1263 lines · c
1// SPDX-License-Identifier: GPL-2.02#include <linux/slab.h>3#include <linux/file.h>4#include <linux/fdtable.h>5#include <linux/freezer.h>6#include <linux/mm.h>7#include <linux/stat.h>8#include <linux/fcntl.h>9#include <linux/swap.h>10#include <linux/ctype.h>11#include <linux/string.h>12#include <linux/init.h>13#include <linux/pagemap.h>14#include <linux/perf_event.h>15#include <linux/highmem.h>16#include <linux/spinlock.h>17#include <linux/key.h>18#include <linux/personality.h>19#include <linux/binfmts.h>20#include <linux/coredump.h>21#include <linux/sort.h>22#include <linux/sched/coredump.h>23#include <linux/sched/signal.h>24#include <linux/sched/task_stack.h>25#include <linux/utsname.h>26#include <linux/pid_namespace.h>27#include <linux/module.h>28#include <linux/namei.h>29#include <linux/mount.h>30#include <linux/security.h>31#include <linux/syscalls.h>32#include <linux/tsacct_kern.h>33#include <linux/cn_proc.h>34#include <linux/audit.h>35#include <linux/kmod.h>36#include <linux/fsnotify.h>37#include <linux/fs_struct.h>38#include <linux/pipe_fs_i.h>39#include <linux/oom.h>40#include <linux/compat.h>41#include <linux/fs.h>42#include <linux/path.h>43#include <linux/timekeeping.h>44#include <linux/sysctl.h>45#include <linux/elf.h>46 47#include <linux/uaccess.h>48#include <asm/mmu_context.h>49#include <asm/tlb.h>50#include <asm/exec.h>51 52#include <trace/events/task.h>53#include "internal.h"54 55#include <trace/events/sched.h>56 57static bool dump_vma_snapshot(struct coredump_params *cprm);58static void free_vma_snapshot(struct coredump_params *cprm);59 60#define CORE_FILE_NOTE_SIZE_DEFAULT (4*1024*1024)61/* Define a reasonable max cap */62#define CORE_FILE_NOTE_SIZE_MAX (16*1024*1024)63 64static int core_uses_pid;65static unsigned int core_pipe_limit;66static char core_pattern[CORENAME_MAX_SIZE] = "core";67static int core_name_size = CORENAME_MAX_SIZE;68unsigned int core_file_note_size_limit = CORE_FILE_NOTE_SIZE_DEFAULT;69 70struct core_name {71 char *corename;72 int used, size;73};74 75static int expand_corename(struct core_name *cn, int size)76{77 char *corename;78 79 size = kmalloc_size_roundup(size);80 corename = krealloc(cn->corename, size, GFP_KERNEL);81 82 if (!corename)83 return -ENOMEM;84 85 if (size > core_name_size) /* racy but harmless */86 core_name_size = size;87 88 cn->size = size;89 cn->corename = corename;90 return 0;91}92 93static __printf(2, 0) int cn_vprintf(struct core_name *cn, const char *fmt,94 va_list arg)95{96 int free, need;97 va_list arg_copy;98 99again:100 free = cn->size - cn->used;101 102 va_copy(arg_copy, arg);103 need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);104 va_end(arg_copy);105 106 if (need < free) {107 cn->used += need;108 return 0;109 }110 111 if (!expand_corename(cn, cn->size + need - free + 1))112 goto again;113 114 return -ENOMEM;115}116 117static __printf(2, 3) int cn_printf(struct core_name *cn, const char *fmt, ...)118{119 va_list arg;120 int ret;121 122 va_start(arg, fmt);123 ret = cn_vprintf(cn, fmt, arg);124 va_end(arg);125 126 return ret;127}128 129static __printf(2, 3)130int cn_esc_printf(struct core_name *cn, const char *fmt, ...)131{132 int cur = cn->used;133 va_list arg;134 int ret;135 136 va_start(arg, fmt);137 ret = cn_vprintf(cn, fmt, arg);138 va_end(arg);139 140 if (ret == 0) {141 /*142 * Ensure that this coredump name component can't cause the143 * resulting corefile path to consist of a ".." or ".".144 */145 if ((cn->used - cur == 1 && cn->corename[cur] == '.') ||146 (cn->used - cur == 2 && cn->corename[cur] == '.'147 && cn->corename[cur+1] == '.'))148 cn->corename[cur] = '!';149 150 /*151 * Empty names are fishy and could be used to create a "//" in a152 * corefile name, causing the coredump to happen one directory153 * level too high. Enforce that all components of the core154 * pattern are at least one character long.155 */156 if (cn->used == cur)157 ret = cn_printf(cn, "!");158 }159 160 for (; cur < cn->used; ++cur) {161 if (cn->corename[cur] == '/')162 cn->corename[cur] = '!';163 }164 return ret;165}166 167static int cn_print_exe_file(struct core_name *cn, bool name_only)168{169 struct file *exe_file;170 char *pathbuf, *path, *ptr;171 int ret;172 173 exe_file = get_mm_exe_file(current->mm);174 if (!exe_file)175 return cn_esc_printf(cn, "%s (path unknown)", current->comm);176 177 pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);178 if (!pathbuf) {179 ret = -ENOMEM;180 goto put_exe_file;181 }182 183 path = file_path(exe_file, pathbuf, PATH_MAX);184 if (IS_ERR(path)) {185 ret = PTR_ERR(path);186 goto free_buf;187 }188 189 if (name_only) {190 ptr = strrchr(path, '/');191 if (ptr)192 path = ptr + 1;193 }194 ret = cn_esc_printf(cn, "%s", path);195 196free_buf:197 kfree(pathbuf);198put_exe_file:199 fput(exe_file);200 return ret;201}202 203/* format_corename will inspect the pattern parameter, and output a204 * name into corename, which must have space for at least205 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.206 */207static HWJS_SUSPENDS int format_corename(struct core_name *cn, struct coredump_params *cprm,208 size_t **argv, int *argc)209{210 const struct cred *cred = current_cred();211 const char *pat_ptr = core_pattern;212 int ispipe = (*pat_ptr == '|');213 bool was_space = false;214 int pid_in_pattern = 0;215 int err = 0;216 217 cn->used = 0;218 cn->corename = NULL;219 if (expand_corename(cn, core_name_size))220 return -ENOMEM;221 cn->corename[0] = '\0';222 223 if (ispipe) {224 int argvs = sizeof(core_pattern) / 2;225 (*argv) = kmalloc_array(argvs, sizeof(**argv), GFP_KERNEL);226 if (!(*argv))227 return -ENOMEM;228 (*argv)[(*argc)++] = 0;229 ++pat_ptr;230 if (!(*pat_ptr))231 return -ENOMEM;232 }233 234 /* Repeat as long as we have more pattern to process and more output235 space */236 while (*pat_ptr) {237 /*238 * Split on spaces before doing template expansion so that239 * %e and %E don't get split if they have spaces in them240 */241 if (ispipe) {242 if (isspace(*pat_ptr)) {243 if (cn->used != 0)244 was_space = true;245 pat_ptr++;246 continue;247 } else if (was_space) {248 was_space = false;249 err = cn_printf(cn, "%c", '\0');250 if (err)251 return err;252 (*argv)[(*argc)++] = cn->used;253 }254 }255 if (*pat_ptr != '%') {256 err = cn_printf(cn, "%c", *pat_ptr++);257 } else {258 switch (*++pat_ptr) {259 /* single % at the end, drop that */260 case 0:261 goto out;262 /* Double percent, output one percent */263 case '%':264 err = cn_printf(cn, "%c", '%');265 break;266 /* pid */267 case 'p':268 pid_in_pattern = 1;269 err = cn_printf(cn, "%d",270 task_tgid_vnr(current));271 break;272 /* global pid */273 case 'P':274 err = cn_printf(cn, "%d",275 task_tgid_nr(current));276 break;277 case 'i':278 err = cn_printf(cn, "%d",279 task_pid_vnr(current));280 break;281 case 'I':282 err = cn_printf(cn, "%d",283 task_pid_nr(current));284 break;285 /* uid */286 case 'u':287 err = cn_printf(cn, "%u",288 from_kuid(&init_user_ns,289 cred->uid));290 break;291 /* gid */292 case 'g':293 err = cn_printf(cn, "%u",294 from_kgid(&init_user_ns,295 cred->gid));296 break;297 case 'd':298 err = cn_printf(cn, "%d",299 __get_dumpable(cprm->mm_flags));300 break;301 /* signal that caused the coredump */302 case 's':303 err = cn_printf(cn, "%d",304 cprm->siginfo->si_signo);305 break;306 /* UNIX time of coredump */307 case 't': {308 time64_t time;309 310 time = ktime_get_real_seconds();311 err = cn_printf(cn, "%lld", time);312 break;313 }314 /* hostname */315 case 'h':316 down_read(&uts_sem);317 err = cn_esc_printf(cn, "%s",318 utsname()->nodename);319 up_read(&uts_sem);320 break;321 /* executable, could be changed by prctl PR_SET_NAME etc */322 case 'e':323 err = cn_esc_printf(cn, "%s", current->comm);324 break;325 /* file name of executable */326 case 'f':327 err = cn_print_exe_file(cn, true);328 break;329 case 'E':330 err = cn_print_exe_file(cn, false);331 break;332 /* core limit size */333 case 'c':334 err = cn_printf(cn, "%lu",335 rlimit(RLIMIT_CORE));336 break;337 /* CPU the task ran on */338 case 'C':339 err = cn_printf(cn, "%d", cprm->cpu);340 break;341 default:342 break;343 }344 ++pat_ptr;345 }346 347 if (err)348 return err;349 }350 351out:352 /* Backward compatibility with core_uses_pid:353 *354 * If core_pattern does not include a %p (as is the default)355 * and core_uses_pid is set, then .%pid will be appended to356 * the filename. Do not do this for piped commands. */357 if (!ispipe && !pid_in_pattern && core_uses_pid) {358 err = cn_printf(cn, ".%d", task_tgid_vnr(current));359 if (err)360 return err;361 }362 return ispipe;363}364 365static HWJS_SUSPENDS int zap_process(struct signal_struct *signal, int exit_code)366{367 struct task_struct *t;368 int nr = 0;369 370 signal->flags = SIGNAL_GROUP_EXIT;371 signal->group_exit_code = exit_code;372 signal->group_stop_count = 0;373 374 __for_each_thread(signal, t) {375 task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK);376 if (t != current && !(t->flags & PF_POSTCOREDUMP)) {377 sigaddset(&t->pending.signal, SIGKILL);378 signal_wake_up(t, 1);379 nr++;380 }381 }382 383 return nr;384}385 386static HWJS_SUSPENDS int zap_threads(struct task_struct *tsk,387 struct core_state *core_state, int exit_code)388{389 struct signal_struct *signal = tsk->signal;390 int nr = -EAGAIN;391 392 spin_lock_irq(&tsk->sighand->siglock);393 if (!(signal->flags & SIGNAL_GROUP_EXIT) && !signal->group_exec_task) {394 /* Allow SIGKILL, see prepare_signal() */395 signal->core_state = core_state;396 nr = zap_process(signal, exit_code);397 clear_tsk_thread_flag(tsk, TIF_SIGPENDING);398 tsk->flags |= PF_DUMPCORE;399 atomic_set(&core_state->nr_threads, nr);400 }401 spin_unlock_irq(&tsk->sighand->siglock);402 return nr;403}404 405static HWJS_SUSPENDS int coredump_wait(int exit_code, struct core_state *core_state)406{407 struct task_struct *tsk = current;408 int core_waiters = -EBUSY;409 410 init_completion(&core_state->startup);411 core_state->dumper.task = tsk;412 core_state->dumper.next = NULL;413 414 core_waiters = zap_threads(tsk, core_state, exit_code);415 if (core_waiters > 0) {416 struct core_thread *ptr;417 418 wait_for_completion_state(&core_state->startup,419 TASK_UNINTERRUPTIBLE|TASK_FREEZABLE);420 /*421 * Wait for all the threads to become inactive, so that422 * all the thread context (extended register state, like423 * fpu etc) gets copied to the memory.424 */425 ptr = core_state->dumper.next;426 while (ptr != NULL) {427 wait_task_inactive(ptr->task, TASK_ANY);428 ptr = ptr->next;429 }430 }431 432 return core_waiters;433}434 435static HWJS_SUSPENDS void coredump_finish(bool core_dumped)436{437 struct core_thread *curr, *next;438 struct task_struct *task;439 440 spin_lock_irq(¤t->sighand->siglock);441 if (core_dumped && !__fatal_signal_pending(current))442 current->signal->group_exit_code |= 0x80;443 next = current->signal->core_state->dumper.next;444 current->signal->core_state = NULL;445 spin_unlock_irq(¤t->sighand->siglock);446 447 while ((curr = next) != NULL) {448 next = curr->next;449 task = curr->task;450 /*451 * see coredump_task_exit(), curr->task must not see452 * ->task == NULL before we read ->next.453 */454 smp_mb();455 curr->task = NULL;456 wake_up_process(task);457 }458}459 460static bool dump_interrupted(void)461{462 /*463 * SIGKILL or freezing() interrupt the coredumping. Perhaps we464 * can do try_to_freeze() and check __fatal_signal_pending(),465 * but then we need to teach dump_write() to restart and clear466 * TIF_SIGPENDING.467 */468 return fatal_signal_pending(current) || freezing(current);469}470 471static HWJS_SUSPENDS void wait_for_dump_helpers(struct file *file)472{473 struct pipe_inode_info *pipe = file->private_data;474 475 pipe_lock(pipe);476 pipe->readers++;477 pipe->writers--;478 wake_up_interruptible_sync(&pipe->rd_wait);479 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);480 pipe_unlock(pipe);481 482 /*483 * We actually want wait_event_freezable() but then we need484 * to clear TIF_SIGPENDING and improve dump_interrupted().485 */486 wait_event_interruptible(pipe->rd_wait, pipe->readers == 1);487 488 pipe_lock(pipe);489 pipe->readers--;490 pipe->writers++;491 pipe_unlock(pipe);492}493 494/*495 * umh_pipe_setup496 * helper function to customize the process used497 * to collect the core in userspace. Specifically498 * it sets up a pipe and installs it as fd 0 (stdin)499 * for the process. Returns 0 on success, or500 * PTR_ERR on failure.501 * Note that it also sets the core limit to 1. This502 * is a special value that we use to trap recursive503 * core dumps504 */505static HWJS_SUSPENDS int umh_pipe_setup(struct subprocess_info *info, struct cred *new)506{507 struct file *files[2];508 struct coredump_params *cp = (struct coredump_params *)info->data;509 int err = create_pipe_files(files, 0);510 if (err)511 return err;512 513 cp->file = files[1];514 515 err = replace_fd(0, files[0], 0);516 fput(files[0]);517 /* and disallow core files too */518 current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};519 520 return err;521}522 523void do_coredump(const kernel_siginfo_t *siginfo)524{525 struct core_state core_state;526 struct core_name cn;527 struct mm_struct *mm = current->mm;528 struct linux_binfmt * binfmt;529 const struct cred *old_cred;530 struct cred *cred;531 int retval = 0;532 int ispipe;533 size_t *argv = NULL;534 int argc = 0;535 /* require nonrelative corefile path and be extra careful */536 bool need_suid_safe = false;537 bool core_dumped = false;538 static atomic_t core_dump_count = ATOMIC_INIT(0);539 struct coredump_params cprm = {540 .siginfo = siginfo,541 .limit = rlimit(RLIMIT_CORE),542 /*543 * We must use the same mm->flags while dumping core to avoid544 * inconsistency of bit flags, since this flag is not protected545 * by any locks.546 */547 .mm_flags = mm->flags,548 .vma_meta = NULL,549 .cpu = raw_smp_processor_id(),550 };551 552 audit_core_dumps(siginfo->si_signo);553 554 binfmt = mm->binfmt;555 if (!binfmt || !binfmt->core_dump)556 goto fail;557 if (!__get_dumpable(cprm.mm_flags))558 goto fail;559 560 cred = prepare_creds();561 if (!cred)562 goto fail;563 /*564 * We cannot trust fsuid as being the "true" uid of the process565 * nor do we know its entire history. We only know it was tainted566 * so we dump it as root in mode 2, and only into a controlled567 * environment (pipe handler or fully qualified path).568 */569 if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {570 /* Setuid core dump mode */571 cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */572 need_suid_safe = true;573 }574 575 retval = coredump_wait(siginfo->si_signo, &core_state);576 if (retval < 0)577 goto fail_creds;578 579 old_cred = override_creds(cred);580 581 ispipe = format_corename(&cn, &cprm, &argv, &argc);582 583 if (ispipe) {584 int argi;585 int dump_count;586 char **helper_argv;587 struct subprocess_info *sub_info;588 589 if (ispipe < 0) {590 coredump_report_failure("format_corename failed, aborting core");591 goto fail_unlock;592 }593 594 if (cprm.limit == 1) {595 /* See umh_pipe_setup() which sets RLIMIT_CORE = 1.596 *597 * Normally core limits are irrelevant to pipes, since598 * we're not writing to the file system, but we use599 * cprm.limit of 1 here as a special value, this is a600 * consistent way to catch recursive crashes.601 * We can still crash if the core_pattern binary sets602 * RLIM_CORE = !1, but it runs as root, and can do603 * lots of stupid things.604 *605 * Note that we use task_tgid_vnr here to grab the pid606 * of the process group leader. That way we get the607 * right pid if a thread in a multi-threaded608 * core_pattern process dies.609 */610 coredump_report_failure("RLIMIT_CORE is set to 1, aborting core");611 goto fail_unlock;612 }613 cprm.limit = RLIM_INFINITY;614 615 dump_count = atomic_inc_return(&core_dump_count);616 if (core_pipe_limit && (core_pipe_limit < dump_count)) {617 coredump_report_failure("over core_pipe_limit, skipping core dump");618 goto fail_dropcount;619 }620 621 helper_argv = kmalloc_array(argc + 1, sizeof(*helper_argv),622 GFP_KERNEL);623 if (!helper_argv) {624 coredump_report_failure("%s failed to allocate memory", __func__);625 goto fail_dropcount;626 }627 for (argi = 0; argi < argc; argi++)628 helper_argv[argi] = cn.corename + argv[argi];629 helper_argv[argi] = NULL;630 631 retval = -ENOMEM;632 sub_info = call_usermodehelper_setup(helper_argv[0],633 helper_argv, NULL, GFP_KERNEL,634 umh_pipe_setup, NULL, &cprm);635 if (sub_info)636 retval = call_usermodehelper_exec(sub_info,637 UMH_WAIT_EXEC);638 639 kfree(helper_argv);640 if (retval) {641 coredump_report_failure("|%s pipe failed", cn.corename);642 goto close_fail;643 }644 } else {645 struct mnt_idmap *idmap;646 struct inode *inode;647 int open_flags = O_CREAT | O_WRONLY | O_NOFOLLOW |648 O_LARGEFILE | O_EXCL;649 650 if (cprm.limit < binfmt->min_coredump)651 goto fail_unlock;652 653 if (need_suid_safe && cn.corename[0] != '/') {654 coredump_report_failure(655 "this process can only dump core to a fully qualified path, skipping core dump");656 goto fail_unlock;657 }658 659 /*660 * Unlink the file if it exists unless this is a SUID661 * binary - in that case, we're running around with root662 * privs and don't want to unlink another user's coredump.663 */664 if (!need_suid_safe) {665 /*666 * If it doesn't exist, that's fine. If there's some667 * other problem, we'll catch it at the filp_open().668 */669 do_unlinkat(AT_FDCWD, getname_kernel(cn.corename));670 }671 672 /*673 * There is a race between unlinking and creating the674 * file, but if that causes an EEXIST here, that's675 * fine - another process raced with us while creating676 * the corefile, and the other process won. To userspace,677 * what matters is that at least one of the two processes678 * writes its coredump successfully, not which one.679 */680 if (need_suid_safe) {681 /*682 * Using user namespaces, normal user tasks can change683 * their current->fs->root to point to arbitrary684 * directories. Since the intention of the "only dump685 * with a fully qualified path" rule is to control where686 * coredumps may be placed using root privileges,687 * current->fs->root must not be used. Instead, use the688 * root directory of init_task.689 */690 struct path root;691 692 task_lock(&init_task);693 get_fs_root(init_task.fs, &root);694 task_unlock(&init_task);695 cprm.file = file_open_root(&root, cn.corename,696 open_flags, 0600);697 path_put(&root);698 } else {699 cprm.file = filp_open(cn.corename, open_flags, 0600);700 }701 if (IS_ERR(cprm.file))702 goto fail_unlock;703 704 inode = file_inode(cprm.file);705 if (inode->i_nlink > 1)706 goto close_fail;707 if (d_unhashed(cprm.file->f_path.dentry))708 goto close_fail;709 /*710 * AK: actually i see no reason to not allow this for named711 * pipes etc, but keep the previous behaviour for now.712 */713 if (!S_ISREG(inode->i_mode))714 goto close_fail;715 /*716 * Don't dump core if the filesystem changed owner or mode717 * of the file during file creation. This is an issue when718 * a process dumps core while its cwd is e.g. on a vfat719 * filesystem.720 */721 idmap = file_mnt_idmap(cprm.file);722 if (!vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode),723 current_fsuid())) {724 coredump_report_failure("Core dump to %s aborted: "725 "cannot preserve file owner", cn.corename);726 goto close_fail;727 }728 if ((inode->i_mode & 0677) != 0600) {729 coredump_report_failure("Core dump to %s aborted: "730 "cannot preserve file permissions", cn.corename);731 goto close_fail;732 }733 if (!(cprm.file->f_mode & FMODE_CAN_WRITE))734 goto close_fail;735 if (do_truncate(idmap, cprm.file->f_path.dentry,736 0, 0, cprm.file))737 goto close_fail;738 }739 740 /* get us an unshared descriptor table; almost always a no-op */741 /* The cell spufs coredump code reads the file descriptor tables */742 retval = unshare_files();743 if (retval)744 goto close_fail;745 if (!dump_interrupted()) {746 /*747 * umh disabled with CONFIG_STATIC_USERMODEHELPER_PATH="" would748 * have this set to NULL.749 */750 if (!cprm.file) {751 coredump_report_failure("Core dump to |%s disabled", cn.corename);752 goto close_fail;753 }754 if (!dump_vma_snapshot(&cprm))755 goto close_fail;756 757 file_start_write(cprm.file);758 core_dumped = binfmt->core_dump(&cprm);759 /*760 * Ensures that file size is big enough to contain the current761 * file postion. This prevents gdb from complaining about762 * a truncated file if the last "write" to the file was763 * dump_skip.764 */765 if (cprm.to_skip) {766 cprm.to_skip--;767 dump_emit(&cprm, "", 1);768 }769 file_end_write(cprm.file);770 free_vma_snapshot(&cprm);771 }772 if (ispipe && core_pipe_limit)773 wait_for_dump_helpers(cprm.file);774close_fail:775 if (cprm.file)776 filp_close(cprm.file, NULL);777fail_dropcount:778 if (ispipe)779 atomic_dec(&core_dump_count);780fail_unlock:781 kfree(argv);782 kfree(cn.corename);783 coredump_finish(core_dumped);784 revert_creds(old_cred);785fail_creds:786 put_cred(cred);787fail:788 return;789}790 791/*792 * Core dumping helper functions. These are the only things you should793 * do on a core-file: use only these functions to write out all the794 * necessary info.795 */796static int __dump_emit(struct coredump_params *cprm, const void *addr, int nr)797{798 struct file *file = cprm->file;799 loff_t pos = file->f_pos;800 ssize_t n;801 if (cprm->written + nr > cprm->limit)802 return 0;803 804 805 if (dump_interrupted())806 return 0;807 n = __kernel_write(file, addr, nr, &pos);808 if (n != nr)809 return 0;810 file->f_pos = pos;811 cprm->written += n;812 cprm->pos += n;813 814 return 1;815}816 817static int __dump_skip(struct coredump_params *cprm, size_t nr)818{819 static char zeroes[PAGE_SIZE];820 struct file *file = cprm->file;821 if (file->f_mode & FMODE_LSEEK) {822 if (dump_interrupted() ||823 vfs_llseek(file, nr, SEEK_CUR) < 0)824 return 0;825 cprm->pos += nr;826 return 1;827 } else {828 while (nr > PAGE_SIZE) {829 if (!__dump_emit(cprm, zeroes, PAGE_SIZE))830 return 0;831 nr -= PAGE_SIZE;832 }833 return __dump_emit(cprm, zeroes, nr);834 }835}836 837int dump_emit(struct coredump_params *cprm, const void *addr, int nr)838{839 if (cprm->to_skip) {840 if (!__dump_skip(cprm, cprm->to_skip))841 return 0;842 cprm->to_skip = 0;843 }844 return __dump_emit(cprm, addr, nr);845}846EXPORT_SYMBOL(dump_emit);847 848void dump_skip_to(struct coredump_params *cprm, unsigned long pos)849{850 cprm->to_skip = pos - cprm->pos;851}852EXPORT_SYMBOL(dump_skip_to);853 854void dump_skip(struct coredump_params *cprm, size_t nr)855{856 cprm->to_skip += nr;857}858EXPORT_SYMBOL(dump_skip);859 860#ifdef CONFIG_ELF_CORE861static int dump_emit_page(struct coredump_params *cprm, struct page *page)862{863 struct bio_vec bvec;864 struct iov_iter iter;865 struct file *file = cprm->file;866 loff_t pos;867 ssize_t n;868 869 if (!page)870 return 0;871 872 if (cprm->to_skip) {873 if (!__dump_skip(cprm, cprm->to_skip))874 return 0;875 cprm->to_skip = 0;876 }877 if (cprm->written + PAGE_SIZE > cprm->limit)878 return 0;879 if (dump_interrupted())880 return 0;881 pos = file->f_pos;882 bvec_set_page(&bvec, page, PAGE_SIZE, 0);883 iov_iter_bvec(&iter, ITER_SOURCE, &bvec, 1, PAGE_SIZE);884 n = __kernel_write_iter(cprm->file, &iter, &pos);885 if (n != PAGE_SIZE)886 return 0;887 file->f_pos = pos;888 cprm->written += PAGE_SIZE;889 cprm->pos += PAGE_SIZE;890 891 return 1;892}893 894/*895 * If we might get machine checks from kernel accesses during the896 * core dump, let's get those errors early rather than during the897 * IO. This is not performance-critical enough to warrant having898 * all the machine check logic in the iovec paths.899 */900#ifdef copy_mc_to_kernel901 902#define dump_page_alloc() alloc_page(GFP_KERNEL)903#define dump_page_free(x) __free_page(x)904static struct page *dump_page_copy(struct page *src, struct page *dst)905{906 void *buf = kmap_local_page(src);907 size_t left = copy_mc_to_kernel(page_address(dst), buf, PAGE_SIZE);908 kunmap_local(buf);909 return left ? NULL : dst;910}911 912#else913 914/* We just want to return non-NULL; it's never used. */915#define dump_page_alloc() ERR_PTR(-EINVAL)916#define dump_page_free(x) ((void)(x))917static inline struct page *dump_page_copy(struct page *src, struct page *dst)918{919 return src;920}921#endif922 923int dump_user_range(struct coredump_params *cprm, unsigned long start,924 unsigned long len)925{926 unsigned long addr;927 struct page *dump_page;928 929 dump_page = dump_page_alloc();930 if (!dump_page)931 return 0;932 933 for (addr = start; addr < start + len; addr += PAGE_SIZE) {934 struct page *page;935 936 /*937 * To avoid having to allocate page tables for virtual address938 * ranges that have never been used yet, and also to make it939 * easy to generate sparse core files, use a helper that returns940 * NULL when encountering an empty page table entry that would941 * otherwise have been filled with the zero page.942 */943 page = get_dump_page(addr);944 if (page) {945 int stop = !dump_emit_page(cprm, dump_page_copy(page, dump_page));946 put_page(page);947 if (stop) {948 dump_page_free(dump_page);949 return 0;950 }951 } else {952 dump_skip(cprm, PAGE_SIZE);953 }954 }955 dump_page_free(dump_page);956 return 1;957}958#endif959 960int dump_align(struct coredump_params *cprm, int align)961{962 unsigned mod = (cprm->pos + cprm->to_skip) & (align - 1);963 if (align & (align - 1))964 return 0;965 if (mod)966 cprm->to_skip += align - mod;967 return 1;968}969EXPORT_SYMBOL(dump_align);970 971#ifdef CONFIG_SYSCTL972 973void validate_coredump_safety(void)974{975 if (suid_dumpable == SUID_DUMP_ROOT &&976 core_pattern[0] != '/' && core_pattern[0] != '|') {977 978 coredump_report_failure("Unsafe core_pattern used with fs.suid_dumpable=2: "979 "pipe handler or fully qualified core dump path required. "980 "Set kernel.core_pattern before fs.suid_dumpable.");981 }982}983 984static int proc_dostring_coredump(const struct ctl_table *table, int write,985 void *buffer, size_t *lenp, loff_t *ppos)986{987 int error = proc_dostring(table, write, buffer, lenp, ppos);988 989 if (!error)990 validate_coredump_safety();991 return error;992}993 994static const unsigned int core_file_note_size_min = CORE_FILE_NOTE_SIZE_DEFAULT;995static const unsigned int core_file_note_size_max = CORE_FILE_NOTE_SIZE_MAX;996 997static struct ctl_table coredump_sysctls[] = {998 {999 .procname = "core_uses_pid",1000 .data = &core_uses_pid,1001 .maxlen = sizeof(int),1002 .mode = 0644,1003 .proc_handler = proc_dointvec,1004 },1005 {1006 .procname = "core_pattern",1007 .data = core_pattern,1008 .maxlen = CORENAME_MAX_SIZE,1009 .mode = 0644,1010 .proc_handler = proc_dostring_coredump,1011 },1012 {1013 .procname = "core_pipe_limit",1014 .data = &core_pipe_limit,1015 .maxlen = sizeof(unsigned int),1016 .mode = 0644,1017 .proc_handler = proc_dointvec,1018 },1019 {1020 .procname = "core_file_note_size_limit",1021 .data = &core_file_note_size_limit,1022 .maxlen = sizeof(unsigned int),1023 .mode = 0644,1024 .proc_handler = proc_douintvec_minmax,1025 .extra1 = (unsigned int *)&core_file_note_size_min,1026 .extra2 = (unsigned int *)&core_file_note_size_max,1027 },1028};1029 1030static int __init init_fs_coredump_sysctls(void)1031{1032 register_sysctl_init("kernel", coredump_sysctls);1033 return 0;1034}1035fs_initcall(init_fs_coredump_sysctls);1036#endif /* CONFIG_SYSCTL */1037 1038/*1039 * The purpose of always_dump_vma() is to make sure that special kernel mappings1040 * that are useful for post-mortem analysis are included in every core dump.1041 * In that way we ensure that the core dump is fully interpretable later1042 * without matching up the same kernel and hardware config to see what PC values1043 * meant. These special mappings include - vDSO, vsyscall, and other1044 * architecture specific mappings1045 */1046static bool always_dump_vma(struct vm_area_struct *vma)1047{1048 /* Any vsyscall mappings? */1049 if (vma == get_gate_vma(vma->vm_mm))1050 return true;1051 1052 /*1053 * Assume that all vmas with a .name op should always be dumped.1054 * If this changes, a new vm_ops field can easily be added.1055 */1056 if (vma->vm_ops && vma->vm_ops->name && vma->vm_ops->name(vma))1057 return true;1058 1059 /*1060 * arch_vma_name() returns non-NULL for special architecture mappings,1061 * such as vDSO sections.1062 */1063 if (arch_vma_name(vma))1064 return true;1065 1066 return false;1067}1068 1069#define DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER 11070 1071/*1072 * Decide how much of @vma's contents should be included in a core dump.1073 */1074static unsigned long vma_dump_size(struct vm_area_struct *vma,1075 unsigned long mm_flags)1076{1077#define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))1078 1079 /* always dump the vdso and vsyscall sections */1080 if (always_dump_vma(vma))1081 goto whole;1082 1083 if (vma->vm_flags & VM_DONTDUMP)1084 return 0;1085 1086 /* support for DAX */1087 if (vma_is_dax(vma)) {1088 if ((vma->vm_flags & VM_SHARED) && FILTER(DAX_SHARED))1089 goto whole;1090 if (!(vma->vm_flags & VM_SHARED) && FILTER(DAX_PRIVATE))1091 goto whole;1092 return 0;1093 }1094 1095 /* Hugetlb memory check */1096 if (is_vm_hugetlb_page(vma)) {1097 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))1098 goto whole;1099 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))1100 goto whole;1101 return 0;1102 }1103 1104 /* Do not dump I/O mapped devices or special mappings */1105 if (vma->vm_flags & VM_IO)1106 return 0;1107 1108 /* By default, dump shared memory if mapped from an anonymous file. */1109 if (vma->vm_flags & VM_SHARED) {1110 if (file_inode(vma->vm_file)->i_nlink == 0 ?1111 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))1112 goto whole;1113 return 0;1114 }1115 1116 /* Dump segments that have been written to. */1117 if ((!IS_ENABLED(CONFIG_MMU) || vma->anon_vma) && FILTER(ANON_PRIVATE))1118 goto whole;1119 if (vma->vm_file == NULL)1120 return 0;1121 1122 if (FILTER(MAPPED_PRIVATE))1123 goto whole;1124 1125 /*1126 * If this is the beginning of an executable file mapping,1127 * dump the first page to aid in determining what was mapped here.1128 */1129 if (FILTER(ELF_HEADERS) &&1130 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {1131 if ((READ_ONCE(file_inode(vma->vm_file)->i_mode) & 0111) != 0)1132 return PAGE_SIZE;1133 1134 /*1135 * ELF libraries aren't always executable.1136 * We'll want to check whether the mapping starts with the ELF1137 * magic, but not now - we're holding the mmap lock,1138 * so copy_from_user() doesn't work here.1139 * Use a placeholder instead, and fix it up later in1140 * dump_vma_snapshot().1141 */1142 return DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER;1143 }1144 1145#undef FILTER1146 1147 return 0;1148 1149whole:1150 return vma->vm_end - vma->vm_start;1151}1152 1153/*1154 * Helper function for iterating across a vma list. It ensures that the caller1155 * will visit `gate_vma' prior to terminating the search.1156 */1157static struct vm_area_struct *coredump_next_vma(struct vma_iterator *vmi,1158 struct vm_area_struct *vma,1159 struct vm_area_struct *gate_vma)1160{1161 if (gate_vma && (vma == gate_vma))1162 return NULL;1163 1164 vma = vma_next(vmi);1165 if (vma)1166 return vma;1167 return gate_vma;1168}1169 1170static void free_vma_snapshot(struct coredump_params *cprm)1171{1172 if (cprm->vma_meta) {1173 int i;1174 for (i = 0; i < cprm->vma_count; i++) {1175 struct file *file = cprm->vma_meta[i].file;1176 if (file)1177 fput(file);1178 }1179 kvfree(cprm->vma_meta);1180 cprm->vma_meta = NULL;1181 }1182}1183 1184static int cmp_vma_size(const void *vma_meta_lhs_ptr, const void *vma_meta_rhs_ptr)1185{1186 const struct core_vma_metadata *vma_meta_lhs = vma_meta_lhs_ptr;1187 const struct core_vma_metadata *vma_meta_rhs = vma_meta_rhs_ptr;1188 1189 if (vma_meta_lhs->dump_size < vma_meta_rhs->dump_size)1190 return -1;1191 if (vma_meta_lhs->dump_size > vma_meta_rhs->dump_size)1192 return 1;1193 return 0;1194}1195 1196/*1197 * Under the mmap_lock, take a snapshot of relevant information about the task's1198 * VMAs.1199 */1200static HWJS_SUSPENDS bool dump_vma_snapshot(struct coredump_params *cprm)1201{1202 struct vm_area_struct *gate_vma, *vma = NULL;1203 struct mm_struct *mm = current->mm;1204 VMA_ITERATOR(vmi, mm, 0);1205 int i = 0;1206 1207 /*1208 * Once the stack expansion code is fixed to not change VMA bounds1209 * under mmap_lock in read mode, this can be changed to take the1210 * mmap_lock in read mode.1211 */1212 if (mmap_write_lock_killable(mm))1213 return false;1214 1215 cprm->vma_data_size = 0;1216 gate_vma = get_gate_vma(mm);1217 cprm->vma_count = mm->map_count + (gate_vma ? 1 : 0);1218 1219 cprm->vma_meta = kvmalloc_array(cprm->vma_count, sizeof(*cprm->vma_meta), GFP_KERNEL);1220 if (!cprm->vma_meta) {1221 mmap_write_unlock(mm);1222 return false;1223 }1224 1225 while ((vma = coredump_next_vma(&vmi, vma, gate_vma)) != NULL) {1226 struct core_vma_metadata *m = cprm->vma_meta + i;1227 1228 m->start = vma->vm_start;1229 m->end = vma->vm_end;1230 m->flags = vma->vm_flags;1231 m->dump_size = vma_dump_size(vma, cprm->mm_flags);1232 m->pgoff = vma->vm_pgoff;1233 m->file = vma->vm_file;1234 if (m->file)1235 get_file(m->file);1236 i++;1237 }1238 1239 mmap_write_unlock(mm);1240 1241 for (i = 0; i < cprm->vma_count; i++) {1242 struct core_vma_metadata *m = cprm->vma_meta + i;1243 1244 if (m->dump_size == DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER) {1245 char elfmag[SELFMAG];1246 1247 if (copy_from_user(elfmag, (void __user *)m->start, SELFMAG) ||1248 memcmp(elfmag, ELFMAG, SELFMAG) != 0) {1249 m->dump_size = 0;1250 } else {1251 m->dump_size = PAGE_SIZE;1252 }1253 }1254 1255 cprm->vma_data_size += m->dump_size;1256 }1257 1258 sort(cprm->vma_meta, cprm->vma_count, sizeof(*cprm->vma_meta),1259 cmp_vma_size, NULL);1260 1261 return true;1262}1263