1 #include <linux/slab.h> 2 #include <linux/file.h> 3 #include <linux/fdtable.h> 4 #include <linux/freezer.h> 5 #include <linux/mm.h> 6 #include <linux/stat.h> 7 #include <linux/fcntl.h> 8 #include <linux/swap.h> 9 #include <linux/string.h> 10 #include <linux/init.h> 11 #include <linux/pagemap.h> 12 #include <linux/perf_event.h> 13 #include <linux/highmem.h> 14 #include <linux/spinlock.h> 15 #include <linux/key.h> 16 #include <linux/personality.h> 17 #include <linux/binfmts.h> 18 #include <linux/coredump.h> 19 #include <linux/sched/coredump.h> 20 #include <linux/sched/signal.h> 21 #include <linux/utsname.h> 22 #include <linux/pid_namespace.h> 23 #include <linux/module.h> 24 #include <linux/namei.h> 25 #include <linux/mount.h> 26 #include <linux/security.h> 27 #include <linux/syscalls.h> 28 #include <linux/tsacct_kern.h> 29 #include <linux/cn_proc.h> 30 #include <linux/audit.h> 31 #include <linux/tracehook.h> 32 #include <linux/kmod.h> 33 #include <linux/fsnotify.h> 34 #include <linux/fs_struct.h> 35 #include <linux/pipe_fs_i.h> 36 #include <linux/oom.h> 37 #include <linux/compat.h> 38 #include <linux/fs.h> 39 #include <linux/path.h> 40 #include <linux/timekeeping.h> 41 42 #include <linux/uaccess.h> 43 #include <asm/mmu_context.h> 44 #include <asm/tlb.h> 45 #include <asm/exec.h> 46 47 #include <trace/events/task.h> 48 #include "internal.h" 49 50 #include <trace/events/sched.h> 51 52 int core_uses_pid; 53 unsigned int core_pipe_limit; 54 char core_pattern[CORENAME_MAX_SIZE] = "core"; 55 static int core_name_size = CORENAME_MAX_SIZE; 56 57 struct core_name { 58 char *corename; 59 int used, size; 60 }; 61 62 /* The maximal length of core_pattern is also specified in sysctl.c */ 63 64 static int expand_corename(struct core_name *cn, int size) 65 { 66 char *corename = krealloc(cn->corename, size, GFP_KERNEL); 67 68 if (!corename) 69 return -ENOMEM; 70 71 if (size > core_name_size) /* racy but harmless */ 72 core_name_size = size; 73 74 cn->size = ksize(corename); 75 cn->corename = corename; 76 return 0; 77 } 78 79 static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt, 80 va_list arg) 81 { 82 int free, need; 83 va_list arg_copy; 84 85 again: 86 free = cn->size - cn->used; 87 88 va_copy(arg_copy, arg); 89 need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy); 90 va_end(arg_copy); 91 92 if (need < free) { 93 cn->used += need; 94 return 0; 95 } 96 97 if (!expand_corename(cn, cn->size + need - free + 1)) 98 goto again; 99 100 return -ENOMEM; 101 } 102 103 static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...) 104 { 105 va_list arg; 106 int ret; 107 108 va_start(arg, fmt); 109 ret = cn_vprintf(cn, fmt, arg); 110 va_end(arg); 111 112 return ret; 113 } 114 115 static __printf(2, 3) 116 int cn_esc_printf(struct core_name *cn, const char *fmt, ...) 117 { 118 int cur = cn->used; 119 va_list arg; 120 int ret; 121 122 va_start(arg, fmt); 123 ret = cn_vprintf(cn, fmt, arg); 124 va_end(arg); 125 126 if (ret == 0) { 127 /* 128 * Ensure that this coredump name component can't cause the 129 * resulting corefile path to consist of a ".." or ".". 130 */ 131 if ((cn->used - cur == 1 && cn->corename[cur] == '.') || 132 (cn->used - cur == 2 && cn->corename[cur] == '.' 133 && cn->corename[cur+1] == '.')) 134 cn->corename[cur] = '!'; 135 136 /* 137 * Empty names are fishy and could be used to create a "//" in a 138 * corefile name, causing the coredump to happen one directory 139 * level too high. Enforce that all components of the core 140 * pattern are at least one character long. 141 */ 142 if (cn->used == cur) 143 ret = cn_printf(cn, "!"); 144 } 145 146 for (; cur < cn->used; ++cur) { 147 if (cn->corename[cur] == '/') 148 cn->corename[cur] = '!'; 149 } 150 return ret; 151 } 152 153 static int cn_print_exe_file(struct core_name *cn) 154 { 155 struct file *exe_file; 156 char *pathbuf, *path; 157 int ret; 158 159 exe_file = get_mm_exe_file(current->mm); 160 if (!exe_file) 161 return cn_esc_printf(cn, "%s (path unknown)", current->comm); 162 163 pathbuf = kmalloc(PATH_MAX, GFP_TEMPORARY); 164 if (!pathbuf) { 165 ret = -ENOMEM; 166 goto put_exe_file; 167 } 168 169 path = file_path(exe_file, pathbuf, PATH_MAX); 170 if (IS_ERR(path)) { 171 ret = PTR_ERR(path); 172 goto free_buf; 173 } 174 175 ret = cn_esc_printf(cn, "%s", path); 176 177 free_buf: 178 kfree(pathbuf); 179 put_exe_file: 180 fput(exe_file); 181 return ret; 182 } 183 184 /* format_corename will inspect the pattern parameter, and output a 185 * name into corename, which must have space for at least 186 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator. 187 */ 188 static int format_corename(struct core_name *cn, struct coredump_params *cprm) 189 { 190 const struct cred *cred = current_cred(); 191 const char *pat_ptr = core_pattern; 192 int ispipe = (*pat_ptr == '|'); 193 int pid_in_pattern = 0; 194 int err = 0; 195 196 cn->used = 0; 197 cn->corename = NULL; 198 if (expand_corename(cn, core_name_size)) 199 return -ENOMEM; 200 cn->corename[0] = '\0'; 201 202 if (ispipe) 203 ++pat_ptr; 204 205 /* Repeat as long as we have more pattern to process and more output 206 space */ 207 while (*pat_ptr) { 208 if (*pat_ptr != '%') { 209 err = cn_printf(cn, "%c", *pat_ptr++); 210 } else { 211 switch (*++pat_ptr) { 212 /* single % at the end, drop that */ 213 case 0: 214 goto out; 215 /* Double percent, output one percent */ 216 case '%': 217 err = cn_printf(cn, "%c", '%'); 218 break; 219 /* pid */ 220 case 'p': 221 pid_in_pattern = 1; 222 err = cn_printf(cn, "%d", 223 task_tgid_vnr(current)); 224 break; 225 /* global pid */ 226 case 'P': 227 err = cn_printf(cn, "%d", 228 task_tgid_nr(current)); 229 break; 230 case 'i': 231 err = cn_printf(cn, "%d", 232 task_pid_vnr(current)); 233 break; 234 case 'I': 235 err = cn_printf(cn, "%d", 236 task_pid_nr(current)); 237 break; 238 /* uid */ 239 case 'u': 240 err = cn_printf(cn, "%u", 241 from_kuid(&init_user_ns, 242 cred->uid)); 243 break; 244 /* gid */ 245 case 'g': 246 err = cn_printf(cn, "%u", 247 from_kgid(&init_user_ns, 248 cred->gid)); 249 break; 250 case 'd': 251 err = cn_printf(cn, "%d", 252 __get_dumpable(cprm->mm_flags)); 253 break; 254 /* signal that caused the coredump */ 255 case 's': 256 err = cn_printf(cn, "%d", 257 cprm->siginfo->si_signo); 258 break; 259 /* UNIX time of coredump */ 260 case 't': { 261 time64_t time; 262 263 time = ktime_get_real_seconds(); 264 err = cn_printf(cn, "%lld", time); 265 break; 266 } 267 /* hostname */ 268 case 'h': 269 down_read(&uts_sem); 270 err = cn_esc_printf(cn, "%s", 271 utsname()->nodename); 272 up_read(&uts_sem); 273 break; 274 /* executable */ 275 case 'e': 276 err = cn_esc_printf(cn, "%s", current->comm); 277 break; 278 case 'E': 279 err = cn_print_exe_file(cn); 280 break; 281 /* core limit size */ 282 case 'c': 283 err = cn_printf(cn, "%lu", 284 rlimit(RLIMIT_CORE)); 285 break; 286 default: 287 break; 288 } 289 ++pat_ptr; 290 } 291 292 if (err) 293 return err; 294 } 295 296 out: 297 /* Backward compatibility with core_uses_pid: 298 * 299 * If core_pattern does not include a %p (as is the default) 300 * and core_uses_pid is set, then .%pid will be appended to 301 * the filename. Do not do this for piped commands. */ 302 if (!ispipe && !pid_in_pattern && core_uses_pid) { 303 err = cn_printf(cn, ".%d", task_tgid_vnr(current)); 304 if (err) 305 return err; 306 } 307 return ispipe; 308 } 309 310 static int zap_process(struct task_struct *start, int exit_code, int flags) 311 { 312 struct task_struct *t; 313 int nr = 0; 314 315 /* ignore all signals except SIGKILL, see prepare_signal() */ 316 start->signal->flags = SIGNAL_GROUP_COREDUMP | flags; 317 start->signal->group_exit_code = exit_code; 318 start->signal->group_stop_count = 0; 319 320 for_each_thread(start, t) { 321 task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK); 322 if (t != current && t->mm) { 323 sigaddset(&t->pending.signal, SIGKILL); 324 signal_wake_up(t, 1); 325 nr++; 326 } 327 } 328 329 return nr; 330 } 331 332 static int zap_threads(struct task_struct *tsk, struct mm_struct *mm, 333 struct core_state *core_state, int exit_code) 334 { 335 struct task_struct *g, *p; 336 unsigned long flags; 337 int nr = -EAGAIN; 338 339 spin_lock_irq(&tsk->sighand->siglock); 340 if (!signal_group_exit(tsk->signal)) { 341 mm->core_state = core_state; 342 tsk->signal->group_exit_task = tsk; 343 nr = zap_process(tsk, exit_code, 0); 344 clear_tsk_thread_flag(tsk, TIF_SIGPENDING); 345 } 346 spin_unlock_irq(&tsk->sighand->siglock); 347 if (unlikely(nr < 0)) 348 return nr; 349 350 tsk->flags |= PF_DUMPCORE; 351 if (atomic_read(&mm->mm_users) == nr + 1) 352 goto done; 353 /* 354 * We should find and kill all tasks which use this mm, and we should 355 * count them correctly into ->nr_threads. We don't take tasklist 356 * lock, but this is safe wrt: 357 * 358 * fork: 359 * None of sub-threads can fork after zap_process(leader). All 360 * processes which were created before this point should be 361 * visible to zap_threads() because copy_process() adds the new 362 * process to the tail of init_task.tasks list, and lock/unlock 363 * of ->siglock provides a memory barrier. 364 * 365 * do_exit: 366 * The caller holds mm->mmap_sem. This means that the task which 367 * uses this mm can't pass exit_mm(), so it can't exit or clear 368 * its ->mm. 369 * 370 * de_thread: 371 * It does list_replace_rcu(&leader->tasks, ¤t->tasks), 372 * we must see either old or new leader, this does not matter. 373 * However, it can change p->sighand, so lock_task_sighand(p) 374 * must be used. Since p->mm != NULL and we hold ->mmap_sem 375 * it can't fail. 376 * 377 * Note also that "g" can be the old leader with ->mm == NULL 378 * and already unhashed and thus removed from ->thread_group. 379 * This is OK, __unhash_process()->list_del_rcu() does not 380 * clear the ->next pointer, we will find the new leader via 381 * next_thread(). 382 */ 383 rcu_read_lock(); 384 for_each_process(g) { 385 if (g == tsk->group_leader) 386 continue; 387 if (g->flags & PF_KTHREAD) 388 continue; 389 390 for_each_thread(g, p) { 391 if (unlikely(!p->mm)) 392 continue; 393 if (unlikely(p->mm == mm)) { 394 lock_task_sighand(p, &flags); 395 nr += zap_process(p, exit_code, 396 SIGNAL_GROUP_EXIT); 397 unlock_task_sighand(p, &flags); 398 } 399 break; 400 } 401 } 402 rcu_read_unlock(); 403 done: 404 atomic_set(&core_state->nr_threads, nr); 405 return nr; 406 } 407 408 static int coredump_wait(int exit_code, struct core_state *core_state) 409 { 410 struct task_struct *tsk = current; 411 struct mm_struct *mm = tsk->mm; 412 int core_waiters = -EBUSY; 413 414 init_completion(&core_state->startup); 415 core_state->dumper.task = tsk; 416 core_state->dumper.next = NULL; 417 418 if (down_write_killable(&mm->mmap_sem)) 419 return -EINTR; 420 421 if (!mm->core_state) 422 core_waiters = zap_threads(tsk, mm, core_state, exit_code); 423 up_write(&mm->mmap_sem); 424 425 if (core_waiters > 0) { 426 struct core_thread *ptr; 427 428 freezer_do_not_count(); 429 wait_for_completion(&core_state->startup); 430 freezer_count(); 431 /* 432 * Wait for all the threads to become inactive, so that 433 * all the thread context (extended register state, like 434 * fpu etc) gets copied to the memory. 435 */ 436 ptr = core_state->dumper.next; 437 while (ptr != NULL) { 438 wait_task_inactive(ptr->task, 0); 439 ptr = ptr->next; 440 } 441 } 442 443 return core_waiters; 444 } 445 446 static void coredump_finish(struct mm_struct *mm, bool core_dumped) 447 { 448 struct core_thread *curr, *next; 449 struct task_struct *task; 450 451 spin_lock_irq(¤t->sighand->siglock); 452 if (core_dumped && !__fatal_signal_pending(current)) 453 current->signal->group_exit_code |= 0x80; 454 current->signal->group_exit_task = NULL; 455 current->signal->flags = SIGNAL_GROUP_EXIT; 456 spin_unlock_irq(¤t->sighand->siglock); 457 458 next = mm->core_state->dumper.next; 459 while ((curr = next) != NULL) { 460 next = curr->next; 461 task = curr->task; 462 /* 463 * see exit_mm(), curr->task must not see 464 * ->task == NULL before we read ->next. 465 */ 466 smp_mb(); 467 curr->task = NULL; 468 wake_up_process(task); 469 } 470 471 mm->core_state = NULL; 472 } 473 474 static bool dump_interrupted(void) 475 { 476 /* 477 * SIGKILL or freezing() interrupt the coredumping. Perhaps we 478 * can do try_to_freeze() and check __fatal_signal_pending(), 479 * but then we need to teach dump_write() to restart and clear 480 * TIF_SIGPENDING. 481 */ 482 return signal_pending(current); 483 } 484 485 static void wait_for_dump_helpers(struct file *file) 486 { 487 struct pipe_inode_info *pipe = file->private_data; 488 489 pipe_lock(pipe); 490 pipe->readers++; 491 pipe->writers--; 492 wake_up_interruptible_sync(&pipe->wait); 493 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); 494 pipe_unlock(pipe); 495 496 /* 497 * We actually want wait_event_freezable() but then we need 498 * to clear TIF_SIGPENDING and improve dump_interrupted(). 499 */ 500 wait_event_interruptible(pipe->wait, pipe->readers == 1); 501 502 pipe_lock(pipe); 503 pipe->readers--; 504 pipe->writers++; 505 pipe_unlock(pipe); 506 } 507 508 /* 509 * umh_pipe_setup 510 * helper function to customize the process used 511 * to collect the core in userspace. Specifically 512 * it sets up a pipe and installs it as fd 0 (stdin) 513 * for the process. Returns 0 on success, or 514 * PTR_ERR on failure. 515 * Note that it also sets the core limit to 1. This 516 * is a special value that we use to trap recursive 517 * core dumps 518 */ 519 static int umh_pipe_setup(struct subprocess_info *info, struct cred *new) 520 { 521 struct file *files[2]; 522 struct coredump_params *cp = (struct coredump_params *)info->data; 523 int err = create_pipe_files(files, 0); 524 if (err) 525 return err; 526 527 cp->file = files[1]; 528 529 err = replace_fd(0, files[0], 0); 530 fput(files[0]); 531 /* and disallow core files too */ 532 current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1}; 533 534 return err; 535 } 536 537 void do_coredump(const siginfo_t *siginfo) 538 { 539 struct core_state core_state; 540 struct core_name cn; 541 struct mm_struct *mm = current->mm; 542 struct linux_binfmt * binfmt; 543 const struct cred *old_cred; 544 struct cred *cred; 545 int retval = 0; 546 int ispipe; 547 struct files_struct *displaced; 548 /* require nonrelative corefile path and be extra careful */ 549 bool need_suid_safe = false; 550 bool core_dumped = false; 551 static atomic_t core_dump_count = ATOMIC_INIT(0); 552 struct coredump_params cprm = { 553 .siginfo = siginfo, 554 .regs = signal_pt_regs(), 555 .limit = rlimit(RLIMIT_CORE), 556 /* 557 * We must use the same mm->flags while dumping core to avoid 558 * inconsistency of bit flags, since this flag is not protected 559 * by any locks. 560 */ 561 .mm_flags = mm->flags, 562 }; 563 564 audit_core_dumps(siginfo->si_signo); 565 566 binfmt = mm->binfmt; 567 if (!binfmt || !binfmt->core_dump) 568 goto fail; 569 if (!__get_dumpable(cprm.mm_flags)) 570 goto fail; 571 572 cred = prepare_creds(); 573 if (!cred) 574 goto fail; 575 /* 576 * We cannot trust fsuid as being the "true" uid of the process 577 * nor do we know its entire history. We only know it was tainted 578 * so we dump it as root in mode 2, and only into a controlled 579 * environment (pipe handler or fully qualified path). 580 */ 581 if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) { 582 /* Setuid core dump mode */ 583 cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */ 584 need_suid_safe = true; 585 } 586 587 retval = coredump_wait(siginfo->si_signo, &core_state); 588 if (retval < 0) 589 goto fail_creds; 590 591 old_cred = override_creds(cred); 592 593 ispipe = format_corename(&cn, &cprm); 594 595 if (ispipe) { 596 int dump_count; 597 char **helper_argv; 598 struct subprocess_info *sub_info; 599 600 if (ispipe < 0) { 601 printk(KERN_WARNING "format_corename failed\n"); 602 printk(KERN_WARNING "Aborting core\n"); 603 goto fail_unlock; 604 } 605 606 if (cprm.limit == 1) { 607 /* See umh_pipe_setup() which sets RLIMIT_CORE = 1. 608 * 609 * Normally core limits are irrelevant to pipes, since 610 * we're not writing to the file system, but we use 611 * cprm.limit of 1 here as a special value, this is a 612 * consistent way to catch recursive crashes. 613 * We can still crash if the core_pattern binary sets 614 * RLIM_CORE = !1, but it runs as root, and can do 615 * lots of stupid things. 616 * 617 * Note that we use task_tgid_vnr here to grab the pid 618 * of the process group leader. That way we get the 619 * right pid if a thread in a multi-threaded 620 * core_pattern process dies. 621 */ 622 printk(KERN_WARNING 623 "Process %d(%s) has RLIMIT_CORE set to 1\n", 624 task_tgid_vnr(current), current->comm); 625 printk(KERN_WARNING "Aborting core\n"); 626 goto fail_unlock; 627 } 628 cprm.limit = RLIM_INFINITY; 629 630 dump_count = atomic_inc_return(&core_dump_count); 631 if (core_pipe_limit && (core_pipe_limit < dump_count)) { 632 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n", 633 task_tgid_vnr(current), current->comm); 634 printk(KERN_WARNING "Skipping core dump\n"); 635 goto fail_dropcount; 636 } 637 638 helper_argv = argv_split(GFP_KERNEL, cn.corename, NULL); 639 if (!helper_argv) { 640 printk(KERN_WARNING "%s failed to allocate memory\n", 641 __func__); 642 goto fail_dropcount; 643 } 644 645 retval = -ENOMEM; 646 sub_info = call_usermodehelper_setup(helper_argv[0], 647 helper_argv, NULL, GFP_KERNEL, 648 umh_pipe_setup, NULL, &cprm); 649 if (sub_info) 650 retval = call_usermodehelper_exec(sub_info, 651 UMH_WAIT_EXEC); 652 653 argv_free(helper_argv); 654 if (retval) { 655 printk(KERN_INFO "Core dump to |%s pipe failed\n", 656 cn.corename); 657 goto close_fail; 658 } 659 } else { 660 struct inode *inode; 661 int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW | 662 O_LARGEFILE | O_EXCL; 663 664 if (cprm.limit < binfmt->min_coredump) 665 goto fail_unlock; 666 667 if (need_suid_safe && cn.corename[0] != '/') { 668 printk(KERN_WARNING "Pid %d(%s) can only dump core "\ 669 "to fully qualified path!\n", 670 task_tgid_vnr(current), current->comm); 671 printk(KERN_WARNING "Skipping core dump\n"); 672 goto fail_unlock; 673 } 674 675 /* 676 * Unlink the file if it exists unless this is a SUID 677 * binary - in that case, we're running around with root 678 * privs and don't want to unlink another user's coredump. 679 */ 680 if (!need_suid_safe) { 681 mm_segment_t old_fs; 682 683 old_fs = get_fs(); 684 set_fs(KERNEL_DS); 685 /* 686 * If it doesn't exist, that's fine. If there's some 687 * other problem, we'll catch it at the filp_open(). 688 */ 689 (void) sys_unlink((const char __user *)cn.corename); 690 set_fs(old_fs); 691 } 692 693 /* 694 * There is a race between unlinking and creating the 695 * file, but if that causes an EEXIST here, that's 696 * fine - another process raced with us while creating 697 * the corefile, and the other process won. To userspace, 698 * what matters is that at least one of the two processes 699 * writes its coredump successfully, not which one. 700 */ 701 if (need_suid_safe) { 702 /* 703 * Using user namespaces, normal user tasks can change 704 * their current->fs->root to point to arbitrary 705 * directories. Since the intention of the "only dump 706 * with a fully qualified path" rule is to control where 707 * coredumps may be placed using root privileges, 708 * current->fs->root must not be used. Instead, use the 709 * root directory of init_task. 710 */ 711 struct path root; 712 713 task_lock(&init_task); 714 get_fs_root(init_task.fs, &root); 715 task_unlock(&init_task); 716 cprm.file = file_open_root(root.dentry, root.mnt, 717 cn.corename, open_flags, 0600); 718 path_put(&root); 719 } else { 720 cprm.file = filp_open(cn.corename, open_flags, 0600); 721 } 722 if (IS_ERR(cprm.file)) 723 goto fail_unlock; 724 725 inode = file_inode(cprm.file); 726 if (inode->i_nlink > 1) 727 goto close_fail; 728 if (d_unhashed(cprm.file->f_path.dentry)) 729 goto close_fail; 730 /* 731 * AK: actually i see no reason to not allow this for named 732 * pipes etc, but keep the previous behaviour for now. 733 */ 734 if (!S_ISREG(inode->i_mode)) 735 goto close_fail; 736 /* 737 * Don't dump core if the filesystem changed owner or mode 738 * of the file during file creation. This is an issue when 739 * a process dumps core while its cwd is e.g. on a vfat 740 * filesystem. 741 */ 742 if (!uid_eq(inode->i_uid, current_fsuid())) 743 goto close_fail; 744 if ((inode->i_mode & 0677) != 0600) 745 goto close_fail; 746 if (!(cprm.file->f_mode & FMODE_CAN_WRITE)) 747 goto close_fail; 748 if (do_truncate(cprm.file->f_path.dentry, 0, 0, cprm.file)) 749 goto close_fail; 750 } 751 752 /* get us an unshared descriptor table; almost always a no-op */ 753 retval = unshare_files(&displaced); 754 if (retval) 755 goto close_fail; 756 if (displaced) 757 put_files_struct(displaced); 758 if (!dump_interrupted()) { 759 file_start_write(cprm.file); 760 core_dumped = binfmt->core_dump(&cprm); 761 file_end_write(cprm.file); 762 } 763 if (ispipe && core_pipe_limit) 764 wait_for_dump_helpers(cprm.file); 765 close_fail: 766 if (cprm.file) 767 filp_close(cprm.file, NULL); 768 fail_dropcount: 769 if (ispipe) 770 atomic_dec(&core_dump_count); 771 fail_unlock: 772 kfree(cn.corename); 773 coredump_finish(mm, core_dumped); 774 revert_creds(old_cred); 775 fail_creds: 776 put_cred(cred); 777 fail: 778 return; 779 } 780 781 /* 782 * Core dumping helper functions. These are the only things you should 783 * do on a core-file: use only these functions to write out all the 784 * necessary info. 785 */ 786 int dump_emit(struct coredump_params *cprm, const void *addr, int nr) 787 { 788 struct file *file = cprm->file; 789 loff_t pos = file->f_pos; 790 ssize_t n; 791 if (cprm->written + nr > cprm->limit) 792 return 0; 793 while (nr) { 794 if (dump_interrupted()) 795 return 0; 796 n = __kernel_write(file, addr, nr, &pos); 797 if (n <= 0) 798 return 0; 799 file->f_pos = pos; 800 cprm->written += n; 801 cprm->pos += n; 802 nr -= n; 803 } 804 return 1; 805 } 806 EXPORT_SYMBOL(dump_emit); 807 808 int dump_skip(struct coredump_params *cprm, size_t nr) 809 { 810 static char zeroes[PAGE_SIZE]; 811 struct file *file = cprm->file; 812 if (file->f_op->llseek && file->f_op->llseek != no_llseek) { 813 if (dump_interrupted() || 814 file->f_op->llseek(file, nr, SEEK_CUR) < 0) 815 return 0; 816 cprm->pos += nr; 817 return 1; 818 } else { 819 while (nr > PAGE_SIZE) { 820 if (!dump_emit(cprm, zeroes, PAGE_SIZE)) 821 return 0; 822 nr -= PAGE_SIZE; 823 } 824 return dump_emit(cprm, zeroes, nr); 825 } 826 } 827 EXPORT_SYMBOL(dump_skip); 828 829 int dump_align(struct coredump_params *cprm, int align) 830 { 831 unsigned mod = cprm->pos & (align - 1); 832 if (align & (align - 1)) 833 return 0; 834 return mod ? dump_skip(cprm, align - mod) : 1; 835 } 836 EXPORT_SYMBOL(dump_align); 837 838 /* 839 * Ensures that file size is big enough to contain the current file 840 * postion. This prevents gdb from complaining about a truncated file 841 * if the last "write" to the file was dump_skip. 842 */ 843 void dump_truncate(struct coredump_params *cprm) 844 { 845 struct file *file = cprm->file; 846 loff_t offset; 847 848 if (file->f_op->llseek && file->f_op->llseek != no_llseek) { 849 offset = file->f_op->llseek(file, 0, SEEK_CUR); 850 if (i_size_read(file->f_mapping->host) < offset) 851 do_truncate(file->f_path.dentry, offset, 0, file); 852 } 853 } 854 EXPORT_SYMBOL(dump_truncate); 855