2188 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/*3 * linux/fs/exec.c4 *5 * Copyright (C) 1991, 1992 Linus Torvalds6 */7 8/*9 * #!-checking implemented by tytso.10 */11/*12 * Demand-loading implemented 01.12.91 - no need to read anything but13 * the header into memory. The inode of the executable is put into14 * "current->executable", and page faults do the actual loading. Clean.15 *16 * Once more I can proudly say that linux stood up to being changed: it17 * was less than 2 hours work to get demand-loading completely implemented.18 *19 * Demand loading changed July 1993 by Eric Youngdale. Use mmap instead,20 * current->executable is only used by the procfs. This allows a dispatch21 * table to check for several different types of binary formats. We keep22 * trying until we recognize the file or we run out of supported binary23 * formats.24 */25 26#include <linux/kernel_read_file.h>27#include <linux/slab.h>28#include <linux/file.h>29#include <linux/fdtable.h>30#include <linux/mm.h>31#include <linux/stat.h>32#include <linux/fcntl.h>33#include <linux/swap.h>34#include <linux/string.h>35#include <linux/init.h>36#include <linux/sched/mm.h>37#include <linux/sched/coredump.h>38#include <linux/sched/signal.h>39#include <linux/sched/numa_balancing.h>40#include <linux/sched/task.h>41#include <linux/pagemap.h>42#include <linux/perf_event.h>43#include <linux/highmem.h>44#include <linux/spinlock.h>45#include <linux/key.h>46#include <linux/personality.h>47#include <linux/binfmts.h>48#include <linux/utsname.h>49#include <linux/pid_namespace.h>50#include <linux/module.h>51#include <linux/namei.h>52#include <linux/mount.h>53#include <linux/security.h>54#include <linux/syscalls.h>55#include <linux/tsacct_kern.h>56#include <linux/cn_proc.h>57#include <linux/audit.h>58#include <linux/kmod.h>59#include <linux/fsnotify.h>60#include <linux/fs_struct.h>61#include <linux/oom.h>62#include <linux/compat.h>63#include <linux/vmalloc.h>64#include <linux/io_uring.h>65#include <linux/syscall_user_dispatch.h>66#include <linux/coredump.h>67#include <linux/time_namespace.h>68#include <linux/user_events.h>69#include <linux/rseq.h>70#include <linux/ksm.h>71 72#include <linux/uaccess.h>73#include <asm/mmu_context.h>74#include <asm/tlb.h>75 76#include <trace/events/task.h>77#include "internal.h"78 79#include <trace/events/sched.h>80 81static int bprm_creds_from_file(struct linux_binprm *bprm);82 83int suid_dumpable = 0;84 85static LIST_HEAD(formats);86static DEFINE_RWLOCK(binfmt_lock);87 88void __register_binfmt(struct linux_binfmt * fmt, int insert)89{90 write_lock(&binfmt_lock);91 insert ? list_add(&fmt->lh, &formats) :92 list_add_tail(&fmt->lh, &formats);93 write_unlock(&binfmt_lock);94}95 96EXPORT_SYMBOL(__register_binfmt);97 98void unregister_binfmt(struct linux_binfmt * fmt)99{100 write_lock(&binfmt_lock);101 list_del(&fmt->lh);102 write_unlock(&binfmt_lock);103}104 105EXPORT_SYMBOL(unregister_binfmt);106 107static inline void put_binfmt(struct linux_binfmt * fmt)108{109 module_put(fmt->module);110}111 112bool path_noexec(const struct path *path)113{114 return (path->mnt->mnt_flags & MNT_NOEXEC) ||115 (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC);116}117 118#ifdef CONFIG_USELIB119/*120 * Note that a shared library must be both readable and executable due to121 * security reasons.122 *123 * Also note that we take the address to load from the file itself.124 */125SYSCALL_DEFINE1(uselib, const char __user *, library)126{127 struct linux_binfmt *fmt;128 struct file *file;129 struct filename *tmp = getname(library);130 int error = PTR_ERR(tmp);131 static const struct open_flags uselib_flags = {132 .open_flag = O_LARGEFILE | O_RDONLY,133 .acc_mode = MAY_READ | MAY_EXEC,134 .intent = LOOKUP_OPEN,135 .lookup_flags = LOOKUP_FOLLOW,136 };137 138 if (IS_ERR(tmp))139 goto out;140 141 file = do_filp_open(AT_FDCWD, tmp, &uselib_flags);142 putname(tmp);143 error = PTR_ERR(file);144 if (IS_ERR(file))145 goto out;146 147 /*148 * Check do_open_execat() for an explanation.149 */150 error = -EACCES;151 if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) ||152 path_noexec(&file->f_path))153 goto exit;154 155 error = -ENOEXEC;156 157 read_lock(&binfmt_lock);158 list_for_each_entry(fmt, &formats, lh) {159 if (!fmt->load_shlib)160 continue;161 if (!try_module_get(fmt->module))162 continue;163 read_unlock(&binfmt_lock);164 error = fmt->load_shlib(file);165 read_lock(&binfmt_lock);166 put_binfmt(fmt);167 if (error != -ENOEXEC)168 break;169 }170 read_unlock(&binfmt_lock);171exit:172 fput(file);173out:174 return error;175}176#endif /* #ifdef CONFIG_USELIB */177 178#ifdef CONFIG_MMU179/*180 * The nascent bprm->mm is not visible until exec_mmap() but it can181 * use a lot of memory, account these pages in current->mm temporary182 * for oom_badness()->get_mm_rss(). Once exec succeeds or fails, we183 * change the counter back via acct_arg_size(0).184 */185static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)186{187 struct mm_struct *mm = current->mm;188 long diff = (long)(pages - bprm->vma_pages);189 190 if (!mm || !diff)191 return;192 193 bprm->vma_pages = pages;194 add_mm_counter(mm, MM_ANONPAGES, diff);195}196 197static HWJS_SUSPENDS struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,198 int write)199{200 struct page *page;201 struct vm_area_struct *vma = bprm->vma;202 struct mm_struct *mm = bprm->mm;203 int ret;204 205 /*206 * Avoid relying on expanding the stack down in GUP (which207 * does not work for STACK_GROWSUP anyway), and just do it208 * by hand ahead of time.209 */210 if (write && pos < vma->vm_start) {211 mmap_write_lock(mm);212 ret = expand_downwards(vma, pos);213 if (unlikely(ret < 0)) {214 mmap_write_unlock(mm);215 return NULL;216 }217 mmap_write_downgrade(mm);218 } else219 mmap_read_lock(mm);220 221 /*222 * We are doing an exec(). 'current' is the process223 * doing the exec and 'mm' is the new process's mm.224 */225 ret = get_user_pages_remote(mm, pos, 1,226 write ? FOLL_WRITE : 0,227 &page, NULL);228 mmap_read_unlock(mm);229 if (ret <= 0)230 return NULL;231 232 if (write)233 acct_arg_size(bprm, vma_pages(vma));234 235 return page;236}237 238static void put_arg_page(struct page *page)239{240 put_page(page);241}242 243static void free_arg_pages(struct linux_binprm *bprm)244{245}246 247static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,248 struct page *page)249{250 flush_cache_page(bprm->vma, pos, page_to_pfn(page));251}252 253static HWJS_SUSPENDS int __bprm_mm_init(struct linux_binprm *bprm)254{255 int err;256 struct vm_area_struct *vma = NULL;257 struct mm_struct *mm = bprm->mm;258 259 bprm->vma = vma = vm_area_alloc(mm);260 if (!vma)261 return -ENOMEM;262 vma_set_anonymous(vma);263 264 if (mmap_write_lock_killable(mm)) {265 err = -EINTR;266 goto err_free;267 }268 269 /*270 * Need to be called with mmap write lock271 * held, to avoid race with ksmd.272 */273 err = ksm_execve(mm);274 if (err)275 goto err_ksm;276 277 /*278 * Place the stack at the largest stack address the architecture279 * supports. Later, we'll move this to an appropriate place. We don't280 * use STACK_TOP because that can depend on attributes which aren't281 * configured yet.282 */283 BUILD_BUG_ON(VM_STACK_FLAGS & VM_STACK_INCOMPLETE_SETUP);284 vma->vm_end = STACK_TOP_MAX;285 vma->vm_start = vma->vm_end - PAGE_SIZE;286 vm_flags_init(vma, VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP);287 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);288 289 err = insert_vm_struct(mm, vma);290 if (err)291 goto err;292 293 mm->stack_vm = mm->total_vm = 1;294 mmap_write_unlock(mm);295 bprm->p = vma->vm_end - sizeof(void *);296 return 0;297err:298 ksm_exit(mm);299err_ksm:300 mmap_write_unlock(mm);301err_free:302 bprm->vma = NULL;303 vm_area_free(vma);304 return err;305}306 307static bool valid_arg_len(struct linux_binprm *bprm, long len)308{309 return len <= MAX_ARG_STRLEN;310}311 312#else313 314static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)315{316}317 318static HWJS_SUSPENDS struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,319 int write)320{321 struct page *page;322 323 page = bprm->page[pos / PAGE_SIZE];324 if (!page && write) {325 page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);326 if (!page)327 return NULL;328 bprm->page[pos / PAGE_SIZE] = page;329 }330 331 return page;332}333 334static void put_arg_page(struct page *page)335{336}337 338static void free_arg_page(struct linux_binprm *bprm, int i)339{340 if (bprm->page[i]) {341 __free_page(bprm->page[i]);342 bprm->page[i] = NULL;343 }344}345 346static void free_arg_pages(struct linux_binprm *bprm)347{348 int i;349 350 for (i = 0; i < MAX_ARG_PAGES; i++)351 free_arg_page(bprm, i);352}353 354static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,355 struct page *page)356{357}358 359static HWJS_SUSPENDS int __bprm_mm_init(struct linux_binprm *bprm)360{361 bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);362 return 0;363}364 365static bool valid_arg_len(struct linux_binprm *bprm, long len)366{367 return len <= bprm->p;368}369 370#endif /* CONFIG_MMU */371 372/*373 * Create a new mm_struct and populate it with a temporary stack374 * vm_area_struct. We don't have enough context at this point to set the stack375 * flags, permissions, and offset, so we use temporary values. We'll update376 * them later in setup_arg_pages().377 */378static int bprm_mm_init(struct linux_binprm *bprm)379{380 int err;381 struct mm_struct *mm = NULL;382 383 bprm->mm = mm = mm_alloc();384 err = -ENOMEM;385 if (!mm)386 goto err;387 388 /* Save current stack limit for all calculations made during exec. */389 task_lock(current->group_leader);390 bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];391 task_unlock(current->group_leader);392 393 err = __bprm_mm_init(bprm);394 if (err)395 goto err;396 397 return 0;398 399err:400 if (mm) {401 bprm->mm = NULL;402 mmdrop(mm);403 }404 405 return err;406}407 408struct user_arg_ptr {409#ifdef CONFIG_COMPAT410 bool is_compat;411#endif412 union {413 const char __user *const __user *native;414#ifdef CONFIG_COMPAT415 const compat_uptr_t __user *compat;416#endif417 } ptr;418};419 420static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)421{422 const char __user *native;423 424#ifdef CONFIG_COMPAT425 if (unlikely(argv.is_compat)) {426 compat_uptr_t compat;427 428 if (get_user(compat, argv.ptr.compat + nr))429 return ERR_PTR(-EFAULT);430 431 return compat_ptr(compat);432 }433#endif434 435 if (get_user(native, argv.ptr.native + nr))436 return ERR_PTR(-EFAULT);437 438 return native;439}440 441/*442 * count() counts the number of strings in array ARGV.443 */444static HWJS_SUSPENDS int count(struct user_arg_ptr argv, int max)445{446 int i = 0;447 448 if (argv.ptr.native != NULL) {449 for (;;) {450 const char __user *p = get_user_arg_ptr(argv, i);451 452 if (!p)453 break;454 455 if (IS_ERR(p))456 return -EFAULT;457 458 if (i >= max)459 return -E2BIG;460 ++i;461 462 if (fatal_signal_pending(current))463 return -ERESTARTNOHAND;464 cond_resched();465 }466 }467 return i;468}469 470static HWJS_SUSPENDS int count_strings_kernel(const char *const *argv)471{472 int i;473 474 if (!argv)475 return 0;476 477 for (i = 0; argv[i]; ++i) {478 if (i >= MAX_ARG_STRINGS)479 return -E2BIG;480 if (fatal_signal_pending(current))481 return -ERESTARTNOHAND;482 cond_resched();483 }484 return i;485}486 487static inline int bprm_set_stack_limit(struct linux_binprm *bprm,488 unsigned long limit)489{490#ifdef CONFIG_MMU491 /* Avoid a pathological bprm->p. */492 if (bprm->p < limit)493 return -E2BIG;494 bprm->argmin = bprm->p - limit;495#endif496 return 0;497}498static inline bool bprm_hit_stack_limit(struct linux_binprm *bprm)499{500#ifdef CONFIG_MMU501 return bprm->p < bprm->argmin;502#else503 return false;504#endif505}506 507/*508 * Calculate bprm->argmin from:509 * - _STK_LIM510 * - ARG_MAX511 * - bprm->rlim_stack.rlim_cur512 * - bprm->argc513 * - bprm->envc514 * - bprm->p515 */516static int bprm_stack_limits(struct linux_binprm *bprm)517{518 unsigned long limit, ptr_size;519 520 /*521 * Limit to 1/4 of the max stack size or 3/4 of _STK_LIM522 * (whichever is smaller) for the argv+env strings.523 * This ensures that:524 * - the remaining binfmt code will not run out of stack space,525 * - the program will have a reasonable amount of stack left526 * to work from.527 */528 limit = _STK_LIM / 4 * 3;529 limit = min(limit, bprm->rlim_stack.rlim_cur / 4);530 /*531 * We've historically supported up to 32 pages (ARG_MAX)532 * of argument strings even with small stacks533 */534 limit = max_t(unsigned long, limit, ARG_MAX);535 /* Reject totally pathological counts. */536 if (bprm->argc < 0 || bprm->envc < 0)537 return -E2BIG;538 /*539 * We must account for the size of all the argv and envp pointers to540 * the argv and envp strings, since they will also take up space in541 * the stack. They aren't stored until much later when we can't542 * signal to the parent that the child has run out of stack space.543 * Instead, calculate it here so it's possible to fail gracefully.544 *545 * In the case of argc = 0, make sure there is space for adding a546 * empty string (which will bump argc to 1), to ensure confused547 * userspace programs don't start processing from argv[1], thinking548 * argc can never be 0, to keep them from walking envp by accident.549 * See do_execveat_common().550 */551 if (check_add_overflow(max(bprm->argc, 1), bprm->envc, &ptr_size) ||552 check_mul_overflow(ptr_size, sizeof(void *), &ptr_size))553 return -E2BIG;554 if (limit <= ptr_size)555 return -E2BIG;556 limit -= ptr_size;557 558 return bprm_set_stack_limit(bprm, limit);559}560 561/*562 * 'copy_strings()' copies argument/environment strings from the old563 * processes's memory to the new process's stack. The call to get_user_pages()564 * ensures the destination page is created and not swapped out.565 */566static HWJS_SUSPENDS int copy_strings(int argc, struct user_arg_ptr argv,567 struct linux_binprm *bprm)568{569 struct page *kmapped_page = NULL;570 char *kaddr = NULL;571 unsigned long kpos = 0;572 int ret;573 574 while (argc-- > 0) {575 const char __user *str;576 int len;577 unsigned long pos;578 579 ret = -EFAULT;580 str = get_user_arg_ptr(argv, argc);581 if (IS_ERR(str))582 goto out;583 584 len = strnlen_user(str, MAX_ARG_STRLEN);585 if (!len)586 goto out;587 588 ret = -E2BIG;589 if (!valid_arg_len(bprm, len))590 goto out;591 592 /* We're going to work our way backwards. */593 pos = bprm->p;594 str += len;595 bprm->p -= len;596 if (bprm_hit_stack_limit(bprm))597 goto out;598 599 while (len > 0) {600 int offset, bytes_to_copy;601 602 if (fatal_signal_pending(current)) {603 ret = -ERESTARTNOHAND;604 goto out;605 }606 cond_resched();607 608 offset = pos % PAGE_SIZE;609 if (offset == 0)610 offset = PAGE_SIZE;611 612 bytes_to_copy = offset;613 if (bytes_to_copy > len)614 bytes_to_copy = len;615 616 offset -= bytes_to_copy;617 pos -= bytes_to_copy;618 str -= bytes_to_copy;619 len -= bytes_to_copy;620 621 if (!kmapped_page || kpos != (pos & PAGE_MASK)) {622 struct page *page;623 624 page = get_arg_page(bprm, pos, 1);625 if (!page) {626 ret = -E2BIG;627 goto out;628 }629 630 if (kmapped_page) {631 flush_dcache_page(kmapped_page);632 kunmap_local(kaddr);633 put_arg_page(kmapped_page);634 }635 kmapped_page = page;636 kaddr = kmap_local_page(kmapped_page);637 kpos = pos & PAGE_MASK;638 flush_arg_page(bprm, kpos, kmapped_page);639 }640 if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {641 ret = -EFAULT;642 goto out;643 }644 }645 }646 ret = 0;647out:648 if (kmapped_page) {649 flush_dcache_page(kmapped_page);650 kunmap_local(kaddr);651 put_arg_page(kmapped_page);652 }653 return ret;654}655 656/*657 * Copy and argument/environment string from the kernel to the processes stack.658 */659int copy_string_kernel(const char *arg, struct linux_binprm *bprm)660{661 int len = strnlen(arg, MAX_ARG_STRLEN) + 1 /* terminating NUL */;662 unsigned long pos = bprm->p;663 664 if (len == 0)665 return -EFAULT;666 if (!valid_arg_len(bprm, len))667 return -E2BIG;668 669 /* We're going to work our way backwards. */670 arg += len;671 bprm->p -= len;672 if (bprm_hit_stack_limit(bprm))673 return -E2BIG;674 675 while (len > 0) {676 unsigned int bytes_to_copy = min_t(unsigned int, len,677 min_not_zero(offset_in_page(pos), PAGE_SIZE));678 struct page *page;679 680 pos -= bytes_to_copy;681 arg -= bytes_to_copy;682 len -= bytes_to_copy;683 684 page = get_arg_page(bprm, pos, 1);685 if (!page)686 return -E2BIG;687 flush_arg_page(bprm, pos & PAGE_MASK, page);688 memcpy_to_page(page, offset_in_page(pos), arg, bytes_to_copy);689 put_arg_page(page);690 }691 692 return 0;693}694EXPORT_SYMBOL(copy_string_kernel);695 696static HWJS_SUSPENDS int copy_strings_kernel(int argc, const char *const *argv,697 struct linux_binprm *bprm)698{699 while (argc-- > 0) {700 int ret = copy_string_kernel(argv[argc], bprm);701 if (ret < 0)702 return ret;703 if (fatal_signal_pending(current))704 return -ERESTARTNOHAND;705 cond_resched();706 }707 return 0;708}709 710#ifdef CONFIG_MMU711 712/*713 * Finalizes the stack vm_area_struct. The flags and permissions are updated,714 * the stack is optionally relocated, and some extra space is added.715 */716int setup_arg_pages(struct linux_binprm *bprm,717 unsigned long stack_top,718 int executable_stack)719{720 unsigned long ret;721 unsigned long stack_shift;722 struct mm_struct *mm = current->mm;723 struct vm_area_struct *vma = bprm->vma;724 struct vm_area_struct *prev = NULL;725 unsigned long vm_flags;726 unsigned long stack_base;727 unsigned long stack_size;728 unsigned long stack_expand;729 unsigned long rlim_stack;730 struct mmu_gather tlb;731 struct vma_iterator vmi;732 733#ifdef CONFIG_STACK_GROWSUP734 /* Limit stack size */735 stack_base = bprm->rlim_stack.rlim_max;736 737 stack_base = calc_max_stack_size(stack_base);738 739 /* Add space for stack randomization. */740 if (current->flags & PF_RANDOMIZE)741 stack_base += (STACK_RND_MASK << PAGE_SHIFT);742 743 /* Make sure we didn't let the argument array grow too large. */744 if (vma->vm_end - vma->vm_start > stack_base)745 return -ENOMEM;746 747 stack_base = PAGE_ALIGN(stack_top - stack_base);748 749 stack_shift = vma->vm_start - stack_base;750 mm->arg_start = bprm->p - stack_shift;751 bprm->p = vma->vm_end - stack_shift;752#else753 stack_top = arch_align_stack(stack_top);754 stack_top = PAGE_ALIGN(stack_top);755 756 if (unlikely(stack_top < mmap_min_addr) ||757 unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))758 return -ENOMEM;759 760 stack_shift = vma->vm_end - stack_top;761 762 bprm->p -= stack_shift;763 mm->arg_start = bprm->p;764#endif765 766 if (bprm->loader)767 bprm->loader -= stack_shift;768 bprm->exec -= stack_shift;769 770 if (mmap_write_lock_killable(mm))771 return -EINTR;772 773 vm_flags = VM_STACK_FLAGS;774 775 /*776 * Adjust stack execute permissions; explicitly enable for777 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone778 * (arch default) otherwise.779 */780 if (unlikely(executable_stack == EXSTACK_ENABLE_X))781 vm_flags |= VM_EXEC;782 else if (executable_stack == EXSTACK_DISABLE_X)783 vm_flags &= ~VM_EXEC;784 vm_flags |= mm->def_flags;785 vm_flags |= VM_STACK_INCOMPLETE_SETUP;786 787 vma_iter_init(&vmi, mm, vma->vm_start);788 789 tlb_gather_mmu(&tlb, mm);790 ret = mprotect_fixup(&vmi, &tlb, vma, &prev, vma->vm_start, vma->vm_end,791 vm_flags);792 tlb_finish_mmu(&tlb);793 794 if (ret)795 goto out_unlock;796 BUG_ON(prev != vma);797 798 if (unlikely(vm_flags & VM_EXEC)) {799 pr_warn_once("process '%pD4' started with executable stack\n",800 bprm->file);801 }802 803 /* Move stack pages down in memory. */804 if (stack_shift) {805 /*806 * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX. Once807 * the binfmt code determines where the new stack should reside, we shift it to808 * its final location.809 */810 ret = relocate_vma_down(vma, stack_shift);811 if (ret)812 goto out_unlock;813 }814 815 /* mprotect_fixup is overkill to remove the temporary stack flags */816 vm_flags_clear(vma, VM_STACK_INCOMPLETE_SETUP);817 818 stack_expand = 131072UL; /* randomly 32*4k (or 2*64k) pages */819 stack_size = vma->vm_end - vma->vm_start;820 /*821 * Align this down to a page boundary as expand_stack822 * will align it up.823 */824 rlim_stack = bprm->rlim_stack.rlim_cur & PAGE_MASK;825 826 stack_expand = min(rlim_stack, stack_size + stack_expand);827 828#ifdef CONFIG_STACK_GROWSUP829 stack_base = vma->vm_start + stack_expand;830#else831 stack_base = vma->vm_end - stack_expand;832#endif833 current->mm->start_stack = bprm->p;834 ret = expand_stack_locked(vma, stack_base);835 if (ret)836 ret = -EFAULT;837 838out_unlock:839 mmap_write_unlock(mm);840 return ret;841}842EXPORT_SYMBOL(setup_arg_pages);843 844#else845 846/*847 * Transfer the program arguments and environment from the holding pages848 * onto the stack. The provided stack pointer is adjusted accordingly.849 */850int transfer_args_to_stack(struct linux_binprm *bprm,851 unsigned long *sp_location)852{853 unsigned long index, stop, sp;854 int ret = 0;855 856 stop = bprm->p >> PAGE_SHIFT;857 sp = *sp_location;858 859 for (index = MAX_ARG_PAGES - 1; index >= stop; index--) {860 unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0;861 char *src = kmap_local_page(bprm->page[index]) + offset;862 sp -= PAGE_SIZE - offset;863 if (copy_to_user((void *) sp, src, PAGE_SIZE - offset) != 0)864 ret = -EFAULT;865 kunmap_local(src);866 if (ret)867 goto out;868 }869 870 bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;871 *sp_location = sp;872 873out:874 return ret;875}876EXPORT_SYMBOL(transfer_args_to_stack);877 878#endif /* CONFIG_MMU */879 880/*881 * On success, caller must call do_close_execat() on the returned882 * struct file to close it.883 */884static struct file *do_open_execat(int fd, struct filename *name, int flags)885{886 struct file *file;887 struct open_flags open_exec_flags = {888 .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,889 .acc_mode = MAY_EXEC,890 .intent = LOOKUP_OPEN,891 .lookup_flags = LOOKUP_FOLLOW,892 };893 894 if ((flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)895 return ERR_PTR(-EINVAL);896 if (flags & AT_SYMLINK_NOFOLLOW)897 open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW;898 if (flags & AT_EMPTY_PATH)899 open_exec_flags.lookup_flags |= LOOKUP_EMPTY;900 901 file = do_filp_open(fd, name, &open_exec_flags);902 if (IS_ERR(file))903 return file;904 905 /*906 * In the past the regular type check was here. It moved to may_open() in907 * 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is908 * an invariant that all non-regular files error out before we get here.909 */910 if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)) ||911 path_noexec(&file->f_path)) {912 fput(file);913 return ERR_PTR(-EACCES);914 }915 916 return file;917}918 919/**920 * open_exec - Open a path name for execution921 *922 * @name: path name to open with the intent of executing it.923 *924 * Returns ERR_PTR on failure or allocated struct file on success.925 *926 * As this is a wrapper for the internal do_open_execat(). Also see927 * do_close_execat().928 */929struct file *open_exec(const char *name)930{931 struct filename *filename = getname_kernel(name);932 struct file *f = ERR_CAST(filename);933 934 if (!IS_ERR(filename)) {935 f = do_open_execat(AT_FDCWD, filename, 0);936 putname(filename);937 }938 return f;939}940EXPORT_SYMBOL(open_exec);941 942#if defined(CONFIG_BINFMT_FLAT) || defined(CONFIG_BINFMT_ELF_FDPIC)943ssize_t read_code(struct file *file, unsigned long addr, loff_t pos, size_t len)944{945 ssize_t res = vfs_read(file, (void __user *)addr, len, &pos);946 if (res > 0)947 flush_icache_user_range(addr, addr + len);948 return res;949}950EXPORT_SYMBOL(read_code);951#endif952 953/*954 * Maps the mm_struct mm into the current task struct.955 * On success, this function returns with exec_update_lock956 * held for writing.957 */958static int exec_mmap(struct mm_struct *mm)959{960 struct task_struct *tsk;961 struct mm_struct *old_mm, *active_mm;962 int ret;963 964 /* Notify parent that we're no longer interested in the old VM */965 tsk = current;966 old_mm = current->mm;967 exec_mm_release(tsk, old_mm);968 969 ret = down_write_killable(&tsk->signal->exec_update_lock);970 if (ret)971 return ret;972 973 if (old_mm) {974 /*975 * If there is a pending fatal signal perhaps a signal976 * whose default action is to create a coredump get977 * out and die instead of going through with the exec.978 */979 ret = mmap_read_lock_killable(old_mm);980 if (ret) {981 up_write(&tsk->signal->exec_update_lock);982 return ret;983 }984 }985 986 task_lock(tsk);987 membarrier_exec_mmap(mm);988 989 local_irq_disable();990 active_mm = tsk->active_mm;991 tsk->active_mm = mm;992 tsk->mm = mm;993 mm_init_cid(mm);994 /*995 * This prevents preemption while active_mm is being loaded and996 * it and mm are being updated, which could cause problems for997 * lazy tlb mm refcounting when these are updated by context998 * switches. Not all architectures can handle irqs off over999 * activate_mm yet.1000 */1001 if (!IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))1002 local_irq_enable();1003 activate_mm(active_mm, mm);1004 if (IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))1005 local_irq_enable();1006 lru_gen_add_mm(mm);1007 task_unlock(tsk);1008 lru_gen_use_mm(mm);1009 if (old_mm) {1010 mmap_read_unlock(old_mm);1011 BUG_ON(active_mm != old_mm);1012 setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm);1013 mm_update_next_owner(old_mm);1014 mmput(old_mm);1015 return 0;1016 }1017 mmdrop_lazy_tlb(active_mm);1018 return 0;1019}1020 1021static HWJS_SUSPENDS int de_thread(struct task_struct *tsk)1022{1023 struct signal_struct *sig = tsk->signal;1024 struct sighand_struct *oldsighand = tsk->sighand;1025 spinlock_t *lock = &oldsighand->siglock;1026 1027 if (thread_group_empty(tsk))1028 goto no_thread_group;1029 1030 /*1031 * Kill all other threads in the thread group.1032 */1033 spin_lock_irq(lock);1034 if ((sig->flags & SIGNAL_GROUP_EXIT) || sig->group_exec_task) {1035 /*1036 * Another group action in progress, just1037 * return so that the signal is processed.1038 */1039 spin_unlock_irq(lock);1040 return -EAGAIN;1041 }1042 1043 sig->group_exec_task = tsk;1044 sig->notify_count = zap_other_threads(tsk);1045 if (!thread_group_leader(tsk))1046 sig->notify_count--;1047 1048 while (sig->notify_count) {1049 __set_current_state(TASK_KILLABLE);1050 spin_unlock_irq(lock);1051 schedule();1052 if (__fatal_signal_pending(tsk))1053 goto killed;1054 spin_lock_irq(lock);1055 }1056 spin_unlock_irq(lock);1057 1058 /*1059 * At this point all other threads have exited, all we have to1060 * do is to wait for the thread group leader to become inactive,1061 * and to assume its PID:1062 */1063 if (!thread_group_leader(tsk)) {1064 struct task_struct *leader = tsk->group_leader;1065 1066 for (;;) {1067 cgroup_threadgroup_change_begin(tsk);1068 write_lock_irq(&tasklist_lock);1069 /*1070 * Do this under tasklist_lock to ensure that1071 * exit_notify() can't miss ->group_exec_task1072 */1073 sig->notify_count = -1;1074 if (likely(leader->exit_state))1075 break;1076 __set_current_state(TASK_KILLABLE);1077 write_unlock_irq(&tasklist_lock);1078 cgroup_threadgroup_change_end(tsk);1079 schedule();1080 if (__fatal_signal_pending(tsk))1081 goto killed;1082 }1083 1084 /*1085 * The only record we have of the real-time age of a1086 * process, regardless of execs it's done, is start_time.1087 * All the past CPU time is accumulated in signal_struct1088 * from sister threads now dead. But in this non-leader1089 * exec, nothing survives from the original leader thread,1090 * whose birth marks the true age of this process now.1091 * When we take on its identity by switching to its PID, we1092 * also take its birthdate (always earlier than our own).1093 */1094 tsk->start_time = leader->start_time;1095 tsk->start_boottime = leader->start_boottime;1096 1097 BUG_ON(!same_thread_group(leader, tsk));1098 /*1099 * An exec() starts a new thread group with the1100 * TGID of the previous thread group. Rehash the1101 * two threads with a switched PID, and release1102 * the former thread group leader:1103 */1104 1105 /* Become a process group leader with the old leader's pid.1106 * The old leader becomes a thread of the this thread group.1107 */1108 exchange_tids(tsk, leader);1109 transfer_pid(leader, tsk, PIDTYPE_TGID);1110 transfer_pid(leader, tsk, PIDTYPE_PGID);1111 transfer_pid(leader, tsk, PIDTYPE_SID);1112 1113 list_replace_rcu(&leader->tasks, &tsk->tasks);1114 list_replace_init(&leader->sibling, &tsk->sibling);1115 1116 tsk->group_leader = tsk;1117 leader->group_leader = tsk;1118 1119 tsk->exit_signal = SIGCHLD;1120 leader->exit_signal = -1;1121 1122 BUG_ON(leader->exit_state != EXIT_ZOMBIE);1123 leader->exit_state = EXIT_DEAD;1124 /*1125 * We are going to release_task()->ptrace_unlink() silently,1126 * the tracer can sleep in do_wait(). EXIT_DEAD guarantees1127 * the tracer won't block again waiting for this thread.1128 */1129 if (unlikely(leader->ptrace))1130 __wake_up_parent(leader, leader->parent);1131 write_unlock_irq(&tasklist_lock);1132 cgroup_threadgroup_change_end(tsk);1133 1134 release_task(leader);1135 }1136 1137 sig->group_exec_task = NULL;1138 sig->notify_count = 0;1139 1140no_thread_group:1141 /* we have changed execution domain */1142 tsk->exit_signal = SIGCHLD;1143 1144 BUG_ON(!thread_group_leader(tsk));1145 return 0;1146 1147killed:1148 /* protects against exit_notify() and __exit_signal() */1149 read_lock(&tasklist_lock);1150 sig->group_exec_task = NULL;1151 sig->notify_count = 0;1152 read_unlock(&tasklist_lock);1153 return -EAGAIN;1154}1155 1156 1157/*1158 * This function makes sure the current process has its own signal table,1159 * so that flush_signal_handlers can later reset the handlers without1160 * disturbing other processes. (Other processes might share the signal1161 * table via the CLONE_SIGHAND option to clone().)1162 */1163static int unshare_sighand(struct task_struct *me)1164{1165 struct sighand_struct *oldsighand = me->sighand;1166 1167 if (refcount_read(&oldsighand->count) != 1) {1168 struct sighand_struct *newsighand;1169 /*1170 * This ->sighand is shared with the CLONE_SIGHAND1171 * but not CLONE_THREAD task, switch to the new one.1172 */1173 newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);1174 if (!newsighand)1175 return -ENOMEM;1176 1177 refcount_set(&newsighand->count, 1);1178 1179 write_lock_irq(&tasklist_lock);1180 spin_lock(&oldsighand->siglock);1181 memcpy(newsighand->action, oldsighand->action,1182 sizeof(newsighand->action));1183 rcu_assign_pointer(me->sighand, newsighand);1184 spin_unlock(&oldsighand->siglock);1185 write_unlock_irq(&tasklist_lock);1186 1187 __cleanup_sighand(oldsighand);1188 }1189 return 0;1190}1191 1192char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)1193{1194 task_lock(tsk);1195 /* Always NUL terminated and zero-padded */1196 strscpy_pad(buf, tsk->comm, buf_size);1197 task_unlock(tsk);1198 return buf;1199}1200EXPORT_SYMBOL_GPL(__get_task_comm);1201 1202/*1203 * These functions flushes out all traces of the currently running executable1204 * so that a new one can be started1205 */1206 1207void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)1208{1209 task_lock(tsk);1210 trace_task_rename(tsk, buf);1211 strscpy_pad(tsk->comm, buf, sizeof(tsk->comm));1212 task_unlock(tsk);1213 perf_event_comm(tsk, exec);1214}1215 1216/*1217 * Calling this is the point of no return. None of the failures will be1218 * seen by userspace since either the process is already taking a fatal1219 * signal (via de_thread() or coredump), or will have SEGV raised1220 * (after exec_mmap()) by search_binary_handler (see below).1221 */1222int begin_new_exec(struct linux_binprm * bprm)1223{1224 struct task_struct *me = current;1225 int retval;1226 1227 /* Once we are committed compute the creds */1228 retval = bprm_creds_from_file(bprm);1229 if (retval)1230 return retval;1231 1232 /*1233 * This tracepoint marks the point before flushing the old exec where1234 * the current task is still unchanged, but errors are fatal (point of1235 * no return). The later "sched_process_exec" tracepoint is called after1236 * the current task has successfully switched to the new exec.1237 */1238 trace_sched_prepare_exec(current, bprm);1239 1240 /*1241 * Ensure all future errors are fatal.1242 */1243 bprm->point_of_no_return = true;1244 1245 /*1246 * Make this the only thread in the thread group.1247 */1248 retval = de_thread(me);1249 if (retval)1250 goto out;1251 1252 /*1253 * Cancel any io_uring activity across execve1254 */1255 io_uring_task_cancel();1256 1257 /* Ensure the files table is not shared. */1258 retval = unshare_files();1259 if (retval)1260 goto out;1261 1262 /*1263 * Must be called _before_ exec_mmap() as bprm->mm is1264 * not visible until then. Doing it here also ensures1265 * we don't race against replace_mm_exe_file().1266 */1267 retval = set_mm_exe_file(bprm->mm, bprm->file);1268 if (retval)1269 goto out;1270 1271 /* If the binary is not readable then enforce mm->dumpable=0 */1272 would_dump(bprm, bprm->file);1273 if (bprm->have_execfd)1274 would_dump(bprm, bprm->executable);1275 1276 /*1277 * Release all of the old mmap stuff1278 */1279 acct_arg_size(bprm, 0);1280 retval = exec_mmap(bprm->mm);1281 if (retval)1282 goto out;1283 1284 bprm->mm = NULL;1285 1286 retval = exec_task_namespaces();1287 if (retval)1288 goto out_unlock;1289 1290#ifdef CONFIG_POSIX_TIMERS1291 spin_lock_irq(&me->sighand->siglock);1292 posix_cpu_timers_exit(me);1293 spin_unlock_irq(&me->sighand->siglock);1294 exit_itimers(me);1295 flush_itimer_signals();1296#endif1297 1298 /*1299 * Make the signal table private.1300 */1301 retval = unshare_sighand(me);1302 if (retval)1303 goto out_unlock;1304 1305 me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC |1306 PF_NOFREEZE | PF_NO_SETAFFINITY);1307 flush_thread();1308 me->personality &= ~bprm->per_clear;1309 1310 clear_syscall_work_syscall_user_dispatch(me);1311 1312 /*1313 * We have to apply CLOEXEC before we change whether the process is1314 * dumpable (in setup_new_exec) to avoid a race with a process in userspace1315 * trying to access the should-be-closed file descriptors of a process1316 * undergoing exec(2).1317 */1318 do_close_on_exec(me->files);1319 1320 if (bprm->secureexec) {1321 /* Make sure parent cannot signal privileged process. */1322 me->pdeath_signal = 0;1323 1324 /*1325 * For secureexec, reset the stack limit to sane default to1326 * avoid bad behavior from the prior rlimits. This has to1327 * happen before arch_pick_mmap_layout(), which examines1328 * RLIMIT_STACK, but after the point of no return to avoid1329 * needing to clean up the change on failure.1330 */1331 if (bprm->rlim_stack.rlim_cur > _STK_LIM)1332 bprm->rlim_stack.rlim_cur = _STK_LIM;1333 }1334 1335 me->sas_ss_sp = me->sas_ss_size = 0;1336 1337 /*1338 * Figure out dumpability. Note that this checking only of current1339 * is wrong, but userspace depends on it. This should be testing1340 * bprm->secureexec instead.1341 */1342 if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||1343 !(uid_eq(current_euid(), current_uid()) &&1344 gid_eq(current_egid(), current_gid())))1345 set_dumpable(current->mm, suid_dumpable);1346 else1347 set_dumpable(current->mm, SUID_DUMP_USER);1348 1349 perf_event_exec();1350 __set_task_comm(me, kbasename(bprm->filename), true);1351 1352 /* An exec changes our domain. We are no longer part of the thread1353 group */1354 WRITE_ONCE(me->self_exec_id, me->self_exec_id + 1);1355 flush_signal_handlers(me, 0);1356 1357 retval = set_cred_ucounts(bprm->cred);1358 if (retval < 0)1359 goto out_unlock;1360 1361 /*1362 * install the new credentials for this executable1363 */1364 security_bprm_committing_creds(bprm);1365 1366 commit_creds(bprm->cred);1367 bprm->cred = NULL;1368 1369 /*1370 * Disable monitoring for regular users1371 * when executing setuid binaries. Must1372 * wait until new credentials are committed1373 * by commit_creds() above1374 */1375 if (get_dumpable(me->mm) != SUID_DUMP_USER)1376 perf_event_exit_task(me);1377 /*1378 * cred_guard_mutex must be held at least to this point to prevent1379 * ptrace_attach() from altering our determination of the task's1380 * credentials; any time after this it may be unlocked.1381 */1382 security_bprm_committed_creds(bprm);1383 1384 /* Pass the opened binary to the interpreter. */1385 if (bprm->have_execfd) {1386 retval = get_unused_fd_flags(0);1387 if (retval < 0)1388 goto out_unlock;1389 fd_install(retval, bprm->executable);1390 bprm->executable = NULL;1391 bprm->execfd = retval;1392 }1393 return 0;1394 1395out_unlock:1396 up_write(&me->signal->exec_update_lock);1397 if (!bprm->cred)1398 mutex_unlock(&me->signal->cred_guard_mutex);1399 1400out:1401 return retval;1402}1403EXPORT_SYMBOL(begin_new_exec);1404 1405void would_dump(struct linux_binprm *bprm, struct file *file)1406{1407 struct inode *inode = file_inode(file);1408 struct mnt_idmap *idmap = file_mnt_idmap(file);1409 if (inode_permission(idmap, inode, MAY_READ) < 0) {1410 struct user_namespace *old, *user_ns;1411 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;1412 1413 /* Ensure mm->user_ns contains the executable */1414 user_ns = old = bprm->mm->user_ns;1415 while ((user_ns != &init_user_ns) &&1416 !privileged_wrt_inode_uidgid(user_ns, idmap, inode))1417 user_ns = user_ns->parent;1418 1419 if (old != user_ns) {1420 bprm->mm->user_ns = get_user_ns(user_ns);1421 put_user_ns(old);1422 }1423 }1424}1425EXPORT_SYMBOL(would_dump);1426 1427void setup_new_exec(struct linux_binprm * bprm)1428{1429 /* Setup things that can depend upon the personality */1430 struct task_struct *me = current;1431 1432 arch_pick_mmap_layout(me->mm, &bprm->rlim_stack);1433 1434 arch_setup_new_exec();1435 1436 /* Set the new mm task size. We have to do that late because it may1437 * depend on TIF_32BIT which is only updated in flush_thread() on1438 * some architectures like powerpc1439 */1440 me->mm->task_size = TASK_SIZE;1441 up_write(&me->signal->exec_update_lock);1442 mutex_unlock(&me->signal->cred_guard_mutex);1443}1444EXPORT_SYMBOL(setup_new_exec);1445 1446/* Runs immediately before start_thread() takes over. */1447void finalize_exec(struct linux_binprm *bprm)1448{1449 /* Store any stack rlimit changes before starting thread. */1450 task_lock(current->group_leader);1451 current->signal->rlim[RLIMIT_STACK] = bprm->rlim_stack;1452 task_unlock(current->group_leader);1453}1454EXPORT_SYMBOL(finalize_exec);1455 1456/*1457 * Prepare credentials and lock ->cred_guard_mutex.1458 * setup_new_exec() commits the new creds and drops the lock.1459 * Or, if exec fails before, free_bprm() should release ->cred1460 * and unlock.1461 */1462static HWJS_SUSPENDS int prepare_bprm_creds(struct linux_binprm *bprm)1463{1464 if (mutex_lock_interruptible(¤t->signal->cred_guard_mutex))1465 return -ERESTARTNOINTR;1466 1467 bprm->cred = prepare_exec_creds();1468 if (likely(bprm->cred))1469 return 0;1470 1471 mutex_unlock(¤t->signal->cred_guard_mutex);1472 return -ENOMEM;1473}1474 1475/* Matches do_open_execat() */1476static void do_close_execat(struct file *file)1477{1478 if (file)1479 fput(file);1480}1481 1482static HWJS_SUSPENDS void free_bprm(struct linux_binprm *bprm)1483{1484 if (bprm->mm) {1485 acct_arg_size(bprm, 0);1486 mmput(bprm->mm);1487 }1488 free_arg_pages(bprm);1489 if (bprm->cred) {1490 mutex_unlock(¤t->signal->cred_guard_mutex);1491 abort_creds(bprm->cred);1492 }1493 do_close_execat(bprm->file);1494 if (bprm->executable)1495 fput(bprm->executable);1496 /* If a binfmt changed the interp, free it. */1497 if (bprm->interp != bprm->filename)1498 kfree(bprm->interp);1499 kfree(bprm->fdpath);1500 kfree(bprm);1501}1502 1503static HWJS_SUSPENDS struct linux_binprm *alloc_bprm(int fd, struct filename *filename, int flags)1504{1505 struct linux_binprm *bprm;1506 struct file *file;1507 int retval = -ENOMEM;1508 1509 file = do_open_execat(fd, filename, flags);1510 if (IS_ERR(file))1511 return ERR_CAST(file);1512 1513 bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);1514 if (!bprm) {1515 do_close_execat(file);1516 return ERR_PTR(-ENOMEM);1517 }1518 1519 bprm->file = file;1520 1521 if (fd == AT_FDCWD || filename->name[0] == '/') {1522 bprm->filename = filename->name;1523 } else {1524 if (filename->name[0] == '\0')1525 bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd);1526 else1527 bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s",1528 fd, filename->name);1529 if (!bprm->fdpath)1530 goto out_free;1531 1532 /*1533 * Record that a name derived from an O_CLOEXEC fd will be1534 * inaccessible after exec. This allows the code in exec to1535 * choose to fail when the executable is not mmaped into the1536 * interpreter and an open file descriptor is not passed to1537 * the interpreter. This makes for a better user experience1538 * than having the interpreter start and then immediately fail1539 * when it finds the executable is inaccessible.1540 */1541 if (get_close_on_exec(fd))1542 bprm->interp_flags |= BINPRM_FLAGS_PATH_INACCESSIBLE;1543 1544 bprm->filename = bprm->fdpath;1545 }1546 bprm->interp = bprm->filename;1547 1548 retval = bprm_mm_init(bprm);1549 if (!retval)1550 return bprm;1551 1552out_free:1553 free_bprm(bprm);1554 return ERR_PTR(retval);1555}1556 1557int bprm_change_interp(const char *interp, struct linux_binprm *bprm)1558{1559 /* If a binfmt changed the interp, free it first. */1560 if (bprm->interp != bprm->filename)1561 kfree(bprm->interp);1562 bprm->interp = kstrdup(interp, GFP_KERNEL);1563 if (!bprm->interp)1564 return -ENOMEM;1565 return 0;1566}1567EXPORT_SYMBOL(bprm_change_interp);1568 1569/*1570 * determine how safe it is to execute the proposed program1571 * - the caller must hold ->cred_guard_mutex to protect against1572 * PTRACE_ATTACH or seccomp thread-sync1573 */1574static void check_unsafe_exec(struct linux_binprm *bprm)1575{1576 struct task_struct *p = current, *t;1577 unsigned n_fs;1578 1579 if (p->ptrace)1580 bprm->unsafe |= LSM_UNSAFE_PTRACE;1581 1582 /*1583 * This isn't strictly necessary, but it makes it harder for LSMs to1584 * mess up.1585 */1586 if (task_no_new_privs(current))1587 bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;1588 1589 /*1590 * If another task is sharing our fs, we cannot safely1591 * suid exec because the differently privileged task1592 * will be able to manipulate the current directory, etc.1593 * It would be nice to force an unshare instead...1594 */1595 n_fs = 1;1596 spin_lock(&p->fs->lock);1597 rcu_read_lock();1598 for_other_threads(p, t) {1599 if (t->fs == p->fs)1600 n_fs++;1601 }1602 rcu_read_unlock();1603 1604 /* "users" and "in_exec" locked for copy_fs() */1605 if (p->fs->users > n_fs)1606 bprm->unsafe |= LSM_UNSAFE_SHARE;1607 else1608 p->fs->in_exec = 1;1609 spin_unlock(&p->fs->lock);1610}1611 1612static HWJS_SUSPENDS void bprm_fill_uid(struct linux_binprm *bprm, struct file *file)1613{1614 /* Handle suid and sgid on files */1615 struct mnt_idmap *idmap;1616 struct inode *inode = file_inode(file);1617 unsigned int mode;1618 vfsuid_t vfsuid;1619 vfsgid_t vfsgid;1620 int err;1621 1622 if (!mnt_may_suid(file->f_path.mnt))1623 return;1624 1625 if (task_no_new_privs(current))1626 return;1627 1628 mode = READ_ONCE(inode->i_mode);1629 if (!(mode & (S_ISUID|S_ISGID)))1630 return;1631 1632 idmap = file_mnt_idmap(file);1633 1634 /* Be careful if suid/sgid is set */1635 inode_lock(inode);1636 1637 /* Atomically reload and check mode/uid/gid now that lock held. */1638 mode = inode->i_mode;1639 vfsuid = i_uid_into_vfsuid(idmap, inode);1640 vfsgid = i_gid_into_vfsgid(idmap, inode);1641 err = inode_permission(idmap, inode, MAY_EXEC);1642 inode_unlock(inode);1643 1644 /* Did the exec bit vanish out from under us? Give up. */1645 if (err)1646 return;1647 1648 /* We ignore suid/sgid if there are no mappings for them in the ns */1649 if (!vfsuid_has_mapping(bprm->cred->user_ns, vfsuid) ||1650 !vfsgid_has_mapping(bprm->cred->user_ns, vfsgid))1651 return;1652 1653 if (mode & S_ISUID) {1654 bprm->per_clear |= PER_CLEAR_ON_SETID;1655 bprm->cred->euid = vfsuid_into_kuid(vfsuid);1656 }1657 1658 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {1659 bprm->per_clear |= PER_CLEAR_ON_SETID;1660 bprm->cred->egid = vfsgid_into_kgid(vfsgid);1661 }1662}1663 1664/*1665 * Compute brpm->cred based upon the final binary.1666 */1667static HWJS_SUSPENDS int bprm_creds_from_file(struct linux_binprm *bprm)1668{1669 /* Compute creds based on which file? */1670 struct file *file = bprm->execfd_creds ? bprm->executable : bprm->file;1671 1672 bprm_fill_uid(bprm, file);1673 return security_bprm_creds_from_file(bprm, file);1674}1675 1676/*1677 * Fill the binprm structure from the inode.1678 * Read the first BINPRM_BUF_SIZE bytes1679 *1680 * This may be called multiple times for binary chains (scripts for example).1681 */1682static int prepare_binprm(struct linux_binprm *bprm)1683{1684 loff_t pos = 0;1685 1686 memset(bprm->buf, 0, BINPRM_BUF_SIZE);1687 return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos);1688}1689 1690/*1691 * Arguments are '\0' separated strings found at the location bprm->p1692 * points to; chop off the first by relocating brpm->p to right after1693 * the first '\0' encountered.1694 */1695int remove_arg_zero(struct linux_binprm *bprm)1696{1697 unsigned long offset;1698 char *kaddr;1699 struct page *page;1700 1701 if (!bprm->argc)1702 return 0;1703 1704 do {1705 offset = bprm->p & ~PAGE_MASK;1706 page = get_arg_page(bprm, bprm->p, 0);1707 if (!page)1708 return -EFAULT;1709 kaddr = kmap_local_page(page);1710 1711 for (; offset < PAGE_SIZE && kaddr[offset];1712 offset++, bprm->p++)1713 ;1714 1715 kunmap_local(kaddr);1716 put_arg_page(page);1717 } while (offset == PAGE_SIZE);1718 1719 bprm->p++;1720 bprm->argc--;1721 1722 return 0;1723}1724EXPORT_SYMBOL(remove_arg_zero);1725 1726#define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))1727/*1728 * cycle the list of binary formats handler, until one recognizes the image1729 */1730static int search_binary_handler(struct linux_binprm *bprm)1731{1732 bool need_retry = IS_ENABLED(CONFIG_MODULES);1733 struct linux_binfmt *fmt;1734 int retval;1735 1736 retval = prepare_binprm(bprm);1737 if (retval < 0)1738 return retval;1739 1740 retval = security_bprm_check(bprm);1741 if (retval)1742 return retval;1743 1744 retval = -ENOENT;1745 retry:1746 read_lock(&binfmt_lock);1747 list_for_each_entry(fmt, &formats, lh) {1748 if (!try_module_get(fmt->module))1749 continue;1750 read_unlock(&binfmt_lock);1751 1752 retval = fmt->load_binary(bprm);1753 1754 read_lock(&binfmt_lock);1755 put_binfmt(fmt);1756 if (bprm->point_of_no_return || (retval != -ENOEXEC)) {1757 read_unlock(&binfmt_lock);1758 return retval;1759 }1760 }1761 read_unlock(&binfmt_lock);1762 1763 if (need_retry) {1764 if (printable(bprm->buf[0]) && printable(bprm->buf[1]) &&1765 printable(bprm->buf[2]) && printable(bprm->buf[3]))1766 return retval;1767 if (request_module("binfmt-%04x", *(ushort *)(bprm->buf + 2)) < 0)1768 return retval;1769 need_retry = false;1770 goto retry;1771 }1772 1773 return retval;1774}1775 1776/* arch hook; see end of file for the weak default + patch 0005 header */1777void arch_post_execve(struct linux_binprm *bprm);1778 1779/* binfmt handlers will call back into begin_new_exec() on success. */1780static HWJS_SUSPENDS int exec_binprm(struct linux_binprm *bprm)1781{1782 pid_t old_pid, old_vpid;1783 int ret, depth;1784 1785 /* Need to fetch pid before load_binary changes it */1786 old_pid = current->pid;1787 rcu_read_lock();1788 old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));1789 rcu_read_unlock();1790 1791 /* This allows 4 levels of binfmt rewrites before failing hard. */1792 for (depth = 0;; depth++) {1793 struct file *exec;1794 if (depth > 5)1795 return -ELOOP;1796 1797 ret = search_binary_handler(bprm);1798 if (ret < 0)1799 return ret;1800 if (!bprm->interpreter)1801 break;1802 1803 exec = bprm->file;1804 bprm->file = bprm->interpreter;1805 bprm->interpreter = NULL;1806 1807 if (unlikely(bprm->have_execfd)) {1808 if (bprm->executable) {1809 fput(exec);1810 return -ENOEXEC;1811 }1812 bprm->executable = exec;1813 } else1814 fput(exec);1815 }1816 1817 audit_bprm(bprm);1818 trace_sched_process_exec(current, old_pid, bprm);1819 ptrace_event(PTRACE_EVENT_EXEC, old_vpid);1820 proc_exec_connector(current);1821 return 0;1822}1823 1824static HWJS_SUSPENDS int bprm_execve(struct linux_binprm *bprm)1825{1826 int retval;1827 1828 retval = prepare_bprm_creds(bprm);1829 if (retval)1830 return retval;1831 1832 /*1833 * Check for unsafe execution states before exec_binprm(), which1834 * will call back into begin_new_exec(), into bprm_creds_from_file(),1835 * where setuid-ness is evaluated.1836 */1837 check_unsafe_exec(bprm);1838 current->in_execve = 1;1839 sched_mm_cid_before_execve(current);1840 1841 sched_exec();1842 1843 /* Set the unchanging part of bprm->cred */1844 retval = security_bprm_creds_for_exec(bprm);1845 if (retval)1846 goto out;1847 1848 retval = exec_binprm(bprm);1849 if (retval < 0)1850 goto out;1851 1852 sched_mm_cid_after_execve(current);1853 /* execve succeeded */1854 current->fs->in_exec = 0;1855 current->in_execve = 0;1856 rseq_execve(current);1857 user_events_execve(current);1858 acct_update_integrals(current);1859 task_numa_free(current, false);1860 arch_post_execve(bprm);1861 return retval;1862 1863out:1864 /*1865 * If past the point of no return ensure the code never1866 * returns to the userspace process. Use an existing fatal1867 * signal if present otherwise terminate the process with1868 * SIGSEGV.1869 */1870 if (bprm->point_of_no_return && !fatal_signal_pending(current))1871 force_fatal_sig(SIGSEGV);1872 1873 sched_mm_cid_after_execve(current);1874 current->fs->in_exec = 0;1875 current->in_execve = 0;1876 1877 return retval;1878}1879 1880static HWJS_SUSPENDS int do_execveat_common(int fd, struct filename *filename,1881 struct user_arg_ptr argv,1882 struct user_arg_ptr envp,1883 int flags)1884{1885 struct linux_binprm *bprm;1886 int retval;1887 1888 if (IS_ERR(filename))1889 return PTR_ERR(filename);1890 1891 /*1892 * We move the actual failure in case of RLIMIT_NPROC excess from1893 * set*uid() to execve() because too many poorly written programs1894 * don't check setuid() return code. Here we additionally recheck1895 * whether NPROC limit is still exceeded.1896 */1897 if ((current->flags & PF_NPROC_EXCEEDED) &&1898 is_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {1899 retval = -EAGAIN;1900 goto out_ret;1901 }1902 1903 /* We're below the limit (still or again), so we don't want to make1904 * further execve() calls fail. */1905 current->flags &= ~PF_NPROC_EXCEEDED;1906 1907 bprm = alloc_bprm(fd, filename, flags);1908 if (IS_ERR(bprm)) {1909 retval = PTR_ERR(bprm);1910 goto out_ret;1911 }1912 1913 retval = count(argv, MAX_ARG_STRINGS);1914 if (retval == 0)1915 pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",1916 current->comm, bprm->filename);1917 if (retval < 0)1918 goto out_free;1919 bprm->argc = retval;1920 1921 retval = count(envp, MAX_ARG_STRINGS);1922 if (retval < 0)1923 goto out_free;1924 bprm->envc = retval;1925 1926 retval = bprm_stack_limits(bprm);1927 if (retval < 0)1928 goto out_free;1929 1930 retval = copy_string_kernel(bprm->filename, bprm);1931 if (retval < 0)1932 goto out_free;1933 bprm->exec = bprm->p;1934 1935 retval = copy_strings(bprm->envc, envp, bprm);1936 if (retval < 0)1937 goto out_free;1938 1939 retval = copy_strings(bprm->argc, argv, bprm);1940 if (retval < 0)1941 goto out_free;1942 1943 /*1944 * When argv is empty, add an empty string ("") as argv[0] to1945 * ensure confused userspace programs that start processing1946 * from argv[1] won't end up walking envp. See also1947 * bprm_stack_limits().1948 */1949 if (bprm->argc == 0) {1950 retval = copy_string_kernel("", bprm);1951 if (retval < 0)1952 goto out_free;1953 bprm->argc = 1;1954 }1955 1956 retval = bprm_execve(bprm);1957out_free:1958 free_bprm(bprm);1959 1960out_ret:1961 putname(filename);1962 return retval;1963}1964 1965int kernel_execve(const char *kernel_filename,1966 const char *const *argv, const char *const *envp)1967{1968 struct filename *filename;1969 struct linux_binprm *bprm;1970 int fd = AT_FDCWD;1971 int retval;1972 1973 /* It is non-sense for kernel threads to call execve */1974 if (WARN_ON_ONCE(current->flags & PF_KTHREAD))1975 return -EINVAL;1976 1977 filename = getname_kernel(kernel_filename);1978 if (IS_ERR(filename))1979 return PTR_ERR(filename);1980 1981 bprm = alloc_bprm(fd, filename, 0);1982 if (IS_ERR(bprm)) {1983 retval = PTR_ERR(bprm);1984 goto out_ret;1985 }1986 1987 retval = count_strings_kernel(argv);1988 if (WARN_ON_ONCE(retval == 0))1989 retval = -EINVAL;1990 if (retval < 0)1991 goto out_free;1992 bprm->argc = retval;1993 1994 retval = count_strings_kernel(envp);1995 if (retval < 0)1996 goto out_free;1997 bprm->envc = retval;1998 1999 retval = bprm_stack_limits(bprm);2000 if (retval < 0)2001 goto out_free;2002 2003 retval = copy_string_kernel(bprm->filename, bprm);2004 if (retval < 0)2005 goto out_free;2006 bprm->exec = bprm->p;2007 2008 retval = copy_strings_kernel(bprm->envc, envp, bprm);2009 if (retval < 0)2010 goto out_free;2011 2012 retval = copy_strings_kernel(bprm->argc, argv, bprm);2013 if (retval < 0)2014 goto out_free;2015 2016 retval = bprm_execve(bprm);2017out_free:2018 free_bprm(bprm);2019out_ret:2020 putname(filename);2021 return retval;2022}2023 2024static HWJS_SUSPENDS int do_execve(struct filename *filename,2025 const char __user *const __user *__argv,2026 const char __user *const __user *__envp)2027{2028 struct user_arg_ptr argv = { .ptr.native = __argv };2029 struct user_arg_ptr envp = { .ptr.native = __envp };2030 return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);2031}2032 2033static HWJS_SUSPENDS int do_execveat(int fd, struct filename *filename,2034 const char __user *const __user *__argv,2035 const char __user *const __user *__envp,2036 int flags)2037{2038 struct user_arg_ptr argv = { .ptr.native = __argv };2039 struct user_arg_ptr envp = { .ptr.native = __envp };2040 2041 return do_execveat_common(fd, filename, argv, envp, flags);2042}2043 2044#ifdef CONFIG_COMPAT2045static int compat_do_execve(struct filename *filename,2046 const compat_uptr_t __user *__argv,2047 const compat_uptr_t __user *__envp)2048{2049 struct user_arg_ptr argv = {2050 .is_compat = true,2051 .ptr.compat = __argv,2052 };2053 struct user_arg_ptr envp = {2054 .is_compat = true,2055 .ptr.compat = __envp,2056 };2057 return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);2058}2059 2060static int compat_do_execveat(int fd, struct filename *filename,2061 const compat_uptr_t __user *__argv,2062 const compat_uptr_t __user *__envp,2063 int flags)2064{2065 struct user_arg_ptr argv = {2066 .is_compat = true,2067 .ptr.compat = __argv,2068 };2069 struct user_arg_ptr envp = {2070 .is_compat = true,2071 .ptr.compat = __envp,2072 };2073 return do_execveat_common(fd, filename, argv, envp, flags);2074}2075#endif2076 2077void set_binfmt(struct linux_binfmt *new)2078{2079 struct mm_struct *mm = current->mm;2080 2081 if (mm->binfmt)2082 module_put(mm->binfmt->module);2083 2084 mm->binfmt = new;2085 if (new)2086 __module_get(new->module);2087}2088EXPORT_SYMBOL(set_binfmt);2089 2090/*2091 * arch_post_execve - arch-specific hook called at the tail of2092 * bprm_execve's success path, after the standard post-execve2093 * teardown has run. bprm->binfmt is the loader that matched.2094 *2095 * Default is no-op. Arches that need to react to a specific2096 * binfmt match — e.g. wasm32 parks the kthread when binfmt_wasm2097 * transferred execution to a user Worker — override the weak2098 * default. See Documentation/wasm/rootfs-model.rst §4 R7.2099 */2100void __weak arch_post_execve(struct linux_binprm *bprm) { }2101 2102/*2103 * set_dumpable stores three-value SUID_DUMP_* into mm->flags.2104 */2105void set_dumpable(struct mm_struct *mm, int value)2106{2107 if (WARN_ON((unsigned)value > SUID_DUMP_ROOT))2108 return;2109 2110 set_mask_bits(&mm->flags, MMF_DUMPABLE_MASK, value);2111}2112 2113SYSCALL_DEFINE3(execve,2114 const char __user *, filename,2115 const char __user *const __user *, argv,2116 const char __user *const __user *, envp)2117{2118 return do_execve(getname(filename), argv, envp);2119}2120 2121SYSCALL_DEFINE5(execveat,2122 int, fd, const char __user *, filename,2123 const char __user *const __user *, argv,2124 const char __user *const __user *, envp,2125 int, flags)2126{2127 return do_execveat(fd,2128 getname_uflags(filename, flags),2129 argv, envp, flags);2130}2131 2132#ifdef CONFIG_COMPAT2133COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename,2134 const compat_uptr_t __user *, argv,2135 const compat_uptr_t __user *, envp)2136{2137 return compat_do_execve(getname(filename), argv, envp);2138}2139 2140COMPAT_SYSCALL_DEFINE5(execveat, int, fd,2141 const char __user *, filename,2142 const compat_uptr_t __user *, argv,2143 const compat_uptr_t __user *, envp,2144 int, flags)2145{2146 return compat_do_execveat(fd,2147 getname_uflags(filename, flags),2148 argv, envp, flags);2149}2150#endif2151 2152#ifdef CONFIG_SYSCTL2153 2154static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int write,2155 void *buffer, size_t *lenp, loff_t *ppos)2156{2157 int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);2158 2159 if (!error)2160 validate_coredump_safety();2161 return error;2162}2163 2164static struct ctl_table fs_exec_sysctls[] = {2165 {2166 .procname = "suid_dumpable",2167 .data = &suid_dumpable,2168 .maxlen = sizeof(int),2169 .mode = 0644,2170 .proc_handler = proc_dointvec_minmax_coredump,2171 .extra1 = SYSCTL_ZERO,2172 .extra2 = SYSCTL_TWO,2173 },2174};2175 2176static int __init init_fs_exec_sysctls(void)2177{2178 register_sysctl_init("fs", fs_exec_sysctls);2179 return 0;2180}2181 2182fs_initcall(init_fs_exec_sysctls);2183#endif /* CONFIG_SYSCTL */2184 2185#ifdef CONFIG_EXEC_KUNIT_TEST2186#include "tests/exec_kunit.c"2187#endif2188