1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/slab.h> 3 #include <linux/file.h> 4 #include <linux/fdtable.h> 5 #include <linux/freezer.h> 6 #include <linux/mm.h> 7 #include <linux/stat.h> 8 #include <linux/fcntl.h> 9 #include <linux/swap.h> 10 #include <linux/ctype.h> 11 #include <linux/string.h> 12 #include <linux/init.h> 13 #include <linux/pagemap.h> 14 #include <linux/perf_event.h> 15 #include <linux/highmem.h> 16 #include <linux/spinlock.h> 17 #include <linux/key.h> 18 #include <linux/personality.h> 19 #include <linux/binfmts.h> 20 #include <linux/coredump.h> 21 #include <linux/sort.h> 22 #include <linux/sched/coredump.h> 23 #include <linux/sched/signal.h> 24 #include <linux/sched/task_stack.h> 25 #include <linux/utsname.h> 26 #include <linux/pid_namespace.h> 27 #include <linux/module.h> 28 #include <linux/namei.h> 29 #include <linux/mount.h> 30 #include <linux/security.h> 31 #include <linux/syscalls.h> 32 #include <linux/tsacct_kern.h> 33 #include <linux/cn_proc.h> 34 #include <linux/audit.h> 35 #include <linux/kmod.h> 36 #include <linux/fsnotify.h> 37 #include <linux/fs_struct.h> 38 #include <linux/pipe_fs_i.h> 39 #include <linux/oom.h> 40 #include <linux/compat.h> 41 #include <linux/fs.h> 42 #include <linux/path.h> 43 #include <linux/timekeeping.h> 44 #include <linux/sysctl.h> 45 #include <linux/elf.h> 46 47 #include <linux/uaccess.h> 48 #include <asm/mmu_context.h> 49 #include <asm/tlb.h> 50 #include <asm/exec.h> 51 52 #include <trace/events/task.h> 53 #include "internal.h" 54 55 #include <trace/events/sched.h> 56 57 static bool dump_vma_snapshot(struct coredump_params *cprm); 58 static void free_vma_snapshot(struct coredump_params *cprm); 59 60 #define CORE_FILE_NOTE_SIZE_DEFAULT (4*1024*1024) 61 /* Define a reasonable max cap */ 62 #define CORE_FILE_NOTE_SIZE_MAX (16*1024*1024) 63 64 static int core_uses_pid; 65 static unsigned int core_pipe_limit; 66 static char core_pattern[CORENAME_MAX_SIZE] = "core"; 67 static int core_name_size = CORENAME_MAX_SIZE; 68 unsigned int core_file_note_size_limit = CORE_FILE_NOTE_SIZE_DEFAULT; 69 70 struct core_name { 71 char *corename; 72 int used, size; 73 }; 74 75 static int expand_corename(struct core_name *cn, int size) 76 { 77 char *corename; 78 79 size = kmalloc_size_roundup(size); 80 corename = krealloc(cn->corename, size, GFP_KERNEL); 81 82 if (!corename) 83 return -ENOMEM; 84 85 if (size > core_name_size) /* racy but harmless */ 86 core_name_size = size; 87 88 cn->size = size; 89 cn->corename = corename; 90 return 0; 91 } 92 93 static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt, 94 va_list arg) 95 { 96 int free, need; 97 va_list arg_copy; 98 99 again: 100 free = cn->size - cn->used; 101 102 va_copy(arg_copy, arg); 103 need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy); 104 va_end(arg_copy); 105 106 if (need < free) { 107 cn->used += need; 108 return 0; 109 } 110 111 if (!expand_corename(cn, cn->size + need - free + 1)) 112 goto again; 113 114 return -ENOMEM; 115 } 116 117 static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...) 118 { 119 va_list arg; 120 int ret; 121 122 va_start(arg, fmt); 123 ret = cn_vprintf(cn, fmt, arg); 124 va_end(arg); 125 126 return ret; 127 } 128 129 static __printf(2, 3) 130 int cn_esc_printf(struct core_name *cn, const char *fmt, ...) 131 { 132 int cur = cn->used; 133 va_list arg; 134 int ret; 135 136 va_start(arg, fmt); 137 ret = cn_vprintf(cn, fmt, arg); 138 va_end(arg); 139 140 if (ret == 0) { 141 /* 142 * Ensure that this coredump name component can't cause the 143 * resulting corefile path to consist of a ".." or ".". 144 */ 145 if ((cn->used - cur == 1 && cn->corename[cur] == '.') || 146 (cn->used - cur == 2 && cn->corename[cur] == '.' 147 && cn->corename[cur+1] == '.')) 148 cn->corename[cur] = '!'; 149 150 /* 151 * Empty names are fishy and could be used to create a "//" in a 152 * corefile name, causing the coredump to happen one directory 153 * level too high. Enforce that all components of the core 154 * pattern are at least one character long. 155 */ 156 if (cn->used == cur) 157 ret = cn_printf(cn, "!"); 158 } 159 160 for (; cur < cn->used; ++cur) { 161 if (cn->corename[cur] == '/') 162 cn->corename[cur] = '!'; 163 } 164 return ret; 165 } 166 167 static int cn_print_exe_file(struct core_name *cn, bool name_only) 168 { 169 struct file *exe_file; 170 char *pathbuf, *path, *ptr; 171 int ret; 172 173 exe_file = get_mm_exe_file(current->mm); 174 if (!exe_file) 175 return cn_esc_printf(cn, "%s (path unknown)", current->comm); 176 177 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL); 178 if (!pathbuf) { 179 ret = -ENOMEM; 180 goto put_exe_file; 181 } 182 183 path = file_path(exe_file, pathbuf, PATH_MAX); 184 if (IS_ERR(path)) { 185 ret = PTR_ERR(path); 186 goto free_buf; 187 } 188 189 if (name_only) { 190 ptr = strrchr(path, '/'); 191 if (ptr) 192 path = ptr + 1; 193 } 194 ret = cn_esc_printf(cn, "%s", path); 195 196 free_buf: 197 kfree(pathbuf); 198 put_exe_file: 199 fput(exe_file); 200 return ret; 201 } 202 203 /* format_corename will inspect the pattern parameter, and output a 204 * name into corename, which must have space for at least 205 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator. 206 */ 207 static int format_corename(struct core_name *cn, struct coredump_params *cprm, 208 size_t **argv, int *argc) 209 { 210 const struct cred *cred = current_cred(); 211 const char *pat_ptr = core_pattern; 212 int ispipe = (*pat_ptr == '|'); 213 bool was_space = false; 214 int pid_in_pattern = 0; 215 int err = 0; 216 217 cn->used = 0; 218 cn->corename = NULL; 219 if (expand_corename(cn, core_name_size)) 220 return -ENOMEM; 221 cn->corename[0] = '\0'; 222 223 if (ispipe) { 224 int argvs = sizeof(core_pattern) / 2; 225 (*argv) = kmalloc_array(argvs, sizeof(**argv), GFP_KERNEL); 226 if (!(*argv)) 227 return -ENOMEM; 228 (*argv)[(*argc)++] = 0; 229 ++pat_ptr; 230 if (!(*pat_ptr)) 231 return -ENOMEM; 232 } 233 234 /* Repeat as long as we have more pattern to process and more output 235 space */ 236 while (*pat_ptr) { 237 /* 238 * Split on spaces before doing template expansion so that 239 * %e and %E don't get split if they have spaces in them 240 */ 241 if (ispipe) { 242 if (isspace(*pat_ptr)) { 243 if (cn->used != 0) 244 was_space = true; 245 pat_ptr++; 246 continue; 247 } else if (was_space) { 248 was_space = false; 249 err = cn_printf(cn, "%c", '\0'); 250 if (err) 251 return err; 252 (*argv)[(*argc)++] = cn->used; 253 } 254 } 255 if (*pat_ptr != '%') { 256 err = cn_printf(cn, "%c", *pat_ptr++); 257 } else { 258 switch (*++pat_ptr) { 259 /* single % at the end, drop that */ 260 case 0: 261 goto out; 262 /* Double percent, output one percent */ 263 case '%': 264 err = cn_printf(cn, "%c", '%'); 265 break; 266 /* pid */ 267 case 'p': 268 pid_in_pattern = 1; 269 err = cn_printf(cn, "%d", 270 task_tgid_vnr(current)); 271 break; 272 /* global pid */ 273 case 'P': 274 err = cn_printf(cn, "%d", 275 task_tgid_nr(current)); 276 break; 277 case 'i': 278 err = cn_printf(cn, "%d", 279 task_pid_vnr(current)); 280 break; 281 case 'I': 282 err = cn_printf(cn, "%d", 283 task_pid_nr(current)); 284 break; 285 /* uid */ 286 case 'u': 287 err = cn_printf(cn, "%u", 288 from_kuid(&init_user_ns, 289 cred->uid)); 290 break; 291 /* gid */ 292 case 'g': 293 err = cn_printf(cn, "%u", 294 from_kgid(&init_user_ns, 295 cred->gid)); 296 break; 297 case 'd': 298 err = cn_printf(cn, "%d", 299 __get_dumpable(cprm->mm_flags)); 300 break; 301 /* signal that caused the coredump */ 302 case 's': 303 err = cn_printf(cn, "%d", 304 cprm->siginfo->si_signo); 305 break; 306 /* UNIX time of coredump */ 307 case 't': { 308 time64_t time; 309 310 time = ktime_get_real_seconds(); 311 err = cn_printf(cn, "%lld", time); 312 break; 313 } 314 /* hostname */ 315 case 'h': 316 down_read(&uts_sem); 317 err = cn_esc_printf(cn, "%s", 318 utsname()->nodename); 319 up_read(&uts_sem); 320 break; 321 /* executable, could be changed by prctl PR_SET_NAME etc */ 322 case 'e': 323 err = cn_esc_printf(cn, "%s", current->comm); 324 break; 325 /* file name of executable */ 326 case 'f': 327 err = cn_print_exe_file(cn, true); 328 break; 329 case 'E': 330 err = cn_print_exe_file(cn, false); 331 break; 332 /* core limit size */ 333 case 'c': 334 err = cn_printf(cn, "%lu", 335 rlimit(RLIMIT_CORE)); 336 break; 337 /* CPU the task ran on */ 338 case 'C': 339 err = cn_printf(cn, "%d", cprm->cpu); 340 break; 341 default: 342 break; 343 } 344 ++pat_ptr; 345 } 346 347 if (err) 348 return err; 349 } 350 351 out: 352 /* Backward compatibility with core_uses_pid: 353 * 354 * If core_pattern does not include a %p (as is the default) 355 * and core_uses_pid is set, then .%pid will be appended to 356 * the filename. Do not do this for piped commands. */ 357 if (!ispipe && !pid_in_pattern && core_uses_pid) { 358 err = cn_printf(cn, ".%d", task_tgid_vnr(current)); 359 if (err) 360 return err; 361 } 362 return ispipe; 363 } 364 365 static int zap_process(struct signal_struct *signal, int exit_code) 366 { 367 struct task_struct *t; 368 int nr = 0; 369 370 signal->flags = SIGNAL_GROUP_EXIT; 371 signal->group_exit_code = exit_code; 372 signal->group_stop_count = 0; 373 374 __for_each_thread(signal, t) { 375 task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK); 376 if (t != current && !(t->flags & PF_POSTCOREDUMP)) { 377 sigaddset(&t->pending.signal, SIGKILL); 378 signal_wake_up(t, 1); 379 nr++; 380 } 381 } 382 383 return nr; 384 } 385 386 static int zap_threads(struct task_struct *tsk, 387 struct core_state *core_state, int exit_code) 388 { 389 struct signal_struct *signal = tsk->signal; 390 int nr = -EAGAIN; 391 392 spin_lock_irq(&tsk->sighand->siglock); 393 if (!(signal->flags & SIGNAL_GROUP_EXIT) && !signal->group_exec_task) { 394 /* Allow SIGKILL, see prepare_signal() */ 395 signal->core_state = core_state; 396 nr = zap_process(signal, exit_code); 397 clear_tsk_thread_flag(tsk, TIF_SIGPENDING); 398 tsk->flags |= PF_DUMPCORE; 399 atomic_set(&core_state->nr_threads, nr); 400 } 401 spin_unlock_irq(&tsk->sighand->siglock); 402 return nr; 403 } 404 405 static int coredump_wait(int exit_code, struct core_state *core_state) 406 { 407 struct task_struct *tsk = current; 408 int core_waiters = -EBUSY; 409 410 init_completion(&core_state->startup); 411 core_state->dumper.task = tsk; 412 core_state->dumper.next = NULL; 413 414 core_waiters = zap_threads(tsk, core_state, exit_code); 415 if (core_waiters > 0) { 416 struct core_thread *ptr; 417 418 wait_for_completion_state(&core_state->startup, 419 TASK_UNINTERRUPTIBLE|TASK_FREEZABLE); 420 /* 421 * Wait for all the threads to become inactive, so that 422 * all the thread context (extended register state, like 423 * fpu etc) gets copied to the memory. 424 */ 425 ptr = core_state->dumper.next; 426 while (ptr != NULL) { 427 wait_task_inactive(ptr->task, TASK_ANY); 428 ptr = ptr->next; 429 } 430 } 431 432 return core_waiters; 433 } 434 435 static void coredump_finish(bool core_dumped) 436 { 437 struct core_thread *curr, *next; 438 struct task_struct *task; 439 440 spin_lock_irq(¤t->sighand->siglock); 441 if (core_dumped && !__fatal_signal_pending(current)) 442 current->signal->group_exit_code |= 0x80; 443 next = current->signal->core_state->dumper.next; 444 current->signal->core_state = NULL; 445 spin_unlock_irq(¤t->sighand->siglock); 446 447 while ((curr = next) != NULL) { 448 next = curr->next; 449 task = curr->task; 450 /* 451 * see coredump_task_exit(), curr->task must not see 452 * ->task == NULL before we read ->next. 453 */ 454 smp_mb(); 455 curr->task = NULL; 456 wake_up_process(task); 457 } 458 } 459 460 static bool dump_interrupted(void) 461 { 462 /* 463 * SIGKILL or freezing() interrupt the coredumping. Perhaps we 464 * can do try_to_freeze() and check __fatal_signal_pending(), 465 * but then we need to teach dump_write() to restart and clear 466 * TIF_SIGPENDING. 467 */ 468 return fatal_signal_pending(current) || freezing(current); 469 } 470 471 static void wait_for_dump_helpers(struct file *file) 472 { 473 struct pipe_inode_info *pipe = file->private_data; 474 475 pipe_lock(pipe); 476 pipe->readers++; 477 pipe->writers--; 478 wake_up_interruptible_sync(&pipe->rd_wait); 479 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); 480 pipe_unlock(pipe); 481 482 /* 483 * We actually want wait_event_freezable() but then we need 484 * to clear TIF_SIGPENDING and improve dump_interrupted(). 485 */ 486 wait_event_interruptible(pipe->rd_wait, pipe->readers == 1); 487 488 pipe_lock(pipe); 489 pipe->readers--; 490 pipe->writers++; 491 pipe_unlock(pipe); 492 } 493 494 /* 495 * umh_pipe_setup 496 * helper function to customize the process used 497 * to collect the core in userspace. Specifically 498 * it sets up a pipe and installs it as fd 0 (stdin) 499 * for the process. Returns 0 on success, or 500 * PTR_ERR on failure. 501 * Note that it also sets the core limit to 1. This 502 * is a special value that we use to trap recursive 503 * core dumps 504 */ 505 static int umh_pipe_setup(struct subprocess_info *info, struct cred *new) 506 { 507 struct file *files[2]; 508 struct coredump_params *cp = (struct coredump_params *)info->data; 509 int err = create_pipe_files(files, 0); 510 if (err) 511 return err; 512 513 cp->file = files[1]; 514 515 err = replace_fd(0, files[0], 0); 516 fput(files[0]); 517 /* and disallow core files too */ 518 current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1}; 519 520 return err; 521 } 522 523 void do_coredump(const kernel_siginfo_t *siginfo) 524 { 525 struct core_state core_state; 526 struct core_name cn; 527 struct mm_struct *mm = current->mm; 528 struct linux_binfmt * binfmt; 529 const struct cred *old_cred; 530 struct cred *cred; 531 int retval = 0; 532 int ispipe; 533 size_t *argv = NULL; 534 int argc = 0; 535 /* require nonrelative corefile path and be extra careful */ 536 bool need_suid_safe = false; 537 bool core_dumped = false; 538 static atomic_t core_dump_count = ATOMIC_INIT(0); 539 struct coredump_params cprm = { 540 .siginfo = siginfo, 541 .limit = rlimit(RLIMIT_CORE), 542 /* 543 * We must use the same mm->flags while dumping core to avoid 544 * inconsistency of bit flags, since this flag is not protected 545 * by any locks. 546 */ 547 .mm_flags = mm->flags, 548 .vma_meta = NULL, 549 .cpu = raw_smp_processor_id(), 550 }; 551 552 audit_core_dumps(siginfo->si_signo); 553 554 binfmt = mm->binfmt; 555 if (!binfmt || !binfmt->core_dump) 556 goto fail; 557 if (!__get_dumpable(cprm.mm_flags)) 558 goto fail; 559 560 cred = prepare_creds(); 561 if (!cred) 562 goto fail; 563 /* 564 * We cannot trust fsuid as being the "true" uid of the process 565 * nor do we know its entire history. We only know it was tainted 566 * so we dump it as root in mode 2, and only into a controlled 567 * environment (pipe handler or fully qualified path). 568 */ 569 if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) { 570 /* Setuid core dump mode */ 571 cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */ 572 need_suid_safe = true; 573 } 574 575 retval = coredump_wait(siginfo->si_signo, &core_state); 576 if (retval < 0) 577 goto fail_creds; 578 579 old_cred = override_creds(cred); 580 581 ispipe = format_corename(&cn, &cprm, &argv, &argc); 582 583 if (ispipe) { 584 int argi; 585 int dump_count; 586 char **helper_argv; 587 struct subprocess_info *sub_info; 588 589 if (ispipe < 0) { 590 coredump_report_failure("format_corename failed, aborting core"); 591 goto fail_unlock; 592 } 593 594 if (cprm.limit == 1) { 595 /* See umh_pipe_setup() which sets RLIMIT_CORE = 1. 596 * 597 * Normally core limits are irrelevant to pipes, since 598 * we're not writing to the file system, but we use 599 * cprm.limit of 1 here as a special value, this is a 600 * consistent way to catch recursive crashes. 601 * We can still crash if the core_pattern binary sets 602 * RLIM_CORE = !1, but it runs as root, and can do 603 * lots of stupid things. 604 * 605 * Note that we use task_tgid_vnr here to grab the pid 606 * of the process group leader. That way we get the 607 * right pid if a thread in a multi-threaded 608 * core_pattern process dies. 609 */ 610 coredump_report_failure("RLIMIT_CORE is set to 1, aborting core"); 611 goto fail_unlock; 612 } 613 cprm.limit = RLIM_INFINITY; 614 615 dump_count = atomic_inc_return(&core_dump_count); 616 if (core_pipe_limit && (core_pipe_limit < dump_count)) { 617 coredump_report_failure("over core_pipe_limit, skipping core dump"); 618 goto fail_dropcount; 619 } 620 621 helper_argv = kmalloc_array(argc + 1, sizeof(*helper_argv), 622 GFP_KERNEL); 623 if (!helper_argv) { 624 coredump_report_failure("%s failed to allocate memory", __func__); 625 goto fail_dropcount; 626 } 627 for (argi = 0; argi < argc; argi++) 628 helper_argv[argi] = cn.corename + argv[argi]; 629 helper_argv[argi] = NULL; 630 631 retval = -ENOMEM; 632 sub_info = call_usermodehelper_setup(helper_argv[0], 633 helper_argv, NULL, GFP_KERNEL, 634 umh_pipe_setup, NULL, &cprm); 635 if (sub_info) 636 retval = call_usermodehelper_exec(sub_info, 637 UMH_WAIT_EXEC); 638 639 kfree(helper_argv); 640 if (retval) { 641 coredump_report_failure("|%s pipe failed", cn.corename); 642 goto close_fail; 643 } 644 } else { 645 struct mnt_idmap *idmap; 646 struct inode *inode; 647 int open_flags = O_CREAT | O_WRONLY | O_NOFOLLOW | 648 O_LARGEFILE | O_EXCL; 649 650 if (cprm.limit < binfmt->min_coredump) 651 goto fail_unlock; 652 653 if (need_suid_safe && cn.corename[0] != '/') { 654 coredump_report_failure( 655 "this process can only dump core to a fully qualified path, skipping core dump"); 656 goto fail_unlock; 657 } 658 659 /* 660 * Unlink the file if it exists unless this is a SUID 661 * binary - in that case, we're running around with root 662 * privs and don't want to unlink another user's coredump. 663 */ 664 if (!need_suid_safe) { 665 /* 666 * If it doesn't exist, that's fine. If there's some 667 * other problem, we'll catch it at the filp_open(). 668 */ 669 do_unlinkat(AT_FDCWD, getname_kernel(cn.corename)); 670 } 671 672 /* 673 * There is a race between unlinking and creating the 674 * file, but if that causes an EEXIST here, that's 675 * fine - another process raced with us while creating 676 * the corefile, and the other process won. To userspace, 677 * what matters is that at least one of the two processes 678 * writes its coredump successfully, not which one. 679 */ 680 if (need_suid_safe) { 681 /* 682 * Using user namespaces, normal user tasks can change 683 * their current->fs->root to point to arbitrary 684 * directories. Since the intention of the "only dump 685 * with a fully qualified path" rule is to control where 686 * coredumps may be placed using root privileges, 687 * current->fs->root must not be used. Instead, use the 688 * root directory of init_task. 689 */ 690 struct path root; 691 692 task_lock(&init_task); 693 get_fs_root(init_task.fs, &root); 694 task_unlock(&init_task); 695 cprm.file = file_open_root(&root, cn.corename, 696 open_flags, 0600); 697 path_put(&root); 698 } else { 699 cprm.file = filp_open(cn.corename, open_flags, 0600); 700 } 701 if (IS_ERR(cprm.file)) 702 goto fail_unlock; 703 704 inode = file_inode(cprm.file); 705 if (inode->i_nlink > 1) 706 goto close_fail; 707 if (d_unhashed(cprm.file->f_path.dentry)) 708 goto close_fail; 709 /* 710 * AK: actually i see no reason to not allow this for named 711 * pipes etc, but keep the previous behaviour for now. 712 */ 713 if (!S_ISREG(inode->i_mode)) 714 goto close_fail; 715 /* 716 * Don't dump core if the filesystem changed owner or mode 717 * of the file during file creation. This is an issue when 718 * a process dumps core while its cwd is e.g. on a vfat 719 * filesystem. 720 */ 721 idmap = file_mnt_idmap(cprm.file); 722 if (!vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), 723 current_fsuid())) { 724 coredump_report_failure("Core dump to %s aborted: " 725 "cannot preserve file owner", cn.corename); 726 goto close_fail; 727 } 728 if ((inode->i_mode & 0677) != 0600) { 729 coredump_report_failure("Core dump to %s aborted: " 730 "cannot preserve file permissions", cn.corename); 731 goto close_fail; 732 } 733 if (!(cprm.file->f_mode & FMODE_CAN_WRITE)) 734 goto close_fail; 735 if (do_truncate(idmap, cprm.file->f_path.dentry, 736 0, 0, cprm.file)) 737 goto close_fail; 738 } 739 740 /* get us an unshared descriptor table; almost always a no-op */ 741 /* The cell spufs coredump code reads the file descriptor tables */ 742 retval = unshare_files(); 743 if (retval) 744 goto close_fail; 745 if (!dump_interrupted()) { 746 /* 747 * umh disabled with CONFIG_STATIC_USERMODEHELPER_PATH="" would 748 * have this set to NULL. 749 */ 750 if (!cprm.file) { 751 coredump_report_failure("Core dump to |%s disabled", cn.corename); 752 goto close_fail; 753 } 754 if (!dump_vma_snapshot(&cprm)) 755 goto close_fail; 756 757 file_start_write(cprm.file); 758 core_dumped = binfmt->core_dump(&cprm); 759 /* 760 * Ensures that file size is big enough to contain the current 761 * file postion. This prevents gdb from complaining about 762 * a truncated file if the last "write" to the file was 763 * dump_skip. 764 */ 765 if (cprm.to_skip) { 766 cprm.to_skip--; 767 dump_emit(&cprm, "", 1); 768 } 769 file_end_write(cprm.file); 770 free_vma_snapshot(&cprm); 771 } 772 if (ispipe && core_pipe_limit) 773 wait_for_dump_helpers(cprm.file); 774 close_fail: 775 if (cprm.file) 776 filp_close(cprm.file, NULL); 777 fail_dropcount: 778 if (ispipe) 779 atomic_dec(&core_dump_count); 780 fail_unlock: 781 kfree(argv); 782 kfree(cn.corename); 783 coredump_finish(core_dumped); 784 revert_creds(old_cred); 785 fail_creds: 786 put_cred(cred); 787 fail: 788 return; 789 } 790 791 /* 792 * Core dumping helper functions. These are the only things you should 793 * do on a core-file: use only these functions to write out all the 794 * necessary info. 795 */ 796 static int __dump_emit(struct coredump_params *cprm, const void *addr, int nr) 797 { 798 struct file *file = cprm->file; 799 loff_t pos = file->f_pos; 800 ssize_t n; 801 if (cprm->written + nr > cprm->limit) 802 return 0; 803 804 805 if (dump_interrupted()) 806 return 0; 807 n = __kernel_write(file, addr, nr, &pos); 808 if (n != nr) 809 return 0; 810 file->f_pos = pos; 811 cprm->written += n; 812 cprm->pos += n; 813 814 return 1; 815 } 816 817 static int __dump_skip(struct coredump_params *cprm, size_t nr) 818 { 819 static char zeroes[PAGE_SIZE]; 820 struct file *file = cprm->file; 821 if (file->f_mode & FMODE_LSEEK) { 822 if (dump_interrupted() || 823 vfs_llseek(file, nr, SEEK_CUR) < 0) 824 return 0; 825 cprm->pos += nr; 826 return 1; 827 } else { 828 while (nr > PAGE_SIZE) { 829 if (!__dump_emit(cprm, zeroes, PAGE_SIZE)) 830 return 0; 831 nr -= PAGE_SIZE; 832 } 833 return __dump_emit(cprm, zeroes, nr); 834 } 835 } 836 837 int dump_emit(struct coredump_params *cprm, const void *addr, int nr) 838 { 839 if (cprm->to_skip) { 840 if (!__dump_skip(cprm, cprm->to_skip)) 841 return 0; 842 cprm->to_skip = 0; 843 } 844 return __dump_emit(cprm, addr, nr); 845 } 846 EXPORT_SYMBOL(dump_emit); 847 848 void dump_skip_to(struct coredump_params *cprm, unsigned long pos) 849 { 850 cprm->to_skip = pos - cprm->pos; 851 } 852 EXPORT_SYMBOL(dump_skip_to); 853 854 void dump_skip(struct coredump_params *cprm, size_t nr) 855 { 856 cprm->to_skip += nr; 857 } 858 EXPORT_SYMBOL(dump_skip); 859 860 #ifdef CONFIG_ELF_CORE 861 static int dump_emit_page(struct coredump_params *cprm, struct page *page) 862 { 863 struct bio_vec bvec; 864 struct iov_iter iter; 865 struct file *file = cprm->file; 866 loff_t pos; 867 ssize_t n; 868 869 if (!page) 870 return 0; 871 872 if (cprm->to_skip) { 873 if (!__dump_skip(cprm, cprm->to_skip)) 874 return 0; 875 cprm->to_skip = 0; 876 } 877 if (cprm->written + PAGE_SIZE > cprm->limit) 878 return 0; 879 if (dump_interrupted()) 880 return 0; 881 pos = file->f_pos; 882 bvec_set_page(&bvec, page, PAGE_SIZE, 0); 883 iov_iter_bvec(&iter, ITER_SOURCE, &bvec, 1, PAGE_SIZE); 884 n = __kernel_write_iter(cprm->file, &iter, &pos); 885 if (n != PAGE_SIZE) 886 return 0; 887 file->f_pos = pos; 888 cprm->written += PAGE_SIZE; 889 cprm->pos += PAGE_SIZE; 890 891 return 1; 892 } 893 894 /* 895 * If we might get machine checks from kernel accesses during the 896 * core dump, let's get those errors early rather than during the 897 * IO. This is not performance-critical enough to warrant having 898 * all the machine check logic in the iovec paths. 899 */ 900 #ifdef copy_mc_to_kernel 901 902 #define dump_page_alloc() alloc_page(GFP_KERNEL) 903 #define dump_page_free(x) __free_page(x) 904 static struct page *dump_page_copy(struct page *src, struct page *dst) 905 { 906 void *buf = kmap_local_page(src); 907 size_t left = copy_mc_to_kernel(page_address(dst), buf, PAGE_SIZE); 908 kunmap_local(buf); 909 return left ? NULL : dst; 910 } 911 912 #else 913 914 /* We just want to return non-NULL; it's never used. */ 915 #define dump_page_alloc() ERR_PTR(-EINVAL) 916 #define dump_page_free(x) ((void)(x)) 917 static inline struct page *dump_page_copy(struct page *src, struct page *dst) 918 { 919 return src; 920 } 921 #endif 922 923 int dump_user_range(struct coredump_params *cprm, unsigned long start, 924 unsigned long len) 925 { 926 unsigned long addr; 927 struct page *dump_page; 928 929 dump_page = dump_page_alloc(); 930 if (!dump_page) 931 return 0; 932 933 for (addr = start; addr < start + len; addr += PAGE_SIZE) { 934 struct page *page; 935 936 /* 937 * To avoid having to allocate page tables for virtual address 938 * ranges that have never been used yet, and also to make it 939 * easy to generate sparse core files, use a helper that returns 940 * NULL when encountering an empty page table entry that would 941 * otherwise have been filled with the zero page. 942 */ 943 page = get_dump_page(addr); 944 if (page) { 945 int stop = !dump_emit_page(cprm, dump_page_copy(page, dump_page)); 946 put_page(page); 947 if (stop) { 948 dump_page_free(dump_page); 949 return 0; 950 } 951 } else { 952 dump_skip(cprm, PAGE_SIZE); 953 } 954 } 955 dump_page_free(dump_page); 956 return 1; 957 } 958 #endif 959 960 int dump_align(struct coredump_params *cprm, int align) 961 { 962 unsigned mod = (cprm->pos + cprm->to_skip) & (align - 1); 963 if (align & (align - 1)) 964 return 0; 965 if (mod) 966 cprm->to_skip += align - mod; 967 return 1; 968 } 969 EXPORT_SYMBOL(dump_align); 970 971 #ifdef CONFIG_SYSCTL 972 973 void validate_coredump_safety(void) 974 { 975 if (suid_dumpable == SUID_DUMP_ROOT && 976 core_pattern[0] != '/' && core_pattern[0] != '|') { 977 978 coredump_report_failure("Unsafe core_pattern used with fs.suid_dumpable=2: " 979 "pipe handler or fully qualified core dump path required. " 980 "Set kernel.core_pattern before fs.suid_dumpable."); 981 } 982 } 983 984 static int proc_dostring_coredump(const struct ctl_table *table, int write, 985 void *buffer, size_t *lenp, loff_t *ppos) 986 { 987 int error = proc_dostring(table, write, buffer, lenp, ppos); 988 989 if (!error) 990 validate_coredump_safety(); 991 return error; 992 } 993 994 static const unsigned int core_file_note_size_min = CORE_FILE_NOTE_SIZE_DEFAULT; 995 static const unsigned int core_file_note_size_max = CORE_FILE_NOTE_SIZE_MAX; 996 997 static struct ctl_table coredump_sysctls[] = { 998 { 999 .procname = "core_uses_pid", 1000 .data = &core_uses_pid, 1001 .maxlen = sizeof(int), 1002 .mode = 0644, 1003 .proc_handler = proc_dointvec, 1004 }, 1005 { 1006 .procname = "core_pattern", 1007 .data = core_pattern, 1008 .maxlen = CORENAME_MAX_SIZE, 1009 .mode = 0644, 1010 .proc_handler = proc_dostring_coredump, 1011 }, 1012 { 1013 .procname = "core_pipe_limit", 1014 .data = &core_pipe_limit, 1015 .maxlen = sizeof(unsigned int), 1016 .mode = 0644, 1017 .proc_handler = proc_dointvec, 1018 }, 1019 { 1020 .procname = "core_file_note_size_limit", 1021 .data = &core_file_note_size_limit, 1022 .maxlen = sizeof(unsigned int), 1023 .mode = 0644, 1024 .proc_handler = proc_douintvec_minmax, 1025 .extra1 = (unsigned int *)&core_file_note_size_min, 1026 .extra2 = (unsigned int *)&core_file_note_size_max, 1027 }, 1028 }; 1029 1030 static int __init init_fs_coredump_sysctls(void) 1031 { 1032 register_sysctl_init("kernel", coredump_sysctls); 1033 return 0; 1034 } 1035 fs_initcall(init_fs_coredump_sysctls); 1036 #endif /* CONFIG_SYSCTL */ 1037 1038 /* 1039 * The purpose of always_dump_vma() is to make sure that special kernel mappings 1040 * that are useful for post-mortem analysis are included in every core dump. 1041 * In that way we ensure that the core dump is fully interpretable later 1042 * without matching up the same kernel and hardware config to see what PC values 1043 * meant. These special mappings include - vDSO, vsyscall, and other 1044 * architecture specific mappings 1045 */ 1046 static bool always_dump_vma(struct vm_area_struct *vma) 1047 { 1048 /* Any vsyscall mappings? */ 1049 if (vma == get_gate_vma(vma->vm_mm)) 1050 return true; 1051 1052 /* 1053 * Assume that all vmas with a .name op should always be dumped. 1054 * If this changes, a new vm_ops field can easily be added. 1055 */ 1056 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 1057 return true; 1058 1059 /* 1060 * arch_vma_name() returns non-NULL for special architecture mappings, 1061 * such as vDSO sections. 1062 */ 1063 if (arch_vma_name(vma)) 1064 return true; 1065 1066 return false; 1067 } 1068 1069 #define DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER 1 1070 1071 /* 1072 * Decide how much of @vma's contents should be included in a core dump. 1073 */ 1074 static unsigned long vma_dump_size(struct vm_area_struct *vma, 1075 unsigned long mm_flags) 1076 { 1077 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) 1078 1079 /* always dump the vdso and vsyscall sections */ 1080 if (always_dump_vma(vma)) 1081 goto whole; 1082 1083 if (vma->vm_flags & VM_DONTDUMP) 1084 return 0; 1085 1086 /* support for DAX */ 1087 if (vma_is_dax(vma)) { 1088 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED)) 1089 goto whole; 1090 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE)) 1091 goto whole; 1092 return 0; 1093 } 1094 1095 /* Hugetlb memory check */ 1096 if (is_vm_hugetlb_page(vma)) { 1097 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED)) 1098 goto whole; 1099 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) 1100 goto whole; 1101 return 0; 1102 } 1103 1104 /* Do not dump I/O mapped devices or special mappings */ 1105 if (vma->vm_flags & VM_IO) 1106 return 0; 1107 1108 /* By default, dump shared memory if mapped from an anonymous file. */ 1109 if (vma->vm_flags & VM_SHARED) { 1110 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1111 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED)) 1112 goto whole; 1113 return 0; 1114 } 1115 1116 /* Dump segments that have been written to. */ 1117 if ((!IS_ENABLED(CONFIG_MMU) || vma->anon_vma) && FILTER(ANON_PRIVATE)) 1118 goto whole; 1119 if (vma->vm_file == NULL) 1120 return 0; 1121 1122 if (FILTER(MAPPED_PRIVATE)) 1123 goto whole; 1124 1125 /* 1126 * If this is the beginning of an executable file mapping, 1127 * dump the first page to aid in determining what was mapped here. 1128 */ 1129 if (FILTER(ELF_HEADERS) && 1130 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1131 if ((READ_ONCE(file_inode(vma->vm_file)->i_mode) & 0111) != 0) 1132 return PAGE_SIZE; 1133 1134 /* 1135 * ELF libraries aren't always executable. 1136 * We'll want to check whether the mapping starts with the ELF 1137 * magic, but not now - we're holding the mmap lock, 1138 * so copy_from_user() doesn't work here. 1139 * Use a placeholder instead, and fix it up later in 1140 * dump_vma_snapshot(). 1141 */ 1142 return DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER; 1143 } 1144 1145 #undef FILTER 1146 1147 return 0; 1148 1149 whole: 1150 return vma->vm_end - vma->vm_start; 1151 } 1152 1153 /* 1154 * Helper function for iterating across a vma list. It ensures that the caller 1155 * will visit `gate_vma' prior to terminating the search. 1156 */ 1157 static struct vm_area_struct *coredump_next_vma(struct vma_iterator *vmi, 1158 struct vm_area_struct *vma, 1159 struct vm_area_struct *gate_vma) 1160 { 1161 if (gate_vma && (vma == gate_vma)) 1162 return NULL; 1163 1164 vma = vma_next(vmi); 1165 if (vma) 1166 return vma; 1167 return gate_vma; 1168 } 1169 1170 static void free_vma_snapshot(struct coredump_params *cprm) 1171 { 1172 if (cprm->vma_meta) { 1173 int i; 1174 for (i = 0; i < cprm->vma_count; i++) { 1175 struct file *file = cprm->vma_meta[i].file; 1176 if (file) 1177 fput(file); 1178 } 1179 kvfree(cprm->vma_meta); 1180 cprm->vma_meta = NULL; 1181 } 1182 } 1183 1184 static int cmp_vma_size(const void *vma_meta_lhs_ptr, const void *vma_meta_rhs_ptr) 1185 { 1186 const struct core_vma_metadata *vma_meta_lhs = vma_meta_lhs_ptr; 1187 const struct core_vma_metadata *vma_meta_rhs = vma_meta_rhs_ptr; 1188 1189 if (vma_meta_lhs->dump_size < vma_meta_rhs->dump_size) 1190 return -1; 1191 if (vma_meta_lhs->dump_size > vma_meta_rhs->dump_size) 1192 return 1; 1193 return 0; 1194 } 1195 1196 /* 1197 * Under the mmap_lock, take a snapshot of relevant information about the task's 1198 * VMAs. 1199 */ 1200 static bool dump_vma_snapshot(struct coredump_params *cprm) 1201 { 1202 struct vm_area_struct *gate_vma, *vma = NULL; 1203 struct mm_struct *mm = current->mm; 1204 VMA_ITERATOR(vmi, mm, 0); 1205 int i = 0; 1206 1207 /* 1208 * Once the stack expansion code is fixed to not change VMA bounds 1209 * under mmap_lock in read mode, this can be changed to take the 1210 * mmap_lock in read mode. 1211 */ 1212 if (mmap_write_lock_killable(mm)) 1213 return false; 1214 1215 cprm->vma_data_size = 0; 1216 gate_vma = get_gate_vma(mm); 1217 cprm->vma_count = mm->map_count + (gate_vma ? 1 : 0); 1218 1219 cprm->vma_meta = kvmalloc_array(cprm->vma_count, sizeof(*cprm->vma_meta), GFP_KERNEL); 1220 if (!cprm->vma_meta) { 1221 mmap_write_unlock(mm); 1222 return false; 1223 } 1224 1225 while ((vma = coredump_next_vma(&vmi, vma, gate_vma)) != NULL) { 1226 struct core_vma_metadata *m = cprm->vma_meta + i; 1227 1228 m->start = vma->vm_start; 1229 m->end = vma->vm_end; 1230 m->flags = vma->vm_flags; 1231 m->dump_size = vma_dump_size(vma, cprm->mm_flags); 1232 m->pgoff = vma->vm_pgoff; 1233 m->file = vma->vm_file; 1234 if (m->file) 1235 get_file(m->file); 1236 i++; 1237 } 1238 1239 mmap_write_unlock(mm); 1240 1241 for (i = 0; i < cprm->vma_count; i++) { 1242 struct core_vma_metadata *m = cprm->vma_meta + i; 1243 1244 if (m->dump_size == DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER) { 1245 char elfmag[SELFMAG]; 1246 1247 if (copy_from_user(elfmag, (void __user *)m->start, SELFMAG) || 1248 memcmp(elfmag, ELFMAG, SELFMAG) != 0) { 1249 m->dump_size = 0; 1250 } else { 1251 m->dump_size = PAGE_SIZE; 1252 } 1253 } 1254 1255 cprm->vma_data_size += m->dump_size; 1256 } 1257 1258 sort(cprm->vma_meta, cprm->vma_count, sizeof(*cprm->vma_meta), 1259 cmp_vma_size, NULL); 1260 1261 return true; 1262 } 1263