1 /* 2 * linux/kernel/ptrace.c 3 * 4 * (C) Copyright 1999 Linus Torvalds 5 * 6 * Common interfaces for "ptrace()" which we do not want 7 * to continually duplicate across every architecture. 8 */ 9 10 #include <linux/capability.h> 11 #include <linux/export.h> 12 #include <linux/sched.h> 13 #include <linux/errno.h> 14 #include <linux/mm.h> 15 #include <linux/highmem.h> 16 #include <linux/pagemap.h> 17 #include <linux/ptrace.h> 18 #include <linux/security.h> 19 #include <linux/signal.h> 20 #include <linux/audit.h> 21 #include <linux/pid_namespace.h> 22 #include <linux/syscalls.h> 23 #include <linux/uaccess.h> 24 #include <linux/regset.h> 25 #include <linux/hw_breakpoint.h> 26 #include <linux/cn_proc.h> 27 #include <linux/compat.h> 28 29 30 static int ptrace_trapping_sleep_fn(void *flags) 31 { 32 schedule(); 33 return 0; 34 } 35 36 /* 37 * ptrace a task: make the debugger its new parent and 38 * move it to the ptrace list. 39 * 40 * Must be called with the tasklist lock write-held. 41 */ 42 void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) 43 { 44 BUG_ON(!list_empty(&child->ptrace_entry)); 45 list_add(&child->ptrace_entry, &new_parent->ptraced); 46 child->parent = new_parent; 47 } 48 49 /** 50 * __ptrace_unlink - unlink ptracee and restore its execution state 51 * @child: ptracee to be unlinked 52 * 53 * Remove @child from the ptrace list, move it back to the original parent, 54 * and restore the execution state so that it conforms to the group stop 55 * state. 56 * 57 * Unlinking can happen via two paths - explicit PTRACE_DETACH or ptracer 58 * exiting. For PTRACE_DETACH, unless the ptracee has been killed between 59 * ptrace_check_attach() and here, it's guaranteed to be in TASK_TRACED. 60 * If the ptracer is exiting, the ptracee can be in any state. 61 * 62 * After detach, the ptracee should be in a state which conforms to the 63 * group stop. If the group is stopped or in the process of stopping, the 64 * ptracee should be put into TASK_STOPPED; otherwise, it should be woken 65 * up from TASK_TRACED. 66 * 67 * If the ptracee is in TASK_TRACED and needs to be moved to TASK_STOPPED, 68 * it goes through TRACED -> RUNNING -> STOPPED transition which is similar 69 * to but in the opposite direction of what happens while attaching to a 70 * stopped task. However, in this direction, the intermediate RUNNING 71 * state is not hidden even from the current ptracer and if it immediately 72 * re-attaches and performs a WNOHANG wait(2), it may fail. 73 * 74 * CONTEXT: 75 * write_lock_irq(tasklist_lock) 76 */ 77 void __ptrace_unlink(struct task_struct *child) 78 { 79 BUG_ON(!child->ptrace); 80 81 child->ptrace = 0; 82 child->parent = child->real_parent; 83 list_del_init(&child->ptrace_entry); 84 85 spin_lock(&child->sighand->siglock); 86 87 /* 88 * Clear all pending traps and TRAPPING. TRAPPING should be 89 * cleared regardless of JOBCTL_STOP_PENDING. Do it explicitly. 90 */ 91 task_clear_jobctl_pending(child, JOBCTL_TRAP_MASK); 92 task_clear_jobctl_trapping(child); 93 94 /* 95 * Reinstate JOBCTL_STOP_PENDING if group stop is in effect and 96 * @child isn't dead. 97 */ 98 if (!(child->flags & PF_EXITING) && 99 (child->signal->flags & SIGNAL_STOP_STOPPED || 100 child->signal->group_stop_count)) { 101 child->jobctl |= JOBCTL_STOP_PENDING; 102 103 /* 104 * This is only possible if this thread was cloned by the 105 * traced task running in the stopped group, set the signal 106 * for the future reports. 107 * FIXME: we should change ptrace_init_task() to handle this 108 * case. 109 */ 110 if (!(child->jobctl & JOBCTL_STOP_SIGMASK)) 111 child->jobctl |= SIGSTOP; 112 } 113 114 /* 115 * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick 116 * @child in the butt. Note that @resume should be used iff @child 117 * is in TASK_TRACED; otherwise, we might unduly disrupt 118 * TASK_KILLABLE sleeps. 119 */ 120 if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child)) 121 ptrace_signal_wake_up(child, true); 122 123 spin_unlock(&child->sighand->siglock); 124 } 125 126 /* Ensure that nothing can wake it up, even SIGKILL */ 127 static bool ptrace_freeze_traced(struct task_struct *task) 128 { 129 bool ret = false; 130 131 /* Lockless, nobody but us can set this flag */ 132 if (task->jobctl & JOBCTL_LISTENING) 133 return ret; 134 135 spin_lock_irq(&task->sighand->siglock); 136 if (task_is_traced(task) && !__fatal_signal_pending(task)) { 137 task->state = __TASK_TRACED; 138 ret = true; 139 } 140 spin_unlock_irq(&task->sighand->siglock); 141 142 return ret; 143 } 144 145 static void ptrace_unfreeze_traced(struct task_struct *task) 146 { 147 if (task->state != __TASK_TRACED) 148 return; 149 150 WARN_ON(!task->ptrace || task->parent != current); 151 152 spin_lock_irq(&task->sighand->siglock); 153 if (__fatal_signal_pending(task)) 154 wake_up_state(task, __TASK_TRACED); 155 else 156 task->state = TASK_TRACED; 157 spin_unlock_irq(&task->sighand->siglock); 158 } 159 160 /** 161 * ptrace_check_attach - check whether ptracee is ready for ptrace operation 162 * @child: ptracee to check for 163 * @ignore_state: don't check whether @child is currently %TASK_TRACED 164 * 165 * Check whether @child is being ptraced by %current and ready for further 166 * ptrace operations. If @ignore_state is %false, @child also should be in 167 * %TASK_TRACED state and on return the child is guaranteed to be traced 168 * and not executing. If @ignore_state is %true, @child can be in any 169 * state. 170 * 171 * CONTEXT: 172 * Grabs and releases tasklist_lock and @child->sighand->siglock. 173 * 174 * RETURNS: 175 * 0 on success, -ESRCH if %child is not ready. 176 */ 177 static int ptrace_check_attach(struct task_struct *child, bool ignore_state) 178 { 179 int ret = -ESRCH; 180 181 /* 182 * We take the read lock around doing both checks to close a 183 * possible race where someone else was tracing our child and 184 * detached between these two checks. After this locked check, 185 * we are sure that this is our traced child and that can only 186 * be changed by us so it's not changing right after this. 187 */ 188 read_lock(&tasklist_lock); 189 if (child->ptrace && child->parent == current) { 190 WARN_ON(child->state == __TASK_TRACED); 191 /* 192 * child->sighand can't be NULL, release_task() 193 * does ptrace_unlink() before __exit_signal(). 194 */ 195 if (ignore_state || ptrace_freeze_traced(child)) 196 ret = 0; 197 } 198 read_unlock(&tasklist_lock); 199 200 if (!ret && !ignore_state) { 201 if (!wait_task_inactive(child, __TASK_TRACED)) { 202 /* 203 * This can only happen if may_ptrace_stop() fails and 204 * ptrace_stop() changes ->state back to TASK_RUNNING, 205 * so we should not worry about leaking __TASK_TRACED. 206 */ 207 WARN_ON(child->state == __TASK_TRACED); 208 ret = -ESRCH; 209 } 210 } 211 212 return ret; 213 } 214 215 static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode) 216 { 217 if (mode & PTRACE_MODE_NOAUDIT) 218 return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE); 219 else 220 return has_ns_capability(current, ns, CAP_SYS_PTRACE); 221 } 222 223 /* Returns 0 on success, -errno on denial. */ 224 static int __ptrace_may_access(struct task_struct *task, unsigned int mode) 225 { 226 const struct cred *cred = current_cred(), *tcred; 227 228 /* May we inspect the given task? 229 * This check is used both for attaching with ptrace 230 * and for allowing access to sensitive information in /proc. 231 * 232 * ptrace_attach denies several cases that /proc allows 233 * because setting up the necessary parent/child relationship 234 * or halting the specified task is impossible. 235 */ 236 int dumpable = 0; 237 /* Don't let security modules deny introspection */ 238 if (task == current) 239 return 0; 240 rcu_read_lock(); 241 tcred = __task_cred(task); 242 if (uid_eq(cred->uid, tcred->euid) && 243 uid_eq(cred->uid, tcred->suid) && 244 uid_eq(cred->uid, tcred->uid) && 245 gid_eq(cred->gid, tcred->egid) && 246 gid_eq(cred->gid, tcred->sgid) && 247 gid_eq(cred->gid, tcred->gid)) 248 goto ok; 249 if (ptrace_has_cap(tcred->user_ns, mode)) 250 goto ok; 251 rcu_read_unlock(); 252 return -EPERM; 253 ok: 254 rcu_read_unlock(); 255 smp_rmb(); 256 if (task->mm) 257 dumpable = get_dumpable(task->mm); 258 rcu_read_lock(); 259 if (!dumpable && !ptrace_has_cap(__task_cred(task)->user_ns, mode)) { 260 rcu_read_unlock(); 261 return -EPERM; 262 } 263 rcu_read_unlock(); 264 265 return security_ptrace_access_check(task, mode); 266 } 267 268 bool ptrace_may_access(struct task_struct *task, unsigned int mode) 269 { 270 int err; 271 task_lock(task); 272 err = __ptrace_may_access(task, mode); 273 task_unlock(task); 274 return !err; 275 } 276 277 static int ptrace_attach(struct task_struct *task, long request, 278 unsigned long addr, 279 unsigned long flags) 280 { 281 bool seize = (request == PTRACE_SEIZE); 282 int retval; 283 284 retval = -EIO; 285 if (seize) { 286 if (addr != 0) 287 goto out; 288 if (flags & ~(unsigned long)PTRACE_O_MASK) 289 goto out; 290 flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); 291 } else { 292 flags = PT_PTRACED; 293 } 294 295 audit_ptrace(task); 296 297 retval = -EPERM; 298 if (unlikely(task->flags & PF_KTHREAD)) 299 goto out; 300 if (same_thread_group(task, current)) 301 goto out; 302 303 /* 304 * Protect exec's credential calculations against our interference; 305 * SUID, SGID and LSM creds get determined differently 306 * under ptrace. 307 */ 308 retval = -ERESTARTNOINTR; 309 if (mutex_lock_interruptible(&task->signal->cred_guard_mutex)) 310 goto out; 311 312 task_lock(task); 313 retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH); 314 task_unlock(task); 315 if (retval) 316 goto unlock_creds; 317 318 write_lock_irq(&tasklist_lock); 319 retval = -EPERM; 320 if (unlikely(task->exit_state)) 321 goto unlock_tasklist; 322 if (task->ptrace) 323 goto unlock_tasklist; 324 325 if (seize) 326 flags |= PT_SEIZED; 327 rcu_read_lock(); 328 if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE)) 329 flags |= PT_PTRACE_CAP; 330 rcu_read_unlock(); 331 task->ptrace = flags; 332 333 __ptrace_link(task, current); 334 335 /* SEIZE doesn't trap tracee on attach */ 336 if (!seize) 337 send_sig_info(SIGSTOP, SEND_SIG_FORCED, task); 338 339 spin_lock(&task->sighand->siglock); 340 341 /* 342 * If the task is already STOPPED, set JOBCTL_TRAP_STOP and 343 * TRAPPING, and kick it so that it transits to TRACED. TRAPPING 344 * will be cleared if the child completes the transition or any 345 * event which clears the group stop states happens. We'll wait 346 * for the transition to complete before returning from this 347 * function. 348 * 349 * This hides STOPPED -> RUNNING -> TRACED transition from the 350 * attaching thread but a different thread in the same group can 351 * still observe the transient RUNNING state. IOW, if another 352 * thread's WNOHANG wait(2) on the stopped tracee races against 353 * ATTACH, the wait(2) may fail due to the transient RUNNING. 354 * 355 * The following task_is_stopped() test is safe as both transitions 356 * in and out of STOPPED are protected by siglock. 357 */ 358 if (task_is_stopped(task) && 359 task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING)) 360 signal_wake_up_state(task, __TASK_STOPPED); 361 362 spin_unlock(&task->sighand->siglock); 363 364 retval = 0; 365 unlock_tasklist: 366 write_unlock_irq(&tasklist_lock); 367 unlock_creds: 368 mutex_unlock(&task->signal->cred_guard_mutex); 369 out: 370 if (!retval) { 371 wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT, 372 ptrace_trapping_sleep_fn, TASK_UNINTERRUPTIBLE); 373 proc_ptrace_connector(task, PTRACE_ATTACH); 374 } 375 376 return retval; 377 } 378 379 /** 380 * ptrace_traceme -- helper for PTRACE_TRACEME 381 * 382 * Performs checks and sets PT_PTRACED. 383 * Should be used by all ptrace implementations for PTRACE_TRACEME. 384 */ 385 static int ptrace_traceme(void) 386 { 387 int ret = -EPERM; 388 389 write_lock_irq(&tasklist_lock); 390 /* Are we already being traced? */ 391 if (!current->ptrace) { 392 ret = security_ptrace_traceme(current->parent); 393 /* 394 * Check PF_EXITING to ensure ->real_parent has not passed 395 * exit_ptrace(). Otherwise we don't report the error but 396 * pretend ->real_parent untraces us right after return. 397 */ 398 if (!ret && !(current->real_parent->flags & PF_EXITING)) { 399 current->ptrace = PT_PTRACED; 400 __ptrace_link(current, current->real_parent); 401 } 402 } 403 write_unlock_irq(&tasklist_lock); 404 405 return ret; 406 } 407 408 /* 409 * Called with irqs disabled, returns true if childs should reap themselves. 410 */ 411 static int ignoring_children(struct sighand_struct *sigh) 412 { 413 int ret; 414 spin_lock(&sigh->siglock); 415 ret = (sigh->action[SIGCHLD-1].sa.sa_handler == SIG_IGN) || 416 (sigh->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT); 417 spin_unlock(&sigh->siglock); 418 return ret; 419 } 420 421 /* 422 * Called with tasklist_lock held for writing. 423 * Unlink a traced task, and clean it up if it was a traced zombie. 424 * Return true if it needs to be reaped with release_task(). 425 * (We can't call release_task() here because we already hold tasklist_lock.) 426 * 427 * If it's a zombie, our attachedness prevented normal parent notification 428 * or self-reaping. Do notification now if it would have happened earlier. 429 * If it should reap itself, return true. 430 * 431 * If it's our own child, there is no notification to do. But if our normal 432 * children self-reap, then this child was prevented by ptrace and we must 433 * reap it now, in that case we must also wake up sub-threads sleeping in 434 * do_wait(). 435 */ 436 static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p) 437 { 438 bool dead; 439 440 __ptrace_unlink(p); 441 442 if (p->exit_state != EXIT_ZOMBIE) 443 return false; 444 445 dead = !thread_group_leader(p); 446 447 if (!dead && thread_group_empty(p)) { 448 if (!same_thread_group(p->real_parent, tracer)) 449 dead = do_notify_parent(p, p->exit_signal); 450 else if (ignoring_children(tracer->sighand)) { 451 __wake_up_parent(p, tracer); 452 dead = true; 453 } 454 } 455 /* Mark it as in the process of being reaped. */ 456 if (dead) 457 p->exit_state = EXIT_DEAD; 458 return dead; 459 } 460 461 static int ptrace_detach(struct task_struct *child, unsigned int data) 462 { 463 bool dead = false; 464 465 if (!valid_signal(data)) 466 return -EIO; 467 468 /* Architecture-specific hardware disable .. */ 469 ptrace_disable(child); 470 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 471 472 write_lock_irq(&tasklist_lock); 473 /* 474 * This child can be already killed. Make sure de_thread() or 475 * our sub-thread doing do_wait() didn't do release_task() yet. 476 */ 477 if (child->ptrace) { 478 child->exit_code = data; 479 dead = __ptrace_detach(current, child); 480 } 481 write_unlock_irq(&tasklist_lock); 482 483 proc_ptrace_connector(child, PTRACE_DETACH); 484 if (unlikely(dead)) 485 release_task(child); 486 487 return 0; 488 } 489 490 /* 491 * Detach all tasks we were using ptrace on. Called with tasklist held 492 * for writing, and returns with it held too. But note it can release 493 * and reacquire the lock. 494 */ 495 void exit_ptrace(struct task_struct *tracer) 496 __releases(&tasklist_lock) 497 __acquires(&tasklist_lock) 498 { 499 struct task_struct *p, *n; 500 LIST_HEAD(ptrace_dead); 501 502 if (likely(list_empty(&tracer->ptraced))) 503 return; 504 505 list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) { 506 if (unlikely(p->ptrace & PT_EXITKILL)) 507 send_sig_info(SIGKILL, SEND_SIG_FORCED, p); 508 509 if (__ptrace_detach(tracer, p)) 510 list_add(&p->ptrace_entry, &ptrace_dead); 511 } 512 513 write_unlock_irq(&tasklist_lock); 514 BUG_ON(!list_empty(&tracer->ptraced)); 515 516 list_for_each_entry_safe(p, n, &ptrace_dead, ptrace_entry) { 517 list_del_init(&p->ptrace_entry); 518 release_task(p); 519 } 520 521 write_lock_irq(&tasklist_lock); 522 } 523 524 int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len) 525 { 526 int copied = 0; 527 528 while (len > 0) { 529 char buf[128]; 530 int this_len, retval; 531 532 this_len = (len > sizeof(buf)) ? sizeof(buf) : len; 533 retval = access_process_vm(tsk, src, buf, this_len, 0); 534 if (!retval) { 535 if (copied) 536 break; 537 return -EIO; 538 } 539 if (copy_to_user(dst, buf, retval)) 540 return -EFAULT; 541 copied += retval; 542 src += retval; 543 dst += retval; 544 len -= retval; 545 } 546 return copied; 547 } 548 549 int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len) 550 { 551 int copied = 0; 552 553 while (len > 0) { 554 char buf[128]; 555 int this_len, retval; 556 557 this_len = (len > sizeof(buf)) ? sizeof(buf) : len; 558 if (copy_from_user(buf, src, this_len)) 559 return -EFAULT; 560 retval = access_process_vm(tsk, dst, buf, this_len, 1); 561 if (!retval) { 562 if (copied) 563 break; 564 return -EIO; 565 } 566 copied += retval; 567 src += retval; 568 dst += retval; 569 len -= retval; 570 } 571 return copied; 572 } 573 574 static int ptrace_setoptions(struct task_struct *child, unsigned long data) 575 { 576 unsigned flags; 577 578 if (data & ~(unsigned long)PTRACE_O_MASK) 579 return -EINVAL; 580 581 /* Avoid intermediate state when all opts are cleared */ 582 flags = child->ptrace; 583 flags &= ~(PTRACE_O_MASK << PT_OPT_FLAG_SHIFT); 584 flags |= (data << PT_OPT_FLAG_SHIFT); 585 child->ptrace = flags; 586 587 return 0; 588 } 589 590 static int ptrace_getsiginfo(struct task_struct *child, siginfo_t *info) 591 { 592 unsigned long flags; 593 int error = -ESRCH; 594 595 if (lock_task_sighand(child, &flags)) { 596 error = -EINVAL; 597 if (likely(child->last_siginfo != NULL)) { 598 *info = *child->last_siginfo; 599 error = 0; 600 } 601 unlock_task_sighand(child, &flags); 602 } 603 return error; 604 } 605 606 static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info) 607 { 608 unsigned long flags; 609 int error = -ESRCH; 610 611 if (lock_task_sighand(child, &flags)) { 612 error = -EINVAL; 613 if (likely(child->last_siginfo != NULL)) { 614 *child->last_siginfo = *info; 615 error = 0; 616 } 617 unlock_task_sighand(child, &flags); 618 } 619 return error; 620 } 621 622 static int ptrace_peek_siginfo(struct task_struct *child, 623 unsigned long addr, 624 unsigned long data) 625 { 626 struct ptrace_peeksiginfo_args arg; 627 struct sigpending *pending; 628 struct sigqueue *q; 629 int ret, i; 630 631 ret = copy_from_user(&arg, (void __user *) addr, 632 sizeof(struct ptrace_peeksiginfo_args)); 633 if (ret) 634 return -EFAULT; 635 636 if (arg.flags & ~PTRACE_PEEKSIGINFO_SHARED) 637 return -EINVAL; /* unknown flags */ 638 639 if (arg.nr < 0) 640 return -EINVAL; 641 642 if (arg.flags & PTRACE_PEEKSIGINFO_SHARED) 643 pending = &child->signal->shared_pending; 644 else 645 pending = &child->pending; 646 647 for (i = 0; i < arg.nr; ) { 648 siginfo_t info; 649 s32 off = arg.off + i; 650 651 spin_lock_irq(&child->sighand->siglock); 652 list_for_each_entry(q, &pending->list, list) { 653 if (!off--) { 654 copy_siginfo(&info, &q->info); 655 break; 656 } 657 } 658 spin_unlock_irq(&child->sighand->siglock); 659 660 if (off >= 0) /* beyond the end of the list */ 661 break; 662 663 #ifdef CONFIG_COMPAT 664 if (unlikely(is_compat_task())) { 665 compat_siginfo_t __user *uinfo = compat_ptr(data); 666 667 ret = copy_siginfo_to_user32(uinfo, &info); 668 ret |= __put_user(info.si_code, &uinfo->si_code); 669 } else 670 #endif 671 { 672 siginfo_t __user *uinfo = (siginfo_t __user *) data; 673 674 ret = copy_siginfo_to_user(uinfo, &info); 675 ret |= __put_user(info.si_code, &uinfo->si_code); 676 } 677 678 if (ret) { 679 ret = -EFAULT; 680 break; 681 } 682 683 data += sizeof(siginfo_t); 684 i++; 685 686 if (signal_pending(current)) 687 break; 688 689 cond_resched(); 690 } 691 692 if (i > 0) 693 return i; 694 695 return ret; 696 } 697 698 #ifdef PTRACE_SINGLESTEP 699 #define is_singlestep(request) ((request) == PTRACE_SINGLESTEP) 700 #else 701 #define is_singlestep(request) 0 702 #endif 703 704 #ifdef PTRACE_SINGLEBLOCK 705 #define is_singleblock(request) ((request) == PTRACE_SINGLEBLOCK) 706 #else 707 #define is_singleblock(request) 0 708 #endif 709 710 #ifdef PTRACE_SYSEMU 711 #define is_sysemu_singlestep(request) ((request) == PTRACE_SYSEMU_SINGLESTEP) 712 #else 713 #define is_sysemu_singlestep(request) 0 714 #endif 715 716 static int ptrace_resume(struct task_struct *child, long request, 717 unsigned long data) 718 { 719 if (!valid_signal(data)) 720 return -EIO; 721 722 if (request == PTRACE_SYSCALL) 723 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 724 else 725 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 726 727 #ifdef TIF_SYSCALL_EMU 728 if (request == PTRACE_SYSEMU || request == PTRACE_SYSEMU_SINGLESTEP) 729 set_tsk_thread_flag(child, TIF_SYSCALL_EMU); 730 else 731 clear_tsk_thread_flag(child, TIF_SYSCALL_EMU); 732 #endif 733 734 if (is_singleblock(request)) { 735 if (unlikely(!arch_has_block_step())) 736 return -EIO; 737 user_enable_block_step(child); 738 } else if (is_singlestep(request) || is_sysemu_singlestep(request)) { 739 if (unlikely(!arch_has_single_step())) 740 return -EIO; 741 user_enable_single_step(child); 742 } else { 743 user_disable_single_step(child); 744 } 745 746 child->exit_code = data; 747 wake_up_state(child, __TASK_TRACED); 748 749 return 0; 750 } 751 752 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK 753 754 static const struct user_regset * 755 find_regset(const struct user_regset_view *view, unsigned int type) 756 { 757 const struct user_regset *regset; 758 int n; 759 760 for (n = 0; n < view->n; ++n) { 761 regset = view->regsets + n; 762 if (regset->core_note_type == type) 763 return regset; 764 } 765 766 return NULL; 767 } 768 769 static int ptrace_regset(struct task_struct *task, int req, unsigned int type, 770 struct iovec *kiov) 771 { 772 const struct user_regset_view *view = task_user_regset_view(task); 773 const struct user_regset *regset = find_regset(view, type); 774 int regset_no; 775 776 if (!regset || (kiov->iov_len % regset->size) != 0) 777 return -EINVAL; 778 779 regset_no = regset - view->regsets; 780 kiov->iov_len = min(kiov->iov_len, 781 (__kernel_size_t) (regset->n * regset->size)); 782 783 if (req == PTRACE_GETREGSET) 784 return copy_regset_to_user(task, view, regset_no, 0, 785 kiov->iov_len, kiov->iov_base); 786 else 787 return copy_regset_from_user(task, view, regset_no, 0, 788 kiov->iov_len, kiov->iov_base); 789 } 790 791 /* 792 * This is declared in linux/regset.h and defined in machine-dependent 793 * code. We put the export here, near the primary machine-neutral use, 794 * to ensure no machine forgets it. 795 */ 796 EXPORT_SYMBOL_GPL(task_user_regset_view); 797 #endif 798 799 int ptrace_request(struct task_struct *child, long request, 800 unsigned long addr, unsigned long data) 801 { 802 bool seized = child->ptrace & PT_SEIZED; 803 int ret = -EIO; 804 siginfo_t siginfo, *si; 805 void __user *datavp = (void __user *) data; 806 unsigned long __user *datalp = datavp; 807 unsigned long flags; 808 809 switch (request) { 810 case PTRACE_PEEKTEXT: 811 case PTRACE_PEEKDATA: 812 return generic_ptrace_peekdata(child, addr, data); 813 case PTRACE_POKETEXT: 814 case PTRACE_POKEDATA: 815 return generic_ptrace_pokedata(child, addr, data); 816 817 #ifdef PTRACE_OLDSETOPTIONS 818 case PTRACE_OLDSETOPTIONS: 819 #endif 820 case PTRACE_SETOPTIONS: 821 ret = ptrace_setoptions(child, data); 822 break; 823 case PTRACE_GETEVENTMSG: 824 ret = put_user(child->ptrace_message, datalp); 825 break; 826 827 case PTRACE_PEEKSIGINFO: 828 ret = ptrace_peek_siginfo(child, addr, data); 829 break; 830 831 case PTRACE_GETSIGINFO: 832 ret = ptrace_getsiginfo(child, &siginfo); 833 if (!ret) 834 ret = copy_siginfo_to_user(datavp, &siginfo); 835 break; 836 837 case PTRACE_SETSIGINFO: 838 if (copy_from_user(&siginfo, datavp, sizeof siginfo)) 839 ret = -EFAULT; 840 else 841 ret = ptrace_setsiginfo(child, &siginfo); 842 break; 843 844 case PTRACE_INTERRUPT: 845 /* 846 * Stop tracee without any side-effect on signal or job 847 * control. At least one trap is guaranteed to happen 848 * after this request. If @child is already trapped, the 849 * current trap is not disturbed and another trap will 850 * happen after the current trap is ended with PTRACE_CONT. 851 * 852 * The actual trap might not be PTRACE_EVENT_STOP trap but 853 * the pending condition is cleared regardless. 854 */ 855 if (unlikely(!seized || !lock_task_sighand(child, &flags))) 856 break; 857 858 /* 859 * INTERRUPT doesn't disturb existing trap sans one 860 * exception. If ptracer issued LISTEN for the current 861 * STOP, this INTERRUPT should clear LISTEN and re-trap 862 * tracee into STOP. 863 */ 864 if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP))) 865 ptrace_signal_wake_up(child, child->jobctl & JOBCTL_LISTENING); 866 867 unlock_task_sighand(child, &flags); 868 ret = 0; 869 break; 870 871 case PTRACE_LISTEN: 872 /* 873 * Listen for events. Tracee must be in STOP. It's not 874 * resumed per-se but is not considered to be in TRACED by 875 * wait(2) or ptrace(2). If an async event (e.g. group 876 * stop state change) happens, tracee will enter STOP trap 877 * again. Alternatively, ptracer can issue INTERRUPT to 878 * finish listening and re-trap tracee into STOP. 879 */ 880 if (unlikely(!seized || !lock_task_sighand(child, &flags))) 881 break; 882 883 si = child->last_siginfo; 884 if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) { 885 child->jobctl |= JOBCTL_LISTENING; 886 /* 887 * If NOTIFY is set, it means event happened between 888 * start of this trap and now. Trigger re-trap. 889 */ 890 if (child->jobctl & JOBCTL_TRAP_NOTIFY) 891 ptrace_signal_wake_up(child, true); 892 ret = 0; 893 } 894 unlock_task_sighand(child, &flags); 895 break; 896 897 case PTRACE_DETACH: /* detach a process that was attached. */ 898 ret = ptrace_detach(child, data); 899 break; 900 901 #ifdef CONFIG_BINFMT_ELF_FDPIC 902 case PTRACE_GETFDPIC: { 903 struct mm_struct *mm = get_task_mm(child); 904 unsigned long tmp = 0; 905 906 ret = -ESRCH; 907 if (!mm) 908 break; 909 910 switch (addr) { 911 case PTRACE_GETFDPIC_EXEC: 912 tmp = mm->context.exec_fdpic_loadmap; 913 break; 914 case PTRACE_GETFDPIC_INTERP: 915 tmp = mm->context.interp_fdpic_loadmap; 916 break; 917 default: 918 break; 919 } 920 mmput(mm); 921 922 ret = put_user(tmp, datalp); 923 break; 924 } 925 #endif 926 927 #ifdef PTRACE_SINGLESTEP 928 case PTRACE_SINGLESTEP: 929 #endif 930 #ifdef PTRACE_SINGLEBLOCK 931 case PTRACE_SINGLEBLOCK: 932 #endif 933 #ifdef PTRACE_SYSEMU 934 case PTRACE_SYSEMU: 935 case PTRACE_SYSEMU_SINGLESTEP: 936 #endif 937 case PTRACE_SYSCALL: 938 case PTRACE_CONT: 939 return ptrace_resume(child, request, data); 940 941 case PTRACE_KILL: 942 if (child->exit_state) /* already dead */ 943 return 0; 944 return ptrace_resume(child, request, SIGKILL); 945 946 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK 947 case PTRACE_GETREGSET: 948 case PTRACE_SETREGSET: 949 { 950 struct iovec kiov; 951 struct iovec __user *uiov = datavp; 952 953 if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov))) 954 return -EFAULT; 955 956 if (__get_user(kiov.iov_base, &uiov->iov_base) || 957 __get_user(kiov.iov_len, &uiov->iov_len)) 958 return -EFAULT; 959 960 ret = ptrace_regset(child, request, addr, &kiov); 961 if (!ret) 962 ret = __put_user(kiov.iov_len, &uiov->iov_len); 963 break; 964 } 965 #endif 966 default: 967 break; 968 } 969 970 return ret; 971 } 972 973 static struct task_struct *ptrace_get_task_struct(pid_t pid) 974 { 975 struct task_struct *child; 976 977 rcu_read_lock(); 978 child = find_task_by_vpid(pid); 979 if (child) 980 get_task_struct(child); 981 rcu_read_unlock(); 982 983 if (!child) 984 return ERR_PTR(-ESRCH); 985 return child; 986 } 987 988 #ifndef arch_ptrace_attach 989 #define arch_ptrace_attach(child) do { } while (0) 990 #endif 991 992 SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr, 993 unsigned long, data) 994 { 995 struct task_struct *child; 996 long ret; 997 998 if (request == PTRACE_TRACEME) { 999 ret = ptrace_traceme(); 1000 if (!ret) 1001 arch_ptrace_attach(current); 1002 goto out; 1003 } 1004 1005 child = ptrace_get_task_struct(pid); 1006 if (IS_ERR(child)) { 1007 ret = PTR_ERR(child); 1008 goto out; 1009 } 1010 1011 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) { 1012 ret = ptrace_attach(child, request, addr, data); 1013 /* 1014 * Some architectures need to do book-keeping after 1015 * a ptrace attach. 1016 */ 1017 if (!ret) 1018 arch_ptrace_attach(child); 1019 goto out_put_task_struct; 1020 } 1021 1022 ret = ptrace_check_attach(child, request == PTRACE_KILL || 1023 request == PTRACE_INTERRUPT); 1024 if (ret < 0) 1025 goto out_put_task_struct; 1026 1027 ret = arch_ptrace(child, request, addr, data); 1028 if (ret || request != PTRACE_DETACH) 1029 ptrace_unfreeze_traced(child); 1030 1031 out_put_task_struct: 1032 put_task_struct(child); 1033 out: 1034 return ret; 1035 } 1036 1037 int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr, 1038 unsigned long data) 1039 { 1040 unsigned long tmp; 1041 int copied; 1042 1043 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0); 1044 if (copied != sizeof(tmp)) 1045 return -EIO; 1046 return put_user(tmp, (unsigned long __user *)data); 1047 } 1048 1049 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr, 1050 unsigned long data) 1051 { 1052 int copied; 1053 1054 copied = access_process_vm(tsk, addr, &data, sizeof(data), 1); 1055 return (copied == sizeof(data)) ? 0 : -EIO; 1056 } 1057 1058 #if defined CONFIG_COMPAT 1059 #include <linux/compat.h> 1060 1061 int compat_ptrace_request(struct task_struct *child, compat_long_t request, 1062 compat_ulong_t addr, compat_ulong_t data) 1063 { 1064 compat_ulong_t __user *datap = compat_ptr(data); 1065 compat_ulong_t word; 1066 siginfo_t siginfo; 1067 int ret; 1068 1069 switch (request) { 1070 case PTRACE_PEEKTEXT: 1071 case PTRACE_PEEKDATA: 1072 ret = access_process_vm(child, addr, &word, sizeof(word), 0); 1073 if (ret != sizeof(word)) 1074 ret = -EIO; 1075 else 1076 ret = put_user(word, datap); 1077 break; 1078 1079 case PTRACE_POKETEXT: 1080 case PTRACE_POKEDATA: 1081 ret = access_process_vm(child, addr, &data, sizeof(data), 1); 1082 ret = (ret != sizeof(data) ? -EIO : 0); 1083 break; 1084 1085 case PTRACE_GETEVENTMSG: 1086 ret = put_user((compat_ulong_t) child->ptrace_message, datap); 1087 break; 1088 1089 case PTRACE_GETSIGINFO: 1090 ret = ptrace_getsiginfo(child, &siginfo); 1091 if (!ret) 1092 ret = copy_siginfo_to_user32( 1093 (struct compat_siginfo __user *) datap, 1094 &siginfo); 1095 break; 1096 1097 case PTRACE_SETSIGINFO: 1098 memset(&siginfo, 0, sizeof siginfo); 1099 if (copy_siginfo_from_user32( 1100 &siginfo, (struct compat_siginfo __user *) datap)) 1101 ret = -EFAULT; 1102 else 1103 ret = ptrace_setsiginfo(child, &siginfo); 1104 break; 1105 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK 1106 case PTRACE_GETREGSET: 1107 case PTRACE_SETREGSET: 1108 { 1109 struct iovec kiov; 1110 struct compat_iovec __user *uiov = 1111 (struct compat_iovec __user *) datap; 1112 compat_uptr_t ptr; 1113 compat_size_t len; 1114 1115 if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov))) 1116 return -EFAULT; 1117 1118 if (__get_user(ptr, &uiov->iov_base) || 1119 __get_user(len, &uiov->iov_len)) 1120 return -EFAULT; 1121 1122 kiov.iov_base = compat_ptr(ptr); 1123 kiov.iov_len = len; 1124 1125 ret = ptrace_regset(child, request, addr, &kiov); 1126 if (!ret) 1127 ret = __put_user(kiov.iov_len, &uiov->iov_len); 1128 break; 1129 } 1130 #endif 1131 1132 default: 1133 ret = ptrace_request(child, request, addr, data); 1134 } 1135 1136 return ret; 1137 } 1138 1139 asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid, 1140 compat_long_t addr, compat_long_t data) 1141 { 1142 struct task_struct *child; 1143 long ret; 1144 1145 if (request == PTRACE_TRACEME) { 1146 ret = ptrace_traceme(); 1147 goto out; 1148 } 1149 1150 child = ptrace_get_task_struct(pid); 1151 if (IS_ERR(child)) { 1152 ret = PTR_ERR(child); 1153 goto out; 1154 } 1155 1156 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) { 1157 ret = ptrace_attach(child, request, addr, data); 1158 /* 1159 * Some architectures need to do book-keeping after 1160 * a ptrace attach. 1161 */ 1162 if (!ret) 1163 arch_ptrace_attach(child); 1164 goto out_put_task_struct; 1165 } 1166 1167 ret = ptrace_check_attach(child, request == PTRACE_KILL || 1168 request == PTRACE_INTERRUPT); 1169 if (!ret) { 1170 ret = compat_arch_ptrace(child, request, addr, data); 1171 if (ret || request != PTRACE_DETACH) 1172 ptrace_unfreeze_traced(child); 1173 } 1174 1175 out_put_task_struct: 1176 put_task_struct(child); 1177 out: 1178 return ret; 1179 } 1180 #endif /* CONFIG_COMPAT */ 1181 1182 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1183 int ptrace_get_breakpoints(struct task_struct *tsk) 1184 { 1185 if (atomic_inc_not_zero(&tsk->ptrace_bp_refcnt)) 1186 return 0; 1187 1188 return -1; 1189 } 1190 1191 void ptrace_put_breakpoints(struct task_struct *tsk) 1192 { 1193 if (atomic_dec_and_test(&tsk->ptrace_bp_refcnt)) 1194 flush_ptrace_hw_breakpoint(tsk); 1195 } 1196 #endif /* CONFIG_HAVE_HW_BREAKPOINT */ 1197