blob: 592683711c6432e3a9fa8eabcb95a7934b2b5571 [file] [log] [blame]
Alex Kelly10c28d92012-09-26 21:52:08 -04001#include <linux/slab.h>
2#include <linux/file.h>
3#include <linux/fdtable.h>
Andrey Ryabinin70d78fe2016-11-10 10:46:38 -08004#include <linux/freezer.h>
Alex Kelly10c28d92012-09-26 21:52:08 -04005#include <linux/mm.h>
6#include <linux/stat.h>
7#include <linux/fcntl.h>
8#include <linux/swap.h>
9#include <linux/string.h>
10#include <linux/init.h>
11#include <linux/pagemap.h>
12#include <linux/perf_event.h>
13#include <linux/highmem.h>
14#include <linux/spinlock.h>
15#include <linux/key.h>
16#include <linux/personality.h>
17#include <linux/binfmts.h>
Alex Kelly179899f2012-10-04 17:15:24 -070018#include <linux/coredump.h>
Ingo Molnarf7ccbae2017-02-08 18:51:30 +010019#include <linux/sched/coredump.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010020#include <linux/sched/signal.h>
Ingo Molnar68db0cf2017-02-08 18:51:37 +010021#include <linux/sched/task_stack.h>
Alex Kelly10c28d92012-09-26 21:52:08 -040022#include <linux/utsname.h>
23#include <linux/pid_namespace.h>
24#include <linux/module.h>
25#include <linux/namei.h>
26#include <linux/mount.h>
27#include <linux/security.h>
28#include <linux/syscalls.h>
29#include <linux/tsacct_kern.h>
30#include <linux/cn_proc.h>
31#include <linux/audit.h>
32#include <linux/tracehook.h>
33#include <linux/kmod.h>
34#include <linux/fsnotify.h>
35#include <linux/fs_struct.h>
36#include <linux/pipe_fs_i.h>
37#include <linux/oom.h>
38#include <linux/compat.h>
Jann Horn378c6522016-03-22 14:25:36 -070039#include <linux/fs.h>
40#include <linux/path.h>
Arnd Bergmann03927c82015-11-25 16:22:25 +010041#include <linux/timekeeping.h>
Alex Kelly10c28d92012-09-26 21:52:08 -040042
Linus Torvalds7c0f6ba2016-12-24 11:46:01 -080043#include <linux/uaccess.h>
Alex Kelly10c28d92012-09-26 21:52:08 -040044#include <asm/mmu_context.h>
45#include <asm/tlb.h>
46#include <asm/exec.h>
47
48#include <trace/events/task.h>
49#include "internal.h"
Alex Kelly10c28d92012-09-26 21:52:08 -040050
51#include <trace/events/sched.h>
52
53int core_uses_pid;
Alex Kelly10c28d92012-09-26 21:52:08 -040054unsigned int core_pipe_limit;
Oleg Nesterov3ceadcf2013-07-03 15:08:22 -070055char core_pattern[CORENAME_MAX_SIZE] = "core";
56static int core_name_size = CORENAME_MAX_SIZE;
Alex Kelly10c28d92012-09-26 21:52:08 -040057
58struct core_name {
59 char *corename;
60 int used, size;
61};
Alex Kelly10c28d92012-09-26 21:52:08 -040062
63/* The maximal length of core_pattern is also specified in sysctl.c */
64
Oleg Nesterov3ceadcf2013-07-03 15:08:22 -070065static int expand_corename(struct core_name *cn, int size)
Alex Kelly10c28d92012-09-26 21:52:08 -040066{
Oleg Nesterove7fd1542013-07-03 15:08:16 -070067 char *corename = krealloc(cn->corename, size, GFP_KERNEL);
Alex Kelly10c28d92012-09-26 21:52:08 -040068
Oleg Nesterove7fd1542013-07-03 15:08:16 -070069 if (!corename)
Alex Kelly10c28d92012-09-26 21:52:08 -040070 return -ENOMEM;
Alex Kelly10c28d92012-09-26 21:52:08 -040071
Oleg Nesterov3ceadcf2013-07-03 15:08:22 -070072 if (size > core_name_size) /* racy but harmless */
73 core_name_size = size;
74
75 cn->size = ksize(corename);
Oleg Nesterove7fd1542013-07-03 15:08:16 -070076 cn->corename = corename;
Alex Kelly10c28d92012-09-26 21:52:08 -040077 return 0;
78}
79
Nicolas Ioossb4176b72015-06-25 15:03:53 -070080static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt,
81 va_list arg)
Alex Kelly10c28d92012-09-26 21:52:08 -040082{
Oleg Nesterov5fe9d8c2013-07-03 15:08:19 -070083 int free, need;
Eric Dumazet404ca802014-04-19 10:15:07 -070084 va_list arg_copy;
Alex Kelly10c28d92012-09-26 21:52:08 -040085
Oleg Nesterov5fe9d8c2013-07-03 15:08:19 -070086again:
87 free = cn->size - cn->used;
Eric Dumazet404ca802014-04-19 10:15:07 -070088
89 va_copy(arg_copy, arg);
90 need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);
91 va_end(arg_copy);
92
Oleg Nesterov5fe9d8c2013-07-03 15:08:19 -070093 if (need < free) {
94 cn->used += need;
95 return 0;
96 }
Alex Kelly10c28d92012-09-26 21:52:08 -040097
Oleg Nesterov3ceadcf2013-07-03 15:08:22 -070098 if (!expand_corename(cn, cn->size + need - free + 1))
Oleg Nesterov5fe9d8c2013-07-03 15:08:19 -070099 goto again;
Alex Kelly10c28d92012-09-26 21:52:08 -0400100
Oleg Nesterov5fe9d8c2013-07-03 15:08:19 -0700101 return -ENOMEM;
Alex Kelly10c28d92012-09-26 21:52:08 -0400102}
103
Nicolas Ioossb4176b72015-06-25 15:03:53 -0700104static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...)
Oleg Nesterovbc03c692013-07-03 15:08:17 -0700105{
106 va_list arg;
107 int ret;
108
109 va_start(arg, fmt);
110 ret = cn_vprintf(cn, fmt, arg);
111 va_end(arg);
112
113 return ret;
114}
115
Nicolas Ioossb4176b72015-06-25 15:03:53 -0700116static __printf(2, 3)
117int cn_esc_printf(struct core_name *cn, const char *fmt, ...)
Alex Kelly10c28d92012-09-26 21:52:08 -0400118{
Oleg Nesterov923bed032013-07-03 15:08:20 -0700119 int cur = cn->used;
120 va_list arg;
121 int ret;
122
123 va_start(arg, fmt);
124 ret = cn_vprintf(cn, fmt, arg);
125 va_end(arg);
126
Jann Hornac94b6e2016-01-20 15:00:08 -0800127 if (ret == 0) {
128 /*
129 * Ensure that this coredump name component can't cause the
130 * resulting corefile path to consist of a ".." or ".".
131 */
132 if ((cn->used - cur == 1 && cn->corename[cur] == '.') ||
133 (cn->used - cur == 2 && cn->corename[cur] == '.'
134 && cn->corename[cur+1] == '.'))
135 cn->corename[cur] = '!';
136
137 /*
138 * Empty names are fishy and could be used to create a "//" in a
139 * corefile name, causing the coredump to happen one directory
140 * level too high. Enforce that all components of the core
141 * pattern are at least one character long.
142 */
143 if (cn->used == cur)
144 ret = cn_printf(cn, "!");
145 }
146
Oleg Nesterov923bed032013-07-03 15:08:20 -0700147 for (; cur < cn->used; ++cur) {
148 if (cn->corename[cur] == '/')
149 cn->corename[cur] = '!';
150 }
151 return ret;
Alex Kelly10c28d92012-09-26 21:52:08 -0400152}
153
154static int cn_print_exe_file(struct core_name *cn)
155{
156 struct file *exe_file;
157 char *pathbuf, *path;
158 int ret;
159
160 exe_file = get_mm_exe_file(current->mm);
Oleg Nesterov923bed032013-07-03 15:08:20 -0700161 if (!exe_file)
162 return cn_esc_printf(cn, "%s (path unknown)", current->comm);
Alex Kelly10c28d92012-09-26 21:52:08 -0400163
164 pathbuf = kmalloc(PATH_MAX, GFP_TEMPORARY);
165 if (!pathbuf) {
166 ret = -ENOMEM;
167 goto put_exe_file;
168 }
169
Miklos Szeredi9bf39ab2015-06-19 10:29:13 +0200170 path = file_path(exe_file, pathbuf, PATH_MAX);
Alex Kelly10c28d92012-09-26 21:52:08 -0400171 if (IS_ERR(path)) {
172 ret = PTR_ERR(path);
173 goto free_buf;
174 }
175
Oleg Nesterov923bed032013-07-03 15:08:20 -0700176 ret = cn_esc_printf(cn, "%s", path);
Alex Kelly10c28d92012-09-26 21:52:08 -0400177
178free_buf:
179 kfree(pathbuf);
180put_exe_file:
181 fput(exe_file);
182 return ret;
183}
184
185/* format_corename will inspect the pattern parameter, and output a
186 * name into corename, which must have space for at least
187 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
188 */
Oleg Nesterov12a2b4b2012-10-04 17:15:25 -0700189static int format_corename(struct core_name *cn, struct coredump_params *cprm)
Alex Kelly10c28d92012-09-26 21:52:08 -0400190{
191 const struct cred *cred = current_cred();
192 const char *pat_ptr = core_pattern;
193 int ispipe = (*pat_ptr == '|');
194 int pid_in_pattern = 0;
195 int err = 0;
196
Oleg Nesterove7fd1542013-07-03 15:08:16 -0700197 cn->used = 0;
Oleg Nesterov3ceadcf2013-07-03 15:08:22 -0700198 cn->corename = NULL;
199 if (expand_corename(cn, core_name_size))
Alex Kelly10c28d92012-09-26 21:52:08 -0400200 return -ENOMEM;
Oleg Nesterov888ffc52013-07-03 15:08:23 -0700201 cn->corename[0] = '\0';
202
203 if (ispipe)
204 ++pat_ptr;
Alex Kelly10c28d92012-09-26 21:52:08 -0400205
206 /* Repeat as long as we have more pattern to process and more output
207 space */
208 while (*pat_ptr) {
209 if (*pat_ptr != '%') {
Alex Kelly10c28d92012-09-26 21:52:08 -0400210 err = cn_printf(cn, "%c", *pat_ptr++);
211 } else {
212 switch (*++pat_ptr) {
213 /* single % at the end, drop that */
214 case 0:
215 goto out;
216 /* Double percent, output one percent */
217 case '%':
218 err = cn_printf(cn, "%c", '%');
219 break;
220 /* pid */
221 case 'p':
222 pid_in_pattern = 1;
223 err = cn_printf(cn, "%d",
224 task_tgid_vnr(current));
225 break;
Stéphane Graber65aafb12013-09-11 14:24:32 -0700226 /* global pid */
227 case 'P':
228 err = cn_printf(cn, "%d",
229 task_tgid_nr(current));
230 break;
Oleg Nesterovb03023e2014-10-13 15:53:35 -0700231 case 'i':
232 err = cn_printf(cn, "%d",
233 task_pid_vnr(current));
234 break;
235 case 'I':
236 err = cn_printf(cn, "%d",
237 task_pid_nr(current));
238 break;
Alex Kelly10c28d92012-09-26 21:52:08 -0400239 /* uid */
240 case 'u':
Nicolas Iooss5202efe2015-06-25 15:03:51 -0700241 err = cn_printf(cn, "%u",
242 from_kuid(&init_user_ns,
243 cred->uid));
Alex Kelly10c28d92012-09-26 21:52:08 -0400244 break;
245 /* gid */
246 case 'g':
Nicolas Iooss5202efe2015-06-25 15:03:51 -0700247 err = cn_printf(cn, "%u",
248 from_kgid(&init_user_ns,
249 cred->gid));
Alex Kelly10c28d92012-09-26 21:52:08 -0400250 break;
Oleg Nesterov12a2b4b2012-10-04 17:15:25 -0700251 case 'd':
252 err = cn_printf(cn, "%d",
253 __get_dumpable(cprm->mm_flags));
254 break;
Alex Kelly10c28d92012-09-26 21:52:08 -0400255 /* signal that caused the coredump */
256 case 's':
Nicolas Ioossb4176b72015-06-25 15:03:53 -0700257 err = cn_printf(cn, "%d",
258 cprm->siginfo->si_signo);
Alex Kelly10c28d92012-09-26 21:52:08 -0400259 break;
260 /* UNIX time of coredump */
261 case 't': {
Arnd Bergmann03927c82015-11-25 16:22:25 +0100262 time64_t time;
263
264 time = ktime_get_real_seconds();
265 err = cn_printf(cn, "%lld", time);
Alex Kelly10c28d92012-09-26 21:52:08 -0400266 break;
267 }
268 /* hostname */
Oleg Nesterov923bed032013-07-03 15:08:20 -0700269 case 'h':
Alex Kelly10c28d92012-09-26 21:52:08 -0400270 down_read(&uts_sem);
Oleg Nesterov923bed032013-07-03 15:08:20 -0700271 err = cn_esc_printf(cn, "%s",
Alex Kelly10c28d92012-09-26 21:52:08 -0400272 utsname()->nodename);
273 up_read(&uts_sem);
Alex Kelly10c28d92012-09-26 21:52:08 -0400274 break;
Alex Kelly10c28d92012-09-26 21:52:08 -0400275 /* executable */
Oleg Nesterov923bed032013-07-03 15:08:20 -0700276 case 'e':
277 err = cn_esc_printf(cn, "%s", current->comm);
Alex Kelly10c28d92012-09-26 21:52:08 -0400278 break;
Alex Kelly10c28d92012-09-26 21:52:08 -0400279 case 'E':
280 err = cn_print_exe_file(cn);
281 break;
282 /* core limit size */
283 case 'c':
284 err = cn_printf(cn, "%lu",
285 rlimit(RLIMIT_CORE));
286 break;
287 default:
288 break;
289 }
290 ++pat_ptr;
291 }
292
293 if (err)
294 return err;
295 }
296
Oleg Nesterov888ffc52013-07-03 15:08:23 -0700297out:
Alex Kelly10c28d92012-09-26 21:52:08 -0400298 /* Backward compatibility with core_uses_pid:
299 *
300 * If core_pattern does not include a %p (as is the default)
301 * and core_uses_pid is set, then .%pid will be appended to
302 * the filename. Do not do this for piped commands. */
303 if (!ispipe && !pid_in_pattern && core_uses_pid) {
304 err = cn_printf(cn, ".%d", task_tgid_vnr(current));
305 if (err)
306 return err;
307 }
Alex Kelly10c28d92012-09-26 21:52:08 -0400308 return ispipe;
309}
310
Oleg Nesterov5fa534c2015-11-06 16:32:31 -0800311static int zap_process(struct task_struct *start, int exit_code, int flags)
Alex Kelly10c28d92012-09-26 21:52:08 -0400312{
313 struct task_struct *t;
314 int nr = 0;
315
Oleg Nesterov5fa534c2015-11-06 16:32:31 -0800316 /* ignore all signals except SIGKILL, see prepare_signal() */
317 start->signal->flags = SIGNAL_GROUP_COREDUMP | flags;
Alex Kelly10c28d92012-09-26 21:52:08 -0400318 start->signal->group_exit_code = exit_code;
319 start->signal->group_stop_count = 0;
320
Oleg Nesterovd61ba582015-11-06 16:32:34 -0800321 for_each_thread(start, t) {
Alex Kelly10c28d92012-09-26 21:52:08 -0400322 task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK);
323 if (t != current && t->mm) {
324 sigaddset(&t->pending.signal, SIGKILL);
325 signal_wake_up(t, 1);
326 nr++;
327 }
Oleg Nesterovd61ba582015-11-06 16:32:34 -0800328 }
Alex Kelly10c28d92012-09-26 21:52:08 -0400329
330 return nr;
331}
332
Oleg Nesterov403bad72013-04-30 15:28:10 -0700333static int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
334 struct core_state *core_state, int exit_code)
Alex Kelly10c28d92012-09-26 21:52:08 -0400335{
336 struct task_struct *g, *p;
337 unsigned long flags;
338 int nr = -EAGAIN;
339
340 spin_lock_irq(&tsk->sighand->siglock);
341 if (!signal_group_exit(tsk->signal)) {
342 mm->core_state = core_state;
Oleg Nesterov6cd8f0a2013-04-30 15:28:12 -0700343 tsk->signal->group_exit_task = tsk;
Oleg Nesterov5fa534c2015-11-06 16:32:31 -0800344 nr = zap_process(tsk, exit_code, 0);
Oleg Nesterov403bad72013-04-30 15:28:10 -0700345 clear_tsk_thread_flag(tsk, TIF_SIGPENDING);
Alex Kelly10c28d92012-09-26 21:52:08 -0400346 }
347 spin_unlock_irq(&tsk->sighand->siglock);
348 if (unlikely(nr < 0))
349 return nr;
350
Silesh C Vaed8adb2014-07-23 13:59:59 -0700351 tsk->flags |= PF_DUMPCORE;
Alex Kelly10c28d92012-09-26 21:52:08 -0400352 if (atomic_read(&mm->mm_users) == nr + 1)
353 goto done;
354 /*
355 * We should find and kill all tasks which use this mm, and we should
356 * count them correctly into ->nr_threads. We don't take tasklist
357 * lock, but this is safe wrt:
358 *
359 * fork:
360 * None of sub-threads can fork after zap_process(leader). All
361 * processes which were created before this point should be
362 * visible to zap_threads() because copy_process() adds the new
363 * process to the tail of init_task.tasks list, and lock/unlock
364 * of ->siglock provides a memory barrier.
365 *
366 * do_exit:
367 * The caller holds mm->mmap_sem. This means that the task which
368 * uses this mm can't pass exit_mm(), so it can't exit or clear
369 * its ->mm.
370 *
371 * de_thread:
372 * It does list_replace_rcu(&leader->tasks, &current->tasks),
373 * we must see either old or new leader, this does not matter.
374 * However, it can change p->sighand, so lock_task_sighand(p)
375 * must be used. Since p->mm != NULL and we hold ->mmap_sem
376 * it can't fail.
377 *
378 * Note also that "g" can be the old leader with ->mm == NULL
379 * and already unhashed and thus removed from ->thread_group.
380 * This is OK, __unhash_process()->list_del_rcu() does not
381 * clear the ->next pointer, we will find the new leader via
382 * next_thread().
383 */
384 rcu_read_lock();
385 for_each_process(g) {
386 if (g == tsk->group_leader)
387 continue;
388 if (g->flags & PF_KTHREAD)
389 continue;
Oleg Nesterovd61ba582015-11-06 16:32:34 -0800390
391 for_each_thread(g, p) {
392 if (unlikely(!p->mm))
393 continue;
394 if (unlikely(p->mm == mm)) {
395 lock_task_sighand(p, &flags);
396 nr += zap_process(p, exit_code,
397 SIGNAL_GROUP_EXIT);
398 unlock_task_sighand(p, &flags);
Alex Kelly10c28d92012-09-26 21:52:08 -0400399 }
Oleg Nesterovd61ba582015-11-06 16:32:34 -0800400 break;
401 }
Alex Kelly10c28d92012-09-26 21:52:08 -0400402 }
403 rcu_read_unlock();
404done:
405 atomic_set(&core_state->nr_threads, nr);
406 return nr;
407}
408
409static int coredump_wait(int exit_code, struct core_state *core_state)
410{
411 struct task_struct *tsk = current;
412 struct mm_struct *mm = tsk->mm;
413 int core_waiters = -EBUSY;
414
415 init_completion(&core_state->startup);
416 core_state->dumper.task = tsk;
417 core_state->dumper.next = NULL;
418
Michal Hocko4136c262016-05-23 16:25:57 -0700419 if (down_write_killable(&mm->mmap_sem))
420 return -EINTR;
421
Alex Kelly10c28d92012-09-26 21:52:08 -0400422 if (!mm->core_state)
423 core_waiters = zap_threads(tsk, mm, core_state, exit_code);
424 up_write(&mm->mmap_sem);
425
426 if (core_waiters > 0) {
427 struct core_thread *ptr;
428
Andrey Ryabinin70d78fe2016-11-10 10:46:38 -0800429 freezer_do_not_count();
Alex Kelly10c28d92012-09-26 21:52:08 -0400430 wait_for_completion(&core_state->startup);
Andrey Ryabinin70d78fe2016-11-10 10:46:38 -0800431 freezer_count();
Alex Kelly10c28d92012-09-26 21:52:08 -0400432 /*
433 * Wait for all the threads to become inactive, so that
434 * all the thread context (extended register state, like
435 * fpu etc) gets copied to the memory.
436 */
437 ptr = core_state->dumper.next;
438 while (ptr != NULL) {
439 wait_task_inactive(ptr->task, 0);
440 ptr = ptr->next;
441 }
442 }
443
444 return core_waiters;
445}
446
Oleg Nesterovacdedd92013-04-30 15:28:13 -0700447static void coredump_finish(struct mm_struct *mm, bool core_dumped)
Alex Kelly10c28d92012-09-26 21:52:08 -0400448{
449 struct core_thread *curr, *next;
450 struct task_struct *task;
451
Oleg Nesterov6cd8f0a2013-04-30 15:28:12 -0700452 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterovacdedd92013-04-30 15:28:13 -0700453 if (core_dumped && !__fatal_signal_pending(current))
454 current->signal->group_exit_code |= 0x80;
Oleg Nesterov6cd8f0a2013-04-30 15:28:12 -0700455 current->signal->group_exit_task = NULL;
456 current->signal->flags = SIGNAL_GROUP_EXIT;
457 spin_unlock_irq(&current->sighand->siglock);
458
Alex Kelly10c28d92012-09-26 21:52:08 -0400459 next = mm->core_state->dumper.next;
460 while ((curr = next) != NULL) {
461 next = curr->next;
462 task = curr->task;
463 /*
464 * see exit_mm(), curr->task must not see
465 * ->task == NULL before we read ->next.
466 */
467 smp_mb();
468 curr->task = NULL;
469 wake_up_process(task);
470 }
471
472 mm->core_state = NULL;
473}
474
Oleg Nesterov528f8272013-04-30 15:28:15 -0700475static bool dump_interrupted(void)
476{
477 /*
478 * SIGKILL or freezing() interrupt the coredumping. Perhaps we
479 * can do try_to_freeze() and check __fatal_signal_pending(),
480 * but then we need to teach dump_write() to restart and clear
481 * TIF_SIGPENDING.
482 */
483 return signal_pending(current);
484}
485
Alex Kelly10c28d92012-09-26 21:52:08 -0400486static void wait_for_dump_helpers(struct file *file)
487{
Al Virode32ec42013-03-21 11:16:56 -0400488 struct pipe_inode_info *pipe = file->private_data;
Alex Kelly10c28d92012-09-26 21:52:08 -0400489
490 pipe_lock(pipe);
491 pipe->readers++;
492 pipe->writers--;
Oleg Nesterovdc7ee2a2013-04-30 15:28:17 -0700493 wake_up_interruptible_sync(&pipe->wait);
494 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
495 pipe_unlock(pipe);
Alex Kelly10c28d92012-09-26 21:52:08 -0400496
Oleg Nesterovdc7ee2a2013-04-30 15:28:17 -0700497 /*
498 * We actually want wait_event_freezable() but then we need
499 * to clear TIF_SIGPENDING and improve dump_interrupted().
500 */
501 wait_event_interruptible(pipe->wait, pipe->readers == 1);
Alex Kelly10c28d92012-09-26 21:52:08 -0400502
Oleg Nesterovdc7ee2a2013-04-30 15:28:17 -0700503 pipe_lock(pipe);
Alex Kelly10c28d92012-09-26 21:52:08 -0400504 pipe->readers--;
505 pipe->writers++;
506 pipe_unlock(pipe);
Alex Kelly10c28d92012-09-26 21:52:08 -0400507}
508
509/*
510 * umh_pipe_setup
511 * helper function to customize the process used
512 * to collect the core in userspace. Specifically
513 * it sets up a pipe and installs it as fd 0 (stdin)
514 * for the process. Returns 0 on success, or
515 * PTR_ERR on failure.
516 * Note that it also sets the core limit to 1. This
517 * is a special value that we use to trap recursive
518 * core dumps
519 */
520static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
521{
522 struct file *files[2];
523 struct coredump_params *cp = (struct coredump_params *)info->data;
524 int err = create_pipe_files(files, 0);
525 if (err)
526 return err;
527
528 cp->file = files[1];
529
Al Viro45525b22012-10-16 13:30:07 -0400530 err = replace_fd(0, files[0], 0);
531 fput(files[0]);
Alex Kelly10c28d92012-09-26 21:52:08 -0400532 /* and disallow core files too */
533 current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};
534
Al Viro45525b22012-10-16 13:30:07 -0400535 return err;
Alex Kelly10c28d92012-09-26 21:52:08 -0400536}
537
Al Viroec579412013-10-13 17:57:29 -0400538void do_coredump(const siginfo_t *siginfo)
Alex Kelly10c28d92012-09-26 21:52:08 -0400539{
540 struct core_state core_state;
541 struct core_name cn;
542 struct mm_struct *mm = current->mm;
543 struct linux_binfmt * binfmt;
544 const struct cred *old_cred;
545 struct cred *cred;
546 int retval = 0;
Alex Kelly10c28d92012-09-26 21:52:08 -0400547 int ispipe;
548 struct files_struct *displaced;
Jann Hornfbb18162015-09-09 15:38:28 -0700549 /* require nonrelative corefile path and be extra careful */
550 bool need_suid_safe = false;
Oleg Nesterovacdedd92013-04-30 15:28:13 -0700551 bool core_dumped = false;
Alex Kelly10c28d92012-09-26 21:52:08 -0400552 static atomic_t core_dump_count = ATOMIC_INIT(0);
553 struct coredump_params cprm = {
Denys Vlasenko5ab1c302012-10-04 17:15:29 -0700554 .siginfo = siginfo,
Al Viro541880d2012-11-05 13:11:26 -0500555 .regs = signal_pt_regs(),
Alex Kelly10c28d92012-09-26 21:52:08 -0400556 .limit = rlimit(RLIMIT_CORE),
557 /*
558 * We must use the same mm->flags while dumping core to avoid
559 * inconsistency of bit flags, since this flag is not protected
560 * by any locks.
561 */
562 .mm_flags = mm->flags,
563 };
564
Denys Vlasenko5ab1c302012-10-04 17:15:29 -0700565 audit_core_dumps(siginfo->si_signo);
Alex Kelly10c28d92012-09-26 21:52:08 -0400566
567 binfmt = mm->binfmt;
568 if (!binfmt || !binfmt->core_dump)
569 goto fail;
570 if (!__get_dumpable(cprm.mm_flags))
571 goto fail;
572
573 cred = prepare_creds();
574 if (!cred)
575 goto fail;
576 /*
577 * We cannot trust fsuid as being the "true" uid of the process
578 * nor do we know its entire history. We only know it was tainted
579 * so we dump it as root in mode 2, and only into a controlled
580 * environment (pipe handler or fully qualified path).
581 */
Kees Cooke579d2c2013-02-27 17:03:15 -0800582 if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {
Alex Kelly10c28d92012-09-26 21:52:08 -0400583 /* Setuid core dump mode */
Alex Kelly10c28d92012-09-26 21:52:08 -0400584 cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */
Jann Hornfbb18162015-09-09 15:38:28 -0700585 need_suid_safe = true;
Alex Kelly10c28d92012-09-26 21:52:08 -0400586 }
587
Denys Vlasenko5ab1c302012-10-04 17:15:29 -0700588 retval = coredump_wait(siginfo->si_signo, &core_state);
Alex Kelly10c28d92012-09-26 21:52:08 -0400589 if (retval < 0)
590 goto fail_creds;
591
592 old_cred = override_creds(cred);
593
Oleg Nesterov12a2b4b2012-10-04 17:15:25 -0700594 ispipe = format_corename(&cn, &cprm);
Alex Kelly10c28d92012-09-26 21:52:08 -0400595
Lucas De Marchifb96c472013-04-30 15:28:06 -0700596 if (ispipe) {
Alex Kelly10c28d92012-09-26 21:52:08 -0400597 int dump_count;
598 char **helper_argv;
Lucas De Marchi907ed132013-04-30 15:28:07 -0700599 struct subprocess_info *sub_info;
Alex Kelly10c28d92012-09-26 21:52:08 -0400600
601 if (ispipe < 0) {
602 printk(KERN_WARNING "format_corename failed\n");
603 printk(KERN_WARNING "Aborting core\n");
Oleg Nesterove7fd1542013-07-03 15:08:16 -0700604 goto fail_unlock;
Alex Kelly10c28d92012-09-26 21:52:08 -0400605 }
606
607 if (cprm.limit == 1) {
608 /* See umh_pipe_setup() which sets RLIMIT_CORE = 1.
609 *
610 * Normally core limits are irrelevant to pipes, since
611 * we're not writing to the file system, but we use
Bastien Nocerafcbc32b2015-02-05 14:35:05 +0100612 * cprm.limit of 1 here as a special value, this is a
Alex Kelly10c28d92012-09-26 21:52:08 -0400613 * consistent way to catch recursive crashes.
614 * We can still crash if the core_pattern binary sets
615 * RLIM_CORE = !1, but it runs as root, and can do
616 * lots of stupid things.
617 *
618 * Note that we use task_tgid_vnr here to grab the pid
619 * of the process group leader. That way we get the
620 * right pid if a thread in a multi-threaded
621 * core_pattern process dies.
622 */
623 printk(KERN_WARNING
624 "Process %d(%s) has RLIMIT_CORE set to 1\n",
625 task_tgid_vnr(current), current->comm);
626 printk(KERN_WARNING "Aborting core\n");
627 goto fail_unlock;
628 }
629 cprm.limit = RLIM_INFINITY;
630
631 dump_count = atomic_inc_return(&core_dump_count);
632 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
633 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
634 task_tgid_vnr(current), current->comm);
635 printk(KERN_WARNING "Skipping core dump\n");
636 goto fail_dropcount;
637 }
638
Oleg Nesterov888ffc52013-07-03 15:08:23 -0700639 helper_argv = argv_split(GFP_KERNEL, cn.corename, NULL);
Alex Kelly10c28d92012-09-26 21:52:08 -0400640 if (!helper_argv) {
641 printk(KERN_WARNING "%s failed to allocate memory\n",
642 __func__);
643 goto fail_dropcount;
644 }
645
Lucas De Marchi907ed132013-04-30 15:28:07 -0700646 retval = -ENOMEM;
647 sub_info = call_usermodehelper_setup(helper_argv[0],
648 helper_argv, NULL, GFP_KERNEL,
649 umh_pipe_setup, NULL, &cprm);
650 if (sub_info)
651 retval = call_usermodehelper_exec(sub_info,
652 UMH_WAIT_EXEC);
653
Alex Kelly10c28d92012-09-26 21:52:08 -0400654 argv_free(helper_argv);
655 if (retval) {
Oleg Nesterov888ffc52013-07-03 15:08:23 -0700656 printk(KERN_INFO "Core dump to |%s pipe failed\n",
Alex Kelly10c28d92012-09-26 21:52:08 -0400657 cn.corename);
658 goto close_fail;
Lucas De Marchifb96c472013-04-30 15:28:06 -0700659 }
Alex Kelly10c28d92012-09-26 21:52:08 -0400660 } else {
661 struct inode *inode;
Jann Horn378c6522016-03-22 14:25:36 -0700662 int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW |
663 O_LARGEFILE | O_EXCL;
Alex Kelly10c28d92012-09-26 21:52:08 -0400664
665 if (cprm.limit < binfmt->min_coredump)
666 goto fail_unlock;
667
Jann Hornfbb18162015-09-09 15:38:28 -0700668 if (need_suid_safe && cn.corename[0] != '/') {
Alex Kelly10c28d92012-09-26 21:52:08 -0400669 printk(KERN_WARNING "Pid %d(%s) can only dump core "\
670 "to fully qualified path!\n",
671 task_tgid_vnr(current), current->comm);
672 printk(KERN_WARNING "Skipping core dump\n");
673 goto fail_unlock;
674 }
675
Jann Hornfbb18162015-09-09 15:38:28 -0700676 /*
677 * Unlink the file if it exists unless this is a SUID
678 * binary - in that case, we're running around with root
679 * privs and don't want to unlink another user's coredump.
680 */
681 if (!need_suid_safe) {
682 mm_segment_t old_fs;
683
684 old_fs = get_fs();
685 set_fs(KERNEL_DS);
686 /*
687 * If it doesn't exist, that's fine. If there's some
688 * other problem, we'll catch it at the filp_open().
689 */
690 (void) sys_unlink((const char __user *)cn.corename);
691 set_fs(old_fs);
692 }
693
694 /*
695 * There is a race between unlinking and creating the
696 * file, but if that causes an EEXIST here, that's
697 * fine - another process raced with us while creating
698 * the corefile, and the other process won. To userspace,
699 * what matters is that at least one of the two processes
700 * writes its coredump successfully, not which one.
701 */
Jann Horn378c6522016-03-22 14:25:36 -0700702 if (need_suid_safe) {
703 /*
704 * Using user namespaces, normal user tasks can change
705 * their current->fs->root to point to arbitrary
706 * directories. Since the intention of the "only dump
707 * with a fully qualified path" rule is to control where
708 * coredumps may be placed using root privileges,
709 * current->fs->root must not be used. Instead, use the
710 * root directory of init_task.
711 */
712 struct path root;
713
714 task_lock(&init_task);
715 get_fs_root(init_task.fs, &root);
716 task_unlock(&init_task);
717 cprm.file = file_open_root(root.dentry, root.mnt,
718 cn.corename, open_flags, 0600);
719 path_put(&root);
720 } else {
721 cprm.file = filp_open(cn.corename, open_flags, 0600);
722 }
Alex Kelly10c28d92012-09-26 21:52:08 -0400723 if (IS_ERR(cprm.file))
724 goto fail_unlock;
725
Al Viro496ad9a2013-01-23 17:07:38 -0500726 inode = file_inode(cprm.file);
Alex Kelly10c28d92012-09-26 21:52:08 -0400727 if (inode->i_nlink > 1)
728 goto close_fail;
729 if (d_unhashed(cprm.file->f_path.dentry))
730 goto close_fail;
731 /*
732 * AK: actually i see no reason to not allow this for named
733 * pipes etc, but keep the previous behaviour for now.
734 */
735 if (!S_ISREG(inode->i_mode))
736 goto close_fail;
737 /*
Jann Horn40f705a2015-09-09 15:38:30 -0700738 * Don't dump core if the filesystem changed owner or mode
739 * of the file during file creation. This is an issue when
740 * a process dumps core while its cwd is e.g. on a vfat
741 * filesystem.
Alex Kelly10c28d92012-09-26 21:52:08 -0400742 */
743 if (!uid_eq(inode->i_uid, current_fsuid()))
744 goto close_fail;
Jann Horn40f705a2015-09-09 15:38:30 -0700745 if ((inode->i_mode & 0677) != 0600)
746 goto close_fail;
Al Viro86cc0582015-04-03 15:23:17 -0400747 if (!(cprm.file->f_mode & FMODE_CAN_WRITE))
Alex Kelly10c28d92012-09-26 21:52:08 -0400748 goto close_fail;
749 if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file))
750 goto close_fail;
751 }
752
753 /* get us an unshared descriptor table; almost always a no-op */
754 retval = unshare_files(&displaced);
755 if (retval)
756 goto close_fail;
757 if (displaced)
758 put_files_struct(displaced);
Al Viroe86d35c2013-05-04 14:45:54 -0400759 if (!dump_interrupted()) {
760 file_start_write(cprm.file);
761 core_dumped = binfmt->core_dump(&cprm);
762 file_end_write(cprm.file);
763 }
Alex Kelly10c28d92012-09-26 21:52:08 -0400764 if (ispipe && core_pipe_limit)
765 wait_for_dump_helpers(cprm.file);
766close_fail:
767 if (cprm.file)
768 filp_close(cprm.file, NULL);
769fail_dropcount:
770 if (ispipe)
771 atomic_dec(&core_dump_count);
772fail_unlock:
773 kfree(cn.corename);
Oleg Nesterovacdedd92013-04-30 15:28:13 -0700774 coredump_finish(mm, core_dumped);
Alex Kelly10c28d92012-09-26 21:52:08 -0400775 revert_creds(old_cred);
776fail_creds:
777 put_cred(cred);
778fail:
779 return;
780}
781
782/*
783 * Core dumping helper functions. These are the only things you should
784 * do on a core-file: use only these functions to write out all the
785 * necessary info.
786 */
Al Viroecc8c772013-10-05 15:32:35 -0400787int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
788{
789 struct file *file = cprm->file;
Al Viro2507a4f2013-10-08 09:11:48 -0400790 loff_t pos = file->f_pos;
791 ssize_t n;
Omar Sandoval2c4cb042016-05-11 15:16:37 -0700792 if (cprm->written + nr > cprm->limit)
Al Viroecc8c772013-10-05 15:32:35 -0400793 return 0;
Al Viro2507a4f2013-10-08 09:11:48 -0400794 while (nr) {
795 if (dump_interrupted())
796 return 0;
Al Viro52da40a2013-11-15 21:58:33 -0500797 n = __kernel_write(file, addr, nr, &pos);
Al Viro2507a4f2013-10-08 09:11:48 -0400798 if (n <= 0)
799 return 0;
800 file->f_pos = pos;
Omar Sandoval2c4cb042016-05-11 15:16:37 -0700801 cprm->written += n;
Mateusz Guzik1607f092016-06-05 23:14:14 +0200802 cprm->pos += n;
Al Viro2507a4f2013-10-08 09:11:48 -0400803 nr -= n;
804 }
Al Viroecc8c772013-10-05 15:32:35 -0400805 return 1;
806}
807EXPORT_SYMBOL(dump_emit);
808
Al Viro9b56d542013-10-08 09:26:08 -0400809int dump_skip(struct coredump_params *cprm, size_t nr)
Alex Kelly10c28d92012-09-26 21:52:08 -0400810{
Al Viro9b56d542013-10-08 09:26:08 -0400811 static char zeroes[PAGE_SIZE];
812 struct file *file = cprm->file;
Alex Kelly10c28d92012-09-26 21:52:08 -0400813 if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
Oleg Nesterov528f8272013-04-30 15:28:15 -0700814 if (dump_interrupted() ||
Al Viro9b56d542013-10-08 09:26:08 -0400815 file->f_op->llseek(file, nr, SEEK_CUR) < 0)
Alex Kelly10c28d92012-09-26 21:52:08 -0400816 return 0;
Mateusz Guzik1607f092016-06-05 23:14:14 +0200817 cprm->pos += nr;
Al Viro9b56d542013-10-08 09:26:08 -0400818 return 1;
Alex Kelly10c28d92012-09-26 21:52:08 -0400819 } else {
Al Viro9b56d542013-10-08 09:26:08 -0400820 while (nr > PAGE_SIZE) {
821 if (!dump_emit(cprm, zeroes, PAGE_SIZE))
822 return 0;
823 nr -= PAGE_SIZE;
Alex Kelly10c28d92012-09-26 21:52:08 -0400824 }
Al Viro9b56d542013-10-08 09:26:08 -0400825 return dump_emit(cprm, zeroes, nr);
Alex Kelly10c28d92012-09-26 21:52:08 -0400826 }
Alex Kelly10c28d92012-09-26 21:52:08 -0400827}
Al Viro9b56d542013-10-08 09:26:08 -0400828EXPORT_SYMBOL(dump_skip);
Al Viro22a8cb82013-10-08 11:05:01 -0400829
830int dump_align(struct coredump_params *cprm, int align)
831{
Mateusz Guzik1607f092016-06-05 23:14:14 +0200832 unsigned mod = cprm->pos & (align - 1);
Al Viro22a8cb82013-10-08 11:05:01 -0400833 if (align & (align - 1))
Al Virodb512422013-11-15 21:55:52 -0500834 return 0;
835 return mod ? dump_skip(cprm, align - mod) : 1;
Al Viro22a8cb82013-10-08 11:05:01 -0400836}
837EXPORT_SYMBOL(dump_align);
Dave Kleikamp4d22c752017-01-11 13:25:00 -0600838
839/*
840 * Ensures that file size is big enough to contain the current file
841 * postion. This prevents gdb from complaining about a truncated file
842 * if the last "write" to the file was dump_skip.
843 */
844void dump_truncate(struct coredump_params *cprm)
845{
846 struct file *file = cprm->file;
847 loff_t offset;
848
849 if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
850 offset = file->f_op->llseek(file, 0, SEEK_CUR);
851 if (i_size_read(file->f_mapping->host) < offset)
852 do_truncate(file->f_path.dentry, offset, 0, file);
853 }
854}
855EXPORT_SYMBOL(dump_truncate);