Bug Summary

File:kern/kern_exec.c
Warning:line 843, column 8
Although the value stored to 'r' is used in the enclosing expression, the value is never actually read from 'r'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name kern_exec.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -D CONFIG_DRM_AMD_DC_DCN3_0 -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /usr/obj/sys/arch/amd64/compile/GENERIC.MP/scan-build/2022-01-12-131800-47421-1 -x c /usr/src/sys/kern/kern_exec.c
1/* $OpenBSD: kern_exec.c,v 1.228 2021/12/09 00:26:10 guenther Exp $ */
2/* $NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $ */
3
4/*-
5 * Copyright (C) 1993, 1994 Christopher G. Demetriou
6 * Copyright (C) 1992 Wolfgang Solfrank.
7 * Copyright (C) 1992 TooLs GmbH.
8 * All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 * must display the following acknowledgement:
20 * This product includes software developed by TooLs GmbH.
21 * 4. The name of TooLs GmbH may not be used to endorse or promote products
22 * derived from this software without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
25 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
27 * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
29 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
30 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
31 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
32 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
33 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36#include <sys/param.h>
37#include <sys/systm.h>
38#include <sys/filedesc.h>
39#include <sys/kernel.h>
40#include <sys/proc.h>
41#include <sys/mount.h>
42#include <sys/malloc.h>
43#include <sys/pool.h>
44#include <sys/namei.h>
45#include <sys/vnode.h>
46#include <sys/fcntl.h>
47#include <sys/file.h>
48#include <sys/acct.h>
49#include <sys/exec.h>
50#include <sys/exec_elf.h>
51#include <sys/ktrace.h>
52#include <sys/resourcevar.h>
53#include <sys/wait.h>
54#include <sys/mman.h>
55#include <sys/signalvar.h>
56#include <sys/stat.h>
57#include <sys/conf.h>
58#include <sys/pledge.h>
59#ifdef SYSVSHM1
60#include <sys/shm.h>
61#endif
62
63#include <sys/syscallargs.h>
64
65#include <uvm/uvm_extern.h>
66#include <machine/tcb.h>
67
68#include <sys/timetc.h>
69
70struct uvm_object *sigobject; /* shared sigcode object */
71struct uvm_object *timekeep_object;
72struct timekeep *timekeep;
73
74void unveil_destroy(struct process *ps);
75
76const struct kmem_va_mode kv_exec = {
77 .kv_wait = 1,
78 .kv_map = &exec_map
79};
80
81/*
82 * Map the shared signal code.
83 */
84int exec_sigcode_map(struct process *);
85
86/*
87 * Map the shared timekeep page.
88 */
89int exec_timekeep_map(struct process *);
90
91/*
92 * If non-zero, stackgap_random specifies the upper limit of the random gap size
93 * added to the fixed stack position. Must be n^2.
94 */
95int stackgap_random = STACKGAP_RANDOM256*1024;
96
97/*
98 * check exec:
99 * given an "executable" described in the exec package's namei info,
100 * see what we can do with it.
101 *
102 * ON ENTRY:
103 * exec package with appropriate namei info
104 * proc pointer of exec'ing proc
105 * NO SELF-LOCKED VNODES
106 *
107 * ON EXIT:
108 * error: nothing held, etc. exec header still allocated.
109 * ok: filled exec package, one locked vnode.
110 *
111 * EXEC SWITCH ENTRY:
112 * Locked vnode to check, exec package, proc.
113 *
114 * EXEC SWITCH EXIT:
115 * ok: return 0, filled exec package, one locked vnode.
116 * error: destructive:
117 * everything deallocated except exec header.
118 * non-destructive:
119 * error code, locked vnode, exec header unmodified
120 */
121int
122check_exec(struct proc *p, struct exec_package *epp)
123{
124 int error, i;
125 struct vnode *vp;
126 struct nameidata *ndp;
127 size_t resid;
128
129 ndp = epp->ep_ndp;
130 ndp->ni_cnd.cn_nameiop = LOOKUP0;
131 ndp->ni_cnd.cn_flags = FOLLOW0x0040 | LOCKLEAF0x0004 | SAVENAME0x000800;
132 if (epp->ep_flags & EXEC_INDIR0x0001)
133 ndp->ni_cnd.cn_flags |= BYPASSUNVEIL0x400000;
134 /* first get the vnode */
135 if ((error = namei(ndp)) != 0)
136 return (error);
137 epp->ep_vp = vp = ndp->ni_vp;
138
139 /* check for regular file */
140 if (vp->v_type != VREG) {
141 error = EACCES13;
142 goto bad1;
143 }
144
145 /* get attributes */
146 if ((error = VOP_GETATTR(vp, epp->ep_vap, p->p_ucred, p)) != 0)
147 goto bad1;
148
149 /* Check mount point */
150 if (vp->v_mount->mnt_flag & MNT_NOEXEC0x00000004) {
151 error = EACCES13;
152 goto bad1;
153 }
154
155 /* SUID programs may not be started with execpromises */
156 if ((epp->ep_vap->va_mode & (VSUID04000 | VSGID02000)) &&
157 (p->p_p->ps_flags & PS_EXECPLEDGE0x00400000)) {
158 error = EACCES13;
159 goto bad1;
160 }
161
162 if ((vp->v_mount->mnt_flag & MNT_NOSUID0x00000008))
163 epp->ep_vap->va_mode &= ~(VSUID04000 | VSGID02000);
164
165 /* check access. for root we have to see if any exec bit on */
166 if ((error = VOP_ACCESS(vp, VEXEC00100, p->p_ucred, p)) != 0)
167 goto bad1;
168 if ((epp->ep_vap->va_mode & (S_IXUSR0000100 | S_IXGRP0000010 | S_IXOTH0000001)) == 0) {
169 error = EACCES13;
170 goto bad1;
171 }
172
173 /* try to open it */
174 if ((error = VOP_OPEN(vp, FREAD0x0001, p->p_ucred, p)) != 0)
175 goto bad1;
176
177 /* unlock vp, we need it unlocked from here */
178 VOP_UNLOCK(vp);
179
180 /* now we have the file, get the exec header */
181 error = vn_rdwr(UIO_READ, vp, epp->ep_hdr, epp->ep_hdrlen, 0,
182 UIO_SYSSPACE, 0, p->p_ucred, &resid, p);
183 if (error)
184 goto bad2;
185 epp->ep_hdrvalid = epp->ep_hdrlen - resid;
186
187 /*
188 * set up the vmcmds for creation of the process
189 * address space
190 */
191 error = ENOEXEC8;
192 for (i = 0; i < nexecs && error != 0; i++) {
193 int newerror;
194
195 if (execsw[i].es_check == NULL((void *)0))
196 continue;
197 newerror = (*execsw[i].es_check)(p, epp);
198 /* make sure the first "interesting" error code is saved. */
199 if (!newerror || error == ENOEXEC8)
200 error = newerror;
201 if (epp->ep_flags & EXEC_DESTR0x0010 && error != 0)
202 return (error);
203 }
204 if (!error) {
205 /* check that entry point is sane */
206 if (epp->ep_entry > VM_MAXUSER_ADDRESS0x00007f7fffffc000) {
207 error = ENOEXEC8;
208 }
209
210 /* check limits */
211 if ((epp->ep_tsize > MAXTSIZ((paddr_t)256*1024*1024)) ||
212 (epp->ep_dsize > lim_cur(RLIMIT_DATA2)))
213 error = ENOMEM12;
214
215 if (!error)
216 return (0);
217 }
218
219 /*
220 * free any vmspace-creation commands,
221 * and release their references
222 */
223 kill_vmcmds(&epp->ep_vmcmds);
224
225bad2:
226 /*
227 * close the vnode, free the pathname buf, and punt.
228 */
229 vn_close(vp, FREAD0x0001, p->p_ucred, p);
230 pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
231 return (error);
232
233bad1:
234 /*
235 * free the namei pathname buffer, and put the vnode
236 * (which we don't yet have open).
237 */
238 pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
239 vput(vp);
240 return (error);
241}
242
243/*
244 * exec system call
245 */
246int
247sys_execve(struct proc *p, void *v, register_t *retval)
248{
249 struct sys_execve_args /* {
250 syscallarg(const char *) path;
251 syscallarg(char *const *) argp;
252 syscallarg(char *const *) envp;
253 } */ *uap = v;
254 int error;
255 struct exec_package pack;
256 struct nameidata nid;
257 struct vattr attr;
258 struct ucred *cred = p->p_ucred;
259 char *argp;
260 char * const *cpp, *dp, *sp;
261#ifdef KTRACE1
262 char *env_start;
263#endif
264 struct process *pr = p->p_p;
265 long argc, envc;
266 size_t len, sgap, dstsize;
267#ifdef MACHINE_STACK_GROWS_UP
268 size_t slen;
269#endif
270 char *stack;
271 struct ps_strings arginfo;
272 struct vmspace *vm;
273 struct vnode *otvp;
274
275 /* get other threads to stop */
276 if ((error = single_thread_set(p, SINGLE_UNWIND, 1)))
277 return (error);
278
279 /*
280 * Cheap solution to complicated problems.
281 * Mark this process as "leave me alone, I'm execing".
282 */
283 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_INEXEC0x00000004);
284
285 NDINIT(&nid, LOOKUP, NOFOLLOW, UIO_USERSPACE, SCARG(uap, path), p)ndinitat(&nid, 0, 0x0000, UIO_USERSPACE, -100, ((uap)->
path.le.datum), p);
286 nid.ni_pledge = PLEDGE_EXEC0x0000000000080000ULL;
287 nid.ni_unveil = UNVEIL_EXEC0x08;
288
289 /*
290 * initialize the fields of the exec package.
291 */
292 pack.ep_name = (char *)SCARG(uap, path)((uap)->path.le.datum);
293 pack.ep_hdr = malloc(exec_maxhdrsz, M_EXEC63, M_WAITOK0x0001);
294 pack.ep_hdrlen = exec_maxhdrsz;
295 pack.ep_hdrvalid = 0;
296 pack.ep_ndp = &nid;
297 pack.ep_interp = NULL((void *)0);
298 pack.ep_args = NULL((void *)0);
299 pack.ep_auxinfo = NULL((void *)0);
300 VMCMDSET_INIT(&pack.ep_vmcmds)do { (&pack.ep_vmcmds)->evs_cnt = 8; (&pack.ep_vmcmds
)->evs_cmds = (&pack.ep_vmcmds)->evs_start; (&pack
.ep_vmcmds)->evs_used = 0; } while (0);
301 pack.ep_vap = &attr;
302 pack.ep_flags = 0;
303
304 /* see if we can run it. */
305 if ((error = check_exec(p, &pack)) != 0) {
306 goto freehdr;
307 }
308
309 /* XXX -- THE FOLLOWING SECTION NEEDS MAJOR CLEANUP */
310
311 /* allocate an argument buffer */
312 argp = km_alloc(NCARGS(512 * 1024), &kv_exec, &kp_pageable, &kd_waitok);
313#ifdef DIAGNOSTIC1
314 if (argp == NULL((void *)0))
315 panic("execve: argp == NULL");
316#endif
317 dp = argp;
318 argc = 0;
319
320 /*
321 * Copy the fake args list, if there's one, freeing it as we go.
322 * exec_script_makecmds() allocates either 2 or 3 fake args bounded
323 * by MAXINTERP + MAXPATHLEN < NCARGS so no overflow can happen.
324 */
325 if (pack.ep_flags & EXEC_HASARGL0x0004) {
326 dstsize = NCARGS(512 * 1024);
327 for(; pack.ep_fa[argc] != NULL((void *)0); argc++) {
328 len = strlcpy(dp, pack.ep_fa[argc], dstsize);
329 len++;
330 dp += len; dstsize -= len;
331 if (pack.ep_fa[argc+1] != NULL((void *)0))
332 free(pack.ep_fa[argc], M_EXEC63, len);
333 else
334 free(pack.ep_fa[argc], M_EXEC63, MAXPATHLEN1024);
335 }
336 free(pack.ep_fa, M_EXEC63, 4 * sizeof(char *));
337 pack.ep_flags &= ~EXEC_HASARGL0x0004;
338 }
339
340 /* Now get argv & environment */
341 if (!(cpp = SCARG(uap, argp)((uap)->argp.le.datum))) {
342 error = EFAULT14;
343 goto bad;
344 }
345
346 if (pack.ep_flags & EXEC_SKIPARG0x0008)
347 cpp++;
348
349 while (1) {
350 len = argp + ARG_MAX(512 * 1024) - dp;
351 if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
352 goto bad;
353 if (!sp)
354 break;
355 if ((error = copyinstr(sp, dp, len, &len)) != 0) {
356 if (error == ENAMETOOLONG63)
357 error = E2BIG7;
358 goto bad;
359 }
360 dp += len;
361 cpp++;
362 argc++;
363 }
364
365 /* must have at least one argument */
366 if (argc == 0) {
367 error = EINVAL22;
368 goto bad;
369 }
370
371#ifdef KTRACE1
372 if (KTRPOINT(p, KTR_EXECARGS)((p)->p_p->ps_traceflag & (1<<(10)) &&
((p)->p_flag & 0x00000001) == 0))
373 ktrexec(p, KTR_EXECARGS10, argp, dp - argp);
374#endif
375
376 envc = 0;
377 /* environment does not need to be there */
378 if ((cpp = SCARG(uap, envp)((uap)->envp.le.datum)) != NULL((void *)0) ) {
379#ifdef KTRACE1
380 env_start = dp;
381#endif
382 while (1) {
383 len = argp + ARG_MAX(512 * 1024) - dp;
384 if ((error = copyin(cpp, &sp, sizeof(sp))) != 0)
385 goto bad;
386 if (!sp)
387 break;
388 if ((error = copyinstr(sp, dp, len, &len)) != 0) {
389 if (error == ENAMETOOLONG63)
390 error = E2BIG7;
391 goto bad;
392 }
393 dp += len;
394 cpp++;
395 envc++;
396 }
397
398#ifdef KTRACE1
399 if (KTRPOINT(p, KTR_EXECENV)((p)->p_p->ps_traceflag & (1<<(11)) &&
((p)->p_flag & 0x00000001) == 0))
400 ktrexec(p, KTR_EXECENV11, env_start, dp - env_start);
401#endif
402 }
403
404 dp = (char *)(((long)dp + _STACKALIGNBYTES15) & ~_STACKALIGNBYTES15);
405
406 sgap = STACKGAPLEN(2*1024);
407
408 /*
409 * If we have enabled random stackgap, the stack itself has already
410 * been moved from a random location, but is still aligned to a page
411 * boundary. Provide the lower bits of random placement now.
412 */
413 if (stackgap_random != 0) {
414 sgap += arc4random() & PAGE_MASK((1 << 12) - 1);
415 sgap = (sgap + _STACKALIGNBYTES15) & ~_STACKALIGNBYTES15;
416 }
417
418 /* Now check if args & environ fit into new stack */
419 len = ((argc + envc + 2 + ELF_AUX_WORDS(sizeof(Aux64Info) * 9 / sizeof(char *))) * sizeof(char *) +
420 sizeof(long) + dp + sgap + sizeof(struct ps_strings)) - argp;
421
422 len = (len + _STACKALIGNBYTES15) &~ _STACKALIGNBYTES15;
423
424 if (len > pack.ep_ssize) { /* in effect, compare to initial limit */
425 error = ENOMEM12;
426 goto bad;
427 }
428
429 /* adjust "active stack depth" for process VSZ */
430 pack.ep_ssize = len; /* maybe should go elsewhere, but... */
431
432 /*
433 * we're committed: any further errors will kill the process, so
434 * kill the other threads now.
435 */
436 single_thread_set(p, SINGLE_EXIT, 1);
437
438 /*
439 * Prepare vmspace for remapping. Note that uvmspace_exec can replace
440 * ps_vmspace!
441 */
442 uvmspace_exec(p, VM_MIN_ADDRESS(1 << 12), VM_MAXUSER_ADDRESS0x00007f7fffffc000);
443
444 vm = pr->ps_vmspace;
445 /* Now map address space */
446 vm->vm_taddr = (char *)trunc_page(pack.ep_taddr)((pack.ep_taddr) & ~((1 << 12) - 1));
447 vm->vm_tsize = atop(round_page(pack.ep_taddr + pack.ep_tsize) -(((((pack.ep_taddr + pack.ep_tsize) + ((1 << 12) - 1)) &
~((1 << 12) - 1)) - ((pack.ep_taddr) & ~((1 <<
12) - 1))) >> 12)
448 trunc_page(pack.ep_taddr))(((((pack.ep_taddr + pack.ep_tsize) + ((1 << 12) - 1)) &
~((1 << 12) - 1)) - ((pack.ep_taddr) & ~((1 <<
12) - 1))) >> 12);
449 vm->vm_daddr = (char *)trunc_page(pack.ep_daddr)((pack.ep_daddr) & ~((1 << 12) - 1));
450 vm->vm_dsize = atop(round_page(pack.ep_daddr + pack.ep_dsize) -(((((pack.ep_daddr + pack.ep_dsize) + ((1 << 12) - 1)) &
~((1 << 12) - 1)) - ((pack.ep_daddr) & ~((1 <<
12) - 1))) >> 12)
451 trunc_page(pack.ep_daddr))(((((pack.ep_daddr + pack.ep_dsize) + ((1 << 12) - 1)) &
~((1 << 12) - 1)) - ((pack.ep_daddr) & ~((1 <<
12) - 1))) >> 12);
452 vm->vm_dused = 0;
453 vm->vm_ssize = atop(round_page(pack.ep_ssize))(((((pack.ep_ssize) + ((1 << 12) - 1)) & ~((1 <<
12) - 1))) >> 12);
454 vm->vm_maxsaddr = (char *)pack.ep_maxsaddr;
455 vm->vm_minsaddr = (char *)pack.ep_minsaddr;
456
457 /* create the new process's VM space by running the vmcmds */
458#ifdef DIAGNOSTIC1
459 if (pack.ep_vmcmds.evs_used == 0)
460 panic("execve: no vmcmds");
461#endif
462 error = exec_process_vmcmds(p, &pack);
463
464 /* if an error happened, deallocate and punt */
465 if (error)
466 goto exec_abort;
467
468#ifdef MACHINE_STACK_GROWS_UP
469 pr->ps_strings = (vaddr_t)vm->vm_maxsaddr + sgap;
470 if (uvm_map_protect(&vm->vm_map, (vaddr_t)vm->vm_maxsaddr,
471 trunc_page(pr->ps_strings)((pr->ps_strings) & ~((1 << 12) - 1)), PROT_NONE0x00, TRUE1))
472 goto exec_abort;
473#else
474 pr->ps_strings = (vaddr_t)vm->vm_minsaddr - sizeof(arginfo) - sgap;
475 if (uvm_map_protect(&vm->vm_map,
476 round_page(pr->ps_strings + sizeof(arginfo))(((pr->ps_strings + sizeof(arginfo)) + ((1 << 12) - 1
)) & ~((1 << 12) - 1)),
477 (vaddr_t)vm->vm_minsaddr, PROT_NONE0x00, TRUE1))
478 goto exec_abort;
479#endif
480
481 memset(&arginfo, 0, sizeof(arginfo))__builtin_memset((&arginfo), (0), (sizeof(arginfo)));
482
483 /* remember information about the process */
484 arginfo.ps_nargvstr = argc;
485 arginfo.ps_nenvstr = envc;
486
487#ifdef MACHINE_STACK_GROWS_UP
488 stack = (char *)vm->vm_maxsaddr + sizeof(arginfo) + sgap;
489 slen = len - sizeof(arginfo) - sgap;
490#else
491 stack = (char *)(vm->vm_minsaddr - len);
492#endif
493 /* Now copy argc, args & environ to new stack */
494 if (!copyargs(&pack, &arginfo, stack, argp))
495 goto exec_abort;
496
497 /* copy out the process's ps_strings structure */
498 if (copyout(&arginfo, (char *)pr->ps_strings, sizeof(arginfo)))
499 goto exec_abort;
500
501 stopprofclock(pr); /* stop profiling */
502 fdcloseexec(p); /* handle close on exec */
503 execsigs(p); /* reset caught signals */
504 TCB_SET(p, NULL)tcb_set(p, ((void *)0)); /* reset the TCB address */
505 pr->ps_kbind_addr = 0; /* reset the kbind bits */
506 pr->ps_kbind_cookie = 0;
507 arc4random_buf(&pr->ps_sigcookie, sizeof pr->ps_sigcookie);
508
509 /* set command name & other accounting info */
510 memset(pr->ps_comm, 0, sizeof(pr->ps_comm))__builtin_memset((pr->ps_comm), (0), (sizeof(pr->ps_comm
)));
511 len = min(nid.ni_cnd.cn_namelen, MAXCOMLEN16);
512 memcpy(pr->ps_comm, nid.ni_cnd.cn_nameptr, len)__builtin_memcpy((pr->ps_comm), (nid.ni_cnd.cn_nameptr), (
len));
513 pr->ps_acflag &= ~AFORK0x01;
514
515 /* record proc's vnode, for use by sysctl */
516 otvp = pr->ps_textvp;
517 vref(pack.ep_vp);
518 pr->ps_textvp = pack.ep_vp;
519 if (otvp)
520 vrele(otvp);
521
522 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_EXEC0x00000002);
523 if (pr->ps_flags & PS_PPWAIT0x00000040) {
524 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_PPWAIT0x00000040);
525 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_pptr->ps_flags, PS_ISPWAIT0x00000080);
526 wakeup(pr->ps_pptr);
527 }
528
529 /*
530 * If process does execve() while it has a mismatched real,
531 * effective, or saved uid/gid, we set PS_SUGIDEXEC.
532 */
533 if (cred->cr_uid != cred->cr_ruid ||
534 cred->cr_uid != cred->cr_svuid ||
535 cred->cr_gid != cred->cr_rgid ||
536 cred->cr_gid != cred->cr_svgid)
537 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_SUGIDEXEC0x00000020);
538 else
539 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_SUGIDEXEC0x00000020);
540
541 if (pr->ps_flags & PS_EXECPLEDGE0x00400000) {
542 pr->ps_pledge = pr->ps_execpledge;
543 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_PLEDGE0x00100000);
544 } else {
545 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_PLEDGE0x00100000);
546 pr->ps_pledge = 0;
547 /* XXX XXX XXX XXX */
548 /* Clear our unveil paths out so the child
549 * starts afresh
550 */
551 unveil_destroy(pr);
552 pr->ps_uvdone = 0;
553 }
554
555 /*
556 * deal with set[ug]id.
557 * MNT_NOEXEC has already been used to disable s[ug]id.
558 */
559 if ((attr.va_mode & (VSUID04000 | VSGID02000)) && proc_cansugid(p)) {
560 int i;
561
562 atomic_setbits_intx86_atomic_setbits_u32(&pr->ps_flags, PS_SUGID0x00000010|PS_SUGIDEXEC0x00000020);
563
564#ifdef KTRACE1
565 /*
566 * If process is being ktraced, turn off - unless
567 * root set it.
568 */
569 if (pr->ps_tracevp && !(pr->ps_traceflag & KTRFAC_ROOT0x80000000U))
570 ktrcleartrace(pr);
571#endif
572 p->p_ucred = cred = crcopy(cred);
573 if (attr.va_mode & VSUID04000)
574 cred->cr_uid = attr.va_uid;
575 if (attr.va_mode & VSGID02000)
576 cred->cr_gid = attr.va_gid;
577
578 /*
579 * For set[ug]id processes, a few caveats apply to
580 * stdin, stdout, and stderr.
581 */
582 error = 0;
583 fdplock(p->p_fd)do { do { int _s = rw_status(&netlock); if ((splassert_ctl
> 0) && (_s == 0x0001UL)) splassert_fail(0, 0x0001UL
, __func__); } while (0); rw_enter_write(&(p->p_fd)->
fd_lock); } while (0);
584 for (i = 0; i < 3; i++) {
585 struct file *fp = NULL((void *)0);
586
587 /*
588 * NOTE - This will never return NULL because of
589 * immature fds. The file descriptor table is not
590 * shared because we're suid.
591 */
592 fp = fd_getfile(p->p_fd, i);
593
594 /*
595 * Ensure that stdin, stdout, and stderr are already
596 * allocated. We do not want userland to accidentally
597 * allocate descriptors in this range which has implied
598 * meaning to libc.
599 */
600 if (fp == NULL((void *)0)) {
601 short flags = FREAD0x0001 | (i == 0 ? 0 : FWRITE0x0002);
602 struct vnode *vp;
603 int indx;
604
605 if ((error = falloc(p, &fp, &indx)) != 0)
606 break;
607#ifdef DIAGNOSTIC1
608 if (indx != i)
609 panic("sys_execve: falloc indx != i");
610#endif
611 if ((error = cdevvp(getnulldev(), &vp)) != 0) {
612 fdremove(p->p_fd, indx);
613 closef(fp, p);
614 break;
615 }
616 if ((error = VOP_OPEN(vp, flags, cred, p)) != 0) {
617 fdremove(p->p_fd, indx);
618 closef(fp, p);
619 vrele(vp);
620 break;
621 }
622 if (flags & FWRITE0x0002)
623 vp->v_writecount++;
624 fp->f_flag = flags;
625 fp->f_type = DTYPE_VNODE1;
626 fp->f_ops = &vnops;
627 fp->f_data = (caddr_t)vp;
628 fdinsert(p->p_fd, indx, 0, fp);
629 }
630 FRELE(fp, p)(_atomic_sub_int_nv((&fp->f_count), 1) == 0 ? fdrop(fp
, p) : 0);
631 }
632 fdpunlock(p->p_fd)rw_exit_write(&(p->p_fd)->fd_lock);
633 if (error)
634 goto exec_abort;
635 } else
636 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_SUGID0x00000010);
637
638 /*
639 * Reset the saved ugids and update the process's copy of the
640 * creds if the creds have been changed
641 */
642 if (cred->cr_uid != cred->cr_svuid ||
643 cred->cr_gid != cred->cr_svgid) {
644 /* make sure we have unshared ucreds */
645 p->p_ucred = cred = crcopy(cred);
646 cred->cr_svuid = cred->cr_uid;
647 cred->cr_svgid = cred->cr_gid;
648 }
649
650 if (pr->ps_ucred != cred) {
651 struct ucred *ocred;
652
653 ocred = pr->ps_ucred;
654 crhold(cred);
655 pr->ps_ucred = cred;
656 crfree(ocred);
657 }
658
659 if (pr->ps_flags & PS_SUGIDEXEC0x00000020) {
660 cancel_all_itimers();
661 }
662
663 /* reset CPU time usage for the thread, but not the process */
664 timespecclear(&p->p_tu.tu_runtime)(&p->p_tu.tu_runtime)->tv_sec = (&p->p_tu.tu_runtime
)->tv_nsec = 0;
665 p->p_tu.tu_uticks = p->p_tu.tu_sticks = p->p_tu.tu_iticks = 0;
666
667 km_free(argp, NCARGS(512 * 1024), &kv_exec, &kp_pageable);
668
669 pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
670 vn_close(pack.ep_vp, FREAD0x0001, cred, p);
671
672 /*
673 * notify others that we exec'd
674 */
675 KNOTE(&pr->ps_klist, NOTE_EXEC)do { struct klist *__list = (&pr->ps_klist); if (__list
!= ((void *)0)) knote(__list, 0x20000000); } while (0);
676
677 /* map the process's timekeep page, needs to be before exec_elf_fixup */
678 if (exec_timekeep_map(pr))
679 goto free_pack_abort;
680
681 /* setup new registers and do misc. setup. */
682 if (exec_elf_fixup(p, &pack) != 0)
683 goto free_pack_abort;
684#ifdef MACHINE_STACK_GROWS_UP
685 setregs(p, &pack, (u_long)stack + slen, retval);
686#else
687 setregs(p, &pack, (u_long)stack, retval);
688#endif
689
690 /* map the process's signal trampoline code */
691 if (exec_sigcode_map(pr))
692 goto free_pack_abort;
693
694#ifdef __HAVE_EXEC_MD_MAP
695 /* perform md specific mappings that process might need */
696 if (exec_md_map(p, &pack))
697 goto free_pack_abort;
698#endif
699
700 if (pr->ps_flags & PS_TRACED0x00000200)
701 psignal(p, SIGTRAP5);
702
703 free(pack.ep_hdr, M_EXEC63, pack.ep_hdrlen);
704
705 p->p_descfd = 255;
706 if ((pack.ep_flags & EXEC_HASFD0x0002) && pack.ep_fd < 255)
707 p->p_descfd = pack.ep_fd;
708
709 if (pack.ep_flags & EXEC_WXNEEDED0x0020)
710 atomic_setbits_intx86_atomic_setbits_u32(&p->p_p->ps_flags, PS_WXNEEDED0x00200000);
711 else
712 atomic_clearbits_intx86_atomic_clearbits_u32(&p->p_p->ps_flags, PS_WXNEEDED0x00200000);
713
714 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_INEXEC0x00000004);
715 single_thread_clear(p, P_SUSPSIG0x08000000);
716
717 return (0);
718
719bad:
720 /* free the vmspace-creation commands, and release their references */
721 kill_vmcmds(&pack.ep_vmcmds);
722 /* kill any opened file descriptor, if necessary */
723 if (pack.ep_flags & EXEC_HASFD0x0002) {
724 pack.ep_flags &= ~EXEC_HASFD0x0002;
725 fdplock(p->p_fd)do { do { int _s = rw_status(&netlock); if ((splassert_ctl
> 0) && (_s == 0x0001UL)) splassert_fail(0, 0x0001UL
, __func__); } while (0); rw_enter_write(&(p->p_fd)->
fd_lock); } while (0);
726 /* fdrelease unlocks p->p_fd. */
727 (void) fdrelease(p, pack.ep_fd);
728 }
729 if (pack.ep_interp != NULL((void *)0))
730 pool_put(&namei_pool, pack.ep_interp);
731 free(pack.ep_args, M_TEMP127, sizeof *pack.ep_args);
732 /* close and put the exec'd file */
733 vn_close(pack.ep_vp, FREAD0x0001, cred, p);
734 pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
735 km_free(argp, NCARGS(512 * 1024), &kv_exec, &kp_pageable);
736
737freehdr:
738 free(pack.ep_hdr, M_EXEC63, pack.ep_hdrlen);
739 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_INEXEC0x00000004);
740 single_thread_clear(p, P_SUSPSIG0x08000000);
741
742 return (error);
743
744exec_abort:
745 /*
746 * the old process doesn't exist anymore. exit gracefully.
747 * get rid of the (new) address space we have created, if any, get rid
748 * of our namei data and vnode, and exit noting failure
749 */
750 uvm_unmap(&vm->vm_map, VM_MIN_ADDRESS(1 << 12), VM_MAXUSER_ADDRESS0x00007f7fffffc000);
751 if (pack.ep_interp != NULL((void *)0))
752 pool_put(&namei_pool, pack.ep_interp);
753 free(pack.ep_args, M_TEMP127, sizeof *pack.ep_args);
754 pool_put(&namei_pool, nid.ni_cnd.cn_pnbuf);
755 vn_close(pack.ep_vp, FREAD0x0001, cred, p);
756 km_free(argp, NCARGS(512 * 1024), &kv_exec, &kp_pageable);
757
758free_pack_abort:
759 free(pack.ep_hdr, M_EXEC63, pack.ep_hdrlen);
760 exit1(p, 0, SIGABRT6, EXIT_NORMAL0x00000001);
761
762 /* NOTREACHED */
763 atomic_clearbits_intx86_atomic_clearbits_u32(&pr->ps_flags, PS_INEXEC0x00000004);
764
765 return (0);
766}
767
768
769int
770copyargs(struct exec_package *pack, struct ps_strings *arginfo, void *stack,
771 void *argp)
772{
773 char **cpp = stack;
774 char *dp, *sp;
775 size_t len;
776 void *nullp = NULL((void *)0);
777 long argc = arginfo->ps_nargvstr;
778 int envc = arginfo->ps_nenvstr;
779
780 if (copyout(&argc, cpp++, sizeof(argc)))
781 return (0);
782
783 dp = (char *) (cpp + argc + envc + 2 + ELF_AUX_WORDS(sizeof(Aux64Info) * 9 / sizeof(char *)));
784 sp = argp;
785
786 /* XXX don't copy them out, remap them! */
787 arginfo->ps_argvstr = cpp; /* remember location of argv for later */
788
789 for (; --argc >= 0; sp += len, dp += len)
790 if (copyout(&dp, cpp++, sizeof(dp)) ||
791 copyoutstr(sp, dp, ARG_MAX(512 * 1024), &len))
792 return (0);
793
794 if (copyout(&nullp, cpp++, sizeof(nullp)))
795 return (0);
796
797 arginfo->ps_envstr = cpp; /* remember location of envp for later */
798
799 for (; --envc >= 0; sp += len, dp += len)
800 if (copyout(&dp, cpp++, sizeof(dp)) ||
801 copyoutstr(sp, dp, ARG_MAX(512 * 1024), &len))
802 return (0);
803
804 if (copyout(&nullp, cpp++, sizeof(nullp)))
805 return (0);
806
807 /* if this process needs auxinfo, note where to place it */
808 if (pack->ep_args != NULL((void *)0))
809 pack->ep_auxinfo = cpp;
810
811 return (1);
812}
813
814int
815exec_sigcode_map(struct process *pr)
816{
817 extern char sigcode[], esigcode[], sigcoderet[];
818 vsize_t sz;
819
820 sz = (vaddr_t)esigcode - (vaddr_t)sigcode;
821
822 /*
823 * If we don't have a sigobject yet, create one.
824 *
825 * sigobject is an anonymous memory object (just like SYSV shared
826 * memory) that we keep a permanent reference to and that we map
827 * in all processes that need this sigcode. The creation is simple,
828 * we create an object, add a permanent reference to it, map it in
829 * kernel space, copy out the sigcode to it and unmap it.
830 * Then we map it with PROT_READ|PROT_EXEC into the process just
831 * the way sys_mmap would map it.
832 */
833 if (sigobject == NULL((void *)0)) {
834 extern int sigfillsiz;
835 extern u_char sigfill[];
836 size_t off, left;
837 vaddr_t va;
838 int r;
839
840 sigobject = uao_create(sz, 0);
841 uao_reference(sigobject); /* permanent reference */
842
843 if ((r = uvm_map(kernel_map, &va, round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)), sigobject,
Although the value stored to 'r' is used in the enclosing expression, the value is never actually read from 'r'
844 0, 0, UVM_MAPFLAG(PROT_READ | PROT_WRITE, PROT_READ | PROT_WRITE,((0x01 | 0x02) | ((0x01 | 0x02) << 8) | ((0) << 4
) | ((1) << 12) | (0))
845 MAP_INHERIT_SHARE, MADV_RANDOM, 0)((0x01 | 0x02) | ((0x01 | 0x02) << 8) | ((0) << 4
) | ((1) << 12) | (0))))) {
846 uao_detach(sigobject);
847 return (ENOMEM12);
848 }
849
850 for (off = 0, left = round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)); left != 0;
851 off += sigfillsiz) {
852 size_t chunk = ulmin(left, sigfillsiz);
853 memcpy((caddr_t)va + off, sigfill, chunk)__builtin_memcpy(((caddr_t)va + off), (sigfill), (chunk));
854 left -= chunk;
855 }
856 memcpy((caddr_t)va, sigcode, sz)__builtin_memcpy(((caddr_t)va), (sigcode), (sz));
857 uvm_unmap(kernel_map, va, va + round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)));
858 }
859
860 pr->ps_sigcode = 0; /* no hint */
861 uao_reference(sigobject);
862 if (uvm_map(&pr->ps_vmspace->vm_map, &pr->ps_sigcode, round_page(sz)(((sz) + ((1 << 12) - 1)) & ~((1 << 12) - 1)),
863 sigobject, 0, 0, UVM_MAPFLAG(PROT_READ | PROT_EXEC,((0x01 | 0x04) | ((0x01 | 0x02 | 0x04) << 8) | ((1) <<
4) | ((1) << 12) | (0x0080000 | 0x10000000))
864 PROT_READ | PROT_WRITE | PROT_EXEC, MAP_INHERIT_COPY,((0x01 | 0x04) | ((0x01 | 0x02 | 0x04) << 8) | ((1) <<
4) | ((1) << 12) | (0x0080000 | 0x10000000))
865 MADV_RANDOM, UVM_FLAG_COPYONW | UVM_FLAG_SYSCALL)((0x01 | 0x04) | ((0x01 | 0x02 | 0x04) << 8) | ((1) <<
4) | ((1) << 12) | (0x0080000 | 0x10000000)))) {
866 uao_detach(sigobject);
867 return (ENOMEM12);
868 }
869
870 /* Calculate PC at point of sigreturn entry */
871 pr->ps_sigcoderet = pr->ps_sigcode + (sigcoderet - sigcode);
872
873 return (0);
874}
875
876int
877exec_timekeep_map(struct process *pr)
878{
879 size_t timekeep_sz = round_page(sizeof(struct timekeep))(((sizeof(struct timekeep)) + ((1 << 12) - 1)) & ~(
(1 << 12) - 1));
880
881 /*
882 * Similar to the sigcode object
883 */
884 if (timekeep_object == NULL((void *)0)) {
885 vaddr_t va = 0;
886
887 timekeep_object = uao_create(timekeep_sz, 0);
888 uao_reference(timekeep_object);
889
890 if (uvm_map(kernel_map, &va, timekeep_sz, timekeep_object,
891 0, 0, UVM_MAPFLAG(PROT_READ | PROT_WRITE, PROT_READ | PROT_WRITE,((0x01 | 0x02) | ((0x01 | 0x02) << 8) | ((0) << 4
) | ((1) << 12) | (0))
892 MAP_INHERIT_SHARE, MADV_RANDOM, 0)((0x01 | 0x02) | ((0x01 | 0x02) << 8) | ((0) << 4
) | ((1) << 12) | (0)))) {
893 uao_detach(timekeep_object);
894 timekeep_object = NULL((void *)0);
895 return (ENOMEM12);
896 }
897 if (uvm_fault_wire(kernel_map, va, va + timekeep_sz,
898 PROT_READ0x01 | PROT_WRITE0x02)) {
899 uvm_unmap(kernel_map, va, va + timekeep_sz);
900 uao_detach(timekeep_object);
901 timekeep_object = NULL((void *)0);
902 return (ENOMEM12);
903 }
904
905 timekeep = (struct timekeep *)va;
906 timekeep->tk_version = TK_VERSION0;
907 }
908
909 pr->ps_timekeep = 0; /* no hint */
910 uao_reference(timekeep_object);
911 if (uvm_map(&pr->ps_vmspace->vm_map, &pr->ps_timekeep, timekeep_sz,
912 timekeep_object, 0, 0, UVM_MAPFLAG(PROT_READ, PROT_READ,((0x01) | ((0x01) << 8) | ((1) << 4) | ((1) <<
12) | (0))
913 MAP_INHERIT_COPY, MADV_RANDOM, 0)((0x01) | ((0x01) << 8) | ((1) << 4) | ((1) <<
12) | (0)))) {
914 uao_detach(timekeep_object);
915 return (ENOMEM12);
916 }
917
918 return (0);
919}