1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25#include <linux/slab.h>
26#include <linux/file.h>
27#include <linux/fdtable.h>
28#include <linux/mm.h>
29#include <linux/stat.h>
30#include <linux/fcntl.h>
31#include <linux/swap.h>
32#include <linux/string.h>
33#include <linux/init.h>
34#include <linux/pagemap.h>
35#include <linux/perf_event.h>
36#include <linux/highmem.h>
37#include <linux/spinlock.h>
38#include <linux/key.h>
39#include <linux/personality.h>
40#include <linux/binfmts.h>
41#include <linux/utsname.h>
42#include <linux/pid_namespace.h>
43#include <linux/module.h>
44#include <linux/namei.h>
45#include <linux/mount.h>
46#include <linux/security.h>
47#include <linux/syscalls.h>
48#include <linux/tsacct_kern.h>
49#include <linux/cn_proc.h>
50#include <linux/audit.h>
51#include <linux/tracehook.h>
52#include <linux/kmod.h>
53#include <linux/fsnotify.h>
54#include <linux/fs_struct.h>
55#include <linux/pipe_fs_i.h>
56#include <linux/oom.h>
57#include <linux/compat.h>
58
59#include <asm/uaccess.h>
60#include <asm/mmu_context.h>
61#include <asm/tlb.h>
62#include "internal.h"
63
64int core_uses_pid;
65char core_pattern[CORENAME_MAX_SIZE] = "core";
66unsigned int core_pipe_limit;
67int suid_dumpable = 0;
68
69struct core_name {
70 char *corename;
71 int used, size;
72};
73static atomic_t call_count = ATOMIC_INIT(1);
74
75
76
77static LIST_HEAD(formats);
78static DEFINE_RWLOCK(binfmt_lock);
79
80int __register_binfmt(struct linux_binfmt * fmt, int insert)
81{
82 if (!fmt)
83 return -EINVAL;
84 write_lock(&binfmt_lock);
85 insert ? list_add(&fmt->lh, &formats) :
86 list_add_tail(&fmt->lh, &formats);
87 write_unlock(&binfmt_lock);
88 return 0;
89}
90
91EXPORT_SYMBOL(__register_binfmt);
92
93void unregister_binfmt(struct linux_binfmt * fmt)
94{
95 write_lock(&binfmt_lock);
96 list_del(&fmt->lh);
97 write_unlock(&binfmt_lock);
98}
99
100EXPORT_SYMBOL(unregister_binfmt);
101
102static inline void put_binfmt(struct linux_binfmt * fmt)
103{
104 module_put(fmt->module);
105}
106
107
108
109
110
111
112
113SYSCALL_DEFINE1(uselib, const char __user *, library)
114{
115 struct file *file;
116 char *tmp = getname(library);
117 int error = PTR_ERR(tmp);
118 static const struct open_flags uselib_flags = {
119 .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
120 .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
121 .intent = LOOKUP_OPEN
122 };
123
124 if (IS_ERR(tmp))
125 goto out;
126
127 file = do_filp_open(AT_FDCWD, tmp, &uselib_flags, LOOKUP_FOLLOW);
128 putname(tmp);
129 error = PTR_ERR(file);
130 if (IS_ERR(file))
131 goto out;
132
133 error = -EINVAL;
134 if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))
135 goto exit;
136
137 error = -EACCES;
138 if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
139 goto exit;
140
141 fsnotify_open(file);
142
143 error = -ENOEXEC;
144 if(file->f_op) {
145 struct linux_binfmt * fmt;
146
147 read_lock(&binfmt_lock);
148 list_for_each_entry(fmt, &formats, lh) {
149 if (!fmt->load_shlib)
150 continue;
151 if (!try_module_get(fmt->module))
152 continue;
153 read_unlock(&binfmt_lock);
154 error = fmt->load_shlib(file);
155 read_lock(&binfmt_lock);
156 put_binfmt(fmt);
157 if (error != -ENOEXEC)
158 break;
159 }
160 read_unlock(&binfmt_lock);
161 }
162exit:
163 fput(file);
164out:
165 return error;
166}
167
168#ifdef CONFIG_MMU
169
170
171
172
173
174
175static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
176{
177 struct mm_struct *mm = current->mm;
178 long diff = (long)(pages - bprm->vma_pages);
179
180 if (!mm || !diff)
181 return;
182
183 bprm->vma_pages = pages;
184 add_mm_counter(mm, MM_ANONPAGES, diff);
185}
186
187static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
188 int write)
189{
190 struct page *page;
191 int ret;
192
193#ifdef CONFIG_STACK_GROWSUP
194 if (write) {
195 ret = expand_downwards(bprm->vma, pos);
196 if (ret < 0)
197 return NULL;
198 }
199#endif
200 ret = get_user_pages(current, bprm->mm, pos,
201 1, write, 1, &page, NULL);
202 if (ret <= 0)
203 return NULL;
204
205 if (write) {
206 unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
207 struct rlimit *rlim;
208
209 acct_arg_size(bprm, size / PAGE_SIZE);
210
211
212
213
214
215 if (size <= ARG_MAX)
216 return page;
217
218
219
220
221
222
223
224
225 rlim = current->signal->rlim;
226 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) {
227 put_page(page);
228 return NULL;
229 }
230 }
231
232 return page;
233}
234
235static void put_arg_page(struct page *page)
236{
237 put_page(page);
238}
239
240static void free_arg_page(struct linux_binprm *bprm, int i)
241{
242}
243
244static void free_arg_pages(struct linux_binprm *bprm)
245{
246}
247
248static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
249 struct page *page)
250{
251 flush_cache_page(bprm->vma, pos, page_to_pfn(page));
252}
253
254static int __bprm_mm_init(struct linux_binprm *bprm)
255{
256 int err;
257 struct vm_area_struct *vma = NULL;
258 struct mm_struct *mm = bprm->mm;
259
260 bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
261 if (!vma)
262 return -ENOMEM;
263
264 down_write(&mm->mmap_sem);
265 vma->vm_mm = mm;
266
267
268
269
270
271
272
273 BUILD_BUG_ON(VM_STACK_FLAGS & VM_STACK_INCOMPLETE_SETUP);
274 vma->vm_end = STACK_TOP_MAX;
275 vma->vm_start = vma->vm_end - PAGE_SIZE;
276 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
277 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
278 INIT_LIST_HEAD(&vma->anon_vma_chain);
279
280 err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
281 if (err)
282 goto err;
283
284 err = insert_vm_struct(mm, vma);
285 if (err)
286 goto err;
287
288 mm->stack_vm = mm->total_vm = 1;
289 up_write(&mm->mmap_sem);
290 bprm->p = vma->vm_end - sizeof(void *);
291 return 0;
292err:
293 up_write(&mm->mmap_sem);
294 bprm->vma = NULL;
295 kmem_cache_free(vm_area_cachep, vma);
296 return err;
297}
298
299static bool valid_arg_len(struct linux_binprm *bprm, long len)
300{
301 return len <= MAX_ARG_STRLEN;
302}
303
304#else
305
306static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
307{
308}
309
310static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
311 int write)
312{
313 struct page *page;
314
315 page = bprm->page[pos / PAGE_SIZE];
316 if (!page && write) {
317 page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
318 if (!page)
319 return NULL;
320 bprm->page[pos / PAGE_SIZE] = page;
321 }
322
323 return page;
324}
325
326static void put_arg_page(struct page *page)
327{
328}
329
330static void free_arg_page(struct linux_binprm *bprm, int i)
331{
332 if (bprm->page[i]) {
333 __free_page(bprm->page[i]);
334 bprm->page[i] = NULL;
335 }
336}
337
338static void free_arg_pages(struct linux_binprm *bprm)
339{
340 int i;
341
342 for (i = 0; i < MAX_ARG_PAGES; i++)
343 free_arg_page(bprm, i);
344}
345
346static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
347 struct page *page)
348{
349}
350
351static int __bprm_mm_init(struct linux_binprm *bprm)
352{
353 bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
354 return 0;
355}
356
357static bool valid_arg_len(struct linux_binprm *bprm, long len)
358{
359 return len <= bprm->p;
360}
361
362#endif
363
364
365
366
367
368
369
370int bprm_mm_init(struct linux_binprm *bprm)
371{
372 int err;
373 struct mm_struct *mm = NULL;
374
375 bprm->mm = mm = mm_alloc();
376 err = -ENOMEM;
377 if (!mm)
378 goto err;
379
380 err = init_new_context(current, mm);
381 if (err)
382 goto err;
383
384 err = __bprm_mm_init(bprm);
385 if (err)
386 goto err;
387
388 return 0;
389
390err:
391 if (mm) {
392 bprm->mm = NULL;
393 mmdrop(mm);
394 }
395
396 return err;
397}
398
399struct user_arg_ptr {
400#ifdef CONFIG_COMPAT
401 bool is_compat;
402#endif
403 union {
404 const char __user *const __user *native;
405#ifdef CONFIG_COMPAT
406 compat_uptr_t __user *compat;
407#endif
408 } ptr;
409};
410
411static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
412{
413 const char __user *native;
414
415#ifdef CONFIG_COMPAT
416 if (unlikely(argv.is_compat)) {
417 compat_uptr_t compat;
418
419 if (get_user(compat, argv.ptr.compat + nr))
420 return ERR_PTR(-EFAULT);
421
422 return compat_ptr(compat);
423 }
424#endif
425
426 if (get_user(native, argv.ptr.native + nr))
427 return ERR_PTR(-EFAULT);
428
429 return native;
430}
431
432
433
434
435static int count(struct user_arg_ptr argv, int max)
436{
437 int i = 0;
438
439 if (argv.ptr.native != NULL) {
440 for (;;) {
441 const char __user *p = get_user_arg_ptr(argv, i);
442
443 if (!p)
444 break;
445
446 if (IS_ERR(p))
447 return -EFAULT;
448
449 if (i++ >= max)
450 return -E2BIG;
451
452 if (fatal_signal_pending(current))
453 return -ERESTARTNOHAND;
454 cond_resched();
455 }
456 }
457 return i;
458}
459
460
461
462
463
464
465static int copy_strings(int argc, struct user_arg_ptr argv,
466 struct linux_binprm *bprm)
467{
468 struct page *kmapped_page = NULL;
469 char *kaddr = NULL;
470 unsigned long kpos = 0;
471 int ret;
472
473 while (argc-- > 0) {
474 const char __user *str;
475 int len;
476 unsigned long pos;
477
478 ret = -EFAULT;
479 str = get_user_arg_ptr(argv, argc);
480 if (IS_ERR(str))
481 goto out;
482
483 len = strnlen_user(str, MAX_ARG_STRLEN);
484 if (!len)
485 goto out;
486
487 ret = -E2BIG;
488 if (!valid_arg_len(bprm, len))
489 goto out;
490
491
492 pos = bprm->p;
493 str += len;
494 bprm->p -= len;
495
496 while (len > 0) {
497 int offset, bytes_to_copy;
498
499 if (fatal_signal_pending(current)) {
500 ret = -ERESTARTNOHAND;
501 goto out;
502 }
503 cond_resched();
504
505 offset = pos % PAGE_SIZE;
506 if (offset == 0)
507 offset = PAGE_SIZE;
508
509 bytes_to_copy = offset;
510 if (bytes_to_copy > len)
511 bytes_to_copy = len;
512
513 offset -= bytes_to_copy;
514 pos -= bytes_to_copy;
515 str -= bytes_to_copy;
516 len -= bytes_to_copy;
517
518 if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
519 struct page *page;
520
521 page = get_arg_page(bprm, pos, 1);
522 if (!page) {
523 ret = -E2BIG;
524 goto out;
525 }
526
527 if (kmapped_page) {
528 flush_kernel_dcache_page(kmapped_page);
529 kunmap(kmapped_page);
530 put_arg_page(kmapped_page);
531 }
532 kmapped_page = page;
533 kaddr = kmap(kmapped_page);
534 kpos = pos & PAGE_MASK;
535 flush_arg_page(bprm, kpos, kmapped_page);
536 }
537 if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
538 ret = -EFAULT;
539 goto out;
540 }
541 }
542 }
543 ret = 0;
544out:
545 if (kmapped_page) {
546 flush_kernel_dcache_page(kmapped_page);
547 kunmap(kmapped_page);
548 put_arg_page(kmapped_page);
549 }
550 return ret;
551}
552
553
554
555
556int copy_strings_kernel(int argc, const char *const *__argv,
557 struct linux_binprm *bprm)
558{
559 int r;
560 mm_segment_t oldfs = get_fs();
561 struct user_arg_ptr argv = {
562 .ptr.native = (const char __user *const __user *)__argv,
563 };
564
565 set_fs(KERNEL_DS);
566 r = copy_strings(argc, argv, bprm);
567 set_fs(oldfs);
568
569 return r;
570}
571EXPORT_SYMBOL(copy_strings_kernel);
572
573#ifdef CONFIG_MMU
574
575
576
577
578
579
580
581
582
583
584
585
586
587static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
588{
589 struct mm_struct *mm = vma->vm_mm;
590 unsigned long old_start = vma->vm_start;
591 unsigned long old_end = vma->vm_end;
592 unsigned long length = old_end - old_start;
593 unsigned long new_start = old_start - shift;
594 unsigned long new_end = old_end - shift;
595 struct mmu_gather tlb;
596
597 BUG_ON(new_start > new_end);
598
599
600
601
602
603 if (vma != find_vma(mm, new_start))
604 return -EFAULT;
605
606
607
608
609 if (vma_adjust(vma, new_start, old_end, vma->vm_pgoff, NULL))
610 return -ENOMEM;
611
612
613
614
615
616 if (length != move_page_tables(vma, old_start,
617 vma, new_start, length))
618 return -ENOMEM;
619
620 lru_add_drain();
621 tlb_gather_mmu(&tlb, mm, 0);
622 if (new_end > old_start) {
623
624
625
626 free_pgd_range(&tlb, new_end, old_end, new_end,
627 vma->vm_next ? vma->vm_next->vm_start : 0);
628 } else {
629
630
631
632
633
634
635 free_pgd_range(&tlb, old_start, old_end, new_end,
636 vma->vm_next ? vma->vm_next->vm_start : 0);
637 }
638 tlb_finish_mmu(&tlb, new_end, old_end);
639
640
641
642
643 vma_adjust(vma, new_start, new_end, vma->vm_pgoff, NULL);
644
645 return 0;
646}
647
648
649
650
651
652int setup_arg_pages(struct linux_binprm *bprm,
653 unsigned long stack_top,
654 int executable_stack)
655{
656 unsigned long ret;
657 unsigned long stack_shift;
658 struct mm_struct *mm = current->mm;
659 struct vm_area_struct *vma = bprm->vma;
660 struct vm_area_struct *prev = NULL;
661 unsigned long vm_flags;
662 unsigned long stack_base;
663 unsigned long stack_size;
664 unsigned long stack_expand;
665 unsigned long rlim_stack;
666
667#ifdef CONFIG_STACK_GROWSUP
668
669 stack_base = rlimit_max(RLIMIT_STACK);
670 if (stack_base > (1 << 30))
671 stack_base = 1 << 30;
672
673
674 if (vma->vm_end - vma->vm_start > stack_base)
675 return -ENOMEM;
676
677 stack_base = PAGE_ALIGN(stack_top - stack_base);
678
679 stack_shift = vma->vm_start - stack_base;
680 mm->arg_start = bprm->p - stack_shift;
681 bprm->p = vma->vm_end - stack_shift;
682#else
683 stack_top = arch_align_stack(stack_top);
684 stack_top = PAGE_ALIGN(stack_top);
685
686 if (unlikely(stack_top < mmap_min_addr) ||
687 unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
688 return -ENOMEM;
689
690 stack_shift = vma->vm_end - stack_top;
691
692 bprm->p -= stack_shift;
693 mm->arg_start = bprm->p;
694#endif
695
696 if (bprm->loader)
697 bprm->loader -= stack_shift;
698 bprm->exec -= stack_shift;
699
700 down_write(&mm->mmap_sem);
701 vm_flags = VM_STACK_FLAGS;
702
703
704
705
706
707
708 if (unlikely(executable_stack == EXSTACK_ENABLE_X))
709 vm_flags |= VM_EXEC;
710 else if (executable_stack == EXSTACK_DISABLE_X)
711 vm_flags &= ~VM_EXEC;
712 vm_flags |= mm->def_flags;
713 vm_flags |= VM_STACK_INCOMPLETE_SETUP;
714
715 ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
716 vm_flags);
717 if (ret)
718 goto out_unlock;
719 BUG_ON(prev != vma);
720
721
722 if (stack_shift) {
723 ret = shift_arg_pages(vma, stack_shift);
724 if (ret)
725 goto out_unlock;
726 }
727
728
729 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
730
731 stack_expand = 131072UL;
732 stack_size = vma->vm_end - vma->vm_start;
733
734
735
736
737 rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
738#ifdef CONFIG_STACK_GROWSUP
739 if (stack_size + stack_expand > rlim_stack)
740 stack_base = vma->vm_start + rlim_stack;
741 else
742 stack_base = vma->vm_end + stack_expand;
743#else
744 if (stack_size + stack_expand > rlim_stack)
745 stack_base = vma->vm_end - rlim_stack;
746 else
747 stack_base = vma->vm_start - stack_expand;
748#endif
749 current->mm->start_stack = bprm->p;
750 ret = expand_stack(vma, stack_base);
751 if (ret)
752 ret = -EFAULT;
753
754out_unlock:
755 up_write(&mm->mmap_sem);
756 return ret;
757}
758EXPORT_SYMBOL(setup_arg_pages);
759
760#endif
761
762struct file *open_exec(const char *name)
763{
764 struct file *file;
765 int err;
766 static const struct open_flags open_exec_flags = {
767 .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
768 .acc_mode = MAY_EXEC | MAY_OPEN,
769 .intent = LOOKUP_OPEN
770 };
771
772 file = do_filp_open(AT_FDCWD, name, &open_exec_flags, LOOKUP_FOLLOW);
773 if (IS_ERR(file))
774 goto out;
775
776 err = -EACCES;
777 if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))
778 goto exit;
779
780 if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
781 goto exit;
782
783 fsnotify_open(file);
784
785 err = deny_write_access(file);
786 if (err)
787 goto exit;
788
789out:
790 return file;
791
792exit:
793 fput(file);
794 return ERR_PTR(err);
795}
796EXPORT_SYMBOL(open_exec);
797
798int kernel_read(struct file *file, loff_t offset,
799 char *addr, unsigned long count)
800{
801 mm_segment_t old_fs;
802 loff_t pos = offset;
803 int result;
804
805 old_fs = get_fs();
806 set_fs(get_ds());
807
808 result = vfs_read(file, (void __user *)addr, count, &pos);
809 set_fs(old_fs);
810 return result;
811}
812
813EXPORT_SYMBOL(kernel_read);
814
815static int exec_mmap(struct mm_struct *mm)
816{
817 struct task_struct *tsk;
818 struct mm_struct * old_mm, *active_mm;
819
820
821 tsk = current;
822 old_mm = current->mm;
823 sync_mm_rss(tsk, old_mm);
824 mm_release(tsk, old_mm);
825
826 if (old_mm) {
827
828
829
830
831
832
833 down_read(&old_mm->mmap_sem);
834 if (unlikely(old_mm->core_state)) {
835 up_read(&old_mm->mmap_sem);
836 return -EINTR;
837 }
838 }
839 task_lock(tsk);
840 active_mm = tsk->active_mm;
841 tsk->mm = mm;
842 tsk->active_mm = mm;
843 activate_mm(active_mm, mm);
844 task_unlock(tsk);
845 arch_pick_mmap_layout(mm);
846 if (old_mm) {
847 up_read(&old_mm->mmap_sem);
848 BUG_ON(active_mm != old_mm);
849 mm_update_next_owner(old_mm);
850 mmput(old_mm);
851 return 0;
852 }
853 mmdrop(active_mm);
854 return 0;
855}
856
857
858
859
860
861
862
863static int de_thread(struct task_struct *tsk)
864{
865 struct signal_struct *sig = tsk->signal;
866 struct sighand_struct *oldsighand = tsk->sighand;
867 spinlock_t *lock = &oldsighand->siglock;
868
869 if (thread_group_empty(tsk))
870 goto no_thread_group;
871
872
873
874
875 spin_lock_irq(lock);
876 if (signal_group_exit(sig)) {
877
878
879
880
881 spin_unlock_irq(lock);
882 return -EAGAIN;
883 }
884
885 sig->group_exit_task = tsk;
886 sig->notify_count = zap_other_threads(tsk);
887 if (!thread_group_leader(tsk))
888 sig->notify_count--;
889
890 while (sig->notify_count) {
891 __set_current_state(TASK_UNINTERRUPTIBLE);
892 spin_unlock_irq(lock);
893 schedule();
894 spin_lock_irq(lock);
895 }
896 spin_unlock_irq(lock);
897
898
899
900
901
902
903 if (!thread_group_leader(tsk)) {
904 struct task_struct *leader = tsk->group_leader;
905
906 sig->notify_count = -1;
907 for (;;) {
908 write_lock_irq(&tasklist_lock);
909 if (likely(leader->exit_state))
910 break;
911 __set_current_state(TASK_UNINTERRUPTIBLE);
912 write_unlock_irq(&tasklist_lock);
913 schedule();
914 }
915
916
917
918
919
920
921
922
923
924
925
926 tsk->start_time = leader->start_time;
927
928 BUG_ON(!same_thread_group(leader, tsk));
929 BUG_ON(has_group_leader_pid(tsk));
930
931
932
933
934
935
936
937
938
939
940
941
942 detach_pid(tsk, PIDTYPE_PID);
943 tsk->pid = leader->pid;
944 attach_pid(tsk, PIDTYPE_PID, task_pid(leader));
945 transfer_pid(leader, tsk, PIDTYPE_PGID);
946 transfer_pid(leader, tsk, PIDTYPE_SID);
947
948 list_replace_rcu(&leader->tasks, &tsk->tasks);
949 list_replace_init(&leader->sibling, &tsk->sibling);
950
951 tsk->group_leader = tsk;
952 leader->group_leader = tsk;
953
954 tsk->exit_signal = SIGCHLD;
955 leader->exit_signal = -1;
956
957 BUG_ON(leader->exit_state != EXIT_ZOMBIE);
958 leader->exit_state = EXIT_DEAD;
959
960
961
962
963
964
965 if (unlikely(leader->ptrace))
966 __wake_up_parent(leader, leader->parent);
967 write_unlock_irq(&tasklist_lock);
968
969 release_task(leader);
970 }
971
972 sig->group_exit_task = NULL;
973 sig->notify_count = 0;
974
975no_thread_group:
976 if (current->mm)
977 setmax_mm_hiwater_rss(&sig->maxrss, current->mm);
978
979 exit_itimers(sig);
980 flush_itimer_signals();
981
982 if (atomic_read(&oldsighand->count) != 1) {
983 struct sighand_struct *newsighand;
984
985
986
987
988 newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
989 if (!newsighand)
990 return -ENOMEM;
991
992 atomic_set(&newsighand->count, 1);
993 memcpy(newsighand->action, oldsighand->action,
994 sizeof(newsighand->action));
995
996 write_lock_irq(&tasklist_lock);
997 spin_lock(&oldsighand->siglock);
998 rcu_assign_pointer(tsk->sighand, newsighand);
999 spin_unlock(&oldsighand->siglock);
1000 write_unlock_irq(&tasklist_lock);
1001
1002 __cleanup_sighand(oldsighand);
1003 }
1004
1005 BUG_ON(!thread_group_leader(tsk));
1006 return 0;
1007}
1008
1009
1010
1011
1012
1013static void flush_old_files(struct files_struct * files)
1014{
1015 long j = -1;
1016 struct fdtable *fdt;
1017
1018 spin_lock(&files->file_lock);
1019 for (;;) {
1020 unsigned long set, i;
1021
1022 j++;
1023 i = j * __NFDBITS;
1024 fdt = files_fdtable(files);
1025 if (i >= fdt->max_fds)
1026 break;
1027 set = fdt->close_on_exec->fds_bits[j];
1028 if (!set)
1029 continue;
1030 fdt->close_on_exec->fds_bits[j] = 0;
1031 spin_unlock(&files->file_lock);
1032 for ( ; set ; i++,set >>= 1) {
1033 if (set & 1) {
1034 sys_close(i);
1035 }
1036 }
1037 spin_lock(&files->file_lock);
1038
1039 }
1040 spin_unlock(&files->file_lock);
1041}
1042
1043char *get_task_comm(char *buf, struct task_struct *tsk)
1044{
1045
1046 task_lock(tsk);
1047 strncpy(buf, tsk->comm, sizeof(tsk->comm));
1048 task_unlock(tsk);
1049 return buf;
1050}
1051EXPORT_SYMBOL_GPL(get_task_comm);
1052
1053void set_task_comm(struct task_struct *tsk, char *buf)
1054{
1055 task_lock(tsk);
1056
1057
1058
1059
1060
1061
1062
1063 memset(tsk->comm, 0, TASK_COMM_LEN);
1064 wmb();
1065 strlcpy(tsk->comm, buf, sizeof(tsk->comm));
1066 task_unlock(tsk);
1067 perf_event_comm(tsk);
1068}
1069
1070int flush_old_exec(struct linux_binprm * bprm)
1071{
1072 int retval;
1073
1074
1075
1076
1077
1078 retval = de_thread(current);
1079 if (retval)
1080 goto out;
1081
1082 set_mm_exe_file(bprm->mm, bprm->file);
1083
1084
1085
1086
1087 acct_arg_size(bprm, 0);
1088 retval = exec_mmap(bprm->mm);
1089 if (retval)
1090 goto out;
1091
1092 bprm->mm = NULL;
1093
1094 set_fs(USER_DS);
1095 current->flags &= ~(PF_RANDOMIZE | PF_KTHREAD);
1096 flush_thread();
1097 current->personality &= ~bprm->per_clear;
1098
1099 return 0;
1100
1101out:
1102 return retval;
1103}
1104EXPORT_SYMBOL(flush_old_exec);
1105
1106void would_dump(struct linux_binprm *bprm, struct file *file)
1107{
1108 if (inode_permission(file->f_path.dentry->d_inode, MAY_READ) < 0)
1109 bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
1110}
1111EXPORT_SYMBOL(would_dump);
1112
1113void setup_new_exec(struct linux_binprm * bprm)
1114{
1115 int i, ch;
1116 const char *name;
1117 char tcomm[sizeof(current->comm)];
1118
1119 arch_pick_mmap_layout(current->mm);
1120
1121
1122 current->sas_ss_sp = current->sas_ss_size = 0;
1123
1124 if (current_euid() == current_uid() && current_egid() == current_gid())
1125 set_dumpable(current->mm, 1);
1126 else
1127 set_dumpable(current->mm, suid_dumpable);
1128
1129 name = bprm->filename;
1130
1131
1132 for (i=0; (ch = *(name++)) != '\0';) {
1133 if (ch == '/')
1134 i = 0;
1135 else
1136 if (i < (sizeof(tcomm) - 1))
1137 tcomm[i++] = ch;
1138 }
1139 tcomm[i] = '\0';
1140 set_task_comm(current, tcomm);
1141
1142
1143
1144
1145
1146 current->mm->task_size = TASK_SIZE;
1147
1148
1149 if (bprm->cred->uid != current_euid() ||
1150 bprm->cred->gid != current_egid()) {
1151 current->pdeath_signal = 0;
1152 } else {
1153 would_dump(bprm, bprm->file);
1154 if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)
1155 set_dumpable(current->mm, suid_dumpable);
1156 }
1157
1158
1159
1160
1161
1162 if (!get_dumpable(current->mm))
1163 perf_event_exit_task(current);
1164
1165
1166
1167
1168 current->self_exec_id++;
1169
1170 flush_signal_handlers(current, 0);
1171 flush_old_files(current->files);
1172}
1173EXPORT_SYMBOL(setup_new_exec);
1174
1175
1176
1177
1178
1179
1180
1181int prepare_bprm_creds(struct linux_binprm *bprm)
1182{
1183 if (mutex_lock_interruptible(¤t->signal->cred_guard_mutex))
1184 return -ERESTARTNOINTR;
1185
1186 bprm->cred = prepare_exec_creds();
1187 if (likely(bprm->cred))
1188 return 0;
1189
1190 mutex_unlock(¤t->signal->cred_guard_mutex);
1191 return -ENOMEM;
1192}
1193
1194void free_bprm(struct linux_binprm *bprm)
1195{
1196 free_arg_pages(bprm);
1197 if (bprm->cred) {
1198 mutex_unlock(¤t->signal->cred_guard_mutex);
1199 abort_creds(bprm->cred);
1200 }
1201 kfree(bprm);
1202}
1203
1204
1205
1206
1207void install_exec_creds(struct linux_binprm *bprm)
1208{
1209 security_bprm_committing_creds(bprm);
1210
1211 commit_creds(bprm->cred);
1212 bprm->cred = NULL;
1213
1214
1215
1216
1217
1218 security_bprm_committed_creds(bprm);
1219 mutex_unlock(¤t->signal->cred_guard_mutex);
1220}
1221EXPORT_SYMBOL(install_exec_creds);
1222
1223
1224
1225
1226
1227
1228int check_unsafe_exec(struct linux_binprm *bprm)
1229{
1230 struct task_struct *p = current, *t;
1231 unsigned n_fs;
1232 int res = 0;
1233
1234 if (p->ptrace) {
1235 if (p->ptrace & PT_PTRACE_CAP)
1236 bprm->unsafe |= LSM_UNSAFE_PTRACE_CAP;
1237 else
1238 bprm->unsafe |= LSM_UNSAFE_PTRACE;
1239 }
1240
1241 n_fs = 1;
1242 spin_lock(&p->fs->lock);
1243 rcu_read_lock();
1244 for (t = next_thread(p); t != p; t = next_thread(t)) {
1245 if (t->fs == p->fs)
1246 n_fs++;
1247 }
1248 rcu_read_unlock();
1249
1250 if (p->fs->users > n_fs) {
1251 bprm->unsafe |= LSM_UNSAFE_SHARE;
1252 } else {
1253 res = -EAGAIN;
1254 if (!p->fs->in_exec) {
1255 p->fs->in_exec = 1;
1256 res = 1;
1257 }
1258 }
1259 spin_unlock(&p->fs->lock);
1260
1261 return res;
1262}
1263
1264
1265
1266
1267
1268
1269
1270int prepare_binprm(struct linux_binprm *bprm)
1271{
1272 umode_t mode;
1273 struct inode * inode = bprm->file->f_path.dentry->d_inode;
1274 int retval;
1275
1276 mode = inode->i_mode;
1277 if (bprm->file->f_op == NULL)
1278 return -EACCES;
1279
1280
1281 bprm->cred->euid = current_euid();
1282 bprm->cred->egid = current_egid();
1283
1284 if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
1285
1286 if (mode & S_ISUID) {
1287 bprm->per_clear |= PER_CLEAR_ON_SETID;
1288 bprm->cred->euid = inode->i_uid;
1289 }
1290
1291
1292
1293
1294
1295
1296
1297 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
1298 bprm->per_clear |= PER_CLEAR_ON_SETID;
1299 bprm->cred->egid = inode->i_gid;
1300 }
1301 }
1302
1303
1304 retval = security_bprm_set_creds(bprm);
1305 if (retval)
1306 return retval;
1307 bprm->cred_prepared = 1;
1308
1309 memset(bprm->buf, 0, BINPRM_BUF_SIZE);
1310 return kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE);
1311}
1312
1313EXPORT_SYMBOL(prepare_binprm);
1314
1315
1316
1317
1318
1319
1320int remove_arg_zero(struct linux_binprm *bprm)
1321{
1322 int ret = 0;
1323 unsigned long offset;
1324 char *kaddr;
1325 struct page *page;
1326
1327 if (!bprm->argc)
1328 return 0;
1329
1330 do {
1331 offset = bprm->p & ~PAGE_MASK;
1332 page = get_arg_page(bprm, bprm->p, 0);
1333 if (!page) {
1334 ret = -EFAULT;
1335 goto out;
1336 }
1337 kaddr = kmap_atomic(page, KM_USER0);
1338
1339 for (; offset < PAGE_SIZE && kaddr[offset];
1340 offset++, bprm->p++)
1341 ;
1342
1343 kunmap_atomic(kaddr, KM_USER0);
1344 put_arg_page(page);
1345
1346 if (offset == PAGE_SIZE)
1347 free_arg_page(bprm, (bprm->p >> PAGE_SHIFT) - 1);
1348 } while (offset == PAGE_SIZE);
1349
1350 bprm->p++;
1351 bprm->argc--;
1352 ret = 0;
1353
1354out:
1355 return ret;
1356}
1357EXPORT_SYMBOL(remove_arg_zero);
1358
1359
1360
1361
1362int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
1363{
1364 unsigned int depth = bprm->recursion_depth;
1365 int try,retval;
1366 struct linux_binfmt *fmt;
1367 pid_t old_pid;
1368
1369 retval = security_bprm_check(bprm);
1370 if (retval)
1371 return retval;
1372
1373 retval = audit_bprm(bprm);
1374 if (retval)
1375 return retval;
1376
1377
1378 rcu_read_lock();
1379 old_pid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
1380 rcu_read_unlock();
1381
1382 retval = -ENOENT;
1383 for (try=0; try<2; try++) {
1384 read_lock(&binfmt_lock);
1385 list_for_each_entry(fmt, &formats, lh) {
1386 int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
1387 if (!fn)
1388 continue;
1389 if (!try_module_get(fmt->module))
1390 continue;
1391 read_unlock(&binfmt_lock);
1392 retval = fn(bprm, regs);
1393
1394
1395
1396
1397
1398 bprm->recursion_depth = depth;
1399 if (retval >= 0) {
1400 if (depth == 0)
1401 ptrace_event(PTRACE_EVENT_EXEC,
1402 old_pid);
1403 put_binfmt(fmt);
1404 allow_write_access(bprm->file);
1405 if (bprm->file)
1406 fput(bprm->file);
1407 bprm->file = NULL;
1408 current->did_exec = 1;
1409 proc_exec_connector(current);
1410 return retval;
1411 }
1412 read_lock(&binfmt_lock);
1413 put_binfmt(fmt);
1414 if (retval != -ENOEXEC || bprm->mm == NULL)
1415 break;
1416 if (!bprm->file) {
1417 read_unlock(&binfmt_lock);
1418 return retval;
1419 }
1420 }
1421 read_unlock(&binfmt_lock);
1422#ifdef CONFIG_MODULES
1423 if (retval != -ENOEXEC || bprm->mm == NULL) {
1424 break;
1425 } else {
1426#define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
1427 if (printable(bprm->buf[0]) &&
1428 printable(bprm->buf[1]) &&
1429 printable(bprm->buf[2]) &&
1430 printable(bprm->buf[3]))
1431 break;
1432 if (try)
1433 break;
1434 request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
1435 }
1436#else
1437 break;
1438#endif
1439 }
1440 return retval;
1441}
1442
1443EXPORT_SYMBOL(search_binary_handler);
1444
1445
1446
1447
1448static int do_execve_common(const char *filename,
1449 struct user_arg_ptr argv,
1450 struct user_arg_ptr envp,
1451 struct pt_regs *regs)
1452{
1453 struct linux_binprm *bprm;
1454 struct file *file;
1455 struct files_struct *displaced;
1456 bool clear_in_exec;
1457 int retval;
1458 const struct cred *cred = current_cred();
1459
1460
1461
1462
1463
1464
1465
1466 if ((current->flags & PF_NPROC_EXCEEDED) &&
1467 atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) {
1468 retval = -EAGAIN;
1469 goto out_ret;
1470 }
1471
1472
1473
1474 current->flags &= ~PF_NPROC_EXCEEDED;
1475
1476 retval = unshare_files(&displaced);
1477 if (retval)
1478 goto out_ret;
1479
1480 retval = -ENOMEM;
1481 bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
1482 if (!bprm)
1483 goto out_files;
1484
1485 retval = prepare_bprm_creds(bprm);
1486 if (retval)
1487 goto out_free;
1488
1489 retval = check_unsafe_exec(bprm);
1490 if (retval < 0)
1491 goto out_free;
1492 clear_in_exec = retval;
1493 current->in_execve = 1;
1494
1495 file = open_exec(filename);
1496 retval = PTR_ERR(file);
1497 if (IS_ERR(file))
1498 goto out_unmark;
1499
1500 sched_exec();
1501
1502 bprm->file = file;
1503 bprm->filename = filename;
1504 bprm->interp = filename;
1505
1506 retval = bprm_mm_init(bprm);
1507 if (retval)
1508 goto out_file;
1509
1510 bprm->argc = count(argv, MAX_ARG_STRINGS);
1511 if ((retval = bprm->argc) < 0)
1512 goto out;
1513
1514 bprm->envc = count(envp, MAX_ARG_STRINGS);
1515 if ((retval = bprm->envc) < 0)
1516 goto out;
1517
1518 retval = prepare_binprm(bprm);
1519 if (retval < 0)
1520 goto out;
1521
1522 retval = copy_strings_kernel(1, &bprm->filename, bprm);
1523 if (retval < 0)
1524 goto out;
1525
1526 bprm->exec = bprm->p;
1527 retval = copy_strings(bprm->envc, envp, bprm);
1528 if (retval < 0)
1529 goto out;
1530
1531 retval = copy_strings(bprm->argc, argv, bprm);
1532 if (retval < 0)
1533 goto out;
1534
1535 retval = search_binary_handler(bprm,regs);
1536 if (retval < 0)
1537 goto out;
1538
1539
1540 current->fs->in_exec = 0;
1541 current->in_execve = 0;
1542 acct_update_integrals(current);
1543 free_bprm(bprm);
1544 if (displaced)
1545 put_files_struct(displaced);
1546 return retval;
1547
1548out:
1549 if (bprm->mm) {
1550 acct_arg_size(bprm, 0);
1551 mmput(bprm->mm);
1552 }
1553
1554out_file:
1555 if (bprm->file) {
1556 allow_write_access(bprm->file);
1557 fput(bprm->file);
1558 }
1559
1560out_unmark:
1561 if (clear_in_exec)
1562 current->fs->in_exec = 0;
1563 current->in_execve = 0;
1564
1565out_free:
1566 free_bprm(bprm);
1567
1568out_files:
1569 if (displaced)
1570 reset_files_struct(displaced);
1571out_ret:
1572 return retval;
1573}
1574
1575int do_execve(const char *filename,
1576 const char __user *const __user *__argv,
1577 const char __user *const __user *__envp,
1578 struct pt_regs *regs)
1579{
1580 struct user_arg_ptr argv = { .ptr.native = __argv };
1581 struct user_arg_ptr envp = { .ptr.native = __envp };
1582 return do_execve_common(filename, argv, envp, regs);
1583}
1584
1585#ifdef CONFIG_COMPAT
1586int compat_do_execve(char *filename,
1587 compat_uptr_t __user *__argv,
1588 compat_uptr_t __user *__envp,
1589 struct pt_regs *regs)
1590{
1591 struct user_arg_ptr argv = {
1592 .is_compat = true,
1593 .ptr.compat = __argv,
1594 };
1595 struct user_arg_ptr envp = {
1596 .is_compat = true,
1597 .ptr.compat = __envp,
1598 };
1599 return do_execve_common(filename, argv, envp, regs);
1600}
1601#endif
1602
1603void set_binfmt(struct linux_binfmt *new)
1604{
1605 struct mm_struct *mm = current->mm;
1606
1607 if (mm->binfmt)
1608 module_put(mm->binfmt->module);
1609
1610 mm->binfmt = new;
1611 if (new)
1612 __module_get(new->module);
1613}
1614
1615EXPORT_SYMBOL(set_binfmt);
1616
1617static int expand_corename(struct core_name *cn)
1618{
1619 char *old_corename = cn->corename;
1620
1621 cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
1622 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
1623
1624 if (!cn->corename) {
1625 kfree(old_corename);
1626 return -ENOMEM;
1627 }
1628
1629 return 0;
1630}
1631
1632static int cn_printf(struct core_name *cn, const char *fmt, ...)
1633{
1634 char *cur;
1635 int need;
1636 int ret;
1637 va_list arg;
1638
1639 va_start(arg, fmt);
1640 need = vsnprintf(NULL, 0, fmt, arg);
1641 va_end(arg);
1642
1643 if (likely(need < cn->size - cn->used - 1))
1644 goto out_printf;
1645
1646 ret = expand_corename(cn);
1647 if (ret)
1648 goto expand_fail;
1649
1650out_printf:
1651 cur = cn->corename + cn->used;
1652 va_start(arg, fmt);
1653 vsnprintf(cur, need + 1, fmt, arg);
1654 va_end(arg);
1655 cn->used += need;
1656 return 0;
1657
1658expand_fail:
1659 return ret;
1660}
1661
1662static void cn_escape(char *str)
1663{
1664 for (; *str; str++)
1665 if (*str == '/')
1666 *str = '!';
1667}
1668
1669static int cn_print_exe_file(struct core_name *cn)
1670{
1671 struct file *exe_file;
1672 char *pathbuf, *path;
1673 int ret;
1674
1675 exe_file = get_mm_exe_file(current->mm);
1676 if (!exe_file) {
1677 char *commstart = cn->corename + cn->used;
1678 ret = cn_printf(cn, "%s (path unknown)", current->comm);
1679 cn_escape(commstart);
1680 return ret;
1681 }
1682
1683 pathbuf = kmalloc(PATH_MAX, GFP_TEMPORARY);
1684 if (!pathbuf) {
1685 ret = -ENOMEM;
1686 goto put_exe_file;
1687 }
1688
1689 path = d_path(&exe_file->f_path, pathbuf, PATH_MAX);
1690 if (IS_ERR(path)) {
1691 ret = PTR_ERR(path);
1692 goto free_buf;
1693 }
1694
1695 cn_escape(path);
1696
1697 ret = cn_printf(cn, "%s", path);
1698
1699free_buf:
1700 kfree(pathbuf);
1701put_exe_file:
1702 fput(exe_file);
1703 return ret;
1704}
1705
1706
1707
1708
1709
1710static int format_corename(struct core_name *cn, long signr)
1711{
1712 const struct cred *cred = current_cred();
1713 const char *pat_ptr = core_pattern;
1714 int ispipe = (*pat_ptr == '|');
1715 int pid_in_pattern = 0;
1716 int err = 0;
1717
1718 cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
1719 cn->corename = kmalloc(cn->size, GFP_KERNEL);
1720 cn->used = 0;
1721
1722 if (!cn->corename)
1723 return -ENOMEM;
1724
1725
1726
1727 while (*pat_ptr) {
1728 if (*pat_ptr != '%') {
1729 if (*pat_ptr == 0)
1730 goto out;
1731 err = cn_printf(cn, "%c", *pat_ptr++);
1732 } else {
1733 switch (*++pat_ptr) {
1734
1735 case 0:
1736 goto out;
1737
1738 case '%':
1739 err = cn_printf(cn, "%c", '%');
1740 break;
1741
1742 case 'p':
1743 pid_in_pattern = 1;
1744 err = cn_printf(cn, "%d",
1745 task_tgid_vnr(current));
1746 break;
1747
1748 case 'u':
1749 err = cn_printf(cn, "%d", cred->uid);
1750 break;
1751
1752 case 'g':
1753 err = cn_printf(cn, "%d", cred->gid);
1754 break;
1755
1756 case 's':
1757 err = cn_printf(cn, "%ld", signr);
1758 break;
1759
1760 case 't': {
1761 struct timeval tv;
1762 do_gettimeofday(&tv);
1763 err = cn_printf(cn, "%lu", tv.tv_sec);
1764 break;
1765 }
1766
1767 case 'h': {
1768 char *namestart = cn->corename + cn->used;
1769 down_read(&uts_sem);
1770 err = cn_printf(cn, "%s",
1771 utsname()->nodename);
1772 up_read(&uts_sem);
1773 cn_escape(namestart);
1774 break;
1775 }
1776
1777 case 'e': {
1778 char *commstart = cn->corename + cn->used;
1779 err = cn_printf(cn, "%s", current->comm);
1780 cn_escape(commstart);
1781 break;
1782 }
1783 case 'E':
1784 err = cn_print_exe_file(cn);
1785 break;
1786
1787 case 'c':
1788 err = cn_printf(cn, "%lu",
1789 rlimit(RLIMIT_CORE));
1790 break;
1791 default:
1792 break;
1793 }
1794 ++pat_ptr;
1795 }
1796
1797 if (err)
1798 return err;
1799 }
1800
1801
1802
1803
1804
1805
1806 if (!ispipe && !pid_in_pattern && core_uses_pid) {
1807 err = cn_printf(cn, ".%d", task_tgid_vnr(current));
1808 if (err)
1809 return err;
1810 }
1811out:
1812 return ispipe;
1813}
1814
1815static int zap_process(struct task_struct *start, int exit_code)
1816{
1817 struct task_struct *t;
1818 int nr = 0;
1819
1820 start->signal->flags = SIGNAL_GROUP_EXIT;
1821 start->signal->group_exit_code = exit_code;
1822 start->signal->group_stop_count = 0;
1823
1824 t = start;
1825 do {
1826 task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK);
1827 if (t != current && t->mm) {
1828 sigaddset(&t->pending.signal, SIGKILL);
1829 signal_wake_up(t, 1);
1830 nr++;
1831 }
1832 } while_each_thread(start, t);
1833
1834 return nr;
1835}
1836
1837static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
1838 struct core_state *core_state, int exit_code)
1839{
1840 struct task_struct *g, *p;
1841 unsigned long flags;
1842 int nr = -EAGAIN;
1843
1844 spin_lock_irq(&tsk->sighand->siglock);
1845 if (!signal_group_exit(tsk->signal)) {
1846 mm->core_state = core_state;
1847 nr = zap_process(tsk, exit_code);
1848 }
1849 spin_unlock_irq(&tsk->sighand->siglock);
1850 if (unlikely(nr < 0))
1851 return nr;
1852
1853 if (atomic_read(&mm->mm_users) == nr + 1)
1854 goto done;
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885 rcu_read_lock();
1886 for_each_process(g) {
1887 if (g == tsk->group_leader)
1888 continue;
1889 if (g->flags & PF_KTHREAD)
1890 continue;
1891 p = g;
1892 do {
1893 if (p->mm) {
1894 if (unlikely(p->mm == mm)) {
1895 lock_task_sighand(p, &flags);
1896 nr += zap_process(p, exit_code);
1897 unlock_task_sighand(p, &flags);
1898 }
1899 break;
1900 }
1901 } while_each_thread(g, p);
1902 }
1903 rcu_read_unlock();
1904done:
1905 atomic_set(&core_state->nr_threads, nr);
1906 return nr;
1907}
1908
1909static int coredump_wait(int exit_code, struct core_state *core_state)
1910{
1911 struct task_struct *tsk = current;
1912 struct mm_struct *mm = tsk->mm;
1913 struct completion *vfork_done;
1914 int core_waiters = -EBUSY;
1915
1916 init_completion(&core_state->startup);
1917 core_state->dumper.task = tsk;
1918 core_state->dumper.next = NULL;
1919
1920 down_write(&mm->mmap_sem);
1921 if (!mm->core_state)
1922 core_waiters = zap_threads(tsk, mm, core_state, exit_code);
1923 up_write(&mm->mmap_sem);
1924
1925 if (unlikely(core_waiters < 0))
1926 goto fail;
1927
1928
1929
1930
1931
1932 vfork_done = tsk->vfork_done;
1933 if (vfork_done) {
1934 tsk->vfork_done = NULL;
1935 complete(vfork_done);
1936 }
1937
1938 if (core_waiters)
1939 wait_for_completion(&core_state->startup);
1940fail:
1941 return core_waiters;
1942}
1943
1944static void coredump_finish(struct mm_struct *mm)
1945{
1946 struct core_thread *curr, *next;
1947 struct task_struct *task;
1948
1949 next = mm->core_state->dumper.next;
1950 while ((curr = next) != NULL) {
1951 next = curr->next;
1952 task = curr->task;
1953
1954
1955
1956
1957 smp_mb();
1958 curr->task = NULL;
1959 wake_up_process(task);
1960 }
1961
1962 mm->core_state = NULL;
1963}
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985void set_dumpable(struct mm_struct *mm, int value)
1986{
1987 switch (value) {
1988 case 0:
1989 clear_bit(MMF_DUMPABLE, &mm->flags);
1990 smp_wmb();
1991 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
1992 break;
1993 case 1:
1994 set_bit(MMF_DUMPABLE, &mm->flags);
1995 smp_wmb();
1996 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
1997 break;
1998 case 2:
1999 set_bit(MMF_DUMP_SECURELY, &mm->flags);
2000 smp_wmb();
2001 set_bit(MMF_DUMPABLE, &mm->flags);
2002 break;
2003 }
2004}
2005
2006static int __get_dumpable(unsigned long mm_flags)
2007{
2008 int ret;
2009
2010 ret = mm_flags & MMF_DUMPABLE_MASK;
2011 return (ret >= 2) ? 2 : ret;
2012}
2013
2014int get_dumpable(struct mm_struct *mm)
2015{
2016 return __get_dumpable(mm->flags);
2017}
2018
2019static void wait_for_dump_helpers(struct file *file)
2020{
2021 struct pipe_inode_info *pipe;
2022
2023 pipe = file->f_path.dentry->d_inode->i_pipe;
2024
2025 pipe_lock(pipe);
2026 pipe->readers++;
2027 pipe->writers--;
2028
2029 while ((pipe->readers > 1) && (!signal_pending(current))) {
2030 wake_up_interruptible_sync(&pipe->wait);
2031 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
2032 pipe_wait(pipe);
2033 }
2034
2035 pipe->readers--;
2036 pipe->writers++;
2037 pipe_unlock(pipe);
2038
2039}
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
2054{
2055 struct file *rp, *wp;
2056 struct fdtable *fdt;
2057 struct coredump_params *cp = (struct coredump_params *)info->data;
2058 struct files_struct *cf = current->files;
2059
2060 wp = create_write_pipe(0);
2061 if (IS_ERR(wp))
2062 return PTR_ERR(wp);
2063
2064 rp = create_read_pipe(wp, 0);
2065 if (IS_ERR(rp)) {
2066 free_write_pipe(wp);
2067 return PTR_ERR(rp);
2068 }
2069
2070 cp->file = wp;
2071
2072 sys_close(0);
2073 fd_install(0, rp);
2074 spin_lock(&cf->file_lock);
2075 fdt = files_fdtable(cf);
2076 FD_SET(0, fdt->open_fds);
2077 FD_CLR(0, fdt->close_on_exec);
2078 spin_unlock(&cf->file_lock);
2079
2080
2081 current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};
2082
2083 return 0;
2084}
2085
2086void do_coredump(long signr, int exit_code, struct pt_regs *regs)
2087{
2088 struct core_state core_state;
2089 struct core_name cn;
2090 struct mm_struct *mm = current->mm;
2091 struct linux_binfmt * binfmt;
2092 const struct cred *old_cred;
2093 struct cred *cred;
2094 int retval = 0;
2095 int flag = 0;
2096 int ispipe;
2097 static atomic_t core_dump_count = ATOMIC_INIT(0);
2098 struct coredump_params cprm = {
2099 .signr = signr,
2100 .regs = regs,
2101 .limit = rlimit(RLIMIT_CORE),
2102
2103
2104
2105
2106
2107 .mm_flags = mm->flags,
2108 };
2109
2110 audit_core_dumps(signr);
2111
2112 binfmt = mm->binfmt;
2113 if (!binfmt || !binfmt->core_dump)
2114 goto fail;
2115 if (!__get_dumpable(cprm.mm_flags))
2116 goto fail;
2117
2118 cred = prepare_creds();
2119 if (!cred)
2120 goto fail;
2121
2122
2123
2124
2125
2126 if (__get_dumpable(cprm.mm_flags) == 2) {
2127
2128 flag = O_EXCL;
2129 cred->fsuid = 0;
2130 }
2131
2132 retval = coredump_wait(exit_code, &core_state);
2133 if (retval < 0)
2134 goto fail_creds;
2135
2136 old_cred = override_creds(cred);
2137
2138
2139
2140
2141
2142 clear_thread_flag(TIF_SIGPENDING);
2143
2144 ispipe = format_corename(&cn, signr);
2145
2146 if (ispipe) {
2147 int dump_count;
2148 char **helper_argv;
2149
2150 if (ispipe < 0) {
2151 printk(KERN_WARNING "format_corename failed\n");
2152 printk(KERN_WARNING "Aborting core\n");
2153 goto fail_corename;
2154 }
2155
2156 if (cprm.limit == 1) {
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171 printk(KERN_WARNING
2172 "Process %d(%s) has RLIMIT_CORE set to 1\n",
2173 task_tgid_vnr(current), current->comm);
2174 printk(KERN_WARNING "Aborting core\n");
2175 goto fail_unlock;
2176 }
2177 cprm.limit = RLIM_INFINITY;
2178
2179 dump_count = atomic_inc_return(&core_dump_count);
2180 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
2181 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
2182 task_tgid_vnr(current), current->comm);
2183 printk(KERN_WARNING "Skipping core dump\n");
2184 goto fail_dropcount;
2185 }
2186
2187 helper_argv = argv_split(GFP_KERNEL, cn.corename+1, NULL);
2188 if (!helper_argv) {
2189 printk(KERN_WARNING "%s failed to allocate memory\n",
2190 __func__);
2191 goto fail_dropcount;
2192 }
2193
2194 retval = call_usermodehelper_fns(helper_argv[0], helper_argv,
2195 NULL, UMH_WAIT_EXEC, umh_pipe_setup,
2196 NULL, &cprm);
2197 argv_free(helper_argv);
2198 if (retval) {
2199 printk(KERN_INFO "Core dump to %s pipe failed\n",
2200 cn.corename);
2201 goto close_fail;
2202 }
2203 } else {
2204 struct inode *inode;
2205
2206 if (cprm.limit < binfmt->min_coredump)
2207 goto fail_unlock;
2208
2209 cprm.file = filp_open(cn.corename,
2210 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
2211 0600);
2212 if (IS_ERR(cprm.file))
2213 goto fail_unlock;
2214
2215 inode = cprm.file->f_path.dentry->d_inode;
2216 if (inode->i_nlink > 1)
2217 goto close_fail;
2218 if (d_unhashed(cprm.file->f_path.dentry))
2219 goto close_fail;
2220
2221
2222
2223
2224 if (!S_ISREG(inode->i_mode))
2225 goto close_fail;
2226
2227
2228
2229
2230 if (inode->i_uid != current_fsuid())
2231 goto close_fail;
2232 if (!cprm.file->f_op || !cprm.file->f_op->write)
2233 goto close_fail;
2234 if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file))
2235 goto close_fail;
2236 }
2237
2238 retval = binfmt->core_dump(&cprm);
2239 if (retval)
2240 current->signal->group_exit_code |= 0x80;
2241
2242 if (ispipe && core_pipe_limit)
2243 wait_for_dump_helpers(cprm.file);
2244close_fail:
2245 if (cprm.file)
2246 filp_close(cprm.file, NULL);
2247fail_dropcount:
2248 if (ispipe)
2249 atomic_dec(&core_dump_count);
2250fail_unlock:
2251 kfree(cn.corename);
2252fail_corename:
2253 coredump_finish(mm);
2254 revert_creds(old_cred);
2255fail_creds:
2256 put_cred(cred);
2257fail:
2258 return;
2259}
2260
2261
2262
2263
2264
2265
2266int dump_write(struct file *file, const void *addr, int nr)
2267{
2268 return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
2269}
2270EXPORT_SYMBOL(dump_write);
2271
2272int dump_seek(struct file *file, loff_t off)
2273{
2274 int ret = 1;
2275
2276 if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
2277 if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
2278 return 0;
2279 } else {
2280 char *buf = (char *)get_zeroed_page(GFP_KERNEL);
2281
2282 if (!buf)
2283 return 0;
2284 while (off > 0) {
2285 unsigned long n = off;
2286
2287 if (n > PAGE_SIZE)
2288 n = PAGE_SIZE;
2289 if (!dump_write(file, buf, n)) {
2290 ret = 0;
2291 break;
2292 }
2293 off -= n;
2294 }
2295 free_page((unsigned long)buf);
2296 }
2297 return ret;
2298}
2299EXPORT_SYMBOL(dump_seek);
2300