1 /* 2 * linux/kernel/ptrace.c 3 * 4 * (C) Copyright 1999 Linus Torvalds 5 * 6 * Common interfaces for "ptrace()" which we do not want 7 * to continually duplicate across every architecture. 8 */ 9 10 #include <linux/capability.h> 11 #include <linux/module.h> 12 #include <linux/sched.h> 13 #include <linux/errno.h> 14 #include <linux/mm.h> 15 #include <linux/highmem.h> 16 #include <linux/pagemap.h> 17 #include <linux/smp_lock.h> 18 #include <linux/ptrace.h> 19 #include <linux/security.h> 20 #include <linux/signal.h> 21 #include <linux/audit.h> 22 23 #include <asm/pgtable.h> 24 #include <asm/uaccess.h> 25 26 /* 27 * ptrace a task: make the debugger its new parent and 28 * move it to the ptrace list. 29 * 30 * Must be called with the tasklist lock write-held. 31 */ 32 void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) 33 { 34 BUG_ON(!list_empty(&child->ptrace_list)); 35 if (child->parent == new_parent) 36 return; 37 list_add(&child->ptrace_list, &child->parent->ptrace_children); 38 remove_parent(child); 39 child->parent = new_parent; 40 add_parent(child); 41 } 42 43 /* 44 * Turn a tracing stop into a normal stop now, since with no tracer there 45 * would be no way to wake it up with SIGCONT or SIGKILL. If there was a 46 * signal sent that would resume the child, but didn't because it was in 47 * TASK_TRACED, resume it now. 48 * Requires that irqs be disabled. 49 */ 50 void ptrace_untrace(struct task_struct *child) 51 { 52 spin_lock(&child->sighand->siglock); 53 if (child->state == TASK_TRACED) { 54 if (child->signal->flags & SIGNAL_STOP_STOPPED) { 55 child->state = TASK_STOPPED; 56 } else { 57 signal_wake_up(child, 1); 58 } 59 } 60 spin_unlock(&child->sighand->siglock); 61 } 62 63 /* 64 * unptrace a task: move it back to its original parent and 65 * remove it from the ptrace list. 66 * 67 * Must be called with the tasklist lock write-held. 68 */ 69 void __ptrace_unlink(struct task_struct *child) 70 { 71 BUG_ON(!child->ptrace); 72 73 child->ptrace = 0; 74 if (!list_empty(&child->ptrace_list)) { 75 list_del_init(&child->ptrace_list); 76 remove_parent(child); 77 child->parent = child->real_parent; 78 add_parent(child); 79 } 80 81 if (child->state == TASK_TRACED) 82 ptrace_untrace(child); 83 } 84 85 /* 86 * Check that we have indeed attached to the thing.. 87 */ 88 int ptrace_check_attach(struct task_struct *child, int kill) 89 { 90 int ret = -ESRCH; 91 92 /* 93 * We take the read lock around doing both checks to close a 94 * possible race where someone else was tracing our child and 95 * detached between these two checks. After this locked check, 96 * we are sure that this is our traced child and that can only 97 * be changed by us so it's not changing right after this. 98 */ 99 read_lock(&tasklist_lock); 100 if ((child->ptrace & PT_PTRACED) && child->parent == current && 101 (!(child->ptrace & PT_ATTACHED) || child->real_parent != current) 102 && child->signal != NULL) { 103 ret = 0; 104 spin_lock_irq(&child->sighand->siglock); 105 if (child->state == TASK_STOPPED) { 106 child->state = TASK_TRACED; 107 } else if (child->state != TASK_TRACED && !kill) { 108 ret = -ESRCH; 109 } 110 spin_unlock_irq(&child->sighand->siglock); 111 } 112 read_unlock(&tasklist_lock); 113 114 if (!ret && !kill) { 115 wait_task_inactive(child); 116 } 117 118 /* All systems go.. */ 119 return ret; 120 } 121 122 static int may_attach(struct task_struct *task) 123 { 124 /* May we inspect the given task? 125 * This check is used both for attaching with ptrace 126 * and for allowing access to sensitive information in /proc. 127 * 128 * ptrace_attach denies several cases that /proc allows 129 * because setting up the necessary parent/child relationship 130 * or halting the specified task is impossible. 131 */ 132 int dumpable = 0; 133 /* Don't let security modules deny introspection */ 134 if (task == current) 135 return 0; 136 if (((current->uid != task->euid) || 137 (current->uid != task->suid) || 138 (current->uid != task->uid) || 139 (current->gid != task->egid) || 140 (current->gid != task->sgid) || 141 (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE)) 142 return -EPERM; 143 smp_rmb(); 144 if (task->mm) 145 dumpable = task->mm->dumpable; 146 if (!dumpable && !capable(CAP_SYS_PTRACE)) 147 return -EPERM; 148 149 return security_ptrace(current, task); 150 } 151 152 int ptrace_may_attach(struct task_struct *task) 153 { 154 int err; 155 task_lock(task); 156 err = may_attach(task); 157 task_unlock(task); 158 return !err; 159 } 160 161 int ptrace_attach(struct task_struct *task) 162 { 163 int retval; 164 165 audit_ptrace(task); 166 167 retval = -EPERM; 168 if (task->pid <= 1) 169 goto out; 170 if (task->tgid == current->tgid) 171 goto out; 172 173 repeat: 174 /* 175 * Nasty, nasty. 176 * 177 * We want to hold both the task-lock and the 178 * tasklist_lock for writing at the same time. 179 * But that's against the rules (tasklist_lock 180 * is taken for reading by interrupts on other 181 * cpu's that may have task_lock). 182 */ 183 task_lock(task); 184 local_irq_disable(); 185 if (!write_trylock(&tasklist_lock)) { 186 local_irq_enable(); 187 task_unlock(task); 188 do { 189 cpu_relax(); 190 } while (!write_can_lock(&tasklist_lock)); 191 goto repeat; 192 } 193 194 if (!task->mm) 195 goto bad; 196 /* the same process cannot be attached many times */ 197 if (task->ptrace & PT_PTRACED) 198 goto bad; 199 retval = may_attach(task); 200 if (retval) 201 goto bad; 202 203 /* Go */ 204 task->ptrace |= PT_PTRACED | ((task->real_parent != current) 205 ? PT_ATTACHED : 0); 206 if (capable(CAP_SYS_PTRACE)) 207 task->ptrace |= PT_PTRACE_CAP; 208 209 __ptrace_link(task, current); 210 211 force_sig_specific(SIGSTOP, task); 212 213 bad: 214 write_unlock_irq(&tasklist_lock); 215 task_unlock(task); 216 out: 217 return retval; 218 } 219 220 static inline void __ptrace_detach(struct task_struct *child, unsigned int data) 221 { 222 child->exit_code = data; 223 /* .. re-parent .. */ 224 __ptrace_unlink(child); 225 /* .. and wake it up. */ 226 if (child->exit_state != EXIT_ZOMBIE) 227 wake_up_process(child); 228 } 229 230 int ptrace_detach(struct task_struct *child, unsigned int data) 231 { 232 if (!valid_signal(data)) 233 return -EIO; 234 235 /* Architecture-specific hardware disable .. */ 236 ptrace_disable(child); 237 238 write_lock_irq(&tasklist_lock); 239 /* protect against de_thread()->release_task() */ 240 if (child->ptrace) 241 __ptrace_detach(child, data); 242 write_unlock_irq(&tasklist_lock); 243 244 return 0; 245 } 246 247 int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len) 248 { 249 int copied = 0; 250 251 while (len > 0) { 252 char buf[128]; 253 int this_len, retval; 254 255 this_len = (len > sizeof(buf)) ? sizeof(buf) : len; 256 retval = access_process_vm(tsk, src, buf, this_len, 0); 257 if (!retval) { 258 if (copied) 259 break; 260 return -EIO; 261 } 262 if (copy_to_user(dst, buf, retval)) 263 return -EFAULT; 264 copied += retval; 265 src += retval; 266 dst += retval; 267 len -= retval; 268 } 269 return copied; 270 } 271 272 int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len) 273 { 274 int copied = 0; 275 276 while (len > 0) { 277 char buf[128]; 278 int this_len, retval; 279 280 this_len = (len > sizeof(buf)) ? sizeof(buf) : len; 281 if (copy_from_user(buf, src, this_len)) 282 return -EFAULT; 283 retval = access_process_vm(tsk, dst, buf, this_len, 1); 284 if (!retval) { 285 if (copied) 286 break; 287 return -EIO; 288 } 289 copied += retval; 290 src += retval; 291 dst += retval; 292 len -= retval; 293 } 294 return copied; 295 } 296 297 static int ptrace_setoptions(struct task_struct *child, long data) 298 { 299 child->ptrace &= ~PT_TRACE_MASK; 300 301 if (data & PTRACE_O_TRACESYSGOOD) 302 child->ptrace |= PT_TRACESYSGOOD; 303 304 if (data & PTRACE_O_TRACEFORK) 305 child->ptrace |= PT_TRACE_FORK; 306 307 if (data & PTRACE_O_TRACEVFORK) 308 child->ptrace |= PT_TRACE_VFORK; 309 310 if (data & PTRACE_O_TRACECLONE) 311 child->ptrace |= PT_TRACE_CLONE; 312 313 if (data & PTRACE_O_TRACEEXEC) 314 child->ptrace |= PT_TRACE_EXEC; 315 316 if (data & PTRACE_O_TRACEVFORKDONE) 317 child->ptrace |= PT_TRACE_VFORK_DONE; 318 319 if (data & PTRACE_O_TRACEEXIT) 320 child->ptrace |= PT_TRACE_EXIT; 321 322 return (data & ~PTRACE_O_MASK) ? -EINVAL : 0; 323 } 324 325 static int ptrace_getsiginfo(struct task_struct *child, siginfo_t __user * data) 326 { 327 siginfo_t lastinfo; 328 int error = -ESRCH; 329 330 read_lock(&tasklist_lock); 331 if (likely(child->sighand != NULL)) { 332 error = -EINVAL; 333 spin_lock_irq(&child->sighand->siglock); 334 if (likely(child->last_siginfo != NULL)) { 335 lastinfo = *child->last_siginfo; 336 error = 0; 337 } 338 spin_unlock_irq(&child->sighand->siglock); 339 } 340 read_unlock(&tasklist_lock); 341 if (!error) 342 return copy_siginfo_to_user(data, &lastinfo); 343 return error; 344 } 345 346 static int ptrace_setsiginfo(struct task_struct *child, siginfo_t __user * data) 347 { 348 siginfo_t newinfo; 349 int error = -ESRCH; 350 351 if (copy_from_user(&newinfo, data, sizeof (siginfo_t))) 352 return -EFAULT; 353 354 read_lock(&tasklist_lock); 355 if (likely(child->sighand != NULL)) { 356 error = -EINVAL; 357 spin_lock_irq(&child->sighand->siglock); 358 if (likely(child->last_siginfo != NULL)) { 359 *child->last_siginfo = newinfo; 360 error = 0; 361 } 362 spin_unlock_irq(&child->sighand->siglock); 363 } 364 read_unlock(&tasklist_lock); 365 return error; 366 } 367 368 int ptrace_request(struct task_struct *child, long request, 369 long addr, long data) 370 { 371 int ret = -EIO; 372 373 switch (request) { 374 #ifdef PTRACE_OLDSETOPTIONS 375 case PTRACE_OLDSETOPTIONS: 376 #endif 377 case PTRACE_SETOPTIONS: 378 ret = ptrace_setoptions(child, data); 379 break; 380 case PTRACE_GETEVENTMSG: 381 ret = put_user(child->ptrace_message, (unsigned long __user *) data); 382 break; 383 case PTRACE_GETSIGINFO: 384 ret = ptrace_getsiginfo(child, (siginfo_t __user *) data); 385 break; 386 case PTRACE_SETSIGINFO: 387 ret = ptrace_setsiginfo(child, (siginfo_t __user *) data); 388 break; 389 default: 390 break; 391 } 392 393 return ret; 394 } 395 396 /** 397 * ptrace_traceme -- helper for PTRACE_TRACEME 398 * 399 * Performs checks and sets PT_PTRACED. 400 * Should be used by all ptrace implementations for PTRACE_TRACEME. 401 */ 402 int ptrace_traceme(void) 403 { 404 int ret = -EPERM; 405 406 /* 407 * Are we already being traced? 408 */ 409 task_lock(current); 410 if (!(current->ptrace & PT_PTRACED)) { 411 ret = security_ptrace(current->parent, current); 412 /* 413 * Set the ptrace bit in the process ptrace flags. 414 */ 415 if (!ret) 416 current->ptrace |= PT_PTRACED; 417 } 418 task_unlock(current); 419 return ret; 420 } 421 422 /** 423 * ptrace_get_task_struct -- grab a task struct reference for ptrace 424 * @pid: process id to grab a task_struct reference of 425 * 426 * This function is a helper for ptrace implementations. It checks 427 * permissions and then grabs a task struct for use of the actual 428 * ptrace implementation. 429 * 430 * Returns the task_struct for @pid or an ERR_PTR() on failure. 431 */ 432 struct task_struct *ptrace_get_task_struct(pid_t pid) 433 { 434 struct task_struct *child; 435 436 /* 437 * Tracing init is not allowed. 438 */ 439 if (pid == 1) 440 return ERR_PTR(-EPERM); 441 442 read_lock(&tasklist_lock); 443 child = find_task_by_pid(pid); 444 if (child) 445 get_task_struct(child); 446 447 read_unlock(&tasklist_lock); 448 if (!child) 449 return ERR_PTR(-ESRCH); 450 return child; 451 } 452 453 #ifndef __ARCH_SYS_PTRACE 454 asmlinkage long sys_ptrace(long request, long pid, long addr, long data) 455 { 456 struct task_struct *child; 457 long ret; 458 459 /* 460 * This lock_kernel fixes a subtle race with suid exec 461 */ 462 lock_kernel(); 463 if (request == PTRACE_TRACEME) { 464 ret = ptrace_traceme(); 465 goto out; 466 } 467 468 child = ptrace_get_task_struct(pid); 469 if (IS_ERR(child)) { 470 ret = PTR_ERR(child); 471 goto out; 472 } 473 474 if (request == PTRACE_ATTACH) { 475 ret = ptrace_attach(child); 476 goto out_put_task_struct; 477 } 478 479 ret = ptrace_check_attach(child, request == PTRACE_KILL); 480 if (ret < 0) 481 goto out_put_task_struct; 482 483 ret = arch_ptrace(child, request, addr, data); 484 if (ret < 0) 485 goto out_put_task_struct; 486 487 out_put_task_struct: 488 put_task_struct(child); 489 out: 490 unlock_kernel(); 491 return ret; 492 } 493 #endif /* __ARCH_SYS_PTRACE */ 494