coredump.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852
  1. // SPDX-License-Identifier: GPL-2.0
  2. #include <linux/slab.h>
  3. #include <linux/file.h>
  4. #include <linux/fdtable.h>
  5. #include <linux/freezer.h>
  6. #include <linux/mm.h>
  7. #include <linux/stat.h>
  8. #include <linux/fcntl.h>
  9. #include <linux/swap.h>
  10. #include <linux/string.h>
  11. #include <linux/init.h>
  12. #include <linux/pagemap.h>
  13. #include <linux/perf_event.h>
  14. #include <linux/highmem.h>
  15. #include <linux/spinlock.h>
  16. #include <linux/key.h>
  17. #include <linux/personality.h>
  18. #include <linux/binfmts.h>
  19. #include <linux/coredump.h>
  20. #include <linux/sched/coredump.h>
  21. #include <linux/sched/signal.h>
  22. #include <linux/sched/task_stack.h>
  23. #include <linux/utsname.h>
  24. #include <linux/pid_namespace.h>
  25. #include <linux/module.h>
  26. #include <linux/namei.h>
  27. #include <linux/mount.h>
  28. #include <linux/security.h>
  29. #include <linux/syscalls.h>
  30. #include <linux/tsacct_kern.h>
  31. #include <linux/cn_proc.h>
  32. #include <linux/audit.h>
  33. #include <linux/tracehook.h>
  34. #include <linux/kmod.h>
  35. #include <linux/fsnotify.h>
  36. #include <linux/fs_struct.h>
  37. #include <linux/pipe_fs_i.h>
  38. #include <linux/oom.h>
  39. #include <linux/compat.h>
  40. #include <linux/fs.h>
  41. #include <linux/path.h>
  42. #include <linux/timekeeping.h>
  43. #include <linux/uaccess.h>
  44. #include <asm/mmu_context.h>
  45. #include <asm/tlb.h>
  46. #include <asm/exec.h>
  47. #include <trace/events/task.h>
  48. #include "internal.h"
  49. #include <trace/events/sched.h>
  50. int core_uses_pid;
  51. unsigned int core_pipe_limit;
  52. char core_pattern[CORENAME_MAX_SIZE] = "core";
  53. static int core_name_size = CORENAME_MAX_SIZE;
  54. struct core_name {
  55. char *corename;
  56. int used, size;
  57. };
  58. /* The maximal length of core_pattern is also specified in sysctl.c */
  59. static int expand_corename(struct core_name *cn, int size)
  60. {
  61. char *corename = krealloc(cn->corename, size, GFP_KERNEL);
  62. if (!corename)
  63. return -ENOMEM;
  64. if (size > core_name_size) /* racy but harmless */
  65. core_name_size = size;
  66. cn->size = ksize(corename);
  67. cn->corename = corename;
  68. return 0;
  69. }
  70. static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt,
  71. va_list arg)
  72. {
  73. int free, need;
  74. va_list arg_copy;
  75. again:
  76. free = cn->size - cn->used;
  77. va_copy(arg_copy, arg);
  78. need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);
  79. va_end(arg_copy);
  80. if (need < free) {
  81. cn->used += need;
  82. return 0;
  83. }
  84. if (!expand_corename(cn, cn->size + need - free + 1))
  85. goto again;
  86. return -ENOMEM;
  87. }
  88. static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...)
  89. {
  90. va_list arg;
  91. int ret;
  92. va_start(arg, fmt);
  93. ret = cn_vprintf(cn, fmt, arg);
  94. va_end(arg);
  95. return ret;
  96. }
  97. static __printf(2, 3)
  98. int cn_esc_printf(struct core_name *cn, const char *fmt, ...)
  99. {
  100. int cur = cn->used;
  101. va_list arg;
  102. int ret;
  103. va_start(arg, fmt);
  104. ret = cn_vprintf(cn, fmt, arg);
  105. va_end(arg);
  106. if (ret == 0) {
  107. /*
  108. * Ensure that this coredump name component can't cause the
  109. * resulting corefile path to consist of a ".." or ".".
  110. */
  111. if ((cn->used - cur == 1 && cn->corename[cur] == '.') ||
  112. (cn->used - cur == 2 && cn->corename[cur] == '.'
  113. && cn->corename[cur+1] == '.'))
  114. cn->corename[cur] = '!';
  115. /*
  116. * Empty names are fishy and could be used to create a "//" in a
  117. * corefile name, causing the coredump to happen one directory
  118. * level too high. Enforce that all components of the core
  119. * pattern are at least one character long.
  120. */
  121. if (cn->used == cur)
  122. ret = cn_printf(cn, "!");
  123. }
  124. for (; cur < cn->used; ++cur) {
  125. if (cn->corename[cur] == '/')
  126. cn->corename[cur] = '!';
  127. }
  128. return ret;
  129. }
  130. static int cn_print_exe_file(struct core_name *cn)
  131. {
  132. struct file *exe_file;
  133. char *pathbuf, *path;
  134. int ret;
  135. exe_file = get_mm_exe_file(current->mm);
  136. if (!exe_file)
  137. return cn_esc_printf(cn, "%s (path unknown)", current->comm);
  138. pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
  139. if (!pathbuf) {
  140. ret = -ENOMEM;
  141. goto put_exe_file;
  142. }
  143. path = file_path(exe_file, pathbuf, PATH_MAX);
  144. if (IS_ERR(path)) {
  145. ret = PTR_ERR(path);
  146. goto free_buf;
  147. }
  148. ret = cn_esc_printf(cn, "%s", path);
  149. free_buf:
  150. kfree(pathbuf);
  151. put_exe_file:
  152. fput(exe_file);
  153. return ret;
  154. }
  155. /* format_corename will inspect the pattern parameter, and output a
  156. * name into corename, which must have space for at least
  157. * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
  158. */
  159. static int format_corename(struct core_name *cn, struct coredump_params *cprm)
  160. {
  161. const struct cred *cred = current_cred();
  162. const char *pat_ptr = core_pattern;
  163. int ispipe = (*pat_ptr == '|');
  164. int pid_in_pattern = 0;
  165. int err = 0;
  166. cn->used = 0;
  167. cn->corename = NULL;
  168. if (expand_corename(cn, core_name_size))
  169. return -ENOMEM;
  170. cn->corename[0] = '\0';
  171. if (ispipe)
  172. ++pat_ptr;
  173. /* Repeat as long as we have more pattern to process and more output
  174. space */
  175. while (*pat_ptr) {
  176. if (*pat_ptr != '%') {
  177. err = cn_printf(cn, "%c", *pat_ptr++);
  178. } else {
  179. switch (*++pat_ptr) {
  180. /* single % at the end, drop that */
  181. case 0:
  182. goto out;
  183. /* Double percent, output one percent */
  184. case '%':
  185. err = cn_printf(cn, "%c", '%');
  186. break;
  187. /* pid */
  188. case 'p':
  189. pid_in_pattern = 1;
  190. err = cn_printf(cn, "%d",
  191. task_tgid_vnr(current));
  192. break;
  193. /* global pid */
  194. case 'P':
  195. err = cn_printf(cn, "%d",
  196. task_tgid_nr(current));
  197. break;
  198. case 'i':
  199. err = cn_printf(cn, "%d",
  200. task_pid_vnr(current));
  201. break;
  202. case 'I':
  203. err = cn_printf(cn, "%d",
  204. task_pid_nr(current));
  205. break;
  206. /* uid */
  207. case 'u':
  208. err = cn_printf(cn, "%u",
  209. from_kuid(&init_user_ns,
  210. cred->uid));
  211. break;
  212. /* gid */
  213. case 'g':
  214. err = cn_printf(cn, "%u",
  215. from_kgid(&init_user_ns,
  216. cred->gid));
  217. break;
  218. case 'd':
  219. err = cn_printf(cn, "%d",
  220. __get_dumpable(cprm->mm_flags));
  221. break;
  222. /* signal that caused the coredump */
  223. case 's':
  224. err = cn_printf(cn, "%d",
  225. cprm->siginfo->si_signo);
  226. break;
  227. /* UNIX time of coredump */
  228. case 't': {
  229. time64_t time;
  230. time = ktime_get_real_seconds();
  231. err = cn_printf(cn, "%lld", time);
  232. break;
  233. }
  234. /* hostname */
  235. case 'h':
  236. down_read(&uts_sem);
  237. err = cn_esc_printf(cn, "%s",
  238. utsname()->nodename);
  239. up_read(&uts_sem);
  240. break;
  241. /* executable */
  242. case 'e':
  243. err = cn_esc_printf(cn, "%s", current->comm);
  244. break;
  245. case 'E':
  246. err = cn_print_exe_file(cn);
  247. break;
  248. /* core limit size */
  249. case 'c':
  250. err = cn_printf(cn, "%lu",
  251. rlimit(RLIMIT_CORE));
  252. break;
  253. default:
  254. break;
  255. }
  256. ++pat_ptr;
  257. }
  258. if (err)
  259. return err;
  260. }
  261. out:
  262. /* Backward compatibility with core_uses_pid:
  263. *
  264. * If core_pattern does not include a %p (as is the default)
  265. * and core_uses_pid is set, then .%pid will be appended to
  266. * the filename. Do not do this for piped commands. */
  267. if (!ispipe && !pid_in_pattern && core_uses_pid) {
  268. err = cn_printf(cn, ".%d", task_tgid_vnr(current));
  269. if (err)
  270. return err;
  271. }
  272. return ispipe;
  273. }
  274. static int zap_process(struct task_struct *start, int exit_code, int flags)
  275. {
  276. struct task_struct *t;
  277. int nr = 0;
  278. /* ignore all signals except SIGKILL, see prepare_signal() */
  279. start->signal->flags = SIGNAL_GROUP_COREDUMP | flags;
  280. start->signal->group_exit_code = exit_code;
  281. start->signal->group_stop_count = 0;
  282. for_each_thread(start, t) {
  283. task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK);
  284. if (t != current && t->mm) {
  285. sigaddset(&t->pending.signal, SIGKILL);
  286. signal_wake_up(t, 1);
  287. nr++;
  288. }
  289. }
  290. return nr;
  291. }
  292. static int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
  293. struct core_state *core_state, int exit_code)
  294. {
  295. struct task_struct *g, *p;
  296. unsigned long flags;
  297. int nr = -EAGAIN;
  298. spin_lock_irq(&tsk->sighand->siglock);
  299. if (!signal_group_exit(tsk->signal)) {
  300. mm->core_state = core_state;
  301. tsk->signal->group_exit_task = tsk;
  302. nr = zap_process(tsk, exit_code, 0);
  303. clear_tsk_thread_flag(tsk, TIF_SIGPENDING);
  304. }
  305. spin_unlock_irq(&tsk->sighand->siglock);
  306. if (unlikely(nr < 0))
  307. return nr;
  308. tsk->flags |= PF_DUMPCORE;
  309. if (atomic_read(&mm->mm_users) == nr + 1)
  310. goto done;
  311. /*
  312. * We should find and kill all tasks which use this mm, and we should
  313. * count them correctly into ->nr_threads. We don't take tasklist
  314. * lock, but this is safe wrt:
  315. *
  316. * fork:
  317. * None of sub-threads can fork after zap_process(leader). All
  318. * processes which were created before this point should be
  319. * visible to zap_threads() because copy_process() adds the new
  320. * process to the tail of init_task.tasks list, and lock/unlock
  321. * of ->siglock provides a memory barrier.
  322. *
  323. * do_exit:
  324. * The caller holds mm->mmap_sem. This means that the task which
  325. * uses this mm can't pass exit_mm(), so it can't exit or clear
  326. * its ->mm.
  327. *
  328. * de_thread:
  329. * It does list_replace_rcu(&leader->tasks, &current->tasks),
  330. * we must see either old or new leader, this does not matter.
  331. * However, it can change p->sighand, so lock_task_sighand(p)
  332. * must be used. Since p->mm != NULL and we hold ->mmap_sem
  333. * it can't fail.
  334. *
  335. * Note also that "g" can be the old leader with ->mm == NULL
  336. * and already unhashed and thus removed from ->thread_group.
  337. * This is OK, __unhash_process()->list_del_rcu() does not
  338. * clear the ->next pointer, we will find the new leader via
  339. * next_thread().
  340. */
  341. rcu_read_lock();
  342. for_each_process(g) {
  343. if (g == tsk->group_leader)
  344. continue;
  345. if (g->flags & PF_KTHREAD)
  346. continue;
  347. for_each_thread(g, p) {
  348. if (unlikely(!p->mm))
  349. continue;
  350. if (unlikely(p->mm == mm)) {
  351. lock_task_sighand(p, &flags);
  352. nr += zap_process(p, exit_code,
  353. SIGNAL_GROUP_EXIT);
  354. unlock_task_sighand(p, &flags);
  355. }
  356. break;
  357. }
  358. }
  359. rcu_read_unlock();
  360. done:
  361. atomic_set(&core_state->nr_threads, nr);
  362. return nr;
  363. }
  364. static int coredump_wait(int exit_code, struct core_state *core_state)
  365. {
  366. struct task_struct *tsk = current;
  367. struct mm_struct *mm = tsk->mm;
  368. int core_waiters = -EBUSY;
  369. init_completion(&core_state->startup);
  370. core_state->dumper.task = tsk;
  371. core_state->dumper.next = NULL;
  372. if (down_write_killable(&mm->mmap_sem))
  373. return -EINTR;
  374. if (!mm->core_state)
  375. core_waiters = zap_threads(tsk, mm, core_state, exit_code);
  376. up_write(&mm->mmap_sem);
  377. if (core_waiters > 0) {
  378. struct core_thread *ptr;
  379. freezer_do_not_count();
  380. wait_for_completion(&core_state->startup);
  381. freezer_count();
  382. /*
  383. * Wait for all the threads to become inactive, so that
  384. * all the thread context (extended register state, like
  385. * fpu etc) gets copied to the memory.
  386. */
  387. ptr = core_state->dumper.next;
  388. while (ptr != NULL) {
  389. wait_task_inactive(ptr->task, 0);
  390. ptr = ptr->next;
  391. }
  392. }
  393. return core_waiters;
  394. }
  395. static void coredump_finish(struct mm_struct *mm, bool core_dumped)
  396. {
  397. struct core_thread *curr, *next;
  398. struct task_struct *task;
  399. spin_lock_irq(&current->sighand->siglock);
  400. if (core_dumped && !__fatal_signal_pending(current))
  401. current->signal->group_exit_code |= 0x80;
  402. current->signal->group_exit_task = NULL;
  403. current->signal->flags = SIGNAL_GROUP_EXIT;
  404. spin_unlock_irq(&current->sighand->siglock);
  405. next = mm->core_state->dumper.next;
  406. while ((curr = next) != NULL) {
  407. next = curr->next;
  408. task = curr->task;
  409. /*
  410. * see exit_mm(), curr->task must not see
  411. * ->task == NULL before we read ->next.
  412. */
  413. smp_mb();
  414. curr->task = NULL;
  415. wake_up_process(task);
  416. }
  417. mm->core_state = NULL;
  418. }
  419. static bool dump_interrupted(void)
  420. {
  421. /*
  422. * SIGKILL or freezing() interrupt the coredumping. Perhaps we
  423. * can do try_to_freeze() and check __fatal_signal_pending(),
  424. * but then we need to teach dump_write() to restart and clear
  425. * TIF_SIGPENDING.
  426. */
  427. return signal_pending(current);
  428. }
  429. static void wait_for_dump_helpers(struct file *file)
  430. {
  431. struct pipe_inode_info *pipe = file->private_data;
  432. pipe_lock(pipe);
  433. pipe->readers++;
  434. pipe->writers--;
  435. wake_up_interruptible_sync(&pipe->wait);
  436. kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
  437. pipe_unlock(pipe);
  438. /*
  439. * We actually want wait_event_freezable() but then we need
  440. * to clear TIF_SIGPENDING and improve dump_interrupted().
  441. */
  442. wait_event_interruptible(pipe->wait, pipe->readers == 1);
  443. pipe_lock(pipe);
  444. pipe->readers--;
  445. pipe->writers++;
  446. pipe_unlock(pipe);
  447. }
  448. /*
  449. * umh_pipe_setup
  450. * helper function to customize the process used
  451. * to collect the core in userspace. Specifically
  452. * it sets up a pipe and installs it as fd 0 (stdin)
  453. * for the process. Returns 0 on success, or
  454. * PTR_ERR on failure.
  455. * Note that it also sets the core limit to 1. This
  456. * is a special value that we use to trap recursive
  457. * core dumps
  458. */
  459. static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
  460. {
  461. struct file *files[2];
  462. struct coredump_params *cp = (struct coredump_params *)info->data;
  463. int err = create_pipe_files(files, 0);
  464. if (err)
  465. return err;
  466. cp->file = files[1];
  467. err = replace_fd(0, files[0], 0);
  468. fput(files[0]);
  469. /* and disallow core files too */
  470. current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};
  471. return err;
  472. }
  473. void do_coredump(const siginfo_t *siginfo)
  474. {
  475. struct core_state core_state;
  476. struct core_name cn;
  477. struct mm_struct *mm = current->mm;
  478. struct linux_binfmt * binfmt;
  479. const struct cred *old_cred;
  480. struct cred *cred;
  481. int retval = 0;
  482. int ispipe;
  483. struct files_struct *displaced;
  484. /* require nonrelative corefile path and be extra careful */
  485. bool need_suid_safe = false;
  486. bool core_dumped = false;
  487. static atomic_t core_dump_count = ATOMIC_INIT(0);
  488. struct coredump_params cprm = {
  489. .siginfo = siginfo,
  490. .regs = signal_pt_regs(),
  491. .limit = rlimit(RLIMIT_CORE),
  492. /*
  493. * We must use the same mm->flags while dumping core to avoid
  494. * inconsistency of bit flags, since this flag is not protected
  495. * by any locks.
  496. */
  497. .mm_flags = mm->flags,
  498. };
  499. audit_core_dumps(siginfo->si_signo);
  500. binfmt = mm->binfmt;
  501. if (!binfmt || !binfmt->core_dump)
  502. goto fail;
  503. if (!__get_dumpable(cprm.mm_flags))
  504. goto fail;
  505. cred = prepare_creds();
  506. if (!cred)
  507. goto fail;
  508. /*
  509. * We cannot trust fsuid as being the "true" uid of the process
  510. * nor do we know its entire history. We only know it was tainted
  511. * so we dump it as root in mode 2, and only into a controlled
  512. * environment (pipe handler or fully qualified path).
  513. */
  514. if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {
  515. /* Setuid core dump mode */
  516. cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */
  517. need_suid_safe = true;
  518. }
  519. retval = coredump_wait(siginfo->si_signo, &core_state);
  520. if (retval < 0)
  521. goto fail_creds;
  522. old_cred = override_creds(cred);
  523. ispipe = format_corename(&cn, &cprm);
  524. if (ispipe) {
  525. int dump_count;
  526. char **helper_argv;
  527. struct subprocess_info *sub_info;
  528. if (ispipe < 0) {
  529. printk(KERN_WARNING "format_corename failed\n");
  530. printk(KERN_WARNING "Aborting core\n");
  531. goto fail_unlock;
  532. }
  533. if (cprm.limit == 1) {
  534. /* See umh_pipe_setup() which sets RLIMIT_CORE = 1.
  535. *
  536. * Normally core limits are irrelevant to pipes, since
  537. * we're not writing to the file system, but we use
  538. * cprm.limit of 1 here as a special value, this is a
  539. * consistent way to catch recursive crashes.
  540. * We can still crash if the core_pattern binary sets
  541. * RLIM_CORE = !1, but it runs as root, and can do
  542. * lots of stupid things.
  543. *
  544. * Note that we use task_tgid_vnr here to grab the pid
  545. * of the process group leader. That way we get the
  546. * right pid if a thread in a multi-threaded
  547. * core_pattern process dies.
  548. */
  549. printk(KERN_WARNING
  550. "Process %d(%s) has RLIMIT_CORE set to 1\n",
  551. task_tgid_vnr(current), current->comm);
  552. printk(KERN_WARNING "Aborting core\n");
  553. goto fail_unlock;
  554. }
  555. cprm.limit = RLIM_INFINITY;
  556. dump_count = atomic_inc_return(&core_dump_count);
  557. if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  558. printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  559. task_tgid_vnr(current), current->comm);
  560. printk(KERN_WARNING "Skipping core dump\n");
  561. goto fail_dropcount;
  562. }
  563. helper_argv = argv_split(GFP_KERNEL, cn.corename, NULL);
  564. if (!helper_argv) {
  565. printk(KERN_WARNING "%s failed to allocate memory\n",
  566. __func__);
  567. goto fail_dropcount;
  568. }
  569. retval = -ENOMEM;
  570. sub_info = call_usermodehelper_setup(helper_argv[0],
  571. helper_argv, NULL, GFP_KERNEL,
  572. umh_pipe_setup, NULL, &cprm);
  573. if (sub_info)
  574. retval = call_usermodehelper_exec(sub_info,
  575. UMH_WAIT_EXEC);
  576. argv_free(helper_argv);
  577. if (retval) {
  578. printk(KERN_INFO "Core dump to |%s pipe failed\n",
  579. cn.corename);
  580. goto close_fail;
  581. }
  582. } else {
  583. struct inode *inode;
  584. int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW |
  585. O_LARGEFILE | O_EXCL;
  586. if (cprm.limit < binfmt->min_coredump)
  587. goto fail_unlock;
  588. if (need_suid_safe && cn.corename[0] != '/') {
  589. printk(KERN_WARNING "Pid %d(%s) can only dump core "\
  590. "to fully qualified path!\n",
  591. task_tgid_vnr(current), current->comm);
  592. printk(KERN_WARNING "Skipping core dump\n");
  593. goto fail_unlock;
  594. }
  595. /*
  596. * Unlink the file if it exists unless this is a SUID
  597. * binary - in that case, we're running around with root
  598. * privs and don't want to unlink another user's coredump.
  599. */
  600. if (!need_suid_safe) {
  601. /*
  602. * If it doesn't exist, that's fine. If there's some
  603. * other problem, we'll catch it at the filp_open().
  604. */
  605. do_unlinkat(AT_FDCWD, getname_kernel(cn.corename));
  606. }
  607. /*
  608. * There is a race between unlinking and creating the
  609. * file, but if that causes an EEXIST here, that's
  610. * fine - another process raced with us while creating
  611. * the corefile, and the other process won. To userspace,
  612. * what matters is that at least one of the two processes
  613. * writes its coredump successfully, not which one.
  614. */
  615. if (need_suid_safe) {
  616. /*
  617. * Using user namespaces, normal user tasks can change
  618. * their current->fs->root to point to arbitrary
  619. * directories. Since the intention of the "only dump
  620. * with a fully qualified path" rule is to control where
  621. * coredumps may be placed using root privileges,
  622. * current->fs->root must not be used. Instead, use the
  623. * root directory of init_task.
  624. */
  625. struct path root;
  626. task_lock(&init_task);
  627. get_fs_root(init_task.fs, &root);
  628. task_unlock(&init_task);
  629. cprm.file = file_open_root(root.dentry, root.mnt,
  630. cn.corename, open_flags, 0600);
  631. path_put(&root);
  632. } else {
  633. cprm.file = filp_open(cn.corename, open_flags, 0600);
  634. }
  635. if (IS_ERR(cprm.file))
  636. goto fail_unlock;
  637. inode = file_inode(cprm.file);
  638. if (inode->i_nlink > 1)
  639. goto close_fail;
  640. if (d_unhashed(cprm.file->f_path.dentry))
  641. goto close_fail;
  642. /*
  643. * AK: actually i see no reason to not allow this for named
  644. * pipes etc, but keep the previous behaviour for now.
  645. */
  646. if (!S_ISREG(inode->i_mode))
  647. goto close_fail;
  648. /*
  649. * Don't dump core if the filesystem changed owner or mode
  650. * of the file during file creation. This is an issue when
  651. * a process dumps core while its cwd is e.g. on a vfat
  652. * filesystem.
  653. */
  654. if (!uid_eq(inode->i_uid, current_fsuid()))
  655. goto close_fail;
  656. if ((inode->i_mode & 0677) != 0600)
  657. goto close_fail;
  658. if (!(cprm.file->f_mode & FMODE_CAN_WRITE))
  659. goto close_fail;
  660. if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file))
  661. goto close_fail;
  662. }
  663. /* get us an unshared descriptor table; almost always a no-op */
  664. retval = unshare_files(&displaced);
  665. if (retval)
  666. goto close_fail;
  667. if (displaced)
  668. put_files_struct(displaced);
  669. if (!dump_interrupted()) {
  670. file_start_write(cprm.file);
  671. core_dumped = binfmt->core_dump(&cprm);
  672. file_end_write(cprm.file);
  673. }
  674. if (ispipe && core_pipe_limit)
  675. wait_for_dump_helpers(cprm.file);
  676. close_fail:
  677. if (cprm.file)
  678. filp_close(cprm.file, NULL);
  679. fail_dropcount:
  680. if (ispipe)
  681. atomic_dec(&core_dump_count);
  682. fail_unlock:
  683. kfree(cn.corename);
  684. coredump_finish(mm, core_dumped);
  685. revert_creds(old_cred);
  686. fail_creds:
  687. put_cred(cred);
  688. fail:
  689. return;
  690. }
  691. /*
  692. * Core dumping helper functions. These are the only things you should
  693. * do on a core-file: use only these functions to write out all the
  694. * necessary info.
  695. */
  696. int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
  697. {
  698. struct file *file = cprm->file;
  699. loff_t pos = file->f_pos;
  700. ssize_t n;
  701. if (cprm->written + nr > cprm->limit)
  702. return 0;
  703. while (nr) {
  704. if (dump_interrupted())
  705. return 0;
  706. n = __kernel_write(file, addr, nr, &pos);
  707. if (n <= 0)
  708. return 0;
  709. file->f_pos = pos;
  710. cprm->written += n;
  711. cprm->pos += n;
  712. nr -= n;
  713. }
  714. return 1;
  715. }
  716. EXPORT_SYMBOL(dump_emit);
  717. int dump_skip(struct coredump_params *cprm, size_t nr)
  718. {
  719. static char zeroes[PAGE_SIZE];
  720. struct file *file = cprm->file;
  721. if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
  722. if (dump_interrupted() ||
  723. file->f_op->llseek(file, nr, SEEK_CUR) < 0)
  724. return 0;
  725. cprm->pos += nr;
  726. return 1;
  727. } else {
  728. while (nr > PAGE_SIZE) {
  729. if (!dump_emit(cprm, zeroes, PAGE_SIZE))
  730. return 0;
  731. nr -= PAGE_SIZE;
  732. }
  733. return dump_emit(cprm, zeroes, nr);
  734. }
  735. }
  736. EXPORT_SYMBOL(dump_skip);
  737. int dump_align(struct coredump_params *cprm, int align)
  738. {
  739. unsigned mod = cprm->pos & (align - 1);
  740. if (align & (align - 1))
  741. return 0;
  742. return mod ? dump_skip(cprm, align - mod) : 1;
  743. }
  744. EXPORT_SYMBOL(dump_align);
  745. /*
  746. * Ensures that file size is big enough to contain the current file
  747. * postion. This prevents gdb from complaining about a truncated file
  748. * if the last "write" to the file was dump_skip.
  749. */
  750. void dump_truncate(struct coredump_params *cprm)
  751. {
  752. struct file *file = cprm->file;
  753. loff_t offset;
  754. if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
  755. offset = file->f_op->llseek(file, 0, SEEK_CUR);
  756. if (i_size_read(file->f_mapping->host) < offset)
  757. do_truncate(file->f_path.dentry, offset, 0, file);
  758. }
  759. }
  760. EXPORT_SYMBOL(dump_truncate);