1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  linux/fs/exec.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  */
7 
8 /*
9  * #!-checking implemented by tytso.
10  */
11 /*
12  * Demand-loading implemented 01.12.91 - no need to read anything but
13  * the header into memory. The inode of the executable is put into
14  * "current->executable", and page faults do the actual loading. Clean.
15  *
16  * Once more I can proudly say that linux stood up to being changed: it
17  * was less than 2 hours work to get demand-loading completely implemented.
18  *
19  * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
20  * current->executable is only used by the procfs.  This allows a dispatch
21  * table to check for several different types  of binary formats.  We keep
22  * trying until we recognize the file or we run out of supported binary
23  * formats.
24  */
25 
26 #include <linux/kernel_read_file.h>
27 #include <linux/slab.h>
28 #include <linux/file.h>
29 #include <linux/fdtable.h>
30 #include <linux/mm.h>
31 #include <linux/stat.h>
32 #include <linux/fcntl.h>
33 #include <linux/swap.h>
34 #include <linux/string.h>
35 #include <linux/init.h>
36 #include <linux/sched/mm.h>
37 #include <linux/sched/coredump.h>
38 #include <linux/sched/signal.h>
39 #include <linux/sched/numa_balancing.h>
40 #include <linux/sched/task.h>
41 #include <linux/pagemap.h>
42 #include <linux/perf_event.h>
43 #include <linux/highmem.h>
44 #include <linux/spinlock.h>
45 #include <linux/key.h>
46 #include <linux/personality.h>
47 #include <linux/binfmts.h>
48 #include <linux/utsname.h>
49 #include <linux/pid_namespace.h>
50 #include <linux/module.h>
51 #include <linux/namei.h>
52 #include <linux/mount.h>
53 #include <linux/security.h>
54 #include <linux/syscalls.h>
55 #include <linux/tsacct_kern.h>
56 #include <linux/cn_proc.h>
57 #include <linux/audit.h>
58 #include <linux/kmod.h>
59 #include <linux/fsnotify.h>
60 #include <linux/fs_struct.h>
61 #include <linux/oom.h>
62 #include <linux/compat.h>
63 #include <linux/vmalloc.h>
64 #include <linux/io_uring.h>
65 #include <linux/syscall_user_dispatch.h>
66 #include <linux/coredump.h>
67 
68 #include <linux/uaccess.h>
69 #include <asm/mmu_context.h>
70 #include <asm/tlb.h>
71 
72 #include <trace/events/task.h>
73 #include "internal.h"
74 
75 #include <trace/events/sched.h>
76 
77 static int bprm_creds_from_file(struct linux_binprm *bprm);
78 
79 int suid_dumpable = 0;
80 
81 static LIST_HEAD(formats);
82 static DEFINE_RWLOCK(binfmt_lock);
83 
__register_binfmt(struct linux_binfmt * fmt,int insert)84 void __register_binfmt(struct linux_binfmt * fmt, int insert)
85 {
86 	write_lock(&binfmt_lock);
87 	insert ? list_add(&fmt->lh, &formats) :
88 		 list_add_tail(&fmt->lh, &formats);
89 	write_unlock(&binfmt_lock);
90 }
91 
92 EXPORT_SYMBOL(__register_binfmt);
93 
unregister_binfmt(struct linux_binfmt * fmt)94 void unregister_binfmt(struct linux_binfmt * fmt)
95 {
96 	write_lock(&binfmt_lock);
97 	list_del(&fmt->lh);
98 	write_unlock(&binfmt_lock);
99 }
100 
101 EXPORT_SYMBOL(unregister_binfmt);
102 
put_binfmt(struct linux_binfmt * fmt)103 static inline void put_binfmt(struct linux_binfmt * fmt)
104 {
105 	module_put(fmt->module);
106 }
107 
path_noexec(const struct path * path)108 bool path_noexec(const struct path *path)
109 {
110 	return (path->mnt->mnt_flags & MNT_NOEXEC) ||
111 	       (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC);
112 }
113 
114 #ifdef CONFIG_USELIB
115 /*
116  * Note that a shared library must be both readable and executable due to
117  * security reasons.
118  *
119  * Also note that we take the address to load from the file itself.
120  */
SYSCALL_DEFINE1(uselib,const char __user *,library)121 SYSCALL_DEFINE1(uselib, const char __user *, library)
122 {
123 	struct linux_binfmt *fmt;
124 	struct file *file;
125 	struct filename *tmp = getname(library);
126 	int error = PTR_ERR(tmp);
127 	static const struct open_flags uselib_flags = {
128 		.open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
129 		.acc_mode = MAY_READ | MAY_EXEC,
130 		.intent = LOOKUP_OPEN,
131 		.lookup_flags = LOOKUP_FOLLOW,
132 	};
133 
134 	if (IS_ERR(tmp))
135 		goto out;
136 
137 	file = do_filp_open(AT_FDCWD, tmp, &uselib_flags);
138 	putname(tmp);
139 	error = PTR_ERR(file);
140 	if (IS_ERR(file))
141 		goto out;
142 
143 	/*
144 	 * may_open() has already checked for this, so it should be
145 	 * impossible to trip now. But we need to be extra cautious
146 	 * and check again at the very end too.
147 	 */
148 	error = -EACCES;
149 	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) ||
150 			 path_noexec(&file->f_path)))
151 		goto exit;
152 
153 	fsnotify_open(file);
154 
155 	error = -ENOEXEC;
156 
157 	read_lock(&binfmt_lock);
158 	list_for_each_entry(fmt, &formats, lh) {
159 		if (!fmt->load_shlib)
160 			continue;
161 		if (!try_module_get(fmt->module))
162 			continue;
163 		read_unlock(&binfmt_lock);
164 		error = fmt->load_shlib(file);
165 		read_lock(&binfmt_lock);
166 		put_binfmt(fmt);
167 		if (error != -ENOEXEC)
168 			break;
169 	}
170 	read_unlock(&binfmt_lock);
171 exit:
172 	fput(file);
173 out:
174   	return error;
175 }
176 #endif /* #ifdef CONFIG_USELIB */
177 
178 #ifdef CONFIG_MMU
179 /*
180  * The nascent bprm->mm is not visible until exec_mmap() but it can
181  * use a lot of memory, account these pages in current->mm temporary
182  * for oom_badness()->get_mm_rss(). Once exec succeeds or fails, we
183  * change the counter back via acct_arg_size(0).
184  */
acct_arg_size(struct linux_binprm * bprm,unsigned long pages)185 static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
186 {
187 	struct mm_struct *mm = current->mm;
188 	long diff = (long)(pages - bprm->vma_pages);
189 
190 	if (!mm || !diff)
191 		return;
192 
193 	bprm->vma_pages = pages;
194 	add_mm_counter(mm, MM_ANONPAGES, diff);
195 }
196 
get_arg_page(struct linux_binprm * bprm,unsigned long pos,int write)197 static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
198 		int write)
199 {
200 	struct page *page;
201 	int ret;
202 	unsigned int gup_flags = FOLL_FORCE;
203 
204 #ifdef CONFIG_STACK_GROWSUP
205 	if (write) {
206 		ret = expand_downwards(bprm->vma, pos);
207 		if (ret < 0)
208 			return NULL;
209 	}
210 #endif
211 
212 	if (write)
213 		gup_flags |= FOLL_WRITE;
214 
215 	/*
216 	 * We are doing an exec().  'current' is the process
217 	 * doing the exec and bprm->mm is the new process's mm.
218 	 */
219 	mmap_read_lock(bprm->mm);
220 	ret = get_user_pages_remote(bprm->mm, pos, 1, gup_flags,
221 			&page, NULL, NULL);
222 	mmap_read_unlock(bprm->mm);
223 	if (ret <= 0)
224 		return NULL;
225 
226 	if (write)
227 		acct_arg_size(bprm, vma_pages(bprm->vma));
228 
229 	return page;
230 }
231 
put_arg_page(struct page * page)232 static void put_arg_page(struct page *page)
233 {
234 	put_page(page);
235 }
236 
free_arg_pages(struct linux_binprm * bprm)237 static void free_arg_pages(struct linux_binprm *bprm)
238 {
239 }
240 
flush_arg_page(struct linux_binprm * bprm,unsigned long pos,struct page * page)241 static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
242 		struct page *page)
243 {
244 	flush_cache_page(bprm->vma, pos, page_to_pfn(page));
245 }
246 
__bprm_mm_init(struct linux_binprm * bprm)247 static int __bprm_mm_init(struct linux_binprm *bprm)
248 {
249 	int err;
250 	struct vm_area_struct *vma = NULL;
251 	struct mm_struct *mm = bprm->mm;
252 
253 	bprm->vma = vma = vm_area_alloc(mm);
254 	if (!vma)
255 		return -ENOMEM;
256 	vma_set_anonymous(vma);
257 
258 	if (mmap_write_lock_killable(mm)) {
259 		err = -EINTR;
260 		goto err_free;
261 	}
262 
263 	/*
264 	 * Place the stack at the largest stack address the architecture
265 	 * supports. Later, we'll move this to an appropriate place. We don't
266 	 * use STACK_TOP because that can depend on attributes which aren't
267 	 * configured yet.
268 	 */
269 	BUILD_BUG_ON(VM_STACK_FLAGS & VM_STACK_INCOMPLETE_SETUP);
270 	vma->vm_end = STACK_TOP_MAX;
271 	vma->vm_start = vma->vm_end - PAGE_SIZE;
272 	vma->vm_flags = VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
273 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
274 
275 	err = insert_vm_struct(mm, vma);
276 	if (err)
277 		goto err;
278 
279 	mm->stack_vm = mm->total_vm = 1;
280 	mmap_write_unlock(mm);
281 	bprm->p = vma->vm_end - sizeof(void *);
282 	return 0;
283 err:
284 	mmap_write_unlock(mm);
285 err_free:
286 	bprm->vma = NULL;
287 	vm_area_free(vma);
288 	return err;
289 }
290 
valid_arg_len(struct linux_binprm * bprm,long len)291 static bool valid_arg_len(struct linux_binprm *bprm, long len)
292 {
293 	return len <= MAX_ARG_STRLEN;
294 }
295 
296 #else
297 
acct_arg_size(struct linux_binprm * bprm,unsigned long pages)298 static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
299 {
300 }
301 
get_arg_page(struct linux_binprm * bprm,unsigned long pos,int write)302 static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
303 		int write)
304 {
305 	struct page *page;
306 
307 	page = bprm->page[pos / PAGE_SIZE];
308 	if (!page && write) {
309 		page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
310 		if (!page)
311 			return NULL;
312 		bprm->page[pos / PAGE_SIZE] = page;
313 	}
314 
315 	return page;
316 }
317 
put_arg_page(struct page * page)318 static void put_arg_page(struct page *page)
319 {
320 }
321 
free_arg_page(struct linux_binprm * bprm,int i)322 static void free_arg_page(struct linux_binprm *bprm, int i)
323 {
324 	if (bprm->page[i]) {
325 		__free_page(bprm->page[i]);
326 		bprm->page[i] = NULL;
327 	}
328 }
329 
free_arg_pages(struct linux_binprm * bprm)330 static void free_arg_pages(struct linux_binprm *bprm)
331 {
332 	int i;
333 
334 	for (i = 0; i < MAX_ARG_PAGES; i++)
335 		free_arg_page(bprm, i);
336 }
337 
flush_arg_page(struct linux_binprm * bprm,unsigned long pos,struct page * page)338 static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
339 		struct page *page)
340 {
341 }
342 
__bprm_mm_init(struct linux_binprm * bprm)343 static int __bprm_mm_init(struct linux_binprm *bprm)
344 {
345 	bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
346 	return 0;
347 }
348 
valid_arg_len(struct linux_binprm * bprm,long len)349 static bool valid_arg_len(struct linux_binprm *bprm, long len)
350 {
351 	return len <= bprm->p;
352 }
353 
354 #endif /* CONFIG_MMU */
355 
356 /*
357  * Create a new mm_struct and populate it with a temporary stack
358  * vm_area_struct.  We don't have enough context at this point to set the stack
359  * flags, permissions, and offset, so we use temporary values.  We'll update
360  * them later in setup_arg_pages().
361  */
bprm_mm_init(struct linux_binprm * bprm)362 static int bprm_mm_init(struct linux_binprm *bprm)
363 {
364 	int err;
365 	struct mm_struct *mm = NULL;
366 
367 	bprm->mm = mm = mm_alloc();
368 	err = -ENOMEM;
369 	if (!mm)
370 		goto err;
371 
372 	/* Save current stack limit for all calculations made during exec. */
373 	task_lock(current->group_leader);
374 	bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];
375 	task_unlock(current->group_leader);
376 
377 	err = __bprm_mm_init(bprm);
378 	if (err)
379 		goto err;
380 
381 	return 0;
382 
383 err:
384 	if (mm) {
385 		bprm->mm = NULL;
386 		mmdrop(mm);
387 	}
388 
389 	return err;
390 }
391 
392 struct user_arg_ptr {
393 #ifdef CONFIG_COMPAT
394 	bool is_compat;
395 #endif
396 	union {
397 		const char __user *const __user *native;
398 #ifdef CONFIG_COMPAT
399 		const compat_uptr_t __user *compat;
400 #endif
401 	} ptr;
402 };
403 
get_user_arg_ptr(struct user_arg_ptr argv,int nr)404 static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
405 {
406 	const char __user *native;
407 
408 #ifdef CONFIG_COMPAT
409 	if (unlikely(argv.is_compat)) {
410 		compat_uptr_t compat;
411 
412 		if (get_user(compat, argv.ptr.compat + nr))
413 			return ERR_PTR(-EFAULT);
414 
415 		return compat_ptr(compat);
416 	}
417 #endif
418 
419 	if (get_user(native, argv.ptr.native + nr))
420 		return ERR_PTR(-EFAULT);
421 
422 	return native;
423 }
424 
425 /*
426  * count() counts the number of strings in array ARGV.
427  */
count(struct user_arg_ptr argv,int max)428 static int count(struct user_arg_ptr argv, int max)
429 {
430 	int i = 0;
431 
432 	if (argv.ptr.native != NULL) {
433 		for (;;) {
434 			const char __user *p = get_user_arg_ptr(argv, i);
435 
436 			if (!p)
437 				break;
438 
439 			if (IS_ERR(p))
440 				return -EFAULT;
441 
442 			if (i >= max)
443 				return -E2BIG;
444 			++i;
445 
446 			if (fatal_signal_pending(current))
447 				return -ERESTARTNOHAND;
448 			cond_resched();
449 		}
450 	}
451 	return i;
452 }
453 
count_strings_kernel(const char * const * argv)454 static int count_strings_kernel(const char *const *argv)
455 {
456 	int i;
457 
458 	if (!argv)
459 		return 0;
460 
461 	for (i = 0; argv[i]; ++i) {
462 		if (i >= MAX_ARG_STRINGS)
463 			return -E2BIG;
464 		if (fatal_signal_pending(current))
465 			return -ERESTARTNOHAND;
466 		cond_resched();
467 	}
468 	return i;
469 }
470 
bprm_stack_limits(struct linux_binprm * bprm)471 static int bprm_stack_limits(struct linux_binprm *bprm)
472 {
473 	unsigned long limit, ptr_size;
474 
475 	/*
476 	 * Limit to 1/4 of the max stack size or 3/4 of _STK_LIM
477 	 * (whichever is smaller) for the argv+env strings.
478 	 * This ensures that:
479 	 *  - the remaining binfmt code will not run out of stack space,
480 	 *  - the program will have a reasonable amount of stack left
481 	 *    to work from.
482 	 */
483 	limit = _STK_LIM / 4 * 3;
484 	limit = min(limit, bprm->rlim_stack.rlim_cur / 4);
485 	/*
486 	 * We've historically supported up to 32 pages (ARG_MAX)
487 	 * of argument strings even with small stacks
488 	 */
489 	limit = max_t(unsigned long, limit, ARG_MAX);
490 	/*
491 	 * We must account for the size of all the argv and envp pointers to
492 	 * the argv and envp strings, since they will also take up space in
493 	 * the stack. They aren't stored until much later when we can't
494 	 * signal to the parent that the child has run out of stack space.
495 	 * Instead, calculate it here so it's possible to fail gracefully.
496 	 *
497 	 * In the case of argc = 0, make sure there is space for adding a
498 	 * empty string (which will bump argc to 1), to ensure confused
499 	 * userspace programs don't start processing from argv[1], thinking
500 	 * argc can never be 0, to keep them from walking envp by accident.
501 	 * See do_execveat_common().
502 	 */
503 	ptr_size = (max(bprm->argc, 1) + bprm->envc) * sizeof(void *);
504 	if (limit <= ptr_size)
505 		return -E2BIG;
506 	limit -= ptr_size;
507 
508 	bprm->argmin = bprm->p - limit;
509 	return 0;
510 }
511 
512 /*
513  * 'copy_strings()' copies argument/environment strings from the old
514  * processes's memory to the new process's stack.  The call to get_user_pages()
515  * ensures the destination page is created and not swapped out.
516  */
copy_strings(int argc,struct user_arg_ptr argv,struct linux_binprm * bprm)517 static int copy_strings(int argc, struct user_arg_ptr argv,
518 			struct linux_binprm *bprm)
519 {
520 	struct page *kmapped_page = NULL;
521 	char *kaddr = NULL;
522 	unsigned long kpos = 0;
523 	int ret;
524 
525 	while (argc-- > 0) {
526 		const char __user *str;
527 		int len;
528 		unsigned long pos;
529 
530 		ret = -EFAULT;
531 		str = get_user_arg_ptr(argv, argc);
532 		if (IS_ERR(str))
533 			goto out;
534 
535 		len = strnlen_user(str, MAX_ARG_STRLEN);
536 		if (!len)
537 			goto out;
538 
539 		ret = -E2BIG;
540 		if (!valid_arg_len(bprm, len))
541 			goto out;
542 
543 		/* We're going to work our way backwards. */
544 		pos = bprm->p;
545 		str += len;
546 		bprm->p -= len;
547 #ifdef CONFIG_MMU
548 		if (bprm->p < bprm->argmin)
549 			goto out;
550 #endif
551 
552 		while (len > 0) {
553 			int offset, bytes_to_copy;
554 
555 			if (fatal_signal_pending(current)) {
556 				ret = -ERESTARTNOHAND;
557 				goto out;
558 			}
559 			cond_resched();
560 
561 			offset = pos % PAGE_SIZE;
562 			if (offset == 0)
563 				offset = PAGE_SIZE;
564 
565 			bytes_to_copy = offset;
566 			if (bytes_to_copy > len)
567 				bytes_to_copy = len;
568 
569 			offset -= bytes_to_copy;
570 			pos -= bytes_to_copy;
571 			str -= bytes_to_copy;
572 			len -= bytes_to_copy;
573 
574 			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
575 				struct page *page;
576 
577 				page = get_arg_page(bprm, pos, 1);
578 				if (!page) {
579 					ret = -E2BIG;
580 					goto out;
581 				}
582 
583 				if (kmapped_page) {
584 					flush_dcache_page(kmapped_page);
585 					kunmap_local(kaddr);
586 					put_arg_page(kmapped_page);
587 				}
588 				kmapped_page = page;
589 				kaddr = kmap_local_page(kmapped_page);
590 				kpos = pos & PAGE_MASK;
591 				flush_arg_page(bprm, kpos, kmapped_page);
592 			}
593 			if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
594 				ret = -EFAULT;
595 				goto out;
596 			}
597 		}
598 	}
599 	ret = 0;
600 out:
601 	if (kmapped_page) {
602 		flush_dcache_page(kmapped_page);
603 		kunmap_local(kaddr);
604 		put_arg_page(kmapped_page);
605 	}
606 	return ret;
607 }
608 
609 /*
610  * Copy and argument/environment string from the kernel to the processes stack.
611  */
copy_string_kernel(const char * arg,struct linux_binprm * bprm)612 int copy_string_kernel(const char *arg, struct linux_binprm *bprm)
613 {
614 	int len = strnlen(arg, MAX_ARG_STRLEN) + 1 /* terminating NUL */;
615 	unsigned long pos = bprm->p;
616 
617 	if (len == 0)
618 		return -EFAULT;
619 	if (!valid_arg_len(bprm, len))
620 		return -E2BIG;
621 
622 	/* We're going to work our way backwards. */
623 	arg += len;
624 	bprm->p -= len;
625 	if (IS_ENABLED(CONFIG_MMU) && bprm->p < bprm->argmin)
626 		return -E2BIG;
627 
628 	while (len > 0) {
629 		unsigned int bytes_to_copy = min_t(unsigned int, len,
630 				min_not_zero(offset_in_page(pos), PAGE_SIZE));
631 		struct page *page;
632 
633 		pos -= bytes_to_copy;
634 		arg -= bytes_to_copy;
635 		len -= bytes_to_copy;
636 
637 		page = get_arg_page(bprm, pos, 1);
638 		if (!page)
639 			return -E2BIG;
640 		flush_arg_page(bprm, pos & PAGE_MASK, page);
641 		memcpy_to_page(page, offset_in_page(pos), arg, bytes_to_copy);
642 		put_arg_page(page);
643 	}
644 
645 	return 0;
646 }
647 EXPORT_SYMBOL(copy_string_kernel);
648 
copy_strings_kernel(int argc,const char * const * argv,struct linux_binprm * bprm)649 static int copy_strings_kernel(int argc, const char *const *argv,
650 			       struct linux_binprm *bprm)
651 {
652 	while (argc-- > 0) {
653 		int ret = copy_string_kernel(argv[argc], bprm);
654 		if (ret < 0)
655 			return ret;
656 		if (fatal_signal_pending(current))
657 			return -ERESTARTNOHAND;
658 		cond_resched();
659 	}
660 	return 0;
661 }
662 
663 #ifdef CONFIG_MMU
664 
665 /*
666  * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX.  Once
667  * the binfmt code determines where the new stack should reside, we shift it to
668  * its final location.  The process proceeds as follows:
669  *
670  * 1) Use shift to calculate the new vma endpoints.
671  * 2) Extend vma to cover both the old and new ranges.  This ensures the
672  *    arguments passed to subsequent functions are consistent.
673  * 3) Move vma's page tables to the new range.
674  * 4) Free up any cleared pgd range.
675  * 5) Shrink the vma to cover only the new range.
676  */
shift_arg_pages(struct vm_area_struct * vma,unsigned long shift)677 static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
678 {
679 	struct mm_struct *mm = vma->vm_mm;
680 	unsigned long old_start = vma->vm_start;
681 	unsigned long old_end = vma->vm_end;
682 	unsigned long length = old_end - old_start;
683 	unsigned long new_start = old_start - shift;
684 	unsigned long new_end = old_end - shift;
685 	VMA_ITERATOR(vmi, mm, new_start);
686 	struct vm_area_struct *next;
687 	struct mmu_gather tlb;
688 
689 	BUG_ON(new_start > new_end);
690 
691 	/*
692 	 * ensure there are no vmas between where we want to go
693 	 * and where we are
694 	 */
695 	if (vma != vma_next(&vmi))
696 		return -EFAULT;
697 
698 	/*
699 	 * cover the whole range: [new_start, old_end)
700 	 */
701 	if (vma_adjust(vma, new_start, old_end, vma->vm_pgoff, NULL))
702 		return -ENOMEM;
703 
704 	/*
705 	 * move the page tables downwards, on failure we rely on
706 	 * process cleanup to remove whatever mess we made.
707 	 */
708 	if (length != move_page_tables(vma, old_start,
709 				       vma, new_start, length, false))
710 		return -ENOMEM;
711 
712 	lru_add_drain();
713 	tlb_gather_mmu(&tlb, mm);
714 	next = vma_next(&vmi);
715 	if (new_end > old_start) {
716 		/*
717 		 * when the old and new regions overlap clear from new_end.
718 		 */
719 		free_pgd_range(&tlb, new_end, old_end, new_end,
720 			next ? next->vm_start : USER_PGTABLES_CEILING);
721 	} else {
722 		/*
723 		 * otherwise, clean from old_start; this is done to not touch
724 		 * the address space in [new_end, old_start) some architectures
725 		 * have constraints on va-space that make this illegal (IA64) -
726 		 * for the others its just a little faster.
727 		 */
728 		free_pgd_range(&tlb, old_start, old_end, new_end,
729 			next ? next->vm_start : USER_PGTABLES_CEILING);
730 	}
731 	tlb_finish_mmu(&tlb);
732 
733 	/*
734 	 * Shrink the vma to just the new range.  Always succeeds.
735 	 */
736 	vma_adjust(vma, new_start, new_end, vma->vm_pgoff, NULL);
737 
738 	return 0;
739 }
740 
741 /*
742  * Finalizes the stack vm_area_struct. The flags and permissions are updated,
743  * the stack is optionally relocated, and some extra space is added.
744  */
setup_arg_pages(struct linux_binprm * bprm,unsigned long stack_top,int executable_stack)745 int setup_arg_pages(struct linux_binprm *bprm,
746 		    unsigned long stack_top,
747 		    int executable_stack)
748 {
749 	unsigned long ret;
750 	unsigned long stack_shift;
751 	struct mm_struct *mm = current->mm;
752 	struct vm_area_struct *vma = bprm->vma;
753 	struct vm_area_struct *prev = NULL;
754 	unsigned long vm_flags;
755 	unsigned long stack_base;
756 	unsigned long stack_size;
757 	unsigned long stack_expand;
758 	unsigned long rlim_stack;
759 	struct mmu_gather tlb;
760 
761 #ifdef CONFIG_STACK_GROWSUP
762 	/* Limit stack size */
763 	stack_base = bprm->rlim_stack.rlim_max;
764 
765 	stack_base = calc_max_stack_size(stack_base);
766 
767 	/* Add space for stack randomization. */
768 	stack_base += (STACK_RND_MASK << PAGE_SHIFT);
769 
770 	/* Make sure we didn't let the argument array grow too large. */
771 	if (vma->vm_end - vma->vm_start > stack_base)
772 		return -ENOMEM;
773 
774 	stack_base = PAGE_ALIGN(stack_top - stack_base);
775 
776 	stack_shift = vma->vm_start - stack_base;
777 	mm->arg_start = bprm->p - stack_shift;
778 	bprm->p = vma->vm_end - stack_shift;
779 #else
780 	stack_top = arch_align_stack(stack_top);
781 	stack_top = PAGE_ALIGN(stack_top);
782 
783 	if (unlikely(stack_top < mmap_min_addr) ||
784 	    unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
785 		return -ENOMEM;
786 
787 	stack_shift = vma->vm_end - stack_top;
788 
789 	bprm->p -= stack_shift;
790 	mm->arg_start = bprm->p;
791 #endif
792 
793 	if (bprm->loader)
794 		bprm->loader -= stack_shift;
795 	bprm->exec -= stack_shift;
796 
797 	if (mmap_write_lock_killable(mm))
798 		return -EINTR;
799 
800 	vm_flags = VM_STACK_FLAGS;
801 
802 	/*
803 	 * Adjust stack execute permissions; explicitly enable for
804 	 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
805 	 * (arch default) otherwise.
806 	 */
807 	if (unlikely(executable_stack == EXSTACK_ENABLE_X))
808 		vm_flags |= VM_EXEC;
809 	else if (executable_stack == EXSTACK_DISABLE_X)
810 		vm_flags &= ~VM_EXEC;
811 	vm_flags |= mm->def_flags;
812 	vm_flags |= VM_STACK_INCOMPLETE_SETUP;
813 
814 	tlb_gather_mmu(&tlb, mm);
815 	ret = mprotect_fixup(&tlb, vma, &prev, vma->vm_start, vma->vm_end,
816 			vm_flags);
817 	tlb_finish_mmu(&tlb);
818 
819 	if (ret)
820 		goto out_unlock;
821 	BUG_ON(prev != vma);
822 
823 	if (unlikely(vm_flags & VM_EXEC)) {
824 		pr_warn_once("process '%pD4' started with executable stack\n",
825 			     bprm->file);
826 	}
827 
828 	/* Move stack pages down in memory. */
829 	if (stack_shift) {
830 		ret = shift_arg_pages(vma, stack_shift);
831 		if (ret)
832 			goto out_unlock;
833 	}
834 
835 	/* mprotect_fixup is overkill to remove the temporary stack flags */
836 	vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
837 
838 	stack_expand = 131072UL; /* randomly 32*4k (or 2*64k) pages */
839 	stack_size = vma->vm_end - vma->vm_start;
840 	/*
841 	 * Align this down to a page boundary as expand_stack
842 	 * will align it up.
843 	 */
844 	rlim_stack = bprm->rlim_stack.rlim_cur & PAGE_MASK;
845 #ifdef CONFIG_STACK_GROWSUP
846 	if (stack_size + stack_expand > rlim_stack)
847 		stack_base = vma->vm_start + rlim_stack;
848 	else
849 		stack_base = vma->vm_end + stack_expand;
850 #else
851 	if (stack_size + stack_expand > rlim_stack)
852 		stack_base = vma->vm_end - rlim_stack;
853 	else
854 		stack_base = vma->vm_start - stack_expand;
855 #endif
856 	current->mm->start_stack = bprm->p;
857 	ret = expand_stack(vma, stack_base);
858 	if (ret)
859 		ret = -EFAULT;
860 
861 out_unlock:
862 	mmap_write_unlock(mm);
863 	return ret;
864 }
865 EXPORT_SYMBOL(setup_arg_pages);
866 
867 #else
868 
869 /*
870  * Transfer the program arguments and environment from the holding pages
871  * onto the stack. The provided stack pointer is adjusted accordingly.
872  */
transfer_args_to_stack(struct linux_binprm * bprm,unsigned long * sp_location)873 int transfer_args_to_stack(struct linux_binprm *bprm,
874 			   unsigned long *sp_location)
875 {
876 	unsigned long index, stop, sp;
877 	int ret = 0;
878 
879 	stop = bprm->p >> PAGE_SHIFT;
880 	sp = *sp_location;
881 
882 	for (index = MAX_ARG_PAGES - 1; index >= stop; index--) {
883 		unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0;
884 		char *src = kmap_local_page(bprm->page[index]) + offset;
885 		sp -= PAGE_SIZE - offset;
886 		if (copy_to_user((void *) sp, src, PAGE_SIZE - offset) != 0)
887 			ret = -EFAULT;
888 		kunmap_local(src);
889 		if (ret)
890 			goto out;
891 	}
892 
893 	*sp_location = sp;
894 
895 out:
896 	return ret;
897 }
898 EXPORT_SYMBOL(transfer_args_to_stack);
899 
900 #endif /* CONFIG_MMU */
901 
do_open_execat(int fd,struct filename * name,int flags)902 static struct file *do_open_execat(int fd, struct filename *name, int flags)
903 {
904 	struct file *file;
905 	int err;
906 	struct open_flags open_exec_flags = {
907 		.open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
908 		.acc_mode = MAY_EXEC,
909 		.intent = LOOKUP_OPEN,
910 		.lookup_flags = LOOKUP_FOLLOW,
911 	};
912 
913 	if ((flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
914 		return ERR_PTR(-EINVAL);
915 	if (flags & AT_SYMLINK_NOFOLLOW)
916 		open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW;
917 	if (flags & AT_EMPTY_PATH)
918 		open_exec_flags.lookup_flags |= LOOKUP_EMPTY;
919 
920 	file = do_filp_open(fd, name, &open_exec_flags);
921 	if (IS_ERR(file))
922 		goto out;
923 
924 	/*
925 	 * may_open() has already checked for this, so it should be
926 	 * impossible to trip now. But we need to be extra cautious
927 	 * and check again at the very end too.
928 	 */
929 	err = -EACCES;
930 	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) ||
931 			 path_noexec(&file->f_path)))
932 		goto exit;
933 
934 	err = deny_write_access(file);
935 	if (err)
936 		goto exit;
937 
938 	if (name->name[0] != '\0')
939 		fsnotify_open(file);
940 
941 out:
942 	return file;
943 
944 exit:
945 	fput(file);
946 	return ERR_PTR(err);
947 }
948 
open_exec(const char * name)949 struct file *open_exec(const char *name)
950 {
951 	struct filename *filename = getname_kernel(name);
952 	struct file *f = ERR_CAST(filename);
953 
954 	if (!IS_ERR(filename)) {
955 		f = do_open_execat(AT_FDCWD, filename, 0);
956 		putname(filename);
957 	}
958 	return f;
959 }
960 EXPORT_SYMBOL(open_exec);
961 
962 #if defined(CONFIG_BINFMT_FLAT) || defined(CONFIG_BINFMT_ELF_FDPIC)
read_code(struct file * file,unsigned long addr,loff_t pos,size_t len)963 ssize_t read_code(struct file *file, unsigned long addr, loff_t pos, size_t len)
964 {
965 	ssize_t res = vfs_read(file, (void __user *)addr, len, &pos);
966 	if (res > 0)
967 		flush_icache_user_range(addr, addr + len);
968 	return res;
969 }
970 EXPORT_SYMBOL(read_code);
971 #endif
972 
973 /*
974  * Maps the mm_struct mm into the current task struct.
975  * On success, this function returns with exec_update_lock
976  * held for writing.
977  */
exec_mmap(struct mm_struct * mm)978 static int exec_mmap(struct mm_struct *mm)
979 {
980 	struct task_struct *tsk;
981 	struct mm_struct *old_mm, *active_mm;
982 	int ret;
983 
984 	/* Notify parent that we're no longer interested in the old VM */
985 	tsk = current;
986 	old_mm = current->mm;
987 	exec_mm_release(tsk, old_mm);
988 	if (old_mm)
989 		sync_mm_rss(old_mm);
990 
991 	ret = down_write_killable(&tsk->signal->exec_update_lock);
992 	if (ret)
993 		return ret;
994 
995 	if (old_mm) {
996 		/*
997 		 * If there is a pending fatal signal perhaps a signal
998 		 * whose default action is to create a coredump get
999 		 * out and die instead of going through with the exec.
1000 		 */
1001 		ret = mmap_read_lock_killable(old_mm);
1002 		if (ret) {
1003 			up_write(&tsk->signal->exec_update_lock);
1004 			return ret;
1005 		}
1006 	}
1007 
1008 	task_lock(tsk);
1009 	membarrier_exec_mmap(mm);
1010 
1011 	local_irq_disable();
1012 	active_mm = tsk->active_mm;
1013 	tsk->active_mm = mm;
1014 	tsk->mm = mm;
1015 	/*
1016 	 * This prevents preemption while active_mm is being loaded and
1017 	 * it and mm are being updated, which could cause problems for
1018 	 * lazy tlb mm refcounting when these are updated by context
1019 	 * switches. Not all architectures can handle irqs off over
1020 	 * activate_mm yet.
1021 	 */
1022 	if (!IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
1023 		local_irq_enable();
1024 	activate_mm(active_mm, mm);
1025 	if (IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
1026 		local_irq_enable();
1027 	lru_gen_add_mm(mm);
1028 	task_unlock(tsk);
1029 	lru_gen_use_mm(mm);
1030 	if (old_mm) {
1031 		mmap_read_unlock(old_mm);
1032 		BUG_ON(active_mm != old_mm);
1033 		setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm);
1034 		mm_update_next_owner(old_mm);
1035 		mmput(old_mm);
1036 		return 0;
1037 	}
1038 	mmdrop(active_mm);
1039 	return 0;
1040 }
1041 
de_thread(struct task_struct * tsk)1042 static int de_thread(struct task_struct *tsk)
1043 {
1044 	struct signal_struct *sig = tsk->signal;
1045 	struct sighand_struct *oldsighand = tsk->sighand;
1046 	spinlock_t *lock = &oldsighand->siglock;
1047 
1048 	if (thread_group_empty(tsk))
1049 		goto no_thread_group;
1050 
1051 	/*
1052 	 * Kill all other threads in the thread group.
1053 	 */
1054 	spin_lock_irq(lock);
1055 	if ((sig->flags & SIGNAL_GROUP_EXIT) || sig->group_exec_task) {
1056 		/*
1057 		 * Another group action in progress, just
1058 		 * return so that the signal is processed.
1059 		 */
1060 		spin_unlock_irq(lock);
1061 		return -EAGAIN;
1062 	}
1063 
1064 	sig->group_exec_task = tsk;
1065 	sig->notify_count = zap_other_threads(tsk);
1066 	if (!thread_group_leader(tsk))
1067 		sig->notify_count--;
1068 
1069 	while (sig->notify_count) {
1070 		__set_current_state(TASK_KILLABLE);
1071 		spin_unlock_irq(lock);
1072 		schedule();
1073 		if (__fatal_signal_pending(tsk))
1074 			goto killed;
1075 		spin_lock_irq(lock);
1076 	}
1077 	spin_unlock_irq(lock);
1078 
1079 	/*
1080 	 * At this point all other threads have exited, all we have to
1081 	 * do is to wait for the thread group leader to become inactive,
1082 	 * and to assume its PID:
1083 	 */
1084 	if (!thread_group_leader(tsk)) {
1085 		struct task_struct *leader = tsk->group_leader;
1086 
1087 		for (;;) {
1088 			cgroup_threadgroup_change_begin(tsk);
1089 			write_lock_irq(&tasklist_lock);
1090 			/*
1091 			 * Do this under tasklist_lock to ensure that
1092 			 * exit_notify() can't miss ->group_exec_task
1093 			 */
1094 			sig->notify_count = -1;
1095 			if (likely(leader->exit_state))
1096 				break;
1097 			__set_current_state(TASK_KILLABLE);
1098 			write_unlock_irq(&tasklist_lock);
1099 			cgroup_threadgroup_change_end(tsk);
1100 			schedule();
1101 			if (__fatal_signal_pending(tsk))
1102 				goto killed;
1103 		}
1104 
1105 		/*
1106 		 * The only record we have of the real-time age of a
1107 		 * process, regardless of execs it's done, is start_time.
1108 		 * All the past CPU time is accumulated in signal_struct
1109 		 * from sister threads now dead.  But in this non-leader
1110 		 * exec, nothing survives from the original leader thread,
1111 		 * whose birth marks the true age of this process now.
1112 		 * When we take on its identity by switching to its PID, we
1113 		 * also take its birthdate (always earlier than our own).
1114 		 */
1115 		tsk->start_time = leader->start_time;
1116 		tsk->start_boottime = leader->start_boottime;
1117 
1118 		BUG_ON(!same_thread_group(leader, tsk));
1119 		/*
1120 		 * An exec() starts a new thread group with the
1121 		 * TGID of the previous thread group. Rehash the
1122 		 * two threads with a switched PID, and release
1123 		 * the former thread group leader:
1124 		 */
1125 
1126 		/* Become a process group leader with the old leader's pid.
1127 		 * The old leader becomes a thread of the this thread group.
1128 		 */
1129 		exchange_tids(tsk, leader);
1130 		transfer_pid(leader, tsk, PIDTYPE_TGID);
1131 		transfer_pid(leader, tsk, PIDTYPE_PGID);
1132 		transfer_pid(leader, tsk, PIDTYPE_SID);
1133 
1134 		list_replace_rcu(&leader->tasks, &tsk->tasks);
1135 		list_replace_init(&leader->sibling, &tsk->sibling);
1136 
1137 		tsk->group_leader = tsk;
1138 		leader->group_leader = tsk;
1139 
1140 		tsk->exit_signal = SIGCHLD;
1141 		leader->exit_signal = -1;
1142 
1143 		BUG_ON(leader->exit_state != EXIT_ZOMBIE);
1144 		leader->exit_state = EXIT_DEAD;
1145 
1146 		/*
1147 		 * We are going to release_task()->ptrace_unlink() silently,
1148 		 * the tracer can sleep in do_wait(). EXIT_DEAD guarantees
1149 		 * the tracer won't block again waiting for this thread.
1150 		 */
1151 		if (unlikely(leader->ptrace))
1152 			__wake_up_parent(leader, leader->parent);
1153 		write_unlock_irq(&tasklist_lock);
1154 		cgroup_threadgroup_change_end(tsk);
1155 
1156 		release_task(leader);
1157 	}
1158 
1159 	sig->group_exec_task = NULL;
1160 	sig->notify_count = 0;
1161 
1162 no_thread_group:
1163 	/* we have changed execution domain */
1164 	tsk->exit_signal = SIGCHLD;
1165 
1166 	BUG_ON(!thread_group_leader(tsk));
1167 	return 0;
1168 
1169 killed:
1170 	/* protects against exit_notify() and __exit_signal() */
1171 	read_lock(&tasklist_lock);
1172 	sig->group_exec_task = NULL;
1173 	sig->notify_count = 0;
1174 	read_unlock(&tasklist_lock);
1175 	return -EAGAIN;
1176 }
1177 
1178 
1179 /*
1180  * This function makes sure the current process has its own signal table,
1181  * so that flush_signal_handlers can later reset the handlers without
1182  * disturbing other processes.  (Other processes might share the signal
1183  * table via the CLONE_SIGHAND option to clone().)
1184  */
unshare_sighand(struct task_struct * me)1185 static int unshare_sighand(struct task_struct *me)
1186 {
1187 	struct sighand_struct *oldsighand = me->sighand;
1188 
1189 	if (refcount_read(&oldsighand->count) != 1) {
1190 		struct sighand_struct *newsighand;
1191 		/*
1192 		 * This ->sighand is shared with the CLONE_SIGHAND
1193 		 * but not CLONE_THREAD task, switch to the new one.
1194 		 */
1195 		newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
1196 		if (!newsighand)
1197 			return -ENOMEM;
1198 
1199 		refcount_set(&newsighand->count, 1);
1200 
1201 		write_lock_irq(&tasklist_lock);
1202 		spin_lock(&oldsighand->siglock);
1203 		memcpy(newsighand->action, oldsighand->action,
1204 		       sizeof(newsighand->action));
1205 		rcu_assign_pointer(me->sighand, newsighand);
1206 		spin_unlock(&oldsighand->siglock);
1207 		write_unlock_irq(&tasklist_lock);
1208 
1209 		__cleanup_sighand(oldsighand);
1210 	}
1211 	return 0;
1212 }
1213 
__get_task_comm(char * buf,size_t buf_size,struct task_struct * tsk)1214 char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
1215 {
1216 	task_lock(tsk);
1217 	/* Always NUL terminated and zero-padded */
1218 	strscpy_pad(buf, tsk->comm, buf_size);
1219 	task_unlock(tsk);
1220 	return buf;
1221 }
1222 EXPORT_SYMBOL_GPL(__get_task_comm);
1223 
1224 /*
1225  * These functions flushes out all traces of the currently running executable
1226  * so that a new one can be started
1227  */
1228 
__set_task_comm(struct task_struct * tsk,const char * buf,bool exec)1229 void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)
1230 {
1231 	task_lock(tsk);
1232 	trace_task_rename(tsk, buf);
1233 	strscpy_pad(tsk->comm, buf, sizeof(tsk->comm));
1234 	task_unlock(tsk);
1235 	perf_event_comm(tsk, exec);
1236 }
1237 
1238 /*
1239  * Calling this is the point of no return. None of the failures will be
1240  * seen by userspace since either the process is already taking a fatal
1241  * signal (via de_thread() or coredump), or will have SEGV raised
1242  * (after exec_mmap()) by search_binary_handler (see below).
1243  */
begin_new_exec(struct linux_binprm * bprm)1244 int begin_new_exec(struct linux_binprm * bprm)
1245 {
1246 	struct task_struct *me = current;
1247 	int retval;
1248 
1249 	/* Once we are committed compute the creds */
1250 	retval = bprm_creds_from_file(bprm);
1251 	if (retval)
1252 		return retval;
1253 
1254 	/*
1255 	 * Ensure all future errors are fatal.
1256 	 */
1257 	bprm->point_of_no_return = true;
1258 
1259 	/*
1260 	 * Make this the only thread in the thread group.
1261 	 */
1262 	retval = de_thread(me);
1263 	if (retval)
1264 		goto out;
1265 
1266 	/*
1267 	 * Cancel any io_uring activity across execve
1268 	 */
1269 	io_uring_task_cancel();
1270 
1271 	/* Ensure the files table is not shared. */
1272 	retval = unshare_files();
1273 	if (retval)
1274 		goto out;
1275 
1276 	/*
1277 	 * Must be called _before_ exec_mmap() as bprm->mm is
1278 	 * not visible until then. This also enables the update
1279 	 * to be lockless.
1280 	 */
1281 	retval = set_mm_exe_file(bprm->mm, bprm->file);
1282 	if (retval)
1283 		goto out;
1284 
1285 	/* If the binary is not readable then enforce mm->dumpable=0 */
1286 	would_dump(bprm, bprm->file);
1287 	if (bprm->have_execfd)
1288 		would_dump(bprm, bprm->executable);
1289 
1290 	/*
1291 	 * Release all of the old mmap stuff
1292 	 */
1293 	acct_arg_size(bprm, 0);
1294 	retval = exec_mmap(bprm->mm);
1295 	if (retval)
1296 		goto out;
1297 
1298 	bprm->mm = NULL;
1299 
1300 #ifdef CONFIG_POSIX_TIMERS
1301 	spin_lock_irq(&me->sighand->siglock);
1302 	posix_cpu_timers_exit(me);
1303 	spin_unlock_irq(&me->sighand->siglock);
1304 	exit_itimers(me);
1305 	flush_itimer_signals();
1306 #endif
1307 
1308 	/*
1309 	 * Make the signal table private.
1310 	 */
1311 	retval = unshare_sighand(me);
1312 	if (retval)
1313 		goto out_unlock;
1314 
1315 	me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC |
1316 					PF_NOFREEZE | PF_NO_SETAFFINITY);
1317 	flush_thread();
1318 	me->personality &= ~bprm->per_clear;
1319 
1320 	clear_syscall_work_syscall_user_dispatch(me);
1321 
1322 	/*
1323 	 * We have to apply CLOEXEC before we change whether the process is
1324 	 * dumpable (in setup_new_exec) to avoid a race with a process in userspace
1325 	 * trying to access the should-be-closed file descriptors of a process
1326 	 * undergoing exec(2).
1327 	 */
1328 	do_close_on_exec(me->files);
1329 
1330 	if (bprm->secureexec) {
1331 		/* Make sure parent cannot signal privileged process. */
1332 		me->pdeath_signal = 0;
1333 
1334 		/*
1335 		 * For secureexec, reset the stack limit to sane default to
1336 		 * avoid bad behavior from the prior rlimits. This has to
1337 		 * happen before arch_pick_mmap_layout(), which examines
1338 		 * RLIMIT_STACK, but after the point of no return to avoid
1339 		 * needing to clean up the change on failure.
1340 		 */
1341 		if (bprm->rlim_stack.rlim_cur > _STK_LIM)
1342 			bprm->rlim_stack.rlim_cur = _STK_LIM;
1343 	}
1344 
1345 	me->sas_ss_sp = me->sas_ss_size = 0;
1346 
1347 	/*
1348 	 * Figure out dumpability. Note that this checking only of current
1349 	 * is wrong, but userspace depends on it. This should be testing
1350 	 * bprm->secureexec instead.
1351 	 */
1352 	if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||
1353 	    !(uid_eq(current_euid(), current_uid()) &&
1354 	      gid_eq(current_egid(), current_gid())))
1355 		set_dumpable(current->mm, suid_dumpable);
1356 	else
1357 		set_dumpable(current->mm, SUID_DUMP_USER);
1358 
1359 	perf_event_exec();
1360 	__set_task_comm(me, kbasename(bprm->filename), true);
1361 
1362 	/* An exec changes our domain. We are no longer part of the thread
1363 	   group */
1364 	WRITE_ONCE(me->self_exec_id, me->self_exec_id + 1);
1365 	flush_signal_handlers(me, 0);
1366 
1367 	retval = set_cred_ucounts(bprm->cred);
1368 	if (retval < 0)
1369 		goto out_unlock;
1370 
1371 	/*
1372 	 * install the new credentials for this executable
1373 	 */
1374 	security_bprm_committing_creds(bprm);
1375 
1376 	commit_creds(bprm->cred);
1377 	bprm->cred = NULL;
1378 
1379 	/*
1380 	 * Disable monitoring for regular users
1381 	 * when executing setuid binaries. Must
1382 	 * wait until new credentials are committed
1383 	 * by commit_creds() above
1384 	 */
1385 	if (get_dumpable(me->mm) != SUID_DUMP_USER)
1386 		perf_event_exit_task(me);
1387 	/*
1388 	 * cred_guard_mutex must be held at least to this point to prevent
1389 	 * ptrace_attach() from altering our determination of the task's
1390 	 * credentials; any time after this it may be unlocked.
1391 	 */
1392 	security_bprm_committed_creds(bprm);
1393 
1394 	/* Pass the opened binary to the interpreter. */
1395 	if (bprm->have_execfd) {
1396 		retval = get_unused_fd_flags(0);
1397 		if (retval < 0)
1398 			goto out_unlock;
1399 		fd_install(retval, bprm->executable);
1400 		bprm->executable = NULL;
1401 		bprm->execfd = retval;
1402 	}
1403 	return 0;
1404 
1405 out_unlock:
1406 	up_write(&me->signal->exec_update_lock);
1407 out:
1408 	return retval;
1409 }
1410 EXPORT_SYMBOL(begin_new_exec);
1411 
would_dump(struct linux_binprm * bprm,struct file * file)1412 void would_dump(struct linux_binprm *bprm, struct file *file)
1413 {
1414 	struct inode *inode = file_inode(file);
1415 	struct user_namespace *mnt_userns = file_mnt_user_ns(file);
1416 	if (inode_permission(mnt_userns, inode, MAY_READ) < 0) {
1417 		struct user_namespace *old, *user_ns;
1418 		bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
1419 
1420 		/* Ensure mm->user_ns contains the executable */
1421 		user_ns = old = bprm->mm->user_ns;
1422 		while ((user_ns != &init_user_ns) &&
1423 		       !privileged_wrt_inode_uidgid(user_ns, mnt_userns, inode))
1424 			user_ns = user_ns->parent;
1425 
1426 		if (old != user_ns) {
1427 			bprm->mm->user_ns = get_user_ns(user_ns);
1428 			put_user_ns(old);
1429 		}
1430 	}
1431 }
1432 EXPORT_SYMBOL(would_dump);
1433 
setup_new_exec(struct linux_binprm * bprm)1434 void setup_new_exec(struct linux_binprm * bprm)
1435 {
1436 	/* Setup things that can depend upon the personality */
1437 	struct task_struct *me = current;
1438 
1439 	arch_pick_mmap_layout(me->mm, &bprm->rlim_stack);
1440 
1441 	arch_setup_new_exec();
1442 
1443 	/* Set the new mm task size. We have to do that late because it may
1444 	 * depend on TIF_32BIT which is only updated in flush_thread() on
1445 	 * some architectures like powerpc
1446 	 */
1447 	me->mm->task_size = TASK_SIZE;
1448 	up_write(&me->signal->exec_update_lock);
1449 	mutex_unlock(&me->signal->cred_guard_mutex);
1450 }
1451 EXPORT_SYMBOL(setup_new_exec);
1452 
1453 /* Runs immediately before start_thread() takes over. */
finalize_exec(struct linux_binprm * bprm)1454 void finalize_exec(struct linux_binprm *bprm)
1455 {
1456 	/* Store any stack rlimit changes before starting thread. */
1457 	task_lock(current->group_leader);
1458 	current->signal->rlim[RLIMIT_STACK] = bprm->rlim_stack;
1459 	task_unlock(current->group_leader);
1460 }
1461 EXPORT_SYMBOL(finalize_exec);
1462 
1463 /*
1464  * Prepare credentials and lock ->cred_guard_mutex.
1465  * setup_new_exec() commits the new creds and drops the lock.
1466  * Or, if exec fails before, free_bprm() should release ->cred
1467  * and unlock.
1468  */
prepare_bprm_creds(struct linux_binprm * bprm)1469 static int prepare_bprm_creds(struct linux_binprm *bprm)
1470 {
1471 	if (mutex_lock_interruptible(&current->signal->cred_guard_mutex))
1472 		return -ERESTARTNOINTR;
1473 
1474 	bprm->cred = prepare_exec_creds();
1475 	if (likely(bprm->cred))
1476 		return 0;
1477 
1478 	mutex_unlock(&current->signal->cred_guard_mutex);
1479 	return -ENOMEM;
1480 }
1481 
free_bprm(struct linux_binprm * bprm)1482 static void free_bprm(struct linux_binprm *bprm)
1483 {
1484 	if (bprm->mm) {
1485 		acct_arg_size(bprm, 0);
1486 		mmput(bprm->mm);
1487 	}
1488 	free_arg_pages(bprm);
1489 	if (bprm->cred) {
1490 		mutex_unlock(&current->signal->cred_guard_mutex);
1491 		abort_creds(bprm->cred);
1492 	}
1493 	if (bprm->file) {
1494 		allow_write_access(bprm->file);
1495 		fput(bprm->file);
1496 	}
1497 	if (bprm->executable)
1498 		fput(bprm->executable);
1499 	/* If a binfmt changed the interp, free it. */
1500 	if (bprm->interp != bprm->filename)
1501 		kfree(bprm->interp);
1502 	kfree(bprm->fdpath);
1503 	kfree(bprm);
1504 }
1505 
alloc_bprm(int fd,struct filename * filename)1506 static struct linux_binprm *alloc_bprm(int fd, struct filename *filename)
1507 {
1508 	struct linux_binprm *bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
1509 	int retval = -ENOMEM;
1510 	if (!bprm)
1511 		goto out;
1512 
1513 	if (fd == AT_FDCWD || filename->name[0] == '/') {
1514 		bprm->filename = filename->name;
1515 	} else {
1516 		if (filename->name[0] == '\0')
1517 			bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd);
1518 		else
1519 			bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s",
1520 						  fd, filename->name);
1521 		if (!bprm->fdpath)
1522 			goto out_free;
1523 
1524 		bprm->filename = bprm->fdpath;
1525 	}
1526 	bprm->interp = bprm->filename;
1527 
1528 	retval = bprm_mm_init(bprm);
1529 	if (retval)
1530 		goto out_free;
1531 	return bprm;
1532 
1533 out_free:
1534 	free_bprm(bprm);
1535 out:
1536 	return ERR_PTR(retval);
1537 }
1538 
bprm_change_interp(const char * interp,struct linux_binprm * bprm)1539 int bprm_change_interp(const char *interp, struct linux_binprm *bprm)
1540 {
1541 	/* If a binfmt changed the interp, free it first. */
1542 	if (bprm->interp != bprm->filename)
1543 		kfree(bprm->interp);
1544 	bprm->interp = kstrdup(interp, GFP_KERNEL);
1545 	if (!bprm->interp)
1546 		return -ENOMEM;
1547 	return 0;
1548 }
1549 EXPORT_SYMBOL(bprm_change_interp);
1550 
1551 /*
1552  * determine how safe it is to execute the proposed program
1553  * - the caller must hold ->cred_guard_mutex to protect against
1554  *   PTRACE_ATTACH or seccomp thread-sync
1555  */
check_unsafe_exec(struct linux_binprm * bprm)1556 static void check_unsafe_exec(struct linux_binprm *bprm)
1557 {
1558 	struct task_struct *p = current, *t;
1559 	unsigned n_fs;
1560 
1561 	if (p->ptrace)
1562 		bprm->unsafe |= LSM_UNSAFE_PTRACE;
1563 
1564 	/*
1565 	 * This isn't strictly necessary, but it makes it harder for LSMs to
1566 	 * mess up.
1567 	 */
1568 	if (task_no_new_privs(current))
1569 		bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;
1570 
1571 	t = p;
1572 	n_fs = 1;
1573 	spin_lock(&p->fs->lock);
1574 	rcu_read_lock();
1575 	while_each_thread(p, t) {
1576 		if (t->fs == p->fs)
1577 			n_fs++;
1578 	}
1579 	rcu_read_unlock();
1580 
1581 	if (p->fs->users > n_fs)
1582 		bprm->unsafe |= LSM_UNSAFE_SHARE;
1583 	else
1584 		p->fs->in_exec = 1;
1585 	spin_unlock(&p->fs->lock);
1586 }
1587 
bprm_fill_uid(struct linux_binprm * bprm,struct file * file)1588 static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file)
1589 {
1590 	/* Handle suid and sgid on files */
1591 	struct user_namespace *mnt_userns;
1592 	struct inode *inode = file_inode(file);
1593 	unsigned int mode;
1594 	kuid_t uid;
1595 	kgid_t gid;
1596 
1597 	if (!mnt_may_suid(file->f_path.mnt))
1598 		return;
1599 
1600 	if (task_no_new_privs(current))
1601 		return;
1602 
1603 	mode = READ_ONCE(inode->i_mode);
1604 	if (!(mode & (S_ISUID|S_ISGID)))
1605 		return;
1606 
1607 	mnt_userns = file_mnt_user_ns(file);
1608 
1609 	/* Be careful if suid/sgid is set */
1610 	inode_lock(inode);
1611 
1612 	/* reload atomically mode/uid/gid now that lock held */
1613 	mode = inode->i_mode;
1614 	uid = i_uid_into_mnt(mnt_userns, inode);
1615 	gid = i_gid_into_mnt(mnt_userns, inode);
1616 	inode_unlock(inode);
1617 
1618 	/* We ignore suid/sgid if there are no mappings for them in the ns */
1619 	if (!kuid_has_mapping(bprm->cred->user_ns, uid) ||
1620 		 !kgid_has_mapping(bprm->cred->user_ns, gid))
1621 		return;
1622 
1623 	if (mode & S_ISUID) {
1624 		bprm->per_clear |= PER_CLEAR_ON_SETID;
1625 		bprm->cred->euid = uid;
1626 	}
1627 
1628 	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
1629 		bprm->per_clear |= PER_CLEAR_ON_SETID;
1630 		bprm->cred->egid = gid;
1631 	}
1632 }
1633 
1634 /*
1635  * Compute brpm->cred based upon the final binary.
1636  */
bprm_creds_from_file(struct linux_binprm * bprm)1637 static int bprm_creds_from_file(struct linux_binprm *bprm)
1638 {
1639 	/* Compute creds based on which file? */
1640 	struct file *file = bprm->execfd_creds ? bprm->executable : bprm->file;
1641 
1642 	bprm_fill_uid(bprm, file);
1643 	return security_bprm_creds_from_file(bprm, file);
1644 }
1645 
1646 /*
1647  * Fill the binprm structure from the inode.
1648  * Read the first BINPRM_BUF_SIZE bytes
1649  *
1650  * This may be called multiple times for binary chains (scripts for example).
1651  */
prepare_binprm(struct linux_binprm * bprm)1652 static int prepare_binprm(struct linux_binprm *bprm)
1653 {
1654 	loff_t pos = 0;
1655 
1656 	memset(bprm->buf, 0, BINPRM_BUF_SIZE);
1657 	return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos);
1658 }
1659 
1660 /*
1661  * Arguments are '\0' separated strings found at the location bprm->p
1662  * points to; chop off the first by relocating brpm->p to right after
1663  * the first '\0' encountered.
1664  */
remove_arg_zero(struct linux_binprm * bprm)1665 int remove_arg_zero(struct linux_binprm *bprm)
1666 {
1667 	int ret = 0;
1668 	unsigned long offset;
1669 	char *kaddr;
1670 	struct page *page;
1671 
1672 	if (!bprm->argc)
1673 		return 0;
1674 
1675 	do {
1676 		offset = bprm->p & ~PAGE_MASK;
1677 		page = get_arg_page(bprm, bprm->p, 0);
1678 		if (!page) {
1679 			ret = -EFAULT;
1680 			goto out;
1681 		}
1682 		kaddr = kmap_local_page(page);
1683 
1684 		for (; offset < PAGE_SIZE && kaddr[offset];
1685 				offset++, bprm->p++)
1686 			;
1687 
1688 		kunmap_local(kaddr);
1689 		put_arg_page(page);
1690 	} while (offset == PAGE_SIZE);
1691 
1692 	bprm->p++;
1693 	bprm->argc--;
1694 	ret = 0;
1695 
1696 out:
1697 	return ret;
1698 }
1699 EXPORT_SYMBOL(remove_arg_zero);
1700 
1701 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
1702 /*
1703  * cycle the list of binary formats handler, until one recognizes the image
1704  */
search_binary_handler(struct linux_binprm * bprm)1705 static int search_binary_handler(struct linux_binprm *bprm)
1706 {
1707 	bool need_retry = IS_ENABLED(CONFIG_MODULES);
1708 	struct linux_binfmt *fmt;
1709 	int retval;
1710 
1711 	retval = prepare_binprm(bprm);
1712 	if (retval < 0)
1713 		return retval;
1714 
1715 	retval = security_bprm_check(bprm);
1716 	if (retval)
1717 		return retval;
1718 
1719 	retval = -ENOENT;
1720  retry:
1721 	read_lock(&binfmt_lock);
1722 	list_for_each_entry(fmt, &formats, lh) {
1723 		if (!try_module_get(fmt->module))
1724 			continue;
1725 		read_unlock(&binfmt_lock);
1726 
1727 		retval = fmt->load_binary(bprm);
1728 
1729 		read_lock(&binfmt_lock);
1730 		put_binfmt(fmt);
1731 		if (bprm->point_of_no_return || (retval != -ENOEXEC)) {
1732 			read_unlock(&binfmt_lock);
1733 			return retval;
1734 		}
1735 	}
1736 	read_unlock(&binfmt_lock);
1737 
1738 	if (need_retry) {
1739 		if (printable(bprm->buf[0]) && printable(bprm->buf[1]) &&
1740 		    printable(bprm->buf[2]) && printable(bprm->buf[3]))
1741 			return retval;
1742 		if (request_module("binfmt-%04x", *(ushort *)(bprm->buf + 2)) < 0)
1743 			return retval;
1744 		need_retry = false;
1745 		goto retry;
1746 	}
1747 
1748 	return retval;
1749 }
1750 
exec_binprm(struct linux_binprm * bprm)1751 static int exec_binprm(struct linux_binprm *bprm)
1752 {
1753 	pid_t old_pid, old_vpid;
1754 	int ret, depth;
1755 
1756 	/* Need to fetch pid before load_binary changes it */
1757 	old_pid = current->pid;
1758 	rcu_read_lock();
1759 	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
1760 	rcu_read_unlock();
1761 
1762 	/* This allows 4 levels of binfmt rewrites before failing hard. */
1763 	for (depth = 0;; depth++) {
1764 		struct file *exec;
1765 		if (depth > 5)
1766 			return -ELOOP;
1767 
1768 		ret = search_binary_handler(bprm);
1769 		if (ret < 0)
1770 			return ret;
1771 		if (!bprm->interpreter)
1772 			break;
1773 
1774 		exec = bprm->file;
1775 		bprm->file = bprm->interpreter;
1776 		bprm->interpreter = NULL;
1777 
1778 		allow_write_access(exec);
1779 		if (unlikely(bprm->have_execfd)) {
1780 			if (bprm->executable) {
1781 				fput(exec);
1782 				return -ENOEXEC;
1783 			}
1784 			bprm->executable = exec;
1785 		} else
1786 			fput(exec);
1787 	}
1788 
1789 	audit_bprm(bprm);
1790 	trace_sched_process_exec(current, old_pid, bprm);
1791 	ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
1792 	proc_exec_connector(current);
1793 	return 0;
1794 }
1795 
1796 /*
1797  * sys_execve() executes a new program.
1798  */
bprm_execve(struct linux_binprm * bprm,int fd,struct filename * filename,int flags)1799 static int bprm_execve(struct linux_binprm *bprm,
1800 		       int fd, struct filename *filename, int flags)
1801 {
1802 	struct file *file;
1803 	int retval;
1804 
1805 	retval = prepare_bprm_creds(bprm);
1806 	if (retval)
1807 		return retval;
1808 
1809 	check_unsafe_exec(bprm);
1810 	current->in_execve = 1;
1811 
1812 	file = do_open_execat(fd, filename, flags);
1813 	retval = PTR_ERR(file);
1814 	if (IS_ERR(file))
1815 		goto out_unmark;
1816 
1817 	sched_exec();
1818 
1819 	bprm->file = file;
1820 	/*
1821 	 * Record that a name derived from an O_CLOEXEC fd will be
1822 	 * inaccessible after exec.  This allows the code in exec to
1823 	 * choose to fail when the executable is not mmaped into the
1824 	 * interpreter and an open file descriptor is not passed to
1825 	 * the interpreter.  This makes for a better user experience
1826 	 * than having the interpreter start and then immediately fail
1827 	 * when it finds the executable is inaccessible.
1828 	 */
1829 	if (bprm->fdpath && get_close_on_exec(fd))
1830 		bprm->interp_flags |= BINPRM_FLAGS_PATH_INACCESSIBLE;
1831 
1832 	/* Set the unchanging part of bprm->cred */
1833 	retval = security_bprm_creds_for_exec(bprm);
1834 	if (retval)
1835 		goto out;
1836 
1837 	retval = exec_binprm(bprm);
1838 	if (retval < 0)
1839 		goto out;
1840 
1841 	/* execve succeeded */
1842 	current->fs->in_exec = 0;
1843 	current->in_execve = 0;
1844 	rseq_execve(current);
1845 	acct_update_integrals(current);
1846 	task_numa_free(current, false);
1847 	return retval;
1848 
1849 out:
1850 	/*
1851 	 * If past the point of no return ensure the code never
1852 	 * returns to the userspace process.  Use an existing fatal
1853 	 * signal if present otherwise terminate the process with
1854 	 * SIGSEGV.
1855 	 */
1856 	if (bprm->point_of_no_return && !fatal_signal_pending(current))
1857 		force_fatal_sig(SIGSEGV);
1858 
1859 out_unmark:
1860 	current->fs->in_exec = 0;
1861 	current->in_execve = 0;
1862 
1863 	return retval;
1864 }
1865 
do_execveat_common(int fd,struct filename * filename,struct user_arg_ptr argv,struct user_arg_ptr envp,int flags)1866 static int do_execveat_common(int fd, struct filename *filename,
1867 			      struct user_arg_ptr argv,
1868 			      struct user_arg_ptr envp,
1869 			      int flags)
1870 {
1871 	struct linux_binprm *bprm;
1872 	int retval;
1873 
1874 	if (IS_ERR(filename))
1875 		return PTR_ERR(filename);
1876 
1877 	/*
1878 	 * We move the actual failure in case of RLIMIT_NPROC excess from
1879 	 * set*uid() to execve() because too many poorly written programs
1880 	 * don't check setuid() return code.  Here we additionally recheck
1881 	 * whether NPROC limit is still exceeded.
1882 	 */
1883 	if ((current->flags & PF_NPROC_EXCEEDED) &&
1884 	    is_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
1885 		retval = -EAGAIN;
1886 		goto out_ret;
1887 	}
1888 
1889 	/* We're below the limit (still or again), so we don't want to make
1890 	 * further execve() calls fail. */
1891 	current->flags &= ~PF_NPROC_EXCEEDED;
1892 
1893 	bprm = alloc_bprm(fd, filename);
1894 	if (IS_ERR(bprm)) {
1895 		retval = PTR_ERR(bprm);
1896 		goto out_ret;
1897 	}
1898 
1899 	retval = count(argv, MAX_ARG_STRINGS);
1900 	if (retval == 0)
1901 		pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",
1902 			     current->comm, bprm->filename);
1903 	if (retval < 0)
1904 		goto out_free;
1905 	bprm->argc = retval;
1906 
1907 	retval = count(envp, MAX_ARG_STRINGS);
1908 	if (retval < 0)
1909 		goto out_free;
1910 	bprm->envc = retval;
1911 
1912 	retval = bprm_stack_limits(bprm);
1913 	if (retval < 0)
1914 		goto out_free;
1915 
1916 	retval = copy_string_kernel(bprm->filename, bprm);
1917 	if (retval < 0)
1918 		goto out_free;
1919 	bprm->exec = bprm->p;
1920 
1921 	retval = copy_strings(bprm->envc, envp, bprm);
1922 	if (retval < 0)
1923 		goto out_free;
1924 
1925 	retval = copy_strings(bprm->argc, argv, bprm);
1926 	if (retval < 0)
1927 		goto out_free;
1928 
1929 	/*
1930 	 * When argv is empty, add an empty string ("") as argv[0] to
1931 	 * ensure confused userspace programs that start processing
1932 	 * from argv[1] won't end up walking envp. See also
1933 	 * bprm_stack_limits().
1934 	 */
1935 	if (bprm->argc == 0) {
1936 		retval = copy_string_kernel("", bprm);
1937 		if (retval < 0)
1938 			goto out_free;
1939 		bprm->argc = 1;
1940 	}
1941 
1942 	retval = bprm_execve(bprm, fd, filename, flags);
1943 out_free:
1944 	free_bprm(bprm);
1945 
1946 out_ret:
1947 	putname(filename);
1948 	return retval;
1949 }
1950 
kernel_execve(const char * kernel_filename,const char * const * argv,const char * const * envp)1951 int kernel_execve(const char *kernel_filename,
1952 		  const char *const *argv, const char *const *envp)
1953 {
1954 	struct filename *filename;
1955 	struct linux_binprm *bprm;
1956 	int fd = AT_FDCWD;
1957 	int retval;
1958 
1959 	/* It is non-sense for kernel threads to call execve */
1960 	if (WARN_ON_ONCE(current->flags & PF_KTHREAD))
1961 		return -EINVAL;
1962 
1963 	filename = getname_kernel(kernel_filename);
1964 	if (IS_ERR(filename))
1965 		return PTR_ERR(filename);
1966 
1967 	bprm = alloc_bprm(fd, filename);
1968 	if (IS_ERR(bprm)) {
1969 		retval = PTR_ERR(bprm);
1970 		goto out_ret;
1971 	}
1972 
1973 	retval = count_strings_kernel(argv);
1974 	if (WARN_ON_ONCE(retval == 0))
1975 		retval = -EINVAL;
1976 	if (retval < 0)
1977 		goto out_free;
1978 	bprm->argc = retval;
1979 
1980 	retval = count_strings_kernel(envp);
1981 	if (retval < 0)
1982 		goto out_free;
1983 	bprm->envc = retval;
1984 
1985 	retval = bprm_stack_limits(bprm);
1986 	if (retval < 0)
1987 		goto out_free;
1988 
1989 	retval = copy_string_kernel(bprm->filename, bprm);
1990 	if (retval < 0)
1991 		goto out_free;
1992 	bprm->exec = bprm->p;
1993 
1994 	retval = copy_strings_kernel(bprm->envc, envp, bprm);
1995 	if (retval < 0)
1996 		goto out_free;
1997 
1998 	retval = copy_strings_kernel(bprm->argc, argv, bprm);
1999 	if (retval < 0)
2000 		goto out_free;
2001 
2002 	retval = bprm_execve(bprm, fd, filename, 0);
2003 out_free:
2004 	free_bprm(bprm);
2005 out_ret:
2006 	putname(filename);
2007 	return retval;
2008 }
2009 
do_execve(struct filename * filename,const char __user * const __user * __argv,const char __user * const __user * __envp)2010 static int do_execve(struct filename *filename,
2011 	const char __user *const __user *__argv,
2012 	const char __user *const __user *__envp)
2013 {
2014 	struct user_arg_ptr argv = { .ptr.native = __argv };
2015 	struct user_arg_ptr envp = { .ptr.native = __envp };
2016 	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
2017 }
2018 
do_execveat(int fd,struct filename * filename,const char __user * const __user * __argv,const char __user * const __user * __envp,int flags)2019 static int do_execveat(int fd, struct filename *filename,
2020 		const char __user *const __user *__argv,
2021 		const char __user *const __user *__envp,
2022 		int flags)
2023 {
2024 	struct user_arg_ptr argv = { .ptr.native = __argv };
2025 	struct user_arg_ptr envp = { .ptr.native = __envp };
2026 
2027 	return do_execveat_common(fd, filename, argv, envp, flags);
2028 }
2029 
2030 #ifdef CONFIG_COMPAT
compat_do_execve(struct filename * filename,const compat_uptr_t __user * __argv,const compat_uptr_t __user * __envp)2031 static int compat_do_execve(struct filename *filename,
2032 	const compat_uptr_t __user *__argv,
2033 	const compat_uptr_t __user *__envp)
2034 {
2035 	struct user_arg_ptr argv = {
2036 		.is_compat = true,
2037 		.ptr.compat = __argv,
2038 	};
2039 	struct user_arg_ptr envp = {
2040 		.is_compat = true,
2041 		.ptr.compat = __envp,
2042 	};
2043 	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
2044 }
2045 
compat_do_execveat(int fd,struct filename * filename,const compat_uptr_t __user * __argv,const compat_uptr_t __user * __envp,int flags)2046 static int compat_do_execveat(int fd, struct filename *filename,
2047 			      const compat_uptr_t __user *__argv,
2048 			      const compat_uptr_t __user *__envp,
2049 			      int flags)
2050 {
2051 	struct user_arg_ptr argv = {
2052 		.is_compat = true,
2053 		.ptr.compat = __argv,
2054 	};
2055 	struct user_arg_ptr envp = {
2056 		.is_compat = true,
2057 		.ptr.compat = __envp,
2058 	};
2059 	return do_execveat_common(fd, filename, argv, envp, flags);
2060 }
2061 #endif
2062 
set_binfmt(struct linux_binfmt * new)2063 void set_binfmt(struct linux_binfmt *new)
2064 {
2065 	struct mm_struct *mm = current->mm;
2066 
2067 	if (mm->binfmt)
2068 		module_put(mm->binfmt->module);
2069 
2070 	mm->binfmt = new;
2071 	if (new)
2072 		__module_get(new->module);
2073 }
2074 EXPORT_SYMBOL(set_binfmt);
2075 
2076 /*
2077  * set_dumpable stores three-value SUID_DUMP_* into mm->flags.
2078  */
set_dumpable(struct mm_struct * mm,int value)2079 void set_dumpable(struct mm_struct *mm, int value)
2080 {
2081 	if (WARN_ON((unsigned)value > SUID_DUMP_ROOT))
2082 		return;
2083 
2084 	set_mask_bits(&mm->flags, MMF_DUMPABLE_MASK, value);
2085 }
2086 
SYSCALL_DEFINE3(execve,const char __user *,filename,const char __user * const __user *,argv,const char __user * const __user *,envp)2087 SYSCALL_DEFINE3(execve,
2088 		const char __user *, filename,
2089 		const char __user *const __user *, argv,
2090 		const char __user *const __user *, envp)
2091 {
2092 	return do_execve(getname(filename), argv, envp);
2093 }
2094 
SYSCALL_DEFINE5(execveat,int,fd,const char __user *,filename,const char __user * const __user *,argv,const char __user * const __user *,envp,int,flags)2095 SYSCALL_DEFINE5(execveat,
2096 		int, fd, const char __user *, filename,
2097 		const char __user *const __user *, argv,
2098 		const char __user *const __user *, envp,
2099 		int, flags)
2100 {
2101 	return do_execveat(fd,
2102 			   getname_uflags(filename, flags),
2103 			   argv, envp, flags);
2104 }
2105 
2106 #ifdef CONFIG_COMPAT
COMPAT_SYSCALL_DEFINE3(execve,const char __user *,filename,const compat_uptr_t __user *,argv,const compat_uptr_t __user *,envp)2107 COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename,
2108 	const compat_uptr_t __user *, argv,
2109 	const compat_uptr_t __user *, envp)
2110 {
2111 	return compat_do_execve(getname(filename), argv, envp);
2112 }
2113 
COMPAT_SYSCALL_DEFINE5(execveat,int,fd,const char __user *,filename,const compat_uptr_t __user *,argv,const compat_uptr_t __user *,envp,int,flags)2114 COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
2115 		       const char __user *, filename,
2116 		       const compat_uptr_t __user *, argv,
2117 		       const compat_uptr_t __user *, envp,
2118 		       int,  flags)
2119 {
2120 	return compat_do_execveat(fd,
2121 				  getname_uflags(filename, flags),
2122 				  argv, envp, flags);
2123 }
2124 #endif
2125 
2126 #ifdef CONFIG_SYSCTL
2127 
proc_dointvec_minmax_coredump(struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)2128 static int proc_dointvec_minmax_coredump(struct ctl_table *table, int write,
2129 		void *buffer, size_t *lenp, loff_t *ppos)
2130 {
2131 	int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
2132 
2133 	if (!error)
2134 		validate_coredump_safety();
2135 	return error;
2136 }
2137 
2138 static struct ctl_table fs_exec_sysctls[] = {
2139 	{
2140 		.procname	= "suid_dumpable",
2141 		.data		= &suid_dumpable,
2142 		.maxlen		= sizeof(int),
2143 		.mode		= 0644,
2144 		.proc_handler	= proc_dointvec_minmax_coredump,
2145 		.extra1		= SYSCTL_ZERO,
2146 		.extra2		= SYSCTL_TWO,
2147 	},
2148 	{ }
2149 };
2150 
init_fs_exec_sysctls(void)2151 static int __init init_fs_exec_sysctls(void)
2152 {
2153 	register_sysctl_init("fs", fs_exec_sysctls);
2154 	return 0;
2155 }
2156 
2157 fs_initcall(init_fs_exec_sysctls);
2158 #endif /* CONFIG_SYSCTL */
2159