binfmt_aout.c 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * linux/fs/binfmt_aout.c
  4. *
  5. * Copyright (C) 1991, 1992, 1996 Linus Torvalds
  6. */
  7. #include <linux/module.h>
  8. #include <linux/time.h>
  9. #include <linux/kernel.h>
  10. #include <linux/mm.h>
  11. #include <linux/mman.h>
  12. #include <linux/a.out.h>
  13. #include <linux/errno.h>
  14. #include <linux/signal.h>
  15. #include <linux/string.h>
  16. #include <linux/fs.h>
  17. #include <linux/file.h>
  18. #include <linux/stat.h>
  19. #include <linux/fcntl.h>
  20. #include <linux/ptrace.h>
  21. #include <linux/user.h>
  22. #include <linux/binfmts.h>
  23. #include <linux/personality.h>
  24. #include <linux/init.h>
  25. #include <linux/coredump.h>
  26. #include <linux/slab.h>
  27. #include <linux/sched/task_stack.h>
  28. #include <linux/uaccess.h>
  29. #include <asm/cacheflush.h>
  30. static int load_aout_binary(struct linux_binprm *);
  31. static int load_aout_library(struct file*);
  32. static struct linux_binfmt aout_format = {
  33. .module = THIS_MODULE,
  34. .load_binary = load_aout_binary,
  35. .load_shlib = load_aout_library,
  36. };
  37. #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
  38. static int set_brk(unsigned long start, unsigned long end)
  39. {
  40. start = PAGE_ALIGN(start);
  41. end = PAGE_ALIGN(end);
  42. if (end > start)
  43. return vm_brk(start, end - start);
  44. return 0;
  45. }
  46. /*
  47. * create_aout_tables() parses the env- and arg-strings in new user
  48. * memory and creates the pointer tables from them, and puts their
  49. * addresses on the "stack", returning the new stack pointer value.
  50. */
  51. static unsigned long __user *create_aout_tables(char __user *p, struct linux_binprm * bprm)
  52. {
  53. char __user * __user *argv;
  54. char __user * __user *envp;
  55. unsigned long __user *sp;
  56. int argc = bprm->argc;
  57. int envc = bprm->envc;
  58. sp = (void __user *)((-(unsigned long)sizeof(char *)) & (unsigned long) p);
  59. #ifdef __alpha__
  60. /* whee.. test-programs are so much fun. */
  61. put_user(0, --sp);
  62. put_user(0, --sp);
  63. if (bprm->loader) {
  64. put_user(0, --sp);
  65. put_user(1003, --sp);
  66. put_user(bprm->loader, --sp);
  67. put_user(1002, --sp);
  68. }
  69. put_user(bprm->exec, --sp);
  70. put_user(1001, --sp);
  71. #endif
  72. sp -= envc+1;
  73. envp = (char __user * __user *) sp;
  74. sp -= argc+1;
  75. argv = (char __user * __user *) sp;
  76. #ifndef __alpha__
  77. put_user((unsigned long) envp,--sp);
  78. put_user((unsigned long) argv,--sp);
  79. #endif
  80. put_user(argc,--sp);
  81. current->mm->arg_start = (unsigned long) p;
  82. while (argc-->0) {
  83. char c;
  84. put_user(p,argv++);
  85. do {
  86. get_user(c,p++);
  87. } while (c);
  88. }
  89. put_user(NULL,argv);
  90. current->mm->arg_end = current->mm->env_start = (unsigned long) p;
  91. while (envc-->0) {
  92. char c;
  93. put_user(p,envp++);
  94. do {
  95. get_user(c,p++);
  96. } while (c);
  97. }
  98. put_user(NULL,envp);
  99. current->mm->env_end = (unsigned long) p;
  100. return sp;
  101. }
  102. /*
  103. * These are the functions used to load a.out style executables and shared
  104. * libraries. There is no binary dependent code anywhere else.
  105. */
  106. static int load_aout_binary(struct linux_binprm * bprm)
  107. {
  108. struct pt_regs *regs = current_pt_regs();
  109. struct exec ex;
  110. unsigned long error;
  111. unsigned long fd_offset;
  112. unsigned long rlim;
  113. int retval;
  114. ex = *((struct exec *) bprm->buf); /* exec-header */
  115. if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != OMAGIC &&
  116. N_MAGIC(ex) != QMAGIC && N_MAGIC(ex) != NMAGIC) ||
  117. N_TRSIZE(ex) || N_DRSIZE(ex) ||
  118. i_size_read(file_inode(bprm->file)) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) {
  119. return -ENOEXEC;
  120. }
  121. /*
  122. * Requires a mmap handler. This prevents people from using a.out
  123. * as part of an exploit attack against /proc-related vulnerabilities.
  124. */
  125. if (!bprm->file->f_op->mmap)
  126. return -ENOEXEC;
  127. fd_offset = N_TXTOFF(ex);
  128. /* Check initial limits. This avoids letting people circumvent
  129. * size limits imposed on them by creating programs with large
  130. * arrays in the data or bss.
  131. */
  132. rlim = rlimit(RLIMIT_DATA);
  133. if (rlim >= RLIM_INFINITY)
  134. rlim = ~0;
  135. if (ex.a_data + ex.a_bss > rlim)
  136. return -ENOMEM;
  137. /* Flush all traces of the currently running executable */
  138. retval = begin_new_exec(bprm);
  139. if (retval)
  140. return retval;
  141. /* OK, This is the point of no return */
  142. #ifdef __alpha__
  143. SET_AOUT_PERSONALITY(bprm, ex);
  144. #else
  145. set_personality(PER_LINUX);
  146. #endif
  147. setup_new_exec(bprm);
  148. current->mm->end_code = ex.a_text +
  149. (current->mm->start_code = N_TXTADDR(ex));
  150. current->mm->end_data = ex.a_data +
  151. (current->mm->start_data = N_DATADDR(ex));
  152. current->mm->brk = ex.a_bss +
  153. (current->mm->start_brk = N_BSSADDR(ex));
  154. retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
  155. if (retval < 0)
  156. return retval;
  157. if (N_MAGIC(ex) == OMAGIC) {
  158. unsigned long text_addr, map_size;
  159. loff_t pos;
  160. text_addr = N_TXTADDR(ex);
  161. #ifdef __alpha__
  162. pos = fd_offset;
  163. map_size = ex.a_text+ex.a_data + PAGE_SIZE - 1;
  164. #else
  165. pos = 32;
  166. map_size = ex.a_text+ex.a_data;
  167. #endif
  168. error = vm_brk(text_addr & PAGE_MASK, map_size);
  169. if (error)
  170. return error;
  171. error = read_code(bprm->file, text_addr, pos,
  172. ex.a_text+ex.a_data);
  173. if ((signed long)error < 0)
  174. return error;
  175. } else {
  176. if ((ex.a_text & 0xfff || ex.a_data & 0xfff) &&
  177. (N_MAGIC(ex) != NMAGIC) && printk_ratelimit())
  178. {
  179. printk(KERN_NOTICE "executable not page aligned\n");
  180. }
  181. if ((fd_offset & ~PAGE_MASK) != 0 && printk_ratelimit())
  182. {
  183. printk(KERN_WARNING
  184. "fd_offset is not page aligned. Please convert program: %pD\n",
  185. bprm->file);
  186. }
  187. if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
  188. error = vm_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
  189. if (error)
  190. return error;
  191. read_code(bprm->file, N_TXTADDR(ex), fd_offset,
  192. ex.a_text + ex.a_data);
  193. goto beyond_if;
  194. }
  195. error = vm_mmap(bprm->file, N_TXTADDR(ex), ex.a_text,
  196. PROT_READ | PROT_EXEC,
  197. MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
  198. fd_offset);
  199. if (error != N_TXTADDR(ex))
  200. return error;
  201. error = vm_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
  202. PROT_READ | PROT_WRITE | PROT_EXEC,
  203. MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
  204. fd_offset + ex.a_text);
  205. if (error != N_DATADDR(ex))
  206. return error;
  207. }
  208. beyond_if:
  209. set_binfmt(&aout_format);
  210. retval = set_brk(current->mm->start_brk, current->mm->brk);
  211. if (retval < 0)
  212. return retval;
  213. current->mm->start_stack =
  214. (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
  215. #ifdef __alpha__
  216. regs->gp = ex.a_gpvalue;
  217. #endif
  218. finalize_exec(bprm);
  219. start_thread(regs, ex.a_entry, current->mm->start_stack);
  220. return 0;
  221. }
  222. static int load_aout_library(struct file *file)
  223. {
  224. struct inode * inode;
  225. unsigned long bss, start_addr, len;
  226. unsigned long error;
  227. int retval;
  228. struct exec ex;
  229. loff_t pos = 0;
  230. inode = file_inode(file);
  231. retval = -ENOEXEC;
  232. error = kernel_read(file, &ex, sizeof(ex), &pos);
  233. if (error != sizeof(ex))
  234. goto out;
  235. /* We come in here for the regular a.out style of shared libraries */
  236. if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != QMAGIC) || N_TRSIZE(ex) ||
  237. N_DRSIZE(ex) || ((ex.a_entry & 0xfff) && N_MAGIC(ex) == ZMAGIC) ||
  238. i_size_read(inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) {
  239. goto out;
  240. }
  241. /*
  242. * Requires a mmap handler. This prevents people from using a.out
  243. * as part of an exploit attack against /proc-related vulnerabilities.
  244. */
  245. if (!file->f_op->mmap)
  246. goto out;
  247. if (N_FLAGS(ex))
  248. goto out;
  249. /* For QMAGIC, the starting address is 0x20 into the page. We mask
  250. this off to get the starting address for the page */
  251. start_addr = ex.a_entry & 0xfffff000;
  252. if ((N_TXTOFF(ex) & ~PAGE_MASK) != 0) {
  253. if (printk_ratelimit())
  254. {
  255. printk(KERN_WARNING
  256. "N_TXTOFF is not page aligned. Please convert library: %pD\n",
  257. file);
  258. }
  259. retval = vm_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
  260. if (retval)
  261. goto out;
  262. read_code(file, start_addr, N_TXTOFF(ex),
  263. ex.a_text + ex.a_data);
  264. retval = 0;
  265. goto out;
  266. }
  267. /* Now use mmap to map the library into memory. */
  268. error = vm_mmap(file, start_addr, ex.a_text + ex.a_data,
  269. PROT_READ | PROT_WRITE | PROT_EXEC,
  270. MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
  271. N_TXTOFF(ex));
  272. retval = error;
  273. if (error != start_addr)
  274. goto out;
  275. len = PAGE_ALIGN(ex.a_text + ex.a_data);
  276. bss = ex.a_text + ex.a_data + ex.a_bss;
  277. if (bss > len) {
  278. retval = vm_brk(start_addr + len, bss - len);
  279. if (retval)
  280. goto out;
  281. }
  282. retval = 0;
  283. out:
  284. return retval;
  285. }
  286. static int __init init_aout_binfmt(void)
  287. {
  288. register_binfmt(&aout_format);
  289. return 0;
  290. }
  291. static void __exit exit_aout_binfmt(void)
  292. {
  293. unregister_binfmt(&aout_format);
  294. }
  295. core_initcall(init_aout_binfmt);
  296. module_exit(exit_aout_binfmt);
  297. MODULE_LICENSE("GPL");