1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/slab.h> 3 #include <linux/file.h> 4 #include <linux/fdtable.h> 5 #include <linux/freezer.h> 6 #include <linux/mm.h> 7 #include <linux/stat.h> 8 #include <linux/fcntl.h> 9 #include <linux/swap.h> 10 #include <linux/ctype.h> 11 #include <linux/string.h> 12 #include <linux/init.h> 13 #include <linux/pagemap.h> 14 #include <linux/perf_event.h> 15 #include <linux/highmem.h> 16 #include <linux/spinlock.h> 17 #include <linux/key.h> 18 #include <linux/personality.h> 19 #include <linux/binfmts.h> 20 #include <linux/coredump.h> 21 #include <linux/sort.h> 22 #include <linux/sched/coredump.h> 23 #include <linux/sched/signal.h> 24 #include <linux/sched/task_stack.h> 25 #include <linux/utsname.h> 26 #include <linux/pid_namespace.h> 27 #include <linux/module.h> 28 #include <linux/namei.h> 29 #include <linux/mount.h> 30 #include <linux/security.h> 31 #include <linux/syscalls.h> 32 #include <linux/tsacct_kern.h> 33 #include <linux/cn_proc.h> 34 #include <linux/audit.h> 35 #include <linux/kmod.h> 36 #include <linux/fsnotify.h> 37 #include <linux/fs_struct.h> 38 #include <linux/pipe_fs_i.h> 39 #include <linux/oom.h> 40 #include <linux/compat.h> 41 #include <linux/fs.h> 42 #include <linux/wait_bit.h> 43 #include <linux/path.h> 44 #include <linux/timekeeping.h> 45 #include <linux/sysctl.h> 46 #include <linux/elf.h> 47 #include <linux/pidfs.h> 48 #include <linux/net.h> 49 #include <linux/socket.h> 50 #include <net/af_unix.h> 51 #include <net/net_namespace.h> 52 #include <net/sock.h> 53 #include <uapi/linux/pidfd.h> 54 #include <uapi/linux/un.h> 55 56 #include <linux/uaccess.h> 57 #include <asm/mmu_context.h> 58 #include <asm/tlb.h> 59 #include <asm/exec.h> 60 61 #include <trace/events/task.h> 62 #include "internal.h" 63 64 #include <trace/events/sched.h> 65 66 #define CREATE_TRACE_POINTS 67 #include <trace/events/coredump.h> 68 69 static bool dump_vma_snapshot(struct coredump_params *cprm); 70 static void free_vma_snapshot(struct coredump_params *cprm); 71 static void dump_end_record(struct coredump_params *cprm); 72 static bool dump_flush_skip(struct coredump_params *cprm); 73 74 #define CORE_FILE_NOTE_SIZE_DEFAULT (4*1024*1024) 75 /* Define a reasonable max cap */ 76 #define CORE_FILE_NOTE_SIZE_MAX (16*1024*1024) 77 /* 78 * File descriptor number for the pidfd for the thread-group leader of 79 * the coredumping task installed into the usermode helper's file 80 * descriptor table. 81 */ 82 #define COREDUMP_PIDFD_NUMBER 3 83 84 static int core_uses_pid; 85 static unsigned int core_pipe_limit; 86 static unsigned int core_sort_vma; 87 static char core_pattern[CORENAME_MAX_SIZE] = "core"; 88 /* Taken around every copy in and out of core_pattern. */ 89 static DEFINE_SPINLOCK(core_pattern_lock); 90 static int core_name_size = CORENAME_MAX_SIZE; 91 unsigned int core_file_note_size_limit = CORE_FILE_NOTE_SIZE_DEFAULT; 92 static atomic_t core_pipe_count = ATOMIC_INIT(0); 93 94 enum coredump_type_t { 95 COREDUMP_FILE = 1, 96 COREDUMP_PIPE = 2, 97 COREDUMP_SOCK = 3, 98 COREDUMP_SOCK_REQ = 4, 99 }; 100 101 struct core_name { 102 char *corename __counted_by_ptr(size); 103 int used, size; 104 unsigned int core_pipe_limit; 105 enum coredump_type_t core_type; 106 }; 107 108 static int expand_corename(struct core_name *cn, int size) 109 { 110 char *corename; 111 112 size = kmalloc_size_roundup(size); 113 corename = krealloc(cn->corename, size, GFP_KERNEL); 114 if (!corename) 115 return -ENOMEM; 116 117 cn->corename = corename; 118 cn->size = size; 119 120 if (size > core_name_size) /* racy but harmless */ 121 core_name_size = size; 122 123 return 0; 124 } 125 126 static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt, 127 va_list arg) 128 { 129 int free, need; 130 va_list arg_copy; 131 132 again: 133 free = cn->size - cn->used; 134 135 va_copy(arg_copy, arg); 136 need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy); 137 va_end(arg_copy); 138 139 if (need < free) { 140 cn->used += need; 141 return 0; 142 } 143 144 if (!expand_corename(cn, cn->size + need - free + 1)) 145 goto again; 146 147 return -ENOMEM; 148 } 149 150 static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...) 151 { 152 va_list arg; 153 int ret; 154 155 va_start(arg, fmt); 156 ret = cn_vprintf(cn, fmt, arg); 157 va_end(arg); 158 159 return ret; 160 } 161 162 static __printf(2, 3) 163 int cn_esc_printf(struct core_name *cn, const char *fmt, ...) 164 { 165 int cur = cn->used; 166 va_list arg; 167 int ret; 168 169 va_start(arg, fmt); 170 ret = cn_vprintf(cn, fmt, arg); 171 va_end(arg); 172 173 if (ret == 0) { 174 /* 175 * Ensure that this coredump name component can't cause the 176 * resulting corefile path to consist of a ".." or ".". 177 */ 178 if ((cn->used - cur == 1 && cn->corename[cur] == '.') || 179 (cn->used - cur == 2 && cn->corename[cur] == '.' 180 && cn->corename[cur+1] == '.')) 181 cn->corename[cur] = '!'; 182 183 /* 184 * Empty names are fishy and could be used to create a "//" in a 185 * corefile name, causing the coredump to happen one directory 186 * level too high. Enforce that all components of the core 187 * pattern are at least one character long. 188 */ 189 if (cn->used == cur) 190 ret = cn_printf(cn, "!"); 191 } 192 193 for (; cur < cn->used; ++cur) { 194 if (cn->corename[cur] == '/') 195 cn->corename[cur] = '!'; 196 } 197 return ret; 198 } 199 200 static int cn_print_exe_file(struct core_name *cn, bool name_only) 201 { 202 struct file *exe_file; 203 char *pathbuf, *path, *ptr; 204 int ret; 205 206 exe_file = get_mm_exe_file(current->mm); 207 if (!exe_file) 208 return cn_esc_printf(cn, "%s (path unknown)", current->comm); 209 210 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL); 211 if (!pathbuf) { 212 ret = -ENOMEM; 213 goto put_exe_file; 214 } 215 216 path = file_path(exe_file, pathbuf, PATH_MAX); 217 if (IS_ERR(path)) { 218 ret = PTR_ERR(path); 219 goto free_buf; 220 } 221 222 if (name_only) { 223 ptr = strrchr(path, '/'); 224 if (ptr) 225 path = ptr + 1; 226 } 227 ret = cn_esc_printf(cn, "%s", path); 228 229 free_buf: 230 kfree(pathbuf); 231 put_exe_file: 232 fput(exe_file); 233 return ret; 234 } 235 236 /* 237 * coredump_parse will inspect the pattern parameter, and output a name 238 * into corename, which must have space for at least CORENAME_MAX_SIZE 239 * bytes plus one byte for the zero terminator. 240 */ 241 static bool coredump_parse(struct core_name *cn, struct coredump_params *cprm, 242 size_t **argv, int *argc) 243 { 244 const struct cred *cred = current_cred(); 245 char pattern[CORENAME_MAX_SIZE]; 246 const char *pat_ptr = pattern; 247 bool was_space = false; 248 int pid_in_pattern = 0; 249 int err = 0; 250 251 /* The sysctl handler may be publishing a new pattern. */ 252 scoped_guard(spinlock, &core_pattern_lock) 253 strscpy(pattern, core_pattern); 254 255 cprm->mask = COREDUMP_KERNEL; 256 if (core_pipe_limit) 257 cprm->mask |= COREDUMP_WAIT; 258 cn->used = 0; 259 cn->corename = NULL; 260 cn->core_pipe_limit = 0; 261 if (*pat_ptr == '|') 262 cn->core_type = COREDUMP_PIPE; 263 else if (*pat_ptr == '@') 264 cn->core_type = COREDUMP_SOCK; 265 else 266 cn->core_type = COREDUMP_FILE; 267 if (expand_corename(cn, core_name_size)) 268 return false; 269 cn->corename[0] = '\0'; 270 271 switch (cn->core_type) { 272 case COREDUMP_PIPE: { 273 int argvs = sizeof(core_pattern) / 2; 274 (*argv) = kmalloc_objs(**argv, argvs); 275 if (!(*argv)) 276 return false; 277 (*argv)[(*argc)++] = 0; 278 ++pat_ptr; 279 if (!(*pat_ptr)) 280 return false; 281 break; 282 } 283 case COREDUMP_SOCK: { 284 /* skip the @ */ 285 pat_ptr++; 286 if (!(*pat_ptr)) 287 return false; 288 if (*pat_ptr == '@') { 289 pat_ptr++; 290 if (!(*pat_ptr)) 291 return false; 292 293 cn->core_type = COREDUMP_SOCK_REQ; 294 } 295 296 err = cn_printf(cn, "%s", pat_ptr); 297 if (err) 298 return false; 299 300 /* Require absolute paths. */ 301 if (cn->corename[0] != '/') 302 return false; 303 304 /* 305 * Ensure we can uses spaces to indicate additional 306 * parameters in the future. 307 */ 308 if (strchr(cn->corename, ' ')) { 309 coredump_report_failure("Coredump socket may not %s contain spaces", cn->corename); 310 return false; 311 } 312 313 /* Must not contain ".." in the path. */ 314 if (name_contains_dotdot(cn->corename)) { 315 coredump_report_failure("Coredump socket may not %s contain '..' spaces", cn->corename); 316 return false; 317 } 318 319 if (strlen(cn->corename) >= UNIX_PATH_MAX) { 320 coredump_report_failure("Coredump socket path %s too long", cn->corename); 321 return false; 322 } 323 324 /* 325 * Currently no need to parse any other options. 326 * Relevant information can be retrieved from the peer 327 * pidfd retrievable via SO_PEERPIDFD by the receiver or 328 * via /proc/<pid>, using the SO_PEERPIDFD to guard 329 * against pid recycling when opening /proc/<pid>. 330 */ 331 return true; 332 } 333 case COREDUMP_FILE: 334 break; 335 default: 336 WARN_ON_ONCE(true); 337 return false; 338 } 339 340 /* Repeat as long as we have more pattern to process and more output 341 space */ 342 while (*pat_ptr) { 343 /* 344 * Split on spaces before doing template expansion so that 345 * %e and %E don't get split if they have spaces in them 346 */ 347 if (cn->core_type == COREDUMP_PIPE) { 348 if (isspace(*pat_ptr)) { 349 if (cn->used != 0) 350 was_space = true; 351 pat_ptr++; 352 continue; 353 } else if (was_space) { 354 was_space = false; 355 err = cn_printf(cn, "%c", '\0'); 356 if (err) 357 return false; 358 (*argv)[(*argc)++] = cn->used; 359 } 360 } 361 if (*pat_ptr != '%') { 362 err = cn_printf(cn, "%c", *pat_ptr++); 363 } else { 364 switch (*++pat_ptr) { 365 /* single % at the end, drop that */ 366 case 0: 367 goto out; 368 /* Double percent, output one percent */ 369 case '%': 370 err = cn_printf(cn, "%c", '%'); 371 break; 372 /* pid */ 373 case 'p': 374 pid_in_pattern = 1; 375 err = cn_printf(cn, "%d", 376 task_tgid_vnr(current)); 377 break; 378 /* global pid */ 379 case 'P': 380 err = cn_printf(cn, "%d", 381 task_tgid_nr(current)); 382 break; 383 case 'i': 384 err = cn_printf(cn, "%d", 385 task_pid_vnr(current)); 386 break; 387 case 'I': 388 err = cn_printf(cn, "%d", 389 task_pid_nr(current)); 390 break; 391 /* uid */ 392 case 'u': 393 err = cn_printf(cn, "%u", 394 from_kuid(&init_user_ns, 395 cred->uid)); 396 break; 397 /* gid */ 398 case 'g': 399 err = cn_printf(cn, "%u", 400 from_kgid(&init_user_ns, 401 cred->gid)); 402 break; 403 case 'd': 404 err = cn_printf(cn, "%d", cprm->dumpable); 405 break; 406 /* signal that caused the coredump */ 407 case 's': 408 err = cn_printf(cn, "%d", 409 cprm->siginfo->si_signo); 410 break; 411 /* UNIX time of coredump */ 412 case 't': { 413 time64_t time; 414 415 time = ktime_get_real_seconds(); 416 err = cn_printf(cn, "%lld", time); 417 break; 418 } 419 /* hostname */ 420 case 'h': 421 down_read(&uts_sem); 422 err = cn_esc_printf(cn, "%s", 423 utsname()->nodename); 424 up_read(&uts_sem); 425 break; 426 /* executable, could be changed by prctl PR_SET_NAME etc */ 427 case 'e': 428 err = cn_esc_printf(cn, "%s", current->comm); 429 break; 430 /* file name of executable */ 431 case 'f': 432 err = cn_print_exe_file(cn, true); 433 break; 434 case 'E': 435 err = cn_print_exe_file(cn, false); 436 break; 437 /* core limit size */ 438 case 'c': 439 err = cn_printf(cn, "%lu", 440 rlimit(RLIMIT_CORE)); 441 break; 442 /* CPU the task ran on */ 443 case 'C': 444 err = cn_printf(cn, "%d", cprm->cpu); 445 break; 446 /* pidfd number */ 447 case 'F': { 448 /* 449 * Installing a pidfd only makes sense if 450 * we actually spawn a usermode helper. 451 */ 452 if (cn->core_type != COREDUMP_PIPE) 453 break; 454 455 /* 456 * Note that we'll install a pidfd for the 457 * thread-group leader. We know that task 458 * linkage hasn't been removed yet and even if 459 * this @current isn't the actual thread-group 460 * leader we know that the thread-group leader 461 * cannot be reaped until @current has exited. 462 */ 463 task_pids(cprm->pid, current); 464 err = cn_printf(cn, "%d", COREDUMP_PIDFD_NUMBER); 465 break; 466 } 467 default: 468 break; 469 } 470 ++pat_ptr; 471 } 472 473 if (err) 474 return false; 475 } 476 477 out: 478 /* Backward compatibility with core_uses_pid: 479 * 480 * If core_pattern does not include a %p (as is the default) 481 * and core_uses_pid is set, then .%pid will be appended to 482 * the filename. Do not do this for piped commands. */ 483 if (cn->core_type == COREDUMP_FILE && !pid_in_pattern && core_uses_pid) 484 return cn_printf(cn, ".%d", task_tgid_vnr(current)) == 0; 485 486 return true; 487 } 488 489 static int zap_process(struct signal_struct *signal, int exit_code) 490 { 491 struct task_struct *t; 492 int nr = 0; 493 494 signal->flags = SIGNAL_GROUP_EXIT; 495 signal->group_exit_code = exit_code; 496 signal->group_stop_count = 0; 497 498 __for_each_thread(signal, t) { 499 task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK); 500 if (t != current && !(t->flags & PF_POSTCOREDUMP)) { 501 sigaddset(&t->pending.signal, SIGKILL); 502 signal_wake_up(t, 1); 503 nr++; 504 } 505 } 506 507 return nr; 508 } 509 510 static int zap_threads(struct task_struct *tsk, 511 struct core_state *core_state, int exit_code) 512 { 513 struct signal_struct *signal = tsk->signal; 514 int nr = -EAGAIN; 515 516 spin_lock_irq(&tsk->sighand->siglock); 517 /* A freeze requested before the dump would be lost with TIF_SIGPENDING. */ 518 if (!(signal->flags & SIGNAL_GROUP_EXIT) && !signal->group_exec_task && 519 !freezing(tsk) && !(tsk->jobctl & JOBCTL_TRAP_FREEZE)) { 520 /* Allow SIGKILL, see prepare_signal() */ 521 signal->core_state = core_state; 522 nr = zap_process(signal, exit_code); 523 clear_tsk_thread_flag(tsk, TIF_SIGPENDING); 524 tsk->flags |= PF_DUMPCORE; 525 atomic_set(&core_state->threads_remaining, nr); 526 } 527 spin_unlock_irq(&tsk->sighand->siglock); 528 return nr; 529 } 530 531 static void coredump_wait_inactive(struct core_state *core_state) 532 { 533 struct core_thread *ptr; 534 535 wait_var_event_state(&core_state->threads_remaining, 536 !atomic_read_acquire(&core_state->threads_remaining), 537 TASK_UNINTERRUPTIBLE | TASK_FREEZABLE); 538 /* 539 * Wait for all the threads to become inactive, so that 540 * all the thread context (extended register state, like 541 * fpu etc) gets copied to the memory. 542 */ 543 for (ptr = core_state->tasks; ptr; ptr = ptr->next) 544 wait_task_inactive(ptr->task, TASK_ANY); 545 } 546 547 static int coredump_wait(int exit_code, struct core_state *core_state) 548 { 549 struct task_struct *tsk = current; 550 int core_waiters = -EBUSY; 551 552 core_state->tasks = NULL; 553 554 core_waiters = zap_threads(tsk, core_state, exit_code); 555 if (core_waiters > 0) 556 coredump_wait_inactive(core_state); 557 558 return core_waiters; 559 } 560 561 static void coredump_finish(enum coredump_state state) 562 { 563 struct core_thread *curr, *next; 564 struct task_struct *task; 565 566 spin_lock_irq(¤t->sighand->siglock); 567 if ((state & COREDUMP_STATE_STARTED) && !__fatal_signal_pending(current)) 568 current->signal->group_exit_code |= 0x80; 569 next = current->signal->core_state->tasks; 570 current->signal->core_state = NULL; 571 spin_unlock_irq(¤t->sighand->siglock); 572 573 /* A released thread may exit and be freed before it is woken. */ 574 guard(rcu)(); 575 while ((curr = next) != NULL) { 576 next = curr->next; 577 task = curr->task; 578 /* 579 * see coredump_task_exit(), curr->task must not see 580 * ->task == NULL before we read ->next. 581 */ 582 smp_mb(); 583 /* Any wakeup now lets the thread exit, rcu keeps it alive. */ 584 curr->task = NULL; 585 wake_up_process(task); 586 } 587 } 588 589 static bool dump_interrupted(void) 590 { 591 /* Only SIGKILL and the freezers set it after zap_threads(). */ 592 return task_sigpending(current); 593 } 594 595 static void wait_for_dump_helpers(struct file *file) 596 { 597 struct pipe_inode_info *pipe = file->private_data; 598 599 pipe_lock(pipe); 600 pipe->readers++; 601 pipe->writers--; 602 wake_up_interruptible_sync(&pipe->rd_wait); 603 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); 604 pipe_unlock(pipe); 605 606 /* 607 * We actually want wait_event_freezable() but then we need 608 * to clear TIF_SIGPENDING and improve dump_interrupted(). 609 */ 610 wait_event_interruptible(pipe->rd_wait, pipe->readers == 1); 611 612 pipe_lock(pipe); 613 pipe->readers--; 614 pipe->writers++; 615 pipe_unlock(pipe); 616 } 617 618 /* 619 * umh_coredump_setup 620 * helper function to customize the process used 621 * to collect the core in userspace. Specifically 622 * it sets up a pipe and installs it as fd 0 (stdin) 623 * for the process. Returns 0 on success, or 624 * PTR_ERR on failure. 625 * Note that it also sets the core limit to 1. This 626 * is a special value that we use to trap recursive 627 * core dumps 628 */ 629 static int umh_coredump_setup(struct subprocess_info *info, struct cred *new) 630 { 631 struct file *files[2]; 632 struct coredump_params *cp = (struct coredump_params *)info->data; 633 int err; 634 635 if (cp->pid[PIDTYPE_TGID]) { 636 struct file *pidfs_file __free(fput) = NULL; 637 638 pidfs_file = pidfs_alloc_file(cp->pid[PIDTYPE_TGID], 0); 639 if (IS_ERR(pidfs_file)) 640 return PTR_ERR(pidfs_file); 641 642 err = pidfs_register_pids(cp->pid); 643 if (err) 644 return err; 645 646 pidfs_coredump(cp); 647 648 /* 649 * Usermode helpers are childen of either 650 * system_dfl_wq or of kthreadd. So we know that 651 * we're starting off with a clean file descriptor 652 * table. So we should always be able to use 653 * COREDUMP_PIDFD_NUMBER as our file descriptor value. 654 */ 655 err = replace_fd(COREDUMP_PIDFD_NUMBER, pidfs_file, 0); 656 if (err < 0) 657 return err; 658 } 659 660 err = create_pipe_files(files, 0); 661 if (err) 662 return err; 663 664 cp->file = files[1]; 665 666 err = replace_fd(0, files[0], 0); 667 fput(files[0]); 668 if (err < 0) 669 return err; 670 671 /* and disallow core files too */ 672 current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1}; 673 674 return 0; 675 } 676 677 static_assert(sizeof(struct coredump_record_header) == COREDUMP_RECORD_HEADER_SIZE_VER0); 678 679 #ifdef CONFIG_UNIX 680 /* af_unix halves the send buffer to size a single skb. */ 681 #define COREDUMP_SOCK_SNDBUF_MIN (3 * PAGE_SIZE) 682 683 static bool coredump_sock_connect(struct core_name *cn, struct coredump_params *cprm) 684 { 685 struct file *file __free(fput) = NULL; 686 struct sockaddr_un addr = { 687 .sun_family = AF_UNIX, 688 }; 689 ssize_t addr_len; 690 int retval; 691 struct socket *socket; 692 693 addr_len = strscpy(addr.sun_path, cn->corename); 694 if (addr_len < 0) 695 return false; 696 addr_len += offsetof(struct sockaddr_un, sun_path) + 1; 697 698 /* 699 * It is possible that the userspace process which is supposed 700 * to handle the coredump and is listening on the AF_UNIX socket 701 * coredumps. Userspace should just mark itself non dumpable. 702 */ 703 704 retval = sock_create_kern(&init_net, AF_UNIX, SOCK_STREAM, 0, &socket); 705 if (retval < 0) 706 return false; 707 708 /* Don't let a page-sized write split into several skbs. */ 709 socket->sk->sk_sndbuf = max_t(int, socket->sk->sk_sndbuf, 710 COREDUMP_SOCK_SNDBUF_MIN); 711 712 file = sock_alloc_file(socket, 0, NULL); 713 if (IS_ERR(file)) 714 return false; 715 716 /* 717 * Set the pids of the dumping thread and its thread-group leader 718 * which are used for the peer credentials during connect() below. 719 * Then immediately register them in pidfs... 720 */ 721 task_pids(cprm->pid, current); 722 retval = pidfs_register_pids(cprm->pid); 723 if (retval) 724 return false; 725 726 /* 727 * ... and set the coredump information so userspace has it 728 * available after connect()... 729 */ 730 pidfs_coredump(cprm); 731 732 retval = kernel_connect(socket, (struct sockaddr_unsized *)(&addr), addr_len, 733 O_NONBLOCK | SOCK_COREDUMP); 734 735 if (retval) { 736 if (retval == -EAGAIN) 737 coredump_report_failure("Coredump socket %s receive queue full", addr.sun_path); 738 else 739 coredump_report_failure("Coredump socket connection %s failed %d", addr.sun_path, retval); 740 return false; 741 } 742 743 /* ... and validate that @sk_peer_pid matches @cprm.pid. */ 744 if (WARN_ON_ONCE(!pids_equal(unix_peer(socket->sk)->sk_peer_pid, cprm->pid))) 745 return false; 746 747 cprm->limit = RLIM_INFINITY; 748 cprm->file = no_free_ptr(file); 749 750 return true; 751 } 752 753 static inline bool coredump_sock_recv(struct file *file, struct coredump_ack *ack, size_t size, int flags) 754 { 755 struct msghdr msg = {}; 756 struct kvec iov = { .iov_base = ack, .iov_len = size }; 757 ssize_t ret; 758 759 memset(ack, 0, size); 760 ret = kernel_recvmsg(sock_from_file(file), &msg, &iov, 1, size, flags); 761 return ret == size; 762 } 763 764 static inline bool coredump_sock_send(struct file *file, struct coredump_req *req) 765 { 766 struct msghdr msg = { .msg_flags = MSG_NOSIGNAL }; 767 struct kvec iov = { .iov_base = req, .iov_len = sizeof(*req) }; 768 ssize_t ret; 769 770 ret = kernel_sendmsg(sock_from_file(file), &msg, &iov, 1, sizeof(*req)); 771 return ret == sizeof(*req); 772 } 773 774 static_assert(sizeof(struct coredump_req) == COREDUMP_REQ_SIZE_VER1); 775 static_assert(sizeof(struct coredump_ack) == COREDUMP_ACK_SIZE_VER1); 776 static_assert(sizeof(enum coredump_mark) == sizeof(__u32)); 777 778 /* Every memory type this kernel knows. */ 779 #define COREDUMP_MEMORY_ALL \ 780 (COREDUMP_MEMORY_ANON_PRIVATE | COREDUMP_MEMORY_ANON_SHARED | \ 781 COREDUMP_MEMORY_FILE_PRIVATE | COREDUMP_MEMORY_FILE_SHARED | \ 782 COREDUMP_MEMORY_ELF_HEADERS | \ 783 COREDUMP_MEMORY_HUGETLB_PRIVATE | COREDUMP_MEMORY_HUGETLB_SHARED | \ 784 COREDUMP_MEMORY_DAX_PRIVATE | COREDUMP_MEMORY_DAX_SHARED) 785 786 #define COREDUMP_MEMORY_TYPE_BIT(mmf) BIT((mmf) - MMF_DUMP_FILTER_SHIFT) 787 static_assert(COREDUMP_MEMORY_ALL == (MMF_DUMP_FILTER_MASK >> MMF_DUMP_FILTER_SHIFT)); 788 static_assert(COREDUMP_MEMORY_ANON_PRIVATE == 789 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_ANON_PRIVATE)); 790 static_assert(COREDUMP_MEMORY_ANON_SHARED == 791 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_ANON_SHARED)); 792 static_assert(COREDUMP_MEMORY_FILE_PRIVATE == 793 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_MAPPED_PRIVATE)); 794 static_assert(COREDUMP_MEMORY_FILE_SHARED == 795 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_MAPPED_SHARED)); 796 static_assert(COREDUMP_MEMORY_ELF_HEADERS == 797 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_ELF_HEADERS)); 798 static_assert(COREDUMP_MEMORY_HUGETLB_PRIVATE == 799 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_HUGETLB_PRIVATE)); 800 static_assert(COREDUMP_MEMORY_HUGETLB_SHARED == 801 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_HUGETLB_SHARED)); 802 static_assert(COREDUMP_MEMORY_DAX_PRIVATE == 803 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_DAX_PRIVATE)); 804 static_assert(COREDUMP_MEMORY_DAX_SHARED == 805 COREDUMP_MEMORY_TYPE_BIT(MMF_DUMP_DAX_SHARED)); 806 807 static inline bool coredump_sock_mark(struct file *file, enum coredump_mark mark) 808 { 809 struct msghdr msg = { .msg_flags = MSG_NOSIGNAL }; 810 struct kvec iov = { .iov_base = &mark, .iov_len = sizeof(mark) }; 811 ssize_t ret; 812 813 ret = kernel_sendmsg(sock_from_file(file), &msg, &iov, 1, sizeof(mark)); 814 return ret == sizeof(mark); 815 } 816 817 static inline void coredump_sock_wait(struct file *file) 818 { 819 ssize_t n; 820 821 /* 822 * We use a simple read to wait for the coredump processing to 823 * finish. Either the socket is closed or we get sent unexpected 824 * data. In both cases, we're done. 825 */ 826 n = __kernel_read(file, &(char){ 0 }, 1, NULL); 827 if (n > 0) 828 coredump_report_failure("Coredump socket had unexpected data"); 829 else if (n < 0) 830 coredump_report_failure("Coredump socket failed"); 831 } 832 833 static inline void coredump_sock_shutdown(struct file *file) 834 { 835 struct socket *socket; 836 837 socket = sock_from_file(file); 838 if (!socket) 839 return; 840 841 /* Let userspace know we're done processing the coredump. */ 842 kernel_sock_shutdown(socket, SHUT_WR); 843 } 844 845 static bool coredump_sock_request(struct core_name *cn, struct coredump_params *cprm) 846 { 847 struct coredump_req req = { 848 .size = sizeof(struct coredump_req), 849 .mask = COREDUMP_KERNEL | COREDUMP_USERSPACE | 850 COREDUMP_REJECT | COREDUMP_WAIT | 851 COREDUMP_RECORDS | COREDUMP_SPARSE | 852 COREDUMP_MEMORY_TYPES, 853 .size_ack = sizeof(struct coredump_ack), 854 .memory_types = cprm->memory_types, 855 .memory_types_mask = COREDUMP_MEMORY_ALL, 856 }; 857 struct coredump_ack ack = {}; 858 ssize_t usize; 859 860 if (cn->core_type != COREDUMP_SOCK_REQ) 861 return true; 862 863 /* Let userspace know what we support. */ 864 if (!coredump_sock_send(cprm->file, &req)) 865 return false; 866 867 /* Peek the size of the coredump_ack. */ 868 if (!coredump_sock_recv(cprm->file, &ack, sizeof(ack.size), 869 MSG_PEEK | MSG_WAITALL)) 870 return false; 871 872 /* Refuse unknown coredump_ack sizes. */ 873 usize = ack.size; 874 if (usize < COREDUMP_ACK_SIZE_VER0) { 875 coredump_sock_mark(cprm->file, COREDUMP_MARK_MINSIZE); 876 return false; 877 } 878 879 if (usize > sizeof(ack)) { 880 coredump_sock_mark(cprm->file, COREDUMP_MARK_MAXSIZE); 881 return false; 882 } 883 884 /* Now retrieve the coredump_ack. */ 885 if (!coredump_sock_recv(cprm->file, &ack, usize, MSG_WAITALL)) 886 return false; 887 if (ack.size != usize) 888 return false; 889 890 /* Refuse unknown coredump_ack flags. */ 891 if (ack.mask & ~req.mask) { 892 coredump_sock_mark(cprm->file, COREDUMP_MARK_UNSUPPORTED); 893 return false; 894 } 895 896 /* Refuse mutually exclusive options. */ 897 if (hweight64(ack.mask & (COREDUMP_USERSPACE | COREDUMP_KERNEL | 898 COREDUMP_REJECT)) != 1) { 899 coredump_sock_mark(cprm->file, COREDUMP_MARK_CONFLICTING); 900 return false; 901 } 902 903 if (ack.spare) { 904 coredump_sock_mark(cprm->file, COREDUMP_MARK_UNSUPPORTED); 905 return false; 906 } 907 908 /* Records only describe a coredump the kernel writes. */ 909 if ((ack.mask & COREDUMP_RECORDS) && !(ack.mask & COREDUMP_KERNEL)) { 910 coredump_sock_mark(cprm->file, COREDUMP_MARK_CONFLICTING); 911 return false; 912 } 913 914 /* Zero records only exist inside a record stream. */ 915 if ((ack.mask & COREDUMP_SPARSE) && !(ack.mask & COREDUMP_RECORDS)) { 916 coredump_sock_mark(cprm->file, COREDUMP_MARK_CONFLICTING); 917 return false; 918 } 919 920 if (ack.mask & COREDUMP_MEMORY_TYPES) { 921 /* The memory types need the whole field. */ 922 if (usize < COREDUMP_ACK_SIZE_VER1) { 923 coredump_sock_mark(cprm->file, COREDUMP_MARK_MINSIZE); 924 return false; 925 } 926 927 /* The memory types only select what the kernel writes. */ 928 if (!(ack.mask & COREDUMP_KERNEL)) { 929 coredump_sock_mark(cprm->file, COREDUMP_MARK_CONFLICTING); 930 return false; 931 } 932 933 /* Refuse unknown memory types. */ 934 if (ack.memory_types & ~req.memory_types_mask) { 935 coredump_sock_mark(cprm->file, COREDUMP_MARK_UNSUPPORTED); 936 return false; 937 } 938 } else if (ack.memory_types) { 939 /* Like @spare the field must be zero when it isn't used. */ 940 coredump_sock_mark(cprm->file, COREDUMP_MARK_UNSUPPORTED); 941 return false; 942 } 943 944 /* Record header scratch; a bvec can't point at the stack. */ 945 if (ack.mask & COREDUMP_RECORDS) { 946 cprm->record_hdr = kmalloc_obj(*cprm->record_hdr); 947 if (!cprm->record_hdr) 948 return false; 949 } 950 951 /* The server's selection replaces the task's entirely. */ 952 if (ack.mask & COREDUMP_MEMORY_TYPES) 953 cprm->memory_types = ack.memory_types; 954 955 cprm->mask = ack.mask; 956 return coredump_sock_mark(cprm->file, COREDUMP_MARK_REQACK); 957 } 958 959 static bool coredump_socket(struct core_name *cn, struct coredump_params *cprm) 960 { 961 if (!coredump_sock_connect(cn, cprm)) 962 return false; 963 964 return coredump_sock_request(cn, cprm); 965 } 966 #else 967 static inline void coredump_sock_wait(struct file *file) { } 968 static inline void coredump_sock_shutdown(struct file *file) { } 969 static inline bool coredump_socket(struct core_name *cn, struct coredump_params *cprm) { return false; } 970 #endif 971 972 /* cprm->dumpable is the snapshot of task dumpability at dump start. */ 973 static inline bool coredump_force_suid_safe(const struct coredump_params *cprm) 974 { 975 /* Require nonrelative corefile path and be extra careful. */ 976 return cprm->dumpable == TASK_DUMPABLE_ROOT; 977 } 978 979 static bool coredump_file(struct core_name *cn, struct coredump_params *cprm, 980 const struct linux_binfmt *binfmt) 981 { 982 const struct mnt_idmap *idmap; 983 struct inode *inode; 984 struct file *file __free(fput) = NULL; 985 int open_flags = O_CREAT | O_WRONLY | O_NOFOLLOW | O_LARGEFILE | O_EXCL; 986 987 if (cprm->limit < binfmt->min_coredump) 988 return false; 989 990 if (coredump_force_suid_safe(cprm) && cn->corename[0] != '/') { 991 coredump_report_failure("this process can only dump core to a fully qualified path, skipping core dump"); 992 return false; 993 } 994 995 /* 996 * Unlink the file if it exists unless this is a SUID 997 * binary - in that case, we're running around with root 998 * privs and don't want to unlink another user's coredump. 999 */ 1000 if (!coredump_force_suid_safe(cprm)) { 1001 CLASS(filename_kernel, name)(cn->corename); 1002 /* 1003 * If it doesn't exist, that's fine. If there's some 1004 * other problem, we'll catch it at the filp_open(). 1005 */ 1006 filename_unlinkat(AT_FDCWD, name); 1007 } 1008 1009 /* 1010 * There is a race between unlinking and creating the 1011 * file, but if that causes an EEXIST here, that's 1012 * fine - another process raced with us while creating 1013 * the corefile, and the other process won. To userspace, 1014 * what matters is that at least one of the two processes 1015 * writes its coredump successfully, not which one. 1016 */ 1017 if (coredump_force_suid_safe(cprm)) { 1018 /* 1019 * Using user namespaces, normal user tasks can change 1020 * their current->fs->root to point to arbitrary 1021 * directories. Since the intention of the "only dump 1022 * with a fully qualified path" rule is to control where 1023 * coredumps may be placed using root privileges, 1024 * current->fs->root must not be used. Instead, use the 1025 * root directory of PID 1. 1026 */ 1027 scoped_with_init_fs() 1028 file = filp_open(cn->corename, open_flags, 0600); 1029 } else { 1030 file = filp_open(cn->corename, open_flags, 0600); 1031 } 1032 if (IS_ERR(file)) 1033 return false; 1034 1035 inode = file_inode(file); 1036 if (inode->i_nlink > 1) 1037 return false; 1038 if (d_unhashed(file->f_path.dentry)) 1039 return false; 1040 /* 1041 * AK: actually i see no reason to not allow this for named 1042 * pipes etc, but keep the previous behaviour for now. 1043 */ 1044 if (!S_ISREG(inode->i_mode)) 1045 return false; 1046 /* 1047 * Don't dump core if the filesystem changed owner or mode 1048 * of the file during file creation. This is an issue when 1049 * a process dumps core while its cwd is e.g. on a vfat 1050 * filesystem. 1051 */ 1052 idmap = file_mnt_idmap(file); 1053 if (!vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), current_fsuid())) { 1054 coredump_report_failure("Core dump to %s aborted: cannot preserve file owner", cn->corename); 1055 return false; 1056 } 1057 if ((inode->i_mode & 0677) != 0600) { 1058 coredump_report_failure("Core dump to %s aborted: cannot preserve file permissions", cn->corename); 1059 return false; 1060 } 1061 if (!(file->f_mode & FMODE_CAN_WRITE)) 1062 return false; 1063 if (do_truncate(idmap, file->f_path.dentry, 0, 0, file)) 1064 return false; 1065 1066 cprm->file = no_free_ptr(file); 1067 return true; 1068 } 1069 1070 static bool coredump_pipe(struct core_name *cn, struct coredump_params *cprm, 1071 size_t *argv, int argc) 1072 { 1073 int argi; 1074 char **helper_argv __free(kfree) = NULL; 1075 struct subprocess_info *sub_info; 1076 1077 if (cprm->limit == 1) { 1078 /* See umh_coredump_setup() which sets RLIMIT_CORE = 1. 1079 * 1080 * Normally core limits are irrelevant to pipes, since 1081 * we're not writing to the file system, but we use 1082 * cprm.limit of 1 here as a special value, this is a 1083 * consistent way to catch recursive crashes. 1084 * We can still crash if the core_pattern binary sets 1085 * RLIM_CORE = !1, but it runs as root, and can do 1086 * lots of stupid things. 1087 * 1088 * Note that we use task_tgid_vnr here to grab the pid 1089 * of the process group leader. That way we get the 1090 * right pid if a thread in a multi-threaded 1091 * core_pattern process dies. 1092 */ 1093 coredump_report_failure("RLIMIT_CORE is set to 1, aborting core"); 1094 return false; 1095 } 1096 cprm->limit = RLIM_INFINITY; 1097 1098 cn->core_pipe_limit = atomic_inc_return(&core_pipe_count); 1099 if (core_pipe_limit && (core_pipe_limit < cn->core_pipe_limit)) { 1100 coredump_report_failure("over core_pipe_limit, skipping core dump"); 1101 return false; 1102 } 1103 1104 helper_argv = kmalloc_objs(*helper_argv, argc + 1); 1105 if (!helper_argv) { 1106 coredump_report_failure("%s failed to allocate memory", __func__); 1107 return false; 1108 } 1109 for (argi = 0; argi < argc; argi++) 1110 helper_argv[argi] = cn->corename + argv[argi]; 1111 helper_argv[argi] = NULL; 1112 1113 sub_info = call_usermodehelper_setup(helper_argv[0], helper_argv, NULL, 1114 GFP_KERNEL, umh_coredump_setup, 1115 NULL, cprm); 1116 if (!sub_info) 1117 return false; 1118 1119 if (call_usermodehelper_exec(sub_info, UMH_WAIT_EXEC)) { 1120 coredump_report_failure("|%s pipe failed", cn->corename); 1121 return false; 1122 } 1123 1124 /* 1125 * umh disabled with CONFIG_STATIC_USERMODEHELPER_PATH="" would 1126 * have this set to NULL. 1127 */ 1128 if (!cprm->file) { 1129 coredump_report_failure("Core dump to |%s disabled", cn->corename); 1130 return false; 1131 } 1132 1133 return true; 1134 } 1135 1136 static bool coredump_write(struct coredump_params *cprm, 1137 const struct linux_binfmt *binfmt) 1138 { 1139 if (dump_interrupted()) { 1140 cprm->state |= COREDUMP_STATE_TRUNCATED; 1141 return true; 1142 } 1143 1144 if (!dump_vma_snapshot(cprm)) { 1145 cprm->state |= COREDUMP_STATE_TRUNCATED; 1146 return false; 1147 } 1148 1149 file_start_write(cprm->file); 1150 if (!binfmt->core_dump(cprm)) 1151 cprm->state |= COREDUMP_STATE_TRUNCATED; 1152 /* 1153 * A trailing hole still has to land in the coredump. Seeking over 1154 * it doesn't grow the file, so the last byte of it is written 1155 * instead and gdb doesn't see a truncated file. Everything else 1156 * puts the hole on the wire as it flushes it. 1157 */ 1158 if (cprm->to_skip) { 1159 bool flushed; 1160 1161 if (cprm->file->f_mode & FMODE_LSEEK) { 1162 cprm->to_skip--; 1163 flushed = dump_emit(cprm, "", 1); 1164 } else { 1165 flushed = dump_flush_skip(cprm); 1166 } 1167 if (!flushed) 1168 cprm->state |= COREDUMP_STATE_TRUNCATED; 1169 } 1170 dump_end_record(cprm); 1171 file_end_write(cprm->file); 1172 free_vma_snapshot(cprm); 1173 return true; 1174 } 1175 1176 static void coredump_cleanup(struct core_name *cn, struct coredump_params *cprm) 1177 { 1178 if (cprm->file) 1179 filp_close(cprm->file, NULL); 1180 if (cn->core_pipe_limit) { 1181 VFS_WARN_ON_ONCE(cn->core_type != COREDUMP_PIPE); 1182 atomic_dec(&core_pipe_count); 1183 } 1184 kfree(cn->corename); 1185 kfree(cprm->record_hdr); 1186 coredump_finish(cprm->state); 1187 } 1188 1189 static inline bool coredump_skip(const struct coredump_params *cprm, 1190 const struct linux_binfmt *binfmt) 1191 { 1192 if (!binfmt) 1193 return true; 1194 if (!binfmt->core_dump) 1195 return true; 1196 if (cprm->dumpable == TASK_DUMPABLE_OFF) 1197 return true; 1198 return false; 1199 } 1200 1201 static void do_coredump(struct core_name *cn, struct coredump_params *cprm, 1202 size_t **argv, int *argc, const struct linux_binfmt *binfmt) 1203 { 1204 trace_coredump(cprm->siginfo->si_signo); 1205 1206 if (!coredump_parse(cn, cprm, argv, argc)) { 1207 coredump_report_failure("format_corename failed, aborting core"); 1208 return; 1209 } 1210 1211 switch (cn->core_type) { 1212 case COREDUMP_FILE: 1213 if (!coredump_file(cn, cprm, binfmt)) 1214 return; 1215 break; 1216 case COREDUMP_PIPE: 1217 if (!coredump_pipe(cn, cprm, *argv, *argc)) 1218 return; 1219 break; 1220 case COREDUMP_SOCK_REQ: 1221 fallthrough; 1222 case COREDUMP_SOCK: 1223 if (!coredump_socket(cn, cprm)) 1224 return; 1225 break; 1226 default: 1227 WARN_ON_ONCE(true); 1228 return; 1229 } 1230 1231 /* Don't even generate the coredump. */ 1232 if (cprm->mask & COREDUMP_REJECT) 1233 return; 1234 1235 if ((cprm->mask & COREDUMP_KERNEL) && !coredump_write(cprm, binfmt)) 1236 return; 1237 1238 coredump_sock_shutdown(cprm->file); 1239 1240 /* Let the parent know that a coredump was generated. */ 1241 if (cprm->mask & COREDUMP_USERSPACE) 1242 cprm->state |= COREDUMP_STATE_STARTED; 1243 1244 /* 1245 * When core_pipe_limit is set we wait for the coredump server 1246 * or usermodehelper to finish before exiting so it can e.g., 1247 * inspect /proc/<pid>. 1248 */ 1249 if (cprm->mask & COREDUMP_WAIT) { 1250 switch (cn->core_type) { 1251 case COREDUMP_PIPE: 1252 wait_for_dump_helpers(cprm->file); 1253 break; 1254 case COREDUMP_SOCK_REQ: 1255 fallthrough; 1256 case COREDUMP_SOCK: 1257 coredump_sock_wait(cprm->file); 1258 break; 1259 default: 1260 break; 1261 } 1262 } 1263 } 1264 1265 #define COREDUMP_TASK_MEMORY_TYPES(mm) \ 1266 ((__mm_flags_get_word((mm)) & MMF_DUMP_FILTER_MASK) >> \ 1267 MMF_DUMP_FILTER_SHIFT) 1268 1269 void vfs_coredump(const kernel_siginfo_t *siginfo) 1270 { 1271 size_t *argv __free(kfree) = NULL; 1272 struct core_state core_state; 1273 struct core_name cn; 1274 const struct mm_struct *mm = current->mm; 1275 const struct linux_binfmt *binfmt = mm->binfmt; 1276 int argc = 0; 1277 struct coredump_params cprm = { 1278 .siginfo = siginfo, 1279 .limit = rlimit(RLIMIT_CORE), 1280 /* Snapshot the memory types (unlocked) and dumpable for the dump. */ 1281 .memory_types = COREDUMP_TASK_MEMORY_TYPES(mm), 1282 .dumpable = task_exec_state_get_dumpable(current), 1283 .vma_meta = NULL, 1284 .cpu = raw_smp_processor_id(), 1285 }; 1286 1287 audit_core_dumps(siginfo->si_signo); 1288 1289 if (coredump_skip(&cprm, binfmt)) 1290 return; 1291 1292 CLASS(prepare_creds, cred)(); 1293 if (!cred) 1294 return; 1295 /* 1296 * We cannot trust fsuid as being the "true" uid of the process 1297 * nor do we know its entire history. We only know it was tainted 1298 * so we dump it as root in mode 2, and only into a controlled 1299 * environment (pipe handler or fully qualified path). 1300 */ 1301 if (coredump_force_suid_safe(&cprm)) 1302 cred->fsuid = GLOBAL_ROOT_UID; 1303 1304 if (coredump_wait(siginfo->si_signo, &core_state) < 0) 1305 return; 1306 1307 /* Task work must not cut the dump short, see signal_pending(). */ 1308 guard(no_notify_signal)(); 1309 scoped_with_creds(cred) 1310 do_coredump(&cn, &cprm, &argv, &argc, binfmt); 1311 coredump_cleanup(&cn, &cprm); 1312 return; 1313 } 1314 1315 /* 1316 * Core dumping helper functions. These are the only things you should 1317 * do on a core-file: use only these functions to write out all the 1318 * necessary info. 1319 */ 1320 static bool dump_records(const struct coredump_params *cprm) 1321 { 1322 return cprm->mask & COREDUMP_RECORDS; 1323 } 1324 1325 static bool dump_sparse(const struct coredump_params *cprm) 1326 { 1327 return cprm->mask & COREDUMP_SPARSE; 1328 } 1329 1330 /* Describe the next @len bytes of the coredump. Returns the header size. */ 1331 static size_t dump_record_init(struct coredump_params *cprm, 1332 enum coredump_record_type type, u64 flags, 1333 u64 len) 1334 { 1335 if (!dump_records(cprm)) 1336 return 0; 1337 1338 *cprm->record_hdr = (struct coredump_record_header) { 1339 .size = sizeof(*cprm->record_hdr), 1340 .type = type, 1341 .flags = flags, 1342 .offset = cprm->pos, 1343 .len = len, 1344 }; 1345 1346 return sizeof(*cprm->record_hdr); 1347 } 1348 1349 /* Write @iter whole or fail. @len is what it advances the coredump by. */ 1350 static bool dump_write_iter(struct coredump_params *cprm, struct iov_iter *iter, 1351 size_t len) 1352 { 1353 struct file *file = cprm->file; 1354 size_t count = iov_iter_count(iter); 1355 loff_t pos = file->f_pos; 1356 ssize_t n; 1357 1358 n = __kernel_write_iter(file, iter, &pos); 1359 if (n != (ssize_t)count) 1360 return false; 1361 file->f_pos = pos; 1362 cprm->written += count; 1363 cprm->pos += len; 1364 1365 return true; 1366 } 1367 1368 /* One record, never more than a page. See __dump_emit(). */ 1369 static bool dump_emit_chunk(struct coredump_params *cprm, const void *addr, 1370 int nr) 1371 { 1372 struct kvec kvec[2]; 1373 struct iov_iter iter; 1374 unsigned int nseg = 0; 1375 size_t hdrlen; 1376 1377 if (dump_interrupted()) 1378 return false; 1379 1380 hdrlen = dump_record_init(cprm, COREDUMP_RECORD_DATA, 0, nr); 1381 if (hdrlen) { 1382 kvec[nseg].iov_base = cprm->record_hdr; 1383 kvec[nseg].iov_len = hdrlen; 1384 nseg++; 1385 } 1386 kvec[nseg].iov_base = (void *)addr; 1387 kvec[nseg].iov_len = nr; 1388 nseg++; 1389 1390 iov_iter_kvec(&iter, ITER_SOURCE, kvec, nseg, hdrlen + nr); 1391 1392 return dump_write_iter(cprm, &iter, nr); 1393 } 1394 1395 static bool __dump_emit(struct coredump_params *cprm, const void *addr, int nr) 1396 { 1397 if (cprm->written + nr > cprm->limit) 1398 return false; 1399 1400 while (nr) { 1401 int chunk = min_t(int, nr, PAGE_SIZE); 1402 1403 if (!dump_emit_chunk(cprm, addr, chunk)) 1404 return false; 1405 1406 addr += chunk; 1407 nr -= chunk; 1408 } 1409 1410 return true; 1411 } 1412 1413 /* Send a record that stands on its own: a header and nothing else. */ 1414 static bool dump_emit_record(struct coredump_params *cprm, 1415 enum coredump_record_type type, u64 flags, u64 len) 1416 { 1417 struct kvec kvec; 1418 struct iov_iter iter; 1419 size_t hdrlen; 1420 1421 hdrlen = dump_record_init(cprm, type, flags, len); 1422 if (!hdrlen) 1423 return false; 1424 1425 kvec.iov_base = cprm->record_hdr; 1426 kvec.iov_len = hdrlen; 1427 iov_iter_kvec(&iter, ITER_SOURCE, &kvec, 1, hdrlen); 1428 1429 return dump_write_iter(cprm, &iter, len); 1430 } 1431 1432 /* Close the record stream. Only a whole coredump gets an end record. */ 1433 static void dump_end_record(struct coredump_params *cprm) 1434 { 1435 if (cprm->state & COREDUMP_STATE_TRUNCATED) 1436 return; 1437 1438 dump_emit_record(cprm, COREDUMP_RECORD_END, 0, 0); 1439 } 1440 1441 static bool __dump_skip(struct coredump_params *cprm, size_t nr) 1442 { 1443 static char zeroes[PAGE_SIZE]; 1444 struct file *file = cprm->file; 1445 1446 if (dump_sparse(cprm)) { 1447 /* Hand the server the length of the hole instead of the hole itself. */ 1448 if (dump_interrupted()) 1449 return false; 1450 return dump_emit_record(cprm, COREDUMP_RECORD_ZERO, 0, nr); 1451 } 1452 1453 if (file->f_mode & FMODE_LSEEK) { 1454 if (dump_interrupted() || vfs_llseek(file, nr, SEEK_CUR) < 0) 1455 return false; 1456 cprm->pos += nr; 1457 return true; 1458 } 1459 1460 while (nr) { 1461 size_t chunk = min_t(size_t, nr, PAGE_SIZE); 1462 1463 if (!__dump_emit(cprm, zeroes, chunk)) 1464 return false; 1465 1466 nr -= chunk; 1467 } 1468 1469 return true; 1470 } 1471 1472 /* Flush the accumulated hole before writing data. */ 1473 static bool dump_flush_skip(struct coredump_params *cprm) 1474 { 1475 if (cprm->to_skip) { 1476 if (!__dump_skip(cprm, cprm->to_skip)) 1477 return false; 1478 cprm->to_skip = 0; 1479 } 1480 return true; 1481 } 1482 1483 bool dump_emit(struct coredump_params *cprm, const void *addr, int nr) 1484 { 1485 if (!dump_flush_skip(cprm)) 1486 return false; 1487 return __dump_emit(cprm, addr, nr); 1488 } 1489 EXPORT_SYMBOL(dump_emit); 1490 1491 void dump_skip_to(struct coredump_params *cprm, unsigned long pos) 1492 { 1493 if (WARN_ON_ONCE(pos < cprm->pos)) 1494 return; 1495 cprm->to_skip = pos - cprm->pos; 1496 } 1497 EXPORT_SYMBOL(dump_skip_to); 1498 1499 void dump_skip(struct coredump_params *cprm, size_t nr) 1500 { 1501 cprm->to_skip += nr; 1502 } 1503 EXPORT_SYMBOL(dump_skip); 1504 1505 #ifdef CONFIG_ELF_CORE 1506 static bool dump_emit_page(struct coredump_params *cprm, struct page *page) 1507 { 1508 struct bio_vec bvec[2]; 1509 struct iov_iter iter; 1510 unsigned int nseg = 0; 1511 size_t hdrlen; 1512 1513 if (!page) 1514 return false; 1515 1516 if (!dump_flush_skip(cprm)) 1517 return false; 1518 if (cprm->written + PAGE_SIZE > cprm->limit) 1519 return false; 1520 if (dump_interrupted()) 1521 return false; 1522 1523 /* Hand the record header to the same write as the page it describes. */ 1524 hdrlen = dump_record_init(cprm, COREDUMP_RECORD_DATA, 0, PAGE_SIZE); 1525 if (hdrlen) 1526 bvec_set_virt(&bvec[nseg++], cprm->record_hdr, hdrlen); 1527 bvec_set_page(&bvec[nseg++], page, PAGE_SIZE, 0); 1528 1529 iov_iter_bvec(&iter, ITER_SOURCE, bvec, nseg, hdrlen + PAGE_SIZE); 1530 1531 return dump_write_iter(cprm, &iter, PAGE_SIZE); 1532 } 1533 1534 /* 1535 * If we might get machine checks from kernel accesses during the 1536 * core dump, let's get those errors early rather than during the 1537 * IO. This is not performance-critical enough to warrant having 1538 * all the machine check logic in the iovec paths. 1539 */ 1540 #ifdef copy_mc_to_kernel 1541 1542 #define dump_page_alloc() alloc_page(GFP_KERNEL) 1543 #define dump_page_free(x) __free_page(x) 1544 static struct page *dump_page_copy(struct page *src, struct page *dst) 1545 { 1546 void *buf = kmap_local_page(src); 1547 size_t left = copy_mc_to_kernel(page_address(dst), buf, PAGE_SIZE); 1548 kunmap_local(buf); 1549 return left ? NULL : dst; 1550 } 1551 1552 #else 1553 1554 /* We just want to return non-NULL; it's never used. */ 1555 #define dump_page_alloc() ERR_PTR(-EINVAL) 1556 #define dump_page_free(x) ((void)(x)) 1557 static inline struct page *dump_page_copy(struct page *src, struct page *dst) 1558 { 1559 return src; 1560 } 1561 #endif 1562 1563 bool dump_user_range(struct coredump_params *cprm, unsigned long start, 1564 unsigned long len) 1565 { 1566 unsigned long addr; 1567 struct page *dump_page; 1568 int locked; 1569 bool ret; 1570 1571 dump_page = dump_page_alloc(); 1572 if (!dump_page) 1573 return false; 1574 1575 ret = false; 1576 locked = 0; 1577 for (addr = start; addr < start + len; addr += PAGE_SIZE) { 1578 struct page *page; 1579 1580 if (!locked) { 1581 if (mmap_read_lock_killable(current->mm)) 1582 goto out; 1583 locked = 1; 1584 } 1585 1586 /* 1587 * To avoid having to allocate page tables for virtual address 1588 * ranges that have never been used yet, and also to make it 1589 * easy to generate sparse core files, use a helper that returns 1590 * NULL when encountering an empty page table entry that would 1591 * otherwise have been filled with the zero page. 1592 */ 1593 page = get_dump_page(addr, &locked); 1594 if (page) { 1595 if (locked) { 1596 mmap_read_unlock(current->mm); 1597 locked = 0; 1598 } 1599 bool stop = !dump_emit_page(cprm, dump_page_copy(page, dump_page)); 1600 put_page(page); 1601 if (stop) 1602 goto out; 1603 } else { 1604 dump_skip(cprm, PAGE_SIZE); 1605 } 1606 1607 if (dump_interrupted()) 1608 goto out; 1609 1610 if (!need_resched()) 1611 continue; 1612 if (locked) { 1613 mmap_read_unlock(current->mm); 1614 locked = 0; 1615 } 1616 cond_resched(); 1617 } 1618 ret = true; 1619 out: 1620 if (locked) 1621 mmap_read_unlock(current->mm); 1622 1623 dump_page_free(dump_page); 1624 return ret; 1625 } 1626 #endif 1627 1628 bool dump_align(struct coredump_params *cprm, int align) 1629 { 1630 unsigned mod = (cprm->pos + cprm->to_skip) & (align - 1); 1631 if (align & (align - 1)) 1632 return false; 1633 if (mod) 1634 cprm->to_skip += align - mod; 1635 return true; 1636 } 1637 EXPORT_SYMBOL(dump_align); 1638 1639 #ifdef CONFIG_SYSCTL 1640 1641 void validate_coredump_safety(void) 1642 { 1643 if (suid_dumpable == TASK_DUMPABLE_ROOT && 1644 core_pattern[0] != '/' && core_pattern[0] != '|' && core_pattern[0] != '@') { 1645 1646 coredump_report_failure("Unsafe core_pattern used with fs.suid_dumpable=2: " 1647 "pipe handler or fully qualified core dump path required. " 1648 "Set kernel.core_pattern before fs.suid_dumpable."); 1649 } 1650 } 1651 1652 static inline bool check_coredump_socket(const char *pattern) 1653 { 1654 const char *p; 1655 1656 if (pattern[0] != '@') 1657 return true; 1658 1659 /* 1660 * Coredump socket must be located in the initial mount 1661 * namespace. Don't give the impression that anything else is 1662 * supported right now. 1663 */ 1664 if (current->nsproxy->mnt_ns != init_task.nsproxy->mnt_ns) 1665 return false; 1666 1667 /* Must be an absolute path... */ 1668 if (pattern[1] != '/') { 1669 /* ... or the socket request protocol... */ 1670 if (pattern[1] != '@') 1671 return false; 1672 /* ... and if so must be an absolute path. */ 1673 if (pattern[2] != '/') 1674 return false; 1675 p = &pattern[2]; 1676 } else { 1677 p = &pattern[1]; 1678 } 1679 1680 /* The path obviously cannot exceed UNIX_PATH_MAX. */ 1681 if (strlen(p) >= UNIX_PATH_MAX) 1682 return false; 1683 1684 /* Must not contain ".." in the path. */ 1685 if (name_contains_dotdot(pattern)) 1686 return false; 1687 1688 return true; 1689 } 1690 1691 static int proc_dostring_coredump(const struct ctl_table *table, int write, 1692 void *buffer, size_t *lenp, loff_t *ppos) 1693 { 1694 char pattern[CORENAME_MAX_SIZE]; 1695 const struct ctl_table tmp = { 1696 .procname = table->procname, 1697 .data = pattern, 1698 .maxlen = sizeof(pattern), 1699 }; 1700 bool changed = false; 1701 int error; 1702 1703 /* Work on a copy, proc_dostring() appends at *ppos. */ 1704 scoped_guard(spinlock, &core_pattern_lock) 1705 strscpy(pattern, core_pattern); 1706 1707 error = proc_dostring(&tmp, write, buffer, lenp, ppos); 1708 if (error || !write) 1709 return error; 1710 1711 if (!check_coredump_socket(pattern)) 1712 return -EINVAL; 1713 1714 /* Publish the validated pattern whole. */ 1715 scoped_guard(spinlock, &core_pattern_lock) { 1716 changed = strncmp(pattern, core_pattern, CORENAME_MAX_SIZE); 1717 if (changed) 1718 strscpy(core_pattern, pattern); 1719 } 1720 if (changed) 1721 validate_coredump_safety(); 1722 return 0; 1723 } 1724 1725 static const unsigned int core_file_note_size_min = CORE_FILE_NOTE_SIZE_DEFAULT; 1726 static const unsigned int core_file_note_size_max = CORE_FILE_NOTE_SIZE_MAX; 1727 static char core_modes[] = { 1728 "file\npipe" 1729 #ifdef CONFIG_UNIX 1730 "\nsocket" 1731 #endif 1732 }; 1733 1734 static const struct ctl_table coredump_sysctls[] = { 1735 { 1736 .procname = "core_uses_pid", 1737 .data = &core_uses_pid, 1738 .maxlen = sizeof(int), 1739 .mode = 0644, 1740 .proc_handler = proc_dointvec, 1741 }, 1742 { 1743 .procname = "core_pattern", 1744 .data = core_pattern, 1745 .maxlen = CORENAME_MAX_SIZE, 1746 .mode = 0644, 1747 .proc_handler = proc_dostring_coredump, 1748 }, 1749 { 1750 .procname = "core_pipe_limit", 1751 .data = &core_pipe_limit, 1752 .maxlen = sizeof(unsigned int), 1753 .mode = 0644, 1754 .proc_handler = proc_dointvec_minmax, 1755 .extra1 = SYSCTL_ZERO, 1756 .extra2 = SYSCTL_INT_MAX, 1757 }, 1758 { 1759 .procname = "core_file_note_size_limit", 1760 .data = &core_file_note_size_limit, 1761 .maxlen = sizeof(unsigned int), 1762 .mode = 0644, 1763 .proc_handler = proc_douintvec_minmax, 1764 .extra1 = (unsigned int *)&core_file_note_size_min, 1765 .extra2 = (unsigned int *)&core_file_note_size_max, 1766 }, 1767 { 1768 .procname = "core_sort_vma", 1769 .data = &core_sort_vma, 1770 .maxlen = sizeof(int), 1771 .mode = 0644, 1772 .proc_handler = proc_douintvec_minmax, 1773 .extra1 = SYSCTL_ZERO, 1774 .extra2 = SYSCTL_ONE, 1775 }, 1776 { 1777 .procname = "core_modes", 1778 .data = core_modes, 1779 .maxlen = sizeof(core_modes) - 1, 1780 .mode = 0444, 1781 .proc_handler = proc_dostring, 1782 }, 1783 }; 1784 1785 static int __init init_fs_coredump_sysctls(void) 1786 { 1787 register_sysctl_init("kernel", coredump_sysctls); 1788 return 0; 1789 } 1790 fs_initcall(init_fs_coredump_sysctls); 1791 #endif /* CONFIG_SYSCTL */ 1792 1793 /* 1794 * The purpose of always_dump_vma() is to make sure that special kernel mappings 1795 * that are useful for post-mortem analysis are included in every core dump. 1796 * In that way we ensure that the core dump is fully interpretable later 1797 * without matching up the same kernel and hardware config to see what PC values 1798 * meant. These special mappings include - vDSO, vsyscall, and other 1799 * architecture specific mappings 1800 */ 1801 static bool always_dump_vma(struct vm_area_struct *vma) 1802 { 1803 /* Any vsyscall mappings? */ 1804 if (vma == get_gate_vma(vma->vm_mm)) 1805 return true; 1806 1807 /* 1808 * Assume that all vmas with a .name op should always be dumped. 1809 * If this changes, a new vm_ops field can easily be added. 1810 */ 1811 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 1812 return true; 1813 1814 /* 1815 * arch_vma_name() returns non-NULL for special architecture mappings, 1816 * such as vDSO sections. 1817 */ 1818 if (arch_vma_name(vma)) 1819 return true; 1820 1821 return false; 1822 } 1823 1824 #define DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER 1 1825 #define COREDUMP_MEMORY_TYPE_INCLUDE(types, type) \ 1826 ((types) & COREDUMP_MEMORY_##type) 1827 1828 /* 1829 * Decide how much of @vma's contents should be included in a core dump. 1830 */ 1831 static unsigned long vma_dump_size(struct vm_area_struct *vma, 1832 u64 memory_types) 1833 { 1834 /* always dump the vdso and vsyscall sections */ 1835 if (always_dump_vma(vma)) 1836 goto whole; 1837 1838 if (vma->vm_flags & VM_DONTDUMP) 1839 return 0; 1840 1841 /* support for DAX */ 1842 if (vma_is_dax(vma)) { 1843 if ((vma->vm_flags & VM_SHARED) && 1844 COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, DAX_SHARED)) 1845 goto whole; 1846 if (!(vma->vm_flags & VM_SHARED) && 1847 COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, DAX_PRIVATE)) 1848 goto whole; 1849 return 0; 1850 } 1851 1852 /* Hugetlb memory check */ 1853 if (is_vm_hugetlb_page(vma)) { 1854 if ((vma->vm_flags & VM_SHARED) && 1855 COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, HUGETLB_SHARED)) 1856 goto whole; 1857 if (!(vma->vm_flags & VM_SHARED) && 1858 COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, HUGETLB_PRIVATE)) 1859 goto whole; 1860 return 0; 1861 } 1862 1863 /* Do not dump I/O mapped devices or special mappings */ 1864 if (vma->vm_flags & VM_IO) 1865 return 0; 1866 1867 /* By default, dump shared memory if mapped from an anonymous file. */ 1868 if (vma->vm_flags & VM_SHARED) { 1869 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1870 COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, ANON_SHARED) : 1871 COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, FILE_SHARED)) 1872 goto whole; 1873 return 0; 1874 } 1875 1876 /* Dump segments that have been written to. */ 1877 if ((!IS_ENABLED(CONFIG_MMU) || vma->anon_vma) && 1878 COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, ANON_PRIVATE)) 1879 goto whole; 1880 if (vma->vm_file == NULL) 1881 return 0; 1882 1883 if (COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, FILE_PRIVATE)) 1884 goto whole; 1885 1886 /* 1887 * If this is the beginning of an executable file mapping, 1888 * dump the first page to aid in determining what was mapped here. 1889 */ 1890 if (COREDUMP_MEMORY_TYPE_INCLUDE(memory_types, ELF_HEADERS) && 1891 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1892 if ((READ_ONCE(file_inode(vma->vm_file)->i_mode) & 0111) != 0) 1893 return PAGE_SIZE; 1894 1895 /* 1896 * ELF libraries aren't always executable. 1897 * We'll want to check whether the mapping starts with the ELF 1898 * magic, but not now - we're holding the mmap lock, 1899 * so copy_from_user() doesn't work here. 1900 * Use a placeholder instead, and fix it up later in 1901 * dump_vma_snapshot(). 1902 */ 1903 return DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER; 1904 } 1905 1906 return 0; 1907 1908 whole: 1909 return vma->vm_end - vma->vm_start; 1910 } 1911 1912 /* 1913 * Helper function for iterating across a vma list. It ensures that the caller 1914 * will visit `gate_vma' prior to terminating the search. 1915 */ 1916 static struct vm_area_struct *coredump_next_vma(struct vma_iterator *vmi, 1917 struct vm_area_struct *vma, 1918 struct vm_area_struct *gate_vma) 1919 { 1920 if (gate_vma && (vma == gate_vma)) 1921 return NULL; 1922 1923 vma = vma_next(vmi); 1924 if (vma) 1925 return vma; 1926 return gate_vma; 1927 } 1928 1929 static void free_vma_snapshot(struct coredump_params *cprm) 1930 { 1931 if (cprm->vma_meta) { 1932 int i; 1933 for (i = 0; i < cprm->vma_count; i++) { 1934 struct file *file = cprm->vma_meta[i].file; 1935 if (file) 1936 fput(file); 1937 } 1938 kvfree(cprm->vma_meta); 1939 cprm->vma_meta = NULL; 1940 } 1941 } 1942 1943 static int cmp_vma_size(const void *vma_meta_lhs_ptr, const void *vma_meta_rhs_ptr) 1944 { 1945 const struct core_vma_metadata *vma_meta_lhs = vma_meta_lhs_ptr; 1946 const struct core_vma_metadata *vma_meta_rhs = vma_meta_rhs_ptr; 1947 1948 if (vma_meta_lhs->dump_size < vma_meta_rhs->dump_size) 1949 return -1; 1950 if (vma_meta_lhs->dump_size > vma_meta_rhs->dump_size) 1951 return 1; 1952 return 0; 1953 } 1954 1955 /* 1956 * Under the mmap_lock, take a snapshot of relevant information about the task's 1957 * VMAs. 1958 */ 1959 static bool dump_vma_snapshot(struct coredump_params *cprm) 1960 { 1961 struct vm_area_struct *gate_vma, *vma = NULL; 1962 struct mm_struct *mm = current->mm; 1963 VMA_ITERATOR(vmi, mm, 0); 1964 int i = 0; 1965 1966 /* 1967 * Once the stack expansion code is fixed to not change VMA bounds 1968 * under mmap_lock in read mode, this can be changed to take the 1969 * mmap_lock in read mode. 1970 */ 1971 if (mmap_write_lock_killable(mm)) 1972 return false; 1973 1974 cprm->vma_data_size = 0; 1975 gate_vma = get_gate_vma(mm); 1976 cprm->vma_count = mm->map_count + (gate_vma ? 1 : 0); 1977 1978 cprm->vma_meta = kvmalloc_objs(*cprm->vma_meta, cprm->vma_count); 1979 if (!cprm->vma_meta) { 1980 mmap_write_unlock(mm); 1981 return false; 1982 } 1983 1984 while ((vma = coredump_next_vma(&vmi, vma, gate_vma)) != NULL) { 1985 struct core_vma_metadata *m = cprm->vma_meta + i; 1986 1987 m->start = vma->vm_start; 1988 m->end = vma->vm_end; 1989 m->flags = vma->vm_flags; 1990 m->dump_size = vma_dump_size(vma, cprm->memory_types); 1991 m->pgoff = vma->vm_pgoff; 1992 m->file = vma->vm_file; 1993 if (m->file) 1994 get_file(m->file); 1995 i++; 1996 } 1997 1998 mmap_write_unlock(mm); 1999 2000 for (i = 0; i < cprm->vma_count; i++) { 2001 struct core_vma_metadata *m = cprm->vma_meta + i; 2002 2003 if (m->dump_size == DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER) { 2004 char elfmag[SELFMAG]; 2005 2006 if (copy_from_user(elfmag, (void __user *)m->start, SELFMAG) || 2007 memcmp(elfmag, ELFMAG, SELFMAG) != 0) { 2008 m->dump_size = 0; 2009 } else { 2010 m->dump_size = PAGE_SIZE; 2011 } 2012 } 2013 2014 cprm->vma_data_size += m->dump_size; 2015 } 2016 2017 if (core_sort_vma) 2018 sort(cprm->vma_meta, cprm->vma_count, sizeof(*cprm->vma_meta), 2019 cmp_vma_size, NULL); 2020 2021 return true; 2022 } 2023