exec.c 30.1 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
/*
 *  linux/fs/exec.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */

/*
 * #!-checking implemented by tytso.
 */
/*
 * Demand-loading implemented 01.12.91 - no need to read anything but
 * the header into memory. The inode of the executable is put into
 * "current->executable", and page faults do the actual loading. Clean.
 *
 * Once more I can proudly say that linux stood up to being changed: it
 * was less than 2 hours work to get demand-loading completely implemented.
 *
 * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
 * current->executable is only used by the procfs.  This allows a dispatch
 * table to check for several different types  of binary formats.  We keep
 * trying until we recognize the file or we run out of supported binary
 * formats. 
 */

#include <linux/config.h>
#include <linux/slab.h>
#include <linux/file.h>
#include <linux/mman.h>
#include <linux/a.out.h>
#include <linux/stat.h>
#include <linux/fcntl.h>
#include <linux/smp_lock.h>
#include <linux/init.h>
#include <linux/pagemap.h>
#include <linux/highmem.h>
#include <linux/spinlock.h>
Linus Torvalds's avatar
Linus Torvalds committed
37
#include <linux/personality.h>
38
#include <linux/binfmts.h>
Andrew Morton's avatar
Andrew Morton committed
39
#include <linux/swap.h>
Alan Cox's avatar
Alan Cox committed
40
#include <linux/utsname.h>
Linus Torvalds's avatar
Linus Torvalds committed
41
#include <linux/module.h>
42
#include <linux/namei.h>
43
#include <linux/proc_fs.h>
44
#include <linux/ptrace.h>
45
#include <linux/mount.h>
46
#include <linux/security.h>
47
#include <linux/rmap-locking.h>
Linus Torvalds's avatar
Linus Torvalds committed
48 49 50 51 52 53 54 55 56

#include <asm/uaccess.h>
#include <asm/pgalloc.h>
#include <asm/mmu_context.h>

#ifdef CONFIG_KMOD
#include <linux/kmod.h>
#endif

Linus Torvalds's avatar
Linus Torvalds committed
57
int core_uses_pid;
Alan Cox's avatar
Alan Cox committed
58 59
char core_pattern[65] = "core";
/* The maximal length of core_pattern is also specified in sysctl.c */ 
Linus Torvalds's avatar
Linus Torvalds committed
60

Linus Torvalds's avatar
Linus Torvalds committed
61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104
static struct linux_binfmt *formats;
static rwlock_t binfmt_lock = RW_LOCK_UNLOCKED;

int register_binfmt(struct linux_binfmt * fmt)
{
	struct linux_binfmt ** tmp = &formats;

	if (!fmt)
		return -EINVAL;
	if (fmt->next)
		return -EBUSY;
	write_lock(&binfmt_lock);
	while (*tmp) {
		if (fmt == *tmp) {
			write_unlock(&binfmt_lock);
			return -EBUSY;
		}
		tmp = &(*tmp)->next;
	}
	fmt->next = formats;
	formats = fmt;
	write_unlock(&binfmt_lock);
	return 0;	
}

int unregister_binfmt(struct linux_binfmt * fmt)
{
	struct linux_binfmt ** tmp = &formats;

	write_lock(&binfmt_lock);
	while (*tmp) {
		if (fmt == *tmp) {
			*tmp = fmt->next;
			write_unlock(&binfmt_lock);
			return 0;
		}
		tmp = &(*tmp)->next;
	}
	write_unlock(&binfmt_lock);
	return -EINVAL;
}

static inline void put_binfmt(struct linux_binfmt * fmt)
{
105
	module_put(fmt->module);
Linus Torvalds's avatar
Linus Torvalds committed
106 107 108 109 110 111 112 113
}

/*
 * Note that a shared library must be both readable and executable due to
 * security reasons.
 *
 * Also note that we take the address to load from from the file itself.
 */
114
asmlinkage long sys_uselib(const char __user * library)
Linus Torvalds's avatar
Linus Torvalds committed
115 116 117 118 119
{
	struct file * file;
	struct nameidata nd;
	int error;

120 121
	nd.intent.open.flags = O_RDONLY;
	error = __user_walk(library, LOOKUP_FOLLOW|LOOKUP_OPEN, &nd);
Linus Torvalds's avatar
Linus Torvalds committed
122 123 124 125 126 127 128
	if (error)
		goto out;

	error = -EINVAL;
	if (!S_ISREG(nd.dentry->d_inode->i_mode))
		goto exit;

129
	error = permission(nd.dentry->d_inode, MAY_READ | MAY_EXEC, &nd);
Linus Torvalds's avatar
Linus Torvalds committed
130 131 132 133 134 135 136 137 138
	if (error)
		goto exit;

	file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
	error = PTR_ERR(file);
	if (IS_ERR(file))
		goto out;

	error = -ENOEXEC;
139
	if(file->f_op) {
Linus Torvalds's avatar
Linus Torvalds committed
140 141 142 143 144 145
		struct linux_binfmt * fmt;

		read_lock(&binfmt_lock);
		for (fmt = formats ; fmt ; fmt = fmt->next) {
			if (!fmt->load_shlib)
				continue;
146
			if (!try_module_get(fmt->module))
Linus Torvalds's avatar
Linus Torvalds committed
147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165
				continue;
			read_unlock(&binfmt_lock);
			error = fmt->load_shlib(file);
			read_lock(&binfmt_lock);
			put_binfmt(fmt);
			if (error != -ENOEXEC)
				break;
		}
		read_unlock(&binfmt_lock);
	}
	fput(file);
out:
  	return error;
exit:
	path_release(&nd);
	goto out;
}

/*
David Mosberger's avatar
David Mosberger committed
166
 * count() counts the number of strings in array ARGV.
Linus Torvalds's avatar
Linus Torvalds committed
167
 */
168
static int count(char __user * __user * argv, int max)
Linus Torvalds's avatar
Linus Torvalds committed
169 170 171 172 173
{
	int i = 0;

	if (argv != NULL) {
		for (;;) {
174
			char __user * p;
Linus Torvalds's avatar
Linus Torvalds committed
175

Linus Torvalds's avatar
Linus Torvalds committed
176 177
			if (get_user(p, argv))
				return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
178 179 180 181 182 183 184 185 186 187 188
			if (!p)
				break;
			argv++;
			if(++i > max)
				return -E2BIG;
		}
	}
	return i;
}

/*
David Mosberger's avatar
David Mosberger committed
189
 * 'copy_strings()' copies argument/environment strings from user
Linus Torvalds's avatar
Linus Torvalds committed
190 191 192
 * memory to free pages in kernel mem. These are in a format ready
 * to be put directly into the top of new user memory.
 */
193
int copy_strings(int argc,char __user * __user * argv, struct linux_binprm *bprm) 
Linus Torvalds's avatar
Linus Torvalds committed
194
{
Andrew Morton's avatar
Andrew Morton committed
195 196 197 198
	struct page *kmapped_page = NULL;
	char *kaddr = NULL;
	int ret;

Linus Torvalds's avatar
Linus Torvalds committed
199
	while (argc-- > 0) {
200
		char __user *str;
Linus Torvalds's avatar
Linus Torvalds committed
201 202 203
		int len;
		unsigned long pos;

Andrew Morton's avatar
Andrew Morton committed
204 205 206 207 208 209 210 211 212 213
		if (get_user(str, argv+argc) ||
				!(len = strnlen_user(str, bprm->p))) {
			ret = -EFAULT;
			goto out;
		}

		if (bprm->p < len)  {
			ret = -E2BIG;
			goto out;
		}
Linus Torvalds's avatar
Linus Torvalds committed
214 215 216 217

		bprm->p -= len;
		/* XXX: add architecture specific overflow check here. */ 
		pos = bprm->p;
Andrew Morton's avatar
Andrew Morton committed
218

Linus Torvalds's avatar
Linus Torvalds committed
219 220 221
		while (len > 0) {
			int i, new, err;
			int offset, bytes_to_copy;
Andrew Morton's avatar
Andrew Morton committed
222
			struct page *page;
Linus Torvalds's avatar
Linus Torvalds committed
223 224 225 226 227 228 229 230

			offset = pos % PAGE_SIZE;
			i = pos/PAGE_SIZE;
			page = bprm->page[i];
			new = 0;
			if (!page) {
				page = alloc_page(GFP_HIGHUSER);
				bprm->page[i] = page;
Andrew Morton's avatar
Andrew Morton committed
231 232 233 234
				if (!page) {
					ret = -ENOMEM;
					goto out;
				}
Linus Torvalds's avatar
Linus Torvalds committed
235 236 237
				new = 1;
			}

Andrew Morton's avatar
Andrew Morton committed
238 239 240 241 242 243
			if (page != kmapped_page) {
				if (kmapped_page)
					kunmap(kmapped_page);
				kmapped_page = page;
				kaddr = kmap(kmapped_page);
			}
Linus Torvalds's avatar
Linus Torvalds committed
244 245 246 247 248 249
			if (new && offset)
				memset(kaddr, 0, offset);
			bytes_to_copy = PAGE_SIZE - offset;
			if (bytes_to_copy > len) {
				bytes_to_copy = len;
				if (new)
Andrew Morton's avatar
Andrew Morton committed
250 251 252 253 254 255 256
					memset(kaddr+offset+len, 0,
						PAGE_SIZE-offset-len);
			}
			err = copy_from_user(kaddr+offset, str, bytes_to_copy);
			if (err) {
				ret = -EFAULT;
				goto out;
Linus Torvalds's avatar
Linus Torvalds committed
257 258 259 260 261 262 263
			}

			pos += bytes_to_copy;
			str += bytes_to_copy;
			len -= bytes_to_copy;
		}
	}
Andrew Morton's avatar
Andrew Morton committed
264 265 266 267 268
	ret = 0;
out:
	if (kmapped_page)
		kunmap(kmapped_page);
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
269 270 271 272 273 274 275 276 277 278
}

/*
 * Like copy_strings, but get argv and its values from kernel memory.
 */
int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
{
	int r;
	mm_segment_t oldfs = get_fs();
	set_fs(KERNEL_DS); 
279
	r = copy_strings(argc, (char __user * __user *)argv, bprm);
Linus Torvalds's avatar
Linus Torvalds committed
280 281 282 283
	set_fs(oldfs);
	return r; 
}

284
#ifdef CONFIG_MMU
Linus Torvalds's avatar
Linus Torvalds committed
285 286 287
/*
 * This routine is used to map in a page into an address space: needed by
 * execve() for the initial stack and environment pages.
Linus Torvalds's avatar
Linus Torvalds committed
288 289
 *
 * tsk->mmap_sem is held for writing.
Linus Torvalds's avatar
Linus Torvalds committed
290
 */
291 292
void put_dirty_page(struct task_struct *tsk, struct page *page,
			unsigned long address, pgprot_t prot)
Linus Torvalds's avatar
Linus Torvalds committed
293 294 295 296
{
	pgd_t * pgd;
	pmd_t * pmd;
	pte_t * pte;
297
	struct pte_chain *pte_chain;
Linus Torvalds's avatar
Linus Torvalds committed
298 299

	if (page_count(page) != 1)
300 301
		printk(KERN_ERR "mem_map disagrees with %p at %08lx\n",
				page, address);
302

Linus Torvalds's avatar
Linus Torvalds committed
303
	pgd = pgd_offset(tsk->mm, address);
304
	pte_chain = pte_chain_alloc(GFP_KERNEL);
305 306
	if (!pte_chain)
		goto out_sig;
Linus Torvalds's avatar
Linus Torvalds committed
307 308 309 310
	spin_lock(&tsk->mm->page_table_lock);
	pmd = pmd_alloc(tsk->mm, pgd, address);
	if (!pmd)
		goto out;
311
	pte = pte_alloc_map(tsk->mm, pmd, address);
Linus Torvalds's avatar
Linus Torvalds committed
312 313
	if (!pte)
		goto out;
314 315
	if (!pte_none(*pte)) {
		pte_unmap(pte);
Linus Torvalds's avatar
Linus Torvalds committed
316
		goto out;
317
	}
318
	lru_cache_add_active(page);
Linus Torvalds's avatar
Linus Torvalds committed
319
	flush_dcache_page(page);
320
	set_pte(pte, pte_mkdirty(pte_mkwrite(mk_pte(page, prot))));
321
	pte_chain = page_add_rmap(page, pte, pte_chain);
322
	pte_unmap(pte);
Linus Torvalds's avatar
Linus Torvalds committed
323
	tsk->mm->rss++;
Linus Torvalds's avatar
Linus Torvalds committed
324 325 326
	spin_unlock(&tsk->mm->page_table_lock);

	/* no need for flush_tlb */
327
	pte_chain_free(pte_chain);
Linus Torvalds's avatar
Linus Torvalds committed
328 329 330
	return;
out:
	spin_unlock(&tsk->mm->page_table_lock);
331
out_sig:
Linus Torvalds's avatar
Linus Torvalds committed
332 333
	__free_page(page);
	force_sig(SIGKILL, tsk);
334
	pte_chain_free(pte_chain);
Linus Torvalds's avatar
Linus Torvalds committed
335
	return;
Linus Torvalds's avatar
Linus Torvalds committed
336 337 338 339 340 341
}

int setup_arg_pages(struct linux_binprm *bprm)
{
	unsigned long stack_base;
	struct vm_area_struct *mpnt;
342
	struct mm_struct *mm = current->mm;
Linus Torvalds's avatar
Linus Torvalds committed
343 344
	int i;

345
#ifdef CONFIG_STACK_GROWSUP
346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367
	/* Move the argument and environment strings to the bottom of the
	 * stack space.
	 */
	int offset, j;
	char *to, *from;

	/* Start by shifting all the pages down */
	i = 0;
	for (j = 0; j < MAX_ARG_PAGES; j++) {
		struct page *page = bprm->page[j];
		if (!page)
			continue;
		bprm->page[i++] = page;
	}

	/* Now move them within their pages */
	offset = bprm->p % PAGE_SIZE;
	to = kmap(bprm->page[0]);
	for (j = 1; j < i; j++) {
		memmove(to, to + offset, PAGE_SIZE - offset);
		from = kmap(bprm->page[j]);
		memcpy(to + PAGE_SIZE - offset, from, offset);
368
		kunmap(bprm->page[j - 1]);
369 370 371
		to = from;
	}
	memmove(to, to + offset, PAGE_SIZE - offset);
372
	kunmap(bprm->page[j - 1]);
373 374 375 376 377 378 379 380 381 382 383 384 385

	/* Adjust bprm->p to point to the end of the strings. */
	bprm->p = PAGE_SIZE * i - offset;
	stack_base = STACK_TOP - current->rlim[RLIMIT_STACK].rlim_max;
	mm->arg_start = stack_base;

	/* zero pages that were copied above */
	while (i < MAX_ARG_PAGES)
		bprm->page[i++] = NULL;
#else
	stack_base = STACK_TOP - MAX_ARG_PAGES * PAGE_SIZE;
	mm->arg_start = bprm->p + stack_base;
#endif
Linus Torvalds's avatar
Linus Torvalds committed
386 387 388 389 390 391 392

	bprm->p += stack_base;
	if (bprm->loader)
		bprm->loader += stack_base;
	bprm->exec += stack_base;

	mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
393
	if (!mpnt)
Andrew Morton's avatar
Andrew Morton committed
394 395
		return -ENOMEM;

396
	if (security_vm_enough_memory((STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))>>PAGE_SHIFT)) {
Andrew Morton's avatar
Andrew Morton committed
397 398 399 400
		kmem_cache_free(vm_area_cachep, mpnt);
		return -ENOMEM;
	}

401
	down_write(&mm->mmap_sem);
Linus Torvalds's avatar
Linus Torvalds committed
402
	{
403
		mpnt->vm_mm = mm;
404
#ifdef CONFIG_STACK_GROWSUP
405 406 407 408
		mpnt->vm_start = stack_base;
		mpnt->vm_end = PAGE_MASK &
			(PAGE_SIZE - 1 + (unsigned long) bprm->p);
#else
Linus Torvalds's avatar
Linus Torvalds committed
409 410
		mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
		mpnt->vm_end = STACK_TOP;
411
#endif
412
		mpnt->vm_page_prot = protection_map[VM_STACK_FLAGS & 0x7];
Linus Torvalds's avatar
Linus Torvalds committed
413 414 415 416
		mpnt->vm_flags = VM_STACK_FLAGS;
		mpnt->vm_ops = NULL;
		mpnt->vm_pgoff = 0;
		mpnt->vm_file = NULL;
417
		INIT_LIST_HEAD(&mpnt->shared);
Linus Torvalds's avatar
Linus Torvalds committed
418
		mpnt->vm_private_data = (void *) 0;
419 420
		insert_vm_struct(mm, mpnt);
		mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
Linus Torvalds's avatar
Linus Torvalds committed
421 422 423 424 425 426
	} 

	for (i = 0 ; i < MAX_ARG_PAGES ; i++) {
		struct page *page = bprm->page[i];
		if (page) {
			bprm->page[i] = NULL;
427 428
			put_dirty_page(current, page, stack_base,
					mpnt->vm_page_prot);
Linus Torvalds's avatar
Linus Torvalds committed
429 430 431
		}
		stack_base += PAGE_SIZE;
	}
432
	up_write(&mm->mmap_sem);
Linus Torvalds's avatar
Linus Torvalds committed
433 434 435 436
	
	return 0;
}

437 438 439 440 441 442 443 444
#define free_arg_pages(bprm) do { } while (0)

#else

static inline void free_arg_pages(struct linux_binprm *bprm)
{
	int i;

445
	for (i = 0; i < MAX_ARG_PAGES; i++) {
446
		if (bprm->page[i])
447
			__free_page(bprm->page[i]);
448 449 450 451 452 453
		bprm->page[i] = NULL;
	}
}

#endif /* CONFIG_MMU */

Linus Torvalds's avatar
Linus Torvalds committed
454 455 456
struct file *open_exec(const char *name)
{
	struct nameidata nd;
Alexander Viro's avatar
Alexander Viro committed
457 458
	int err = path_lookup(name, LOOKUP_FOLLOW, &nd);
	struct file *file = ERR_PTR(err);
Linus Torvalds's avatar
Linus Torvalds committed
459 460

	if (!err) {
Alexander Viro's avatar
Alexander Viro committed
461
		struct inode *inode = nd.dentry->d_inode;
Linus Torvalds's avatar
Linus Torvalds committed
462
		file = ERR_PTR(-EACCES);
Linus Torvalds's avatar
Linus Torvalds committed
463 464
		if (!(nd.mnt->mnt_flags & MNT_NOEXEC) &&
		    S_ISREG(inode->i_mode)) {
465
			int err = permission(inode, MAY_EXEC, &nd);
Linus Torvalds's avatar
Linus Torvalds committed
466 467
			if (!err && !(inode->i_mode & 0111))
				err = -EACCES;
Linus Torvalds's avatar
Linus Torvalds committed
468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487
			file = ERR_PTR(err);
			if (!err) {
				file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
				if (!IS_ERR(file)) {
					err = deny_write_access(file);
					if (err) {
						fput(file);
						file = ERR_PTR(err);
					}
				}
out:
				return file;
			}
		}
		path_release(&nd);
	}
	goto out;
}

int kernel_read(struct file *file, unsigned long offset,
488
	char *addr, unsigned long count)
Linus Torvalds's avatar
Linus Torvalds committed
489 490 491
{
	mm_segment_t old_fs;
	loff_t pos = offset;
492
	int result;
Linus Torvalds's avatar
Linus Torvalds committed
493 494 495

	old_fs = get_fs();
	set_fs(get_ds());
496 497
	/* The cast to a user pointer is valid due to the set_fs() */
	result = vfs_read(file, (void __user *)addr, count, &pos);
Linus Torvalds's avatar
Linus Torvalds committed
498 499 500 501
	set_fs(old_fs);
	return result;
}

502
static int exec_mmap(struct mm_struct *mm)
Linus Torvalds's avatar
Linus Torvalds committed
503
{
504
	struct task_struct *tsk;
505
	struct mm_struct * old_mm, *active_mm;
Linus Torvalds's avatar
Linus Torvalds committed
506

507 508 509 510 511
	/* Add it to the list of mm's */
	spin_lock(&mmlist_lock);
	list_add(&mm->mmlist, &init_mm.mmlist);
	mmlist_nr++;
	spin_unlock(&mmlist_lock);
Linus Torvalds's avatar
Linus Torvalds committed
512

513 514
	/* Notify parent that we're no longer interested in the old VM */
	tsk = current;
515
	old_mm = current->mm;
516 517 518 519 520 521
	mm_release(tsk, old_mm);

	task_lock(tsk);
	active_mm = tsk->active_mm;
	tsk->mm = mm;
	tsk->active_mm = mm;
522
	activate_mm(active_mm, mm);
523
	task_unlock(tsk);
524 525 526
	if (old_mm) {
		if (active_mm != old_mm) BUG();
		mmput(old_mm);
Linus Torvalds's avatar
Linus Torvalds committed
527 528
		return 0;
	}
529 530
	mmdrop(active_mm);
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
531 532 533 534 535 536
}

/*
 * This function makes sure the current process has its own signal table,
 * so that flush_signal_handlers can later reset the handlers without
 * disturbing other processes.  (Other processes might share the signal
537
 * table via the CLONE_SIGHAND option to clone().)
Linus Torvalds's avatar
Linus Torvalds committed
538
 */
539
static inline int de_thread(struct task_struct *tsk)
Linus Torvalds's avatar
Linus Torvalds committed
540
{
541 542 543
	struct signal_struct *newsig, *oldsig = tsk->signal;
	struct sighand_struct *newsighand, *oldsighand = tsk->sighand;
	spinlock_t *lock = &oldsighand->siglock;
544
	int count;
Ingo Molnar's avatar
Ingo Molnar committed
545

546 547 548 549 550
	/*
	 * If we don't share sighandlers, then we aren't sharing anything
	 * and we can just re-use it all.
	 */
	if (atomic_read(&oldsighand->count) <= 1)
Linus Torvalds's avatar
Linus Torvalds committed
551
		return 0;
552

553 554
	newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
	if (!newsighand)
Linus Torvalds's avatar
Linus Torvalds committed
555
		return -ENOMEM;
556

557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575
	spin_lock_init(&newsighand->siglock);
	atomic_set(&newsighand->count, 1);
	memcpy(newsighand->action, oldsighand->action, sizeof(newsighand->action));

	/*
	 * See if we need to allocate a new signal structure
	 */
	newsig = NULL;
	if (atomic_read(&oldsig->count) > 1) {
		newsig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
		if (!newsig) {
			kmem_cache_free(sighand_cachep, newsighand);
			return -ENOMEM;
		}
		atomic_set(&newsig->count, 1);
		newsig->group_exit = 0;
		newsig->group_exit_code = 0;
		newsig->group_exit_task = NULL;
		newsig->group_stop_count = 0;
576
		newsig->curr_target = NULL;
577 578 579
		init_sigpending(&newsig->shared_pending);
	}

580
	if (thread_group_empty(current))
581
		goto no_thread_group;
582

583
	/*
584 585
	 * Kill all other threads in the thread group.
	 * We must hold tasklist_lock to call zap_other_threads.
586
	 */
587
	read_lock(&tasklist_lock);
588
	spin_lock_irq(lock);
589 590 591 592 593
	if (oldsig->group_exit) {
		/*
		 * Another group action in progress, just
		 * return so that the signal is processed.
		 */
594
		spin_unlock_irq(lock);
595
		read_unlock(&tasklist_lock);
596 597 598
		kmem_cache_free(sighand_cachep, newsighand);
		if (newsig)
			kmem_cache_free(signal_cachep, newsig);
599 600 601
		return -EAGAIN;
	}
	oldsig->group_exit = 1;
Ingo Molnar's avatar
Ingo Molnar committed
602
	zap_other_threads(current);
603
	read_unlock(&tasklist_lock);
604 605 606 607 608 609 610 611 612

	/*
	 * Account for the thread group leader hanging around:
	 */
	count = 2;
	if (current->pid == current->tgid)
		count = 1;
	while (atomic_read(&oldsig->count) > count) {
		oldsig->group_exit_task = current;
613
		oldsig->notify_count = count;
614
		__set_current_state(TASK_UNINTERRUPTIBLE);
615
		spin_unlock_irq(lock);
616
		schedule();
617
		spin_lock_irq(lock);
618
	}
619
	spin_unlock_irq(lock);
620 621 622 623 624 625 626

	/*
	 * At this point all other threads have exited, all we have to
	 * do is to wait for the thread group leader to become inactive,
	 * and to assume its PID:
	 */
	if (current->pid != current->tgid) {
627
		struct task_struct *leader = current->group_leader, *parent;
628
		struct dentry *proc_dentry1, *proc_dentry2;
629
		unsigned long state, ptrace;
630

631 632 633 634 635 636 637
		/*
		 * Wait for the thread group leader to be a zombie.
		 * It should already be zombie at this point, most
		 * of the time.
		 */
		while (leader->state != TASK_ZOMBIE)
			yield();
638

639 640 641 642
		spin_lock(&leader->proc_lock);
		spin_lock(&current->proc_lock);
		proc_dentry1 = proc_pid_unhash(current);
		proc_dentry2 = proc_pid_unhash(leader);
643 644 645 646 647 648 649 650 651 652 653 654
		write_lock_irq(&tasklist_lock);

		if (leader->tgid != current->tgid)
			BUG();
		if (current->pid == current->tgid)
			BUG();
		/*
		 * An exec() starts a new thread group with the
		 * TGID of the previous thread group. Rehash the
		 * two threads with a switched PID, and release
		 * the former thread group leader:
		 */
655 656 657 658
		ptrace = leader->ptrace;
		parent = leader->parent;

		ptrace_unlink(current);
659
		ptrace_unlink(leader);
660 661 662
		remove_parent(current);
		remove_parent(leader);

663 664
		switch_exec_pids(leader, current);

665 666
		current->parent = current->real_parent = leader->real_parent;
		leader->parent = leader->real_parent = child_reaper;
667 668
		current->group_leader = current;
		leader->group_leader = leader;
669 670 671 672 673 674 675

		add_parent(current, current->parent);
		add_parent(leader, leader->parent);
		if (ptrace) {
			current->ptrace = ptrace;
			__ptrace_link(current, parent);
		}
Ingo Molnar's avatar
Ingo Molnar committed
676 677

		list_del(&current->tasks);
678
		list_add_tail(&current->tasks, &init_task.tasks);
679
		current->exit_signal = SIGCHLD;
680
		state = leader->state;
681

682
		write_unlock_irq(&tasklist_lock);
683 684 685 686
		spin_unlock(&leader->proc_lock);
		spin_unlock(&current->proc_lock);
		proc_pid_flush(proc_dentry1);
		proc_pid_flush(proc_dentry2);
687

688 689 690
		if (state != TASK_ZOMBIE)
			BUG();
		release_task(leader);
691 692
        }

693
no_thread_group:
694

Ingo Molnar's avatar
Ingo Molnar committed
695
	write_lock_irq(&tasklist_lock);
696 697
	spin_lock(&oldsighand->siglock);
	spin_lock(&newsighand->siglock);
Ingo Molnar's avatar
Ingo Molnar committed
698 699 700

	if (current == oldsig->curr_target)
		oldsig->curr_target = next_thread(current);
701 702 703
	if (newsig)
		current->signal = newsig;
	current->sighand = newsighand;
704 705
	init_sigpending(&current->pending);
	recalc_sigpending();
Ingo Molnar's avatar
Ingo Molnar committed
706

707 708
	spin_unlock(&newsighand->siglock);
	spin_unlock(&oldsighand->siglock);
Ingo Molnar's avatar
Ingo Molnar committed
709
	write_unlock_irq(&tasklist_lock);
Linus Torvalds's avatar
Linus Torvalds committed
710

711 712 713 714 715
	if (newsig && atomic_dec_and_test(&oldsig->count))
		kmem_cache_free(signal_cachep, oldsig);

	if (atomic_dec_and_test(&oldsighand->count))
		kmem_cache_free(sighand_cachep, oldsighand);
Linus Torvalds's avatar
Linus Torvalds committed
716

717
	if (!thread_group_empty(current))
718 719 720 721 722 723
		BUG();
	if (current->tgid != current->pid)
		BUG();
	return 0;
}
	
Linus Torvalds's avatar
Linus Torvalds committed
724 725 726 727 728 729 730 731 732
/*
 * These functions flushes out all traces of the currently running executable
 * so that a new one can be started
 */

static inline void flush_old_files(struct files_struct * files)
{
	long j = -1;

733
	spin_lock(&files->file_lock);
Linus Torvalds's avatar
Linus Torvalds committed
734 735 736 737 738 739 740 741 742 743 744
	for (;;) {
		unsigned long set, i;

		j++;
		i = j * __NFDBITS;
		if (i >= files->max_fds || i >= files->max_fdset)
			break;
		set = files->close_on_exec->fds_bits[j];
		if (!set)
			continue;
		files->close_on_exec->fds_bits[j] = 0;
745
		spin_unlock(&files->file_lock);
Linus Torvalds's avatar
Linus Torvalds committed
746 747 748 749 750
		for ( ; set ; i++,set >>= 1) {
			if (set & 1) {
				sys_close(i);
			}
		}
751
		spin_lock(&files->file_lock);
Linus Torvalds's avatar
Linus Torvalds committed
752 753

	}
754
	spin_unlock(&files->file_lock);
Linus Torvalds's avatar
Linus Torvalds committed
755 756 757 758 759 760 761 762 763 764
}

int flush_old_exec(struct linux_binprm * bprm)
{
	char * name;
	int i, ch, retval;

	/* 
	 * Release all of the old mmap stuff
	 */
765
	retval = exec_mmap(bprm->mm);
766
	if (retval)
767
		goto out;
768 769 770 771
	/*
	 * Make sure we have a private signal table and that
	 * we are unassociated from the previous thread group.
	 */
772
	retval = de_thread(current);
773
	if (retval)
774
		goto out;
Linus Torvalds's avatar
Linus Torvalds committed
775

776 777
	bprm->mm = NULL;		/* We're using it now */

Linus Torvalds's avatar
Linus Torvalds committed
778 779 780 781 782
	/* This is the point of no return */

	current->sas_ss_sp = current->sas_ss_size = 0;

	if (current->euid == current->uid && current->egid == current->gid)
Linus Torvalds's avatar
Linus Torvalds committed
783
		current->mm->dumpable = 1;
Linus Torvalds's avatar
Linus Torvalds committed
784 785 786 787 788 789 790 791 792 793 794 795 796
	name = bprm->filename;
	for (i=0; (ch = *(name++)) != '\0';) {
		if (ch == '/')
			i = 0;
		else
			if (i < 15)
				current->comm[i++] = ch;
	}
	current->comm[i] = '\0';

	flush_thread();

	if (bprm->e_uid != current->euid || bprm->e_gid != current->egid || 
797
	    permission(bprm->file->f_dentry->d_inode,MAY_READ, NULL))
Linus Torvalds's avatar
Linus Torvalds committed
798
		current->mm->dumpable = 0;
Linus Torvalds's avatar
Linus Torvalds committed
799 800 801 802 803 804

	/* An exec changes our domain. We are no longer part of the thread
	   group */
	   
	current->self_exec_id++;
			
805
	flush_signal_handlers(current, 0);
Linus Torvalds's avatar
Linus Torvalds committed
806
	flush_old_files(current->files);
807
	exit_itimers(current);
Linus Torvalds's avatar
Linus Torvalds committed
808 809 810

	return 0;

811
out:
Linus Torvalds's avatar
Linus Torvalds committed
812 813 814 815 816 817 818 819 820
	return retval;
}

/*
 * We mustn't allow tracing of suid binaries, unless
 * the tracer has the capability to trace anything..
 */
static inline int must_not_trace_exec(struct task_struct * p)
{
Linus Torvalds's avatar
Linus Torvalds committed
821
	return (p->ptrace & PT_PTRACED) && !(p->ptrace & PT_PTRACE_CAP);
Linus Torvalds's avatar
Linus Torvalds committed
822 823 824 825 826 827 828 829 830 831
}

/* 
 * Fill the binprm structure from the inode. 
 * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
 */
int prepare_binprm(struct linux_binprm *bprm)
{
	int mode;
	struct inode * inode = bprm->file->f_dentry->d_inode;
832
	int retval;
Linus Torvalds's avatar
Linus Torvalds committed
833 834

	mode = inode->i_mode;
Linus Torvalds's avatar
Linus Torvalds committed
835 836 837 838
	/*
	 * Check execute perms again - if the caller has CAP_DAC_OVERRIDE,
	 * vfs_permission lets a non-executable through
	 */
Linus Torvalds's avatar
Linus Torvalds committed
839 840 841 842 843 844 845 846
	if (!(mode & 0111))	/* with at least _one_ execute bit set */
		return -EACCES;
	if (bprm->file->f_op == NULL)
		return -EACCES;

	bprm->e_uid = current->euid;
	bprm->e_gid = current->egid;

Linus Torvalds's avatar
Linus Torvalds committed
847
	if(!(bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)) {
Linus Torvalds's avatar
Linus Torvalds committed
848 849 850 851 852 853 854 855 856 857 858 859 860 861
		/* Set-uid? */
		if (mode & S_ISUID)
			bprm->e_uid = inode->i_uid;

		/* Set-gid? */
		/*
		 * If setgid is set but no group execute bit then this
		 * is a candidate for mandatory locking, not a setgid
		 * executable.
		 */
		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
			bprm->e_gid = inode->i_gid;
	}

862
	/* fill in binprm security blob */
863 864
	retval = security_bprm_set(bprm);
	if (retval)
865
		return retval;
Linus Torvalds's avatar
Linus Torvalds committed
866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887

	memset(bprm->buf,0,BINPRM_BUF_SIZE);
	return kernel_read(bprm->file,0,bprm->buf,BINPRM_BUF_SIZE);
}

/*
 * This function is used to produce the new IDs and capabilities
 * from the old ones and the file's capabilities.
 *
 * The formula used for evolving capabilities is:
 *
 *       pI' = pI
 * (***) pP' = (fP & X) | (fI & pI)
 *       pE' = pP' & fE          [NB. fE is 0 or ~0]
 *
 * I=Inheritable, P=Permitted, E=Effective // p=process, f=file
 * ' indicates post-exec(), and X is the global 'cap_bset'.
 *
 */

void compute_creds(struct linux_binprm *bprm) 
{
888
	task_lock(current);
889
	if (bprm->e_uid != current->uid || bprm->e_gid != current->gid) {
Linus Torvalds's avatar
Linus Torvalds committed
890
                current->mm->dumpable = 0;
Linus Torvalds's avatar
Linus Torvalds committed
891 892 893 894
		
		if (must_not_trace_exec(current)
		    || atomic_read(&current->fs->count) > 1
		    || atomic_read(&current->files->count) > 1
895
		    || atomic_read(&current->sighand->count) > 1) {
Linus Torvalds's avatar
Linus Torvalds committed
896 897 898 899 900 901 902 903 904 905
			if(!capable(CAP_SETUID)) {
				bprm->e_uid = current->uid;
				bprm->e_gid = current->gid;
			}
		}
	}

        current->suid = current->euid = current->fsuid = bprm->e_uid;
        current->sgid = current->egid = current->fsgid = bprm->e_gid;

906
	task_unlock(current);
907

908
	security_bprm_compute_creds(bprm);
Linus Torvalds's avatar
Linus Torvalds committed
909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958
}

void remove_arg_zero(struct linux_binprm *bprm)
{
	if (bprm->argc) {
		unsigned long offset;
		char * kaddr;
		struct page *page;

		offset = bprm->p % PAGE_SIZE;
		goto inside;

		while (bprm->p++, *(kaddr+offset++)) {
			if (offset != PAGE_SIZE)
				continue;
			offset = 0;
			kunmap(page);
inside:
			page = bprm->page[bprm->p/PAGE_SIZE];
			kaddr = kmap(page);
		}
		kunmap(page);
		bprm->argc--;
	}
}

/*
 * cycle the list of binary formats handler, until one recognizes the image
 */
int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
{
	int try,retval=0;
	struct linux_binfmt *fmt;
#ifdef __alpha__
	/* handle /sbin/loader.. */
	{
	    struct exec * eh = (struct exec *) bprm->buf;

	    if (!bprm->loader && eh->fh.f_magic == 0x183 &&
		(eh->fh.f_flags & 0x3000) == 0x3000)
	    {
		struct file * file;
		unsigned long loader;

		allow_write_access(bprm->file);
		fput(bprm->file);
		bprm->file = NULL;

	        loader = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);

Linus Torvalds's avatar
Linus Torvalds committed
959
		file = open_exec("/sbin/loader");
Linus Torvalds's avatar
Linus Torvalds committed
960 961 962
		retval = PTR_ERR(file);
		if (IS_ERR(file))
			return retval;
Linus Torvalds's avatar
Linus Torvalds committed
963 964 965 966

		/* Remember if the application is TASO.  */
		bprm->sh_bang = eh->ah.entry < 0x100000000;

Linus Torvalds's avatar
Linus Torvalds committed
967 968 969 970 971 972 973 974 975 976
		bprm->file = file;
		bprm->loader = loader;
		retval = prepare_binprm(bprm);
		if (retval<0)
			return retval;
		/* should call search_binary_handler recursively here,
		   but it does not matter */
	    }
	}
#endif
977 978
	retval = security_bprm_check(bprm);
	if (retval)
979 980
		return retval;

Linus Torvalds's avatar
Linus Torvalds committed
981 982 983
	/* kernel module loader fixup */
	/* so we don't try to load run modprobe in kernel space. */
	set_fs(USER_DS);
Linus Torvalds's avatar
Linus Torvalds committed
984 985 986 987 988 989
	for (try=0; try<2; try++) {
		read_lock(&binfmt_lock);
		for (fmt = formats ; fmt ; fmt = fmt->next) {
			int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
			if (!fn)
				continue;
990
			if (!try_module_get(fmt->module))
Linus Torvalds's avatar
Linus Torvalds committed
991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004
				continue;
			read_unlock(&binfmt_lock);
			retval = fn(bprm, regs);
			if (retval >= 0) {
				put_binfmt(fmt);
				allow_write_access(bprm->file);
				if (bprm->file)
					fput(bprm->file);
				bprm->file = NULL;
				current->did_exec = 1;
				return retval;
			}
			read_lock(&binfmt_lock);
			put_binfmt(fmt);
1005
			if (retval != -ENOEXEC || bprm->mm == NULL)
Linus Torvalds's avatar
Linus Torvalds committed
1006 1007 1008 1009 1010 1011 1012
				break;
			if (!bprm->file) {
				read_unlock(&binfmt_lock);
				return retval;
			}
		}
		read_unlock(&binfmt_lock);
1013
		if (retval != -ENOEXEC || bprm->mm == NULL) {
Linus Torvalds's avatar
Linus Torvalds committed
1014 1015 1016 1017 1018 1019 1020 1021 1022
			break;
#ifdef CONFIG_KMOD
		}else{
#define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
			if (printable(bprm->buf[0]) &&
			    printable(bprm->buf[1]) &&
			    printable(bprm->buf[2]) &&
			    printable(bprm->buf[3]))
				break; /* -ENOEXEC */
1023
			request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
Linus Torvalds's avatar
Linus Torvalds committed
1024 1025 1026 1027 1028 1029 1030 1031 1032
#endif
		}
	}
	return retval;
}

/*
 * sys_execve() executes a new program.
 */
1033 1034 1035 1036
int do_execve(char * filename,
	char __user *__user *argv,
	char __user *__user *envp,
	struct pt_regs * regs)
Linus Torvalds's avatar
Linus Torvalds committed
1037 1038 1039 1040 1041
{
	struct linux_binprm bprm;
	struct file *file;
	int retval;

1042 1043
	sched_balance_exec();

Linus Torvalds's avatar
Linus Torvalds committed
1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057
	file = open_exec(filename);

	retval = PTR_ERR(file);
	if (IS_ERR(file))
		return retval;

	bprm.p = PAGE_SIZE*MAX_ARG_PAGES-sizeof(void *);
	memset(bprm.page, 0, MAX_ARG_PAGES*sizeof(bprm.page[0])); 

	bprm.file = file;
	bprm.filename = filename;
	bprm.sh_bang = 0;
	bprm.loader = 0;
	bprm.exec = 0;
1058
	bprm.security = NULL;
1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074
	bprm.mm = mm_alloc();
	retval = -ENOMEM;
	if (!bprm.mm)
		goto out_file;

	retval = init_new_context(current, bprm.mm);
	if (retval < 0)
		goto out_mm;

	bprm.argc = count(argv, bprm.p / sizeof(void *));
	if ((retval = bprm.argc) < 0)
		goto out_mm;

	bprm.envc = count(envp, bprm.p / sizeof(void *));
	if ((retval = bprm.envc) < 0)
		goto out_mm;
Linus Torvalds's avatar
Linus Torvalds committed
1075

1076 1077
	retval = security_bprm_alloc(&bprm);
	if (retval)
1078 1079
		goto out;

Linus Torvalds's avatar
Linus Torvalds committed
1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097
	retval = prepare_binprm(&bprm);
	if (retval < 0) 
		goto out; 

	retval = copy_strings_kernel(1, &bprm.filename, &bprm);
	if (retval < 0) 
		goto out; 

	bprm.exec = bprm.p;
	retval = copy_strings(bprm.envc, envp, &bprm);
	if (retval < 0) 
		goto out; 

	retval = copy_strings(bprm.argc, argv, &bprm);
	if (retval < 0) 
		goto out; 

	retval = search_binary_handler(&bprm,regs);
1098
	if (retval >= 0) {
1099 1100
		free_arg_pages(&bprm);

Linus Torvalds's avatar
Linus Torvalds committed
1101
		/* execve success */
1102
		security_bprm_free(&bprm);
Linus Torvalds's avatar
Linus Torvalds committed
1103
		return retval;
1104
	}
Linus Torvalds's avatar
Linus Torvalds committed
1105 1106 1107

out:
	/* Something went wrong, return the inode and free the argument pages*/
1108
	free_arg_pages(&bprm);
Linus Torvalds's avatar
Linus Torvalds committed
1109

1110
	if (bprm.security)
1111
		security_bprm_free(&bprm);
1112

1113
out_mm:
1114 1115
	if (bprm.mm)
		mmdrop(bprm.mm);
1116 1117 1118 1119 1120 1121

out_file:
	if (bprm.file) {
		allow_write_access(bprm.file);
		fput(bprm.file);
	}
Linus Torvalds's avatar
Linus Torvalds committed
1122 1123 1124
	return retval;
}

1125
int set_binfmt(struct linux_binfmt *new)
Linus Torvalds's avatar
Linus Torvalds committed
1126 1127
{
	struct linux_binfmt *old = current->binfmt;
1128 1129 1130 1131 1132

	if (new) {
		if (!try_module_get(new->module))
			return -1;
	}
Linus Torvalds's avatar
Linus Torvalds committed
1133
	current->binfmt = new;
1134 1135 1136
	if (old)
		module_put(old->module);
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
1137 1138
}

Alan Cox's avatar
Alan Cox committed
1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173
#define CORENAME_MAX_SIZE 64

/* format_corename will inspect the pattern parameter, and output a
 * name into corename, which must have space for at least
 * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
 */
void format_corename(char *corename, const char *pattern, long signr)
{
	const char *pat_ptr = pattern;
	char *out_ptr = corename;
	char *const out_end = corename + CORENAME_MAX_SIZE;
	int rc;
	int pid_in_pattern = 0;

	/* Repeat as long as we have more pattern to process and more output
	   space */
	while (*pat_ptr) {
		if (*pat_ptr != '%') {
			if (out_ptr == out_end)
				goto out;
			*out_ptr++ = *pat_ptr++;
		} else {
			switch (*++pat_ptr) {
			case 0:
				goto out;
			/* Double percent, output one percent */
			case '%':
				if (out_ptr == out_end)
					goto out;
				*out_ptr++ = '%';
				break;
			/* pid */
			case 'p':
				pid_in_pattern = 1;
				rc = snprintf(out_ptr, out_end - out_ptr,
1174
					      "%d", current->tgid);
Alan Cox's avatar
Alan Cox committed
1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207
				if (rc > out_end - out_ptr)
					goto out;
				out_ptr += rc;
				break;
			/* uid */
			case 'u':
				rc = snprintf(out_ptr, out_end - out_ptr,
					      "%d", current->uid);
				if (rc > out_end - out_ptr)
					goto out;
				out_ptr += rc;
				break;
			/* gid */
			case 'g':
				rc = snprintf(out_ptr, out_end - out_ptr,
					      "%d", current->gid);
				if (rc > out_end - out_ptr)
					goto out;
				out_ptr += rc;
				break;
			/* signal that caused the coredump */
			case 's':
				rc = snprintf(out_ptr, out_end - out_ptr,
					      "%ld", signr);
				if (rc > out_end - out_ptr)
					goto out;
				out_ptr += rc;
				break;
			/* UNIX time of coredump */
			case 't': {
				struct timeval tv;
				do_gettimeofday(&tv);
				rc = snprintf(out_ptr, out_end - out_ptr,
Linus Torvalds's avatar
Linus Torvalds committed
1208
					      "%lu", tv.tv_sec);
Alan Cox's avatar
Alan Cox committed
1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245
				if (rc > out_end - out_ptr)
					goto out;
				out_ptr += rc;
				break;
			}
			/* hostname */
			case 'h':
				down_read(&uts_sem);
				rc = snprintf(out_ptr, out_end - out_ptr,
					      "%s", system_utsname.nodename);
				up_read(&uts_sem);
				if (rc > out_end - out_ptr)
					goto out;
				out_ptr += rc;
				break;
			/* executable */
			case 'e':
				rc = snprintf(out_ptr, out_end - out_ptr,
					      "%s", current->comm);
				if (rc > out_end - out_ptr)
					goto out;
				out_ptr += rc;
				break;
			default:
				break;
			}
			++pat_ptr;
		}
	}
	/* Backward compatibility with core_uses_pid:
	 *
	 * If core_pattern does not include a %p (as is the default)
	 * and core_uses_pid is set, then .%pid will be appended to
	 * the filename */
	if (!pid_in_pattern
            && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
		rc = snprintf(out_ptr, out_end - out_ptr,
1246
			      ".%d", current->tgid);
Alan Cox's avatar
Alan Cox committed
1247 1248 1249 1250 1251 1252 1253 1254
		if (rc > out_end - out_ptr)
			goto out;
		out_ptr += rc;
	}
      out:
	*out_ptr = 0;
}

1255 1256 1257 1258 1259 1260
static void zap_threads (struct mm_struct *mm)
{
	struct task_struct *g, *p;

	read_lock(&tasklist_lock);
	do_each_thread(g,p)
Ingo Molnar's avatar
Ingo Molnar committed
1261
		if (mm == p->mm && p != current) {
1262
			force_sig_specific(SIGKILL, p);
Ingo Molnar's avatar
Ingo Molnar committed
1263 1264
			mm->core_waiters++;
		}
1265
	while_each_thread(g,p);
Ingo Molnar's avatar
Ingo Molnar committed
1266

1267 1268 1269 1270 1271
	read_unlock(&tasklist_lock);
}

static void coredump_wait(struct mm_struct *mm)
{
Ingo Molnar's avatar
Ingo Molnar committed
1272 1273 1274 1275 1276 1277 1278
	DECLARE_COMPLETION(startup_done);

	mm->core_waiters++; /* let other threads block */
	mm->core_startup_done = &startup_done;

	/* give other threads a chance to run: */
	yield();
1279 1280

	zap_threads(mm);
Ingo Molnar's avatar
Ingo Molnar committed
1281 1282 1283 1284 1285 1286
	if (--mm->core_waiters) {
		up_write(&mm->mmap_sem);
		wait_for_completion(&startup_done);
	} else
		up_write(&mm->mmap_sem);
	BUG_ON(mm->core_waiters);
1287 1288
}

1289
int do_coredump(long signr, int exit_code, struct pt_regs * regs)
Linus Torvalds's avatar
Linus Torvalds committed
1290
{
Alan Cox's avatar
Alan Cox committed
1291
	char corename[CORENAME_MAX_SIZE + 1];
Ingo Molnar's avatar
Ingo Molnar committed
1292 1293
	struct mm_struct *mm = current->mm;
	struct linux_binfmt * binfmt;
Linus Torvalds's avatar
Linus Torvalds committed
1294
	struct inode * inode;
Ingo Molnar's avatar
Ingo Molnar committed
1295
	struct file * file;
Linus Torvalds's avatar
Linus Torvalds committed
1296
	int retval = 0;
Linus Torvalds's avatar
Linus Torvalds committed
1297 1298 1299 1300 1301

	lock_kernel();
	binfmt = current->binfmt;
	if (!binfmt || !binfmt->core_dump)
		goto fail;
Ingo Molnar's avatar
Ingo Molnar committed
1302 1303 1304
	down_write(&mm->mmap_sem);
	if (!mm->dumpable) {
		up_write(&mm->mmap_sem);
Linus Torvalds's avatar
Linus Torvalds committed
1305
		goto fail;
Ingo Molnar's avatar
Ingo Molnar committed
1306 1307 1308
	}
	mm->dumpable = 0;
	init_completion(&mm->core_done);
1309 1310
	current->signal->group_exit = 1;
	current->signal->group_exit_code = exit_code;
Ingo Molnar's avatar
Ingo Molnar committed
1311 1312
	coredump_wait(mm);

Linus Torvalds's avatar
Linus Torvalds committed
1313
	if (current->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
1314
		goto fail_unlock;
Linus Torvalds's avatar
Linus Torvalds committed
1315

Alan Cox's avatar
Alan Cox committed
1316
 	format_corename(corename, core_pattern, signr);
Linus Torvalds's avatar
Linus Torvalds committed
1317
	file = filp_open(corename, O_CREAT | 2 | O_NOFOLLOW, 0600);
Linus Torvalds's avatar
Linus Torvalds committed
1318
	if (IS_ERR(file))
1319
		goto fail_unlock;
Linus Torvalds's avatar
Linus Torvalds committed
1320 1321 1322
	inode = file->f_dentry->d_inode;
	if (inode->i_nlink > 1)
		goto close_fail;	/* multiple links - don't dump */
Linus Torvalds's avatar
Linus Torvalds committed
1323 1324
	if (d_unhashed(file->f_dentry))
		goto close_fail;
Linus Torvalds's avatar
Linus Torvalds committed
1325 1326 1327 1328 1329 1330 1331

	if (!S_ISREG(inode->i_mode))
		goto close_fail;
	if (!file->f_op)
		goto close_fail;
	if (!file->f_op->write)
		goto close_fail;
Linus Torvalds's avatar
Linus Torvalds committed
1332 1333
	if (do_truncate(file->f_dentry, 0) != 0)
		goto close_fail;
Linus Torvalds's avatar
Linus Torvalds committed
1334 1335

	retval = binfmt->core_dump(signr, regs, file);
Linus Torvalds's avatar
Linus Torvalds committed
1336

1337
	current->signal->group_exit_code |= 0x80;
Linus Torvalds's avatar
Linus Torvalds committed
1338 1339
close_fail:
	filp_close(file, NULL);
1340
fail_unlock:
Ingo Molnar's avatar
Ingo Molnar committed
1341
	complete_all(&mm->core_done);
Linus Torvalds's avatar
Linus Torvalds committed
1342 1343
fail:
	unlock_kernel();
Linus Torvalds's avatar
Linus Torvalds committed
1344
	return retval;
Linus Torvalds's avatar
Linus Torvalds committed
1345
}