coredump.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855
  1. #include <linux/slab.h>
  2. #include <linux/file.h>
  3. #include <linux/fdtable.h>
  4. #include <linux/freezer.h>
  5. #include <linux/mm.h>
  6. #include <linux/stat.h>
  7. #include <linux/fcntl.h>
  8. #include <linux/swap.h>
  9. #include <linux/string.h>
  10. #include <linux/init.h>
  11. #include <linux/pagemap.h>
  12. #include <linux/perf_event.h>
  13. #include <linux/highmem.h>
  14. #include <linux/spinlock.h>
  15. #include <linux/key.h>
  16. #include <linux/personality.h>
  17. #include <linux/binfmts.h>
  18. #include <linux/coredump.h>
  19. #include <linux/sched/coredump.h>
  20. #include <linux/sched/signal.h>
  21. #include <linux/sched/task_stack.h>
  22. #include <linux/utsname.h>
  23. #include <linux/pid_namespace.h>
  24. #include <linux/module.h>
  25. #include <linux/namei.h>
  26. #include <linux/mount.h>
  27. #include <linux/security.h>
  28. #include <linux/syscalls.h>
  29. #include <linux/tsacct_kern.h>
  30. #include <linux/cn_proc.h>
  31. #include <linux/audit.h>
  32. #include <linux/tracehook.h>
  33. #include <linux/kmod.h>
  34. #include <linux/fsnotify.h>
  35. #include <linux/fs_struct.h>
  36. #include <linux/pipe_fs_i.h>
  37. #include <linux/oom.h>
  38. #include <linux/compat.h>
  39. #include <linux/fs.h>
  40. #include <linux/path.h>
  41. #include <linux/timekeeping.h>
  42. #include <linux/uaccess.h>
  43. #include <asm/mmu_context.h>
  44. #include <asm/tlb.h>
  45. #include <asm/exec.h>
  46. #include <trace/events/task.h>
  47. #include "internal.h"
  48. #include <trace/events/sched.h>
  49. int core_uses_pid;
  50. unsigned int core_pipe_limit;
  51. char core_pattern[CORENAME_MAX_SIZE] = "core";
  52. static int core_name_size = CORENAME_MAX_SIZE;
  53. struct core_name {
  54. char *corename;
  55. int used, size;
  56. };
  57. /* The maximal length of core_pattern is also specified in sysctl.c */
  58. static int expand_corename(struct core_name *cn, int size)
  59. {
  60. char *corename = krealloc(cn->corename, size, GFP_KERNEL);
  61. if (!corename)
  62. return -ENOMEM;
  63. if (size > core_name_size) /* racy but harmless */
  64. core_name_size = size;
  65. cn->size = ksize(corename);
  66. cn->corename = corename;
  67. return 0;
  68. }
  69. static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt,
  70. va_list arg)
  71. {
  72. int free, need;
  73. va_list arg_copy;
  74. again:
  75. free = cn->size - cn->used;
  76. va_copy(arg_copy, arg);
  77. need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);
  78. va_end(arg_copy);
  79. if (need < free) {
  80. cn->used += need;
  81. return 0;
  82. }
  83. if (!expand_corename(cn, cn->size + need - free + 1))
  84. goto again;
  85. return -ENOMEM;
  86. }
  87. static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...)
  88. {
  89. va_list arg;
  90. int ret;
  91. va_start(arg, fmt);
  92. ret = cn_vprintf(cn, fmt, arg);
  93. va_end(arg);
  94. return ret;
  95. }
  96. static __printf(2, 3)
  97. int cn_esc_printf(struct core_name *cn, const char *fmt, ...)
  98. {
  99. int cur = cn->used;
  100. va_list arg;
  101. int ret;
  102. va_start(arg, fmt);
  103. ret = cn_vprintf(cn, fmt, arg);
  104. va_end(arg);
  105. if (ret == 0) {
  106. /*
  107. * Ensure that this coredump name component can't cause the
  108. * resulting corefile path to consist of a ".." or ".".
  109. */
  110. if ((cn->used - cur == 1 && cn->corename[cur] == '.') ||
  111. (cn->used - cur == 2 && cn->corename[cur] == '.'
  112. && cn->corename[cur+1] == '.'))
  113. cn->corename[cur] = '!';
  114. /*
  115. * Empty names are fishy and could be used to create a "//" in a
  116. * corefile name, causing the coredump to happen one directory
  117. * level too high. Enforce that all components of the core
  118. * pattern are at least one character long.
  119. */
  120. if (cn->used == cur)
  121. ret = cn_printf(cn, "!");
  122. }
  123. for (; cur < cn->used; ++cur) {
  124. if (cn->corename[cur] == '/')
  125. cn->corename[cur] = '!';
  126. }
  127. return ret;
  128. }
  129. static int cn_print_exe_file(struct core_name *cn)
  130. {
  131. struct file *exe_file;
  132. char *pathbuf, *path;
  133. int ret;
  134. exe_file = get_mm_exe_file(current->mm);
  135. if (!exe_file)
  136. return cn_esc_printf(cn, "%s (path unknown)", current->comm);
  137. pathbuf = kmalloc(PATH_MAX, GFP_TEMPORARY);
  138. if (!pathbuf) {
  139. ret = -ENOMEM;
  140. goto put_exe_file;
  141. }
  142. path = file_path(exe_file, pathbuf, PATH_MAX);
  143. if (IS_ERR(path)) {
  144. ret = PTR_ERR(path);
  145. goto free_buf;
  146. }
  147. ret = cn_esc_printf(cn, "%s", path);
  148. free_buf:
  149. kfree(pathbuf);
  150. put_exe_file:
  151. fput(exe_file);
  152. return ret;
  153. }
  154. /* format_corename will inspect the pattern parameter, and output a
  155. * name into corename, which must have space for at least
  156. * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
  157. */
  158. static int format_corename(struct core_name *cn, struct coredump_params *cprm)
  159. {
  160. const struct cred *cred = current_cred();
  161. const char *pat_ptr = core_pattern;
  162. int ispipe = (*pat_ptr == '|');
  163. int pid_in_pattern = 0;
  164. int err = 0;
  165. cn->used = 0;
  166. cn->corename = NULL;
  167. if (expand_corename(cn, core_name_size))
  168. return -ENOMEM;
  169. cn->corename[0] = '\0';
  170. if (ispipe)
  171. ++pat_ptr;
  172. /* Repeat as long as we have more pattern to process and more output
  173. space */
  174. while (*pat_ptr) {
  175. if (*pat_ptr != '%') {
  176. err = cn_printf(cn, "%c", *pat_ptr++);
  177. } else {
  178. switch (*++pat_ptr) {
  179. /* single % at the end, drop that */
  180. case 0:
  181. goto out;
  182. /* Double percent, output one percent */
  183. case '%':
  184. err = cn_printf(cn, "%c", '%');
  185. break;
  186. /* pid */
  187. case 'p':
  188. pid_in_pattern = 1;
  189. err = cn_printf(cn, "%d",
  190. task_tgid_vnr(current));
  191. break;
  192. /* global pid */
  193. case 'P':
  194. err = cn_printf(cn, "%d",
  195. task_tgid_nr(current));
  196. break;
  197. case 'i':
  198. err = cn_printf(cn, "%d",
  199. task_pid_vnr(current));
  200. break;
  201. case 'I':
  202. err = cn_printf(cn, "%d",
  203. task_pid_nr(current));
  204. break;
  205. /* uid */
  206. case 'u':
  207. err = cn_printf(cn, "%u",
  208. from_kuid(&init_user_ns,
  209. cred->uid));
  210. break;
  211. /* gid */
  212. case 'g':
  213. err = cn_printf(cn, "%u",
  214. from_kgid(&init_user_ns,
  215. cred->gid));
  216. break;
  217. case 'd':
  218. err = cn_printf(cn, "%d",
  219. __get_dumpable(cprm->mm_flags));
  220. break;
  221. /* signal that caused the coredump */
  222. case 's':
  223. err = cn_printf(cn, "%d",
  224. cprm->siginfo->si_signo);
  225. break;
  226. /* UNIX time of coredump */
  227. case 't': {
  228. time64_t time;
  229. time = ktime_get_real_seconds();
  230. err = cn_printf(cn, "%lld", time);
  231. break;
  232. }
  233. /* hostname */
  234. case 'h':
  235. down_read(&uts_sem);
  236. err = cn_esc_printf(cn, "%s",
  237. utsname()->nodename);
  238. up_read(&uts_sem);
  239. break;
  240. /* executable */
  241. case 'e':
  242. err = cn_esc_printf(cn, "%s", current->comm);
  243. break;
  244. case 'E':
  245. err = cn_print_exe_file(cn);
  246. break;
  247. /* core limit size */
  248. case 'c':
  249. err = cn_printf(cn, "%lu",
  250. rlimit(RLIMIT_CORE));
  251. break;
  252. default:
  253. break;
  254. }
  255. ++pat_ptr;
  256. }
  257. if (err)
  258. return err;
  259. }
  260. out:
  261. /* Backward compatibility with core_uses_pid:
  262. *
  263. * If core_pattern does not include a %p (as is the default)
  264. * and core_uses_pid is set, then .%pid will be appended to
  265. * the filename. Do not do this for piped commands. */
  266. if (!ispipe && !pid_in_pattern && core_uses_pid) {
  267. err = cn_printf(cn, ".%d", task_tgid_vnr(current));
  268. if (err)
  269. return err;
  270. }
  271. return ispipe;
  272. }
  273. static int zap_process(struct task_struct *start, int exit_code, int flags)
  274. {
  275. struct task_struct *t;
  276. int nr = 0;
  277. /* ignore all signals except SIGKILL, see prepare_signal() */
  278. start->signal->flags = SIGNAL_GROUP_COREDUMP | flags;
  279. start->signal->group_exit_code = exit_code;
  280. start->signal->group_stop_count = 0;
  281. for_each_thread(start, t) {
  282. task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK);
  283. if (t != current && t->mm) {
  284. sigaddset(&t->pending.signal, SIGKILL);
  285. signal_wake_up(t, 1);
  286. nr++;
  287. }
  288. }
  289. return nr;
  290. }
  291. static int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
  292. struct core_state *core_state, int exit_code)
  293. {
  294. struct task_struct *g, *p;
  295. unsigned long flags;
  296. int nr = -EAGAIN;
  297. spin_lock_irq(&tsk->sighand->siglock);
  298. if (!signal_group_exit(tsk->signal)) {
  299. mm->core_state = core_state;
  300. tsk->signal->group_exit_task = tsk;
  301. nr = zap_process(tsk, exit_code, 0);
  302. clear_tsk_thread_flag(tsk, TIF_SIGPENDING);
  303. }
  304. spin_unlock_irq(&tsk->sighand->siglock);
  305. if (unlikely(nr < 0))
  306. return nr;
  307. tsk->flags |= PF_DUMPCORE;
  308. if (atomic_read(&mm->mm_users) == nr + 1)
  309. goto done;
  310. /*
  311. * We should find and kill all tasks which use this mm, and we should
  312. * count them correctly into ->nr_threads. We don't take tasklist
  313. * lock, but this is safe wrt:
  314. *
  315. * fork:
  316. * None of sub-threads can fork after zap_process(leader). All
  317. * processes which were created before this point should be
  318. * visible to zap_threads() because copy_process() adds the new
  319. * process to the tail of init_task.tasks list, and lock/unlock
  320. * of ->siglock provides a memory barrier.
  321. *
  322. * do_exit:
  323. * The caller holds mm->mmap_sem. This means that the task which
  324. * uses this mm can't pass exit_mm(), so it can't exit or clear
  325. * its ->mm.
  326. *
  327. * de_thread:
  328. * It does list_replace_rcu(&leader->tasks, &current->tasks),
  329. * we must see either old or new leader, this does not matter.
  330. * However, it can change p->sighand, so lock_task_sighand(p)
  331. * must be used. Since p->mm != NULL and we hold ->mmap_sem
  332. * it can't fail.
  333. *
  334. * Note also that "g" can be the old leader with ->mm == NULL
  335. * and already unhashed and thus removed from ->thread_group.
  336. * This is OK, __unhash_process()->list_del_rcu() does not
  337. * clear the ->next pointer, we will find the new leader via
  338. * next_thread().
  339. */
  340. rcu_read_lock();
  341. for_each_process(g) {
  342. if (g == tsk->group_leader)
  343. continue;
  344. if (g->flags & PF_KTHREAD)
  345. continue;
  346. for_each_thread(g, p) {
  347. if (unlikely(!p->mm))
  348. continue;
  349. if (unlikely(p->mm == mm)) {
  350. lock_task_sighand(p, &flags);
  351. nr += zap_process(p, exit_code,
  352. SIGNAL_GROUP_EXIT);
  353. unlock_task_sighand(p, &flags);
  354. }
  355. break;
  356. }
  357. }
  358. rcu_read_unlock();
  359. done:
  360. atomic_set(&core_state->nr_threads, nr);
  361. return nr;
  362. }
  363. static int coredump_wait(int exit_code, struct core_state *core_state)
  364. {
  365. struct task_struct *tsk = current;
  366. struct mm_struct *mm = tsk->mm;
  367. int core_waiters = -EBUSY;
  368. init_completion(&core_state->startup);
  369. core_state->dumper.task = tsk;
  370. core_state->dumper.next = NULL;
  371. if (down_write_killable(&mm->mmap_sem))
  372. return -EINTR;
  373. if (!mm->core_state)
  374. core_waiters = zap_threads(tsk, mm, core_state, exit_code);
  375. up_write(&mm->mmap_sem);
  376. if (core_waiters > 0) {
  377. struct core_thread *ptr;
  378. freezer_do_not_count();
  379. wait_for_completion(&core_state->startup);
  380. freezer_count();
  381. /*
  382. * Wait for all the threads to become inactive, so that
  383. * all the thread context (extended register state, like
  384. * fpu etc) gets copied to the memory.
  385. */
  386. ptr = core_state->dumper.next;
  387. while (ptr != NULL) {
  388. wait_task_inactive(ptr->task, 0);
  389. ptr = ptr->next;
  390. }
  391. }
  392. return core_waiters;
  393. }
  394. static void coredump_finish(struct mm_struct *mm, bool core_dumped)
  395. {
  396. struct core_thread *curr, *next;
  397. struct task_struct *task;
  398. spin_lock_irq(&current->sighand->siglock);
  399. if (core_dumped && !__fatal_signal_pending(current))
  400. current->signal->group_exit_code |= 0x80;
  401. current->signal->group_exit_task = NULL;
  402. current->signal->flags = SIGNAL_GROUP_EXIT;
  403. spin_unlock_irq(&current->sighand->siglock);
  404. next = mm->core_state->dumper.next;
  405. while ((curr = next) != NULL) {
  406. next = curr->next;
  407. task = curr->task;
  408. /*
  409. * see exit_mm(), curr->task must not see
  410. * ->task == NULL before we read ->next.
  411. */
  412. smp_mb();
  413. curr->task = NULL;
  414. wake_up_process(task);
  415. }
  416. mm->core_state = NULL;
  417. }
  418. static bool dump_interrupted(void)
  419. {
  420. /*
  421. * SIGKILL or freezing() interrupt the coredumping. Perhaps we
  422. * can do try_to_freeze() and check __fatal_signal_pending(),
  423. * but then we need to teach dump_write() to restart and clear
  424. * TIF_SIGPENDING.
  425. */
  426. return signal_pending(current);
  427. }
  428. static void wait_for_dump_helpers(struct file *file)
  429. {
  430. struct pipe_inode_info *pipe = file->private_data;
  431. pipe_lock(pipe);
  432. pipe->readers++;
  433. pipe->writers--;
  434. wake_up_interruptible_sync(&pipe->wait);
  435. kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
  436. pipe_unlock(pipe);
  437. /*
  438. * We actually want wait_event_freezable() but then we need
  439. * to clear TIF_SIGPENDING and improve dump_interrupted().
  440. */
  441. wait_event_interruptible(pipe->wait, pipe->readers == 1);
  442. pipe_lock(pipe);
  443. pipe->readers--;
  444. pipe->writers++;
  445. pipe_unlock(pipe);
  446. }
  447. /*
  448. * umh_pipe_setup
  449. * helper function to customize the process used
  450. * to collect the core in userspace. Specifically
  451. * it sets up a pipe and installs it as fd 0 (stdin)
  452. * for the process. Returns 0 on success, or
  453. * PTR_ERR on failure.
  454. * Note that it also sets the core limit to 1. This
  455. * is a special value that we use to trap recursive
  456. * core dumps
  457. */
  458. static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
  459. {
  460. struct file *files[2];
  461. struct coredump_params *cp = (struct coredump_params *)info->data;
  462. int err = create_pipe_files(files, 0);
  463. if (err)
  464. return err;
  465. cp->file = files[1];
  466. err = replace_fd(0, files[0], 0);
  467. fput(files[0]);
  468. /* and disallow core files too */
  469. current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};
  470. return err;
  471. }
  472. void do_coredump(const siginfo_t *siginfo)
  473. {
  474. struct core_state core_state;
  475. struct core_name cn;
  476. struct mm_struct *mm = current->mm;
  477. struct linux_binfmt * binfmt;
  478. const struct cred *old_cred;
  479. struct cred *cred;
  480. int retval = 0;
  481. int ispipe;
  482. struct files_struct *displaced;
  483. /* require nonrelative corefile path and be extra careful */
  484. bool need_suid_safe = false;
  485. bool core_dumped = false;
  486. static atomic_t core_dump_count = ATOMIC_INIT(0);
  487. struct coredump_params cprm = {
  488. .siginfo = siginfo,
  489. .regs = signal_pt_regs(),
  490. .limit = rlimit(RLIMIT_CORE),
  491. /*
  492. * We must use the same mm->flags while dumping core to avoid
  493. * inconsistency of bit flags, since this flag is not protected
  494. * by any locks.
  495. */
  496. .mm_flags = mm->flags,
  497. };
  498. audit_core_dumps(siginfo->si_signo);
  499. binfmt = mm->binfmt;
  500. if (!binfmt || !binfmt->core_dump)
  501. goto fail;
  502. if (!__get_dumpable(cprm.mm_flags))
  503. goto fail;
  504. cred = prepare_creds();
  505. if (!cred)
  506. goto fail;
  507. /*
  508. * We cannot trust fsuid as being the "true" uid of the process
  509. * nor do we know its entire history. We only know it was tainted
  510. * so we dump it as root in mode 2, and only into a controlled
  511. * environment (pipe handler or fully qualified path).
  512. */
  513. if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {
  514. /* Setuid core dump mode */
  515. cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */
  516. need_suid_safe = true;
  517. }
  518. retval = coredump_wait(siginfo->si_signo, &core_state);
  519. if (retval < 0)
  520. goto fail_creds;
  521. old_cred = override_creds(cred);
  522. ispipe = format_corename(&cn, &cprm);
  523. if (ispipe) {
  524. int dump_count;
  525. char **helper_argv;
  526. struct subprocess_info *sub_info;
  527. if (ispipe < 0) {
  528. printk(KERN_WARNING "format_corename failed\n");
  529. printk(KERN_WARNING "Aborting core\n");
  530. goto fail_unlock;
  531. }
  532. if (cprm.limit == 1) {
  533. /* See umh_pipe_setup() which sets RLIMIT_CORE = 1.
  534. *
  535. * Normally core limits are irrelevant to pipes, since
  536. * we're not writing to the file system, but we use
  537. * cprm.limit of 1 here as a special value, this is a
  538. * consistent way to catch recursive crashes.
  539. * We can still crash if the core_pattern binary sets
  540. * RLIM_CORE = !1, but it runs as root, and can do
  541. * lots of stupid things.
  542. *
  543. * Note that we use task_tgid_vnr here to grab the pid
  544. * of the process group leader. That way we get the
  545. * right pid if a thread in a multi-threaded
  546. * core_pattern process dies.
  547. */
  548. printk(KERN_WARNING
  549. "Process %d(%s) has RLIMIT_CORE set to 1\n",
  550. task_tgid_vnr(current), current->comm);
  551. printk(KERN_WARNING "Aborting core\n");
  552. goto fail_unlock;
  553. }
  554. cprm.limit = RLIM_INFINITY;
  555. dump_count = atomic_inc_return(&core_dump_count);
  556. if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  557. printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  558. task_tgid_vnr(current), current->comm);
  559. printk(KERN_WARNING "Skipping core dump\n");
  560. goto fail_dropcount;
  561. }
  562. helper_argv = argv_split(GFP_KERNEL, cn.corename, NULL);
  563. if (!helper_argv) {
  564. printk(KERN_WARNING "%s failed to allocate memory\n",
  565. __func__);
  566. goto fail_dropcount;
  567. }
  568. retval = -ENOMEM;
  569. sub_info = call_usermodehelper_setup(helper_argv[0],
  570. helper_argv, NULL, GFP_KERNEL,
  571. umh_pipe_setup, NULL, &cprm);
  572. if (sub_info)
  573. retval = call_usermodehelper_exec(sub_info,
  574. UMH_WAIT_EXEC);
  575. argv_free(helper_argv);
  576. if (retval) {
  577. printk(KERN_INFO "Core dump to |%s pipe failed\n",
  578. cn.corename);
  579. goto close_fail;
  580. }
  581. } else {
  582. struct inode *inode;
  583. int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW |
  584. O_LARGEFILE | O_EXCL;
  585. if (cprm.limit < binfmt->min_coredump)
  586. goto fail_unlock;
  587. if (need_suid_safe && cn.corename[0] != '/') {
  588. printk(KERN_WARNING "Pid %d(%s) can only dump core "\
  589. "to fully qualified path!\n",
  590. task_tgid_vnr(current), current->comm);
  591. printk(KERN_WARNING "Skipping core dump\n");
  592. goto fail_unlock;
  593. }
  594. /*
  595. * Unlink the file if it exists unless this is a SUID
  596. * binary - in that case, we're running around with root
  597. * privs and don't want to unlink another user's coredump.
  598. */
  599. if (!need_suid_safe) {
  600. mm_segment_t old_fs;
  601. old_fs = get_fs();
  602. set_fs(KERNEL_DS);
  603. /*
  604. * If it doesn't exist, that's fine. If there's some
  605. * other problem, we'll catch it at the filp_open().
  606. */
  607. (void) sys_unlink((const char __user *)cn.corename);
  608. set_fs(old_fs);
  609. }
  610. /*
  611. * There is a race between unlinking and creating the
  612. * file, but if that causes an EEXIST here, that's
  613. * fine - another process raced with us while creating
  614. * the corefile, and the other process won. To userspace,
  615. * what matters is that at least one of the two processes
  616. * writes its coredump successfully, not which one.
  617. */
  618. if (need_suid_safe) {
  619. /*
  620. * Using user namespaces, normal user tasks can change
  621. * their current->fs->root to point to arbitrary
  622. * directories. Since the intention of the "only dump
  623. * with a fully qualified path" rule is to control where
  624. * coredumps may be placed using root privileges,
  625. * current->fs->root must not be used. Instead, use the
  626. * root directory of init_task.
  627. */
  628. struct path root;
  629. task_lock(&init_task);
  630. get_fs_root(init_task.fs, &root);
  631. task_unlock(&init_task);
  632. cprm.file = file_open_root(root.dentry, root.mnt,
  633. cn.corename, open_flags, 0600);
  634. path_put(&root);
  635. } else {
  636. cprm.file = filp_open(cn.corename, open_flags, 0600);
  637. }
  638. if (IS_ERR(cprm.file))
  639. goto fail_unlock;
  640. inode = file_inode(cprm.file);
  641. if (inode->i_nlink > 1)
  642. goto close_fail;
  643. if (d_unhashed(cprm.file->f_path.dentry))
  644. goto close_fail;
  645. /*
  646. * AK: actually i see no reason to not allow this for named
  647. * pipes etc, but keep the previous behaviour for now.
  648. */
  649. if (!S_ISREG(inode->i_mode))
  650. goto close_fail;
  651. /*
  652. * Don't dump core if the filesystem changed owner or mode
  653. * of the file during file creation. This is an issue when
  654. * a process dumps core while its cwd is e.g. on a vfat
  655. * filesystem.
  656. */
  657. if (!uid_eq(inode->i_uid, current_fsuid()))
  658. goto close_fail;
  659. if ((inode->i_mode & 0677) != 0600)
  660. goto close_fail;
  661. if (!(cprm.file->f_mode & FMODE_CAN_WRITE))
  662. goto close_fail;
  663. if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file))
  664. goto close_fail;
  665. }
  666. /* get us an unshared descriptor table; almost always a no-op */
  667. retval = unshare_files(&displaced);
  668. if (retval)
  669. goto close_fail;
  670. if (displaced)
  671. put_files_struct(displaced);
  672. if (!dump_interrupted()) {
  673. file_start_write(cprm.file);
  674. core_dumped = binfmt->core_dump(&cprm);
  675. file_end_write(cprm.file);
  676. }
  677. if (ispipe && core_pipe_limit)
  678. wait_for_dump_helpers(cprm.file);
  679. close_fail:
  680. if (cprm.file)
  681. filp_close(cprm.file, NULL);
  682. fail_dropcount:
  683. if (ispipe)
  684. atomic_dec(&core_dump_count);
  685. fail_unlock:
  686. kfree(cn.corename);
  687. coredump_finish(mm, core_dumped);
  688. revert_creds(old_cred);
  689. fail_creds:
  690. put_cred(cred);
  691. fail:
  692. return;
  693. }
  694. /*
  695. * Core dumping helper functions. These are the only things you should
  696. * do on a core-file: use only these functions to write out all the
  697. * necessary info.
  698. */
  699. int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
  700. {
  701. struct file *file = cprm->file;
  702. loff_t pos = file->f_pos;
  703. ssize_t n;
  704. if (cprm->written + nr > cprm->limit)
  705. return 0;
  706. while (nr) {
  707. if (dump_interrupted())
  708. return 0;
  709. n = __kernel_write(file, addr, nr, &pos);
  710. if (n <= 0)
  711. return 0;
  712. file->f_pos = pos;
  713. cprm->written += n;
  714. cprm->pos += n;
  715. nr -= n;
  716. }
  717. return 1;
  718. }
  719. EXPORT_SYMBOL(dump_emit);
  720. int dump_skip(struct coredump_params *cprm, size_t nr)
  721. {
  722. static char zeroes[PAGE_SIZE];
  723. struct file *file = cprm->file;
  724. if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
  725. if (dump_interrupted() ||
  726. file->f_op->llseek(file, nr, SEEK_CUR) < 0)
  727. return 0;
  728. cprm->pos += nr;
  729. return 1;
  730. } else {
  731. while (nr > PAGE_SIZE) {
  732. if (!dump_emit(cprm, zeroes, PAGE_SIZE))
  733. return 0;
  734. nr -= PAGE_SIZE;
  735. }
  736. return dump_emit(cprm, zeroes, nr);
  737. }
  738. }
  739. EXPORT_SYMBOL(dump_skip);
  740. int dump_align(struct coredump_params *cprm, int align)
  741. {
  742. unsigned mod = cprm->pos & (align - 1);
  743. if (align & (align - 1))
  744. return 0;
  745. return mod ? dump_skip(cprm, align - mod) : 1;
  746. }
  747. EXPORT_SYMBOL(dump_align);
  748. /*
  749. * Ensures that file size is big enough to contain the current file
  750. * postion. This prevents gdb from complaining about a truncated file
  751. * if the last "write" to the file was dump_skip.
  752. */
  753. void dump_truncate(struct coredump_params *cprm)
  754. {
  755. struct file *file = cprm->file;
  756. loff_t offset;
  757. if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
  758. offset = file->f_op->llseek(file, 0, SEEK_CUR);
  759. if (i_size_read(file->f_mapping->host) < offset)
  760. do_truncate(file->f_path.dentry, offset, 0, file);
  761. }
  762. }
  763. EXPORT_SYMBOL(dump_truncate);