1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
24 */
25
26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
27 /* All Rights Reserved */
28 /*
29 * Copyright (c) 2019, Joyent, Inc.
30 * Copyright 2021 Oxide Computer Company
31 */
32
33 #include <sys/types.h>
34 #include <sys/param.h>
35 #include <sys/thread.h>
36 #include <sys/sysmacros.h>
37 #include <sys/signal.h>
38 #include <sys/cred.h>
39 #include <sys/user.h>
40 #include <sys/errno.h>
41 #include <sys/vnode.h>
42 #include <sys/mman.h>
43 #include <sys/kmem.h>
44 #include <sys/proc.h>
45 #include <sys/pathname.h>
46 #include <sys/policy.h>
47 #include <sys/cmn_err.h>
48 #include <sys/systm.h>
49 #include <sys/elf.h>
50 #include <sys/vmsystm.h>
51 #include <sys/debug.h>
52 #include <sys/auxv.h>
53 #include <sys/exec.h>
54 #include <sys/prsystm.h>
55 #include <vm/as.h>
56 #include <vm/rm.h>
57 #include <vm/seg.h>
58 #include <vm/seg_vn.h>
59 #include <sys/modctl.h>
60 #include <sys/systeminfo.h>
61 #include <sys/vmparam.h>
62 #include <sys/machelf.h>
63 #include <sys/shm_impl.h>
64 #include <sys/archsystm.h>
65 #include <sys/fasttrap.h>
66 #include <sys/brand.h>
67 #include "elf_impl.h"
68 #include <sys/sdt.h>
69 #include <sys/siginfo.h>
70 #include <sys/random.h>
71
72 #include <core_shstrtab.h>
73
74 #if defined(__x86)
75 #include <sys/comm_page_util.h>
76 #include <sys/fp.h>
77 #endif /* defined(__x86) */
78
79
80 extern int at_flags;
81 extern volatile size_t aslr_max_brk_skew;
82
83 #define ORIGIN_STR "ORIGIN"
84 #define ORIGIN_STR_SIZE 6
85
86 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);
87 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *,
88 ssize_t *);
89 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *,
90 ssize_t *, caddr_t *, ssize_t *);
91 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *);
92 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t,
93 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *,
94 caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *);
95
96 static int
dtrace_safe_phdr(Phdr * phdrp,struct uarg * args,uintptr_t base)97 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base)
98 {
99 ASSERT(phdrp->p_type == PT_SUNWDTRACE);
100
101 /*
102 * See the comment in fasttrap.h for information on how to safely
103 * update this program header.
104 */
105 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE ||
106 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X))
107 return (-1);
108
109 args->thrptr = phdrp->p_vaddr + base;
110
111 return (0);
112 }
113
114 static int
handle_secflag_dt(proc_t * p,uint_t dt,uint_t val)115 handle_secflag_dt(proc_t *p, uint_t dt, uint_t val)
116 {
117 uint_t flag;
118
119 switch (dt) {
120 case DT_SUNW_ASLR:
121 flag = PROC_SEC_ASLR;
122 break;
123 default:
124 return (EINVAL);
125 }
126
127 if (val == 0) {
128 if (secflag_isset(p->p_secflags.psf_lower, flag))
129 return (EPERM);
130 if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
131 secflag_isset(p->p_secflags.psf_inherit, flag))
132 return (EPERM);
133
134 secflag_clear(&p->p_secflags.psf_effective, flag);
135 } else {
136 if (!secflag_isset(p->p_secflags.psf_upper, flag))
137 return (EPERM);
138
139 if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
140 !secflag_isset(p->p_secflags.psf_inherit, flag))
141 return (EPERM);
142
143 secflag_set(&p->p_secflags.psf_effective, flag);
144 }
145
146 return (0);
147 }
148
149 /*
150 * Map in the executable pointed to by vp. Returns 0 on success.
151 */
152 int
mapexec_brand(vnode_t * vp,uarg_t * args,Ehdr * ehdr,Addr * uphdr_vaddr,intptr_t * voffset,caddr_t exec_file,int * interp,caddr_t * bssbase,caddr_t * brkbase,size_t * brksize,uintptr_t * lddatap)153 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
154 intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
155 caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap)
156 {
157 size_t len;
158 struct vattr vat;
159 caddr_t phdrbase = NULL;
160 ssize_t phdrsize;
161 int nshdrs, shstrndx, nphdrs;
162 int error = 0;
163 Phdr *uphdr = NULL;
164 Phdr *junk = NULL;
165 Phdr *dynphdr = NULL;
166 Phdr *dtrphdr = NULL;
167 uintptr_t lddata;
168 long execsz;
169 intptr_t minaddr;
170
171 if (lddatap != NULL)
172 *lddatap = 0;
173
174 if (error = execpermissions(vp, &vat, args)) {
175 uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
176 return (error);
177 }
178
179 if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx,
180 &nphdrs)) != 0 ||
181 (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase,
182 &phdrsize)) != 0) {
183 uprintf("%s: Cannot read %s\n", exec_file, args->pathname);
184 return (error);
185 }
186
187 if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) {
188 uprintf("%s: Nothing to load in %s", exec_file, args->pathname);
189 kmem_free(phdrbase, phdrsize);
190 return (ENOEXEC);
191 }
192 if (lddatap != NULL)
193 *lddatap = lddata;
194
195 if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr,
196 &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
197 len, &execsz, brksize)) {
198 uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
199 kmem_free(phdrbase, phdrsize);
200 return (error);
201 }
202
203 /*
204 * Inform our caller if the executable needs an interpreter.
205 */
206 *interp = (dynphdr == NULL) ? 0 : 1;
207
208 /*
209 * If this is a statically linked executable, voffset should indicate
210 * the address of the executable itself (it normally holds the address
211 * of the interpreter).
212 */
213 if (ehdr->e_type == ET_EXEC && *interp == 0)
214 *voffset = minaddr;
215
216 if (uphdr != NULL) {
217 *uphdr_vaddr = uphdr->p_vaddr;
218 } else {
219 *uphdr_vaddr = (Addr)-1;
220 }
221
222 kmem_free(phdrbase, phdrsize);
223 return (error);
224 }
225
226 /*ARGSUSED*/
227 int
elfexec(vnode_t * vp,execa_t * uap,uarg_t * args,intpdata_t * idatap,int level,long * execsz,int setid,caddr_t exec_file,cred_t * cred,int brand_action)228 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
229 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
230 int brand_action)
231 {
232 caddr_t phdrbase = NULL;
233 caddr_t bssbase = 0;
234 caddr_t brkbase = 0;
235 size_t brksize = 0;
236 ssize_t dlnsize;
237 aux_entry_t *aux;
238 int error;
239 ssize_t resid;
240 int fd = -1;
241 intptr_t voffset;
242 Phdr *intphdr = NULL;
243 Phdr *dynamicphdr = NULL;
244 Phdr *stphdr = NULL;
245 Phdr *uphdr = NULL;
246 Phdr *junk = NULL;
247 size_t len;
248 size_t i;
249 ssize_t phdrsize;
250 int postfixsize = 0;
251 int hsize;
252 Phdr *phdrp;
253 Phdr *dataphdrp = NULL;
254 Phdr *dtrphdr;
255 Phdr *capphdr = NULL;
256 Cap *cap = NULL;
257 ssize_t capsize;
258 int hasu = 0;
259 int hasauxv = 0;
260 int hasintp = 0;
261 int branded = 0;
262
263 struct proc *p = ttoproc(curthread);
264 struct user *up = PTOU(p);
265 struct bigwad {
266 Ehdr ehdr;
267 aux_entry_t elfargs[__KERN_NAUXV_IMPL];
268 char dl_name[MAXPATHLEN];
269 char pathbuf[MAXPATHLEN];
270 struct vattr vattr;
271 struct execenv exenv;
272 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */
273 Ehdr *ehdrp;
274 int nshdrs, shstrndx, nphdrs;
275 char *dlnp;
276 char *pathbufp;
277 rlim64_t limit;
278 rlim64_t roundlimit;
279
280 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64);
281
282 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP);
283 ehdrp = &bigwad->ehdr;
284 dlnp = bigwad->dl_name;
285 pathbufp = bigwad->pathbuf;
286
287 /*
288 * Obtain ELF and program header information.
289 */
290 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx,
291 &nphdrs)) != 0 ||
292 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase,
293 &phdrsize)) != 0)
294 goto out;
295
296 /*
297 * Prevent executing an ELF file that has no entry point.
298 */
299 if (ehdrp->e_entry == 0) {
300 uprintf("%s: Bad entry point\n", exec_file);
301 goto bad;
302 }
303
304 /*
305 * Put data model that we're exec-ing to into the args passed to
306 * exec_args(), so it will know what it is copying to on new stack.
307 * Now that we know whether we are exec-ing a 32-bit or 64-bit
308 * executable, we can set execsz with the appropriate NCARGS.
309 */
310 #ifdef _LP64
311 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) {
312 args->to_model = DATAMODEL_ILP32;
313 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
314 } else {
315 args->to_model = DATAMODEL_LP64;
316 args->stk_prot &= ~PROT_EXEC;
317 #if defined(__x86)
318 args->dat_prot &= ~PROT_EXEC;
319 #endif
320 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1);
321 }
322 #else /* _LP64 */
323 args->to_model = DATAMODEL_ILP32;
324 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1);
325 #endif /* _LP64 */
326
327 /*
328 * We delay invoking the brand callback until we've figured out
329 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
330 * We do this because now the brand library can just check
331 * args->to_model to see if the target is 32-bit or 64-bit without
332 * having do duplicate all the code above.
333 *
334 * The level checks associated with brand handling below are used to
335 * prevent a loop since the brand elfexec function typically comes back
336 * through this function. We must check <= here since the nested
337 * handling in the #! interpreter code will increment the level before
338 * calling gexec to run the final elfexec interpreter.
339 */
340 if ((level <= INTP_MAXDEPTH) &&
341 (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
342 error = BROP(p)->b_elfexec(vp, uap, args,
343 idatap, level + 1, execsz, setid, exec_file, cred,
344 brand_action);
345 goto out;
346 }
347
348 /*
349 * Determine aux size now so that stack can be built
350 * in one shot (except actual copyout of aux image),
351 * determine any non-default stack protections,
352 * and still have this code be machine independent.
353 */
354 hsize = ehdrp->e_phentsize;
355 phdrp = (Phdr *)phdrbase;
356 for (i = nphdrs; i > 0; i--) {
357 switch (phdrp->p_type) {
358 case PT_INTERP:
359 hasauxv = hasintp = 1;
360 break;
361 case PT_PHDR:
362 hasu = 1;
363 break;
364 case PT_SUNWSTACK:
365 args->stk_prot = PROT_USER;
366 if (phdrp->p_flags & PF_R)
367 args->stk_prot |= PROT_READ;
368 if (phdrp->p_flags & PF_W)
369 args->stk_prot |= PROT_WRITE;
370 if (phdrp->p_flags & PF_X)
371 args->stk_prot |= PROT_EXEC;
372 break;
373 case PT_LOAD:
374 dataphdrp = phdrp;
375 break;
376 case PT_SUNWCAP:
377 capphdr = phdrp;
378 break;
379 case PT_DYNAMIC:
380 dynamicphdr = phdrp;
381 break;
382 }
383 phdrp = (Phdr *)((caddr_t)phdrp + hsize);
384 }
385
386 if (ehdrp->e_type != ET_EXEC) {
387 dataphdrp = NULL;
388 hasauxv = 1;
389 }
390
391 /* Copy BSS permissions to args->dat_prot */
392 if (dataphdrp != NULL) {
393 args->dat_prot = PROT_USER;
394 if (dataphdrp->p_flags & PF_R)
395 args->dat_prot |= PROT_READ;
396 if (dataphdrp->p_flags & PF_W)
397 args->dat_prot |= PROT_WRITE;
398 if (dataphdrp->p_flags & PF_X)
399 args->dat_prot |= PROT_EXEC;
400 }
401
402 /*
403 * If a auxvector will be required - reserve the space for
404 * it now. This may be increased by exec_args if there are
405 * ISA-specific types (included in __KERN_NAUXV_IMPL).
406 */
407 if (hasauxv) {
408 /*
409 * If a AUX vector is being built - the base AUX
410 * entries are:
411 *
412 * AT_BASE
413 * AT_FLAGS
414 * AT_PAGESZ
415 * AT_SUN_AUXFLAGS
416 * AT_SUN_HWCAP
417 * AT_SUN_HWCAP2
418 * AT_SUN_PLATFORM (added in stk_copyout)
419 * AT_SUN_EXECNAME (added in stk_copyout)
420 * AT_NULL
421 *
422 * total == 9
423 */
424 if (hasintp && hasu) {
425 /*
426 * Has PT_INTERP & PT_PHDR - the auxvectors that
427 * will be built are:
428 *
429 * AT_PHDR
430 * AT_PHENT
431 * AT_PHNUM
432 * AT_ENTRY
433 * AT_LDDATA
434 *
435 * total = 5
436 */
437 args->auxsize = (9 + 5) * sizeof (aux_entry_t);
438 } else if (hasintp) {
439 /*
440 * Has PT_INTERP but no PT_PHDR
441 *
442 * AT_EXECFD
443 * AT_LDDATA
444 *
445 * total = 2
446 */
447 args->auxsize = (9 + 2) * sizeof (aux_entry_t);
448 } else {
449 args->auxsize = 9 * sizeof (aux_entry_t);
450 }
451 } else {
452 args->auxsize = 0;
453 }
454
455 /*
456 * If this binary is using an emulator, we need to add an
457 * AT_SUN_EMULATOR aux entry.
458 */
459 if (args->emulator != NULL)
460 args->auxsize += sizeof (aux_entry_t);
461
462 /*
463 * On supported kernels (x86_64) make room in the auxv for the
464 * AT_SUN_COMMPAGE entry. This will go unpopulated on i86xpv systems
465 * which do not provide such functionality.
466 *
467 * Additionally cover the floating point information AT_SUN_FPSIZE and
468 * AT_SUN_FPTYPE.
469 */
470 #if defined(__amd64)
471 args->auxsize += 3 * sizeof (aux_entry_t);
472 #endif /* defined(__amd64) */
473
474 if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
475 branded = 1;
476 /*
477 * We will be adding 4 entries to the aux vectors. One for
478 * the the brandname and 3 for the brand specific aux vectors.
479 */
480 args->auxsize += 4 * sizeof (aux_entry_t);
481 }
482
483 /* If the binary has an explicit ASLR flag, it must be honoured */
484 if ((dynamicphdr != NULL) && (dynamicphdr->p_filesz > 0)) {
485 const size_t dynfilesz = dynamicphdr->p_filesz;
486 const size_t dynoffset = dynamicphdr->p_offset;
487 Dyn *dyn, *dp;
488
489 if (dynoffset > MAXOFFSET_T ||
490 dynfilesz > MAXOFFSET_T ||
491 dynoffset + dynfilesz > MAXOFFSET_T) {
492 uprintf("%s: cannot read full .dynamic section\n",
493 exec_file);
494 error = EINVAL;
495 goto out;
496 }
497
498 #define DYN_STRIDE 100
499 for (i = 0; i < dynfilesz; i += sizeof (*dyn) * DYN_STRIDE) {
500 const size_t remdyns = (dynfilesz - i) / sizeof (*dyn);
501 const size_t ndyns = MIN(DYN_STRIDE, remdyns);
502 const size_t dynsize = ndyns * sizeof (*dyn);
503
504 dyn = kmem_alloc(dynsize, KM_SLEEP);
505
506 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)dyn,
507 (ssize_t)dynsize, (offset_t)(dynoffset + i),
508 UIO_SYSSPACE, 0, (rlim64_t)0,
509 CRED(), &resid)) != 0) {
510 uprintf("%s: cannot read .dynamic section\n",
511 exec_file);
512 goto out;
513 }
514
515 for (dp = dyn; dp < (dyn + ndyns); dp++) {
516 if (dp->d_tag == DT_SUNW_ASLR) {
517 if ((error = handle_secflag_dt(p,
518 DT_SUNW_ASLR,
519 dp->d_un.d_val)) != 0) {
520 uprintf("%s: error setting "
521 "security-flag from "
522 "DT_SUNW_ASLR: %d\n",
523 exec_file, error);
524 goto out;
525 }
526 }
527 }
528
529 kmem_free(dyn, dynsize);
530 }
531 }
532
533 /* Hardware/Software capabilities */
534 if (capphdr != NULL &&
535 (capsize = capphdr->p_filesz) > 0 &&
536 capsize <= 16 * sizeof (*cap)) {
537 int ncaps = capsize / sizeof (*cap);
538 Cap *cp;
539
540 cap = kmem_alloc(capsize, KM_SLEEP);
541 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap,
542 capsize, (offset_t)capphdr->p_offset,
543 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) {
544 uprintf("%s: Cannot read capabilities section\n",
545 exec_file);
546 goto out;
547 }
548 for (cp = cap; cp < cap + ncaps; cp++) {
549 if (cp->c_tag == CA_SUNW_SF_1 &&
550 (cp->c_un.c_val & SF1_SUNW_ADDR32)) {
551 if (args->to_model == DATAMODEL_LP64)
552 args->addr32 = 1;
553 break;
554 }
555 }
556 }
557
558 aux = bigwad->elfargs;
559 /*
560 * Move args to the user's stack.
561 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries.
562 */
563 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
564 if (error == -1) {
565 error = ENOEXEC;
566 goto bad;
567 }
568 goto out;
569 }
570 /* we're single threaded after this point */
571
572 /*
573 * If this is an ET_DYN executable (shared object),
574 * determine its memory size so that mapelfexec() can load it.
575 */
576 if (ehdrp->e_type == ET_DYN)
577 len = elfsize(ehdrp, nphdrs, phdrbase, NULL);
578 else
579 len = 0;
580
581 dtrphdr = NULL;
582
583 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &intphdr,
584 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
585 len, execsz, &brksize)) != 0)
586 goto bad;
587
588 if (uphdr != NULL && intphdr == NULL)
589 goto bad;
590
591 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
592 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
593 goto bad;
594 }
595
596 if (intphdr != NULL) {
597 size_t len;
598 uintptr_t lddata;
599 char *p;
600 struct vnode *nvp;
601
602 dlnsize = intphdr->p_filesz;
603
604 if (dlnsize > MAXPATHLEN || dlnsize <= 0)
605 goto bad;
606
607 /*
608 * Read in "interpreter" pathname.
609 */
610 if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz,
611 (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
612 CRED(), &resid)) != 0) {
613 uprintf("%s: Cannot obtain interpreter pathname\n",
614 exec_file);
615 goto bad;
616 }
617
618 if (resid != 0 || dlnp[dlnsize - 1] != '\0')
619 goto bad;
620
621 /*
622 * Search for '$ORIGIN' token in interpreter path.
623 * If found, expand it.
624 */
625 for (p = dlnp; p = strchr(p, '$'); ) {
626 uint_t len, curlen;
627 char *_ptr;
628
629 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE))
630 continue;
631
632 /*
633 * We don't support $ORIGIN on setid programs to close
634 * a potential attack vector.
635 */
636 if ((setid & EXECSETID_SETID) != 0) {
637 error = ENOEXEC;
638 goto bad;
639 }
640
641 curlen = 0;
642 len = p - dlnp - 1;
643 if (len) {
644 bcopy(dlnp, pathbufp, len);
645 curlen += len;
646 }
647 if (_ptr = strrchr(args->pathname, '/')) {
648 len = _ptr - args->pathname;
649 if ((curlen + len) > MAXPATHLEN)
650 break;
651
652 bcopy(args->pathname, &pathbufp[curlen], len);
653 curlen += len;
654 } else {
655 /*
656 * executable is a basename found in the
657 * current directory. So - just substitue
658 * '.' for ORIGIN.
659 */
660 pathbufp[curlen] = '.';
661 curlen++;
662 }
663 p += ORIGIN_STR_SIZE;
664 len = strlen(p);
665
666 if ((curlen + len) > MAXPATHLEN)
667 break;
668 bcopy(p, &pathbufp[curlen], len);
669 curlen += len;
670 pathbufp[curlen++] = '\0';
671 bcopy(pathbufp, dlnp, curlen);
672 }
673
674 /*
675 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1
676 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1).
677 * Just in case /usr is not mounted, change it now.
678 */
679 if (strcmp(dlnp, USR_LIB_RTLD) == 0)
680 dlnp += 4;
681 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp);
682 if (error && dlnp != bigwad->dl_name) {
683 /* new kernel, old user-level */
684 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW,
685 NULLVPP, &nvp);
686 }
687 if (error) {
688 uprintf("%s: Cannot find %s\n", exec_file, dlnp);
689 goto bad;
690 }
691
692 /*
693 * Setup the "aux" vector.
694 */
695 if (uphdr) {
696 if (ehdrp->e_type == ET_DYN) {
697 /* don't use the first page */
698 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE;
699 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE;
700 } else {
701 bigwad->exenv.ex_bssbase = bssbase;
702 bigwad->exenv.ex_brkbase = brkbase;
703 }
704 bigwad->exenv.ex_brksize = brksize;
705 bigwad->exenv.ex_magic = elfmagic;
706 bigwad->exenv.ex_vp = vp;
707 setexecenv(&bigwad->exenv);
708
709 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset)
710 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize)
711 ADDAUX(aux, AT_PHNUM, nphdrs)
712 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset)
713 } else {
714 if ((error = execopen(&vp, &fd)) != 0) {
715 VN_RELE(nvp);
716 goto bad;
717 }
718
719 ADDAUX(aux, AT_EXECFD, fd)
720 }
721
722 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) {
723 VN_RELE(nvp);
724 uprintf("%s: Cannot execute %s\n", exec_file, dlnp);
725 goto bad;
726 }
727
728 /*
729 * Now obtain the ELF header along with the entire program
730 * header contained in "nvp".
731 */
732 kmem_free(phdrbase, phdrsize);
733 phdrbase = NULL;
734 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs,
735 &shstrndx, &nphdrs)) != 0 ||
736 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase,
737 &phdrsize)) != 0) {
738 VN_RELE(nvp);
739 uprintf("%s: Cannot read %s\n", exec_file, dlnp);
740 goto bad;
741 }
742
743 /*
744 * Determine memory size of the "interpreter's" loadable
745 * sections. This size is then used to obtain the virtual
746 * address of a hole, in the user's address space, large
747 * enough to map the "interpreter".
748 */
749 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) {
750 VN_RELE(nvp);
751 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp);
752 goto bad;
753 }
754
755 dtrphdr = NULL;
756
757 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
758 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
759 execsz, NULL);
760 if (error || junk != NULL) {
761 VN_RELE(nvp);
762 uprintf("%s: Cannot map %s\n", exec_file, dlnp);
763 goto bad;
764 }
765
766 /*
767 * We use the DTrace program header to initialize the
768 * architecture-specific user per-LWP location. The dtrace
769 * fasttrap provider requires ready access to per-LWP scratch
770 * space. We assume that there is only one such program header
771 * in the interpreter.
772 */
773 if (dtrphdr != NULL &&
774 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
775 VN_RELE(nvp);
776 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp);
777 goto bad;
778 }
779
780 VN_RELE(nvp);
781 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata)
782 }
783
784 if (hasauxv) {
785 int auxf = AF_SUN_HWCAPVERIFY;
786 #if defined(__amd64)
787 size_t fpsize;
788 int fptype;
789 #endif /* defined(__amd64) */
790
791 /*
792 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via
793 * exec_args()
794 */
795 ADDAUX(aux, AT_BASE, voffset)
796 ADDAUX(aux, AT_FLAGS, at_flags)
797 ADDAUX(aux, AT_PAGESZ, PAGESIZE)
798 /*
799 * Linker flags. (security)
800 * p_flag not yet set at this time.
801 * We rely on gexec() to provide us with the information.
802 * If the application is set-uid but this is not reflected
803 * in a mismatch between real/effective uids/gids, then
804 * don't treat this as a set-uid exec. So we care about
805 * the EXECSETID_UGIDS flag but not the ...SETID flag.
806 */
807 if ((setid &= ~EXECSETID_SETID) != 0)
808 auxf |= AF_SUN_SETUGID;
809
810 /*
811 * If we're running a native process from within a branded
812 * zone under pfexec then we clear the AF_SUN_SETUGID flag so
813 * that the native ld.so.1 is able to link with the native
814 * libraries instead of using the brand libraries that are
815 * installed in the zone. We only do this for processes
816 * which we trust because we see they are already running
817 * under pfexec (where uid != euid). This prevents a
818 * malicious user within the zone from crafting a wrapper to
819 * run native suid commands with unsecure libraries interposed.
820 */
821 if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) &&
822 (setid &= ~EXECSETID_SETID) != 0))
823 auxf &= ~AF_SUN_SETUGID;
824
825 /*
826 * Record the user addr of the auxflags aux vector entry
827 * since brands may optionally want to manipulate this field.
828 */
829 args->auxp_auxflags =
830 (char *)((char *)args->stackend +
831 ((char *)&aux->a_type -
832 (char *)bigwad->elfargs));
833 ADDAUX(aux, AT_SUN_AUXFLAGS, auxf);
834
835 /*
836 * Hardware capability flag word (performance hints)
837 * Used for choosing faster library routines.
838 * (Potentially different between 32-bit and 64-bit ABIs)
839 */
840 #if defined(_LP64)
841 if (args->to_model == DATAMODEL_NATIVE) {
842 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
843 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
844 } else {
845 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32)
846 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2)
847 }
848 #else
849 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
850 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
851 #endif
852 if (branded) {
853 /*
854 * Reserve space for the brand-private aux vectors,
855 * and record the user addr of that space.
856 */
857 args->auxp_brand =
858 (char *)((char *)args->stackend +
859 ((char *)&aux->a_type -
860 (char *)bigwad->elfargs));
861 ADDAUX(aux, AT_SUN_BRAND_AUX1, 0)
862 ADDAUX(aux, AT_SUN_BRAND_AUX2, 0)
863 ADDAUX(aux, AT_SUN_BRAND_AUX3, 0)
864 }
865
866 /*
867 * Add the comm page auxv entry, mapping it in if needed. Also
868 * take care of the FPU entries.
869 */
870 #if defined(__amd64)
871 if (args->commpage != (uintptr_t)NULL ||
872 (args->commpage = (uintptr_t)comm_page_mapin()) !=
873 (uintptr_t)NULL) {
874 ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage)
875 } else {
876 /*
877 * If the comm page cannot be mapped, pad out the auxv
878 * to satisfy later size checks.
879 */
880 ADDAUX(aux, AT_NULL, 0)
881 }
882
883 fptype = AT_386_FPINFO_NONE;
884 fpu_auxv_info(&fptype, &fpsize);
885 if (fptype != AT_386_FPINFO_NONE) {
886 ADDAUX(aux, AT_SUN_FPTYPE, fptype)
887 ADDAUX(aux, AT_SUN_FPSIZE, fpsize)
888 } else {
889 ADDAUX(aux, AT_NULL, 0)
890 ADDAUX(aux, AT_NULL, 0)
891 }
892 #endif /* defined(__amd64) */
893
894 ADDAUX(aux, AT_NULL, 0)
895 postfixsize = (char *)aux - (char *)bigwad->elfargs;
896
897 /*
898 * We make assumptions above when we determine how many aux
899 * vector entries we will be adding. However, if we have an
900 * invalid elf file, it is possible that mapelfexec might
901 * behave differently (but not return an error), in which case
902 * the number of aux entries we actually add will be different.
903 * We detect that now and error out.
904 */
905 if (postfixsize != args->auxsize) {
906 DTRACE_PROBE2(elfexec_badaux, int, postfixsize,
907 int, args->auxsize);
908 goto bad;
909 }
910 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t));
911 }
912
913 /*
914 * For the 64-bit kernel, the limit is big enough that rounding it up
915 * to a page can overflow the 64-bit limit, so we check for btopr()
916 * overflowing here by comparing it with the unrounded limit in pages.
917 * If it hasn't overflowed, compare the exec size with the rounded up
918 * limit in pages. Otherwise, just compare with the unrounded limit.
919 */
920 limit = btop(p->p_vmem_ctl);
921 roundlimit = btopr(p->p_vmem_ctl);
922 if ((roundlimit > limit && *execsz > roundlimit) ||
923 (roundlimit < limit && *execsz > limit)) {
924 mutex_enter(&p->p_lock);
925 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p,
926 RCA_SAFE);
927 mutex_exit(&p->p_lock);
928 error = ENOMEM;
929 goto bad;
930 }
931
932 bzero(up->u_auxv, sizeof (up->u_auxv));
933 up->u_commpagep = args->commpage;
934 if (postfixsize) {
935 int num_auxv;
936
937 /*
938 * Copy the aux vector to the user stack.
939 */
940 error = execpoststack(args, bigwad->elfargs, postfixsize);
941 if (error)
942 goto bad;
943
944 /*
945 * Copy auxv to the process's user structure for use by /proc.
946 * If this is a branded process, the brand's exec routine will
947 * copy it's private entries to the user structure later. It
948 * relies on the fact that the blank entries are at the end.
949 */
950 num_auxv = postfixsize / sizeof (aux_entry_t);
951 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t));
952 aux = bigwad->elfargs;
953 for (i = 0; i < num_auxv; i++) {
954 up->u_auxv[i].a_type = aux[i].a_type;
955 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val;
956 }
957 }
958
959 /*
960 * Pass back the starting address so we can set the program counter.
961 */
962 args->entry = (uintptr_t)(ehdrp->e_entry + voffset);
963
964 if (!uphdr) {
965 if (ehdrp->e_type == ET_DYN) {
966 /*
967 * If we are executing a shared library which doesn't
968 * have a interpreter (probably ld.so.1) then
969 * we don't set the brkbase now. Instead we
970 * delay it's setting until the first call
971 * via grow.c::brk(). This permits ld.so.1 to
972 * initialize brkbase to the tail of the executable it
973 * loads (which is where it needs to be).
974 */
975 bigwad->exenv.ex_brkbase = (caddr_t)0;
976 bigwad->exenv.ex_bssbase = (caddr_t)0;
977 bigwad->exenv.ex_brksize = 0;
978 } else {
979 bigwad->exenv.ex_brkbase = brkbase;
980 bigwad->exenv.ex_bssbase = bssbase;
981 bigwad->exenv.ex_brksize = brksize;
982 }
983 bigwad->exenv.ex_magic = elfmagic;
984 bigwad->exenv.ex_vp = vp;
985 setexecenv(&bigwad->exenv);
986 }
987
988 ASSERT(error == 0);
989 goto out;
990
991 bad:
992 if (fd != -1) /* did we open the a.out yet */
993 (void) execclose(fd);
994
995 psignal(p, SIGKILL);
996
997 if (error == 0)
998 error = ENOEXEC;
999 out:
1000 if (phdrbase != NULL)
1001 kmem_free(phdrbase, phdrsize);
1002 if (cap != NULL)
1003 kmem_free(cap, capsize);
1004 kmem_free(bigwad, sizeof (struct bigwad));
1005 return (error);
1006 }
1007
1008 /*
1009 * Compute the memory size requirement for the ELF file.
1010 */
1011 static size_t
elfsize(Ehdr * ehdrp,int nphdrs,caddr_t phdrbase,uintptr_t * lddata)1012 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata)
1013 {
1014 size_t len;
1015 Phdr *phdrp = (Phdr *)phdrbase;
1016 int hsize = ehdrp->e_phentsize;
1017 int first = 1;
1018 int dfirst = 1; /* first data segment */
1019 uintptr_t loaddr = 0;
1020 uintptr_t hiaddr = 0;
1021 uintptr_t lo, hi;
1022 int i;
1023
1024 for (i = nphdrs; i > 0; i--) {
1025 if (phdrp->p_type == PT_LOAD) {
1026 lo = phdrp->p_vaddr;
1027 hi = lo + phdrp->p_memsz;
1028 if (first) {
1029 loaddr = lo;
1030 hiaddr = hi;
1031 first = 0;
1032 } else {
1033 if (loaddr > lo)
1034 loaddr = lo;
1035 if (hiaddr < hi)
1036 hiaddr = hi;
1037 }
1038
1039 /*
1040 * save the address of the first data segment
1041 * of a object - used for the AT_SUNW_LDDATA
1042 * aux entry.
1043 */
1044 if ((lddata != NULL) && dfirst &&
1045 (phdrp->p_flags & PF_W)) {
1046 *lddata = lo;
1047 dfirst = 0;
1048 }
1049 }
1050 phdrp = (Phdr *)((caddr_t)phdrp + hsize);
1051 }
1052
1053 len = hiaddr - (loaddr & PAGEMASK);
1054 len = roundup(len, PAGESIZE);
1055
1056 return (len);
1057 }
1058
1059 /*
1060 * Read in the ELF header and program header table.
1061 * SUSV3 requires:
1062 * ENOEXEC File format is not recognized
1063 * EINVAL Format recognized but execution not supported
1064 */
1065 static int
getelfhead(vnode_t * vp,cred_t * credp,Ehdr * ehdr,int * nshdrs,int * shstrndx,int * nphdrs)1066 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx,
1067 int *nphdrs)
1068 {
1069 int error;
1070 ssize_t resid;
1071
1072 /*
1073 * We got here by the first two bytes in ident,
1074 * now read the entire ELF header.
1075 */
1076 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr,
1077 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0,
1078 (rlim64_t)0, credp, &resid)) != 0)
1079 return (error);
1080
1081 /*
1082 * Since a separate version is compiled for handling 32-bit and
1083 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version
1084 * doesn't need to be able to deal with 32-bit ELF files.
1085 */
1086 if (resid != 0 ||
1087 ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1088 ehdr->e_ident[EI_MAG3] != ELFMAG3)
1089 return (ENOEXEC);
1090
1091 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) ||
1092 #if defined(_ILP32) || defined(_ELF32_COMPAT)
1093 ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
1094 #else
1095 ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
1096 #endif
1097 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine,
1098 ehdr->e_flags))
1099 return (EINVAL);
1100
1101 *nshdrs = ehdr->e_shnum;
1102 *shstrndx = ehdr->e_shstrndx;
1103 *nphdrs = ehdr->e_phnum;
1104
1105 /*
1106 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need
1107 * to read in the section header at index zero to acces the true
1108 * values for those fields.
1109 */
1110 if ((*nshdrs == 0 && ehdr->e_shoff != 0) ||
1111 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) {
1112 Shdr shdr;
1113
1114 if (ehdr->e_shoff == 0)
1115 return (EINVAL);
1116
1117 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr,
1118 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0,
1119 (rlim64_t)0, credp, &resid)) != 0)
1120 return (error);
1121
1122 if (*nshdrs == 0)
1123 *nshdrs = shdr.sh_size;
1124 if (*shstrndx == SHN_XINDEX)
1125 *shstrndx = shdr.sh_link;
1126 if (*nphdrs == PN_XNUM && shdr.sh_info != 0)
1127 *nphdrs = shdr.sh_info;
1128 }
1129
1130 return (0);
1131 }
1132
1133 #ifdef _ELF32_COMPAT
1134 extern size_t elf_nphdr_max;
1135 #else
1136 size_t elf_nphdr_max = 1000;
1137 #endif
1138
1139 static int
getelfphdr(vnode_t * vp,cred_t * credp,const Ehdr * ehdr,int nphdrs,caddr_t * phbasep,ssize_t * phsizep)1140 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs,
1141 caddr_t *phbasep, ssize_t *phsizep)
1142 {
1143 ssize_t resid, minsize;
1144 int err;
1145
1146 /*
1147 * Since we're going to be using e_phentsize to iterate down the
1148 * array of program headers, it must be 8-byte aligned or else
1149 * a we might cause a misaligned access. We use all members through
1150 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so
1151 * e_phentsize must be at least large enough to include those
1152 * members.
1153 */
1154 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1155 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags);
1156 #else
1157 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz);
1158 #endif
1159 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3))
1160 return (EINVAL);
1161
1162 *phsizep = nphdrs * ehdr->e_phentsize;
1163
1164 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) {
1165 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL)
1166 return (ENOMEM);
1167 } else {
1168 *phbasep = kmem_alloc(*phsizep, KM_SLEEP);
1169 }
1170
1171 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep,
1172 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1173 credp, &resid)) != 0) {
1174 kmem_free(*phbasep, *phsizep);
1175 *phbasep = NULL;
1176 return (err);
1177 }
1178
1179 return (0);
1180 }
1181
1182 #ifdef _ELF32_COMPAT
1183 extern size_t elf_nshdr_max;
1184 extern size_t elf_shstrtab_max;
1185 #else
1186 size_t elf_nshdr_max = 10000;
1187 size_t elf_shstrtab_max = 100 * 1024;
1188 #endif
1189
1190
1191 static int
getelfshdr(vnode_t * vp,cred_t * credp,const Ehdr * ehdr,int nshdrs,int shstrndx,caddr_t * shbasep,ssize_t * shsizep,char ** shstrbasep,ssize_t * shstrsizep)1192 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
1193 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep,
1194 char **shstrbasep, ssize_t *shstrsizep)
1195 {
1196 ssize_t resid, minsize;
1197 int err;
1198 Shdr *shdr;
1199
1200 /*
1201 * Since we're going to be using e_shentsize to iterate down the
1202 * array of section headers, it must be 8-byte aligned or else
1203 * a we might cause a misaligned access. We use all members through
1204 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize
1205 * must be at least large enough to include that member. The index
1206 * of the string table section must also be valid.
1207 */
1208 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize);
1209 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) ||
1210 shstrndx >= nshdrs)
1211 return (EINVAL);
1212
1213 *shsizep = nshdrs * ehdr->e_shentsize;
1214
1215 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) {
1216 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL)
1217 return (ENOMEM);
1218 } else {
1219 *shbasep = kmem_alloc(*shsizep, KM_SLEEP);
1220 }
1221
1222 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep,
1223 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1224 credp, &resid)) != 0) {
1225 kmem_free(*shbasep, *shsizep);
1226 return (err);
1227 }
1228
1229 /*
1230 * Pull the section string table out of the vnode; fail if the size
1231 * is zero.
1232 */
1233 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize);
1234 if ((*shstrsizep = shdr->sh_size) == 0) {
1235 kmem_free(*shbasep, *shsizep);
1236 return (EINVAL);
1237 }
1238
1239 if (*shstrsizep > elf_shstrtab_max) {
1240 if ((*shstrbasep = kmem_alloc(*shstrsizep,
1241 KM_NOSLEEP)) == NULL) {
1242 kmem_free(*shbasep, *shsizep);
1243 return (ENOMEM);
1244 }
1245 } else {
1246 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP);
1247 }
1248
1249 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep,
1250 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
1251 credp, &resid)) != 0) {
1252 kmem_free(*shbasep, *shsizep);
1253 kmem_free(*shstrbasep, *shstrsizep);
1254 return (err);
1255 }
1256
1257 /*
1258 * Make sure the strtab is null-terminated to make sure we
1259 * don't run off the end of the table.
1260 */
1261 (*shstrbasep)[*shstrsizep - 1] = '\0';
1262
1263 return (0);
1264 }
1265
1266 static int
mapelfexec(vnode_t * vp,Ehdr * ehdr,int nphdrs,caddr_t phdrbase,Phdr ** uphdr,Phdr ** intphdr,Phdr ** stphdr,Phdr ** dtphdr,Phdr * dataphdrp,caddr_t * bssbase,caddr_t * brkbase,intptr_t * voffset,intptr_t * minaddr,size_t len,long * execsz,size_t * brksize)1267 mapelfexec(
1268 vnode_t *vp,
1269 Ehdr *ehdr,
1270 int nphdrs,
1271 caddr_t phdrbase,
1272 Phdr **uphdr,
1273 Phdr **intphdr,
1274 Phdr **stphdr,
1275 Phdr **dtphdr,
1276 Phdr *dataphdrp,
1277 caddr_t *bssbase,
1278 caddr_t *brkbase,
1279 intptr_t *voffset,
1280 intptr_t *minaddr,
1281 size_t len,
1282 long *execsz,
1283 size_t *brksize)
1284 {
1285 Phdr *phdr;
1286 int i, prot, error;
1287 caddr_t addr = NULL;
1288 size_t zfodsz;
1289 int ptload = 0;
1290 int page;
1291 off_t offset;
1292 int hsize = ehdr->e_phentsize;
1293 caddr_t mintmp = (caddr_t)-1;
1294 extern int use_brk_lpg;
1295
1296 if (ehdr->e_type == ET_DYN) {
1297 secflagset_t flags = 0;
1298 /*
1299 * Obtain the virtual address of a hole in the
1300 * address space to map the "interpreter".
1301 */
1302 if (secflag_enabled(curproc, PROC_SEC_ASLR))
1303 flags |= _MAP_RANDOMIZE;
1304
1305 map_addr(&addr, len, (offset_t)0, 1, flags);
1306 if (addr == NULL)
1307 return (ENOMEM);
1308 *voffset = (intptr_t)addr;
1309
1310 /*
1311 * Calculate the minimum vaddr so it can be subtracted out.
1312 * According to the ELF specification, since PT_LOAD sections
1313 * must be sorted by increasing p_vaddr values, this is
1314 * guaranteed to be the first PT_LOAD section.
1315 */
1316 phdr = (Phdr *)phdrbase;
1317 for (i = nphdrs; i > 0; i--) {
1318 if (phdr->p_type == PT_LOAD) {
1319 *voffset -= (uintptr_t)phdr->p_vaddr;
1320 break;
1321 }
1322 phdr = (Phdr *)((caddr_t)phdr + hsize);
1323 }
1324
1325 } else {
1326 *voffset = 0;
1327 }
1328 phdr = (Phdr *)phdrbase;
1329 for (i = nphdrs; i > 0; i--) {
1330 switch (phdr->p_type) {
1331 case PT_LOAD:
1332 if ((*intphdr != NULL) && (*uphdr == NULL))
1333 return (0);
1334
1335 ptload = 1;
1336 prot = PROT_USER;
1337 if (phdr->p_flags & PF_R)
1338 prot |= PROT_READ;
1339 if (phdr->p_flags & PF_W)
1340 prot |= PROT_WRITE;
1341 if (phdr->p_flags & PF_X)
1342 prot |= PROT_EXEC;
1343
1344 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
1345
1346 /*
1347 * Keep track of the segment with the lowest starting
1348 * address.
1349 */
1350 if (addr < mintmp)
1351 mintmp = addr;
1352
1353 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
1354
1355 offset = phdr->p_offset;
1356 if (((uintptr_t)offset & PAGEOFFSET) ==
1357 ((uintptr_t)addr & PAGEOFFSET) &&
1358 (!(vp->v_flag & VNOMAP))) {
1359 page = 1;
1360 } else {
1361 page = 0;
1362 }
1363
1364 /*
1365 * Set the heap pagesize for OOB when the bss size
1366 * is known and use_brk_lpg is not 0.
1367 */
1368 if (brksize != NULL && use_brk_lpg &&
1369 zfodsz != 0 && phdr == dataphdrp &&
1370 (prot & PROT_WRITE)) {
1371 size_t tlen = P2NPHASE((uintptr_t)addr +
1372 phdr->p_filesz, PAGESIZE);
1373
1374 if (zfodsz > tlen) {
1375 curproc->p_brkpageszc =
1376 page_szc(map_pgsz(MAPPGSZ_HEAP,
1377 curproc, addr + phdr->p_filesz +
1378 tlen, zfodsz - tlen, 0));
1379 }
1380 }
1381
1382 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
1383 (prot & PROT_WRITE)) {
1384 uint_t szc = curproc->p_brkpageszc;
1385 size_t pgsz = page_get_pagesize(szc);
1386 caddr_t ebss = addr + phdr->p_memsz;
1387 /*
1388 * If we need extra space to keep the BSS an
1389 * integral number of pages in size, some of
1390 * that space may fall beyond p_brkbase, so we
1391 * need to set p_brksize to account for it
1392 * being (logically) part of the brk.
1393 */
1394 size_t extra_zfodsz;
1395
1396 ASSERT(pgsz > PAGESIZE);
1397
1398 extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);
1399
1400 if (error = execmap(vp, addr, phdr->p_filesz,
1401 zfodsz + extra_zfodsz, phdr->p_offset,
1402 prot, page, szc))
1403 goto bad;
1404 if (brksize != NULL)
1405 *brksize = extra_zfodsz;
1406 } else {
1407 if (error = execmap(vp, addr, phdr->p_filesz,
1408 zfodsz, phdr->p_offset, prot, page, 0))
1409 goto bad;
1410 }
1411
1412 if (bssbase != NULL && addr >= *bssbase &&
1413 phdr == dataphdrp) {
1414 *bssbase = addr + phdr->p_filesz;
1415 }
1416 if (brkbase != NULL && addr >= *brkbase) {
1417 *brkbase = addr + phdr->p_memsz;
1418 }
1419
1420 *execsz += btopr(phdr->p_memsz);
1421 break;
1422
1423 case PT_INTERP:
1424 if (ptload)
1425 goto bad;
1426 *intphdr = phdr;
1427 break;
1428
1429 case PT_SHLIB:
1430 *stphdr = phdr;
1431 break;
1432
1433 case PT_PHDR:
1434 if (ptload)
1435 goto bad;
1436 *uphdr = phdr;
1437 break;
1438
1439 case PT_NULL:
1440 case PT_DYNAMIC:
1441 case PT_NOTE:
1442 break;
1443
1444 case PT_SUNWDTRACE:
1445 if (dtphdr != NULL)
1446 *dtphdr = phdr;
1447 break;
1448
1449 default:
1450 break;
1451 }
1452 phdr = (Phdr *)((caddr_t)phdr + hsize);
1453 }
1454
1455 if (minaddr != NULL) {
1456 ASSERT(mintmp != (caddr_t)-1);
1457 *minaddr = (intptr_t)mintmp;
1458 }
1459
1460 if (brkbase != NULL && secflag_enabled(curproc, PROC_SEC_ASLR)) {
1461 size_t off;
1462 uintptr_t base = (uintptr_t)*brkbase;
1463 uintptr_t oend = base + *brksize;
1464
1465 ASSERT(ISP2(aslr_max_brk_skew));
1466
1467 (void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off));
1468 base += P2PHASE(off, aslr_max_brk_skew);
1469 base = P2ROUNDUP(base, PAGESIZE);
1470 *brkbase = (caddr_t)base;
1471 /*
1472 * Above, we set *brksize to account for the possibility we
1473 * had to grow the 'brk' in padding out the BSS to a page
1474 * boundary.
1475 *
1476 * We now need to adjust that based on where we now are
1477 * actually putting the brk.
1478 */
1479 if (oend > base)
1480 *brksize = oend - base;
1481 else
1482 *brksize = 0;
1483 }
1484
1485 return (0);
1486 bad:
1487 if (error == 0)
1488 error = EINVAL;
1489 return (error);
1490 }
1491
1492 int
elfnote(vnode_t * vp,offset_t * offsetp,int type,int descsz,void * desc,rlim64_t rlimit,cred_t * credp)1493 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc,
1494 rlim64_t rlimit, cred_t *credp)
1495 {
1496 Note note;
1497 int error;
1498
1499 bzero(¬e, sizeof (note));
1500 bcopy("CORE", note.name, 4);
1501 note.nhdr.n_type = type;
1502 /*
1503 * The System V ABI states that n_namesz must be the length of the
1504 * string that follows the Nhdr structure including the terminating
1505 * null. The ABI also specifies that sufficient padding should be
1506 * included so that the description that follows the name string
1507 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries
1508 * respectively. However, since this change was not made correctly
1509 * at the time of the 64-bit port, both 32- and 64-bit binaries
1510 * descriptions are only guaranteed to begin on a 4-byte boundary.
1511 */
1512 note.nhdr.n_namesz = 5;
1513 note.nhdr.n_descsz = roundup(descsz, sizeof (Word));
1514
1515 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e,
1516 sizeof (note), rlimit, credp))
1517 return (error);
1518
1519 *offsetp += sizeof (note);
1520
1521 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc,
1522 note.nhdr.n_descsz, rlimit, credp))
1523 return (error);
1524
1525 *offsetp += note.nhdr.n_descsz;
1526 return (0);
1527 }
1528
1529 /*
1530 * Copy the section data from one vnode to the section of another vnode.
1531 */
1532 static void
copy_scn(Shdr * src,vnode_t * src_vp,Shdr * dst,vnode_t * dst_vp,Off * doffset,void * buf,size_t size,cred_t * credp,rlim64_t rlimit)1533 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset,
1534 void *buf, size_t size, cred_t *credp, rlim64_t rlimit)
1535 {
1536 ssize_t resid;
1537 size_t len, n = src->sh_size;
1538 offset_t off = 0;
1539
1540 while (n != 0) {
1541 len = MIN(size, n);
1542 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off,
1543 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 ||
1544 resid >= len ||
1545 core_write(dst_vp, UIO_SYSSPACE, *doffset + off,
1546 buf, len - resid, rlimit, credp) != 0) {
1547 dst->sh_size = 0;
1548 dst->sh_offset = 0;
1549 return;
1550 }
1551
1552 ASSERT(n >= len - resid);
1553
1554 n -= len - resid;
1555 off += len - resid;
1556 }
1557
1558 *doffset += src->sh_size;
1559 }
1560
1561 #ifdef _ELF32_COMPAT
1562 extern size_t elf_datasz_max;
1563 extern size_t elf_zeropg_sz;
1564 #else
1565 size_t elf_datasz_max = 1 * 1024 * 1024;
1566 size_t elf_zeropg_sz = 4 * 1024;
1567 #endif
1568
1569 /*
1570 * This function processes mappings that correspond to load objects to
1571 * examine their respective sections for elfcore(). It's called once with
1572 * v set to NULL to count the number of sections that we're going to need
1573 * and then again with v set to some allocated buffer that we fill in with
1574 * all the section data.
1575 */
1576 static int
process_scns(core_content_t content,proc_t * p,cred_t * credp,vnode_t * vp,Shdr * v,int nv,rlim64_t rlimit,Off * doffsetp,int * nshdrsp)1577 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp,
1578 Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp)
1579 {
1580 vnode_t *lastvp = NULL;
1581 struct seg *seg;
1582 int i, j;
1583 void *data = NULL;
1584 size_t datasz = 0;
1585 shstrtab_t shstrtab;
1586 struct as *as = p->p_as;
1587 int error = 0;
1588
1589 if (!shstrtab_init(&shstrtab)) {
1590 error = ENOMEM;
1591 goto done;
1592 }
1593
1594 i = 1;
1595 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1596 uint_t prot;
1597 vnode_t *mvp;
1598 void *tmp = NULL;
1599 caddr_t saddr = seg->s_base;
1600 caddr_t naddr;
1601 caddr_t eaddr;
1602 size_t segsize;
1603
1604 Ehdr ehdr;
1605 int nshdrs, shstrndx, nphdrs;
1606 caddr_t shbase;
1607 ssize_t shsize;
1608 char *shstrbase;
1609 ssize_t shstrsize;
1610
1611 Shdr *shdr;
1612 const char *name;
1613 size_t sz;
1614 uintptr_t off;
1615
1616 int ctf_ndx = 0;
1617 int symtab_ndx = 0;
1618
1619 /*
1620 * Since we're just looking for text segments of load
1621 * objects, we only care about the protection bits; we don't
1622 * care about the actual size of the segment so we use the
1623 * reserved size. If the segment's size is zero, there's
1624 * something fishy going on so we ignore this segment.
1625 */
1626 if (seg->s_ops != &segvn_ops ||
1627 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1628 mvp == lastvp || mvp == NULL || mvp->v_type != VREG ||
1629 (segsize = pr_getsegsize(seg, 1)) == 0)
1630 continue;
1631
1632 eaddr = saddr + segsize;
1633 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
1634 pr_getprot_done(&tmp);
1635
1636 /*
1637 * Skip this segment unless the protection bits look like
1638 * what we'd expect for a text segment.
1639 */
1640 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
1641 continue;
1642
1643 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx,
1644 &nphdrs) != 0 ||
1645 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx,
1646 &shbase, &shsize, &shstrbase, &shstrsize) != 0)
1647 continue;
1648
1649 off = ehdr.e_shentsize;
1650 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) {
1651 Shdr *symtab = NULL, *strtab;
1652 size_t allocsz;
1653
1654 shdr = (Shdr *)(shbase + off);
1655 allocsz = MIN(shdr->sh_size, elf_datasz_max);
1656
1657 if (shdr->sh_name >= shstrsize)
1658 continue;
1659
1660 name = shstrbase + shdr->sh_name;
1661
1662 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) {
1663 if ((content & CC_CONTENT_CTF) == 0 ||
1664 ctf_ndx != 0)
1665 continue;
1666
1667 if (shdr->sh_link > 0 &&
1668 shdr->sh_link < nshdrs) {
1669 symtab = (Shdr *)(shbase +
1670 shdr->sh_link * ehdr.e_shentsize);
1671 }
1672
1673 if (v != NULL && i < nv - 1) {
1674 if (allocsz > datasz) {
1675 if (data != NULL)
1676 kmem_free(data, datasz);
1677
1678 datasz = allocsz;
1679 data = kmem_alloc(datasz,
1680 KM_SLEEP);
1681 }
1682
1683 if (!shstrtab_ndx(&shstrtab,
1684 shstrtab_data[STR_CTF],
1685 &v[i].sh_name)) {
1686 error = ENOMEM;
1687 goto done;
1688 }
1689 v[i].sh_addr = (Addr)(uintptr_t)saddr;
1690 v[i].sh_type = SHT_PROGBITS;
1691 v[i].sh_addralign = 4;
1692 *doffsetp = roundup(*doffsetp,
1693 v[i].sh_addralign);
1694 v[i].sh_offset = *doffsetp;
1695 v[i].sh_size = shdr->sh_size;
1696 if (symtab == NULL) {
1697 v[i].sh_link = 0;
1698 } else if (symtab->sh_type ==
1699 SHT_SYMTAB &&
1700 symtab_ndx != 0) {
1701 v[i].sh_link =
1702 symtab_ndx;
1703 } else {
1704 v[i].sh_link = i + 1;
1705 }
1706
1707 copy_scn(shdr, mvp, &v[i], vp,
1708 doffsetp, data, datasz, credp,
1709 rlimit);
1710 }
1711
1712 ctf_ndx = i++;
1713
1714 /*
1715 * We've already dumped the symtab.
1716 */
1717 if (symtab != NULL &&
1718 symtab->sh_type == SHT_SYMTAB &&
1719 symtab_ndx != 0)
1720 continue;
1721
1722 } else if (strcmp(name,
1723 shstrtab_data[STR_SYMTAB]) == 0) {
1724 if ((content & CC_CONTENT_SYMTAB) == 0 ||
1725 symtab != 0)
1726 continue;
1727
1728 symtab = shdr;
1729 } else if (strncmp(name, ".debug_",
1730 strlen(".debug_")) == 0) {
1731 /*
1732 * The design of the above check is intentional.
1733 * In particular, we want to capture any
1734 * sections that begin with '.debug_' for a few
1735 * reasons:
1736 *
1737 * 1) Various revisions to the DWARF spec end up
1738 * changing the set of section headers that
1739 * exist. This ensures that we don't need to
1740 * change the kernel to get a new version.
1741 *
1742 * 2) Other software uses .debug_ sections for
1743 * things which aren't DWARF. This allows them
1744 * to be captured as well.
1745 */
1746 if ((content & CC_CONTENT_DEBUG) == 0)
1747 continue;
1748
1749 if (v != NULL && i < nv - 1) {
1750 if (allocsz > datasz) {
1751 if (data != NULL)
1752 kmem_free(data, datasz);
1753
1754 datasz = allocsz;
1755 data = kmem_alloc(datasz,
1756 KM_SLEEP);
1757 }
1758
1759 if (!shstrtab_ndx(&shstrtab,
1760 name, &v[i].sh_name)) {
1761 error = ENOMEM;
1762 goto done;
1763 }
1764 v[i].sh_addr = (Addr)(uintptr_t)saddr;
1765 v[i].sh_type = shdr->sh_type;
1766 v[i].sh_addralign = shdr->sh_addralign;
1767 *doffsetp = roundup(*doffsetp,
1768 v[i].sh_addralign);
1769 v[i].sh_offset = *doffsetp;
1770 v[i].sh_size = shdr->sh_size;
1771 v[i].sh_link = 0;
1772 v[i].sh_entsize = shdr->sh_entsize;
1773 v[i].sh_info = shdr->sh_info;
1774
1775 copy_scn(shdr, mvp, &v[i], vp,
1776 doffsetp, data, datasz, credp,
1777 rlimit);
1778 }
1779
1780 i++;
1781 continue;
1782 }
1783
1784 if (symtab != NULL) {
1785 if ((symtab->sh_type != SHT_DYNSYM &&
1786 symtab->sh_type != SHT_SYMTAB) ||
1787 symtab->sh_link == 0 ||
1788 symtab->sh_link >= nshdrs)
1789 continue;
1790
1791 strtab = (Shdr *)(shbase +
1792 symtab->sh_link * ehdr.e_shentsize);
1793
1794 if (strtab->sh_type != SHT_STRTAB)
1795 continue;
1796
1797 if (v != NULL && i < nv - 2) {
1798 sz = MAX(symtab->sh_size,
1799 strtab->sh_size);
1800 allocsz = MIN(sz, elf_datasz_max);
1801 if (allocsz > datasz) {
1802 if (data != NULL)
1803 kmem_free(data, datasz);
1804
1805 datasz = allocsz;
1806 data = kmem_alloc(datasz,
1807 KM_SLEEP);
1808 }
1809
1810 if (symtab->sh_type == SHT_DYNSYM) {
1811 if (!shstrtab_ndx(&shstrtab,
1812 shstrtab_data[STR_DYNSYM],
1813 &v[i].sh_name)) {
1814 error = ENOMEM;
1815 goto done;
1816 }
1817 if (!shstrtab_ndx(&shstrtab,
1818 shstrtab_data[STR_DYNSTR],
1819 &v[i + 1].sh_name)) {
1820 error = ENOMEM;
1821 goto done;
1822 }
1823 } else {
1824 if (!shstrtab_ndx(&shstrtab,
1825 shstrtab_data[STR_SYMTAB],
1826 &v[i].sh_name)) {
1827 error = ENOMEM;
1828 goto done;
1829 }
1830 if (!shstrtab_ndx(&shstrtab,
1831 shstrtab_data[STR_STRTAB],
1832 &v[i + 1].sh_name)) {
1833 error = ENOMEM;
1834 goto done;
1835 }
1836 }
1837
1838 v[i].sh_type = symtab->sh_type;
1839 v[i].sh_addr = symtab->sh_addr;
1840 if (ehdr.e_type == ET_DYN ||
1841 v[i].sh_addr == 0)
1842 v[i].sh_addr +=
1843 (Addr)(uintptr_t)saddr;
1844 v[i].sh_addralign =
1845 symtab->sh_addralign;
1846 *doffsetp = roundup(*doffsetp,
1847 v[i].sh_addralign);
1848 v[i].sh_offset = *doffsetp;
1849 v[i].sh_size = symtab->sh_size;
1850 v[i].sh_link = i + 1;
1851 v[i].sh_entsize = symtab->sh_entsize;
1852 v[i].sh_info = symtab->sh_info;
1853
1854 copy_scn(symtab, mvp, &v[i], vp,
1855 doffsetp, data, datasz, credp,
1856 rlimit);
1857
1858 v[i + 1].sh_type = SHT_STRTAB;
1859 v[i + 1].sh_flags = SHF_STRINGS;
1860 v[i + 1].sh_addr = symtab->sh_addr;
1861 if (ehdr.e_type == ET_DYN ||
1862 v[i + 1].sh_addr == 0)
1863 v[i + 1].sh_addr +=
1864 (Addr)(uintptr_t)saddr;
1865 v[i + 1].sh_addralign =
1866 strtab->sh_addralign;
1867 *doffsetp = roundup(*doffsetp,
1868 v[i + 1].sh_addralign);
1869 v[i + 1].sh_offset = *doffsetp;
1870 v[i + 1].sh_size = strtab->sh_size;
1871
1872 copy_scn(strtab, mvp, &v[i + 1], vp,
1873 doffsetp, data, datasz, credp,
1874 rlimit);
1875 }
1876
1877 if (symtab->sh_type == SHT_SYMTAB)
1878 symtab_ndx = i;
1879 i += 2;
1880 }
1881 }
1882
1883 kmem_free(shstrbase, shstrsize);
1884 kmem_free(shbase, shsize);
1885
1886 lastvp = mvp;
1887 }
1888
1889 if (v == NULL) {
1890 if (i == 1)
1891 *nshdrsp = 0;
1892 else
1893 *nshdrsp = i + 1;
1894 goto done;
1895 }
1896
1897 if (i != nv - 1) {
1898 cmn_err(CE_WARN, "elfcore: core dump failed for "
1899 "process %d; address space is changing", p->p_pid);
1900 error = EIO;
1901 goto done;
1902 }
1903
1904 if (!shstrtab_ndx(&shstrtab, shstrtab_data[STR_SHSTRTAB],
1905 &v[i].sh_name)) {
1906 error = ENOMEM;
1907 goto done;
1908 }
1909 v[i].sh_size = shstrtab_size(&shstrtab);
1910 v[i].sh_addralign = 1;
1911 *doffsetp = roundup(*doffsetp, v[i].sh_addralign);
1912 v[i].sh_offset = *doffsetp;
1913 v[i].sh_flags = SHF_STRINGS;
1914 v[i].sh_type = SHT_STRTAB;
1915
1916 if (v[i].sh_size > datasz) {
1917 if (data != NULL)
1918 kmem_free(data, datasz);
1919
1920 datasz = v[i].sh_size;
1921 data = kmem_alloc(datasz,
1922 KM_SLEEP);
1923 }
1924
1925 shstrtab_dump(&shstrtab, data);
1926
1927 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp,
1928 data, v[i].sh_size, rlimit, credp)) != 0)
1929 goto done;
1930
1931 *doffsetp += v[i].sh_size;
1932
1933 done:
1934 if (data != NULL)
1935 kmem_free(data, datasz);
1936
1937 shstrtab_fini(&shstrtab);
1938
1939 return (error);
1940 }
1941
1942 int
elfcore(vnode_t * vp,proc_t * p,cred_t * credp,rlim64_t rlimit,int sig,core_content_t content)1943 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig,
1944 core_content_t content)
1945 {
1946 offset_t poffset, soffset;
1947 Off doffset;
1948 int error, i, nphdrs, nshdrs;
1949 int overflow = 0;
1950 struct seg *seg;
1951 struct as *as = p->p_as;
1952 union {
1953 Ehdr ehdr;
1954 Phdr phdr[1];
1955 Shdr shdr[1];
1956 } *bigwad;
1957 size_t bigsize;
1958 size_t phdrsz, shdrsz;
1959 Ehdr *ehdr;
1960 Phdr *v;
1961 void *zeropg = NULL;
1962 caddr_t brkbase;
1963 size_t brksize;
1964 caddr_t stkbase;
1965 size_t stksize;
1966 int ntries = 0;
1967 klwp_t *lwp = ttolwp(curthread);
1968
1969 top:
1970 /*
1971 * Make sure we have everything we need (registers, etc.).
1972 * All other lwps have already stopped and are in an orderly state.
1973 */
1974 ASSERT(p == ttoproc(curthread));
1975 prstop(0, 0);
1976
1977 AS_LOCK_ENTER(as, RW_WRITER);
1978 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */
1979
1980 /*
1981 * Count the number of section headers we're going to need.
1982 */
1983 nshdrs = 0;
1984 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB | CC_CONTENT_DEBUG)) {
1985 (void) process_scns(content, p, credp, NULL, NULL, 0, 0,
1986 NULL, &nshdrs);
1987 }
1988 AS_LOCK_EXIT(as);
1989
1990 ASSERT(nshdrs == 0 || nshdrs > 1);
1991
1992 /*
1993 * The core file contents may required zero section headers, but if
1994 * we overflow the 16 bits allotted to the program header count in
1995 * the ELF header, we'll need that program header at index zero.
1996 */
1997 if (nshdrs == 0 && nphdrs >= PN_XNUM)
1998 nshdrs = 1;
1999
2000 phdrsz = nphdrs * sizeof (Phdr);
2001 shdrsz = nshdrs * sizeof (Shdr);
2002
2003 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz));
2004 bigwad = kmem_alloc(bigsize, KM_SLEEP);
2005
2006 ehdr = &bigwad->ehdr;
2007 bzero(ehdr, sizeof (*ehdr));
2008
2009 ehdr->e_ident[EI_MAG0] = ELFMAG0;
2010 ehdr->e_ident[EI_MAG1] = ELFMAG1;
2011 ehdr->e_ident[EI_MAG2] = ELFMAG2;
2012 ehdr->e_ident[EI_MAG3] = ELFMAG3;
2013 ehdr->e_ident[EI_CLASS] = ELFCLASS;
2014 ehdr->e_type = ET_CORE;
2015
2016 #if !defined(_LP64) || defined(_ELF32_COMPAT)
2017
2018 #if defined(__sparc)
2019 ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
2020 ehdr->e_machine = EM_SPARC;
2021 #elif defined(__i386_COMPAT)
2022 ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
2023 ehdr->e_machine = EM_386;
2024 #else
2025 #error "no recognized machine type is defined"
2026 #endif
2027
2028 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */
2029
2030 #if defined(__sparc)
2031 ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
2032 ehdr->e_machine = EM_SPARCV9;
2033 #elif defined(__amd64)
2034 ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
2035 ehdr->e_machine = EM_AMD64;
2036 #else
2037 #error "no recognized 64-bit machine type is defined"
2038 #endif
2039
2040 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */
2041
2042 /*
2043 * If the count of program headers or section headers or the index
2044 * of the section string table can't fit in the mere 16 bits
2045 * shortsightedly allotted to them in the ELF header, we use the
2046 * extended formats and put the real values in the section header
2047 * as index 0.
2048 */
2049 ehdr->e_ident[EI_VERSION] = EV_CURRENT;
2050 ehdr->e_version = EV_CURRENT;
2051 ehdr->e_ehsize = sizeof (Ehdr);
2052
2053 if (nphdrs >= PN_XNUM)
2054 ehdr->e_phnum = PN_XNUM;
2055 else
2056 ehdr->e_phnum = (unsigned short)nphdrs;
2057
2058 ehdr->e_phoff = sizeof (Ehdr);
2059 ehdr->e_phentsize = sizeof (Phdr);
2060
2061 if (nshdrs > 0) {
2062 if (nshdrs >= SHN_LORESERVE)
2063 ehdr->e_shnum = 0;
2064 else
2065 ehdr->e_shnum = (unsigned short)nshdrs;
2066
2067 if (nshdrs - 1 >= SHN_LORESERVE)
2068 ehdr->e_shstrndx = SHN_XINDEX;
2069 else
2070 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1);
2071
2072 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs;
2073 ehdr->e_shentsize = sizeof (Shdr);
2074 }
2075
2076 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr,
2077 sizeof (Ehdr), rlimit, credp))
2078 goto done;
2079
2080 poffset = sizeof (Ehdr);
2081 soffset = sizeof (Ehdr) + phdrsz;
2082 doffset = sizeof (Ehdr) + phdrsz + shdrsz;
2083
2084 v = &bigwad->phdr[0];
2085 bzero(v, phdrsz);
2086
2087 setup_old_note_header(&v[0], p);
2088 v[0].p_offset = doffset = roundup(doffset, sizeof (Word));
2089 doffset += v[0].p_filesz;
2090
2091 setup_note_header(&v[1], p);
2092 v[1].p_offset = doffset = roundup(doffset, sizeof (Word));
2093 doffset += v[1].p_filesz;
2094
2095 mutex_enter(&p->p_lock);
2096
2097 brkbase = p->p_brkbase;
2098 brksize = p->p_brksize;
2099
2100 stkbase = p->p_usrstack - p->p_stksize;
2101 stksize = p->p_stksize;
2102
2103 mutex_exit(&p->p_lock);
2104
2105 AS_LOCK_ENTER(as, RW_WRITER);
2106 i = 2;
2107 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
2108 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0);
2109 caddr_t saddr, naddr;
2110 void *tmp = NULL;
2111 extern struct seg_ops segspt_shmops;
2112
2113 if ((seg->s_flags & S_HOLE) != 0) {
2114 continue;
2115 }
2116
2117 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
2118 uint_t prot;
2119 size_t size;
2120 int type;
2121 vnode_t *mvp;
2122
2123 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr);
2124 prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
2125 if ((size = (size_t)(naddr - saddr)) == 0)
2126 continue;
2127 if (i == nphdrs) {
2128 overflow++;
2129 continue;
2130 }
2131 v[i].p_type = PT_LOAD;
2132 v[i].p_vaddr = (Addr)(uintptr_t)saddr;
2133 v[i].p_memsz = size;
2134 if (prot & PROT_READ)
2135 v[i].p_flags |= PF_R;
2136 if (prot & PROT_WRITE)
2137 v[i].p_flags |= PF_W;
2138 if (prot & PROT_EXEC)
2139 v[i].p_flags |= PF_X;
2140
2141 /*
2142 * Figure out which mappings to include in the core.
2143 */
2144 type = SEGOP_GETTYPE(seg, saddr);
2145
2146 if (saddr == stkbase && size == stksize) {
2147 if (!(content & CC_CONTENT_STACK))
2148 goto exclude;
2149
2150 } else if (saddr == brkbase && size == brksize) {
2151 if (!(content & CC_CONTENT_HEAP))
2152 goto exclude;
2153
2154 } else if (seg->s_ops == &segspt_shmops) {
2155 if (type & MAP_NORESERVE) {
2156 if (!(content & CC_CONTENT_DISM))
2157 goto exclude;
2158 } else {
2159 if (!(content & CC_CONTENT_ISM))
2160 goto exclude;
2161 }
2162
2163 } else if (seg->s_ops != &segvn_ops) {
2164 goto exclude;
2165
2166 } else if (type & MAP_SHARED) {
2167 if (shmgetid(p, saddr) != SHMID_NONE) {
2168 if (!(content & CC_CONTENT_SHM))
2169 goto exclude;
2170
2171 } else if (SEGOP_GETVP(seg, seg->s_base,
2172 &mvp) != 0 || mvp == NULL ||
2173 mvp->v_type != VREG) {
2174 if (!(content & CC_CONTENT_SHANON))
2175 goto exclude;
2176
2177 } else {
2178 if (!(content & CC_CONTENT_SHFILE))
2179 goto exclude;
2180 }
2181
2182 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
2183 mvp == NULL || mvp->v_type != VREG) {
2184 if (!(content & CC_CONTENT_ANON))
2185 goto exclude;
2186
2187 } else if (prot == (PROT_READ | PROT_EXEC)) {
2188 if (!(content & CC_CONTENT_TEXT))
2189 goto exclude;
2190
2191 } else if (prot == PROT_READ) {
2192 if (!(content & CC_CONTENT_RODATA))
2193 goto exclude;
2194
2195 } else {
2196 if (!(content & CC_CONTENT_DATA))
2197 goto exclude;
2198 }
2199
2200 doffset = roundup(doffset, sizeof (Word));
2201 v[i].p_offset = doffset;
2202 v[i].p_filesz = size;
2203 doffset += size;
2204 exclude:
2205 i++;
2206 }
2207 ASSERT(tmp == NULL);
2208 }
2209 AS_LOCK_EXIT(as);
2210
2211 if (overflow || i != nphdrs) {
2212 if (ntries++ == 0) {
2213 kmem_free(bigwad, bigsize);
2214 overflow = 0;
2215 goto top;
2216 }
2217 cmn_err(CE_WARN, "elfcore: core dump failed for "
2218 "process %d; address space is changing", p->p_pid);
2219 error = EIO;
2220 goto done;
2221 }
2222
2223 if ((error = core_write(vp, UIO_SYSSPACE, poffset,
2224 v, phdrsz, rlimit, credp)) != 0)
2225 goto done;
2226
2227 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit,
2228 credp)) != 0)
2229 goto done;
2230
2231 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit,
2232 credp, content)) != 0)
2233 goto done;
2234
2235 for (i = 2; i < nphdrs; i++) {
2236 prkillinfo_t killinfo;
2237 sigqueue_t *sq;
2238 int sig, j;
2239
2240 if (v[i].p_filesz == 0)
2241 continue;
2242
2243 /*
2244 * If we hit a region that was mapped PROT_NONE then we cannot
2245 * continue dumping this normally as the kernel would be unable
2246 * to read from the page and that would result in us failing to
2247 * dump the page. As such, any region mapped PROT_NONE, we dump
2248 * as a zero-filled page such that this is still represented in
2249 * the map.
2250 *
2251 * If dumping out this segment fails, rather than failing
2252 * the core dump entirely, we reset the size of the mapping
2253 * to zero to indicate that the data is absent from the core
2254 * file and or in the PF_SUNW_FAILURE flag to differentiate
2255 * this from mappings that were excluded due to the core file
2256 * content settings.
2257 */
2258 if ((v[i].p_flags & (PF_R | PF_W | PF_X)) == 0) {
2259 size_t towrite = v[i].p_filesz;
2260 size_t curoff = 0;
2261
2262 if (zeropg == NULL) {
2263 zeropg = kmem_zalloc(elf_zeropg_sz, KM_SLEEP);
2264 }
2265
2266 error = 0;
2267 while (towrite != 0) {
2268 size_t len = MIN(towrite, elf_zeropg_sz);
2269
2270 error = core_write(vp, UIO_SYSSPACE,
2271 v[i].p_offset + curoff, zeropg, len, rlimit,
2272 credp);
2273 if (error != 0)
2274 break;
2275
2276 towrite -= len;
2277 curoff += len;
2278 }
2279
2280 if (error == 0)
2281 continue;
2282 } else {
2283 error = core_seg(p, vp, v[i].p_offset,
2284 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz,
2285 rlimit, credp);
2286 if (error == 0)
2287 continue;
2288 }
2289
2290 if ((sig = lwp->lwp_cursig) == 0) {
2291 /*
2292 * We failed due to something other than a signal.
2293 * Since the space reserved for the segment is now
2294 * unused, we stash the errno in the first four
2295 * bytes. This undocumented interface will let us
2296 * understand the nature of the failure.
2297 */
2298 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2299 &error, sizeof (error), rlimit, credp);
2300
2301 v[i].p_filesz = 0;
2302 v[i].p_flags |= PF_SUNW_FAILURE;
2303 if ((error = core_write(vp, UIO_SYSSPACE,
2304 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]),
2305 rlimit, credp)) != 0)
2306 goto done;
2307
2308 continue;
2309 }
2310
2311 /*
2312 * We took a signal. We want to abort the dump entirely, but
2313 * we also want to indicate what failed and why. We therefore
2314 * use the space reserved for the first failing segment to
2315 * write our error (which, for purposes of compatability with
2316 * older core dump readers, we set to EINTR) followed by any
2317 * siginfo associated with the signal.
2318 */
2319 bzero(&killinfo, sizeof (killinfo));
2320 killinfo.prk_error = EINTR;
2321
2322 sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo;
2323
2324 if (sq != NULL) {
2325 bcopy(&sq->sq_info, &killinfo.prk_info,
2326 sizeof (sq->sq_info));
2327 } else {
2328 killinfo.prk_info.si_signo = lwp->lwp_cursig;
2329 killinfo.prk_info.si_code = SI_NOINFO;
2330 }
2331
2332 #if (defined(_SYSCALL32_IMPL) || defined(_LP64))
2333 /*
2334 * If this is a 32-bit process, we need to translate from the
2335 * native siginfo to the 32-bit variant. (Core readers must
2336 * always have the same data model as their target or must
2337 * be aware of -- and compensate for -- data model differences.)
2338 */
2339 if (curproc->p_model == DATAMODEL_ILP32) {
2340 siginfo32_t si32;
2341
2342 siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32);
2343 bcopy(&si32, &killinfo.prk_info, sizeof (si32));
2344 }
2345 #endif
2346
2347 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2348 &killinfo, sizeof (killinfo), rlimit, credp);
2349
2350 /*
2351 * For the segment on which we took the signal, indicate that
2352 * its data now refers to a siginfo.
2353 */
2354 v[i].p_filesz = 0;
2355 v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED |
2356 PF_SUNW_SIGINFO;
2357
2358 /*
2359 * And for every other segment, indicate that its absence
2360 * is due to a signal.
2361 */
2362 for (j = i + 1; j < nphdrs; j++) {
2363 v[j].p_filesz = 0;
2364 v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED;
2365 }
2366
2367 /*
2368 * Finally, write out our modified program headers.
2369 */
2370 if ((error = core_write(vp, UIO_SYSSPACE,
2371 poffset + sizeof (v[i]) * i, &v[i],
2372 sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0)
2373 goto done;
2374
2375 break;
2376 }
2377
2378 if (nshdrs > 0) {
2379 bzero(&bigwad->shdr[0], shdrsz);
2380
2381 if (nshdrs >= SHN_LORESERVE)
2382 bigwad->shdr[0].sh_size = nshdrs;
2383
2384 if (nshdrs - 1 >= SHN_LORESERVE)
2385 bigwad->shdr[0].sh_link = nshdrs - 1;
2386
2387 if (nphdrs >= PN_XNUM)
2388 bigwad->shdr[0].sh_info = nphdrs;
2389
2390 if (nshdrs > 1) {
2391 AS_LOCK_ENTER(as, RW_WRITER);
2392 if ((error = process_scns(content, p, credp, vp,
2393 &bigwad->shdr[0], nshdrs, rlimit, &doffset,
2394 NULL)) != 0) {
2395 AS_LOCK_EXIT(as);
2396 goto done;
2397 }
2398 AS_LOCK_EXIT(as);
2399 }
2400
2401 if ((error = core_write(vp, UIO_SYSSPACE, soffset,
2402 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0)
2403 goto done;
2404 }
2405
2406 done:
2407 if (zeropg != NULL) {
2408 kmem_free(zeropg, elf_zeropg_sz);
2409 }
2410 kmem_free(bigwad, bigsize);
2411 return (error);
2412 }
2413
2414 #ifndef _ELF32_COMPAT
2415
2416 static struct execsw esw = {
2417 #ifdef _LP64
2418 elf64magicstr,
2419 #else /* _LP64 */
2420 elf32magicstr,
2421 #endif /* _LP64 */
2422 0,
2423 5,
2424 elfexec,
2425 elfcore
2426 };
2427
2428 static struct modlexec modlexec = {
2429 &mod_execops, "exec module for elf", &esw
2430 };
2431
2432 #ifdef _LP64
2433 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
2434 intpdata_t *idatap, int level, long *execsz,
2435 int setid, caddr_t exec_file, cred_t *cred,
2436 int brand_action);
2437 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
2438 rlim64_t rlimit, int sig, core_content_t content);
2439
2440 static struct execsw esw32 = {
2441 elf32magicstr,
2442 0,
2443 5,
2444 elf32exec,
2445 elf32core
2446 };
2447
2448 static struct modlexec modlexec32 = {
2449 &mod_execops, "32-bit exec module for elf", &esw32
2450 };
2451 #endif /* _LP64 */
2452
2453 static struct modlinkage modlinkage = {
2454 MODREV_1,
2455 (void *)&modlexec,
2456 #ifdef _LP64
2457 (void *)&modlexec32,
2458 #endif /* _LP64 */
2459 NULL
2460 };
2461
2462 int
_init(void)2463 _init(void)
2464 {
2465 return (mod_install(&modlinkage));
2466 }
2467
2468 int
_fini(void)2469 _fini(void)
2470 {
2471 return (mod_remove(&modlinkage));
2472 }
2473
2474 int
_info(struct modinfo * modinfop)2475 _info(struct modinfo *modinfop)
2476 {
2477 return (mod_info(&modlinkage, modinfop));
2478 }
2479
2480 #endif /* !_ELF32_COMPAT */
2481