1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/slab.h> 3 #include <linux/file.h> 4 #include <linux/fdtable.h> 5 #include <linux/freezer.h> 6 #include <linux/mm.h> 7 #include <linux/stat.h> 8 #include <linux/fcntl.h> 9 #include <linux/swap.h> 10 #include <linux/ctype.h> 11 #include <linux/string.h> 12 #include <linux/init.h> 13 #include <linux/pagemap.h> 14 #include <linux/perf_event.h> 15 #include <linux/highmem.h> 16 #include <linux/spinlock.h> 17 #include <linux/key.h> 18 #include <linux/personality.h> 19 #include <linux/binfmts.h> 20 #include <linux/coredump.h> 21 #include <linux/sched/coredump.h> 22 #include <linux/sched/signal.h> 23 #include <linux/sched/task_stack.h> 24 #include <linux/utsname.h> 25 #include <linux/pid_namespace.h> 26 #include <linux/module.h> 27 #include <linux/namei.h> 28 #include <linux/mount.h> 29 #include <linux/security.h> 30 #include <linux/syscalls.h> 31 #include <linux/tsacct_kern.h> 32 #include <linux/cn_proc.h> 33 #include <linux/audit.h> 34 #include <linux/kmod.h> 35 #include <linux/fsnotify.h> 36 #include <linux/fs_struct.h> 37 #include <linux/pipe_fs_i.h> 38 #include <linux/oom.h> 39 #include <linux/compat.h> 40 #include <linux/fs.h> 41 #include <linux/path.h> 42 #include <linux/timekeeping.h> 43 #include <linux/sysctl.h> 44 #include <linux/elf.h> 45 46 #include <linux/uaccess.h> 47 #include <asm/mmu_context.h> 48 #include <asm/tlb.h> 49 #include <asm/exec.h> 50 51 #include <trace/events/task.h> 52 #include "internal.h" 53 54 #include <trace/events/sched.h> 55 56 static bool dump_vma_snapshot(struct coredump_params *cprm); 57 static void free_vma_snapshot(struct coredump_params *cprm); 58 59 #define CORE_FILE_NOTE_SIZE_DEFAULT (4*1024*1024) 60 /* Define a reasonable max cap */ 61 #define CORE_FILE_NOTE_SIZE_MAX (16*1024*1024) 62 63 static int core_uses_pid; 64 static unsigned int core_pipe_limit; 65 static char core_pattern[CORENAME_MAX_SIZE] = "core"; 66 static int core_name_size = CORENAME_MAX_SIZE; 67 unsigned int core_file_note_size_limit = CORE_FILE_NOTE_SIZE_DEFAULT; 68 69 struct core_name { 70 char *corename; 71 int used, size; 72 }; 73 74 static int expand_corename(struct core_name *cn, int size) 75 { 76 char *corename; 77 78 size = kmalloc_size_roundup(size); 79 corename = krealloc(cn->corename, size, GFP_KERNEL); 80 81 if (!corename) 82 return -ENOMEM; 83 84 if (size > core_name_size) /* racy but harmless */ 85 core_name_size = size; 86 87 cn->size = size; 88 cn->corename = corename; 89 return 0; 90 } 91 92 static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt, 93 va_list arg) 94 { 95 int free, need; 96 va_list arg_copy; 97 98 again: 99 free = cn->size - cn->used; 100 101 va_copy(arg_copy, arg); 102 need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy); 103 va_end(arg_copy); 104 105 if (need < free) { 106 cn->used += need; 107 return 0; 108 } 109 110 if (!expand_corename(cn, cn->size + need - free + 1)) 111 goto again; 112 113 return -ENOMEM; 114 } 115 116 static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...) 117 { 118 va_list arg; 119 int ret; 120 121 va_start(arg, fmt); 122 ret = cn_vprintf(cn, fmt, arg); 123 va_end(arg); 124 125 return ret; 126 } 127 128 static __printf(2, 3) 129 int cn_esc_printf(struct core_name *cn, const char *fmt, ...) 130 { 131 int cur = cn->used; 132 va_list arg; 133 int ret; 134 135 va_start(arg, fmt); 136 ret = cn_vprintf(cn, fmt, arg); 137 va_end(arg); 138 139 if (ret == 0) { 140 /* 141 * Ensure that this coredump name component can't cause the 142 * resulting corefile path to consist of a ".." or ".". 143 */ 144 if ((cn->used - cur == 1 && cn->corename[cur] == '.') || 145 (cn->used - cur == 2 && cn->corename[cur] == '.' 146 && cn->corename[cur+1] == '.')) 147 cn->corename[cur] = '!'; 148 149 /* 150 * Empty names are fishy and could be used to create a "//" in a 151 * corefile name, causing the coredump to happen one directory 152 * level too high. Enforce that all components of the core 153 * pattern are at least one character long. 154 */ 155 if (cn->used == cur) 156 ret = cn_printf(cn, "!"); 157 } 158 159 for (; cur < cn->used; ++cur) { 160 if (cn->corename[cur] == '/') 161 cn->corename[cur] = '!'; 162 } 163 return ret; 164 } 165 166 static int cn_print_exe_file(struct core_name *cn, bool name_only) 167 { 168 struct file *exe_file; 169 char *pathbuf, *path, *ptr; 170 int ret; 171 172 exe_file = get_mm_exe_file(current->mm); 173 if (!exe_file) 174 return cn_esc_printf(cn, "%s (path unknown)", current->comm); 175 176 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL); 177 if (!pathbuf) { 178 ret = -ENOMEM; 179 goto put_exe_file; 180 } 181 182 path = file_path(exe_file, pathbuf, PATH_MAX); 183 if (IS_ERR(path)) { 184 ret = PTR_ERR(path); 185 goto free_buf; 186 } 187 188 if (name_only) { 189 ptr = strrchr(path, '/'); 190 if (ptr) 191 path = ptr + 1; 192 } 193 ret = cn_esc_printf(cn, "%s", path); 194 195 free_buf: 196 kfree(pathbuf); 197 put_exe_file: 198 fput(exe_file); 199 return ret; 200 } 201 202 /* format_corename will inspect the pattern parameter, and output a 203 * name into corename, which must have space for at least 204 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator. 205 */ 206 static int format_corename(struct core_name *cn, struct coredump_params *cprm, 207 size_t **argv, int *argc) 208 { 209 const struct cred *cred = current_cred(); 210 const char *pat_ptr = core_pattern; 211 int ispipe = (*pat_ptr == '|'); 212 bool was_space = false; 213 int pid_in_pattern = 0; 214 int err = 0; 215 216 cn->used = 0; 217 cn->corename = NULL; 218 if (expand_corename(cn, core_name_size)) 219 return -ENOMEM; 220 cn->corename[0] = '\0'; 221 222 if (ispipe) { 223 int argvs = sizeof(core_pattern) / 2; 224 (*argv) = kmalloc_array(argvs, sizeof(**argv), GFP_KERNEL); 225 if (!(*argv)) 226 return -ENOMEM; 227 (*argv)[(*argc)++] = 0; 228 ++pat_ptr; 229 if (!(*pat_ptr)) 230 return -ENOMEM; 231 } 232 233 /* Repeat as long as we have more pattern to process and more output 234 space */ 235 while (*pat_ptr) { 236 /* 237 * Split on spaces before doing template expansion so that 238 * %e and %E don't get split if they have spaces in them 239 */ 240 if (ispipe) { 241 if (isspace(*pat_ptr)) { 242 if (cn->used != 0) 243 was_space = true; 244 pat_ptr++; 245 continue; 246 } else if (was_space) { 247 was_space = false; 248 err = cn_printf(cn, "%c", '\0'); 249 if (err) 250 return err; 251 (*argv)[(*argc)++] = cn->used; 252 } 253 } 254 if (*pat_ptr != '%') { 255 err = cn_printf(cn, "%c", *pat_ptr++); 256 } else { 257 switch (*++pat_ptr) { 258 /* single % at the end, drop that */ 259 case 0: 260 goto out; 261 /* Double percent, output one percent */ 262 case '%': 263 err = cn_printf(cn, "%c", '%'); 264 break; 265 /* pid */ 266 case 'p': 267 pid_in_pattern = 1; 268 err = cn_printf(cn, "%d", 269 task_tgid_vnr(current)); 270 break; 271 /* global pid */ 272 case 'P': 273 err = cn_printf(cn, "%d", 274 task_tgid_nr(current)); 275 break; 276 case 'i': 277 err = cn_printf(cn, "%d", 278 task_pid_vnr(current)); 279 break; 280 case 'I': 281 err = cn_printf(cn, "%d", 282 task_pid_nr(current)); 283 break; 284 /* uid */ 285 case 'u': 286 err = cn_printf(cn, "%u", 287 from_kuid(&init_user_ns, 288 cred->uid)); 289 break; 290 /* gid */ 291 case 'g': 292 err = cn_printf(cn, "%u", 293 from_kgid(&init_user_ns, 294 cred->gid)); 295 break; 296 case 'd': 297 err = cn_printf(cn, "%d", 298 __get_dumpable(cprm->mm_flags)); 299 break; 300 /* signal that caused the coredump */ 301 case 's': 302 err = cn_printf(cn, "%d", 303 cprm->siginfo->si_signo); 304 break; 305 /* UNIX time of coredump */ 306 case 't': { 307 time64_t time; 308 309 time = ktime_get_real_seconds(); 310 err = cn_printf(cn, "%lld", time); 311 break; 312 } 313 /* hostname */ 314 case 'h': 315 down_read(&uts_sem); 316 err = cn_esc_printf(cn, "%s", 317 utsname()->nodename); 318 up_read(&uts_sem); 319 break; 320 /* executable, could be changed by prctl PR_SET_NAME etc */ 321 case 'e': 322 err = cn_esc_printf(cn, "%s", current->comm); 323 break; 324 /* file name of executable */ 325 case 'f': 326 err = cn_print_exe_file(cn, true); 327 break; 328 case 'E': 329 err = cn_print_exe_file(cn, false); 330 break; 331 /* core limit size */ 332 case 'c': 333 err = cn_printf(cn, "%lu", 334 rlimit(RLIMIT_CORE)); 335 break; 336 /* CPU the task ran on */ 337 case 'C': 338 err = cn_printf(cn, "%d", cprm->cpu); 339 break; 340 default: 341 break; 342 } 343 ++pat_ptr; 344 } 345 346 if (err) 347 return err; 348 } 349 350 out: 351 /* Backward compatibility with core_uses_pid: 352 * 353 * If core_pattern does not include a %p (as is the default) 354 * and core_uses_pid is set, then .%pid will be appended to 355 * the filename. Do not do this for piped commands. */ 356 if (!ispipe && !pid_in_pattern && core_uses_pid) { 357 err = cn_printf(cn, ".%d", task_tgid_vnr(current)); 358 if (err) 359 return err; 360 } 361 return ispipe; 362 } 363 364 static int zap_process(struct task_struct *start, int exit_code) 365 { 366 struct task_struct *t; 367 int nr = 0; 368 369 /* Allow SIGKILL, see prepare_signal() */ 370 start->signal->flags = SIGNAL_GROUP_EXIT; 371 start->signal->group_exit_code = exit_code; 372 start->signal->group_stop_count = 0; 373 374 for_each_thread(start, t) { 375 task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK); 376 if (t != current && !(t->flags & PF_POSTCOREDUMP)) { 377 sigaddset(&t->pending.signal, SIGKILL); 378 signal_wake_up(t, 1); 379 /* The vhost_worker does not particpate in coredumps */ 380 if ((t->flags & (PF_USER_WORKER | PF_IO_WORKER)) != PF_USER_WORKER) 381 nr++; 382 } 383 } 384 385 return nr; 386 } 387 388 static int zap_threads(struct task_struct *tsk, 389 struct core_state *core_state, int exit_code) 390 { 391 struct signal_struct *signal = tsk->signal; 392 int nr = -EAGAIN; 393 394 spin_lock_irq(&tsk->sighand->siglock); 395 if (!(signal->flags & SIGNAL_GROUP_EXIT) && !signal->group_exec_task) { 396 signal->core_state = core_state; 397 nr = zap_process(tsk, exit_code); 398 clear_tsk_thread_flag(tsk, TIF_SIGPENDING); 399 tsk->flags |= PF_DUMPCORE; 400 atomic_set(&core_state->nr_threads, nr); 401 } 402 spin_unlock_irq(&tsk->sighand->siglock); 403 return nr; 404 } 405 406 static int coredump_wait(int exit_code, struct core_state *core_state) 407 { 408 struct task_struct *tsk = current; 409 int core_waiters = -EBUSY; 410 411 init_completion(&core_state->startup); 412 core_state->dumper.task = tsk; 413 core_state->dumper.next = NULL; 414 415 core_waiters = zap_threads(tsk, core_state, exit_code); 416 if (core_waiters > 0) { 417 struct core_thread *ptr; 418 419 wait_for_completion_state(&core_state->startup, 420 TASK_UNINTERRUPTIBLE|TASK_FREEZABLE); 421 /* 422 * Wait for all the threads to become inactive, so that 423 * all the thread context (extended register state, like 424 * fpu etc) gets copied to the memory. 425 */ 426 ptr = core_state->dumper.next; 427 while (ptr != NULL) { 428 wait_task_inactive(ptr->task, TASK_ANY); 429 ptr = ptr->next; 430 } 431 } 432 433 return core_waiters; 434 } 435 436 static void coredump_finish(bool core_dumped) 437 { 438 struct core_thread *curr, *next; 439 struct task_struct *task; 440 441 spin_lock_irq(¤t->sighand->siglock); 442 if (core_dumped && !__fatal_signal_pending(current)) 443 current->signal->group_exit_code |= 0x80; 444 next = current->signal->core_state->dumper.next; 445 current->signal->core_state = NULL; 446 spin_unlock_irq(¤t->sighand->siglock); 447 448 while ((curr = next) != NULL) { 449 next = curr->next; 450 task = curr->task; 451 /* 452 * see coredump_task_exit(), curr->task must not see 453 * ->task == NULL before we read ->next. 454 */ 455 smp_mb(); 456 curr->task = NULL; 457 wake_up_process(task); 458 } 459 } 460 461 static bool dump_interrupted(void) 462 { 463 /* 464 * SIGKILL or freezing() interrupt the coredumping. Perhaps we 465 * can do try_to_freeze() and check __fatal_signal_pending(), 466 * but then we need to teach dump_write() to restart and clear 467 * TIF_SIGPENDING. 468 */ 469 return fatal_signal_pending(current) || freezing(current); 470 } 471 472 static void wait_for_dump_helpers(struct file *file) 473 { 474 struct pipe_inode_info *pipe = file->private_data; 475 476 pipe_lock(pipe); 477 pipe->readers++; 478 pipe->writers--; 479 wake_up_interruptible_sync(&pipe->rd_wait); 480 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); 481 pipe_unlock(pipe); 482 483 /* 484 * We actually want wait_event_freezable() but then we need 485 * to clear TIF_SIGPENDING and improve dump_interrupted(). 486 */ 487 wait_event_interruptible(pipe->rd_wait, pipe->readers == 1); 488 489 pipe_lock(pipe); 490 pipe->readers--; 491 pipe->writers++; 492 pipe_unlock(pipe); 493 } 494 495 /* 496 * umh_pipe_setup 497 * helper function to customize the process used 498 * to collect the core in userspace. Specifically 499 * it sets up a pipe and installs it as fd 0 (stdin) 500 * for the process. Returns 0 on success, or 501 * PTR_ERR on failure. 502 * Note that it also sets the core limit to 1. This 503 * is a special value that we use to trap recursive 504 * core dumps 505 */ 506 static int umh_pipe_setup(struct subprocess_info *info, struct cred *new) 507 { 508 struct file *files[2]; 509 struct coredump_params *cp = (struct coredump_params *)info->data; 510 int err = create_pipe_files(files, 0); 511 if (err) 512 return err; 513 514 cp->file = files[1]; 515 516 err = replace_fd(0, files[0], 0); 517 fput(files[0]); 518 /* and disallow core files too */ 519 current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1}; 520 521 return err; 522 } 523 524 void do_coredump(const kernel_siginfo_t *siginfo) 525 { 526 struct core_state core_state; 527 struct core_name cn; 528 struct mm_struct *mm = current->mm; 529 struct linux_binfmt * binfmt; 530 const struct cred *old_cred; 531 struct cred *cred; 532 int retval = 0; 533 int ispipe; 534 size_t *argv = NULL; 535 int argc = 0; 536 /* require nonrelative corefile path and be extra careful */ 537 bool need_suid_safe = false; 538 bool core_dumped = false; 539 static atomic_t core_dump_count = ATOMIC_INIT(0); 540 struct coredump_params cprm = { 541 .siginfo = siginfo, 542 .limit = rlimit(RLIMIT_CORE), 543 /* 544 * We must use the same mm->flags while dumping core to avoid 545 * inconsistency of bit flags, since this flag is not protected 546 * by any locks. 547 */ 548 .mm_flags = mm->flags, 549 .vma_meta = NULL, 550 .cpu = raw_smp_processor_id(), 551 }; 552 553 audit_core_dumps(siginfo->si_signo); 554 555 binfmt = mm->binfmt; 556 if (!binfmt || !binfmt->core_dump) 557 goto fail; 558 if (!__get_dumpable(cprm.mm_flags)) 559 goto fail; 560 561 cred = prepare_creds(); 562 if (!cred) 563 goto fail; 564 /* 565 * We cannot trust fsuid as being the "true" uid of the process 566 * nor do we know its entire history. We only know it was tainted 567 * so we dump it as root in mode 2, and only into a controlled 568 * environment (pipe handler or fully qualified path). 569 */ 570 if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) { 571 /* Setuid core dump mode */ 572 cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */ 573 need_suid_safe = true; 574 } 575 576 retval = coredump_wait(siginfo->si_signo, &core_state); 577 if (retval < 0) 578 goto fail_creds; 579 580 old_cred = override_creds(cred); 581 582 ispipe = format_corename(&cn, &cprm, &argv, &argc); 583 584 if (ispipe) { 585 int argi; 586 int dump_count; 587 char **helper_argv; 588 struct subprocess_info *sub_info; 589 590 if (ispipe < 0) { 591 printk(KERN_WARNING "format_corename failed\n"); 592 printk(KERN_WARNING "Aborting core\n"); 593 goto fail_unlock; 594 } 595 596 if (cprm.limit == 1) { 597 /* See umh_pipe_setup() which sets RLIMIT_CORE = 1. 598 * 599 * Normally core limits are irrelevant to pipes, since 600 * we're not writing to the file system, but we use 601 * cprm.limit of 1 here as a special value, this is a 602 * consistent way to catch recursive crashes. 603 * We can still crash if the core_pattern binary sets 604 * RLIM_CORE = !1, but it runs as root, and can do 605 * lots of stupid things. 606 * 607 * Note that we use task_tgid_vnr here to grab the pid 608 * of the process group leader. That way we get the 609 * right pid if a thread in a multi-threaded 610 * core_pattern process dies. 611 */ 612 printk(KERN_WARNING 613 "Process %d(%s) has RLIMIT_CORE set to 1\n", 614 task_tgid_vnr(current), current->comm); 615 printk(KERN_WARNING "Aborting core\n"); 616 goto fail_unlock; 617 } 618 cprm.limit = RLIM_INFINITY; 619 620 dump_count = atomic_inc_return(&core_dump_count); 621 if (core_pipe_limit && (core_pipe_limit < dump_count)) { 622 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n", 623 task_tgid_vnr(current), current->comm); 624 printk(KERN_WARNING "Skipping core dump\n"); 625 goto fail_dropcount; 626 } 627 628 helper_argv = kmalloc_array(argc + 1, sizeof(*helper_argv), 629 GFP_KERNEL); 630 if (!helper_argv) { 631 printk(KERN_WARNING "%s failed to allocate memory\n", 632 __func__); 633 goto fail_dropcount; 634 } 635 for (argi = 0; argi < argc; argi++) 636 helper_argv[argi] = cn.corename + argv[argi]; 637 helper_argv[argi] = NULL; 638 639 retval = -ENOMEM; 640 sub_info = call_usermodehelper_setup(helper_argv[0], 641 helper_argv, NULL, GFP_KERNEL, 642 umh_pipe_setup, NULL, &cprm); 643 if (sub_info) 644 retval = call_usermodehelper_exec(sub_info, 645 UMH_WAIT_EXEC); 646 647 kfree(helper_argv); 648 if (retval) { 649 printk(KERN_INFO "Core dump to |%s pipe failed\n", 650 cn.corename); 651 goto close_fail; 652 } 653 } else { 654 struct mnt_idmap *idmap; 655 struct inode *inode; 656 int open_flags = O_CREAT | O_WRONLY | O_NOFOLLOW | 657 O_LARGEFILE | O_EXCL; 658 659 if (cprm.limit < binfmt->min_coredump) 660 goto fail_unlock; 661 662 if (need_suid_safe && cn.corename[0] != '/') { 663 printk(KERN_WARNING "Pid %d(%s) can only dump core "\ 664 "to fully qualified path!\n", 665 task_tgid_vnr(current), current->comm); 666 printk(KERN_WARNING "Skipping core dump\n"); 667 goto fail_unlock; 668 } 669 670 /* 671 * Unlink the file if it exists unless this is a SUID 672 * binary - in that case, we're running around with root 673 * privs and don't want to unlink another user's coredump. 674 */ 675 if (!need_suid_safe) { 676 /* 677 * If it doesn't exist, that's fine. If there's some 678 * other problem, we'll catch it at the filp_open(). 679 */ 680 do_unlinkat(AT_FDCWD, getname_kernel(cn.corename)); 681 } 682 683 /* 684 * There is a race between unlinking and creating the 685 * file, but if that causes an EEXIST here, that's 686 * fine - another process raced with us while creating 687 * the corefile, and the other process won. To userspace, 688 * what matters is that at least one of the two processes 689 * writes its coredump successfully, not which one. 690 */ 691 if (need_suid_safe) { 692 /* 693 * Using user namespaces, normal user tasks can change 694 * their current->fs->root to point to arbitrary 695 * directories. Since the intention of the "only dump 696 * with a fully qualified path" rule is to control where 697 * coredumps may be placed using root privileges, 698 * current->fs->root must not be used. Instead, use the 699 * root directory of init_task. 700 */ 701 struct path root; 702 703 task_lock(&init_task); 704 get_fs_root(init_task.fs, &root); 705 task_unlock(&init_task); 706 cprm.file = file_open_root(&root, cn.corename, 707 open_flags, 0600); 708 path_put(&root); 709 } else { 710 cprm.file = filp_open(cn.corename, open_flags, 0600); 711 } 712 if (IS_ERR(cprm.file)) 713 goto fail_unlock; 714 715 inode = file_inode(cprm.file); 716 if (inode->i_nlink > 1) 717 goto close_fail; 718 if (d_unhashed(cprm.file->f_path.dentry)) 719 goto close_fail; 720 /* 721 * AK: actually i see no reason to not allow this for named 722 * pipes etc, but keep the previous behaviour for now. 723 */ 724 if (!S_ISREG(inode->i_mode)) 725 goto close_fail; 726 /* 727 * Don't dump core if the filesystem changed owner or mode 728 * of the file during file creation. This is an issue when 729 * a process dumps core while its cwd is e.g. on a vfat 730 * filesystem. 731 */ 732 idmap = file_mnt_idmap(cprm.file); 733 if (!vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode), 734 current_fsuid())) { 735 pr_info_ratelimited("Core dump to %s aborted: cannot preserve file owner\n", 736 cn.corename); 737 goto close_fail; 738 } 739 if ((inode->i_mode & 0677) != 0600) { 740 pr_info_ratelimited("Core dump to %s aborted: cannot preserve file permissions\n", 741 cn.corename); 742 goto close_fail; 743 } 744 if (!(cprm.file->f_mode & FMODE_CAN_WRITE)) 745 goto close_fail; 746 if (do_truncate(idmap, cprm.file->f_path.dentry, 747 0, 0, cprm.file)) 748 goto close_fail; 749 } 750 751 /* get us an unshared descriptor table; almost always a no-op */ 752 /* The cell spufs coredump code reads the file descriptor tables */ 753 retval = unshare_files(); 754 if (retval) 755 goto close_fail; 756 if (!dump_interrupted()) { 757 /* 758 * umh disabled with CONFIG_STATIC_USERMODEHELPER_PATH="" would 759 * have this set to NULL. 760 */ 761 if (!cprm.file) { 762 pr_info("Core dump to |%s disabled\n", cn.corename); 763 goto close_fail; 764 } 765 if (!dump_vma_snapshot(&cprm)) 766 goto close_fail; 767 768 file_start_write(cprm.file); 769 core_dumped = binfmt->core_dump(&cprm); 770 /* 771 * Ensures that file size is big enough to contain the current 772 * file postion. This prevents gdb from complaining about 773 * a truncated file if the last "write" to the file was 774 * dump_skip. 775 */ 776 if (cprm.to_skip) { 777 cprm.to_skip--; 778 dump_emit(&cprm, "", 1); 779 } 780 file_end_write(cprm.file); 781 free_vma_snapshot(&cprm); 782 } 783 if (ispipe && core_pipe_limit) 784 wait_for_dump_helpers(cprm.file); 785 close_fail: 786 if (cprm.file) 787 filp_close(cprm.file, NULL); 788 fail_dropcount: 789 if (ispipe) 790 atomic_dec(&core_dump_count); 791 fail_unlock: 792 kfree(argv); 793 kfree(cn.corename); 794 coredump_finish(core_dumped); 795 revert_creds(old_cred); 796 fail_creds: 797 put_cred(cred); 798 fail: 799 return; 800 } 801 802 /* 803 * Core dumping helper functions. These are the only things you should 804 * do on a core-file: use only these functions to write out all the 805 * necessary info. 806 */ 807 static int __dump_emit(struct coredump_params *cprm, const void *addr, int nr) 808 { 809 struct file *file = cprm->file; 810 loff_t pos = file->f_pos; 811 ssize_t n; 812 if (cprm->written + nr > cprm->limit) 813 return 0; 814 815 816 if (dump_interrupted()) 817 return 0; 818 n = __kernel_write(file, addr, nr, &pos); 819 if (n != nr) 820 return 0; 821 file->f_pos = pos; 822 cprm->written += n; 823 cprm->pos += n; 824 825 return 1; 826 } 827 828 static int __dump_skip(struct coredump_params *cprm, size_t nr) 829 { 830 static char zeroes[PAGE_SIZE]; 831 struct file *file = cprm->file; 832 if (file->f_mode & FMODE_LSEEK) { 833 if (dump_interrupted() || 834 vfs_llseek(file, nr, SEEK_CUR) < 0) 835 return 0; 836 cprm->pos += nr; 837 return 1; 838 } else { 839 while (nr > PAGE_SIZE) { 840 if (!__dump_emit(cprm, zeroes, PAGE_SIZE)) 841 return 0; 842 nr -= PAGE_SIZE; 843 } 844 return __dump_emit(cprm, zeroes, nr); 845 } 846 } 847 848 int dump_emit(struct coredump_params *cprm, const void *addr, int nr) 849 { 850 if (cprm->to_skip) { 851 if (!__dump_skip(cprm, cprm->to_skip)) 852 return 0; 853 cprm->to_skip = 0; 854 } 855 return __dump_emit(cprm, addr, nr); 856 } 857 EXPORT_SYMBOL(dump_emit); 858 859 void dump_skip_to(struct coredump_params *cprm, unsigned long pos) 860 { 861 cprm->to_skip = pos - cprm->pos; 862 } 863 EXPORT_SYMBOL(dump_skip_to); 864 865 void dump_skip(struct coredump_params *cprm, size_t nr) 866 { 867 cprm->to_skip += nr; 868 } 869 EXPORT_SYMBOL(dump_skip); 870 871 #ifdef CONFIG_ELF_CORE 872 static int dump_emit_page(struct coredump_params *cprm, struct page *page) 873 { 874 struct bio_vec bvec; 875 struct iov_iter iter; 876 struct file *file = cprm->file; 877 loff_t pos; 878 ssize_t n; 879 880 if (!page) 881 return 0; 882 883 if (cprm->to_skip) { 884 if (!__dump_skip(cprm, cprm->to_skip)) 885 return 0; 886 cprm->to_skip = 0; 887 } 888 if (cprm->written + PAGE_SIZE > cprm->limit) 889 return 0; 890 if (dump_interrupted()) 891 return 0; 892 pos = file->f_pos; 893 bvec_set_page(&bvec, page, PAGE_SIZE, 0); 894 iov_iter_bvec(&iter, ITER_SOURCE, &bvec, 1, PAGE_SIZE); 895 n = __kernel_write_iter(cprm->file, &iter, &pos); 896 if (n != PAGE_SIZE) 897 return 0; 898 file->f_pos = pos; 899 cprm->written += PAGE_SIZE; 900 cprm->pos += PAGE_SIZE; 901 902 return 1; 903 } 904 905 /* 906 * If we might get machine checks from kernel accesses during the 907 * core dump, let's get those errors early rather than during the 908 * IO. This is not performance-critical enough to warrant having 909 * all the machine check logic in the iovec paths. 910 */ 911 #ifdef copy_mc_to_kernel 912 913 #define dump_page_alloc() alloc_page(GFP_KERNEL) 914 #define dump_page_free(x) __free_page(x) 915 static struct page *dump_page_copy(struct page *src, struct page *dst) 916 { 917 void *buf = kmap_local_page(src); 918 size_t left = copy_mc_to_kernel(page_address(dst), buf, PAGE_SIZE); 919 kunmap_local(buf); 920 return left ? NULL : dst; 921 } 922 923 #else 924 925 /* We just want to return non-NULL; it's never used. */ 926 #define dump_page_alloc() ERR_PTR(-EINVAL) 927 #define dump_page_free(x) ((void)(x)) 928 static inline struct page *dump_page_copy(struct page *src, struct page *dst) 929 { 930 return src; 931 } 932 #endif 933 934 int dump_user_range(struct coredump_params *cprm, unsigned long start, 935 unsigned long len) 936 { 937 unsigned long addr; 938 struct page *dump_page; 939 940 dump_page = dump_page_alloc(); 941 if (!dump_page) 942 return 0; 943 944 for (addr = start; addr < start + len; addr += PAGE_SIZE) { 945 struct page *page; 946 947 /* 948 * To avoid having to allocate page tables for virtual address 949 * ranges that have never been used yet, and also to make it 950 * easy to generate sparse core files, use a helper that returns 951 * NULL when encountering an empty page table entry that would 952 * otherwise have been filled with the zero page. 953 */ 954 page = get_dump_page(addr); 955 if (page) { 956 int stop = !dump_emit_page(cprm, dump_page_copy(page, dump_page)); 957 put_page(page); 958 if (stop) { 959 dump_page_free(dump_page); 960 return 0; 961 } 962 } else { 963 dump_skip(cprm, PAGE_SIZE); 964 } 965 } 966 dump_page_free(dump_page); 967 return 1; 968 } 969 #endif 970 971 int dump_align(struct coredump_params *cprm, int align) 972 { 973 unsigned mod = (cprm->pos + cprm->to_skip) & (align - 1); 974 if (align & (align - 1)) 975 return 0; 976 if (mod) 977 cprm->to_skip += align - mod; 978 return 1; 979 } 980 EXPORT_SYMBOL(dump_align); 981 982 #ifdef CONFIG_SYSCTL 983 984 void validate_coredump_safety(void) 985 { 986 if (suid_dumpable == SUID_DUMP_ROOT && 987 core_pattern[0] != '/' && core_pattern[0] != '|') { 988 pr_warn( 989 "Unsafe core_pattern used with fs.suid_dumpable=2.\n" 990 "Pipe handler or fully qualified core dump path required.\n" 991 "Set kernel.core_pattern before fs.suid_dumpable.\n" 992 ); 993 } 994 } 995 996 static int proc_dostring_coredump(struct ctl_table *table, int write, 997 void *buffer, size_t *lenp, loff_t *ppos) 998 { 999 int error = proc_dostring(table, write, buffer, lenp, ppos); 1000 1001 if (!error) 1002 validate_coredump_safety(); 1003 return error; 1004 } 1005 1006 static const unsigned int core_file_note_size_min = CORE_FILE_NOTE_SIZE_DEFAULT; 1007 static const unsigned int core_file_note_size_max = CORE_FILE_NOTE_SIZE_MAX; 1008 1009 static struct ctl_table coredump_sysctls[] = { 1010 { 1011 .procname = "core_uses_pid", 1012 .data = &core_uses_pid, 1013 .maxlen = sizeof(int), 1014 .mode = 0644, 1015 .proc_handler = proc_dointvec, 1016 }, 1017 { 1018 .procname = "core_pattern", 1019 .data = core_pattern, 1020 .maxlen = CORENAME_MAX_SIZE, 1021 .mode = 0644, 1022 .proc_handler = proc_dostring_coredump, 1023 }, 1024 { 1025 .procname = "core_pipe_limit", 1026 .data = &core_pipe_limit, 1027 .maxlen = sizeof(unsigned int), 1028 .mode = 0644, 1029 .proc_handler = proc_dointvec, 1030 }, 1031 { 1032 .procname = "core_file_note_size_limit", 1033 .data = &core_file_note_size_limit, 1034 .maxlen = sizeof(unsigned int), 1035 .mode = 0644, 1036 .proc_handler = proc_douintvec_minmax, 1037 .extra1 = (unsigned int *)&core_file_note_size_min, 1038 .extra2 = (unsigned int *)&core_file_note_size_max, 1039 }, 1040 }; 1041 1042 static int __init init_fs_coredump_sysctls(void) 1043 { 1044 register_sysctl_init("kernel", coredump_sysctls); 1045 return 0; 1046 } 1047 fs_initcall(init_fs_coredump_sysctls); 1048 #endif /* CONFIG_SYSCTL */ 1049 1050 /* 1051 * The purpose of always_dump_vma() is to make sure that special kernel mappings 1052 * that are useful for post-mortem analysis are included in every core dump. 1053 * In that way we ensure that the core dump is fully interpretable later 1054 * without matching up the same kernel and hardware config to see what PC values 1055 * meant. These special mappings include - vDSO, vsyscall, and other 1056 * architecture specific mappings 1057 */ 1058 static bool always_dump_vma(struct vm_area_struct *vma) 1059 { 1060 /* Any vsyscall mappings? */ 1061 if (vma == get_gate_vma(vma->vm_mm)) 1062 return true; 1063 1064 /* 1065 * Assume that all vmas with a .name op should always be dumped. 1066 * If this changes, a new vm_ops field can easily be added. 1067 */ 1068 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma)) 1069 return true; 1070 1071 /* 1072 * arch_vma_name() returns non-NULL for special architecture mappings, 1073 * such as vDSO sections. 1074 */ 1075 if (arch_vma_name(vma)) 1076 return true; 1077 1078 return false; 1079 } 1080 1081 #define DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER 1 1082 1083 /* 1084 * Decide how much of @vma's contents should be included in a core dump. 1085 */ 1086 static unsigned long vma_dump_size(struct vm_area_struct *vma, 1087 unsigned long mm_flags) 1088 { 1089 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) 1090 1091 /* always dump the vdso and vsyscall sections */ 1092 if (always_dump_vma(vma)) 1093 goto whole; 1094 1095 if (vma->vm_flags & VM_DONTDUMP) 1096 return 0; 1097 1098 /* support for DAX */ 1099 if (vma_is_dax(vma)) { 1100 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED)) 1101 goto whole; 1102 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE)) 1103 goto whole; 1104 return 0; 1105 } 1106 1107 /* Hugetlb memory check */ 1108 if (is_vm_hugetlb_page(vma)) { 1109 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED)) 1110 goto whole; 1111 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) 1112 goto whole; 1113 return 0; 1114 } 1115 1116 /* Do not dump I/O mapped devices or special mappings */ 1117 if (vma->vm_flags & VM_IO) 1118 return 0; 1119 1120 /* By default, dump shared memory if mapped from an anonymous file. */ 1121 if (vma->vm_flags & VM_SHARED) { 1122 if (file_inode(vma->vm_file)->i_nlink == 0 ? 1123 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED)) 1124 goto whole; 1125 return 0; 1126 } 1127 1128 /* Dump segments that have been written to. */ 1129 if ((!IS_ENABLED(CONFIG_MMU) || vma->anon_vma) && FILTER(ANON_PRIVATE)) 1130 goto whole; 1131 if (vma->vm_file == NULL) 1132 return 0; 1133 1134 if (FILTER(MAPPED_PRIVATE)) 1135 goto whole; 1136 1137 /* 1138 * If this is the beginning of an executable file mapping, 1139 * dump the first page to aid in determining what was mapped here. 1140 */ 1141 if (FILTER(ELF_HEADERS) && 1142 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { 1143 if ((READ_ONCE(file_inode(vma->vm_file)->i_mode) & 0111) != 0) 1144 return PAGE_SIZE; 1145 1146 /* 1147 * ELF libraries aren't always executable. 1148 * We'll want to check whether the mapping starts with the ELF 1149 * magic, but not now - we're holding the mmap lock, 1150 * so copy_from_user() doesn't work here. 1151 * Use a placeholder instead, and fix it up later in 1152 * dump_vma_snapshot(). 1153 */ 1154 return DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER; 1155 } 1156 1157 #undef FILTER 1158 1159 return 0; 1160 1161 whole: 1162 return vma->vm_end - vma->vm_start; 1163 } 1164 1165 /* 1166 * Helper function for iterating across a vma list. It ensures that the caller 1167 * will visit `gate_vma' prior to terminating the search. 1168 */ 1169 static struct vm_area_struct *coredump_next_vma(struct vma_iterator *vmi, 1170 struct vm_area_struct *vma, 1171 struct vm_area_struct *gate_vma) 1172 { 1173 if (gate_vma && (vma == gate_vma)) 1174 return NULL; 1175 1176 vma = vma_next(vmi); 1177 if (vma) 1178 return vma; 1179 return gate_vma; 1180 } 1181 1182 static void free_vma_snapshot(struct coredump_params *cprm) 1183 { 1184 if (cprm->vma_meta) { 1185 int i; 1186 for (i = 0; i < cprm->vma_count; i++) { 1187 struct file *file = cprm->vma_meta[i].file; 1188 if (file) 1189 fput(file); 1190 } 1191 kvfree(cprm->vma_meta); 1192 cprm->vma_meta = NULL; 1193 } 1194 } 1195 1196 /* 1197 * Under the mmap_lock, take a snapshot of relevant information about the task's 1198 * VMAs. 1199 */ 1200 static bool dump_vma_snapshot(struct coredump_params *cprm) 1201 { 1202 struct vm_area_struct *gate_vma, *vma = NULL; 1203 struct mm_struct *mm = current->mm; 1204 VMA_ITERATOR(vmi, mm, 0); 1205 int i = 0; 1206 1207 /* 1208 * Once the stack expansion code is fixed to not change VMA bounds 1209 * under mmap_lock in read mode, this can be changed to take the 1210 * mmap_lock in read mode. 1211 */ 1212 if (mmap_write_lock_killable(mm)) 1213 return false; 1214 1215 cprm->vma_data_size = 0; 1216 gate_vma = get_gate_vma(mm); 1217 cprm->vma_count = mm->map_count + (gate_vma ? 1 : 0); 1218 1219 cprm->vma_meta = kvmalloc_array(cprm->vma_count, sizeof(*cprm->vma_meta), GFP_KERNEL); 1220 if (!cprm->vma_meta) { 1221 mmap_write_unlock(mm); 1222 return false; 1223 } 1224 1225 while ((vma = coredump_next_vma(&vmi, vma, gate_vma)) != NULL) { 1226 struct core_vma_metadata *m = cprm->vma_meta + i; 1227 1228 m->start = vma->vm_start; 1229 m->end = vma->vm_end; 1230 m->flags = vma->vm_flags; 1231 m->dump_size = vma_dump_size(vma, cprm->mm_flags); 1232 m->pgoff = vma->vm_pgoff; 1233 m->file = vma->vm_file; 1234 if (m->file) 1235 get_file(m->file); 1236 i++; 1237 } 1238 1239 mmap_write_unlock(mm); 1240 1241 for (i = 0; i < cprm->vma_count; i++) { 1242 struct core_vma_metadata *m = cprm->vma_meta + i; 1243 1244 if (m->dump_size == DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER) { 1245 char elfmag[SELFMAG]; 1246 1247 if (copy_from_user(elfmag, (void __user *)m->start, SELFMAG) || 1248 memcmp(elfmag, ELFMAG, SELFMAG) != 0) { 1249 m->dump_size = 0; 1250 } else { 1251 m->dump_size = PAGE_SIZE; 1252 } 1253 } 1254 1255 cprm->vma_data_size += m->dump_size; 1256 } 1257 1258 return true; 1259 } 1260