xref: /openbmc/linux/fs/exec.c (revision d5cb9783536a41df9f9cba5b0a1d78047ed787f7)
1 /*
2  *  linux/fs/exec.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6 
7 /*
8  * #!-checking implemented by tytso.
9  */
10 /*
11  * Demand-loading implemented 01.12.91 - no need to read anything but
12  * the header into memory. The inode of the executable is put into
13  * "current->executable", and page faults do the actual loading. Clean.
14  *
15  * Once more I can proudly say that linux stood up to being changed: it
16  * was less than 2 hours work to get demand-loading completely implemented.
17  *
18  * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
19  * current->executable is only used by the procfs.  This allows a dispatch
20  * table to check for several different types  of binary formats.  We keep
21  * trying until we recognize the file or we run out of supported binary
22  * formats.
23  */
24 
25 #include <linux/config.h>
26 #include <linux/slab.h>
27 #include <linux/file.h>
28 #include <linux/mman.h>
29 #include <linux/a.out.h>
30 #include <linux/stat.h>
31 #include <linux/fcntl.h>
32 #include <linux/smp_lock.h>
33 #include <linux/init.h>
34 #include <linux/pagemap.h>
35 #include <linux/highmem.h>
36 #include <linux/spinlock.h>
37 #include <linux/key.h>
38 #include <linux/personality.h>
39 #include <linux/binfmts.h>
40 #include <linux/swap.h>
41 #include <linux/utsname.h>
42 #include <linux/module.h>
43 #include <linux/namei.h>
44 #include <linux/proc_fs.h>
45 #include <linux/ptrace.h>
46 #include <linux/mount.h>
47 #include <linux/security.h>
48 #include <linux/syscalls.h>
49 #include <linux/rmap.h>
50 #include <linux/acct.h>
51 
52 #include <asm/uaccess.h>
53 #include <asm/mmu_context.h>
54 
55 #ifdef CONFIG_KMOD
56 #include <linux/kmod.h>
57 #endif
58 
59 int core_uses_pid;
60 char core_pattern[65] = "core";
61 int suid_dumpable = 0;
62 
63 EXPORT_SYMBOL(suid_dumpable);
64 /* The maximal length of core_pattern is also specified in sysctl.c */
65 
66 static struct linux_binfmt *formats;
67 static DEFINE_RWLOCK(binfmt_lock);
68 
69 int register_binfmt(struct linux_binfmt * fmt)
70 {
71 	struct linux_binfmt ** tmp = &formats;
72 
73 	if (!fmt)
74 		return -EINVAL;
75 	if (fmt->next)
76 		return -EBUSY;
77 	write_lock(&binfmt_lock);
78 	while (*tmp) {
79 		if (fmt == *tmp) {
80 			write_unlock(&binfmt_lock);
81 			return -EBUSY;
82 		}
83 		tmp = &(*tmp)->next;
84 	}
85 	fmt->next = formats;
86 	formats = fmt;
87 	write_unlock(&binfmt_lock);
88 	return 0;
89 }
90 
91 EXPORT_SYMBOL(register_binfmt);
92 
93 int unregister_binfmt(struct linux_binfmt * fmt)
94 {
95 	struct linux_binfmt ** tmp = &formats;
96 
97 	write_lock(&binfmt_lock);
98 	while (*tmp) {
99 		if (fmt == *tmp) {
100 			*tmp = fmt->next;
101 			write_unlock(&binfmt_lock);
102 			return 0;
103 		}
104 		tmp = &(*tmp)->next;
105 	}
106 	write_unlock(&binfmt_lock);
107 	return -EINVAL;
108 }
109 
110 EXPORT_SYMBOL(unregister_binfmt);
111 
112 static inline void put_binfmt(struct linux_binfmt * fmt)
113 {
114 	module_put(fmt->module);
115 }
116 
117 /*
118  * Note that a shared library must be both readable and executable due to
119  * security reasons.
120  *
121  * Also note that we take the address to load from from the file itself.
122  */
123 asmlinkage long sys_uselib(const char __user * library)
124 {
125 	struct file * file;
126 	struct nameidata nd;
127 	int error;
128 
129 	error = __user_path_lookup_open(library, LOOKUP_FOLLOW, &nd, FMODE_READ);
130 	if (error)
131 		goto out;
132 
133 	error = -EINVAL;
134 	if (!S_ISREG(nd.dentry->d_inode->i_mode))
135 		goto exit;
136 
137 	error = permission(nd.dentry->d_inode, MAY_READ | MAY_EXEC, &nd);
138 	if (error)
139 		goto exit;
140 
141 	file = nameidata_to_filp(&nd, O_RDONLY);
142 	error = PTR_ERR(file);
143 	if (IS_ERR(file))
144 		goto out;
145 
146 	error = -ENOEXEC;
147 	if(file->f_op) {
148 		struct linux_binfmt * fmt;
149 
150 		read_lock(&binfmt_lock);
151 		for (fmt = formats ; fmt ; fmt = fmt->next) {
152 			if (!fmt->load_shlib)
153 				continue;
154 			if (!try_module_get(fmt->module))
155 				continue;
156 			read_unlock(&binfmt_lock);
157 			error = fmt->load_shlib(file);
158 			read_lock(&binfmt_lock);
159 			put_binfmt(fmt);
160 			if (error != -ENOEXEC)
161 				break;
162 		}
163 		read_unlock(&binfmt_lock);
164 	}
165 	fput(file);
166 out:
167   	return error;
168 exit:
169 	release_open_intent(&nd);
170 	path_release(&nd);
171 	goto out;
172 }
173 
174 /*
175  * count() counts the number of strings in array ARGV.
176  */
177 static int count(char __user * __user * argv, int max)
178 {
179 	int i = 0;
180 
181 	if (argv != NULL) {
182 		for (;;) {
183 			char __user * p;
184 
185 			if (get_user(p, argv))
186 				return -EFAULT;
187 			if (!p)
188 				break;
189 			argv++;
190 			if(++i > max)
191 				return -E2BIG;
192 			cond_resched();
193 		}
194 	}
195 	return i;
196 }
197 
198 /*
199  * 'copy_strings()' copies argument/environment strings from user
200  * memory to free pages in kernel mem. These are in a format ready
201  * to be put directly into the top of new user memory.
202  */
203 static int copy_strings(int argc, char __user * __user * argv,
204 			struct linux_binprm *bprm)
205 {
206 	struct page *kmapped_page = NULL;
207 	char *kaddr = NULL;
208 	int ret;
209 
210 	while (argc-- > 0) {
211 		char __user *str;
212 		int len;
213 		unsigned long pos;
214 
215 		if (get_user(str, argv+argc) ||
216 				!(len = strnlen_user(str, bprm->p))) {
217 			ret = -EFAULT;
218 			goto out;
219 		}
220 
221 		if (bprm->p < len)  {
222 			ret = -E2BIG;
223 			goto out;
224 		}
225 
226 		bprm->p -= len;
227 		/* XXX: add architecture specific overflow check here. */
228 		pos = bprm->p;
229 
230 		while (len > 0) {
231 			int i, new, err;
232 			int offset, bytes_to_copy;
233 			struct page *page;
234 
235 			offset = pos % PAGE_SIZE;
236 			i = pos/PAGE_SIZE;
237 			page = bprm->page[i];
238 			new = 0;
239 			if (!page) {
240 				page = alloc_page(GFP_HIGHUSER);
241 				bprm->page[i] = page;
242 				if (!page) {
243 					ret = -ENOMEM;
244 					goto out;
245 				}
246 				new = 1;
247 			}
248 
249 			if (page != kmapped_page) {
250 				if (kmapped_page)
251 					kunmap(kmapped_page);
252 				kmapped_page = page;
253 				kaddr = kmap(kmapped_page);
254 			}
255 			if (new && offset)
256 				memset(kaddr, 0, offset);
257 			bytes_to_copy = PAGE_SIZE - offset;
258 			if (bytes_to_copy > len) {
259 				bytes_to_copy = len;
260 				if (new)
261 					memset(kaddr+offset+len, 0,
262 						PAGE_SIZE-offset-len);
263 			}
264 			err = copy_from_user(kaddr+offset, str, bytes_to_copy);
265 			if (err) {
266 				ret = -EFAULT;
267 				goto out;
268 			}
269 
270 			pos += bytes_to_copy;
271 			str += bytes_to_copy;
272 			len -= bytes_to_copy;
273 		}
274 	}
275 	ret = 0;
276 out:
277 	if (kmapped_page)
278 		kunmap(kmapped_page);
279 	return ret;
280 }
281 
282 /*
283  * Like copy_strings, but get argv and its values from kernel memory.
284  */
285 int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
286 {
287 	int r;
288 	mm_segment_t oldfs = get_fs();
289 	set_fs(KERNEL_DS);
290 	r = copy_strings(argc, (char __user * __user *)argv, bprm);
291 	set_fs(oldfs);
292 	return r;
293 }
294 
295 EXPORT_SYMBOL(copy_strings_kernel);
296 
297 #ifdef CONFIG_MMU
298 /*
299  * This routine is used to map in a page into an address space: needed by
300  * execve() for the initial stack and environment pages.
301  *
302  * vma->vm_mm->mmap_sem is held for writing.
303  */
304 void install_arg_page(struct vm_area_struct *vma,
305 			struct page *page, unsigned long address)
306 {
307 	struct mm_struct *mm = vma->vm_mm;
308 	pgd_t * pgd;
309 	pud_t * pud;
310 	pmd_t * pmd;
311 	pte_t * pte;
312 	spinlock_t *ptl;
313 
314 	if (unlikely(anon_vma_prepare(vma)))
315 		goto out;
316 
317 	flush_dcache_page(page);
318 	pgd = pgd_offset(mm, address);
319 	pud = pud_alloc(mm, pgd, address);
320 	if (!pud)
321 		goto out;
322 	pmd = pmd_alloc(mm, pud, address);
323 	if (!pmd)
324 		goto out;
325 	pte = pte_alloc_map_lock(mm, pmd, address, &ptl);
326 	if (!pte)
327 		goto out;
328 	if (!pte_none(*pte)) {
329 		pte_unmap_unlock(pte, ptl);
330 		goto out;
331 	}
332 	inc_mm_counter(mm, anon_rss);
333 	lru_cache_add_active(page);
334 	set_pte_at(mm, address, pte, pte_mkdirty(pte_mkwrite(mk_pte(
335 					page, vma->vm_page_prot))));
336 	page_add_anon_rmap(page, vma, address);
337 	pte_unmap_unlock(pte, ptl);
338 
339 	/* no need for flush_tlb */
340 	return;
341 out:
342 	__free_page(page);
343 	force_sig(SIGKILL, current);
344 }
345 
346 #define EXTRA_STACK_VM_PAGES	20	/* random */
347 
348 int setup_arg_pages(struct linux_binprm *bprm,
349 		    unsigned long stack_top,
350 		    int executable_stack)
351 {
352 	unsigned long stack_base;
353 	struct vm_area_struct *mpnt;
354 	struct mm_struct *mm = current->mm;
355 	int i, ret;
356 	long arg_size;
357 
358 #ifdef CONFIG_STACK_GROWSUP
359 	/* Move the argument and environment strings to the bottom of the
360 	 * stack space.
361 	 */
362 	int offset, j;
363 	char *to, *from;
364 
365 	/* Start by shifting all the pages down */
366 	i = 0;
367 	for (j = 0; j < MAX_ARG_PAGES; j++) {
368 		struct page *page = bprm->page[j];
369 		if (!page)
370 			continue;
371 		bprm->page[i++] = page;
372 	}
373 
374 	/* Now move them within their pages */
375 	offset = bprm->p % PAGE_SIZE;
376 	to = kmap(bprm->page[0]);
377 	for (j = 1; j < i; j++) {
378 		memmove(to, to + offset, PAGE_SIZE - offset);
379 		from = kmap(bprm->page[j]);
380 		memcpy(to + PAGE_SIZE - offset, from, offset);
381 		kunmap(bprm->page[j - 1]);
382 		to = from;
383 	}
384 	memmove(to, to + offset, PAGE_SIZE - offset);
385 	kunmap(bprm->page[j - 1]);
386 
387 	/* Limit stack size to 1GB */
388 	stack_base = current->signal->rlim[RLIMIT_STACK].rlim_max;
389 	if (stack_base > (1 << 30))
390 		stack_base = 1 << 30;
391 	stack_base = PAGE_ALIGN(stack_top - stack_base);
392 
393 	/* Adjust bprm->p to point to the end of the strings. */
394 	bprm->p = stack_base + PAGE_SIZE * i - offset;
395 
396 	mm->arg_start = stack_base;
397 	arg_size = i << PAGE_SHIFT;
398 
399 	/* zero pages that were copied above */
400 	while (i < MAX_ARG_PAGES)
401 		bprm->page[i++] = NULL;
402 #else
403 	stack_base = arch_align_stack(stack_top - MAX_ARG_PAGES*PAGE_SIZE);
404 	stack_base = PAGE_ALIGN(stack_base);
405 	bprm->p += stack_base;
406 	mm->arg_start = bprm->p;
407 	arg_size = stack_top - (PAGE_MASK & (unsigned long) mm->arg_start);
408 #endif
409 
410 	arg_size += EXTRA_STACK_VM_PAGES * PAGE_SIZE;
411 
412 	if (bprm->loader)
413 		bprm->loader += stack_base;
414 	bprm->exec += stack_base;
415 
416 	mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
417 	if (!mpnt)
418 		return -ENOMEM;
419 
420 	memset(mpnt, 0, sizeof(*mpnt));
421 
422 	down_write(&mm->mmap_sem);
423 	{
424 		mpnt->vm_mm = mm;
425 #ifdef CONFIG_STACK_GROWSUP
426 		mpnt->vm_start = stack_base;
427 		mpnt->vm_end = stack_base + arg_size;
428 #else
429 		mpnt->vm_end = stack_top;
430 		mpnt->vm_start = mpnt->vm_end - arg_size;
431 #endif
432 		/* Adjust stack execute permissions; explicitly enable
433 		 * for EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X
434 		 * and leave alone (arch default) otherwise. */
435 		if (unlikely(executable_stack == EXSTACK_ENABLE_X))
436 			mpnt->vm_flags = VM_STACK_FLAGS |  VM_EXEC;
437 		else if (executable_stack == EXSTACK_DISABLE_X)
438 			mpnt->vm_flags = VM_STACK_FLAGS & ~VM_EXEC;
439 		else
440 			mpnt->vm_flags = VM_STACK_FLAGS;
441 		mpnt->vm_flags |= mm->def_flags;
442 		mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7];
443 		if ((ret = insert_vm_struct(mm, mpnt))) {
444 			up_write(&mm->mmap_sem);
445 			kmem_cache_free(vm_area_cachep, mpnt);
446 			return ret;
447 		}
448 		mm->stack_vm = mm->total_vm = vma_pages(mpnt);
449 	}
450 
451 	for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
452 		struct page *page = bprm->page[i];
453 		if (page) {
454 			bprm->page[i] = NULL;
455 			install_arg_page(mpnt, page, stack_base);
456 		}
457 		stack_base += PAGE_SIZE;
458 	}
459 	up_write(&mm->mmap_sem);
460 
461 	return 0;
462 }
463 
464 EXPORT_SYMBOL(setup_arg_pages);
465 
466 #define free_arg_pages(bprm) do { } while (0)
467 
468 #else
469 
470 static inline void free_arg_pages(struct linux_binprm *bprm)
471 {
472 	int i;
473 
474 	for (i = 0; i < MAX_ARG_PAGES; i++) {
475 		if (bprm->page[i])
476 			__free_page(bprm->page[i]);
477 		bprm->page[i] = NULL;
478 	}
479 }
480 
481 #endif /* CONFIG_MMU */
482 
483 struct file *open_exec(const char *name)
484 {
485 	struct nameidata nd;
486 	int err;
487 	struct file *file;
488 
489 	err = path_lookup_open(name, LOOKUP_FOLLOW, &nd, FMODE_READ);
490 	file = ERR_PTR(err);
491 
492 	if (!err) {
493 		struct inode *inode = nd.dentry->d_inode;
494 		file = ERR_PTR(-EACCES);
495 		if (!(nd.mnt->mnt_flags & MNT_NOEXEC) &&
496 		    S_ISREG(inode->i_mode)) {
497 			int err = permission(inode, MAY_EXEC, &nd);
498 			if (!err && !(inode->i_mode & 0111))
499 				err = -EACCES;
500 			file = ERR_PTR(err);
501 			if (!err) {
502 				file = nameidata_to_filp(&nd, O_RDONLY);
503 				if (!IS_ERR(file)) {
504 					err = deny_write_access(file);
505 					if (err) {
506 						fput(file);
507 						file = ERR_PTR(err);
508 					}
509 				}
510 out:
511 				return file;
512 			}
513 		}
514 		release_open_intent(&nd);
515 		path_release(&nd);
516 	}
517 	goto out;
518 }
519 
520 EXPORT_SYMBOL(open_exec);
521 
522 int kernel_read(struct file *file, unsigned long offset,
523 	char *addr, unsigned long count)
524 {
525 	mm_segment_t old_fs;
526 	loff_t pos = offset;
527 	int result;
528 
529 	old_fs = get_fs();
530 	set_fs(get_ds());
531 	/* The cast to a user pointer is valid due to the set_fs() */
532 	result = vfs_read(file, (void __user *)addr, count, &pos);
533 	set_fs(old_fs);
534 	return result;
535 }
536 
537 EXPORT_SYMBOL(kernel_read);
538 
539 static int exec_mmap(struct mm_struct *mm)
540 {
541 	struct task_struct *tsk;
542 	struct mm_struct * old_mm, *active_mm;
543 
544 	/* Notify parent that we're no longer interested in the old VM */
545 	tsk = current;
546 	old_mm = current->mm;
547 	mm_release(tsk, old_mm);
548 
549 	if (old_mm) {
550 		/*
551 		 * Make sure that if there is a core dump in progress
552 		 * for the old mm, we get out and die instead of going
553 		 * through with the exec.  We must hold mmap_sem around
554 		 * checking core_waiters and changing tsk->mm.  The
555 		 * core-inducing thread will increment core_waiters for
556 		 * each thread whose ->mm == old_mm.
557 		 */
558 		down_read(&old_mm->mmap_sem);
559 		if (unlikely(old_mm->core_waiters)) {
560 			up_read(&old_mm->mmap_sem);
561 			return -EINTR;
562 		}
563 	}
564 	task_lock(tsk);
565 	active_mm = tsk->active_mm;
566 	tsk->mm = mm;
567 	tsk->active_mm = mm;
568 	activate_mm(active_mm, mm);
569 	task_unlock(tsk);
570 	arch_pick_mmap_layout(mm);
571 	if (old_mm) {
572 		up_read(&old_mm->mmap_sem);
573 		if (active_mm != old_mm) BUG();
574 		mmput(old_mm);
575 		return 0;
576 	}
577 	mmdrop(active_mm);
578 	return 0;
579 }
580 
581 /*
582  * This function makes sure the current process has its own signal table,
583  * so that flush_signal_handlers can later reset the handlers without
584  * disturbing other processes.  (Other processes might share the signal
585  * table via the CLONE_SIGHAND option to clone().)
586  */
587 static inline int de_thread(struct task_struct *tsk)
588 {
589 	struct signal_struct *sig = tsk->signal;
590 	struct sighand_struct *newsighand, *oldsighand = tsk->sighand;
591 	spinlock_t *lock = &oldsighand->siglock;
592 	int count;
593 
594 	/*
595 	 * If we don't share sighandlers, then we aren't sharing anything
596 	 * and we can just re-use it all.
597 	 */
598 	if (atomic_read(&oldsighand->count) <= 1) {
599 		BUG_ON(atomic_read(&sig->count) != 1);
600 		exit_itimers(sig);
601 		return 0;
602 	}
603 
604 	newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
605 	if (!newsighand)
606 		return -ENOMEM;
607 
608 	if (thread_group_empty(current))
609 		goto no_thread_group;
610 
611 	/*
612 	 * Kill all other threads in the thread group.
613 	 * We must hold tasklist_lock to call zap_other_threads.
614 	 */
615 	read_lock(&tasklist_lock);
616 	spin_lock_irq(lock);
617 	if (sig->flags & SIGNAL_GROUP_EXIT) {
618 		/*
619 		 * Another group action in progress, just
620 		 * return so that the signal is processed.
621 		 */
622 		spin_unlock_irq(lock);
623 		read_unlock(&tasklist_lock);
624 		kmem_cache_free(sighand_cachep, newsighand);
625 		return -EAGAIN;
626 	}
627 	zap_other_threads(current);
628 	read_unlock(&tasklist_lock);
629 
630 	/*
631 	 * Account for the thread group leader hanging around:
632 	 */
633 	count = 1;
634 	if (!thread_group_leader(current)) {
635 		count = 2;
636 		/*
637 		 * The SIGALRM timer survives the exec, but needs to point
638 		 * at us as the new group leader now.  We have a race with
639 		 * a timer firing now getting the old leader, so we need to
640 		 * synchronize with any firing (by calling del_timer_sync)
641 		 * before we can safely let the old group leader die.
642 		 */
643 		sig->real_timer.data = (unsigned long)current;
644 		spin_unlock_irq(lock);
645 		if (del_timer_sync(&sig->real_timer))
646 			add_timer(&sig->real_timer);
647 		spin_lock_irq(lock);
648 	}
649 	while (atomic_read(&sig->count) > count) {
650 		sig->group_exit_task = current;
651 		sig->notify_count = count;
652 		__set_current_state(TASK_UNINTERRUPTIBLE);
653 		spin_unlock_irq(lock);
654 		schedule();
655 		spin_lock_irq(lock);
656 	}
657 	sig->group_exit_task = NULL;
658 	sig->notify_count = 0;
659 	spin_unlock_irq(lock);
660 
661 	/*
662 	 * At this point all other threads have exited, all we have to
663 	 * do is to wait for the thread group leader to become inactive,
664 	 * and to assume its PID:
665 	 */
666 	if (!thread_group_leader(current)) {
667 		struct task_struct *leader = current->group_leader, *parent;
668 		struct dentry *proc_dentry1, *proc_dentry2;
669 		unsigned long exit_state, ptrace;
670 
671 		/*
672 		 * Wait for the thread group leader to be a zombie.
673 		 * It should already be zombie at this point, most
674 		 * of the time.
675 		 */
676 		while (leader->exit_state != EXIT_ZOMBIE)
677 			yield();
678 
679 		spin_lock(&leader->proc_lock);
680 		spin_lock(&current->proc_lock);
681 		proc_dentry1 = proc_pid_unhash(current);
682 		proc_dentry2 = proc_pid_unhash(leader);
683 		write_lock_irq(&tasklist_lock);
684 
685 		BUG_ON(leader->tgid != current->tgid);
686 		BUG_ON(current->pid == current->tgid);
687 		/*
688 		 * An exec() starts a new thread group with the
689 		 * TGID of the previous thread group. Rehash the
690 		 * two threads with a switched PID, and release
691 		 * the former thread group leader:
692 		 */
693 		ptrace = leader->ptrace;
694 		parent = leader->parent;
695 		if (unlikely(ptrace) && unlikely(parent == current)) {
696 			/*
697 			 * Joker was ptracing his own group leader,
698 			 * and now he wants to be his own parent!
699 			 * We can't have that.
700 			 */
701 			ptrace = 0;
702 		}
703 
704 		ptrace_unlink(current);
705 		ptrace_unlink(leader);
706 		remove_parent(current);
707 		remove_parent(leader);
708 
709 		switch_exec_pids(leader, current);
710 
711 		current->parent = current->real_parent = leader->real_parent;
712 		leader->parent = leader->real_parent = child_reaper;
713 		current->group_leader = current;
714 		leader->group_leader = leader;
715 
716 		add_parent(current, current->parent);
717 		add_parent(leader, leader->parent);
718 		if (ptrace) {
719 			current->ptrace = ptrace;
720 			__ptrace_link(current, parent);
721 		}
722 
723 		list_del(&current->tasks);
724 		list_add_tail(&current->tasks, &init_task.tasks);
725 		current->exit_signal = SIGCHLD;
726 		exit_state = leader->exit_state;
727 
728 		write_unlock_irq(&tasklist_lock);
729 		spin_unlock(&leader->proc_lock);
730 		spin_unlock(&current->proc_lock);
731 		proc_pid_flush(proc_dentry1);
732 		proc_pid_flush(proc_dentry2);
733 
734 		BUG_ON(exit_state != EXIT_ZOMBIE);
735 		release_task(leader);
736         }
737 
738 	/*
739 	 * There may be one thread left which is just exiting,
740 	 * but it's safe to stop telling the group to kill themselves.
741 	 */
742 	sig->flags = 0;
743 
744 no_thread_group:
745 	BUG_ON(atomic_read(&sig->count) != 1);
746 	exit_itimers(sig);
747 
748 	if (atomic_read(&oldsighand->count) == 1) {
749 		/*
750 		 * Now that we nuked the rest of the thread group,
751 		 * it turns out we are not sharing sighand any more either.
752 		 * So we can just keep it.
753 		 */
754 		kmem_cache_free(sighand_cachep, newsighand);
755 	} else {
756 		/*
757 		 * Move our state over to newsighand and switch it in.
758 		 */
759 		spin_lock_init(&newsighand->siglock);
760 		atomic_set(&newsighand->count, 1);
761 		memcpy(newsighand->action, oldsighand->action,
762 		       sizeof(newsighand->action));
763 
764 		write_lock_irq(&tasklist_lock);
765 		spin_lock(&oldsighand->siglock);
766 		spin_lock(&newsighand->siglock);
767 
768 		current->sighand = newsighand;
769 		recalc_sigpending();
770 
771 		spin_unlock(&newsighand->siglock);
772 		spin_unlock(&oldsighand->siglock);
773 		write_unlock_irq(&tasklist_lock);
774 
775 		if (atomic_dec_and_test(&oldsighand->count))
776 			kmem_cache_free(sighand_cachep, oldsighand);
777 	}
778 
779 	BUG_ON(!thread_group_leader(current));
780 	return 0;
781 }
782 
783 /*
784  * These functions flushes out all traces of the currently running executable
785  * so that a new one can be started
786  */
787 
788 static inline void flush_old_files(struct files_struct * files)
789 {
790 	long j = -1;
791 	struct fdtable *fdt;
792 
793 	spin_lock(&files->file_lock);
794 	for (;;) {
795 		unsigned long set, i;
796 
797 		j++;
798 		i = j * __NFDBITS;
799 		fdt = files_fdtable(files);
800 		if (i >= fdt->max_fds || i >= fdt->max_fdset)
801 			break;
802 		set = fdt->close_on_exec->fds_bits[j];
803 		if (!set)
804 			continue;
805 		fdt->close_on_exec->fds_bits[j] = 0;
806 		spin_unlock(&files->file_lock);
807 		for ( ; set ; i++,set >>= 1) {
808 			if (set & 1) {
809 				sys_close(i);
810 			}
811 		}
812 		spin_lock(&files->file_lock);
813 
814 	}
815 	spin_unlock(&files->file_lock);
816 }
817 
818 void get_task_comm(char *buf, struct task_struct *tsk)
819 {
820 	/* buf must be at least sizeof(tsk->comm) in size */
821 	task_lock(tsk);
822 	strncpy(buf, tsk->comm, sizeof(tsk->comm));
823 	task_unlock(tsk);
824 }
825 
826 void set_task_comm(struct task_struct *tsk, char *buf)
827 {
828 	task_lock(tsk);
829 	strlcpy(tsk->comm, buf, sizeof(tsk->comm));
830 	task_unlock(tsk);
831 }
832 
833 int flush_old_exec(struct linux_binprm * bprm)
834 {
835 	char * name;
836 	int i, ch, retval;
837 	struct files_struct *files;
838 	char tcomm[sizeof(current->comm)];
839 
840 	/*
841 	 * Make sure we have a private signal table and that
842 	 * we are unassociated from the previous thread group.
843 	 */
844 	retval = de_thread(current);
845 	if (retval)
846 		goto out;
847 
848 	/*
849 	 * Make sure we have private file handles. Ask the
850 	 * fork helper to do the work for us and the exit
851 	 * helper to do the cleanup of the old one.
852 	 */
853 	files = current->files;		/* refcounted so safe to hold */
854 	retval = unshare_files();
855 	if (retval)
856 		goto out;
857 	/*
858 	 * Release all of the old mmap stuff
859 	 */
860 	retval = exec_mmap(bprm->mm);
861 	if (retval)
862 		goto mmap_failed;
863 
864 	bprm->mm = NULL;		/* We're using it now */
865 
866 	/* This is the point of no return */
867 	steal_locks(files);
868 	put_files_struct(files);
869 
870 	current->sas_ss_sp = current->sas_ss_size = 0;
871 
872 	if (current->euid == current->uid && current->egid == current->gid)
873 		current->mm->dumpable = 1;
874 	else
875 		current->mm->dumpable = suid_dumpable;
876 
877 	name = bprm->filename;
878 
879 	/* Copies the binary name from after last slash */
880 	for (i=0; (ch = *(name++)) != '\0';) {
881 		if (ch == '/')
882 			i = 0; /* overwrite what we wrote */
883 		else
884 			if (i < (sizeof(tcomm) - 1))
885 				tcomm[i++] = ch;
886 	}
887 	tcomm[i] = '\0';
888 	set_task_comm(current, tcomm);
889 
890 	current->flags &= ~PF_RANDOMIZE;
891 	flush_thread();
892 
893 	if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
894 	    permission(bprm->file->f_dentry->d_inode,MAY_READ, NULL) ||
895 	    (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
896 		suid_keys(current);
897 		current->mm->dumpable = suid_dumpable;
898 	}
899 
900 	/* An exec changes our domain. We are no longer part of the thread
901 	   group */
902 
903 	current->self_exec_id++;
904 
905 	flush_signal_handlers(current, 0);
906 	flush_old_files(current->files);
907 
908 	return 0;
909 
910 mmap_failed:
911 	put_files_struct(current->files);
912 	current->files = files;
913 out:
914 	return retval;
915 }
916 
917 EXPORT_SYMBOL(flush_old_exec);
918 
919 /*
920  * Fill the binprm structure from the inode.
921  * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
922  */
923 int prepare_binprm(struct linux_binprm *bprm)
924 {
925 	int mode;
926 	struct inode * inode = bprm->file->f_dentry->d_inode;
927 	int retval;
928 
929 	mode = inode->i_mode;
930 	/*
931 	 * Check execute perms again - if the caller has CAP_DAC_OVERRIDE,
932 	 * generic_permission lets a non-executable through
933 	 */
934 	if (!(mode & 0111))	/* with at least _one_ execute bit set */
935 		return -EACCES;
936 	if (bprm->file->f_op == NULL)
937 		return -EACCES;
938 
939 	bprm->e_uid = current->euid;
940 	bprm->e_gid = current->egid;
941 
942 	if(!(bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)) {
943 		/* Set-uid? */
944 		if (mode & S_ISUID) {
945 			current->personality &= ~PER_CLEAR_ON_SETID;
946 			bprm->e_uid = inode->i_uid;
947 		}
948 
949 		/* Set-gid? */
950 		/*
951 		 * If setgid is set but no group execute bit then this
952 		 * is a candidate for mandatory locking, not a setgid
953 		 * executable.
954 		 */
955 		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
956 			current->personality &= ~PER_CLEAR_ON_SETID;
957 			bprm->e_gid = inode->i_gid;
958 		}
959 	}
960 
961 	/* fill in binprm security blob */
962 	retval = security_bprm_set(bprm);
963 	if (retval)
964 		return retval;
965 
966 	memset(bprm->buf,0,BINPRM_BUF_SIZE);
967 	return kernel_read(bprm->file,0,bprm->buf,BINPRM_BUF_SIZE);
968 }
969 
970 EXPORT_SYMBOL(prepare_binprm);
971 
972 static inline int unsafe_exec(struct task_struct *p)
973 {
974 	int unsafe = 0;
975 	if (p->ptrace & PT_PTRACED) {
976 		if (p->ptrace & PT_PTRACE_CAP)
977 			unsafe |= LSM_UNSAFE_PTRACE_CAP;
978 		else
979 			unsafe |= LSM_UNSAFE_PTRACE;
980 	}
981 	if (atomic_read(&p->fs->count) > 1 ||
982 	    atomic_read(&p->files->count) > 1 ||
983 	    atomic_read(&p->sighand->count) > 1)
984 		unsafe |= LSM_UNSAFE_SHARE;
985 
986 	return unsafe;
987 }
988 
989 void compute_creds(struct linux_binprm *bprm)
990 {
991 	int unsafe;
992 
993 	if (bprm->e_uid != current->uid)
994 		suid_keys(current);
995 	exec_keys(current);
996 
997 	task_lock(current);
998 	unsafe = unsafe_exec(current);
999 	security_bprm_apply_creds(bprm, unsafe);
1000 	task_unlock(current);
1001 	security_bprm_post_apply_creds(bprm);
1002 }
1003 
1004 EXPORT_SYMBOL(compute_creds);
1005 
1006 void remove_arg_zero(struct linux_binprm *bprm)
1007 {
1008 	if (bprm->argc) {
1009 		unsigned long offset;
1010 		char * kaddr;
1011 		struct page *page;
1012 
1013 		offset = bprm->p % PAGE_SIZE;
1014 		goto inside;
1015 
1016 		while (bprm->p++, *(kaddr+offset++)) {
1017 			if (offset != PAGE_SIZE)
1018 				continue;
1019 			offset = 0;
1020 			kunmap_atomic(kaddr, KM_USER0);
1021 inside:
1022 			page = bprm->page[bprm->p/PAGE_SIZE];
1023 			kaddr = kmap_atomic(page, KM_USER0);
1024 		}
1025 		kunmap_atomic(kaddr, KM_USER0);
1026 		bprm->argc--;
1027 	}
1028 }
1029 
1030 EXPORT_SYMBOL(remove_arg_zero);
1031 
1032 /*
1033  * cycle the list of binary formats handler, until one recognizes the image
1034  */
1035 int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
1036 {
1037 	int try,retval;
1038 	struct linux_binfmt *fmt;
1039 #ifdef __alpha__
1040 	/* handle /sbin/loader.. */
1041 	{
1042 	    struct exec * eh = (struct exec *) bprm->buf;
1043 
1044 	    if (!bprm->loader && eh->fh.f_magic == 0x183 &&
1045 		(eh->fh.f_flags & 0x3000) == 0x3000)
1046 	    {
1047 		struct file * file;
1048 		unsigned long loader;
1049 
1050 		allow_write_access(bprm->file);
1051 		fput(bprm->file);
1052 		bprm->file = NULL;
1053 
1054 	        loader = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
1055 
1056 		file = open_exec("/sbin/loader");
1057 		retval = PTR_ERR(file);
1058 		if (IS_ERR(file))
1059 			return retval;
1060 
1061 		/* Remember if the application is TASO.  */
1062 		bprm->sh_bang = eh->ah.entry < 0x100000000UL;
1063 
1064 		bprm->file = file;
1065 		bprm->loader = loader;
1066 		retval = prepare_binprm(bprm);
1067 		if (retval<0)
1068 			return retval;
1069 		/* should call search_binary_handler recursively here,
1070 		   but it does not matter */
1071 	    }
1072 	}
1073 #endif
1074 	retval = security_bprm_check(bprm);
1075 	if (retval)
1076 		return retval;
1077 
1078 	/* kernel module loader fixup */
1079 	/* so we don't try to load run modprobe in kernel space. */
1080 	set_fs(USER_DS);
1081 	retval = -ENOENT;
1082 	for (try=0; try<2; try++) {
1083 		read_lock(&binfmt_lock);
1084 		for (fmt = formats ; fmt ; fmt = fmt->next) {
1085 			int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
1086 			if (!fn)
1087 				continue;
1088 			if (!try_module_get(fmt->module))
1089 				continue;
1090 			read_unlock(&binfmt_lock);
1091 			retval = fn(bprm, regs);
1092 			if (retval >= 0) {
1093 				put_binfmt(fmt);
1094 				allow_write_access(bprm->file);
1095 				if (bprm->file)
1096 					fput(bprm->file);
1097 				bprm->file = NULL;
1098 				current->did_exec = 1;
1099 				return retval;
1100 			}
1101 			read_lock(&binfmt_lock);
1102 			put_binfmt(fmt);
1103 			if (retval != -ENOEXEC || bprm->mm == NULL)
1104 				break;
1105 			if (!bprm->file) {
1106 				read_unlock(&binfmt_lock);
1107 				return retval;
1108 			}
1109 		}
1110 		read_unlock(&binfmt_lock);
1111 		if (retval != -ENOEXEC || bprm->mm == NULL) {
1112 			break;
1113 #ifdef CONFIG_KMOD
1114 		}else{
1115 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
1116 			if (printable(bprm->buf[0]) &&
1117 			    printable(bprm->buf[1]) &&
1118 			    printable(bprm->buf[2]) &&
1119 			    printable(bprm->buf[3]))
1120 				break; /* -ENOEXEC */
1121 			request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
1122 #endif
1123 		}
1124 	}
1125 	return retval;
1126 }
1127 
1128 EXPORT_SYMBOL(search_binary_handler);
1129 
1130 /*
1131  * sys_execve() executes a new program.
1132  */
1133 int do_execve(char * filename,
1134 	char __user *__user *argv,
1135 	char __user *__user *envp,
1136 	struct pt_regs * regs)
1137 {
1138 	struct linux_binprm *bprm;
1139 	struct file *file;
1140 	int retval;
1141 	int i;
1142 
1143 	retval = -ENOMEM;
1144 	bprm = kmalloc(sizeof(*bprm), GFP_KERNEL);
1145 	if (!bprm)
1146 		goto out_ret;
1147 	memset(bprm, 0, sizeof(*bprm));
1148 
1149 	file = open_exec(filename);
1150 	retval = PTR_ERR(file);
1151 	if (IS_ERR(file))
1152 		goto out_kfree;
1153 
1154 	sched_exec();
1155 
1156 	bprm->p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
1157 
1158 	bprm->file = file;
1159 	bprm->filename = filename;
1160 	bprm->interp = filename;
1161 	bprm->mm = mm_alloc();
1162 	retval = -ENOMEM;
1163 	if (!bprm->mm)
1164 		goto out_file;
1165 
1166 	retval = init_new_context(current, bprm->mm);
1167 	if (retval < 0)
1168 		goto out_mm;
1169 
1170 	bprm->argc = count(argv, bprm->p / sizeof(void *));
1171 	if ((retval = bprm->argc) < 0)
1172 		goto out_mm;
1173 
1174 	bprm->envc = count(envp, bprm->p / sizeof(void *));
1175 	if ((retval = bprm->envc) < 0)
1176 		goto out_mm;
1177 
1178 	retval = security_bprm_alloc(bprm);
1179 	if (retval)
1180 		goto out;
1181 
1182 	retval = prepare_binprm(bprm);
1183 	if (retval < 0)
1184 		goto out;
1185 
1186 	retval = copy_strings_kernel(1, &bprm->filename, bprm);
1187 	if (retval < 0)
1188 		goto out;
1189 
1190 	bprm->exec = bprm->p;
1191 	retval = copy_strings(bprm->envc, envp, bprm);
1192 	if (retval < 0)
1193 		goto out;
1194 
1195 	retval = copy_strings(bprm->argc, argv, bprm);
1196 	if (retval < 0)
1197 		goto out;
1198 
1199 	retval = search_binary_handler(bprm,regs);
1200 	if (retval >= 0) {
1201 		free_arg_pages(bprm);
1202 
1203 		/* execve success */
1204 		security_bprm_free(bprm);
1205 		acct_update_integrals(current);
1206 		kfree(bprm);
1207 		return retval;
1208 	}
1209 
1210 out:
1211 	/* Something went wrong, return the inode and free the argument pages*/
1212 	for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
1213 		struct page * page = bprm->page[i];
1214 		if (page)
1215 			__free_page(page);
1216 	}
1217 
1218 	if (bprm->security)
1219 		security_bprm_free(bprm);
1220 
1221 out_mm:
1222 	if (bprm->mm)
1223 		mmdrop(bprm->mm);
1224 
1225 out_file:
1226 	if (bprm->file) {
1227 		allow_write_access(bprm->file);
1228 		fput(bprm->file);
1229 	}
1230 
1231 out_kfree:
1232 	kfree(bprm);
1233 
1234 out_ret:
1235 	return retval;
1236 }
1237 
1238 int set_binfmt(struct linux_binfmt *new)
1239 {
1240 	struct linux_binfmt *old = current->binfmt;
1241 
1242 	if (new) {
1243 		if (!try_module_get(new->module))
1244 			return -1;
1245 	}
1246 	current->binfmt = new;
1247 	if (old)
1248 		module_put(old->module);
1249 	return 0;
1250 }
1251 
1252 EXPORT_SYMBOL(set_binfmt);
1253 
1254 #define CORENAME_MAX_SIZE 64
1255 
1256 /* format_corename will inspect the pattern parameter, and output a
1257  * name into corename, which must have space for at least
1258  * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
1259  */
1260 static void format_corename(char *corename, const char *pattern, long signr)
1261 {
1262 	const char *pat_ptr = pattern;
1263 	char *out_ptr = corename;
1264 	char *const out_end = corename + CORENAME_MAX_SIZE;
1265 	int rc;
1266 	int pid_in_pattern = 0;
1267 
1268 	/* Repeat as long as we have more pattern to process and more output
1269 	   space */
1270 	while (*pat_ptr) {
1271 		if (*pat_ptr != '%') {
1272 			if (out_ptr == out_end)
1273 				goto out;
1274 			*out_ptr++ = *pat_ptr++;
1275 		} else {
1276 			switch (*++pat_ptr) {
1277 			case 0:
1278 				goto out;
1279 			/* Double percent, output one percent */
1280 			case '%':
1281 				if (out_ptr == out_end)
1282 					goto out;
1283 				*out_ptr++ = '%';
1284 				break;
1285 			/* pid */
1286 			case 'p':
1287 				pid_in_pattern = 1;
1288 				rc = snprintf(out_ptr, out_end - out_ptr,
1289 					      "%d", current->tgid);
1290 				if (rc > out_end - out_ptr)
1291 					goto out;
1292 				out_ptr += rc;
1293 				break;
1294 			/* uid */
1295 			case 'u':
1296 				rc = snprintf(out_ptr, out_end - out_ptr,
1297 					      "%d", current->uid);
1298 				if (rc > out_end - out_ptr)
1299 					goto out;
1300 				out_ptr += rc;
1301 				break;
1302 			/* gid */
1303 			case 'g':
1304 				rc = snprintf(out_ptr, out_end - out_ptr,
1305 					      "%d", current->gid);
1306 				if (rc > out_end - out_ptr)
1307 					goto out;
1308 				out_ptr += rc;
1309 				break;
1310 			/* signal that caused the coredump */
1311 			case 's':
1312 				rc = snprintf(out_ptr, out_end - out_ptr,
1313 					      "%ld", signr);
1314 				if (rc > out_end - out_ptr)
1315 					goto out;
1316 				out_ptr += rc;
1317 				break;
1318 			/* UNIX time of coredump */
1319 			case 't': {
1320 				struct timeval tv;
1321 				do_gettimeofday(&tv);
1322 				rc = snprintf(out_ptr, out_end - out_ptr,
1323 					      "%lu", tv.tv_sec);
1324 				if (rc > out_end - out_ptr)
1325 					goto out;
1326 				out_ptr += rc;
1327 				break;
1328 			}
1329 			/* hostname */
1330 			case 'h':
1331 				down_read(&uts_sem);
1332 				rc = snprintf(out_ptr, out_end - out_ptr,
1333 					      "%s", system_utsname.nodename);
1334 				up_read(&uts_sem);
1335 				if (rc > out_end - out_ptr)
1336 					goto out;
1337 				out_ptr += rc;
1338 				break;
1339 			/* executable */
1340 			case 'e':
1341 				rc = snprintf(out_ptr, out_end - out_ptr,
1342 					      "%s", current->comm);
1343 				if (rc > out_end - out_ptr)
1344 					goto out;
1345 				out_ptr += rc;
1346 				break;
1347 			default:
1348 				break;
1349 			}
1350 			++pat_ptr;
1351 		}
1352 	}
1353 	/* Backward compatibility with core_uses_pid:
1354 	 *
1355 	 * If core_pattern does not include a %p (as is the default)
1356 	 * and core_uses_pid is set, then .%pid will be appended to
1357 	 * the filename */
1358 	if (!pid_in_pattern
1359             && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
1360 		rc = snprintf(out_ptr, out_end - out_ptr,
1361 			      ".%d", current->tgid);
1362 		if (rc > out_end - out_ptr)
1363 			goto out;
1364 		out_ptr += rc;
1365 	}
1366       out:
1367 	*out_ptr = 0;
1368 }
1369 
1370 static void zap_threads (struct mm_struct *mm)
1371 {
1372 	struct task_struct *g, *p;
1373 	struct task_struct *tsk = current;
1374 	struct completion *vfork_done = tsk->vfork_done;
1375 	int traced = 0;
1376 
1377 	/*
1378 	 * Make sure nobody is waiting for us to release the VM,
1379 	 * otherwise we can deadlock when we wait on each other
1380 	 */
1381 	if (vfork_done) {
1382 		tsk->vfork_done = NULL;
1383 		complete(vfork_done);
1384 	}
1385 
1386 	read_lock(&tasklist_lock);
1387 	do_each_thread(g,p)
1388 		if (mm == p->mm && p != tsk) {
1389 			force_sig_specific(SIGKILL, p);
1390 			mm->core_waiters++;
1391 			if (unlikely(p->ptrace) &&
1392 			    unlikely(p->parent->mm == mm))
1393 				traced = 1;
1394 		}
1395 	while_each_thread(g,p);
1396 
1397 	read_unlock(&tasklist_lock);
1398 
1399 	if (unlikely(traced)) {
1400 		/*
1401 		 * We are zapping a thread and the thread it ptraces.
1402 		 * If the tracee went into a ptrace stop for exit tracing,
1403 		 * we could deadlock since the tracer is waiting for this
1404 		 * coredump to finish.  Detach them so they can both die.
1405 		 */
1406 		write_lock_irq(&tasklist_lock);
1407 		do_each_thread(g,p) {
1408 			if (mm == p->mm && p != tsk &&
1409 			    p->ptrace && p->parent->mm == mm) {
1410 				__ptrace_unlink(p);
1411 			}
1412 		} while_each_thread(g,p);
1413 		write_unlock_irq(&tasklist_lock);
1414 	}
1415 }
1416 
1417 static void coredump_wait(struct mm_struct *mm)
1418 {
1419 	DECLARE_COMPLETION(startup_done);
1420 	int core_waiters;
1421 
1422 	mm->core_startup_done = &startup_done;
1423 
1424 	zap_threads(mm);
1425 	core_waiters = mm->core_waiters;
1426 	up_write(&mm->mmap_sem);
1427 
1428 	if (core_waiters)
1429 		wait_for_completion(&startup_done);
1430 	BUG_ON(mm->core_waiters);
1431 }
1432 
1433 int do_coredump(long signr, int exit_code, struct pt_regs * regs)
1434 {
1435 	char corename[CORENAME_MAX_SIZE + 1];
1436 	struct mm_struct *mm = current->mm;
1437 	struct linux_binfmt * binfmt;
1438 	struct inode * inode;
1439 	struct file * file;
1440 	int retval = 0;
1441 	int fsuid = current->fsuid;
1442 	int flag = 0;
1443 
1444 	binfmt = current->binfmt;
1445 	if (!binfmt || !binfmt->core_dump)
1446 		goto fail;
1447 	down_write(&mm->mmap_sem);
1448 	if (!mm->dumpable) {
1449 		up_write(&mm->mmap_sem);
1450 		goto fail;
1451 	}
1452 
1453 	/*
1454 	 *	We cannot trust fsuid as being the "true" uid of the
1455 	 *	process nor do we know its entire history. We only know it
1456 	 *	was tainted so we dump it as root in mode 2.
1457 	 */
1458 	if (mm->dumpable == 2) {	/* Setuid core dump mode */
1459 		flag = O_EXCL;		/* Stop rewrite attacks */
1460 		current->fsuid = 0;	/* Dump root private */
1461 	}
1462 	mm->dumpable = 0;
1463 
1464 	retval = -EAGAIN;
1465 	spin_lock_irq(&current->sighand->siglock);
1466 	if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
1467 		current->signal->flags = SIGNAL_GROUP_EXIT;
1468 		current->signal->group_exit_code = exit_code;
1469 		retval = 0;
1470 	}
1471 	spin_unlock_irq(&current->sighand->siglock);
1472 	if (retval) {
1473 		up_write(&mm->mmap_sem);
1474 		goto fail;
1475 	}
1476 
1477 	init_completion(&mm->core_done);
1478 	coredump_wait(mm);
1479 
1480 	/*
1481 	 * Clear any false indication of pending signals that might
1482 	 * be seen by the filesystem code called to write the core file.
1483 	 */
1484 	current->signal->group_stop_count = 0;
1485 	clear_thread_flag(TIF_SIGPENDING);
1486 
1487 	if (current->signal->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
1488 		goto fail_unlock;
1489 
1490 	/*
1491 	 * lock_kernel() because format_corename() is controlled by sysctl, which
1492 	 * uses lock_kernel()
1493 	 */
1494  	lock_kernel();
1495 	format_corename(corename, core_pattern, signr);
1496 	unlock_kernel();
1497 	file = filp_open(corename, O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag, 0600);
1498 	if (IS_ERR(file))
1499 		goto fail_unlock;
1500 	inode = file->f_dentry->d_inode;
1501 	if (inode->i_nlink > 1)
1502 		goto close_fail;	/* multiple links - don't dump */
1503 	if (d_unhashed(file->f_dentry))
1504 		goto close_fail;
1505 
1506 	if (!S_ISREG(inode->i_mode))
1507 		goto close_fail;
1508 	if (!file->f_op)
1509 		goto close_fail;
1510 	if (!file->f_op->write)
1511 		goto close_fail;
1512 	if (do_truncate(file->f_dentry, 0) != 0)
1513 		goto close_fail;
1514 
1515 	retval = binfmt->core_dump(signr, regs, file);
1516 
1517 	if (retval)
1518 		current->signal->group_exit_code |= 0x80;
1519 close_fail:
1520 	filp_close(file, NULL);
1521 fail_unlock:
1522 	current->fsuid = fsuid;
1523 	complete_all(&mm->core_done);
1524 fail:
1525 	return retval;
1526 }
1527