exec.c: fix coredump to pipe problem and obscure "security hole"

The patch checks for "|" in the pattern not the output and doesn't nail a
pid on to a piped name (as it is a program name not a file)

Also fixes a very very obscure security corner case.  If you happen to have
decided on a core pattern that starts with the program name then the user
can run a program called "|myevilhack" as it stands.  I doubt anyone does
this.

Signed-off-by: Alan Cox <alan@redhat.com>
Confirmed-by: Christopher S. Aker <caker@theshore.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 11 insertions, 7 deletions

diff --git a/fs/exec.c b/fs/exec.c
index 7e36c6f6f538..3155e915307a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1244,13 +1244,17 @@ EXPORT_SYMBOL(set_binfmt);
  * name into corename, which must have space for at least
  * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
  */
-static void format_corename(char *corename, const char *pattern, long signr)
+static int format_corename(char *corename, const char *pattern, long signr)
 {
         const char *pat_ptr = pattern;
         char *out_ptr = corename;
         char *const out_end = corename + CORENAME_MAX_SIZE;
         int rc;
         int pid_in_pattern = 0;
+        int ispipe = 0;
+
+        if (*pattern == '|')
+                ispipe = 1;
 
         /* Repeat as long as we have more pattern to process and more output
            space */
@@ -1341,8 +1345,8 @@ static void format_corename(char *corename, const char *pattern, long signr)
          *
          * If core_pattern does not include a %p (as is the default)
          * and core_uses_pid is set, then .%pid will be appended to
-         * the filename */
-        if (!pid_in_pattern
+         * the filename. Do not do this for piped commands. */
+        if (!ispipe && !pid_in_pattern
             && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
                 rc = snprintf(out_ptr, out_end - out_ptr,
                               ".%d", current->tgid);
@@ -1350,8 +1354,9 @@ static void format_corename(char *corename, const char *pattern, long signr)
                         goto out;
                 out_ptr += rc;
         }
-      out:
+out:
         *out_ptr = 0;
+        return ispipe;
 }
 
 static void zap_process(struct task_struct *start)
@@ -1502,16 +1507,15 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
          * uses lock_kernel()
          */
         lock_kernel();
-        format_corename(corename, core_pattern, signr);
+        ispipe = format_corename(corename, core_pattern, signr);
         unlock_kernel();
-        if (corename[0] == '|') {
+        if (ispipe) {
                 /* SIGPIPE can happen, but it's just never processed */
                 if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
                         printk(KERN_INFO "Core dump to %s pipe failed\n",
                                corename);
                         goto fail_unlock;
                 }
-                ispipe = 1;
         } else
                 file = filp_open(corename,
                                  O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,