mm: variable length argument support
[linux-3.10.git] / fs / exec.c
1 /*
2  *  linux/fs/exec.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * #!-checking implemented by tytso.
9  */
10 /*
11  * Demand-loading implemented 01.12.91 - no need to read anything but
12  * the header into memory. The inode of the executable is put into
13  * "current->executable", and page faults do the actual loading. Clean.
14  *
15  * Once more I can proudly say that linux stood up to being changed: it
16  * was less than 2 hours work to get demand-loading completely implemented.
17  *
18  * Demand loading changed July 1993 by Eric Youngdale.   Use mmap instead,
19  * current->executable is only used by the procfs.  This allows a dispatch
20  * table to check for several different types  of binary formats.  We keep
21  * trying until we recognize the file or we run out of supported binary
22  * formats. 
23  */
24
25 #include <linux/slab.h>
26 #include <linux/file.h>
27 #include <linux/mman.h>
28 #include <linux/a.out.h>
29 #include <linux/stat.h>
30 #include <linux/fcntl.h>
31 #include <linux/smp_lock.h>
32 #include <linux/init.h>
33 #include <linux/pagemap.h>
34 #include <linux/highmem.h>
35 #include <linux/spinlock.h>
36 #include <linux/key.h>
37 #include <linux/personality.h>
38 #include <linux/binfmts.h>
39 #include <linux/swap.h>
40 #include <linux/utsname.h>
41 #include <linux/pid_namespace.h>
42 #include <linux/module.h>
43 #include <linux/namei.h>
44 #include <linux/proc_fs.h>
45 #include <linux/ptrace.h>
46 #include <linux/mount.h>
47 #include <linux/security.h>
48 #include <linux/syscalls.h>
49 #include <linux/rmap.h>
50 #include <linux/tsacct_kern.h>
51 #include <linux/cn_proc.h>
52 #include <linux/audit.h>
53 #include <linux/signalfd.h>
54
55 #include <asm/uaccess.h>
56 #include <asm/mmu_context.h>
57 #include <asm/tlb.h>
58
59 #ifdef CONFIG_KMOD
60 #include <linux/kmod.h>
61 #endif
62
63 int core_uses_pid;
64 char core_pattern[CORENAME_MAX_SIZE] = "core";
65 int suid_dumpable = 0;
66
67 EXPORT_SYMBOL(suid_dumpable);
68 /* The maximal length of core_pattern is also specified in sysctl.c */
69
70 static struct linux_binfmt *formats;
71 static DEFINE_RWLOCK(binfmt_lock);
72
73 int register_binfmt(struct linux_binfmt * fmt)
74 {
75         struct linux_binfmt ** tmp = &formats;
76
77         if (!fmt)
78                 return -EINVAL;
79         if (fmt->next)
80                 return -EBUSY;
81         write_lock(&binfmt_lock);
82         while (*tmp) {
83                 if (fmt == *tmp) {
84                         write_unlock(&binfmt_lock);
85                         return -EBUSY;
86                 }
87                 tmp = &(*tmp)->next;
88         }
89         fmt->next = formats;
90         formats = fmt;
91         write_unlock(&binfmt_lock);
92         return 0;       
93 }
94
95 EXPORT_SYMBOL(register_binfmt);
96
97 int unregister_binfmt(struct linux_binfmt * fmt)
98 {
99         struct linux_binfmt ** tmp = &formats;
100
101         write_lock(&binfmt_lock);
102         while (*tmp) {
103                 if (fmt == *tmp) {
104                         *tmp = fmt->next;
105                         fmt->next = NULL;
106                         write_unlock(&binfmt_lock);
107                         return 0;
108                 }
109                 tmp = &(*tmp)->next;
110         }
111         write_unlock(&binfmt_lock);
112         return -EINVAL;
113 }
114
115 EXPORT_SYMBOL(unregister_binfmt);
116
117 static inline void put_binfmt(struct linux_binfmt * fmt)
118 {
119         module_put(fmt->module);
120 }
121
122 /*
123  * Note that a shared library must be both readable and executable due to
124  * security reasons.
125  *
126  * Also note that we take the address to load from from the file itself.
127  */
128 asmlinkage long sys_uselib(const char __user * library)
129 {
130         struct file * file;
131         struct nameidata nd;
132         int error;
133
134         error = __user_path_lookup_open(library, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
135         if (error)
136                 goto out;
137
138         error = -EACCES;
139         if (nd.mnt->mnt_flags & MNT_NOEXEC)
140                 goto exit;
141         error = -EINVAL;
142         if (!S_ISREG(nd.dentry->d_inode->i_mode))
143                 goto exit;
144
145         error = vfs_permission(&nd, MAY_READ | MAY_EXEC);
146         if (error)
147                 goto exit;
148
149         file = nameidata_to_filp(&nd, O_RDONLY);
150         error = PTR_ERR(file);
151         if (IS_ERR(file))
152                 goto out;
153
154         error = -ENOEXEC;
155         if(file->f_op) {
156                 struct linux_binfmt * fmt;
157
158                 read_lock(&binfmt_lock);
159                 for (fmt = formats ; fmt ; fmt = fmt->next) {
160                         if (!fmt->load_shlib)
161                                 continue;
162                         if (!try_module_get(fmt->module))
163                                 continue;
164                         read_unlock(&binfmt_lock);
165                         error = fmt->load_shlib(file);
166                         read_lock(&binfmt_lock);
167                         put_binfmt(fmt);
168                         if (error != -ENOEXEC)
169                                 break;
170                 }
171                 read_unlock(&binfmt_lock);
172         }
173         fput(file);
174 out:
175         return error;
176 exit:
177         release_open_intent(&nd);
178         path_release(&nd);
179         goto out;
180 }
181
182 #ifdef CONFIG_MMU
183
184 static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
185                 int write)
186 {
187         struct page *page;
188         int ret;
189
190 #ifdef CONFIG_STACK_GROWSUP
191         if (write) {
192                 ret = expand_stack_downwards(bprm->vma, pos);
193                 if (ret < 0)
194                         return NULL;
195         }
196 #endif
197         ret = get_user_pages(current, bprm->mm, pos,
198                         1, write, 1, &page, NULL);
199         if (ret <= 0)
200                 return NULL;
201
202         if (write) {
203                 struct rlimit *rlim = current->signal->rlim;
204                 unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
205
206                 /*
207                  * Limit to 1/4-th the stack size for the argv+env strings.
208                  * This ensures that:
209                  *  - the remaining binfmt code will not run out of stack space,
210                  *  - the program will have a reasonable amount of stack left
211                  *    to work from.
212                  */
213                 if (size > rlim[RLIMIT_STACK].rlim_cur / 4) {
214                         put_page(page);
215                         return NULL;
216                 }
217         }
218
219         return page;
220 }
221
222 static void put_arg_page(struct page *page)
223 {
224         put_page(page);
225 }
226
227 static void free_arg_page(struct linux_binprm *bprm, int i)
228 {
229 }
230
231 static void free_arg_pages(struct linux_binprm *bprm)
232 {
233 }
234
235 static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
236                 struct page *page)
237 {
238         flush_cache_page(bprm->vma, pos, page_to_pfn(page));
239 }
240
241 static int __bprm_mm_init(struct linux_binprm *bprm)
242 {
243         int err = -ENOMEM;
244         struct vm_area_struct *vma = NULL;
245         struct mm_struct *mm = bprm->mm;
246
247         bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
248         if (!vma)
249                 goto err;
250
251         down_write(&mm->mmap_sem);
252         vma->vm_mm = mm;
253
254         /*
255          * Place the stack at the largest stack address the architecture
256          * supports. Later, we'll move this to an appropriate place. We don't
257          * use STACK_TOP because that can depend on attributes which aren't
258          * configured yet.
259          */
260         vma->vm_end = STACK_TOP_MAX;
261         vma->vm_start = vma->vm_end - PAGE_SIZE;
262
263         vma->vm_flags = VM_STACK_FLAGS;
264         vma->vm_page_prot = protection_map[vma->vm_flags & 0x7];
265         err = insert_vm_struct(mm, vma);
266         if (err) {
267                 up_write(&mm->mmap_sem);
268                 goto err;
269         }
270
271         mm->stack_vm = mm->total_vm = 1;
272         up_write(&mm->mmap_sem);
273
274         bprm->p = vma->vm_end - sizeof(void *);
275
276         return 0;
277
278 err:
279         if (vma) {
280                 bprm->vma = NULL;
281                 kmem_cache_free(vm_area_cachep, vma);
282         }
283
284         return err;
285 }
286
287 static bool valid_arg_len(struct linux_binprm *bprm, long len)
288 {
289         return len <= MAX_ARG_STRLEN;
290 }
291
292 #else
293
294 static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
295                 int write)
296 {
297         struct page *page;
298
299         page = bprm->page[pos / PAGE_SIZE];
300         if (!page && write) {
301                 page = alloc_page(GFP_HIGHUSER|__GFP_ZERO);
302                 if (!page)
303                         return NULL;
304                 bprm->page[pos / PAGE_SIZE] = page;
305         }
306
307         return page;
308 }
309
310 static void put_arg_page(struct page *page)
311 {
312 }
313
314 static void free_arg_page(struct linux_binprm *bprm, int i)
315 {
316         if (bprm->page[i]) {
317                 __free_page(bprm->page[i]);
318                 bprm->page[i] = NULL;
319         }
320 }
321
322 static void free_arg_pages(struct linux_binprm *bprm)
323 {
324         int i;
325
326         for (i = 0; i < MAX_ARG_PAGES; i++)
327                 free_arg_page(bprm, i);
328 }
329
330 static void flush_arg_page(struct linux_binprm *bprm, unsigned long pos,
331                 struct page *page)
332 {
333 }
334
335 static int __bprm_mm_init(struct linux_binprm *bprm)
336 {
337         bprm->p = PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *);
338         return 0;
339 }
340
341 static bool valid_arg_len(struct linux_binprm *bprm, long len)
342 {
343         return len <= bprm->p;
344 }
345
346 #endif /* CONFIG_MMU */
347
348 /*
349  * Create a new mm_struct and populate it with a temporary stack
350  * vm_area_struct.  We don't have enough context at this point to set the stack
351  * flags, permissions, and offset, so we use temporary values.  We'll update
352  * them later in setup_arg_pages().
353  */
354 int bprm_mm_init(struct linux_binprm *bprm)
355 {
356         int err;
357         struct mm_struct *mm = NULL;
358
359         bprm->mm = mm = mm_alloc();
360         err = -ENOMEM;
361         if (!mm)
362                 goto err;
363
364         err = init_new_context(current, mm);
365         if (err)
366                 goto err;
367
368         err = __bprm_mm_init(bprm);
369         if (err)
370                 goto err;
371
372         return 0;
373
374 err:
375         if (mm) {
376                 bprm->mm = NULL;
377                 mmdrop(mm);
378         }
379
380         return err;
381 }
382
383 /*
384  * count() counts the number of strings in array ARGV.
385  */
386 static int count(char __user * __user * argv, int max)
387 {
388         int i = 0;
389
390         if (argv != NULL) {
391                 for (;;) {
392                         char __user * p;
393
394                         if (get_user(p, argv))
395                                 return -EFAULT;
396                         if (!p)
397                                 break;
398                         argv++;
399                         if(++i > max)
400                                 return -E2BIG;
401                         cond_resched();
402                 }
403         }
404         return i;
405 }
406
407 /*
408  * 'copy_strings()' copies argument/environment strings from the old
409  * processes's memory to the new process's stack.  The call to get_user_pages()
410  * ensures the destination page is created and not swapped out.
411  */
412 static int copy_strings(int argc, char __user * __user * argv,
413                         struct linux_binprm *bprm)
414 {
415         struct page *kmapped_page = NULL;
416         char *kaddr = NULL;
417         unsigned long kpos = 0;
418         int ret;
419
420         while (argc-- > 0) {
421                 char __user *str;
422                 int len;
423                 unsigned long pos;
424
425                 if (get_user(str, argv+argc) ||
426                                 !(len = strnlen_user(str, MAX_ARG_STRLEN))) {
427                         ret = -EFAULT;
428                         goto out;
429                 }
430
431                 if (!valid_arg_len(bprm, len)) {
432                         ret = -E2BIG;
433                         goto out;
434                 }
435
436                 /* We're going to work our way backwords. */
437                 pos = bprm->p;
438                 str += len;
439                 bprm->p -= len;
440
441                 while (len > 0) {
442                         int offset, bytes_to_copy;
443
444                         offset = pos % PAGE_SIZE;
445                         if (offset == 0)
446                                 offset = PAGE_SIZE;
447
448                         bytes_to_copy = offset;
449                         if (bytes_to_copy > len)
450                                 bytes_to_copy = len;
451
452                         offset -= bytes_to_copy;
453                         pos -= bytes_to_copy;
454                         str -= bytes_to_copy;
455                         len -= bytes_to_copy;
456
457                         if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
458                                 struct page *page;
459
460                                 page = get_arg_page(bprm, pos, 1);
461                                 if (!page) {
462                                         ret = -E2BIG;
463                                         goto out;
464                                 }
465
466                                 if (kmapped_page) {
467                                         flush_kernel_dcache_page(kmapped_page);
468                                         kunmap(kmapped_page);
469                                         put_arg_page(kmapped_page);
470                                 }
471                                 kmapped_page = page;
472                                 kaddr = kmap(kmapped_page);
473                                 kpos = pos & PAGE_MASK;
474                                 flush_arg_page(bprm, kpos, kmapped_page);
475                         }
476                         if (copy_from_user(kaddr+offset, str, bytes_to_copy)) {
477                                 ret = -EFAULT;
478                                 goto out;
479                         }
480                 }
481         }
482         ret = 0;
483 out:
484         if (kmapped_page) {
485                 flush_kernel_dcache_page(kmapped_page);
486                 kunmap(kmapped_page);
487                 put_arg_page(kmapped_page);
488         }
489         return ret;
490 }
491
492 /*
493  * Like copy_strings, but get argv and its values from kernel memory.
494  */
495 int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
496 {
497         int r;
498         mm_segment_t oldfs = get_fs();
499         set_fs(KERNEL_DS);
500         r = copy_strings(argc, (char __user * __user *)argv, bprm);
501         set_fs(oldfs);
502         return r;
503 }
504 EXPORT_SYMBOL(copy_strings_kernel);
505
506 #ifdef CONFIG_MMU
507
508 /*
509  * During bprm_mm_init(), we create a temporary stack at STACK_TOP_MAX.  Once
510  * the binfmt code determines where the new stack should reside, we shift it to
511  * its final location.  The process proceeds as follows:
512  *
513  * 1) Use shift to calculate the new vma endpoints.
514  * 2) Extend vma to cover both the old and new ranges.  This ensures the
515  *    arguments passed to subsequent functions are consistent.
516  * 3) Move vma's page tables to the new range.
517  * 4) Free up any cleared pgd range.
518  * 5) Shrink the vma to cover only the new range.
519  */
520 static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
521 {
522         struct mm_struct *mm = vma->vm_mm;
523         unsigned long old_start = vma->vm_start;
524         unsigned long old_end = vma->vm_end;
525         unsigned long length = old_end - old_start;
526         unsigned long new_start = old_start - shift;
527         unsigned long new_end = old_end - shift;
528         struct mmu_gather *tlb;
529
530         BUG_ON(new_start > new_end);
531
532         /*
533          * ensure there are no vmas between where we want to go
534          * and where we are
535          */
536         if (vma != find_vma(mm, new_start))
537                 return -EFAULT;
538
539         /*
540          * cover the whole range: [new_start, old_end)
541          */
542         vma_adjust(vma, new_start, old_end, vma->vm_pgoff, NULL);
543
544         /*
545          * move the page tables downwards, on failure we rely on
546          * process cleanup to remove whatever mess we made.
547          */
548         if (length != move_page_tables(vma, old_start,
549                                        vma, new_start, length))
550                 return -ENOMEM;
551
552         lru_add_drain();
553         tlb = tlb_gather_mmu(mm, 0);
554         if (new_end > old_start) {
555                 /*
556                  * when the old and new regions overlap clear from new_end.
557                  */
558                 free_pgd_range(&tlb, new_end, old_end, new_end,
559                         vma->vm_next ? vma->vm_next->vm_start : 0);
560         } else {
561                 /*
562                  * otherwise, clean from old_start; this is done to not touch
563                  * the address space in [new_end, old_start) some architectures
564                  * have constraints on va-space that make this illegal (IA64) -
565                  * for the others its just a little faster.
566                  */
567                 free_pgd_range(&tlb, old_start, old_end, new_end,
568                         vma->vm_next ? vma->vm_next->vm_start : 0);
569         }
570         tlb_finish_mmu(tlb, new_end, old_end);
571
572         /*
573          * shrink the vma to just the new range.
574          */
575         vma_adjust(vma, new_start, new_end, vma->vm_pgoff, NULL);
576
577         return 0;
578 }
579
580 #define EXTRA_STACK_VM_PAGES    20      /* random */
581
582 /*
583  * Finalizes the stack vm_area_struct. The flags and permissions are updated,
584  * the stack is optionally relocated, and some extra space is added.
585  */
586 int setup_arg_pages(struct linux_binprm *bprm,
587                     unsigned long stack_top,
588                     int executable_stack)
589 {
590         unsigned long ret;
591         unsigned long stack_shift;
592         struct mm_struct *mm = current->mm;
593         struct vm_area_struct *vma = bprm->vma;
594         struct vm_area_struct *prev = NULL;
595         unsigned long vm_flags;
596         unsigned long stack_base;
597
598 #ifdef CONFIG_STACK_GROWSUP
599         /* Limit stack size to 1GB */
600         stack_base = current->signal->rlim[RLIMIT_STACK].rlim_max;
601         if (stack_base > (1 << 30))
602                 stack_base = 1 << 30;
603
604         /* Make sure we didn't let the argument array grow too large. */
605         if (vma->vm_end - vma->vm_start > stack_base)
606                 return -ENOMEM;
607
608         stack_base = PAGE_ALIGN(stack_top - stack_base);
609
610         stack_shift = vma->vm_start - stack_base;
611         mm->arg_start = bprm->p - stack_shift;
612         bprm->p = vma->vm_end - stack_shift;
613 #else
614         stack_top = arch_align_stack(stack_top);
615         stack_top = PAGE_ALIGN(stack_top);
616         stack_shift = vma->vm_end - stack_top;
617
618         bprm->p -= stack_shift;
619         mm->arg_start = bprm->p;
620 #endif
621
622         if (bprm->loader)
623                 bprm->loader -= stack_shift;
624         bprm->exec -= stack_shift;
625
626         down_write(&mm->mmap_sem);
627         vm_flags = vma->vm_flags;
628
629         /*
630          * Adjust stack execute permissions; explicitly enable for
631          * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
632          * (arch default) otherwise.
633          */
634         if (unlikely(executable_stack == EXSTACK_ENABLE_X))
635                 vm_flags |= VM_EXEC;
636         else if (executable_stack == EXSTACK_DISABLE_X)
637                 vm_flags &= ~VM_EXEC;
638         vm_flags |= mm->def_flags;
639
640         ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
641                         vm_flags);
642         if (ret)
643                 goto out_unlock;
644         BUG_ON(prev != vma);
645
646         /* Move stack pages down in memory. */
647         if (stack_shift) {
648                 ret = shift_arg_pages(vma, stack_shift);
649                 if (ret) {
650                         up_write(&mm->mmap_sem);
651                         return ret;
652                 }
653         }
654
655 #ifdef CONFIG_STACK_GROWSUP
656         stack_base = vma->vm_end + EXTRA_STACK_VM_PAGES * PAGE_SIZE;
657 #else
658         stack_base = vma->vm_start - EXTRA_STACK_VM_PAGES * PAGE_SIZE;
659 #endif
660         ret = expand_stack(vma, stack_base);
661         if (ret)
662                 ret = -EFAULT;
663
664 out_unlock:
665         up_write(&mm->mmap_sem);
666         return 0;
667 }
668 EXPORT_SYMBOL(setup_arg_pages);
669
670 #endif /* CONFIG_MMU */
671
672 struct file *open_exec(const char *name)
673 {
674         struct nameidata nd;
675         int err;
676         struct file *file;
677
678         err = path_lookup_open(AT_FDCWD, name, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
679         file = ERR_PTR(err);
680
681         if (!err) {
682                 struct inode *inode = nd.dentry->d_inode;
683                 file = ERR_PTR(-EACCES);
684                 if (!(nd.mnt->mnt_flags & MNT_NOEXEC) &&
685                     S_ISREG(inode->i_mode)) {
686                         int err = vfs_permission(&nd, MAY_EXEC);
687                         file = ERR_PTR(err);
688                         if (!err) {
689                                 file = nameidata_to_filp(&nd, O_RDONLY);
690                                 if (!IS_ERR(file)) {
691                                         err = deny_write_access(file);
692                                         if (err) {
693                                                 fput(file);
694                                                 file = ERR_PTR(err);
695                                         }
696                                 }
697 out:
698                                 return file;
699                         }
700                 }
701                 release_open_intent(&nd);
702                 path_release(&nd);
703         }
704         goto out;
705 }
706
707 EXPORT_SYMBOL(open_exec);
708
709 int kernel_read(struct file *file, unsigned long offset,
710         char *addr, unsigned long count)
711 {
712         mm_segment_t old_fs;
713         loff_t pos = offset;
714         int result;
715
716         old_fs = get_fs();
717         set_fs(get_ds());
718         /* The cast to a user pointer is valid due to the set_fs() */
719         result = vfs_read(file, (void __user *)addr, count, &pos);
720         set_fs(old_fs);
721         return result;
722 }
723
724 EXPORT_SYMBOL(kernel_read);
725
726 static int exec_mmap(struct mm_struct *mm)
727 {
728         struct task_struct *tsk;
729         struct mm_struct * old_mm, *active_mm;
730
731         /* Notify parent that we're no longer interested in the old VM */
732         tsk = current;
733         old_mm = current->mm;
734         mm_release(tsk, old_mm);
735
736         if (old_mm) {
737                 /*
738                  * Make sure that if there is a core dump in progress
739                  * for the old mm, we get out and die instead of going
740                  * through with the exec.  We must hold mmap_sem around
741                  * checking core_waiters and changing tsk->mm.  The
742                  * core-inducing thread will increment core_waiters for
743                  * each thread whose ->mm == old_mm.
744                  */
745                 down_read(&old_mm->mmap_sem);
746                 if (unlikely(old_mm->core_waiters)) {
747                         up_read(&old_mm->mmap_sem);
748                         return -EINTR;
749                 }
750         }
751         task_lock(tsk);
752         active_mm = tsk->active_mm;
753         tsk->mm = mm;
754         tsk->active_mm = mm;
755         activate_mm(active_mm, mm);
756         task_unlock(tsk);
757         arch_pick_mmap_layout(mm);
758         if (old_mm) {
759                 up_read(&old_mm->mmap_sem);
760                 BUG_ON(active_mm != old_mm);
761                 mmput(old_mm);
762                 return 0;
763         }
764         mmdrop(active_mm);
765         return 0;
766 }
767
768 /*
769  * This function makes sure the current process has its own signal table,
770  * so that flush_signal_handlers can later reset the handlers without
771  * disturbing other processes.  (Other processes might share the signal
772  * table via the CLONE_SIGHAND option to clone().)
773  */
774 static int de_thread(struct task_struct *tsk)
775 {
776         struct signal_struct *sig = tsk->signal;
777         struct sighand_struct *newsighand, *oldsighand = tsk->sighand;
778         spinlock_t *lock = &oldsighand->siglock;
779         struct task_struct *leader = NULL;
780         int count;
781
782         /*
783          * Tell all the sighand listeners that this sighand has
784          * been detached. The signalfd_detach() function grabs the
785          * sighand lock, if signal listeners are present on the sighand.
786          */
787         signalfd_detach(tsk);
788
789         /*
790          * If we don't share sighandlers, then we aren't sharing anything
791          * and we can just re-use it all.
792          */
793         if (atomic_read(&oldsighand->count) <= 1) {
794                 BUG_ON(atomic_read(&sig->count) != 1);
795                 exit_itimers(sig);
796                 return 0;
797         }
798
799         newsighand = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
800         if (!newsighand)
801                 return -ENOMEM;
802
803         if (thread_group_empty(tsk))
804                 goto no_thread_group;
805
806         /*
807          * Kill all other threads in the thread group.
808          * We must hold tasklist_lock to call zap_other_threads.
809          */
810         read_lock(&tasklist_lock);
811         spin_lock_irq(lock);
812         if (sig->flags & SIGNAL_GROUP_EXIT) {
813                 /*
814                  * Another group action in progress, just
815                  * return so that the signal is processed.
816                  */
817                 spin_unlock_irq(lock);
818                 read_unlock(&tasklist_lock);
819                 kmem_cache_free(sighand_cachep, newsighand);
820                 return -EAGAIN;
821         }
822
823         /*
824          * child_reaper ignores SIGKILL, change it now.
825          * Reparenting needs write_lock on tasklist_lock,
826          * so it is safe to do it under read_lock.
827          */
828         if (unlikely(tsk->group_leader == child_reaper(tsk)))
829                 tsk->nsproxy->pid_ns->child_reaper = tsk;
830
831         zap_other_threads(tsk);
832         read_unlock(&tasklist_lock);
833
834         /*
835          * Account for the thread group leader hanging around:
836          */
837         count = 1;
838         if (!thread_group_leader(tsk)) {
839                 count = 2;
840                 /*
841                  * The SIGALRM timer survives the exec, but needs to point
842                  * at us as the new group leader now.  We have a race with
843                  * a timer firing now getting the old leader, so we need to
844                  * synchronize with any firing (by calling del_timer_sync)
845                  * before we can safely let the old group leader die.
846                  */
847                 sig->tsk = tsk;
848                 spin_unlock_irq(lock);
849                 if (hrtimer_cancel(&sig->real_timer))
850                         hrtimer_restart(&sig->real_timer);
851                 spin_lock_irq(lock);
852         }
853         while (atomic_read(&sig->count) > count) {
854                 sig->group_exit_task = tsk;
855                 sig->notify_count = count;
856                 __set_current_state(TASK_UNINTERRUPTIBLE);
857                 spin_unlock_irq(lock);
858                 schedule();
859                 spin_lock_irq(lock);
860         }
861         sig->group_exit_task = NULL;
862         sig->notify_count = 0;
863         spin_unlock_irq(lock);
864
865         /*
866          * At this point all other threads have exited, all we have to
867          * do is to wait for the thread group leader to become inactive,
868          * and to assume its PID:
869          */
870         if (!thread_group_leader(tsk)) {
871                 /*
872                  * Wait for the thread group leader to be a zombie.
873                  * It should already be zombie at this point, most
874                  * of the time.
875                  */
876                 leader = tsk->group_leader;
877                 while (leader->exit_state != EXIT_ZOMBIE)
878                         yield();
879
880                 /*
881                  * The only record we have of the real-time age of a
882                  * process, regardless of execs it's done, is start_time.
883                  * All the past CPU time is accumulated in signal_struct
884                  * from sister threads now dead.  But in this non-leader
885                  * exec, nothing survives from the original leader thread,
886                  * whose birth marks the true age of this process now.
887                  * When we take on its identity by switching to its PID, we
888                  * also take its birthdate (always earlier than our own).
889                  */
890                 tsk->start_time = leader->start_time;
891
892                 write_lock_irq(&tasklist_lock);
893
894                 BUG_ON(leader->tgid != tsk->tgid);
895                 BUG_ON(tsk->pid == tsk->tgid);
896                 /*
897                  * An exec() starts a new thread group with the
898                  * TGID of the previous thread group. Rehash the
899                  * two threads with a switched PID, and release
900                  * the former thread group leader:
901                  */
902
903                 /* Become a process group leader with the old leader's pid.
904                  * The old leader becomes a thread of the this thread group.
905                  * Note: The old leader also uses this pid until release_task
906                  *       is called.  Odd but simple and correct.
907                  */
908                 detach_pid(tsk, PIDTYPE_PID);
909                 tsk->pid = leader->pid;
910                 attach_pid(tsk, PIDTYPE_PID,  find_pid(tsk->pid));
911                 transfer_pid(leader, tsk, PIDTYPE_PGID);
912                 transfer_pid(leader, tsk, PIDTYPE_SID);
913                 list_replace_rcu(&leader->tasks, &tsk->tasks);
914
915                 tsk->group_leader = tsk;
916                 leader->group_leader = tsk;
917
918                 tsk->exit_signal = SIGCHLD;
919
920                 BUG_ON(leader->exit_state != EXIT_ZOMBIE);
921                 leader->exit_state = EXIT_DEAD;
922
923                 write_unlock_irq(&tasklist_lock);
924         }
925
926         /*
927          * There may be one thread left which is just exiting,
928          * but it's safe to stop telling the group to kill themselves.
929          */
930         sig->flags = 0;
931
932 no_thread_group:
933         exit_itimers(sig);
934         if (leader)
935                 release_task(leader);
936
937         BUG_ON(atomic_read(&sig->count) != 1);
938
939         if (atomic_read(&oldsighand->count) == 1) {
940                 /*
941                  * Now that we nuked the rest of the thread group,
942                  * it turns out we are not sharing sighand any more either.
943                  * So we can just keep it.
944                  */
945                 kmem_cache_free(sighand_cachep, newsighand);
946         } else {
947                 /*
948                  * Move our state over to newsighand and switch it in.
949                  */
950                 atomic_set(&newsighand->count, 1);
951                 memcpy(newsighand->action, oldsighand->action,
952                        sizeof(newsighand->action));
953
954                 write_lock_irq(&tasklist_lock);
955                 spin_lock(&oldsighand->siglock);
956                 spin_lock_nested(&newsighand->siglock, SINGLE_DEPTH_NESTING);
957
958                 rcu_assign_pointer(tsk->sighand, newsighand);
959                 recalc_sigpending();
960
961                 spin_unlock(&newsighand->siglock);
962                 spin_unlock(&oldsighand->siglock);
963                 write_unlock_irq(&tasklist_lock);
964
965                 __cleanup_sighand(oldsighand);
966         }
967
968         BUG_ON(!thread_group_leader(tsk));
969         return 0;
970 }
971         
972 /*
973  * These functions flushes out all traces of the currently running executable
974  * so that a new one can be started
975  */
976
977 static void flush_old_files(struct files_struct * files)
978 {
979         long j = -1;
980         struct fdtable *fdt;
981
982         spin_lock(&files->file_lock);
983         for (;;) {
984                 unsigned long set, i;
985
986                 j++;
987                 i = j * __NFDBITS;
988                 fdt = files_fdtable(files);
989                 if (i >= fdt->max_fds)
990                         break;
991                 set = fdt->close_on_exec->fds_bits[j];
992                 if (!set)
993                         continue;
994                 fdt->close_on_exec->fds_bits[j] = 0;
995                 spin_unlock(&files->file_lock);
996                 for ( ; set ; i++,set >>= 1) {
997                         if (set & 1) {
998                                 sys_close(i);
999                         }
1000                 }
1001                 spin_lock(&files->file_lock);
1002
1003         }
1004         spin_unlock(&files->file_lock);
1005 }
1006
1007 void get_task_comm(char *buf, struct task_struct *tsk)
1008 {
1009         /* buf must be at least sizeof(tsk->comm) in size */
1010         task_lock(tsk);
1011         strncpy(buf, tsk->comm, sizeof(tsk->comm));
1012         task_unlock(tsk);
1013 }
1014
1015 void set_task_comm(struct task_struct *tsk, char *buf)
1016 {
1017         task_lock(tsk);
1018         strlcpy(tsk->comm, buf, sizeof(tsk->comm));
1019         task_unlock(tsk);
1020 }
1021
1022 int flush_old_exec(struct linux_binprm * bprm)
1023 {
1024         char * name;
1025         int i, ch, retval;
1026         struct files_struct *files;
1027         char tcomm[sizeof(current->comm)];
1028
1029         /*
1030          * Make sure we have a private signal table and that
1031          * we are unassociated from the previous thread group.
1032          */
1033         retval = de_thread(current);
1034         if (retval)
1035                 goto out;
1036
1037         /*
1038          * Make sure we have private file handles. Ask the
1039          * fork helper to do the work for us and the exit
1040          * helper to do the cleanup of the old one.
1041          */
1042         files = current->files;         /* refcounted so safe to hold */
1043         retval = unshare_files();
1044         if (retval)
1045                 goto out;
1046         /*
1047          * Release all of the old mmap stuff
1048          */
1049         retval = exec_mmap(bprm->mm);
1050         if (retval)
1051                 goto mmap_failed;
1052
1053         bprm->mm = NULL;                /* We're using it now */
1054
1055         /* This is the point of no return */
1056         put_files_struct(files);
1057
1058         current->sas_ss_sp = current->sas_ss_size = 0;
1059
1060         if (current->euid == current->uid && current->egid == current->gid)
1061                 current->mm->dumpable = 1;
1062         else
1063                 current->mm->dumpable = suid_dumpable;
1064
1065         name = bprm->filename;
1066
1067         /* Copies the binary name from after last slash */
1068         for (i=0; (ch = *(name++)) != '\0';) {
1069                 if (ch == '/')
1070                         i = 0; /* overwrite what we wrote */
1071                 else
1072                         if (i < (sizeof(tcomm) - 1))
1073                                 tcomm[i++] = ch;
1074         }
1075         tcomm[i] = '\0';
1076         set_task_comm(current, tcomm);
1077
1078         current->flags &= ~PF_RANDOMIZE;
1079         flush_thread();
1080
1081         /* Set the new mm task size. We have to do that late because it may
1082          * depend on TIF_32BIT which is only updated in flush_thread() on
1083          * some architectures like powerpc
1084          */
1085         current->mm->task_size = TASK_SIZE;
1086
1087         if (bprm->e_uid != current->euid || bprm->e_gid != current->egid || 
1088             file_permission(bprm->file, MAY_READ) ||
1089             (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
1090                 suid_keys(current);
1091                 current->mm->dumpable = suid_dumpable;
1092         }
1093
1094         /* An exec changes our domain. We are no longer part of the thread
1095            group */
1096
1097         current->self_exec_id++;
1098                         
1099         flush_signal_handlers(current, 0);
1100         flush_old_files(current->files);
1101
1102         return 0;
1103
1104 mmap_failed:
1105         reset_files_struct(current, files);
1106 out:
1107         return retval;
1108 }
1109
1110 EXPORT_SYMBOL(flush_old_exec);
1111
1112 /* 
1113  * Fill the binprm structure from the inode. 
1114  * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
1115  */
1116 int prepare_binprm(struct linux_binprm *bprm)
1117 {
1118         int mode;
1119         struct inode * inode = bprm->file->f_path.dentry->d_inode;
1120         int retval;
1121
1122         mode = inode->i_mode;
1123         if (bprm->file->f_op == NULL)
1124                 return -EACCES;
1125
1126         bprm->e_uid = current->euid;
1127         bprm->e_gid = current->egid;
1128
1129         if(!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
1130                 /* Set-uid? */
1131                 if (mode & S_ISUID) {
1132                         current->personality &= ~PER_CLEAR_ON_SETID;
1133                         bprm->e_uid = inode->i_uid;
1134                 }
1135
1136                 /* Set-gid? */
1137                 /*
1138                  * If setgid is set but no group execute bit then this
1139                  * is a candidate for mandatory locking, not a setgid
1140                  * executable.
1141                  */
1142                 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
1143                         current->personality &= ~PER_CLEAR_ON_SETID;
1144                         bprm->e_gid = inode->i_gid;
1145                 }
1146         }
1147
1148         /* fill in binprm security blob */
1149         retval = security_bprm_set(bprm);
1150         if (retval)
1151                 return retval;
1152
1153         memset(bprm->buf,0,BINPRM_BUF_SIZE);
1154         return kernel_read(bprm->file,0,bprm->buf,BINPRM_BUF_SIZE);
1155 }
1156
1157 EXPORT_SYMBOL(prepare_binprm);
1158
1159 static int unsafe_exec(struct task_struct *p)
1160 {
1161         int unsafe = 0;
1162         if (p->ptrace & PT_PTRACED) {
1163                 if (p->ptrace & PT_PTRACE_CAP)
1164                         unsafe |= LSM_UNSAFE_PTRACE_CAP;
1165                 else
1166                         unsafe |= LSM_UNSAFE_PTRACE;
1167         }
1168         if (atomic_read(&p->fs->count) > 1 ||
1169             atomic_read(&p->files->count) > 1 ||
1170             atomic_read(&p->sighand->count) > 1)
1171                 unsafe |= LSM_UNSAFE_SHARE;
1172
1173         return unsafe;
1174 }
1175
1176 void compute_creds(struct linux_binprm *bprm)
1177 {
1178         int unsafe;
1179
1180         if (bprm->e_uid != current->uid)
1181                 suid_keys(current);
1182         exec_keys(current);
1183
1184         task_lock(current);
1185         unsafe = unsafe_exec(current);
1186         security_bprm_apply_creds(bprm, unsafe);
1187         task_unlock(current);
1188         security_bprm_post_apply_creds(bprm);
1189 }
1190 EXPORT_SYMBOL(compute_creds);
1191
1192 /*
1193  * Arguments are '\0' separated strings found at the location bprm->p
1194  * points to; chop off the first by relocating brpm->p to right after
1195  * the first '\0' encountered.
1196  */
1197 int remove_arg_zero(struct linux_binprm *bprm)
1198 {
1199         int ret = 0;
1200         unsigned long offset;
1201         char *kaddr;
1202         struct page *page;
1203
1204         if (!bprm->argc)
1205                 return 0;
1206
1207         do {
1208                 offset = bprm->p & ~PAGE_MASK;
1209                 page = get_arg_page(bprm, bprm->p, 0);
1210                 if (!page) {
1211                         ret = -EFAULT;
1212                         goto out;
1213                 }
1214                 kaddr = kmap_atomic(page, KM_USER0);
1215
1216                 for (; offset < PAGE_SIZE && kaddr[offset];
1217                                 offset++, bprm->p++)
1218                         ;
1219
1220                 kunmap_atomic(kaddr, KM_USER0);
1221                 put_arg_page(page);
1222
1223                 if (offset == PAGE_SIZE)
1224                         free_arg_page(bprm, (bprm->p >> PAGE_SHIFT) - 1);
1225         } while (offset == PAGE_SIZE);
1226
1227         bprm->p++;
1228         bprm->argc--;
1229         ret = 0;
1230
1231 out:
1232         return ret;
1233 }
1234 EXPORT_SYMBOL(remove_arg_zero);
1235
1236 /*
1237  * cycle the list of binary formats handler, until one recognizes the image
1238  */
1239 int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
1240 {
1241         int try,retval;
1242         struct linux_binfmt *fmt;
1243 #ifdef __alpha__
1244         /* handle /sbin/loader.. */
1245         {
1246             struct exec * eh = (struct exec *) bprm->buf;
1247
1248             if (!bprm->loader && eh->fh.f_magic == 0x183 &&
1249                 (eh->fh.f_flags & 0x3000) == 0x3000)
1250             {
1251                 struct file * file;
1252                 unsigned long loader;
1253
1254                 allow_write_access(bprm->file);
1255                 fput(bprm->file);
1256                 bprm->file = NULL;
1257
1258                 loader = bprm->vma->vm_end - sizeof(void *);
1259
1260                 file = open_exec("/sbin/loader");
1261                 retval = PTR_ERR(file);
1262                 if (IS_ERR(file))
1263                         return retval;
1264
1265                 /* Remember if the application is TASO.  */
1266                 bprm->sh_bang = eh->ah.entry < 0x100000000UL;
1267
1268                 bprm->file = file;
1269                 bprm->loader = loader;
1270                 retval = prepare_binprm(bprm);
1271                 if (retval<0)
1272                         return retval;
1273                 /* should call search_binary_handler recursively here,
1274                    but it does not matter */
1275             }
1276         }
1277 #endif
1278         retval = security_bprm_check(bprm);
1279         if (retval)
1280                 return retval;
1281
1282         /* kernel module loader fixup */
1283         /* so we don't try to load run modprobe in kernel space. */
1284         set_fs(USER_DS);
1285
1286         retval = audit_bprm(bprm);
1287         if (retval)
1288                 return retval;
1289
1290         retval = -ENOENT;
1291         for (try=0; try<2; try++) {
1292                 read_lock(&binfmt_lock);
1293                 for (fmt = formats ; fmt ; fmt = fmt->next) {
1294                         int (*fn)(struct linux_binprm *, struct pt_regs *) = fmt->load_binary;
1295                         if (!fn)
1296                                 continue;
1297                         if (!try_module_get(fmt->module))
1298                                 continue;
1299                         read_unlock(&binfmt_lock);
1300                         retval = fn(bprm, regs);
1301                         if (retval >= 0) {
1302                                 put_binfmt(fmt);
1303                                 allow_write_access(bprm->file);
1304                                 if (bprm->file)
1305                                         fput(bprm->file);
1306                                 bprm->file = NULL;
1307                                 current->did_exec = 1;
1308                                 proc_exec_connector(current);
1309                                 return retval;
1310                         }
1311                         read_lock(&binfmt_lock);
1312                         put_binfmt(fmt);
1313                         if (retval != -ENOEXEC || bprm->mm == NULL)
1314                                 break;
1315                         if (!bprm->file) {
1316                                 read_unlock(&binfmt_lock);
1317                                 return retval;
1318                         }
1319                 }
1320                 read_unlock(&binfmt_lock);
1321                 if (retval != -ENOEXEC || bprm->mm == NULL) {
1322                         break;
1323 #ifdef CONFIG_KMOD
1324                 }else{
1325 #define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
1326                         if (printable(bprm->buf[0]) &&
1327                             printable(bprm->buf[1]) &&
1328                             printable(bprm->buf[2]) &&
1329                             printable(bprm->buf[3]))
1330                                 break; /* -ENOEXEC */
1331                         request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
1332 #endif
1333                 }
1334         }
1335         return retval;
1336 }
1337
1338 EXPORT_SYMBOL(search_binary_handler);
1339
1340 /*
1341  * sys_execve() executes a new program.
1342  */
1343 int do_execve(char * filename,
1344         char __user *__user *argv,
1345         char __user *__user *envp,
1346         struct pt_regs * regs)
1347 {
1348         struct linux_binprm *bprm;
1349         struct file *file;
1350         unsigned long env_p;
1351         int retval;
1352
1353         retval = -ENOMEM;
1354         bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
1355         if (!bprm)
1356                 goto out_ret;
1357
1358         file = open_exec(filename);
1359         retval = PTR_ERR(file);
1360         if (IS_ERR(file))
1361                 goto out_kfree;
1362
1363         sched_exec();
1364
1365         bprm->file = file;
1366         bprm->filename = filename;
1367         bprm->interp = filename;
1368
1369         retval = bprm_mm_init(bprm);
1370         if (retval)
1371                 goto out_file;
1372
1373         bprm->argc = count(argv, MAX_ARG_STRINGS);
1374         if ((retval = bprm->argc) < 0)
1375                 goto out_mm;
1376
1377         bprm->envc = count(envp, MAX_ARG_STRINGS);
1378         if ((retval = bprm->envc) < 0)
1379                 goto out_mm;
1380
1381         retval = security_bprm_alloc(bprm);
1382         if (retval)
1383                 goto out;
1384
1385         retval = prepare_binprm(bprm);
1386         if (retval < 0)
1387                 goto out;
1388
1389         retval = copy_strings_kernel(1, &bprm->filename, bprm);
1390         if (retval < 0)
1391                 goto out;
1392
1393         bprm->exec = bprm->p;
1394         retval = copy_strings(bprm->envc, envp, bprm);
1395         if (retval < 0)
1396                 goto out;
1397
1398         env_p = bprm->p;
1399         retval = copy_strings(bprm->argc, argv, bprm);
1400         if (retval < 0)
1401                 goto out;
1402         bprm->argv_len = env_p - bprm->p;
1403
1404         retval = search_binary_handler(bprm,regs);
1405         if (retval >= 0) {
1406                 /* execve success */
1407                 free_arg_pages(bprm);
1408                 security_bprm_free(bprm);
1409                 acct_update_integrals(current);
1410                 kfree(bprm);
1411                 return retval;
1412         }
1413
1414 out:
1415         free_arg_pages(bprm);
1416         if (bprm->security)
1417                 security_bprm_free(bprm);
1418
1419 out_mm:
1420         if (bprm->mm)
1421                 mmput (bprm->mm);
1422
1423 out_file:
1424         if (bprm->file) {
1425                 allow_write_access(bprm->file);
1426                 fput(bprm->file);
1427         }
1428 out_kfree:
1429         kfree(bprm);
1430
1431 out_ret:
1432         return retval;
1433 }
1434
1435 int set_binfmt(struct linux_binfmt *new)
1436 {
1437         struct linux_binfmt *old = current->binfmt;
1438
1439         if (new) {
1440                 if (!try_module_get(new->module))
1441                         return -1;
1442         }
1443         current->binfmt = new;
1444         if (old)
1445                 module_put(old->module);
1446         return 0;
1447 }
1448
1449 EXPORT_SYMBOL(set_binfmt);
1450
1451 /* format_corename will inspect the pattern parameter, and output a
1452  * name into corename, which must have space for at least
1453  * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
1454  */
1455 static int format_corename(char *corename, const char *pattern, long signr)
1456 {
1457         const char *pat_ptr = pattern;
1458         char *out_ptr = corename;
1459         char *const out_end = corename + CORENAME_MAX_SIZE;
1460         int rc;
1461         int pid_in_pattern = 0;
1462         int ispipe = 0;
1463
1464         if (*pattern == '|')
1465                 ispipe = 1;
1466
1467         /* Repeat as long as we have more pattern to process and more output
1468            space */
1469         while (*pat_ptr) {
1470                 if (*pat_ptr != '%') {
1471                         if (out_ptr == out_end)
1472                                 goto out;
1473                         *out_ptr++ = *pat_ptr++;
1474                 } else {
1475                         switch (*++pat_ptr) {
1476                         case 0:
1477                                 goto out;
1478                         /* Double percent, output one percent */
1479                         case '%':
1480                                 if (out_ptr == out_end)
1481                                         goto out;
1482                                 *out_ptr++ = '%';
1483                                 break;
1484                         /* pid */
1485                         case 'p':
1486                                 pid_in_pattern = 1;
1487                                 rc = snprintf(out_ptr, out_end - out_ptr,
1488                                               "%d", current->tgid);
1489                                 if (rc > out_end - out_ptr)
1490                                         goto out;
1491                                 out_ptr += rc;
1492                                 break;
1493                         /* uid */
1494                         case 'u':
1495                                 rc = snprintf(out_ptr, out_end - out_ptr,
1496                                               "%d", current->uid);
1497                                 if (rc > out_end - out_ptr)
1498                                         goto out;
1499                                 out_ptr += rc;
1500                                 break;
1501                         /* gid */
1502                         case 'g':
1503                                 rc = snprintf(out_ptr, out_end - out_ptr,
1504                                               "%d", current->gid);
1505                                 if (rc > out_end - out_ptr)
1506                                         goto out;
1507                                 out_ptr += rc;
1508                                 break;
1509                         /* signal that caused the coredump */
1510                         case 's':
1511                                 rc = snprintf(out_ptr, out_end - out_ptr,
1512                                               "%ld", signr);
1513                                 if (rc > out_end - out_ptr)
1514                                         goto out;
1515                                 out_ptr += rc;
1516                                 break;
1517                         /* UNIX time of coredump */
1518                         case 't': {
1519                                 struct timeval tv;
1520                                 do_gettimeofday(&tv);
1521                                 rc = snprintf(out_ptr, out_end - out_ptr,
1522                                               "%lu", tv.tv_sec);
1523                                 if (rc > out_end - out_ptr)
1524                                         goto out;
1525                                 out_ptr += rc;
1526                                 break;
1527                         }
1528                         /* hostname */
1529                         case 'h':
1530                                 down_read(&uts_sem);
1531                                 rc = snprintf(out_ptr, out_end - out_ptr,
1532                                               "%s", utsname()->nodename);
1533                                 up_read(&uts_sem);
1534                                 if (rc > out_end - out_ptr)
1535                                         goto out;
1536                                 out_ptr += rc;
1537                                 break;
1538                         /* executable */
1539                         case 'e':
1540                                 rc = snprintf(out_ptr, out_end - out_ptr,
1541                                               "%s", current->comm);
1542                                 if (rc > out_end - out_ptr)
1543                                         goto out;
1544                                 out_ptr += rc;
1545                                 break;
1546                         default:
1547                                 break;
1548                         }
1549                         ++pat_ptr;
1550                 }
1551         }
1552         /* Backward compatibility with core_uses_pid:
1553          *
1554          * If core_pattern does not include a %p (as is the default)
1555          * and core_uses_pid is set, then .%pid will be appended to
1556          * the filename. Do not do this for piped commands. */
1557         if (!ispipe && !pid_in_pattern
1558             && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
1559                 rc = snprintf(out_ptr, out_end - out_ptr,
1560                               ".%d", current->tgid);
1561                 if (rc > out_end - out_ptr)
1562                         goto out;
1563                 out_ptr += rc;
1564         }
1565 out:
1566         *out_ptr = 0;
1567         return ispipe;
1568 }
1569
1570 static void zap_process(struct task_struct *start)
1571 {
1572         struct task_struct *t;
1573
1574         start->signal->flags = SIGNAL_GROUP_EXIT;
1575         start->signal->group_stop_count = 0;
1576
1577         t = start;
1578         do {
1579                 if (t != current && t->mm) {
1580                         t->mm->core_waiters++;
1581                         sigaddset(&t->pending.signal, SIGKILL);
1582                         signal_wake_up(t, 1);
1583                 }
1584         } while ((t = next_thread(t)) != start);
1585 }
1586
1587 static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
1588                                 int exit_code)
1589 {
1590         struct task_struct *g, *p;
1591         unsigned long flags;
1592         int err = -EAGAIN;
1593
1594         spin_lock_irq(&tsk->sighand->siglock);
1595         if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT)) {
1596                 tsk->signal->group_exit_code = exit_code;
1597                 zap_process(tsk);
1598                 err = 0;
1599         }
1600         spin_unlock_irq(&tsk->sighand->siglock);
1601         if (err)
1602                 return err;
1603
1604         if (atomic_read(&mm->mm_users) == mm->core_waiters + 1)
1605                 goto done;
1606
1607         rcu_read_lock();
1608         for_each_process(g) {
1609                 if (g == tsk->group_leader)
1610                         continue;
1611
1612                 p = g;
1613                 do {
1614                         if (p->mm) {
1615                                 if (p->mm == mm) {
1616                                         /*
1617                                          * p->sighand can't disappear, but
1618                                          * may be changed by de_thread()
1619                                          */
1620                                         lock_task_sighand(p, &flags);
1621                                         zap_process(p);
1622                                         unlock_task_sighand(p, &flags);
1623                                 }
1624                                 break;
1625                         }
1626                 } while ((p = next_thread(p)) != g);
1627         }
1628         rcu_read_unlock();
1629 done:
1630         return mm->core_waiters;
1631 }
1632
1633 static int coredump_wait(int exit_code)
1634 {
1635         struct task_struct *tsk = current;
1636         struct mm_struct *mm = tsk->mm;
1637         struct completion startup_done;
1638         struct completion *vfork_done;
1639         int core_waiters;
1640
1641         init_completion(&mm->core_done);
1642         init_completion(&startup_done);
1643         mm->core_startup_done = &startup_done;
1644
1645         core_waiters = zap_threads(tsk, mm, exit_code);
1646         up_write(&mm->mmap_sem);
1647
1648         if (unlikely(core_waiters < 0))
1649                 goto fail;
1650
1651         /*
1652          * Make sure nobody is waiting for us to release the VM,
1653          * otherwise we can deadlock when we wait on each other
1654          */
1655         vfork_done = tsk->vfork_done;
1656         if (vfork_done) {
1657                 tsk->vfork_done = NULL;
1658                 complete(vfork_done);
1659         }
1660
1661         if (core_waiters)
1662                 wait_for_completion(&startup_done);
1663 fail:
1664         BUG_ON(mm->core_waiters);
1665         return core_waiters;
1666 }
1667
1668 int do_coredump(long signr, int exit_code, struct pt_regs * regs)
1669 {
1670         char corename[CORENAME_MAX_SIZE + 1];
1671         struct mm_struct *mm = current->mm;
1672         struct linux_binfmt * binfmt;
1673         struct inode * inode;
1674         struct file * file;
1675         int retval = 0;
1676         int fsuid = current->fsuid;
1677         int flag = 0;
1678         int ispipe = 0;
1679
1680         audit_core_dumps(signr);
1681
1682         binfmt = current->binfmt;
1683         if (!binfmt || !binfmt->core_dump)
1684                 goto fail;
1685         down_write(&mm->mmap_sem);
1686         if (!mm->dumpable) {
1687                 up_write(&mm->mmap_sem);
1688                 goto fail;
1689         }
1690
1691         /*
1692          *      We cannot trust fsuid as being the "true" uid of the
1693          *      process nor do we know its entire history. We only know it
1694          *      was tainted so we dump it as root in mode 2.
1695          */
1696         if (mm->dumpable == 2) {        /* Setuid core dump mode */
1697                 flag = O_EXCL;          /* Stop rewrite attacks */
1698                 current->fsuid = 0;     /* Dump root private */
1699         }
1700         mm->dumpable = 0;
1701
1702         retval = coredump_wait(exit_code);
1703         if (retval < 0)
1704                 goto fail;
1705
1706         /*
1707          * Clear any false indication of pending signals that might
1708          * be seen by the filesystem code called to write the core file.
1709          */
1710         clear_thread_flag(TIF_SIGPENDING);
1711
1712         if (current->signal->rlim[RLIMIT_CORE].rlim_cur < binfmt->min_coredump)
1713                 goto fail_unlock;
1714
1715         /*
1716          * lock_kernel() because format_corename() is controlled by sysctl, which
1717          * uses lock_kernel()
1718          */
1719         lock_kernel();
1720         ispipe = format_corename(corename, core_pattern, signr);
1721         unlock_kernel();
1722         if (ispipe) {
1723                 /* SIGPIPE can happen, but it's just never processed */
1724                 if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
1725                         printk(KERN_INFO "Core dump to %s pipe failed\n",
1726                                corename);
1727                         goto fail_unlock;
1728                 }
1729         } else
1730                 file = filp_open(corename,
1731                                  O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
1732                                  0600);
1733         if (IS_ERR(file))
1734                 goto fail_unlock;
1735         inode = file->f_path.dentry->d_inode;
1736         if (inode->i_nlink > 1)
1737                 goto close_fail;        /* multiple links - don't dump */
1738         if (!ispipe && d_unhashed(file->f_path.dentry))
1739                 goto close_fail;
1740
1741         /* AK: actually i see no reason to not allow this for named pipes etc.,
1742            but keep the previous behaviour for now. */
1743         if (!ispipe && !S_ISREG(inode->i_mode))
1744                 goto close_fail;
1745         if (!file->f_op)
1746                 goto close_fail;
1747         if (!file->f_op->write)
1748                 goto close_fail;
1749         if (!ispipe && do_truncate(file->f_path.dentry, 0, 0, file) != 0)
1750                 goto close_fail;
1751
1752         retval = binfmt->core_dump(signr, regs, file);
1753
1754         if (retval)
1755                 current->signal->group_exit_code |= 0x80;
1756 close_fail:
1757         filp_close(file, NULL);
1758 fail_unlock:
1759         current->fsuid = fsuid;
1760         complete_all(&mm->core_done);
1761 fail:
1762         return retval;
1763 }