81 static int bprm_creds_from_file(struct linux_binprm *bprm);
185 static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)  in acct_arg_size()  argument
188 	long diff = (long)(pages - bprm->vma_pages);  in acct_arg_size()
193 	bprm->vma_pages = pages;  in acct_arg_size()
197 static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,  in get_arg_page()  argument
201 	struct vm_area_struct *vma = bprm->vma;  in get_arg_page()
202 	struct mm_struct *mm = bprm->mm;  in get_arg_page()
225 		acct_arg_size(bprm, vma_pages(vma));  in get_arg_page()
235 static void free_arg_pages(struct linux_binprm *bprm)  in free_arg_pages()  argument
239 static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,  in flush_arg_page()  argument
242 	flush_cache_page(bprm->vma, pos, page_to_pfn(page));  in flush_arg_page()
245 static int __bprm_mm_init(struct linux_binprm *bprm)  in __bprm_mm_init()  argument
249 	struct mm_struct *mm = bprm->mm;  in __bprm_mm_init()
251 	bprm->vma = vma = vm_area_alloc(mm);  in __bprm_mm_init()
287 	bprm->p = vma->vm_end - sizeof(void *);  in __bprm_mm_init()
294 	bprm->vma = NULL;  in __bprm_mm_init()
299 static bool valid_arg_len(struct linux_binprm *bprm, long len)  in valid_arg_len()  argument
306 static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)  in acct_arg_size()  argument
310 static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,  in get_arg_page()  argument
315 	page = bprm->page[pos / PAGE_SIZE];  in get_arg_page()
320 		bprm->page[pos / PAGE_SIZE] = page;  in get_arg_page()
330 static void free_arg_page(struct linux_binprm *bprm, int i)  in free_arg_page()  argument
332 	if (bprm->page[i]) {  in free_arg_page()
333 		__free_page(bprm->page[i]);  in free_arg_page()
334 		bprm->page[i] = NULL;  in free_arg_page()
338 static void free_arg_pages(struct linux_binprm *bprm)  in free_arg_pages()  argument
343 		free_arg_page(bprm, i);  in free_arg_pages()
346 static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,  in flush_arg_page()  argument
351 static int __bprm_mm_init(struct linux_binprm *bprm)  in __bprm_mm_init()  argument
353 	bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);  in __bprm_mm_init()
357 static bool valid_arg_len(struct linux_binprm *bprm, long len)  in valid_arg_len()  argument
359 	return len <= bprm->p;  in valid_arg_len()
370 static int bprm_mm_init(struct linux_binprm *bprm)  in bprm_mm_init()  argument
375 	bprm->mm = mm = mm_alloc();  in bprm_mm_init()
382 	bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];  in bprm_mm_init()
385 	err = __bprm_mm_init(bprm);  in bprm_mm_init()
393 		bprm->mm = NULL;  in bprm_mm_init()
479 static inline int bprm_set_stack_limit(struct linux_binprm *bprm,  in bprm_set_stack_limit()  argument
484 	if (bprm->p < limit)  in bprm_set_stack_limit()
486 	bprm->argmin = bprm->p - limit;  in bprm_set_stack_limit()
490 static inline bool bprm_hit_stack_limit(struct linux_binprm *bprm)  in bprm_hit_stack_limit()  argument
493 	return bprm->p < bprm->argmin;  in bprm_hit_stack_limit()
508 static int bprm_stack_limits(struct linux_binprm *bprm)  in bprm_stack_limits()  argument
521 	limit = min(limit, bprm->rlim_stack.rlim_cur / 4);  in bprm_stack_limits()
528 	if (bprm->argc < 0 || bprm->envc < 0)  in bprm_stack_limits()
543 	if (check_add_overflow(max(bprm->argc, 1), bprm->envc, &ptr_size) ||  in bprm_stack_limits()
550 	return bprm_set_stack_limit(bprm, limit);  in bprm_stack_limits()
559 			struct linux_binprm *bprm)  in copy_strings()  argument
581 		if (!valid_arg_len(bprm, len))  in copy_strings()
585 		pos = bprm->p;  in copy_strings()
587 		bprm->p -= len;  in copy_strings()
588 		if (bprm_hit_stack_limit(bprm))  in copy_strings()
616 				page = get_arg_page(bprm, pos, 1);  in copy_strings()
630 				flush_arg_page(bprm, kpos, kmapped_page);  in copy_strings()
651 int copy_string_kernel(const char *arg, struct linux_binprm *bprm)  in copy_string_kernel()  argument
654 	unsigned long pos = bprm->p;  in copy_string_kernel()
658 	if (!valid_arg_len(bprm, len))  in copy_string_kernel()
663 	bprm->p -= len;  in copy_string_kernel()
664 	if (bprm_hit_stack_limit(bprm))  in copy_string_kernel()
676 		page = get_arg_page(bprm, pos, 1);  in copy_string_kernel()
679 		flush_arg_page(bprm, pos & PAGE_MASK, page);  in copy_string_kernel()
689 			       struct linux_binprm *bprm)  in copy_strings_kernel()  argument
692 		int ret = copy_string_kernel(argv[argc], bprm);  in copy_strings_kernel()
708 int setup_arg_pages(struct linux_binprm *bprm,  in setup_arg_pages()  argument
715 	struct vm_area_struct *vma = bprm->vma;  in setup_arg_pages()
727 	stack_base = bprm->rlim_stack.rlim_max;  in setup_arg_pages()
742 	mm->arg_start = bprm->p - stack_shift;  in setup_arg_pages()
743 	bprm->p = vma->vm_end - stack_shift;  in setup_arg_pages()
754 	bprm->p -= stack_shift;  in setup_arg_pages()
755 	mm->arg_start = bprm->p;  in setup_arg_pages()
758 	bprm->exec -= stack_shift;  in setup_arg_pages()
790 			     bprm->file);  in setup_arg_pages()
814 	rlim_stack = bprm->rlim_stack.rlim_cur & PAGE_MASK;  in setup_arg_pages()
823 	current->mm->start_stack = bprm->p;  in setup_arg_pages()
840 int transfer_args_to_stack(struct linux_binprm *bprm,  in transfer_args_to_stack()  argument
846 	stop = bprm->p >> PAGE_SHIFT;  in transfer_args_to_stack()
850 		unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0;  in transfer_args_to_stack()
851 		char *src = kmap_local_page(bprm->page[index]) + offset;  in transfer_args_to_stack()
860 	bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;  in transfer_args_to_stack()
1207 int begin_new_exec(struct linux_binprm * bprm)  in begin_new_exec()  argument
1213 	retval = bprm_creds_from_file(bprm);  in begin_new_exec()
1223 	trace_sched_prepare_exec(current, bprm);  in begin_new_exec()
1228 	bprm->point_of_no_return = true;  in begin_new_exec()
1251 	retval = set_mm_exe_file(bprm->mm, bprm->file);  in begin_new_exec()
1256 	would_dump(bprm, bprm->file);  in begin_new_exec()
1257 	if (bprm->have_execfd)  in begin_new_exec()
1258 		would_dump(bprm, bprm->executable);  in begin_new_exec()
1263 	acct_arg_size(bprm, 0);  in begin_new_exec()
1264 	retval = exec_mmap(bprm->mm);  in begin_new_exec()
1268 	bprm->mm = NULL;  in begin_new_exec()
1292 	me->personality &= ~bprm->per_clear;  in begin_new_exec()
1304 	if (bprm->secureexec) {  in begin_new_exec()
1315 		if (bprm->rlim_stack.rlim_cur > _STK_LIM)  in begin_new_exec()
1316 			bprm->rlim_stack.rlim_cur = _STK_LIM;  in begin_new_exec()
1326 	if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||  in begin_new_exec()
1340 	if (bprm->comm_from_dentry) {  in begin_new_exec()
1350 		__set_task_comm(me, smp_load_acquire(&bprm->file->f_path.dentry->d_name.name),  in begin_new_exec()
1354 		__set_task_comm(me, kbasename(bprm->filename), true);  in begin_new_exec()
1362 	retval = set_cred_ucounts(bprm->cred);  in begin_new_exec()
1369 	security_bprm_committing_creds(bprm);  in begin_new_exec()
1371 	commit_creds(bprm->cred);  in begin_new_exec()
1372 	bprm->cred = NULL;  in begin_new_exec()
1387 	security_bprm_committed_creds(bprm);  in begin_new_exec()
1390 	if (bprm->have_execfd) {  in begin_new_exec()
1394 		fd_install(retval, bprm->executable);  in begin_new_exec()
1395 		bprm->executable = NULL;  in begin_new_exec()
1396 		bprm->execfd = retval;  in begin_new_exec()
1402 	if (!bprm->cred)  in begin_new_exec()
1410 void would_dump(struct linux_binprm *bprm, struct file *file)  in would_dump()  argument
1416 		bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;  in would_dump()
1419 		user_ns = old = bprm->mm->user_ns;  in would_dump()
1425 			bprm->mm->user_ns = get_user_ns(user_ns);  in would_dump()
1432 void setup_new_exec(struct linux_binprm * bprm)  in setup_new_exec()  argument
1437 	arch_pick_mmap_layout(me->mm, &bprm->rlim_stack);  in setup_new_exec()
1452 void finalize_exec(struct linux_binprm *bprm)  in finalize_exec()  argument
1456 	current->signal->rlim[RLIMIT_STACK] = bprm->rlim_stack;  in finalize_exec()
1467 static int prepare_bprm_creds(struct linux_binprm *bprm)  in prepare_bprm_creds()  argument
1472 	bprm->cred = prepare_exec_creds();  in prepare_bprm_creds()
1473 	if (likely(bprm->cred))  in prepare_bprm_creds()
1489 static void free_bprm(struct linux_binprm *bprm)  in free_bprm()  argument
1491 	if (bprm->mm) {  in free_bprm()
1492 		acct_arg_size(bprm, 0);  in free_bprm()
1493 		mmput(bprm->mm);  in free_bprm()
1495 	free_arg_pages(bprm);  in free_bprm()
1496 	if (bprm->cred) {  in free_bprm()
1500 		abort_creds(bprm->cred);  in free_bprm()
1502 	do_close_execat(bprm->file);  in free_bprm()
1503 	if (bprm->executable)  in free_bprm()
1504 		fput(bprm->executable);  in free_bprm()
1506 	if (bprm->interp != bprm->filename)  in free_bprm()
1507 		kfree(bprm->interp);  in free_bprm()
1508 	kfree(bprm->fdpath);  in free_bprm()
1509 	kfree(bprm);  in free_bprm()
1514 	struct linux_binprm *bprm;  in alloc_bprm()  local
1522 	bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);  in alloc_bprm()
1523 	if (!bprm) {  in alloc_bprm()
1528 	bprm->file = file;  in alloc_bprm()
1531 		bprm->filename = filename->name;  in alloc_bprm()
1534 			bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd);  in alloc_bprm()
1535 			bprm->comm_from_dentry = 1;  in alloc_bprm()
1537 			bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s",  in alloc_bprm()
1540 		if (!bprm->fdpath)  in alloc_bprm()
1553 			bprm->interp_flags |= BINPRM_FLAGS_PATH_INACCESSIBLE;  in alloc_bprm()
1555 		bprm->filename = bprm->fdpath;  in alloc_bprm()
1557 	bprm->interp = bprm->filename;  in alloc_bprm()
1572 	bprm->is_check = !!(flags & AT_EXECVE_CHECK);  in alloc_bprm()
1574 	retval = bprm_mm_init(bprm);  in alloc_bprm()
1576 		return bprm;  in alloc_bprm()
1579 	free_bprm(bprm);  in alloc_bprm()
1583 int bprm_change_interp(const char *interp, struct linux_binprm *bprm)  in bprm_change_interp()  argument
1586 	if (bprm->interp != bprm->filename)  in bprm_change_interp()
1587 		kfree(bprm->interp);  in bprm_change_interp()
1588 	bprm->interp = kstrdup(interp, GFP_KERNEL);  in bprm_change_interp()
1589 	if (!bprm->interp)  in bprm_change_interp()
1600 static void check_unsafe_exec(struct linux_binprm *bprm)  in check_unsafe_exec()  argument
1606 		bprm->unsafe |= LSM_UNSAFE_PTRACE;  in check_unsafe_exec()
1613 		bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;  in check_unsafe_exec()
1636 		bprm->unsafe |= LSM_UNSAFE_SHARE;  in check_unsafe_exec()
1642 static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file)  in bprm_fill_uid()  argument
1679 	if (!vfsuid_has_mapping(bprm->cred->user_ns, vfsuid) ||  in bprm_fill_uid()
1680 	    !vfsgid_has_mapping(bprm->cred->user_ns, vfsgid))  in bprm_fill_uid()
1684 		bprm->per_clear |= PER_CLEAR_ON_SETID;  in bprm_fill_uid()
1685 		bprm->cred->euid = vfsuid_into_kuid(vfsuid);  in bprm_fill_uid()
1689 		bprm->per_clear |= PER_CLEAR_ON_SETID;  in bprm_fill_uid()
1690 		bprm->cred->egid = vfsgid_into_kgid(vfsgid);  in bprm_fill_uid()
1697 static int bprm_creds_from_file(struct linux_binprm *bprm)  in bprm_creds_from_file()  argument
1700 	struct file *file = bprm->execfd_creds ? bprm->executable : bprm->file;  in bprm_creds_from_file()
1702 	bprm_fill_uid(bprm, file);  in bprm_creds_from_file()
1703 	return security_bprm_creds_from_file(bprm, file);  in bprm_creds_from_file()
1712 static int prepare_binprm(struct linux_binprm *bprm)  in prepare_binprm()  argument
1716 	memset(bprm->buf, 0, BINPRM_BUF_SIZE);  in prepare_binprm()
1717 	return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos);  in prepare_binprm()
1725 int remove_arg_zero(struct linux_binprm *bprm)  in remove_arg_zero()  argument
1731 	if (!bprm->argc)  in remove_arg_zero()
1735 		offset = bprm->p & ~PAGE_MASK;  in remove_arg_zero()
1736 		page = get_arg_page(bprm, bprm->p, 0);  in remove_arg_zero()
1742 				offset++, bprm->p++)  in remove_arg_zero()
1749 	bprm->p++;  in remove_arg_zero()
1750 	bprm->argc--;  in remove_arg_zero()
1759 static int search_binary_handler(struct linux_binprm *bprm)  in search_binary_handler()  argument
1764 	retval = prepare_binprm(bprm);  in search_binary_handler()
1768 	retval = security_bprm_check(bprm);  in search_binary_handler()
1778 		retval = fmt->load_binary(bprm);  in search_binary_handler()
1782 		if (bprm->point_of_no_return || (retval != -ENOEXEC)) {  in search_binary_handler()
1793 static int exec_binprm(struct linux_binprm *bprm)  in exec_binprm()  argument
1810 		ret = search_binary_handler(bprm);  in exec_binprm()
1813 		if (!bprm->interpreter)  in exec_binprm()
1816 		exec = bprm->file;  in exec_binprm()
1817 		bprm->file = bprm->interpreter;  in exec_binprm()
1818 		bprm->interpreter = NULL;  in exec_binprm()
1821 		if (unlikely(bprm->have_execfd)) {  in exec_binprm()
1822 			if (bprm->executable) {  in exec_binprm()
1826 			bprm->executable = exec;  in exec_binprm()
1831 	audit_bprm(bprm);  in exec_binprm()
1832 	trace_sched_process_exec(current, old_pid, bprm);  in exec_binprm()
1838 static int bprm_execve(struct linux_binprm *bprm)  in bprm_execve()  argument
1842 	retval = prepare_bprm_creds(bprm);  in bprm_execve()
1851 	check_unsafe_exec(bprm);  in bprm_execve()
1858 	retval = security_bprm_creds_for_exec(bprm);  in bprm_execve()
1859 	if (retval || bprm->is_check)  in bprm_execve()
1862 	retval = exec_binprm(bprm);  in bprm_execve()
1882 	if (bprm->point_of_no_return && !fatal_signal_pending(current))  in bprm_execve()
1897 	struct linux_binprm *bprm;  in do_execveat_common()  local
1919 	bprm = alloc_bprm(fd, filename, flags);  in do_execveat_common()
1920 	if (IS_ERR(bprm)) {  in do_execveat_common()
1921 		retval = PTR_ERR(bprm);  in do_execveat_common()
1928 	bprm->argc = retval;  in do_execveat_common()
1933 	bprm->envc = retval;  in do_execveat_common()
1935 	retval = bprm_stack_limits(bprm);  in do_execveat_common()
1939 	retval = copy_string_kernel(bprm->filename, bprm);  in do_execveat_common()
1942 	bprm->exec = bprm->p;  in do_execveat_common()
1944 	retval = copy_strings(bprm->envc, envp, bprm);  in do_execveat_common()
1948 	retval = copy_strings(bprm->argc, argv, bprm);  in do_execveat_common()
1958 	if (bprm->argc == 0) {  in do_execveat_common()
1959 		retval = copy_string_kernel("", bprm);  in do_execveat_common()
1962 		bprm->argc = 1;  in do_execveat_common()
1965 			     current->comm, bprm->filename);  in do_execveat_common()
1968 	retval = bprm_execve(bprm);  in do_execveat_common()
1970 	free_bprm(bprm);  in do_execveat_common()
1981 	struct linux_binprm *bprm;  in kernel_execve()  local
1993 	bprm = alloc_bprm(fd, filename, 0);  in kernel_execve()
1994 	if (IS_ERR(bprm)) {  in kernel_execve()
1995 		retval = PTR_ERR(bprm);  in kernel_execve()
2004 	bprm->argc = retval;  in kernel_execve()
2009 	bprm->envc = retval;  in kernel_execve()
2011 	retval = bprm_stack_limits(bprm);  in kernel_execve()
2015 	retval = copy_string_kernel(bprm->filename, bprm);  in kernel_execve()
2018 	bprm->exec = bprm->p;  in kernel_execve()
2020 	retval = copy_strings_kernel(bprm->envc, envp, bprm);  in kernel_execve()
2024 	retval = copy_strings_kernel(bprm->argc, argv, bprm);  in kernel_execve()
2028 	retval = bprm_execve(bprm);  in kernel_execve()
2030 	free_bprm(bprm);  in kernel_execve()