1/* 2 * linux/kernel/ptrace.c 3 * 4 * (C) Copyright 1999 Linus Torvalds 5 * 6 * Common interfaces for "ptrace()" which we do not want 7 * to continually duplicate across every architecture. 8 */ 9 10#include <linux/capability.h> 11#include <linux/export.h> 12#include <linux/sched.h> 13#include <linux/errno.h> 14#include <linux/mm.h> 15#include <linux/highmem.h> 16#include <linux/pagemap.h> 17#include <linux/ptrace.h> 18#include <linux/security.h> 19#include <linux/signal.h> 20#include <linux/uio.h> 21#include <linux/audit.h> 22#include <linux/pid_namespace.h> 23#include <linux/syscalls.h> 24#include <linux/uaccess.h> 25#include <linux/regset.h> 26#include <linux/hw_breakpoint.h> 27#include <linux/cn_proc.h> 28#include <linux/compat.h> 29 30 31/* 32 * ptrace a task: make the debugger its new parent and 33 * move it to the ptrace list. 34 * 35 * Must be called with the tasklist lock write-held. 36 */ 37void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) 38{ 39 BUG_ON(!list_empty(&child->ptrace_entry)); 40 list_add(&child->ptrace_entry, &new_parent->ptraced); 41 child->parent = new_parent; 42} 43 44/** 45 * __ptrace_unlink - unlink ptracee and restore its execution state 46 * @child: ptracee to be unlinked 47 * 48 * Remove @child from the ptrace list, move it back to the original parent, 49 * and restore the execution state so that it conforms to the group stop 50 * state. 51 * 52 * Unlinking can happen via two paths - explicit PTRACE_DETACH or ptracer 53 * exiting. For PTRACE_DETACH, unless the ptracee has been killed between 54 * ptrace_check_attach() and here, it's guaranteed to be in TASK_TRACED. 55 * If the ptracer is exiting, the ptracee can be in any state. 56 * 57 * After detach, the ptracee should be in a state which conforms to the 58 * group stop. If the group is stopped or in the process of stopping, the 59 * ptracee should be put into TASK_STOPPED; otherwise, it should be woken 60 * up from TASK_TRACED. 61 * 62 * If the ptracee is in TASK_TRACED and needs to be moved to TASK_STOPPED, 63 * it goes through TRACED -> RUNNING -> STOPPED transition which is similar 64 * to but in the opposite direction of what happens while attaching to a 65 * stopped task. However, in this direction, the intermediate RUNNING 66 * state is not hidden even from the current ptracer and if it immediately 67 * re-attaches and performs a WNOHANG wait(2), it may fail. 68 * 69 * CONTEXT: 70 * write_lock_irq(tasklist_lock) 71 */ 72void __ptrace_unlink(struct task_struct *child) 73{ 74 BUG_ON(!child->ptrace); 75 76 child->ptrace = 0; 77 child->parent = child->real_parent; 78 list_del_init(&child->ptrace_entry); 79 80 spin_lock(&child->sighand->siglock); 81 82 /* 83 * Clear all pending traps and TRAPPING. TRAPPING should be 84 * cleared regardless of JOBCTL_STOP_PENDING. Do it explicitly. 85 */ 86 task_clear_jobctl_pending(child, JOBCTL_TRAP_MASK); 87 task_clear_jobctl_trapping(child); 88 89 /* 90 * Reinstate JOBCTL_STOP_PENDING if group stop is in effect and 91 * @child isn't dead. 92 */ 93 if (!(child->flags & PF_EXITING) && 94 (child->signal->flags & SIGNAL_STOP_STOPPED || 95 child->signal->group_stop_count)) { 96 child->jobctl |= JOBCTL_STOP_PENDING; 97 98 /* 99 * This is only possible if this thread was cloned by the 100 * traced task running in the stopped group, set the signal 101 * for the future reports. 102 * FIXME: we should change ptrace_init_task() to handle this 103 * case. 104 */ 105 if (!(child->jobctl & JOBCTL_STOP_SIGMASK)) 106 child->jobctl |= SIGSTOP; 107 } 108 109 /* 110 * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick 111 * @child in the butt. Note that @resume should be used iff @child 112 * is in TASK_TRACED; otherwise, we might unduly disrupt 113 * TASK_KILLABLE sleeps. 114 */ 115 if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child)) 116 ptrace_signal_wake_up(child, true); 117 118 spin_unlock(&child->sighand->siglock); 119} 120 121/* Ensure that nothing can wake it up, even SIGKILL */ 122static bool ptrace_freeze_traced(struct task_struct *task) 123{ 124 bool ret = false; 125 126 /* Lockless, nobody but us can set this flag */ 127 if (task->jobctl & JOBCTL_LISTENING) 128 return ret; 129 130 spin_lock_irq(&task->sighand->siglock); 131 if (task_is_traced(task) && !__fatal_signal_pending(task)) { 132 task->state = __TASK_TRACED; 133 ret = true; 134 } 135 spin_unlock_irq(&task->sighand->siglock); 136 137 return ret; 138} 139 140static void ptrace_unfreeze_traced(struct task_struct *task) 141{ 142 if (task->state != __TASK_TRACED) 143 return; 144 145 WARN_ON(!task->ptrace || task->parent != current); 146 147 spin_lock_irq(&task->sighand->siglock); 148 if (__fatal_signal_pending(task)) 149 wake_up_state(task, __TASK_TRACED); 150 else 151 task->state = TASK_TRACED; 152 spin_unlock_irq(&task->sighand->siglock); 153} 154 155/** 156 * ptrace_check_attach - check whether ptracee is ready for ptrace operation 157 * @child: ptracee to check for 158 * @ignore_state: don't check whether @child is currently %TASK_TRACED 159 * 160 * Check whether @child is being ptraced by %current and ready for further 161 * ptrace operations. If @ignore_state is %false, @child also should be in 162 * %TASK_TRACED state and on return the child is guaranteed to be traced 163 * and not executing. If @ignore_state is %true, @child can be in any 164 * state. 165 * 166 * CONTEXT: 167 * Grabs and releases tasklist_lock and @child->sighand->siglock. 168 * 169 * RETURNS: 170 * 0 on success, -ESRCH if %child is not ready. 171 */ 172static int ptrace_check_attach(struct task_struct *child, bool ignore_state) 173{ 174 int ret = -ESRCH; 175 176 /* 177 * We take the read lock around doing both checks to close a 178 * possible race where someone else was tracing our child and 179 * detached between these two checks. After this locked check, 180 * we are sure that this is our traced child and that can only 181 * be changed by us so it's not changing right after this. 182 */ 183 read_lock(&tasklist_lock); 184 if (child->ptrace && child->parent == current) { 185 WARN_ON(child->state == __TASK_TRACED); 186 /* 187 * child->sighand can't be NULL, release_task() 188 * does ptrace_unlink() before __exit_signal(). 189 */ 190 if (ignore_state || ptrace_freeze_traced(child)) 191 ret = 0; 192 } 193 read_unlock(&tasklist_lock); 194 195 if (!ret && !ignore_state) { 196 if (!wait_task_inactive(child, __TASK_TRACED)) { 197 /* 198 * This can only happen if may_ptrace_stop() fails and 199 * ptrace_stop() changes ->state back to TASK_RUNNING, 200 * so we should not worry about leaking __TASK_TRACED. 201 */ 202 WARN_ON(child->state == __TASK_TRACED); 203 ret = -ESRCH; 204 } 205 } 206 207 return ret; 208} 209 210static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode) 211{ 212 if (mode & PTRACE_MODE_NOAUDIT) 213 return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE); 214 else 215 return has_ns_capability(current, ns, CAP_SYS_PTRACE); 216} 217 218/* Returns 0 on success, -errno on denial. */ 219static int __ptrace_may_access(struct task_struct *task, unsigned int mode) 220{ 221 const struct cred *cred = current_cred(), *tcred; 222 223 /* May we inspect the given task? 224 * This check is used both for attaching with ptrace 225 * and for allowing access to sensitive information in /proc. 226 * 227 * ptrace_attach denies several cases that /proc allows 228 * because setting up the necessary parent/child relationship 229 * or halting the specified task is impossible. 230 */ 231 int dumpable = 0; 232 /* Don't let security modules deny introspection */ 233 if (same_thread_group(task, current)) 234 return 0; 235 rcu_read_lock(); 236 tcred = __task_cred(task); 237 if (uid_eq(cred->uid, tcred->euid) && 238 uid_eq(cred->uid, tcred->suid) && 239 uid_eq(cred->uid, tcred->uid) && 240 gid_eq(cred->gid, tcred->egid) && 241 gid_eq(cred->gid, tcred->sgid) && 242 gid_eq(cred->gid, tcred->gid)) 243 goto ok; 244 if (ptrace_has_cap(tcred->user_ns, mode)) 245 goto ok; 246 rcu_read_unlock(); 247 return -EPERM; 248ok: 249 rcu_read_unlock(); 250 smp_rmb(); 251 if (task->mm) 252 dumpable = get_dumpable(task->mm); 253 rcu_read_lock(); 254 if (dumpable != SUID_DUMP_USER && 255 !ptrace_has_cap(__task_cred(task)->user_ns, mode)) { 256 rcu_read_unlock(); 257 return -EPERM; 258 } 259 rcu_read_unlock(); 260 261 return security_ptrace_access_check(task, mode); 262} 263 264bool ptrace_may_access(struct task_struct *task, unsigned int mode) 265{ 266 int err; 267 task_lock(task); 268 err = __ptrace_may_access(task, mode); 269 task_unlock(task); 270 return !err; 271} 272 273static int ptrace_attach(struct task_struct *task, long request, 274 unsigned long addr, 275 unsigned long flags) 276{ 277 bool seize = (request == PTRACE_SEIZE); 278 int retval; 279 280 retval = -EIO; 281 if (seize) { 282 if (addr != 0) 283 goto out; 284 if (flags & ~(unsigned long)PTRACE_O_MASK) 285 goto out; 286 flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); 287 } else { 288 flags = PT_PTRACED; 289 } 290 291 audit_ptrace(task); 292 293 retval = -EPERM; 294 if (unlikely(task->flags & PF_KTHREAD)) 295 goto out; 296 if (same_thread_group(task, current)) 297 goto out; 298 299 /* 300 * Protect exec's credential calculations against our interference; 301 * SUID, SGID and LSM creds get determined differently 302 * under ptrace. 303 */ 304 retval = -ERESTARTNOINTR; 305 if (mutex_lock_interruptible(&task->signal->cred_guard_mutex)) 306 goto out; 307 308 task_lock(task); 309 retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH); 310 task_unlock(task); 311 if (retval) 312 goto unlock_creds; 313 314 write_lock_irq(&tasklist_lock); 315 retval = -EPERM; 316 if (unlikely(task->exit_state)) 317 goto unlock_tasklist; 318 if (task->ptrace) 319 goto unlock_tasklist; 320 321 if (seize) 322 flags |= PT_SEIZED; 323 rcu_read_lock(); 324 if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE)) 325 flags |= PT_PTRACE_CAP; 326 rcu_read_unlock(); 327 task->ptrace = flags; 328 329 __ptrace_link(task, current); 330 331 /* SEIZE doesn't trap tracee on attach */ 332 if (!seize) 333 send_sig_info(SIGSTOP, SEND_SIG_FORCED, task); 334 335 spin_lock(&task->sighand->siglock); 336 337 /* 338 * If the task is already STOPPED, set JOBCTL_TRAP_STOP and 339 * TRAPPING, and kick it so that it transits to TRACED. TRAPPING 340 * will be cleared if the child completes the transition or any 341 * event which clears the group stop states happens. We'll wait 342 * for the transition to complete before returning from this 343 * function. 344 * 345 * This hides STOPPED -> RUNNING -> TRACED transition from the 346 * attaching thread but a different thread in the same group can 347 * still observe the transient RUNNING state. IOW, if another 348 * thread's WNOHANG wait(2) on the stopped tracee races against 349 * ATTACH, the wait(2) may fail due to the transient RUNNING. 350 * 351 * The following task_is_stopped() test is safe as both transitions 352 * in and out of STOPPED are protected by siglock. 353 */ 354 if (task_is_stopped(task) && 355 task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING)) 356 signal_wake_up_state(task, __TASK_STOPPED); 357 358 spin_unlock(&task->sighand->siglock); 359 360 retval = 0; 361unlock_tasklist: 362 write_unlock_irq(&tasklist_lock); 363unlock_creds: 364 mutex_unlock(&task->signal->cred_guard_mutex); 365out: 366 if (!retval) { 367 wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT, 368 TASK_UNINTERRUPTIBLE); 369 proc_ptrace_connector(task, PTRACE_ATTACH); 370 } 371 372 return retval; 373} 374 375/** 376 * ptrace_traceme -- helper for PTRACE_TRACEME 377 * 378 * Performs checks and sets PT_PTRACED. 379 * Should be used by all ptrace implementations for PTRACE_TRACEME. 380 */ 381static int ptrace_traceme(void) 382{ 383 int ret = -EPERM; 384 385 write_lock_irq(&tasklist_lock); 386 /* Are we already being traced? */ 387 if (!current->ptrace) { 388 ret = security_ptrace_traceme(current->parent); 389 /* 390 * Check PF_EXITING to ensure ->real_parent has not passed 391 * exit_ptrace(). Otherwise we don't report the error but 392 * pretend ->real_parent untraces us right after return. 393 */ 394 if (!ret && !(current->real_parent->flags & PF_EXITING)) { 395 current->ptrace = PT_PTRACED; 396 __ptrace_link(current, current->real_parent); 397 } 398 } 399 write_unlock_irq(&tasklist_lock); 400 401 return ret; 402} 403 404/* 405 * Called with irqs disabled, returns true if childs should reap themselves. 406 */ 407static int ignoring_children(struct sighand_struct *sigh) 408{ 409 int ret; 410 spin_lock(&sigh->siglock); 411 ret = (sigh->action[SIGCHLD-1].sa.sa_handler == SIG_IGN) || 412 (sigh->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT); 413 spin_unlock(&sigh->siglock); 414 return ret; 415} 416 417/* 418 * Called with tasklist_lock held for writing. 419 * Unlink a traced task, and clean it up if it was a traced zombie. 420 * Return true if it needs to be reaped with release_task(). 421 * (We can't call release_task() here because we already hold tasklist_lock.) 422 * 423 * If it's a zombie, our attachedness prevented normal parent notification 424 * or self-reaping. Do notification now if it would have happened earlier. 425 * If it should reap itself, return true. 426 * 427 * If it's our own child, there is no notification to do. But if our normal 428 * children self-reap, then this child was prevented by ptrace and we must 429 * reap it now, in that case we must also wake up sub-threads sleeping in 430 * do_wait(). 431 */ 432static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p) 433{ 434 bool dead; 435 436 __ptrace_unlink(p); 437 438 if (p->exit_state != EXIT_ZOMBIE) 439 return false; 440 441 dead = !thread_group_leader(p); 442 443 if (!dead && thread_group_empty(p)) { 444 if (!same_thread_group(p->real_parent, tracer)) 445 dead = do_notify_parent(p, p->exit_signal); 446 else if (ignoring_children(tracer->sighand)) { 447 __wake_up_parent(p, tracer); 448 dead = true; 449 } 450 } 451 /* Mark it as in the process of being reaped. */ 452 if (dead) 453 p->exit_state = EXIT_DEAD; 454 return dead; 455} 456 457static int ptrace_detach(struct task_struct *child, unsigned int data) 458{ 459 bool dead = false; 460 461 if (!valid_signal(data)) 462 return -EIO; 463 464 /* Architecture-specific hardware disable .. */ 465 ptrace_disable(child); 466 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 467 468 write_lock_irq(&tasklist_lock); 469 /* 470 * This child can be already killed. Make sure de_thread() or 471 * our sub-thread doing do_wait() didn't do release_task() yet. 472 */ 473 if (child->ptrace) { 474 child->exit_code = data; 475 dead = __ptrace_detach(current, child); 476 } 477 write_unlock_irq(&tasklist_lock); 478 479 proc_ptrace_connector(child, PTRACE_DETACH); 480 if (unlikely(dead)) 481 release_task(child); 482 483 return 0; 484} 485 486/* 487 * Detach all tasks we were using ptrace on. Called with tasklist held 488 * for writing, and returns with it held too. But note it can release 489 * and reacquire the lock. 490 */ 491void exit_ptrace(struct task_struct *tracer) 492 __releases(&tasklist_lock) 493 __acquires(&tasklist_lock) 494{ 495 struct task_struct *p, *n; 496 LIST_HEAD(ptrace_dead); 497 498 if (likely(list_empty(&tracer->ptraced))) 499 return; 500 501 list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) { 502 if (unlikely(p->ptrace & PT_EXITKILL)) 503 send_sig_info(SIGKILL, SEND_SIG_FORCED, p); 504 505 if (__ptrace_detach(tracer, p)) 506 list_add(&p->ptrace_entry, &ptrace_dead); 507 } 508 509 write_unlock_irq(&tasklist_lock); 510 BUG_ON(!list_empty(&tracer->ptraced)); 511 512 list_for_each_entry_safe(p, n, &ptrace_dead, ptrace_entry) { 513 list_del_init(&p->ptrace_entry); 514 release_task(p); 515 } 516 517 write_lock_irq(&tasklist_lock); 518} 519 520int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len) 521{ 522 int copied = 0; 523 524 while (len > 0) { 525 char buf[128]; 526 int this_len, retval; 527 528 this_len = (len > sizeof(buf)) ? sizeof(buf) : len; 529 retval = access_process_vm(tsk, src, buf, this_len, 0); 530 if (!retval) { 531 if (copied) 532 break; 533 return -EIO; 534 } 535 if (copy_to_user(dst, buf, retval)) 536 return -EFAULT; 537 copied += retval; 538 src += retval; 539 dst += retval; 540 len -= retval; 541 } 542 return copied; 543} 544 545int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len) 546{ 547 int copied = 0; 548 549 while (len > 0) { 550 char buf[128]; 551 int this_len, retval; 552 553 this_len = (len > sizeof(buf)) ? sizeof(buf) : len; 554 if (copy_from_user(buf, src, this_len)) 555 return -EFAULT; 556 retval = access_process_vm(tsk, dst, buf, this_len, 1); 557 if (!retval) { 558 if (copied) 559 break; 560 return -EIO; 561 } 562 copied += retval; 563 src += retval; 564 dst += retval; 565 len -= retval; 566 } 567 return copied; 568} 569 570static int ptrace_setoptions(struct task_struct *child, unsigned long data) 571{ 572 unsigned flags; 573 574 if (data & ~(unsigned long)PTRACE_O_MASK) 575 return -EINVAL; 576 577 /* Avoid intermediate state when all opts are cleared */ 578 flags = child->ptrace; 579 flags &= ~(PTRACE_O_MASK << PT_OPT_FLAG_SHIFT); 580 flags |= (data << PT_OPT_FLAG_SHIFT); 581 child->ptrace = flags; 582 583 return 0; 584} 585 586static int ptrace_getsiginfo(struct task_struct *child, siginfo_t *info) 587{ 588 unsigned long flags; 589 int error = -ESRCH; 590 591 if (lock_task_sighand(child, &flags)) { 592 error = -EINVAL; 593 if (likely(child->last_siginfo != NULL)) { 594 *info = *child->last_siginfo; 595 error = 0; 596 } 597 unlock_task_sighand(child, &flags); 598 } 599 return error; 600} 601 602static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info) 603{ 604 unsigned long flags; 605 int error = -ESRCH; 606 607 if (lock_task_sighand(child, &flags)) { 608 error = -EINVAL; 609 if (likely(child->last_siginfo != NULL)) { 610 *child->last_siginfo = *info; 611 error = 0; 612 } 613 unlock_task_sighand(child, &flags); 614 } 615 return error; 616} 617 618static int ptrace_peek_siginfo(struct task_struct *child, 619 unsigned long addr, 620 unsigned long data) 621{ 622 struct ptrace_peeksiginfo_args arg; 623 struct sigpending *pending; 624 struct sigqueue *q; 625 int ret, i; 626 627 ret = copy_from_user(&arg, (void __user *) addr, 628 sizeof(struct ptrace_peeksiginfo_args)); 629 if (ret) 630 return -EFAULT; 631 632 if (arg.flags & ~PTRACE_PEEKSIGINFO_SHARED) 633 return -EINVAL; /* unknown flags */ 634 635 if (arg.nr < 0) 636 return -EINVAL; 637 638 if (arg.flags & PTRACE_PEEKSIGINFO_SHARED) 639 pending = &child->signal->shared_pending; 640 else 641 pending = &child->pending; 642 643 for (i = 0; i < arg.nr; ) { 644 siginfo_t info; 645 s32 off = arg.off + i; 646 647 spin_lock_irq(&child->sighand->siglock); 648 list_for_each_entry(q, &pending->list, list) { 649 if (!off--) { 650 copy_siginfo(&info, &q->info); 651 break; 652 } 653 } 654 spin_unlock_irq(&child->sighand->siglock); 655 656 if (off >= 0) /* beyond the end of the list */ 657 break; 658 659#ifdef CONFIG_COMPAT 660 if (unlikely(is_compat_task())) { 661 compat_siginfo_t __user *uinfo = compat_ptr(data); 662 663 if (copy_siginfo_to_user32(uinfo, &info) || 664 __put_user(info.si_code, &uinfo->si_code)) { 665 ret = -EFAULT; 666 break; 667 } 668 669 } else 670#endif 671 { 672 siginfo_t __user *uinfo = (siginfo_t __user *) data; 673 674 if (copy_siginfo_to_user(uinfo, &info) || 675 __put_user(info.si_code, &uinfo->si_code)) { 676 ret = -EFAULT; 677 break; 678 } 679 } 680 681 data += sizeof(siginfo_t); 682 i++; 683 684 if (signal_pending(current)) 685 break; 686 687 cond_resched(); 688 } 689 690 if (i > 0) 691 return i; 692 693 return ret; 694} 695 696#ifdef PTRACE_SINGLESTEP 697#define is_singlestep(request) ((request) == PTRACE_SINGLESTEP) 698#else 699#define is_singlestep(request) 0 700#endif 701 702#ifdef PTRACE_SINGLEBLOCK 703#define is_singleblock(request) ((request) == PTRACE_SINGLEBLOCK) 704#else 705#define is_singleblock(request) 0 706#endif 707 708#ifdef PTRACE_SYSEMU 709#define is_sysemu_singlestep(request) ((request) == PTRACE_SYSEMU_SINGLESTEP) 710#else 711#define is_sysemu_singlestep(request) 0 712#endif 713 714static int ptrace_resume(struct task_struct *child, long request, 715 unsigned long data) 716{ 717 if (!valid_signal(data)) 718 return -EIO; 719 720 if (request == PTRACE_SYSCALL) 721 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 722 else 723 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 724 725#ifdef TIF_SYSCALL_EMU 726 if (request == PTRACE_SYSEMU || request == PTRACE_SYSEMU_SINGLESTEP) 727 set_tsk_thread_flag(child, TIF_SYSCALL_EMU); 728 else 729 clear_tsk_thread_flag(child, TIF_SYSCALL_EMU); 730#endif 731 732 if (is_singleblock(request)) { 733 if (unlikely(!arch_has_block_step())) 734 return -EIO; 735 user_enable_block_step(child); 736 } else if (is_singlestep(request) || is_sysemu_singlestep(request)) { 737 if (unlikely(!arch_has_single_step())) 738 return -EIO; 739 user_enable_single_step(child); 740 } else { 741 user_disable_single_step(child); 742 } 743 744 child->exit_code = data; 745 wake_up_state(child, __TASK_TRACED); 746 747 return 0; 748} 749 750#ifdef CONFIG_HAVE_ARCH_TRACEHOOK 751 752static const struct user_regset * 753find_regset(const struct user_regset_view *view, unsigned int type) 754{ 755 const struct user_regset *regset; 756 int n; 757 758 for (n = 0; n < view->n; ++n) { 759 regset = view->regsets + n; 760 if (regset->core_note_type == type) 761 return regset; 762 } 763 764 return NULL; 765} 766 767static int ptrace_regset(struct task_struct *task, int req, unsigned int type, 768 struct iovec *kiov) 769{ 770 const struct user_regset_view *view = task_user_regset_view(task); 771 const struct user_regset *regset = find_regset(view, type); 772 int regset_no; 773 774 if (!regset || (kiov->iov_len % regset->size) != 0) 775 return -EINVAL; 776 777 regset_no = regset - view->regsets; 778 kiov->iov_len = min(kiov->iov_len, 779 (__kernel_size_t) (regset->n * regset->size)); 780 781 if (req == PTRACE_GETREGSET) 782 return copy_regset_to_user(task, view, regset_no, 0, 783 kiov->iov_len, kiov->iov_base); 784 else 785 return copy_regset_from_user(task, view, regset_no, 0, 786 kiov->iov_len, kiov->iov_base); 787} 788 789/* 790 * This is declared in linux/regset.h and defined in machine-dependent 791 * code. We put the export here, near the primary machine-neutral use, 792 * to ensure no machine forgets it. 793 */ 794EXPORT_SYMBOL_GPL(task_user_regset_view); 795#endif 796 797int ptrace_request(struct task_struct *child, long request, 798 unsigned long addr, unsigned long data) 799{ 800 bool seized = child->ptrace & PT_SEIZED; 801 int ret = -EIO; 802 siginfo_t siginfo, *si; 803 void __user *datavp = (void __user *) data; 804 unsigned long __user *datalp = datavp; 805 unsigned long flags; 806 807 switch (request) { 808 case PTRACE_PEEKTEXT: 809 case PTRACE_PEEKDATA: 810 return generic_ptrace_peekdata(child, addr, data); 811 case PTRACE_POKETEXT: 812 case PTRACE_POKEDATA: 813 return generic_ptrace_pokedata(child, addr, data); 814 815#ifdef PTRACE_OLDSETOPTIONS 816 case PTRACE_OLDSETOPTIONS: 817#endif 818 case PTRACE_SETOPTIONS: 819 ret = ptrace_setoptions(child, data); 820 break; 821 case PTRACE_GETEVENTMSG: 822 ret = put_user(child->ptrace_message, datalp); 823 break; 824 825 case PTRACE_PEEKSIGINFO: 826 ret = ptrace_peek_siginfo(child, addr, data); 827 break; 828 829 case PTRACE_GETSIGINFO: 830 ret = ptrace_getsiginfo(child, &siginfo); 831 if (!ret) 832 ret = copy_siginfo_to_user(datavp, &siginfo); 833 break; 834 835 case PTRACE_SETSIGINFO: 836 if (copy_from_user(&siginfo, datavp, sizeof siginfo)) 837 ret = -EFAULT; 838 else 839 ret = ptrace_setsiginfo(child, &siginfo); 840 break; 841 842 case PTRACE_GETSIGMASK: 843 if (addr != sizeof(sigset_t)) { 844 ret = -EINVAL; 845 break; 846 } 847 848 if (copy_to_user(datavp, &child->blocked, sizeof(sigset_t))) 849 ret = -EFAULT; 850 else 851 ret = 0; 852 853 break; 854 855 case PTRACE_SETSIGMASK: { 856 sigset_t new_set; 857 858 if (addr != sizeof(sigset_t)) { 859 ret = -EINVAL; 860 break; 861 } 862 863 if (copy_from_user(&new_set, datavp, sizeof(sigset_t))) { 864 ret = -EFAULT; 865 break; 866 } 867 868 sigdelsetmask(&new_set, sigmask(SIGKILL)|sigmask(SIGSTOP)); 869 870 /* 871 * Every thread does recalc_sigpending() after resume, so 872 * retarget_shared_pending() and recalc_sigpending() are not 873 * called here. 874 */ 875 spin_lock_irq(&child->sighand->siglock); 876 child->blocked = new_set; 877 spin_unlock_irq(&child->sighand->siglock); 878 879 ret = 0; 880 break; 881 } 882 883 case PTRACE_INTERRUPT: 884 /* 885 * Stop tracee without any side-effect on signal or job 886 * control. At least one trap is guaranteed to happen 887 * after this request. If @child is already trapped, the 888 * current trap is not disturbed and another trap will 889 * happen after the current trap is ended with PTRACE_CONT. 890 * 891 * The actual trap might not be PTRACE_EVENT_STOP trap but 892 * the pending condition is cleared regardless. 893 */ 894 if (unlikely(!seized || !lock_task_sighand(child, &flags))) 895 break; 896 897 /* 898 * INTERRUPT doesn't disturb existing trap sans one 899 * exception. If ptracer issued LISTEN for the current 900 * STOP, this INTERRUPT should clear LISTEN and re-trap 901 * tracee into STOP. 902 */ 903 if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP))) 904 ptrace_signal_wake_up(child, child->jobctl & JOBCTL_LISTENING); 905 906 unlock_task_sighand(child, &flags); 907 ret = 0; 908 break; 909 910 case PTRACE_LISTEN: 911 /* 912 * Listen for events. Tracee must be in STOP. It's not 913 * resumed per-se but is not considered to be in TRACED by 914 * wait(2) or ptrace(2). If an async event (e.g. group 915 * stop state change) happens, tracee will enter STOP trap 916 * again. Alternatively, ptracer can issue INTERRUPT to 917 * finish listening and re-trap tracee into STOP. 918 */ 919 if (unlikely(!seized || !lock_task_sighand(child, &flags))) 920 break; 921 922 si = child->last_siginfo; 923 if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) { 924 child->jobctl |= JOBCTL_LISTENING; 925 /* 926 * If NOTIFY is set, it means event happened between 927 * start of this trap and now. Trigger re-trap. 928 */ 929 if (child->jobctl & JOBCTL_TRAP_NOTIFY) 930 ptrace_signal_wake_up(child, true); 931 ret = 0; 932 } 933 unlock_task_sighand(child, &flags); 934 break; 935 936 case PTRACE_DETACH: /* detach a process that was attached. */ 937 ret = ptrace_detach(child, data); 938 break; 939 940#ifdef CONFIG_BINFMT_ELF_FDPIC 941 case PTRACE_GETFDPIC: { 942 struct mm_struct *mm = get_task_mm(child); 943 unsigned long tmp = 0; 944 945 ret = -ESRCH; 946 if (!mm) 947 break; 948 949 switch (addr) { 950 case PTRACE_GETFDPIC_EXEC: 951 tmp = mm->context.exec_fdpic_loadmap; 952 break; 953 case PTRACE_GETFDPIC_INTERP: 954 tmp = mm->context.interp_fdpic_loadmap; 955 break; 956 default: 957 break; 958 } 959 mmput(mm); 960 961 ret = put_user(tmp, datalp); 962 break; 963 } 964#endif 965 966#ifdef PTRACE_SINGLESTEP 967 case PTRACE_SINGLESTEP: 968#endif 969#ifdef PTRACE_SINGLEBLOCK 970 case PTRACE_SINGLEBLOCK: 971#endif 972#ifdef PTRACE_SYSEMU 973 case PTRACE_SYSEMU: 974 case PTRACE_SYSEMU_SINGLESTEP: 975#endif 976 case PTRACE_SYSCALL: 977 case PTRACE_CONT: 978 return ptrace_resume(child, request, data); 979 980 case PTRACE_KILL: 981 if (child->exit_state) /* already dead */ 982 return 0; 983 return ptrace_resume(child, request, SIGKILL); 984 985#ifdef CONFIG_HAVE_ARCH_TRACEHOOK 986 case PTRACE_GETREGSET: 987 case PTRACE_SETREGSET: { 988 struct iovec kiov; 989 struct iovec __user *uiov = datavp; 990 991 if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov))) 992 return -EFAULT; 993 994 if (__get_user(kiov.iov_base, &uiov->iov_base) || 995 __get_user(kiov.iov_len, &uiov->iov_len)) 996 return -EFAULT; 997 998 ret = ptrace_regset(child, request, addr, &kiov); 999 if (!ret) 1000 ret = __put_user(kiov.iov_len, &uiov->iov_len); 1001 break; 1002 } 1003#endif 1004 default: 1005 break; 1006 } 1007 1008 return ret; 1009} 1010 1011static struct task_struct *ptrace_get_task_struct(pid_t pid) 1012{ 1013 struct task_struct *child; 1014 1015 rcu_read_lock(); 1016 child = find_task_by_vpid(pid); 1017 if (child) 1018 get_task_struct(child); 1019 rcu_read_unlock(); 1020 1021 if (!child) 1022 return ERR_PTR(-ESRCH); 1023 return child; 1024} 1025 1026#ifndef arch_ptrace_attach 1027#define arch_ptrace_attach(child) do { } while (0) 1028#endif 1029 1030SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr, 1031 unsigned long, data) 1032{ 1033 struct task_struct *child; 1034 long ret; 1035 1036 if (request == PTRACE_TRACEME) { 1037 ret = ptrace_traceme(); 1038 if (!ret) 1039 arch_ptrace_attach(current); 1040 goto out; 1041 } 1042 1043 child = ptrace_get_task_struct(pid); 1044 if (IS_ERR(child)) { 1045 ret = PTR_ERR(child); 1046 goto out; 1047 } 1048 1049 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) { 1050 ret = ptrace_attach(child, request, addr, data); 1051 /* 1052 * Some architectures need to do book-keeping after 1053 * a ptrace attach. 1054 */ 1055 if (!ret) 1056 arch_ptrace_attach(child); 1057 goto out_put_task_struct; 1058 } 1059 1060 ret = ptrace_check_attach(child, request == PTRACE_KILL || 1061 request == PTRACE_INTERRUPT); 1062 if (ret < 0) 1063 goto out_put_task_struct; 1064 1065 ret = arch_ptrace(child, request, addr, data); 1066 if (ret || request != PTRACE_DETACH) 1067 ptrace_unfreeze_traced(child); 1068 1069 out_put_task_struct: 1070 put_task_struct(child); 1071 out: 1072 return ret; 1073} 1074 1075int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr, 1076 unsigned long data) 1077{ 1078 unsigned long tmp; 1079 int copied; 1080 1081 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0); 1082 if (copied != sizeof(tmp)) 1083 return -EIO; 1084 return put_user(tmp, (unsigned long __user *)data); 1085} 1086 1087int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr, 1088 unsigned long data) 1089{ 1090 int copied; 1091 1092 copied = access_process_vm(tsk, addr, &data, sizeof(data), 1); 1093 return (copied == sizeof(data)) ? 0 : -EIO; 1094} 1095 1096#if defined CONFIG_COMPAT 1097#include <linux/compat.h> 1098 1099int compat_ptrace_request(struct task_struct *child, compat_long_t request, 1100 compat_ulong_t addr, compat_ulong_t data) 1101{ 1102 compat_ulong_t __user *datap = compat_ptr(data); 1103 compat_ulong_t word; 1104 siginfo_t siginfo; 1105 int ret; 1106 1107 switch (request) { 1108 case PTRACE_PEEKTEXT: 1109 case PTRACE_PEEKDATA: 1110 ret = access_process_vm(child, addr, &word, sizeof(word), 0); 1111 if (ret != sizeof(word)) 1112 ret = -EIO; 1113 else 1114 ret = put_user(word, datap); 1115 break; 1116 1117 case PTRACE_POKETEXT: 1118 case PTRACE_POKEDATA: 1119 ret = access_process_vm(child, addr, &data, sizeof(data), 1); 1120 ret = (ret != sizeof(data) ? -EIO : 0); 1121 break; 1122 1123 case PTRACE_GETEVENTMSG: 1124 ret = put_user((compat_ulong_t) child->ptrace_message, datap); 1125 break; 1126 1127 case PTRACE_GETSIGINFO: 1128 ret = ptrace_getsiginfo(child, &siginfo); 1129 if (!ret) 1130 ret = copy_siginfo_to_user32( 1131 (struct compat_siginfo __user *) datap, 1132 &siginfo); 1133 break; 1134 1135 case PTRACE_SETSIGINFO: 1136 memset(&siginfo, 0, sizeof siginfo); 1137 if (copy_siginfo_from_user32( 1138 &siginfo, (struct compat_siginfo __user *) datap)) 1139 ret = -EFAULT; 1140 else 1141 ret = ptrace_setsiginfo(child, &siginfo); 1142 break; 1143#ifdef CONFIG_HAVE_ARCH_TRACEHOOK 1144 case PTRACE_GETREGSET: 1145 case PTRACE_SETREGSET: 1146 { 1147 struct iovec kiov; 1148 struct compat_iovec __user *uiov = 1149 (struct compat_iovec __user *) datap; 1150 compat_uptr_t ptr; 1151 compat_size_t len; 1152 1153 if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov))) 1154 return -EFAULT; 1155 1156 if (__get_user(ptr, &uiov->iov_base) || 1157 __get_user(len, &uiov->iov_len)) 1158 return -EFAULT; 1159 1160 kiov.iov_base = compat_ptr(ptr); 1161 kiov.iov_len = len; 1162 1163 ret = ptrace_regset(child, request, addr, &kiov); 1164 if (!ret) 1165 ret = __put_user(kiov.iov_len, &uiov->iov_len); 1166 break; 1167 } 1168#endif 1169 1170 default: 1171 ret = ptrace_request(child, request, addr, data); 1172 } 1173 1174 return ret; 1175} 1176 1177COMPAT_SYSCALL_DEFINE4(ptrace, compat_long_t, request, compat_long_t, pid, 1178 compat_long_t, addr, compat_long_t, data) 1179{ 1180 struct task_struct *child; 1181 long ret; 1182 1183 if (request == PTRACE_TRACEME) { 1184 ret = ptrace_traceme(); 1185 goto out; 1186 } 1187 1188 child = ptrace_get_task_struct(pid); 1189 if (IS_ERR(child)) { 1190 ret = PTR_ERR(child); 1191 goto out; 1192 } 1193 1194 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) { 1195 ret = ptrace_attach(child, request, addr, data); 1196 /* 1197 * Some architectures need to do book-keeping after 1198 * a ptrace attach. 1199 */ 1200 if (!ret) 1201 arch_ptrace_attach(child); 1202 goto out_put_task_struct; 1203 } 1204 1205 ret = ptrace_check_attach(child, request == PTRACE_KILL || 1206 request == PTRACE_INTERRUPT); 1207 if (!ret) { 1208 ret = compat_arch_ptrace(child, request, addr, data); 1209 if (ret || request != PTRACE_DETACH) 1210 ptrace_unfreeze_traced(child); 1211 } 1212 1213 out_put_task_struct: 1214 put_task_struct(child); 1215 out: 1216 return ret; 1217} 1218#endif /* CONFIG_COMPAT */ 1219