1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/slab.h> 3 #include <linux/file.h> 4 #include <linux/fdtable.h> 5 #include <linux/freezer.h> 6 #include <linux/mm.h> 7 #include <linux/stat.h> 8 #include <linux/fcntl.h> 9 #include <linux/swap.h> 10 #include <linux/ctype.h> 11 #include <linux/string.h> 12 #include <linux/init.h> 13 #include <linux/pagemap.h> 14 #include <linux/perf_event.h> 15 #include <linux/highmem.h> 16 #include <linux/spinlock.h> 17 #include <linux/key.h> 18 #include <linux/personality.h> 19 #include <linux/binfmts.h> 20 #include <linux/coredump.h> 21 #include <linux/sched/coredump.h> 22 #include <linux/sched/signal.h> 23 #include <linux/sched/task_stack.h> 24 #include <linux/utsname.h> 25 #include <linux/pid_namespace.h> 26 #include <linux/module.h> 27 #include <linux/namei.h> 28 #include <linux/mount.h> 29 #include <linux/security.h> 30 #include <linux/syscalls.h> 31 #include <linux/tsacct_kern.h> 32 #include <linux/cn_proc.h> 33 #include <linux/audit.h> 34 #include <linux/tracehook.h> 35 #include <linux/kmod.h> 36 #include <linux/fsnotify.h> 37 #include <linux/fs_struct.h> 38 #include <linux/pipe_fs_i.h> 39 #include <linux/oom.h> 40 #include <linux/compat.h> 41 #include <linux/fs.h> 42 #include <linux/path.h> 43 #include <linux/timekeeping.h> 44 #include <linux/sysctl.h> 45 #include <linux/elf.h> 46 47 #include <linux/uaccess.h> 48 #include <asm/mmu_context.h> 49 #include <asm/tlb.h> 50 #include <asm/exec.h> 51 52 #include <trace/events/task.h> 53 #include "internal.h" 54 55 #include <trace/events/sched.h> 56 57 static bool dump_vma_snapshot(struct coredump_params *cprm); 58 static void free_vma_snapshot(struct coredump_params *cprm); 59 60 static int core_uses_pid; 61 static unsigned int core_pipe_limit; 62 static char core_pattern[CORENAME_MAX_SIZE] = "core"; 63 static int core_name_size = CORENAME_MAX_SIZE; 64 65 struct core_name { 66 char *corename; 67 int used, size; 68 }; 69 70 static int expand_corename(struct core_name *cn, int size) 71 { 72 char *corename = krealloc(cn->corename, size, GFP_KERNEL); 73 74 if (!corename) 75 return -ENOMEM; 76 77 if (size > core_name_size) /* racy but harmless */ 78 core_name_size = size; 79 80 cn->size = ksize(corename); 81 cn->corename = corename; 82 return 0; 83 } 84 85 static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt, 86 va_list arg) 87 { 88 int free, need; 89 va_list arg_copy; 90 91 again: 92 free = cn->size - cn->used; 93 94 va_copy(arg_copy, arg); 95 need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy); 96 va_end(arg_copy); 97 98 if (need < free) { 99 cn->used += need; 100 return 0; 101 } 102 103 if (!expand_corename(cn, cn->size + need - free + 1)) 104 goto again; 105 106 return -ENOMEM; 107 } 108 109 static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...) 110 { 111 va_list arg; 112 int ret; 113 114 va_start(arg, fmt); 115 ret = cn_vprintf(cn, fmt, arg); 116 va_end(arg); 117 118 return ret; 119 } 120 121 static __printf(2, 3) 122 int cn_esc_printf(struct core_name *cn, const char *fmt, ...) 123 { 124 int cur = cn->used; 125 va_list arg; 126 int ret; 127 128 va_start(arg, fmt); 129 ret = cn_vprintf(cn, fmt, arg); 130 va_end(arg); 131 132 if (ret == 0) { 133 /* 134 * Ensure that this coredump name component can't cause the 135 * resulting corefile path to consist of a ".." or ".". 136 */ 137 if ((cn->used - cur == 1 && cn->corename[cur] == '.') || 138 (cn->used - cur == 2 && cn->corename[cur] == '.' 139 && cn->corename[cur+1] == '.')) 140 cn->corename[cur] = '!'; 141 142 /* 143 * Empty names are fishy and could be used to create a "//" in a 144 * corefile name, causing the coredump to happen one directory 145 * level too high. Enforce that all components of the core 146 * pattern are at least one character long. 147 */ 148 if (cn->used == cur) 149 ret = cn_printf(cn, "!"); 150 } 151 152 for (; cur < cn->used; ++cur) { 153 if (cn->corename[cur] == '/') 154 cn->corename[cur] = '!'; 155 } 156 return ret; 157 } 158 159 static int cn_print_exe_file(struct core_name *cn, bool name_only) 160 { 161 struct file *exe_file; 162 char *pathbuf, *path, *ptr; 163 int ret; 164 165 exe_file = get_mm_exe_file(current->mm); 166 if (!exe_file) 167 return cn_esc_printf(cn, "%s (path unknown)", current->comm); 168 169 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL); 170 if (!pathbuf) { 171 ret = -ENOMEM; 172 goto put_exe_file; 173 } 174 175 path = file_path(exe_file, pathbuf, PATH_MAX); 176 if (IS_ERR(path)) { 177 ret = PTR_ERR(path); 178 goto free_buf; 179 } 180 181 if (name_only) { 182 ptr = strrchr(path, '/'); 183 if (ptr) 184 path = ptr + 1; 185 } 186 ret = cn_esc_printf(cn, "%s", path); 187 188 free_buf: 189 kfree(pathbuf); 190 put_exe_file: 191 fput(exe_file); 192 return ret; 193 } 194 195 /* format_corename will inspect the pattern parameter, and output a 196 * name into corename, which must have space for at least 197 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator. 198 */ 199 static int format_corename(struct core_name *cn, struct coredump_params *cprm, 200 size_t **argv, int *argc) 201 { 202 const struct cred *cred = current_cred(); 203 const char *pat_ptr = core_pattern; 204 int ispipe = (*pat_ptr == '|'); 205 bool was_space = false; 206 int pid_in_pattern = 0; 207 int err = 0; 208 209 cn->used = 0; 210 cn->corename = NULL; 211 if (expand_corename(cn, core_name_size)) 212 return -ENOMEM; 213 cn->corename[0] = '\0'; 214 215 if (ispipe) { 216 int argvs = sizeof(core_pattern) / 2; 217 (*argv) = kmalloc_array(argvs, sizeof(**argv), GFP_KERNEL); 218 if (!(*argv)) 219 return -ENOMEM; 220 (*argv)[(*argc)++] = 0; 221 ++pat_ptr; 222 if (!(*pat_ptr)) 223 return -ENOMEM; 224 } 225 226 /* Repeat as long as we have more pattern to process and more output 227 space */ 228 while (*pat_ptr) { 229 /* 230 * Split on spaces before doing template expansion so that 231 * %e and %E don't get split if they have spaces in them 232 */ 233 if (ispipe) { 234 if (isspace(*pat_ptr)) { 235 if (cn->used != 0) 236 was_space = true; 237 pat_ptr++; 238 continue; 239 } else if (was_space) { 240 was_space = false; 241 err = cn_printf(cn, "%c", '\0'); 242 if (err) 243 return err; 244 (*argv)[(*argc)++] = cn->used; 245 } 246 } 247 if (*pat_ptr != '%') { 248 err = cn_printf(cn, "%c", *pat_ptr++); 249 } else { 250 switch (*++pat_ptr) { 251 /* single % at the end, drop that */ 252 case 0: 253 goto out; 254 /* Double percent, output one percent */ 255 case '%': 256 err = cn_printf(cn, "%c", '%'); 257 break; 258 /* pid */ 259 case 'p': 260 pid_in_pattern = 1; 261 err = cn_printf(cn, "%d", 262 task_tgid_vnr(current)); 263 break; 264 /* global pid */ 265 case 'P': 266 err = cn_printf(cn, "%d", 267 task_tgid_nr(current)); 268 break; 269 case 'i': 270 err = cn_printf(cn, "%d", 271 task_pid_vnr(current)); 272 break; 273 case 'I': 274 err = cn_printf(cn, "%d", 275 task_pid_nr(current)); 276 break; 277 /* uid */ 278 case 'u': 279 err = cn_printf(cn, "%u", 280 from_kuid(&init_user_ns, 281 cred->uid)); 282 break; 283 /* gid */ 284 case 'g': 285 err = cn_printf(cn, "%u", 286 from_kgid(&init_user_ns, 287 cred->gid)); 288 break; 289 case 'd': 290 err = cn_printf(cn, "%d", 291 __get_dumpable(cprm->mm_flags)); 292 break; 293 /* signal that caused the coredump */ 294 case 's': 295 err = cn_printf(cn, "%d", 296 cprm->siginfo->si_signo); 297 break; 298 /* UNIX time of coredump */ 299 case 't': { 300 time64_t time; 301 302 time = ktime_get_real_seconds(); 303 err = cn_printf(cn, "%lld", time); 304 break; 305 } 306 /* hostname */ 307 case 'h': 308 down_read(&uts_sem); 309 err = cn_esc_printf(cn, "%s", 310 utsname()->nodename); 311 up_read(&uts_sem); 312 break; 313 /* executable, could be changed by prctl PR_SET_NAME etc */ 314 case 'e': 315 err = cn_esc_printf(cn, "%s", current->comm); 316 break; 317 /* file name of executable */ 318 case 'f': 319 err = cn_print_exe_file(cn, true); 320 break; 321 case 'E': 322 err = cn_print_exe_file(cn, false); 323 break; 324 /* core limit size */ 325 case 'c': 326 err = cn_printf(cn, "%lu", 327 rlimit(RLIMIT_CORE)); 328 break; 329 default: 330 break; 331 } 332 ++pat_ptr; 333 } 334 335 if (err) 336 return err; 337 } 338 339 out: 340 /* Backward compatibility with core_uses_pid: 341 * 342 * If core_pattern does not include a %p (as is the default) 343 * and core_uses_pid is set, then .%pid will be appended to 344 * the filename. Do not do this for piped commands. */ 345 if (!ispipe && !pid_in_pattern && core_uses_pid) { 346 err = cn_printf(cn, ".%d", task_tgid_vnr(current)); 347 if (err) 348 return err; 349 } 350 return ispipe; 351 } 352 353 static int zap_process(struct task_struct *start, int exit_code) 354 { 355 struct task_struct *t; 356 int nr = 0; 357 358 /* ignore all signals except SIGKILL, see prepare_signal() */ 359 start->signal->flags = SIGNAL_GROUP_EXIT; 360 start->signal->group_exit_code = exit_code; 361 start->signal->group_stop_count = 0; 362 363 for_each_thread(start, t) { 364 task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK); 365 if (t != current && !(t->flags & PF_POSTCOREDUMP)) { 366 sigaddset(&t->pending.signal, SIGKILL); 367 signal_wake_up(t, 1); 368 nr++; 369 } 370 } 371 372 return nr; 373 } 374 375 static int zap_threads(struct task_struct *tsk, 376 struct core_state *core_state, int exit_code) 377 { 378 struct signal_struct *signal = tsk->signal; 379 int nr = -EAGAIN; 380 381 spin_lock_irq(&tsk->sighand->siglock); 382 if (!(signal->flags & SIGNAL_GROUP_EXIT) && !signal->group_exec_task) { 383 signal->core_state = core_state; 384 nr = zap_process(tsk, exit_code); 385 clear_tsk_thread_flag(tsk, TIF_SIGPENDING); 386 tsk->flags |= PF_DUMPCORE; 387 atomic_set(&core_state->nr_threads, nr); 388 } 389 spin_unlock_irq(&tsk->sighand->siglock); 390 return nr; 391 } 392 393 static int coredump_wait(int exit_code, struct core_state *core_state) 394 { 395 struct task_struct *tsk = current; 396 int core_waiters = -EBUSY; 397 398 init_completion(&core_state->startup); 399 core_state->dumper.task = tsk; 400 core_state->dumper.next = NULL; 401 402 core_waiters = zap_threads(tsk, core_state, exit_code); 403 if (core_waiters > 0) { 404 struct core_thread *ptr; 405 406 freezer_do_not_count(); 407 wait_for_completion(&core_state->startup); 408 freezer_count(); 409 /* 410 * Wait for all the threads to become inactive, so that 411 * all the thread context (extended register state, like 412 * fpu etc) gets copied to the memory. 413 */ 414 ptr = core_state->dumper.next; 415 while (ptr != NULL) { 416 wait_task_inactive(ptr->task, 0); 417 ptr = ptr->next; 418 } 419 } 420 421 return core_waiters; 422 } 423 424 static void coredump_finish(bool core_dumped) 425 { 426 struct core_thread *curr, *next; 427 struct task_struct *task; 428 429 spin_lock_irq(¤t->sighand->siglock); 430 if (core_dumped && !__fatal_signal_pending(current)) 431 current->signal->group_exit_code |= 0x80; 432 next = current->signal->core_state->dumper.next; 433 current->signal->core_state = NULL; 434 spin_unlock_irq(¤t->sighand->siglock); 435 436 while ((curr = next) != NULL) { 437 next = curr->next; 438 task = curr->task; 439 /* 440 * see coredump_task_exit(), curr->task must not see 441 * ->task == NULL before we read ->next. 442 */ 443 smp_mb(); 444 curr->task = NULL; 445 wake_up_process(task); 446 } 447 } 448 449 static bool dump_interrupted(void) 450 { 451 /* 452 * SIGKILL or freezing() interrupt the coredumping. Perhaps we 453 * can do try_to_freeze() and check __fatal_signal_pending(), 454 * but then we need to teach dump_write() to restart and clear 455 * TIF_SIGPENDING. 456 */ 457 return fatal_signal_pending(current) || freezing(current); 458 } 459 460 static void wait_for_dump_helpers(struct file *file) 461 { 462 struct pipe_inode_info *pipe = file->private_data; 463 464 pipe_lock(pipe); 465 pipe->readers++; 466 pipe->writers--; 467 wake_up_interruptible_sync(&pipe->rd_wait); 468 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); 469 pipe_unlock(pipe); 470 471 /* 472 * We actually want wait_event_freezable() but then we need 473 * to clear TIF_SIGPENDING and improve dump_interrupted(). 474 */ 475 wait_event_interruptible(pipe->rd_wait, pipe->readers == 1); 476 477 pipe_lock(pipe); 478 pipe->readers--; 479 pipe->writers++; 480 pipe_unlock(pipe); 481 } 482 483 /* 484 * umh_pipe_setup 485 * helper function to customize the process used 486 * to collect the core in userspace. Specifically 487 * it sets up a pipe and installs it as fd 0 (stdin) 488 * for the process. Returns 0 on success, or 489 * PTR_ERR on failure. 490 * Note that it also sets the core limit to 1. This 491 * is a special value that we use to trap recursive 492 * core dumps 493 */ 494 static int umh_pipe_setup(struct subprocess_info *info, struct cred *new) 495 { 496 struct file *files[2]; 497 struct coredump_params *cp = (struct coredump_params *)info->data; 498 int err = create_pipe_files(files, 0); 499 if (err) 500 return err; 501 502 cp->file = files[1]; 503 504 err = replace_fd(0, files[0], 0); 505 fput(files[0]); 506 /* and disallow core files too */ 507 current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1}; 508 509 return err; 510 } 511 512 void do_coredump(const kernel_siginfo_t *siginfo) 513 { 514 struct core_state core_state; 515 struct core_name cn; 516 struct mm_struct *mm = current->mm; 517 struct linux_binfmt * binfmt; 518 const struct cred *old_cred; 519 struct cred *cred; 520 int retval = 0; 521 int ispipe; 522 size_t *argv = NULL; 523 int argc = 0; 524 /* require nonrelative corefile path and be extra careful */ 525 bool need_suid_safe = false; 526 bool core_dumped = false; 527 static atomic_t core_dump_count = ATOMIC_INIT(0); 528 struct coredump_params cprm = { 529 .siginfo = siginfo, 530 .regs = signal_pt_regs(), 531 .limit = rlimit(RLIMIT_CORE), 532 /* 533 * We must use the same mm->flags while dumping core to avoid 534 * inconsistency of bit flags, since this flag is not protected 535 * by any locks. 536 */ 537 .mm_flags = mm->flags, 538 .vma_meta = NULL, 539 }; 540 541 audit_core_dumps(siginfo->si_signo); 542 543 binfmt = mm->binfmt; 544 if (!binfmt || !binfmt->core_dump) 545 goto fail; 546 if (!__get_dumpable(cprm.mm_flags)) 547 goto fail; 548 549 cred = prepare_creds(); 550 if (!cred) 551 goto fail; 552 /* 553 * We cannot trust fsuid as being the "true" uid of the process 554 * nor do we know its entire history. We only know it was tainted 555 * so we dump it as root in mode 2, and only into a controlled 556 * environment (pipe handler or fully qualified path). 557 */ 558 if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) { 559 /* Setuid core dump mode */ 560 cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */ 561 need_suid_safe = true; 562 } 563 564 retval = coredump_wait(siginfo->si_signo, &core_state); 565 if (retval < 0) 566 goto fail_creds; 567 568 old_cred = override_creds(cred); 569 570 ispipe = format_corename(&cn, &cprm, &argv, &argc); 571 572 if (ispipe) { 573 int argi; 574 int dump_count; 575 char **helper_argv; 576 struct subprocess_info *sub_info; 577 578 if (ispipe < 0) { 579 printk(KERN_WARNING "format_corename failed\n"); 580 printk(KERN_WARNING "Aborting core\n"); 581 goto fail_unlock; 582 } 583 584 if (cprm.limit == 1) { 585 /* See umh_pipe_setup() which sets RLIMIT_CORE = 1. 586 * 587 * Normally core limits are irrelevant to pipes, since 588 * we're not writing to the file system, but we use 589 * cprm.limit of 1 here as a special value, this is a 590 * consistent way to catch recursive crashes. 591 * We can still crash if the core_pattern binary sets 592 * RLIM_CORE = !1, but it runs as root, and can do 593 * lots of stupid things. 594 * 595 * Note that we use task_tgid_vnr here to grab the pid 596 * of the process group leader. That way we get the 597 * right pid if a thread in a multi-threaded 598 * core_pattern process dies. 599 */ 600 printk(KERN_WARNING 601 "Process %d(%s) has RLIMIT_CORE set to 1\n", 602 task_tgid_vnr(current), current->comm); 603 printk(KERN_WARNING "Aborting core\n"); 604 goto fail_unlock; 605 } 606 cprm.limit = RLIM_INFINITY; 607 608 dump_count = atomic_inc_return(&core_dump_count); 609 if (core_pipe_limit && (core_pipe_limit < dump_count)) { 610 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n", 611 task_tgid_vnr(current), current->comm); 612 printk(KERN_WARNING "Skipping core dump\n"); 613 goto fail_dropcount; 614 } 615 616 helper_argv = kmalloc_array(argc + 1, sizeof(*helper_argv), 617 GFP_KERNEL); 618 if (!helper_argv) { 619 printk(KERN_WARNING "%s failed to allocate memory\n", 620 __func__); 621 goto fail_dropcount; 622 } 623 for (argi = 0; argi < argc; argi++) 624 helper_argv[argi] = cn.corename + argv[argi]; 625 helper_argv[argi] = NULL; 626 627 retval = -ENOMEM; 628 sub_info = call_usermodehelper_setup(helper_argv[0], 629 helper_argv, NULL, GFP_KERNEL, 630 umh_pipe_setup, NULL, &cprm); 631 if (sub_info) 632 retval = call_usermodehelper_exec(sub_info, 633 UMH_WAIT_EXEC); 634 635 kfree(helper_argv); 636 if (retval) { 637 printk(KERN_INFO "Core dump to |%s pipe failed\n", 638 cn.corename); 639 goto close_fail; 640 } 641 } else { 642 struct user_namespace *mnt_userns; 643 struct inode *inode; 644 int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW | 645 O_LARGEFILE | O_EXCL; 646 647 if (cprm.limit < binfmt->min_coredump) 648 goto fail_unlock; 649 650 if (need_suid_safe && cn.corename[0] != '/') { 651 printk(KERN_WARNING "Pid %d(%s) can only dump core "\ 652 "to fully qualified path!\n", 653 task_tgid_vnr(current), current->comm); 654 printk(KERN_WARNING "Skipping core dump\n"); 655 goto fail_unlock; 656 } 657 658 /* 659 * Unlink the file if it exists unless this is a SUID 660 * binary - in that case, we're running around with root 661 * privs and don't want to unlink another user's coredump. 662 */ 663 if (!need_suid_safe) { 664 /* 665 * If it doesn't exist, that's fine. If there's some 666 * other problem, we'll catch it at the filp_open(). 667 */ 668 do_unlinkat(AT_FDCWD, getname_kernel(cn.corename)); 669 } 670 671 /* 672 * There is a race between unlinking and creating the 673 * file, but if that causes an EEXIST here, that's 674 * fine - another process raced with us while creating 675 * the corefile, and the other process won. To userspace, 676 * what matters is that at least one of the two processes 677 * writes its coredump successfully, not which one. 678 */ 679 if (need_suid_safe) { 680 /* 681 * Using user namespaces, normal user tasks can change 682 * their current->fs->root to point to arbitrary 683 * directories. Since the intention of the "only dump 684 * with a fully qualified path" rule is to control where 685 * coredumps may be placed using root privileges, 686 * current->fs->root must not be used. Instead, use the 687 * root directory of init_task. 688 */ 689 struct path root; 690 691 task_lock(&init_task); 692 get_fs_root(init_task.fs, &root); 693 task_unlock(&init_task); 694 cprm.file = file_open_root(&root, cn.corename, 695 open_flags, 0600); 696 path_put(&root); 697 } else { 698 cprm.file = filp_open(cn.corename, open_flags, 0600); 699 } 700 if (IS_ERR(cprm.file)) 701 goto fail_unlock; 702 703 inode = file_inode(cprm.file); 704 if (inode->i_nlink > 1) 705 goto close_fail; 706 if (d_unhashed(cprm.file->f_path.dentry)) 707 goto close_fail; 708 /* 709 * AK: actually i see no reason to not allow this for named 710 * pipes etc, but keep the previous behaviour for now. 711 */ 712 if (!S_ISREG(inode->i_mode)) 713 goto close_fail; 714 /* 715 * Don't dump core if the filesystem changed owner or mode 716 * of the file during file creation. This is an issue when 717 * a process dumps core while its cwd is e.g. on a vfat 718 * filesystem. 719 */ 720 mnt_userns = file_mnt_user_ns(cprm.file); 721 if (!uid_eq(i_uid_into_mnt(mnt_userns, inode), 722 current_fsuid())) { 723 pr_info_ratelimited("Core dump to %s aborted: cannot preserve file owner\n", 724 cn.corename); 725 goto close_fail; 726 } 727 if ((inode->i_mode & 0677) != 0600) { 728 pr_info_ratelimited("Core dump to %s aborted: cannot preserve file permissions\n", 729 cn.corename); 730 goto close_fail; 731 } 732 if (!(cprm.file->f_mode & FMODE_CAN_WRITE)) 733 goto close_fail; 734 if (do_truncate(mnt_userns, cprm.file->f_path.dentry, 735 0, 0, cprm.file)) 736 goto close_fail; 737 } 738 739 /* get us an unshared descriptor table; almost always a no-op */ 740 /* The cell spufs coredump code reads the file descriptor tables */ 741 retval = unshare_files(); 742 if (retval) 743 goto close_fail; 744 if (!dump_interrupted()) { 745 /* 746 * umh disabled with CONFIG_STATIC_USERMODEHELPER_PATH="" would 747 * have this set to NULL. 748 */ 749 if (!cprm.file) { 750 pr_info("Core dump to |%s disabled\n", cn.corename); 751 goto close_fail; 752 } 753 if (!dump_vma_snapshot(&cprm)) 754 goto close_fail; 755 756 file_start_write(cprm.file); 757 core_dumped = binfmt->core_dump(&cprm); 758 /* 759 * Ensures that file size is big enough to contain the current 760 * file postion. This prevents gdb from complaining about 761 * a truncated file if the last "write" to the file was 762 * dump_skip. 763 */ 764 if (cprm.to_skip) { 765 cprm.to_skip--; 766 dump_emit(&cprm, "", 1); 767 } 768 file_end_write(cprm.file); 769 free_vma_snapshot(&cprm); 770 } 771 if (ispipe && core_pipe_limit) 772 wait_for_dump_helpers(cprm.file); 773 close_fail: 774 if (cprm.file) 775 filp_close(cprm.file, NULL); 776 fail_dropcount: 777 if (ispipe) 778 atomic_dec(&core_dump_count); 779 fail_unlock: 780 kfree(argv); 781 kfree(cn.corename); 782 coredump_finish(core_dumped); 783 revert_creds(old_cred); 784 fail_creds: 785 put_cred(cred); 786 fail: 787 return; 788 } 789 790 /* 791 * Core dumping helper functions. These are the only things you should 792 * do on a core-file: use only these functions to write out all the 793 * necessary info. 794 */ 795 static int __dump_emit(struct coredump_params *cprm, const void *addr, int nr) 796 { 797 struct file *file = cprm->file; 798 loff_t pos = file->f_pos; 799 ssize_t n; 800 if (cprm->written + nr > cprm->limit) 801 return 0; 802 803 804 if (dump_interrupted()) 805 return 0; 806 n = __kernel_write(file, addr, nr, &pos); 807 if (n != nr) 808 return 0; 809 file->f_pos = pos; 810 cprm->written += n; 811 cprm->pos += n; 812 813 return 1; 814 } 815 816 static int __dump_skip(struct coredump_params *cprm, size_t nr) 817 { 818 static char zeroes[PAGE_SIZE]; 819 struct file *file = cprm->file; 820 if (file->f_op->llseek && file->f_op->llseek != no_llseek) { 821 if (dump_interrupted() || 822 file->f_op->llseek(file, nr, SEEK_CUR) < 0) 823 return 0; 824 cprm->pos += nr; 825 return 1; 826 } else { 827 while (nr > PAGE_SIZE) { 828 if (!__dump_emit(cprm, zeroes, PAGE_SIZE)) 829 return 0; 830 nr -= PAGE_SIZE; 831 } 832 return __dump_emit(cprm, zeroes, nr); 833 } 834 } 835 836 int dump_emit(struct coredump_params *cprm, const void *addr, int nr) 837 { 838 if (cprm->to_skip) { 839 if (!__dump_skip(cprm, cprm->to_skip)) 840 return 0; 841 cprm->to_skip = 0; 842 } 843 return __dump_emit(cprm, addr, nr); 844 } 845 EXPORT_SYMBOL(dump_emit); 846 847 void dump_skip_to(struct coredump_params *cprm, unsigned long pos) 848 { 849 cprm->to_skip = pos - cprm->pos; 850 } 851 EXPORT_SYMBOL(dump_skip_to); 852 853 void dump_skip(struct coredump_params *cprm, size_t nr) 854 { 855 cprm->to_skip += nr; 856 } 857 EXPORT_SYMBOL(dump_skip); 858 859 #ifdef CONFIG_ELF_CORE 860 int dump_user_range(struct coredump_params *cprm, unsigned long start, 861 unsigned long len) 862 { 863 unsigned long addr; 864 865 for (addr = start; addr < start + len; addr += PAGE_SIZE) { 866 struct page *page; 867 int stop; 868 869 /* 870 * To avoid having to allocate page tables for virtual address 871 * ranges that have never been used yet, and also to make it 872 * easy to generate sparse core files, use a helper that returns 873 * NULL when encountering an empty page table entry that would 874 * otherwise have been filled with the zero page. 875 */ 876 page = get_dump_page(addr); 877 if (page) { 878 void *kaddr = kmap_local_page(page); 879 880 stop = !dump_emit(cprm, kaddr, PAGE_SIZE); 881 kunmap_local(kaddr); 882 put_page(page); 883 if (stop) 884 return 0; 885 } else { 886 dump_skip(cprm, PAGE_SIZE); 887 } 888 } 889 return 1; 890 } 891 #endif 892 893 int dump_align(struct coredump_params *cprm, int align) 894 { 895 unsigned mod = (cprm->pos + cprm->to_skip) & (align - 1); 896 if (align & (align - 1)) 897 return 0; 898 if (mod) 899 cprm->to_skip += align - mod; 900 return 1; 901 } 902 EXPORT_SYMBOL(dump_align); 903 904 #ifdef CONFIG_SYSCTL 905 906 void validate_coredump_safety(void) 907 { 908 if (suid_dumpable == SUID_DUMP_ROOT && 909 core_pattern[0] != '/' && core_pattern[0] != '|') { 910 pr_warn( 911 "Unsafe core_pattern used with fs.suid_dumpable=2.\n" 912 "Pipe handler or fully qualified core dump path required.\n" 913 "Set kernel.core_pattern before fs.suid_dumpable.\n" 914 ); 915 } 916 } 917 918 static int proc_dostring_coredump(struct ctl_table *table, int write, 919 void *buffer, size_t *lenp, loff_t *ppos) 920 { 921 int error = proc_dostring(table, write, buffer, lenp, ppos); 922 923 if (!error) 924 validate_coredump_safety(); 925 return error; 926 } 927 928 static struct ctl_table coredump_sysctls[] = { 929 { 930 .procname = "core_uses_pid", 931 .data = &core_uses_pid, 932 .maxlen = sizeof(int), 933 .mode = 0644, 934 .proc_handler = proc_dointvec, 935 }, 936 { 937 .procname = "core_pattern", 938 .data = core_pattern, 939 .maxlen = CORENAME_MAX_SIZE, 940 .mode = 0644, 941 .proc_handler = proc_dostring_coredump, 942 }, 943 { 944 .procname = "core_pipe_limit", 945 .data = &core_pipe_limit, 946 .maxlen = sizeof(unsigned int), 947 .mode = 0644, 948 .proc_handler = proc_dointvec, 949 }, 950 { } 951 }; 952 953 static int __init init_fs_coredump_sysctls(void) 954 { 955 register_sysctl_init("kernel", coredump_sysctls); 956 return 0; 957 } 958 fs_initcall(init_fs_coredump_sysctls); 959 #endif /* CONFIG_SYSCTL */ 960 961 /* 962 * The purpose of always_dump_vma() is to make sure that special kernel mappings 963 * that are useful for post-mortem analysis are included in every core dump. 964 * In that way we ensure that the core dump is fully interpretable later 965 * without matching up the same kernel and hardware config to see what PC values 966 * meant. These special mappings include - vDSO, vsyscall, and other 967 * architecture specific mappings 968 */ 969 static bool always_dump_vma(struct vm_area_struct *vma) 970 { 971 /* Any vsyscall mappings? */ 972 if (vma == get_gate_vma(vma->vm_mm)) 973 return true; 974 975 /* 976 * Assume that all vmas with a .name op should always be dumped. 977 * If this changes, a new vm_ops field can easily be added. 978 */ 979 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 980 return true; 981 982 /* 983 * arch_vma_name() returns non-NULL for special architecture mappings, 984 * such as vDSO sections. 985 */ 986 if (arch_vma_name(vma)) 987 return true; 988 989 return false; 990 } 991 992 #define DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER 1 993 994 /* 995 * Decide how much of @vma's contents should be included in a core dump. 996 */ 997 static unsigned long vma_dump_size(struct vm_area_struct *vma, 998 unsigned long mm_flags) 999 { 1000 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) 1001 1002 /* always dump the vdso and vsyscall sections */ 1003 if (always_dump_vma(vma)) 1004 goto whole; 1005 1006 if (vma->vm_flags & VM_DONTDUMP) 1007 return 0; 1008 1009 /* support for DAX */ 1010 if (vma_is_dax(vma)) { 1011 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED)) 1012 goto whole; 1013 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE)) 1014 goto whole; 1015 return 0; 1016 } 1017 1018 /* Hugetlb memory check */ 1019 if (is_vm_hugetlb_page(vma)) { 1020 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED)) 1021 goto whole; 1022 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) 1023 goto whole; 1024 return 0; 1025 } 1026 1027 /* Do not dump I/O mapped devices or special mappings */ 1028 if (vma->vm_flags & VM_IO) 1029 return 0; 1030 1031 /* By default, dump shared memory if mapped from an anonymous file. */ 1032 if (vma->vm_flags & VM_SHARED) { 1033 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1034 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED)) 1035 goto whole; 1036 return 0; 1037 } 1038 1039 /* Dump segments that have been written to. */ 1040 if ((!IS_ENABLED(CONFIG_MMU) || vma->anon_vma) && FILTER(ANON_PRIVATE)) 1041 goto whole; 1042 if (vma->vm_file == NULL) 1043 return 0; 1044 1045 if (FILTER(MAPPED_PRIVATE)) 1046 goto whole; 1047 1048 /* 1049 * If this is the beginning of an executable file mapping, 1050 * dump the first page to aid in determining what was mapped here. 1051 */ 1052 if (FILTER(ELF_HEADERS) && 1053 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1054 if ((READ_ONCE(file_inode(vma->vm_file)->i_mode) & 0111) != 0) 1055 return PAGE_SIZE; 1056 1057 /* 1058 * ELF libraries aren't always executable. 1059 * We'll want to check whether the mapping starts with the ELF 1060 * magic, but not now - we're holding the mmap lock, 1061 * so copy_from_user() doesn't work here. 1062 * Use a placeholder instead, and fix it up later in 1063 * dump_vma_snapshot(). 1064 */ 1065 return DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER; 1066 } 1067 1068 #undef FILTER 1069 1070 return 0; 1071 1072 whole: 1073 return vma->vm_end - vma->vm_start; 1074 } 1075 1076 static struct vm_area_struct *first_vma(struct task_struct *tsk, 1077 struct vm_area_struct *gate_vma) 1078 { 1079 struct vm_area_struct *ret = tsk->mm->mmap; 1080 1081 if (ret) 1082 return ret; 1083 return gate_vma; 1084 } 1085 1086 /* 1087 * Helper function for iterating across a vma list. It ensures that the caller 1088 * will visit `gate_vma' prior to terminating the search. 1089 */ 1090 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma, 1091 struct vm_area_struct *gate_vma) 1092 { 1093 struct vm_area_struct *ret; 1094 1095 ret = this_vma->vm_next; 1096 if (ret) 1097 return ret; 1098 if (this_vma == gate_vma) 1099 return NULL; 1100 return gate_vma; 1101 } 1102 1103 static void free_vma_snapshot(struct coredump_params *cprm) 1104 { 1105 if (cprm->vma_meta) { 1106 int i; 1107 for (i = 0; i < cprm->vma_count; i++) { 1108 struct file *file = cprm->vma_meta[i].file; 1109 if (file) 1110 fput(file); 1111 } 1112 kvfree(cprm->vma_meta); 1113 cprm->vma_meta = NULL; 1114 } 1115 } 1116 1117 /* 1118 * Under the mmap_lock, take a snapshot of relevant information about the task's 1119 * VMAs. 1120 */ 1121 static bool dump_vma_snapshot(struct coredump_params *cprm) 1122 { 1123 struct vm_area_struct *vma, *gate_vma; 1124 struct mm_struct *mm = current->mm; 1125 int i; 1126 1127 /* 1128 * Once the stack expansion code is fixed to not change VMA bounds 1129 * under mmap_lock in read mode, this can be changed to take the 1130 * mmap_lock in read mode. 1131 */ 1132 if (mmap_write_lock_killable(mm)) 1133 return false; 1134 1135 cprm->vma_data_size = 0; 1136 gate_vma = get_gate_vma(mm); 1137 cprm->vma_count = mm->map_count + (gate_vma ? 1 : 0); 1138 1139 cprm->vma_meta = kvmalloc_array(cprm->vma_count, sizeof(*cprm->vma_meta), GFP_KERNEL); 1140 if (!cprm->vma_meta) { 1141 mmap_write_unlock(mm); 1142 return false; 1143 } 1144 1145 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; 1146 vma = next_vma(vma, gate_vma), i++) { 1147 struct core_vma_metadata *m = cprm->vma_meta + i; 1148 1149 m->start = vma->vm_start; 1150 m->end = vma->vm_end; 1151 m->flags = vma->vm_flags; 1152 m->dump_size = vma_dump_size(vma, cprm->mm_flags); 1153 m->pgoff = vma->vm_pgoff; 1154 1155 m->file = vma->vm_file; 1156 if (m->file) 1157 get_file(m->file); 1158 } 1159 1160 mmap_write_unlock(mm); 1161 1162 for (i = 0; i < cprm->vma_count; i++) { 1163 struct core_vma_metadata *m = cprm->vma_meta + i; 1164 1165 if (m->dump_size == DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER) { 1166 char elfmag[SELFMAG]; 1167 1168 if (copy_from_user(elfmag, (void __user *)m->start, SELFMAG) || 1169 memcmp(elfmag, ELFMAG, SELFMAG) != 0) { 1170 m->dump_size = 0; 1171 } else { 1172 m->dump_size = PAGE_SIZE; 1173 } 1174 } 1175 1176 cprm->vma_data_size += m->dump_size; 1177 } 1178 1179 return true; 1180 } 1181