exec.c 40 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782
  1. /*
  2. * linux/fs/exec.c
  3. *
  4. * Copyright (C) 1991, 1992 Linus Torvalds
  5. */
  6. /*
  7. * #!-checking implemented by tytso.
  8. */
  9. /*
  10. * Demand-loading implemented 01.12.91 - no need to read anything but
  11. * the header into memory. The inode of the executable is put into
  12. * "current->executable", and page faults do the actual loading. Clean.
  13. *
  14. * Once more I can proudly say that linux stood up to being changed: it
  15. * was less than 2 hours work to get demand-loading completely implemented.
  16. *
  17. * Demand loading changed July 1993 by Eric Youngdale. Use mmap instead,
  18. * current->executable is only used by the procfs. This allows a dispatch
  19. * table to check for several different types of binary formats. We keep
  20. * trying until we recognize the file or we run out of supported binary
  21. * formats.
  22. */
  23. #include <linux/slab.h>
  24. #include <linux/file.h>
  25. #include <linux/mman.h>
  26. #include <linux/a.out.h>
  27. #include <linux/stat.h>
  28. #include <linux/fcntl.h>
  29. #include <linux/smp_lock.h>
  30. #include <linux/string.h>
  31. #include <linux/init.h>
  32. #include <linux/pagemap.h>
  33. #include <linux/highmem.h>
  34. #include <linux/spinlock.h>
  35. #include <linux/key.h>
  36. #include <linux/personality.h>
  37. #include <linux/binfmts.h>
  38. #include <linux/swap.h>
  39. #include <linux/utsname.h>
  40. #include <linux/pid_namespace.h>
  41. #include <linux/module.h>
  42. #include <linux/namei.h>
  43. #include <linux/proc_fs.h>
  44. #include <linux/ptrace.h>
  45. #include <linux/mount.h>
  46. #include <linux/security.h>
  47. #include <linux/syscalls.h>
  48. #include <linux/rmap.h>
  49. #include <linux/tsacct_kern.h>
  50. #include <linux/cn_proc.h>
  51. #include <linux/audit.h>
  52. #include <asm/uaccess.h>
  53. #include <asm/mmu_context.h>
  54. #include <asm/tlb.h>
  55. #ifdef CONFIG_KMOD
  56. #include <linux/kmod.h>
  57. #endif
  58. int core_uses_pid;
  59. char core_pattern[CORENAME_MAX_SIZE] = "core";
  60. int suid_dumpable = 0;
  61. /* The maximal length of core_pattern is also specified in sysctl.c */
  62. static LIST_HEAD(formats);
  63. static DEFINE_RWLOCK(binfmt_lock);
  64. int register_binfmt(struct linux_binfmt * fmt)
  65. {
  66. if (!fmt)
  67. return -EINVAL;
  68. write_lock(&binfmt_lock);
  69. list_add(&fmt->lh, &formats);
  70. write_unlock(&binfmt_lock);
  71. return 0;
  72. }
  73. EXPORT_SYMBOL(register_binfmt);
  74. void unregister_binfmt(struct linux_binfmt * fmt)
  75. {
  76. write_lock(&binfmt_lock);
  77. list_del(&fmt->lh);
  78. write_unlock(&binfmt_lock);
  79. }
  80. EXPORT_SYMBOL(unregister_binfmt);
  81. static inline void put_binfmt(struct linux_binfmt * fmt)
  82. {
  83. module_put(fmt->module);
  84. }
  85. /*
  86. * Note that a shared library must be both readable and executable due to
  87. * security reasons.
  88. *
  89. * Also note that we take the address to load from from the file itself.
  90. */
  91. asmlinkage long sys_uselib(const char __user * library)
  92. {
  93. struct file * file;
  94. struct nameidata nd;
  95. int error;
  96. error = __user_path_lookup_open(library, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
  97. if (error)
  98. goto out;
  99. error = -EINVAL;
  100. if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
  101. goto exit;
  102. error = vfs_permission(&nd, MAY_READ | MAY_EXEC);
  103. if (error)
  104. goto exit;
  105. file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
  106. error = PTR_ERR(file);
  107. if (IS_ERR(file))
  108. goto out;
  109. error = -ENOEXEC;
  110. if(file->f_op) {
  111. struct linux_binfmt * fmt;
  112. read_lock(&binfmt_lock);
  113. list_for_each_entry(fmt, &formats, lh) {
  114. if (!fmt->load_shlib)
  115. continue;
  116. if (!try_module_get(fmt->module))
  117. continue;
  118. read_unlock(&binfmt_lock);
  119. error = fmt->load_shlib(file);
  120. read_lock(&binfmt_lock);
  121. put_binfmt(fmt);
  122. if (error != -ENOEXEC)
  123. break;
  124. }
  125. read_unlock(&binfmt_lock);
  126. }
  127. fput(file);
  128. out:
  129. return error;
  130. exit:
  131. release_open_intent(&nd);
  132. path_put(&nd.path);
  133. goto out;
  134. }
  135. #ifdef CONFIG_MMU
  136. static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
  137. int write)
  138. {
  139. struct page *page;
  140. int ret;
  141. #ifdef CONFIG_STACK_GROWSUP
  142. if (write) {
  143. ret = expand_stack_downwards(bprm->vma, pos);
  144. if (ret < 0)
  145. return NULL;
  146. }
  147. #endif
  148. ret = get_user_pages(current, bprm->mm, pos,
  149. 1, write, 1, &page, NULL);
  150. if (ret <= 0)
  151. return NULL;
  152. if (write) {
  153. unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
  154. struct rlimit *rlim;
  155. /*
  156. * We've historically supported up to 32 pages (ARG_MAX)
  157. * of argument strings even with small stacks
  158. */
  159. if (size <= ARG_MAX)
  160. return page;
  161. /*
  162. * Limit to 1/4-th the stack size for the argv+env strings.
  163. * This ensures that:
  164. * - the remaining binfmt code will not run out of stack space,
  165. * - the program will have a reasonable amount of stack left
  166. * to work from.
  167. */
  168. rlim = current->signal->rlim;
  169. if (size > rlim[RLIMIT_STACK].rlim_cur / 4) {
  170. put_page(page);
  171. return NULL;
  172. }
  173. }
  174. return page;
  175. }
  176. static void put_arg_page(struct page *page)
  177. {
  178. put_page(page);
  179. }
  180. static void free_arg_page(struct linux_binprm *bprm, int i)
  181. {
  182. }
  183. static void free_arg_pages(struct linux_binprm *bprm)
  184. {
  185. }
  186. static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
  187. struct page *page)
  188. {
  189. flush_cache_page(bprm->vma, pos, page_to_pfn(page));
  190. }
  191. static int __bprm_mm_init(struct linux_binprm *bprm)
  192. {
  193. int err = -ENOMEM;
  194. struct vm_area_struct *vma = NULL;
  195. struct mm_struct *mm = bprm->mm;
  196. bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  197. if (!vma)
  198. goto err;
  199. down_write(&mm->mmap_sem);
  200. vma->vm_mm = mm;
  201. /*
  202. * Place the stack at the largest stack address the architecture
  203. * supports. Later, we'll move this to an appropriate place. We don't
  204. * use STACK_TOP because that can depend on attributes which aren't
  205. * configured yet.
  206. */
  207. vma->vm_end = STACK_TOP_MAX;
  208. vma->vm_start = vma->vm_end - PAGE_SIZE;
  209. vma->vm_flags = VM_STACK_FLAGS;
  210. vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
  211. err = insert_vm_struct(mm, vma);
  212. if (err) {
  213. up_write(&mm->mmap_sem);
  214. goto err;
  215. }
  216. mm->stack_vm = mm->total_vm = 1;
  217. up_write(&mm->mmap_sem);
  218. bprm->p = vma->vm_end - sizeof(void *);
  219. return 0;
  220. err:
  221. if (vma) {
  222. bprm->vma = NULL;
  223. kmem_cache_free(vm_area_cachep, vma);
  224. }
  225. return err;
  226. }
  227. static bool valid_arg_len(struct linux_binprm *bprm, long len)
  228. {
  229. return len <= MAX_ARG_STRLEN;
  230. }
  231. #else
  232. static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
  233. int write)
  234. {
  235. struct page *page;
  236. page = bprm->page[pos / PAGE_SIZE];
  237. if (!page && write) {
  238. page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
  239. if (!page)
  240. return NULL;
  241. bprm->page[pos / PAGE_SIZE] = page;
  242. }
  243. return page;
  244. }
  245. static void put_arg_page(struct page *page)
  246. {
  247. }
  248. static void free_arg_page(struct linux_binprm *bprm, int i)
  249. {
  250. if (bprm->page[i]) {
  251. __free_page(bprm->page[i]);
  252. bprm->page[i] = NULL;
  253. }
  254. }
  255. static void free_arg_pages(struct linux_binprm *bprm)
  256. {
  257. int i;
  258. for (i = 0; i < MAX_ARG_PAGES; i++)
  259. free_arg_page(bprm, i);
  260. }
  261. static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
  262. struct page *page)
  263. {
  264. }
  265. static int __bprm_mm_init(struct linux_binprm *bprm)
  266. {
  267. bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
  268. return 0;
  269. }
  270. static bool valid_arg_len(struct linux_binprm *bprm, long len)
  271. {
  272. return len <= bprm->p;
  273. }
  274. #endif /* CONFIG_MMU */
  275. /*
  276. * Create a new mm_struct and populate it with a temporary stack
  277. * vm_area_struct. We don't have enough context at this point to set the stack
  278. * flags, permissions, and offset, so we use temporary values. We'll update
  279. * them later in setup_arg_pages().
  280. */
  281. int bprm_mm_init(struct linux_binprm *bprm)
  282. {
  283. int err;
  284. struct mm_struct *mm = NULL;
  285. bprm->mm = mm = mm_alloc();
  286. err = -ENOMEM;
  287. if (!mm)
  288. goto err;
  289. err = init_new_context(current, mm);
  290. if (err)
  291. goto err;
  292. err = __bprm_mm_init(bprm);
  293. if (err)
  294. goto err;
  295. return 0;
  296. err:
  297. if (mm) {
  298. bprm->mm = NULL;
  299. mmdrop(mm);
  300. }
  301. return err;
  302. }
  303. /*
  304. * count() counts the number of strings in array ARGV.
  305. */
  306. static int count(char __user * __user * argv, int max)
  307. {
  308. int i = 0;
  309. if (argv != NULL) {
  310. for (;;) {
  311. char __user * p;
  312. if (get_user(p, argv))
  313. return -EFAULT;
  314. if (!p)
  315. break;
  316. argv++;
  317. if(++i > max)
  318. return -E2BIG;
  319. cond_resched();
  320. }
  321. }
  322. return i;
  323. }
  324. /*
  325. * 'copy_strings()' copies argument/environment strings from the old
  326. * processes's memory to the new process's stack. The call to get_user_pages()
  327. * ensures the destination page is created and not swapped out.
  328. */
  329. static int copy_strings(int argc, char __user * __user * argv,
  330. struct linux_binprm *bprm)
  331. {
  332. struct page *kmapped_page = NULL;
  333. char *kaddr = NULL;
  334. unsigned long kpos = 0;
  335. int ret;
  336. while (argc-- > 0) {
  337. char __user *str;
  338. int len;
  339. unsigned long pos;
  340. if (get_user(str, argv+argc) ||
  341. !(len = strnlen_user(str, MAX_ARG_STRLEN))) {
  342. ret = -EFAULT;
  343. goto out;
  344. }
  345. if (!valid_arg_len(bprm, len)) {
  346. ret = -E2BIG;
  347. goto out;
  348. }
  349. /* We're going to work our way backwords. */
  350. pos = bprm->p;
  351. str += len;
  352. bprm->p -= len;
  353. while (len > 0) {
  354. int offset, bytes_to_copy;
  355. offset = pos % PAGE_SIZE;
  356. if (offset == 0)
  357. offset = PAGE_SIZE;
  358. bytes_to_copy = offset;
  359. if (bytes_to_copy > len)
  360. bytes_to_copy = len;
  361. offset -= bytes_to_copy;
  362. pos -= bytes_to_copy;
  363. str -= bytes_to_copy;
  364. len -= bytes_to_copy;
  365. if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
  366. struct page *page;
  367. page = get_arg_page(bprm, pos, 1);
  368. if (!page) {
  369. ret = -E2BIG;
  370. goto out;
  371. }
  372. if (kmapped_page) {
  373. flush_kernel_dcache_page(kmapped_page);
  374. kunmap(kmapped_page);
  375. put_arg_page(kmapped_page);
  376. }
  377. kmapped_page = page;
  378. kaddr = kmap(kmapped_page);
  379. kpos = pos & PAGE_MASK;
  380. flush_arg_page(bprm, kpos, kmapped_page);
  381. }
  382. if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
  383. ret = -EFAULT;
  384. goto out;
  385. }
  386. }
  387. }
  388. ret = 0;
  389. out:
  390. if (kmapped_page) {
  391. flush_kernel_dcache_page(kmapped_page);
  392. kunmap(kmapped_page);
  393. put_arg_page(kmapped_page);
  394. }
  395. return ret;
  396. }
  397. /*
  398. * Like copy_strings, but get argv and its values from kernel memory.
  399. */
  400. int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
  401. {
  402. int r;
  403. mm_segment_t oldfs = get_fs();
  404. set_fs(KERNEL_DS);
  405. r = copy_strings(argc, (char __user * __user *)argv, bprm);
  406. set_fs(oldfs);
  407. return r;
  408. }
  409. EXPORT_SYMBOL(copy_strings_kernel);
  410. #ifdef CONFIG_MMU
  411. /*
  412. * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX. Once
  413. * the binfmt code determines where the new stack should reside, we shift it to
  414. * its final location. The process proceeds as follows:
  415. *
  416. * 1) Use shift to calculate the new vma endpoints.
  417. * 2) Extend vma to cover both the old and new ranges. This ensures the
  418. * arguments passed to subsequent functions are consistent.
  419. * 3) Move vma's page tables to the new range.
  420. * 4) Free up any cleared pgd range.
  421. * 5) Shrink the vma to cover only the new range.
  422. */
  423. static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  424. {
  425. struct mm_struct *mm = vma->vm_mm;
  426. unsigned long old_start = vma->vm_start;
  427. unsigned long old_end = vma->vm_end;
  428. unsigned long length = old_end - old_start;
  429. unsigned long new_start = old_start - shift;
  430. unsigned long new_end = old_end - shift;
  431. struct mmu_gather *tlb;
  432. BUG_ON(new_start > new_end);
  433. /*
  434. * ensure there are no vmas between where we want to go
  435. * and where we are
  436. */
  437. if (vma != find_vma(mm, new_start))
  438. return -EFAULT;
  439. /*
  440. * cover the whole range: [new_start, old_end)
  441. */
  442. vma_adjust(vma, new_start, old_end, vma->vm_pgoff, NULL);
  443. /*
  444. * move the page tables downwards, on failure we rely on
  445. * process cleanup to remove whatever mess we made.
  446. */
  447. if (length != move_page_tables(vma, old_start,
  448. vma, new_start, length))
  449. return -ENOMEM;
  450. lru_add_drain();
  451. tlb = tlb_gather_mmu(mm, 0);
  452. if (new_end > old_start) {
  453. /*
  454. * when the old and new regions overlap clear from new_end.
  455. */
  456. free_pgd_range(&tlb, new_end, old_end, new_end,
  457. vma->vm_next ? vma->vm_next->vm_start : 0);
  458. } else {
  459. /*
  460. * otherwise, clean from old_start; this is done to not touch
  461. * the address space in [new_end, old_start) some architectures
  462. * have constraints on va-space that make this illegal (IA64) -
  463. * for the others its just a little faster.
  464. */
  465. free_pgd_range(&tlb, old_start, old_end, new_end,
  466. vma->vm_next ? vma->vm_next->vm_start : 0);
  467. }
  468. tlb_finish_mmu(tlb, new_end, old_end);
  469. /*
  470. * shrink the vma to just the new range.
  471. */
  472. vma_adjust(vma, new_start, new_end, vma->vm_pgoff, NULL);
  473. return 0;
  474. }
  475. #define EXTRA_STACK_VM_PAGES 20 /* random */
  476. /*
  477. * Finalizes the stack vm_area_struct. The flags and permissions are updated,
  478. * the stack is optionally relocated, and some extra space is added.
  479. */
  480. int setup_arg_pages(struct linux_binprm *bprm,
  481. unsigned long stack_top,
  482. int executable_stack)
  483. {
  484. unsigned long ret;
  485. unsigned long stack_shift;
  486. struct mm_struct *mm = current->mm;
  487. struct vm_area_struct *vma = bprm->vma;
  488. struct vm_area_struct *prev = NULL;
  489. unsigned long vm_flags;
  490. unsigned long stack_base;
  491. #ifdef CONFIG_STACK_GROWSUP
  492. /* Limit stack size to 1GB */
  493. stack_base = current->signal->rlim[RLIMIT_STACK].rlim_max;
  494. if (stack_base > (1 << 30))
  495. stack_base = 1 << 30;
  496. /* Make sure we didn't let the argument array grow too large. */
  497. if (vma->vm_end - vma->vm_start > stack_base)
  498. return -ENOMEM;
  499. stack_base = PAGE_ALIGN(stack_top - stack_base);
  500. stack_shift = vma->vm_start - stack_base;
  501. mm->arg_start = bprm->p - stack_shift;
  502. bprm->p = vma->vm_end - stack_shift;
  503. #else
  504. stack_top = arch_align_stack(stack_top);
  505. stack_top = PAGE_ALIGN(stack_top);
  506. stack_shift = vma->vm_end - stack_top;
  507. bprm->p -= stack_shift;
  508. mm->arg_start = bprm->p;
  509. #endif
  510. if (bprm->loader)
  511. bprm->loader -= stack_shift;
  512. bprm->exec -= stack_shift;
  513. down_write(&mm->mmap_sem);
  514. vm_flags = vma->vm_flags;
  515. /*
  516. * Adjust stack execute permissions; explicitly enable for
  517. * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
  518. * (arch default) otherwise.
  519. */
  520. if (unlikely(executable_stack == EXSTACK_ENABLE_X))
  521. vm_flags |= VM_EXEC;
  522. else if (executable_stack == EXSTACK_DISABLE_X)
  523. vm_flags &= ~VM_EXEC;
  524. vm_flags |= mm->def_flags;
  525. ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
  526. vm_flags);
  527. if (ret)
  528. goto out_unlock;
  529. BUG_ON(prev != vma);
  530. /* Move stack pages down in memory. */
  531. if (stack_shift) {
  532. ret = shift_arg_pages(vma, stack_shift);
  533. if (ret) {
  534. up_write(&mm->mmap_sem);
  535. return ret;
  536. }
  537. }
  538. #ifdef CONFIG_STACK_GROWSUP
  539. stack_base = vma->vm_end + EXTRA_STACK_VM_PAGES * PAGE_SIZE;
  540. #else
  541. stack_base = vma->vm_start - EXTRA_STACK_VM_PAGES * PAGE_SIZE;
  542. #endif
  543. ret = expand_stack(vma, stack_base);
  544. if (ret)
  545. ret = -EFAULT;
  546. out_unlock:
  547. up_write(&mm->mmap_sem);
  548. return 0;
  549. }
  550. EXPORT_SYMBOL(setup_arg_pages);
  551. #endif /* CONFIG_MMU */
  552. struct file *open_exec(const char *name)
  553. {
  554. struct nameidata nd;
  555. int err;
  556. struct file *file;
  557. err = path_lookup_open(AT_FDCWD, name, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
  558. file = ERR_PTR(err);
  559. if (!err) {
  560. struct inode *inode = nd.path.dentry->d_inode;
  561. file = ERR_PTR(-EACCES);
  562. if (S_ISREG(inode->i_mode)) {
  563. int err = vfs_permission(&nd, MAY_EXEC);
  564. file = ERR_PTR(err);
  565. if (!err) {
  566. file = nameidata_to_filp(&nd,
  567. O_RDONLY|O_LARGEFILE);
  568. if (!IS_ERR(file)) {
  569. err = deny_write_access(file);
  570. if (err) {
  571. fput(file);
  572. file = ERR_PTR(err);
  573. }
  574. }
  575. out:
  576. return file;
  577. }
  578. }
  579. release_open_intent(&nd);
  580. path_put(&nd.path);
  581. }
  582. goto out;
  583. }
  584. EXPORT_SYMBOL(open_exec);
  585. int kernel_read(struct file *file, unsigned long offset,
  586. char *addr, unsigned long count)
  587. {
  588. mm_segment_t old_fs;
  589. loff_t pos = offset;
  590. int result;
  591. old_fs = get_fs();
  592. set_fs(get_ds());
  593. /* The cast to a user pointer is valid due to the set_fs() */
  594. result = vfs_read(file, (void __user *)addr, count, &pos);
  595. set_fs(old_fs);
  596. return result;
  597. }
  598. EXPORT_SYMBOL(kernel_read);
  599. static int exec_mmap(struct mm_struct *mm)
  600. {
  601. struct task_struct *tsk;
  602. struct mm_struct * old_mm, *active_mm;
  603. /* Notify parent that we're no longer interested in the old VM */
  604. tsk = current;
  605. old_mm = current->mm;
  606. mm_release(tsk, old_mm);
  607. if (old_mm) {
  608. /*
  609. * Make sure that if there is a core dump in progress
  610. * for the old mm, we get out and die instead of going
  611. * through with the exec. We must hold mmap_sem around
  612. * checking core_waiters and changing tsk->mm. The
  613. * core-inducing thread will increment core_waiters for
  614. * each thread whose ->mm == old_mm.
  615. */
  616. down_read(&old_mm->mmap_sem);
  617. if (unlikely(old_mm->core_waiters)) {
  618. up_read(&old_mm->mmap_sem);
  619. return -EINTR;
  620. }
  621. }
  622. task_lock(tsk);
  623. active_mm = tsk->active_mm;
  624. tsk->mm = mm;
  625. tsk->active_mm = mm;
  626. activate_mm(active_mm, mm);
  627. task_unlock(tsk);
  628. mm_update_next_owner(mm);
  629. arch_pick_mmap_layout(mm);
  630. if (old_mm) {
  631. up_read(&old_mm->mmap_sem);
  632. BUG_ON(active_mm != old_mm);
  633. mmput(old_mm);
  634. return 0;
  635. }
  636. mmdrop(active_mm);
  637. return 0;
  638. }
  639. /*
  640. * This function makes sure the current process has its own signal table,
  641. * so that flush_signal_handlers can later reset the handlers without
  642. * disturbing other processes. (Other processes might share the signal
  643. * table via the CLONE_SIGHAND option to clone().)
  644. */
  645. static int de_thread(struct task_struct *tsk)
  646. {
  647. struct signal_struct *sig = tsk->signal;
  648. struct sighand_struct *oldsighand = tsk->sighand;
  649. spinlock_t *lock = &oldsighand->siglock;
  650. struct task_struct *leader = NULL;
  651. int count;
  652. if (thread_group_empty(tsk))
  653. goto no_thread_group;
  654. /*
  655. * Kill all other threads in the thread group.
  656. */
  657. spin_lock_irq(lock);
  658. if (signal_group_exit(sig)) {
  659. /*
  660. * Another group action in progress, just
  661. * return so that the signal is processed.
  662. */
  663. spin_unlock_irq(lock);
  664. return -EAGAIN;
  665. }
  666. sig->group_exit_task = tsk;
  667. zap_other_threads(tsk);
  668. /* Account for the thread group leader hanging around: */
  669. count = thread_group_leader(tsk) ? 1 : 2;
  670. sig->notify_count = count;
  671. while (atomic_read(&sig->count) > count) {
  672. __set_current_state(TASK_UNINTERRUPTIBLE);
  673. spin_unlock_irq(lock);
  674. schedule();
  675. spin_lock_irq(lock);
  676. }
  677. spin_unlock_irq(lock);
  678. /*
  679. * At this point all other threads have exited, all we have to
  680. * do is to wait for the thread group leader to become inactive,
  681. * and to assume its PID:
  682. */
  683. if (!thread_group_leader(tsk)) {
  684. leader = tsk->group_leader;
  685. sig->notify_count = -1; /* for exit_notify() */
  686. for (;;) {
  687. write_lock_irq(&tasklist_lock);
  688. if (likely(leader->exit_state))
  689. break;
  690. __set_current_state(TASK_UNINTERRUPTIBLE);
  691. write_unlock_irq(&tasklist_lock);
  692. schedule();
  693. }
  694. if (unlikely(task_child_reaper(tsk) == leader))
  695. task_active_pid_ns(tsk)->child_reaper = tsk;
  696. /*
  697. * The only record we have of the real-time age of a
  698. * process, regardless of execs it's done, is start_time.
  699. * All the past CPU time is accumulated in signal_struct
  700. * from sister threads now dead. But in this non-leader
  701. * exec, nothing survives from the original leader thread,
  702. * whose birth marks the true age of this process now.
  703. * When we take on its identity by switching to its PID, we
  704. * also take its birthdate (always earlier than our own).
  705. */
  706. tsk->start_time = leader->start_time;
  707. BUG_ON(!same_thread_group(leader, tsk));
  708. BUG_ON(has_group_leader_pid(tsk));
  709. /*
  710. * An exec() starts a new thread group with the
  711. * TGID of the previous thread group. Rehash the
  712. * two threads with a switched PID, and release
  713. * the former thread group leader:
  714. */
  715. /* Become a process group leader with the old leader's pid.
  716. * The old leader becomes a thread of the this thread group.
  717. * Note: The old leader also uses this pid until release_task
  718. * is called. Odd but simple and correct.
  719. */
  720. detach_pid(tsk, PIDTYPE_PID);
  721. tsk->pid = leader->pid;
  722. attach_pid(tsk, PIDTYPE_PID, task_pid(leader));
  723. transfer_pid(leader, tsk, PIDTYPE_PGID);
  724. transfer_pid(leader, tsk, PIDTYPE_SID);
  725. list_replace_rcu(&leader->tasks, &tsk->tasks);
  726. tsk->group_leader = tsk;
  727. leader->group_leader = tsk;
  728. tsk->exit_signal = SIGCHLD;
  729. BUG_ON(leader->exit_state != EXIT_ZOMBIE);
  730. leader->exit_state = EXIT_DEAD;
  731. write_unlock_irq(&tasklist_lock);
  732. }
  733. sig->group_exit_task = NULL;
  734. sig->notify_count = 0;
  735. no_thread_group:
  736. exit_itimers(sig);
  737. if (leader)
  738. release_task(leader);
  739. if (atomic_read(&oldsighand->count) != 1) {
  740. struct sighand_struct *newsighand;
  741. /*
  742. * This ->sighand is shared with the CLONE_SIGHAND
  743. * but not CLONE_THREAD task, switch to the new one.
  744. */
  745. newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
  746. if (!newsighand)
  747. return -ENOMEM;
  748. atomic_set(&newsighand->count, 1);
  749. memcpy(newsighand->action, oldsighand->action,
  750. sizeof(newsighand->action));
  751. write_lock_irq(&tasklist_lock);
  752. spin_lock(&oldsighand->siglock);
  753. rcu_assign_pointer(tsk->sighand, newsighand);
  754. spin_unlock(&oldsighand->siglock);
  755. write_unlock_irq(&tasklist_lock);
  756. __cleanup_sighand(oldsighand);
  757. }
  758. BUG_ON(!thread_group_leader(tsk));
  759. return 0;
  760. }
  761. /*
  762. * These functions flushes out all traces of the currently running executable
  763. * so that a new one can be started
  764. */
  765. static void flush_old_files(struct files_struct * files)
  766. {
  767. long j = -1;
  768. struct fdtable *fdt;
  769. spin_lock(&files->file_lock);
  770. for (;;) {
  771. unsigned long set, i;
  772. j++;
  773. i = j * __NFDBITS;
  774. fdt = files_fdtable(files);
  775. if (i >= fdt->max_fds)
  776. break;
  777. set = fdt->close_on_exec->fds_bits[j];
  778. if (!set)
  779. continue;
  780. fdt->close_on_exec->fds_bits[j] = 0;
  781. spin_unlock(&files->file_lock);
  782. for ( ; set ; i++,set >>= 1) {
  783. if (set & 1) {
  784. sys_close(i);
  785. }
  786. }
  787. spin_lock(&files->file_lock);
  788. }
  789. spin_unlock(&files->file_lock);
  790. }
  791. char *get_task_comm(char *buf, struct task_struct *tsk)
  792. {
  793. /* buf must be at least sizeof(tsk->comm) in size */
  794. task_lock(tsk);
  795. strncpy(buf, tsk->comm, sizeof(tsk->comm));
  796. task_unlock(tsk);
  797. return buf;
  798. }
  799. void set_task_comm(struct task_struct *tsk, char *buf)
  800. {
  801. task_lock(tsk);
  802. strlcpy(tsk->comm, buf, sizeof(tsk->comm));
  803. task_unlock(tsk);
  804. }
  805. int flush_old_exec(struct linux_binprm * bprm)
  806. {
  807. char * name;
  808. int i, ch, retval;
  809. char tcomm[sizeof(current->comm)];
  810. /*
  811. * Make sure we have a private signal table and that
  812. * we are unassociated from the previous thread group.
  813. */
  814. retval = de_thread(current);
  815. if (retval)
  816. goto out;
  817. set_mm_exe_file(bprm->mm, bprm->file);
  818. /*
  819. * Release all of the old mmap stuff
  820. */
  821. retval = exec_mmap(bprm->mm);
  822. if (retval)
  823. goto out;
  824. bprm->mm = NULL; /* We're using it now */
  825. /* This is the point of no return */
  826. current->sas_ss_sp = current->sas_ss_size = 0;
  827. if (current->euid == current->uid && current->egid == current->gid)
  828. set_dumpable(current->mm, 1);
  829. else
  830. set_dumpable(current->mm, suid_dumpable);
  831. name = bprm->filename;
  832. /* Copies the binary name from after last slash */
  833. for (i=0; (ch = *(name++)) != '\0';) {
  834. if (ch == '/')
  835. i = 0; /* overwrite what we wrote */
  836. else
  837. if (i < (sizeof(tcomm) - 1))
  838. tcomm[i++] = ch;
  839. }
  840. tcomm[i] = '\0';
  841. set_task_comm(current, tcomm);
  842. current->flags &= ~PF_RANDOMIZE;
  843. flush_thread();
  844. /* Set the new mm task size. We have to do that late because it may
  845. * depend on TIF_32BIT which is only updated in flush_thread() on
  846. * some architectures like powerpc
  847. */
  848. current->mm->task_size = TASK_SIZE;
  849. if (bprm->e_uid != current->euid || bprm->e_gid != current->egid) {
  850. suid_keys(current);
  851. set_dumpable(current->mm, suid_dumpable);
  852. current->pdeath_signal = 0;
  853. } else if (file_permission(bprm->file, MAY_READ) ||
  854. (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
  855. suid_keys(current);
  856. set_dumpable(current->mm, suid_dumpable);
  857. }
  858. /* An exec changes our domain. We are no longer part of the thread
  859. group */
  860. current->self_exec_id++;
  861. flush_signal_handlers(current, 0);
  862. flush_old_files(current->files);
  863. return 0;
  864. out:
  865. return retval;
  866. }
  867. EXPORT_SYMBOL(flush_old_exec);
  868. /*
  869. * Fill the binprm structure from the inode.
  870. * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
  871. */
  872. int prepare_binprm(struct linux_binprm *bprm)
  873. {
  874. int mode;
  875. struct inode * inode = bprm->file->f_path.dentry->d_inode;
  876. int retval;
  877. mode = inode->i_mode;
  878. if (bprm->file->f_op == NULL)
  879. return -EACCES;
  880. bprm->e_uid = current->euid;
  881. bprm->e_gid = current->egid;
  882. if(!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
  883. /* Set-uid? */
  884. if (mode & S_ISUID) {
  885. current->personality &= ~PER_CLEAR_ON_SETID;
  886. bprm->e_uid = inode->i_uid;
  887. }
  888. /* Set-gid? */
  889. /*
  890. * If setgid is set but no group execute bit then this
  891. * is a candidate for mandatory locking, not a setgid
  892. * executable.
  893. */
  894. if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
  895. current->personality &= ~PER_CLEAR_ON_SETID;
  896. bprm->e_gid = inode->i_gid;
  897. }
  898. }
  899. /* fill in binprm security blob */
  900. retval = security_bprm_set(bprm);
  901. if (retval)
  902. return retval;
  903. memset(bprm->buf,0,BINPRM_BUF_SIZE);
  904. return kernel_read(bprm->file,0,bprm->buf,BINPRM_BUF_SIZE);
  905. }
  906. EXPORT_SYMBOL(prepare_binprm);
  907. static int unsafe_exec(struct task_struct *p)
  908. {
  909. int unsafe = 0;
  910. if (p->ptrace & PT_PTRACED) {
  911. if (p->ptrace & PT_PTRACE_CAP)
  912. unsafe |= LSM_UNSAFE_PTRACE_CAP;
  913. else
  914. unsafe |= LSM_UNSAFE_PTRACE;
  915. }
  916. if (atomic_read(&p->fs->count) > 1 ||
  917. atomic_read(&p->files->count) > 1 ||
  918. atomic_read(&p->sighand->count) > 1)
  919. unsafe |= LSM_UNSAFE_SHARE;
  920. return unsafe;
  921. }
  922. void compute_creds(struct linux_binprm *bprm)
  923. {
  924. int unsafe;
  925. if (bprm->e_uid != current->uid) {
  926. suid_keys(current);
  927. current->pdeath_signal = 0;
  928. }
  929. exec_keys(current);
  930. task_lock(current);
  931. unsafe = unsafe_exec(current);
  932. security_bprm_apply_creds(bprm, unsafe);
  933. task_unlock(current);
  934. security_bprm_post_apply_creds(bprm);
  935. }
  936. EXPORT_SYMBOL(compute_creds);
  937. /*
  938. * Arguments are '\0' separated strings found at the location bprm->p
  939. * points to; chop off the first by relocating brpm->p to right after
  940. * the first '\0' encountered.
  941. */
  942. int remove_arg_zero(struct linux_binprm *bprm)
  943. {
  944. int ret = 0;
  945. unsigned long offset;
  946. char *kaddr;
  947. struct page *page;
  948. if (!bprm->argc)
  949. return 0;
  950. do {
  951. offset = bprm->p & ~PAGE_MASK;
  952. page = get_arg_page(bprm, bprm->p, 0);
  953. if (!page) {
  954. ret = -EFAULT;
  955. goto out;
  956. }
  957. kaddr = kmap_atomic(page, KM_USER0);
  958. for (; offset < PAGE_SIZE && kaddr[offset];
  959. offset++, bprm->p++)
  960. ;
  961. kunmap_atomic(kaddr, KM_USER0);
  962. put_arg_page(page);
  963. if (offset == PAGE_SIZE)
  964. free_arg_page(bprm, (bprm->p >> PAGE_SHIFT) - 1);
  965. } while (offset == PAGE_SIZE);
  966. bprm->p++;
  967. bprm->argc--;
  968. ret = 0;
  969. out:
  970. return ret;
  971. }
  972. EXPORT_SYMBOL(remove_arg_zero);
  973. /*
  974. * cycle the list of binary formats handler, until one recognizes the image
  975. */
  976. int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  977. {
  978. int try,retval;
  979. struct linux_binfmt *fmt;
  980. #if defined(__alpha__) && defined(CONFIG_ARCH_SUPPORTS_AOUT)
  981. /* handle /sbin/loader.. */
  982. {
  983. struct exec * eh = (struct exec *) bprm->buf;
  984. if (!bprm->loader && eh->fh.f_magic == 0x183 &&
  985. (eh->fh.f_flags & 0x3000) == 0x3000)
  986. {
  987. struct file * file;
  988. unsigned long loader;
  989. allow_write_access(bprm->file);
  990. fput(bprm->file);
  991. bprm->file = NULL;
  992. loader = bprm->vma->vm_end - sizeof(void *);
  993. file = open_exec("/sbin/loader");
  994. retval = PTR_ERR(file);
  995. if (IS_ERR(file))
  996. return retval;
  997. /* Remember if the application is TASO. */
  998. bprm->sh_bang = eh->ah.entry < 0x100000000UL;
  999. bprm->file = file;
  1000. bprm->loader = loader;
  1001. retval = prepare_binprm(bprm);
  1002. if (retval<0)
  1003. return retval;
  1004. /* should call search_binary_handler recursively here,
  1005. but it does not matter */
  1006. }
  1007. }
  1008. #endif
  1009. retval = security_bprm_check(bprm);
  1010. if (retval)
  1011. return retval;
  1012. /* kernel module loader fixup */
  1013. /* so we don't try to load run modprobe in kernel space. */
  1014. set_fs(USER_DS);
  1015. retval = audit_bprm(bprm);
  1016. if (retval)
  1017. return retval;
  1018. retval = -ENOENT;
  1019. for (try=0; try<2; try++) {
  1020. read_lock(&binfmt_lock);
  1021. list_for_each_entry(fmt, &formats, lh) {
  1022. int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
  1023. if (!fn)
  1024. continue;
  1025. if (!try_module_get(fmt->module))
  1026. continue;
  1027. read_unlock(&binfmt_lock);
  1028. retval = fn(bprm, regs);
  1029. if (retval >= 0) {
  1030. put_binfmt(fmt);
  1031. allow_write_access(bprm->file);
  1032. if (bprm->file)
  1033. fput(bprm->file);
  1034. bprm->file = NULL;
  1035. current->did_exec = 1;
  1036. proc_exec_connector(current);
  1037. return retval;
  1038. }
  1039. read_lock(&binfmt_lock);
  1040. put_binfmt(fmt);
  1041. if (retval != -ENOEXEC || bprm->mm == NULL)
  1042. break;
  1043. if (!bprm->file) {
  1044. read_unlock(&binfmt_lock);
  1045. return retval;
  1046. }
  1047. }
  1048. read_unlock(&binfmt_lock);
  1049. if (retval != -ENOEXEC || bprm->mm == NULL) {
  1050. break;
  1051. #ifdef CONFIG_KMOD
  1052. }else{
  1053. #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
  1054. if (printable(bprm->buf[0]) &&
  1055. printable(bprm->buf[1]) &&
  1056. printable(bprm->buf[2]) &&
  1057. printable(bprm->buf[3]))
  1058. break; /* -ENOEXEC */
  1059. request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
  1060. #endif
  1061. }
  1062. }
  1063. return retval;
  1064. }
  1065. EXPORT_SYMBOL(search_binary_handler);
  1066. /*
  1067. * sys_execve() executes a new program.
  1068. */
  1069. int do_execve(char * filename,
  1070. char __user *__user *argv,
  1071. char __user *__user *envp,
  1072. struct pt_regs * regs)
  1073. {
  1074. struct linux_binprm *bprm;
  1075. struct file *file;
  1076. struct files_struct *displaced;
  1077. int retval;
  1078. retval = unshare_files(&displaced);
  1079. if (retval)
  1080. goto out_ret;
  1081. retval = -ENOMEM;
  1082. bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
  1083. if (!bprm)
  1084. goto out_files;
  1085. file = open_exec(filename);
  1086. retval = PTR_ERR(file);
  1087. if (IS_ERR(file))
  1088. goto out_kfree;
  1089. sched_exec();
  1090. bprm->file = file;
  1091. bprm->filename = filename;
  1092. bprm->interp = filename;
  1093. retval = bprm_mm_init(bprm);
  1094. if (retval)
  1095. goto out_file;
  1096. bprm->argc = count(argv, MAX_ARG_STRINGS);
  1097. if ((retval = bprm->argc) < 0)
  1098. goto out_mm;
  1099. bprm->envc = count(envp, MAX_ARG_STRINGS);
  1100. if ((retval = bprm->envc) < 0)
  1101. goto out_mm;
  1102. retval = security_bprm_alloc(bprm);
  1103. if (retval)
  1104. goto out;
  1105. retval = prepare_binprm(bprm);
  1106. if (retval < 0)
  1107. goto out;
  1108. retval = copy_strings_kernel(1, &bprm->filename, bprm);
  1109. if (retval < 0)
  1110. goto out;
  1111. bprm->exec = bprm->p;
  1112. retval = copy_strings(bprm->envc, envp, bprm);
  1113. if (retval < 0)
  1114. goto out;
  1115. retval = copy_strings(bprm->argc, argv, bprm);
  1116. if (retval < 0)
  1117. goto out;
  1118. retval = search_binary_handler(bprm,regs);
  1119. if (retval >= 0) {
  1120. /* execve success */
  1121. free_arg_pages(bprm);
  1122. security_bprm_free(bprm);
  1123. acct_update_integrals(current);
  1124. kfree(bprm);
  1125. if (displaced)
  1126. put_files_struct(displaced);
  1127. return retval;
  1128. }
  1129. out:
  1130. free_arg_pages(bprm);
  1131. if (bprm->security)
  1132. security_bprm_free(bprm);
  1133. out_mm:
  1134. if (bprm->mm)
  1135. mmput (bprm->mm);
  1136. out_file:
  1137. if (bprm->file) {
  1138. allow_write_access(bprm->file);
  1139. fput(bprm->file);
  1140. }
  1141. out_kfree:
  1142. kfree(bprm);
  1143. out_files:
  1144. if (displaced)
  1145. reset_files_struct(displaced);
  1146. out_ret:
  1147. return retval;
  1148. }
  1149. int set_binfmt(struct linux_binfmt *new)
  1150. {
  1151. struct linux_binfmt *old = current->binfmt;
  1152. if (new) {
  1153. if (!try_module_get(new->module))
  1154. return -1;
  1155. }
  1156. current->binfmt = new;
  1157. if (old)
  1158. module_put(old->module);
  1159. return 0;
  1160. }
  1161. EXPORT_SYMBOL(set_binfmt);
  1162. /* format_corename will inspect the pattern parameter, and output a
  1163. * name into corename, which must have space for at least
  1164. * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
  1165. */
  1166. static int format_corename(char *corename, const char *pattern, long signr)
  1167. {
  1168. const char *pat_ptr = pattern;
  1169. char *out_ptr = corename;
  1170. char *const out_end = corename + CORENAME_MAX_SIZE;
  1171. int rc;
  1172. int pid_in_pattern = 0;
  1173. int ispipe = 0;
  1174. if (*pattern == '|')
  1175. ispipe = 1;
  1176. /* Repeat as long as we have more pattern to process and more output
  1177. space */
  1178. while (*pat_ptr) {
  1179. if (*pat_ptr != '%') {
  1180. if (out_ptr == out_end)
  1181. goto out;
  1182. *out_ptr++ = *pat_ptr++;
  1183. } else {
  1184. switch (*++pat_ptr) {
  1185. case 0:
  1186. goto out;
  1187. /* Double percent, output one percent */
  1188. case '%':
  1189. if (out_ptr == out_end)
  1190. goto out;
  1191. *out_ptr++ = '%';
  1192. break;
  1193. /* pid */
  1194. case 'p':
  1195. pid_in_pattern = 1;
  1196. rc = snprintf(out_ptr, out_end - out_ptr,
  1197. "%d", task_tgid_vnr(current));
  1198. if (rc > out_end - out_ptr)
  1199. goto out;
  1200. out_ptr += rc;
  1201. break;
  1202. /* uid */
  1203. case 'u':
  1204. rc = snprintf(out_ptr, out_end - out_ptr,
  1205. "%d", current->uid);
  1206. if (rc > out_end - out_ptr)
  1207. goto out;
  1208. out_ptr += rc;
  1209. break;
  1210. /* gid */
  1211. case 'g':
  1212. rc = snprintf(out_ptr, out_end - out_ptr,
  1213. "%d", current->gid);
  1214. if (rc > out_end - out_ptr)
  1215. goto out;
  1216. out_ptr += rc;
  1217. break;
  1218. /* signal that caused the coredump */
  1219. case 's':
  1220. rc = snprintf(out_ptr, out_end - out_ptr,
  1221. "%ld", signr);
  1222. if (rc > out_end - out_ptr)
  1223. goto out;
  1224. out_ptr += rc;
  1225. break;
  1226. /* UNIX time of coredump */
  1227. case 't': {
  1228. struct timeval tv;
  1229. do_gettimeofday(&tv);
  1230. rc = snprintf(out_ptr, out_end - out_ptr,
  1231. "%lu", tv.tv_sec);
  1232. if (rc > out_end - out_ptr)
  1233. goto out;
  1234. out_ptr += rc;
  1235. break;
  1236. }
  1237. /* hostname */
  1238. case 'h':
  1239. down_read(&uts_sem);
  1240. rc = snprintf(out_ptr, out_end - out_ptr,
  1241. "%s", utsname()->nodename);
  1242. up_read(&uts_sem);
  1243. if (rc > out_end - out_ptr)
  1244. goto out;
  1245. out_ptr += rc;
  1246. break;
  1247. /* executable */
  1248. case 'e':
  1249. rc = snprintf(out_ptr, out_end - out_ptr,
  1250. "%s", current->comm);
  1251. if (rc > out_end - out_ptr)
  1252. goto out;
  1253. out_ptr += rc;
  1254. break;
  1255. /* core limit size */
  1256. case 'c':
  1257. rc = snprintf(out_ptr, out_end - out_ptr,
  1258. "%lu", current->signal->rlim[RLIMIT_CORE].rlim_cur);
  1259. if (rc > out_end - out_ptr)
  1260. goto out;
  1261. out_ptr += rc;
  1262. break;
  1263. default:
  1264. break;
  1265. }
  1266. ++pat_ptr;
  1267. }
  1268. }
  1269. /* Backward compatibility with core_uses_pid:
  1270. *
  1271. * If core_pattern does not include a %p (as is the default)
  1272. * and core_uses_pid is set, then .%pid will be appended to
  1273. * the filename. Do not do this for piped commands. */
  1274. if (!ispipe && !pid_in_pattern
  1275. && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
  1276. rc = snprintf(out_ptr, out_end - out_ptr,
  1277. ".%d", task_tgid_vnr(current));
  1278. if (rc > out_end - out_ptr)
  1279. goto out;
  1280. out_ptr += rc;
  1281. }
  1282. out:
  1283. *out_ptr = 0;
  1284. return ispipe;
  1285. }
  1286. static void zap_process(struct task_struct *start)
  1287. {
  1288. struct task_struct *t;
  1289. start->signal->flags = SIGNAL_GROUP_EXIT;
  1290. start->signal->group_stop_count = 0;
  1291. t = start;
  1292. do {
  1293. if (t != current && t->mm) {
  1294. t->mm->core_waiters++;
  1295. sigaddset(&t->pending.signal, SIGKILL);
  1296. signal_wake_up(t, 1);
  1297. }
  1298. } while ((t = next_thread(t)) != start);
  1299. }
  1300. static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
  1301. int exit_code)
  1302. {
  1303. struct task_struct *g, *p;
  1304. unsigned long flags;
  1305. int err = -EAGAIN;
  1306. spin_lock_irq(&tsk->sighand->siglock);
  1307. if (!signal_group_exit(tsk->signal)) {
  1308. tsk->signal->group_exit_code = exit_code;
  1309. zap_process(tsk);
  1310. err = 0;
  1311. }
  1312. spin_unlock_irq(&tsk->sighand->siglock);
  1313. if (err)
  1314. return err;
  1315. if (atomic_read(&mm->mm_users) == mm->core_waiters + 1)
  1316. goto done;
  1317. rcu_read_lock();
  1318. for_each_process(g) {
  1319. if (g == tsk->group_leader)
  1320. continue;
  1321. p = g;
  1322. do {
  1323. if (p->mm) {
  1324. if (p->mm == mm) {
  1325. /*
  1326. * p->sighand can't disappear, but
  1327. * may be changed by de_thread()
  1328. */
  1329. lock_task_sighand(p, &flags);
  1330. zap_process(p);
  1331. unlock_task_sighand(p, &flags);
  1332. }
  1333. break;
  1334. }
  1335. } while ((p = next_thread(p)) != g);
  1336. }
  1337. rcu_read_unlock();
  1338. done:
  1339. return mm->core_waiters;
  1340. }
  1341. static int coredump_wait(int exit_code)
  1342. {
  1343. struct task_struct *tsk = current;
  1344. struct mm_struct *mm = tsk->mm;
  1345. struct completion startup_done;
  1346. struct completion *vfork_done;
  1347. int core_waiters;
  1348. init_completion(&mm->core_done);
  1349. init_completion(&startup_done);
  1350. mm->core_startup_done = &startup_done;
  1351. core_waiters = zap_threads(tsk, mm, exit_code);
  1352. up_write(&mm->mmap_sem);
  1353. if (unlikely(core_waiters < 0))
  1354. goto fail;
  1355. /*
  1356. * Make sure nobody is waiting for us to release the VM,
  1357. * otherwise we can deadlock when we wait on each other
  1358. */
  1359. vfork_done = tsk->vfork_done;
  1360. if (vfork_done) {
  1361. tsk->vfork_done = NULL;
  1362. complete(vfork_done);
  1363. }
  1364. if (core_waiters)
  1365. wait_for_completion(&startup_done);
  1366. fail:
  1367. BUG_ON(mm->core_waiters);
  1368. return core_waiters;
  1369. }
  1370. /*
  1371. * set_dumpable converts traditional three-value dumpable to two flags and
  1372. * stores them into mm->flags. It modifies lower two bits of mm->flags, but
  1373. * these bits are not changed atomically. So get_dumpable can observe the
  1374. * intermediate state. To avoid doing unexpected behavior, get get_dumpable
  1375. * return either old dumpable or new one by paying attention to the order of
  1376. * modifying the bits.
  1377. *
  1378. * dumpable | mm->flags (binary)
  1379. * old new | initial interim final
  1380. * ---------+-----------------------
  1381. * 0 1 | 00 01 01
  1382. * 0 2 | 00 10(*) 11
  1383. * 1 0 | 01 00 00
  1384. * 1 2 | 01 11 11
  1385. * 2 0 | 11 10(*) 00
  1386. * 2 1 | 11 11 01
  1387. *
  1388. * (*) get_dumpable regards interim value of 10 as 11.
  1389. */
  1390. void set_dumpable(struct mm_struct *mm, int value)
  1391. {
  1392. switch (value) {
  1393. case 0:
  1394. clear_bit(MMF_DUMPABLE, &mm->flags);
  1395. smp_wmb();
  1396. clear_bit(MMF_DUMP_SECURELY, &mm->flags);
  1397. break;
  1398. case 1:
  1399. set_bit(MMF_DUMPABLE, &mm->flags);
  1400. smp_wmb();
  1401. clear_bit(MMF_DUMP_SECURELY, &mm->flags);
  1402. break;
  1403. case 2:
  1404. set_bit(MMF_DUMP_SECURELY, &mm->flags);
  1405. smp_wmb();
  1406. set_bit(MMF_DUMPABLE, &mm->flags);
  1407. break;
  1408. }
  1409. }
  1410. int get_dumpable(struct mm_struct *mm)
  1411. {
  1412. int ret;
  1413. ret = mm->flags & 0x3;
  1414. return (ret >= 2) ? 2 : ret;
  1415. }
  1416. int do_coredump(long signr, int exit_code, struct pt_regs * regs)
  1417. {
  1418. char corename[CORENAME_MAX_SIZE + 1];
  1419. struct mm_struct *mm = current->mm;
  1420. struct linux_binfmt * binfmt;
  1421. struct inode * inode;
  1422. struct file * file;
  1423. int retval = 0;
  1424. int fsuid = current->fsuid;
  1425. int flag = 0;
  1426. int ispipe = 0;
  1427. unsigned long core_limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
  1428. char **helper_argv = NULL;
  1429. int helper_argc = 0;
  1430. char *delimit;
  1431. audit_core_dumps(signr);
  1432. binfmt = current->binfmt;
  1433. if (!binfmt || !binfmt->core_dump)
  1434. goto fail;
  1435. down_write(&mm->mmap_sem);
  1436. /*
  1437. * If another thread got here first, or we are not dumpable, bail out.
  1438. */
  1439. if (mm->core_waiters || !get_dumpable(mm)) {
  1440. up_write(&mm->mmap_sem);
  1441. goto fail;
  1442. }
  1443. /*
  1444. * We cannot trust fsuid as being the "true" uid of the
  1445. * process nor do we know its entire history. We only know it
  1446. * was tainted so we dump it as root in mode 2.
  1447. */
  1448. if (get_dumpable(mm) == 2) { /* Setuid core dump mode */
  1449. flag = O_EXCL; /* Stop rewrite attacks */
  1450. current->fsuid = 0; /* Dump root private */
  1451. }
  1452. retval = coredump_wait(exit_code);
  1453. if (retval < 0)
  1454. goto fail;
  1455. /*
  1456. * Clear any false indication of pending signals that might
  1457. * be seen by the filesystem code called to write the core file.
  1458. */
  1459. clear_thread_flag(TIF_SIGPENDING);
  1460. /*
  1461. * lock_kernel() because format_corename() is controlled by sysctl, which
  1462. * uses lock_kernel()
  1463. */
  1464. lock_kernel();
  1465. ispipe = format_corename(corename, core_pattern, signr);
  1466. unlock_kernel();
  1467. /*
  1468. * Don't bother to check the RLIMIT_CORE value if core_pattern points
  1469. * to a pipe. Since we're not writing directly to the filesystem
  1470. * RLIMIT_CORE doesn't really apply, as no actual core file will be
  1471. * created unless the pipe reader choses to write out the core file
  1472. * at which point file size limits and permissions will be imposed
  1473. * as it does with any other process
  1474. */
  1475. if ((!ispipe) && (core_limit < binfmt->min_coredump))
  1476. goto fail_unlock;
  1477. if (ispipe) {
  1478. helper_argv = argv_split(GFP_KERNEL, corename+1, &helper_argc);
  1479. /* Terminate the string before the first option */
  1480. delimit = strchr(corename, ' ');
  1481. if (delimit)
  1482. *delimit = '\0';
  1483. delimit = strrchr(helper_argv[0], '/');
  1484. if (delimit)
  1485. delimit++;
  1486. else
  1487. delimit = helper_argv[0];
  1488. if (!strcmp(delimit, current->comm)) {
  1489. printk(KERN_NOTICE "Recursive core dump detected, "
  1490. "aborting\n");
  1491. goto fail_unlock;
  1492. }
  1493. core_limit = RLIM_INFINITY;
  1494. /* SIGPIPE can happen, but it's just never processed */
  1495. if (call_usermodehelper_pipe(corename+1, helper_argv, NULL,
  1496. &file)) {
  1497. printk(KERN_INFO "Core dump to %s pipe failed\n",
  1498. corename);
  1499. goto fail_unlock;
  1500. }
  1501. } else
  1502. file = filp_open(corename,
  1503. O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
  1504. 0600);
  1505. if (IS_ERR(file))
  1506. goto fail_unlock;
  1507. inode = file->f_path.dentry->d_inode;
  1508. if (inode->i_nlink > 1)
  1509. goto close_fail; /* multiple links - don't dump */
  1510. if (!ispipe && d_unhashed(file->f_path.dentry))
  1511. goto close_fail;
  1512. /* AK: actually i see no reason to not allow this for named pipes etc.,
  1513. but keep the previous behaviour for now. */
  1514. if (!ispipe && !S_ISREG(inode->i_mode))
  1515. goto close_fail;
  1516. /*
  1517. * Dont allow local users get cute and trick others to coredump
  1518. * into their pre-created files:
  1519. */
  1520. if (inode->i_uid != current->fsuid)
  1521. goto close_fail;
  1522. if (!file->f_op)
  1523. goto close_fail;
  1524. if (!file->f_op->write)
  1525. goto close_fail;
  1526. if (!ispipe && do_truncate(file->f_path.dentry, 0, 0, file) != 0)
  1527. goto close_fail;
  1528. retval = binfmt->core_dump(signr, regs, file, core_limit);
  1529. if (retval)
  1530. current->signal->group_exit_code |= 0x80;
  1531. close_fail:
  1532. filp_close(file, NULL);
  1533. fail_unlock:
  1534. if (helper_argv)
  1535. argv_free(helper_argv);
  1536. current->fsuid = fsuid;
  1537. complete_all(&mm->core_done);
  1538. fail:
  1539. return retval;
  1540. }