exec.c 35 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553
  1. /*
  2. * linux/fs/exec.c
  3. *
  4. * Copyright (C) 1991, 1992 Linus Torvalds
  5. */
  6. /*
  7. * #!-checking implemented by tytso.
  8. */
  9. /*
  10. * Demand-loading implemented 01.12.91 - no need to read anything but
  11. * the header into memory. The inode of the executable is put into
  12. * "current->executable", and page faults do the actual loading. Clean.
  13. *
  14. * Once more I can proudly say that linux stood up to being changed: it
  15. * was less than 2 hours work to get demand-loading completely implemented.
  16. *
  17. * Demand loading changed July 1993 by Eric Youngdale. Use mmap instead,
  18. * current->executable is only used by the procfs. This allows a dispatch
  19. * table to check for several different types of binary formats. We keep
  20. * trying until we recognize the file or we run out of supported binary
  21. * formats.
  22. */
  23. #include <linux/slab.h>
  24. #include <linux/file.h>
  25. #include <linux/mman.h>
  26. #include <linux/a.out.h>
  27. #include <linux/stat.h>
  28. #include <linux/fcntl.h>
  29. #include <linux/smp_lock.h>
  30. #include <linux/init.h>
  31. #include <linux/pagemap.h>
  32. #include <linux/highmem.h>
  33. #include <linux/spinlock.h>
  34. #include <linux/key.h>
  35. #include <linux/personality.h>
  36. #include <linux/binfmts.h>
  37. #include <linux/swap.h>
  38. #include <linux/utsname.h>
  39. #include <linux/pid_namespace.h>
  40. #include <linux/module.h>
  41. #include <linux/namei.h>
  42. #include <linux/proc_fs.h>
  43. #include <linux/ptrace.h>
  44. #include <linux/mount.h>
  45. #include <linux/security.h>
  46. #include <linux/syscalls.h>
  47. #include <linux/rmap.h>
  48. #include <linux/tsacct_kern.h>
  49. #include <linux/cn_proc.h>
  50. #include <linux/audit.h>
  51. #include <asm/uaccess.h>
  52. #include <asm/mmu_context.h>
  53. #ifdef CONFIG_KMOD
  54. #include <linux/kmod.h>
  55. #endif
  56. int core_uses_pid;
  57. char core_pattern[128] = "core";
  58. int suid_dumpable = 0;
  59. EXPORT_SYMBOL(suid_dumpable);
  60. /* The maximal length of core_pattern is also specified in sysctl.c */
  61. static struct linux_binfmt *formats;
  62. static DEFINE_RWLOCK(binfmt_lock);
  63. int register_binfmt(struct linux_binfmt * fmt)
  64. {
  65. struct linux_binfmt ** tmp = &formats;
  66. if (!fmt)
  67. return -EINVAL;
  68. if (fmt->next)
  69. return -EBUSY;
  70. write_lock(&binfmt_lock);
  71. while (*tmp) {
  72. if (fmt == *tmp) {
  73. write_unlock(&binfmt_lock);
  74. return -EBUSY;
  75. }
  76. tmp = &(*tmp)->next;
  77. }
  78. fmt->next = formats;
  79. formats = fmt;
  80. write_unlock(&binfmt_lock);
  81. return 0;
  82. }
  83. EXPORT_SYMBOL(register_binfmt);
  84. int unregister_binfmt(struct linux_binfmt * fmt)
  85. {
  86. struct linux_binfmt ** tmp = &formats;
  87. write_lock(&binfmt_lock);
  88. while (*tmp) {
  89. if (fmt == *tmp) {
  90. *tmp = fmt->next;
  91. write_unlock(&binfmt_lock);
  92. return 0;
  93. }
  94. tmp = &(*tmp)->next;
  95. }
  96. write_unlock(&binfmt_lock);
  97. return -EINVAL;
  98. }
  99. EXPORT_SYMBOL(unregister_binfmt);
  100. static inline void put_binfmt(struct linux_binfmt * fmt)
  101. {
  102. module_put(fmt->module);
  103. }
  104. /*
  105. * Note that a shared library must be both readable and executable due to
  106. * security reasons.
  107. *
  108. * Also note that we take the address to load from from the file itself.
  109. */
  110. asmlinkage long sys_uselib(const char __user * library)
  111. {
  112. struct file * file;
  113. struct nameidata nd;
  114. int error;
  115. error = __user_path_lookup_open(library, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
  116. if (error)
  117. goto out;
  118. error = -EINVAL;
  119. if (!S_ISREG(nd.dentry->d_inode->i_mode))
  120. goto exit;
  121. error = vfs_permission(&nd, MAY_READ | MAY_EXEC);
  122. if (error)
  123. goto exit;
  124. file = nameidata_to_filp(&nd, O_RDONLY);
  125. error = PTR_ERR(file);
  126. if (IS_ERR(file))
  127. goto out;
  128. error = -ENOEXEC;
  129. if(file->f_op) {
  130. struct linux_binfmt * fmt;
  131. read_lock(&binfmt_lock);
  132. for (fmt = formats ; fmt ; fmt = fmt->next) {
  133. if (!fmt->load_shlib)
  134. continue;
  135. if (!try_module_get(fmt->module))
  136. continue;
  137. read_unlock(&binfmt_lock);
  138. error = fmt->load_shlib(file);
  139. read_lock(&binfmt_lock);
  140. put_binfmt(fmt);
  141. if (error != -ENOEXEC)
  142. break;
  143. }
  144. read_unlock(&binfmt_lock);
  145. }
  146. fput(file);
  147. out:
  148. return error;
  149. exit:
  150. release_open_intent(&nd);
  151. path_release(&nd);
  152. goto out;
  153. }
  154. /*
  155. * count() counts the number of strings in array ARGV.
  156. */
  157. static int count(char __user * __user * argv, int max)
  158. {
  159. int i = 0;
  160. if (argv != NULL) {
  161. for (;;) {
  162. char __user * p;
  163. if (get_user(p, argv))
  164. return -EFAULT;
  165. if (!p)
  166. break;
  167. argv++;
  168. if(++i > max)
  169. return -E2BIG;
  170. cond_resched();
  171. }
  172. }
  173. return i;
  174. }
  175. /*
  176. * 'copy_strings()' copies argument/environment strings from user
  177. * memory to free pages in kernel mem. These are in a format ready
  178. * to be put directly into the top of new user memory.
  179. */
  180. static int copy_strings(int argc, char __user * __user * argv,
  181. struct linux_binprm *bprm)
  182. {
  183. struct page *kmapped_page = NULL;
  184. char *kaddr = NULL;
  185. int ret;
  186. while (argc-- > 0) {
  187. char __user *str;
  188. int len;
  189. unsigned long pos;
  190. if (get_user(str, argv+argc) ||
  191. !(len = strnlen_user(str, bprm->p))) {
  192. ret = -EFAULT;
  193. goto out;
  194. }
  195. if (bprm->p < len) {
  196. ret = -E2BIG;
  197. goto out;
  198. }
  199. bprm->p -= len;
  200. /* XXX: add architecture specific overflow check here. */
  201. pos = bprm->p;
  202. while (len > 0) {
  203. int i, new, err;
  204. int offset, bytes_to_copy;
  205. struct page *page;
  206. offset = pos % PAGE_SIZE;
  207. i = pos/PAGE_SIZE;
  208. page = bprm->page[i];
  209. new = 0;
  210. if (!page) {
  211. page = alloc_page(GFP_HIGHUSER);
  212. bprm->page[i] = page;
  213. if (!page) {
  214. ret = -ENOMEM;
  215. goto out;
  216. }
  217. new = 1;
  218. }
  219. if (page != kmapped_page) {
  220. if (kmapped_page)
  221. kunmap(kmapped_page);
  222. kmapped_page = page;
  223. kaddr = kmap(kmapped_page);
  224. }
  225. if (new && offset)
  226. memset(kaddr, 0, offset);
  227. bytes_to_copy = PAGE_SIZE - offset;
  228. if (bytes_to_copy > len) {
  229. bytes_to_copy = len;
  230. if (new)
  231. memset(kaddr+offset+len, 0,
  232. PAGE_SIZE-offset-len);
  233. }
  234. err = copy_from_user(kaddr+offset, str, bytes_to_copy);
  235. if (err) {
  236. ret = -EFAULT;
  237. goto out;
  238. }
  239. pos += bytes_to_copy;
  240. str += bytes_to_copy;
  241. len -= bytes_to_copy;
  242. }
  243. }
  244. ret = 0;
  245. out:
  246. if (kmapped_page)
  247. kunmap(kmapped_page);
  248. return ret;
  249. }
  250. /*
  251. * Like copy_strings, but get argv and its values from kernel memory.
  252. */
  253. int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
  254. {
  255. int r;
  256. mm_segment_t oldfs = get_fs();
  257. set_fs(KERNEL_DS);
  258. r = copy_strings(argc, (char __user * __user *)argv, bprm);
  259. set_fs(oldfs);
  260. return r;
  261. }
  262. EXPORT_SYMBOL(copy_strings_kernel);
  263. #ifdef CONFIG_MMU
  264. /*
  265. * This routine is used to map in a page into an address space: needed by
  266. * execve() for the initial stack and environment pages.
  267. *
  268. * vma->vm_mm->mmap_sem is held for writing.
  269. */
  270. void install_arg_page(struct vm_area_struct *vma,
  271. struct page *page, unsigned long address)
  272. {
  273. struct mm_struct *mm = vma->vm_mm;
  274. pte_t * pte;
  275. spinlock_t *ptl;
  276. if (unlikely(anon_vma_prepare(vma)))
  277. goto out;
  278. flush_dcache_page(page);
  279. pte = get_locked_pte(mm, address, &ptl);
  280. if (!pte)
  281. goto out;
  282. if (!pte_none(*pte)) {
  283. pte_unmap_unlock(pte, ptl);
  284. goto out;
  285. }
  286. inc_mm_counter(mm, anon_rss);
  287. lru_cache_add_active(page);
  288. set_pte_at(mm, address, pte, pte_mkdirty(pte_mkwrite(mk_pte(
  289. page, vma->vm_page_prot))));
  290. page_add_new_anon_rmap(page, vma, address);
  291. pte_unmap_unlock(pte, ptl);
  292. /* no need for flush_tlb */
  293. return;
  294. out:
  295. __free_page(page);
  296. force_sig(SIGKILL, current);
  297. }
  298. #define EXTRA_STACK_VM_PAGES 20 /* random */
  299. int setup_arg_pages(struct linux_binprm *bprm,
  300. unsigned long stack_top,
  301. int executable_stack)
  302. {
  303. unsigned long stack_base;
  304. struct vm_area_struct *mpnt;
  305. struct mm_struct *mm = current->mm;
  306. int i, ret;
  307. long arg_size;
  308. #ifdef CONFIG_STACK_GROWSUP
  309. /* Move the argument and environment strings to the bottom of the
  310. * stack space.
  311. */
  312. int offset, j;
  313. char *to, *from;
  314. /* Start by shifting all the pages down */
  315. i = 0;
  316. for (j = 0; j < MAX_ARG_PAGES; j++) {
  317. struct page *page = bprm->page[j];
  318. if (!page)
  319. continue;
  320. bprm->page[i++] = page;
  321. }
  322. /* Now move them within their pages */
  323. offset = bprm->p % PAGE_SIZE;
  324. to = kmap(bprm->page[0]);
  325. for (j = 1; j < i; j++) {
  326. memmove(to, to + offset, PAGE_SIZE - offset);
  327. from = kmap(bprm->page[j]);
  328. memcpy(to + PAGE_SIZE - offset, from, offset);
  329. kunmap(bprm->page[j - 1]);
  330. to = from;
  331. }
  332. memmove(to, to + offset, PAGE_SIZE - offset);
  333. kunmap(bprm->page[j - 1]);
  334. /* Limit stack size to 1GB */
  335. stack_base = current->signal->rlim[RLIMIT_STACK].rlim_max;
  336. if (stack_base > (1 << 30))
  337. stack_base = 1 << 30;
  338. stack_base = PAGE_ALIGN(stack_top - stack_base);
  339. /* Adjust bprm->p to point to the end of the strings. */
  340. bprm->p = stack_base + PAGE_SIZE * i - offset;
  341. mm->arg_start = stack_base;
  342. arg_size = i << PAGE_SHIFT;
  343. /* zero pages that were copied above */
  344. while (i < MAX_ARG_PAGES)
  345. bprm->page[i++] = NULL;
  346. #else
  347. stack_base = arch_align_stack(stack_top - MAX_ARG_PAGES*PAGE_SIZE);
  348. stack_base = PAGE_ALIGN(stack_base);
  349. bprm->p += stack_base;
  350. mm->arg_start = bprm->p;
  351. arg_size = stack_top - (PAGE_MASK & (unsigned long) mm->arg_start);
  352. #endif
  353. arg_size += EXTRA_STACK_VM_PAGES * PAGE_SIZE;
  354. if (bprm->loader)
  355. bprm->loader += stack_base;
  356. bprm->exec += stack_base;
  357. mpnt = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  358. if (!mpnt)
  359. return -ENOMEM;
  360. down_write(&mm->mmap_sem);
  361. {
  362. mpnt->vm_mm = mm;
  363. #ifdef CONFIG_STACK_GROWSUP
  364. mpnt->vm_start = stack_base;
  365. mpnt->vm_end = stack_base + arg_size;
  366. #else
  367. mpnt->vm_end = stack_top;
  368. mpnt->vm_start = mpnt->vm_end - arg_size;
  369. #endif
  370. /* Adjust stack execute permissions; explicitly enable
  371. * for EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X
  372. * and leave alone (arch default) otherwise. */
  373. if (unlikely(executable_stack == EXSTACK_ENABLE_X))
  374. mpnt->vm_flags = VM_STACK_FLAGS | VM_EXEC;
  375. else if (executable_stack == EXSTACK_DISABLE_X)
  376. mpnt->vm_flags = VM_STACK_FLAGS & ~VM_EXEC;
  377. else
  378. mpnt->vm_flags = VM_STACK_FLAGS;
  379. mpnt->vm_flags |= mm->def_flags;
  380. mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7];
  381. if ((ret = insert_vm_struct(mm, mpnt))) {
  382. up_write(&mm->mmap_sem);
  383. kmem_cache_free(vm_area_cachep, mpnt);
  384. return ret;
  385. }
  386. mm->stack_vm = mm->total_vm = vma_pages(mpnt);
  387. }
  388. for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
  389. struct page *page = bprm->page[i];
  390. if (page) {
  391. bprm->page[i] = NULL;
  392. install_arg_page(mpnt, page, stack_base);
  393. }
  394. stack_base += PAGE_SIZE;
  395. }
  396. up_write(&mm->mmap_sem);
  397. return 0;
  398. }
  399. EXPORT_SYMBOL(setup_arg_pages);
  400. #define free_arg_pages(bprm) do { } while (0)
  401. #else
  402. static inline void free_arg_pages(struct linux_binprm *bprm)
  403. {
  404. int i;
  405. for (i = 0; i < MAX_ARG_PAGES; i++) {
  406. if (bprm->page[i])
  407. __free_page(bprm->page[i]);
  408. bprm->page[i] = NULL;
  409. }
  410. }
  411. #endif /* CONFIG_MMU */
  412. struct file *open_exec(const char *name)
  413. {
  414. struct nameidata nd;
  415. int err;
  416. struct file *file;
  417. err = path_lookup_open(AT_FDCWD, name, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
  418. file = ERR_PTR(err);
  419. if (!err) {
  420. struct inode *inode = nd.dentry->d_inode;
  421. file = ERR_PTR(-EACCES);
  422. if (!(nd.mnt->mnt_flags & MNT_NOEXEC) &&
  423. S_ISREG(inode->i_mode)) {
  424. int err = vfs_permission(&nd, MAY_EXEC);
  425. file = ERR_PTR(err);
  426. if (!err) {
  427. file = nameidata_to_filp(&nd, O_RDONLY);
  428. if (!IS_ERR(file)) {
  429. err = deny_write_access(file);
  430. if (err) {
  431. fput(file);
  432. file = ERR_PTR(err);
  433. }
  434. }
  435. out:
  436. return file;
  437. }
  438. }
  439. release_open_intent(&nd);
  440. path_release(&nd);
  441. }
  442. goto out;
  443. }
  444. EXPORT_SYMBOL(open_exec);
  445. int kernel_read(struct file *file, unsigned long offset,
  446. char *addr, unsigned long count)
  447. {
  448. mm_segment_t old_fs;
  449. loff_t pos = offset;
  450. int result;
  451. old_fs = get_fs();
  452. set_fs(get_ds());
  453. /* The cast to a user pointer is valid due to the set_fs() */
  454. result = vfs_read(file, (void __user *)addr, count, &pos);
  455. set_fs(old_fs);
  456. return result;
  457. }
  458. EXPORT_SYMBOL(kernel_read);
  459. static int exec_mmap(struct mm_struct *mm)
  460. {
  461. struct task_struct *tsk;
  462. struct mm_struct * old_mm, *active_mm;
  463. /* Notify parent that we're no longer interested in the old VM */
  464. tsk = current;
  465. old_mm = current->mm;
  466. mm_release(tsk, old_mm);
  467. if (old_mm) {
  468. /*
  469. * Make sure that if there is a core dump in progress
  470. * for the old mm, we get out and die instead of going
  471. * through with the exec. We must hold mmap_sem around
  472. * checking core_waiters and changing tsk->mm. The
  473. * core-inducing thread will increment core_waiters for
  474. * each thread whose ->mm == old_mm.
  475. */
  476. down_read(&old_mm->mmap_sem);
  477. if (unlikely(old_mm->core_waiters)) {
  478. up_read(&old_mm->mmap_sem);
  479. return -EINTR;
  480. }
  481. }
  482. task_lock(tsk);
  483. active_mm = tsk->active_mm;
  484. tsk->mm = mm;
  485. tsk->active_mm = mm;
  486. activate_mm(active_mm, mm);
  487. task_unlock(tsk);
  488. arch_pick_mmap_layout(mm);
  489. if (old_mm) {
  490. up_read(&old_mm->mmap_sem);
  491. BUG_ON(active_mm != old_mm);
  492. mmput(old_mm);
  493. return 0;
  494. }
  495. mmdrop(active_mm);
  496. return 0;
  497. }
  498. /*
  499. * This function makes sure the current process has its own signal table,
  500. * so that flush_signal_handlers can later reset the handlers without
  501. * disturbing other processes. (Other processes might share the signal
  502. * table via the CLONE_SIGHAND option to clone().)
  503. */
  504. static int de_thread(struct task_struct *tsk)
  505. {
  506. struct signal_struct *sig = tsk->signal;
  507. struct sighand_struct *newsighand, *oldsighand = tsk->sighand;
  508. spinlock_t *lock = &oldsighand->siglock;
  509. struct task_struct *leader = NULL;
  510. int count;
  511. /*
  512. * If we don't share sighandlers, then we aren't sharing anything
  513. * and we can just re-use it all.
  514. */
  515. if (atomic_read(&oldsighand->count) <= 1) {
  516. BUG_ON(atomic_read(&sig->count) != 1);
  517. exit_itimers(sig);
  518. return 0;
  519. }
  520. newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
  521. if (!newsighand)
  522. return -ENOMEM;
  523. if (thread_group_empty(tsk))
  524. goto no_thread_group;
  525. /*
  526. * Kill all other threads in the thread group.
  527. * We must hold tasklist_lock to call zap_other_threads.
  528. */
  529. read_lock(&tasklist_lock);
  530. spin_lock_irq(lock);
  531. if (sig->flags & SIGNAL_GROUP_EXIT) {
  532. /*
  533. * Another group action in progress, just
  534. * return so that the signal is processed.
  535. */
  536. spin_unlock_irq(lock);
  537. read_unlock(&tasklist_lock);
  538. kmem_cache_free(sighand_cachep, newsighand);
  539. return -EAGAIN;
  540. }
  541. /*
  542. * child_reaper ignores SIGKILL, change it now.
  543. * Reparenting needs write_lock on tasklist_lock,
  544. * so it is safe to do it under read_lock.
  545. */
  546. if (unlikely(tsk->group_leader == child_reaper(tsk)))
  547. tsk->nsproxy->pid_ns->child_reaper = tsk;
  548. zap_other_threads(tsk);
  549. read_unlock(&tasklist_lock);
  550. /*
  551. * Account for the thread group leader hanging around:
  552. */
  553. count = 1;
  554. if (!thread_group_leader(tsk)) {
  555. count = 2;
  556. /*
  557. * The SIGALRM timer survives the exec, but needs to point
  558. * at us as the new group leader now. We have a race with
  559. * a timer firing now getting the old leader, so we need to
  560. * synchronize with any firing (by calling del_timer_sync)
  561. * before we can safely let the old group leader die.
  562. */
  563. sig->tsk = tsk;
  564. spin_unlock_irq(lock);
  565. if (hrtimer_cancel(&sig->real_timer))
  566. hrtimer_restart(&sig->real_timer);
  567. spin_lock_irq(lock);
  568. }
  569. while (atomic_read(&sig->count) > count) {
  570. sig->group_exit_task = tsk;
  571. sig->notify_count = count;
  572. __set_current_state(TASK_UNINTERRUPTIBLE);
  573. spin_unlock_irq(lock);
  574. schedule();
  575. spin_lock_irq(lock);
  576. }
  577. sig->group_exit_task = NULL;
  578. sig->notify_count = 0;
  579. spin_unlock_irq(lock);
  580. /*
  581. * At this point all other threads have exited, all we have to
  582. * do is to wait for the thread group leader to become inactive,
  583. * and to assume its PID:
  584. */
  585. if (!thread_group_leader(tsk)) {
  586. /*
  587. * Wait for the thread group leader to be a zombie.
  588. * It should already be zombie at this point, most
  589. * of the time.
  590. */
  591. leader = tsk->group_leader;
  592. while (leader->exit_state != EXIT_ZOMBIE)
  593. yield();
  594. /*
  595. * The only record we have of the real-time age of a
  596. * process, regardless of execs it's done, is start_time.
  597. * All the past CPU time is accumulated in signal_struct
  598. * from sister threads now dead. But in this non-leader
  599. * exec, nothing survives from the original leader thread,
  600. * whose birth marks the true age of this process now.
  601. * When we take on its identity by switching to its PID, we
  602. * also take its birthdate (always earlier than our own).
  603. */
  604. tsk->start_time = leader->start_time;
  605. write_lock_irq(&tasklist_lock);
  606. BUG_ON(leader->tgid != tsk->tgid);
  607. BUG_ON(tsk->pid == tsk->tgid);
  608. /*
  609. * An exec() starts a new thread group with the
  610. * TGID of the previous thread group. Rehash the
  611. * two threads with a switched PID, and release
  612. * the former thread group leader:
  613. */
  614. /* Become a process group leader with the old leader's pid.
  615. * The old leader becomes a thread of the this thread group.
  616. * Note: The old leader also uses this pid until release_task
  617. * is called. Odd but simple and correct.
  618. */
  619. detach_pid(tsk, PIDTYPE_PID);
  620. tsk->pid = leader->pid;
  621. attach_pid(tsk, PIDTYPE_PID, tsk->pid);
  622. transfer_pid(leader, tsk, PIDTYPE_PGID);
  623. transfer_pid(leader, tsk, PIDTYPE_SID);
  624. list_replace_rcu(&leader->tasks, &tsk->tasks);
  625. tsk->group_leader = tsk;
  626. leader->group_leader = tsk;
  627. tsk->exit_signal = SIGCHLD;
  628. BUG_ON(leader->exit_state != EXIT_ZOMBIE);
  629. leader->exit_state = EXIT_DEAD;
  630. write_unlock_irq(&tasklist_lock);
  631. }
  632. /*
  633. * There may be one thread left which is just exiting,
  634. * but it's safe to stop telling the group to kill themselves.
  635. */
  636. sig->flags = 0;
  637. no_thread_group:
  638. exit_itimers(sig);
  639. if (leader)
  640. release_task(leader);
  641. BUG_ON(atomic_read(&sig->count) != 1);
  642. if (atomic_read(&oldsighand->count) == 1) {
  643. /*
  644. * Now that we nuked the rest of the thread group,
  645. * it turns out we are not sharing sighand any more either.
  646. * So we can just keep it.
  647. */
  648. kmem_cache_free(sighand_cachep, newsighand);
  649. } else {
  650. /*
  651. * Move our state over to newsighand and switch it in.
  652. */
  653. atomic_set(&newsighand->count, 1);
  654. memcpy(newsighand->action, oldsighand->action,
  655. sizeof(newsighand->action));
  656. write_lock_irq(&tasklist_lock);
  657. spin_lock(&oldsighand->siglock);
  658. spin_lock_nested(&newsighand->siglock, SINGLE_DEPTH_NESTING);
  659. rcu_assign_pointer(tsk->sighand, newsighand);
  660. recalc_sigpending();
  661. spin_unlock(&newsighand->siglock);
  662. spin_unlock(&oldsighand->siglock);
  663. write_unlock_irq(&tasklist_lock);
  664. if (atomic_dec_and_test(&oldsighand->count))
  665. kmem_cache_free(sighand_cachep, oldsighand);
  666. }
  667. BUG_ON(!thread_group_leader(tsk));
  668. return 0;
  669. }
  670. /*
  671. * These functions flushes out all traces of the currently running executable
  672. * so that a new one can be started
  673. */
  674. static void flush_old_files(struct files_struct * files)
  675. {
  676. long j = -1;
  677. struct fdtable *fdt;
  678. spin_lock(&files->file_lock);
  679. for (;;) {
  680. unsigned long set, i;
  681. j++;
  682. i = j * __NFDBITS;
  683. fdt = files_fdtable(files);
  684. if (i >= fdt->max_fds)
  685. break;
  686. set = fdt->close_on_exec->fds_bits[j];
  687. if (!set)
  688. continue;
  689. fdt->close_on_exec->fds_bits[j] = 0;
  690. spin_unlock(&files->file_lock);
  691. for ( ; set ; i++,set >>= 1) {
  692. if (set & 1) {
  693. sys_close(i);
  694. }
  695. }
  696. spin_lock(&files->file_lock);
  697. }
  698. spin_unlock(&files->file_lock);
  699. }
  700. void get_task_comm(char *buf, struct task_struct *tsk)
  701. {
  702. /* buf must be at least sizeof(tsk->comm) in size */
  703. task_lock(tsk);
  704. strncpy(buf, tsk->comm, sizeof(tsk->comm));
  705. task_unlock(tsk);
  706. }
  707. void set_task_comm(struct task_struct *tsk, char *buf)
  708. {
  709. task_lock(tsk);
  710. strlcpy(tsk->comm, buf, sizeof(tsk->comm));
  711. task_unlock(tsk);
  712. }
  713. int flush_old_exec(struct linux_binprm * bprm)
  714. {
  715. char * name;
  716. int i, ch, retval;
  717. struct files_struct *files;
  718. char tcomm[sizeof(current->comm)];
  719. /*
  720. * Make sure we have a private signal table and that
  721. * we are unassociated from the previous thread group.
  722. */
  723. retval = de_thread(current);
  724. if (retval)
  725. goto out;
  726. /*
  727. * Make sure we have private file handles. Ask the
  728. * fork helper to do the work for us and the exit
  729. * helper to do the cleanup of the old one.
  730. */
  731. files = current->files; /* refcounted so safe to hold */
  732. retval = unshare_files();
  733. if (retval)
  734. goto out;
  735. /*
  736. * Release all of the old mmap stuff
  737. */
  738. retval = exec_mmap(bprm->mm);
  739. if (retval)
  740. goto mmap_failed;
  741. bprm->mm = NULL; /* We're using it now */
  742. /* This is the point of no return */
  743. put_files_struct(files);
  744. current->sas_ss_sp = current->sas_ss_size = 0;
  745. if (current->euid == current->uid && current->egid == current->gid)
  746. current->mm->dumpable = 1;
  747. else
  748. current->mm->dumpable = suid_dumpable;
  749. name = bprm->filename;
  750. /* Copies the binary name from after last slash */
  751. for (i=0; (ch = *(name++)) != '\0';) {
  752. if (ch == '/')
  753. i = 0; /* overwrite what we wrote */
  754. else
  755. if (i < (sizeof(tcomm) - 1))
  756. tcomm[i++] = ch;
  757. }
  758. tcomm[i] = '\0';
  759. set_task_comm(current, tcomm);
  760. current->flags &= ~PF_RANDOMIZE;
  761. flush_thread();
  762. /* Set the new mm task size. We have to do that late because it may
  763. * depend on TIF_32BIT which is only updated in flush_thread() on
  764. * some architectures like powerpc
  765. */
  766. current->mm->task_size = TASK_SIZE;
  767. if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
  768. file_permission(bprm->file, MAY_READ) ||
  769. (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
  770. suid_keys(current);
  771. current->mm->dumpable = suid_dumpable;
  772. }
  773. /* An exec changes our domain. We are no longer part of the thread
  774. group */
  775. current->self_exec_id++;
  776. flush_signal_handlers(current, 0);
  777. flush_old_files(current->files);
  778. return 0;
  779. mmap_failed:
  780. reset_files_struct(current, files);
  781. out:
  782. return retval;
  783. }
  784. EXPORT_SYMBOL(flush_old_exec);
  785. /*
  786. * Fill the binprm structure from the inode.
  787. * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
  788. */
  789. int prepare_binprm(struct linux_binprm *bprm)
  790. {
  791. int mode;
  792. struct inode * inode = bprm->file->f_path.dentry->d_inode;
  793. int retval;
  794. mode = inode->i_mode;
  795. if (bprm->file->f_op == NULL)
  796. return -EACCES;
  797. bprm->e_uid = current->euid;
  798. bprm->e_gid = current->egid;
  799. if(!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
  800. /* Set-uid? */
  801. if (mode & S_ISUID) {
  802. current->personality &= ~PER_CLEAR_ON_SETID;
  803. bprm->e_uid = inode->i_uid;
  804. }
  805. /* Set-gid? */
  806. /*
  807. * If setgid is set but no group execute bit then this
  808. * is a candidate for mandatory locking, not a setgid
  809. * executable.
  810. */
  811. if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
  812. current->personality &= ~PER_CLEAR_ON_SETID;
  813. bprm->e_gid = inode->i_gid;
  814. }
  815. }
  816. /* fill in binprm security blob */
  817. retval = security_bprm_set(bprm);
  818. if (retval)
  819. return retval;
  820. memset(bprm->buf,0,BINPRM_BUF_SIZE);
  821. return kernel_read(bprm->file,0,bprm->buf,BINPRM_BUF_SIZE);
  822. }
  823. EXPORT_SYMBOL(prepare_binprm);
  824. static int unsafe_exec(struct task_struct *p)
  825. {
  826. int unsafe = 0;
  827. if (p->ptrace & PT_PTRACED) {
  828. if (p->ptrace & PT_PTRACE_CAP)
  829. unsafe |= LSM_UNSAFE_PTRACE_CAP;
  830. else
  831. unsafe |= LSM_UNSAFE_PTRACE;
  832. }
  833. if (atomic_read(&p->fs->count) > 1 ||
  834. atomic_read(&p->files->count) > 1 ||
  835. atomic_read(&p->sighand->count) > 1)
  836. unsafe |= LSM_UNSAFE_SHARE;
  837. return unsafe;
  838. }
  839. void compute_creds(struct linux_binprm *bprm)
  840. {
  841. int unsafe;
  842. if (bprm->e_uid != current->uid)
  843. suid_keys(current);
  844. exec_keys(current);
  845. task_lock(current);
  846. unsafe = unsafe_exec(current);
  847. security_bprm_apply_creds(bprm, unsafe);
  848. task_unlock(current);
  849. security_bprm_post_apply_creds(bprm);
  850. }
  851. EXPORT_SYMBOL(compute_creds);
  852. void remove_arg_zero(struct linux_binprm *bprm)
  853. {
  854. if (bprm->argc) {
  855. unsigned long offset;
  856. char * kaddr;
  857. struct page *page;
  858. offset = bprm->p % PAGE_SIZE;
  859. goto inside;
  860. while (bprm->p++, *(kaddr+offset++)) {
  861. if (offset != PAGE_SIZE)
  862. continue;
  863. offset = 0;
  864. kunmap_atomic(kaddr, KM_USER0);
  865. inside:
  866. page = bprm->page[bprm->p/PAGE_SIZE];
  867. kaddr = kmap_atomic(page, KM_USER0);
  868. }
  869. kunmap_atomic(kaddr, KM_USER0);
  870. bprm->argc--;
  871. }
  872. }
  873. EXPORT_SYMBOL(remove_arg_zero);
  874. /*
  875. * cycle the list of binary formats handler, until one recognizes the image
  876. */
  877. int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  878. {
  879. int try,retval;
  880. struct linux_binfmt *fmt;
  881. #ifdef __alpha__
  882. /* handle /sbin/loader.. */
  883. {
  884. struct exec * eh = (struct exec *) bprm->buf;
  885. if (!bprm->loader && eh->fh.f_magic == 0x183 &&
  886. (eh->fh.f_flags & 0x3000) == 0x3000)
  887. {
  888. struct file * file;
  889. unsigned long loader;
  890. allow_write_access(bprm->file);
  891. fput(bprm->file);
  892. bprm->file = NULL;
  893. loader = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
  894. file = open_exec("/sbin/loader");
  895. retval = PTR_ERR(file);
  896. if (IS_ERR(file))
  897. return retval;
  898. /* Remember if the application is TASO. */
  899. bprm->sh_bang = eh->ah.entry < 0x100000000UL;
  900. bprm->file = file;
  901. bprm->loader = loader;
  902. retval = prepare_binprm(bprm);
  903. if (retval<0)
  904. return retval;
  905. /* should call search_binary_handler recursively here,
  906. but it does not matter */
  907. }
  908. }
  909. #endif
  910. retval = security_bprm_check(bprm);
  911. if (retval)
  912. return retval;
  913. /* kernel module loader fixup */
  914. /* so we don't try to load run modprobe in kernel space. */
  915. set_fs(USER_DS);
  916. retval = audit_bprm(bprm);
  917. if (retval)
  918. return retval;
  919. retval = -ENOENT;
  920. for (try=0; try<2; try++) {
  921. read_lock(&binfmt_lock);
  922. for (fmt = formats ; fmt ; fmt = fmt->next) {
  923. int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
  924. if (!fn)
  925. continue;
  926. if (!try_module_get(fmt->module))
  927. continue;
  928. read_unlock(&binfmt_lock);
  929. retval = fn(bprm, regs);
  930. if (retval >= 0) {
  931. put_binfmt(fmt);
  932. allow_write_access(bprm->file);
  933. if (bprm->file)
  934. fput(bprm->file);
  935. bprm->file = NULL;
  936. current->did_exec = 1;
  937. proc_exec_connector(current);
  938. return retval;
  939. }
  940. read_lock(&binfmt_lock);
  941. put_binfmt(fmt);
  942. if (retval != -ENOEXEC || bprm->mm == NULL)
  943. break;
  944. if (!bprm->file) {
  945. read_unlock(&binfmt_lock);
  946. return retval;
  947. }
  948. }
  949. read_unlock(&binfmt_lock);
  950. if (retval != -ENOEXEC || bprm->mm == NULL) {
  951. break;
  952. #ifdef CONFIG_KMOD
  953. }else{
  954. #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
  955. if (printable(bprm->buf[0]) &&
  956. printable(bprm->buf[1]) &&
  957. printable(bprm->buf[2]) &&
  958. printable(bprm->buf[3]))
  959. break; /* -ENOEXEC */
  960. request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
  961. #endif
  962. }
  963. }
  964. return retval;
  965. }
  966. EXPORT_SYMBOL(search_binary_handler);
  967. /*
  968. * sys_execve() executes a new program.
  969. */
  970. int do_execve(char * filename,
  971. char __user *__user *argv,
  972. char __user *__user *envp,
  973. struct pt_regs * regs)
  974. {
  975. struct linux_binprm *bprm;
  976. struct file *file;
  977. int retval;
  978. int i;
  979. retval = -ENOMEM;
  980. bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
  981. if (!bprm)
  982. goto out_ret;
  983. file = open_exec(filename);
  984. retval = PTR_ERR(file);
  985. if (IS_ERR(file))
  986. goto out_kfree;
  987. sched_exec();
  988. bprm->p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
  989. bprm->file = file;
  990. bprm->filename = filename;
  991. bprm->interp = filename;
  992. bprm->mm = mm_alloc();
  993. retval = -ENOMEM;
  994. if (!bprm->mm)
  995. goto out_file;
  996. retval = init_new_context(current, bprm->mm);
  997. if (retval < 0)
  998. goto out_mm;
  999. bprm->argc = count(argv, bprm->p / sizeof(void *));
  1000. if ((retval = bprm->argc) < 0)
  1001. goto out_mm;
  1002. bprm->envc = count(envp, bprm->p / sizeof(void *));
  1003. if ((retval = bprm->envc) < 0)
  1004. goto out_mm;
  1005. retval = security_bprm_alloc(bprm);
  1006. if (retval)
  1007. goto out;
  1008. retval = prepare_binprm(bprm);
  1009. if (retval < 0)
  1010. goto out;
  1011. retval = copy_strings_kernel(1, &bprm->filename, bprm);
  1012. if (retval < 0)
  1013. goto out;
  1014. bprm->exec = bprm->p;
  1015. retval = copy_strings(bprm->envc, envp, bprm);
  1016. if (retval < 0)
  1017. goto out;
  1018. retval = copy_strings(bprm->argc, argv, bprm);
  1019. if (retval < 0)
  1020. goto out;
  1021. retval = search_binary_handler(bprm,regs);
  1022. if (retval >= 0) {
  1023. free_arg_pages(bprm);
  1024. /* execve success */
  1025. security_bprm_free(bprm);
  1026. acct_update_integrals(current);
  1027. kfree(bprm);
  1028. return retval;
  1029. }
  1030. out:
  1031. /* Something went wrong, return the inode and free the argument pages*/
  1032. for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
  1033. struct page * page = bprm->page[i];
  1034. if (page)
  1035. __free_page(page);
  1036. }
  1037. if (bprm->security)
  1038. security_bprm_free(bprm);
  1039. out_mm:
  1040. if (bprm->mm)
  1041. mmdrop(bprm->mm);
  1042. out_file:
  1043. if (bprm->file) {
  1044. allow_write_access(bprm->file);
  1045. fput(bprm->file);
  1046. }
  1047. out_kfree:
  1048. kfree(bprm);
  1049. out_ret:
  1050. return retval;
  1051. }
  1052. int set_binfmt(struct linux_binfmt *new)
  1053. {
  1054. struct linux_binfmt *old = current->binfmt;
  1055. if (new) {
  1056. if (!try_module_get(new->module))
  1057. return -1;
  1058. }
  1059. current->binfmt = new;
  1060. if (old)
  1061. module_put(old->module);
  1062. return 0;
  1063. }
  1064. EXPORT_SYMBOL(set_binfmt);
  1065. #define CORENAME_MAX_SIZE 64
  1066. /* format_corename will inspect the pattern parameter, and output a
  1067. * name into corename, which must have space for at least
  1068. * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
  1069. */
  1070. static int format_corename(char *corename, const char *pattern, long signr)
  1071. {
  1072. const char *pat_ptr = pattern;
  1073. char *out_ptr = corename;
  1074. char *const out_end = corename + CORENAME_MAX_SIZE;
  1075. int rc;
  1076. int pid_in_pattern = 0;
  1077. int ispipe = 0;
  1078. if (*pattern == '|')
  1079. ispipe = 1;
  1080. /* Repeat as long as we have more pattern to process and more output
  1081. space */
  1082. while (*pat_ptr) {
  1083. if (*pat_ptr != '%') {
  1084. if (out_ptr == out_end)
  1085. goto out;
  1086. *out_ptr++ = *pat_ptr++;
  1087. } else {
  1088. switch (*++pat_ptr) {
  1089. case 0:
  1090. goto out;
  1091. /* Double percent, output one percent */
  1092. case '%':
  1093. if (out_ptr == out_end)
  1094. goto out;
  1095. *out_ptr++ = '%';
  1096. break;
  1097. /* pid */
  1098. case 'p':
  1099. pid_in_pattern = 1;
  1100. rc = snprintf(out_ptr, out_end - out_ptr,
  1101. "%d", current->tgid);
  1102. if (rc > out_end - out_ptr)
  1103. goto out;
  1104. out_ptr += rc;
  1105. break;
  1106. /* uid */
  1107. case 'u':
  1108. rc = snprintf(out_ptr, out_end - out_ptr,
  1109. "%d", current->uid);
  1110. if (rc > out_end - out_ptr)
  1111. goto out;
  1112. out_ptr += rc;
  1113. break;
  1114. /* gid */
  1115. case 'g':
  1116. rc = snprintf(out_ptr, out_end - out_ptr,
  1117. "%d", current->gid);
  1118. if (rc > out_end - out_ptr)
  1119. goto out;
  1120. out_ptr += rc;
  1121. break;
  1122. /* signal that caused the coredump */
  1123. case 's':
  1124. rc = snprintf(out_ptr, out_end - out_ptr,
  1125. "%ld", signr);
  1126. if (rc > out_end - out_ptr)
  1127. goto out;
  1128. out_ptr += rc;
  1129. break;
  1130. /* UNIX time of coredump */
  1131. case 't': {
  1132. struct timeval tv;
  1133. do_gettimeofday(&tv);
  1134. rc = snprintf(out_ptr, out_end - out_ptr,
  1135. "%lu", tv.tv_sec);
  1136. if (rc > out_end - out_ptr)
  1137. goto out;
  1138. out_ptr += rc;
  1139. break;
  1140. }
  1141. /* hostname */
  1142. case 'h':
  1143. down_read(&uts_sem);
  1144. rc = snprintf(out_ptr, out_end - out_ptr,
  1145. "%s", utsname()->nodename);
  1146. up_read(&uts_sem);
  1147. if (rc > out_end - out_ptr)
  1148. goto out;
  1149. out_ptr += rc;
  1150. break;
  1151. /* executable */
  1152. case 'e':
  1153. rc = snprintf(out_ptr, out_end - out_ptr,
  1154. "%s", current->comm);
  1155. if (rc > out_end - out_ptr)
  1156. goto out;
  1157. out_ptr += rc;
  1158. break;
  1159. default:
  1160. break;
  1161. }
  1162. ++pat_ptr;
  1163. }
  1164. }
  1165. /* Backward compatibility with core_uses_pid:
  1166. *
  1167. * If core_pattern does not include a %p (as is the default)
  1168. * and core_uses_pid is set, then .%pid will be appended to
  1169. * the filename. Do not do this for piped commands. */
  1170. if (!ispipe && !pid_in_pattern
  1171. && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
  1172. rc = snprintf(out_ptr, out_end - out_ptr,
  1173. ".%d", current->tgid);
  1174. if (rc > out_end - out_ptr)
  1175. goto out;
  1176. out_ptr += rc;
  1177. }
  1178. out:
  1179. *out_ptr = 0;
  1180. return ispipe;
  1181. }
  1182. static void zap_process(struct task_struct *start)
  1183. {
  1184. struct task_struct *t;
  1185. start->signal->flags = SIGNAL_GROUP_EXIT;
  1186. start->signal->group_stop_count = 0;
  1187. t = start;
  1188. do {
  1189. if (t != current && t->mm) {
  1190. t->mm->core_waiters++;
  1191. sigaddset(&t->pending.signal, SIGKILL);
  1192. signal_wake_up(t, 1);
  1193. }
  1194. } while ((t = next_thread(t)) != start);
  1195. }
  1196. static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
  1197. int exit_code)
  1198. {
  1199. struct task_struct *g, *p;
  1200. unsigned long flags;
  1201. int err = -EAGAIN;
  1202. spin_lock_irq(&tsk->sighand->siglock);
  1203. if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT)) {
  1204. tsk->signal->group_exit_code = exit_code;
  1205. zap_process(tsk);
  1206. err = 0;
  1207. }
  1208. spin_unlock_irq(&tsk->sighand->siglock);
  1209. if (err)
  1210. return err;
  1211. if (atomic_read(&mm->mm_users) == mm->core_waiters + 1)
  1212. goto done;
  1213. rcu_read_lock();
  1214. for_each_process(g) {
  1215. if (g == tsk->group_leader)
  1216. continue;
  1217. p = g;
  1218. do {
  1219. if (p->mm) {
  1220. if (p->mm == mm) {
  1221. /*
  1222. * p->sighand can't disappear, but
  1223. * may be changed by de_thread()
  1224. */
  1225. lock_task_sighand(p, &flags);
  1226. zap_process(p);
  1227. unlock_task_sighand(p, &flags);
  1228. }
  1229. break;
  1230. }
  1231. } while ((p = next_thread(p)) != g);
  1232. }
  1233. rcu_read_unlock();
  1234. done:
  1235. return mm->core_waiters;
  1236. }
  1237. static int coredump_wait(int exit_code)
  1238. {
  1239. struct task_struct *tsk = current;
  1240. struct mm_struct *mm = tsk->mm;
  1241. struct completion startup_done;
  1242. struct completion *vfork_done;
  1243. int core_waiters;
  1244. init_completion(&mm->core_done);
  1245. init_completion(&startup_done);
  1246. mm->core_startup_done = &startup_done;
  1247. core_waiters = zap_threads(tsk, mm, exit_code);
  1248. up_write(&mm->mmap_sem);
  1249. if (unlikely(core_waiters < 0))
  1250. goto fail;
  1251. /*
  1252. * Make sure nobody is waiting for us to release the VM,
  1253. * otherwise we can deadlock when we wait on each other
  1254. */
  1255. vfork_done = tsk->vfork_done;
  1256. if (vfork_done) {
  1257. tsk->vfork_done = NULL;
  1258. complete(vfork_done);
  1259. }
  1260. if (core_waiters)
  1261. wait_for_completion(&startup_done);
  1262. fail:
  1263. BUG_ON(mm->core_waiters);
  1264. return core_waiters;
  1265. }
  1266. int do_coredump(long signr, int exit_code, struct pt_regs * regs)
  1267. {
  1268. char corename[CORENAME_MAX_SIZE + 1];
  1269. struct mm_struct *mm = current->mm;
  1270. struct linux_binfmt * binfmt;
  1271. struct inode * inode;
  1272. struct file * file;
  1273. int retval = 0;
  1274. int fsuid = current->fsuid;
  1275. int flag = 0;
  1276. int ispipe = 0;
  1277. binfmt = current->binfmt;
  1278. if (!binfmt || !binfmt->core_dump)
  1279. goto fail;
  1280. down_write(&mm->mmap_sem);
  1281. if (!mm->dumpable) {
  1282. up_write(&mm->mmap_sem);
  1283. goto fail;
  1284. }
  1285. /*
  1286. * We cannot trust fsuid as being the "true" uid of the
  1287. * process nor do we know its entire history. We only know it
  1288. * was tainted so we dump it as root in mode 2.
  1289. */
  1290. if (mm->dumpable == 2) { /* Setuid core dump mode */
  1291. flag = O_EXCL; /* Stop rewrite attacks */
  1292. current->fsuid = 0; /* Dump root private */
  1293. }
  1294. mm->dumpable = 0;
  1295. retval = coredump_wait(exit_code);
  1296. if (retval < 0)
  1297. goto fail;
  1298. /*
  1299. * Clear any false indication of pending signals that might
  1300. * be seen by the filesystem code called to write the core file.
  1301. */
  1302. clear_thread_flag(TIF_SIGPENDING);
  1303. if (current->signal->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
  1304. goto fail_unlock;
  1305. /*
  1306. * lock_kernel() because format_corename() is controlled by sysctl, which
  1307. * uses lock_kernel()
  1308. */
  1309. lock_kernel();
  1310. ispipe = format_corename(corename, core_pattern, signr);
  1311. unlock_kernel();
  1312. if (ispipe) {
  1313. /* SIGPIPE can happen, but it's just never processed */
  1314. if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
  1315. printk(KERN_INFO "Core dump to %s pipe failed\n",
  1316. corename);
  1317. goto fail_unlock;
  1318. }
  1319. } else
  1320. file = filp_open(corename,
  1321. O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
  1322. 0600);
  1323. if (IS_ERR(file))
  1324. goto fail_unlock;
  1325. inode = file->f_path.dentry->d_inode;
  1326. if (inode->i_nlink > 1)
  1327. goto close_fail; /* multiple links - don't dump */
  1328. if (!ispipe && d_unhashed(file->f_path.dentry))
  1329. goto close_fail;
  1330. /* AK: actually i see no reason to not allow this for named pipes etc.,
  1331. but keep the previous behaviour for now. */
  1332. if (!ispipe && !S_ISREG(inode->i_mode))
  1333. goto close_fail;
  1334. if (!file->f_op)
  1335. goto close_fail;
  1336. if (!file->f_op->write)
  1337. goto close_fail;
  1338. if (!ispipe && do_truncate(file->f_path.dentry, 0, 0, file) != 0)
  1339. goto close_fail;
  1340. retval = binfmt->core_dump(signr, regs, file);
  1341. if (retval)
  1342. current->signal->group_exit_code |= 0x80;
  1343. close_fail:
  1344. filp_close(file, NULL);
  1345. fail_unlock:
  1346. current->fsuid = fsuid;
  1347. complete_all(&mm->core_done);
  1348. fail:
  1349. return retval;
  1350. }