xref: /openbsd-src/sys/kern/kern_exec.c (revision f763167468dba5339ed4b14b7ecaca2a397ab0f6)
1 /*	$OpenBSD: kern_exec.c,v 1.189 2017/08/29 02:51:27 deraadt Exp $	*/
2 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
3 
4 /*-
5  * Copyright (C) 1993, 1994 Christopher G. Demetriou
6  * Copyright (C) 1992 Wolfgang Solfrank.
7  * Copyright (C) 1992 TooLs GmbH.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by TooLs GmbH.
21  * 4. The name of TooLs GmbH may not be used to endorse or promote products
22  *    derived from this software without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
25  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
27  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
29  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
30  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
31  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
32  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
33  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/filedesc.h>
39 #include <sys/kernel.h>
40 #include <sys/proc.h>
41 #include <sys/mount.h>
42 #include <sys/malloc.h>
43 #include <sys/pool.h>
44 #include <sys/namei.h>
45 #include <sys/vnode.h>
46 #include <sys/file.h>
47 #include <sys/acct.h>
48 #include <sys/exec.h>
49 #include <sys/ktrace.h>
50 #include <sys/resourcevar.h>
51 #include <sys/wait.h>
52 #include <sys/mman.h>
53 #include <sys/signalvar.h>
54 #include <sys/stat.h>
55 #include <sys/conf.h>
56 #include <sys/pledge.h>
57 #ifdef SYSVSHM
58 #include <sys/shm.h>
59 #endif
60 
61 #include <sys/syscallargs.h>
62 
63 #include <uvm/uvm_extern.h>
64 #include <machine/tcb.h>
65 
66 const struct kmem_va_mode kv_exec = {
67 	.kv_wait = 1,
68 	.kv_map = &exec_map
69 };
70 
71 /*
72  * Map the shared signal code.
73  */
74 int exec_sigcode_map(struct process *, struct emul *);
75 
76 /*
77  * If non-zero, stackgap_random specifies the upper limit of the random gap size
78  * added to the fixed stack position. Must be n^2.
79  */
80 int stackgap_random = STACKGAP_RANDOM;
81 
82 /*
83  * check exec:
84  * given an "executable" described in the exec package's namei info,
85  * see what we can do with it.
86  *
87  * ON ENTRY:
88  *	exec package with appropriate namei info
89  *	proc pointer of exec'ing proc
90  *	NO SELF-LOCKED VNODES
91  *
92  * ON EXIT:
93  *	error:	nothing held, etc.  exec header still allocated.
94  *	ok:	filled exec package, one locked vnode.
95  *
96  * EXEC SWITCH ENTRY:
97  * 	Locked vnode to check, exec package, proc.
98  *
99  * EXEC SWITCH EXIT:
100  *	ok:	return 0, filled exec package, one locked vnode.
101  *	error:	destructive:
102  *			everything deallocated except exec header.
103  *		non-destructive:
104  *			error code, locked vnode, exec header unmodified
105  */
106 int
107 check_exec(struct proc *p, struct exec_package *epp)
108 {
109 	int error, i;
110 	struct vnode *vp;
111 	struct nameidata *ndp;
112 	size_t resid;
113 
114 	ndp = epp->ep_ndp;
115 	ndp->ni_cnd.cn_nameiop = LOOKUP;
116 	ndp->ni_cnd.cn_flags = FOLLOW | LOCKLEAF | SAVENAME;
117 	/* first get the vnode */
118 	if ((error = namei(ndp)) != 0)
119 		return (error);
120 	epp->ep_vp = vp = ndp->ni_vp;
121 
122 	/* check for regular file */
123 	if (vp->v_type == VDIR) {
124 		error = EISDIR;
125 		goto bad1;
126 	}
127 	if (vp->v_type != VREG) {
128 		error = EACCES;
129 		goto bad1;
130 	}
131 
132 	/* get attributes */
133 	if ((error = VOP_GETATTR(vp, epp->ep_vap, p->p_ucred, p)) != 0)
134 		goto bad1;
135 
136 	/* Check mount point */
137 	if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
138 		error = EACCES;
139 		goto bad1;
140 	}
141 
142 	if ((vp->v_mount->mnt_flag & MNT_NOSUID))
143 		epp->ep_vap->va_mode &= ~(VSUID | VSGID);
144 
145 	/* check access.  for root we have to see if any exec bit on */
146 	if ((error = VOP_ACCESS(vp, VEXEC, p->p_ucred, p)) != 0)
147 		goto bad1;
148 	if ((epp->ep_vap->va_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) {
149 		error = EACCES;
150 		goto bad1;
151 	}
152 
153 	/* try to open it */
154 	if ((error = VOP_OPEN(vp, FREAD, p->p_ucred, p)) != 0)
155 		goto bad1;
156 
157 	/* unlock vp, we need it unlocked from here */
158 	VOP_UNLOCK(vp, p);
159 
160 	/* now we have the file, get the exec header */
161 	error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
162 	    UIO_SYSSPACE, 0, p->p_ucred, &resid, p);
163 	if (error)
164 		goto bad2;
165 	epp->ep_hdrvalid = epp->ep_hdrlen - resid;
166 
167 	/*
168 	 * set up the vmcmds for creation of the process
169 	 * address space
170 	 */
171 	error = ENOEXEC;
172 	for (i = 0; i < nexecs && error != 0; i++) {
173 		int newerror;
174 
175 		if (execsw[i].es_check == NULL)
176 			continue;
177 		newerror = (*execsw[i].es_check)(p, epp);
178 		if (!newerror && !(epp->ep_emul->e_flags & EMUL_ENABLED))
179 			newerror = EPERM;
180 		/* make sure the first "interesting" error code is saved. */
181 		if (!newerror || error == ENOEXEC)
182 			error = newerror;
183 		if (epp->ep_flags & EXEC_DESTR && error != 0)
184 			return (error);
185 	}
186 	if (!error) {
187 		/* check that entry point is sane */
188 		if (epp->ep_entry > VM_MAXUSER_ADDRESS) {
189 			error = ENOEXEC;
190 		}
191 
192 		/* check limits */
193 		if ((epp->ep_tsize > MAXTSIZ) ||
194 		    (epp->ep_dsize > p->p_rlimit[RLIMIT_DATA].rlim_cur))
195 			error = ENOMEM;
196 
197 		if (!error)
198 			return (0);
199 	}
200 
201 	/*
202 	 * free any vmspace-creation commands,
203 	 * and release their references
204 	 */
205 	kill_vmcmds(&epp->ep_vmcmds);
206 
207 bad2:
208 	/*
209 	 * close the vnode, free the pathname buf, and punt.
210 	 */
211 	vn_close(vp, FREAD, p->p_ucred, p);
212 	pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
213 	return (error);
214 
215 bad1:
216 	/*
217 	 * free the namei pathname buffer, and put the vnode
218 	 * (which we don't yet have open).
219 	 */
220 	pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
221 	vput(vp);
222 	return (error);
223 }
224 
225 /*
226  * exec system call
227  */
228 int
229 sys_execve(struct proc *p, void *v, register_t *retval)
230 {
231 	struct sys_execve_args /* {
232 		syscallarg(const char *) path;
233 		syscallarg(char *const *) argp;
234 		syscallarg(char *const *) envp;
235 	} */ *uap = v;
236 	int error;
237 	struct exec_package pack;
238 	struct nameidata nid;
239 	struct vattr attr;
240 	struct ucred *cred = p->p_ucred;
241 	char *argp;
242 	char * const *cpp, *dp, *sp;
243 #ifdef KTRACE
244 	char *env_start;
245 #endif
246 	struct process *pr = p->p_p;
247 	long argc, envc;
248 	size_t len, sgap;
249 #ifdef MACHINE_STACK_GROWS_UP
250 	size_t slen;
251 #endif
252 	char *stack;
253 	struct ps_strings arginfo;
254 	struct vmspace *vm;
255 	char **tmpfap;
256 	extern struct emul emul_native;
257 	struct vnode *otvp;
258 
259 	/* get other threads to stop */
260 	if ((error = single_thread_set(p, SINGLE_UNWIND, 1)))
261 		return (error);
262 
263 	/*
264 	 * Cheap solution to complicated problems.
265 	 * Mark this process as "leave me alone, I'm execing".
266 	 */
267 	atomic_setbits_int(&pr->ps_flags, PS_INEXEC);
268 
269 	NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_USERSPACE, SCARG(uap, path), p);
270 	nid.ni_pledge = PLEDGE_EXEC;
271 
272 	/*
273 	 * initialize the fields of the exec package.
274 	 */
275 	pack.ep_name = (char *)SCARG(uap, path);
276 	pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC, M_WAITOK);
277 	pack.ep_hdrlen = exec_maxhdrsz;
278 	pack.ep_hdrvalid = 0;
279 	pack.ep_ndp = &nid;
280 	pack.ep_interp = NULL;
281 	pack.ep_emul_arg = NULL;
282 	VMCMDSET_INIT(&pack.ep_vmcmds);
283 	pack.ep_vap = &attr;
284 	pack.ep_emul = &emul_native;
285 	pack.ep_flags = 0;
286 
287 	/* see if we can run it. */
288 	if ((error = check_exec(p, &pack)) != 0) {
289 		goto freehdr;
290 	}
291 
292 	/* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
293 
294 	/* allocate an argument buffer */
295 	argp = km_alloc(NCARGS, &kv_exec, &kp_pageable, &kd_waitok);
296 #ifdef DIAGNOSTIC
297 	if (argp == NULL)
298 		panic("execve: argp == NULL");
299 #endif
300 	dp = argp;
301 	argc = 0;
302 
303 	/* copy the fake args list, if there's one, freeing it as we go */
304 	if (pack.ep_flags & EXEC_HASARGL) {
305 		tmpfap = pack.ep_fa;
306 		while (*tmpfap != NULL) {
307 			char *cp;
308 
309 			cp = *tmpfap;
310 			while (*cp)
311 				*dp++ = *cp++;
312 			*dp++ = '\0';
313 
314 			free(*tmpfap, M_EXEC, 0);
315 			tmpfap++; argc++;
316 		}
317 		free(pack.ep_fa, M_EXEC, 0);
318 		pack.ep_flags &= ~EXEC_HASARGL;
319 	}
320 
321 	/* Now get argv & environment */
322 	if (!(cpp = SCARG(uap, argp))) {
323 		error = EFAULT;
324 		goto bad;
325 	}
326 
327 	if (pack.ep_flags & EXEC_SKIPARG)
328 		cpp++;
329 
330 	while (1) {
331 		len = argp + ARG_MAX - dp;
332 		if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
333 			goto bad;
334 		if (!sp)
335 			break;
336 		if ((error = copyinstr(sp, dp, len, &len)) != 0) {
337 			if (error == ENAMETOOLONG)
338 				error = E2BIG;
339 			goto bad;
340 		}
341 		dp += len;
342 		cpp++;
343 		argc++;
344 	}
345 
346 	/* must have at least one argument */
347 	if (argc == 0) {
348 		error = EINVAL;
349 		goto bad;
350 	}
351 
352 #ifdef KTRACE
353 	if (KTRPOINT(p, KTR_EXECARGS))
354 		ktrexec(p, KTR_EXECARGS, argp, dp - argp);
355 #endif
356 
357 	envc = 0;
358 	/* environment does not need to be there */
359 	if ((cpp = SCARG(uap, envp)) != NULL ) {
360 #ifdef KTRACE
361 		env_start = dp;
362 #endif
363 		while (1) {
364 			len = argp + ARG_MAX - dp;
365 			if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
366 				goto bad;
367 			if (!sp)
368 				break;
369 			if ((error = copyinstr(sp, dp, len, &len)) != 0) {
370 				if (error == ENAMETOOLONG)
371 					error = E2BIG;
372 				goto bad;
373 			}
374 			dp += len;
375 			cpp++;
376 			envc++;
377 		}
378 
379 #ifdef KTRACE
380 		if (KTRPOINT(p, KTR_EXECENV))
381 			ktrexec(p, KTR_EXECENV, env_start, dp - env_start);
382 #endif
383 	}
384 
385 	dp = (char *)(((long)dp + _STACKALIGNBYTES) & ~_STACKALIGNBYTES);
386 
387 	sgap = STACKGAPLEN;
388 
389 	/*
390 	 * If we have enabled random stackgap, the stack itself has already
391 	 * been moved from a random location, but is still aligned to a page
392 	 * boundary.  Provide the lower bits of random placement now.
393 	 */
394 	if (stackgap_random != 0) {
395 		sgap += arc4random() & PAGE_MASK;
396 		sgap = (sgap + _STACKALIGNBYTES) & ~_STACKALIGNBYTES;
397 	}
398 
399 	/* Now check if args & environ fit into new stack */
400 	len = ((argc + envc + 2 + pack.ep_emul->e_arglen) * sizeof(char *) +
401 	    sizeof(long) + dp + sgap + sizeof(struct ps_strings)) - argp;
402 
403 	len = (len + _STACKALIGNBYTES) &~ _STACKALIGNBYTES;
404 
405 	if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
406 		error = ENOMEM;
407 		goto bad;
408 	}
409 
410 	/* adjust "active stack depth" for process VSZ */
411 	pack.ep_ssize = len;	/* maybe should go elsewhere, but... */
412 
413 	/*
414 	 * we're committed: any further errors will kill the process, so
415 	 * kill the other threads now.
416 	 */
417 	single_thread_set(p, SINGLE_EXIT, 0);
418 
419 	/*
420 	 * Prepare vmspace for remapping. Note that uvmspace_exec can replace
421 	 * ps_vmspace!
422 	 */
423 	uvmspace_exec(p, VM_MIN_ADDRESS, VM_MAXUSER_ADDRESS);
424 
425 	vm = pr->ps_vmspace;
426 	/* Now map address space */
427 	vm->vm_taddr = (char *)trunc_page(pack.ep_taddr);
428 	vm->vm_tsize = atop(round_page(pack.ep_taddr + pack.ep_tsize) -
429 	    trunc_page(pack.ep_taddr));
430 	vm->vm_daddr = (char *)trunc_page(pack.ep_daddr);
431 	vm->vm_dsize = atop(round_page(pack.ep_daddr + pack.ep_dsize) -
432 	    trunc_page(pack.ep_daddr));
433 	vm->vm_dused = 0;
434 	vm->vm_ssize = atop(round_page(pack.ep_ssize));
435 	vm->vm_maxsaddr = (char *)pack.ep_maxsaddr;
436 	vm->vm_minsaddr = (char *)pack.ep_minsaddr;
437 
438 	/* create the new process's VM space by running the vmcmds */
439 #ifdef DIAGNOSTIC
440 	if (pack.ep_vmcmds.evs_used == 0)
441 		panic("execve: no vmcmds");
442 #endif
443 	error = exec_process_vmcmds(p, &pack);
444 
445 	/* if an error happened, deallocate and punt */
446 	if (error)
447 		goto exec_abort;
448 
449 	/* old "stackgap" is gone now */
450 	pr->ps_stackgap = 0;
451 
452 #ifdef MACHINE_STACK_GROWS_UP
453 	pr->ps_strings = (vaddr_t)vm->vm_maxsaddr + sgap;
454         if (uvm_map_protect(&vm->vm_map, (vaddr_t)vm->vm_maxsaddr,
455             trunc_page(pr->ps_strings), PROT_NONE, TRUE))
456                 goto exec_abort;
457 #else
458 	pr->ps_strings = (vaddr_t)vm->vm_minsaddr - sizeof(arginfo) - sgap;
459         if (uvm_map_protect(&vm->vm_map,
460             round_page(pr->ps_strings + sizeof(arginfo)),
461             (vaddr_t)vm->vm_minsaddr, PROT_NONE, TRUE))
462                 goto exec_abort;
463 #endif
464 
465 	/* remember information about the process */
466 	arginfo.ps_nargvstr = argc;
467 	arginfo.ps_nenvstr = envc;
468 
469 #ifdef MACHINE_STACK_GROWS_UP
470 	stack = (char *)vm->vm_maxsaddr + sizeof(arginfo) + sgap;
471 	slen = len - sizeof(arginfo) - sgap;
472 #else
473 	stack = (char *)(vm->vm_minsaddr - len);
474 #endif
475 	/* Now copy argc, args & environ to new stack */
476 	if (!(*pack.ep_emul->e_copyargs)(&pack, &arginfo, stack, argp))
477 		goto exec_abort;
478 
479 	/* copy out the process's ps_strings structure */
480 	if (copyout(&arginfo, (char *)pr->ps_strings, sizeof(arginfo)))
481 		goto exec_abort;
482 
483 	stopprofclock(pr);	/* stop profiling */
484 	fdcloseexec(p);		/* handle close on exec */
485 	execsigs(p);		/* reset caught signals */
486 	TCB_SET(p, NULL);	/* reset the TCB address */
487 	pr->ps_kbind_addr = 0;	/* reset the kbind bits */
488 	pr->ps_kbind_cookie = 0;
489 	arc4random_buf(&pr->ps_sigcookie, sizeof pr->ps_sigcookie);
490 
491 	/* set command name & other accounting info */
492 	memset(pr->ps_comm, 0, sizeof(pr->ps_comm));
493 	len = min(nid.ni_cnd.cn_namelen, MAXCOMLEN);
494 	memcpy(pr->ps_comm, nid.ni_cnd.cn_nameptr, len);
495 	pr->ps_acflag &= ~AFORK;
496 
497 	/* record proc's vnode, for use by sysctl */
498 	otvp = pr->ps_textvp;
499 	vref(pack.ep_vp);
500 	pr->ps_textvp = pack.ep_vp;
501 	if (otvp)
502 		vrele(otvp);
503 
504 	atomic_setbits_int(&pr->ps_flags, PS_EXEC);
505 	if (pr->ps_flags & PS_PPWAIT) {
506 		atomic_clearbits_int(&pr->ps_flags, PS_PPWAIT);
507 		atomic_clearbits_int(&pr->ps_pptr->ps_flags, PS_ISPWAIT);
508 		wakeup(pr->ps_pptr);
509 	}
510 
511 	/*
512 	 * If process does execve() while it has a mismatched real,
513 	 * effective, or saved uid/gid, we set PS_SUGIDEXEC.
514 	 */
515 	if (cred->cr_uid != cred->cr_ruid ||
516 	    cred->cr_uid != cred->cr_svuid ||
517 	    cred->cr_gid != cred->cr_rgid ||
518 	    cred->cr_gid != cred->cr_svgid)
519 		atomic_setbits_int(&pr->ps_flags, PS_SUGIDEXEC);
520 	else
521 		atomic_clearbits_int(&pr->ps_flags, PS_SUGIDEXEC);
522 
523 	atomic_clearbits_int(&pr->ps_flags, PS_PLEDGE);
524 
525 	/*
526 	 * deal with set[ug]id.
527 	 * MNT_NOEXEC has already been used to disable s[ug]id.
528 	 */
529 	if ((attr.va_mode & (VSUID | VSGID)) && proc_cansugid(p)) {
530 		int i;
531 
532 		atomic_setbits_int(&pr->ps_flags, PS_SUGID|PS_SUGIDEXEC);
533 
534 #ifdef KTRACE
535 		/*
536 		 * If process is being ktraced, turn off - unless
537 		 * root set it.
538 		 */
539 		if (pr->ps_tracevp && !(pr->ps_traceflag & KTRFAC_ROOT))
540 			ktrcleartrace(pr);
541 #endif
542 		p->p_ucred = cred = crcopy(cred);
543 		if (attr.va_mode & VSUID)
544 			cred->cr_uid = attr.va_uid;
545 		if (attr.va_mode & VSGID)
546 			cred->cr_gid = attr.va_gid;
547 
548 		/*
549 		 * For set[ug]id processes, a few caveats apply to
550 		 * stdin, stdout, and stderr.
551 		 */
552 		error = 0;
553 		fdplock(p->p_fd);
554 		for (i = 0; i < 3; i++) {
555 			struct file *fp = NULL;
556 
557 			/*
558 			 * NOTE - This will never return NULL because of
559 			 * immature fds. The file descriptor table is not
560 			 * shared because we're suid.
561 			 */
562 			fp = fd_getfile(p->p_fd, i);
563 
564 			/*
565 			 * Ensure that stdin, stdout, and stderr are already
566 			 * allocated.  We do not want userland to accidentally
567 			 * allocate descriptors in this range which has implied
568 			 * meaning to libc.
569 			 */
570 			if (fp == NULL) {
571 				short flags = FREAD | (i == 0 ? 0 : FWRITE);
572 				struct vnode *vp;
573 				int indx;
574 
575 				if ((error = falloc(p, 0, &fp, &indx)) != 0)
576 					break;
577 #ifdef DIAGNOSTIC
578 				if (indx != i)
579 					panic("sys_execve: falloc indx != i");
580 #endif
581 				if ((error = cdevvp(getnulldev(), &vp)) != 0) {
582 					fdremove(p->p_fd, indx);
583 					closef(fp, p);
584 					break;
585 				}
586 				if ((error = VOP_OPEN(vp, flags, cred, p)) != 0) {
587 					fdremove(p->p_fd, indx);
588 					closef(fp, p);
589 					vrele(vp);
590 					break;
591 				}
592 				if (flags & FWRITE)
593 					vp->v_writecount++;
594 				fp->f_flag = flags;
595 				fp->f_type = DTYPE_VNODE;
596 				fp->f_ops = &vnops;
597 				fp->f_data = (caddr_t)vp;
598 				FILE_SET_MATURE(fp, p);
599 			}
600 		}
601 		fdpunlock(p->p_fd);
602 		if (error)
603 			goto exec_abort;
604 	} else
605 		atomic_clearbits_int(&pr->ps_flags, PS_SUGID);
606 
607 	/*
608 	 * Reset the saved ugids and update the process's copy of the
609 	 * creds if the creds have been changed
610 	 */
611 	if (cred->cr_uid != cred->cr_svuid ||
612 	    cred->cr_gid != cred->cr_svgid) {
613 		/* make sure we have unshared ucreds */
614 		p->p_ucred = cred = crcopy(cred);
615 		cred->cr_svuid = cred->cr_uid;
616 		cred->cr_svgid = cred->cr_gid;
617 	}
618 
619 	if (pr->ps_ucred != cred) {
620 		struct ucred *ocred;
621 
622 		ocred = pr->ps_ucred;
623 		crhold(cred);
624 		pr->ps_ucred = cred;
625 		crfree(ocred);
626 	}
627 
628 	if (pr->ps_flags & PS_SUGIDEXEC) {
629 		int i, s = splclock();
630 
631 		timeout_del(&pr->ps_realit_to);
632 		for (i = 0; i < nitems(pr->ps_timer); i++) {
633 			timerclear(&pr->ps_timer[i].it_interval);
634 			timerclear(&pr->ps_timer[i].it_value);
635 		}
636 		splx(s);
637 	}
638 
639 	/* reset CPU time usage for the thread, but not the process */
640 	timespecclear(&p->p_tu.tu_runtime);
641 	p->p_tu.tu_uticks = p->p_tu.tu_sticks = p->p_tu.tu_iticks = 0;
642 
643 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
644 
645 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
646 	vn_close(pack.ep_vp, FREAD, cred, p);
647 
648 	/*
649 	 * notify others that we exec'd
650 	 */
651 	KNOTE(&pr->ps_klist, NOTE_EXEC);
652 
653 	/* setup new registers and do misc. setup. */
654 	if (pack.ep_emul->e_fixup != NULL) {
655 		if ((*pack.ep_emul->e_fixup)(p, &pack) != 0)
656 			goto free_pack_abort;
657 	}
658 #ifdef MACHINE_STACK_GROWS_UP
659 	(*pack.ep_emul->e_setregs)(p, &pack, (u_long)stack + slen, retval);
660 #else
661 	(*pack.ep_emul->e_setregs)(p, &pack, (u_long)stack, retval);
662 #endif
663 
664 	/* map the process's signal trampoline code */
665 	if (exec_sigcode_map(pr, pack.ep_emul))
666 		goto free_pack_abort;
667 
668 #ifdef __HAVE_EXEC_MD_MAP
669 	/* perform md specific mappings that process might need */
670 	if (exec_md_map(p, &pack))
671 		goto free_pack_abort;
672 #endif
673 
674 	if (pr->ps_flags & PS_TRACED)
675 		psignal(p, SIGTRAP);
676 
677 	free(pack.ep_hdr, M_EXEC, pack.ep_hdrlen);
678 
679 	p->p_descfd = 255;
680 	if ((pack.ep_flags & EXEC_HASFD) && pack.ep_fd < 255)
681 		p->p_descfd = pack.ep_fd;
682 
683 	if (pack.ep_flags & EXEC_WXNEEDED)
684 		p->p_p->ps_flags |= PS_WXNEEDED;
685 	else
686 		p->p_p->ps_flags &= ~PS_WXNEEDED;
687 
688 	/* update ps_emul, the old value is no longer needed */
689 	pr->ps_emul = pack.ep_emul;
690 
691 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
692 	single_thread_clear(p, P_SUSPSIG);
693 
694 	return (0);
695 
696 bad:
697 	/* free the vmspace-creation commands, and release their references */
698 	kill_vmcmds(&pack.ep_vmcmds);
699 	/* kill any opened file descriptor, if necessary */
700 	if (pack.ep_flags & EXEC_HASFD) {
701 		pack.ep_flags &= ~EXEC_HASFD;
702 		fdplock(p->p_fd);
703 		(void) fdrelease(p, pack.ep_fd);
704 		fdpunlock(p->p_fd);
705 	}
706 	if (pack.ep_interp != NULL)
707 		pool_put(&namei_pool, pack.ep_interp);
708 	if (pack.ep_emul_arg != NULL)
709 		free(pack.ep_emul_arg, M_TEMP, pack.ep_emul_argsize);
710 	/* close and put the exec'd file */
711 	vn_close(pack.ep_vp, FREAD, cred, p);
712 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
713 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
714 
715 freehdr:
716 	free(pack.ep_hdr, M_EXEC, pack.ep_hdrlen);
717 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
718 	single_thread_clear(p, P_SUSPSIG);
719 
720 	return (error);
721 
722 exec_abort:
723 	/*
724 	 * the old process doesn't exist anymore.  exit gracefully.
725 	 * get rid of the (new) address space we have created, if any, get rid
726 	 * of our namei data and vnode, and exit noting failure
727 	 */
728 	uvm_deallocate(&vm->vm_map, VM_MIN_ADDRESS,
729 		VM_MAXUSER_ADDRESS - VM_MIN_ADDRESS);
730 	if (pack.ep_interp != NULL)
731 		pool_put(&namei_pool, pack.ep_interp);
732 	if (pack.ep_emul_arg != NULL)
733 		free(pack.ep_emul_arg, M_TEMP, pack.ep_emul_argsize);
734 	pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
735 	vn_close(pack.ep_vp, FREAD, cred, p);
736 	km_free(argp, NCARGS, &kv_exec, &kp_pageable);
737 
738 free_pack_abort:
739 	free(pack.ep_hdr, M_EXEC, pack.ep_hdrlen);
740 	exit1(p, W_EXITCODE(0, SIGABRT), EXIT_NORMAL);
741 
742 	/* NOTREACHED */
743 	atomic_clearbits_int(&pr->ps_flags, PS_INEXEC);
744 
745 	return (0);
746 }
747 
748 
749 void *
750 copyargs(struct exec_package *pack, struct ps_strings *arginfo, void *stack,
751     void *argp)
752 {
753 	char **cpp = stack;
754 	char *dp, *sp;
755 	size_t len;
756 	void *nullp = NULL;
757 	long argc = arginfo->ps_nargvstr;
758 	int envc = arginfo->ps_nenvstr;
759 
760 	if (copyout(&argc, cpp++, sizeof(argc)))
761 		return (NULL);
762 
763 	dp = (char *) (cpp + argc + envc + 2 + pack->ep_emul->e_arglen);
764 	sp = argp;
765 
766 	/* XXX don't copy them out, remap them! */
767 	arginfo->ps_argvstr = cpp; /* remember location of argv for later */
768 
769 	for (; --argc >= 0; sp += len, dp += len)
770 		if (copyout(&dp, cpp++, sizeof(dp)) ||
771 		    copyoutstr(sp, dp, ARG_MAX, &len))
772 			return (NULL);
773 
774 	if (copyout(&nullp, cpp++, sizeof(nullp)))
775 		return (NULL);
776 
777 	arginfo->ps_envstr = cpp; /* remember location of envp for later */
778 
779 	for (; --envc >= 0; sp += len, dp += len)
780 		if (copyout(&dp, cpp++, sizeof(dp)) ||
781 		    copyoutstr(sp, dp, ARG_MAX, &len))
782 			return (NULL);
783 
784 	if (copyout(&nullp, cpp++, sizeof(nullp)))
785 		return (NULL);
786 
787 	return (cpp);
788 }
789 
790 int
791 exec_sigcode_map(struct process *pr, struct emul *e)
792 {
793 	vsize_t sz;
794 
795 	sz = (vaddr_t)e->e_esigcode - (vaddr_t)e->e_sigcode;
796 
797 	/*
798 	 * If we don't have a sigobject for this emulation, create one.
799 	 *
800 	 * sigobject is an anonymous memory object (just like SYSV shared
801 	 * memory) that we keep a permanent reference to and that we map
802 	 * in all processes that need this sigcode. The creation is simple,
803 	 * we create an object, add a permanent reference to it, map it in
804 	 * kernel space, copy out the sigcode to it and unmap it.
805 	 * Then we map it with PROT_READ|PROT_EXEC into the process just
806 	 * the way sys_mmap would map it.
807 	 */
808 	if (e->e_sigobject == NULL) {
809 		extern int sigfillsiz;
810 		extern u_char sigfill[];
811 		size_t off;
812 		vaddr_t va;
813 		int r;
814 
815 		e->e_sigobject = uao_create(sz, 0);
816 		uao_reference(e->e_sigobject);	/* permanent reference */
817 
818 		if ((r = uvm_map(kernel_map, &va, round_page(sz), e->e_sigobject,
819 		    0, 0, UVM_MAPFLAG(PROT_READ | PROT_WRITE, PROT_READ | PROT_WRITE,
820 		    MAP_INHERIT_SHARE, MADV_RANDOM, 0)))) {
821 			uao_detach(e->e_sigobject);
822 			return (ENOMEM);
823 		}
824 
825 		for (off = 0; off < round_page(sz); off += sigfillsiz)
826 			memcpy((caddr_t)va + off, sigfill, sigfillsiz);
827 		memcpy((caddr_t)va, e->e_sigcode, sz);
828 		uvm_unmap(kernel_map, va, va + round_page(sz));
829 	}
830 
831 	pr->ps_sigcode = 0; /* no hint */
832 	uao_reference(e->e_sigobject);
833 	if (uvm_map(&pr->ps_vmspace->vm_map, &pr->ps_sigcode, round_page(sz),
834 	    e->e_sigobject, 0, 0, UVM_MAPFLAG(PROT_READ | PROT_EXEC,
835 	    PROT_READ | PROT_WRITE | PROT_EXEC, MAP_INHERIT_COPY,
836 	    MADV_RANDOM, UVM_FLAG_COPYONW))) {
837 		uao_detach(e->e_sigobject);
838 		return (ENOMEM);
839 	}
840 
841 	/* Calculate PC at point of sigreturn entry */
842 	pr->ps_sigcoderet = pr->ps_sigcode +
843 	    (pr->ps_emul->e_esigret - pr->ps_emul->e_sigcode);
844 
845 	return (0);
846 }
847