input: misc: compass: akm89xx: fix memory leak and race on accessing inf
[linux-3.10.git] / fs / binfmt_elf_fdpic.c
index 952699a..c166f32 100644 (file)
@@ -56,7 +56,7 @@ typedef char *elf_caddr_t;
 
 MODULE_LICENSE("GPL");
 
-static int load_elf_fdpic_binary(struct linux_binprm *, struct pt_regs *);
+static int load_elf_fdpic_binary(struct linux_binprm *);
 static int elf_fdpic_fetch_phdrs(struct elf_fdpic_params *, struct file *);
 static int elf_fdpic_map_file(struct elf_fdpic_params *, struct file *,
                              struct mm_struct *, const char *);
@@ -91,7 +91,8 @@ static struct linux_binfmt elf_fdpic_format = {
 
 static int __init init_elf_fdpic_binfmt(void)
 {
-       return register_binfmt(&elf_fdpic_format);
+       register_binfmt(&elf_fdpic_format);
+       return 0;
 }
 
 static void __exit exit_elf_fdpic_binfmt(void)
@@ -163,10 +164,10 @@ static int elf_fdpic_fetch_phdrs(struct elf_fdpic_params *params,
 /*
  * load an fdpic binary into various bits of memory
  */
-static int load_elf_fdpic_binary(struct linux_binprm *bprm,
-                                struct pt_regs *regs)
+static int load_elf_fdpic_binary(struct linux_binprm *bprm)
 {
        struct elf_fdpic_params exec_params, interp_params;
+       struct pt_regs *regs = current_pt_regs();
        struct elf_phdr *phdr;
        unsigned long stack_size, entryaddr;
 #ifdef ELF_FDPIC_PLAT_INIT
@@ -245,8 +246,7 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
                         * mm->dumpable = 0 regardless of the interpreter's
                         * permissions.
                         */
-                       if (file_permission(interpreter, MAY_READ) < 0)
-                               bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
+                       would_dump(bprm, interpreter);
 
                        retval = kernel_read(interpreter, 0, bprm->buf,
                                             BINPRM_BUF_SIZE);
@@ -335,8 +335,6 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
        current->mm->context.exec_fdpic_loadmap = 0;
        current->mm->context.interp_fdpic_loadmap = 0;
 
-       current->flags &= ~PF_FORKNOEXEC;
-
 #ifdef CONFIG_MMU
        elf_fdpic_arch_lay_out_mm(&exec_params,
                                  &interp_params,
@@ -391,21 +389,17 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
            (executable_stack == EXSTACK_DEFAULT && VM_STACK_FLAGS & VM_EXEC))
                stack_prot |= PROT_EXEC;
 
-       down_write(&current->mm->mmap_sem);
-       current->mm->start_brk = do_mmap(NULL, 0, stack_size, stack_prot,
+       current->mm->start_brk = vm_mmap(NULL, 0, stack_size, stack_prot,
                                         MAP_PRIVATE | MAP_ANONYMOUS |
                                         MAP_UNINITIALIZED | MAP_GROWSDOWN,
                                         0);
 
        if (IS_ERR_VALUE(current->mm->start_brk)) {
-               up_write(&current->mm->mmap_sem);
                retval = current->mm->start_brk;
                current->mm->start_brk = 0;
                goto error_kill;
        }
 
-       up_write(&current->mm->mmap_sem);
-
        current->mm->brk = current->mm->start_brk;
        current->mm->context.end_brk = current->mm->start_brk;
        current->mm->context.end_brk +=
@@ -414,7 +408,6 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
 #endif
 
        install_exec_creds(bprm);
-       current->flags &= ~PF_FORKNOEXEC;
        if (create_elf_fdpic_tables(bprm, current->mm,
                                    &exec_params, &interp_params) < 0)
                goto error_kill;
@@ -490,7 +483,6 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
        size_t platform_len = 0, len;
        char *k_platform, *k_base_platform;
        char __user *u_platform, *u_base_platform, *p;
-       long hwcap;
        int loop;
        int nr; /* reset for each csp adjustment */
 
@@ -509,8 +501,6 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
                return -EFAULT;
 #endif
 
-       hwcap = ELF_HWCAP;
-
        /*
         * If this architecture has a platform capability string, copy it
         * to userspace.  In some cases (Sparc), this info is impossible
@@ -624,7 +614,10 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
 
        nr = 0;
        csp -= DLINFO_ITEMS * 2 * sizeof(unsigned long);
-       NEW_AUX_ENT(AT_HWCAP,   hwcap);
+       NEW_AUX_ENT(AT_HWCAP,   ELF_HWCAP);
+#ifdef ELF_HWCAP2
+       NEW_AUX_ENT(AT_HWCAP2,  ELF_HWCAP2);
+#endif
        NEW_AUX_ENT(AT_PAGESZ,  PAGE_SIZE);
        NEW_AUX_ENT(AT_CLKTCK,  CLOCKS_PER_SEC);
        NEW_AUX_ENT(AT_PHDR,    exec_params->ph_addr);
@@ -633,10 +626,10 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
        NEW_AUX_ENT(AT_BASE,    interp_params->elfhdr_addr);
        NEW_AUX_ENT(AT_FLAGS,   0);
        NEW_AUX_ENT(AT_ENTRY,   exec_params->entry_addr);
-       NEW_AUX_ENT(AT_UID,     (elf_addr_t) cred->uid);
-       NEW_AUX_ENT(AT_EUID,    (elf_addr_t) cred->euid);
-       NEW_AUX_ENT(AT_GID,     (elf_addr_t) cred->gid);
-       NEW_AUX_ENT(AT_EGID,    (elf_addr_t) cred->egid);
+       NEW_AUX_ENT(AT_UID,     (elf_addr_t) from_kuid_munged(cred->user_ns, cred->uid));
+       NEW_AUX_ENT(AT_EUID,    (elf_addr_t) from_kuid_munged(cred->user_ns, cred->euid));
+       NEW_AUX_ENT(AT_GID,     (elf_addr_t) from_kgid_munged(cred->user_ns, cred->gid));
+       NEW_AUX_ENT(AT_EGID,    (elf_addr_t) from_kgid_munged(cred->user_ns, cred->egid));
        NEW_AUX_ENT(AT_SECURE,  security_bprm_secureexec(bprm));
        NEW_AUX_ENT(AT_EXECFN,  bprm->exec);
 
@@ -916,7 +909,7 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params,
 
 dynamic_error:
        printk("ELF FDPIC %s with invalid DYNAMIC section (inode=%lu)\n",
-              what, file->f_path.dentry->d_inode->i_ino);
+              what, file_inode(file)->i_ino);
        return -ELIBBAD;
 }
 
@@ -933,7 +926,6 @@ static int elf_fdpic_map_file_constdisp_on_uclinux(
        struct elf32_fdpic_loadseg *seg;
        struct elf32_phdr *phdr;
        unsigned long load_addr, base = ULONG_MAX, top = 0, maddr = 0, mflags;
-       loff_t fpos;
        int loop, ret;
 
        load_addr = params->load_addr;
@@ -957,10 +949,8 @@ static int elf_fdpic_map_file_constdisp_on_uclinux(
        if (params->flags & ELF_FDPIC_FLAG_EXECUTABLE)
                mflags |= MAP_EXECUTABLE;
 
-       down_write(&mm->mmap_sem);
-       maddr = do_mmap(NULL, load_addr, top - base,
+       maddr = vm_mmap(NULL, load_addr, top - base,
                        PROT_READ | PROT_WRITE | PROT_EXEC, mflags, 0);
-       up_write(&mm->mmap_sem);
        if (IS_ERR_VALUE(maddr))
                return (int) maddr;
 
@@ -973,14 +963,12 @@ static int elf_fdpic_map_file_constdisp_on_uclinux(
                if (params->phdrs[loop].p_type != PT_LOAD)
                        continue;
 
-               fpos = phdr->p_offset;
-
                seg->addr = maddr + (phdr->p_vaddr - base);
                seg->p_vaddr = phdr->p_vaddr;
                seg->p_memsz = phdr->p_memsz;
 
-               ret = file->f_op->read(file, (void *) seg->addr,
-                                      phdr->p_filesz, &fpos);
+               ret = read_code(file, seg->addr, phdr->p_offset,
+                                      phdr->p_filesz);
                if (ret < 0)
                        return ret;
 
@@ -990,10 +978,9 @@ static int elf_fdpic_map_file_constdisp_on_uclinux(
 
                /* clear any space allocated but not loaded */
                if (phdr->p_filesz < phdr->p_memsz) {
-                       ret = clear_user((void *) (seg->addr + phdr->p_filesz),
-                                        phdr->p_memsz - phdr->p_filesz);
-                       if (ret)
-                               return ret;
+                       if (clear_user((void *) (seg->addr + phdr->p_filesz),
+                                      phdr->p_memsz - phdr->p_filesz))
+                               return -EFAULT;
                }
 
                if (mm) {
@@ -1005,15 +992,8 @@ static int elf_fdpic_map_file_constdisp_on_uclinux(
                                }
                        } else if (!mm->start_data) {
                                mm->start_data = seg->addr;
-#ifndef CONFIG_MMU
                                mm->end_data = seg->addr + phdr->p_memsz;
-#endif
                        }
-
-#ifdef CONFIG_MMU
-                       if (seg->addr + phdr->p_memsz > mm->end_data)
-                               mm->end_data = seg->addr + phdr->p_memsz;
-#endif
                }
 
                seg++;
@@ -1034,7 +1014,7 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
        struct elf32_fdpic_loadseg *seg;
        struct elf32_phdr *phdr;
        unsigned long load_addr, delta_vaddr;
-       int loop, dvset, ret;
+       int loop, dvset;
 
        load_addr = params->load_addr;
        delta_vaddr = 0;
@@ -1106,10 +1086,8 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
 
                /* create the mapping */
                disp = phdr->p_vaddr & ~PAGE_MASK;
-               down_write(&mm->mmap_sem);
-               maddr = do_mmap(file, maddr, phdr->p_memsz + disp, prot, flags,
+               maddr = vm_mmap(file, maddr, phdr->p_memsz + disp, prot, flags,
                                phdr->p_offset - disp);
-               up_write(&mm->mmap_sem);
 
                kdebug("mmap[%d] <file> sz=%lx pr=%x fl=%x of=%lx --> %08lx",
                       loop, phdr->p_memsz + disp, prot, flags,
@@ -1134,9 +1112,8 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
                 * PT_LOAD */
                if (prot & PROT_WRITE && disp > 0) {
                        kdebug("clear[%d] ad=%lx sz=%lx", loop, maddr, disp);
-                       ret = clear_user((void __user *) maddr, disp);
-                       if (ret)
-                               return ret;
+                       if (clear_user((void __user *) maddr, disp))
+                               return -EFAULT;
                        maddr += disp;
                }
 
@@ -1154,10 +1131,8 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
                        unsigned long xmaddr;
 
                        flags |= MAP_FIXED | MAP_ANONYMOUS;
-                       down_write(&mm->mmap_sem);
-                       xmaddr = do_mmap(NULL, xaddr, excess - excess1,
+                       xmaddr = vm_mmap(NULL, xaddr, excess - excess1,
                                         prot, flags, 0);
-                       up_write(&mm->mmap_sem);
 
                        kdebug("mmap[%d] <anon>"
                               " ad=%lx sz=%lx pr=%x fl=%x of=0 --> %08lx",
@@ -1171,19 +1146,17 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
                if (prot & PROT_WRITE && excess1 > 0) {
                        kdebug("clear[%d] ad=%lx sz=%lx",
                               loop, maddr + phdr->p_filesz, excess1);
-                       ret = clear_user((void __user *) maddr + phdr->p_filesz,
-                                        excess1);
-                       if (ret)
-                               return ret;
+                       if (clear_user((void __user *) maddr + phdr->p_filesz,
+                                      excess1))
+                               return -EFAULT;
                }
 
 #else
                if (excess > 0) {
                        kdebug("clear[%d] ad=%lx sz=%lx",
                               loop, maddr + phdr->p_filesz, excess);
-                       ret = clear_user((void *) maddr + phdr->p_filesz, excess);
-                       if (ret)
-                               return ret;
+                       if (clear_user((void *) maddr + phdr->p_filesz, excess))
+                               return -EFAULT;
                }
 #endif
 
@@ -1228,7 +1201,7 @@ static int maydump(struct vm_area_struct *vma, unsigned long mm_flags)
        int dump_ok;
 
        /* Do not dump I/O mapped devices or special mappings */
-       if (vma->vm_flags & (VM_IO | VM_RESERVED)) {
+       if (vma->vm_flags & VM_IO) {
                kdcore("%08lx: %08lx: no (IO)", vma->vm_start, vma->vm_flags);
                return 0;
        }
@@ -1243,7 +1216,7 @@ static int maydump(struct vm_area_struct *vma, unsigned long mm_flags)
 
        /* By default, dump shared memory if mapped from an anonymous file. */
        if (vma->vm_flags & VM_SHARED) {
-               if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0) {
+               if (file_inode(vma->vm_file)->i_nlink == 0) {
                        dump_ok = test_bit(MMF_DUMP_ANON_SHARED, &mm_flags);
                        kdcore("%08lx: %08lx: %s (share)", vma->vm_start,
                               vma->vm_flags, dump_ok ? "yes" : "no");
@@ -1374,7 +1347,7 @@ static inline void fill_note(struct memelfnote *note, const char *name, int type
 
 /*
  * fill up all the fields in prstatus from the given task struct, except
- * registers which need to be filled up seperately.
+ * registers which need to be filled up separately.
  */
 static void fill_prstatus(struct elf_prstatus *prstatus,
                          struct task_struct *p, long signr)
@@ -1399,8 +1372,11 @@ static void fill_prstatus(struct elf_prstatus *prstatus,
                cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
                cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
        } else {
-               cputime_to_timeval(p->utime, &prstatus->pr_utime);
-               cputime_to_timeval(p->stime, &prstatus->pr_stime);
+               cputime_t utime, stime;
+
+               task_cputime(p, &utime, &stime);
+               cputime_to_timeval(utime, &prstatus->pr_utime);
+               cputime_to_timeval(stime, &prstatus->pr_stime);
        }
        cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
        cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
@@ -1444,8 +1420,8 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
        psinfo->pr_flag = p->flags;
        rcu_read_lock();
        cred = __task_cred(p);
-       SET_UID(psinfo->pr_uid, cred->uid);
-       SET_GID(psinfo->pr_gid, cred->gid);
+       SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
+       SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
        rcu_read_unlock();
        strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
 
@@ -1505,6 +1481,22 @@ static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
        return sz;
 }
 
+static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+                            elf_addr_t e_shoff, int segs)
+{
+       elf->e_shoff = e_shoff;
+       elf->e_shentsize = sizeof(*shdr4extnum);
+       elf->e_shnum = 1;
+       elf->e_shstrndx = SHN_UNDEF;
+
+       memset(shdr4extnum, 0, sizeof(*shdr4extnum));
+
+       shdr4extnum->sh_type = SHT_NULL;
+       shdr4extnum->sh_size = elf->e_shnum;
+       shdr4extnum->sh_link = elf->e_shstrndx;
+       shdr4extnum->sh_info = segs;
+}
+
 /*
  * dump the segments for an MMU process
  */
@@ -1569,6 +1561,17 @@ static int elf_fdpic_dump_segments(struct file *file, size_t *size,
 }
 #endif
 
+static size_t elf_core_vma_data_size(unsigned long mm_flags)
+{
+       struct vm_area_struct *vma;
+       size_t size = 0;
+
+       for (vma = current->mm->mmap; vma; vma = vma->vm_next)
+               if (maydump(vma, mm_flags))
+                       size += vma->vm_end - vma->vm_start;
+       return size;
+}
+
 /*
  * Actual dumper
  *
@@ -1599,7 +1602,10 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
 #endif
        int thread_status_size = 0;
        elf_addr_t *auxv;
-       unsigned long mm_flags;
+       struct elf_phdr *phdr4note = NULL;
+       struct elf_shdr *shdr4extnum = NULL;
+       Elf_Half e_phnum;
+       elf_addr_t e_shoff;
 
        /*
         * We no longer stop all VM operations.
@@ -1635,7 +1641,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                goto cleanup;
 #endif
 
-       if (cprm->signr) {
+       if (cprm->siginfo->si_signo) {
                struct core_thread *ct;
                struct elf_thread_status *tmp;
 
@@ -1654,24 +1660,30 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                        int sz;
 
                        tmp = list_entry(t, struct elf_thread_status, list);
-                       sz = elf_dump_thread_status(cprm->signr, tmp);
+                       sz = elf_dump_thread_status(cprm->siginfo->si_signo, tmp);
                        thread_status_size += sz;
                }
        }
 
        /* now collect the dump for the current */
-       fill_prstatus(prstatus, current, cprm->signr);
+       fill_prstatus(prstatus, current, cprm->siginfo->si_signo);
        elf_core_copy_regs(&prstatus->pr_reg, cprm->regs);
 
        segs = current->mm->map_count;
        segs += elf_core_extra_phdrs();
 
+       /* for notes section */
+       segs++;
+
+       /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
+        * this, kernel supports extended numbering. Have a look at
+        * include/linux/elf.h for further information. */
+       e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
+
        /* Set up header */
-       fill_elf_fdpic_header(elf, segs + 1);   /* including notes section */
+       fill_elf_fdpic_header(elf, e_phnum);
 
        has_dumped = 1;
-       current->flags |= PF_DUMPCORE;
-
        /*
         * Set up the notes in similar form to SVR4 core dumps made
         * with info from their /proc.
@@ -1706,18 +1718,12 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
        fs = get_fs();
        set_fs(KERNEL_DS);
 
-       size += sizeof(*elf);
-       if (size > cprm->limit
-           || !dump_write(cprm->file, elf, sizeof(*elf)))
-               goto end_coredump;
-
        offset += sizeof(*elf);                         /* Elf header */
-       offset += (segs+1) * sizeof(struct elf_phdr);   /* Program headers */
+       offset += segs * sizeof(struct elf_phdr);       /* Program headers */
        foffset = offset;
 
        /* Write notes phdr entry */
        {
-               struct elf_phdr phdr;
                int sz = 0;
 
                for (i = 0; i < numnote; i++)
@@ -1725,24 +1731,38 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
 
                sz += thread_status_size;
 
-               fill_elf_note_phdr(&phdr, sz, offset);
-               offset += sz;
-
-               size += sizeof(phdr);
-               if (size > cprm->limit
-                   || !dump_write(cprm->file, &phdr, sizeof(phdr)))
+               phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
+               if (!phdr4note)
                        goto end_coredump;
+
+               fill_elf_note_phdr(phdr4note, sz, offset);
+               offset += sz;
        }
 
        /* Page-align dumped data */
        dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
 
-       /*
-        * We must use the same mm->flags while dumping core to avoid
-        * inconsistency between the program headers and bodies, otherwise an
-        * unusable core file can be generated.
-        */
-       mm_flags = current->mm->flags;
+       offset += elf_core_vma_data_size(cprm->mm_flags);
+       offset += elf_core_extra_data_size();
+       e_shoff = offset;
+
+       if (e_phnum == PN_XNUM) {
+               shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
+               if (!shdr4extnum)
+                       goto end_coredump;
+               fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
+       }
+
+       offset = dataoff;
+
+       size += sizeof(*elf);
+       if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
+               goto end_coredump;
+
+       size += sizeof(*phdr4note);
+       if (size > cprm->limit
+           || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
+               goto end_coredump;
 
        /* write program headers for segments dump */
        for (vma = current->mm->mmap; vma; vma = vma->vm_next) {
@@ -1755,7 +1775,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                phdr.p_offset = offset;
                phdr.p_vaddr = vma->vm_start;
                phdr.p_paddr = 0;
-               phdr.p_filesz = maydump(vma, mm_flags) ? sz : 0;
+               phdr.p_filesz = maydump(vma, cprm->mm_flags) ? sz : 0;
                phdr.p_memsz = sz;
                offset += phdr.p_filesz;
                phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
@@ -1793,12 +1813,20 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                goto end_coredump;
 
        if (elf_fdpic_dump_segments(cprm->file, &size, &cprm->limit,
-                                   mm_flags) < 0)
+                                   cprm->mm_flags) < 0)
                goto end_coredump;
 
        if (!elf_core_write_extra_data(cprm->file, &size, cprm->limit))
                goto end_coredump;
 
+       if (e_phnum == PN_XNUM) {
+               size += sizeof(*shdr4extnum);
+               if (size > cprm->limit
+                   || !dump_write(cprm->file, shdr4extnum,
+                                  sizeof(*shdr4extnum)))
+                       goto end_coredump;
+       }
+
        if (cprm->file->f_pos != offset) {
                /* Sanity check */
                printk(KERN_WARNING
@@ -1815,12 +1843,13 @@ cleanup:
                list_del(tmp);
                kfree(list_entry(tmp, struct elf_thread_status, list));
        }
-
+       kfree(phdr4note);
        kfree(elf);
        kfree(prstatus);
        kfree(psinfo);
        kfree(notes);
        kfree(fpu);
+       kfree(shdr4extnum);
 #ifdef ELF_CORE_COPY_XFPREGS
        kfree(xfpu);
 #endif