blob: 0b685888ff6f9b1c51c860191828adbde4950fe6 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * linux/fs/exec.c
3 *
4 * Copyright (C) 1991, 1992 Linus Torvalds
5 */
6
7/*
8 * #!-checking implemented by tytso.
9 */
10/*
11 * Demand-loading implemented 01.12.91 - no need to read anything but
12 * the header into memory. The inode of the executable is put into
13 * "current->executable", and page faults do the actual loading. Clean.
14 *
15 * Once more I can proudly say that linux stood up to being changed: it
16 * was less than 2 hours work to get demand-loading completely implemented.
17 *
18 * Demand loading changed July 1993 by Eric Youngdale. Use mmap instead,
19 * current->executable is only used by the procfs. This allows a dispatch
20 * table to check for several different types of binary formats. We keep
21 * trying until we recognize the file or we run out of supported binary
22 * formats.
23 */
24
Linus Torvalds1da177e2005-04-16 15:20:36 -070025#include <linux/slab.h>
26#include <linux/file.h>
27#include <linux/mman.h>
28#include <linux/a.out.h>
29#include <linux/stat.h>
30#include <linux/fcntl.h>
31#include <linux/smp_lock.h>
32#include <linux/init.h>
33#include <linux/pagemap.h>
34#include <linux/highmem.h>
35#include <linux/spinlock.h>
36#include <linux/key.h>
37#include <linux/personality.h>
38#include <linux/binfmts.h>
39#include <linux/swap.h>
40#include <linux/utsname.h>
Sukadev Bhattiprolu84d73782006-12-08 02:38:01 -080041#include <linux/pid_namespace.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070042#include <linux/module.h>
43#include <linux/namei.h>
44#include <linux/proc_fs.h>
45#include <linux/ptrace.h>
46#include <linux/mount.h>
47#include <linux/security.h>
48#include <linux/syscalls.h>
49#include <linux/rmap.h>
Jay Lan8f0ab512006-09-30 23:28:59 -070050#include <linux/tsacct_kern.h>
Matt Helsley9f460802005-11-07 00:59:16 -080051#include <linux/cn_proc.h>
Al Viro473ae302006-04-26 14:04:08 -040052#include <linux/audit.h>
Davide Libenzifba2afa2007-05-10 22:23:13 -070053#include <linux/signalfd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070054
55#include <asm/uaccess.h>
56#include <asm/mmu_context.h>
57
58#ifdef CONFIG_KMOD
59#include <linux/kmod.h>
60#endif
61
62int core_uses_pid;
Dan Aloni71ce92f2007-05-16 22:11:16 -070063char core_pattern[CORENAME_MAX_SIZE] = "core";
Alan Coxd6e71142005-06-23 00:09:43 -070064int suid_dumpable = 0;
65
66EXPORT_SYMBOL(suid_dumpable);
Linus Torvalds1da177e2005-04-16 15:20:36 -070067/* The maximal length of core_pattern is also specified in sysctl.c */
68
69static struct linux_binfmt *formats;
70static DEFINE_RWLOCK(binfmt_lock);
71
72int register_binfmt(struct linux_binfmt * fmt)
73{
74 struct linux_binfmt ** tmp = &formats;
75
76 if (!fmt)
77 return -EINVAL;
78 if (fmt->next)
79 return -EBUSY;
80 write_lock(&binfmt_lock);
81 while (*tmp) {
82 if (fmt == *tmp) {
83 write_unlock(&binfmt_lock);
84 return -EBUSY;
85 }
86 tmp = &(*tmp)->next;
87 }
88 fmt->next = formats;
89 formats = fmt;
90 write_unlock(&binfmt_lock);
91 return 0;
92}
93
94EXPORT_SYMBOL(register_binfmt);
95
96int unregister_binfmt(struct linux_binfmt * fmt)
97{
98 struct linux_binfmt ** tmp = &formats;
99
100 write_lock(&binfmt_lock);
101 while (*tmp) {
102 if (fmt == *tmp) {
103 *tmp = fmt->next;
kalash nainwal98701d12007-05-08 00:28:31 -0700104 fmt->next = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700105 write_unlock(&binfmt_lock);
106 return 0;
107 }
108 tmp = &(*tmp)->next;
109 }
110 write_unlock(&binfmt_lock);
111 return -EINVAL;
112}
113
114EXPORT_SYMBOL(unregister_binfmt);
115
116static inline void put_binfmt(struct linux_binfmt * fmt)
117{
118 module_put(fmt->module);
119}
120
121/*
122 * Note that a shared library must be both readable and executable due to
123 * security reasons.
124 *
125 * Also note that we take the address to load from from the file itself.
126 */
127asmlinkage long sys_uselib(const char __user * library)
128{
129 struct file * file;
130 struct nameidata nd;
131 int error;
132
Oleg Drokinb5005312006-03-25 03:07:01 -0800133 error = __user_path_lookup_open(library, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700134 if (error)
135 goto out;
136
137 error = -EINVAL;
138 if (!S_ISREG(nd.dentry->d_inode->i_mode))
139 goto exit;
140
Christoph Hellwige4543ed2005-11-08 21:35:04 -0800141 error = vfs_permission(&nd, MAY_READ | MAY_EXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700142 if (error)
143 goto exit;
144
Trond Myklebust834f2a42005-10-18 14:20:16 -0700145 file = nameidata_to_filp(&nd, O_RDONLY);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700146 error = PTR_ERR(file);
147 if (IS_ERR(file))
148 goto out;
149
150 error = -ENOEXEC;
151 if(file->f_op) {
152 struct linux_binfmt * fmt;
153
154 read_lock(&binfmt_lock);
155 for (fmt = formats ; fmt ; fmt = fmt->next) {
156 if (!fmt->load_shlib)
157 continue;
158 if (!try_module_get(fmt->module))
159 continue;
160 read_unlock(&binfmt_lock);
161 error = fmt->load_shlib(file);
162 read_lock(&binfmt_lock);
163 put_binfmt(fmt);
164 if (error != -ENOEXEC)
165 break;
166 }
167 read_unlock(&binfmt_lock);
168 }
169 fput(file);
170out:
171 return error;
172exit:
Trond Myklebust834f2a42005-10-18 14:20:16 -0700173 release_open_intent(&nd);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174 path_release(&nd);
175 goto out;
176}
177
178/*
179 * count() counts the number of strings in array ARGV.
180 */
181static int count(char __user * __user * argv, int max)
182{
183 int i = 0;
184
185 if (argv != NULL) {
186 for (;;) {
187 char __user * p;
188
189 if (get_user(p, argv))
190 return -EFAULT;
191 if (!p)
192 break;
193 argv++;
194 if(++i > max)
195 return -E2BIG;
196 cond_resched();
197 }
198 }
199 return i;
200}
201
202/*
203 * 'copy_strings()' copies argument/environment strings from user
204 * memory to free pages in kernel mem. These are in a format ready
205 * to be put directly into the top of new user memory.
206 */
Adrian Bunk75c96f82005-05-05 16:16:09 -0700207static int copy_strings(int argc, char __user * __user * argv,
208 struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209{
210 struct page *kmapped_page = NULL;
211 char *kaddr = NULL;
212 int ret;
213
214 while (argc-- > 0) {
215 char __user *str;
216 int len;
217 unsigned long pos;
218
219 if (get_user(str, argv+argc) ||
220 !(len = strnlen_user(str, bprm->p))) {
221 ret = -EFAULT;
222 goto out;
223 }
224
225 if (bprm->p < len) {
226 ret = -E2BIG;
227 goto out;
228 }
229
230 bprm->p -= len;
231 /* XXX: add architecture specific overflow check here. */
232 pos = bprm->p;
233
234 while (len > 0) {
235 int i, new, err;
236 int offset, bytes_to_copy;
237 struct page *page;
238
239 offset = pos % PAGE_SIZE;
240 i = pos/PAGE_SIZE;
241 page = bprm->page[i];
242 new = 0;
243 if (!page) {
244 page = alloc_page(GFP_HIGHUSER);
245 bprm->page[i] = page;
246 if (!page) {
247 ret = -ENOMEM;
248 goto out;
249 }
250 new = 1;
251 }
252
253 if (page != kmapped_page) {
254 if (kmapped_page)
255 kunmap(kmapped_page);
256 kmapped_page = page;
257 kaddr = kmap(kmapped_page);
258 }
259 if (new && offset)
260 memset(kaddr, 0, offset);
261 bytes_to_copy = PAGE_SIZE - offset;
262 if (bytes_to_copy > len) {
263 bytes_to_copy = len;
264 if (new)
265 memset(kaddr+offset+len, 0,
266 PAGE_SIZE-offset-len);
267 }
268 err = copy_from_user(kaddr+offset, str, bytes_to_copy);
269 if (err) {
270 ret = -EFAULT;
271 goto out;
272 }
273
274 pos += bytes_to_copy;
275 str += bytes_to_copy;
276 len -= bytes_to_copy;
277 }
278 }
279 ret = 0;
280out:
281 if (kmapped_page)
282 kunmap(kmapped_page);
283 return ret;
284}
285
286/*
287 * Like copy_strings, but get argv and its values from kernel memory.
288 */
289int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
290{
291 int r;
292 mm_segment_t oldfs = get_fs();
293 set_fs(KERNEL_DS);
294 r = copy_strings(argc, (char __user * __user *)argv, bprm);
295 set_fs(oldfs);
296 return r;
297}
298
299EXPORT_SYMBOL(copy_strings_kernel);
300
301#ifdef CONFIG_MMU
302/*
303 * This routine is used to map in a page into an address space: needed by
304 * execve() for the initial stack and environment pages.
305 *
306 * vma->vm_mm->mmap_sem is held for writing.
307 */
308void install_arg_page(struct vm_area_struct *vma,
309 struct page *page, unsigned long address)
310{
311 struct mm_struct *mm = vma->vm_mm;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700312 pte_t * pte;
Hugh Dickinsc74df322005-10-29 18:16:23 -0700313 spinlock_t *ptl;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700314
315 if (unlikely(anon_vma_prepare(vma)))
Hugh Dickinsc74df322005-10-29 18:16:23 -0700316 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700317
318 flush_dcache_page(page);
Linus Torvaldsc9cfcdd2005-11-29 14:03:14 -0800319 pte = get_locked_pte(mm, address, &ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700320 if (!pte)
321 goto out;
322 if (!pte_none(*pte)) {
Hugh Dickinsc74df322005-10-29 18:16:23 -0700323 pte_unmap_unlock(pte, ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700324 goto out;
325 }
Hugh Dickins42946212005-10-29 18:16:05 -0700326 inc_mm_counter(mm, anon_rss);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700327 lru_cache_add_active(page);
328 set_pte_at(mm, address, pte, pte_mkdirty(pte_mkwrite(mk_pte(
329 page, vma->vm_page_prot))));
Nick Piggin9617d952006-01-06 00:11:12 -0800330 page_add_new_anon_rmap(page, vma, address);
Hugh Dickinsc74df322005-10-29 18:16:23 -0700331 pte_unmap_unlock(pte, ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700332
333 /* no need for flush_tlb */
334 return;
335out:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700336 __free_page(page);
337 force_sig(SIGKILL, current);
338}
339
340#define EXTRA_STACK_VM_PAGES 20 /* random */
341
342int setup_arg_pages(struct linux_binprm *bprm,
343 unsigned long stack_top,
344 int executable_stack)
345{
346 unsigned long stack_base;
347 struct vm_area_struct *mpnt;
348 struct mm_struct *mm = current->mm;
349 int i, ret;
350 long arg_size;
351
352#ifdef CONFIG_STACK_GROWSUP
353 /* Move the argument and environment strings to the bottom of the
354 * stack space.
355 */
356 int offset, j;
357 char *to, *from;
358
359 /* Start by shifting all the pages down */
360 i = 0;
361 for (j = 0; j < MAX_ARG_PAGES; j++) {
362 struct page *page = bprm->page[j];
363 if (!page)
364 continue;
365 bprm->page[i++] = page;
366 }
367
368 /* Now move them within their pages */
369 offset = bprm->p % PAGE_SIZE;
370 to = kmap(bprm->page[0]);
371 for (j = 1; j < i; j++) {
372 memmove(to, to + offset, PAGE_SIZE - offset);
373 from = kmap(bprm->page[j]);
374 memcpy(to + PAGE_SIZE - offset, from, offset);
375 kunmap(bprm->page[j - 1]);
376 to = from;
377 }
378 memmove(to, to + offset, PAGE_SIZE - offset);
379 kunmap(bprm->page[j - 1]);
380
381 /* Limit stack size to 1GB */
382 stack_base = current->signal->rlim[RLIMIT_STACK].rlim_max;
383 if (stack_base > (1 << 30))
384 stack_base = 1 << 30;
385 stack_base = PAGE_ALIGN(stack_top - stack_base);
386
387 /* Adjust bprm->p to point to the end of the strings. */
388 bprm->p = stack_base + PAGE_SIZE * i - offset;
389
390 mm->arg_start = stack_base;
391 arg_size = i << PAGE_SHIFT;
392
393 /* zero pages that were copied above */
394 while (i < MAX_ARG_PAGES)
395 bprm->page[i++] = NULL;
396#else
397 stack_base = arch_align_stack(stack_top - MAX_ARG_PAGES*PAGE_SIZE);
398 stack_base = PAGE_ALIGN(stack_base);
399 bprm->p += stack_base;
400 mm->arg_start = bprm->p;
401 arg_size = stack_top - (PAGE_MASK & (unsigned long) mm->arg_start);
402#endif
403
404 arg_size += EXTRA_STACK_VM_PAGES * PAGE_SIZE;
405
406 if (bprm->loader)
407 bprm->loader += stack_base;
408 bprm->exec += stack_base;
409
Robert P. J. Dayc3762222007-02-10 01:45:03 -0800410 mpnt = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700411 if (!mpnt)
412 return -ENOMEM;
413
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414 down_write(&mm->mmap_sem);
415 {
416 mpnt->vm_mm = mm;
417#ifdef CONFIG_STACK_GROWSUP
418 mpnt->vm_start = stack_base;
419 mpnt->vm_end = stack_base + arg_size;
420#else
421 mpnt->vm_end = stack_top;
422 mpnt->vm_start = mpnt->vm_end - arg_size;
423#endif
424 /* Adjust stack execute permissions; explicitly enable
425 * for EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X
426 * and leave alone (arch default) otherwise. */
427 if (unlikely(executable_stack == EXSTACK_ENABLE_X))
428 mpnt->vm_flags = VM_STACK_FLAGS | VM_EXEC;
429 else if (executable_stack == EXSTACK_DISABLE_X)
430 mpnt->vm_flags = VM_STACK_FLAGS & ~VM_EXEC;
431 else
432 mpnt->vm_flags = VM_STACK_FLAGS;
433 mpnt->vm_flags |= mm->def_flags;
434 mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7];
435 if ((ret = insert_vm_struct(mm, mpnt))) {
436 up_write(&mm->mmap_sem);
437 kmem_cache_free(vm_area_cachep, mpnt);
438 return ret;
439 }
440 mm->stack_vm = mm->total_vm = vma_pages(mpnt);
441 }
442
443 for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
444 struct page *page = bprm->page[i];
445 if (page) {
446 bprm->page[i] = NULL;
447 install_arg_page(mpnt, page, stack_base);
448 }
449 stack_base += PAGE_SIZE;
450 }
451 up_write(&mm->mmap_sem);
452
453 return 0;
454}
455
456EXPORT_SYMBOL(setup_arg_pages);
457
458#define free_arg_pages(bprm) do { } while (0)
459
460#else
461
462static inline void free_arg_pages(struct linux_binprm *bprm)
463{
464 int i;
465
466 for (i = 0; i < MAX_ARG_PAGES; i++) {
467 if (bprm->page[i])
468 __free_page(bprm->page[i]);
469 bprm->page[i] = NULL;
470 }
471}
472
473#endif /* CONFIG_MMU */
474
475struct file *open_exec(const char *name)
476{
477 struct nameidata nd;
478 int err;
479 struct file *file;
480
Oleg Drokinb5005312006-03-25 03:07:01 -0800481 err = path_lookup_open(AT_FDCWD, name, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700482 file = ERR_PTR(err);
483
484 if (!err) {
485 struct inode *inode = nd.dentry->d_inode;
486 file = ERR_PTR(-EACCES);
487 if (!(nd.mnt->mnt_flags & MNT_NOEXEC) &&
488 S_ISREG(inode->i_mode)) {
Christoph Hellwige4543ed2005-11-08 21:35:04 -0800489 int err = vfs_permission(&nd, MAY_EXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700490 file = ERR_PTR(err);
491 if (!err) {
Trond Myklebust834f2a42005-10-18 14:20:16 -0700492 file = nameidata_to_filp(&nd, O_RDONLY);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700493 if (!IS_ERR(file)) {
494 err = deny_write_access(file);
495 if (err) {
496 fput(file);
497 file = ERR_PTR(err);
498 }
499 }
500out:
501 return file;
502 }
503 }
Trond Myklebust834f2a42005-10-18 14:20:16 -0700504 release_open_intent(&nd);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700505 path_release(&nd);
506 }
507 goto out;
508}
509
510EXPORT_SYMBOL(open_exec);
511
512int kernel_read(struct file *file, unsigned long offset,
513 char *addr, unsigned long count)
514{
515 mm_segment_t old_fs;
516 loff_t pos = offset;
517 int result;
518
519 old_fs = get_fs();
520 set_fs(get_ds());
521 /* The cast to a user pointer is valid due to the set_fs() */
522 result = vfs_read(file, (void __user *)addr, count, &pos);
523 set_fs(old_fs);
524 return result;
525}
526
527EXPORT_SYMBOL(kernel_read);
528
529static int exec_mmap(struct mm_struct *mm)
530{
531 struct task_struct *tsk;
532 struct mm_struct * old_mm, *active_mm;
533
534 /* Notify parent that we're no longer interested in the old VM */
535 tsk = current;
536 old_mm = current->mm;
537 mm_release(tsk, old_mm);
538
539 if (old_mm) {
540 /*
541 * Make sure that if there is a core dump in progress
542 * for the old mm, we get out and die instead of going
543 * through with the exec. We must hold mmap_sem around
544 * checking core_waiters and changing tsk->mm. The
545 * core-inducing thread will increment core_waiters for
546 * each thread whose ->mm == old_mm.
547 */
548 down_read(&old_mm->mmap_sem);
549 if (unlikely(old_mm->core_waiters)) {
550 up_read(&old_mm->mmap_sem);
551 return -EINTR;
552 }
553 }
554 task_lock(tsk);
555 active_mm = tsk->active_mm;
556 tsk->mm = mm;
557 tsk->active_mm = mm;
558 activate_mm(active_mm, mm);
559 task_unlock(tsk);
560 arch_pick_mmap_layout(mm);
561 if (old_mm) {
562 up_read(&old_mm->mmap_sem);
Eric Sesterhenn7dddb122006-04-01 01:13:38 +0200563 BUG_ON(active_mm != old_mm);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700564 mmput(old_mm);
565 return 0;
566 }
567 mmdrop(active_mm);
568 return 0;
569}
570
571/*
572 * This function makes sure the current process has its own signal table,
573 * so that flush_signal_handlers can later reset the handlers without
574 * disturbing other processes. (Other processes might share the signal
575 * table via the CLONE_SIGHAND option to clone().)
576 */
Arjan van de Ven858119e2006-01-14 13:20:43 -0800577static int de_thread(struct task_struct *tsk)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700578{
579 struct signal_struct *sig = tsk->signal;
580 struct sighand_struct *newsighand, *oldsighand = tsk->sighand;
581 spinlock_t *lock = &oldsighand->siglock;
Oleg Nesterov329f7db2005-11-07 21:12:43 +0300582 struct task_struct *leader = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700583 int count;
584
585 /*
Davide Libenzifba2afa2007-05-10 22:23:13 -0700586 * Tell all the sighand listeners that this sighand has
587 * been detached. The signalfd_detach() function grabs the
588 * sighand lock, if signal listeners are present on the sighand.
589 */
590 signalfd_detach(tsk);
591
592 /*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700593 * If we don't share sighandlers, then we aren't sharing anything
594 * and we can just re-use it all.
595 */
596 if (atomic_read(&oldsighand->count) <= 1) {
597 BUG_ON(atomic_read(&sig->count) != 1);
598 exit_itimers(sig);
599 return 0;
600 }
601
602 newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
603 if (!newsighand)
604 return -ENOMEM;
605
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700606 if (thread_group_empty(tsk))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700607 goto no_thread_group;
608
609 /*
610 * Kill all other threads in the thread group.
611 * We must hold tasklist_lock to call zap_other_threads.
612 */
613 read_lock(&tasklist_lock);
614 spin_lock_irq(lock);
615 if (sig->flags & SIGNAL_GROUP_EXIT) {
616 /*
617 * Another group action in progress, just
618 * return so that the signal is processed.
619 */
620 spin_unlock_irq(lock);
621 read_unlock(&tasklist_lock);
622 kmem_cache_free(sighand_cachep, newsighand);
623 return -EAGAIN;
624 }
Oleg Nesterov14342612006-03-28 16:10:59 -0800625
626 /*
627 * child_reaper ignores SIGKILL, change it now.
628 * Reparenting needs write_lock on tasklist_lock,
629 * so it is safe to do it under read_lock.
630 */
Sukadev Bhattiprolu84d73782006-12-08 02:38:01 -0800631 if (unlikely(tsk->group_leader == child_reaper(tsk)))
632 tsk->nsproxy->pid_ns->child_reaper = tsk;
Oleg Nesterov14342612006-03-28 16:10:59 -0800633
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700634 zap_other_threads(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700635 read_unlock(&tasklist_lock);
636
637 /*
638 * Account for the thread group leader hanging around:
639 */
Oleg Nesterov9e4e23b2005-10-30 15:01:37 -0800640 count = 1;
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700641 if (!thread_group_leader(tsk)) {
Oleg Nesterov9e4e23b2005-10-30 15:01:37 -0800642 count = 2;
Roland McGrath53231252005-07-12 13:58:27 -0700643 /*
644 * The SIGALRM timer survives the exec, but needs to point
645 * at us as the new group leader now. We have a race with
646 * a timer firing now getting the old leader, so we need to
647 * synchronize with any firing (by calling del_timer_sync)
648 * before we can safely let the old group leader die.
649 */
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700650 sig->tsk = tsk;
Oleg Nesterov932aeaf2005-10-30 15:02:17 -0800651 spin_unlock_irq(lock);
Thomas Gleixner2ff678b2006-01-09 20:52:34 -0800652 if (hrtimer_cancel(&sig->real_timer))
653 hrtimer_restart(&sig->real_timer);
Oleg Nesterov932aeaf2005-10-30 15:02:17 -0800654 spin_lock_irq(lock);
Roland McGrath53231252005-07-12 13:58:27 -0700655 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700656 while (atomic_read(&sig->count) > count) {
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700657 sig->group_exit_task = tsk;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700658 sig->notify_count = count;
659 __set_current_state(TASK_UNINTERRUPTIBLE);
660 spin_unlock_irq(lock);
661 schedule();
662 spin_lock_irq(lock);
663 }
664 sig->group_exit_task = NULL;
665 sig->notify_count = 0;
666 spin_unlock_irq(lock);
667
668 /*
669 * At this point all other threads have exited, all we have to
670 * do is to wait for the thread group leader to become inactive,
671 * and to assume its PID:
672 */
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700673 if (!thread_group_leader(tsk)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700674 /*
675 * Wait for the thread group leader to be a zombie.
676 * It should already be zombie at this point, most
677 * of the time.
678 */
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700679 leader = tsk->group_leader;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700680 while (leader->exit_state != EXIT_ZOMBIE)
681 yield();
682
Roland McGrathf5e90282006-04-10 22:54:16 -0700683 /*
684 * The only record we have of the real-time age of a
685 * process, regardless of execs it's done, is start_time.
686 * All the past CPU time is accumulated in signal_struct
687 * from sister threads now dead. But in this non-leader
688 * exec, nothing survives from the original leader thread,
689 * whose birth marks the true age of this process now.
690 * When we take on its identity by switching to its PID, we
691 * also take its birthdate (always earlier than our own).
692 */
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700693 tsk->start_time = leader->start_time;
Roland McGrathf5e90282006-04-10 22:54:16 -0700694
Linus Torvalds1da177e2005-04-16 15:20:36 -0700695 write_lock_irq(&tasklist_lock);
696
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700697 BUG_ON(leader->tgid != tsk->tgid);
698 BUG_ON(tsk->pid == tsk->tgid);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700699 /*
700 * An exec() starts a new thread group with the
701 * TGID of the previous thread group. Rehash the
702 * two threads with a switched PID, and release
703 * the former thread group leader:
704 */
Eric W. Biedermand73d6522006-03-28 16:11:03 -0800705
706 /* Become a process group leader with the old leader's pid.
Eric W. Biedermanc18258c2006-09-27 01:51:06 -0700707 * The old leader becomes a thread of the this thread group.
708 * Note: The old leader also uses this pid until release_task
Eric W. Biedermand73d6522006-03-28 16:11:03 -0800709 * is called. Odd but simple and correct.
710 */
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700711 detach_pid(tsk, PIDTYPE_PID);
712 tsk->pid = leader->pid;
Sukadev Bhattiprolue713d0d2007-05-10 22:22:58 -0700713 attach_pid(tsk, PIDTYPE_PID, find_pid(tsk->pid));
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700714 transfer_pid(leader, tsk, PIDTYPE_PGID);
715 transfer_pid(leader, tsk, PIDTYPE_SID);
716 list_replace_rcu(&leader->tasks, &tsk->tasks);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700717
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700718 tsk->group_leader = tsk;
719 leader->group_leader = tsk;
Eric W. Biedermande12a782006-04-10 17:16:49 -0600720
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700721 tsk->exit_signal = SIGCHLD;
Oleg Nesterov962b5642005-11-23 13:37:43 -0800722
723 BUG_ON(leader->exit_state != EXIT_ZOMBIE);
724 leader->exit_state = EXIT_DEAD;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700725
726 write_unlock_irq(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700727 }
728
729 /*
Alexander Nybergfb085cf2005-09-14 18:54:06 +0200730 * There may be one thread left which is just exiting,
731 * but it's safe to stop telling the group to kill themselves.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700732 */
733 sig->flags = 0;
734
735no_thread_group:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700736 exit_itimers(sig);
Oleg Nesterov329f7db2005-11-07 21:12:43 +0300737 if (leader)
738 release_task(leader);
739
740 BUG_ON(atomic_read(&sig->count) != 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700741
742 if (atomic_read(&oldsighand->count) == 1) {
743 /*
744 * Now that we nuked the rest of the thread group,
745 * it turns out we are not sharing sighand any more either.
746 * So we can just keep it.
747 */
748 kmem_cache_free(sighand_cachep, newsighand);
749 } else {
750 /*
751 * Move our state over to newsighand and switch it in.
752 */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700753 atomic_set(&newsighand->count, 1);
754 memcpy(newsighand->action, oldsighand->action,
755 sizeof(newsighand->action));
756
757 write_lock_irq(&tasklist_lock);
758 spin_lock(&oldsighand->siglock);
Dave Jones513627d2006-08-27 01:23:57 -0700759 spin_lock_nested(&newsighand->siglock, SINGLE_DEPTH_NESTING);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700760
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700761 rcu_assign_pointer(tsk->sighand, newsighand);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700762 recalc_sigpending();
763
764 spin_unlock(&newsighand->siglock);
765 spin_unlock(&oldsighand->siglock);
766 write_unlock_irq(&tasklist_lock);
767
Davide Libenzifba2afa2007-05-10 22:23:13 -0700768 __cleanup_sighand(oldsighand);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700769 }
770
Eric W. Biedermanaafe6c22006-09-27 01:51:13 -0700771 BUG_ON(!thread_group_leader(tsk));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700772 return 0;
773}
774
775/*
776 * These functions flushes out all traces of the currently running executable
777 * so that a new one can be started
778 */
779
Arjan van de Ven858119e2006-01-14 13:20:43 -0800780static void flush_old_files(struct files_struct * files)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700781{
782 long j = -1;
Dipankar Sarmabadf1662005-09-09 13:04:10 -0700783 struct fdtable *fdt;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700784
785 spin_lock(&files->file_lock);
786 for (;;) {
787 unsigned long set, i;
788
789 j++;
790 i = j * __NFDBITS;
Dipankar Sarmabadf1662005-09-09 13:04:10 -0700791 fdt = files_fdtable(files);
Vadim Lobanovbbea9f62006-12-10 02:21:12 -0800792 if (i >= fdt->max_fds)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700793 break;
Dipankar Sarmabadf1662005-09-09 13:04:10 -0700794 set = fdt->close_on_exec->fds_bits[j];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700795 if (!set)
796 continue;
Dipankar Sarmabadf1662005-09-09 13:04:10 -0700797 fdt->close_on_exec->fds_bits[j] = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700798 spin_unlock(&files->file_lock);
799 for ( ; set ; i++,set >>= 1) {
800 if (set & 1) {
801 sys_close(i);
802 }
803 }
804 spin_lock(&files->file_lock);
805
806 }
807 spin_unlock(&files->file_lock);
808}
809
810void get_task_comm(char *buf, struct task_struct *tsk)
811{
812 /* buf must be at least sizeof(tsk->comm) in size */
813 task_lock(tsk);
814 strncpy(buf, tsk->comm, sizeof(tsk->comm));
815 task_unlock(tsk);
816}
817
818void set_task_comm(struct task_struct *tsk, char *buf)
819{
820 task_lock(tsk);
821 strlcpy(tsk->comm, buf, sizeof(tsk->comm));
822 task_unlock(tsk);
823}
824
825int flush_old_exec(struct linux_binprm * bprm)
826{
827 char * name;
828 int i, ch, retval;
829 struct files_struct *files;
830 char tcomm[sizeof(current->comm)];
831
832 /*
833 * Make sure we have a private signal table and that
834 * we are unassociated from the previous thread group.
835 */
836 retval = de_thread(current);
837 if (retval)
838 goto out;
839
840 /*
841 * Make sure we have private file handles. Ask the
842 * fork helper to do the work for us and the exit
843 * helper to do the cleanup of the old one.
844 */
845 files = current->files; /* refcounted so safe to hold */
846 retval = unshare_files();
847 if (retval)
848 goto out;
849 /*
850 * Release all of the old mmap stuff
851 */
852 retval = exec_mmap(bprm->mm);
853 if (retval)
854 goto mmap_failed;
855
856 bprm->mm = NULL; /* We're using it now */
857
858 /* This is the point of no return */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700859 put_files_struct(files);
860
861 current->sas_ss_sp = current->sas_ss_size = 0;
862
863 if (current->euid == current->uid && current->egid == current->gid)
864 current->mm->dumpable = 1;
Alan Coxd6e71142005-06-23 00:09:43 -0700865 else
866 current->mm->dumpable = suid_dumpable;
867
Linus Torvalds1da177e2005-04-16 15:20:36 -0700868 name = bprm->filename;
Paolo 'Blaisorblade' Giarrusso36772092005-05-05 16:16:12 -0700869
870 /* Copies the binary name from after last slash */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700871 for (i=0; (ch = *(name++)) != '\0';) {
872 if (ch == '/')
Paolo 'Blaisorblade' Giarrusso36772092005-05-05 16:16:12 -0700873 i = 0; /* overwrite what we wrote */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700874 else
875 if (i < (sizeof(tcomm) - 1))
876 tcomm[i++] = ch;
877 }
878 tcomm[i] = '\0';
879 set_task_comm(current, tcomm);
880
881 current->flags &= ~PF_RANDOMIZE;
882 flush_thread();
883
Benjamin Herrenschmidt0551fbd2006-02-28 16:59:19 -0800884 /* Set the new mm task size. We have to do that late because it may
885 * depend on TIF_32BIT which is only updated in flush_thread() on
886 * some architectures like powerpc
887 */
888 current->mm->task_size = TASK_SIZE;
889
Linus Torvalds1da177e2005-04-16 15:20:36 -0700890 if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
Christoph Hellwig8c744fb2005-11-08 21:35:04 -0800891 file_permission(bprm->file, MAY_READ) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -0700892 (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
893 suid_keys(current);
Alan Coxd6e71142005-06-23 00:09:43 -0700894 current->mm->dumpable = suid_dumpable;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700895 }
896
897 /* An exec changes our domain. We are no longer part of the thread
898 group */
899
900 current->self_exec_id++;
901
902 flush_signal_handlers(current, 0);
903 flush_old_files(current->files);
904
905 return 0;
906
907mmap_failed:
Kirill Korotaev3b9b8ab2006-09-29 02:00:05 -0700908 reset_files_struct(current, files);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700909out:
910 return retval;
911}
912
913EXPORT_SYMBOL(flush_old_exec);
914
915/*
916 * Fill the binprm structure from the inode.
917 * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
918 */
919int prepare_binprm(struct linux_binprm *bprm)
920{
921 int mode;
Josef "Jeff" Sipek0f7fc9e2006-12-08 02:36:35 -0800922 struct inode * inode = bprm->file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700923 int retval;
924
925 mode = inode->i_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700926 if (bprm->file->f_op == NULL)
927 return -EACCES;
928
929 bprm->e_uid = current->euid;
930 bprm->e_gid = current->egid;
931
Josef "Jeff" Sipek0f7fc9e2006-12-08 02:36:35 -0800932 if(!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700933 /* Set-uid? */
934 if (mode & S_ISUID) {
935 current->personality &= ~PER_CLEAR_ON_SETID;
936 bprm->e_uid = inode->i_uid;
937 }
938
939 /* Set-gid? */
940 /*
941 * If setgid is set but no group execute bit then this
942 * is a candidate for mandatory locking, not a setgid
943 * executable.
944 */
945 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
946 current->personality &= ~PER_CLEAR_ON_SETID;
947 bprm->e_gid = inode->i_gid;
948 }
949 }
950
951 /* fill in binprm security blob */
952 retval = security_bprm_set(bprm);
953 if (retval)
954 return retval;
955
956 memset(bprm->buf,0,BINPRM_BUF_SIZE);
957 return kernel_read(bprm->file,0,bprm->buf,BINPRM_BUF_SIZE);
958}
959
960EXPORT_SYMBOL(prepare_binprm);
961
Arjan van de Ven858119e2006-01-14 13:20:43 -0800962static int unsafe_exec(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700963{
964 int unsafe = 0;
965 if (p->ptrace & PT_PTRACED) {
966 if (p->ptrace & PT_PTRACE_CAP)
967 unsafe |= LSM_UNSAFE_PTRACE_CAP;
968 else
969 unsafe |= LSM_UNSAFE_PTRACE;
970 }
971 if (atomic_read(&p->fs->count) > 1 ||
972 atomic_read(&p->files->count) > 1 ||
973 atomic_read(&p->sighand->count) > 1)
974 unsafe |= LSM_UNSAFE_SHARE;
975
976 return unsafe;
977}
978
979void compute_creds(struct linux_binprm *bprm)
980{
981 int unsafe;
982
983 if (bprm->e_uid != current->uid)
984 suid_keys(current);
985 exec_keys(current);
986
987 task_lock(current);
988 unsafe = unsafe_exec(current);
989 security_bprm_apply_creds(bprm, unsafe);
990 task_unlock(current);
991 security_bprm_post_apply_creds(bprm);
992}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700993EXPORT_SYMBOL(compute_creds);
994
Nick Piggin4fc75ff2007-05-08 00:25:16 -0700995/*
996 * Arguments are '\0' separated strings found at the location bprm->p
997 * points to; chop off the first by relocating brpm->p to right after
998 * the first '\0' encountered.
999 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001000void remove_arg_zero(struct linux_binprm *bprm)
1001{
1002 if (bprm->argc) {
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001003 char ch;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001004
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001005 do {
1006 unsigned long offset;
1007 unsigned long index;
1008 char *kaddr;
1009 struct page *page;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001010
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001011 offset = bprm->p & ~PAGE_MASK;
1012 index = bprm->p >> PAGE_SHIFT;
1013
1014 page = bprm->page[index];
Linus Torvalds1da177e2005-04-16 15:20:36 -07001015 kaddr = kmap_atomic(page, KM_USER0);
Nick Piggin4fc75ff2007-05-08 00:25:16 -07001016
1017 /* run through page until we reach end or find NUL */
1018 do {
1019 ch = *(kaddr + offset);
1020
1021 /* discard that character... */
1022 bprm->p++;
1023 offset++;
1024 } while (offset < PAGE_SIZE && ch != '\0');
1025
1026 kunmap_atomic(kaddr, KM_USER0);
1027
1028 /* free the old page */
1029 if (offset == PAGE_SIZE) {
1030 __free_page(page);
1031 bprm->page[index] = NULL;
1032 }
1033 } while (ch != '\0');
1034
Linus Torvalds1da177e2005-04-16 15:20:36 -07001035 bprm->argc--;
1036 }
1037}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001038EXPORT_SYMBOL(remove_arg_zero);
1039
1040/*
1041 * cycle the list of binary formats handler, until one recognizes the image
1042 */
1043int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
1044{
1045 int try,retval;
1046 struct linux_binfmt *fmt;
1047#ifdef __alpha__
1048 /* handle /sbin/loader.. */
1049 {
1050 struct exec * eh = (struct exec *) bprm->buf;
1051
1052 if (!bprm->loader && eh->fh.f_magic == 0x183 &&
1053 (eh->fh.f_flags & 0x3000) == 0x3000)
1054 {
1055 struct file * file;
1056 unsigned long loader;
1057
1058 allow_write_access(bprm->file);
1059 fput(bprm->file);
1060 bprm->file = NULL;
1061
1062 loader = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
1063
1064 file = open_exec("/sbin/loader");
1065 retval = PTR_ERR(file);
1066 if (IS_ERR(file))
1067 return retval;
1068
1069 /* Remember if the application is TASO. */
1070 bprm->sh_bang = eh->ah.entry < 0x100000000UL;
1071
1072 bprm->file = file;
1073 bprm->loader = loader;
1074 retval = prepare_binprm(bprm);
1075 if (retval<0)
1076 return retval;
1077 /* should call search_binary_handler recursively here,
1078 but it does not matter */
1079 }
1080 }
1081#endif
1082 retval = security_bprm_check(bprm);
1083 if (retval)
1084 return retval;
1085
1086 /* kernel module loader fixup */
1087 /* so we don't try to load run modprobe in kernel space. */
1088 set_fs(USER_DS);
Al Viro473ae302006-04-26 14:04:08 -04001089
1090 retval = audit_bprm(bprm);
1091 if (retval)
1092 return retval;
1093
Linus Torvalds1da177e2005-04-16 15:20:36 -07001094 retval = -ENOENT;
1095 for (try=0; try<2; try++) {
1096 read_lock(&binfmt_lock);
1097 for (fmt = formats ; fmt ; fmt = fmt->next) {
1098 int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
1099 if (!fn)
1100 continue;
1101 if (!try_module_get(fmt->module))
1102 continue;
1103 read_unlock(&binfmt_lock);
1104 retval = fn(bprm, regs);
1105 if (retval >= 0) {
1106 put_binfmt(fmt);
1107 allow_write_access(bprm->file);
1108 if (bprm->file)
1109 fput(bprm->file);
1110 bprm->file = NULL;
1111 current->did_exec = 1;
Matt Helsley9f460802005-11-07 00:59:16 -08001112 proc_exec_connector(current);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001113 return retval;
1114 }
1115 read_lock(&binfmt_lock);
1116 put_binfmt(fmt);
1117 if (retval != -ENOEXEC || bprm->mm == NULL)
1118 break;
1119 if (!bprm->file) {
1120 read_unlock(&binfmt_lock);
1121 return retval;
1122 }
1123 }
1124 read_unlock(&binfmt_lock);
1125 if (retval != -ENOEXEC || bprm->mm == NULL) {
1126 break;
1127#ifdef CONFIG_KMOD
1128 }else{
1129#define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
1130 if (printable(bprm->buf[0]) &&
1131 printable(bprm->buf[1]) &&
1132 printable(bprm->buf[2]) &&
1133 printable(bprm->buf[3]))
1134 break; /* -ENOEXEC */
1135 request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
1136#endif
1137 }
1138 }
1139 return retval;
1140}
1141
1142EXPORT_SYMBOL(search_binary_handler);
1143
1144/*
1145 * sys_execve() executes a new program.
1146 */
1147int do_execve(char * filename,
1148 char __user *__user *argv,
1149 char __user *__user *envp,
1150 struct pt_regs * regs)
1151{
1152 struct linux_binprm *bprm;
1153 struct file *file;
1154 int retval;
1155 int i;
1156
1157 retval = -ENOMEM;
Oliver Neukum11b0b5a2006-03-25 03:08:13 -08001158 bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001159 if (!bprm)
1160 goto out_ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001161
1162 file = open_exec(filename);
1163 retval = PTR_ERR(file);
1164 if (IS_ERR(file))
1165 goto out_kfree;
1166
1167 sched_exec();
1168
1169 bprm->p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
1170
1171 bprm->file = file;
1172 bprm->filename = filename;
1173 bprm->interp = filename;
1174 bprm->mm = mm_alloc();
1175 retval = -ENOMEM;
1176 if (!bprm->mm)
1177 goto out_file;
1178
1179 retval = init_new_context(current, bprm->mm);
1180 if (retval < 0)
1181 goto out_mm;
1182
1183 bprm->argc = count(argv, bprm->p / sizeof(void *));
1184 if ((retval = bprm->argc) < 0)
1185 goto out_mm;
1186
1187 bprm->envc = count(envp, bprm->p / sizeof(void *));
1188 if ((retval = bprm->envc) < 0)
1189 goto out_mm;
1190
1191 retval = security_bprm_alloc(bprm);
1192 if (retval)
1193 goto out;
1194
1195 retval = prepare_binprm(bprm);
1196 if (retval < 0)
1197 goto out;
1198
1199 retval = copy_strings_kernel(1, &bprm->filename, bprm);
1200 if (retval < 0)
1201 goto out;
1202
1203 bprm->exec = bprm->p;
1204 retval = copy_strings(bprm->envc, envp, bprm);
1205 if (retval < 0)
1206 goto out;
1207
1208 retval = copy_strings(bprm->argc, argv, bprm);
1209 if (retval < 0)
1210 goto out;
1211
1212 retval = search_binary_handler(bprm,regs);
1213 if (retval >= 0) {
1214 free_arg_pages(bprm);
1215
1216 /* execve success */
1217 security_bprm_free(bprm);
1218 acct_update_integrals(current);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001219 kfree(bprm);
1220 return retval;
1221 }
1222
1223out:
1224 /* Something went wrong, return the inode and free the argument pages*/
1225 for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
1226 struct page * page = bprm->page[i];
1227 if (page)
1228 __free_page(page);
1229 }
1230
1231 if (bprm->security)
1232 security_bprm_free(bprm);
1233
1234out_mm:
1235 if (bprm->mm)
1236 mmdrop(bprm->mm);
1237
1238out_file:
1239 if (bprm->file) {
1240 allow_write_access(bprm->file);
1241 fput(bprm->file);
1242 }
1243
1244out_kfree:
1245 kfree(bprm);
1246
1247out_ret:
1248 return retval;
1249}
1250
1251int set_binfmt(struct linux_binfmt *new)
1252{
1253 struct linux_binfmt *old = current->binfmt;
1254
1255 if (new) {
1256 if (!try_module_get(new->module))
1257 return -1;
1258 }
1259 current->binfmt = new;
1260 if (old)
1261 module_put(old->module);
1262 return 0;
1263}
1264
1265EXPORT_SYMBOL(set_binfmt);
1266
Linus Torvalds1da177e2005-04-16 15:20:36 -07001267/* format_corename will inspect the pattern parameter, and output a
1268 * name into corename, which must have space for at least
1269 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
1270 */
Alan Coxc4bbafd2007-04-16 22:53:13 -07001271static int format_corename(char *corename, const char *pattern, long signr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001272{
1273 const char *pat_ptr = pattern;
1274 char *out_ptr = corename;
1275 char *const out_end = corename + CORENAME_MAX_SIZE;
1276 int rc;
1277 int pid_in_pattern = 0;
Alan Coxc4bbafd2007-04-16 22:53:13 -07001278 int ispipe = 0;
1279
1280 if (*pattern == '|')
1281 ispipe = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001282
1283 /* Repeat as long as we have more pattern to process and more output
1284 space */
1285 while (*pat_ptr) {
1286 if (*pat_ptr != '%') {
1287 if (out_ptr == out_end)
1288 goto out;
1289 *out_ptr++ = *pat_ptr++;
1290 } else {
1291 switch (*++pat_ptr) {
1292 case 0:
1293 goto out;
1294 /* Double percent, output one percent */
1295 case '%':
1296 if (out_ptr == out_end)
1297 goto out;
1298 *out_ptr++ = '%';
1299 break;
1300 /* pid */
1301 case 'p':
1302 pid_in_pattern = 1;
1303 rc = snprintf(out_ptr, out_end - out_ptr,
1304 "%d", current->tgid);
1305 if (rc > out_end - out_ptr)
1306 goto out;
1307 out_ptr += rc;
1308 break;
1309 /* uid */
1310 case 'u':
1311 rc = snprintf(out_ptr, out_end - out_ptr,
1312 "%d", current->uid);
1313 if (rc > out_end - out_ptr)
1314 goto out;
1315 out_ptr += rc;
1316 break;
1317 /* gid */
1318 case 'g':
1319 rc = snprintf(out_ptr, out_end - out_ptr,
1320 "%d", current->gid);
1321 if (rc > out_end - out_ptr)
1322 goto out;
1323 out_ptr += rc;
1324 break;
1325 /* signal that caused the coredump */
1326 case 's':
1327 rc = snprintf(out_ptr, out_end - out_ptr,
1328 "%ld", signr);
1329 if (rc > out_end - out_ptr)
1330 goto out;
1331 out_ptr += rc;
1332 break;
1333 /* UNIX time of coredump */
1334 case 't': {
1335 struct timeval tv;
1336 do_gettimeofday(&tv);
1337 rc = snprintf(out_ptr, out_end - out_ptr,
1338 "%lu", tv.tv_sec);
1339 if (rc > out_end - out_ptr)
1340 goto out;
1341 out_ptr += rc;
1342 break;
1343 }
1344 /* hostname */
1345 case 'h':
1346 down_read(&uts_sem);
1347 rc = snprintf(out_ptr, out_end - out_ptr,
Serge E. Hallyne9ff3992006-10-02 02:18:11 -07001348 "%s", utsname()->nodename);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001349 up_read(&uts_sem);
1350 if (rc > out_end - out_ptr)
1351 goto out;
1352 out_ptr += rc;
1353 break;
1354 /* executable */
1355 case 'e':
1356 rc = snprintf(out_ptr, out_end - out_ptr,
1357 "%s", current->comm);
1358 if (rc > out_end - out_ptr)
1359 goto out;
1360 out_ptr += rc;
1361 break;
1362 default:
1363 break;
1364 }
1365 ++pat_ptr;
1366 }
1367 }
1368 /* Backward compatibility with core_uses_pid:
1369 *
1370 * If core_pattern does not include a %p (as is the default)
1371 * and core_uses_pid is set, then .%pid will be appended to
Alan Coxc4bbafd2007-04-16 22:53:13 -07001372 * the filename. Do not do this for piped commands. */
1373 if (!ispipe && !pid_in_pattern
Linus Torvalds1da177e2005-04-16 15:20:36 -07001374 && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
1375 rc = snprintf(out_ptr, out_end - out_ptr,
1376 ".%d", current->tgid);
1377 if (rc > out_end - out_ptr)
1378 goto out;
1379 out_ptr += rc;
1380 }
Alan Coxc4bbafd2007-04-16 22:53:13 -07001381out:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001382 *out_ptr = 0;
Alan Coxc4bbafd2007-04-16 22:53:13 -07001383 return ispipe;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001384}
1385
Oleg Nesterovd5f70c02006-06-26 00:26:07 -07001386static void zap_process(struct task_struct *start)
Oleg Nesterovaceecc02006-06-26 00:26:05 -07001387{
1388 struct task_struct *t;
Oleg Nesterov281de332006-06-26 00:26:06 -07001389
Oleg Nesterovd5f70c02006-06-26 00:26:07 -07001390 start->signal->flags = SIGNAL_GROUP_EXIT;
1391 start->signal->group_stop_count = 0;
Oleg Nesterovaceecc02006-06-26 00:26:05 -07001392
1393 t = start;
1394 do {
1395 if (t != current && t->mm) {
1396 t->mm->core_waiters++;
Oleg Nesterov281de332006-06-26 00:26:06 -07001397 sigaddset(&t->pending.signal, SIGKILL);
1398 signal_wake_up(t, 1);
Oleg Nesterovaceecc02006-06-26 00:26:05 -07001399 }
1400 } while ((t = next_thread(t)) != start);
1401}
1402
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001403static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
1404 int exit_code)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001405{
1406 struct task_struct *g, *p;
Oleg Nesterov5debfa62006-06-26 00:26:09 -07001407 unsigned long flags;
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001408 int err = -EAGAIN;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001409
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001410 spin_lock_irq(&tsk->sighand->siglock);
1411 if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT)) {
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001412 tsk->signal->group_exit_code = exit_code;
Oleg Nesterov5debfa62006-06-26 00:26:09 -07001413 zap_process(tsk);
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001414 err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001415 }
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001416 spin_unlock_irq(&tsk->sighand->siglock);
1417 if (err)
1418 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001419
Oleg Nesterov5debfa62006-06-26 00:26:09 -07001420 if (atomic_read(&mm->mm_users) == mm->core_waiters + 1)
1421 goto done;
1422
Oleg Nesterov7b1c6152006-06-26 00:26:08 -07001423 rcu_read_lock();
Oleg Nesterovaceecc02006-06-26 00:26:05 -07001424 for_each_process(g) {
Oleg Nesterov5debfa62006-06-26 00:26:09 -07001425 if (g == tsk->group_leader)
1426 continue;
1427
Oleg Nesterovaceecc02006-06-26 00:26:05 -07001428 p = g;
1429 do {
1430 if (p->mm) {
Oleg Nesterov5debfa62006-06-26 00:26:09 -07001431 if (p->mm == mm) {
1432 /*
1433 * p->sighand can't disappear, but
1434 * may be changed by de_thread()
1435 */
1436 lock_task_sighand(p, &flags);
Oleg Nesterovd5f70c02006-06-26 00:26:07 -07001437 zap_process(p);
Oleg Nesterov5debfa62006-06-26 00:26:09 -07001438 unlock_task_sighand(p, &flags);
1439 }
Oleg Nesterovaceecc02006-06-26 00:26:05 -07001440 break;
1441 }
1442 } while ((p = next_thread(p)) != g);
1443 }
Oleg Nesterov7b1c6152006-06-26 00:26:08 -07001444 rcu_read_unlock();
Oleg Nesterov5debfa62006-06-26 00:26:09 -07001445done:
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001446 return mm->core_waiters;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001447}
1448
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001449static int coredump_wait(int exit_code)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001450{
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001451 struct task_struct *tsk = current;
1452 struct mm_struct *mm = tsk->mm;
1453 struct completion startup_done;
1454 struct completion *vfork_done;
Oleg Nesterov2384f552005-10-30 15:02:47 -08001455 int core_waiters;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001456
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001457 init_completion(&mm->core_done);
1458 init_completion(&startup_done);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001459 mm->core_startup_done = &startup_done;
1460
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001461 core_waiters = zap_threads(tsk, mm, exit_code);
Oleg Nesterov2384f552005-10-30 15:02:47 -08001462 up_write(&mm->mmap_sem);
1463
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001464 if (unlikely(core_waiters < 0))
1465 goto fail;
1466
1467 /*
1468 * Make sure nobody is waiting for us to release the VM,
1469 * otherwise we can deadlock when we wait on each other
1470 */
1471 vfork_done = tsk->vfork_done;
1472 if (vfork_done) {
1473 tsk->vfork_done = NULL;
1474 complete(vfork_done);
1475 }
1476
Oleg Nesterov2384f552005-10-30 15:02:47 -08001477 if (core_waiters)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001478 wait_for_completion(&startup_done);
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001479fail:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001480 BUG_ON(mm->core_waiters);
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001481 return core_waiters;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001482}
1483
1484int do_coredump(long signr, int exit_code, struct pt_regs * regs)
1485{
1486 char corename[CORENAME_MAX_SIZE + 1];
1487 struct mm_struct *mm = current->mm;
1488 struct linux_binfmt * binfmt;
1489 struct inode * inode;
1490 struct file * file;
1491 int retval = 0;
Alan Coxd6e71142005-06-23 00:09:43 -07001492 int fsuid = current->fsuid;
1493 int flag = 0;
Andi Kleend025c9d2006-09-30 23:29:28 -07001494 int ispipe = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001495
Steve Grubb0a4ff8c2007-04-19 10:28:21 -04001496 audit_core_dumps(signr);
1497
Linus Torvalds1da177e2005-04-16 15:20:36 -07001498 binfmt = current->binfmt;
1499 if (!binfmt || !binfmt->core_dump)
1500 goto fail;
1501 down_write(&mm->mmap_sem);
1502 if (!mm->dumpable) {
1503 up_write(&mm->mmap_sem);
1504 goto fail;
1505 }
Alan Coxd6e71142005-06-23 00:09:43 -07001506
1507 /*
1508 * We cannot trust fsuid as being the "true" uid of the
1509 * process nor do we know its entire history. We only know it
1510 * was tainted so we dump it as root in mode 2.
1511 */
1512 if (mm->dumpable == 2) { /* Setuid core dump mode */
1513 flag = O_EXCL; /* Stop rewrite attacks */
1514 current->fsuid = 0; /* Dump root private */
1515 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001516 mm->dumpable = 0;
Oleg Nesterov1291cf42005-10-30 15:02:54 -08001517
Oleg Nesterovdcf560c2006-06-26 00:26:08 -07001518 retval = coredump_wait(exit_code);
1519 if (retval < 0)
Oleg Nesterov1291cf42005-10-30 15:02:54 -08001520 goto fail;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001521
1522 /*
1523 * Clear any false indication of pending signals that might
1524 * be seen by the filesystem code called to write the core file.
1525 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001526 clear_thread_flag(TIF_SIGPENDING);
1527
1528 if (current->signal->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
1529 goto fail_unlock;
1530
1531 /*
1532 * lock_kernel() because format_corename() is controlled by sysctl, which
1533 * uses lock_kernel()
1534 */
1535 lock_kernel();
Alan Coxc4bbafd2007-04-16 22:53:13 -07001536 ispipe = format_corename(corename, core_pattern, signr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001537 unlock_kernel();
Alan Coxc4bbafd2007-04-16 22:53:13 -07001538 if (ispipe) {
Andi Kleend025c9d2006-09-30 23:29:28 -07001539 /* SIGPIPE can happen, but it's just never processed */
1540 if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
1541 printk(KERN_INFO "Core dump to %s pipe failed\n",
1542 corename);
1543 goto fail_unlock;
1544 }
Andi Kleend025c9d2006-09-30 23:29:28 -07001545 } else
1546 file = filp_open(corename,
Alexey Dobriyan6d4df672006-12-06 20:40:39 -08001547 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
1548 0600);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001549 if (IS_ERR(file))
1550 goto fail_unlock;
Josef "Jeff" Sipek0f7fc9e2006-12-08 02:36:35 -08001551 inode = file->f_path.dentry->d_inode;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001552 if (inode->i_nlink > 1)
1553 goto close_fail; /* multiple links - don't dump */
Josef "Jeff" Sipek0f7fc9e2006-12-08 02:36:35 -08001554 if (!ispipe && d_unhashed(file->f_path.dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001555 goto close_fail;
1556
Andi Kleend025c9d2006-09-30 23:29:28 -07001557 /* AK: actually i see no reason to not allow this for named pipes etc.,
1558 but keep the previous behaviour for now. */
1559 if (!ispipe && !S_ISREG(inode->i_mode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001560 goto close_fail;
1561 if (!file->f_op)
1562 goto close_fail;
1563 if (!file->f_op->write)
1564 goto close_fail;
Josef "Jeff" Sipek0f7fc9e2006-12-08 02:36:35 -08001565 if (!ispipe && do_truncate(file->f_path.dentry, 0, 0, file) != 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001566 goto close_fail;
1567
1568 retval = binfmt->core_dump(signr, regs, file);
1569
1570 if (retval)
1571 current->signal->group_exit_code |= 0x80;
1572close_fail:
1573 filp_close(file, NULL);
1574fail_unlock:
Alan Coxd6e71142005-06-23 00:09:43 -07001575 current->fsuid = fsuid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001576 complete_all(&mm->core_done);
1577fail:
1578 return retval;
1579}