exec.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  linux/fs/exec.c
   4 *
   5 *  Copyright (C) 1991, 1992  Linus Torvalds
   6 */
   7
   8/*
   9 * #!-checking implemented by tytso.
  10 */
  11/*
  12 * Demand-loading implemented 01.12.91 - no need to read anything but
  13 * the header into memory. The inode of the executable is put into
  14 * "current->executable", and page faults do the actual loading. Clean.
  15 *
  16 * Once more I can proudly say that linux stood up to being changed: it
  17 * was less than 2 hours work to get demand-loading completely implemented.
  18 *
  19 * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
  20 * current->executable is only used by the procfs.  This allows a dispatch
  21 * table to check for several different types  of binary formats.  We keep
  22 * trying until we recognize the file or we run out of supported binary
  23 * formats.
  24 */
  25
  26#include <linux/kernel_read_file.h>
  27#include <linux/slab.h>
  28#include <linux/file.h>
  29#include <linux/fdtable.h>
  30#include <linux/mm.h>
  31#include <linux/stat.h>
  32#include <linux/fcntl.h>
  33#include <linux/swap.h>
  34#include <linux/string.h>
  35#include <linux/init.h>
  36#include <linux/sched/mm.h>
  37#include <linux/sched/coredump.h>
  38#include <linux/sched/signal.h>
  39#include <linux/sched/numa_balancing.h>
  40#include <linux/sched/task.h>
  41#include <linux/pagemap.h>
  42#include <linux/perf_event.h>
  43#include <linux/highmem.h>
  44#include <linux/spinlock.h>
  45#include <linux/key.h>
  46#include <linux/personality.h>
  47#include <linux/binfmts.h>
  48#include <linux/utsname.h>
  49#include <linux/pid_namespace.h>
  50#include <linux/module.h>
  51#include <linux/namei.h>
  52#include <linux/mount.h>
  53#include <linux/security.h>
  54#include <linux/syscalls.h>
  55#include <linux/tsacct_kern.h>
  56#include <linux/cn_proc.h>
  57#include <linux/audit.h>
  58#include <linux/kmod.h>
  59#include <linux/fsnotify.h>
  60#include <linux/fs_struct.h>
  61#include <linux/oom.h>
  62#include <linux/compat.h>
  63#include <linux/vmalloc.h>
  64#include <linux/io_uring.h>
  65#include <linux/syscall_user_dispatch.h>
  66#include <linux/coredump.h>
  67#include <linux/time_namespace.h>
  68#include <linux/user_events.h>
  69#include <linux/rseq.h>
  70#include <linux/ksm.h>
  71
  72#include <linux/uaccess.h>
  73#include <asm/mmu_context.h>
  74#include <asm/tlb.h>
  75
  76#include <trace/events/task.h>
  77#include "internal.h"
  78
  79#include <trace/events/sched.h>
  80
  81/* For vma exec functions. */
  82#include "../mm/internal.h"
  83
  84static int bprm_creds_from_file(struct linux_binprm *bprm);
  85
  86int suid_dumpable = 0;
  87
  88static LIST_HEAD(formats);
  89static DEFINE_RWLOCK(binfmt_lock);
  90
  91void __register_binfmt(struct linux_binfmt * fmt, int insert)
  92{
  93	write_lock(&binfmt_lock);
  94	insert ? list_add(&fmt->lh, &formats) :
  95		 list_add_tail(&fmt->lh, &formats);
  96	write_unlock(&binfmt_lock);
  97}
  98
  99EXPORT_SYMBOL(__register_binfmt);
 100
 101void unregister_binfmt(struct linux_binfmt * fmt)
 102{
 103	write_lock(&binfmt_lock);
 104	list_del(&fmt->lh);
 105	write_unlock(&binfmt_lock);
 106}
 107
 108EXPORT_SYMBOL(unregister_binfmt);
 109
 110static inline void put_binfmt(struct linux_binfmt * fmt)
 111{
 112	module_put(fmt->module);
 113}
 114
 115bool path_noexec(const struct path *path)
 116{
 117	/* If it's an anonymous inode make sure that we catch any shenanigans. */
 118	VFS_WARN_ON_ONCE(IS_ANON_FILE(d_inode(path->dentry)) &&
 119			 !(path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC));
 120	return (path->mnt->mnt_flags & MNT_NOEXEC) ||
 121	       (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC);
 122}
 123
 124#ifdef CONFIG_MMU
 125/*
 126 * The nascent bprm->mm is not visible until exec_mmap() but it can
 127 * use a lot of memory, account these pages in current->mm temporary
 128 * for oom_badness()->get_mm_rss(). Once exec succeeds or fails, we
 129 * change the counter back via acct_arg_size(0).
 130 */
 131static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
 132{
 133	struct mm_struct *mm = current->mm;
 134	long diff = (long)(pages - bprm->vma_pages);
 135
 136	if (!mm || !diff)
 137		return;
 138
 139	bprm->vma_pages = pages;
 140	add_mm_counter(mm, MM_ANONPAGES, diff);
 141}
 142
 143static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
 144		int write)
 145{
 146	struct page *page;
 147	struct vm_area_struct *vma = bprm->vma;
 148	struct mm_struct *mm = bprm->mm;
 149	int ret;
 150
 151	/*
 152	 * Avoid relying on expanding the stack down in GUP (which
 153	 * does not work for STACK_GROWSUP anyway), and just do it
 154	 * ahead of time.
 155	 */
 156	if (!mmap_read_lock_maybe_expand(mm, vma, pos, write))
 157		return NULL;
 158
 159	/*
 160	 * We are doing an exec().  'current' is the process
 161	 * doing the exec and 'mm' is the new process's mm.
 162	 */
 163	ret = get_user_pages_remote(mm, pos, 1,
 164			write ? FOLL_WRITE : 0,
 165			&page, NULL);
 166	mmap_read_unlock(mm);
 167	if (ret <= 0)
 168		return NULL;
 169
 170	if (write)
 171		acct_arg_size(bprm, vma_pages(vma));
 172
 173	return page;
 174}
 175
 176static void put_arg_page(struct page *page)
 177{
 178	put_page(page);
 179}
 180
 181static void free_arg_pages(struct linux_binprm *bprm)
 182{
 183}
 184
 185static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
 186		struct page *page)
 187{
 188	flush_cache_page(bprm->vma, pos, page_to_pfn(page));
 189}
 190
 191static bool valid_arg_len(struct linux_binprm *bprm, long len)
 192{
 193	return len <= MAX_ARG_STRLEN;
 194}
 195
 196#else
 197
 198static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
 199{
 200}
 201
 202static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
 203		int write)
 204{
 205	struct page *page;
 206
 207	page = bprm->page[pos / PAGE_SIZE];
 208	if (!page && write) {
 209		page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
 210		if (!page)
 211			return NULL;
 212		bprm->page[pos / PAGE_SIZE] = page;
 213	}
 214
 215	return page;
 216}
 217
 218static void put_arg_page(struct page *page)
 219{
 220}
 221
 222static void free_arg_page(struct linux_binprm *bprm, int i)
 223{
 224	if (bprm->page[i]) {
 225		__free_page(bprm->page[i]);
 226		bprm->page[i] = NULL;
 227	}
 228}
 229
 230static void free_arg_pages(struct linux_binprm *bprm)
 231{
 232	int i;
 233
 234	for (i = 0; i < MAX_ARG_PAGES; i++)
 235		free_arg_page(bprm, i);
 236}
 237
 238static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
 239		struct page *page)
 240{
 241}
 242
 243static bool valid_arg_len(struct linux_binprm *bprm, long len)
 244{
 245	return len <= bprm->p;
 246}
 247
 248#endif /* CONFIG_MMU */
 249
 250/*
 251 * Create a new mm_struct and populate it with a temporary stack
 252 * vm_area_struct.  We don't have enough context at this point to set the stack
 253 * flags, permissions, and offset, so we use temporary values.  We'll update
 254 * them later in setup_arg_pages().
 255 */
 256static int bprm_mm_init(struct linux_binprm *bprm)
 257{
 258	int err;
 259	struct mm_struct *mm = NULL;
 260
 261	bprm->mm = mm = mm_alloc();
 262	err = -ENOMEM;
 263	if (!mm)
 264		goto err;
 265
 266	/* Save current stack limit for all calculations made during exec. */
 267	task_lock(current->group_leader);
 268	bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];
 269	task_unlock(current->group_leader);
 270
 271#ifndef CONFIG_MMU
 272	bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
 273#else
 274	err = create_init_stack_vma(bprm->mm, &bprm->vma, &bprm->p);
 275	if (err)
 276		goto err;
 277#endif
 278
 279	return 0;
 280
 281err:
 282	if (mm) {
 283		bprm->mm = NULL;
 284		mmdrop(mm);
 285	}
 286
 287	return err;
 288}
 289
 290struct user_arg_ptr {
 291#ifdef CONFIG_COMPAT
 292	bool is_compat;
 293#endif
 294	union {
 295		const char __user *const __user *native;
 296#ifdef CONFIG_COMPAT
 297		const compat_uptr_t __user *compat;
 298#endif
 299	} ptr;
 300};
 301
 302static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
 303{
 304	const char __user *native;
 305
 306#ifdef CONFIG_COMPAT
 307	if (unlikely(argv.is_compat)) {
 308		compat_uptr_t compat;
 309
 310		if (get_user(compat, argv.ptr.compat + nr))
 311			return ERR_PTR(-EFAULT);
 312
 313		return compat_ptr(compat);
 314	}
 315#endif
 316
 317	if (get_user(native, argv.ptr.native + nr))
 318		return ERR_PTR(-EFAULT);
 319
 320	return native;
 321}
 322
 323/*
 324 * count() counts the number of strings in array ARGV.
 325 */
 326static int count(struct user_arg_ptr argv, int max)
 327{
 328	int i = 0;
 329
 330	if (argv.ptr.native != NULL) {
 331		for (;;) {
 332			const char __user *p = get_user_arg_ptr(argv, i);
 333
 334			if (!p)
 335				break;
 336
 337			if (IS_ERR(p))
 338				return -EFAULT;
 339
 340			if (i >= max)
 341				return -E2BIG;
 342			++i;
 343
 344			if (fatal_signal_pending(current))
 345				return -ERESTARTNOHAND;
 346			cond_resched();
 347		}
 348	}
 349	return i;
 350}
 351
 352static int count_strings_kernel(const char *const *argv)
 353{
 354	int i;
 355
 356	if (!argv)
 357		return 0;
 358
 359	for (i = 0; argv[i]; ++i) {
 360		if (i >= MAX_ARG_STRINGS)
 361			return -E2BIG;
 362		if (fatal_signal_pending(current))
 363			return -ERESTARTNOHAND;
 364		cond_resched();
 365	}
 366	return i;
 367}
 368
 369static inline int bprm_set_stack_limit(struct linux_binprm *bprm,
 370				       unsigned long limit)
 371{
 372#ifdef CONFIG_MMU
 373	/* Avoid a pathological bprm->p. */
 374	if (bprm->p < limit)
 375		return -E2BIG;
 376	bprm->argmin = bprm->p - limit;
 377#endif
 378	return 0;
 379}
 380static inline bool bprm_hit_stack_limit(struct linux_binprm *bprm)
 381{
 382#ifdef CONFIG_MMU
 383	return bprm->p < bprm->argmin;
 384#else
 385	return false;
 386#endif
 387}
 388
 389/*
 390 * Calculate bprm->argmin from:
 391 * - _STK_LIM
 392 * - ARG_MAX
 393 * - bprm->rlim_stack.rlim_cur
 394 * - bprm->argc
 395 * - bprm->envc
 396 * - bprm->p
 397 */
 398static int bprm_stack_limits(struct linux_binprm *bprm)
 399{
 400	unsigned long limit, ptr_size;
 401
 402	/*
 403	 * Limit to 1/4 of the max stack size or 3/4 of _STK_LIM
 404	 * (whichever is smaller) for the argv+env strings.
 405	 * This ensures that:
 406	 *  - the remaining binfmt code will not run out of stack space,
 407	 *  - the program will have a reasonable amount of stack left
 408	 *    to work from.
 409	 */
 410	limit = _STK_LIM / 4 * 3;
 411	limit = min(limit, bprm->rlim_stack.rlim_cur / 4);
 412	/*
 413	 * We've historically supported up to 32 pages (ARG_MAX)
 414	 * of argument strings even with small stacks
 415	 */
 416	limit = max_t(unsigned long, limit, ARG_MAX);
 417	/* Reject totally pathological counts. */
 418	if (bprm->argc < 0 || bprm->envc < 0)
 419		return -E2BIG;
 420	/*
 421	 * We must account for the size of all the argv and envp pointers to
 422	 * the argv and envp strings, since they will also take up space in
 423	 * the stack. They aren't stored until much later when we can't
 424	 * signal to the parent that the child has run out of stack space.
 425	 * Instead, calculate it here so it's possible to fail gracefully.
 426	 *
 427	 * In the case of argc = 0, make sure there is space for adding a
 428	 * empty string (which will bump argc to 1), to ensure confused
 429	 * userspace programs don't start processing from argv[1], thinking
 430	 * argc can never be 0, to keep them from walking envp by accident.
 431	 * See do_execveat_common().
 432	 */
 433	if (check_add_overflow(max(bprm->argc, 1), bprm->envc, &ptr_size) ||
 434	    check_mul_overflow(ptr_size, sizeof(void *), &ptr_size))
 435		return -E2BIG;
 436	if (limit <= ptr_size)
 437		return -E2BIG;
 438	limit -= ptr_size;
 439
 440	return bprm_set_stack_limit(bprm, limit);
 441}
 442
 443/*
 444 * 'copy_strings()' copies argument/environment strings from the old
 445 * processes's memory to the new process's stack.  The call to get_user_pages()
 446 * ensures the destination page is created and not swapped out.
 447 */
 448static int copy_strings(int argc, struct user_arg_ptr argv,
 449			struct linux_binprm *bprm)
 450{
 451	struct page *kmapped_page = NULL;
 452	char *kaddr = NULL;
 453	unsigned long kpos = 0;
 454	int ret;
 455
 456	while (argc-- > 0) {
 457		const char __user *str;
 458		int len;
 459		unsigned long pos;
 460
 461		ret = -EFAULT;
 462		str = get_user_arg_ptr(argv, argc);
 463		if (IS_ERR(str))
 464			goto out;
 465
 466		len = strnlen_user(str, MAX_ARG_STRLEN);
 467		if (!len)
 468			goto out;
 469
 470		ret = -E2BIG;
 471		if (!valid_arg_len(bprm, len))
 472			goto out;
 473
 474		/* We're going to work our way backwards. */
 475		pos = bprm->p;
 476		str += len;
 477		bprm->p -= len;
 478		if (bprm_hit_stack_limit(bprm))
 479			goto out;
 480
 481		while (len > 0) {
 482			int offset, bytes_to_copy;
 483
 484			if (fatal_signal_pending(current)) {
 485				ret = -ERESTARTNOHAND;
 486				goto out;
 487			}
 488			cond_resched();
 489
 490			offset = pos % PAGE_SIZE;
 491			if (offset == 0)
 492				offset = PAGE_SIZE;
 493
 494			bytes_to_copy = offset;
 495			if (bytes_to_copy > len)
 496				bytes_to_copy = len;
 497
 498			offset -= bytes_to_copy;
 499			pos -= bytes_to_copy;
 500			str -= bytes_to_copy;
 501			len -= bytes_to_copy;
 502
 503			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
 504				struct page *page;
 505
 506				page = get_arg_page(bprm, pos, 1);
 507				if (!page) {
 508					ret = -E2BIG;
 509					goto out;
 510				}
 511
 512				if (kmapped_page) {
 513					flush_dcache_page(kmapped_page);
 514					kunmap_local(kaddr);
 515					put_arg_page(kmapped_page);
 516				}
 517				kmapped_page = page;
 518				kaddr = kmap_local_page(kmapped_page);
 519				kpos = pos & PAGE_MASK;
 520				flush_arg_page(bprm, kpos, kmapped_page);
 521			}
 522			if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
 523				ret = -EFAULT;
 524				goto out;
 525			}
 526		}
 527	}
 528	ret = 0;
 529out:
 530	if (kmapped_page) {
 531		flush_dcache_page(kmapped_page);
 532		kunmap_local(kaddr);
 533		put_arg_page(kmapped_page);
 534	}
 535	return ret;
 536}
 537
 538/*
 539 * Copy and argument/environment string from the kernel to the processes stack.
 540 */
 541int copy_string_kernel(const char *arg, struct linux_binprm *bprm)
 542{
 543	int len = strnlen(arg, MAX_ARG_STRLEN) + 1 /* terminating NUL */;
 544	unsigned long pos = bprm->p;
 545
 546	if (len == 0)
 547		return -EFAULT;
 548	if (!valid_arg_len(bprm, len))
 549		return -E2BIG;
 550
 551	/* We're going to work our way backwards. */
 552	arg += len;
 553	bprm->p -= len;
 554	if (bprm_hit_stack_limit(bprm))
 555		return -E2BIG;
 556
 557	while (len > 0) {
 558		unsigned int bytes_to_copy = min_t(unsigned int, len,
 559				min_not_zero(offset_in_page(pos), PAGE_SIZE));
 560		struct page *page;
 561
 562		pos -= bytes_to_copy;
 563		arg -= bytes_to_copy;
 564		len -= bytes_to_copy;
 565
 566		page = get_arg_page(bprm, pos, 1);
 567		if (!page)
 568			return -E2BIG;
 569		flush_arg_page(bprm, pos & PAGE_MASK, page);
 570		memcpy_to_page(page, offset_in_page(pos), arg, bytes_to_copy);
 571		put_arg_page(page);
 572	}
 573
 574	return 0;
 575}
 576EXPORT_SYMBOL(copy_string_kernel);
 577
 578static int copy_strings_kernel(int argc, const char *const *argv,
 579			       struct linux_binprm *bprm)
 580{
 581	while (argc-- > 0) {
 582		int ret = copy_string_kernel(argv[argc], bprm);
 583		if (ret < 0)
 584			return ret;
 585		if (fatal_signal_pending(current))
 586			return -ERESTARTNOHAND;
 587		cond_resched();
 588	}
 589	return 0;
 590}
 591
 592#ifdef CONFIG_MMU
 593
 594/*
 595 * Finalizes the stack vm_area_struct. The flags and permissions are updated,
 596 * the stack is optionally relocated, and some extra space is added.
 597 */
 598int setup_arg_pages(struct linux_binprm *bprm,
 599		    unsigned long stack_top,
 600		    int executable_stack)
 601{
 602	int ret;
 603	unsigned long stack_shift;
 604	struct mm_struct *mm = current->mm;
 605	struct vm_area_struct *vma = bprm->vma;
 606	struct vm_area_struct *prev = NULL;
 607	vm_flags_t vm_flags;
 608	unsigned long stack_base;
 609	unsigned long stack_size;
 610	unsigned long stack_expand;
 611	unsigned long rlim_stack;
 612	struct mmu_gather tlb;
 613	struct vma_iterator vmi;
 614
 615#ifdef CONFIG_STACK_GROWSUP
 616	/* Limit stack size */
 617	stack_base = bprm->rlim_stack.rlim_max;
 618
 619	stack_base = calc_max_stack_size(stack_base);
 620
 621	/* Add space for stack randomization. */
 622	if (current->flags & PF_RANDOMIZE)
 623		stack_base += (STACK_RND_MASK << PAGE_SHIFT);
 624
 625	/* Make sure we didn't let the argument array grow too large. */
 626	if (vma->vm_end - vma->vm_start > stack_base)
 627		return -ENOMEM;
 628
 629	stack_base = PAGE_ALIGN(stack_top - stack_base);
 630
 631	stack_shift = vma->vm_start - stack_base;
 632	mm->arg_start = bprm->p - stack_shift;
 633	bprm->p = vma->vm_end - stack_shift;
 634#else
 635	stack_top = arch_align_stack(stack_top);
 636	stack_top = PAGE_ALIGN(stack_top);
 637
 638	if (unlikely(stack_top < mmap_min_addr) ||
 639	    unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
 640		return -ENOMEM;
 641
 642	stack_shift = vma->vm_end - stack_top;
 643
 644	bprm->p -= stack_shift;
 645	mm->arg_start = bprm->p;
 646#endif
 647
 648	bprm->exec -= stack_shift;
 649
 650	if (mmap_write_lock_killable(mm))
 651		return -EINTR;
 652
 653	vm_flags = VM_STACK_FLAGS;
 654
 655	/*
 656	 * Adjust stack execute permissions; explicitly enable for
 657	 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
 658	 * (arch default) otherwise.
 659	 */
 660	if (unlikely(executable_stack == EXSTACK_ENABLE_X))
 661		vm_flags |= VM_EXEC;
 662	else if (executable_stack == EXSTACK_DISABLE_X)
 663		vm_flags &= ~VM_EXEC;
 664	vm_flags |= mm->def_flags;
 665	vm_flags |= VM_STACK_INCOMPLETE_SETUP;
 666
 667	vma_iter_init(&vmi, mm, vma->vm_start);
 668
 669	tlb_gather_mmu(&tlb, mm);
 670	ret = mprotect_fixup(&vmi, &tlb, vma, &prev, vma->vm_start, vma->vm_end,
 671			vm_flags);
 672	tlb_finish_mmu(&tlb);
 673
 674	if (ret)
 675		goto out_unlock;
 676	BUG_ON(prev != vma);
 677
 678	if (unlikely(vm_flags & VM_EXEC)) {
 679		pr_warn_once("process '%pD4' started with executable stack\n",
 680			     bprm->file);
 681	}
 682
 683	/* Move stack pages down in memory. */
 684	if (stack_shift) {
 685		/*
 686		 * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX.  Once
 687		 * the binfmt code determines where the new stack should reside, we shift it to
 688		 * its final location.
 689		 */
 690		ret = relocate_vma_down(vma, stack_shift);
 691		if (ret)
 692			goto out_unlock;
 693	}
 694
 695	/* mprotect_fixup is overkill to remove the temporary stack flags */
 696	vm_flags_clear(vma, VM_STACK_INCOMPLETE_SETUP);
 697
 698	stack_expand = 131072UL; /* randomly 32*4k (or 2*64k) pages */
 699	stack_size = vma->vm_end - vma->vm_start;
 700	/*
 701	 * Align this down to a page boundary as expand_stack
 702	 * will align it up.
 703	 */
 704	rlim_stack = bprm->rlim_stack.rlim_cur & PAGE_MASK;
 705
 706	stack_expand = min(rlim_stack, stack_size + stack_expand);
 707
 708#ifdef CONFIG_STACK_GROWSUP
 709	stack_base = vma->vm_start + stack_expand;
 710#else
 711	stack_base = vma->vm_end - stack_expand;
 712#endif
 713	current->mm->start_stack = bprm->p;
 714	ret = expand_stack_locked(vma, stack_base);
 715	if (ret)
 716		ret = -EFAULT;
 717
 718out_unlock:
 719	mmap_write_unlock(mm);
 720	return ret;
 721}
 722EXPORT_SYMBOL(setup_arg_pages);
 723
 724#else
 725
 726/*
 727 * Transfer the program arguments and environment from the holding pages
 728 * onto the stack. The provided stack pointer is adjusted accordingly.
 729 */
 730int transfer_args_to_stack(struct linux_binprm *bprm,
 731			   unsigned long *sp_location)
 732{
 733	unsigned long index, stop, sp;
 734	int ret = 0;
 735
 736	stop = bprm->p >> PAGE_SHIFT;
 737	sp = *sp_location;
 738
 739	for (index = MAX_ARG_PAGES - 1; index >= stop; index--) {
 740		unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0;
 741		char *src = kmap_local_page(bprm->page[index]) + offset;
 742		sp -= PAGE_SIZE - offset;
 743		if (copy_to_user((void *) sp, src, PAGE_SIZE - offset) != 0)
 744			ret = -EFAULT;
 745		kunmap_local(src);
 746		if (ret)
 747			goto out;
 748	}
 749
 750	bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
 751	*sp_location = sp;
 752
 753out:
 754	return ret;
 755}
 756EXPORT_SYMBOL(transfer_args_to_stack);
 757
 758#endif /* CONFIG_MMU */
 759
 760/*
 761 * On success, caller must call do_close_execat() on the returned
 762 * struct file to close it.
 763 */
 764static struct file *do_open_execat(int fd, struct filename *name, int flags)
 765{
 766	int err;
 767	struct file *file __free(fput) = NULL;
 768	struct open_flags open_exec_flags = {
 769		.open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
 770		.acc_mode = MAY_EXEC,
 771		.intent = LOOKUP_OPEN,
 772		.lookup_flags = LOOKUP_FOLLOW,
 773	};
 774
 775	if ((flags &
 776	     ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH | AT_EXECVE_CHECK)) != 0)
 777		return ERR_PTR(-EINVAL);
 778	if (flags & AT_SYMLINK_NOFOLLOW)
 779		open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW;
 780	if (flags & AT_EMPTY_PATH)
 781		open_exec_flags.lookup_flags |= LOOKUP_EMPTY;
 782
 783	file = do_filp_open(fd, name, &open_exec_flags);
 784	if (IS_ERR(file))
 785		return file;
 786
 787	if (path_noexec(&file->f_path))
 788		return ERR_PTR(-EACCES);
 789
 790	/*
 791	 * In the past the regular type check was here. It moved to may_open() in
 792	 * 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is
 793	 * an invariant that all non-regular files error out before we get here.
 794	 */
 795	if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode)))
 796		return ERR_PTR(-EACCES);
 797
 798	err = exe_file_deny_write_access(file);
 799	if (err)
 800		return ERR_PTR(err);
 801
 802	return no_free_ptr(file);
 803}
 804
 805/**
 806 * open_exec - Open a path name for execution
 807 *
 808 * @name: path name to open with the intent of executing it.
 809 *
 810 * Returns ERR_PTR on failure or allocated struct file on success.
 811 *
 812 * As this is a wrapper for the internal do_open_execat(), callers
 813 * must call exe_file_allow_write_access() before fput() on release. Also see
 814 * do_close_execat().
 815 */
 816struct file *open_exec(const char *name)
 817{
 818	struct filename *filename = getname_kernel(name);
 819	struct file *f = ERR_CAST(filename);
 820
 821	if (!IS_ERR(filename)) {
 822		f = do_open_execat(AT_FDCWD, filename, 0);
 823		putname(filename);
 824	}
 825	return f;
 826}
 827EXPORT_SYMBOL(open_exec);
 828
 829#if defined(CONFIG_BINFMT_FLAT) || defined(CONFIG_BINFMT_ELF_FDPIC)
 830ssize_t read_code(struct file *file, unsigned long addr, loff_t pos, size_t len)
 831{
 832	ssize_t res = vfs_read(file, (void __user *)addr, len, &pos);
 833	if (res > 0)
 834		flush_icache_user_range(addr, addr + len);
 835	return res;
 836}
 837EXPORT_SYMBOL(read_code);
 838#endif
 839
 840/*
 841 * Maps the mm_struct mm into the current task struct.
 842 * On success, this function returns with exec_update_lock
 843 * held for writing.
 844 */
 845static int exec_mmap(struct mm_struct *mm)
 846{
 847	struct task_struct *tsk;
 848	struct mm_struct *old_mm, *active_mm;
 849	int ret;
 850
 851	/* Notify parent that we're no longer interested in the old VM */
 852	tsk = current;
 853	old_mm = current->mm;
 854	exec_mm_release(tsk, old_mm);
 855
 856	ret = down_write_killable(&tsk->signal->exec_update_lock);
 857	if (ret)
 858		return ret;
 859
 860	if (old_mm) {
 861		/*
 862		 * If there is a pending fatal signal perhaps a signal
 863		 * whose default action is to create a coredump get
 864		 * out and die instead of going through with the exec.
 865		 */
 866		ret = mmap_read_lock_killable(old_mm);
 867		if (ret) {
 868			up_write(&tsk->signal->exec_update_lock);
 869			return ret;
 870		}
 871	}
 872
 873	task_lock(tsk);
 874	membarrier_exec_mmap(mm);
 875
 876	local_irq_disable();
 877	active_mm = tsk->active_mm;
 878	tsk->active_mm = mm;
 879	tsk->mm = mm;
 880	mm_init_cid(mm, tsk);
 881	/*
 882	 * This prevents preemption while active_mm is being loaded and
 883	 * it and mm are being updated, which could cause problems for
 884	 * lazy tlb mm refcounting when these are updated by context
 885	 * switches. Not all architectures can handle irqs off over
 886	 * activate_mm yet.
 887	 */
 888	if (!IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
 889		local_irq_enable();
 890	activate_mm(active_mm, mm);
 891	if (IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
 892		local_irq_enable();
 893	lru_gen_add_mm(mm);
 894	task_unlock(tsk);
 895	lru_gen_use_mm(mm);
 896	if (old_mm) {
 897		mmap_read_unlock(old_mm);
 898		BUG_ON(active_mm != old_mm);
 899		setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm);
 900		mm_update_next_owner(old_mm);
 901		mmput(old_mm);
 902		return 0;
 903	}
 904	mmdrop_lazy_tlb(active_mm);
 905	return 0;
 906}
 907
 908static int de_thread(struct task_struct *tsk)
 909{
 910	struct signal_struct *sig = tsk->signal;
 911	struct sighand_struct *oldsighand = tsk->sighand;
 912	spinlock_t *lock = &oldsighand->siglock;
 913
 914	if (thread_group_empty(tsk))
 915		goto no_thread_group;
 916
 917	/*
 918	 * Kill all other threads in the thread group.
 919	 */
 920	spin_lock_irq(lock);
 921	if ((sig->flags & SIGNAL_GROUP_EXIT) || sig->group_exec_task) {
 922		/*
 923		 * Another group action in progress, just
 924		 * return so that the signal is processed.
 925		 */
 926		spin_unlock_irq(lock);
 927		return -EAGAIN;
 928	}
 929
 930	sig->group_exec_task = tsk;
 931	sig->notify_count = zap_other_threads(tsk);
 932	if (!thread_group_leader(tsk))
 933		sig->notify_count--;
 934
 935	while (sig->notify_count) {
 936		__set_current_state(TASK_KILLABLE);
 937		spin_unlock_irq(lock);
 938		schedule();
 939		if (__fatal_signal_pending(tsk))
 940			goto killed;
 941		spin_lock_irq(lock);
 942	}
 943	spin_unlock_irq(lock);
 944
 945	/*
 946	 * At this point all other threads have exited, all we have to
 947	 * do is to wait for the thread group leader to become inactive,
 948	 * and to assume its PID:
 949	 */
 950	if (!thread_group_leader(tsk)) {
 951		struct task_struct *leader = tsk->group_leader;
 952
 953		for (;;) {
 954			cgroup_threadgroup_change_begin(tsk);
 955			write_lock_irq(&tasklist_lock);
 956			/*
 957			 * Do this under tasklist_lock to ensure that
 958			 * exit_notify() can't miss ->group_exec_task
 959			 */
 960			sig->notify_count = -1;
 961			if (likely(leader->exit_state))
 962				break;
 963			__set_current_state(TASK_KILLABLE);
 964			write_unlock_irq(&tasklist_lock);
 965			cgroup_threadgroup_change_end(tsk);
 966			schedule();
 967			if (__fatal_signal_pending(tsk))
 968				goto killed;
 969		}
 970
 971		/*
 972		 * The only record we have of the real-time age of a
 973		 * process, regardless of execs it's done, is start_time.
 974		 * All the past CPU time is accumulated in signal_struct
 975		 * from sister threads now dead.  But in this non-leader
 976		 * exec, nothing survives from the original leader thread,
 977		 * whose birth marks the true age of this process now.
 978		 * When we take on its identity by switching to its PID, we
 979		 * also take its birthdate (always earlier than our own).
 980		 */
 981		tsk->start_time = leader->start_time;
 982		tsk->start_boottime = leader->start_boottime;
 983
 984		BUG_ON(!same_thread_group(leader, tsk));
 985		/*
 986		 * An exec() starts a new thread group with the
 987		 * TGID of the previous thread group. Rehash the
 988		 * two threads with a switched PID, and release
 989		 * the former thread group leader:
 990		 */
 991
 992		/* Become a process group leader with the old leader's pid.
 993		 * The old leader becomes a thread of the this thread group.
 994		 */
 995		exchange_tids(tsk, leader);
 996		transfer_pid(leader, tsk, PIDTYPE_TGID);
 997		transfer_pid(leader, tsk, PIDTYPE_PGID);
 998		transfer_pid(leader, tsk, PIDTYPE_SID);
 999
1000		list_replace_rcu(&leader->tasks, &tsk->tasks);
1001		list_replace_init(&leader->sibling, &tsk->sibling);
1002
1003		tsk->group_leader = tsk;
1004		leader->group_leader = tsk;
1005
1006		tsk->exit_signal = SIGCHLD;
1007		leader->exit_signal = -1;
1008
1009		BUG_ON(leader->exit_state != EXIT_ZOMBIE);
1010		leader->exit_state = EXIT_DEAD;
1011		/*
1012		 * We are going to release_task()->ptrace_unlink() silently,
1013		 * the tracer can sleep in do_wait(). EXIT_DEAD guarantees
1014		 * the tracer won't block again waiting for this thread.
1015		 */
1016		if (unlikely(leader->ptrace))
1017			__wake_up_parent(leader, leader->parent);
1018		write_unlock_irq(&tasklist_lock);
1019		cgroup_threadgroup_change_end(tsk);
1020
1021		release_task(leader);
1022	}
1023
1024	sig->group_exec_task = NULL;
1025	sig->notify_count = 0;
1026
1027no_thread_group:
1028	/* we have changed execution domain */
1029	tsk->exit_signal = SIGCHLD;
1030
1031	BUG_ON(!thread_group_leader(tsk));
1032	return 0;
1033
1034killed:
1035	/* protects against exit_notify() and __exit_signal() */
1036	read_lock(&tasklist_lock);
1037	sig->group_exec_task = NULL;
1038	sig->notify_count = 0;
1039	read_unlock(&tasklist_lock);
1040	return -EAGAIN;
1041}
1042
1043
1044/*
1045 * This function makes sure the current process has its own signal table,
1046 * so that flush_signal_handlers can later reset the handlers without
1047 * disturbing other processes.  (Other processes might share the signal
1048 * table via the CLONE_SIGHAND option to clone().)
1049 */
1050static int unshare_sighand(struct task_struct *me)
1051{
1052	struct sighand_struct *oldsighand = me->sighand;
1053
1054	if (refcount_read(&oldsighand->count) != 1) {
1055		struct sighand_struct *newsighand;
1056		/*
1057		 * This ->sighand is shared with the CLONE_SIGHAND
1058		 * but not CLONE_THREAD task, switch to the new one.
1059		 */
1060		newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
1061		if (!newsighand)
1062			return -ENOMEM;
1063
1064		refcount_set(&newsighand->count, 1);
1065
1066		write_lock_irq(&tasklist_lock);
1067		spin_lock(&oldsighand->siglock);
1068		memcpy(newsighand->action, oldsighand->action,
1069		       sizeof(newsighand->action));
1070		rcu_assign_pointer(me->sighand, newsighand);
1071		spin_unlock(&oldsighand->siglock);
1072		write_unlock_irq(&tasklist_lock);
1073
1074		__cleanup_sighand(oldsighand);
1075	}
1076	return 0;
1077}
1078
1079/*
1080 * This is unlocked -- the string will always be NUL-terminated, but
1081 * may show overlapping contents if racing concurrent reads.
1082 */
1083void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)
1084{
1085	size_t len = min(strlen(buf), sizeof(tsk->comm) - 1);
1086
1087	trace_task_rename(tsk, buf);
1088	memcpy(tsk->comm, buf, len);
1089	memset(&tsk->comm[len], 0, sizeof(tsk->comm) - len);
1090	perf_event_comm(tsk, exec);
1091}
1092
1093/*
1094 * Calling this is the point of no return. None of the failures will be
1095 * seen by userspace since either the process is already taking a fatal
1096 * signal (via de_thread() or coredump), or will have SEGV raised
1097 * (after exec_mmap()) by search_binary_handler (see below).
1098 */
1099int begin_new_exec(struct linux_binprm * bprm)
1100{
1101	struct task_struct *me = current;
1102	int retval;
1103
1104	/* Once we are committed compute the creds */
1105	retval = bprm_creds_from_file(bprm);
1106	if (retval)
1107		return retval;
1108
1109	/*
1110	 * This tracepoint marks the point before flushing the old exec where
1111	 * the current task is still unchanged, but errors are fatal (point of
1112	 * no return). The later "sched_process_exec" tracepoint is called after
1113	 * the current task has successfully switched to the new exec.
1114	 */
1115	trace_sched_prepare_exec(current, bprm);
1116
1117	/*
1118	 * Ensure all future errors are fatal.
1119	 */
1120	bprm->point_of_no_return = true;
1121
1122	/* Make this the only thread in the thread group */
1123	retval = de_thread(me);
1124	if (retval)
1125		goto out;
1126	/* see the comment in check_unsafe_exec() */
1127	current->fs->in_exec = 0;
1128	/*
1129	 * Cancel any io_uring activity across execve
1130	 */
1131	io_uring_task_cancel();
1132
1133	/* Ensure the files table is not shared. */
1134	retval = unshare_files();
1135	if (retval)
1136		goto out;
1137
1138	/*
1139	 * Must be called _before_ exec_mmap() as bprm->mm is
1140	 * not visible until then. Doing it here also ensures
1141	 * we don't race against replace_mm_exe_file().
1142	 */
1143	retval = set_mm_exe_file(bprm->mm, bprm->file);
1144	if (retval)
1145		goto out;
1146
1147	/* If the binary is not readable then enforce mm->dumpable=0 */
1148	would_dump(bprm, bprm->file);
1149	if (bprm->have_execfd)
1150		would_dump(bprm, bprm->executable);
1151
1152	/*
1153	 * Release all of the old mmap stuff
1154	 */
1155	acct_arg_size(bprm, 0);
1156	retval = exec_mmap(bprm->mm);
1157	if (retval)
1158		goto out;
1159
1160	bprm->mm = NULL;
1161
1162	retval = exec_task_namespaces();
1163	if (retval)
1164		goto out_unlock;
1165
1166#ifdef CONFIG_POSIX_TIMERS
1167	spin_lock_irq(&me->sighand->siglock);
1168	posix_cpu_timers_exit(me);
1169	spin_unlock_irq(&me->sighand->siglock);
1170	exit_itimers(me);
1171	flush_itimer_signals();
1172#endif
1173
1174	/*
1175	 * Make the signal table private.
1176	 */
1177	retval = unshare_sighand(me);
1178	if (retval)
1179		goto out_unlock;
1180
1181	me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC |
1182					PF_NOFREEZE | PF_NO_SETAFFINITY);
1183	flush_thread();
1184	me->personality &= ~bprm->per_clear;
1185
1186	clear_syscall_work_syscall_user_dispatch(me);
1187
1188	/*
1189	 * We have to apply CLOEXEC before we change whether the process is
1190	 * dumpable (in setup_new_exec) to avoid a race with a process in userspace
1191	 * trying to access the should-be-closed file descriptors of a process
1192	 * undergoing exec(2).
1193	 */
1194	do_close_on_exec(me->files);
1195
1196	if (bprm->secureexec) {
1197		/* Make sure parent cannot signal privileged process. */
1198		me->pdeath_signal = 0;
1199
1200		/*
1201		 * For secureexec, reset the stack limit to sane default to
1202		 * avoid bad behavior from the prior rlimits. This has to
1203		 * happen before arch_pick_mmap_layout(), which examines
1204		 * RLIMIT_STACK, but after the point of no return to avoid
1205		 * needing to clean up the change on failure.
1206		 */
1207		if (bprm->rlim_stack.rlim_cur > _STK_LIM)
1208			bprm->rlim_stack.rlim_cur = _STK_LIM;
1209	}
1210
1211	me->sas_ss_sp = me->sas_ss_size = 0;
1212
1213	/*
1214	 * Figure out dumpability. Note that this checking only of current
1215	 * is wrong, but userspace depends on it. This should be testing
1216	 * bprm->secureexec instead.
1217	 */
1218	if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||
1219	    !(uid_eq(current_euid(), current_uid()) &&
1220	      gid_eq(current_egid(), current_gid())))
1221		set_dumpable(current->mm, suid_dumpable);
1222	else
1223		set_dumpable(current->mm, SUID_DUMP_USER);
1224
1225	perf_event_exec();
1226
1227	/*
1228	 * If the original filename was empty, alloc_bprm() made up a path
1229	 * that will probably not be useful to admins running ps or similar.
1230	 * Let's fix it up to be something reasonable.
1231	 */
1232	if (bprm->comm_from_dentry) {
1233		/*
1234		 * Hold RCU lock to keep the name from being freed behind our back.
1235		 * Use acquire semantics to make sure the terminating NUL from
1236		 * __d_alloc() is seen.
1237		 *
1238		 * Note, we're deliberately sloppy here. We don't need to care about
1239		 * detecting a concurrent rename and just want a terminated name.
1240		 */
1241		rcu_read_lock();
1242		__set_task_comm(me, smp_load_acquire(&bprm->file->f_path.dentry->d_name.name),
1243				true);
1244		rcu_read_unlock();
1245	} else {
1246		__set_task_comm(me, kbasename(bprm->filename), true);
1247	}
1248
1249	/* An exec changes our domain. We are no longer part of the thread
1250	   group */
1251	WRITE_ONCE(me->self_exec_id, me->self_exec_id + 1);
1252	flush_signal_handlers(me, 0);
1253
1254	retval = set_cred_ucounts(bprm->cred);
1255	if (retval < 0)
1256		goto out_unlock;
1257
1258	/*
1259	 * install the new credentials for this executable
1260	 */
1261	security_bprm_committing_creds(bprm);
1262
1263	commit_creds(bprm->cred);
1264	bprm->cred = NULL;
1265
1266	/*
1267	 * Disable monitoring for regular users
1268	 * when executing setuid binaries. Must
1269	 * wait until new credentials are committed
1270	 * by commit_creds() above
1271	 */
1272	if (get_dumpable(me->mm) != SUID_DUMP_USER)
1273		perf_event_exit_task(me);
1274	/*
1275	 * cred_guard_mutex must be held at least to this point to prevent
1276	 * ptrace_attach() from altering our determination of the task's
1277	 * credentials; any time after this it may be unlocked.
1278	 */
1279	security_bprm_committed_creds(bprm);
1280
1281	/* Pass the opened binary to the interpreter. */
1282	if (bprm->have_execfd) {
1283		retval = FD_ADD(0, bprm->executable);
1284		if (retval < 0)
1285			goto out_unlock;
1286		bprm->executable = NULL;
1287		bprm->execfd = retval;
1288	}
1289	return 0;
1290
1291out_unlock:
1292	up_write(&me->signal->exec_update_lock);
1293	if (!bprm->cred)
1294		mutex_unlock(&me->signal->cred_guard_mutex);
1295
1296out:
1297	return retval;
1298}
1299EXPORT_SYMBOL(begin_new_exec);
1300
1301void would_dump(struct linux_binprm *bprm, struct file *file)
1302{
1303	struct inode *inode = file_inode(file);
1304	struct mnt_idmap *idmap = file_mnt_idmap(file);
1305	if (inode_permission(idmap, inode, MAY_READ) < 0) {
1306		struct user_namespace *old, *user_ns;
1307		bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
1308
1309		/* Ensure mm->user_ns contains the executable */
1310		user_ns = old = bprm->mm->user_ns;
1311		while ((user_ns != &init_user_ns) &&
1312		       !privileged_wrt_inode_uidgid(user_ns, idmap, inode))
1313			user_ns = user_ns->parent;
1314
1315		if (old != user_ns) {
1316			bprm->mm->user_ns = get_user_ns(user_ns);
1317			put_user_ns(old);
1318		}
1319	}
1320}
1321EXPORT_SYMBOL(would_dump);
1322
1323void setup_new_exec(struct linux_binprm * bprm)
1324{
1325	/* Setup things that can depend upon the personality */
1326	struct task_struct *me = current;
1327
1328	arch_pick_mmap_layout(me->mm, &bprm->rlim_stack);
1329
1330	arch_setup_new_exec();
1331
1332	/* Set the new mm task size. We have to do that late because it may
1333	 * depend on TIF_32BIT which is only updated in flush_thread() on
1334	 * some architectures like powerpc
1335	 */
1336	me->mm->task_size = TASK_SIZE;
1337	up_write(&me->signal->exec_update_lock);
1338	mutex_unlock(&me->signal->cred_guard_mutex);
1339}
1340EXPORT_SYMBOL(setup_new_exec);
1341
1342/* Runs immediately before start_thread() takes over. */
1343void finalize_exec(struct linux_binprm *bprm)
1344{
1345	/* Store any stack rlimit changes before starting thread. */
1346	task_lock(current->group_leader);
1347	current->signal->rlim[RLIMIT_STACK] = bprm->rlim_stack;
1348	task_unlock(current->group_leader);
1349}
1350EXPORT_SYMBOL(finalize_exec);
1351
1352/*
1353 * Prepare credentials and lock ->cred_guard_mutex.
1354 * setup_new_exec() commits the new creds and drops the lock.
1355 * Or, if exec fails before, free_bprm() should release ->cred
1356 * and unlock.
1357 */
1358static int prepare_bprm_creds(struct linux_binprm *bprm)
1359{
1360	if (mutex_lock_interruptible(&current->signal->cred_guard_mutex))
1361		return -ERESTARTNOINTR;
1362
1363	bprm->cred = prepare_exec_creds();
1364	if (likely(bprm->cred))
1365		return 0;
1366
1367	mutex_unlock(&current->signal->cred_guard_mutex);
1368	return -ENOMEM;
1369}
1370
1371/* Matches do_open_execat() */
1372static void do_close_execat(struct file *file)
1373{
1374	if (!file)
1375		return;
1376	exe_file_allow_write_access(file);
1377	fput(file);
1378}
1379
1380static void free_bprm(struct linux_binprm *bprm)
1381{
1382	if (bprm->mm) {
1383		acct_arg_size(bprm, 0);
1384		mmput(bprm->mm);
1385	}
1386	free_arg_pages(bprm);
1387	if (bprm->cred) {
1388		/* in case exec fails before de_thread() succeeds */
1389		current->fs->in_exec = 0;
1390		mutex_unlock(&current->signal->cred_guard_mutex);
1391		abort_creds(bprm->cred);
1392	}
1393	do_close_execat(bprm->file);
1394	if (bprm->executable)
1395		fput(bprm->executable);
1396	/* If a binfmt changed the interp, free it. */
1397	if (bprm->interp != bprm->filename)
1398		kfree(bprm->interp);
1399	kfree(bprm->fdpath);
1400	kfree(bprm);
1401}
1402
1403static struct linux_binprm *alloc_bprm(int fd, struct filename *filename, int flags)
1404{
1405	struct linux_binprm *bprm;
1406	struct file *file;
1407	int retval = -ENOMEM;
1408
1409	file = do_open_execat(fd, filename, flags);
1410	if (IS_ERR(file))
1411		return ERR_CAST(file);
1412
1413	bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
1414	if (!bprm) {
1415		do_close_execat(file);
1416		return ERR_PTR(-ENOMEM);
1417	}
1418
1419	bprm->file = file;
1420
1421	if (fd == AT_FDCWD || filename->name[0] == '/') {
1422		bprm->filename = filename->name;
1423	} else {
1424		if (filename->name[0] == '\0') {
1425			bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd);
1426			bprm->comm_from_dentry = 1;
1427		} else {
1428			bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s",
1429						  fd, filename->name);
1430		}
1431		if (!bprm->fdpath)
1432			goto out_free;
1433
1434		/*
1435		 * Record that a name derived from an O_CLOEXEC fd will be
1436		 * inaccessible after exec.  This allows the code in exec to
1437		 * choose to fail when the executable is not mmaped into the
1438		 * interpreter and an open file descriptor is not passed to
1439		 * the interpreter.  This makes for a better user experience
1440		 * than having the interpreter start and then immediately fail
1441		 * when it finds the executable is inaccessible.
1442		 */
1443		if (get_close_on_exec(fd))
1444			bprm->interp_flags |= BINPRM_FLAGS_PATH_INACCESSIBLE;
1445
1446		bprm->filename = bprm->fdpath;
1447	}
1448	bprm->interp = bprm->filename;
1449
1450	/*
1451	 * At this point, security_file_open() has already been called (with
1452	 * __FMODE_EXEC) and access control checks for AT_EXECVE_CHECK will
1453	 * stop just after the security_bprm_creds_for_exec() call in
1454	 * bprm_execve().  Indeed, the kernel should not try to parse the
1455	 * content of the file with exec_binprm() nor change the calling
1456	 * thread, which means that the following security functions will not
1457	 * be called:
1458	 * - security_bprm_check()
1459	 * - security_bprm_creds_from_file()
1460	 * - security_bprm_committing_creds()
1461	 * - security_bprm_committed_creds()
1462	 */
1463	bprm->is_check = !!(flags & AT_EXECVE_CHECK);
1464
1465	retval = bprm_mm_init(bprm);
1466	if (!retval)
1467		return bprm;
1468
1469out_free:
1470	free_bprm(bprm);
1471	return ERR_PTR(retval);
1472}
1473
1474int bprm_change_interp(const char *interp, struct linux_binprm *bprm)
1475{
1476	/* If a binfmt changed the interp, free it first. */
1477	if (bprm->interp != bprm->filename)
1478		kfree(bprm->interp);
1479	bprm->interp = kstrdup(interp, GFP_KERNEL);
1480	if (!bprm->interp)
1481		return -ENOMEM;
1482	return 0;
1483}
1484EXPORT_SYMBOL(bprm_change_interp);
1485
1486/*
1487 * determine how safe it is to execute the proposed program
1488 * - the caller must hold ->cred_guard_mutex to protect against
1489 *   PTRACE_ATTACH or seccomp thread-sync
1490 */
1491static void check_unsafe_exec(struct linux_binprm *bprm)
1492{
1493	struct task_struct *p = current, *t;
1494	unsigned n_fs;
1495
1496	if (p->ptrace)
1497		bprm->unsafe |= LSM_UNSAFE_PTRACE;
1498
1499	/*
1500	 * This isn't strictly necessary, but it makes it harder for LSMs to
1501	 * mess up.
1502	 */
1503	if (task_no_new_privs(current))
1504		bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;
1505
1506	/*
1507	 * If another task is sharing our fs, we cannot safely
1508	 * suid exec because the differently privileged task
1509	 * will be able to manipulate the current directory, etc.
1510	 * It would be nice to force an unshare instead...
1511	 *
1512	 * Otherwise we set fs->in_exec = 1 to deny clone(CLONE_FS)
1513	 * from another sub-thread until de_thread() succeeds, this
1514	 * state is protected by cred_guard_mutex we hold.
1515	 */
1516	n_fs = 1;
1517	read_seqlock_excl(&p->fs->seq);
1518	rcu_read_lock();
1519	for_other_threads(p, t) {
1520		if (t->fs == p->fs)
1521			n_fs++;
1522	}
1523	rcu_read_unlock();
1524
1525	/* "users" and "in_exec" locked for copy_fs() */
1526	if (p->fs->users > n_fs)
1527		bprm->unsafe |= LSM_UNSAFE_SHARE;
1528	else
1529		p->fs->in_exec = 1;
1530	read_sequnlock_excl(&p->fs->seq);
1531}
1532
1533static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file)
1534{
1535	/* Handle suid and sgid on files */
1536	struct mnt_idmap *idmap;
1537	struct inode *inode = file_inode(file);
1538	unsigned int mode;
1539	vfsuid_t vfsuid;
1540	vfsgid_t vfsgid;
1541	int err;
1542
1543	if (!mnt_may_suid(file->f_path.mnt))
1544		return;
1545
1546	if (task_no_new_privs(current))
1547		return;
1548
1549	mode = READ_ONCE(inode->i_mode);
1550	if (!(mode & (S_ISUID|S_ISGID)))
1551		return;
1552
1553	idmap = file_mnt_idmap(file);
1554
1555	/* Be careful if suid/sgid is set */
1556	inode_lock(inode);
1557
1558	/* Atomically reload and check mode/uid/gid now that lock held. */
1559	mode = inode->i_mode;
1560	vfsuid = i_uid_into_vfsuid(idmap, inode);
1561	vfsgid = i_gid_into_vfsgid(idmap, inode);
1562	err = inode_permission(idmap, inode, MAY_EXEC);
1563	inode_unlock(inode);
1564
1565	/* Did the exec bit vanish out from under us? Give up. */
1566	if (err)
1567		return;
1568
1569	/* We ignore suid/sgid if there are no mappings for them in the ns */
1570	if (!vfsuid_has_mapping(bprm->cred->user_ns, vfsuid) ||
1571	    !vfsgid_has_mapping(bprm->cred->user_ns, vfsgid))
1572		return;
1573
1574	if (mode & S_ISUID) {
1575		bprm->per_clear |= PER_CLEAR_ON_SETID;
1576		bprm->cred->euid = vfsuid_into_kuid(vfsuid);
1577	}
1578
1579	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
1580		bprm->per_clear |= PER_CLEAR_ON_SETID;
1581		bprm->cred->egid = vfsgid_into_kgid(vfsgid);
1582	}
1583}
1584
1585/*
1586 * Compute brpm->cred based upon the final binary.
1587 */
1588static int bprm_creds_from_file(struct linux_binprm *bprm)
1589{
1590	/* Compute creds based on which file? */
1591	struct file *file = bprm->execfd_creds ? bprm->executable : bprm->file;
1592
1593	bprm_fill_uid(bprm, file);
1594	return security_bprm_creds_from_file(bprm, file);
1595}
1596
1597/*
1598 * Fill the binprm structure from the inode.
1599 * Read the first BINPRM_BUF_SIZE bytes
1600 *
1601 * This may be called multiple times for binary chains (scripts for example).
1602 */
1603static int prepare_binprm(struct linux_binprm *bprm)
1604{
1605	loff_t pos = 0;
1606
1607	memset(bprm->buf, 0, BINPRM_BUF_SIZE);
1608	return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos);
1609}
1610
1611/*
1612 * Arguments are '\0' separated strings found at the location bprm->p
1613 * points to; chop off the first by relocating brpm->p to right after
1614 * the first '\0' encountered.
1615 */
1616int remove_arg_zero(struct linux_binprm *bprm)
1617{
1618	unsigned long offset;
1619	char *kaddr;
1620	struct page *page;
1621
1622	if (!bprm->argc)
1623		return 0;
1624
1625	do {
1626		offset = bprm->p & ~PAGE_MASK;
1627		page = get_arg_page(bprm, bprm->p, 0);
1628		if (!page)
1629			return -EFAULT;
1630		kaddr = kmap_local_page(page);
1631
1632		for (; offset < PAGE_SIZE && kaddr[offset];
1633				offset++, bprm->p++)
1634			;
1635
1636		kunmap_local(kaddr);
1637		put_arg_page(page);
1638	} while (offset == PAGE_SIZE);
1639
1640	bprm->p++;
1641	bprm->argc--;
1642
1643	return 0;
1644}
1645EXPORT_SYMBOL(remove_arg_zero);
1646
1647/*
1648 * cycle the list of binary formats handler, until one recognizes the image
1649 */
1650static int search_binary_handler(struct linux_binprm *bprm)
1651{
1652	struct linux_binfmt *fmt;
1653	int retval;
1654
1655	retval = prepare_binprm(bprm);
1656	if (retval < 0)
1657		return retval;
1658
1659	retval = security_bprm_check(bprm);
1660	if (retval)
1661		return retval;
1662
1663	read_lock(&binfmt_lock);
1664	list_for_each_entry(fmt, &formats, lh) {
1665		if (!try_module_get(fmt->module))
1666			continue;
1667		read_unlock(&binfmt_lock);
1668
1669		retval = fmt->load_binary(bprm);
1670
1671		read_lock(&binfmt_lock);
1672		put_binfmt(fmt);
1673		if (bprm->point_of_no_return || (retval != -ENOEXEC)) {
1674			read_unlock(&binfmt_lock);
1675			return retval;
1676		}
1677	}
1678	read_unlock(&binfmt_lock);
1679
1680	return -ENOEXEC;
1681}
1682
1683/* binfmt handlers will call back into begin_new_exec() on success. */
1684static int exec_binprm(struct linux_binprm *bprm)
1685{
1686	pid_t old_pid, old_vpid;
1687	int ret, depth;
1688
1689	/* Need to fetch pid before load_binary changes it */
1690	old_pid = current->pid;
1691	rcu_read_lock();
1692	old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
1693	rcu_read_unlock();
1694
1695	/* This allows 4 levels of binfmt rewrites before failing hard. */
1696	for (depth = 0;; depth++) {
1697		struct file *exec;
1698		if (depth > 5)
1699			return -ELOOP;
1700
1701		ret = search_binary_handler(bprm);
1702		if (ret < 0)
1703			return ret;
1704		if (!bprm->interpreter)
1705			break;
1706
1707		exec = bprm->file;
1708		bprm->file = bprm->interpreter;
1709		bprm->interpreter = NULL;
1710
1711		exe_file_allow_write_access(exec);
1712		if (unlikely(bprm->have_execfd)) {
1713			if (bprm->executable) {
1714				fput(exec);
1715				return -ENOEXEC;
1716			}
1717			bprm->executable = exec;
1718		} else
1719			fput(exec);
1720	}
1721
1722	audit_bprm(bprm);
1723	trace_sched_process_exec(current, old_pid, bprm);
1724	ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
1725	proc_exec_connector(current);
1726	return 0;
1727}
1728
1729static int bprm_execve(struct linux_binprm *bprm)
1730{
1731	int retval;
1732
1733	retval = prepare_bprm_creds(bprm);
1734	if (retval)
1735		return retval;
1736
1737	/*
1738	 * Check for unsafe execution states before exec_binprm(), which
1739	 * will call back into begin_new_exec(), into bprm_creds_from_file(),
1740	 * where setuid-ness is evaluated.
1741	 */
1742	check_unsafe_exec(bprm);
1743	current->in_execve = 1;
1744	sched_mm_cid_before_execve(current);
1745
1746	sched_exec();
1747
1748	/* Set the unchanging part of bprm->cred */
1749	retval = security_bprm_creds_for_exec(bprm);
1750	if (retval || bprm->is_check)
1751		goto out;
1752
1753	retval = exec_binprm(bprm);
1754	if (retval < 0)
1755		goto out;
1756
1757	sched_mm_cid_after_execve(current);
1758	rseq_execve(current);
1759	/* execve succeeded */
1760	current->in_execve = 0;
1761	user_events_execve(current);
1762	acct_update_integrals(current);
1763	task_numa_free(current, false);
1764	return retval;
1765
1766out:
1767	/*
1768	 * If past the point of no return ensure the code never
1769	 * returns to the userspace process.  Use an existing fatal
1770	 * signal if present otherwise terminate the process with
1771	 * SIGSEGV.
1772	 */
1773	if (bprm->point_of_no_return && !fatal_signal_pending(current))
1774		force_fatal_sig(SIGSEGV);
1775
1776	sched_mm_cid_after_execve(current);
1777	rseq_force_update();
1778	current->in_execve = 0;
1779
1780	return retval;
1781}
1782
1783static int do_execveat_common(int fd, struct filename *filename,
1784			      struct user_arg_ptr argv,
1785			      struct user_arg_ptr envp,
1786			      int flags)
1787{
1788	struct linux_binprm *bprm;
1789	int retval;
1790
1791	if (IS_ERR(filename))
1792		return PTR_ERR(filename);
1793
1794	/*
1795	 * We move the actual failure in case of RLIMIT_NPROC excess from
1796	 * set*uid() to execve() because too many poorly written programs
1797	 * don't check setuid() return code.  Here we additionally recheck
1798	 * whether NPROC limit is still exceeded.
1799	 */
1800	if ((current->flags & PF_NPROC_EXCEEDED) &&
1801	    is_rlimit_overlimit(current_ucounts(), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
1802		retval = -EAGAIN;
1803		goto out_ret;
1804	}
1805
1806	/* We're below the limit (still or again), so we don't want to make
1807	 * further execve() calls fail. */
1808	current->flags &= ~PF_NPROC_EXCEEDED;
1809
1810	bprm = alloc_bprm(fd, filename, flags);
1811	if (IS_ERR(bprm)) {
1812		retval = PTR_ERR(bprm);
1813		goto out_ret;
1814	}
1815
1816	retval = count(argv, MAX_ARG_STRINGS);
1817	if (retval < 0)
1818		goto out_free;
1819	bprm->argc = retval;
1820
1821	retval = count(envp, MAX_ARG_STRINGS);
1822	if (retval < 0)
1823		goto out_free;
1824	bprm->envc = retval;
1825
1826	retval = bprm_stack_limits(bprm);
1827	if (retval < 0)
1828		goto out_free;
1829
1830	retval = copy_string_kernel(bprm->filename, bprm);
1831	if (retval < 0)
1832		goto out_free;
1833	bprm->exec = bprm->p;
1834
1835	retval = copy_strings(bprm->envc, envp, bprm);
1836	if (retval < 0)
1837		goto out_free;
1838
1839	retval = copy_strings(bprm->argc, argv, bprm);
1840	if (retval < 0)
1841		goto out_free;
1842
1843	/*
1844	 * When argv is empty, add an empty string ("") as argv[0] to
1845	 * ensure confused userspace programs that start processing
1846	 * from argv[1] won't end up walking envp. See also
1847	 * bprm_stack_limits().
1848	 */
1849	if (bprm->argc == 0) {
1850		retval = copy_string_kernel("", bprm);
1851		if (retval < 0)
1852			goto out_free;
1853		bprm->argc = 1;
1854
1855		pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",
1856			     current->comm, bprm->filename);
1857	}
1858
1859	retval = bprm_execve(bprm);
1860out_free:
1861	free_bprm(bprm);
1862
1863out_ret:
1864	putname(filename);
1865	return retval;
1866}
1867
1868int kernel_execve(const char *kernel_filename,
1869		  const char *const *argv, const char *const *envp)
1870{
1871	struct filename *filename;
1872	struct linux_binprm *bprm;
1873	int fd = AT_FDCWD;
1874	int retval;
1875
1876	/* It is non-sense for kernel threads to call execve */
1877	if (WARN_ON_ONCE(current->flags & PF_KTHREAD))
1878		return -EINVAL;
1879
1880	filename = getname_kernel(kernel_filename);
1881	if (IS_ERR(filename))
1882		return PTR_ERR(filename);
1883
1884	bprm = alloc_bprm(fd, filename, 0);
1885	if (IS_ERR(bprm)) {
1886		retval = PTR_ERR(bprm);
1887		goto out_ret;
1888	}
1889
1890	retval = count_strings_kernel(argv);
1891	if (WARN_ON_ONCE(retval == 0))
1892		retval = -EINVAL;
1893	if (retval < 0)
1894		goto out_free;
1895	bprm->argc = retval;
1896
1897	retval = count_strings_kernel(envp);
1898	if (retval < 0)
1899		goto out_free;
1900	bprm->envc = retval;
1901
1902	retval = bprm_stack_limits(bprm);
1903	if (retval < 0)
1904		goto out_free;
1905
1906	retval = copy_string_kernel(bprm->filename, bprm);
1907	if (retval < 0)
1908		goto out_free;
1909	bprm->exec = bprm->p;
1910
1911	retval = copy_strings_kernel(bprm->envc, envp, bprm);
1912	if (retval < 0)
1913		goto out_free;
1914
1915	retval = copy_strings_kernel(bprm->argc, argv, bprm);
1916	if (retval < 0)
1917		goto out_free;
1918
1919	retval = bprm_execve(bprm);
1920out_free:
1921	free_bprm(bprm);
1922out_ret:
1923	putname(filename);
1924	return retval;
1925}
1926
1927static int do_execve(struct filename *filename,
1928	const char __user *const __user *__argv,
1929	const char __user *const __user *__envp)
1930{
1931	struct user_arg_ptr argv = { .ptr.native = __argv };
1932	struct user_arg_ptr envp = { .ptr.native = __envp };
1933	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
1934}
1935
1936static int do_execveat(int fd, struct filename *filename,
1937		const char __user *const __user *__argv,
1938		const char __user *const __user *__envp,
1939		int flags)
1940{
1941	struct user_arg_ptr argv = { .ptr.native = __argv };
1942	struct user_arg_ptr envp = { .ptr.native = __envp };
1943
1944	return do_execveat_common(fd, filename, argv, envp, flags);
1945}
1946
1947#ifdef CONFIG_COMPAT
1948static int compat_do_execve(struct filename *filename,
1949	const compat_uptr_t __user *__argv,
1950	const compat_uptr_t __user *__envp)
1951{
1952	struct user_arg_ptr argv = {
1953		.is_compat = true,
1954		.ptr.compat = __argv,
1955	};
1956	struct user_arg_ptr envp = {
1957		.is_compat = true,
1958		.ptr.compat = __envp,
1959	};
1960	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
1961}
1962
1963static int compat_do_execveat(int fd, struct filename *filename,
1964			      const compat_uptr_t __user *__argv,
1965			      const compat_uptr_t __user *__envp,
1966			      int flags)
1967{
1968	struct user_arg_ptr argv = {
1969		.is_compat = true,
1970		.ptr.compat = __argv,
1971	};
1972	struct user_arg_ptr envp = {
1973		.is_compat = true,
1974		.ptr.compat = __envp,
1975	};
1976	return do_execveat_common(fd, filename, argv, envp, flags);
1977}
1978#endif
1979
1980void set_binfmt(struct linux_binfmt *new)
1981{
1982	struct mm_struct *mm = current->mm;
1983
1984	if (mm->binfmt)
1985		module_put(mm->binfmt->module);
1986
1987	mm->binfmt = new;
1988	if (new)
1989		__module_get(new->module);
1990}
1991EXPORT_SYMBOL(set_binfmt);
1992
1993/*
1994 * set_dumpable stores three-value SUID_DUMP_* into mm->flags.
1995 */
1996void set_dumpable(struct mm_struct *mm, int value)
1997{
1998	if (WARN_ON((unsigned)value > SUID_DUMP_ROOT))
1999		return;
2000
2001	__mm_flags_set_mask_dumpable(mm, value);
2002}
2003
2004SYSCALL_DEFINE3(execve,
2005		const char __user *, filename,
2006		const char __user *const __user *, argv,
2007		const char __user *const __user *, envp)
2008{
2009	return do_execve(getname(filename), argv, envp);
2010}
2011
2012SYSCALL_DEFINE5(execveat,
2013		int, fd, const char __user *, filename,
2014		const char __user *const __user *, argv,
2015		const char __user *const __user *, envp,
2016		int, flags)
2017{
2018	return do_execveat(fd,
2019			   getname_uflags(filename, flags),
2020			   argv, envp, flags);
2021}
2022
2023#ifdef CONFIG_COMPAT
2024COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename,
2025	const compat_uptr_t __user *, argv,
2026	const compat_uptr_t __user *, envp)
2027{
2028	return compat_do_execve(getname(filename), argv, envp);
2029}
2030
2031COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
2032		       const char __user *, filename,
2033		       const compat_uptr_t __user *, argv,
2034		       const compat_uptr_t __user *, envp,
2035		       int,  flags)
2036{
2037	return compat_do_execveat(fd,
2038				  getname_uflags(filename, flags),
2039				  argv, envp, flags);
2040}
2041#endif
2042
2043#ifdef CONFIG_SYSCTL
2044
2045static int proc_dointvec_minmax_coredump(const struct ctl_table *table, int write,
2046		void *buffer, size_t *lenp, loff_t *ppos)
2047{
2048	int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
2049
2050	if (!error && write)
2051		validate_coredump_safety();
2052	return error;
2053}
2054
2055static const struct ctl_table fs_exec_sysctls[] = {
2056	{
2057		.procname	= "suid_dumpable",
2058		.data		= &suid_dumpable,
2059		.maxlen		= sizeof(int),
2060		.mode		= 0644,
2061		.proc_handler	= proc_dointvec_minmax_coredump,
2062		.extra1		= SYSCTL_ZERO,
2063		.extra2		= SYSCTL_TWO,
2064	},
2065};
2066
2067static int __init init_fs_exec_sysctls(void)
2068{
2069	register_sysctl_init("fs", fs_exec_sysctls);
2070	return 0;
2071}
2072
2073fs_initcall(init_fs_exec_sysctls);
2074#endif /* CONFIG_SYSCTL */
2075
2076#ifdef CONFIG_EXEC_KUNIT_TEST
2077#include "tests/exec_kunit.c"
2078#endif