Commit acdedd99 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

coredump: sanitize the setting of signal->group_exit_code



Now that the coredumping process can be SIGKILL'ed, the setting of
->group_exit_code in do_coredump() can race with complete_signal() and
SIGKILL or 0x80 can be "lost", or wait(status) can report status ==
SIGKILL | 0x80.

But the main problem is that it is not clear to me what should we do if
binfmt->core_dump() succeeds but SIGKILL was sent, that is why this patch
comes as a separate change.

This patch adds 0x80 if ->core_dump() succeeds and the process was not
killed.  But perhaps we can (should?) re-set ->group_exit_code changed by
SIGKILL back to "siginfo->si_signo |= 0x80" in case when core_dumped == T.
Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Tested-by: default avatarMandeep Singh Baines <msb@chromium.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Neil Horman <nhorman@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 6cd8f0ac
...@@ -390,12 +390,14 @@ static int coredump_wait(int exit_code, struct core_state *core_state) ...@@ -390,12 +390,14 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
return core_waiters; return core_waiters;
} }
static void coredump_finish(struct mm_struct *mm) static void coredump_finish(struct mm_struct *mm, bool core_dumped)
{ {
struct core_thread *curr, *next; struct core_thread *curr, *next;
struct task_struct *task; struct task_struct *task;
spin_lock_irq(&current->sighand->siglock); spin_lock_irq(&current->sighand->siglock);
if (core_dumped && !__fatal_signal_pending(current))
current->signal->group_exit_code |= 0x80;
current->signal->group_exit_task = NULL; current->signal->group_exit_task = NULL;
current->signal->flags = SIGNAL_GROUP_EXIT; current->signal->flags = SIGNAL_GROUP_EXIT;
spin_unlock_irq(&current->sighand->siglock); spin_unlock_irq(&current->sighand->siglock);
...@@ -480,6 +482,7 @@ void do_coredump(siginfo_t *siginfo) ...@@ -480,6 +482,7 @@ void do_coredump(siginfo_t *siginfo)
int ispipe; int ispipe;
struct files_struct *displaced; struct files_struct *displaced;
bool need_nonrelative = false; bool need_nonrelative = false;
bool core_dumped = false;
static atomic_t core_dump_count = ATOMIC_INIT(0); static atomic_t core_dump_count = ATOMIC_INIT(0);
struct coredump_params cprm = { struct coredump_params cprm = {
.siginfo = siginfo, .siginfo = siginfo,
...@@ -638,9 +641,7 @@ void do_coredump(siginfo_t *siginfo) ...@@ -638,9 +641,7 @@ void do_coredump(siginfo_t *siginfo)
goto close_fail; goto close_fail;
if (displaced) if (displaced)
put_files_struct(displaced); put_files_struct(displaced);
retval = binfmt->core_dump(&cprm); core_dumped = binfmt->core_dump(&cprm);
if (retval)
current->signal->group_exit_code |= 0x80;
if (ispipe && core_pipe_limit) if (ispipe && core_pipe_limit)
wait_for_dump_helpers(cprm.file); wait_for_dump_helpers(cprm.file);
...@@ -653,7 +654,7 @@ fail_dropcount: ...@@ -653,7 +654,7 @@ fail_dropcount:
fail_unlock: fail_unlock:
kfree(cn.corename); kfree(cn.corename);
fail_corename: fail_corename:
coredump_finish(mm); coredump_finish(mm, core_dumped);
revert_creds(old_cred); revert_creds(old_cred);
fail_creds: fail_creds:
put_cred(cred); put_cred(cred);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment