coredump.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854
  1. #include <linux/slab.h>
  2. #include <linux/file.h>
  3. #include <linux/fdtable.h>
  4. #include <linux/freezer.h>
  5. #include <linux/mm.h>
  6. #include <linux/stat.h>
  7. #include <linux/fcntl.h>
  8. #include <linux/swap.h>
  9. #include <linux/string.h>
  10. #include <linux/init.h>
  11. #include <linux/pagemap.h>
  12. #include <linux/perf_event.h>
  13. #include <linux/highmem.h>
  14. #include <linux/spinlock.h>
  15. #include <linux/key.h>
  16. #include <linux/personality.h>
  17. #include <linux/binfmts.h>
  18. #include <linux/coredump.h>
  19. #include <linux/utsname.h>
  20. #include <linux/pid_namespace.h>
  21. #include <linux/module.h>
  22. #include <linux/namei.h>
  23. #include <linux/mount.h>
  24. #include <linux/security.h>
  25. #include <linux/syscalls.h>
  26. #include <linux/tsacct_kern.h>
  27. #include <linux/cn_proc.h>
  28. #include <linux/audit.h>
  29. #include <linux/tracehook.h>
  30. #include <linux/kmod.h>
  31. #include <linux/fsnotify.h>
  32. #include <linux/fs_struct.h>
  33. #include <linux/pipe_fs_i.h>
  34. #include <linux/oom.h>
  35. #include <linux/compat.h>
  36. #include <linux/sched.h>
  37. #include <linux/fs.h>
  38. #include <linux/path.h>
  39. #include <linux/timekeeping.h>
  40. #include <asm/uaccess.h>
  41. #include <asm/mmu_context.h>
  42. #include <asm/tlb.h>
  43. #include <asm/exec.h>
  44. #include <trace/events/task.h>
  45. #include "internal.h"
  46. #include <trace/events/sched.h>
  47. int core_uses_pid;
  48. unsigned int core_pipe_limit;
  49. char core_pattern[CORENAME_MAX_SIZE] = "core";
  50. static int core_name_size = CORENAME_MAX_SIZE;
  51. struct core_name {
  52. char *corename;
  53. int used, size;
  54. };
  55. /* The maximal length of core_pattern is also specified in sysctl.c */
  56. static int expand_corename(struct core_name *cn, int size)
  57. {
  58. char *corename = krealloc(cn->corename, size, GFP_KERNEL);
  59. if (!corename)
  60. return -ENOMEM;
  61. if (size > core_name_size) /* racy but harmless */
  62. core_name_size = size;
  63. cn->size = ksize(corename);
  64. cn->corename = corename;
  65. return 0;
  66. }
  67. static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt,
  68. va_list arg)
  69. {
  70. int free, need;
  71. va_list arg_copy;
  72. again:
  73. free = cn->size - cn->used;
  74. va_copy(arg_copy, arg);
  75. need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);
  76. va_end(arg_copy);
  77. if (need < free) {
  78. cn->used += need;
  79. return 0;
  80. }
  81. if (!expand_corename(cn, cn->size + need - free + 1))
  82. goto again;
  83. return -ENOMEM;
  84. }
  85. static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...)
  86. {
  87. va_list arg;
  88. int ret;
  89. va_start(arg, fmt);
  90. ret = cn_vprintf(cn, fmt, arg);
  91. va_end(arg);
  92. return ret;
  93. }
  94. static __printf(2, 3)
  95. int cn_esc_printf(struct core_name *cn, const char *fmt, ...)
  96. {
  97. int cur = cn->used;
  98. va_list arg;
  99. int ret;
  100. va_start(arg, fmt);
  101. ret = cn_vprintf(cn, fmt, arg);
  102. va_end(arg);
  103. if (ret == 0) {
  104. /*
  105. * Ensure that this coredump name component can't cause the
  106. * resulting corefile path to consist of a ".." or ".".
  107. */
  108. if ((cn->used - cur == 1 && cn->corename[cur] == '.') ||
  109. (cn->used - cur == 2 && cn->corename[cur] == '.'
  110. && cn->corename[cur+1] == '.'))
  111. cn->corename[cur] = '!';
  112. /*
  113. * Empty names are fishy and could be used to create a "//" in a
  114. * corefile name, causing the coredump to happen one directory
  115. * level too high. Enforce that all components of the core
  116. * pattern are at least one character long.
  117. */
  118. if (cn->used == cur)
  119. ret = cn_printf(cn, "!");
  120. }
  121. for (; cur < cn->used; ++cur) {
  122. if (cn->corename[cur] == '/')
  123. cn->corename[cur] = '!';
  124. }
  125. return ret;
  126. }
  127. static int cn_print_exe_file(struct core_name *cn)
  128. {
  129. struct file *exe_file;
  130. char *pathbuf, *path;
  131. int ret;
  132. exe_file = get_mm_exe_file(current->mm);
  133. if (!exe_file)
  134. return cn_esc_printf(cn, "%s (path unknown)", current->comm);
  135. pathbuf = kmalloc(PATH_MAX, GFP_TEMPORARY);
  136. if (!pathbuf) {
  137. ret = -ENOMEM;
  138. goto put_exe_file;
  139. }
  140. path = file_path(exe_file, pathbuf, PATH_MAX);
  141. if (IS_ERR(path)) {
  142. ret = PTR_ERR(path);
  143. goto free_buf;
  144. }
  145. ret = cn_esc_printf(cn, "%s", path);
  146. free_buf:
  147. kfree(pathbuf);
  148. put_exe_file:
  149. fput(exe_file);
  150. return ret;
  151. }
  152. /* format_corename will inspect the pattern parameter, and output a
  153. * name into corename, which must have space for at least
  154. * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
  155. */
  156. static int format_corename(struct core_name *cn, struct coredump_params *cprm)
  157. {
  158. const struct cred *cred = current_cred();
  159. const char *pat_ptr = core_pattern;
  160. int ispipe = (*pat_ptr == '|');
  161. int pid_in_pattern = 0;
  162. int err = 0;
  163. cn->used = 0;
  164. cn->corename = NULL;
  165. if (expand_corename(cn, core_name_size))
  166. return -ENOMEM;
  167. cn->corename[0] = '\0';
  168. if (ispipe)
  169. ++pat_ptr;
  170. /* Repeat as long as we have more pattern to process and more output
  171. space */
  172. while (*pat_ptr) {
  173. if (*pat_ptr != '%') {
  174. err = cn_printf(cn, "%c", *pat_ptr++);
  175. } else {
  176. switch (*++pat_ptr) {
  177. /* single % at the end, drop that */
  178. case 0:
  179. goto out;
  180. /* Double percent, output one percent */
  181. case '%':
  182. err = cn_printf(cn, "%c", '%');
  183. break;
  184. /* pid */
  185. case 'p':
  186. pid_in_pattern = 1;
  187. err = cn_printf(cn, "%d",
  188. task_tgid_vnr(current));
  189. break;
  190. /* global pid */
  191. case 'P':
  192. err = cn_printf(cn, "%d",
  193. task_tgid_nr(current));
  194. break;
  195. case 'i':
  196. err = cn_printf(cn, "%d",
  197. task_pid_vnr(current));
  198. break;
  199. case 'I':
  200. err = cn_printf(cn, "%d",
  201. task_pid_nr(current));
  202. break;
  203. /* uid */
  204. case 'u':
  205. err = cn_printf(cn, "%u",
  206. from_kuid(&init_user_ns,
  207. cred->uid));
  208. break;
  209. /* gid */
  210. case 'g':
  211. err = cn_printf(cn, "%u",
  212. from_kgid(&init_user_ns,
  213. cred->gid));
  214. break;
  215. case 'd':
  216. err = cn_printf(cn, "%d",
  217. __get_dumpable(cprm->mm_flags));
  218. break;
  219. /* signal that caused the coredump */
  220. case 's':
  221. err = cn_printf(cn, "%d",
  222. cprm->siginfo->si_signo);
  223. break;
  224. /* UNIX time of coredump */
  225. case 't': {
  226. time64_t time;
  227. time = ktime_get_real_seconds();
  228. err = cn_printf(cn, "%lld", time);
  229. break;
  230. }
  231. /* hostname */
  232. case 'h':
  233. down_read(&uts_sem);
  234. err = cn_esc_printf(cn, "%s",
  235. utsname()->nodename);
  236. up_read(&uts_sem);
  237. break;
  238. /* executable */
  239. case 'e':
  240. err = cn_esc_printf(cn, "%s", current->comm);
  241. break;
  242. case 'E':
  243. err = cn_print_exe_file(cn);
  244. break;
  245. /* core limit size */
  246. case 'c':
  247. err = cn_printf(cn, "%lu",
  248. rlimit(RLIMIT_CORE));
  249. break;
  250. default:
  251. break;
  252. }
  253. ++pat_ptr;
  254. }
  255. if (err)
  256. return err;
  257. }
  258. out:
  259. /* Backward compatibility with core_uses_pid:
  260. *
  261. * If core_pattern does not include a %p (as is the default)
  262. * and core_uses_pid is set, then .%pid will be appended to
  263. * the filename. Do not do this for piped commands. */
  264. if (!ispipe && !pid_in_pattern && core_uses_pid) {
  265. err = cn_printf(cn, ".%d", task_tgid_vnr(current));
  266. if (err)
  267. return err;
  268. }
  269. return ispipe;
  270. }
  271. static int zap_process(struct task_struct *start, int exit_code, int flags)
  272. {
  273. struct task_struct *t;
  274. int nr = 0;
  275. /* ignore all signals except SIGKILL, see prepare_signal() */
  276. start->signal->flags = SIGNAL_GROUP_COREDUMP | flags;
  277. start->signal->group_exit_code = exit_code;
  278. start->signal->group_stop_count = 0;
  279. for_each_thread(start, t) {
  280. task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK);
  281. if (t != current && t->mm) {
  282. sigaddset(&t->pending.signal, SIGKILL);
  283. signal_wake_up(t, 1);
  284. nr++;
  285. }
  286. }
  287. return nr;
  288. }
  289. static int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
  290. struct core_state *core_state, int exit_code)
  291. {
  292. struct task_struct *g, *p;
  293. unsigned long flags;
  294. int nr = -EAGAIN;
  295. spin_lock_irq(&tsk->sighand->siglock);
  296. if (!signal_group_exit(tsk->signal)) {
  297. mm->core_state = core_state;
  298. tsk->signal->group_exit_task = tsk;
  299. nr = zap_process(tsk, exit_code, 0);
  300. clear_tsk_thread_flag(tsk, TIF_SIGPENDING);
  301. }
  302. spin_unlock_irq(&tsk->sighand->siglock);
  303. if (unlikely(nr < 0))
  304. return nr;
  305. tsk->flags |= PF_DUMPCORE;
  306. if (atomic_read(&mm->mm_users) == nr + 1)
  307. goto done;
  308. /*
  309. * We should find and kill all tasks which use this mm, and we should
  310. * count them correctly into ->nr_threads. We don't take tasklist
  311. * lock, but this is safe wrt:
  312. *
  313. * fork:
  314. * None of sub-threads can fork after zap_process(leader). All
  315. * processes which were created before this point should be
  316. * visible to zap_threads() because copy_process() adds the new
  317. * process to the tail of init_task.tasks list, and lock/unlock
  318. * of ->siglock provides a memory barrier.
  319. *
  320. * do_exit:
  321. * The caller holds mm->mmap_sem. This means that the task which
  322. * uses this mm can't pass exit_mm(), so it can't exit or clear
  323. * its ->mm.
  324. *
  325. * de_thread:
  326. * It does list_replace_rcu(&leader->tasks, &current->tasks),
  327. * we must see either old or new leader, this does not matter.
  328. * However, it can change p->sighand, so lock_task_sighand(p)
  329. * must be used. Since p->mm != NULL and we hold ->mmap_sem
  330. * it can't fail.
  331. *
  332. * Note also that "g" can be the old leader with ->mm == NULL
  333. * and already unhashed and thus removed from ->thread_group.
  334. * This is OK, __unhash_process()->list_del_rcu() does not
  335. * clear the ->next pointer, we will find the new leader via
  336. * next_thread().
  337. */
  338. rcu_read_lock();
  339. for_each_process(g) {
  340. if (g == tsk->group_leader)
  341. continue;
  342. if (g->flags & PF_KTHREAD)
  343. continue;
  344. for_each_thread(g, p) {
  345. if (unlikely(!p->mm))
  346. continue;
  347. if (unlikely(p->mm == mm)) {
  348. lock_task_sighand(p, &flags);
  349. nr += zap_process(p, exit_code,
  350. SIGNAL_GROUP_EXIT);
  351. unlock_task_sighand(p, &flags);
  352. }
  353. break;
  354. }
  355. }
  356. rcu_read_unlock();
  357. done:
  358. atomic_set(&core_state->nr_threads, nr);
  359. return nr;
  360. }
  361. static int coredump_wait(int exit_code, struct core_state *core_state)
  362. {
  363. struct task_struct *tsk = current;
  364. struct mm_struct *mm = tsk->mm;
  365. int core_waiters = -EBUSY;
  366. init_completion(&core_state->startup);
  367. core_state->dumper.task = tsk;
  368. core_state->dumper.next = NULL;
  369. if (down_write_killable(&mm->mmap_sem))
  370. return -EINTR;
  371. if (!mm->core_state)
  372. core_waiters = zap_threads(tsk, mm, core_state, exit_code);
  373. up_write(&mm->mmap_sem);
  374. if (core_waiters > 0) {
  375. struct core_thread *ptr;
  376. freezer_do_not_count();
  377. wait_for_completion(&core_state->startup);
  378. freezer_count();
  379. /*
  380. * Wait for all the threads to become inactive, so that
  381. * all the thread context (extended register state, like
  382. * fpu etc) gets copied to the memory.
  383. */
  384. ptr = core_state->dumper.next;
  385. while (ptr != NULL) {
  386. wait_task_inactive(ptr->task, 0);
  387. ptr = ptr->next;
  388. }
  389. }
  390. return core_waiters;
  391. }
  392. static void coredump_finish(struct mm_struct *mm, bool core_dumped)
  393. {
  394. struct core_thread *curr, *next;
  395. struct task_struct *task;
  396. spin_lock_irq(&current->sighand->siglock);
  397. if (core_dumped && !__fatal_signal_pending(current))
  398. current->signal->group_exit_code |= 0x80;
  399. current->signal->group_exit_task = NULL;
  400. current->signal->flags = SIGNAL_GROUP_EXIT;
  401. spin_unlock_irq(&current->sighand->siglock);
  402. next = mm->core_state->dumper.next;
  403. while ((curr = next) != NULL) {
  404. next = curr->next;
  405. task = curr->task;
  406. /*
  407. * see exit_mm(), curr->task must not see
  408. * ->task == NULL before we read ->next.
  409. */
  410. smp_mb();
  411. curr->task = NULL;
  412. wake_up_process(task);
  413. }
  414. mm->core_state = NULL;
  415. }
  416. static bool dump_interrupted(void)
  417. {
  418. /*
  419. * SIGKILL or freezing() interrupt the coredumping. Perhaps we
  420. * can do try_to_freeze() and check __fatal_signal_pending(),
  421. * but then we need to teach dump_write() to restart and clear
  422. * TIF_SIGPENDING.
  423. */
  424. return signal_pending(current);
  425. }
  426. static void wait_for_dump_helpers(struct file *file)
  427. {
  428. struct pipe_inode_info *pipe = file->private_data;
  429. pipe_lock(pipe);
  430. pipe->readers++;
  431. pipe->writers--;
  432. wake_up_interruptible_sync(&pipe->wait);
  433. kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
  434. pipe_unlock(pipe);
  435. /*
  436. * We actually want wait_event_freezable() but then we need
  437. * to clear TIF_SIGPENDING and improve dump_interrupted().
  438. */
  439. wait_event_interruptible(pipe->wait, pipe->readers == 1);
  440. pipe_lock(pipe);
  441. pipe->readers--;
  442. pipe->writers++;
  443. pipe_unlock(pipe);
  444. }
  445. /*
  446. * umh_pipe_setup
  447. * helper function to customize the process used
  448. * to collect the core in userspace. Specifically
  449. * it sets up a pipe and installs it as fd 0 (stdin)
  450. * for the process. Returns 0 on success, or
  451. * PTR_ERR on failure.
  452. * Note that it also sets the core limit to 1. This
  453. * is a special value that we use to trap recursive
  454. * core dumps
  455. */
  456. static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
  457. {
  458. struct file *files[2];
  459. struct coredump_params *cp = (struct coredump_params *)info->data;
  460. int err = create_pipe_files(files, 0);
  461. if (err)
  462. return err;
  463. cp->file = files[1];
  464. err = replace_fd(0, files[0], 0);
  465. fput(files[0]);
  466. /* and disallow core files too */
  467. current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};
  468. return err;
  469. }
  470. void do_coredump(const siginfo_t *siginfo)
  471. {
  472. struct core_state core_state;
  473. struct core_name cn;
  474. struct mm_struct *mm = current->mm;
  475. struct linux_binfmt * binfmt;
  476. const struct cred *old_cred;
  477. struct cred *cred;
  478. int retval = 0;
  479. int ispipe;
  480. struct files_struct *displaced;
  481. /* require nonrelative corefile path and be extra careful */
  482. bool need_suid_safe = false;
  483. bool core_dumped = false;
  484. static atomic_t core_dump_count = ATOMIC_INIT(0);
  485. struct coredump_params cprm = {
  486. .siginfo = siginfo,
  487. .regs = signal_pt_regs(),
  488. .limit = rlimit(RLIMIT_CORE),
  489. /*
  490. * We must use the same mm->flags while dumping core to avoid
  491. * inconsistency of bit flags, since this flag is not protected
  492. * by any locks.
  493. */
  494. .mm_flags = mm->flags,
  495. };
  496. audit_core_dumps(siginfo->si_signo);
  497. binfmt = mm->binfmt;
  498. if (!binfmt || !binfmt->core_dump)
  499. goto fail;
  500. if (!__get_dumpable(cprm.mm_flags))
  501. goto fail;
  502. cred = prepare_creds();
  503. if (!cred)
  504. goto fail;
  505. /*
  506. * We cannot trust fsuid as being the "true" uid of the process
  507. * nor do we know its entire history. We only know it was tainted
  508. * so we dump it as root in mode 2, and only into a controlled
  509. * environment (pipe handler or fully qualified path).
  510. */
  511. if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {
  512. /* Setuid core dump mode */
  513. cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */
  514. need_suid_safe = true;
  515. }
  516. retval = coredump_wait(siginfo->si_signo, &core_state);
  517. if (retval < 0)
  518. goto fail_creds;
  519. old_cred = override_creds(cred);
  520. ispipe = format_corename(&cn, &cprm);
  521. if (ispipe) {
  522. int dump_count;
  523. char **helper_argv;
  524. struct subprocess_info *sub_info;
  525. if (ispipe < 0) {
  526. printk(KERN_WARNING "format_corename failed\n");
  527. printk(KERN_WARNING "Aborting core\n");
  528. goto fail_unlock;
  529. }
  530. if (cprm.limit == 1) {
  531. /* See umh_pipe_setup() which sets RLIMIT_CORE = 1.
  532. *
  533. * Normally core limits are irrelevant to pipes, since
  534. * we're not writing to the file system, but we use
  535. * cprm.limit of 1 here as a special value, this is a
  536. * consistent way to catch recursive crashes.
  537. * We can still crash if the core_pattern binary sets
  538. * RLIM_CORE = !1, but it runs as root, and can do
  539. * lots of stupid things.
  540. *
  541. * Note that we use task_tgid_vnr here to grab the pid
  542. * of the process group leader. That way we get the
  543. * right pid if a thread in a multi-threaded
  544. * core_pattern process dies.
  545. */
  546. printk(KERN_WARNING
  547. "Process %d(%s) has RLIMIT_CORE set to 1\n",
  548. task_tgid_vnr(current), current->comm);
  549. printk(KERN_WARNING "Aborting core\n");
  550. goto fail_unlock;
  551. }
  552. cprm.limit = RLIM_INFINITY;
  553. dump_count = atomic_inc_return(&core_dump_count);
  554. if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  555. printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  556. task_tgid_vnr(current), current->comm);
  557. printk(KERN_WARNING "Skipping core dump\n");
  558. goto fail_dropcount;
  559. }
  560. helper_argv = argv_split(GFP_KERNEL, cn.corename, NULL);
  561. if (!helper_argv) {
  562. printk(KERN_WARNING "%s failed to allocate memory\n",
  563. __func__);
  564. goto fail_dropcount;
  565. }
  566. retval = -ENOMEM;
  567. sub_info = call_usermodehelper_setup(helper_argv[0],
  568. helper_argv, NULL, GFP_KERNEL,
  569. umh_pipe_setup, NULL, &cprm);
  570. if (sub_info)
  571. retval = call_usermodehelper_exec(sub_info,
  572. UMH_WAIT_EXEC);
  573. argv_free(helper_argv);
  574. if (retval) {
  575. printk(KERN_INFO "Core dump to |%s pipe failed\n",
  576. cn.corename);
  577. goto close_fail;
  578. }
  579. } else {
  580. struct inode *inode;
  581. int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW |
  582. O_LARGEFILE | O_EXCL;
  583. if (cprm.limit < binfmt->min_coredump)
  584. goto fail_unlock;
  585. if (need_suid_safe && cn.corename[0] != '/') {
  586. printk(KERN_WARNING "Pid %d(%s) can only dump core "\
  587. "to fully qualified path!\n",
  588. task_tgid_vnr(current), current->comm);
  589. printk(KERN_WARNING "Skipping core dump\n");
  590. goto fail_unlock;
  591. }
  592. /*
  593. * Unlink the file if it exists unless this is a SUID
  594. * binary - in that case, we're running around with root
  595. * privs and don't want to unlink another user's coredump.
  596. */
  597. if (!need_suid_safe) {
  598. mm_segment_t old_fs;
  599. old_fs = get_fs();
  600. set_fs(KERNEL_DS);
  601. /*
  602. * If it doesn't exist, that's fine. If there's some
  603. * other problem, we'll catch it at the filp_open().
  604. */
  605. (void) sys_unlink((const char __user *)cn.corename);
  606. set_fs(old_fs);
  607. }
  608. /*
  609. * There is a race between unlinking and creating the
  610. * file, but if that causes an EEXIST here, that's
  611. * fine - another process raced with us while creating
  612. * the corefile, and the other process won. To userspace,
  613. * what matters is that at least one of the two processes
  614. * writes its coredump successfully, not which one.
  615. */
  616. if (need_suid_safe) {
  617. /*
  618. * Using user namespaces, normal user tasks can change
  619. * their current->fs->root to point to arbitrary
  620. * directories. Since the intention of the "only dump
  621. * with a fully qualified path" rule is to control where
  622. * coredumps may be placed using root privileges,
  623. * current->fs->root must not be used. Instead, use the
  624. * root directory of init_task.
  625. */
  626. struct path root;
  627. task_lock(&init_task);
  628. get_fs_root(init_task.fs, &root);
  629. task_unlock(&init_task);
  630. cprm.file = file_open_root(root.dentry, root.mnt,
  631. cn.corename, open_flags, 0600);
  632. path_put(&root);
  633. } else {
  634. cprm.file = filp_open(cn.corename, open_flags, 0600);
  635. }
  636. if (IS_ERR(cprm.file))
  637. goto fail_unlock;
  638. inode = file_inode(cprm.file);
  639. if (inode->i_nlink > 1)
  640. goto close_fail;
  641. if (d_unhashed(cprm.file->f_path.dentry))
  642. goto close_fail;
  643. /*
  644. * AK: actually i see no reason to not allow this for named
  645. * pipes etc, but keep the previous behaviour for now.
  646. */
  647. if (!S_ISREG(inode->i_mode))
  648. goto close_fail;
  649. /*
  650. * Don't dump core if the filesystem changed owner or mode
  651. * of the file during file creation. This is an issue when
  652. * a process dumps core while its cwd is e.g. on a vfat
  653. * filesystem.
  654. */
  655. if (!uid_eq(inode->i_uid, current_fsuid()))
  656. goto close_fail;
  657. if ((inode->i_mode & 0677) != 0600)
  658. goto close_fail;
  659. if (!(cprm.file->f_mode & FMODE_CAN_WRITE))
  660. goto close_fail;
  661. if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file))
  662. goto close_fail;
  663. }
  664. /* get us an unshared descriptor table; almost always a no-op */
  665. retval = unshare_files(&displaced);
  666. if (retval)
  667. goto close_fail;
  668. if (displaced)
  669. put_files_struct(displaced);
  670. if (!dump_interrupted()) {
  671. file_start_write(cprm.file);
  672. core_dumped = binfmt->core_dump(&cprm);
  673. file_end_write(cprm.file);
  674. }
  675. if (ispipe && core_pipe_limit)
  676. wait_for_dump_helpers(cprm.file);
  677. close_fail:
  678. if (cprm.file)
  679. filp_close(cprm.file, NULL);
  680. fail_dropcount:
  681. if (ispipe)
  682. atomic_dec(&core_dump_count);
  683. fail_unlock:
  684. kfree(cn.corename);
  685. coredump_finish(mm, core_dumped);
  686. revert_creds(old_cred);
  687. fail_creds:
  688. put_cred(cred);
  689. fail:
  690. return;
  691. }
  692. /*
  693. * Core dumping helper functions. These are the only things you should
  694. * do on a core-file: use only these functions to write out all the
  695. * necessary info.
  696. */
  697. int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
  698. {
  699. struct file *file = cprm->file;
  700. loff_t pos = file->f_pos;
  701. ssize_t n;
  702. if (cprm->written + nr > cprm->limit)
  703. return 0;
  704. while (nr) {
  705. if (dump_interrupted())
  706. return 0;
  707. n = __kernel_write(file, addr, nr, &pos);
  708. if (n <= 0)
  709. return 0;
  710. file->f_pos = pos;
  711. cprm->written += n;
  712. cprm->pos += n;
  713. nr -= n;
  714. }
  715. return 1;
  716. }
  717. EXPORT_SYMBOL(dump_emit);
  718. int dump_skip(struct coredump_params *cprm, size_t nr)
  719. {
  720. static char zeroes[PAGE_SIZE];
  721. struct file *file = cprm->file;
  722. if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
  723. if (dump_interrupted() ||
  724. file->f_op->llseek(file, nr, SEEK_CUR) < 0)
  725. return 0;
  726. cprm->pos += nr;
  727. return 1;
  728. } else {
  729. while (nr > PAGE_SIZE) {
  730. if (!dump_emit(cprm, zeroes, PAGE_SIZE))
  731. return 0;
  732. nr -= PAGE_SIZE;
  733. }
  734. return dump_emit(cprm, zeroes, nr);
  735. }
  736. }
  737. EXPORT_SYMBOL(dump_skip);
  738. int dump_align(struct coredump_params *cprm, int align)
  739. {
  740. unsigned mod = cprm->pos & (align - 1);
  741. if (align & (align - 1))
  742. return 0;
  743. return mod ? dump_skip(cprm, align - mod) : 1;
  744. }
  745. EXPORT_SYMBOL(dump_align);
  746. /*
  747. * Ensures that file size is big enough to contain the current file
  748. * postion. This prevents gdb from complaining about a truncated file
  749. * if the last "write" to the file was dump_skip.
  750. */
  751. void dump_truncate(struct coredump_params *cprm)
  752. {
  753. struct file *file = cprm->file;
  754. loff_t offset;
  755. if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
  756. offset = file->f_op->llseek(file, 0, SEEK_CUR);
  757. if (i_size_read(file->f_mapping->host) < offset)
  758. do_truncate(file->f_path.dentry, offset, 0, file);
  759. }
  760. }
  761. EXPORT_SYMBOL(dump_truncate);