Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
[cascardo/linux.git] / fs / binfmt_flat.c
index 892dba6..9b2917a 100644 (file)
@@ -15,6 +15,8 @@
  *     JAN/99 -- coded full program relocation (gerg@snapgear.com)
  */
 
+#define pr_fmt(fmt)    KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
@@ -32,6 +34,7 @@
 #include <linux/init.h>
 #include <linux/flat.h>
 #include <linux/uaccess.h>
+#include <linux/vmalloc.h>
 
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
 
 /****************************************************************************/
 
-#if 0
-#define DEBUG 1
-#endif
-
-#ifdef DEBUG
-#define        DBG_FLT(a...)   printk(a)
-#else
-#define        DBG_FLT(a...)
-#endif
-
 /*
  * User data (data section and bss) needs to be aligned.
  * We pick 0x20 here because it is the max value elf2flt has always
@@ -102,8 +95,8 @@ static struct linux_binfmt flat_format = {
 
 static int flat_core_dump(struct coredump_params *cprm)
 {
-       printk("Process %s:%d received signr %d and should have core dumped\n",
-                       current->comm, current->pid, cprm->siginfo->si_signo);
+       pr_warn("Process %s:%d received signr %d and should have core dumped\n",
+               current->comm, current->pid, cprm->siginfo->si_signo);
        return 1;
 }
 
@@ -111,50 +104,58 @@ static int flat_core_dump(struct coredump_params *cprm)
 /*
  * create_flat_tables() parses the env- and arg-strings in new user
  * memory and creates the pointer tables from them, and puts their
- * addresses on the "stack", returning the new stack pointer value.
+ * addresses on the "stack", recording the new stack pointer value.
  */
 
-static unsigned long create_flat_tables(
-       unsigned long pp,
-       struct linux_binprm *bprm)
+static int create_flat_tables(struct linux_binprm *bprm, unsigned long arg_start)
 {
-       unsigned long *argv, *envp;
-       unsigned long *sp;
-       char *p = (char *)pp;
-       int argc = bprm->argc;
-       int envc = bprm->envc;
-       char uninitialized_var(dummy);
-
-       sp = (unsigned long *)p;
-       sp -= (envc + argc + 2) + 1 + (flat_argvp_envp_on_stack() ? 2 : 0);
-       sp = (unsigned long *) ((unsigned long)sp & -FLAT_STACK_ALIGN);
-       argv = sp + 1 + (flat_argvp_envp_on_stack() ? 2 : 0);
-       envp = argv + (argc + 1);
+       char __user *p;
+       unsigned long __user *sp;
+       long i, len;
 
+       p = (char __user *)arg_start;
+       sp = (unsigned long __user *)current->mm->start_stack;
+
+       sp -= bprm->envc + 1;
+       sp -= bprm->argc + 1;
+       sp -= flat_argvp_envp_on_stack() ? 2 : 0;
+       sp -= 1;  /* &argc */
+
+       current->mm->start_stack = (unsigned long)sp & -FLAT_STACK_ALIGN;
+       sp = (unsigned long __user *)current->mm->start_stack;
+
+       __put_user(bprm->argc, sp++);
        if (flat_argvp_envp_on_stack()) {
-               put_user((unsigned long) envp, sp + 2);
-               put_user((unsigned long) argv, sp + 1);
-       }
-
-       put_user(argc, sp);
-       current->mm->arg_start = (unsigned long) p;
-       while (argc-- > 0) {
-               put_user((unsigned long) p, argv++);
-               do {
-                       get_user(dummy, p); p++;
-               } while (dummy);
-       }
-       put_user((unsigned long) NULL, argv);
-       current->mm->arg_end = current->mm->env_start = (unsigned long) p;
-       while (envc-- > 0) {
-               put_user((unsigned long)p, envp); envp++;
-               do {
-                       get_user(dummy, p); p++;
-               } while (dummy);
-       }
-       put_user((unsigned long) NULL, envp);
-       current->mm->env_end = (unsigned long) p;
-       return (unsigned long)sp;
+               unsigned long argv, envp;
+               argv = (unsigned long)(sp + 2);
+               envp = (unsigned long)(sp + 2 + bprm->argc + 1);
+               __put_user(argv, sp++);
+               __put_user(envp, sp++);
+       }
+
+       current->mm->arg_start = (unsigned long)p;
+       for (i = bprm->argc; i > 0; i--) {
+               __put_user((unsigned long)p, sp++);
+               len = strnlen_user(p, MAX_ARG_STRLEN);
+               if (!len || len > MAX_ARG_STRLEN)
+                       return -EINVAL;
+               p += len;
+       }
+       __put_user(0, sp++);
+       current->mm->arg_end = (unsigned long)p;
+
+       current->mm->env_start = (unsigned long) p;
+       for (i = bprm->envc; i > 0; i--) {
+               __put_user((unsigned long)p, sp++);
+               len = strnlen_user(p, MAX_ARG_STRLEN);
+               if (!len || len > MAX_ARG_STRLEN)
+                       return -EINVAL;
+               p += len;
+       }
+       __put_user(0, sp++);
+       current->mm->env_end = (unsigned long)p;
+
+       return 0;
 }
 
 /****************************************************************************/
@@ -186,17 +187,17 @@ static int decompress_exec(
        loff_t fpos;
        int ret, retval;
 
-       DBG_FLT("decompress_exec(offset=%lx,buf=%p,len=%lx)\n", offset, dst, len);
+       pr_debug("decompress_exec(offset=%lx,buf=%p,len=%lx)\n", offset, dst, len);
 
        memset(&strm, 0, sizeof(strm));
        strm.workspace = kmalloc(zlib_inflate_workspacesize(), GFP_KERNEL);
        if (strm.workspace == NULL) {
-               DBG_FLT("binfmt_flat: no memory for decompress workspace\n");
+               pr_debug("no memory for decompress workspace\n");
                return -ENOMEM;
        }
        buf = kmalloc(LBUFSIZE, GFP_KERNEL);
        if (buf == NULL) {
-               DBG_FLT("binfmt_flat: no memory for read buffer\n");
+               pr_debug("no memory for read buffer\n");
                retval = -ENOMEM;
                goto out_free;
        }
@@ -214,25 +215,25 @@ static int decompress_exec(
 
        /* Check minimum size -- gzip header */
        if (ret < 10) {
-               DBG_FLT("binfmt_flat: file too small?\n");
+               pr_debug("file too small?\n");
                goto out_free_buf;
        }
 
        /* Check gzip magic number */
        if ((buf[0] != 037) || ((buf[1] != 0213) && (buf[1] != 0236))) {
-               DBG_FLT("binfmt_flat: unknown compression magic?\n");
+               pr_debug("unknown compression magic?\n");
                goto out_free_buf;
        }
 
        /* Check gzip method */
        if (buf[2] != 8) {
-               DBG_FLT("binfmt_flat: unknown compression method?\n");
+               pr_debug("unknown compression method?\n");
                goto out_free_buf;
        }
        /* Check gzip flags */
        if ((buf[3] & ENCRYPTED) || (buf[3] & CONTINUATION) ||
            (buf[3] & RESERVED)) {
-               DBG_FLT("binfmt_flat: unknown flags?\n");
+               pr_debug("unknown flags?\n");
                goto out_free_buf;
        }
 
@@ -240,7 +241,7 @@ static int decompress_exec(
        if (buf[3] & EXTRA_FIELD) {
                ret += 2 + buf[10] + (buf[11] << 8);
                if (unlikely(ret >= LBUFSIZE)) {
-                       DBG_FLT("binfmt_flat: buffer overflow (EXTRA)?\n");
+                       pr_debug("buffer overflow (EXTRA)?\n");
                        goto out_free_buf;
                }
        }
@@ -248,7 +249,7 @@ static int decompress_exec(
                while (ret < LBUFSIZE && buf[ret++] != 0)
                        ;
                if (unlikely(ret == LBUFSIZE)) {
-                       DBG_FLT("binfmt_flat: buffer overflow (ORIG_NAME)?\n");
+                       pr_debug("buffer overflow (ORIG_NAME)?\n");
                        goto out_free_buf;
                }
        }
@@ -256,7 +257,7 @@ static int decompress_exec(
                while (ret < LBUFSIZE && buf[ret++] != 0)
                        ;
                if (unlikely(ret == LBUFSIZE)) {
-                       DBG_FLT("binfmt_flat: buffer overflow (COMMENT)?\n");
+                       pr_debug("buffer overflow (COMMENT)?\n");
                        goto out_free_buf;
                }
        }
@@ -269,7 +270,7 @@ static int decompress_exec(
        strm.total_out = 0;
 
        if (zlib_inflateInit2(&strm, -MAX_WBITS) != Z_OK) {
-               DBG_FLT("binfmt_flat: zlib init failed?\n");
+               pr_debug("zlib init failed?\n");
                goto out_free_buf;
        }
 
@@ -286,7 +287,7 @@ static int decompress_exec(
        }
 
        if (ret < 0) {
-               DBG_FLT("binfmt_flat: decompression failed (%d), %s\n",
+               pr_debug("decompression failed (%d), %s\n",
                        ret, strm.msg);
                goto out_zlib;
        }
@@ -323,24 +324,23 @@ calc_reloc(unsigned long r, struct lib_info *p, int curid, int internalp)
                r &= 0x00ffffff;        /* Trim ID off here */
        }
        if (id >= MAX_SHARED_LIBS) {
-               printk("BINFMT_FLAT: reference 0x%lx to shared library %d",
-                               r, id);
+               pr_err("reference 0x%lx to shared library %d", r, id);
                goto failed;
        }
        if (curid != id) {
                if (internalp) {
-                       printk("BINFMT_FLAT: reloc address 0x%lx not in same module "
-                                       "(%d != %d)", r, curid, id);
+                       pr_err("reloc address 0x%lx not in same module "
+                              "(%d != %d)", r, curid, id);
                        goto failed;
                } else if (!p->lib_list[id].loaded &&
                           load_flat_shared_library(id, p) < 0) {
-                       printk("BINFMT_FLAT: failed to load library %d", id);
+                       pr_err("failed to load library %d", id);
                        goto failed;
                }
                /* Check versioning information (i.e. time stamps) */
                if (p->lib_list[id].build_date && p->lib_list[curid].build_date &&
                                p->lib_list[curid].build_date < p->lib_list[id].build_date) {
-                       printk("BINFMT_FLAT: library %d is younger than %d", id, curid);
+                       pr_err("library %d is younger than %d", id, curid);
                        goto failed;
                }
        }
@@ -354,7 +354,7 @@ calc_reloc(unsigned long r, struct lib_info *p, int curid, int internalp)
        text_len = p->lib_list[id].text_len;
 
        if (!flat_reloc_valid(r, start_brk - start_data + text_len)) {
-               printk("BINFMT_FLAT: reloc outside program 0x%lx (0 - 0x%lx/0x%lx)",
+               pr_err("reloc outside program 0x%lx (0 - 0x%lx/0x%lx)",
                       r, start_brk-start_data+text_len, text_len);
                goto failed;
        }
@@ -368,7 +368,7 @@ calc_reloc(unsigned long r, struct lib_info *p, int curid, int internalp)
        return addr;
 
 failed:
-       printk(", killing %s!\n", current->comm);
+       pr_cont(", killing %s!\n", current->comm);
        send_sig(SIGSEGV, current, 0);
 
        return RELOC_FAILED;
@@ -378,43 +378,40 @@ failed:
 
 static void old_reloc(unsigned long rl)
 {
-#ifdef DEBUG
        static const char *segment[] = { "TEXT", "DATA", "BSS", "*UNKNOWN*" };
-#endif
        flat_v2_reloc_t r;
-       unsigned long *ptr;
+       unsigned long __user *ptr;
+       unsigned long val;
 
        r.value = rl;
 #if defined(CONFIG_COLDFIRE)
-       ptr = (unsigned long *) (current->mm->start_code + r.reloc.offset);
+       ptr = (unsigned long __user *)(current->mm->start_code + r.reloc.offset);
 #else
-       ptr = (unsigned long *) (current->mm->start_data + r.reloc.offset);
+       ptr = (unsigned long __user *)(current->mm->start_data + r.reloc.offset);
 #endif
+       get_user(val, ptr);
 
-#ifdef DEBUG
-       printk("Relocation of variable at DATASEG+%x "
-               "(address %p, currently %lx) into segment %s\n",
-               r.reloc.offset, ptr, *ptr, segment[r.reloc.type]);
-#endif
+       pr_debug("Relocation of variable at DATASEG+%x "
+                "(address %p, currently %lx) into segment %s\n",
+                r.reloc.offset, ptr, val, segment[r.reloc.type]);
 
        switch (r.reloc.type) {
        case OLD_FLAT_RELOC_TYPE_TEXT:
-               *ptr += current->mm->start_code;
+               val += current->mm->start_code;
                break;
        case OLD_FLAT_RELOC_TYPE_DATA:
-               *ptr += current->mm->start_data;
+               val += current->mm->start_data;
                break;
        case OLD_FLAT_RELOC_TYPE_BSS:
-               *ptr += current->mm->end_data;
+               val += current->mm->end_data;
                break;
        default:
-               printk("BINFMT_FLAT: Unknown relocation type=%x\n", r.reloc.type);
+               pr_err("Unknown relocation type=%x\n", r.reloc.type);
                break;
        }
+       put_user(val, ptr);
 
-#ifdef DEBUG
-       printk("Relocation became %lx\n", *ptr);
-#endif
+       pr_debug("Relocation became %lx\n", val);
 }
 
 /****************************************************************************/
@@ -426,7 +423,7 @@ static int load_flat_file(struct linux_binprm *bprm,
        unsigned long textpos, datapos, realdatastart;
        unsigned long text_len, data_len, bss_len, stack_len, full_data, flags;
        unsigned long len, memp, memp_size, extra, rlim;
-       unsigned long *reloc, *rp;
+       unsigned long __user *reloc, *rp;
        struct inode *inode;
        int i, rev, relocs;
        loff_t fpos;
@@ -463,20 +460,30 @@ static int load_flat_file(struct linux_binprm *bprm,
        }
 
        if (flags & FLAT_FLAG_KTRACE)
-               printk("BINFMT_FLAT: Loading file: %s\n", bprm->filename);
+               pr_info("Loading file: %s\n", bprm->filename);
 
        if (rev != FLAT_VERSION && rev != OLD_FLAT_VERSION) {
-               printk("BINFMT_FLAT: bad flat file version 0x%x (supported "
-                       "0x%lx and 0x%lx)\n",
-                       rev, FLAT_VERSION, OLD_FLAT_VERSION);
+               pr_err("bad flat file version 0x%x (supported 0x%lx and 0x%lx)\n",
+                      rev, FLAT_VERSION, OLD_FLAT_VERSION);
                ret = -ENOEXEC;
                goto err;
        }
 
        /* Don't allow old format executables to use shared libraries */
        if (rev == OLD_FLAT_VERSION && id != 0) {
-               printk("BINFMT_FLAT: shared libraries are not available before rev 0x%lx\n",
-                               FLAT_VERSION);
+               pr_err("shared libraries are not available before rev 0x%lx\n",
+                      FLAT_VERSION);
+               ret = -ENOEXEC;
+               goto err;
+       }
+
+       /*
+        * Make sure the header params are sane.
+        * 28 bits (256 MB) is way more than reasonable in this case.
+        * If some top bits are set we have probable binary corruption.
+       */
+       if ((text_len | data_len | bss_len | stack_len | full_data) >> 28) {
+               pr_err("bad header\n");
                ret = -ENOEXEC;
                goto err;
        }
@@ -490,7 +497,7 @@ static int load_flat_file(struct linux_binprm *bprm,
 
 #ifndef CONFIG_BINFMT_ZFLAT
        if (flags & (FLAT_FLAG_GZIP|FLAT_FLAG_GZDATA)) {
-               printk("Support for ZFLAT executables is not enabled.\n");
+               pr_err("Support for ZFLAT executables is not enabled.\n");
                ret = -ENOEXEC;
                goto err;
        }
@@ -531,12 +538,12 @@ static int load_flat_file(struct linux_binprm *bprm,
         * case,  and then the fully copied to RAM case which lumps
         * it all together.
         */
-       if ((flags & (FLAT_FLAG_RAM|FLAT_FLAG_GZIP)) == 0) {
+       if (!IS_ENABLED(CONFIG_MMU) && !(flags & (FLAT_FLAG_RAM|FLAT_FLAG_GZIP))) {
                /*
                 * this should give us a ROM ptr,  but if it doesn't we don't
                 * really care
                 */
-               DBG_FLT("BINFMT_FLAT: ROM mapping of file (we hope)\n");
+               pr_debug("ROM mapping of file (we hope)\n");
 
                textpos = vm_mmap(bprm->file, 0, text_len, PROT_READ|PROT_EXEC,
                                  MAP_PRIVATE|MAP_EXECUTABLE, 0);
@@ -544,7 +551,7 @@ static int load_flat_file(struct linux_binprm *bprm,
                        ret = textpos;
                        if (!textpos)
                                ret = -ENOMEM;
-                       printk("Unable to mmap process text, errno %d\n", ret);
+                       pr_err("Unable to mmap process text, errno %d\n", ret);
                        goto err;
                }
 
@@ -557,7 +564,7 @@ static int load_flat_file(struct linux_binprm *bprm,
                        ret = realdatastart;
                        if (!realdatastart)
                                ret = -ENOMEM;
-                       printk("Unable to allocate RAM for process data, "
+                       pr_err("Unable to allocate RAM for process data, "
                               "errno %d\n", ret);
                        vm_munmap(textpos, text_len);
                        goto err;
@@ -566,8 +573,8 @@ static int load_flat_file(struct linux_binprm *bprm,
                                MAX_SHARED_LIBS * sizeof(unsigned long),
                                FLAT_DATA_ALIGN);
 
-               DBG_FLT("BINFMT_FLAT: Allocated data+bss+stack (%ld bytes): %lx\n",
-                       data_len + bss_len + stack_len, datapos);
+               pr_debug("Allocated data+bss+stack (%ld bytes): %lx\n",
+                        data_len + bss_len + stack_len, datapos);
 
                fpos = ntohl(hdr->data_start);
 #ifdef CONFIG_BINFMT_ZFLAT
@@ -582,13 +589,13 @@ static int load_flat_file(struct linux_binprm *bprm,
                }
                if (IS_ERR_VALUE(result)) {
                        ret = result;
-                       printk("Unable to read data+bss, errno %d\n", ret);
+                       pr_err("Unable to read data+bss, errno %d\n", ret);
                        vm_munmap(textpos, text_len);
                        vm_munmap(realdatastart, len);
                        goto err;
                }
 
-               reloc = (unsigned long *)
+               reloc = (unsigned long __user *)
                        (datapos + (ntohl(hdr->reloc_start) - text_len));
                memp = realdatastart;
                memp_size = len;
@@ -603,7 +610,7 @@ static int load_flat_file(struct linux_binprm *bprm,
                        ret = textpos;
                        if (!textpos)
                                ret = -ENOMEM;
-                       printk("Unable to allocate RAM for process text/data, "
+                       pr_err("Unable to allocate RAM for process text/data, "
                               "errno %d\n", ret);
                        goto err;
                }
@@ -613,7 +620,7 @@ static int load_flat_file(struct linux_binprm *bprm,
                                MAX_SHARED_LIBS * sizeof(unsigned long),
                                FLAT_DATA_ALIGN);
 
-               reloc = (unsigned long *)
+               reloc = (unsigned long __user *)
                        (datapos + (ntohl(hdr->reloc_start) - text_len));
                memp = textpos;
                memp_size = len;
@@ -622,6 +629,7 @@ static int load_flat_file(struct linux_binprm *bprm,
                 * load it all in and treat it like a RAM load from now on
                 */
                if (flags & FLAT_FLAG_GZIP) {
+#ifndef CONFIG_MMU
                        result = decompress_exec(bprm, sizeof(struct flat_hdr),
                                         (((char *)textpos) + sizeof(struct flat_hdr)),
                                         (text_len + full_data
@@ -629,13 +637,51 @@ static int load_flat_file(struct linux_binprm *bprm,
                                         0);
                        memmove((void *) datapos, (void *) realdatastart,
                                        full_data);
+#else
+                       /*
+                        * This is used on MMU systems mainly for testing.
+                        * Let's use a kernel buffer to simplify things.
+                        */
+                       long unz_text_len = text_len - sizeof(struct flat_hdr);
+                       long unz_len = unz_text_len + full_data;
+                       char *unz_data = vmalloc(unz_len);
+                       if (!unz_data) {
+                               result = -ENOMEM;
+                       } else {
+                               result = decompress_exec(bprm, sizeof(struct flat_hdr),
+                                                        unz_data, unz_len, 0);
+                               if (result == 0 &&
+                                   (copy_to_user((void __user *)textpos + sizeof(struct flat_hdr),
+                                                 unz_data, unz_text_len) ||
+                                    copy_to_user((void __user *)datapos,
+                                                 unz_data + unz_text_len, full_data)))
+                                       result = -EFAULT;
+                               vfree(unz_data);
+                       }
+#endif
                } else if (flags & FLAT_FLAG_GZDATA) {
                        result = read_code(bprm->file, textpos, 0, text_len);
-                       if (!IS_ERR_VALUE(result))
+                       if (!IS_ERR_VALUE(result)) {
+#ifndef CONFIG_MMU
                                result = decompress_exec(bprm, text_len, (char *) datapos,
                                                 full_data, 0);
-               } else
+#else
+                               char *unz_data = vmalloc(full_data);
+                               if (!unz_data) {
+                                       result = -ENOMEM;
+                               } else {
+                                       result = decompress_exec(bprm, text_len,
+                                                      unz_data, full_data, 0);
+                                       if (result == 0 &&
+                                           copy_to_user((void __user *)datapos,
+                                                        unz_data, full_data))
+                                               result = -EFAULT;
+                                       vfree(unz_data);
+                               }
 #endif
+                       }
+               } else
+#endif /* CONFIG_BINFMT_ZFLAT */
                {
                        result = read_code(bprm->file, textpos, 0, text_len);
                        if (!IS_ERR_VALUE(result))
@@ -645,7 +691,7 @@ static int load_flat_file(struct linux_binprm *bprm,
                }
                if (IS_ERR_VALUE(result)) {
                        ret = result;
-                       printk("Unable to read code+data+bss, errno %d\n", ret);
+                       pr_err("Unable to read code+data+bss, errno %d\n", ret);
                        vm_munmap(textpos, text_len + data_len + extra +
                                MAX_SHARED_LIBS * sizeof(unsigned long));
                        goto err;
@@ -671,16 +717,18 @@ static int load_flat_file(struct linux_binprm *bprm,
                 */
                current->mm->start_brk = datapos + data_len + bss_len;
                current->mm->brk = (current->mm->start_brk + 3) & ~3;
+#ifndef CONFIG_MMU
                current->mm->context.end_brk = memp + memp_size - stack_len;
+#endif
        }
 
        if (flags & FLAT_FLAG_KTRACE) {
-               printk("Mapping is %lx, Entry point is %x, data_start is %x\n",
-                      textpos, 0x00ffffff&ntohl(hdr->entry), ntohl(hdr->data_start));
-               printk("%s %s: TEXT=%lx-%lx DATA=%lx-%lx BSS=%lx-%lx\n",
-                      id ? "Lib" : "Load", bprm->filename,
-                      start_code, end_code, datapos, datapos + data_len,
-                      datapos + data_len, (datapos + data_len + bss_len + 3) & ~3);
+               pr_info("Mapping is %lx, Entry point is %x, data_start is %x\n",
+                       textpos, 0x00ffffff&ntohl(hdr->entry), ntohl(hdr->data_start));
+               pr_info("%s %s: TEXT=%lx-%lx DATA=%lx-%lx BSS=%lx-%lx\n",
+                       id ? "Lib" : "Load", bprm->filename,
+                       start_code, end_code, datapos, datapos + data_len,
+                       datapos + data_len, (datapos + data_len + bss_len + 3) & ~3);
        }
 
        /* Store the current module values into the global library structure */
@@ -705,15 +753,20 @@ static int load_flat_file(struct linux_binprm *bprm,
         * image.
         */
        if (flags & FLAT_FLAG_GOTPIC) {
-               for (rp = (unsigned long *)datapos; *rp != 0xffffffff; rp++) {
-                       unsigned long addr;
-                       if (*rp) {
-                               addr = calc_reloc(*rp, libinfo, id, 0);
+               for (rp = (unsigned long __user *)datapos; ; rp++) {
+                       unsigned long addr, rp_val;
+                       if (get_user(rp_val, rp))
+                               return -EFAULT;
+                       if (rp_val == 0xffffffff)
+                               break;
+                       if (rp_val) {
+                               addr = calc_reloc(rp_val, libinfo, id, 0);
                                if (addr == RELOC_FAILED) {
                                        ret = -ENOEXEC;
                                        goto err;
                                }
-                               *rp = addr;
+                               if (put_user(addr, rp))
+                                       return -EFAULT;
                        }
                }
        }
@@ -730,7 +783,7 @@ static int load_flat_file(struct linux_binprm *bprm,
         * __start to address 4 so that is okay).
         */
        if (rev > OLD_FLAT_VERSION) {
-               unsigned long persistent = 0;
+               unsigned long __maybe_unused persistent = 0;
                for (i = 0; i < relocs; i++) {
                        unsigned long addr, relval;
 
@@ -739,12 +792,14 @@ static int load_flat_file(struct linux_binprm *bprm,
                         * relocated (of course, the address has to be
                         * relocated first).
                         */
-                       relval = ntohl(reloc[i]);
+                       if (get_user(relval, reloc + i))
+                               return -EFAULT;
+                       relval = ntohl(relval);
                        if (flat_set_persistent(relval, &persistent))
                                continue;
                        addr = flat_get_relocate_addr(relval);
-                       rp = (unsigned long *) calc_reloc(addr, libinfo, id, 1);
-                       if (rp == (unsigned long *)RELOC_FAILED) {
+                       rp = (unsigned long __user *)calc_reloc(addr, libinfo, id, 1);
+                       if (rp == (unsigned long __user *)RELOC_FAILED) {
                                ret = -ENOEXEC;
                                goto err;
                        }
@@ -770,17 +825,23 @@ static int load_flat_file(struct linux_binprm *bprm,
                        }
                }
        } else {
-               for (i = 0; i < relocs; i++)
-                       old_reloc(ntohl(reloc[i]));
+               for (i = 0; i < relocs; i++) {
+                       unsigned long relval;
+                       if (get_user(relval, reloc + i))
+                               return -EFAULT;
+                       relval = ntohl(relval);
+                       old_reloc(relval);
+               }
        }
 
        flush_icache_range(start_code, end_code);
 
        /* zero the BSS,  BRK and stack areas */
-       memset((void *)(datapos + data_len), 0, bss_len +
-                       (memp + memp_size - stack_len -         /* end brk */
-                       libinfo->lib_list[id].start_brk) +      /* start brk */
-                       stack_len);
+       if (clear_user((void __user *)(datapos + data_len), bss_len +
+                      (memp + memp_size - stack_len -          /* end brk */
+                      libinfo->lib_list[id].start_brk) +       /* start brk */
+                      stack_len))
+               return -EFAULT;
 
        return 0;
 err:
@@ -851,10 +912,8 @@ static int load_flat_binary(struct linux_binprm *bprm)
 {
        struct lib_info libinfo;
        struct pt_regs *regs = current_pt_regs();
-       unsigned long p = bprm->p;
-       unsigned long stack_len;
+       unsigned long stack_len = 0;
        unsigned long start_addr;
-       unsigned long *sp;
        int res;
        int i, j;
 
@@ -867,37 +926,53 @@ static int load_flat_binary(struct linux_binprm *bprm)
         * pedantic and include space for the argv/envp array as it may have
         * a lot of entries.
         */
-#define TOP_OF_ARGS (PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *))
-       stack_len = TOP_OF_ARGS - bprm->p;             /* the strings */
-       stack_len += (bprm->argc + 1) * sizeof(char *); /* the argv array */
-       stack_len += (bprm->envc + 1) * sizeof(char *); /* the envp array */
-       stack_len += FLAT_STACK_ALIGN - 1;  /* reserve for upcoming alignment */
+#ifndef CONFIG_MMU
+       stack_len += PAGE_SIZE * MAX_ARG_PAGES - bprm->p; /* the strings */
+#endif
+       stack_len += (bprm->argc + 1) * sizeof(char *);   /* the argv array */
+       stack_len += (bprm->envc + 1) * sizeof(char *);   /* the envp array */
+       stack_len = ALIGN(stack_len, FLAT_STACK_ALIGN);
 
        res = load_flat_file(bprm, &libinfo, 0, &stack_len);
        if (res < 0)
                return res;
 
        /* Update data segment pointers for all libraries */
-       for (i = 0; i < MAX_SHARED_LIBS; i++)
-               if (libinfo.lib_list[i].loaded)
-                       for (j = 0; j < MAX_SHARED_LIBS; j++)
-                               (-(j+1))[(unsigned long *)(libinfo.lib_list[i].start_data)] =
-                                       (libinfo.lib_list[j].loaded) ?
-                                               libinfo.lib_list[j].start_data : UNLOADED_LIB;
+       for (i = 0; i < MAX_SHARED_LIBS; i++) {
+               if (!libinfo.lib_list[i].loaded)
+                       continue;
+               for (j = 0; j < MAX_SHARED_LIBS; j++) {
+                       unsigned long val = libinfo.lib_list[j].loaded ?
+                               libinfo.lib_list[j].start_data : UNLOADED_LIB;
+                       unsigned long __user *p = (unsigned long __user *)
+                               libinfo.lib_list[i].start_data;
+                       p -= j + 1;
+                       if (put_user(val, p))
+                               return -EFAULT;
+               }
+       }
 
        install_exec_creds(bprm);
 
        set_binfmt(&flat_format);
 
-       p = ((current->mm->context.end_brk + stack_len + 3) & ~3) - 4;
-       DBG_FLT("p=%lx\n", p);
-
-       /* copy the arg pages onto the stack, this could be more efficient :-) */
-       for (i = TOP_OF_ARGS - 1; i >= bprm->p; i--)
-               *(char *) --p =
-                       ((char *) page_address(bprm->page[i/PAGE_SIZE]))[i % PAGE_SIZE];
+#ifdef CONFIG_MMU
+       res = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
+       if (!res)
+               res = create_flat_tables(bprm, bprm->p);
+#else
+       /* Stash our initial stack pointer into the mm structure */
+       current->mm->start_stack =
+               ((current->mm->context.end_brk + stack_len + 3) & ~3) - 4;
+       pr_debug("sp=%lx\n", current->mm->start_stack);
 
-       sp = (unsigned long *) create_flat_tables(p, bprm);
+       /* copy the arg pages onto the stack */
+       res = transfer_args_to_stack(bprm, &current->mm->start_stack);
+       if (!res)
+               res = create_flat_tables(bprm, current->mm->start_stack);
+#endif
+       if (res)
+               return res;
 
        /* Fake some return addresses to ensure the call chain will
         * initialise library in order for us.  We are required to call
@@ -909,21 +984,21 @@ static int load_flat_binary(struct linux_binprm *bprm)
        for (i = MAX_SHARED_LIBS-1; i > 0; i--) {
                if (libinfo.lib_list[i].loaded) {
                        /* Push previos first to call address */
-                       --sp;   put_user(start_addr, sp);
+                       unsigned long __user *sp;
+                       current->mm->start_stack -= sizeof(unsigned long);
+                       sp = (unsigned long __user *)current->mm->start_stack;
+                       __put_user(start_addr, sp);
                        start_addr = libinfo.lib_list[i].entry;
                }
        }
 #endif
 
-       /* Stash our initial stack pointer into the mm structure */
-       current->mm->start_stack = (unsigned long)sp;
-
 #ifdef FLAT_PLAT_INIT
        FLAT_PLAT_INIT(regs);
 #endif
 
-       DBG_FLT("start_thread(regs=0x%p, entry=0x%lx, start_stack=0x%lx)\n",
-               regs, start_addr, current->mm->start_stack);
+       pr_debug("start_thread(regs=0x%p, entry=0x%lx, start_stack=0x%lx)\n",
+                regs, start_addr, current->mm->start_stack);
        start_thread(regs, start_addr, current->mm->start_stack);
 
        return 0;