Line data Source code
1 : /*
2 : * linux/kernel/ptrace.c
3 : *
4 : * (C) Copyright 1999 Linus Torvalds
5 : *
6 : * Common interfaces for "ptrace()" which we do not want
7 : * to continually duplicate across every architecture.
8 : */
9 :
10 : #include <linux/capability.h>
11 : #include <linux/export.h>
12 : #include <linux/sched.h>
13 : #include <linux/errno.h>
14 : #include <linux/mm.h>
15 : #include <linux/highmem.h>
16 : #include <linux/pagemap.h>
17 : #include <linux/ptrace.h>
18 : #include <linux/security.h>
19 : #include <linux/signal.h>
20 : #include <linux/uio.h>
21 : #include <linux/audit.h>
22 : #include <linux/pid_namespace.h>
23 : #include <linux/syscalls.h>
24 : #include <linux/uaccess.h>
25 : #include <linux/regset.h>
26 : #include <linux/hw_breakpoint.h>
27 : #include <linux/cn_proc.h>
28 : #include <linux/compat.h>
29 :
30 :
31 : /*
32 : * ptrace a task: make the debugger its new parent and
33 : * move it to the ptrace list.
34 : *
35 : * Must be called with the tasklist lock write-held.
36 : */
37 0 : void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
38 : {
39 : BUG_ON(!list_empty(&child->ptrace_entry));
40 0 : list_add(&child->ptrace_entry, &new_parent->ptraced);
41 0 : child->parent = new_parent;
42 0 : }
43 :
44 : /**
45 : * __ptrace_unlink - unlink ptracee and restore its execution state
46 : * @child: ptracee to be unlinked
47 : *
48 : * Remove @child from the ptrace list, move it back to the original parent,
49 : * and restore the execution state so that it conforms to the group stop
50 : * state.
51 : *
52 : * Unlinking can happen via two paths - explicit PTRACE_DETACH or ptracer
53 : * exiting. For PTRACE_DETACH, unless the ptracee has been killed between
54 : * ptrace_check_attach() and here, it's guaranteed to be in TASK_TRACED.
55 : * If the ptracer is exiting, the ptracee can be in any state.
56 : *
57 : * After detach, the ptracee should be in a state which conforms to the
58 : * group stop. If the group is stopped or in the process of stopping, the
59 : * ptracee should be put into TASK_STOPPED; otherwise, it should be woken
60 : * up from TASK_TRACED.
61 : *
62 : * If the ptracee is in TASK_TRACED and needs to be moved to TASK_STOPPED,
63 : * it goes through TRACED -> RUNNING -> STOPPED transition which is similar
64 : * to but in the opposite direction of what happens while attaching to a
65 : * stopped task. However, in this direction, the intermediate RUNNING
66 : * state is not hidden even from the current ptracer and if it immediately
67 : * re-attaches and performs a WNOHANG wait(2), it may fail.
68 : *
69 : * CONTEXT:
70 : * write_lock_irq(tasklist_lock)
71 : */
72 0 : void __ptrace_unlink(struct task_struct *child)
73 : {
74 : BUG_ON(!child->ptrace);
75 :
76 0 : child->ptrace = 0;
77 0 : child->parent = child->real_parent;
78 0 : list_del_init(&child->ptrace_entry);
79 :
80 : spin_lock(&child->sighand->siglock);
81 :
82 : /*
83 : * Clear all pending traps and TRAPPING. TRAPPING should be
84 : * cleared regardless of JOBCTL_STOP_PENDING. Do it explicitly.
85 : */
86 0 : task_clear_jobctl_pending(child, JOBCTL_TRAP_MASK);
87 0 : task_clear_jobctl_trapping(child);
88 :
89 : /*
90 : * Reinstate JOBCTL_STOP_PENDING if group stop is in effect and
91 : * @child isn't dead.
92 : */
93 0 : if (!(child->flags & PF_EXITING) &&
94 0 : (child->signal->flags & SIGNAL_STOP_STOPPED ||
95 0 : child->signal->group_stop_count)) {
96 0 : child->jobctl |= JOBCTL_STOP_PENDING;
97 :
98 : /*
99 : * This is only possible if this thread was cloned by the
100 : * traced task running in the stopped group, set the signal
101 : * for the future reports.
102 : * FIXME: we should change ptrace_init_task() to handle this
103 : * case.
104 : */
105 0 : if (!(child->jobctl & JOBCTL_STOP_SIGMASK))
106 0 : child->jobctl |= SIGSTOP;
107 : }
108 :
109 : /*
110 : * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick
111 : * @child in the butt. Note that @resume should be used iff @child
112 : * is in TASK_TRACED; otherwise, we might unduly disrupt
113 : * TASK_KILLABLE sleeps.
114 : */
115 0 : if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child))
116 : ptrace_signal_wake_up(child, true);
117 :
118 : spin_unlock(&child->sighand->siglock);
119 0 : }
120 :
121 : /* Ensure that nothing can wake it up, even SIGKILL */
122 0 : static bool ptrace_freeze_traced(struct task_struct *task)
123 : {
124 : bool ret = false;
125 :
126 : /* Lockless, nobody but us can set this flag */
127 0 : if (task->jobctl & JOBCTL_LISTENING)
128 : return ret;
129 :
130 : spin_lock_irq(&task->sighand->siglock);
131 0 : if (task_is_traced(task) && !__fatal_signal_pending(task)) {
132 0 : task->state = __TASK_TRACED;
133 : ret = true;
134 : }
135 : spin_unlock_irq(&task->sighand->siglock);
136 :
137 0 : return ret;
138 : }
139 :
140 0 : static void ptrace_unfreeze_traced(struct task_struct *task)
141 : {
142 0 : if (task->state != __TASK_TRACED)
143 0 : return;
144 :
145 : WARN_ON(!task->ptrace || task->parent != current);
146 :
147 : spin_lock_irq(&task->sighand->siglock);
148 0 : if (__fatal_signal_pending(task))
149 0 : wake_up_state(task, __TASK_TRACED);
150 : else
151 0 : task->state = TASK_TRACED;
152 : spin_unlock_irq(&task->sighand->siglock);
153 : }
154 :
155 : /**
156 : * ptrace_check_attach - check whether ptracee is ready for ptrace operation
157 : * @child: ptracee to check for
158 : * @ignore_state: don't check whether @child is currently %TASK_TRACED
159 : *
160 : * Check whether @child is being ptraced by %current and ready for further
161 : * ptrace operations. If @ignore_state is %false, @child also should be in
162 : * %TASK_TRACED state and on return the child is guaranteed to be traced
163 : * and not executing. If @ignore_state is %true, @child can be in any
164 : * state.
165 : *
166 : * CONTEXT:
167 : * Grabs and releases tasklist_lock and @child->sighand->siglock.
168 : *
169 : * RETURNS:
170 : * 0 on success, -ESRCH if %child is not ready.
171 : */
172 0 : static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
173 : {
174 : int ret = -ESRCH;
175 :
176 : /*
177 : * We take the read lock around doing both checks to close a
178 : * possible race where someone else was tracing our child and
179 : * detached between these two checks. After this locked check,
180 : * we are sure that this is our traced child and that can only
181 : * be changed by us so it's not changing right after this.
182 : */
183 0 : read_lock(&tasklist_lock);
184 0 : if (child->ptrace && child->parent == current) {
185 0 : WARN_ON(child->state == __TASK_TRACED);
186 : /*
187 : * child->sighand can't be NULL, release_task()
188 : * does ptrace_unlink() before __exit_signal().
189 : */
190 0 : if (ignore_state || ptrace_freeze_traced(child))
191 : ret = 0;
192 : }
193 0 : read_unlock(&tasklist_lock);
194 :
195 : if (!ret && !ignore_state) {
196 : if (!wait_task_inactive(child, __TASK_TRACED)) {
197 : /*
198 : * This can only happen if may_ptrace_stop() fails and
199 : * ptrace_stop() changes ->state back to TASK_RUNNING,
200 : * so we should not worry about leaking __TASK_TRACED.
201 : */
202 : WARN_ON(child->state == __TASK_TRACED);
203 : ret = -ESRCH;
204 : }
205 : }
206 :
207 0 : return ret;
208 : }
209 :
210 732 : static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
211 : {
212 732 : if (mode & PTRACE_MODE_NOAUDIT)
213 492 : return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
214 : else
215 240 : return has_ns_capability(current, ns, CAP_SYS_PTRACE);
216 : }
217 :
218 : /* Returns 0 on success, -errno on denial. */
219 1152 : static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
220 : {
221 1152 : const struct cred *cred = current_cred(), *tcred;
222 :
223 : /* May we inspect the given task?
224 : * This check is used both for attaching with ptrace
225 : * and for allowing access to sensitive information in /proc.
226 : *
227 : * ptrace_attach denies several cases that /proc allows
228 : * because setting up the necessary parent/child relationship
229 : * or halting the specified task is impossible.
230 : */
231 : int dumpable = 0;
232 : /* Don't let security modules deny introspection */
233 1152 : if (same_thread_group(task, current))
234 : return 0;
235 : rcu_read_lock();
236 1046 : tcred = __task_cred(task);
237 1046 : if (uid_eq(cred->uid, tcred->euid) &&
238 780 : uid_eq(cred->uid, tcred->suid) &&
239 780 : uid_eq(cred->uid, tcred->uid) &&
240 780 : gid_eq(cred->gid, tcred->egid) &&
241 780 : gid_eq(cred->gid, tcred->sgid) &&
242 : gid_eq(cred->gid, tcred->gid))
243 : goto ok;
244 266 : if (ptrace_has_cap(tcred->user_ns, mode))
245 : goto ok;
246 : rcu_read_unlock();
247 260 : return -EPERM;
248 : ok:
249 : rcu_read_unlock();
250 786 : smp_rmb();
251 786 : if (task->mm)
252 : dumpable = get_dumpable(task->mm);
253 : rcu_read_lock();
254 1252 : if (dumpable != SUID_DUMP_USER &&
255 466 : !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
256 : rcu_read_unlock();
257 4 : return -EPERM;
258 : }
259 : rcu_read_unlock();
260 :
261 782 : return security_ptrace_access_check(task, mode);
262 : }
263 :
264 1152 : bool ptrace_may_access(struct task_struct *task, unsigned int mode)
265 : {
266 : int err;
267 : task_lock(task);
268 1152 : err = __ptrace_may_access(task, mode);
269 : task_unlock(task);
270 1152 : return !err;
271 : }
272 :
273 0 : static int ptrace_attach(struct task_struct *task, long request,
274 : unsigned long addr,
275 : unsigned long flags)
276 : {
277 0 : bool seize = (request == PTRACE_SEIZE);
278 : int retval;
279 :
280 : retval = -EIO;
281 0 : if (seize) {
282 0 : if (addr != 0)
283 : goto out;
284 0 : if (flags & ~(unsigned long)PTRACE_O_MASK)
285 : goto out;
286 0 : flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT);
287 : } else {
288 : flags = PT_PTRACED;
289 : }
290 :
291 : audit_ptrace(task);
292 :
293 : retval = -EPERM;
294 0 : if (unlikely(task->flags & PF_KTHREAD))
295 : goto out;
296 0 : if (same_thread_group(task, current))
297 : goto out;
298 :
299 : /*
300 : * Protect exec's credential calculations against our interference;
301 : * SUID, SGID and LSM creds get determined differently
302 : * under ptrace.
303 : */
304 : retval = -ERESTARTNOINTR;
305 0 : if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))
306 : goto out;
307 :
308 : task_lock(task);
309 0 : retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
310 : task_unlock(task);
311 0 : if (retval)
312 : goto unlock_creds;
313 :
314 0 : write_lock_irq(&tasklist_lock);
315 : retval = -EPERM;
316 0 : if (unlikely(task->exit_state))
317 : goto unlock_tasklist;
318 0 : if (task->ptrace)
319 : goto unlock_tasklist;
320 :
321 0 : if (seize)
322 0 : flags |= PT_SEIZED;
323 : rcu_read_lock();
324 0 : if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
325 0 : flags |= PT_PTRACE_CAP;
326 : rcu_read_unlock();
327 0 : task->ptrace = flags;
328 :
329 0 : __ptrace_link(task, current);
330 :
331 : /* SEIZE doesn't trap tracee on attach */
332 0 : if (!seize)
333 0 : send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);
334 :
335 : spin_lock(&task->sighand->siglock);
336 :
337 : /*
338 : * If the task is already STOPPED, set JOBCTL_TRAP_STOP and
339 : * TRAPPING, and kick it so that it transits to TRACED. TRAPPING
340 : * will be cleared if the child completes the transition or any
341 : * event which clears the group stop states happens. We'll wait
342 : * for the transition to complete before returning from this
343 : * function.
344 : *
345 : * This hides STOPPED -> RUNNING -> TRACED transition from the
346 : * attaching thread but a different thread in the same group can
347 : * still observe the transient RUNNING state. IOW, if another
348 : * thread's WNOHANG wait(2) on the stopped tracee races against
349 : * ATTACH, the wait(2) may fail due to the transient RUNNING.
350 : *
351 : * The following task_is_stopped() test is safe as both transitions
352 : * in and out of STOPPED are protected by siglock.
353 : */
354 0 : if (task_is_stopped(task) &&
355 0 : task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING))
356 0 : signal_wake_up_state(task, __TASK_STOPPED);
357 :
358 : spin_unlock(&task->sighand->siglock);
359 :
360 : retval = 0;
361 : unlock_tasklist:
362 0 : write_unlock_irq(&tasklist_lock);
363 : unlock_creds:
364 0 : mutex_unlock(&task->signal->cred_guard_mutex);
365 : out:
366 0 : if (!retval) {
367 0 : wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT,
368 : TASK_UNINTERRUPTIBLE);
369 : proc_ptrace_connector(task, PTRACE_ATTACH);
370 : }
371 :
372 0 : return retval;
373 : }
374 :
375 : /**
376 : * ptrace_traceme -- helper for PTRACE_TRACEME
377 : *
378 : * Performs checks and sets PT_PTRACED.
379 : * Should be used by all ptrace implementations for PTRACE_TRACEME.
380 : */
381 0 : static int ptrace_traceme(void)
382 : {
383 : int ret = -EPERM;
384 :
385 0 : write_lock_irq(&tasklist_lock);
386 : /* Are we already being traced? */
387 0 : if (!current->ptrace) {
388 0 : ret = security_ptrace_traceme(current->parent);
389 : /*
390 : * Check PF_EXITING to ensure ->real_parent has not passed
391 : * exit_ptrace(). Otherwise we don't report the error but
392 : * pretend ->real_parent untraces us right after return.
393 : */
394 0 : if (!ret && !(current->real_parent->flags & PF_EXITING)) {
395 0 : current->ptrace = PT_PTRACED;
396 0 : __ptrace_link(current, current->real_parent);
397 : }
398 : }
399 0 : write_unlock_irq(&tasklist_lock);
400 :
401 0 : return ret;
402 : }
403 :
404 : /*
405 : * Called with irqs disabled, returns true if childs should reap themselves.
406 : */
407 0 : static int ignoring_children(struct sighand_struct *sigh)
408 : {
409 : int ret;
410 : spin_lock(&sigh->siglock);
411 0 : ret = (sigh->action[SIGCHLD-1].sa.sa_handler == SIG_IGN) ||
412 0 : (sigh->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT);
413 : spin_unlock(&sigh->siglock);
414 0 : return ret;
415 : }
416 :
417 : /*
418 : * Called with tasklist_lock held for writing.
419 : * Unlink a traced task, and clean it up if it was a traced zombie.
420 : * Return true if it needs to be reaped with release_task().
421 : * (We can't call release_task() here because we already hold tasklist_lock.)
422 : *
423 : * If it's a zombie, our attachedness prevented normal parent notification
424 : * or self-reaping. Do notification now if it would have happened earlier.
425 : * If it should reap itself, return true.
426 : *
427 : * If it's our own child, there is no notification to do. But if our normal
428 : * children self-reap, then this child was prevented by ptrace and we must
429 : * reap it now, in that case we must also wake up sub-threads sleeping in
430 : * do_wait().
431 : */
432 0 : static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
433 : {
434 : bool dead;
435 :
436 0 : __ptrace_unlink(p);
437 :
438 0 : if (p->exit_state != EXIT_ZOMBIE)
439 : return false;
440 :
441 0 : dead = !thread_group_leader(p);
442 :
443 0 : if (!dead && thread_group_empty(p)) {
444 0 : if (!same_thread_group(p->real_parent, tracer))
445 0 : dead = do_notify_parent(p, p->exit_signal);
446 0 : else if (ignoring_children(tracer->sighand)) {
447 0 : __wake_up_parent(p, tracer);
448 : dead = true;
449 : }
450 : }
451 : /* Mark it as in the process of being reaped. */
452 0 : if (dead)
453 0 : p->exit_state = EXIT_DEAD;
454 0 : return dead;
455 : }
456 :
457 0 : static int ptrace_detach(struct task_struct *child, unsigned int data)
458 : {
459 : bool dead = false;
460 :
461 0 : if (!valid_signal(data))
462 : return -EIO;
463 :
464 : /* Architecture-specific hardware disable .. */
465 0 : ptrace_disable(child);
466 : clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
467 :
468 0 : write_lock_irq(&tasklist_lock);
469 : /*
470 : * This child can be already killed. Make sure de_thread() or
471 : * our sub-thread doing do_wait() didn't do release_task() yet.
472 : */
473 0 : if (child->ptrace) {
474 0 : child->exit_code = data;
475 0 : dead = __ptrace_detach(current, child);
476 : }
477 0 : write_unlock_irq(&tasklist_lock);
478 :
479 : proc_ptrace_connector(child, PTRACE_DETACH);
480 0 : if (unlikely(dead))
481 0 : release_task(child);
482 :
483 : return 0;
484 : }
485 :
486 : /*
487 : * Detach all tasks we were using ptrace on. Called with tasklist held
488 : * for writing.
489 : */
490 0 : void exit_ptrace(struct task_struct *tracer, struct list_head *dead)
491 : {
492 : struct task_struct *p, *n;
493 :
494 0 : list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) {
495 0 : if (unlikely(p->ptrace & PT_EXITKILL))
496 0 : send_sig_info(SIGKILL, SEND_SIG_FORCED, p);
497 :
498 0 : if (__ptrace_detach(tracer, p))
499 : list_add(&p->ptrace_entry, dead);
500 : }
501 0 : }
502 :
503 0 : int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len)
504 : {
505 : int copied = 0;
506 :
507 0 : while (len > 0) {
508 : char buf[128];
509 : int this_len, retval;
510 :
511 0 : this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
512 0 : retval = access_process_vm(tsk, src, buf, this_len, 0);
513 0 : if (!retval) {
514 0 : if (copied)
515 : break;
516 0 : return -EIO;
517 : }
518 0 : if (copy_to_user(dst, buf, retval))
519 : return -EFAULT;
520 0 : copied += retval;
521 0 : src += retval;
522 0 : dst += retval;
523 0 : len -= retval;
524 : }
525 0 : return copied;
526 : }
527 :
528 0 : int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len)
529 : {
530 : int copied = 0;
531 :
532 0 : while (len > 0) {
533 : char buf[128];
534 : int this_len, retval;
535 :
536 0 : this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
537 0 : if (copy_from_user(buf, src, this_len))
538 0 : return -EFAULT;
539 0 : retval = access_process_vm(tsk, dst, buf, this_len, 1);
540 0 : if (!retval) {
541 0 : if (copied)
542 : break;
543 : return -EIO;
544 : }
545 0 : copied += retval;
546 0 : src += retval;
547 0 : dst += retval;
548 0 : len -= retval;
549 : }
550 0 : return copied;
551 : }
552 :
553 : static int ptrace_setoptions(struct task_struct *child, unsigned long data)
554 : {
555 : unsigned flags;
556 :
557 0 : if (data & ~(unsigned long)PTRACE_O_MASK)
558 : return -EINVAL;
559 :
560 : /* Avoid intermediate state when all opts are cleared */
561 : flags = child->ptrace;
562 0 : flags &= ~(PTRACE_O_MASK << PT_OPT_FLAG_SHIFT);
563 0 : flags |= (data << PT_OPT_FLAG_SHIFT);
564 0 : child->ptrace = flags;
565 :
566 : return 0;
567 : }
568 :
569 0 : static int ptrace_getsiginfo(struct task_struct *child, siginfo_t *info)
570 : {
571 : unsigned long flags;
572 : int error = -ESRCH;
573 :
574 0 : if (lock_task_sighand(child, &flags)) {
575 : error = -EINVAL;
576 0 : if (likely(child->last_siginfo != NULL)) {
577 0 : *info = *child->last_siginfo;
578 : error = 0;
579 : }
580 0 : unlock_task_sighand(child, &flags);
581 : }
582 0 : return error;
583 : }
584 :
585 0 : static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
586 : {
587 : unsigned long flags;
588 : int error = -ESRCH;
589 :
590 0 : if (lock_task_sighand(child, &flags)) {
591 : error = -EINVAL;
592 0 : if (likely(child->last_siginfo != NULL)) {
593 0 : *child->last_siginfo = *info;
594 : error = 0;
595 : }
596 0 : unlock_task_sighand(child, &flags);
597 : }
598 0 : return error;
599 : }
600 :
601 0 : static int ptrace_peek_siginfo(struct task_struct *child,
602 : unsigned long addr,
603 : unsigned long data)
604 : {
605 : struct ptrace_peeksiginfo_args arg;
606 : struct sigpending *pending;
607 : struct sigqueue *q;
608 : int ret, i;
609 :
610 0 : ret = copy_from_user(&arg, (void __user *) addr,
611 : sizeof(struct ptrace_peeksiginfo_args));
612 0 : if (ret)
613 : return -EFAULT;
614 :
615 0 : if (arg.flags & ~PTRACE_PEEKSIGINFO_SHARED)
616 : return -EINVAL; /* unknown flags */
617 :
618 0 : if (arg.nr < 0)
619 : return -EINVAL;
620 :
621 0 : if (arg.flags & PTRACE_PEEKSIGINFO_SHARED)
622 0 : pending = &child->signal->shared_pending;
623 : else
624 0 : pending = &child->pending;
625 :
626 0 : for (i = 0; i < arg.nr; ) {
627 : siginfo_t info;
628 0 : s32 off = arg.off + i;
629 :
630 : spin_lock_irq(&child->sighand->siglock);
631 0 : list_for_each_entry(q, &pending->list, list) {
632 0 : if (!off--) {
633 0 : copy_siginfo(&info, &q->info);
634 : break;
635 : }
636 : }
637 : spin_unlock_irq(&child->sighand->siglock);
638 :
639 0 : if (off >= 0) /* beyond the end of the list */
640 : break;
641 :
642 : #ifdef CONFIG_COMPAT
643 : if (unlikely(is_compat_task())) {
644 : compat_siginfo_t __user *uinfo = compat_ptr(data);
645 :
646 : if (copy_siginfo_to_user32(uinfo, &info) ||
647 : __put_user(info.si_code, &uinfo->si_code)) {
648 : ret = -EFAULT;
649 : break;
650 : }
651 :
652 : } else
653 : #endif
654 : {
655 0 : siginfo_t __user *uinfo = (siginfo_t __user *) data;
656 :
657 0 : if (copy_siginfo_to_user(uinfo, &info) ||
658 0 : __put_user(info.si_code, &uinfo->si_code)) {
659 : ret = -EFAULT;
660 : break;
661 : }
662 : }
663 :
664 0 : data += sizeof(siginfo_t);
665 0 : i++;
666 :
667 0 : if (signal_pending(current))
668 : break;
669 :
670 0 : cond_resched();
671 : }
672 :
673 0 : if (i > 0)
674 : return i;
675 :
676 0 : return ret;
677 : }
678 :
679 : #ifdef PTRACE_SINGLESTEP
680 : #define is_singlestep(request) ((request) == PTRACE_SINGLESTEP)
681 : #else
682 : #define is_singlestep(request) 0
683 : #endif
684 :
685 : #ifdef PTRACE_SINGLEBLOCK
686 : #define is_singleblock(request) ((request) == PTRACE_SINGLEBLOCK)
687 : #else
688 : #define is_singleblock(request) 0
689 : #endif
690 :
691 : #ifdef PTRACE_SYSEMU
692 : #define is_sysemu_singlestep(request) ((request) == PTRACE_SYSEMU_SINGLESTEP)
693 : #else
694 : #define is_sysemu_singlestep(request) 0
695 : #endif
696 :
697 0 : static int ptrace_resume(struct task_struct *child, long request,
698 : unsigned long data)
699 : {
700 0 : if (!valid_signal(data))
701 : return -EIO;
702 :
703 0 : if (request == PTRACE_SYSCALL)
704 : set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
705 : else
706 : clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
707 :
708 : #ifdef TIF_SYSCALL_EMU
709 : if (request == PTRACE_SYSEMU || request == PTRACE_SYSEMU_SINGLESTEP)
710 : set_tsk_thread_flag(child, TIF_SYSCALL_EMU);
711 : else
712 : clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
713 : #endif
714 :
715 : if (is_singleblock(request)) {
716 : if (unlikely(!arch_has_block_step()))
717 : return -EIO;
718 : user_enable_block_step(child);
719 0 : } else if (is_singlestep(request) || is_sysemu_singlestep(request)) {
720 : if (unlikely(!arch_has_single_step()))
721 : return -EIO;
722 : user_enable_single_step(child);
723 : } else {
724 : user_disable_single_step(child);
725 : }
726 :
727 0 : child->exit_code = data;
728 0 : wake_up_state(child, __TASK_TRACED);
729 :
730 0 : return 0;
731 : }
732 :
733 : #ifdef CONFIG_HAVE_ARCH_TRACEHOOK
734 :
735 : static const struct user_regset *
736 : find_regset(const struct user_regset_view *view, unsigned int type)
737 : {
738 : const struct user_regset *regset;
739 : int n;
740 :
741 0 : for (n = 0; n < view->n; ++n) {
742 0 : regset = view->regsets + n;
743 0 : if (regset->core_note_type == type)
744 : return regset;
745 : }
746 :
747 : return NULL;
748 : }
749 :
750 0 : static int ptrace_regset(struct task_struct *task, int req, unsigned int type,
751 : struct iovec *kiov)
752 : {
753 0 : const struct user_regset_view *view = task_user_regset_view(task);
754 : const struct user_regset *regset = find_regset(view, type);
755 : int regset_no;
756 :
757 0 : if (!regset || (kiov->iov_len % regset->size) != 0)
758 : return -EINVAL;
759 :
760 0 : regset_no = regset - view->regsets;
761 0 : kiov->iov_len = min(kiov->iov_len,
762 : (__kernel_size_t) (regset->n * regset->size));
763 :
764 0 : if (req == PTRACE_GETREGSET)
765 0 : return copy_regset_to_user(task, view, regset_no, 0,
766 : kiov->iov_len, kiov->iov_base);
767 : else
768 0 : return copy_regset_from_user(task, view, regset_no, 0,
769 0 : kiov->iov_len, kiov->iov_base);
770 : }
771 :
772 : /*
773 : * This is declared in linux/regset.h and defined in machine-dependent
774 : * code. We put the export here, near the primary machine-neutral use,
775 : * to ensure no machine forgets it.
776 : */
777 : EXPORT_SYMBOL_GPL(task_user_regset_view);
778 : #endif
779 :
780 0 : int ptrace_request(struct task_struct *child, long request,
781 : unsigned long addr, unsigned long data)
782 : {
783 0 : bool seized = child->ptrace & PT_SEIZED;
784 : int ret = -EIO;
785 : siginfo_t siginfo, *si;
786 0 : void __user *datavp = (void __user *) data;
787 : unsigned long __user *datalp = datavp;
788 : unsigned long flags;
789 :
790 0 : switch (request) {
791 : case PTRACE_PEEKTEXT:
792 : case PTRACE_PEEKDATA:
793 0 : return generic_ptrace_peekdata(child, addr, data);
794 : case PTRACE_POKETEXT:
795 : case PTRACE_POKEDATA:
796 0 : return generic_ptrace_pokedata(child, addr, data);
797 :
798 : #ifdef PTRACE_OLDSETOPTIONS
799 : case PTRACE_OLDSETOPTIONS:
800 : #endif
801 : case PTRACE_SETOPTIONS:
802 : ret = ptrace_setoptions(child, data);
803 0 : break;
804 : case PTRACE_GETEVENTMSG:
805 0 : ret = put_user(child->ptrace_message, datalp);
806 0 : break;
807 :
808 : case PTRACE_PEEKSIGINFO:
809 0 : ret = ptrace_peek_siginfo(child, addr, data);
810 0 : break;
811 :
812 : case PTRACE_GETSIGINFO:
813 0 : ret = ptrace_getsiginfo(child, &siginfo);
814 0 : if (!ret)
815 0 : ret = copy_siginfo_to_user(datavp, &siginfo);
816 : break;
817 :
818 : case PTRACE_SETSIGINFO:
819 0 : if (copy_from_user(&siginfo, datavp, sizeof siginfo))
820 : ret = -EFAULT;
821 : else
822 0 : ret = ptrace_setsiginfo(child, &siginfo);
823 : break;
824 :
825 : case PTRACE_GETSIGMASK:
826 0 : if (addr != sizeof(sigset_t)) {
827 : ret = -EINVAL;
828 : break;
829 : }
830 :
831 0 : if (copy_to_user(datavp, &child->blocked, sizeof(sigset_t)))
832 : ret = -EFAULT;
833 : else
834 : ret = 0;
835 :
836 : break;
837 :
838 : case PTRACE_SETSIGMASK: {
839 : sigset_t new_set;
840 :
841 0 : if (addr != sizeof(sigset_t)) {
842 : ret = -EINVAL;
843 : break;
844 : }
845 :
846 0 : if (copy_from_user(&new_set, datavp, sizeof(sigset_t))) {
847 : ret = -EFAULT;
848 : break;
849 : }
850 :
851 : sigdelsetmask(&new_set, sigmask(SIGKILL)|sigmask(SIGSTOP));
852 :
853 : /*
854 : * Every thread does recalc_sigpending() after resume, so
855 : * retarget_shared_pending() and recalc_sigpending() are not
856 : * called here.
857 : */
858 : spin_lock_irq(&child->sighand->siglock);
859 0 : child->blocked = new_set;
860 : spin_unlock_irq(&child->sighand->siglock);
861 :
862 : ret = 0;
863 : break;
864 : }
865 :
866 : case PTRACE_INTERRUPT:
867 : /*
868 : * Stop tracee without any side-effect on signal or job
869 : * control. At least one trap is guaranteed to happen
870 : * after this request. If @child is already trapped, the
871 : * current trap is not disturbed and another trap will
872 : * happen after the current trap is ended with PTRACE_CONT.
873 : *
874 : * The actual trap might not be PTRACE_EVENT_STOP trap but
875 : * the pending condition is cleared regardless.
876 : */
877 0 : if (unlikely(!seized || !lock_task_sighand(child, &flags)))
878 : break;
879 :
880 : /*
881 : * INTERRUPT doesn't disturb existing trap sans one
882 : * exception. If ptracer issued LISTEN for the current
883 : * STOP, this INTERRUPT should clear LISTEN and re-trap
884 : * tracee into STOP.
885 : */
886 0 : if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP)))
887 0 : ptrace_signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
888 :
889 0 : unlock_task_sighand(child, &flags);
890 : ret = 0;
891 : break;
892 :
893 : case PTRACE_LISTEN:
894 : /*
895 : * Listen for events. Tracee must be in STOP. It's not
896 : * resumed per-se but is not considered to be in TRACED by
897 : * wait(2) or ptrace(2). If an async event (e.g. group
898 : * stop state change) happens, tracee will enter STOP trap
899 : * again. Alternatively, ptracer can issue INTERRUPT to
900 : * finish listening and re-trap tracee into STOP.
901 : */
902 0 : if (unlikely(!seized || !lock_task_sighand(child, &flags)))
903 : break;
904 :
905 0 : si = child->last_siginfo;
906 0 : if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) {
907 0 : child->jobctl |= JOBCTL_LISTENING;
908 : /*
909 : * If NOTIFY is set, it means event happened between
910 : * start of this trap and now. Trigger re-trap.
911 : */
912 0 : if (child->jobctl & JOBCTL_TRAP_NOTIFY)
913 : ptrace_signal_wake_up(child, true);
914 : ret = 0;
915 : }
916 0 : unlock_task_sighand(child, &flags);
917 : break;
918 :
919 : case PTRACE_DETACH: /* detach a process that was attached. */
920 0 : ret = ptrace_detach(child, data);
921 0 : break;
922 :
923 : #ifdef CONFIG_BINFMT_ELF_FDPIC
924 : case PTRACE_GETFDPIC: {
925 : struct mm_struct *mm = get_task_mm(child);
926 : unsigned long tmp = 0;
927 :
928 : ret = -ESRCH;
929 : if (!mm)
930 : break;
931 :
932 : switch (addr) {
933 : case PTRACE_GETFDPIC_EXEC:
934 : tmp = mm->context.exec_fdpic_loadmap;
935 : break;
936 : case PTRACE_GETFDPIC_INTERP:
937 : tmp = mm->context.interp_fdpic_loadmap;
938 : break;
939 : default:
940 : break;
941 : }
942 : mmput(mm);
943 :
944 : ret = put_user(tmp, datalp);
945 : break;
946 : }
947 : #endif
948 :
949 : #ifdef PTRACE_SINGLESTEP
950 : case PTRACE_SINGLESTEP:
951 : #endif
952 : #ifdef PTRACE_SINGLEBLOCK
953 : case PTRACE_SINGLEBLOCK:
954 : #endif
955 : #ifdef PTRACE_SYSEMU
956 : case PTRACE_SYSEMU:
957 : case PTRACE_SYSEMU_SINGLESTEP:
958 : #endif
959 : case PTRACE_SYSCALL:
960 : case PTRACE_CONT:
961 0 : return ptrace_resume(child, request, data);
962 :
963 : case PTRACE_KILL:
964 0 : if (child->exit_state) /* already dead */
965 : return 0;
966 0 : return ptrace_resume(child, request, SIGKILL);
967 :
968 : #ifdef CONFIG_HAVE_ARCH_TRACEHOOK
969 : case PTRACE_GETREGSET:
970 : case PTRACE_SETREGSET: {
971 : struct iovec kiov;
972 : struct iovec __user *uiov = datavp;
973 :
974 0 : if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
975 0 : return -EFAULT;
976 :
977 0 : if (__get_user(kiov.iov_base, &uiov->iov_base) ||
978 0 : __get_user(kiov.iov_len, &uiov->iov_len))
979 : return -EFAULT;
980 :
981 0 : ret = ptrace_regset(child, request, addr, &kiov);
982 0 : if (!ret)
983 0 : ret = __put_user(kiov.iov_len, &uiov->iov_len);
984 0 : break;
985 : }
986 : #endif
987 : default:
988 : break;
989 : }
990 :
991 0 : return ret;
992 : }
993 :
994 0 : static struct task_struct *ptrace_get_task_struct(pid_t pid)
995 : {
996 : struct task_struct *child;
997 :
998 : rcu_read_lock();
999 0 : child = find_task_by_vpid(pid);
1000 0 : if (child)
1001 0 : get_task_struct(child);
1002 : rcu_read_unlock();
1003 :
1004 0 : if (!child)
1005 : return ERR_PTR(-ESRCH);
1006 0 : return child;
1007 : }
1008 :
1009 : #ifndef arch_ptrace_attach
1010 : #define arch_ptrace_attach(child) do { } while (0)
1011 : #endif
1012 :
1013 0 : SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
1014 : unsigned long, data)
1015 : {
1016 : struct task_struct *child;
1017 : long ret;
1018 :
1019 0 : if (request == PTRACE_TRACEME) {
1020 0 : ret = ptrace_traceme();
1021 : if (!ret)
1022 : arch_ptrace_attach(current);
1023 : goto out;
1024 : }
1025 :
1026 0 : child = ptrace_get_task_struct(pid);
1027 0 : if (IS_ERR(child)) {
1028 : ret = PTR_ERR(child);
1029 : goto out;
1030 : }
1031 :
1032 0 : if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
1033 0 : ret = ptrace_attach(child, request, addr, data);
1034 : /*
1035 : * Some architectures need to do book-keeping after
1036 : * a ptrace attach.
1037 : */
1038 : if (!ret)
1039 : arch_ptrace_attach(child);
1040 : goto out_put_task_struct;
1041 : }
1042 :
1043 0 : ret = ptrace_check_attach(child, request == PTRACE_KILL ||
1044 0 : request == PTRACE_INTERRUPT);
1045 0 : if (ret < 0)
1046 : goto out_put_task_struct;
1047 :
1048 0 : ret = arch_ptrace(child, request, addr, data);
1049 0 : if (ret || request != PTRACE_DETACH)
1050 0 : ptrace_unfreeze_traced(child);
1051 :
1052 : out_put_task_struct:
1053 : put_task_struct(child);
1054 : out:
1055 : return ret;
1056 : }
1057 :
1058 0 : int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
1059 : unsigned long data)
1060 : {
1061 : unsigned long tmp;
1062 : int copied;
1063 :
1064 0 : copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
1065 0 : if (copied != sizeof(tmp))
1066 : return -EIO;
1067 0 : return put_user(tmp, (unsigned long __user *)data);
1068 : }
1069 :
1070 0 : int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
1071 : unsigned long data)
1072 : {
1073 : int copied;
1074 :
1075 0 : copied = access_process_vm(tsk, addr, &data, sizeof(data), 1);
1076 0 : return (copied == sizeof(data)) ? 0 : -EIO;
1077 : }
1078 :
1079 : #if defined CONFIG_COMPAT
1080 : #include <linux/compat.h>
1081 :
1082 : int compat_ptrace_request(struct task_struct *child, compat_long_t request,
1083 : compat_ulong_t addr, compat_ulong_t data)
1084 : {
1085 : compat_ulong_t __user *datap = compat_ptr(data);
1086 : compat_ulong_t word;
1087 : siginfo_t siginfo;
1088 : int ret;
1089 :
1090 : switch (request) {
1091 : case PTRACE_PEEKTEXT:
1092 : case PTRACE_PEEKDATA:
1093 : ret = access_process_vm(child, addr, &word, sizeof(word), 0);
1094 : if (ret != sizeof(word))
1095 : ret = -EIO;
1096 : else
1097 : ret = put_user(word, datap);
1098 : break;
1099 :
1100 : case PTRACE_POKETEXT:
1101 : case PTRACE_POKEDATA:
1102 : ret = access_process_vm(child, addr, &data, sizeof(data), 1);
1103 : ret = (ret != sizeof(data) ? -EIO : 0);
1104 : break;
1105 :
1106 : case PTRACE_GETEVENTMSG:
1107 : ret = put_user((compat_ulong_t) child->ptrace_message, datap);
1108 : break;
1109 :
1110 : case PTRACE_GETSIGINFO:
1111 : ret = ptrace_getsiginfo(child, &siginfo);
1112 : if (!ret)
1113 : ret = copy_siginfo_to_user32(
1114 : (struct compat_siginfo __user *) datap,
1115 : &siginfo);
1116 : break;
1117 :
1118 : case PTRACE_SETSIGINFO:
1119 : memset(&siginfo, 0, sizeof siginfo);
1120 : if (copy_siginfo_from_user32(
1121 : &siginfo, (struct compat_siginfo __user *) datap))
1122 : ret = -EFAULT;
1123 : else
1124 : ret = ptrace_setsiginfo(child, &siginfo);
1125 : break;
1126 : #ifdef CONFIG_HAVE_ARCH_TRACEHOOK
1127 : case PTRACE_GETREGSET:
1128 : case PTRACE_SETREGSET:
1129 : {
1130 : struct iovec kiov;
1131 : struct compat_iovec __user *uiov =
1132 : (struct compat_iovec __user *) datap;
1133 : compat_uptr_t ptr;
1134 : compat_size_t len;
1135 :
1136 : if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
1137 : return -EFAULT;
1138 :
1139 : if (__get_user(ptr, &uiov->iov_base) ||
1140 : __get_user(len, &uiov->iov_len))
1141 : return -EFAULT;
1142 :
1143 : kiov.iov_base = compat_ptr(ptr);
1144 : kiov.iov_len = len;
1145 :
1146 : ret = ptrace_regset(child, request, addr, &kiov);
1147 : if (!ret)
1148 : ret = __put_user(kiov.iov_len, &uiov->iov_len);
1149 : break;
1150 : }
1151 : #endif
1152 :
1153 : default:
1154 : ret = ptrace_request(child, request, addr, data);
1155 : }
1156 :
1157 : return ret;
1158 : }
1159 :
1160 : COMPAT_SYSCALL_DEFINE4(ptrace, compat_long_t, request, compat_long_t, pid,
1161 : compat_long_t, addr, compat_long_t, data)
1162 : {
1163 : struct task_struct *child;
1164 : long ret;
1165 :
1166 : if (request == PTRACE_TRACEME) {
1167 : ret = ptrace_traceme();
1168 : goto out;
1169 : }
1170 :
1171 : child = ptrace_get_task_struct(pid);
1172 : if (IS_ERR(child)) {
1173 : ret = PTR_ERR(child);
1174 : goto out;
1175 : }
1176 :
1177 : if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
1178 : ret = ptrace_attach(child, request, addr, data);
1179 : /*
1180 : * Some architectures need to do book-keeping after
1181 : * a ptrace attach.
1182 : */
1183 : if (!ret)
1184 : arch_ptrace_attach(child);
1185 : goto out_put_task_struct;
1186 : }
1187 :
1188 : ret = ptrace_check_attach(child, request == PTRACE_KILL ||
1189 : request == PTRACE_INTERRUPT);
1190 : if (!ret) {
1191 : ret = compat_arch_ptrace(child, request, addr, data);
1192 : if (ret || request != PTRACE_DETACH)
1193 : ptrace_unfreeze_traced(child);
1194 : }
1195 :
1196 : out_put_task_struct:
1197 : put_task_struct(child);
1198 : out:
1199 : return ret;
1200 : }
1201 : #endif /* CONFIG_COMPAT */
|
