1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25#include <linux/slab.h>
26#include <linux/file.h>
27#include <linux/fdtable.h>
28#include <linux/mm.h>
29#include <linux/stat.h>
30#include <linux/fcntl.h>
31#include <linux/smp_lock.h>
32#include <linux/swap.h>
33#include <linux/string.h>
34#include <linux/init.h>
35#include <linux/pagemap.h>
36#include <linux/perf_event.h>
37#include <linux/highmem.h>
38#include <linux/spinlock.h>
39#include <linux/key.h>
40#include <linux/personality.h>
41#include <linux/binfmts.h>
42#include <linux/utsname.h>
43#include <linux/pid_namespace.h>
44#include <linux/module.h>
45#include <linux/namei.h>
46#include <linux/proc_fs.h>
47#include <linux/mount.h>
48#include <linux/security.h>
49#include <linux/ima.h>
50#include <linux/syscalls.h>
51#include <linux/tsacct_kern.h>
52#include <linux/cn_proc.h>
53#include <linux/audit.h>
54#include <linux/tracehook.h>
55#include <linux/kmod.h>
56#include <linux/fsnotify.h>
57#include <linux/fs_struct.h>
58#include <linux/pipe_fs_i.h>
59
60#include <asm/uaccess.h>
61#include <asm/mmu_context.h>
62#include <asm/tlb.h>
63#include "internal.h"
64
65int core_uses_pid;
66char core_pattern[CORENAME_MAX_SIZE] = "core";
67unsigned int core_pipe_limit;
68int suid_dumpable = 0;
69
70
71
72static LIST_HEAD(formats);
73static DEFINE_RWLOCK(binfmt_lock);
74
75int __register_binfmt(struct linux_binfmt * fmt, int insert)
76{
77 if (!fmt)
78 return -EINVAL;
79 write_lock(&binfmt_lock);
80 insert ? list_add(&fmt->lh, &formats) :
81 list_add_tail(&fmt->lh, &formats);
82 write_unlock(&binfmt_lock);
83 return 0;
84}
85
86EXPORT_SYMBOL(__register_binfmt);
87
88void unregister_binfmt(struct linux_binfmt * fmt)
89{
90 write_lock(&binfmt_lock);
91 list_del(&fmt->lh);
92 write_unlock(&binfmt_lock);
93}
94
95EXPORT_SYMBOL(unregister_binfmt);
96
97static inline void put_binfmt(struct linux_binfmt * fmt)
98{
99 module_put(fmt->module);
100}
101
102
103
104
105
106
107
108SYSCALL_DEFINE1(uselib, const char __user *, library)
109{
110 struct file *file;
111 char *tmp = getname(library);
112 int error = PTR_ERR(tmp);
113
114 if (IS_ERR(tmp))
115 goto out;
116
117 file = do_filp_open(AT_FDCWD, tmp,
118 O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
119 MAY_READ | MAY_EXEC | MAY_OPEN);
120 putname(tmp);
121 error = PTR_ERR(file);
122 if (IS_ERR(file))
123 goto out;
124
125 error = -EINVAL;
126 if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))
127 goto exit;
128
129 error = -EACCES;
130 if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
131 goto exit;
132
133 fsnotify_open(file->f_path.dentry);
134
135 error = -ENOEXEC;
136 if(file->f_op) {
137 struct linux_binfmt * fmt;
138
139 read_lock(&binfmt_lock);
140 list_for_each_entry(fmt, &formats, lh) {
141 if (!fmt->load_shlib)
142 continue;
143 if (!try_module_get(fmt->module))
144 continue;
145 read_unlock(&binfmt_lock);
146 error = fmt->load_shlib(file);
147 read_lock(&binfmt_lock);
148 put_binfmt(fmt);
149 if (error != -ENOEXEC)
150 break;
151 }
152 read_unlock(&binfmt_lock);
153 }
154exit:
155 fput(file);
156out:
157 return error;
158}
159
160#ifdef CONFIG_MMU
161
162static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
163 int write)
164{
165 struct page *page;
166 int ret;
167
168#ifdef CONFIG_STACK_GROWSUP
169 if (write) {
170 ret = expand_stack_downwards(bprm->vma, pos);
171 if (ret < 0)
172 return NULL;
173 }
174#endif
175 ret = get_user_pages(current, bprm->mm, pos,
176 1, write, 1, &page, NULL);
177 if (ret <= 0)
178 return NULL;
179
180 if (write) {
181 unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
182 struct rlimit *rlim;
183
184
185
186
187
188 if (size <= ARG_MAX)
189 return page;
190
191
192
193
194
195
196
197
198 rlim = current->signal->rlim;
199 if (size > rlim[RLIMIT_STACK].rlim_cur / 4) {
200 put_page(page);
201 return NULL;
202 }
203 }
204
205 return page;
206}
207
208static void put_arg_page(struct page *page)
209{
210 put_page(page);
211}
212
213static void free_arg_page(struct linux_binprm *bprm, int i)
214{
215}
216
217static void free_arg_pages(struct linux_binprm *bprm)
218{
219}
220
221static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
222 struct page *page)
223{
224 flush_cache_page(bprm->vma, pos, page_to_pfn(page));
225}
226
227static int __bprm_mm_init(struct linux_binprm *bprm)
228{
229 int err;
230 struct vm_area_struct *vma = NULL;
231 struct mm_struct *mm = bprm->mm;
232
233 bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
234 if (!vma)
235 return -ENOMEM;
236
237 down_write(&mm->mmap_sem);
238 vma->vm_mm = mm;
239
240
241
242
243
244
245
246 vma->vm_end = STACK_TOP_MAX;
247 vma->vm_start = vma->vm_end - PAGE_SIZE;
248 vma->vm_flags = VM_STACK_FLAGS;
249 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
250 err = insert_vm_struct(mm, vma);
251 if (err)
252 goto err;
253
254 mm->stack_vm = mm->total_vm = 1;
255 up_write(&mm->mmap_sem);
256 bprm->p = vma->vm_end - sizeof(void *);
257 return 0;
258err:
259 up_write(&mm->mmap_sem);
260 bprm->vma = NULL;
261 kmem_cache_free(vm_area_cachep, vma);
262 return err;
263}
264
265static bool valid_arg_len(struct linux_binprm *bprm, long len)
266{
267 return len <= MAX_ARG_STRLEN;
268}
269
270#else
271
272static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
273 int write)
274{
275 struct page *page;
276
277 page = bprm->page[pos / PAGE_SIZE];
278 if (!page && write) {
279 page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
280 if (!page)
281 return NULL;
282 bprm->page[pos / PAGE_SIZE] = page;
283 }
284
285 return page;
286}
287
288static void put_arg_page(struct page *page)
289{
290}
291
292static void free_arg_page(struct linux_binprm *bprm, int i)
293{
294 if (bprm->page[i]) {
295 __free_page(bprm->page[i]);
296 bprm->page[i] = NULL;
297 }
298}
299
300static void free_arg_pages(struct linux_binprm *bprm)
301{
302 int i;
303
304 for (i = 0; i < MAX_ARG_PAGES; i++)
305 free_arg_page(bprm, i);
306}
307
308static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
309 struct page *page)
310{
311}
312
313static int __bprm_mm_init(struct linux_binprm *bprm)
314{
315 bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
316 return 0;
317}
318
319static bool valid_arg_len(struct linux_binprm *bprm, long len)
320{
321 return len <= bprm->p;
322}
323
324#endif
325
326
327
328
329
330
331
332int bprm_mm_init(struct linux_binprm *bprm)
333{
334 int err;
335 struct mm_struct *mm = NULL;
336
337 bprm->mm = mm = mm_alloc();
338 err = -ENOMEM;
339 if (!mm)
340 goto err;
341
342 err = init_new_context(current, mm);
343 if (err)
344 goto err;
345
346 err = __bprm_mm_init(bprm);
347 if (err)
348 goto err;
349
350 return 0;
351
352err:
353 if (mm) {
354 bprm->mm = NULL;
355 mmdrop(mm);
356 }
357
358 return err;
359}
360
361
362
363
364static int count(char __user * __user * argv, int max)
365{
366 int i = 0;
367
368 if (argv != NULL) {
369 for (;;) {
370 char __user * p;
371
372 if (get_user(p, argv))
373 return -EFAULT;
374 if (!p)
375 break;
376 argv++;
377 if (i++ >= max)
378 return -E2BIG;
379 cond_resched();
380 }
381 }
382 return i;
383}
384
385
386
387
388
389
390static int copy_strings(int argc, char __user * __user * argv,
391 struct linux_binprm *bprm)
392{
393 struct page *kmapped_page = NULL;
394 char *kaddr = NULL;
395 unsigned long kpos = 0;
396 int ret;
397
398 while (argc-- > 0) {
399 char __user *str;
400 int len;
401 unsigned long pos;
402
403 if (get_user(str, argv+argc) ||
404 !(len = strnlen_user(str, MAX_ARG_STRLEN))) {
405 ret = -EFAULT;
406 goto out;
407 }
408
409 if (!valid_arg_len(bprm, len)) {
410 ret = -E2BIG;
411 goto out;
412 }
413
414
415 pos = bprm->p;
416 str += len;
417 bprm->p -= len;
418
419 while (len > 0) {
420 int offset, bytes_to_copy;
421
422 offset = pos % PAGE_SIZE;
423 if (offset == 0)
424 offset = PAGE_SIZE;
425
426 bytes_to_copy = offset;
427 if (bytes_to_copy > len)
428 bytes_to_copy = len;
429
430 offset -= bytes_to_copy;
431 pos -= bytes_to_copy;
432 str -= bytes_to_copy;
433 len -= bytes_to_copy;
434
435 if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
436 struct page *page;
437
438 page = get_arg_page(bprm, pos, 1);
439 if (!page) {
440 ret = -E2BIG;
441 goto out;
442 }
443
444 if (kmapped_page) {
445 flush_kernel_dcache_page(kmapped_page);
446 kunmap(kmapped_page);
447 put_arg_page(kmapped_page);
448 }
449 kmapped_page = page;
450 kaddr = kmap(kmapped_page);
451 kpos = pos & PAGE_MASK;
452 flush_arg_page(bprm, kpos, kmapped_page);
453 }
454 if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
455 ret = -EFAULT;
456 goto out;
457 }
458 }
459 }
460 ret = 0;
461out:
462 if (kmapped_page) {
463 flush_kernel_dcache_page(kmapped_page);
464 kunmap(kmapped_page);
465 put_arg_page(kmapped_page);
466 }
467 return ret;
468}
469
470
471
472
473int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
474{
475 int r;
476 mm_segment_t oldfs = get_fs();
477 set_fs(KERNEL_DS);
478 r = copy_strings(argc, (char __user * __user *)argv, bprm);
479 set_fs(oldfs);
480 return r;
481}
482EXPORT_SYMBOL(copy_strings_kernel);
483
484#ifdef CONFIG_MMU
485
486
487
488
489
490
491
492
493
494
495
496
497
498static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
499{
500 struct mm_struct *mm = vma->vm_mm;
501 unsigned long old_start = vma->vm_start;
502 unsigned long old_end = vma->vm_end;
503 unsigned long length = old_end - old_start;
504 unsigned long new_start = old_start - shift;
505 unsigned long new_end = old_end - shift;
506 struct mmu_gather *tlb;
507
508 BUG_ON(new_start > new_end);
509
510
511
512
513
514 if (vma != find_vma(mm, new_start))
515 return -EFAULT;
516
517
518
519
520 vma_adjust(vma, new_start, old_end, vma->vm_pgoff, NULL);
521
522
523
524
525
526 if (length != move_page_tables(vma, old_start,
527 vma, new_start, length))
528 return -ENOMEM;
529
530 lru_add_drain();
531 tlb = tlb_gather_mmu(mm, 0);
532 if (new_end > old_start) {
533
534
535
536 free_pgd_range(tlb, new_end, old_end, new_end,
537 vma->vm_next ? vma->vm_next->vm_start : 0);
538 } else {
539
540
541
542
543
544
545 free_pgd_range(tlb, old_start, old_end, new_end,
546 vma->vm_next ? vma->vm_next->vm_start : 0);
547 }
548 tlb_finish_mmu(tlb, new_end, old_end);
549
550
551
552
553 vma_adjust(vma, new_start, new_end, vma->vm_pgoff, NULL);
554
555 return 0;
556}
557
558#define EXTRA_STACK_VM_PAGES 20
559
560
561
562
563
564int setup_arg_pages(struct linux_binprm *bprm,
565 unsigned long stack_top,
566 int executable_stack)
567{
568 unsigned long ret;
569 unsigned long stack_shift;
570 struct mm_struct *mm = current->mm;
571 struct vm_area_struct *vma = bprm->vma;
572 struct vm_area_struct *prev = NULL;
573 unsigned long vm_flags;
574 unsigned long stack_base;
575
576#ifdef CONFIG_STACK_GROWSUP
577
578 stack_base = current->signal->rlim[RLIMIT_STACK].rlim_max;
579 if (stack_base > (1 << 30))
580 stack_base = 1 << 30;
581
582
583 if (vma->vm_end - vma->vm_start > stack_base)
584 return -ENOMEM;
585
586 stack_base = PAGE_ALIGN(stack_top - stack_base);
587
588 stack_shift = vma->vm_start - stack_base;
589 mm->arg_start = bprm->p - stack_shift;
590 bprm->p = vma->vm_end - stack_shift;
591#else
592 stack_top = arch_align_stack(stack_top);
593 stack_top = PAGE_ALIGN(stack_top);
594 stack_shift = vma->vm_end - stack_top;
595
596 bprm->p -= stack_shift;
597 mm->arg_start = bprm->p;
598#endif
599
600 if (bprm->loader)
601 bprm->loader -= stack_shift;
602 bprm->exec -= stack_shift;
603
604 down_write(&mm->mmap_sem);
605 vm_flags = VM_STACK_FLAGS;
606
607
608
609
610
611
612 if (unlikely(executable_stack == EXSTACK_ENABLE_X))
613 vm_flags |= VM_EXEC;
614 else if (executable_stack == EXSTACK_DISABLE_X)
615 vm_flags &= ~VM_EXEC;
616 vm_flags |= mm->def_flags;
617
618 ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
619 vm_flags);
620 if (ret)
621 goto out_unlock;
622 BUG_ON(prev != vma);
623
624
625 if (stack_shift) {
626 ret = shift_arg_pages(vma, stack_shift);
627 if (ret)
628 goto out_unlock;
629 }
630
631#ifdef CONFIG_STACK_GROWSUP
632 stack_base = vma->vm_end + EXTRA_STACK_VM_PAGES * PAGE_SIZE;
633#else
634 stack_base = vma->vm_start - EXTRA_STACK_VM_PAGES * PAGE_SIZE;
635#endif
636 ret = expand_stack(vma, stack_base);
637 if (ret)
638 ret = -EFAULT;
639
640out_unlock:
641 up_write(&mm->mmap_sem);
642 return ret;
643}
644EXPORT_SYMBOL(setup_arg_pages);
645
646#endif
647
648struct file *open_exec(const char *name)
649{
650 struct file *file;
651 int err;
652
653 file = do_filp_open(AT_FDCWD, name,
654 O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
655 MAY_EXEC | MAY_OPEN);
656 if (IS_ERR(file))
657 goto out;
658
659 err = -EACCES;
660 if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))
661 goto exit;
662
663 if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
664 goto exit;
665
666 fsnotify_open(file->f_path.dentry);
667
668 err = deny_write_access(file);
669 if (err)
670 goto exit;
671
672out:
673 return file;
674
675exit:
676 fput(file);
677 return ERR_PTR(err);
678}
679EXPORT_SYMBOL(open_exec);
680
681int kernel_read(struct file *file, loff_t offset,
682 char *addr, unsigned long count)
683{
684 mm_segment_t old_fs;
685 loff_t pos = offset;
686 int result;
687
688 old_fs = get_fs();
689 set_fs(get_ds());
690
691 result = vfs_read(file, (void __user *)addr, count, &pos);
692 set_fs(old_fs);
693 return result;
694}
695
696EXPORT_SYMBOL(kernel_read);
697
698static int exec_mmap(struct mm_struct *mm)
699{
700 struct task_struct *tsk;
701 struct mm_struct * old_mm, *active_mm;
702
703
704 tsk = current;
705 old_mm = current->mm;
706 mm_release(tsk, old_mm);
707
708 if (old_mm) {
709
710
711
712
713
714
715 down_read(&old_mm->mmap_sem);
716 if (unlikely(old_mm->core_state)) {
717 up_read(&old_mm->mmap_sem);
718 return -EINTR;
719 }
720 }
721 task_lock(tsk);
722 active_mm = tsk->active_mm;
723 tsk->mm = mm;
724 tsk->active_mm = mm;
725 activate_mm(active_mm, mm);
726 task_unlock(tsk);
727 arch_pick_mmap_layout(mm);
728 if (old_mm) {
729 up_read(&old_mm->mmap_sem);
730 BUG_ON(active_mm != old_mm);
731 mm_update_next_owner(old_mm);
732 mmput(old_mm);
733 return 0;
734 }
735 mmdrop(active_mm);
736 return 0;
737}
738
739
740
741
742
743
744
745static int de_thread(struct task_struct *tsk)
746{
747 struct signal_struct *sig = tsk->signal;
748 struct sighand_struct *oldsighand = tsk->sighand;
749 spinlock_t *lock = &oldsighand->siglock;
750 int count;
751
752 if (thread_group_empty(tsk))
753 goto no_thread_group;
754
755
756
757
758 spin_lock_irq(lock);
759 if (signal_group_exit(sig)) {
760
761
762
763
764 spin_unlock_irq(lock);
765 return -EAGAIN;
766 }
767 sig->group_exit_task = tsk;
768 zap_other_threads(tsk);
769
770
771 count = thread_group_leader(tsk) ? 1 : 2;
772 sig->notify_count = count;
773 while (atomic_read(&sig->count) > count) {
774 __set_current_state(TASK_UNINTERRUPTIBLE);
775 spin_unlock_irq(lock);
776 schedule();
777 spin_lock_irq(lock);
778 }
779 spin_unlock_irq(lock);
780
781
782
783
784
785
786 if (!thread_group_leader(tsk)) {
787 struct task_struct *leader = tsk->group_leader;
788
789 sig->notify_count = -1;
790 for (;;) {
791 write_lock_irq(&tasklist_lock);
792 if (likely(leader->exit_state))
793 break;
794 __set_current_state(TASK_UNINTERRUPTIBLE);
795 write_unlock_irq(&tasklist_lock);
796 schedule();
797 }
798
799
800
801
802
803
804
805
806
807
808
809 tsk->start_time = leader->start_time;
810
811 BUG_ON(!same_thread_group(leader, tsk));
812 BUG_ON(has_group_leader_pid(tsk));
813
814
815
816
817
818
819
820
821
822
823
824
825 detach_pid(tsk, PIDTYPE_PID);
826 tsk->pid = leader->pid;
827 attach_pid(tsk, PIDTYPE_PID, task_pid(leader));
828 transfer_pid(leader, tsk, PIDTYPE_PGID);
829 transfer_pid(leader, tsk, PIDTYPE_SID);
830 list_replace_rcu(&leader->tasks, &tsk->tasks);
831
832 tsk->group_leader = tsk;
833 leader->group_leader = tsk;
834
835 tsk->exit_signal = SIGCHLD;
836
837 BUG_ON(leader->exit_state != EXIT_ZOMBIE);
838 leader->exit_state = EXIT_DEAD;
839 write_unlock_irq(&tasklist_lock);
840
841 release_task(leader);
842 }
843
844 sig->group_exit_task = NULL;
845 sig->notify_count = 0;
846
847no_thread_group:
848 if (current->mm)
849 setmax_mm_hiwater_rss(&sig->maxrss, current->mm);
850
851 exit_itimers(sig);
852 flush_itimer_signals();
853
854 if (atomic_read(&oldsighand->count) != 1) {
855 struct sighand_struct *newsighand;
856
857
858
859
860 newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
861 if (!newsighand)
862 return -ENOMEM;
863
864 atomic_set(&newsighand->count, 1);
865 memcpy(newsighand->action, oldsighand->action,
866 sizeof(newsighand->action));
867
868 write_lock_irq(&tasklist_lock);
869 spin_lock(&oldsighand->siglock);
870 rcu_assign_pointer(tsk->sighand, newsighand);
871 spin_unlock(&oldsighand->siglock);
872 write_unlock_irq(&tasklist_lock);
873
874 __cleanup_sighand(oldsighand);
875 }
876
877 BUG_ON(!thread_group_leader(tsk));
878 return 0;
879}
880
881
882
883
884
885static void flush_old_files(struct files_struct * files)
886{
887 long j = -1;
888 struct fdtable *fdt;
889
890 spin_lock(&files->file_lock);
891 for (;;) {
892 unsigned long set, i;
893
894 j++;
895 i = j * __NFDBITS;
896 fdt = files_fdtable(files);
897 if (i >= fdt->max_fds)
898 break;
899 set = fdt->close_on_exec->fds_bits[j];
900 if (!set)
901 continue;
902 fdt->close_on_exec->fds_bits[j] = 0;
903 spin_unlock(&files->file_lock);
904 for ( ; set ; i++,set >>= 1) {
905 if (set & 1) {
906 sys_close(i);
907 }
908 }
909 spin_lock(&files->file_lock);
910
911 }
912 spin_unlock(&files->file_lock);
913}
914
915char *get_task_comm(char *buf, struct task_struct *tsk)
916{
917
918 task_lock(tsk);
919 strncpy(buf, tsk->comm, sizeof(tsk->comm));
920 task_unlock(tsk);
921 return buf;
922}
923
924void set_task_comm(struct task_struct *tsk, char *buf)
925{
926 task_lock(tsk);
927 strlcpy(tsk->comm, buf, sizeof(tsk->comm));
928 task_unlock(tsk);
929 perf_event_comm(tsk);
930}
931
932int flush_old_exec(struct linux_binprm * bprm)
933{
934 char * name;
935 int i, ch, retval;
936 char tcomm[sizeof(current->comm)];
937
938
939
940
941
942 retval = de_thread(current);
943 if (retval)
944 goto out;
945
946 set_mm_exe_file(bprm->mm, bprm->file);
947
948
949
950
951 retval = exec_mmap(bprm->mm);
952 if (retval)
953 goto out;
954
955 bprm->mm = NULL;
956
957
958 current->sas_ss_sp = current->sas_ss_size = 0;
959
960 if (current_euid() == current_uid() && current_egid() == current_gid())
961 set_dumpable(current->mm, 1);
962 else
963 set_dumpable(current->mm, suid_dumpable);
964
965 name = bprm->filename;
966
967
968 for (i=0; (ch = *(name++)) != '\0';) {
969 if (ch == '/')
970 i = 0;
971 else
972 if (i < (sizeof(tcomm) - 1))
973 tcomm[i++] = ch;
974 }
975 tcomm[i] = '\0';
976 set_task_comm(current, tcomm);
977
978 current->flags &= ~PF_RANDOMIZE;
979 flush_thread();
980
981
982
983
984
985 current->mm->task_size = TASK_SIZE;
986
987
988 if (bprm->cred->uid != current_euid() ||
989 bprm->cred->gid != current_egid()) {
990 current->pdeath_signal = 0;
991 } else if (file_permission(bprm->file, MAY_READ) ||
992 bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP) {
993 set_dumpable(current->mm, suid_dumpable);
994 }
995
996 current->personality &= ~bprm->per_clear;
997
998
999
1000
1001
1002 if (!get_dumpable(current->mm))
1003 perf_event_exit_task(current);
1004
1005
1006
1007
1008 current->self_exec_id++;
1009
1010 flush_signal_handlers(current, 0);
1011 flush_old_files(current->files);
1012
1013 return 0;
1014
1015out:
1016 return retval;
1017}
1018
1019EXPORT_SYMBOL(flush_old_exec);
1020
1021
1022
1023
1024
1025
1026
1027int prepare_bprm_creds(struct linux_binprm *bprm)
1028{
1029 if (mutex_lock_interruptible(¤t->cred_guard_mutex))
1030 return -ERESTARTNOINTR;
1031
1032 bprm->cred = prepare_exec_creds();
1033 if (likely(bprm->cred))
1034 return 0;
1035
1036 mutex_unlock(¤t->cred_guard_mutex);
1037 return -ENOMEM;
1038}
1039
1040void free_bprm(struct linux_binprm *bprm)
1041{
1042 free_arg_pages(bprm);
1043 if (bprm->cred) {
1044 mutex_unlock(¤t->cred_guard_mutex);
1045 abort_creds(bprm->cred);
1046 }
1047 kfree(bprm);
1048}
1049
1050
1051
1052
1053void install_exec_creds(struct linux_binprm *bprm)
1054{
1055 security_bprm_committing_creds(bprm);
1056
1057 commit_creds(bprm->cred);
1058 bprm->cred = NULL;
1059
1060
1061
1062
1063
1064 security_bprm_committed_creds(bprm);
1065 mutex_unlock(¤t->cred_guard_mutex);
1066}
1067EXPORT_SYMBOL(install_exec_creds);
1068
1069
1070
1071
1072
1073
1074int check_unsafe_exec(struct linux_binprm *bprm)
1075{
1076 struct task_struct *p = current, *t;
1077 unsigned n_fs;
1078 int res = 0;
1079
1080 bprm->unsafe = tracehook_unsafe_exec(p);
1081
1082 n_fs = 1;
1083 write_lock(&p->fs->lock);
1084 rcu_read_lock();
1085 for (t = next_thread(p); t != p; t = next_thread(t)) {
1086 if (t->fs == p->fs)
1087 n_fs++;
1088 }
1089 rcu_read_unlock();
1090
1091 if (p->fs->users > n_fs) {
1092 bprm->unsafe |= LSM_UNSAFE_SHARE;
1093 } else {
1094 res = -EAGAIN;
1095 if (!p->fs->in_exec) {
1096 p->fs->in_exec = 1;
1097 res = 1;
1098 }
1099 }
1100 write_unlock(&p->fs->lock);
1101
1102 return res;
1103}
1104
1105
1106
1107
1108
1109
1110
1111int prepare_binprm(struct linux_binprm *bprm)
1112{
1113 umode_t mode;
1114 struct inode * inode = bprm->file->f_path.dentry->d_inode;
1115 int retval;
1116
1117 mode = inode->i_mode;
1118 if (bprm->file->f_op == NULL)
1119 return -EACCES;
1120
1121
1122 bprm->cred->euid = current_euid();
1123 bprm->cred->egid = current_egid();
1124
1125 if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
1126
1127 if (mode & S_ISUID) {
1128 bprm->per_clear |= PER_CLEAR_ON_SETID;
1129 bprm->cred->euid = inode->i_uid;
1130 }
1131
1132
1133
1134
1135
1136
1137
1138 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
1139 bprm->per_clear |= PER_CLEAR_ON_SETID;
1140 bprm->cred->egid = inode->i_gid;
1141 }
1142 }
1143
1144
1145 retval = security_bprm_set_creds(bprm);
1146 if (retval)
1147 return retval;
1148 bprm->cred_prepared = 1;
1149
1150 memset(bprm->buf, 0, BINPRM_BUF_SIZE);
1151 return kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
1152}
1153
1154EXPORT_SYMBOL(prepare_binprm);
1155
1156
1157
1158
1159
1160
1161int remove_arg_zero(struct linux_binprm *bprm)
1162{
1163 int ret = 0;
1164 unsigned long offset;
1165 char *kaddr;
1166 struct page *page;
1167
1168 if (!bprm->argc)
1169 return 0;
1170
1171 do {
1172 offset = bprm->p & ~PAGE_MASK;
1173 page = get_arg_page(bprm, bprm->p, 0);
1174 if (!page) {
1175 ret = -EFAULT;
1176 goto out;
1177 }
1178 kaddr = kmap_atomic(page, KM_USER0);
1179
1180 for (; offset < PAGE_SIZE && kaddr[offset];
1181 offset++, bprm->p++)
1182 ;
1183
1184 kunmap_atomic(kaddr, KM_USER0);
1185 put_arg_page(page);
1186
1187 if (offset == PAGE_SIZE)
1188 free_arg_page(bprm, (bprm->p >> PAGE_SHIFT) - 1);
1189 } while (offset == PAGE_SIZE);
1190
1191 bprm->p++;
1192 bprm->argc--;
1193 ret = 0;
1194
1195out:
1196 return ret;
1197}
1198EXPORT_SYMBOL(remove_arg_zero);
1199
1200
1201
1202
1203int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
1204{
1205 unsigned int depth = bprm->recursion_depth;
1206 int try,retval;
1207 struct linux_binfmt *fmt;
1208
1209 retval = security_bprm_check(bprm);
1210 if (retval)
1211 return retval;
1212 retval = ima_bprm_check(bprm);
1213 if (retval)
1214 return retval;
1215
1216
1217
1218 set_fs(USER_DS);
1219
1220 retval = audit_bprm(bprm);
1221 if (retval)
1222 return retval;
1223
1224 retval = -ENOENT;
1225 for (try=0; try<2; try++) {
1226 read_lock(&binfmt_lock);
1227 list_for_each_entry(fmt, &formats, lh) {
1228 int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
1229 if (!fn)
1230 continue;
1231 if (!try_module_get(fmt->module))
1232 continue;
1233 read_unlock(&binfmt_lock);
1234 retval = fn(bprm, regs);
1235
1236
1237
1238
1239
1240 bprm->recursion_depth = depth;
1241 if (retval >= 0) {
1242 if (depth == 0)
1243 tracehook_report_exec(fmt, bprm, regs);
1244 put_binfmt(fmt);
1245 allow_write_access(bprm->file);
1246 if (bprm->file)
1247 fput(bprm->file);
1248 bprm->file = NULL;
1249 current->did_exec = 1;
1250 proc_exec_connector(current);
1251 return retval;
1252 }
1253 read_lock(&binfmt_lock);
1254 put_binfmt(fmt);
1255 if (retval != -ENOEXEC || bprm->mm == NULL)
1256 break;
1257 if (!bprm->file) {
1258 read_unlock(&binfmt_lock);
1259 return retval;
1260 }
1261 }
1262 read_unlock(&binfmt_lock);
1263 if (retval != -ENOEXEC || bprm->mm == NULL) {
1264 break;
1265#ifdef CONFIG_MODULES
1266 } else {
1267#define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
1268 if (printable(bprm->buf[0]) &&
1269 printable(bprm->buf[1]) &&
1270 printable(bprm->buf[2]) &&
1271 printable(bprm->buf[3]))
1272 break;
1273 request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
1274#endif
1275 }
1276 }
1277 return retval;
1278}
1279
1280EXPORT_SYMBOL(search_binary_handler);
1281
1282
1283
1284
1285int do_execve(char * filename,
1286 char __user *__user *argv,
1287 char __user *__user *envp,
1288 struct pt_regs * regs)
1289{
1290 struct linux_binprm *bprm;
1291 struct file *file;
1292 struct files_struct *displaced;
1293 bool clear_in_exec;
1294 int retval;
1295
1296 retval = unshare_files(&displaced);
1297 if (retval)
1298 goto out_ret;
1299
1300 retval = -ENOMEM;
1301 bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
1302 if (!bprm)
1303 goto out_files;
1304
1305 retval = prepare_bprm_creds(bprm);
1306 if (retval)
1307 goto out_free;
1308
1309 retval = check_unsafe_exec(bprm);
1310 if (retval < 0)
1311 goto out_free;
1312 clear_in_exec = retval;
1313 current->in_execve = 1;
1314
1315 file = open_exec(filename);
1316 retval = PTR_ERR(file);
1317 if (IS_ERR(file))
1318 goto out_unmark;
1319
1320 sched_exec();
1321
1322 bprm->file = file;
1323 bprm->filename = filename;
1324 bprm->interp = filename;
1325
1326 retval = bprm_mm_init(bprm);
1327 if (retval)
1328 goto out_file;
1329
1330 bprm->argc = count(argv, MAX_ARG_STRINGS);
1331 if ((retval = bprm->argc) < 0)
1332 goto out;
1333
1334 bprm->envc = count(envp, MAX_ARG_STRINGS);
1335 if ((retval = bprm->envc) < 0)
1336 goto out;
1337
1338 retval = prepare_binprm(bprm);
1339 if (retval < 0)
1340 goto out;
1341
1342 retval = copy_strings_kernel(1, &bprm->filename, bprm);
1343 if (retval < 0)
1344 goto out;
1345
1346 bprm->exec = bprm->p;
1347 retval = copy_strings(bprm->envc, envp, bprm);
1348 if (retval < 0)
1349 goto out;
1350
1351 retval = copy_strings(bprm->argc, argv, bprm);
1352 if (retval < 0)
1353 goto out;
1354
1355 current->flags &= ~PF_KTHREAD;
1356 retval = search_binary_handler(bprm,regs);
1357 if (retval < 0)
1358 goto out;
1359
1360 current->stack_start = current->mm->start_stack;
1361
1362
1363 current->fs->in_exec = 0;
1364 current->in_execve = 0;
1365 acct_update_integrals(current);
1366 free_bprm(bprm);
1367 if (displaced)
1368 put_files_struct(displaced);
1369 return retval;
1370
1371out:
1372 if (bprm->mm)
1373 mmput (bprm->mm);
1374
1375out_file:
1376 if (bprm->file) {
1377 allow_write_access(bprm->file);
1378 fput(bprm->file);
1379 }
1380
1381out_unmark:
1382 if (clear_in_exec)
1383 current->fs->in_exec = 0;
1384 current->in_execve = 0;
1385
1386out_free:
1387 free_bprm(bprm);
1388
1389out_files:
1390 if (displaced)
1391 reset_files_struct(displaced);
1392out_ret:
1393 return retval;
1394}
1395
1396void set_binfmt(struct linux_binfmt *new)
1397{
1398 struct mm_struct *mm = current->mm;
1399
1400 if (mm->binfmt)
1401 module_put(mm->binfmt->module);
1402
1403 mm->binfmt = new;
1404 if (new)
1405 __module_get(new->module);
1406}
1407
1408EXPORT_SYMBOL(set_binfmt);
1409
1410
1411
1412
1413
1414static int format_corename(char *corename, long signr)
1415{
1416 const struct cred *cred = current_cred();
1417 const char *pat_ptr = core_pattern;
1418 int ispipe = (*pat_ptr == '|');
1419 char *out_ptr = corename;
1420 char *const out_end = corename + CORENAME_MAX_SIZE;
1421 int rc;
1422 int pid_in_pattern = 0;
1423
1424
1425
1426 while (*pat_ptr) {
1427 if (*pat_ptr != '%') {
1428 if (out_ptr == out_end)
1429 goto out;
1430 *out_ptr++ = *pat_ptr++;
1431 } else {
1432 switch (*++pat_ptr) {
1433 case 0:
1434 goto out;
1435
1436 case '%':
1437 if (out_ptr == out_end)
1438 goto out;
1439 *out_ptr++ = '%';
1440 break;
1441
1442 case 'p':
1443 pid_in_pattern = 1;
1444 rc = snprintf(out_ptr, out_end - out_ptr,
1445 "%d", task_tgid_vnr(current));
1446 if (rc > out_end - out_ptr)
1447 goto out;
1448 out_ptr += rc;
1449 break;
1450
1451 case 'u':
1452 rc = snprintf(out_ptr, out_end - out_ptr,
1453 "%d", cred->uid);
1454 if (rc > out_end - out_ptr)
1455 goto out;
1456 out_ptr += rc;
1457 break;
1458
1459 case 'g':
1460 rc = snprintf(out_ptr, out_end - out_ptr,
1461 "%d", cred->gid);
1462 if (rc > out_end - out_ptr)
1463 goto out;
1464 out_ptr += rc;
1465 break;
1466
1467 case 's':
1468 rc = snprintf(out_ptr, out_end - out_ptr,
1469 "%ld", signr);
1470 if (rc > out_end - out_ptr)
1471 goto out;
1472 out_ptr += rc;
1473 break;
1474
1475 case 't': {
1476 struct timeval tv;
1477 do_gettimeofday(&tv);
1478 rc = snprintf(out_ptr, out_end - out_ptr,
1479 "%lu", tv.tv_sec);
1480 if (rc > out_end - out_ptr)
1481 goto out;
1482 out_ptr += rc;
1483 break;
1484 }
1485
1486 case 'h':
1487 down_read(&uts_sem);
1488 rc = snprintf(out_ptr, out_end - out_ptr,
1489 "%s", utsname()->nodename);
1490 up_read(&uts_sem);
1491 if (rc > out_end - out_ptr)
1492 goto out;
1493 out_ptr += rc;
1494 break;
1495
1496 case 'e':
1497 rc = snprintf(out_ptr, out_end - out_ptr,
1498 "%s", current->comm);
1499 if (rc > out_end - out_ptr)
1500 goto out;
1501 out_ptr += rc;
1502 break;
1503
1504 case 'c':
1505 rc = snprintf(out_ptr, out_end - out_ptr,
1506 "%lu", current->signal->rlim[RLIMIT_CORE].rlim_cur);
1507 if (rc > out_end - out_ptr)
1508 goto out;
1509 out_ptr += rc;
1510 break;
1511 default:
1512 break;
1513 }
1514 ++pat_ptr;
1515 }
1516 }
1517
1518
1519
1520
1521
1522 if (!ispipe && !pid_in_pattern && core_uses_pid) {
1523 rc = snprintf(out_ptr, out_end - out_ptr,
1524 ".%d", task_tgid_vnr(current));
1525 if (rc > out_end - out_ptr)
1526 goto out;
1527 out_ptr += rc;
1528 }
1529out:
1530 *out_ptr = 0;
1531 return ispipe;
1532}
1533
1534static int zap_process(struct task_struct *start)
1535{
1536 struct task_struct *t;
1537 int nr = 0;
1538
1539 start->signal->flags = SIGNAL_GROUP_EXIT;
1540 start->signal->group_stop_count = 0;
1541
1542 t = start;
1543 do {
1544 if (t != current && t->mm) {
1545 sigaddset(&t->pending.signal, SIGKILL);
1546 signal_wake_up(t, 1);
1547 nr++;
1548 }
1549 } while_each_thread(start, t);
1550
1551 return nr;
1552}
1553
1554static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
1555 struct core_state *core_state, int exit_code)
1556{
1557 struct task_struct *g, *p;
1558 unsigned long flags;
1559 int nr = -EAGAIN;
1560
1561 spin_lock_irq(&tsk->sighand->siglock);
1562 if (!signal_group_exit(tsk->signal)) {
1563 mm->core_state = core_state;
1564 tsk->signal->group_exit_code = exit_code;
1565 nr = zap_process(tsk);
1566 }
1567 spin_unlock_irq(&tsk->sighand->siglock);
1568 if (unlikely(nr < 0))
1569 return nr;
1570
1571 if (atomic_read(&mm->mm_users) == nr + 1)
1572 goto done;
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603 rcu_read_lock();
1604 for_each_process(g) {
1605 if (g == tsk->group_leader)
1606 continue;
1607 if (g->flags & PF_KTHREAD)
1608 continue;
1609 p = g;
1610 do {
1611 if (p->mm) {
1612 if (unlikely(p->mm == mm)) {
1613 lock_task_sighand(p, &flags);
1614 nr += zap_process(p);
1615 unlock_task_sighand(p, &flags);
1616 }
1617 break;
1618 }
1619 } while_each_thread(g, p);
1620 }
1621 rcu_read_unlock();
1622done:
1623 atomic_set(&core_state->nr_threads, nr);
1624 return nr;
1625}
1626
1627static int coredump_wait(int exit_code, struct core_state *core_state)
1628{
1629 struct task_struct *tsk = current;
1630 struct mm_struct *mm = tsk->mm;
1631 struct completion *vfork_done;
1632 int core_waiters;
1633
1634 init_completion(&core_state->startup);
1635 core_state->dumper.task = tsk;
1636 core_state->dumper.next = NULL;
1637 core_waiters = zap_threads(tsk, mm, core_state, exit_code);
1638 up_write(&mm->mmap_sem);
1639
1640 if (unlikely(core_waiters < 0))
1641 goto fail;
1642
1643
1644
1645
1646
1647 vfork_done = tsk->vfork_done;
1648 if (vfork_done) {
1649 tsk->vfork_done = NULL;
1650 complete(vfork_done);
1651 }
1652
1653 if (core_waiters)
1654 wait_for_completion(&core_state->startup);
1655fail:
1656 return core_waiters;
1657}
1658
1659static void coredump_finish(struct mm_struct *mm)
1660{
1661 struct core_thread *curr, *next;
1662 struct task_struct *task;
1663
1664 next = mm->core_state->dumper.next;
1665 while ((curr = next) != NULL) {
1666 next = curr->next;
1667 task = curr->task;
1668
1669
1670
1671
1672 smp_mb();
1673 curr->task = NULL;
1674 wake_up_process(task);
1675 }
1676
1677 mm->core_state = NULL;
1678}
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700void set_dumpable(struct mm_struct *mm, int value)
1701{
1702 switch (value) {
1703 case 0:
1704 clear_bit(MMF_DUMPABLE, &mm->flags);
1705 smp_wmb();
1706 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
1707 break;
1708 case 1:
1709 set_bit(MMF_DUMPABLE, &mm->flags);
1710 smp_wmb();
1711 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
1712 break;
1713 case 2:
1714 set_bit(MMF_DUMP_SECURELY, &mm->flags);
1715 smp_wmb();
1716 set_bit(MMF_DUMPABLE, &mm->flags);
1717 break;
1718 }
1719}
1720
1721int get_dumpable(struct mm_struct *mm)
1722{
1723 int ret;
1724
1725 ret = mm->flags & 0x3;
1726 return (ret >= 2) ? 2 : ret;
1727}
1728
1729static void wait_for_dump_helpers(struct file *file)
1730{
1731 struct pipe_inode_info *pipe;
1732
1733 pipe = file->f_path.dentry->d_inode->i_pipe;
1734
1735 pipe_lock(pipe);
1736 pipe->readers++;
1737 pipe->writers--;
1738
1739 while ((pipe->readers > 1) && (!signal_pending(current))) {
1740 wake_up_interruptible_sync(&pipe->wait);
1741 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
1742 pipe_wait(pipe);
1743 }
1744
1745 pipe->readers--;
1746 pipe->writers++;
1747 pipe_unlock(pipe);
1748
1749}
1750
1751
1752void do_coredump(long signr, int exit_code, struct pt_regs *regs)
1753{
1754 struct core_state core_state;
1755 char corename[CORENAME_MAX_SIZE + 1];
1756 struct mm_struct *mm = current->mm;
1757 struct linux_binfmt * binfmt;
1758 struct inode * inode;
1759 struct file * file;
1760 const struct cred *old_cred;
1761 struct cred *cred;
1762 int retval = 0;
1763 int flag = 0;
1764 int ispipe = 0;
1765 unsigned long core_limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
1766 char **helper_argv = NULL;
1767 int helper_argc = 0;
1768 int dump_count = 0;
1769 static atomic_t core_dump_count = ATOMIC_INIT(0);
1770
1771 audit_core_dumps(signr);
1772
1773 binfmt = mm->binfmt;
1774 if (!binfmt || !binfmt->core_dump)
1775 goto fail;
1776
1777 cred = prepare_creds();
1778 if (!cred) {
1779 retval = -ENOMEM;
1780 goto fail;
1781 }
1782
1783 down_write(&mm->mmap_sem);
1784
1785
1786
1787 if (mm->core_state || !get_dumpable(mm)) {
1788 up_write(&mm->mmap_sem);
1789 put_cred(cred);
1790 goto fail;
1791 }
1792
1793
1794
1795
1796
1797
1798 if (get_dumpable(mm) == 2) {
1799 flag = O_EXCL;
1800 cred->fsuid = 0;
1801 }
1802
1803 retval = coredump_wait(exit_code, &core_state);
1804 if (retval < 0) {
1805 put_cred(cred);
1806 goto fail;
1807 }
1808
1809 old_cred = override_creds(cred);
1810
1811
1812
1813
1814
1815 clear_thread_flag(TIF_SIGPENDING);
1816
1817
1818
1819
1820
1821 lock_kernel();
1822 ispipe = format_corename(corename, signr);
1823 unlock_kernel();
1824
1825 if ((!ispipe) && (core_limit < binfmt->min_coredump))
1826 goto fail_unlock;
1827
1828 if (ispipe) {
1829 if (core_limit == 0) {
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844 printk(KERN_WARNING
1845 "Process %d(%s) has RLIMIT_CORE set to 0\n",
1846 task_tgid_vnr(current), current->comm);
1847 printk(KERN_WARNING "Aborting core\n");
1848 goto fail_unlock;
1849 }
1850
1851 dump_count = atomic_inc_return(&core_dump_count);
1852 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
1853 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
1854 task_tgid_vnr(current), current->comm);
1855 printk(KERN_WARNING "Skipping core dump\n");
1856 goto fail_dropcount;
1857 }
1858
1859 helper_argv = argv_split(GFP_KERNEL, corename+1, &helper_argc);
1860 if (!helper_argv) {
1861 printk(KERN_WARNING "%s failed to allocate memory\n",
1862 __func__);
1863 goto fail_dropcount;
1864 }
1865
1866 core_limit = RLIM_INFINITY;
1867
1868
1869 if (call_usermodehelper_pipe(helper_argv[0], helper_argv, NULL,
1870 &file)) {
1871 printk(KERN_INFO "Core dump to %s pipe failed\n",
1872 corename);
1873 goto fail_dropcount;
1874 }
1875 } else
1876 file = filp_open(corename,
1877 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
1878 0600);
1879 if (IS_ERR(file))
1880 goto fail_dropcount;
1881 inode = file->f_path.dentry->d_inode;
1882 if (inode->i_nlink > 1)
1883 goto close_fail;
1884 if (!ispipe && d_unhashed(file->f_path.dentry))
1885 goto close_fail;
1886
1887
1888
1889 if (!ispipe && !S_ISREG(inode->i_mode))
1890 goto close_fail;
1891
1892
1893
1894
1895 if (inode->i_uid != current_fsuid())
1896 goto close_fail;
1897 if (!file->f_op)
1898 goto close_fail;
1899 if (!file->f_op->write)
1900 goto close_fail;
1901 if (!ispipe && do_truncate(file->f_path.dentry, 0, 0, file) != 0)
1902 goto close_fail;
1903
1904 retval = binfmt->core_dump(signr, regs, file, core_limit);
1905
1906 if (retval)
1907 current->signal->group_exit_code |= 0x80;
1908close_fail:
1909 if (ispipe && core_pipe_limit)
1910 wait_for_dump_helpers(file);
1911 filp_close(file, NULL);
1912fail_dropcount:
1913 if (dump_count)
1914 atomic_dec(&core_dump_count);
1915fail_unlock:
1916 if (helper_argv)
1917 argv_free(helper_argv);
1918
1919 revert_creds(old_cred);
1920 put_cred(cred);
1921 coredump_finish(mm);
1922fail:
1923 return;
1924}
1925