1 /* 2 * linux/kernel/ptrace.c 3 * 4 * (C) Copyright 1999 Linus Torvalds 5 * 6 * Common interfaces for "ptrace()" which we do not want 7 * to continually duplicate across every architecture. 8 */ 9 10 #include <linux/capability.h> 11 #include <linux/export.h> 12 #include <linux/sched.h> 13 #include <linux/sched/mm.h> 14 #include <linux/sched/coredump.h> 15 #include <linux/sched/task.h> 16 #include <linux/errno.h> 17 #include <linux/mm.h> 18 #include <linux/highmem.h> 19 #include <linux/pagemap.h> 20 #include <linux/ptrace.h> 21 #include <linux/security.h> 22 #include <linux/signal.h> 23 #include <linux/uio.h> 24 #include <linux/audit.h> 25 #include <linux/pid_namespace.h> 26 #include <linux/syscalls.h> 27 #include <linux/uaccess.h> 28 #include <linux/regset.h> 29 #include <linux/hw_breakpoint.h> 30 #include <linux/cn_proc.h> 31 #include <linux/compat.h> 32 33 /* 34 * Access another process' address space via ptrace. 35 * Source/target buffer must be kernel space, 36 * Do not walk the page table directly, use get_user_pages 37 */ 38 int ptrace_access_vm(struct task_struct *tsk, unsigned long addr, 39 void *buf, int len, unsigned int gup_flags) 40 { 41 struct mm_struct *mm; 42 int ret; 43 44 mm = get_task_mm(tsk); 45 if (!mm) 46 return 0; 47 48 if (!tsk->ptrace || 49 (current != tsk->parent) || 50 ((get_dumpable(mm) != SUID_DUMP_USER) && 51 !ptracer_capable(tsk, mm->user_ns))) { 52 mmput(mm); 53 return 0; 54 } 55 56 ret = __access_remote_vm(tsk, mm, addr, buf, len, gup_flags); 57 mmput(mm); 58 59 return ret; 60 } 61 62 63 void __ptrace_link(struct task_struct *child, struct task_struct *new_parent, 64 const struct cred *ptracer_cred) 65 { 66 BUG_ON(!list_empty(&child->ptrace_entry)); 67 list_add(&child->ptrace_entry, &new_parent->ptraced); 68 child->parent = new_parent; 69 child->ptracer_cred = get_cred(ptracer_cred); 70 } 71 72 /* 73 * ptrace a task: make the debugger its new parent and 74 * move it to the ptrace list. 75 * 76 * Must be called with the tasklist lock write-held. 77 */ 78 static void ptrace_link(struct task_struct *child, struct task_struct *new_parent) 79 { 80 rcu_read_lock(); 81 __ptrace_link(child, new_parent, __task_cred(new_parent)); 82 rcu_read_unlock(); 83 } 84 85 /** 86 * __ptrace_unlink - unlink ptracee and restore its execution state 87 * @child: ptracee to be unlinked 88 * 89 * Remove @child from the ptrace list, move it back to the original parent, 90 * and restore the execution state so that it conforms to the group stop 91 * state. 92 * 93 * Unlinking can happen via two paths - explicit PTRACE_DETACH or ptracer 94 * exiting. For PTRACE_DETACH, unless the ptracee has been killed between 95 * ptrace_check_attach() and here, it's guaranteed to be in TASK_TRACED. 96 * If the ptracer is exiting, the ptracee can be in any state. 97 * 98 * After detach, the ptracee should be in a state which conforms to the 99 * group stop. If the group is stopped or in the process of stopping, the 100 * ptracee should be put into TASK_STOPPED; otherwise, it should be woken 101 * up from TASK_TRACED. 102 * 103 * If the ptracee is in TASK_TRACED and needs to be moved to TASK_STOPPED, 104 * it goes through TRACED -> RUNNING -> STOPPED transition which is similar 105 * to but in the opposite direction of what happens while attaching to a 106 * stopped task. However, in this direction, the intermediate RUNNING 107 * state is not hidden even from the current ptracer and if it immediately 108 * re-attaches and performs a WNOHANG wait(2), it may fail. 109 * 110 * CONTEXT: 111 * write_lock_irq(tasklist_lock) 112 */ 113 void __ptrace_unlink(struct task_struct *child) 114 { 115 const struct cred *old_cred; 116 BUG_ON(!child->ptrace); 117 118 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 119 120 child->parent = child->real_parent; 121 list_del_init(&child->ptrace_entry); 122 old_cred = child->ptracer_cred; 123 child->ptracer_cred = NULL; 124 put_cred(old_cred); 125 126 spin_lock(&child->sighand->siglock); 127 child->ptrace = 0; 128 /* 129 * Clear all pending traps and TRAPPING. TRAPPING should be 130 * cleared regardless of JOBCTL_STOP_PENDING. Do it explicitly. 131 */ 132 task_clear_jobctl_pending(child, JOBCTL_TRAP_MASK); 133 task_clear_jobctl_trapping(child); 134 135 /* 136 * Reinstate JOBCTL_STOP_PENDING if group stop is in effect and 137 * @child isn't dead. 138 */ 139 if (!(child->flags & PF_EXITING) && 140 (child->signal->flags & SIGNAL_STOP_STOPPED || 141 child->signal->group_stop_count)) { 142 child->jobctl |= JOBCTL_STOP_PENDING; 143 144 /* 145 * This is only possible if this thread was cloned by the 146 * traced task running in the stopped group, set the signal 147 * for the future reports. 148 * FIXME: we should change ptrace_init_task() to handle this 149 * case. 150 */ 151 if (!(child->jobctl & JOBCTL_STOP_SIGMASK)) 152 child->jobctl |= SIGSTOP; 153 } 154 155 /* 156 * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick 157 * @child in the butt. Note that @resume should be used iff @child 158 * is in TASK_TRACED; otherwise, we might unduly disrupt 159 * TASK_KILLABLE sleeps. 160 */ 161 if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child)) 162 ptrace_signal_wake_up(child, true); 163 164 spin_unlock(&child->sighand->siglock); 165 } 166 167 /* Ensure that nothing can wake it up, even SIGKILL */ 168 static bool ptrace_freeze_traced(struct task_struct *task) 169 { 170 bool ret = false; 171 172 /* Lockless, nobody but us can set this flag */ 173 if (task->jobctl & JOBCTL_LISTENING) 174 return ret; 175 176 spin_lock_irq(&task->sighand->siglock); 177 if (task_is_traced(task) && !__fatal_signal_pending(task)) { 178 task->state = __TASK_TRACED; 179 ret = true; 180 } 181 spin_unlock_irq(&task->sighand->siglock); 182 183 return ret; 184 } 185 186 static void ptrace_unfreeze_traced(struct task_struct *task) 187 { 188 if (task->state != __TASK_TRACED) 189 return; 190 191 WARN_ON(!task->ptrace || task->parent != current); 192 193 /* 194 * PTRACE_LISTEN can allow ptrace_trap_notify to wake us up remotely. 195 * Recheck state under the lock to close this race. 196 */ 197 spin_lock_irq(&task->sighand->siglock); 198 if (task->state == __TASK_TRACED) { 199 if (__fatal_signal_pending(task)) 200 wake_up_state(task, __TASK_TRACED); 201 else 202 task->state = TASK_TRACED; 203 } 204 spin_unlock_irq(&task->sighand->siglock); 205 } 206 207 /** 208 * ptrace_check_attach - check whether ptracee is ready for ptrace operation 209 * @child: ptracee to check for 210 * @ignore_state: don't check whether @child is currently %TASK_TRACED 211 * 212 * Check whether @child is being ptraced by %current and ready for further 213 * ptrace operations. If @ignore_state is %false, @child also should be in 214 * %TASK_TRACED state and on return the child is guaranteed to be traced 215 * and not executing. If @ignore_state is %true, @child can be in any 216 * state. 217 * 218 * CONTEXT: 219 * Grabs and releases tasklist_lock and @child->sighand->siglock. 220 * 221 * RETURNS: 222 * 0 on success, -ESRCH if %child is not ready. 223 */ 224 static int ptrace_check_attach(struct task_struct *child, bool ignore_state) 225 { 226 int ret = -ESRCH; 227 228 /* 229 * We take the read lock around doing both checks to close a 230 * possible race where someone else was tracing our child and 231 * detached between these two checks. After this locked check, 232 * we are sure that this is our traced child and that can only 233 * be changed by us so it's not changing right after this. 234 */ 235 read_lock(&tasklist_lock); 236 if (child->ptrace && child->parent == current) { 237 WARN_ON(child->state == __TASK_TRACED); 238 /* 239 * child->sighand can't be NULL, release_task() 240 * does ptrace_unlink() before __exit_signal(). 241 */ 242 if (ignore_state || ptrace_freeze_traced(child)) 243 ret = 0; 244 } 245 read_unlock(&tasklist_lock); 246 247 if (!ret && !ignore_state) { 248 if (!wait_task_inactive(child, __TASK_TRACED)) { 249 /* 250 * This can only happen if may_ptrace_stop() fails and 251 * ptrace_stop() changes ->state back to TASK_RUNNING, 252 * so we should not worry about leaking __TASK_TRACED. 253 */ 254 WARN_ON(child->state == __TASK_TRACED); 255 ret = -ESRCH; 256 } 257 } 258 259 return ret; 260 } 261 262 static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode) 263 { 264 if (mode & PTRACE_MODE_NOAUDIT) 265 return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE); 266 else 267 return has_ns_capability(current, ns, CAP_SYS_PTRACE); 268 } 269 270 /* Returns 0 on success, -errno on denial. */ 271 static int __ptrace_may_access(struct task_struct *task, unsigned int mode) 272 { 273 const struct cred *cred = current_cred(), *tcred; 274 struct mm_struct *mm; 275 kuid_t caller_uid; 276 kgid_t caller_gid; 277 278 if (!(mode & PTRACE_MODE_FSCREDS) == !(mode & PTRACE_MODE_REALCREDS)) { 279 WARN(1, "denying ptrace access check without PTRACE_MODE_*CREDS\n"); 280 return -EPERM; 281 } 282 283 /* May we inspect the given task? 284 * This check is used both for attaching with ptrace 285 * and for allowing access to sensitive information in /proc. 286 * 287 * ptrace_attach denies several cases that /proc allows 288 * because setting up the necessary parent/child relationship 289 * or halting the specified task is impossible. 290 */ 291 292 /* Don't let security modules deny introspection */ 293 if (same_thread_group(task, current)) 294 return 0; 295 rcu_read_lock(); 296 if (mode & PTRACE_MODE_FSCREDS) { 297 caller_uid = cred->fsuid; 298 caller_gid = cred->fsgid; 299 } else { 300 /* 301 * Using the euid would make more sense here, but something 302 * in userland might rely on the old behavior, and this 303 * shouldn't be a security problem since 304 * PTRACE_MODE_REALCREDS implies that the caller explicitly 305 * used a syscall that requests access to another process 306 * (and not a filesystem syscall to procfs). 307 */ 308 caller_uid = cred->uid; 309 caller_gid = cred->gid; 310 } 311 tcred = __task_cred(task); 312 if (uid_eq(caller_uid, tcred->euid) && 313 uid_eq(caller_uid, tcred->suid) && 314 uid_eq(caller_uid, tcred->uid) && 315 gid_eq(caller_gid, tcred->egid) && 316 gid_eq(caller_gid, tcred->sgid) && 317 gid_eq(caller_gid, tcred->gid)) 318 goto ok; 319 if (ptrace_has_cap(tcred->user_ns, mode)) 320 goto ok; 321 rcu_read_unlock(); 322 return -EPERM; 323 ok: 324 rcu_read_unlock(); 325 mm = task->mm; 326 if (mm && 327 ((get_dumpable(mm) != SUID_DUMP_USER) && 328 !ptrace_has_cap(mm->user_ns, mode))) 329 return -EPERM; 330 331 return security_ptrace_access_check(task, mode); 332 } 333 334 bool ptrace_may_access(struct task_struct *task, unsigned int mode) 335 { 336 int err; 337 task_lock(task); 338 err = __ptrace_may_access(task, mode); 339 task_unlock(task); 340 return !err; 341 } 342 343 static int ptrace_attach(struct task_struct *task, long request, 344 unsigned long addr, 345 unsigned long flags) 346 { 347 bool seize = (request == PTRACE_SEIZE); 348 int retval; 349 350 retval = -EIO; 351 if (seize) { 352 if (addr != 0) 353 goto out; 354 if (flags & ~(unsigned long)PTRACE_O_MASK) 355 goto out; 356 flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); 357 } else { 358 flags = PT_PTRACED; 359 } 360 361 audit_ptrace(task); 362 363 retval = -EPERM; 364 if (unlikely(task->flags & PF_KTHREAD)) 365 goto out; 366 if (same_thread_group(task, current)) 367 goto out; 368 369 /* 370 * Protect exec's credential calculations against our interference; 371 * SUID, SGID and LSM creds get determined differently 372 * under ptrace. 373 */ 374 retval = -ERESTARTNOINTR; 375 if (mutex_lock_interruptible(&task->signal->cred_guard_mutex)) 376 goto out; 377 378 task_lock(task); 379 retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS); 380 task_unlock(task); 381 if (retval) 382 goto unlock_creds; 383 384 write_lock_irq(&tasklist_lock); 385 retval = -EPERM; 386 if (unlikely(task->exit_state)) 387 goto unlock_tasklist; 388 if (task->ptrace) 389 goto unlock_tasklist; 390 391 if (seize) 392 flags |= PT_SEIZED; 393 task->ptrace = flags; 394 395 ptrace_link(task, current); 396 397 /* SEIZE doesn't trap tracee on attach */ 398 if (!seize) 399 send_sig_info(SIGSTOP, SEND_SIG_FORCED, task); 400 401 spin_lock(&task->sighand->siglock); 402 403 /* 404 * If the task is already STOPPED, set JOBCTL_TRAP_STOP and 405 * TRAPPING, and kick it so that it transits to TRACED. TRAPPING 406 * will be cleared if the child completes the transition or any 407 * event which clears the group stop states happens. We'll wait 408 * for the transition to complete before returning from this 409 * function. 410 * 411 * This hides STOPPED -> RUNNING -> TRACED transition from the 412 * attaching thread but a different thread in the same group can 413 * still observe the transient RUNNING state. IOW, if another 414 * thread's WNOHANG wait(2) on the stopped tracee races against 415 * ATTACH, the wait(2) may fail due to the transient RUNNING. 416 * 417 * The following task_is_stopped() test is safe as both transitions 418 * in and out of STOPPED are protected by siglock. 419 */ 420 if (task_is_stopped(task) && 421 task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING)) 422 signal_wake_up_state(task, __TASK_STOPPED); 423 424 spin_unlock(&task->sighand->siglock); 425 426 retval = 0; 427 unlock_tasklist: 428 write_unlock_irq(&tasklist_lock); 429 unlock_creds: 430 mutex_unlock(&task->signal->cred_guard_mutex); 431 out: 432 if (!retval) { 433 /* 434 * We do not bother to change retval or clear JOBCTL_TRAPPING 435 * if wait_on_bit() was interrupted by SIGKILL. The tracer will 436 * not return to user-mode, it will exit and clear this bit in 437 * __ptrace_unlink() if it wasn't already cleared by the tracee; 438 * and until then nobody can ptrace this task. 439 */ 440 wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT, TASK_KILLABLE); 441 proc_ptrace_connector(task, PTRACE_ATTACH); 442 } 443 444 return retval; 445 } 446 447 /** 448 * ptrace_traceme -- helper for PTRACE_TRACEME 449 * 450 * Performs checks and sets PT_PTRACED. 451 * Should be used by all ptrace implementations for PTRACE_TRACEME. 452 */ 453 static int ptrace_traceme(void) 454 { 455 int ret = -EPERM; 456 457 write_lock_irq(&tasklist_lock); 458 /* Are we already being traced? */ 459 if (!current->ptrace) { 460 ret = security_ptrace_traceme(current->parent); 461 /* 462 * Check PF_EXITING to ensure ->real_parent has not passed 463 * exit_ptrace(). Otherwise we don't report the error but 464 * pretend ->real_parent untraces us right after return. 465 */ 466 if (!ret && !(current->real_parent->flags & PF_EXITING)) { 467 current->ptrace = PT_PTRACED; 468 ptrace_link(current, current->real_parent); 469 } 470 } 471 write_unlock_irq(&tasklist_lock); 472 473 return ret; 474 } 475 476 /* 477 * Called with irqs disabled, returns true if childs should reap themselves. 478 */ 479 static int ignoring_children(struct sighand_struct *sigh) 480 { 481 int ret; 482 spin_lock(&sigh->siglock); 483 ret = (sigh->action[SIGCHLD-1].sa.sa_handler == SIG_IGN) || 484 (sigh->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT); 485 spin_unlock(&sigh->siglock); 486 return ret; 487 } 488 489 /* 490 * Called with tasklist_lock held for writing. 491 * Unlink a traced task, and clean it up if it was a traced zombie. 492 * Return true if it needs to be reaped with release_task(). 493 * (We can't call release_task() here because we already hold tasklist_lock.) 494 * 495 * If it's a zombie, our attachedness prevented normal parent notification 496 * or self-reaping. Do notification now if it would have happened earlier. 497 * If it should reap itself, return true. 498 * 499 * If it's our own child, there is no notification to do. But if our normal 500 * children self-reap, then this child was prevented by ptrace and we must 501 * reap it now, in that case we must also wake up sub-threads sleeping in 502 * do_wait(). 503 */ 504 static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p) 505 { 506 bool dead; 507 508 __ptrace_unlink(p); 509 510 if (p->exit_state != EXIT_ZOMBIE) 511 return false; 512 513 dead = !thread_group_leader(p); 514 515 if (!dead && thread_group_empty(p)) { 516 if (!same_thread_group(p->real_parent, tracer)) 517 dead = do_notify_parent(p, p->exit_signal); 518 else if (ignoring_children(tracer->sighand)) { 519 __wake_up_parent(p, tracer); 520 dead = true; 521 } 522 } 523 /* Mark it as in the process of being reaped. */ 524 if (dead) 525 p->exit_state = EXIT_DEAD; 526 return dead; 527 } 528 529 static int ptrace_detach(struct task_struct *child, unsigned int data) 530 { 531 if (!valid_signal(data)) 532 return -EIO; 533 534 /* Architecture-specific hardware disable .. */ 535 ptrace_disable(child); 536 537 write_lock_irq(&tasklist_lock); 538 /* 539 * We rely on ptrace_freeze_traced(). It can't be killed and 540 * untraced by another thread, it can't be a zombie. 541 */ 542 WARN_ON(!child->ptrace || child->exit_state); 543 /* 544 * tasklist_lock avoids the race with wait_task_stopped(), see 545 * the comment in ptrace_resume(). 546 */ 547 child->exit_code = data; 548 __ptrace_detach(current, child); 549 write_unlock_irq(&tasklist_lock); 550 551 proc_ptrace_connector(child, PTRACE_DETACH); 552 553 return 0; 554 } 555 556 /* 557 * Detach all tasks we were using ptrace on. Called with tasklist held 558 * for writing. 559 */ 560 void exit_ptrace(struct task_struct *tracer, struct list_head *dead) 561 { 562 struct task_struct *p, *n; 563 564 list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) { 565 if (unlikely(p->ptrace & PT_EXITKILL)) 566 send_sig_info(SIGKILL, SEND_SIG_FORCED, p); 567 568 if (__ptrace_detach(tracer, p)) 569 list_add(&p->ptrace_entry, dead); 570 } 571 } 572 573 int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len) 574 { 575 int copied = 0; 576 577 while (len > 0) { 578 char buf[128]; 579 int this_len, retval; 580 581 this_len = (len > sizeof(buf)) ? sizeof(buf) : len; 582 retval = ptrace_access_vm(tsk, src, buf, this_len, FOLL_FORCE); 583 584 if (!retval) { 585 if (copied) 586 break; 587 return -EIO; 588 } 589 if (copy_to_user(dst, buf, retval)) 590 return -EFAULT; 591 copied += retval; 592 src += retval; 593 dst += retval; 594 len -= retval; 595 } 596 return copied; 597 } 598 599 int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len) 600 { 601 int copied = 0; 602 603 while (len > 0) { 604 char buf[128]; 605 int this_len, retval; 606 607 this_len = (len > sizeof(buf)) ? sizeof(buf) : len; 608 if (copy_from_user(buf, src, this_len)) 609 return -EFAULT; 610 retval = ptrace_access_vm(tsk, dst, buf, this_len, 611 FOLL_FORCE | FOLL_WRITE); 612 if (!retval) { 613 if (copied) 614 break; 615 return -EIO; 616 } 617 copied += retval; 618 src += retval; 619 dst += retval; 620 len -= retval; 621 } 622 return copied; 623 } 624 625 static int ptrace_setoptions(struct task_struct *child, unsigned long data) 626 { 627 unsigned flags; 628 629 if (data & ~(unsigned long)PTRACE_O_MASK) 630 return -EINVAL; 631 632 if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { 633 if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || 634 !IS_ENABLED(CONFIG_SECCOMP)) 635 return -EINVAL; 636 637 if (!capable(CAP_SYS_ADMIN)) 638 return -EPERM; 639 640 if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || 641 current->ptrace & PT_SUSPEND_SECCOMP) 642 return -EPERM; 643 } 644 645 /* Avoid intermediate state when all opts are cleared */ 646 flags = child->ptrace; 647 flags &= ~(PTRACE_O_MASK << PT_OPT_FLAG_SHIFT); 648 flags |= (data << PT_OPT_FLAG_SHIFT); 649 child->ptrace = flags; 650 651 return 0; 652 } 653 654 static int ptrace_getsiginfo(struct task_struct *child, siginfo_t *info) 655 { 656 unsigned long flags; 657 int error = -ESRCH; 658 659 if (lock_task_sighand(child, &flags)) { 660 error = -EINVAL; 661 if (likely(child->last_siginfo != NULL)) { 662 *info = *child->last_siginfo; 663 error = 0; 664 } 665 unlock_task_sighand(child, &flags); 666 } 667 return error; 668 } 669 670 static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info) 671 { 672 unsigned long flags; 673 int error = -ESRCH; 674 675 if (lock_task_sighand(child, &flags)) { 676 error = -EINVAL; 677 if (likely(child->last_siginfo != NULL)) { 678 *child->last_siginfo = *info; 679 error = 0; 680 } 681 unlock_task_sighand(child, &flags); 682 } 683 return error; 684 } 685 686 static int ptrace_peek_siginfo(struct task_struct *child, 687 unsigned long addr, 688 unsigned long data) 689 { 690 struct ptrace_peeksiginfo_args arg; 691 struct sigpending *pending; 692 struct sigqueue *q; 693 int ret, i; 694 695 ret = copy_from_user(&arg, (void __user *) addr, 696 sizeof(struct ptrace_peeksiginfo_args)); 697 if (ret) 698 return -EFAULT; 699 700 if (arg.flags & ~PTRACE_PEEKSIGINFO_SHARED) 701 return -EINVAL; /* unknown flags */ 702 703 if (arg.nr < 0) 704 return -EINVAL; 705 706 if (arg.flags & PTRACE_PEEKSIGINFO_SHARED) 707 pending = &child->signal->shared_pending; 708 else 709 pending = &child->pending; 710 711 for (i = 0; i < arg.nr; ) { 712 siginfo_t info; 713 s32 off = arg.off + i; 714 715 spin_lock_irq(&child->sighand->siglock); 716 list_for_each_entry(q, &pending->list, list) { 717 if (!off--) { 718 copy_siginfo(&info, &q->info); 719 break; 720 } 721 } 722 spin_unlock_irq(&child->sighand->siglock); 723 724 if (off >= 0) /* beyond the end of the list */ 725 break; 726 727 #ifdef CONFIG_COMPAT 728 if (unlikely(in_compat_syscall())) { 729 compat_siginfo_t __user *uinfo = compat_ptr(data); 730 731 if (copy_siginfo_to_user32(uinfo, &info) || 732 __put_user(info.si_code, &uinfo->si_code)) { 733 ret = -EFAULT; 734 break; 735 } 736 737 } else 738 #endif 739 { 740 siginfo_t __user *uinfo = (siginfo_t __user *) data; 741 742 if (copy_siginfo_to_user(uinfo, &info) || 743 __put_user(info.si_code, &uinfo->si_code)) { 744 ret = -EFAULT; 745 break; 746 } 747 } 748 749 data += sizeof(siginfo_t); 750 i++; 751 752 if (signal_pending(current)) 753 break; 754 755 cond_resched(); 756 } 757 758 if (i > 0) 759 return i; 760 761 return ret; 762 } 763 764 #ifdef PTRACE_SINGLESTEP 765 #define is_singlestep(request) ((request) == PTRACE_SINGLESTEP) 766 #else 767 #define is_singlestep(request) 0 768 #endif 769 770 #ifdef PTRACE_SINGLEBLOCK 771 #define is_singleblock(request) ((request) == PTRACE_SINGLEBLOCK) 772 #else 773 #define is_singleblock(request) 0 774 #endif 775 776 #ifdef PTRACE_SYSEMU 777 #define is_sysemu_singlestep(request) ((request) == PTRACE_SYSEMU_SINGLESTEP) 778 #else 779 #define is_sysemu_singlestep(request) 0 780 #endif 781 782 static int ptrace_resume(struct task_struct *child, long request, 783 unsigned long data) 784 { 785 bool need_siglock; 786 787 if (!valid_signal(data)) 788 return -EIO; 789 790 if (request == PTRACE_SYSCALL) 791 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 792 else 793 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE); 794 795 #ifdef TIF_SYSCALL_EMU 796 if (request == PTRACE_SYSEMU || request == PTRACE_SYSEMU_SINGLESTEP) 797 set_tsk_thread_flag(child, TIF_SYSCALL_EMU); 798 else 799 clear_tsk_thread_flag(child, TIF_SYSCALL_EMU); 800 #endif 801 802 if (is_singleblock(request)) { 803 if (unlikely(!arch_has_block_step())) 804 return -EIO; 805 user_enable_block_step(child); 806 } else if (is_singlestep(request) || is_sysemu_singlestep(request)) { 807 if (unlikely(!arch_has_single_step())) 808 return -EIO; 809 user_enable_single_step(child); 810 } else { 811 user_disable_single_step(child); 812 } 813 814 /* 815 * Change ->exit_code and ->state under siglock to avoid the race 816 * with wait_task_stopped() in between; a non-zero ->exit_code will 817 * wrongly look like another report from tracee. 818 * 819 * Note that we need siglock even if ->exit_code == data and/or this 820 * status was not reported yet, the new status must not be cleared by 821 * wait_task_stopped() after resume. 822 * 823 * If data == 0 we do not care if wait_task_stopped() reports the old 824 * status and clears the code too; this can't race with the tracee, it 825 * takes siglock after resume. 826 */ 827 need_siglock = data && !thread_group_empty(current); 828 if (need_siglock) 829 spin_lock_irq(&child->sighand->siglock); 830 child->exit_code = data; 831 wake_up_state(child, __TASK_TRACED); 832 if (need_siglock) 833 spin_unlock_irq(&child->sighand->siglock); 834 835 return 0; 836 } 837 838 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK 839 840 static const struct user_regset * 841 find_regset(const struct user_regset_view *view, unsigned int type) 842 { 843 const struct user_regset *regset; 844 int n; 845 846 for (n = 0; n < view->n; ++n) { 847 regset = view->regsets + n; 848 if (regset->core_note_type == type) 849 return regset; 850 } 851 852 return NULL; 853 } 854 855 static int ptrace_regset(struct task_struct *task, int req, unsigned int type, 856 struct iovec *kiov) 857 { 858 const struct user_regset_view *view = task_user_regset_view(task); 859 const struct user_regset *regset = find_regset(view, type); 860 int regset_no; 861 862 if (!regset || (kiov->iov_len % regset->size) != 0) 863 return -EINVAL; 864 865 regset_no = regset - view->regsets; 866 kiov->iov_len = min(kiov->iov_len, 867 (__kernel_size_t) (regset->n * regset->size)); 868 869 if (req == PTRACE_GETREGSET) 870 return copy_regset_to_user(task, view, regset_no, 0, 871 kiov->iov_len, kiov->iov_base); 872 else 873 return copy_regset_from_user(task, view, regset_no, 0, 874 kiov->iov_len, kiov->iov_base); 875 } 876 877 /* 878 * This is declared in linux/regset.h and defined in machine-dependent 879 * code. We put the export here, near the primary machine-neutral use, 880 * to ensure no machine forgets it. 881 */ 882 EXPORT_SYMBOL_GPL(task_user_regset_view); 883 #endif 884 885 int ptrace_request(struct task_struct *child, long request, 886 unsigned long addr, unsigned long data) 887 { 888 bool seized = child->ptrace & PT_SEIZED; 889 int ret = -EIO; 890 siginfo_t siginfo, *si; 891 void __user *datavp = (void __user *) data; 892 unsigned long __user *datalp = datavp; 893 unsigned long flags; 894 895 switch (request) { 896 case PTRACE_PEEKTEXT: 897 case PTRACE_PEEKDATA: 898 return generic_ptrace_peekdata(child, addr, data); 899 case PTRACE_POKETEXT: 900 case PTRACE_POKEDATA: 901 return generic_ptrace_pokedata(child, addr, data); 902 903 #ifdef PTRACE_OLDSETOPTIONS 904 case PTRACE_OLDSETOPTIONS: 905 #endif 906 case PTRACE_SETOPTIONS: 907 ret = ptrace_setoptions(child, data); 908 break; 909 case PTRACE_GETEVENTMSG: 910 ret = put_user(child->ptrace_message, datalp); 911 break; 912 913 case PTRACE_PEEKSIGINFO: 914 ret = ptrace_peek_siginfo(child, addr, data); 915 break; 916 917 case PTRACE_GETSIGINFO: 918 ret = ptrace_getsiginfo(child, &siginfo); 919 if (!ret) 920 ret = copy_siginfo_to_user(datavp, &siginfo); 921 break; 922 923 case PTRACE_SETSIGINFO: 924 if (copy_from_user(&siginfo, datavp, sizeof siginfo)) 925 ret = -EFAULT; 926 else 927 ret = ptrace_setsiginfo(child, &siginfo); 928 break; 929 930 case PTRACE_GETSIGMASK: 931 if (addr != sizeof(sigset_t)) { 932 ret = -EINVAL; 933 break; 934 } 935 936 if (copy_to_user(datavp, &child->blocked, sizeof(sigset_t))) 937 ret = -EFAULT; 938 else 939 ret = 0; 940 941 break; 942 943 case PTRACE_SETSIGMASK: { 944 sigset_t new_set; 945 946 if (addr != sizeof(sigset_t)) { 947 ret = -EINVAL; 948 break; 949 } 950 951 if (copy_from_user(&new_set, datavp, sizeof(sigset_t))) { 952 ret = -EFAULT; 953 break; 954 } 955 956 sigdelsetmask(&new_set, sigmask(SIGKILL)|sigmask(SIGSTOP)); 957 958 /* 959 * Every thread does recalc_sigpending() after resume, so 960 * retarget_shared_pending() and recalc_sigpending() are not 961 * called here. 962 */ 963 spin_lock_irq(&child->sighand->siglock); 964 child->blocked = new_set; 965 spin_unlock_irq(&child->sighand->siglock); 966 967 ret = 0; 968 break; 969 } 970 971 case PTRACE_INTERRUPT: 972 /* 973 * Stop tracee without any side-effect on signal or job 974 * control. At least one trap is guaranteed to happen 975 * after this request. If @child is already trapped, the 976 * current trap is not disturbed and another trap will 977 * happen after the current trap is ended with PTRACE_CONT. 978 * 979 * The actual trap might not be PTRACE_EVENT_STOP trap but 980 * the pending condition is cleared regardless. 981 */ 982 if (unlikely(!seized || !lock_task_sighand(child, &flags))) 983 break; 984 985 /* 986 * INTERRUPT doesn't disturb existing trap sans one 987 * exception. If ptracer issued LISTEN for the current 988 * STOP, this INTERRUPT should clear LISTEN and re-trap 989 * tracee into STOP. 990 */ 991 if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP))) 992 ptrace_signal_wake_up(child, child->jobctl & JOBCTL_LISTENING); 993 994 unlock_task_sighand(child, &flags); 995 ret = 0; 996 break; 997 998 case PTRACE_LISTEN: 999 /* 1000 * Listen for events. Tracee must be in STOP. It's not 1001 * resumed per-se but is not considered to be in TRACED by 1002 * wait(2) or ptrace(2). If an async event (e.g. group 1003 * stop state change) happens, tracee will enter STOP trap 1004 * again. Alternatively, ptracer can issue INTERRUPT to 1005 * finish listening and re-trap tracee into STOP. 1006 */ 1007 if (unlikely(!seized || !lock_task_sighand(child, &flags))) 1008 break; 1009 1010 si = child->last_siginfo; 1011 if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) { 1012 child->jobctl |= JOBCTL_LISTENING; 1013 /* 1014 * If NOTIFY is set, it means event happened between 1015 * start of this trap and now. Trigger re-trap. 1016 */ 1017 if (child->jobctl & JOBCTL_TRAP_NOTIFY) 1018 ptrace_signal_wake_up(child, true); 1019 ret = 0; 1020 } 1021 unlock_task_sighand(child, &flags); 1022 break; 1023 1024 case PTRACE_DETACH: /* detach a process that was attached. */ 1025 ret = ptrace_detach(child, data); 1026 break; 1027 1028 #ifdef CONFIG_BINFMT_ELF_FDPIC 1029 case PTRACE_GETFDPIC: { 1030 struct mm_struct *mm = get_task_mm(child); 1031 unsigned long tmp = 0; 1032 1033 ret = -ESRCH; 1034 if (!mm) 1035 break; 1036 1037 switch (addr) { 1038 case PTRACE_GETFDPIC_EXEC: 1039 tmp = mm->context.exec_fdpic_loadmap; 1040 break; 1041 case PTRACE_GETFDPIC_INTERP: 1042 tmp = mm->context.interp_fdpic_loadmap; 1043 break; 1044 default: 1045 break; 1046 } 1047 mmput(mm); 1048 1049 ret = put_user(tmp, datalp); 1050 break; 1051 } 1052 #endif 1053 1054 #ifdef PTRACE_SINGLESTEP 1055 case PTRACE_SINGLESTEP: 1056 #endif 1057 #ifdef PTRACE_SINGLEBLOCK 1058 case PTRACE_SINGLEBLOCK: 1059 #endif 1060 #ifdef PTRACE_SYSEMU 1061 case PTRACE_SYSEMU: 1062 case PTRACE_SYSEMU_SINGLESTEP: 1063 #endif 1064 case PTRACE_SYSCALL: 1065 case PTRACE_CONT: 1066 return ptrace_resume(child, request, data); 1067 1068 case PTRACE_KILL: 1069 if (child->exit_state) /* already dead */ 1070 return 0; 1071 return ptrace_resume(child, request, SIGKILL); 1072 1073 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK 1074 case PTRACE_GETREGSET: 1075 case PTRACE_SETREGSET: { 1076 struct iovec kiov; 1077 struct iovec __user *uiov = datavp; 1078 1079 if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov))) 1080 return -EFAULT; 1081 1082 if (__get_user(kiov.iov_base, &uiov->iov_base) || 1083 __get_user(kiov.iov_len, &uiov->iov_len)) 1084 return -EFAULT; 1085 1086 ret = ptrace_regset(child, request, addr, &kiov); 1087 if (!ret) 1088 ret = __put_user(kiov.iov_len, &uiov->iov_len); 1089 break; 1090 } 1091 #endif 1092 1093 case PTRACE_SECCOMP_GET_FILTER: 1094 ret = seccomp_get_filter(child, addr, datavp); 1095 break; 1096 1097 default: 1098 break; 1099 } 1100 1101 return ret; 1102 } 1103 1104 static struct task_struct *ptrace_get_task_struct(pid_t pid) 1105 { 1106 struct task_struct *child; 1107 1108 rcu_read_lock(); 1109 child = find_task_by_vpid(pid); 1110 if (child) 1111 get_task_struct(child); 1112 rcu_read_unlock(); 1113 1114 if (!child) 1115 return ERR_PTR(-ESRCH); 1116 return child; 1117 } 1118 1119 #ifndef arch_ptrace_attach 1120 #define arch_ptrace_attach(child) do { } while (0) 1121 #endif 1122 1123 SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr, 1124 unsigned long, data) 1125 { 1126 struct task_struct *child; 1127 long ret; 1128 1129 if (request == PTRACE_TRACEME) { 1130 ret = ptrace_traceme(); 1131 if (!ret) 1132 arch_ptrace_attach(current); 1133 goto out; 1134 } 1135 1136 child = ptrace_get_task_struct(pid); 1137 if (IS_ERR(child)) { 1138 ret = PTR_ERR(child); 1139 goto out; 1140 } 1141 1142 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) { 1143 ret = ptrace_attach(child, request, addr, data); 1144 /* 1145 * Some architectures need to do book-keeping after 1146 * a ptrace attach. 1147 */ 1148 if (!ret) 1149 arch_ptrace_attach(child); 1150 goto out_put_task_struct; 1151 } 1152 1153 ret = ptrace_check_attach(child, request == PTRACE_KILL || 1154 request == PTRACE_INTERRUPT); 1155 if (ret < 0) 1156 goto out_put_task_struct; 1157 1158 ret = arch_ptrace(child, request, addr, data); 1159 if (ret || request != PTRACE_DETACH) 1160 ptrace_unfreeze_traced(child); 1161 1162 out_put_task_struct: 1163 put_task_struct(child); 1164 out: 1165 return ret; 1166 } 1167 1168 int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr, 1169 unsigned long data) 1170 { 1171 unsigned long tmp; 1172 int copied; 1173 1174 copied = ptrace_access_vm(tsk, addr, &tmp, sizeof(tmp), FOLL_FORCE); 1175 if (copied != sizeof(tmp)) 1176 return -EIO; 1177 return put_user(tmp, (unsigned long __user *)data); 1178 } 1179 1180 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr, 1181 unsigned long data) 1182 { 1183 int copied; 1184 1185 copied = ptrace_access_vm(tsk, addr, &data, sizeof(data), 1186 FOLL_FORCE | FOLL_WRITE); 1187 return (copied == sizeof(data)) ? 0 : -EIO; 1188 } 1189 1190 #if defined CONFIG_COMPAT 1191 1192 int compat_ptrace_request(struct task_struct *child, compat_long_t request, 1193 compat_ulong_t addr, compat_ulong_t data) 1194 { 1195 compat_ulong_t __user *datap = compat_ptr(data); 1196 compat_ulong_t word; 1197 siginfo_t siginfo; 1198 int ret; 1199 1200 switch (request) { 1201 case PTRACE_PEEKTEXT: 1202 case PTRACE_PEEKDATA: 1203 ret = ptrace_access_vm(child, addr, &word, sizeof(word), 1204 FOLL_FORCE); 1205 if (ret != sizeof(word)) 1206 ret = -EIO; 1207 else 1208 ret = put_user(word, datap); 1209 break; 1210 1211 case PTRACE_POKETEXT: 1212 case PTRACE_POKEDATA: 1213 ret = ptrace_access_vm(child, addr, &data, sizeof(data), 1214 FOLL_FORCE | FOLL_WRITE); 1215 ret = (ret != sizeof(data) ? -EIO : 0); 1216 break; 1217 1218 case PTRACE_GETEVENTMSG: 1219 ret = put_user((compat_ulong_t) child->ptrace_message, datap); 1220 break; 1221 1222 case PTRACE_GETSIGINFO: 1223 ret = ptrace_getsiginfo(child, &siginfo); 1224 if (!ret) 1225 ret = copy_siginfo_to_user32( 1226 (struct compat_siginfo __user *) datap, 1227 &siginfo); 1228 break; 1229 1230 case PTRACE_SETSIGINFO: 1231 memset(&siginfo, 0, sizeof siginfo); 1232 if (copy_siginfo_from_user32( 1233 &siginfo, (struct compat_siginfo __user *) datap)) 1234 ret = -EFAULT; 1235 else 1236 ret = ptrace_setsiginfo(child, &siginfo); 1237 break; 1238 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK 1239 case PTRACE_GETREGSET: 1240 case PTRACE_SETREGSET: 1241 { 1242 struct iovec kiov; 1243 struct compat_iovec __user *uiov = 1244 (struct compat_iovec __user *) datap; 1245 compat_uptr_t ptr; 1246 compat_size_t len; 1247 1248 if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov))) 1249 return -EFAULT; 1250 1251 if (__get_user(ptr, &uiov->iov_base) || 1252 __get_user(len, &uiov->iov_len)) 1253 return -EFAULT; 1254 1255 kiov.iov_base = compat_ptr(ptr); 1256 kiov.iov_len = len; 1257 1258 ret = ptrace_regset(child, request, addr, &kiov); 1259 if (!ret) 1260 ret = __put_user(kiov.iov_len, &uiov->iov_len); 1261 break; 1262 } 1263 #endif 1264 1265 default: 1266 ret = ptrace_request(child, request, addr, data); 1267 } 1268 1269 return ret; 1270 } 1271 1272 COMPAT_SYSCALL_DEFINE4(ptrace, compat_long_t, request, compat_long_t, pid, 1273 compat_long_t, addr, compat_long_t, data) 1274 { 1275 struct task_struct *child; 1276 long ret; 1277 1278 if (request == PTRACE_TRACEME) { 1279 ret = ptrace_traceme(); 1280 goto out; 1281 } 1282 1283 child = ptrace_get_task_struct(pid); 1284 if (IS_ERR(child)) { 1285 ret = PTR_ERR(child); 1286 goto out; 1287 } 1288 1289 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) { 1290 ret = ptrace_attach(child, request, addr, data); 1291 /* 1292 * Some architectures need to do book-keeping after 1293 * a ptrace attach. 1294 */ 1295 if (!ret) 1296 arch_ptrace_attach(child); 1297 goto out_put_task_struct; 1298 } 1299 1300 ret = ptrace_check_attach(child, request == PTRACE_KILL || 1301 request == PTRACE_INTERRUPT); 1302 if (!ret) { 1303 ret = compat_arch_ptrace(child, request, addr, data); 1304 if (ret || request != PTRACE_DETACH) 1305 ptrace_unfreeze_traced(child); 1306 } 1307 1308 out_put_task_struct: 1309 put_task_struct(child); 1310 out: 1311 return ret; 1312 } 1313 #endif /* CONFIG_COMPAT */ 1314