[net-next-2.6.git] / fs / binfmt_misc.c

/*
 *  binfmt_misc.c
 *
 *  Copyright (C) 1997 Richard Günther
 *
 *  binfmt_misc detects binaries via a magic or filename extension and invokes
 *  a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
 *  binfmt_mz.
 *
 *  1997-04-25 first version
 *  [...]
 *  1997-05-19 cleanup
 *  1997-06-26 hpa: pass the real filename rather than argv[0]
 *  1997-06-30 minor cleanup
 *  1997-08-09 removed extension stripping, locking cleanup
 *  2001-02-28 AV: rewritten into something that resembles C. Original didn't.
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/sched.h>
#include <linux/binfmts.h>
#include <linux/slab.h>
#include <linux/ctype.h>
#include <linux/file.h>
#include <linux/pagemap.h>
#include <linux/namei.h>
#include <linux/mount.h>
#include <linux/syscalls.h>

#include <asm/uaccess.h>

enum {
	VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */
};

static LIST_HEAD(entries);
static int enabled = 1;

enum {Enabled, Magic};
#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
#define MISC_FMT_OPEN_BINARY (1<<30)
#define MISC_FMT_CREDENTIALS (1<<29)

typedef struct {
	struct list_head list;
	unsigned long flags;		/* type, status, etc. */
	int offset;			/* offset of magic */
	int size;			/* size of magic/mask */
	char *magic;			/* magic or filename extension */
	char *mask;			/* mask, NULL for exact match */
	char *interpreter;		/* filename of interpreter */
	char *name;
	struct dentry *dentry;
} Node;

static DEFINE_RWLOCK(entries_lock);
static struct file_system_type bm_fs_type;
static struct vfsmount *bm_mnt;
static int entry_count;

/* 
 * Check if we support the binfmt
 * if we do, return the node, else NULL
 * locking is done in load_misc_binary
 */
static Node *check_file(struct linux_binprm *bprm)
{
	char *p = strrchr(bprm->interp, '.');
	struct list_head *l;

	list_for_each(l, &entries) {
		Node *e = list_entry(l, Node, list);
		char *s;
		int j;

		if (!test_bit(Enabled, &e->flags))
			continue;

		if (!test_bit(Magic, &e->flags)) {
			if (p && !strcmp(e->magic, p + 1))
				return e;
			continue;
		}

		s = bprm->buf + e->offset;
		if (e->mask) {
			for (j = 0; j < e->size; j++)
				if ((*s++ ^ e->magic[j]) & e->mask[j])
					break;
		} else {
			for (j = 0; j < e->size; j++)
				if ((*s++ ^ e->magic[j]))
					break;
		}
		if (j == e->size)
			return e;
	}
	return NULL;
}

/*
 * the loader itself
 */
static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
{
	Node *fmt;
	struct file * interp_file = NULL;
	char iname[BINPRM_BUF_SIZE];
	char *iname_addr = iname;
	int retval;
	int fd_binary = -1;
	struct files_struct *files = NULL;

	retval = -ENOEXEC;
	if (!enabled)
		goto _ret;

	/* to keep locking time low, we copy the interpreter string */
	read_lock(&entries_lock);
	fmt = check_file(bprm);
	if (fmt)
		strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
	read_unlock(&entries_lock);
	if (!fmt)
		goto _ret;

	if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
		retval = remove_arg_zero(bprm);
		if (retval)
			goto _ret;
	}

	if (fmt->flags & MISC_FMT_OPEN_BINARY) {

		files = current->files;
		retval = unshare_files();
		if (retval < 0)
			goto _ret;
		if (files == current->files) {
			put_files_struct(files);
			files = NULL;
		}
		/* if the binary should be opened on behalf of the
		 * interpreter than keep it open and assign descriptor
		 * to it */
 		fd_binary = get_unused_fd();
 		if (fd_binary < 0) {
 			retval = fd_binary;
 			goto _unshare;
 		}
 		fd_install(fd_binary, bprm->file);

		/* if the binary is not readable than enforce mm->dumpable=0
		   regardless of the interpreter's permissions */
		if (file_permission(bprm->file, MAY_READ))
			bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;

		allow_write_access(bprm->file);
		bprm->file = NULL;

		/* mark the bprm that fd should be passed to interp */
		bprm->interp_flags |= BINPRM_FLAGS_EXECFD;
		bprm->interp_data = fd_binary;

 	} else {
 		allow_write_access(bprm->file);
 		fput(bprm->file);
 		bprm->file = NULL;
 	}
	/* make argv[1] be the path to the binary */
	retval = copy_strings_kernel (1, &bprm->interp, bprm);
	if (retval < 0)
		goto _error;
	bprm->argc++;

	/* add the interp as argv[0] */
	retval = copy_strings_kernel (1, &iname_addr, bprm);
	if (retval < 0)
		goto _error;
	bprm->argc ++;

	bprm->interp = iname;	/* for binfmt_script */

	interp_file = open_exec (iname);
	retval = PTR_ERR (interp_file);
	if (IS_ERR (interp_file))
		goto _error;

	bprm->file = interp_file;
	if (fmt->flags & MISC_FMT_CREDENTIALS) {
		/*
		 * No need to call prepare_binprm(), it's already been
		 * done.  bprm->buf is stale, update from interp_file.
		 */
		memset(bprm->buf, 0, BINPRM_BUF_SIZE);
		retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
	} else
		retval = prepare_binprm (bprm);

	if (retval < 0)
		goto _error;

	retval = search_binary_handler (bprm, regs);
	if (retval < 0)
		goto _error;

	if (files) {
		put_files_struct(files);
		files = NULL;
	}
_ret:
	return retval;
_error:
	if (fd_binary > 0)
		sys_close(fd_binary);
	bprm->interp_flags = 0;
	bprm->interp_data = 0;
_unshare:
	if (files)
		reset_files_struct(current, files);
	goto _ret;
}

/* Command parsers */

/*
 * parses and copies one argument enclosed in del from *sp to *dp,
 * recognising the \x special.
 * returns pointer to the copied argument or NULL in case of an
 * error (and sets err) or null argument length.
 */
static char *scanarg(char *s, char del)
{
	char c;

	while ((c = *s++) != del) {
		if (c == '\\' && *s == 'x') {
			s++;
			if (!isxdigit(*s++))
				return NULL;
			if (!isxdigit(*s++))
				return NULL;
		}
	}
	return s;
}

static int unquote(char *from)
{
	char c = 0, *s = from, *p = from;

	while ((c = *s++) != '\0') {
		if (c == '\\' && *s == 'x') {
			s++;
			c = toupper(*s++);
			*p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4;
			c = toupper(*s++);
			*p++ |= c - (isdigit(c) ? '0' : 'A' - 10);
			continue;
		}
		*p++ = c;
	}
	return p - from;
}

static char * check_special_flags (char * sfs, Node * e)
{
	char * p = sfs;
	int cont = 1;

	/* special flags */
	while (cont) {
		switch (*p) {
			case 'P':
				p++;
				e->flags |= MISC_FMT_PRESERVE_ARGV0;
				break;
			case 'O':
				p++;
				e->flags |= MISC_FMT_OPEN_BINARY;
				break;
			case 'C':
				p++;
				/* this flags also implies the
				   open-binary flag */
				e->flags |= (MISC_FMT_CREDENTIALS |
						MISC_FMT_OPEN_BINARY);
				break;
			default:
				cont = 0;
		}
	}

	return p;
}
/*
 * This registers a new binary format, it recognises the syntax
 * ':name:type:offset:magic:mask:interpreter:flags'
 * where the ':' is the IFS, that can be chosen with the first char
 */
static Node *create_entry(const char __user *buffer, size_t count)
{
	Node *e;
	int memsize, err;
	char *buf, *p;
	char del;

	/* some sanity checks */
	err = -EINVAL;
	if ((count < 11) || (count > 256))
		goto out;

	err = -ENOMEM;
	memsize = sizeof(Node) + count + 8;
	e = kmalloc(memsize, GFP_USER);
	if (!e)
		goto out;

	p = buf = (char *)e + sizeof(Node);

	memset(e, 0, sizeof(Node));
	if (copy_from_user(buf, buffer, count))
		goto Efault;

	del = *p++;	/* delimeter */

	memset(buf+count, del, 8);

	e->name = p;
	p = strchr(p, del);
	if (!p)
		goto Einval;
	*p++ = '\0';
	if (!e->name[0] ||
	    !strcmp(e->name, ".") ||
	    !strcmp(e->name, "..") ||
	    strchr(e->name, '/'))
		goto Einval;
	switch (*p++) {
		case 'E': e->flags = 1<<Enabled; break;
		case 'M': e->flags = (1<<Enabled) | (1<<Magic); break;
		default: goto Einval;
	}
	if (*p++ != del)
		goto Einval;
	if (test_bit(Magic, &e->flags)) {
		char *s = strchr(p, del);
		if (!s)
			goto Einval;
		*s++ = '\0';
		e->offset = simple_strtoul(p, &p, 10);
		if (*p++)
			goto Einval;
		e->magic = p;
		p = scanarg(p, del);
		if (!p)
			goto Einval;
		p[-1] = '\0';
		if (!e->magic[0])
			goto Einval;
		e->mask = p;
		p = scanarg(p, del);
		if (!p)
			goto Einval;
		p[-1] = '\0';
		if (!e->mask[0])
			e->mask = NULL;
		e->size = unquote(e->magic);
		if (e->mask && unquote(e->mask) != e->size)
			goto Einval;
		if (e->size + e->offset > BINPRM_BUF_SIZE)
			goto Einval;
	} else {
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
		e->magic = p;
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
		if (!e->magic[0] || strchr(e->magic, '/'))
			goto Einval;
		p = strchr(p, del);
		if (!p)
			goto Einval;
		*p++ = '\0';
	}
	e->interpreter = p;
	p = strchr(p, del);
	if (!p)
		goto Einval;
	*p++ = '\0';
	if (!e->interpreter[0])
		goto Einval;


	p = check_special_flags (p, e);

	if (*p == '\n')
		p++;
	if (p != buf + count)
		goto Einval;
	return e;

out:
	return ERR_PTR(err);

Efault:
	kfree(e);
	return ERR_PTR(-EFAULT);
Einval:
	kfree(e);
	return ERR_PTR(-EINVAL);
}

/*
 * Set status of entry/binfmt_misc:
 * '1' enables, '0' disables and '-1' clears entry/binfmt_misc
 */
static int parse_command(const char __user *buffer, size_t count)
{
	char s[4];

	if (!count)
		return 0;
	if (count > 3)
		return -EINVAL;
	if (copy_from_user(s, buffer, count))
		return -EFAULT;
	if (s[count-1] == '\n')
		count--;
	if (count == 1 && s[0] == '0')
		return 1;
	if (count == 1 && s[0] == '1')
		return 2;
	if (count == 2 && s[0] == '-' && s[1] == '1')
		return 3;
	return -EINVAL;
}

/* generic stuff */

static void entry_status(Node *e, char *page)
{
	char *dp;
	char *status = "disabled";
	const char * flags = "flags: ";

	if (test_bit(Enabled, &e->flags))
		status = "enabled";

	if (!VERBOSE_STATUS) {
		sprintf(page, "%s\n", status);
		return;
	}

	sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
	dp = page + strlen(page);

	/* print the special flags */
	sprintf (dp, "%s", flags);
	dp += strlen (flags);
	if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
		*dp ++ = 'P';
	}
	if (e->flags & MISC_FMT_OPEN_BINARY) {
		*dp ++ = 'O';
	}
	if (e->flags & MISC_FMT_CREDENTIALS) {
		*dp ++ = 'C';
	}
	*dp ++ = '\n';


	if (!test_bit(Magic, &e->flags)) {
		sprintf(dp, "extension .%s\n", e->magic);
	} else {
		int i;

		sprintf(dp, "offset %i\nmagic ", e->offset);
		dp = page + strlen(page);
		for (i = 0; i < e->size; i++) {
			sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
			dp += 2;
		}
		if (e->mask) {
			sprintf(dp, "\nmask ");
			dp += 6;
			for (i = 0; i < e->size; i++) {
				sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
				dp += 2;
			}
		}
		*dp++ = '\n';
		*dp = '\0';
	}
}

static struct inode *bm_get_inode(struct super_block *sb, int mode)
{
	struct inode * inode = new_inode(sb);

	if (inode) {
		inode->i_mode = mode;
		inode->i_uid = 0;
		inode->i_gid = 0;
		inode->i_blocks = 0;
		inode->i_atime = inode->i_mtime = inode->i_ctime =
			current_fs_time(inode->i_sb);
	}
	return inode;
}

static void bm_clear_inode(struct inode *inode)
{
	kfree(inode->i_private);
}

static void kill_node(Node *e)
{
	struct dentry *dentry;

	write_lock(&entries_lock);
	dentry = e->dentry;
	if (dentry) {
		list_del_init(&e->list);
		e->dentry = NULL;
	}
	write_unlock(&entries_lock);

	if (dentry) {
		dentry->d_inode->i_nlink--;
		d_drop(dentry);
		dput(dentry);
		simple_release_fs(&bm_mnt, &entry_count);
	}
}

/* /<entry> */

static ssize_t
bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
{
	Node *e = file->f_path.dentry->d_inode->i_private;
	loff_t pos = *ppos;
	ssize_t res;
	char *page;
	int len;

	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
		return -ENOMEM;

	entry_status(e, page);
	len = strlen(page);

	res = -EINVAL;
	if (pos < 0)
		goto out;
	res = 0;
	if (pos >= len)
		goto out;
	if (len < pos + nbytes)
		nbytes = len - pos;
	res = -EFAULT;
	if (copy_to_user(buf, page + pos, nbytes))
		goto out;
	*ppos = pos + nbytes;
	res = nbytes;
out:
	free_page((unsigned long) page);
	return res;
}

static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
				size_t count, loff_t *ppos)
{
	struct dentry *root;
	Node *e = file->f_path.dentry->d_inode->i_private;
	int res = parse_command(buffer, count);

	switch (res) {
		case 1: clear_bit(Enabled, &e->flags);
			break;
		case 2: set_bit(Enabled, &e->flags);
			break;
		case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
			mutex_lock(&root->d_inode->i_mutex);

			kill_node(e);

			mutex_unlock(&root->d_inode->i_mutex);
			dput(root);
			break;
		default: return res;
	}
	return count;
}

static const struct file_operations bm_entry_operations = {
	.read		= bm_entry_read,
	.write		= bm_entry_write,
};

/* /register */

static ssize_t bm_register_write(struct file *file, const char __user *buffer,
			       size_t count, loff_t *ppos)
{
	Node *e;
	struct inode *inode;
	struct dentry *root, *dentry;
	struct super_block *sb = file->f_path.mnt->mnt_sb;
	int err = 0;

	e = create_entry(buffer, count);

	if (IS_ERR(e))
		return PTR_ERR(e);

	root = dget(sb->s_root);
	mutex_lock(&root->d_inode->i_mutex);
	dentry = lookup_one_len(e->name, root, strlen(e->name));
	err = PTR_ERR(dentry);
	if (IS_ERR(dentry))
		goto out;

	err = -EEXIST;
	if (dentry->d_inode)
		goto out2;

	inode = bm_get_inode(sb, S_IFREG | 0644);

	err = -ENOMEM;
	if (!inode)
		goto out2;

	err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
	if (err) {
		iput(inode);
		inode = NULL;
		goto out2;
	}

	e->dentry = dget(dentry);
	inode->i_private = e;
	inode->i_fop = &bm_entry_operations;

	d_instantiate(dentry, inode);
	write_lock(&entries_lock);
	list_add(&e->list, &entries);
	write_unlock(&entries_lock);

	err = 0;
out2:
	dput(dentry);
out:
	mutex_unlock(&root->d_inode->i_mutex);
	dput(root);

	if (err) {
		kfree(e);
		return -EINVAL;
	}
	return count;
}

static const struct file_operations bm_register_operations = {
	.write		= bm_register_write,
};

/* /status */

static ssize_t
bm_status_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
{
	char *s = enabled ? "enabled" : "disabled";

	return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s));
}

static ssize_t bm_status_write(struct file * file, const char __user * buffer,
		size_t count, loff_t *ppos)
{
	int res = parse_command(buffer, count);
	struct dentry *root;

	switch (res) {
		case 1: enabled = 0; break;
		case 2: enabled = 1; break;
		case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
			mutex_lock(&root->d_inode->i_mutex);

			while (!list_empty(&entries))
				kill_node(list_entry(entries.next, Node, list));

			mutex_unlock(&root->d_inode->i_mutex);
			dput(root);
		default: return res;
	}
	return count;
}

static const struct file_operations bm_status_operations = {
	.read		= bm_status_read,
	.write		= bm_status_write,
};

/* Superblock handling */

static const struct super_operations s_ops = {
	.statfs		= simple_statfs,
	.clear_inode	= bm_clear_inode,
};

static int bm_fill_super(struct super_block * sb, void * data, int silent)
{
	static struct tree_descr bm_files[] = {
		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
		[3] = {"register", &bm_register_operations, S_IWUSR},
		/* last one */ {""}
	};
	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
	if (!err)
		sb->s_op = &s_ops;
	return err;
}

static int bm_get_sb(struct file_system_type *fs_type,
	int flags, const char *dev_name, void *data, struct vfsmount *mnt)
{
	return get_sb_single(fs_type, flags, data, bm_fill_super, mnt);
}

static struct linux_binfmt misc_format = {
	.module = THIS_MODULE,
	.load_binary = load_misc_binary,
};

static struct file_system_type bm_fs_type = {
	.owner		= THIS_MODULE,
	.name		= "binfmt_misc",
	.get_sb		= bm_get_sb,
	.kill_sb	= kill_litter_super,
};

static int __init init_misc_binfmt(void)
{
	int err = register_filesystem(&bm_fs_type);
	if (!err) {
		err = register_binfmt(&misc_format);
		if (err)
			unregister_filesystem(&bm_fs_type);
	}
	return err;
}

static void __exit exit_misc_binfmt(void)
{
	unregister_binfmt(&misc_format);
	unregister_filesystem(&bm_fs_type);
}

core_initcall(init_misc_binfmt);
module_exit(exit_misc_binfmt);
MODULE_LICENSE("GPL");
Commit	Line	Data
1da177e4 LT	1	/*
	2	* binfmt_misc.c
	3	*
96de0e25	4	* Copyright (C) 1997 Richard Günther
1da177e4 LT	5	*
	6	* binfmt_misc detects binaries via a magic or filename extension and invokes
	7	* a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
	8	* binfmt_mz.
	9	*
	10	* 1997-04-25 first version
	11	* [...]
	12	* 1997-05-19 cleanup
	13	* 1997-06-26 hpa: pass the real filename rather than argv[0]
	14	* 1997-06-30 minor cleanup
	15	* 1997-08-09 removed extension stripping, locking cleanup
	16	* 2001-02-28 AV: rewritten into something that resembles C. Original didn't.
	17	*/
	18
	19	#include <linux/module.h>
	20	#include <linux/init.h>
e8edc6e0	21	#include <linux/sched.h>
1da177e4 LT	22	#include <linux/binfmts.h>
	23	#include <linux/slab.h>
	24	#include <linux/ctype.h>
	25	#include <linux/file.h>
	26	#include <linux/pagemap.h>
	27	#include <linux/namei.h>
	28	#include <linux/mount.h>
	29	#include <linux/syscalls.h>
	30
	31	#include <asm/uaccess.h>
	32
	33	enum {
	34	VERBOSE_STATUS = 1 /* make it zero to save 400 bytes kernel memory */
	35	};
	36
	37	static LIST_HEAD(entries);
	38	static int enabled = 1;
	39
	40	enum {Enabled, Magic};
	41	#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
	42	#define MISC_FMT_OPEN_BINARY (1<<30)
	43	#define MISC_FMT_CREDENTIALS (1<<29)
	44
	45	typedef struct {
	46	struct list_head list;
	47	unsigned long flags; /* type, status, etc. */
	48	int offset; /* offset of magic */
	49	int size; /* size of magic/mask */
	50	char magic; / magic or filename extension */
	51	char mask; / mask, NULL for exact match */
	52	char interpreter; / filename of interpreter */
	53	char *name;
	54	struct dentry *dentry;
	55	} Node;
	56
	57	static DEFINE_RWLOCK(entries_lock);
1f5ce9e9	58	static struct file_system_type bm_fs_type;
1da177e4 LT	59	static struct vfsmount *bm_mnt;
	60	static int entry_count;
	61
	62	/*
	63	* Check if we support the binfmt
	64	* if we do, return the node, else NULL
	65	* locking is done in load_misc_binary
	66	*/
	67	static Node check_file(struct linux_binprm bprm)
	68	{
	69	char *p = strrchr(bprm->interp, '.');
	70	struct list_head *l;
	71
	72	list_for_each(l, &entries) {
	73	Node *e = list_entry(l, Node, list);
	74	char *s;
	75	int j;
	76
	77	if (!test_bit(Enabled, &e->flags))
	78	continue;
	79
	80	if (!test_bit(Magic, &e->flags)) {
	81	if (p && !strcmp(e->magic, p + 1))
	82	return e;
	83	continue;
	84	}
	85
	86	s = bprm->buf + e->offset;
	87	if (e->mask) {
	88	for (j = 0; j < e->size; j++)
	89	if ((*s++ ^ e->magic[j]) & e->mask[j])
	90	break;
	91	} else {
	92	for (j = 0; j < e->size; j++)
	93	if ((*s++ ^ e->magic[j]))
	94	break;
	95	}
	96	if (j == e->size)
	97	return e;
	98	}
	99	return NULL;
	100	}
	101
	102	/*
	103	* the loader itself
	104	*/
	105	static int load_misc_binary(struct linux_binprm bprm, struct pt_regs regs)
	106	{
	107	Node *fmt;
	108	struct file * interp_file = NULL;
	109	char iname[BINPRM_BUF_SIZE];
	110	char *iname_addr = iname;
	111	int retval;
	112	int fd_binary = -1;
	113	struct files_struct *files = NULL;
	114
	115	retval = -ENOEXEC;
	116	if (!enabled)
	117	goto _ret;
	118
	119	/* to keep locking time low, we copy the interpreter string */
	120	read_lock(&entries_lock);
	121	fmt = check_file(bprm);
	122	if (fmt)
123	strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
124	read_unlock(&entries_lock);
125	if (!fmt)
126	goto _ret;
127
128	if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
b6a2fea3 OW	129	retval = remove_arg_zero(bprm);
	130	if (retval)
	131	goto _ret;
1da177e4 LT	132	}
	133
	134	if (fmt->flags & MISC_FMT_OPEN_BINARY) {
	135
	136	files = current->files;
	137	retval = unshare_files();
	138	if (retval < 0)
	139	goto _ret;
	140	if (files == current->files) {
	141	put_files_struct(files);
	142	files = NULL;
	143	}
	144	/* if the binary should be opened on behalf of the
	145	* interpreter than keep it open and assign descriptor
	146	* to it */
	147	fd_binary = get_unused_fd();
	148	if (fd_binary < 0) {
	149	retval = fd_binary;
	150	goto _unshare;
	151	}
	152	fd_install(fd_binary, bprm->file);
	153
	154	/* if the binary is not readable than enforce mm->dumpable=0
	155	regardless of the interpreter's permissions */
8c744fb8	156	if (file_permission(bprm->file, MAY_READ))
1da177e4 LT	157	bprm->interp_flags \|= BINPRM_FLAGS_ENFORCE_NONDUMP;
	158
	159	allow_write_access(bprm->file);
	160	bprm->file = NULL;
	161
	162	/* mark the bprm that fd should be passed to interp */
	163	bprm->interp_flags \|= BINPRM_FLAGS_EXECFD;
	164	bprm->interp_data = fd_binary;
	165
	166	} else {
	167	allow_write_access(bprm->file);
	168	fput(bprm->file);
	169	bprm->file = NULL;
	170	}
	171	/* make argv[1] be the path to the binary */
	172	retval = copy_strings_kernel (1, &bprm->interp, bprm);
	173	if (retval < 0)
	174	goto _error;
	175	bprm->argc++;
	176
	177	/* add the interp as argv[0] */
	178	retval = copy_strings_kernel (1, &iname_addr, bprm);
	179	if (retval < 0)
	180	goto _error;
	181	bprm->argc ++;
	182
	183	bprm->interp = iname; /* for binfmt_script */
	184
	185	interp_file = open_exec (iname);
	186	retval = PTR_ERR (interp_file);
	187	if (IS_ERR (interp_file))
	188	goto _error;
	189
	190	bprm->file = interp_file;
	191	if (fmt->flags & MISC_FMT_CREDENTIALS) {
	192	/*
	193	* No need to call prepare_binprm(), it's already been
	194	* done. bprm->buf is stale, update from interp_file.
	195	*/
	196	memset(bprm->buf, 0, BINPRM_BUF_SIZE);
	197	retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
	198	} else
	199	retval = prepare_binprm (bprm);
	200
	201	if (retval < 0)
	202	goto _error;
	203
	204	retval = search_binary_handler (bprm, regs);
	205	if (retval < 0)
	206	goto _error;
	207
	208	if (files) {
1da177e4 LT	209	put_files_struct(files);
	210	files = NULL;
	211	}
	212	_ret:
	213	return retval;
	214	_error:
	215	if (fd_binary > 0)
	216	sys_close(fd_binary);
	217	bprm->interp_flags = 0;
	218	bprm->interp_data = 0;
	219	_unshare:
3b9b8ab6 KK	220	if (files)
3b9b8ab6 KK	221	reset_files_struct(current, files);
1da177e4 LT	222	goto _ret;
	223	}
	224
	225	/* Command parsers */
	226
	227	/*
	228	* parses and copies one argument enclosed in del from sp to dp,
	229	* recognising the \x special.
	230	* returns pointer to the copied argument or NULL in case of an
	231	* error (and sets err) or null argument length.
	232	*/
	233	static char scanarg(char s, char del)
	234	{
	235	char c;
	236
	237	while ((c = *s++) != del) {
	238	if (c == '\\' && *s == 'x') {
	239	s++;
	240	if (!isxdigit(*s++))
	241	return NULL;
	242	if (!isxdigit(*s++))
	243	return NULL;
	244	}
	245	}
	246	return s;
	247	}
	248
	249	static int unquote(char *from)
	250	{
	251	char c = 0, s = from, p = from;
	252
	253	while ((c = *s++) != '\0') {
	254	if (c == '\\' && *s == 'x') {
	255	s++;
	256	c = toupper(*s++);
	257	*p = (c - (isdigit(c) ? '0' : 'A' - 10)) << 4;
	258	c = toupper(*s++);
	259	*p++ \|= c - (isdigit(c) ? '0' : 'A' - 10);
	260	continue;
	261	}
	262	*p++ = c;
	263	}
	264	return p - from;
	265	}
	266
858119e1	267	static char * check_special_flags (char * sfs, Node * e)
1da177e4 LT	268	{
	269	char * p = sfs;
	270	int cont = 1;
	271
	272	/* special flags */
	273	while (cont) {
	274	switch (*p) {
	275	case 'P':
	276	p++;
	277	e->flags \|= MISC_FMT_PRESERVE_ARGV0;
	278	break;
	279	case 'O':
	280	p++;
	281	e->flags \|= MISC_FMT_OPEN_BINARY;
	282	break;
	283	case 'C':
	284	p++;
	285	/* this flags also implies the
	286	open-binary flag */
	287	e->flags \|= (MISC_FMT_CREDENTIALS \|
	288	MISC_FMT_OPEN_BINARY);
	289	break;
	290	default:
	291	cont = 0;
	292	}
	293	}
	294
	295	return p;
	296	}
	297	/*
	298	* This registers a new binary format, it recognises the syntax
	299	* ':name:type:offset:magic:mask:interpreter:flags'
	300	* where the ':' is the IFS, that can be chosen with the first char
	301	*/
	302	static Node create_entry(const char __user buffer, size_t count)
	303	{
	304	Node *e;
	305	int memsize, err;
	306	char buf, p;
	307	char del;
	308
	309	/* some sanity checks */
	310	err = -EINVAL;
	311	if ((count < 11) \|\| (count > 256))
	312	goto out;
	313
	314	err = -ENOMEM;
	315	memsize = sizeof(Node) + count + 8;
5cbded58	316	e = kmalloc(memsize, GFP_USER);
1da177e4 LT	317	if (!e)
	318	goto out;
	319
	320	p = buf = (char *)e + sizeof(Node);
	321
	322	memset(e, 0, sizeof(Node));
	323	if (copy_from_user(buf, buffer, count))
	324	goto Efault;
	325
	326	del = p++; / delimeter */
	327
	328	memset(buf+count, del, 8);
	329
	330	e->name = p;
	331	p = strchr(p, del);
	332	if (!p)
	333	goto Einval;
	334	*p++ = '\0';
	335	if (!e->name[0] \|\|
	336	!strcmp(e->name, ".") \|\|
	337	!strcmp(e->name, "..") \|\|
	338	strchr(e->name, '/'))
	339	goto Einval;
	340	switch (*p++) {
	341	case 'E': e->flags = 1<<Enabled; break;
	342	case 'M': e->flags = (1<<Enabled) \| (1<<Magic); break;
	343	default: goto Einval;
	344	}
	345	if (*p++ != del)
	346	goto Einval;
	347	if (test_bit(Magic, &e->flags)) {
	348	char *s = strchr(p, del);
	349	if (!s)
	350	goto Einval;
	351	*s++ = '\0';
	352	e->offset = simple_strtoul(p, &p, 10);
	353	if (*p++)
	354	goto Einval;
	355	e->magic = p;
	356	p = scanarg(p, del);
	357	if (!p)
	358	goto Einval;
	359	p[-1] = '\0';
	360	if (!e->magic[0])
	361	goto Einval;
	362	e->mask = p;
	363	p = scanarg(p, del);
	364	if (!p)
	365	goto Einval;
	366	p[-1] = '\0';
	367	if (!e->mask[0])
	368	e->mask = NULL;
	369	e->size = unquote(e->magic);
	370	if (e->mask && unquote(e->mask) != e->size)
	371	goto Einval;
	372	if (e->size + e->offset > BINPRM_BUF_SIZE)
	373	goto Einval;
	374	} else {
	375	p = strchr(p, del);
	376	if (!p)
	377	goto Einval;
	378	*p++ = '\0';
	379	e->magic = p;
	380	p = strchr(p, del);
381	if (!p)
382	goto Einval;
383	*p++ = '\0';
384	if (!e->magic[0] \|\| strchr(e->magic, '/'))
385	goto Einval;
386	p = strchr(p, del);
387	if (!p)
388	goto Einval;
389	*p++ = '\0';
390	}
391	e->interpreter = p;
392	p = strchr(p, del);
393	if (!p)
394	goto Einval;
395	*p++ = '\0';
396	if (!e->interpreter[0])
397	goto Einval;
398
399
400	p = check_special_flags (p, e);
401
402	if (*p == '\n')
403	p++;
404	if (p != buf + count)
405	goto Einval;
406	return e;
407
408	out:
409	return ERR_PTR(err);
410
411	Efault:
412	kfree(e);
413	return ERR_PTR(-EFAULT);
414	Einval:
415	kfree(e);
416	return ERR_PTR(-EINVAL);
417	}
418
419	/*
420	* Set status of entry/binfmt_misc:
421	* '1' enables, '0' disables and '-1' clears entry/binfmt_misc
422	*/
423	static int parse_command(const char __user *buffer, size_t count)
424	{
425	char s[4];
426
427	if (!count)
428	return 0;
429	if (count > 3)
430	return -EINVAL;
431	if (copy_from_user(s, buffer, count))
432	return -EFAULT;
433	if (s[count-1] == '\n')
434	count--;
435	if (count == 1 && s[0] == '0')
436	return 1;
437	if (count == 1 && s[0] == '1')
438	return 2;
439	if (count == 2 && s[0] == '-' && s[1] == '1')
440	return 3;
441	return -EINVAL;
442	}
443
444	/* generic stuff */
445
446	static void entry_status(Node e, char page)
447	{
448	char *dp;
449	char *status = "disabled";
450	const char * flags = "flags: ";
451
452	if (test_bit(Enabled, &e->flags))
453	status = "enabled";
454
455	if (!VERBOSE_STATUS) {
456	sprintf(page, "%s\n", status);
457	return;
458	}
459
460	sprintf(page, "%s\ninterpreter %s\n", status, e->interpreter);
461	dp = page + strlen(page);
462
463	/* print the special flags */
464	sprintf (dp, "%s", flags);
465	dp += strlen (flags);
466	if (e->flags & MISC_FMT_PRESERVE_ARGV0) {
467	*dp ++ = 'P';
468	}
469	if (e->flags & MISC_FMT_OPEN_BINARY) {
470	*dp ++ = 'O';
471	}
472	if (e->flags & MISC_FMT_CREDENTIALS) {
473	*dp ++ = 'C';
474	}
475	*dp ++ = '\n';
476
477
478	if (!test_bit(Magic, &e->flags)) {
479	sprintf(dp, "extension .%s\n", e->magic);
480	} else {
481	int i;
482
483	sprintf(dp, "offset %i\nmagic ", e->offset);
484	dp = page + strlen(page);
485	for (i = 0; i < e->size; i++) {
486	sprintf(dp, "%02x", 0xff & (int) (e->magic[i]));
487	dp += 2;
488	}
489	if (e->mask) {
490	sprintf(dp, "\nmask ");
491	dp += 6;
492	for (i = 0; i < e->size; i++) {
493	sprintf(dp, "%02x", 0xff & (int) (e->mask[i]));
494	dp += 2;
495	}
496	}
497	*dp++ = '\n';
498	*dp = '\0';
499	}
500	}
501
502	static struct inode bm_get_inode(struct super_block sb, int mode)
503	{
504	struct inode * inode = new_inode(sb);
505
506	if (inode) {
507	inode->i_mode = mode;
508	inode->i_uid = 0;
509	inode->i_gid = 0;
1da177e4 LT	510	inode->i_blocks = 0;
	511	inode->i_atime = inode->i_mtime = inode->i_ctime =
	512	current_fs_time(inode->i_sb);
	513	}
	514	return inode;
	515	}
	516
	517	static void bm_clear_inode(struct inode *inode)
	518	{
8e18e294	519	kfree(inode->i_private);
1da177e4 LT	520	}
	521
	522	static void kill_node(Node *e)
	523	{
	524	struct dentry *dentry;
	525
	526	write_lock(&entries_lock);
	527	dentry = e->dentry;
	528	if (dentry) {
	529	list_del_init(&e->list);
	530	e->dentry = NULL;
	531	}
	532	write_unlock(&entries_lock);
	533
	534	if (dentry) {
	535	dentry->d_inode->i_nlink--;
	536	d_drop(dentry);
	537	dput(dentry);
	538	simple_release_fs(&bm_mnt, &entry_count);
	539	}
	540	}
	541
	542	/* /<entry> */
	543
	544	static ssize_t
	545	bm_entry_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
	546	{
0f7fc9e4	547	Node *e = file->f_path.dentry->d_inode->i_private;
1da177e4 LT	548	loff_t pos = *ppos;
	549	ssize_t res;
	550	char *page;
	551	int len;
	552
	553	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
	554	return -ENOMEM;
	555
	556	entry_status(e, page);
	557	len = strlen(page);
	558
	559	res = -EINVAL;
	560	if (pos < 0)
	561	goto out;
	562	res = 0;
	563	if (pos >= len)
	564	goto out;
	565	if (len < pos + nbytes)
	566	nbytes = len - pos;
	567	res = -EFAULT;
	568	if (copy_to_user(buf, page + pos, nbytes))
	569	goto out;
	570	*ppos = pos + nbytes;
	571	res = nbytes;
	572	out:
	573	free_page((unsigned long) page);
	574	return res;
	575	}
	576
	577	static ssize_t bm_entry_write(struct file file, const char __user buffer,
	578	size_t count, loff_t *ppos)
	579	{
	580	struct dentry *root;
0f7fc9e4	581	Node *e = file->f_path.dentry->d_inode->i_private;
1da177e4 LT	582	int res = parse_command(buffer, count);
	583
	584	switch (res) {
	585	case 1: clear_bit(Enabled, &e->flags);
	586	break;
	587	case 2: set_bit(Enabled, &e->flags);
	588	break;
0f7fc9e4	589	case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
1b1dcc1b	590	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	591
	592	kill_node(e);
	593
1b1dcc1b	594	mutex_unlock(&root->d_inode->i_mutex);
1da177e4 LT	595	dput(root);
	596	break;
	597	default: return res;
	598	}
	599	return count;
	600	}
	601
4b6f5d20	602	static const struct file_operations bm_entry_operations = {
1da177e4 LT	603	.read = bm_entry_read,
	604	.write = bm_entry_write,
	605	};
	606
	607	/* /register */
	608
	609	static ssize_t bm_register_write(struct file file, const char __user buffer,
	610	size_t count, loff_t *ppos)
	611	{
	612	Node *e;
	613	struct inode *inode;
	614	struct dentry root, dentry;
0f7fc9e4	615	struct super_block *sb = file->f_path.mnt->mnt_sb;
1da177e4 LT	616	int err = 0;
	617
	618	e = create_entry(buffer, count);
	619
	620	if (IS_ERR(e))
	621	return PTR_ERR(e);
	622
	623	root = dget(sb->s_root);
1b1dcc1b	624	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	625	dentry = lookup_one_len(e->name, root, strlen(e->name));
	626	err = PTR_ERR(dentry);
	627	if (IS_ERR(dentry))
	628	goto out;
	629
	630	err = -EEXIST;
	631	if (dentry->d_inode)
	632	goto out2;
	633
	634	inode = bm_get_inode(sb, S_IFREG \| 0644);
	635
	636	err = -ENOMEM;
	637	if (!inode)
	638	goto out2;
	639
1f5ce9e9	640	err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
1da177e4 LT	641	if (err) {
	642	iput(inode);
	643	inode = NULL;
	644	goto out2;
	645	}
	646
	647	e->dentry = dget(dentry);
8e18e294	648	inode->i_private = e;
1da177e4 LT	649	inode->i_fop = &bm_entry_operations;
	650
	651	d_instantiate(dentry, inode);
	652	write_lock(&entries_lock);
	653	list_add(&e->list, &entries);
	654	write_unlock(&entries_lock);
	655
	656	err = 0;
	657	out2:
	658	dput(dentry);
	659	out:
1b1dcc1b	660	mutex_unlock(&root->d_inode->i_mutex);
1da177e4 LT	661	dput(root);
	662
	663	if (err) {
	664	kfree(e);
	665	return -EINVAL;
	666	}
	667	return count;
	668	}
	669
4b6f5d20	670	static const struct file_operations bm_register_operations = {
1da177e4 LT	671	.write = bm_register_write,
	672	};
	673
	674	/* /status */
	675
	676	static ssize_t
	677	bm_status_read(struct file file, char __user buf, size_t nbytes, loff_t *ppos)
	678	{
	679	char *s = enabled ? "enabled" : "disabled";
1da177e4	680
92f4c701	681	return simple_read_from_buffer(buf, nbytes, ppos, s, strlen(s));
1da177e4 LT	682	}
	683
	684	static ssize_t bm_status_write(struct file * file, const char __user * buffer,
	685	size_t count, loff_t *ppos)
	686	{
	687	int res = parse_command(buffer, count);
	688	struct dentry *root;
	689
	690	switch (res) {
	691	case 1: enabled = 0; break;
	692	case 2: enabled = 1; break;
0f7fc9e4	693	case 3: root = dget(file->f_path.mnt->mnt_sb->s_root);
1b1dcc1b	694	mutex_lock(&root->d_inode->i_mutex);
1da177e4 LT	695
	696	while (!list_empty(&entries))
	697	kill_node(list_entry(entries.next, Node, list));
	698
1b1dcc1b	699	mutex_unlock(&root->d_inode->i_mutex);
1da177e4 LT	700	dput(root);
	701	default: return res;
	702	}
	703	return count;
	704	}
	705
4b6f5d20	706	static const struct file_operations bm_status_operations = {
1da177e4 LT	707	.read = bm_status_read,
	708	.write = bm_status_write,
	709	};
	710
	711	/* Superblock handling */
	712
ee9b6d61	713	static const struct super_operations s_ops = {
1da177e4 LT	714	.statfs = simple_statfs,
	715	.clear_inode = bm_clear_inode,
	716	};
	717
	718	static int bm_fill_super(struct super_block * sb, void * data, int silent)
	719	{
	720	static struct tree_descr bm_files[] = {
1a1c9bb4 JL	721	[2] = {"status", &bm_status_operations, S_IWUSR\|S_IRUGO},
1a1c9bb4 JL	722	[3] = {"register", &bm_register_operations, S_IWUSR},
1da177e4 LT	723	/* last one */ {""}
	724	};
	725	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
	726	if (!err)
	727	sb->s_op = &s_ops;
	728	return err;
	729	}
	730
454e2398 DH	731	static int bm_get_sb(struct file_system_type *fs_type,
454e2398 DH	732	int flags, const char dev_name, void data, struct vfsmount *mnt)
1da177e4	733	{
454e2398	734	return get_sb_single(fs_type, flags, data, bm_fill_super, mnt);
1da177e4 LT	735	}
	736
	737	static struct linux_binfmt misc_format = {
	738	.module = THIS_MODULE,
	739	.load_binary = load_misc_binary,
	740	};
	741
	742	static struct file_system_type bm_fs_type = {
	743	.owner = THIS_MODULE,
	744	.name = "binfmt_misc",
	745	.get_sb = bm_get_sb,
	746	.kill_sb = kill_litter_super,
	747	};
	748
	749	static int __init init_misc_binfmt(void)
	750	{
	751	int err = register_filesystem(&bm_fs_type);
	752	if (!err) {
	753	err = register_binfmt(&misc_format);
	754	if (err)
	755	unregister_filesystem(&bm_fs_type);
	756	}
	757	return err;
	758	}
	759
	760	static void __exit exit_misc_binfmt(void)
	761	{
	762	unregister_binfmt(&misc_format);
	763	unregister_filesystem(&bm_fs_type);
	764	}
	765
	766	core_initcall(init_misc_binfmt);
	767	module_exit(exit_misc_binfmt);
	768	MODULE_LICENSE("GPL");