1 /* $NetBSD: kern_exec.c,v 1.421 2015/10/22 11:48:02 maxv Exp $ */ 2 3 /*- 4 * Copyright (c) 2008 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /*- 30 * Copyright (C) 1993, 1994, 1996 Christopher G. Demetriou 31 * Copyright (C) 1992 Wolfgang Solfrank. 32 * Copyright (C) 1992 TooLs GmbH. 33 * All rights reserved. 34 * 35 * Redistribution and use in source and binary forms, with or without 36 * modification, are permitted provided that the following conditions 37 * are met: 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. All advertising materials mentioning features or use of this software 44 * must display the following acknowledgement: 45 * This product includes software developed by TooLs GmbH. 46 * 4. The name of TooLs GmbH may not be used to endorse or promote products 47 * derived from this software without specific prior written permission. 48 * 49 * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR 50 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 51 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 52 * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 53 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 54 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 55 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 56 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 57 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 58 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 59 */ 60 61 #include <sys/cdefs.h> 62 __KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.421 2015/10/22 11:48:02 maxv Exp $"); 63 64 #include "opt_exec.h" 65 #include "opt_execfmt.h" 66 #include "opt_ktrace.h" 67 #include "opt_modular.h" 68 #include "opt_syscall_debug.h" 69 #include "veriexec.h" 70 #include "opt_pax.h" 71 72 #include <sys/param.h> 73 #include <sys/systm.h> 74 #include <sys/filedesc.h> 75 #include <sys/kernel.h> 76 #include <sys/proc.h> 77 #include <sys/mount.h> 78 #include <sys/kmem.h> 79 #include <sys/namei.h> 80 #include <sys/vnode.h> 81 #include <sys/file.h> 82 #include <sys/filedesc.h> 83 #include <sys/acct.h> 84 #include <sys/atomic.h> 85 #include <sys/exec.h> 86 #include <sys/ktrace.h> 87 #include <sys/uidinfo.h> 88 #include <sys/wait.h> 89 #include <sys/mman.h> 90 #include <sys/ras.h> 91 #include <sys/signalvar.h> 92 #include <sys/stat.h> 93 #include <sys/syscall.h> 94 #include <sys/kauth.h> 95 #include <sys/lwpctl.h> 96 #include <sys/pax.h> 97 #include <sys/cpu.h> 98 #include <sys/module.h> 99 #include <sys/syscallvar.h> 100 #include <sys/syscallargs.h> 101 #if NVERIEXEC > 0 102 #include <sys/verified_exec.h> 103 #endif /* NVERIEXEC > 0 */ 104 #include <sys/sdt.h> 105 #include <sys/spawn.h> 106 #include <sys/prot.h> 107 #include <sys/cprng.h> 108 109 #include <uvm/uvm_extern.h> 110 111 #include <machine/reg.h> 112 113 #include <compat/common/compat_util.h> 114 115 #ifndef MD_TOPDOWN_INIT 116 #ifdef __USE_TOPDOWN_VM 117 #define MD_TOPDOWN_INIT(epp) (epp)->ep_flags |= EXEC_TOPDOWN_VM 118 #else 119 #define MD_TOPDOWN_INIT(epp) 120 #endif 121 #endif 122 123 struct execve_data; 124 125 static size_t calcargs(struct execve_data * restrict, const size_t); 126 static size_t calcstack(struct execve_data * restrict, const size_t); 127 static int copyoutargs(struct execve_data * restrict, struct lwp *, 128 char * const); 129 static int copyoutpsstrs(struct execve_data * restrict, struct proc *); 130 static int copyinargs(struct execve_data * restrict, char * const *, 131 char * const *, execve_fetch_element_t, char **); 132 static int copyinargstrs(struct execve_data * restrict, char * const *, 133 execve_fetch_element_t, char **, size_t *, void (*)(const void *, size_t)); 134 static int exec_sigcode_map(struct proc *, const struct emul *); 135 136 #ifdef DEBUG_EXEC 137 #define DPRINTF(a) printf a 138 #define COPYPRINTF(s, a, b) printf("%s, %d: copyout%s @%p %zu\n", __func__, \ 139 __LINE__, (s), (a), (b)) 140 static void dump_vmcmds(const struct exec_package * const, size_t, int); 141 #define DUMPVMCMDS(p, x, e) do { dump_vmcmds((p), (x), (e)); } while (0) 142 #else 143 #define DPRINTF(a) 144 #define COPYPRINTF(s, a, b) 145 #define DUMPVMCMDS(p, x, e) do {} while (0) 146 #endif /* DEBUG_EXEC */ 147 148 /* 149 * DTrace SDT provider definitions 150 */ 151 SDT_PROVIDER_DECLARE(proc); 152 SDT_PROBE_DEFINE1(proc, kernel, , exec, "char *"); 153 SDT_PROBE_DEFINE1(proc, kernel, , exec__success, "char *"); 154 SDT_PROBE_DEFINE1(proc, kernel, , exec__failure, "int"); 155 156 /* 157 * Exec function switch: 158 * 159 * Note that each makecmds function is responsible for loading the 160 * exec package with the necessary functions for any exec-type-specific 161 * handling. 162 * 163 * Functions for specific exec types should be defined in their own 164 * header file. 165 */ 166 static const struct execsw **execsw = NULL; 167 static int nexecs; 168 169 u_int exec_maxhdrsz; /* must not be static - used by netbsd32 */ 170 171 /* list of dynamically loaded execsw entries */ 172 static LIST_HEAD(execlist_head, exec_entry) ex_head = 173 LIST_HEAD_INITIALIZER(ex_head); 174 struct exec_entry { 175 LIST_ENTRY(exec_entry) ex_list; 176 SLIST_ENTRY(exec_entry) ex_slist; 177 const struct execsw *ex_sw; 178 }; 179 180 #ifndef __HAVE_SYSCALL_INTERN 181 void syscall(void); 182 #endif 183 184 /* NetBSD emul struct */ 185 struct emul emul_netbsd = { 186 .e_name = "netbsd", 187 #ifdef EMUL_NATIVEROOT 188 .e_path = EMUL_NATIVEROOT, 189 #else 190 .e_path = NULL, 191 #endif 192 #ifndef __HAVE_MINIMAL_EMUL 193 .e_flags = EMUL_HAS_SYS___syscall, 194 .e_errno = NULL, 195 .e_nosys = SYS_syscall, 196 .e_nsysent = SYS_NSYSENT, 197 #endif 198 .e_sysent = sysent, 199 #ifdef SYSCALL_DEBUG 200 .e_syscallnames = syscallnames, 201 #else 202 .e_syscallnames = NULL, 203 #endif 204 .e_sendsig = sendsig, 205 .e_trapsignal = trapsignal, 206 .e_tracesig = NULL, 207 .e_sigcode = NULL, 208 .e_esigcode = NULL, 209 .e_sigobject = NULL, 210 .e_setregs = setregs, 211 .e_proc_exec = NULL, 212 .e_proc_fork = NULL, 213 .e_proc_exit = NULL, 214 .e_lwp_fork = NULL, 215 .e_lwp_exit = NULL, 216 #ifdef __HAVE_SYSCALL_INTERN 217 .e_syscall_intern = syscall_intern, 218 #else 219 .e_syscall = syscall, 220 #endif 221 .e_sysctlovly = NULL, 222 .e_fault = NULL, 223 .e_vm_default_addr = uvm_default_mapaddr, 224 .e_usertrap = NULL, 225 .e_ucsize = sizeof(ucontext_t), 226 .e_startlwp = startlwp 227 }; 228 229 /* 230 * Exec lock. Used to control access to execsw[] structures. 231 * This must not be static so that netbsd32 can access it, too. 232 */ 233 krwlock_t exec_lock; 234 235 static kmutex_t sigobject_lock; 236 237 /* 238 * Data used between a loadvm and execve part of an "exec" operation 239 */ 240 struct execve_data { 241 struct exec_package ed_pack; 242 struct pathbuf *ed_pathbuf; 243 struct vattr ed_attr; 244 struct ps_strings ed_arginfo; 245 char *ed_argp; 246 const char *ed_pathstring; 247 char *ed_resolvedpathbuf; 248 size_t ed_ps_strings_sz; 249 int ed_szsigcode; 250 size_t ed_argslen; 251 long ed_argc; 252 long ed_envc; 253 }; 254 255 /* 256 * data passed from parent lwp to child during a posix_spawn() 257 */ 258 struct spawn_exec_data { 259 struct execve_data sed_exec; 260 struct posix_spawn_file_actions 261 *sed_actions; 262 struct posix_spawnattr *sed_attrs; 263 struct proc *sed_parent; 264 kcondvar_t sed_cv_child_ready; 265 kmutex_t sed_mtx_child; 266 int sed_error; 267 volatile uint32_t sed_refcnt; 268 }; 269 270 static void * 271 exec_pool_alloc(struct pool *pp, int flags) 272 { 273 274 return (void *)uvm_km_alloc(kernel_map, NCARGS, 0, 275 UVM_KMF_PAGEABLE | UVM_KMF_WAITVA); 276 } 277 278 static void 279 exec_pool_free(struct pool *pp, void *addr) 280 { 281 282 uvm_km_free(kernel_map, (vaddr_t)addr, NCARGS, UVM_KMF_PAGEABLE); 283 } 284 285 static struct pool exec_pool; 286 287 static struct pool_allocator exec_palloc = { 288 .pa_alloc = exec_pool_alloc, 289 .pa_free = exec_pool_free, 290 .pa_pagesz = NCARGS 291 }; 292 293 /* 294 * check exec: 295 * given an "executable" described in the exec package's namei info, 296 * see what we can do with it. 297 * 298 * ON ENTRY: 299 * exec package with appropriate namei info 300 * lwp pointer of exec'ing lwp 301 * NO SELF-LOCKED VNODES 302 * 303 * ON EXIT: 304 * error: nothing held, etc. exec header still allocated. 305 * ok: filled exec package, executable's vnode (unlocked). 306 * 307 * EXEC SWITCH ENTRY: 308 * Locked vnode to check, exec package, proc. 309 * 310 * EXEC SWITCH EXIT: 311 * ok: return 0, filled exec package, executable's vnode (unlocked). 312 * error: destructive: 313 * everything deallocated execept exec header. 314 * non-destructive: 315 * error code, executable's vnode (unlocked), 316 * exec header unmodified. 317 */ 318 int 319 /*ARGSUSED*/ 320 check_exec(struct lwp *l, struct exec_package *epp, struct pathbuf *pb) 321 { 322 int error, i; 323 struct vnode *vp; 324 struct nameidata nd; 325 size_t resid; 326 327 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | TRYEMULROOT, pb); 328 329 /* first get the vnode */ 330 if ((error = namei(&nd)) != 0) 331 return error; 332 epp->ep_vp = vp = nd.ni_vp; 333 /* normally this can't fail */ 334 error = copystr(nd.ni_pnbuf, epp->ep_resolvedname, PATH_MAX, NULL); 335 KASSERT(error == 0); 336 337 #ifdef DIAGNOSTIC 338 /* paranoia (take this out once namei stuff stabilizes) */ 339 memset(nd.ni_pnbuf, '~', PATH_MAX); 340 #endif 341 342 /* check access and type */ 343 if (vp->v_type != VREG) { 344 error = EACCES; 345 goto bad1; 346 } 347 if ((error = VOP_ACCESS(vp, VEXEC, l->l_cred)) != 0) 348 goto bad1; 349 350 /* get attributes */ 351 if ((error = VOP_GETATTR(vp, epp->ep_vap, l->l_cred)) != 0) 352 goto bad1; 353 354 /* Check mount point */ 355 if (vp->v_mount->mnt_flag & MNT_NOEXEC) { 356 error = EACCES; 357 goto bad1; 358 } 359 if (vp->v_mount->mnt_flag & MNT_NOSUID) 360 epp->ep_vap->va_mode &= ~(S_ISUID | S_ISGID); 361 362 /* try to open it */ 363 if ((error = VOP_OPEN(vp, FREAD, l->l_cred)) != 0) 364 goto bad1; 365 366 /* unlock vp, since we need it unlocked from here on out. */ 367 VOP_UNLOCK(vp); 368 369 #if NVERIEXEC > 0 370 error = veriexec_verify(l, vp, epp->ep_resolvedname, 371 epp->ep_flags & EXEC_INDIR ? VERIEXEC_INDIRECT : VERIEXEC_DIRECT, 372 NULL); 373 if (error) 374 goto bad2; 375 #endif /* NVERIEXEC > 0 */ 376 377 #ifdef PAX_SEGVGUARD 378 error = pax_segvguard(l, vp, epp->ep_resolvedname, false); 379 if (error) 380 goto bad2; 381 #endif /* PAX_SEGVGUARD */ 382 383 /* now we have the file, get the exec header */ 384 error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0, 385 UIO_SYSSPACE, 0, l->l_cred, &resid, NULL); 386 if (error) 387 goto bad2; 388 epp->ep_hdrvalid = epp->ep_hdrlen - resid; 389 390 /* 391 * Set up default address space limits. Can be overridden 392 * by individual exec packages. 393 * 394 * XXX probably should be all done in the exec packages. 395 */ 396 epp->ep_vm_minaddr = VM_MIN_ADDRESS; 397 epp->ep_vm_maxaddr = VM_MAXUSER_ADDRESS; 398 /* 399 * set up the vmcmds for creation of the process 400 * address space 401 */ 402 error = ENOEXEC; 403 for (i = 0; i < nexecs; i++) { 404 int newerror; 405 406 epp->ep_esch = execsw[i]; 407 newerror = (*execsw[i]->es_makecmds)(l, epp); 408 409 if (!newerror) { 410 /* Seems ok: check that entry point is not too high */ 411 if (epp->ep_entry > epp->ep_vm_maxaddr) { 412 #ifdef DIAGNOSTIC 413 printf("%s: rejecting %p due to " 414 "too high entry address (> %p)\n", 415 __func__, (void *)epp->ep_entry, 416 (void *)epp->ep_vm_maxaddr); 417 #endif 418 error = ENOEXEC; 419 break; 420 } 421 /* Seems ok: check that entry point is not too low */ 422 if (epp->ep_entry < epp->ep_vm_minaddr) { 423 #ifdef DIAGNOSTIC 424 printf("%s: rejecting %p due to " 425 "too low entry address (< %p)\n", 426 __func__, (void *)epp->ep_entry, 427 (void *)epp->ep_vm_minaddr); 428 #endif 429 error = ENOEXEC; 430 break; 431 } 432 433 /* check limits */ 434 if ((epp->ep_tsize > MAXTSIZ) || 435 (epp->ep_dsize > (u_quad_t)l->l_proc->p_rlimit 436 [RLIMIT_DATA].rlim_cur)) { 437 #ifdef DIAGNOSTIC 438 printf("%s: rejecting due to " 439 "limits (t=%llu > %llu || d=%llu > %llu)\n", 440 __func__, 441 (unsigned long long)epp->ep_tsize, 442 (unsigned long long)MAXTSIZ, 443 (unsigned long long)epp->ep_dsize, 444 (unsigned long long) 445 l->l_proc->p_rlimit[RLIMIT_DATA].rlim_cur); 446 #endif 447 error = ENOMEM; 448 break; 449 } 450 return 0; 451 } 452 453 /* 454 * Reset all the fields that may have been modified by the 455 * loader. 456 */ 457 KASSERT(epp->ep_emul_arg == NULL); 458 if (epp->ep_emul_root != NULL) { 459 vrele(epp->ep_emul_root); 460 epp->ep_emul_root = NULL; 461 } 462 if (epp->ep_interp != NULL) { 463 vrele(epp->ep_interp); 464 epp->ep_interp = NULL; 465 } 466 epp->ep_pax_flags = 0; 467 468 /* make sure the first "interesting" error code is saved. */ 469 if (error == ENOEXEC) 470 error = newerror; 471 472 if (epp->ep_flags & EXEC_DESTR) 473 /* Error from "#!" code, tidied up by recursive call */ 474 return error; 475 } 476 477 /* not found, error */ 478 479 /* 480 * free any vmspace-creation commands, 481 * and release their references 482 */ 483 kill_vmcmds(&epp->ep_vmcmds); 484 485 bad2: 486 /* 487 * close and release the vnode, restore the old one, free the 488 * pathname buf, and punt. 489 */ 490 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 491 VOP_CLOSE(vp, FREAD, l->l_cred); 492 vput(vp); 493 return error; 494 495 bad1: 496 /* 497 * free the namei pathname buffer, and put the vnode 498 * (which we don't yet have open). 499 */ 500 vput(vp); /* was still locked */ 501 return error; 502 } 503 504 #ifdef __MACHINE_STACK_GROWS_UP 505 #define STACK_PTHREADSPACE NBPG 506 #else 507 #define STACK_PTHREADSPACE 0 508 #endif 509 510 static int 511 execve_fetch_element(char * const *array, size_t index, char **value) 512 { 513 return copyin(array + index, value, sizeof(*value)); 514 } 515 516 /* 517 * exec system call 518 */ 519 int 520 sys_execve(struct lwp *l, const struct sys_execve_args *uap, register_t *retval) 521 { 522 /* { 523 syscallarg(const char *) path; 524 syscallarg(char * const *) argp; 525 syscallarg(char * const *) envp; 526 } */ 527 528 return execve1(l, SCARG(uap, path), SCARG(uap, argp), 529 SCARG(uap, envp), execve_fetch_element); 530 } 531 532 int 533 sys_fexecve(struct lwp *l, const struct sys_fexecve_args *uap, 534 register_t *retval) 535 { 536 /* { 537 syscallarg(int) fd; 538 syscallarg(char * const *) argp; 539 syscallarg(char * const *) envp; 540 } */ 541 542 return ENOSYS; 543 } 544 545 /* 546 * Load modules to try and execute an image that we do not understand. 547 * If no execsw entries are present, we load those likely to be needed 548 * in order to run native images only. Otherwise, we autoload all 549 * possible modules that could let us run the binary. XXX lame 550 */ 551 static void 552 exec_autoload(void) 553 { 554 #ifdef MODULAR 555 static const char * const native[] = { 556 "exec_elf32", 557 "exec_elf64", 558 "exec_script", 559 NULL 560 }; 561 static const char * const compat[] = { 562 "exec_elf32", 563 "exec_elf64", 564 "exec_script", 565 "exec_aout", 566 "exec_coff", 567 "exec_ecoff", 568 "compat_aoutm68k", 569 "compat_freebsd", 570 "compat_ibcs2", 571 "compat_linux", 572 "compat_linux32", 573 "compat_netbsd32", 574 "compat_sunos", 575 "compat_sunos32", 576 "compat_svr4", 577 "compat_svr4_32", 578 "compat_ultrix", 579 NULL 580 }; 581 char const * const *list; 582 int i; 583 584 list = (nexecs == 0 ? native : compat); 585 for (i = 0; list[i] != NULL; i++) { 586 if (module_autoload(list[i], MODULE_CLASS_EXEC) != 0) { 587 continue; 588 } 589 yield(); 590 } 591 #endif 592 } 593 594 static int 595 makepathbuf(struct lwp *l, const char *upath, struct pathbuf **pbp, 596 size_t *offs) 597 { 598 char *path, *bp; 599 size_t len, tlen; 600 int error; 601 struct cwdinfo *cwdi; 602 603 path = PNBUF_GET(); 604 error = copyinstr(upath, path, MAXPATHLEN, &len); 605 if (error) { 606 PNBUF_PUT(path); 607 DPRINTF(("%s: copyin path @%p %d\n", __func__, upath, error)); 608 return error; 609 } 610 611 if (path[0] == '/') { 612 *offs = 0; 613 goto out; 614 } 615 616 len++; 617 if (len + 1 >= MAXPATHLEN) 618 goto out; 619 bp = path + MAXPATHLEN - len; 620 memmove(bp, path, len); 621 *(--bp) = '/'; 622 623 cwdi = l->l_proc->p_cwdi; 624 rw_enter(&cwdi->cwdi_lock, RW_READER); 625 error = getcwd_common(cwdi->cwdi_cdir, NULL, &bp, path, MAXPATHLEN / 2, 626 GETCWD_CHECK_ACCESS, l); 627 rw_exit(&cwdi->cwdi_lock); 628 629 if (error) { 630 DPRINTF(("%s: getcwd_common path %s %d\n", __func__, path, 631 error)); 632 goto out; 633 } 634 tlen = path + MAXPATHLEN - bp; 635 636 memmove(path, bp, tlen); 637 path[tlen] = '\0'; 638 *offs = tlen - len; 639 out: 640 *pbp = pathbuf_assimilate(path); 641 return 0; 642 } 643 644 static int 645 execve_loadvm(struct lwp *l, const char *path, char * const *args, 646 char * const *envs, execve_fetch_element_t fetch_element, 647 struct execve_data * restrict data) 648 { 649 struct exec_package * const epp = &data->ed_pack; 650 int error; 651 struct proc *p; 652 char *dp; 653 u_int modgen; 654 size_t offs = 0; // XXX: GCC 655 656 KASSERT(data != NULL); 657 658 p = l->l_proc; 659 modgen = 0; 660 661 SDT_PROBE(proc, kernel, , exec, path, 0, 0, 0, 0); 662 663 /* 664 * Check if we have exceeded our number of processes limit. 665 * This is so that we handle the case where a root daemon 666 * forked, ran setuid to become the desired user and is trying 667 * to exec. The obvious place to do the reference counting check 668 * is setuid(), but we don't do the reference counting check there 669 * like other OS's do because then all the programs that use setuid() 670 * must be modified to check the return code of setuid() and exit(). 671 * It is dangerous to make setuid() fail, because it fails open and 672 * the program will continue to run as root. If we make it succeed 673 * and return an error code, again we are not enforcing the limit. 674 * The best place to enforce the limit is here, when the process tries 675 * to execute a new image, because eventually the process will need 676 * to call exec in order to do something useful. 677 */ 678 retry: 679 if (p->p_flag & PK_SUGID) { 680 if (kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT, 681 p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_BYPASS), 682 &p->p_rlimit[RLIMIT_NPROC], 683 KAUTH_ARG(RLIMIT_NPROC)) != 0 && 684 chgproccnt(kauth_cred_getuid(l->l_cred), 0) > 685 p->p_rlimit[RLIMIT_NPROC].rlim_cur) 686 return EAGAIN; 687 } 688 689 /* 690 * Drain existing references and forbid new ones. The process 691 * should be left alone until we're done here. This is necessary 692 * to avoid race conditions - e.g. in ptrace() - that might allow 693 * a local user to illicitly obtain elevated privileges. 694 */ 695 rw_enter(&p->p_reflock, RW_WRITER); 696 697 /* 698 * Init the namei data to point the file user's program name. 699 * This is done here rather than in check_exec(), so that it's 700 * possible to override this settings if any of makecmd/probe 701 * functions call check_exec() recursively - for example, 702 * see exec_script_makecmds(). 703 */ 704 if ((error = makepathbuf(l, path, &data->ed_pathbuf, &offs)) != 0) 705 goto clrflg; 706 data->ed_pathstring = pathbuf_stringcopy_get(data->ed_pathbuf); 707 data->ed_resolvedpathbuf = PNBUF_GET(); 708 709 /* 710 * initialize the fields of the exec package. 711 */ 712 epp->ep_kname = data->ed_pathstring + offs; 713 epp->ep_resolvedname = data->ed_resolvedpathbuf; 714 epp->ep_hdr = kmem_alloc(exec_maxhdrsz, KM_SLEEP); 715 epp->ep_hdrlen = exec_maxhdrsz; 716 epp->ep_hdrvalid = 0; 717 epp->ep_emul_arg = NULL; 718 epp->ep_emul_arg_free = NULL; 719 memset(&epp->ep_vmcmds, 0, sizeof(epp->ep_vmcmds)); 720 epp->ep_vap = &data->ed_attr; 721 epp->ep_flags = (p->p_flag & PK_32) ? EXEC_FROM32 : 0; 722 MD_TOPDOWN_INIT(epp); 723 epp->ep_emul_root = NULL; 724 epp->ep_interp = NULL; 725 epp->ep_esch = NULL; 726 epp->ep_pax_flags = 0; 727 memset(epp->ep_machine_arch, 0, sizeof(epp->ep_machine_arch)); 728 729 rw_enter(&exec_lock, RW_READER); 730 731 /* see if we can run it. */ 732 if ((error = check_exec(l, epp, data->ed_pathbuf)) != 0) { 733 if (error != ENOENT) { 734 DPRINTF(("%s: check exec failed %d\n", 735 __func__, error)); 736 } 737 goto freehdr; 738 } 739 740 /* allocate an argument buffer */ 741 data->ed_argp = pool_get(&exec_pool, PR_WAITOK); 742 KASSERT(data->ed_argp != NULL); 743 dp = data->ed_argp; 744 745 if ((error = copyinargs(data, args, envs, fetch_element, &dp)) != 0) { 746 goto bad; 747 } 748 749 /* 750 * Calculate the new stack size. 751 */ 752 753 #ifdef PAX_ASLR 754 #define ASLR_GAP(epp) (pax_aslr_epp_active(epp) ? (cprng_fast32() % PAGE_SIZE) : 0) 755 #else 756 #define ASLR_GAP(epp) 0 757 #endif 758 759 #ifdef __MACHINE_STACK_GROWS_UP 760 /* 761 * copyargs() fills argc/argv/envp from the lower address even on 762 * __MACHINE_STACK_GROWS_UP machines. Reserve a few words just below the SP 763 * so that _rtld() use it. 764 */ 765 #define RTLD_GAP 32 766 #else 767 #define RTLD_GAP 0 768 #endif 769 770 const size_t argenvstrlen = (char *)ALIGN(dp) - data->ed_argp; 771 772 data->ed_argslen = calcargs(data, argenvstrlen); 773 774 const size_t len = calcstack(data, ASLR_GAP(epp) + RTLD_GAP); 775 776 if (len > epp->ep_ssize) { 777 /* in effect, compare to initial limit */ 778 DPRINTF(("%s: stack limit exceeded %zu\n", __func__, len)); 779 error = ENOMEM; 780 goto bad; 781 } 782 /* adjust "active stack depth" for process VSZ */ 783 epp->ep_ssize = len; 784 785 return 0; 786 787 bad: 788 /* free the vmspace-creation commands, and release their references */ 789 kill_vmcmds(&epp->ep_vmcmds); 790 /* kill any opened file descriptor, if necessary */ 791 if (epp->ep_flags & EXEC_HASFD) { 792 epp->ep_flags &= ~EXEC_HASFD; 793 fd_close(epp->ep_fd); 794 } 795 /* close and put the exec'd file */ 796 vn_lock(epp->ep_vp, LK_EXCLUSIVE | LK_RETRY); 797 VOP_CLOSE(epp->ep_vp, FREAD, l->l_cred); 798 vput(epp->ep_vp); 799 pool_put(&exec_pool, data->ed_argp); 800 801 freehdr: 802 kmem_free(epp->ep_hdr, epp->ep_hdrlen); 803 if (epp->ep_emul_root != NULL) 804 vrele(epp->ep_emul_root); 805 if (epp->ep_interp != NULL) 806 vrele(epp->ep_interp); 807 808 rw_exit(&exec_lock); 809 810 pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring); 811 pathbuf_destroy(data->ed_pathbuf); 812 PNBUF_PUT(data->ed_resolvedpathbuf); 813 814 clrflg: 815 rw_exit(&p->p_reflock); 816 817 if (modgen != module_gen && error == ENOEXEC) { 818 modgen = module_gen; 819 exec_autoload(); 820 goto retry; 821 } 822 823 SDT_PROBE(proc, kernel, , exec__failure, error, 0, 0, 0, 0); 824 return error; 825 } 826 827 static int 828 execve_dovmcmds(struct lwp *l, struct execve_data * restrict data) 829 { 830 struct exec_package * const epp = &data->ed_pack; 831 struct proc *p = l->l_proc; 832 struct exec_vmcmd *base_vcp; 833 int error = 0; 834 size_t i; 835 836 /* record proc's vnode, for use by procfs and others */ 837 if (p->p_textvp) 838 vrele(p->p_textvp); 839 vref(epp->ep_vp); 840 p->p_textvp = epp->ep_vp; 841 842 /* create the new process's VM space by running the vmcmds */ 843 KASSERTMSG(epp->ep_vmcmds.evs_used != 0, "%s: no vmcmds", __func__); 844 845 DUMPVMCMDS(epp, 0, 0); 846 847 base_vcp = NULL; 848 849 for (i = 0; i < epp->ep_vmcmds.evs_used && !error; i++) { 850 struct exec_vmcmd *vcp; 851 852 vcp = &epp->ep_vmcmds.evs_cmds[i]; 853 if (vcp->ev_flags & VMCMD_RELATIVE) { 854 KASSERTMSG(base_vcp != NULL, 855 "%s: relative vmcmd with no base", __func__); 856 KASSERTMSG((vcp->ev_flags & VMCMD_BASE) == 0, 857 "%s: illegal base & relative vmcmd", __func__); 858 vcp->ev_addr += base_vcp->ev_addr; 859 } 860 error = (*vcp->ev_proc)(l, vcp); 861 if (error) 862 DUMPVMCMDS(epp, i, error); 863 if (vcp->ev_flags & VMCMD_BASE) 864 base_vcp = vcp; 865 } 866 867 /* free the vmspace-creation commands, and release their references */ 868 kill_vmcmds(&epp->ep_vmcmds); 869 870 vn_lock(epp->ep_vp, LK_EXCLUSIVE | LK_RETRY); 871 VOP_CLOSE(epp->ep_vp, FREAD, l->l_cred); 872 vput(epp->ep_vp); 873 874 /* if an error happened, deallocate and punt */ 875 if (error != 0) { 876 DPRINTF(("%s: vmcmd %zu failed: %d\n", __func__, i - 1, error)); 877 } 878 return error; 879 } 880 881 static void 882 execve_free_data(struct execve_data *data) 883 { 884 struct exec_package * const epp = &data->ed_pack; 885 886 /* free the vmspace-creation commands, and release their references */ 887 kill_vmcmds(&epp->ep_vmcmds); 888 /* kill any opened file descriptor, if necessary */ 889 if (epp->ep_flags & EXEC_HASFD) { 890 epp->ep_flags &= ~EXEC_HASFD; 891 fd_close(epp->ep_fd); 892 } 893 894 /* close and put the exec'd file */ 895 vn_lock(epp->ep_vp, LK_EXCLUSIVE | LK_RETRY); 896 VOP_CLOSE(epp->ep_vp, FREAD, curlwp->l_cred); 897 vput(epp->ep_vp); 898 pool_put(&exec_pool, data->ed_argp); 899 900 kmem_free(epp->ep_hdr, epp->ep_hdrlen); 901 if (epp->ep_emul_root != NULL) 902 vrele(epp->ep_emul_root); 903 if (epp->ep_interp != NULL) 904 vrele(epp->ep_interp); 905 906 pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring); 907 pathbuf_destroy(data->ed_pathbuf); 908 PNBUF_PUT(data->ed_resolvedpathbuf); 909 } 910 911 static void 912 pathexec(struct exec_package *epp, struct proc *p, const char *pathstring) 913 { 914 const char *commandname; 915 size_t commandlen; 916 char *path; 917 918 /* set command name & other accounting info */ 919 commandname = strrchr(epp->ep_resolvedname, '/'); 920 if (commandname != NULL) { 921 commandname++; 922 } else { 923 commandname = epp->ep_resolvedname; 924 } 925 commandlen = min(strlen(commandname), MAXCOMLEN); 926 (void)memcpy(p->p_comm, commandname, commandlen); 927 p->p_comm[commandlen] = '\0'; 928 929 930 /* 931 * If the path starts with /, we don't need to do any work. 932 * This handles the majority of the cases. 933 * In the future perhaps we could canonicalize it? 934 */ 935 if (pathstring[0] == '/') { 936 path = PNBUF_GET(); 937 (void)strlcpy(path, pathstring, MAXPATHLEN); 938 epp->ep_path = path; 939 } else 940 epp->ep_path = NULL; 941 } 942 943 /* XXX elsewhere */ 944 static int 945 credexec(struct lwp *l, struct vattr *attr) 946 { 947 struct proc *p = l->l_proc; 948 int error; 949 950 /* 951 * Deal with set[ug]id. MNT_NOSUID has already been used to disable 952 * s[ug]id. It's OK to check for PSL_TRACED here as we have blocked 953 * out additional references on the process for the moment. 954 */ 955 if ((p->p_slflag & PSL_TRACED) == 0 && 956 957 (((attr->va_mode & S_ISUID) != 0 && 958 kauth_cred_geteuid(l->l_cred) != attr->va_uid) || 959 960 ((attr->va_mode & S_ISGID) != 0 && 961 kauth_cred_getegid(l->l_cred) != attr->va_gid))) { 962 /* 963 * Mark the process as SUGID before we do 964 * anything that might block. 965 */ 966 proc_crmod_enter(); 967 proc_crmod_leave(NULL, NULL, true); 968 969 /* Make sure file descriptors 0..2 are in use. */ 970 if ((error = fd_checkstd()) != 0) { 971 DPRINTF(("%s: fdcheckstd failed %d\n", 972 __func__, error)); 973 return error; 974 } 975 976 /* 977 * Copy the credential so other references don't see our 978 * changes. 979 */ 980 l->l_cred = kauth_cred_copy(l->l_cred); 981 #ifdef KTRACE 982 /* 983 * If the persistent trace flag isn't set, turn off. 984 */ 985 if (p->p_tracep) { 986 mutex_enter(&ktrace_lock); 987 if (!(p->p_traceflag & KTRFAC_PERSISTENT)) 988 ktrderef(p); 989 mutex_exit(&ktrace_lock); 990 } 991 #endif 992 if (attr->va_mode & S_ISUID) 993 kauth_cred_seteuid(l->l_cred, attr->va_uid); 994 if (attr->va_mode & S_ISGID) 995 kauth_cred_setegid(l->l_cred, attr->va_gid); 996 } else { 997 if (kauth_cred_geteuid(l->l_cred) == 998 kauth_cred_getuid(l->l_cred) && 999 kauth_cred_getegid(l->l_cred) == 1000 kauth_cred_getgid(l->l_cred)) 1001 p->p_flag &= ~PK_SUGID; 1002 } 1003 1004 /* 1005 * Copy the credential so other references don't see our changes. 1006 * Test to see if this is necessary first, since in the common case 1007 * we won't need a private reference. 1008 */ 1009 if (kauth_cred_geteuid(l->l_cred) != kauth_cred_getsvuid(l->l_cred) || 1010 kauth_cred_getegid(l->l_cred) != kauth_cred_getsvgid(l->l_cred)) { 1011 l->l_cred = kauth_cred_copy(l->l_cred); 1012 kauth_cred_setsvuid(l->l_cred, kauth_cred_geteuid(l->l_cred)); 1013 kauth_cred_setsvgid(l->l_cred, kauth_cred_getegid(l->l_cred)); 1014 } 1015 1016 /* Update the master credentials. */ 1017 if (l->l_cred != p->p_cred) { 1018 kauth_cred_t ocred; 1019 1020 kauth_cred_hold(l->l_cred); 1021 mutex_enter(p->p_lock); 1022 ocred = p->p_cred; 1023 p->p_cred = l->l_cred; 1024 mutex_exit(p->p_lock); 1025 kauth_cred_free(ocred); 1026 } 1027 1028 return 0; 1029 } 1030 1031 static void 1032 emulexec(struct lwp *l, struct exec_package *epp) 1033 { 1034 struct proc *p = l->l_proc; 1035 1036 /* The emulation root will usually have been found when we looked 1037 * for the elf interpreter (or similar), if not look now. */ 1038 if (epp->ep_esch->es_emul->e_path != NULL && 1039 epp->ep_emul_root == NULL) 1040 emul_find_root(l, epp); 1041 1042 /* Any old emulation root got removed by fdcloseexec */ 1043 rw_enter(&p->p_cwdi->cwdi_lock, RW_WRITER); 1044 p->p_cwdi->cwdi_edir = epp->ep_emul_root; 1045 rw_exit(&p->p_cwdi->cwdi_lock); 1046 epp->ep_emul_root = NULL; 1047 if (epp->ep_interp != NULL) 1048 vrele(epp->ep_interp); 1049 1050 /* 1051 * Call emulation specific exec hook. This can setup per-process 1052 * p->p_emuldata or do any other per-process stuff an emulation needs. 1053 * 1054 * If we are executing process of different emulation than the 1055 * original forked process, call e_proc_exit() of the old emulation 1056 * first, then e_proc_exec() of new emulation. If the emulation is 1057 * same, the exec hook code should deallocate any old emulation 1058 * resources held previously by this process. 1059 */ 1060 if (p->p_emul && p->p_emul->e_proc_exit 1061 && p->p_emul != epp->ep_esch->es_emul) 1062 (*p->p_emul->e_proc_exit)(p); 1063 1064 /* 1065 * This is now LWP 1. 1066 */ 1067 /* XXX elsewhere */ 1068 mutex_enter(p->p_lock); 1069 p->p_nlwpid = 1; 1070 l->l_lid = 1; 1071 mutex_exit(p->p_lock); 1072 1073 /* 1074 * Call exec hook. Emulation code may NOT store reference to anything 1075 * from &pack. 1076 */ 1077 if (epp->ep_esch->es_emul->e_proc_exec) 1078 (*epp->ep_esch->es_emul->e_proc_exec)(p, epp); 1079 1080 /* update p_emul, the old value is no longer needed */ 1081 p->p_emul = epp->ep_esch->es_emul; 1082 1083 /* ...and the same for p_execsw */ 1084 p->p_execsw = epp->ep_esch; 1085 1086 #ifdef __HAVE_SYSCALL_INTERN 1087 (*p->p_emul->e_syscall_intern)(p); 1088 #endif 1089 ktremul(); 1090 } 1091 1092 static int 1093 execve_runproc(struct lwp *l, struct execve_data * restrict data, 1094 bool no_local_exec_lock, bool is_spawn) 1095 { 1096 struct exec_package * const epp = &data->ed_pack; 1097 int error = 0; 1098 struct proc *p; 1099 1100 /* 1101 * In case of a posix_spawn operation, the child doing the exec 1102 * might not hold the reader lock on exec_lock, but the parent 1103 * will do this instead. 1104 */ 1105 KASSERT(no_local_exec_lock || rw_lock_held(&exec_lock)); 1106 KASSERT(!no_local_exec_lock || is_spawn); 1107 KASSERT(data != NULL); 1108 1109 p = l->l_proc; 1110 1111 /* Get rid of other LWPs. */ 1112 if (p->p_nlwps > 1) { 1113 mutex_enter(p->p_lock); 1114 exit_lwps(l); 1115 mutex_exit(p->p_lock); 1116 } 1117 KDASSERT(p->p_nlwps == 1); 1118 1119 /* Destroy any lwpctl info. */ 1120 if (p->p_lwpctl != NULL) 1121 lwp_ctl_exit(); 1122 1123 /* Remove POSIX timers */ 1124 timers_free(p, TIMERS_POSIX); 1125 1126 /* Set the PaX flags. */ 1127 p->p_pax = epp->ep_pax_flags; 1128 1129 /* 1130 * Do whatever is necessary to prepare the address space 1131 * for remapping. Note that this might replace the current 1132 * vmspace with another! 1133 */ 1134 if (is_spawn) 1135 uvmspace_spawn(l, epp->ep_vm_minaddr, 1136 epp->ep_vm_maxaddr, 1137 epp->ep_flags & EXEC_TOPDOWN_VM); 1138 else 1139 uvmspace_exec(l, epp->ep_vm_minaddr, 1140 epp->ep_vm_maxaddr, 1141 epp->ep_flags & EXEC_TOPDOWN_VM); 1142 1143 struct vmspace *vm; 1144 vm = p->p_vmspace; 1145 vm->vm_taddr = (void *)epp->ep_taddr; 1146 vm->vm_tsize = btoc(epp->ep_tsize); 1147 vm->vm_daddr = (void*)epp->ep_daddr; 1148 vm->vm_dsize = btoc(epp->ep_dsize); 1149 vm->vm_ssize = btoc(epp->ep_ssize); 1150 vm->vm_issize = 0; 1151 vm->vm_maxsaddr = (void *)epp->ep_maxsaddr; 1152 vm->vm_minsaddr = (void *)epp->ep_minsaddr; 1153 1154 #ifdef PAX_ASLR 1155 pax_aslr_init_vm(l, vm); 1156 #endif /* PAX_ASLR */ 1157 1158 /* Now map address space. */ 1159 error = execve_dovmcmds(l, data); 1160 if (error != 0) 1161 goto exec_abort; 1162 1163 pathexec(epp, p, data->ed_pathstring); 1164 1165 char * const newstack = STACK_GROW(vm->vm_minsaddr, epp->ep_ssize); 1166 1167 error = copyoutargs(data, l, newstack); 1168 if (error != 0) 1169 goto exec_abort; 1170 1171 cwdexec(p); 1172 fd_closeexec(); /* handle close on exec */ 1173 1174 if (__predict_false(ktrace_on)) 1175 fd_ktrexecfd(); 1176 1177 execsigs(p); /* reset catched signals */ 1178 1179 mutex_enter(p->p_lock); 1180 l->l_ctxlink = NULL; /* reset ucontext link */ 1181 p->p_acflag &= ~AFORK; 1182 p->p_flag |= PK_EXEC; 1183 mutex_exit(p->p_lock); 1184 1185 /* 1186 * Stop profiling. 1187 */ 1188 if ((p->p_stflag & PST_PROFIL) != 0) { 1189 mutex_spin_enter(&p->p_stmutex); 1190 stopprofclock(p); 1191 mutex_spin_exit(&p->p_stmutex); 1192 } 1193 1194 /* 1195 * It's OK to test PL_PPWAIT unlocked here, as other LWPs have 1196 * exited and exec()/exit() are the only places it will be cleared. 1197 */ 1198 if ((p->p_lflag & PL_PPWAIT) != 0) { 1199 #if 0 1200 lwp_t *lp; 1201 1202 mutex_enter(proc_lock); 1203 lp = p->p_vforklwp; 1204 p->p_vforklwp = NULL; 1205 1206 l->l_lwpctl = NULL; /* was on loan from blocked parent */ 1207 p->p_lflag &= ~PL_PPWAIT; 1208 1209 lp->l_pflag &= ~LP_VFORKWAIT; /* XXX */ 1210 cv_broadcast(&lp->l_waitcv); 1211 mutex_exit(proc_lock); 1212 #else 1213 mutex_enter(proc_lock); 1214 l->l_lwpctl = NULL; /* was on loan from blocked parent */ 1215 p->p_lflag &= ~PL_PPWAIT; 1216 cv_broadcast(&p->p_pptr->p_waitcv); 1217 mutex_exit(proc_lock); 1218 #endif 1219 } 1220 1221 error = credexec(l, &data->ed_attr); 1222 if (error) 1223 goto exec_abort; 1224 1225 #if defined(__HAVE_RAS) 1226 /* 1227 * Remove all RASs from the address space. 1228 */ 1229 ras_purgeall(); 1230 #endif 1231 1232 doexechooks(p); 1233 1234 /* 1235 * Set initial SP at the top of the stack. 1236 * 1237 * Note that on machines where stack grows up (e.g. hppa), SP points to 1238 * the end of arg/env strings. Userland guesses the address of argc 1239 * via ps_strings::ps_argvstr. 1240 */ 1241 1242 /* Setup new registers and do misc. setup. */ 1243 (*epp->ep_esch->es_emul->e_setregs)(l, epp, (vaddr_t)newstack); 1244 if (epp->ep_esch->es_setregs) 1245 (*epp->ep_esch->es_setregs)(l, epp, (vaddr_t)newstack); 1246 1247 /* Provide a consistent LWP private setting */ 1248 (void)lwp_setprivate(l, NULL); 1249 1250 /* Discard all PCU state; need to start fresh */ 1251 pcu_discard_all(l); 1252 1253 /* map the process's signal trampoline code */ 1254 if ((error = exec_sigcode_map(p, epp->ep_esch->es_emul)) != 0) { 1255 DPRINTF(("%s: map sigcode failed %d\n", __func__, error)); 1256 goto exec_abort; 1257 } 1258 1259 pool_put(&exec_pool, data->ed_argp); 1260 1261 /* notify others that we exec'd */ 1262 KNOTE(&p->p_klist, NOTE_EXEC); 1263 1264 kmem_free(epp->ep_hdr, epp->ep_hdrlen); 1265 1266 SDT_PROBE(proc, kernel, , exec__success, epp->ep_kname, 0, 0, 0, 0); 1267 1268 emulexec(l, epp); 1269 1270 /* Allow new references from the debugger/procfs. */ 1271 rw_exit(&p->p_reflock); 1272 if (!no_local_exec_lock) 1273 rw_exit(&exec_lock); 1274 1275 mutex_enter(proc_lock); 1276 1277 if ((p->p_slflag & (PSL_TRACED|PSL_SYSCALL)) == PSL_TRACED) { 1278 ksiginfo_t ksi; 1279 1280 KSI_INIT_EMPTY(&ksi); 1281 ksi.ksi_signo = SIGTRAP; 1282 ksi.ksi_lid = l->l_lid; 1283 kpsignal(p, &ksi, NULL); 1284 } 1285 1286 if (p->p_sflag & PS_STOPEXEC) { 1287 ksiginfoq_t kq; 1288 1289 KERNEL_UNLOCK_ALL(l, &l->l_biglocks); 1290 p->p_pptr->p_nstopchild++; 1291 p->p_waited = 0; 1292 mutex_enter(p->p_lock); 1293 ksiginfo_queue_init(&kq); 1294 sigclearall(p, &contsigmask, &kq); 1295 lwp_lock(l); 1296 l->l_stat = LSSTOP; 1297 p->p_stat = SSTOP; 1298 p->p_nrlwps--; 1299 lwp_unlock(l); 1300 mutex_exit(p->p_lock); 1301 mutex_exit(proc_lock); 1302 lwp_lock(l); 1303 mi_switch(l); 1304 ksiginfo_queue_drain(&kq); 1305 KERNEL_LOCK(l->l_biglocks, l); 1306 } else { 1307 mutex_exit(proc_lock); 1308 } 1309 1310 pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring); 1311 pathbuf_destroy(data->ed_pathbuf); 1312 PNBUF_PUT(data->ed_resolvedpathbuf); 1313 DPRINTF(("%s finished\n", __func__)); 1314 return EJUSTRETURN; 1315 1316 exec_abort: 1317 SDT_PROBE(proc, kernel, , exec__failure, error, 0, 0, 0, 0); 1318 rw_exit(&p->p_reflock); 1319 if (!no_local_exec_lock) 1320 rw_exit(&exec_lock); 1321 1322 pathbuf_stringcopy_put(data->ed_pathbuf, data->ed_pathstring); 1323 pathbuf_destroy(data->ed_pathbuf); 1324 PNBUF_PUT(data->ed_resolvedpathbuf); 1325 1326 /* 1327 * the old process doesn't exist anymore. exit gracefully. 1328 * get rid of the (new) address space we have created, if any, get rid 1329 * of our namei data and vnode, and exit noting failure 1330 */ 1331 uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS, 1332 VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS); 1333 1334 exec_free_emul_arg(epp); 1335 pool_put(&exec_pool, data->ed_argp); 1336 kmem_free(epp->ep_hdr, epp->ep_hdrlen); 1337 if (epp->ep_emul_root != NULL) 1338 vrele(epp->ep_emul_root); 1339 if (epp->ep_interp != NULL) 1340 vrele(epp->ep_interp); 1341 1342 /* Acquire the sched-state mutex (exit1() will release it). */ 1343 if (!is_spawn) { 1344 mutex_enter(p->p_lock); 1345 exit1(l, W_EXITCODE(error, SIGABRT)); 1346 } 1347 1348 return error; 1349 } 1350 1351 int 1352 execve1(struct lwp *l, const char *path, char * const *args, 1353 char * const *envs, execve_fetch_element_t fetch_element) 1354 { 1355 struct execve_data data; 1356 int error; 1357 1358 error = execve_loadvm(l, path, args, envs, fetch_element, &data); 1359 if (error) 1360 return error; 1361 error = execve_runproc(l, &data, false, false); 1362 return error; 1363 } 1364 1365 static size_t 1366 fromptrsz(const struct exec_package *epp) 1367 { 1368 return (epp->ep_flags & EXEC_FROM32) ? sizeof(int) : sizeof(char *); 1369 } 1370 1371 static size_t 1372 ptrsz(const struct exec_package *epp) 1373 { 1374 return (epp->ep_flags & EXEC_32) ? sizeof(int) : sizeof(char *); 1375 } 1376 1377 static size_t 1378 calcargs(struct execve_data * restrict data, const size_t argenvstrlen) 1379 { 1380 struct exec_package * const epp = &data->ed_pack; 1381 1382 const size_t nargenvptrs = 1383 1 + /* long argc */ 1384 data->ed_argc + /* char *argv[] */ 1385 1 + /* \0 */ 1386 data->ed_envc + /* char *env[] */ 1387 1 + /* \0 */ 1388 epp->ep_esch->es_arglen; /* auxinfo */ 1389 1390 return (nargenvptrs * ptrsz(epp)) + argenvstrlen; 1391 } 1392 1393 static size_t 1394 calcstack(struct execve_data * restrict data, const size_t gaplen) 1395 { 1396 struct exec_package * const epp = &data->ed_pack; 1397 1398 data->ed_szsigcode = epp->ep_esch->es_emul->e_esigcode - 1399 epp->ep_esch->es_emul->e_sigcode; 1400 1401 data->ed_ps_strings_sz = (epp->ep_flags & EXEC_32) ? 1402 sizeof(struct ps_strings32) : sizeof(struct ps_strings); 1403 1404 const size_t sigcode_psstr_sz = 1405 data->ed_szsigcode + /* sigcode */ 1406 data->ed_ps_strings_sz + /* ps_strings */ 1407 STACK_PTHREADSPACE; /* pthread space */ 1408 1409 const size_t stacklen = 1410 data->ed_argslen + 1411 gaplen + 1412 sigcode_psstr_sz; 1413 1414 /* make the stack "safely" aligned */ 1415 return STACK_LEN_ALIGN(stacklen, STACK_ALIGNBYTES); 1416 } 1417 1418 static int 1419 copyoutargs(struct execve_data * restrict data, struct lwp *l, 1420 char * const newstack) 1421 { 1422 struct exec_package * const epp = &data->ed_pack; 1423 struct proc *p = l->l_proc; 1424 int error; 1425 1426 /* remember information about the process */ 1427 data->ed_arginfo.ps_nargvstr = data->ed_argc; 1428 data->ed_arginfo.ps_nenvstr = data->ed_envc; 1429 1430 /* 1431 * Allocate the stack address passed to the newly execve()'ed process. 1432 * 1433 * The new stack address will be set to the SP (stack pointer) register 1434 * in setregs(). 1435 */ 1436 1437 char *newargs = STACK_ALLOC( 1438 STACK_SHRINK(newstack, data->ed_argslen), data->ed_argslen); 1439 1440 error = (*epp->ep_esch->es_copyargs)(l, epp, 1441 &data->ed_arginfo, &newargs, data->ed_argp); 1442 1443 if (epp->ep_path) { 1444 PNBUF_PUT(epp->ep_path); 1445 epp->ep_path = NULL; 1446 } 1447 if (error) { 1448 DPRINTF(("%s: copyargs failed %d\n", __func__, error)); 1449 return error; 1450 } 1451 1452 error = copyoutpsstrs(data, p); 1453 if (error != 0) 1454 return error; 1455 1456 return 0; 1457 } 1458 1459 static int 1460 copyoutpsstrs(struct execve_data * restrict data, struct proc *p) 1461 { 1462 struct exec_package * const epp = &data->ed_pack; 1463 struct ps_strings32 arginfo32; 1464 void *aip; 1465 int error; 1466 1467 /* fill process ps_strings info */ 1468 p->p_psstrp = (vaddr_t)STACK_ALLOC(STACK_GROW(epp->ep_minsaddr, 1469 STACK_PTHREADSPACE), data->ed_ps_strings_sz); 1470 1471 if (epp->ep_flags & EXEC_32) { 1472 aip = &arginfo32; 1473 arginfo32.ps_argvstr = (vaddr_t)data->ed_arginfo.ps_argvstr; 1474 arginfo32.ps_nargvstr = data->ed_arginfo.ps_nargvstr; 1475 arginfo32.ps_envstr = (vaddr_t)data->ed_arginfo.ps_envstr; 1476 arginfo32.ps_nenvstr = data->ed_arginfo.ps_nenvstr; 1477 } else 1478 aip = &data->ed_arginfo; 1479 1480 /* copy out the process's ps_strings structure */ 1481 if ((error = copyout(aip, (void *)p->p_psstrp, data->ed_ps_strings_sz)) 1482 != 0) { 1483 DPRINTF(("%s: ps_strings copyout %p->%p size %zu failed\n", 1484 __func__, aip, (void *)p->p_psstrp, data->ed_ps_strings_sz)); 1485 return error; 1486 } 1487 1488 return 0; 1489 } 1490 1491 static int 1492 copyinargs(struct execve_data * restrict data, char * const *args, 1493 char * const *envs, execve_fetch_element_t fetch_element, char **dpp) 1494 { 1495 struct exec_package * const epp = &data->ed_pack; 1496 char *dp; 1497 size_t i; 1498 int error; 1499 1500 dp = *dpp; 1501 1502 data->ed_argc = 0; 1503 1504 /* copy the fake args list, if there's one, freeing it as we go */ 1505 if (epp->ep_flags & EXEC_HASARGL) { 1506 struct exec_fakearg *fa = epp->ep_fa; 1507 1508 while (fa->fa_arg != NULL) { 1509 const size_t maxlen = ARG_MAX - (dp - data->ed_argp); 1510 size_t len; 1511 1512 len = strlcpy(dp, fa->fa_arg, maxlen); 1513 /* Count NUL into len. */ 1514 if (len < maxlen) 1515 len++; 1516 else { 1517 while (fa->fa_arg != NULL) { 1518 kmem_free(fa->fa_arg, fa->fa_len); 1519 fa++; 1520 } 1521 kmem_free(epp->ep_fa, epp->ep_fa_len); 1522 epp->ep_flags &= ~EXEC_HASARGL; 1523 return E2BIG; 1524 } 1525 ktrexecarg(fa->fa_arg, len - 1); 1526 dp += len; 1527 1528 kmem_free(fa->fa_arg, fa->fa_len); 1529 fa++; 1530 data->ed_argc++; 1531 } 1532 kmem_free(epp->ep_fa, epp->ep_fa_len); 1533 epp->ep_flags &= ~EXEC_HASARGL; 1534 } 1535 1536 /* 1537 * Read and count argument strings from user. 1538 */ 1539 1540 if (args == NULL) { 1541 DPRINTF(("%s: null args\n", __func__)); 1542 return EINVAL; 1543 } 1544 if (epp->ep_flags & EXEC_SKIPARG) 1545 args = (const void *)((const char *)args + fromptrsz(epp)); 1546 i = 0; 1547 error = copyinargstrs(data, args, fetch_element, &dp, &i, ktr_execarg); 1548 if (error != 0) { 1549 DPRINTF(("%s: copyin arg %d\n", __func__, error)); 1550 return error; 1551 } 1552 data->ed_argc += i; 1553 1554 /* 1555 * Read and count environment strings from user. 1556 */ 1557 1558 data->ed_envc = 0; 1559 /* environment need not be there */ 1560 if (envs == NULL) 1561 goto done; 1562 i = 0; 1563 error = copyinargstrs(data, envs, fetch_element, &dp, &i, ktr_execenv); 1564 if (error != 0) { 1565 DPRINTF(("%s: copyin env %d\n", __func__, error)); 1566 return error; 1567 } 1568 data->ed_envc += i; 1569 1570 done: 1571 *dpp = dp; 1572 1573 return 0; 1574 } 1575 1576 static int 1577 copyinargstrs(struct execve_data * restrict data, char * const *strs, 1578 execve_fetch_element_t fetch_element, char **dpp, size_t *ip, 1579 void (*ktr)(const void *, size_t)) 1580 { 1581 char *dp, *sp; 1582 size_t i; 1583 int error; 1584 1585 dp = *dpp; 1586 1587 i = 0; 1588 while (1) { 1589 const size_t maxlen = ARG_MAX - (dp - data->ed_argp); 1590 size_t len; 1591 1592 if ((error = (*fetch_element)(strs, i, &sp)) != 0) { 1593 return error; 1594 } 1595 if (!sp) 1596 break; 1597 if ((error = copyinstr(sp, dp, maxlen, &len)) != 0) { 1598 if (error == ENAMETOOLONG) 1599 error = E2BIG; 1600 return error; 1601 } 1602 if (__predict_false(ktrace_on)) 1603 (*ktr)(dp, len - 1); 1604 dp += len; 1605 i++; 1606 } 1607 1608 *dpp = dp; 1609 *ip = i; 1610 1611 return 0; 1612 } 1613 1614 /* 1615 * Copy argv and env strings from kernel buffer (argp) to the new stack. 1616 * Those strings are located just after auxinfo. 1617 */ 1618 int 1619 copyargs(struct lwp *l, struct exec_package *pack, struct ps_strings *arginfo, 1620 char **stackp, void *argp) 1621 { 1622 char **cpp, *dp, *sp; 1623 size_t len; 1624 void *nullp; 1625 long argc, envc; 1626 int error; 1627 1628 cpp = (char **)*stackp; 1629 nullp = NULL; 1630 argc = arginfo->ps_nargvstr; 1631 envc = arginfo->ps_nenvstr; 1632 1633 /* argc on stack is long */ 1634 CTASSERT(sizeof(*cpp) == sizeof(argc)); 1635 1636 dp = (char *)(cpp + 1637 1 + /* long argc */ 1638 argc + /* char *argv[] */ 1639 1 + /* \0 */ 1640 envc + /* char *env[] */ 1641 1 + /* \0 */ 1642 /* XXX auxinfo multiplied by ptr size? */ 1643 pack->ep_esch->es_arglen); /* auxinfo */ 1644 sp = argp; 1645 1646 if ((error = copyout(&argc, cpp++, sizeof(argc))) != 0) { 1647 COPYPRINTF("", cpp - 1, sizeof(argc)); 1648 return error; 1649 } 1650 1651 /* XXX don't copy them out, remap them! */ 1652 arginfo->ps_argvstr = cpp; /* remember location of argv for later */ 1653 1654 for (; --argc >= 0; sp += len, dp += len) { 1655 if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0) { 1656 COPYPRINTF("", cpp - 1, sizeof(dp)); 1657 return error; 1658 } 1659 if ((error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0) { 1660 COPYPRINTF("str", dp, (size_t)ARG_MAX); 1661 return error; 1662 } 1663 } 1664 1665 if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0) { 1666 COPYPRINTF("", cpp - 1, sizeof(nullp)); 1667 return error; 1668 } 1669 1670 arginfo->ps_envstr = cpp; /* remember location of envp for later */ 1671 1672 for (; --envc >= 0; sp += len, dp += len) { 1673 if ((error = copyout(&dp, cpp++, sizeof(dp))) != 0) { 1674 COPYPRINTF("", cpp - 1, sizeof(dp)); 1675 return error; 1676 } 1677 if ((error = copyoutstr(sp, dp, ARG_MAX, &len)) != 0) { 1678 COPYPRINTF("str", dp, (size_t)ARG_MAX); 1679 return error; 1680 } 1681 1682 } 1683 1684 if ((error = copyout(&nullp, cpp++, sizeof(nullp))) != 0) { 1685 COPYPRINTF("", cpp - 1, sizeof(nullp)); 1686 return error; 1687 } 1688 1689 *stackp = (char *)cpp; 1690 return 0; 1691 } 1692 1693 1694 /* 1695 * Add execsw[] entries. 1696 */ 1697 int 1698 exec_add(struct execsw *esp, int count) 1699 { 1700 struct exec_entry *it; 1701 int i; 1702 1703 if (count == 0) { 1704 return 0; 1705 } 1706 1707 /* Check for duplicates. */ 1708 rw_enter(&exec_lock, RW_WRITER); 1709 for (i = 0; i < count; i++) { 1710 LIST_FOREACH(it, &ex_head, ex_list) { 1711 /* assume unique (makecmds, probe_func, emulation) */ 1712 if (it->ex_sw->es_makecmds == esp[i].es_makecmds && 1713 it->ex_sw->u.elf_probe_func == 1714 esp[i].u.elf_probe_func && 1715 it->ex_sw->es_emul == esp[i].es_emul) { 1716 rw_exit(&exec_lock); 1717 return EEXIST; 1718 } 1719 } 1720 } 1721 1722 /* Allocate new entries. */ 1723 for (i = 0; i < count; i++) { 1724 it = kmem_alloc(sizeof(*it), KM_SLEEP); 1725 it->ex_sw = &esp[i]; 1726 LIST_INSERT_HEAD(&ex_head, it, ex_list); 1727 } 1728 1729 /* update execsw[] */ 1730 exec_init(0); 1731 rw_exit(&exec_lock); 1732 return 0; 1733 } 1734 1735 /* 1736 * Remove execsw[] entry. 1737 */ 1738 int 1739 exec_remove(struct execsw *esp, int count) 1740 { 1741 struct exec_entry *it, *next; 1742 int i; 1743 const struct proclist_desc *pd; 1744 proc_t *p; 1745 1746 if (count == 0) { 1747 return 0; 1748 } 1749 1750 /* Abort if any are busy. */ 1751 rw_enter(&exec_lock, RW_WRITER); 1752 for (i = 0; i < count; i++) { 1753 mutex_enter(proc_lock); 1754 for (pd = proclists; pd->pd_list != NULL; pd++) { 1755 PROCLIST_FOREACH(p, pd->pd_list) { 1756 if (p->p_execsw == &esp[i]) { 1757 mutex_exit(proc_lock); 1758 rw_exit(&exec_lock); 1759 return EBUSY; 1760 } 1761 } 1762 } 1763 mutex_exit(proc_lock); 1764 } 1765 1766 /* None are busy, so remove them all. */ 1767 for (i = 0; i < count; i++) { 1768 for (it = LIST_FIRST(&ex_head); it != NULL; it = next) { 1769 next = LIST_NEXT(it, ex_list); 1770 if (it->ex_sw == &esp[i]) { 1771 LIST_REMOVE(it, ex_list); 1772 kmem_free(it, sizeof(*it)); 1773 break; 1774 } 1775 } 1776 } 1777 1778 /* update execsw[] */ 1779 exec_init(0); 1780 rw_exit(&exec_lock); 1781 return 0; 1782 } 1783 1784 /* 1785 * Initialize exec structures. If init_boot is true, also does necessary 1786 * one-time initialization (it's called from main() that way). 1787 * Once system is multiuser, this should be called with exec_lock held, 1788 * i.e. via exec_{add|remove}(). 1789 */ 1790 int 1791 exec_init(int init_boot) 1792 { 1793 const struct execsw **sw; 1794 struct exec_entry *ex; 1795 SLIST_HEAD(,exec_entry) first; 1796 SLIST_HEAD(,exec_entry) any; 1797 SLIST_HEAD(,exec_entry) last; 1798 int i, sz; 1799 1800 if (init_boot) { 1801 /* do one-time initializations */ 1802 rw_init(&exec_lock); 1803 mutex_init(&sigobject_lock, MUTEX_DEFAULT, IPL_NONE); 1804 pool_init(&exec_pool, NCARGS, 0, 0, PR_NOALIGN|PR_NOTOUCH, 1805 "execargs", &exec_palloc, IPL_NONE); 1806 pool_sethardlimit(&exec_pool, maxexec, "should not happen", 0); 1807 } else { 1808 KASSERT(rw_write_held(&exec_lock)); 1809 } 1810 1811 /* Sort each entry onto the appropriate queue. */ 1812 SLIST_INIT(&first); 1813 SLIST_INIT(&any); 1814 SLIST_INIT(&last); 1815 sz = 0; 1816 LIST_FOREACH(ex, &ex_head, ex_list) { 1817 switch(ex->ex_sw->es_prio) { 1818 case EXECSW_PRIO_FIRST: 1819 SLIST_INSERT_HEAD(&first, ex, ex_slist); 1820 break; 1821 case EXECSW_PRIO_ANY: 1822 SLIST_INSERT_HEAD(&any, ex, ex_slist); 1823 break; 1824 case EXECSW_PRIO_LAST: 1825 SLIST_INSERT_HEAD(&last, ex, ex_slist); 1826 break; 1827 default: 1828 panic("%s", __func__); 1829 break; 1830 } 1831 sz++; 1832 } 1833 1834 /* 1835 * Create new execsw[]. Ensure we do not try a zero-sized 1836 * allocation. 1837 */ 1838 sw = kmem_alloc(sz * sizeof(struct execsw *) + 1, KM_SLEEP); 1839 i = 0; 1840 SLIST_FOREACH(ex, &first, ex_slist) { 1841 sw[i++] = ex->ex_sw; 1842 } 1843 SLIST_FOREACH(ex, &any, ex_slist) { 1844 sw[i++] = ex->ex_sw; 1845 } 1846 SLIST_FOREACH(ex, &last, ex_slist) { 1847 sw[i++] = ex->ex_sw; 1848 } 1849 1850 /* Replace old execsw[] and free used memory. */ 1851 if (execsw != NULL) { 1852 kmem_free(__UNCONST(execsw), 1853 nexecs * sizeof(struct execsw *) + 1); 1854 } 1855 execsw = sw; 1856 nexecs = sz; 1857 1858 /* Figure out the maximum size of an exec header. */ 1859 exec_maxhdrsz = sizeof(int); 1860 for (i = 0; i < nexecs; i++) { 1861 if (execsw[i]->es_hdrsz > exec_maxhdrsz) 1862 exec_maxhdrsz = execsw[i]->es_hdrsz; 1863 } 1864 1865 return 0; 1866 } 1867 1868 static int 1869 exec_sigcode_map(struct proc *p, const struct emul *e) 1870 { 1871 vaddr_t va; 1872 vsize_t sz; 1873 int error; 1874 struct uvm_object *uobj; 1875 1876 sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode; 1877 1878 if (e->e_sigobject == NULL || sz == 0) { 1879 return 0; 1880 } 1881 1882 /* 1883 * If we don't have a sigobject for this emulation, create one. 1884 * 1885 * sigobject is an anonymous memory object (just like SYSV shared 1886 * memory) that we keep a permanent reference to and that we map 1887 * in all processes that need this sigcode. The creation is simple, 1888 * we create an object, add a permanent reference to it, map it in 1889 * kernel space, copy out the sigcode to it and unmap it. 1890 * We map it with PROT_READ|PROT_EXEC into the process just 1891 * the way sys_mmap() would map it. 1892 */ 1893 1894 uobj = *e->e_sigobject; 1895 if (uobj == NULL) { 1896 mutex_enter(&sigobject_lock); 1897 if ((uobj = *e->e_sigobject) == NULL) { 1898 uobj = uao_create(sz, 0); 1899 (*uobj->pgops->pgo_reference)(uobj); 1900 va = vm_map_min(kernel_map); 1901 if ((error = uvm_map(kernel_map, &va, round_page(sz), 1902 uobj, 0, 0, 1903 UVM_MAPFLAG(UVM_PROT_RW, UVM_PROT_RW, 1904 UVM_INH_SHARE, UVM_ADV_RANDOM, 0)))) { 1905 printf("kernel mapping failed %d\n", error); 1906 (*uobj->pgops->pgo_detach)(uobj); 1907 mutex_exit(&sigobject_lock); 1908 return error; 1909 } 1910 memcpy((void *)va, e->e_sigcode, sz); 1911 #ifdef PMAP_NEED_PROCWR 1912 pmap_procwr(&proc0, va, sz); 1913 #endif 1914 uvm_unmap(kernel_map, va, va + round_page(sz)); 1915 *e->e_sigobject = uobj; 1916 } 1917 mutex_exit(&sigobject_lock); 1918 } 1919 1920 /* Just a hint to uvm_map where to put it. */ 1921 va = e->e_vm_default_addr(p, (vaddr_t)p->p_vmspace->vm_daddr, 1922 round_page(sz)); 1923 1924 #ifdef __alpha__ 1925 /* 1926 * Tru64 puts /sbin/loader at the end of user virtual memory, 1927 * which causes the above calculation to put the sigcode at 1928 * an invalid address. Put it just below the text instead. 1929 */ 1930 if (va == (vaddr_t)vm_map_max(&p->p_vmspace->vm_map)) { 1931 va = (vaddr_t)p->p_vmspace->vm_taddr - round_page(sz); 1932 } 1933 #endif 1934 1935 (*uobj->pgops->pgo_reference)(uobj); 1936 error = uvm_map(&p->p_vmspace->vm_map, &va, round_page(sz), 1937 uobj, 0, 0, 1938 UVM_MAPFLAG(UVM_PROT_RX, UVM_PROT_RX, UVM_INH_SHARE, 1939 UVM_ADV_RANDOM, 0)); 1940 if (error) { 1941 DPRINTF(("%s, %d: map %p " 1942 "uvm_map %#"PRIxVSIZE"@%#"PRIxVADDR" failed %d\n", 1943 __func__, __LINE__, &p->p_vmspace->vm_map, round_page(sz), 1944 va, error)); 1945 (*uobj->pgops->pgo_detach)(uobj); 1946 return error; 1947 } 1948 p->p_sigctx.ps_sigcode = (void *)va; 1949 return 0; 1950 } 1951 1952 /* 1953 * Release a refcount on spawn_exec_data and destroy memory, if this 1954 * was the last one. 1955 */ 1956 static void 1957 spawn_exec_data_release(struct spawn_exec_data *data) 1958 { 1959 if (atomic_dec_32_nv(&data->sed_refcnt) != 0) 1960 return; 1961 1962 cv_destroy(&data->sed_cv_child_ready); 1963 mutex_destroy(&data->sed_mtx_child); 1964 1965 if (data->sed_actions) 1966 posix_spawn_fa_free(data->sed_actions, 1967 data->sed_actions->len); 1968 if (data->sed_attrs) 1969 kmem_free(data->sed_attrs, 1970 sizeof(*data->sed_attrs)); 1971 kmem_free(data, sizeof(*data)); 1972 } 1973 1974 /* 1975 * A child lwp of a posix_spawn operation starts here and ends up in 1976 * cpu_spawn_return, dealing with all filedescriptor and scheduler 1977 * manipulations in between. 1978 * The parent waits for the child, as it is not clear whether the child 1979 * will be able to acquire its own exec_lock. If it can, the parent can 1980 * be released early and continue running in parallel. If not (or if the 1981 * magic debug flag is passed in the scheduler attribute struct), the 1982 * child rides on the parent's exec lock until it is ready to return to 1983 * to userland - and only then releases the parent. This method loses 1984 * concurrency, but improves error reporting. 1985 */ 1986 static void 1987 spawn_return(void *arg) 1988 { 1989 struct spawn_exec_data *spawn_data = arg; 1990 struct lwp *l = curlwp; 1991 int error, newfd; 1992 int ostat; 1993 size_t i; 1994 const struct posix_spawn_file_actions_entry *fae; 1995 pid_t ppid; 1996 register_t retval; 1997 bool have_reflock; 1998 bool parent_is_waiting = true; 1999 2000 /* 2001 * Check if we can release parent early. 2002 * We either need to have no sed_attrs, or sed_attrs does not 2003 * have POSIX_SPAWN_RETURNERROR or one of the flags, that require 2004 * safe access to the parent proc (passed in sed_parent). 2005 * We then try to get the exec_lock, and only if that works, we can 2006 * release the parent here already. 2007 */ 2008 ppid = spawn_data->sed_parent->p_pid; 2009 if ((!spawn_data->sed_attrs 2010 || (spawn_data->sed_attrs->sa_flags 2011 & (POSIX_SPAWN_RETURNERROR|POSIX_SPAWN_SETPGROUP)) == 0) 2012 && rw_tryenter(&exec_lock, RW_READER)) { 2013 parent_is_waiting = false; 2014 mutex_enter(&spawn_data->sed_mtx_child); 2015 cv_signal(&spawn_data->sed_cv_child_ready); 2016 mutex_exit(&spawn_data->sed_mtx_child); 2017 } 2018 2019 /* don't allow debugger access yet */ 2020 rw_enter(&l->l_proc->p_reflock, RW_WRITER); 2021 have_reflock = true; 2022 2023 error = 0; 2024 /* handle posix_spawn_file_actions */ 2025 if (spawn_data->sed_actions != NULL) { 2026 for (i = 0; i < spawn_data->sed_actions->len; i++) { 2027 fae = &spawn_data->sed_actions->fae[i]; 2028 switch (fae->fae_action) { 2029 case FAE_OPEN: 2030 if (fd_getfile(fae->fae_fildes) != NULL) { 2031 error = fd_close(fae->fae_fildes); 2032 if (error) 2033 break; 2034 } 2035 error = fd_open(fae->fae_path, fae->fae_oflag, 2036 fae->fae_mode, &newfd); 2037 if (error) 2038 break; 2039 if (newfd != fae->fae_fildes) { 2040 error = dodup(l, newfd, 2041 fae->fae_fildes, 0, &retval); 2042 if (fd_getfile(newfd) != NULL) 2043 fd_close(newfd); 2044 } 2045 break; 2046 case FAE_DUP2: 2047 error = dodup(l, fae->fae_fildes, 2048 fae->fae_newfildes, 0, &retval); 2049 break; 2050 case FAE_CLOSE: 2051 if (fd_getfile(fae->fae_fildes) == NULL) { 2052 error = EBADF; 2053 break; 2054 } 2055 error = fd_close(fae->fae_fildes); 2056 break; 2057 } 2058 if (error) 2059 goto report_error; 2060 } 2061 } 2062 2063 /* handle posix_spawnattr */ 2064 if (spawn_data->sed_attrs != NULL) { 2065 struct sigaction sigact; 2066 sigact._sa_u._sa_handler = SIG_DFL; 2067 sigact.sa_flags = 0; 2068 2069 /* 2070 * set state to SSTOP so that this proc can be found by pid. 2071 * see proc_enterprp, do_sched_setparam below 2072 */ 2073 mutex_enter(proc_lock); 2074 /* 2075 * p_stat should be SACTIVE, so we need to adjust the 2076 * parent's p_nstopchild here. For safety, just make 2077 * we're on the good side of SDEAD before we adjust. 2078 */ 2079 ostat = l->l_proc->p_stat; 2080 KASSERT(ostat < SSTOP); 2081 l->l_proc->p_stat = SSTOP; 2082 l->l_proc->p_waited = 0; 2083 l->l_proc->p_pptr->p_nstopchild++; 2084 mutex_exit(proc_lock); 2085 2086 /* Set process group */ 2087 if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETPGROUP) { 2088 pid_t mypid = l->l_proc->p_pid, 2089 pgrp = spawn_data->sed_attrs->sa_pgroup; 2090 2091 if (pgrp == 0) 2092 pgrp = mypid; 2093 2094 error = proc_enterpgrp(spawn_data->sed_parent, 2095 mypid, pgrp, false); 2096 if (error) 2097 goto report_error_stopped; 2098 } 2099 2100 /* Set scheduler policy */ 2101 if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSCHEDULER) 2102 error = do_sched_setparam(l->l_proc->p_pid, 0, 2103 spawn_data->sed_attrs->sa_schedpolicy, 2104 &spawn_data->sed_attrs->sa_schedparam); 2105 else if (spawn_data->sed_attrs->sa_flags 2106 & POSIX_SPAWN_SETSCHEDPARAM) { 2107 error = do_sched_setparam(ppid, 0, 2108 SCHED_NONE, &spawn_data->sed_attrs->sa_schedparam); 2109 } 2110 if (error) 2111 goto report_error_stopped; 2112 2113 /* Reset user ID's */ 2114 if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_RESETIDS) { 2115 error = do_setresuid(l, -1, 2116 kauth_cred_getgid(l->l_cred), -1, 2117 ID_E_EQ_R | ID_E_EQ_S); 2118 if (error) 2119 goto report_error_stopped; 2120 error = do_setresuid(l, -1, 2121 kauth_cred_getuid(l->l_cred), -1, 2122 ID_E_EQ_R | ID_E_EQ_S); 2123 if (error) 2124 goto report_error_stopped; 2125 } 2126 2127 /* Set signal masks/defaults */ 2128 if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSIGMASK) { 2129 mutex_enter(l->l_proc->p_lock); 2130 error = sigprocmask1(l, SIG_SETMASK, 2131 &spawn_data->sed_attrs->sa_sigmask, NULL); 2132 mutex_exit(l->l_proc->p_lock); 2133 if (error) 2134 goto report_error_stopped; 2135 } 2136 2137 if (spawn_data->sed_attrs->sa_flags & POSIX_SPAWN_SETSIGDEF) { 2138 /* 2139 * The following sigaction call is using a sigaction 2140 * version 0 trampoline which is in the compatibility 2141 * code only. This is not a problem because for SIG_DFL 2142 * and SIG_IGN, the trampolines are now ignored. If they 2143 * were not, this would be a problem because we are 2144 * holding the exec_lock, and the compat code needs 2145 * to do the same in order to replace the trampoline 2146 * code of the process. 2147 */ 2148 for (i = 1; i <= NSIG; i++) { 2149 if (sigismember( 2150 &spawn_data->sed_attrs->sa_sigdefault, i)) 2151 sigaction1(l, i, &sigact, NULL, NULL, 2152 0); 2153 } 2154 } 2155 mutex_enter(proc_lock); 2156 l->l_proc->p_stat = ostat; 2157 l->l_proc->p_pptr->p_nstopchild--; 2158 mutex_exit(proc_lock); 2159 } 2160 2161 /* now do the real exec */ 2162 error = execve_runproc(l, &spawn_data->sed_exec, parent_is_waiting, 2163 true); 2164 have_reflock = false; 2165 if (error == EJUSTRETURN) 2166 error = 0; 2167 else if (error) 2168 goto report_error; 2169 2170 if (parent_is_waiting) { 2171 mutex_enter(&spawn_data->sed_mtx_child); 2172 cv_signal(&spawn_data->sed_cv_child_ready); 2173 mutex_exit(&spawn_data->sed_mtx_child); 2174 } 2175 2176 /* release our refcount on the data */ 2177 spawn_exec_data_release(spawn_data); 2178 2179 /* and finally: leave to userland for the first time */ 2180 cpu_spawn_return(l); 2181 2182 /* NOTREACHED */ 2183 return; 2184 2185 report_error_stopped: 2186 mutex_enter(proc_lock); 2187 l->l_proc->p_stat = ostat; 2188 l->l_proc->p_pptr->p_nstopchild--; 2189 mutex_exit(proc_lock); 2190 report_error: 2191 if (have_reflock) { 2192 /* 2193 * We have not passed through execve_runproc(), 2194 * which would have released the p_reflock and also 2195 * taken ownership of the sed_exec part of spawn_data, 2196 * so release/free both here. 2197 */ 2198 rw_exit(&l->l_proc->p_reflock); 2199 execve_free_data(&spawn_data->sed_exec); 2200 } 2201 2202 if (parent_is_waiting) { 2203 /* pass error to parent */ 2204 mutex_enter(&spawn_data->sed_mtx_child); 2205 spawn_data->sed_error = error; 2206 cv_signal(&spawn_data->sed_cv_child_ready); 2207 mutex_exit(&spawn_data->sed_mtx_child); 2208 } else { 2209 rw_exit(&exec_lock); 2210 } 2211 2212 /* release our refcount on the data */ 2213 spawn_exec_data_release(spawn_data); 2214 2215 /* done, exit */ 2216 mutex_enter(l->l_proc->p_lock); 2217 /* 2218 * Posix explicitly asks for an exit code of 127 if we report 2219 * errors from the child process - so, unfortunately, there 2220 * is no way to report a more exact error code. 2221 * A NetBSD specific workaround is POSIX_SPAWN_RETURNERROR as 2222 * flag bit in the attrp argument to posix_spawn(2), see above. 2223 */ 2224 exit1(l, W_EXITCODE(127, 0)); 2225 } 2226 2227 void 2228 posix_spawn_fa_free(struct posix_spawn_file_actions *fa, size_t len) 2229 { 2230 2231 for (size_t i = 0; i < len; i++) { 2232 struct posix_spawn_file_actions_entry *fae = &fa->fae[i]; 2233 if (fae->fae_action != FAE_OPEN) 2234 continue; 2235 kmem_free(fae->fae_path, strlen(fae->fae_path) + 1); 2236 } 2237 if (fa->len > 0) 2238 kmem_free(fa->fae, sizeof(*fa->fae) * fa->len); 2239 kmem_free(fa, sizeof(*fa)); 2240 } 2241 2242 static int 2243 posix_spawn_fa_alloc(struct posix_spawn_file_actions **fap, 2244 const struct posix_spawn_file_actions *ufa, rlim_t lim) 2245 { 2246 struct posix_spawn_file_actions *fa; 2247 struct posix_spawn_file_actions_entry *fae; 2248 char *pbuf = NULL; 2249 int error; 2250 size_t i = 0; 2251 2252 fa = kmem_alloc(sizeof(*fa), KM_SLEEP); 2253 error = copyin(ufa, fa, sizeof(*fa)); 2254 if (error || fa->len == 0) { 2255 kmem_free(fa, sizeof(*fa)); 2256 return error; /* 0 if not an error, and len == 0 */ 2257 } 2258 2259 if (fa->len > lim) { 2260 kmem_free(fa, sizeof(*fa)); 2261 return EINVAL; 2262 } 2263 2264 fa->size = fa->len; 2265 size_t fal = fa->len * sizeof(*fae); 2266 fae = fa->fae; 2267 fa->fae = kmem_alloc(fal, KM_SLEEP); 2268 error = copyin(fae, fa->fae, fal); 2269 if (error) 2270 goto out; 2271 2272 pbuf = PNBUF_GET(); 2273 for (; i < fa->len; i++) { 2274 fae = &fa->fae[i]; 2275 if (fae->fae_action != FAE_OPEN) 2276 continue; 2277 error = copyinstr(fae->fae_path, pbuf, MAXPATHLEN, &fal); 2278 if (error) 2279 goto out; 2280 fae->fae_path = kmem_alloc(fal, KM_SLEEP); 2281 memcpy(fae->fae_path, pbuf, fal); 2282 } 2283 PNBUF_PUT(pbuf); 2284 2285 *fap = fa; 2286 return 0; 2287 out: 2288 if (pbuf) 2289 PNBUF_PUT(pbuf); 2290 posix_spawn_fa_free(fa, i); 2291 return error; 2292 } 2293 2294 int 2295 check_posix_spawn(struct lwp *l1) 2296 { 2297 int error, tnprocs, count; 2298 uid_t uid; 2299 struct proc *p1; 2300 2301 p1 = l1->l_proc; 2302 uid = kauth_cred_getuid(l1->l_cred); 2303 tnprocs = atomic_inc_uint_nv(&nprocs); 2304 2305 /* 2306 * Although process entries are dynamically created, we still keep 2307 * a global limit on the maximum number we will create. 2308 */ 2309 if (__predict_false(tnprocs >= maxproc)) 2310 error = -1; 2311 else 2312 error = kauth_authorize_process(l1->l_cred, 2313 KAUTH_PROCESS_FORK, p1, KAUTH_ARG(tnprocs), NULL, NULL); 2314 2315 if (error) { 2316 atomic_dec_uint(&nprocs); 2317 return EAGAIN; 2318 } 2319 2320 /* 2321 * Enforce limits. 2322 */ 2323 count = chgproccnt(uid, 1); 2324 if (kauth_authorize_process(l1->l_cred, KAUTH_PROCESS_RLIMIT, 2325 p1, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_BYPASS), 2326 &p1->p_rlimit[RLIMIT_NPROC], KAUTH_ARG(RLIMIT_NPROC)) != 0 && 2327 __predict_false(count > p1->p_rlimit[RLIMIT_NPROC].rlim_cur)) { 2328 (void)chgproccnt(uid, -1); 2329 atomic_dec_uint(&nprocs); 2330 return EAGAIN; 2331 } 2332 2333 return 0; 2334 } 2335 2336 int 2337 do_posix_spawn(struct lwp *l1, pid_t *pid_res, bool *child_ok, const char *path, 2338 struct posix_spawn_file_actions *fa, 2339 struct posix_spawnattr *sa, 2340 char *const *argv, char *const *envp, 2341 execve_fetch_element_t fetch) 2342 { 2343 2344 struct proc *p1, *p2; 2345 struct lwp *l2; 2346 int error; 2347 struct spawn_exec_data *spawn_data; 2348 vaddr_t uaddr; 2349 pid_t pid; 2350 bool have_exec_lock = false; 2351 2352 p1 = l1->l_proc; 2353 2354 /* Allocate and init spawn_data */ 2355 spawn_data = kmem_zalloc(sizeof(*spawn_data), KM_SLEEP); 2356 spawn_data->sed_refcnt = 1; /* only parent so far */ 2357 cv_init(&spawn_data->sed_cv_child_ready, "pspawn"); 2358 mutex_init(&spawn_data->sed_mtx_child, MUTEX_DEFAULT, IPL_NONE); 2359 mutex_enter(&spawn_data->sed_mtx_child); 2360 2361 /* 2362 * Do the first part of the exec now, collect state 2363 * in spawn_data. 2364 */ 2365 error = execve_loadvm(l1, path, argv, 2366 envp, fetch, &spawn_data->sed_exec); 2367 if (error == EJUSTRETURN) 2368 error = 0; 2369 else if (error) 2370 goto error_exit; 2371 2372 have_exec_lock = true; 2373 2374 /* 2375 * Allocate virtual address space for the U-area now, while it 2376 * is still easy to abort the fork operation if we're out of 2377 * kernel virtual address space. 2378 */ 2379 uaddr = uvm_uarea_alloc(); 2380 if (__predict_false(uaddr == 0)) { 2381 error = ENOMEM; 2382 goto error_exit; 2383 } 2384 2385 /* 2386 * Allocate new proc. Borrow proc0 vmspace for it, we will 2387 * replace it with its own before returning to userland 2388 * in the child. 2389 * This is a point of no return, we will have to go through 2390 * the child proc to properly clean it up past this point. 2391 */ 2392 p2 = proc_alloc(); 2393 pid = p2->p_pid; 2394 2395 /* 2396 * Make a proc table entry for the new process. 2397 * Start by zeroing the section of proc that is zero-initialized, 2398 * then copy the section that is copied directly from the parent. 2399 */ 2400 memset(&p2->p_startzero, 0, 2401 (unsigned) ((char *)&p2->p_endzero - (char *)&p2->p_startzero)); 2402 memcpy(&p2->p_startcopy, &p1->p_startcopy, 2403 (unsigned) ((char *)&p2->p_endcopy - (char *)&p2->p_startcopy)); 2404 p2->p_vmspace = proc0.p_vmspace; 2405 2406 TAILQ_INIT(&p2->p_sigpend.sp_info); 2407 2408 LIST_INIT(&p2->p_lwps); 2409 LIST_INIT(&p2->p_sigwaiters); 2410 2411 /* 2412 * Duplicate sub-structures as needed. 2413 * Increase reference counts on shared objects. 2414 * Inherit flags we want to keep. The flags related to SIGCHLD 2415 * handling are important in order to keep a consistent behaviour 2416 * for the child after the fork. If we are a 32-bit process, the 2417 * child will be too. 2418 */ 2419 p2->p_flag = 2420 p1->p_flag & (PK_SUGID | PK_NOCLDWAIT | PK_CLDSIGIGN | PK_32); 2421 p2->p_emul = p1->p_emul; 2422 p2->p_execsw = p1->p_execsw; 2423 2424 mutex_init(&p2->p_stmutex, MUTEX_DEFAULT, IPL_HIGH); 2425 mutex_init(&p2->p_auxlock, MUTEX_DEFAULT, IPL_NONE); 2426 rw_init(&p2->p_reflock); 2427 cv_init(&p2->p_waitcv, "wait"); 2428 cv_init(&p2->p_lwpcv, "lwpwait"); 2429 2430 p2->p_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE); 2431 2432 kauth_proc_fork(p1, p2); 2433 2434 p2->p_raslist = NULL; 2435 p2->p_fd = fd_copy(); 2436 2437 /* XXX racy */ 2438 p2->p_mqueue_cnt = p1->p_mqueue_cnt; 2439 2440 p2->p_cwdi = cwdinit(); 2441 2442 /* 2443 * Note: p_limit (rlimit stuff) is copy-on-write, so normally 2444 * we just need increase pl_refcnt. 2445 */ 2446 if (!p1->p_limit->pl_writeable) { 2447 lim_addref(p1->p_limit); 2448 p2->p_limit = p1->p_limit; 2449 } else { 2450 p2->p_limit = lim_copy(p1->p_limit); 2451 } 2452 2453 p2->p_lflag = 0; 2454 p2->p_sflag = 0; 2455 p2->p_slflag = 0; 2456 p2->p_pptr = p1; 2457 p2->p_ppid = p1->p_pid; 2458 LIST_INIT(&p2->p_children); 2459 2460 p2->p_aio = NULL; 2461 2462 #ifdef KTRACE 2463 /* 2464 * Copy traceflag and tracefile if enabled. 2465 * If not inherited, these were zeroed above. 2466 */ 2467 if (p1->p_traceflag & KTRFAC_INHERIT) { 2468 mutex_enter(&ktrace_lock); 2469 p2->p_traceflag = p1->p_traceflag; 2470 if ((p2->p_tracep = p1->p_tracep) != NULL) 2471 ktradref(p2); 2472 mutex_exit(&ktrace_lock); 2473 } 2474 #endif 2475 2476 /* 2477 * Create signal actions for the child process. 2478 */ 2479 p2->p_sigacts = sigactsinit(p1, 0); 2480 mutex_enter(p1->p_lock); 2481 p2->p_sflag |= 2482 (p1->p_sflag & (PS_STOPFORK | PS_STOPEXEC | PS_NOCLDSTOP)); 2483 sched_proc_fork(p1, p2); 2484 mutex_exit(p1->p_lock); 2485 2486 p2->p_stflag = p1->p_stflag; 2487 2488 /* 2489 * p_stats. 2490 * Copy parts of p_stats, and zero out the rest. 2491 */ 2492 p2->p_stats = pstatscopy(p1->p_stats); 2493 2494 /* copy over machdep flags to the new proc */ 2495 cpu_proc_fork(p1, p2); 2496 2497 /* 2498 * Prepare remaining parts of spawn data 2499 */ 2500 spawn_data->sed_actions = fa; 2501 spawn_data->sed_attrs = sa; 2502 2503 spawn_data->sed_parent = p1; 2504 2505 /* create LWP */ 2506 lwp_create(l1, p2, uaddr, 0, NULL, 0, spawn_return, spawn_data, 2507 &l2, l1->l_class); 2508 l2->l_ctxlink = NULL; /* reset ucontext link */ 2509 2510 /* 2511 * Copy the credential so other references don't see our changes. 2512 * Test to see if this is necessary first, since in the common case 2513 * we won't need a private reference. 2514 */ 2515 if (kauth_cred_geteuid(l2->l_cred) != kauth_cred_getsvuid(l2->l_cred) || 2516 kauth_cred_getegid(l2->l_cred) != kauth_cred_getsvgid(l2->l_cred)) { 2517 l2->l_cred = kauth_cred_copy(l2->l_cred); 2518 kauth_cred_setsvuid(l2->l_cred, kauth_cred_geteuid(l2->l_cred)); 2519 kauth_cred_setsvgid(l2->l_cred, kauth_cred_getegid(l2->l_cred)); 2520 } 2521 2522 /* Update the master credentials. */ 2523 if (l2->l_cred != p2->p_cred) { 2524 kauth_cred_t ocred; 2525 2526 kauth_cred_hold(l2->l_cred); 2527 mutex_enter(p2->p_lock); 2528 ocred = p2->p_cred; 2529 p2->p_cred = l2->l_cred; 2530 mutex_exit(p2->p_lock); 2531 kauth_cred_free(ocred); 2532 } 2533 2534 *child_ok = true; 2535 spawn_data->sed_refcnt = 2; /* child gets it as well */ 2536 #if 0 2537 l2->l_nopreempt = 1; /* start it non-preemptable */ 2538 #endif 2539 2540 /* 2541 * It's now safe for the scheduler and other processes to see the 2542 * child process. 2543 */ 2544 mutex_enter(proc_lock); 2545 2546 if (p1->p_session->s_ttyvp != NULL && p1->p_lflag & PL_CONTROLT) 2547 p2->p_lflag |= PL_CONTROLT; 2548 2549 LIST_INSERT_HEAD(&p1->p_children, p2, p_sibling); 2550 p2->p_exitsig = SIGCHLD; /* signal for parent on exit */ 2551 2552 LIST_INSERT_AFTER(p1, p2, p_pglist); 2553 LIST_INSERT_HEAD(&allproc, p2, p_list); 2554 2555 p2->p_trace_enabled = trace_is_enabled(p2); 2556 #ifdef __HAVE_SYSCALL_INTERN 2557 (*p2->p_emul->e_syscall_intern)(p2); 2558 #endif 2559 2560 /* 2561 * Make child runnable, set start time, and add to run queue except 2562 * if the parent requested the child to start in SSTOP state. 2563 */ 2564 mutex_enter(p2->p_lock); 2565 2566 getmicrotime(&p2->p_stats->p_start); 2567 2568 lwp_lock(l2); 2569 KASSERT(p2->p_nrlwps == 1); 2570 p2->p_nrlwps = 1; 2571 p2->p_stat = SACTIVE; 2572 l2->l_stat = LSRUN; 2573 sched_enqueue(l2, false); 2574 lwp_unlock(l2); 2575 2576 mutex_exit(p2->p_lock); 2577 mutex_exit(proc_lock); 2578 2579 cv_wait(&spawn_data->sed_cv_child_ready, &spawn_data->sed_mtx_child); 2580 error = spawn_data->sed_error; 2581 mutex_exit(&spawn_data->sed_mtx_child); 2582 spawn_exec_data_release(spawn_data); 2583 2584 rw_exit(&p1->p_reflock); 2585 rw_exit(&exec_lock); 2586 have_exec_lock = false; 2587 2588 *pid_res = pid; 2589 return error; 2590 2591 error_exit: 2592 if (have_exec_lock) { 2593 execve_free_data(&spawn_data->sed_exec); 2594 rw_exit(&p1->p_reflock); 2595 rw_exit(&exec_lock); 2596 } 2597 mutex_exit(&spawn_data->sed_mtx_child); 2598 spawn_exec_data_release(spawn_data); 2599 2600 return error; 2601 } 2602 2603 int 2604 sys_posix_spawn(struct lwp *l1, const struct sys_posix_spawn_args *uap, 2605 register_t *retval) 2606 { 2607 /* { 2608 syscallarg(pid_t *) pid; 2609 syscallarg(const char *) path; 2610 syscallarg(const struct posix_spawn_file_actions *) file_actions; 2611 syscallarg(const struct posix_spawnattr *) attrp; 2612 syscallarg(char *const *) argv; 2613 syscallarg(char *const *) envp; 2614 } */ 2615 2616 int error; 2617 struct posix_spawn_file_actions *fa = NULL; 2618 struct posix_spawnattr *sa = NULL; 2619 pid_t pid; 2620 bool child_ok = false; 2621 rlim_t max_fileactions; 2622 proc_t *p = l1->l_proc; 2623 2624 error = check_posix_spawn(l1); 2625 if (error) { 2626 *retval = error; 2627 return 0; 2628 } 2629 2630 /* copy in file_actions struct */ 2631 if (SCARG(uap, file_actions) != NULL) { 2632 max_fileactions = 2 * min(p->p_rlimit[RLIMIT_NOFILE].rlim_cur, 2633 maxfiles); 2634 error = posix_spawn_fa_alloc(&fa, SCARG(uap, file_actions), 2635 max_fileactions); 2636 if (error) 2637 goto error_exit; 2638 } 2639 2640 /* copyin posix_spawnattr struct */ 2641 if (SCARG(uap, attrp) != NULL) { 2642 sa = kmem_alloc(sizeof(*sa), KM_SLEEP); 2643 error = copyin(SCARG(uap, attrp), sa, sizeof(*sa)); 2644 if (error) 2645 goto error_exit; 2646 } 2647 2648 /* 2649 * Do the spawn 2650 */ 2651 error = do_posix_spawn(l1, &pid, &child_ok, SCARG(uap, path), fa, sa, 2652 SCARG(uap, argv), SCARG(uap, envp), execve_fetch_element); 2653 if (error) 2654 goto error_exit; 2655 2656 if (error == 0 && SCARG(uap, pid) != NULL) 2657 error = copyout(&pid, SCARG(uap, pid), sizeof(pid)); 2658 2659 *retval = error; 2660 return 0; 2661 2662 error_exit: 2663 if (!child_ok) { 2664 (void)chgproccnt(kauth_cred_getuid(l1->l_cred), -1); 2665 atomic_dec_uint(&nprocs); 2666 2667 if (sa) 2668 kmem_free(sa, sizeof(*sa)); 2669 if (fa) 2670 posix_spawn_fa_free(fa, fa->len); 2671 } 2672 2673 *retval = error; 2674 return 0; 2675 } 2676 2677 void 2678 exec_free_emul_arg(struct exec_package *epp) 2679 { 2680 if (epp->ep_emul_arg_free != NULL) { 2681 KASSERT(epp->ep_emul_arg != NULL); 2682 (*epp->ep_emul_arg_free)(epp->ep_emul_arg); 2683 epp->ep_emul_arg_free = NULL; 2684 epp->ep_emul_arg = NULL; 2685 } else { 2686 KASSERT(epp->ep_emul_arg == NULL); 2687 } 2688 } 2689 2690 #ifdef DEBUG_EXEC 2691 static void 2692 dump_vmcmds(const struct exec_package * const epp, size_t x, int error) 2693 { 2694 struct exec_vmcmd *vp = &epp->ep_vmcmds.evs_cmds[0]; 2695 size_t j; 2696 2697 if (error == 0) 2698 DPRINTF(("vmcmds %u\n", epp->ep_vmcmds.evs_used)); 2699 else 2700 DPRINTF(("vmcmds %zu/%u, error %d\n", x, 2701 epp->ep_vmcmds.evs_used, error)); 2702 2703 for (j = 0; j < epp->ep_vmcmds.evs_used; j++) { 2704 DPRINTF(("vmcmd[%zu] = vmcmd_map_%s %#" 2705 PRIxVADDR"/%#"PRIxVSIZE" fd@%#" 2706 PRIxVSIZE" prot=0%o flags=%d\n", j, 2707 vp[j].ev_proc == vmcmd_map_pagedvn ? 2708 "pagedvn" : 2709 vp[j].ev_proc == vmcmd_map_readvn ? 2710 "readvn" : 2711 vp[j].ev_proc == vmcmd_map_zero ? 2712 "zero" : "*unknown*", 2713 vp[j].ev_addr, vp[j].ev_len, 2714 vp[j].ev_offset, vp[j].ev_prot, 2715 vp[j].ev_flags)); 2716 if (error != 0 && j == x) 2717 DPRINTF((" ^--- failed\n")); 2718 } 2719 } 2720 #endif 2721