit = min(limit, bprm->rlim_stack.rlim_cur / 4);
 530	/*
 531	 * We've historically supported up to 32 pages (ARG_MAX)
 532	 * of argument strings even with small stacks
 533	 */
 534	limit = max_t(unsigned long, limit, ARG_MAX);
 535	/* Reject totally pathological counts. */
 536	if (bprm->argc < 0 || bprm->envc < 0)
 537		return -E2BIG;
 538	/*
 539	 * We must account for the size of all the argv and envp pointers to
 540	 * the argv and envp strings, since they will also take up space in
 541	 * the stack. They aren't stored until much later when we can't
 542	 * signal to the parent that the child has run out of stack space.
 543	 * Instead, calculate it here so it's possible to fail gracefully.
 544	 *
 545	 * In the case of argc = 0, make sure there is space for adding a
 546	 * empty string (which will bump argc to 1), to ensure confused
 547	 * userspace programs don't start processing from argv[1], thinking
 548	 * argc can never be 0, to keep them from walking envp by accident.
 549	 * See do_execveat_common().
 550	 */
 551	if (check_add_overflow(max(bprm->argc, 1), bprm->envc, &ptr_size) ||
 552	    check_mul_overflow(ptr_size, sizeof(void *), &ptr_size))
 553		return -E2BIG;
 554	if (limit <= ptr_size)
 555		return -E2BIG;
 556	limit -= ptr_size;
 557
 558	return bprm_set_stack_limit(bprm, limit);
 559}
 560
 561/*
 562 * 'copy_strings()' copies argument/environment strings from the old
 563 * processes's memory to the new process's stack.  The call to get_user_pages()
 564 * ensures the destination page is created and not swapped out.
 565 */
 566static int copy_strings(int argc, struct user_arg_ptr argv,
 567			struct linux_binprm *bprm)
 568{
 569	struct page *kmapped_page = NULL;
 570	char *kaddr = NULL;
 571	unsigned long kpos = 0;
 572	int ret;
 573
 574	while (argc-- > 0) {
 575		const char __user *str;
 576		int len;
 577		unsigned long pos;
 578
 579		ret = -EFAULT;
 580		str = get_user_arg_ptr(argv, argc);
 581		if (IS_ERR(str))
 582			goto out;
 583
 584		len = strnlen_user(str, MAX_ARG_STRLEN);
 585		if (!len)
 586			goto out;
 587
 588		ret = -E2BIG;
 589		if (!valid_arg_len(bprm, len))
 590			goto out;
 591
 592		/* We're going to work our way backwards. */
 593		pos = bprm->p;
 594		str += len;
 595		bprm->p -= len;
 596		if (bprm_hit_stack_limit(bprm))
 597			goto out;
 598
 599		while (len > 0) {
 600			int offset, bytes_to_copy;
 601
 602			if (fatal_signal_pending(current)) {
 603				ret = -ERESTARTNOHAND;
 604				goto out;
 605			}
 606			cond_resched();
 607
 608			offset = pos % PAGE_SIZE;
 609			if (offset == 0)
 610				offset = PAGE_SIZE;
 611
 612			bytes_to_copy = offset;
 613			if (bytes_to_copy > len)
 614				bytes_to_copy = len;
 615
 616			offset -= bytes_to_copy;
 617			pos -= bytes_to_copy;
 618			str -= bytes_to_copy;
 619			len -= bytes_to_copy;
 620
 621			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
 622				struct page *page;
 623
 624				page = get_arg_page(bprm, pos, 1);
 625				if (!page) {
 626					ret = -E2BIG;
 627					goto out;
 628				}
 629
 630				if (kmapped_page) {
 631					flush_dcache_page(kmapped_page);
 632					kunmap_local(kaddr);
 633					put_arg_page(kmapped_page);
 634				}
 635				kmapped_page = page;
 636				kaddr = kmap_local_page(kmapped_page);
 637				kpos = pos & PAGE_MASK;
 638				flush_arg_page(bprm, kpos, kmapped_page);
 639			}
 640			if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
 641				ret = -EFAULT;
 642				goto out;
 643			}
 644		}
 645	}
 646	ret = 0;
 647out:
 648	if (kmapped_page) {
 649		flush_dcache_page(kmapped_page);
 650		kunmap_local(kaddr);
 651		put_arg_page(kmapped_page);
 652	}
 653	return ret;
 654}
 655
 656/*
 657 * Copy and argument/environment string from the kernel to the processes stack.
 658 */
 659int copy_string_kernel(const char *arg, struct linux_binprm *bprm)
 
 660{
 661	int len = strnlen(arg, MAX_ARG_STRLEN) + 1 /* terminating NUL */;
 662	unsigned long pos = bprm->p;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 663
 664	if (len == 0)
 
 
 
 
 665		return -EFAULT;
 666	if (!valid_arg_len(bprm, len))
 667		return -E2BIG;
 668
 669	/* We're going to work our way backwards. */
 670	arg += len;
 671	bprm->p -= len;
 672	if (bprm_hit_stack_limit(bprm))
 673		return -E2BIG;
 674
 675	while (len > 0) {
 676		unsigned int bytes_to_copy = min_t(unsigned int, len,
 677				min_not_zero(offset_in_page(pos), PAGE_SIZE));
 678		struct page *page;
 679
 680		pos -= bytes_to_copy;
 681		arg -= bytes_to_copy;
 682		len -= bytes_to_copy;
 683
 684		page = get_arg_page(bprm, pos, 1);
 685		if (!page)
 686			return -E2BIG;
 687		flush_arg_page(bprm, pos & PAGE_MASK, page);
 688		memcpy_to_page(page, offset_in_page(pos), arg, bytes_to_copy);
 689		put_arg_page(page);
 
 
 
 
 
 
 
 
 
 
 
 690	}
 
 691
 692	return 0;
 693}
 694EXPORT_SYMBOL(copy_string_kernel);
 
 695
 696static int copy_strings_kernel(int argc, const char *const *argv,
 697			       struct linux_binprm *bprm)
 698{
 699	while (argc-- > 0) {
 700		int ret = copy_string_kernel(argv[argc], bprm);
 701		if (ret < 0)
 702			return ret;
 703		if (fatal_signal_pending(current))
 704			return -ERESTARTNOHAND;
 705		cond_resched();
 706	}
 707	return 0;
 708}
 709
 710#ifdef CONFIG_MMU
 711
 712/*
 713 * Finalizes the stack vm_area_struct. The flags and permissions are updated,
 714 * the stack is optionally relocated, and some extra space is added.
 715 */
 716int setup_arg_pages(struct linux_binprm *bprm,
 717		    unsigned long stack_top,
 718		    int executable_stack)
 719{
 720	unsigned long ret;
 721	unsigned long stack_shift;
 722	struct mm_struct *mm = current->mm;
 723	struct vm_area_struct *vma = bprm->vma;
 724	struct vm_area_struct *prev = NULL;
 725	unsigned long vm_flags;
 726	unsigned long stack_base;
 727	unsigned long stack_size;
 728	unsigned long stack_expand;
 729	unsigned long rlim_stack;
 730	struct mmu_gather tlb;
 731	struct vma_iterator vmi;
 732
 733#ifdef CONFIG_STACK_GROWSUP
 734	/* Limit stack size */
 735	stack_base = bprm->rlim_stack.rlim_max;
 736
 737	stack_base = calc_max_stack_size(stack_base);
 738
 739	/* Add space for stack randomization. */
 740	if (current->flags & PF_RANDOMIZE)
 741		stack_base += (STACK_RND_MASK << PAGE_SHIFT);
 742
 743	/* Make sure we didn't let the argument array grow too large. */
 744	if (vma->vm_end - vma->vm_start > stack_base)
 745		return -ENOMEM;
 746
 747	stack_base = PAGE_ALIGN(stack_top - stack_base);
 748
 749	stack_shift = vma->vm_start - stack_base;
 750	mm->arg_start = bprm->p - stack_shift;
 751	bprm->p = vma->vm_end - stack_shift;
 752#else
 753	stack_top = arch_align_stack(stack_top);
 754	stack_top = PAGE_ALIGN(stack_top);
 755
 756	if (unlikely(stack_top < mmap_min_addr) ||
 757	    unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
 758		return -ENOMEM;
 759
 760	stack_shift = vma->vm_end - stack_top;
 761
 762	bprm->p -= stack_shift;
 763	mm->arg_start = bprm->p;
 764#endif
 765
 766	if (bprm->loader)
 767		bprm->loader -= stack_shift;
 768	bprm->exec -= stack_shift;
 769
 770	if (mmap_write_lock_killable(mm))
 771		return -EINTR;
 772
 773	vm_flags = VM_STACK_FLAGS;
 774
 775	/*
 776	 * Adjust stack execute permissions; explicitly enable for
 777	 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
 778	 * (arch default) otherwise.
 779	 */
 780	if (unlikely(executable_stack == EXSTACK_ENABLE_X))
 781		vm_flags |= VM_EXEC;
 782	else if (executable_stack == EXSTACK_DISABLE_X)
 783		vm_flags &= ~VM_EXEC;
 784	vm_flags |= mm->def_flags;
 785	vm_flags |= VM_STACK_INCOMPLETE_SETUP;
 786
 787	vma_iter_init(&vmi, mm, vma->vm_start);
 788
 789	tlb_gather_mmu(&tlb, mm);
 790	ret = mprotect_fixup(&vmi, &tlb, vma, &prev, vma->vm_start, vma->vm_end,
 791			vm_flags);
 792	tlb_finish_mmu(&tlb);
 793
 794	if (ret)
 795		goto out_unlock;
 796	BUG_ON(prev != vma);
 797
 798	if (unlikely(vm_flags & VM_EXEC)) {
 799		pr_warn_once("process '%pD4' started with executable stack\n",
 800			     bprm->file);
 801	}
 802
 803	/* Move stack pages down in memory. */
 804	if (stack_shift) {
 805		/*
 806		 * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX.  Once
 807		 * the binfmt code determines where the new stack should reside, we shift it to
 808		 * its final location.
 809		 */
 810		ret = relocate_vma_down(vma, stack_shift);
 811		if (ret)
 812			goto out_unlock;
 813	}
 814
 815	/* mprotect_fixup is overkill to remove the temporary stack flags */
 816	vm_flags_clear(vma, VM_STACK_INCOMPLETE_SETUP);
 817
 818	stack_expand = 131072UL; /* randomly 32*4k (or 2*64k) pages */
 819	stack_size = vma->vm_end - vma->vm_start;
 820	/*
 821	 * Align this down to a page boundary as expand_stack
 822	 * will align it up.
 823	 */
 824	rlim_stack = bprm->rlim_stack.rlim_cur & PAGE_MASK;
 825
 826	stack_expand = min(rlim_stack, stack_size + stack_expand);
 827
 828#ifdef CONFIG_STACK_GROWSUP
 829	stack_base = vma->vm_start + stack_expand;
 
 
 
 830#else
 831	stack_base = vma->vm_end - stack_expand;
 
 
 
 832#endif
 833	current->mm->start_stack = bprm->p;
 834	ret = expand_stack_locked(vma, stack_base);
 835	if (ret)
 836		ret = -EFAULT;
 837
 838out_unlock:
 839	mmap_write_unlock(mm);
 840	return ret;
 841}
 842EXPORT_SYMBOL(setup_arg_pages);
 843
 844#else
 845
 846/*
 847 * Transfer the program arguments and environment from the holding pages
 848 * onto the stack. The provided stack pointer is adjusted accordingly.
 849 */
 850int transfer_args_to_stack(struct linux_binprm *bprm,
 851			   unsigned long *sp_location)
 852{
 853	unsigned long index, stop, sp;
 854	int ret = 0;
 855
 856	stop = bprm->p >> PAGE_SHIFT;
 857	sp = *sp_location;
 858
 859	for (index = MAX_ARG_PAGES - 1; index >= stop; index--) {
 860		unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0;
 861		char *src = kmap_local_page(bprm->page[index]) + offset;
 862		sp -= PAGE_SIZE - offset;
 863		if (copy_to_user((void *) sp, src, PAGE_SIZE - offset) != 0)
 864			ret = -EFAULT;
 865		kunmap_local(src);
 866		if (ret)
 867			goto out;
 868	}
 869
 870	bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
 871	*sp_location = sp;
 872
 873out:
 874	return ret;
 875}
 876EXPORT_SYMBOL(transfer_args_to_stack);
 877
 878#endif /* CONFIG_MMU */
 879
 880/*
 881 * On success, caller must call do_close_execat() on the returned
 882 * struct file to close it.
 883 */
 884static struct file *do_open_execat(int fd, struct filename *name, int flags)
 885{
 
 886	int err;
 887	struct file *file __free(fput) = NULL;
 888	struct open_flags open_exec_flags = {
 889		.open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
 890		.acc_mode = MAY_EXEC,
 891		.intent = LOOKUP_OPEN,
 892		.lookup_flags = LOOKUP_FOLLOW,
 893	};
 894
 895	if ((flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
 896		return ERR_PTR(-EINVAL);
 897	if (flags & AT_SYMLINK_NOFOLLOW)
 898		open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW;
 899	if (flags & AT_EMPTY_PATH)
 900		open_exec_flags.lookup_flags |= LOOKUP_EMPTY;
 901
 902	file = do_filp_open(fd, name, &open_exec_flags);
 903	if (IS_ERR(file))
 904		return file;
 905
 906	/*
 907	 * In the past the regular type check was here. It moved to may_open() in
 908	 * 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is
 909	 * an invariant that all non-regular files error out before we get here.
 910	 */
 911	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) ||
 912	    path_noexec(&file->f_path))
 913		return ERR_PTR(-EACCES);
 914
 915	err = deny_write_access(file);
 916	if (err)
 917		return ERR_PTR(err);
 918
 919	return no_free_ptr(file);
 920}
 921
 922/**
 923 * open_exec - Open a path name for execution
 924 *
 925 * @name: path name to open with the intent of executing it.
 926 *
 927 * Returns ERR_PTR on failure or allocated struct file on success.
 928 *
 929 * As this is a wrapper for the internal do_open_execat(), callers
 930 * must call allow_write_access() before fput() on release. Also see
 931 * do_close_execat().
 932 */
 933struct file *open_exec(const char *name)
 934{
 935	struct filename *filename = getname_kernel(name);
 936	struct file *f = ERR_CAST(filename);
 937
 938	if (!IS_ERR(filename)) {
 939		f = do_open_execat(AT_FDCWD, filename, 0);
 940		putname(filename);
 941	}
 942	return f;
 943}
 944EXPORT_SYMBOL(open_exec);
 945
 946#if defined(CONFIG_BINFMT_FLAT) || defined(CONFIG_BINFMT_ELF_FDPIC)
 947ssize_t read_code(struct file *file, unsigned long addr, loff_t pos, size_t len)
 948{
 949	ssize_t res = vfs_read(file, (void __user *)addr, len, &pos);
 950	if (res > 0)
 951		flush_icache_user_range(addr, addr + len);
 952	return res;
 
 
 
 
 
 
 953}
 954EXPORT_SYMBOL(read_code);
 955#endif
 956
 957/*
 958 * Maps the mm_struct mm into the current task struct.
 959 * On success, this function returns with exec_update_lock
 960 * held for writing.
 961 */
 962static int exec_mmap(struct mm_struct *mm)
 963{
 964	struct task_struct *tsk;
 965	struct mm_struct *old_mm, *active_mm;
 966	int ret;
 967
 968	/* Notify parent that we're no longer interested in the old VM */
 969	tsk = current;
 970	old_mm = current->mm;
 971	exec_mm_release(tsk, old_mm);
 972
 973	ret = down_write_killable(&tsk->signal->exec_update_lock);
 974	if (ret)
 975		return ret;
 976
 977	if (old_mm) {
 978		/*
 979		 * If there is a pending fatal signal perhaps a signal
 980		 * whose default action is to create a coredump get
 981		 * out and die instead of going through with the exec.
 
 982		 */
 983		ret = mmap_read_lock_killable(old_mm);
 984		if (ret) {
 985			up_write(&tsk->signal->exec_update_lock);
 986			return ret;
 987		}
 988	}
 989
 990	task_lock(tsk);
 991	membarrier_exec_mmap(mm);
 992
 993	local_irq_disable();
 994	active_mm = tsk->active_mm;
 995	tsk->active_mm = mm;
 996	tsk->mm = mm;
 997	mm_init_cid(mm, tsk);
 998	/*
 999	 * This prevents preemption while active_mm is being loaded and
1000	 * it and mm are being updated, which could cause problems for
1001	 * lazy tlb mm refcounting when these are updated by context
1002	 * switches. Not all architectures can handle irqs off over
1003	 * activate_mm yet.
1004	 */
1005	if (!IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
1006		local_irq_enable();
1007	activate_mm(active_mm, mm);
1008	if (IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
1009		local_irq_enable();
1010	lru_gen_add_mm(mm);
 
1011	task_unlock(tsk);
1012	lru_gen_use_mm(mm);
1013	if (old_mm) {
1014		mmap_read_unlock(old_mm);
1015		BUG_ON(active_mm != old_mm);
1016		setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm);
1017		mm_update_next_owner(old_mm);
1018		mmput(old_mm);
1019		return 0;
1020	}
1021	mmdrop_lazy_tlb(active_mm);
1022	return 0;
1023}
1024
 
 
 
 
 
 
1025static int de_thread(struct task_struct *tsk)
1026{
1027	struct signal_struct *sig = tsk->signal;
1028	struct sighand_struct *oldsighand = tsk->sighand;
1029	spinlock_t *lock = &oldsighand->siglock;
1030
1031	if (thread_group_empty(tsk))
1032		goto no_thread_group;
1033
1034	/*
1035	 * Kill all other threads in the thread group.
1036	 */
1037	spin_lock_irq(lock);
1038	if ((sig->flags & SIGNAL_GROUP_EXIT) || sig->group_exec_task) {
1039		/*
1040		 * Another group action in progress, just
1041		 * return so that the signal is processed.
1042		 */
1043		spin_unlock_irq(lock);
1044		return -EAGAIN;
1045	}
1046
1047	sig->group_exec_task = tsk;
1048	sig->notify_count = zap_other_threads(tsk);
1049	if (!thread_group_leader(tsk))
1050		sig->notify_count--;
1051
1052	while (sig->notify_count) {
1053		__set_current_state(TASK_KILLABLE);
1054		spin_unlock_irq(lock);
1055		schedule();
1056		if (__fatal_signal_pending(tsk))
1057			goto killed;
1058		spin_lock_irq(lock);
1059	}
1060	spin_unlock_irq(lock);
1061
1062	/*
1063	 * At this point all other threads have exited, all we have to
1064	 * do is to wait for the thread group leader to become inactive,
1065	 * and to assume its PID:
1066	 */
1067	if (!thread_group_leader(tsk)) {
1068		struct task_struct *leader = tsk->group_leader;
1069
 
1070		for (;;) {
1071			cgroup_threadgroup_change_begin(tsk);
1072			write_lock_irq(&tasklist_lock);
1073			/*
1074			 * Do this under tasklist_lock to ensure that
1075			 * exit_notify() can't miss ->group_exec_task
1076			 */
1077			sig->notify_count = -1;
1078			if (likely(leader->exit_state))
1079				break;
1080			__set_current_state(TASK_KILLABLE);
1081			write_unlock_irq(&tasklist_lock);
1082			cgroup_threadgroup_change_end(tsk);
1083			schedule();
1084			if (__fatal_signal_pending(tsk))
1085				goto killed;
1086		}
1087
1088		/*
1089		 * The only record we have of the real-time age of a
1090		 * process, regardless of execs it's done, is start_time.
1091		 * All the past CPU time is accumulated in signal_struct
1092		 * from sister threads now dead.  But in this non-leader
1093		 * exec, nothing survives from the original leader thread,
1094		 * whose birth marks the true age of this process now.
1095		 * When we take on its identity by switching to its PID, we
1096		 * also take its birthdate (always earlier than our own).
1097		 */
1098		tsk->start_time = leader->start_time;
1099		tsk->start_boottime = leader->start_boottime;
1100
1101		BUG_ON(!same_thread_group(leader, tsk));
 
1102		/*
1103		 * An exec() starts a new thread group with the
1104		 * TGID of the previous thread group. Rehash the
1105		 * two threads with a switched PID, and release
1106		 * the former thread group leader:
1107		 */
1108
1109		/* Become a process group leader with the old leader's pid.
1110		 * The old leader becomes a thread of the this thread group.
 
 
1111		 */
1112		exchange_tids(tsk, leader);
1113		transfer_pid(leader, tsk, PIDTYPE_TGID);
 
1114		transfer_pid(leader, tsk, PIDTYPE_PGID);
1115		transfer_pid(leader, tsk, PIDTYPE_SID);
1116
1117		list_replace_rcu(&leader->tasks, &tsk->tasks);
1118		list_replace_init(&leader->sibling, &tsk->sibling);
1119
1120		tsk->group_leader = tsk;
1121		leader->group_leader = tsk;
1122
1123		tsk->exit_signal = SIGCHLD;
1124		leader->exit_signal = -1;
1125
1126		BUG_ON(leader->exit_state != EXIT_ZOMBIE);
1127		leader->exit_state = EXIT_DEAD;
 
1128		/*
1129		 * We are going to release_task()->ptrace_unlink() silently,
1130		 * the tracer can sleep in do_wait(). EXIT_DEAD guarantees
1131		 * the tracer won't block again waiting for this thread.
1132		 */
1133		if (unlikely(leader->ptrace))
1134			__wake_up_parent(leader, leader->parent);
1135		write_unlock_irq(&tasklist_lock);
1136		cgroup_threadgroup_change_end(tsk);
1137
1138		release_task(leader);
1139	}
1140
1141	sig->group_exec_task = NULL;
1142	sig->notify_count = 0;
1143
1144no_thread_group:
1145	/* we have changed execution domain */
1146	tsk->exit_signal = SIGCHLD;
1147
1148	BUG_ON(!thread_group_leader(tsk));
1149	return 0;
1150
1151killed:
1152	/* protects against exit_notify() and __exit_signal() */
1153	read_lock(&tasklist_lock);
1154	sig->group_exec_task = NULL;
1155	sig->notify_count = 0;
1156	read_unlock(&tasklist_lock);
1157	return -EAGAIN;
1158}
1159
 
 
1160
1161/*
1162 * This function makes sure the current process has its own signal table,
1163 * so that flush_signal_handlers can later reset the handlers without
1164 * disturbing other processes.  (Other processes might share the signal
1165 * table via the CLONE_SIGHAND option to clone().)
1166 */
1167static int unshare_sighand(struct task_struct *me)
1168{
1169	struct sighand_struct *oldsighand = me->sighand;
1170
1171	if (refcount_read(&oldsighand->count) != 1) {
1172		struct sighand_struct *newsighand;
1173		/*
1174		 * This ->sighand is shared with the CLONE_SIGHAND
1175		 * but not CLONE_THREAD task, switch to the new one.
1176		 */
1177		newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
1178		if (!newsighand)
1179			return -ENOMEM;
1180
1181		refcount_set(&newsighand->count, 1);
 
 
1182
1183		write_lock_irq(&tasklist_lock);
1184		spin_lock(&oldsighand->siglock);
1185		memcpy(newsighand->action, oldsighand->action,
1186		       sizeof(newsighand->action));
1187		rcu_assign_pointer(me->sighand, newsighand);
1188		spin_unlock(&oldsighand->siglock);
1189		write_unlock_irq(&tasklist_lock);
1190
1191		__cleanup_sighand(oldsighand);
1192	}
 
 
1193	return 0;
1194}
1195
1196/*
1197 * These functions flushes out all traces of the currently running executable
1198 * so that a new one can be started
1199 */
 
 
 
 
1200
1201void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1202{
 
1203	task_lock(tsk);
1204	trace_task_rename(tsk, buf);
1205	strscpy_pad(tsk->comm, buf, sizeof(tsk->comm));
1206	task_unlock(tsk);
1207	perf_event_comm(tsk, exec);
1208}
 
1209
1210/*
1211 * Calling this is the point of no return. None of the failures will be
1212 * seen by userspace since either the process is already taking a fatal
1213 * signal (via de_thread() or coredump), or will have SEGV raised
1214 * (after exec_mmap()) by search_binary_handler (see below).
1215 */
1216int begin_new_exec(struct linux_binprm * bprm)
1217{
1218	struct task_struct *me = current;
1219	int retval;
1220
1221	/* Once we are committed compute the creds */
1222	retval = bprm_creds_from_file(bprm);
1223	if (retval)
1224		return retval;
1225
1226	/*
1227	 * This tracepoint marks the point before flushing the old exec where
1228	 * the current task is still unchanged, but errors are fatal (point of
1229	 * no return). The later "sched_process_exec" tracepoint is called after
1230	 * the current task has successfully switched to the new exec.
1231	 */
1232	trace_sched_prepare_exec(current, bprm);
1233
1234	/*
1235	 * Ensure all future errors are fatal.
1236	 */
1237	bprm->point_of_no_return = true;
1238
1239	/*
1240	 * Make this the only thread in the thread group.
1241	 */
1242	retval = de_thread(me);
1243	if (retval)
1244		goto out;
1245
1246	/*
1247	 * Cancel any io_uring activity across execve
1248	 */
1249	io_uring_task_cancel();
 
 
 
 
 
 
 
 
1250
1251	/* Ensure the files table is not shared. */
1252	retval = unshare_files();
1253	if (retval)
1254		goto out;
1255
1256	/*
1257	 * Must be called _before_ exec_mmap() as bprm->mm is
1258	 * not visible until then. Doing it here also ensures
1259	 * we don't race against replace_mm_exe_file().
1260	 */
1261	retval = set_mm_exe_file(bprm->mm, bprm->file);
1262	if (retval)
1263		goto out;
1264
1265	/* If the binary is not readable then enforce mm->dumpable=0 */
1266	would_dump(bprm, bprm->file);
1267	if (bprm->have_execfd)
1268		would_dump(bprm, bprm->executable);
1269
1270	/*
1271	 * Release all of the old mmap stuff
1272	 */
1273	acct_arg_size(bprm, 0);
1274	retval = exec_mmap(bprm->mm);
1275	if (retval)
1276		goto out;
1277
1278	bprm->mm = NULL;
1279
1280	retval = exec_task_namespaces();
1281	if (retval)
1282		goto out_unlock;
1283
1284#ifdef CONFIG_POSIX_TIMERS
1285	spin_lock_irq(&me->sighand->siglock);
1286	posix_cpu_timers_exit(me);
1287	spin_unlock_irq(&me->sighand->siglock);
1288	exit_itimers(me);
1289	flush_itimer_signals();
1290#endif
1291
1292	/*
1293	 * Make the signal table private.
1294	 */
1295	retval = unshare_sighand(me);
1296	if (retval)
1297		goto out_unlock;
1298
1299	me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC |
1300					PF_NOFREEZE | PF_NO_SETAFFINITY);
1301	flush_thread();
1302	me->personality &= ~bprm->per_clear;
1303
1304	clear_syscall_work_syscall_user_dispatch(me);
1305
1306	/*
1307	 * We have to apply CLOEXEC before we change whether the process is
1308	 * dumpable (in setup_new_exec) to avoid a race with a process in userspace
1309	 * trying to access the should-be-closed file descriptors of a process
1310	 * undergoing exec(2).
1311	 */
1312	do_close_on_exec(me->files);
1313
1314	if (bprm->secureexec) {
1315		/* Make sure parent cannot signal privileged process. */
1316		me->pdeath_signal = 0;
1317
1318		/*
1319		 * For secureexec, reset the stack limit to sane default to
1320		 * avoid bad behavior from the prior rlimits. This has to
1321		 * happen before arch_pick_mmap_layout(), which examines
1322		 * RLIMIT_STACK, but after the point of no return to avoid
1323		 * needing to clean up the change on failure.
1324		 */
1325		if (bprm->rlim_stack.rlim_cur > _STK_LIM)
1326			bprm->rlim_stack.rlim_cur = _STK_LIM;
1327	}
1328
1329	me->sas_ss_sp = me->sas_ss_size = 0;
1330
1331	/*
1332	 * Figure out dumpability. Note that this checking only of current
1333	 * is wrong, but userspace depends on it. This should be testing
1334	 * bprm->secureexec instead.
1335	 */
1336	if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||
1337	    !(uid_eq(current_euid(), current_uid()) &&
1338	      gid_eq(current_egid(), current_gid())))
1339		set_dumpable(current->mm, suid_dumpable);
1340	else
1341		set_dumpable(current->mm, SUID_DUMP_USER);
1342
1343	perf_event_exec();
1344
1345	/*
1346	 * If the original filename was empty, alloc_bprm() made up a path
1347	 * that will probably not be useful to admins running ps or similar.
1348	 * Let's fix it up to be something reasonable.
1349	 */
1350	if (bprm->comm_from_dentry) {
1351		/*
1352		 * Hold RCU lock to keep the name from being freed behind our back.
1353		 * Use acquire semantics to make sure the terminating NUL from
1354		 * __d_alloc() is seen.
1355		 *
1356		 * Note, we're deliberately sloppy here. We don't need to care about
1357		 * detecting a concurrent rename and just want a terminated name.
1358		 */
1359		rcu_read_lock();
1360		__set_task_comm(me, smp_load_acquire(&bprm->file->f_path.dentry->d_name.name),
1361				true);
1362		rcu_read_unlock();
1363	} else {
1364		__set_task_comm(me, kbasename(bprm->filename), true);
1365	}
1366
1367	/* An exec changes our domain. We are no longer part of the thread
1368	   group */
1369	WRITE_ONCE(me->self_exec_id, me->self_exec_id + 1);
1370	flush_signal_handlers(me, 0);
1371
1372	retval = set_cred_ucounts(bprm->cred);
1373	if (retval < 0)
1374		goto out_unlock;
1375
1376	/*
1377	 * install the new credentials for this executable
1378	 */
1379	security_bprm_committing_creds(bprm);
1380
1381	commit_creds(bprm->cred);
1382	bprm->cred = NULL;
1383
1384	/*
1385	 * Disable monitoring for regular users
1386	 * when executing setuid binaries. Must
1387	 * wait until new credentials are committed
1388	 * by commit_creds() above
1389	 */
1390	if (get_dumpable(me->mm) != SUID_DUMP_USER)
1391		perf_event_exit_task(me);
1392	/*
1393	 * cred_guard_mutex must be held at least to this point to prevent
1394	 * ptrace_attach() from altering our determination of the task's
1395	 * credentials; any time after this it may be unlocked.
1396	 */
1397	security_bprm_committed_creds(bprm);
1398
1399	/* Pass the opened binary to the interpreter. */
1400	if (bprm->have_execfd) {
1401		retval = get_unused_fd_flags(0);
1402		if (retval < 0)
1403			goto out_unlock;
1404		fd_install(retval, bprm->executable);
1405		bprm->executable = NULL;
1406		bprm->execfd = retval;
1407	}
1408	return 0;
1409
1410out_unlock:
1411	up_write(&me->signal->exec_update_lock);
1412	if (!bprm->cred)
1413		mutex_unlock(&me->signal->cred_guard_mutex);
1414
1415out:
1416	return retval;
1417}
1418EXPORT_SYMBOL(begin_new_exec);
1419
1420void would_dump(struct linux_binprm *bprm, struct file *file)
1421{
1422	struct inode *inode = file_inode(file);
1423	struct mnt_idmap *idmap = file_mnt_idmap(file);
1424	if (inode_permission(idmap, inode, MAY_READ) < 0) {
1425		struct user_namespace *old, *user_ns;
1426		bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
1427
1428		/* Ensure mm->user_ns contains the executable */
1429		user_ns = old = bprm->mm->user_ns;
1430		while ((user_ns != &init_user_ns) &&
1431		       !privileged_wrt_inode_uidgid(user_ns, idmap, inode))
1432			user_ns = user_ns->parent;
1433
1434		if (old != user_ns) {
1435			bprm->mm->user_ns = get_user_ns(user_ns);
1436			put_user_ns(old);
1437		}
1438	}
1439}
1440EXPORT_SYMBOL(would_dump);
1441
1442void setup_new_exec(struct linux_binprm * bprm)
1443{
1444	/* Setup things that can depend upon the personality */
1445	struct task_struct *me = current;
 
1446
1447	arch_pick_mmap_layout(me->mm, &bprm->rlim_stack);
1448
1449	arch_setup_new_exec();
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1450
1451	/* Set the new mm task size. We have to do that late because it may
1452	 * depend on TIF_32BIT which is only updated in flush_thread() on
1453	 * some architectures like powerpc
1454	 */
1455	me->mm->task_size = TASK_SIZE;
1456	up_write(&me->signal->exec_update_lock);
1457	mutex_unlock(&me->signal->cred_guard_mutex);
1458}
1459EXPORT_SYMBOL(setup_new_exec);
1460
1461/* Runs immediately before start_thread() takes over. */
1462void finalize_exec(struct linux_binprm *bprm)
1463{
1464	/* Store any stack rlimit changes before starting thread. */
1465	task_lock(current->group_leader);
1466	current->signal->rlim[RLIMIT_STACK] = bprm->rlim_stack;
1467	task_unlock(current->group_leader);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1468}
1469EXPORT_SYMBOL(finalize_exec);
1470
1471/*
1472 * Prepare credentials and lock ->cred_guard_mutex.
1473 * setup_new_exec() commits the new creds and drops the lock.
1474 * Or, if exec fails before, free_bprm() should release ->cred
1475 * and unlock.
1476 */
1477static int prepare_bprm_creds(struct linux_binprm *bprm)
1478{
1479	if (mutex_lock_interruptible(&current->signal->cred_guard_mutex))
1480		return -ERESTARTNOINTR;
1481
1482	bprm->cred = prepare_exec_creds();
1483	if (likely(bprm->cred))
1484		return 0;
1485
1486	mutex_unlock(&current->signal->cred_guard_mutex);
1487	return -ENOMEM;
1488}
1489
1490/* Matches do_open_execat() */
1491static void do_close_execat(struct file *file)
1492{
1493	if (!file)
1494		return;
1495	allow_write_access(file);
1496	fput(file);
1497}
1498
1499static void free_bprm(struct linux_binprm *bprm)
1500{
1501	if (bprm->mm) {
1502		acct_arg_size(bprm, 0);
1503		mmput(bprm->mm);
1504	}
1505	free_arg_pages(bprm);
1506	if (bprm->cred) {
1507		mutex_unlock(&current->signal->cred_guard_mutex);
1508		abort_creds(bprm->cred);
1509	}
1510	do_close_execat(bprm->file);
1511	if (bprm->executable)
1512		fput(bprm->executable);
1513	/* If a binfmt changed the interp, free it. */
1514	if (bprm->interp != bprm->filename)
1515		kfree(bprm->interp);
1516	kfree(bprm->fdpath);
1517	kfree(bprm);
1518}
1519
1520static struct linux_binprm *alloc_bprm(int fd, struct filename *filename, int flags)
 
 
 
1521{
1522	struct linux_binprm *bprm;
1523	struct file *file;
1524	int retval = -ENOMEM;
1525
1526	file = do_open_execat(fd, filename, flags);
1527	if (IS_ERR(file))
1528		return ERR_CAST(file);
1529
1530	bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
1531	if (!bprm) {
1532		do_close_execat(file);
1533		return ERR_PTR(-ENOMEM);
1534	}
1535
1536	bprm->file = file;
1537
1538	if (fd == AT_FDCWD || filename->name[0] == '/') {
1539		bprm->filename = filename->name;
1540	} else {
1541		if (filename->name[0] == '\0') {
1542			bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd);
1543			bprm->comm_from_dentry = 1;
1544		} else {
1545			bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s",
1546						  fd, filename->name);
1547		}
1548		if (!bprm->fdpath)
1549			goto out_free;
1550
1551		/*
1552		 * Record that a name derived from an O_CLOEXEC fd will be
1553		 * inaccessible after exec.  This allows the code in exec to
1554		 * choose to fail when the executable is not mmaped into the
1555		 * interpreter and an open file descriptor is not passed to
1556		 * the interpreter.  This makes for a better user experience
1557		 * than having the interpreter start and then immediately fail
1558		 * when it finds the executable is inaccessible.
1559		 */
1560		if (get_close_on_exec(fd))
1561			bprm->interp_flags |= BINPRM_FLAGS_PATH_INACCESSIBLE;
1562
1563		bprm->filename = bprm->fdpath;
1564	}
1565	bprm->interp = bprm->filename;
1566
1567	retval = bprm_mm_init(bprm);
1568	if (!retval)
1569		return bprm;
1570
1571out_free:
1572	free_bprm(bprm);
1573	return ERR_PTR(retval);
1574}
1575
1576int bprm_change_interp(const char *interp, struct linux_binprm *bprm)
1577{
1578	/* If a binfmt changed the interp, free it first. */
1579	if (bprm->interp != bprm->filename)
1580		kfree(bprm->interp);
1581	bprm->interp = kstrdup(interp, GFP_KERNEL);
1582	if (!bprm->interp)
1583		return -ENOMEM;
1584	return 0;
1585}
1586EXPORT_SYMBOL(bprm_change_interp);
1587
1588/*
1589 * determine how safe it is to execute the proposed program
1590 * - the caller must hold ->cred_guard_mutex to protect against
1591 *   PTRACE_ATTACH or seccomp thread-sync
1592 */
1593static void check_unsafe_exec(struct linux_binprm *bprm)
1594{
1595	struct task_struct *p = current, *t;
1596	unsigned n_fs;
 
1597
1598	if (p->ptrace)
1599		bprm->unsafe |= LSM_UNSAFE_PTRACE;
1600
1601	/*
1602	 * This isn't strictly necessary, but it makes it harder for LSMs to
1603	 * mess up.
1604	 */
1605	if (task_no_new_privs(current))
1606		bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;
1607
1608	/*
1609	 * If another task is sharing our fs, we cannot safely
1610	 * suid exec because the differently privileged task
1611	 * will be able to manipulate the current directory, etc.
1612	 * It would be nice to force an unshare instead...
1613	 */
1614	n_fs = 1;
1615	spin_lock(&p->fs->lock);
1616	rcu_read_lock();
1617	for_other_threads(p, t) {
1618		if (t->fs == p->fs)
1619			n_fs++;
1620	}
1621	rcu_read_unlock();
1622
1623	/* "users" and "in_exec" locked for copy_fs() */
1624	if (p->fs->users > n_fs)
1625		bprm->unsafe |= LSM_UNSAFE_SHARE;
1626	else
1627		p->fs->in_exec = 1;
 
 
 
 
 
1628	spin_unlock(&p->fs->lock);
 
 
1629}
1630
1631static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file)
 
 
 
 
 
 
1632{
1633	/* Handle suid and sgid on files */
1634	struct mnt_idmap *idmap;
1635	struct inode *inode = file_inode(file);
1636	unsigned int mode;
1637	vfsuid_t vfsuid;
1638	vfsgid_t vfsgid;
1639	int err;
1640
1641	if (!mnt_may_suid(file->f_path.mnt))
1642		return;
1643
1644	if (task_no_new_privs(current))
1645		return;
1646
1647	mode = READ_ONCE(inode->i_mode);
1648	if (!(mode & (S_ISUID|S_ISGID)))
1649		return;
1650
1651	idmap = file_mnt_idmap(file);
1652
1653	/* Be careful if suid/sgid is set */
1654	inode_lock(inode);
1655
1656	/* Atomically reload and check mode/uid/gid now that lock held. */
1657	mode = inode->i_mode;
1658	vfsuid = i_uid_into_vfsuid(idmap, inode);
1659	vfsgid = i_gid_into_vfsgid(idmap, inode);
1660	err = inode_permission(idmap, inode, MAY_EXEC);
1661	inode_unlock(inode);
1662
1663	/* Did the exec bit vanish out from under us? Give up. */
1664	if (err)
1665		return;
1666
1667	/* We ignore suid/sgid if there are no mappings for them in the ns */
1668	if (!vfsuid_has_mapping(bprm->cred->user_ns, vfsuid) ||
1669	    !vfsgid_has_mapping(bprm->cred->user_ns, vfsgid))
1670		return;
1671
1672	if (mode & S_ISUID) {
1673		bprm->per_clear |= PER_CLEAR_ON_SETID;
1674		bprm->cred->euid = vfsuid_into_kuid(vfsuid);
1675	}
 
 
 
 
 
 
1676
1677	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
1678		bprm->per_clear |= PER_CLEAR_ON_SETID;
1679		bprm->cred->egid = vfsgid_into_kgid(vfsgid);
 
 
 
 
 
 
 
1680	}
1681}
1682
1683/*
1684 * Compute brpm->cred based upon the final binary.
1685 */
1686static int bprm_creds_from_file(struct linux_binprm *bprm)
1687{
1688	/* Compute creds based on which file? */
1689	struct file *file = bprm->execfd_creds ? bprm->executable : bprm->file;
1690
1691	bprm_fill_uid(bprm, file);
1692	return security_bprm_creds_from_file(bprm, file);
1693}
1694
1695/*
1696 * Fill the binprm structure from the inode.
1697 * Read the first BINPRM_BUF_SIZE bytes
1698 *
1699 * This may be called multiple times for binary chains (scripts for example).
1700 */
1701static int prepare_binprm(struct linux_binprm *bprm)
1702{
1703	loff_t pos = 0;
1704
1705	memset(bprm->buf, 0, BINPRM_BUF_SIZE);
1706	return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos);
1707}
1708
 
 
1709/*
1710 * Arguments are '\0' separated strings found at the location bprm->p
1711 * points to; chop off the first by relocating brpm->p to right after
1712 * the first '\0' encountered.
1713 */
1714int remove_arg_zero(struct linux_binprm *bprm)
1715{
 
1716	unsigned long offset;
1717	char *kaddr;
1718	struct page *page;
1719
1720	if (!bprm->argc)
1721		return 0;
1722
1723	do {
1724		offset = bprm->p & ~PAGE_MASK;
1725		page = get_arg_page(bprm, bprm->p, 0);
1726		if (!page)
1727			return -EFAULT;
1728		kaddr = kmap_local_page(page);
 
 
1729
1730		for (; offset < PAGE_SIZE && kaddr[offset];
1731				offset++, bprm->p++)
1732			;
1733
1734		kunmap_local(kaddr);
1735		put_arg_page(page);
 
 
 
1736	} while (offset == PAGE_SIZE);
1737
1738	bprm->p++;
1739	bprm->argc--;
 
1740
1741	return 0;
 
1742}
1743EXPORT_SYMBOL(remove_arg_zero);
1744
1745#define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
1746/*
1747 * cycle the list of binary formats handler, until one recognizes the image
1748 */
1749static int search_binary_handler(struct linux_binprm *bprm)
1750{
1751	bool need_retry = IS_ENABLED(CONFIG_MODULES);
 
1752	struct linux_binfmt *fmt;
1753	int retval;
1754
1755	retval = prepare_binprm(bprm);
1756	if (retval < 0)
1757		return retval;
1758
1759	retval = security_bprm_check(bprm);
1760	if (retval)
1761		return retval;
1762
1763	retval = -ENOENT;
1764 retry:
1765	read_lock(&binfmt_lock);
1766	list_for_each_entry(fmt, &formats, lh) {
1767		if (!try_module_get(fmt->module))
1768			continue;
1769		read_unlock(&binfmt_lock);
1770
1771		retval = fmt->load_binary(bprm);
1772
1773		read_lock(&binfmt_lock);
1774		put_binfmt(fmt);
1775		if (bprm->point_of_no_return || (retval != -ENOEXEC)) {
1776			read_unlock(&binfmt_lock);
1777			return retval;
1778		}
1779	}
1780	read_unlock(&binfmt_lock);
1781
1782	if (need_retry) {
1783		if (printable(bprm->buf[0]) && printable(bprm->buf[1]) &&
1784		    printable(bprm->buf[2]) && printable(bprm->buf[3]))
1785			return retval;
1786		if (request_module("binfmt-%04x", *(ushort *)(bprm->buf + 2)) < 0)
1787			return retval;
1788		need_retry = false;
1789		goto retry;
1790	}
1791
1792	return retval;
1793}
1794
1795/* binfmt handlers will call back into begin_new_exec() on success. */
1796static int exec_binprm(struct linux_binprm *bprm)
1797{
1798	pid_t old_pid, old_vpid;
1799	int ret, depth;
1800
1801	/* Need to fetch pid before load_binary changes it */
1802	old_pid = current->pid;
1803	rcu_read_lock();
1804	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
1805	rcu_read_unlock();
1806
1807	/* This allows 4 levels of binfmt rewrites before failing hard. */
1808	for (depth = 0;; depth++) {
1809		struct file *exec;
1810		if (depth > 5)
1811			return -ELOOP;
1812
1813		ret = search_binary_handler(bprm);
1814		if (ret < 0)
1815			return ret;
1816		if (!bprm->interpreter)
1817			break;
1818
1819		exec = bprm->file;
1820		bprm->file = bprm->interpreter;
1821		bprm->interpreter = NULL;
1822
1823		allow_write_access(exec);
1824		if (unlikely(bprm->have_execfd)) {
1825			if (bprm->executable) {
1826				fput(exec);
1827				return -ENOEXEC;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1828			}
1829			bprm->executable = exec;
1830		} else
1831			fput(exec);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1832	}
1833
1834	audit_bprm(bprm);
1835	trace_sched_process_exec(current, old_pid, bprm);
1836	ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
1837	proc_exec_connector(current);
1838	return 0;
1839}
1840
1841static int bprm_execve(struct linux_binprm *bprm)
1842{
1843	int retval;
1844
1845	retval = prepare_bprm_creds(bprm);
1846	if (retval)
1847		return retval;
1848
1849	/*
1850	 * Check for unsafe execution states before exec_binprm(), which
1851	 * will call back into begin_new_exec(), into bprm_creds_from_file(),
1852	 * where setuid-ness is evaluated.
1853	 */
1854	check_unsafe_exec(bprm);
1855	current->in_execve = 1;
1856	sched_mm_cid_before_execve(current);
1857
1858	sched_exec();
1859
1860	/* Set the unchanging part of bprm->cred */
1861	retval = security_bprm_creds_for_exec(bprm);
1862	if (retval)
1863		goto out;
1864
1865	retval = exec_binprm(bprm);
1866	if (retval < 0)
1867		goto out;
1868
1869	sched_mm_cid_after_execve(current);
1870	/* execve succeeded */
1871	current->fs->in_exec = 0;
1872	current->in_execve = 0;
1873	rseq_execve(current);
1874	user_events_execve(current);
1875	acct_update_integrals(current);
1876	task_numa_free(current, false);
1877	return retval;
1878
1879out:
1880	/*
1881	 * If past the point of no return ensure the code never
1882	 * returns to the userspace process.  Use an existing fatal
1883	 * signal if present otherwise terminate the process with
1884	 * SIGSEGV.
1885	 */
1886	if (bprm->point_of_no_return && !fatal_signal_pending(current))
1887		force_fatal_sig(SIGSEGV);
1888
1889	sched_mm_cid_after_execve(current);
1890	current->fs->in_exec = 0;
1891	current->in_execve = 0;
1892
1893	return retval;
1894}
1895
1896static int do_execveat_common(int fd, struct filename *filename,
1897			      struct user_arg_ptr argv,
1898			      struct user_arg_ptr envp,
1899			      int flags)
 
 
 
 
 
1900{
1901	struct linux_binprm *bprm;
 
 
 
1902	int retval;
1903
1904	if (IS_ERR(filename))
1905		return PTR_ERR(filename);
1906
1907	/*
1908	 * We move the actual failure in case of RLIMIT_NPROC excess from
1909	 * set*uid() to execve() because too many poorly written programs
1910	 * don't check setuid() return code.  Here we additionally recheck
1911	 * whether NPROC limit is still exceeded.
1912	 */
1913	if ((current->flags & PF_NPROC_EXCEEDED) &&
1914	    is_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
1915		retval = -EAGAIN;
1916		goto out_ret;
1917	}
1918
1919	/* We're below the limit (still or again), so we don't want to make
1920	 * further execve() calls fail. */
1921	current->flags &= ~PF_NPROC_EXCEEDED;
1922
1923	bprm = alloc_bprm(fd, filename, flags);
1924	if (IS_ERR(bprm)) {
1925		retval = PTR_ERR(bprm);
1926		goto out_ret;
1927	}
1928
1929	retval = count(argv, MAX_ARG_STRINGS);
1930	if (retval == 0)
1931		pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",
1932			     current->comm, bprm->filename);
1933	if (retval < 0)
1934		goto out_free;
1935	bprm->argc = retval;
1936
1937	retval = count(envp, MAX_ARG_STRINGS);
1938	if (retval < 0)
1939		goto out_free;
1940	bprm->envc = retval;
1941
1942	retval = bprm_stack_limits(bprm);
1943	if (retval < 0)
1944		goto out_free;
1945
1946	retval = copy_string_kernel(bprm->filename, bprm);
1947	if (retval < 0)
1948		goto out_free;
1949	bprm->exec = bprm->p;
1950
1951	retval = copy_strings(bprm->envc, envp, bprm);
1952	if (retval < 0)
1953		goto out_free;
1954
1955	retval = copy_strings(bprm->argc, argv, bprm);
1956	if (retval < 0)
1957		goto out_free;
 
 
1958
1959	/*
1960	 * When argv is empty, add an empty string ("") as argv[0] to
1961	 * ensure confused userspace programs that start processing
1962	 * from argv[1] won't end up walking envp. See also
1963	 * bprm_stack_limits().
1964	 */
1965	if (bprm->argc == 0) {
1966		retval = copy_string_kernel("", bprm);
1967		if (retval < 0)
1968			goto out_free;
1969		bprm->argc = 1;
1970	}
1971
1972	retval = bprm_execve(bprm);
1973out_free:
1974	free_bprm(bprm);
1975
1976out_ret:
1977	putname(filename);
1978	return retval;
1979}
1980
1981int kernel_execve(const char *kernel_filename,
1982		  const char *const *argv, const char *const *envp)
1983{
1984	struct filename *filename;
1985	struct linux_binprm *bprm;
1986	int fd = AT_FDCWD;
1987	int retval;
1988
1989	/* It is non-sense for kernel threads to call execve */
1990	if (WARN_ON_ONCE(current->flags & PF_KTHREAD))
1991		return -EINVAL;
1992
1993	filename = getname_kernel(kernel_filename);
1994	if (IS_ERR(filename))
1995		return PTR_ERR(filename);
1996
1997	bprm = alloc_bprm(fd, filename, 0);
1998	if (IS_ERR(bprm)) {
1999		retval = PTR_ERR(bprm);
2000		goto out_ret;
2001	}
2002
2003	retval = count_strings_kernel(argv);
2004	if (WARN_ON_ONCE(retval == 0))
2005		retval = -EINVAL;
2006	if (retval < 0)
2007		goto out_free;
2008	bprm->argc = retval;
2009
2010	retval = count_strings_kernel(envp);
2011	if (retval < 0)
2012		goto out_free;
2013	bprm->envc = retval;
2014
2015	retval = bprm_stack_limits(bprm);
 
2016	if (retval < 0)
2017		goto out_free;
2018
2019	retval = copy_string_kernel(bprm->filename, bprm);
2020	if (retval < 0)
2021		goto out_free;
2022	bprm->exec = bprm->p;
2023
2024	retval = copy_strings_kernel(bprm->envc, envp, bprm);
2025	if (retval < 0)
2026		goto out_free;
2027
2028	retval = copy_strings_kernel(bprm->argc, argv, bprm);
2029	if (retval < 0)
2030		goto out_free;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2031
2032	retval = bprm_execve(bprm);
2033out_free:
2034	free_bprm(bprm);
 
 
 
 
2035out_ret:
2036	putname(filename);
2037	return retval;
2038}
2039
2040static int do_execve(struct filename *filename,
2041	const char __user *const __user *__argv,
2042	const char __user *const __user *__envp)
 
2043{
2044	struct user_arg_ptr argv = { .ptr.native = __argv };
2045	struct user_arg_ptr envp = { .ptr.native = __envp };
2046	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
2047}
2048
2049static int do_execveat(int fd, struct filename *filename,
2050		const char __user *const __user *__argv,
2051		const char __user *const __user *__envp,
2052		int flags)
2053{
2054	struct user_arg_ptr argv = { .ptr.native = __argv };
2055	struct user_arg_ptr envp = { .ptr.native = __envp };
2056
2057	return do_execveat_common(fd, filename, argv, envp, flags);
2058}
2059
2060#ifdef CONFIG_COMPAT
2061static int compat_do_execve(struct filename *filename,
2062	const compat_uptr_t __user *__argv,
2063	const compat_uptr_t __user *__envp)
2064{
2065	struct user_arg_ptr argv = {
2066		.is_compat = true,
2067		.ptr.compat = __argv,
2068	};
2069	struct user_arg_ptr envp = {
2070		.is_compat = true,
2071		.ptr.compat = __envp,
2072	};
2073	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
2074}
2075
2076static int compat_do_execveat(int fd, struct filename *filename,
2077			      const compat_uptr_t __user *__argv,
2078			      const compat_uptr_t __user *__envp,
2079			      int flags)
2080{
2081	struct user_arg_ptr argv = {
2082		.is_compat = true,
2083		.ptr.compat = __argv,
2084	};
2085	struct user_arg_ptr envp = {
2086		.is_compat = true,
2087		.ptr.compat = __envp,
2088	};
2089	return do_execveat_common(fd, filename, argv, envp, flags);
2090}
2091#endif
2092
2093void set_binfmt(struct linux_binfmt *new)
2094{
2095	struct mm_struct *mm = current->mm;
2096
2097	if (mm->binfmt)
2098		module_put(mm->binfmt->module);
2099
2100	mm->binfmt = new;
2101	if (new)
2102		__module_get(new->module);
2103}
 
2104EXPORT_SYMBOL(set_binfmt);
2105
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2106/*
2107 * set_dumpable stores three-value SUID_DUMP_* into mm->flags.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2108 */
2109void set_dumpable(struct mm_struct *mm, int value)
2110{
2111	if (WARN_ON((unsigned)value > SUID_DUMP_ROOT))
2112		return;
2113
2114	set_mask_bits(&mm->flags, MMF_DUMPABLE_MASK, value);
 
 
 
 
 
 
 
 
 
 
 
 
 
2115}
2116
2117SYSCALL_DEFINE3(execve,
2118		const char __user *, filename,
2119		const char __user *const __user *, argv,
2120		const char __user *const __user *, envp)
2121{
2122	return do_execve(getname(filename), argv, envp);
 
 
 
2123}
2124
2125SYSCALL_DEFINE5(execveat,
2126		int, fd, const char __user *, filename,
2127		const char __user *const __user *, argv,
2128		const char __user *const __user *, envp,
2129		int, flags)
2130{
2131	return do_execveat(fd,
2132			   getname_uflags(filename, flags),
2133			   argv, envp, flags);
2134}
2135
2136#ifdef CONFIG_COMPAT
2137COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename,
2138	const compat_uptr_t __user *, argv,
2139	const compat_uptr_t __user *, envp)
2140{
2141	return compat_do_execve(getname(filename), argv, envp);
2142}
2143
2144COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
2145		       const char __user *, filename,
2146		       const compat_uptr_t __user *, argv,
2147		       const compat_uptr_t __user *, envp,
2148		       int,  flags)
2149{
2150	return compat_do_execveat(fd,
2151				  getname_uflags(filename, flags),
2152				  argv, envp, flags);
 
 
 
2153}
2154#endif
2155
2156#ifdef CONFIG_SYSCTL
2157
2158static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int write,
2159		void *buffer, size_t *lenp, loff_t *ppos)
 
 
 
 
 
 
 
 
 
 
2160{
2161	int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 
 
 
2162
2163	if (!error)
2164		validate_coredump_safety();
2165	return error;
2166}
2167
2168static struct ctl_table fs_exec_sysctls[] = {
2169	{
2170		.procname	= "suid_dumpable",
2171		.data		= &suid_dumpable,
2172		.maxlen		= sizeof(int),
2173		.mode		= 0644,
2174		.proc_handler	= proc_dointvec_minmax_coredump,
2175		.extra1		= SYSCTL_ZERO,
2176		.extra2		= SYSCTL_TWO,
2177	},
2178};
 
 
 
 
 
 
2179
2180static int __init init_fs_exec_sysctls(void)
2181{
2182	register_sysctl_init("fs", fs_exec_sysctls);
2183	return 0;
2184}
2185
2186fs_initcall(init_fs_exec_sysctls);
2187#endif /* CONFIG_SYSCTL */
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2188
2189#ifdef CONFIG_EXEC_KUNIT_TEST
2190#include "tests/exec_kunit.c"
2191#endif