kernel/ptrace.c

   1 /*
   2  * linux/kernel/ptrace.c
   3  *
   4  * (C) Copyright 1999 Linus Torvalds
   5  *
   6  * Common interfaces for "ptrace()" which we do not want
   7  * to continually duplicate across every architecture.
   8  */
   9
  10 #include <linux/capability.h>
  11 #include <linux/module.h>
  12 #include <linux/sched.h>
  13 #include <linux/errno.h>
  14 #include <linux/mm.h>
  15 #include <linux/highmem.h>
  16 #include <linux/pagemap.h>
  17 #include <linux/smp_lock.h>
  18 #include <linux/ptrace.h>
  19 #include <linux/security.h>
  20 #include <linux/signal.h>
  21 #include <linux/audit.h>
  22 #include <linux/pid_namespace.h>
  23 #include <linux/syscalls.h>
  24
  25 #include <asm/pgtable.h>
  26 #include <asm/uaccess.h>
  27
  28 /*
  29  * ptrace a task: make the debugger its new parent and
  30  * move it to the ptrace list.
  31  *
  32  * Must be called with the tasklist lock write-held.
  33  */
  34 void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
  35 {
  36         BUG_ON(!list_empty(&child->ptrace_entry));
  37         list_add(&child->ptrace_entry, &new_parent->ptraced);
  38         child->parent = new_parent;
  39 }
  40
  41 /*
  42  * Turn a tracing stop into a normal stop now, since with no tracer there
  43  * would be no way to wake it up with SIGCONT or SIGKILL.  If there was a
  44  * signal sent that would resume the child, but didn't because it was in
  45  * TASK_TRACED, resume it now.
  46  * Requires that irqs be disabled.
  47  */
  48 static void ptrace_untrace(struct task_struct *child)
  49 {
  50         spin_lock(&child->sighand->siglock);
  51         if (task_is_traced(child)) {
  52                 if (child->signal->flags & SIGNAL_STOP_STOPPED) {
  53                         __set_task_state(child, TASK_STOPPED);
  54                 } else {
  55                         signal_wake_up(child, 1);
  56                 }
  57         }
  58         spin_unlock(&child->sighand->siglock);
  59 }
  60
  61 /*
  62  * unptrace a task: move it back to its original parent and
  63  * remove it from the ptrace list.
  64  *
  65  * Must be called with the tasklist lock write-held.
  66  */
  67 void __ptrace_unlink(struct task_struct *child)
  68 {
  69         BUG_ON(!child->ptrace);
  70
  71         child->ptrace = 0;
  72         child->parent = child->real_parent;
  73         list_del_init(&child->ptrace_entry);
  74
  75         if (task_is_traced(child))
  76                 ptrace_untrace(child);
  77 }
  78
  79 /*
  80  * Check that we have indeed attached to the thing..
  81  */
  82 int ptrace_check_attach(struct task_struct *child, int kill)
  83 {
  84         int ret = -ESRCH;
  85
  86         /*
  87          * We take the read lock around doing both checks to close a
  88          * possible race where someone else was tracing our child and
  89          * detached between these two checks.  After this locked check,
  90          * we are sure that this is our traced child and that can only
  91          * be changed by us so it's not changing right after this.
  92          */
  93         read_lock(&tasklist_lock);
  94         if ((child->ptrace & PT_PTRACED) && child->parent == current) {
  95                 ret = 0;
  96                 /*
  97                  * child->sighand can't be NULL, release_task()
  98                  * does ptrace_unlink() before __exit_signal().
  99                  */
 100                 spin_lock_irq(&child->sighand->siglock);
 101                 if (task_is_stopped(child))
 102                         child->state = TASK_TRACED;
 103                 else if (!task_is_traced(child) && !kill)
 104                         ret = -ESRCH;
 105                 spin_unlock_irq(&child->sighand->siglock);
 106         }
 107         read_unlock(&tasklist_lock);
 108
 109         if (!ret && !kill)
 110                 ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
 111
 112         /* All systems go.. */
 113         return ret;
 114 }
 115
 116 int __ptrace_may_access(struct task_struct *task, unsigned int mode)
 117 {
 118         struct cred *cred = current->cred, *tcred = task->cred;
 119
 120         /* May we inspect the given task?
 121          * This check is used both for attaching with ptrace
 122          * and for allowing access to sensitive information in /proc.
 123          *
 124          * ptrace_attach denies several cases that /proc allows
 125          * because setting up the necessary parent/child relationship
 126          * or halting the specified task is impossible.
 127          */
 128         uid_t uid = cred->uid;
 129         gid_t gid = cred->gid;
 130         int dumpable = 0;
 131         /* Don't let security modules deny introspection */
 132         if (task == current)
 133                 return 0;
 134         if ((uid != tcred->euid ||
 135              uid != tcred->suid ||
 136              uid != tcred->uid  ||
 137              gid != tcred->egid ||
 138              gid != tcred->sgid ||
 139              gid != tcred->gid) && !capable(CAP_SYS_PTRACE))
 140                 return -EPERM;
 141         smp_rmb();
 142         if (task->mm)
 143                 dumpable = get_dumpable(task->mm);
 144         if (!dumpable && !capable(CAP_SYS_PTRACE))
 145                 return -EPERM;
 146
 147         return security_ptrace_may_access(task, mode);
 148 }
 149
 150 bool ptrace_may_access(struct task_struct *task, unsigned int mode)
 151 {
 152         int err;
 153         task_lock(task);
 154         err = __ptrace_may_access(task, mode);
 155         task_unlock(task);
 156         return (!err ? true : false);
 157 }
 158
 159 int ptrace_attach(struct task_struct *task)
 160 {
 161         int retval;
 162         unsigned long flags;
 163
 164         audit_ptrace(task);
 165
 166         retval = -EPERM;
 167         if (same_thread_group(task, current))
 168                 goto out;
 169
 170 repeat:
 171         /*
 172          * Nasty, nasty.
 173          *
 174          * We want to hold both the task-lock and the
 175          * tasklist_lock for writing at the same time.
 176          * But that's against the rules (tasklist_lock
 177          * is taken for reading by interrupts on other
 178          * cpu's that may have task_lock).
 179          */
 180         task_lock(task);
 181         if (!write_trylock_irqsave(&tasklist_lock, flags)) {
 182                 task_unlock(task);
 183                 do {
 184                         cpu_relax();
 185                 } while (!write_can_lock(&tasklist_lock));
 186                 goto repeat;
 187         }
 188
 189         if (!task->mm)
 190                 goto bad;
 191         /* the same process cannot be attached many times */
 192         if (task->ptrace & PT_PTRACED)
 193                 goto bad;
 194         retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
 195         if (retval)
 196                 goto bad;
 197
 198         /* Go */
 199         task->ptrace |= PT_PTRACED;
 200         if (capable(CAP_SYS_PTRACE))
 201                 task->ptrace |= PT_PTRACE_CAP;
 202
 203         __ptrace_link(task, current);
 204
 205         send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);
 206 bad:
 207         write_unlock_irqrestore(&tasklist_lock, flags);
 208         task_unlock(task);
 209 out:
 210         return retval;
 211 }
 212
 213 static inline void __ptrace_detach(struct task_struct *child, unsigned int data)
 214 {
 215         child->exit_code = data;
 216         /* .. re-parent .. */
 217         __ptrace_unlink(child);
 218         /* .. and wake it up. */
 219         if (child->exit_state != EXIT_ZOMBIE)
 220                 wake_up_process(child);
 221 }
 222
 223 int ptrace_detach(struct task_struct *child, unsigned int data)
 224 {
 225         if (!valid_signal(data))
 226                 return -EIO;
 227
 228         /* Architecture-specific hardware disable .. */
 229         ptrace_disable(child);
 230         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 231
 232         write_lock_irq(&tasklist_lock);
 233         /* protect against de_thread()->release_task() */
 234         if (child->ptrace)
 235                 __ptrace_detach(child, data);
 236         write_unlock_irq(&tasklist_lock);
 237
 238         return 0;
 239 }
 240
 241 int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len)
 242 {
 243         int copied = 0;
 244
 245         while (len > 0) {
 246                 char buf[128];
 247                 int this_len, retval;
 248
 249                 this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
 250                 retval = access_process_vm(tsk, src, buf, this_len, 0);
 251                 if (!retval) {
 252                         if (copied)
 253                                 break;
 254                         return -EIO;
 255                 }
 256                 if (copy_to_user(dst, buf, retval))
 257                         return -EFAULT;
 258                 copied += retval;
 259                 src += retval;
 260                 dst += retval;
 261                 len -= retval;
 262         }
 263         return copied;
 264 }
 265
 266 int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len)
 267 {
 268         int copied = 0;
 269
 270         while (len > 0) {
 271                 char buf[128];
 272                 int this_len, retval;
 273
 274                 this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
 275                 if (copy_from_user(buf, src, this_len))
 276                         return -EFAULT;
 277                 retval = access_process_vm(tsk, dst, buf, this_len, 1);
 278                 if (!retval) {
 279                         if (copied)
 280                                 break;
 281                         return -EIO;
 282                 }
 283                 copied += retval;
 284                 src += retval;
 285                 dst += retval;
 286                 len -= retval;
 287         }
 288         return copied;
 289 }
 290
 291 static int ptrace_setoptions(struct task_struct *child, long data)
 292 {
 293         child->ptrace &= ~PT_TRACE_MASK;
 294
 295         if (data & PTRACE_O_TRACESYSGOOD)
 296                 child->ptrace |= PT_TRACESYSGOOD;
 297
 298         if (data & PTRACE_O_TRACEFORK)
 299                 child->ptrace |= PT_TRACE_FORK;
 300
 301         if (data & PTRACE_O_TRACEVFORK)
 302                 child->ptrace |= PT_TRACE_VFORK;
 303
 304         if (data & PTRACE_O_TRACECLONE)
 305                 child->ptrace |= PT_TRACE_CLONE;
 306
 307         if (data & PTRACE_O_TRACEEXEC)
 308                 child->ptrace |= PT_TRACE_EXEC;
 309
 310         if (data & PTRACE_O_TRACEVFORKDONE)
 311                 child->ptrace |= PT_TRACE_VFORK_DONE;
 312
 313         if (data & PTRACE_O_TRACEEXIT)
 314                 child->ptrace |= PT_TRACE_EXIT;
 315
 316         return (data & ~PTRACE_O_MASK) ? -EINVAL : 0;
 317 }
 318
 319 static int ptrace_getsiginfo(struct task_struct *child, siginfo_t *info)
 320 {
 321         int error = -ESRCH;
 322
 323         read_lock(&tasklist_lock);
 324         if (likely(child->sighand != NULL)) {
 325                 error = -EINVAL;
 326                 spin_lock_irq(&child->sighand->siglock);
 327                 if (likely(child->last_siginfo != NULL)) {
 328                         *info = *child->last_siginfo;
 329                         error = 0;
 330                 }
 331                 spin_unlock_irq(&child->sighand->siglock);
 332         }
 333         read_unlock(&tasklist_lock);
 334         return error;
 335 }
 336
 337 static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
 338 {
 339         int error = -ESRCH;
 340
 341         read_lock(&tasklist_lock);
 342         if (likely(child->sighand != NULL)) {
 343                 error = -EINVAL;
 344                 spin_lock_irq(&child->sighand->siglock);
 345                 if (likely(child->last_siginfo != NULL)) {
 346                         *child->last_siginfo = *info;
 347                         error = 0;
 348                 }
 349                 spin_unlock_irq(&child->sighand->siglock);
 350         }
 351         read_unlock(&tasklist_lock);
 352         return error;
 353 }
 354
 355
 356 #ifdef PTRACE_SINGLESTEP
 357 #define is_singlestep(request)          ((request) == PTRACE_SINGLESTEP)
 358 #else
 359 #define is_singlestep(request)          0
 360 #endif
 361
 362 #ifdef PTRACE_SINGLEBLOCK
 363 #define is_singleblock(request)         ((request) == PTRACE_SINGLEBLOCK)
 364 #else
 365 #define is_singleblock(request)         0
 366 #endif
 367
 368 #ifdef PTRACE_SYSEMU
 369 #define is_sysemu_singlestep(request)   ((request) == PTRACE_SYSEMU_SINGLESTEP)
 370 #else
 371 #define is_sysemu_singlestep(request)   0
 372 #endif
 373
 374 static int ptrace_resume(struct task_struct *child, long request, long data)
 375 {
 376         if (!valid_signal(data))
 377                 return -EIO;
 378
 379         if (request == PTRACE_SYSCALL)
 380                 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 381         else
 382                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 383
 384 #ifdef TIF_SYSCALL_EMU
 385         if (request == PTRACE_SYSEMU || request == PTRACE_SYSEMU_SINGLESTEP)
 386                 set_tsk_thread_flag(child, TIF_SYSCALL_EMU);
 387         else
 388                 clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
 389 #endif
 390
 391         if (is_singleblock(request)) {
 392                 if (unlikely(!arch_has_block_step()))
 393                         return -EIO;
 394                 user_enable_block_step(child);
 395         } else if (is_singlestep(request) || is_sysemu_singlestep(request)) {
 396                 if (unlikely(!arch_has_single_step()))
 397                         return -EIO;
 398                 user_enable_single_step(child);
 399         }
 400         else
 401                 user_disable_single_step(child);
 402
 403         child->exit_code = data;
 404         wake_up_process(child);
 405
 406         return 0;
 407 }
 408
 409 int ptrace_request(struct task_struct *child, long request,
 410                    long addr, long data)
 411 {
 412         int ret = -EIO;
 413         siginfo_t siginfo;
 414
 415         switch (request) {
 416         case PTRACE_PEEKTEXT:
 417         case PTRACE_PEEKDATA:
 418                 return generic_ptrace_peekdata(child, addr, data);
 419         case PTRACE_POKETEXT:
 420         case PTRACE_POKEDATA:
 421                 return generic_ptrace_pokedata(child, addr, data);
 422
 423 #ifdef PTRACE_OLDSETOPTIONS
 424         case PTRACE_OLDSETOPTIONS:
 425 #endif
 426         case PTRACE_SETOPTIONS:
 427                 ret = ptrace_setoptions(child, data);
 428                 break;
 429         case PTRACE_GETEVENTMSG:
 430                 ret = put_user(child->ptrace_message, (unsigned long __user *) data);
 431                 break;
 432
 433         case PTRACE_GETSIGINFO:
 434                 ret = ptrace_getsiginfo(child, &siginfo);
 435                 if (!ret)
 436                         ret = copy_siginfo_to_user((siginfo_t __user *) data,
 437                                                    &siginfo);
 438                 break;
 439
 440         case PTRACE_SETSIGINFO:
 441                 if (copy_from_user(&siginfo, (siginfo_t __user *) data,
 442                                    sizeof siginfo))
 443                         ret = -EFAULT;
 444                 else
 445                         ret = ptrace_setsiginfo(child, &siginfo);
 446                 break;
 447
 448         case PTRACE_DETACH:      /* detach a process that was attached. */
 449                 ret = ptrace_detach(child, data);
 450                 break;
 451
 452 #ifdef PTRACE_SINGLESTEP
 453         case PTRACE_SINGLESTEP:
 454 #endif
 455 #ifdef PTRACE_SINGLEBLOCK
 456         case PTRACE_SINGLEBLOCK:
 457 #endif
 458 #ifdef PTRACE_SYSEMU
 459         case PTRACE_SYSEMU:
 460         case PTRACE_SYSEMU_SINGLESTEP:
 461 #endif
 462         case PTRACE_SYSCALL:
 463         case PTRACE_CONT:
 464                 return ptrace_resume(child, request, data);
 465
 466         case PTRACE_KILL:
 467                 if (child->exit_state)  /* already dead */
 468                         return 0;
 469                 return ptrace_resume(child, request, SIGKILL);
 470
 471         default:
 472                 break;
 473         }
 474
 475         return ret;
 476 }
 477
 478 /**
 479  * ptrace_traceme  --  helper for PTRACE_TRACEME
 480  *
 481  * Performs checks and sets PT_PTRACED.
 482  * Should be used by all ptrace implementations for PTRACE_TRACEME.
 483  */
 484 int ptrace_traceme(void)
 485 {
 486         int ret = -EPERM;
 487
 488         /*
 489          * Are we already being traced?
 490          */
 491 repeat:
 492         task_lock(current);
 493         if (!(current->ptrace & PT_PTRACED)) {
 494                 /*
 495                  * See ptrace_attach() comments about the locking here.
 496                  */
 497                 unsigned long flags;
 498                 if (!write_trylock_irqsave(&tasklist_lock, flags)) {
 499                         task_unlock(current);
 500                         do {
 501                                 cpu_relax();
 502                         } while (!write_can_lock(&tasklist_lock));
 503                         goto repeat;
 504                 }
 505
 506                 ret = security_ptrace_traceme(current->parent);
 507
 508                 /*
 509                  * Set the ptrace bit in the process ptrace flags.
 510                  * Then link us on our parent's ptraced list.
 511                  */
 512                 if (!ret) {
 513                         current->ptrace |= PT_PTRACED;
 514                         __ptrace_link(current, current->real_parent);
 515                 }
 516
 517                 write_unlock_irqrestore(&tasklist_lock, flags);
 518         }
 519         task_unlock(current);
 520         return ret;
 521 }
 522
 523 /**
 524  * ptrace_get_task_struct  --  grab a task struct reference for ptrace
 525  * @pid:       process id to grab a task_struct reference of
 526  *
 527  * This function is a helper for ptrace implementations.  It checks
 528  * permissions and then grabs a task struct for use of the actual
 529  * ptrace implementation.
 530  *
 531  * Returns the task_struct for @pid or an ERR_PTR() on failure.
 532  */
 533 struct task_struct *ptrace_get_task_struct(pid_t pid)
 534 {
 535         struct task_struct *child;
 536
 537         read_lock(&tasklist_lock);
 538         child = find_task_by_vpid(pid);
 539         if (child)
 540                 get_task_struct(child);
 541
 542         read_unlock(&tasklist_lock);
 543         if (!child)
 544                 return ERR_PTR(-ESRCH);
 545         return child;
 546 }
 547
 548 #ifndef arch_ptrace_attach
 549 #define arch_ptrace_attach(child)       do { } while (0)
 550 #endif
 551
 552 asmlinkage long sys_ptrace(long request, long pid, long addr, long data)
 553 {
 554         struct task_struct *child;
 555         long ret;
 556
 557         /*
 558          * This lock_kernel fixes a subtle race with suid exec
 559          */
 560         lock_kernel();
 561         if (request == PTRACE_TRACEME) {
 562                 ret = ptrace_traceme();
 563                 if (!ret)
 564                         arch_ptrace_attach(current);
 565                 goto out;
 566         }
 567
 568         child = ptrace_get_task_struct(pid);
 569         if (IS_ERR(child)) {
 570                 ret = PTR_ERR(child);
 571                 goto out;
 572         }
 573
 574         if (request == PTRACE_ATTACH) {
 575                 ret = ptrace_attach(child);
 576                 /*
 577                  * Some architectures need to do book-keeping after
 578                  * a ptrace attach.
 579                  */
 580                 if (!ret)
 581                         arch_ptrace_attach(child);
 582                 goto out_put_task_struct;
 583         }
 584
 585         ret = ptrace_check_attach(child, request == PTRACE_KILL);
 586         if (ret < 0)
 587                 goto out_put_task_struct;
 588
 589         ret = arch_ptrace(child, request, addr, data);
 590         if (ret < 0)
 591                 goto out_put_task_struct;
 592
 593  out_put_task_struct:
 594         put_task_struct(child);
 595  out:
 596         unlock_kernel();
 597         return ret;
 598 }
 599
 600 int generic_ptrace_peekdata(struct task_struct *tsk, long addr, long data)
 601 {
 602         unsigned long tmp;
 603         int copied;
 604
 605         copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
 606         if (copied != sizeof(tmp))
 607                 return -EIO;
 608         return put_user(tmp, (unsigned long __user *)data);
 609 }
 610
 611 int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
 612 {
 613         int copied;
 614
 615         copied = access_process_vm(tsk, addr, &data, sizeof(data), 1);
 616         return (copied == sizeof(data)) ? 0 : -EIO;
 617 }
 618
 619 #if defined CONFIG_COMPAT && defined __ARCH_WANT_COMPAT_SYS_PTRACE
 620 #include <linux/compat.h>
 621
 622 int compat_ptrace_request(struct task_struct *child, compat_long_t request,
 623                           compat_ulong_t addr, compat_ulong_t data)
 624 {
 625         compat_ulong_t __user *datap = compat_ptr(data);
 626         compat_ulong_t word;
 627         siginfo_t siginfo;
 628         int ret;
 629
 630         switch (request) {
 631         case PTRACE_PEEKTEXT:
 632         case PTRACE_PEEKDATA:
 633                 ret = access_process_vm(child, addr, &word, sizeof(word), 0);
 634                 if (ret != sizeof(word))
 635                         ret = -EIO;
 636                 else
 637                         ret = put_user(word, datap);
 638                 break;
 639
 640         case PTRACE_POKETEXT:
 641         case PTRACE_POKEDATA:
 642                 ret = access_process_vm(child, addr, &data, sizeof(data), 1);
 643                 ret = (ret != sizeof(data) ? -EIO : 0);
 644                 break;
 645
 646         case PTRACE_GETEVENTMSG:
 647                 ret = put_user((compat_ulong_t) child->ptrace_message, datap);
 648                 break;
 649
 650         case PTRACE_GETSIGINFO:
 651                 ret = ptrace_getsiginfo(child, &siginfo);
 652                 if (!ret)
 653                         ret = copy_siginfo_to_user32(
 654                                 (struct compat_siginfo __user *) datap,
 655                                 &siginfo);
 656                 break;
 657
 658         case PTRACE_SETSIGINFO:
 659                 memset(&siginfo, 0, sizeof siginfo);
 660                 if (copy_siginfo_from_user32(
 661                             &siginfo, (struct compat_siginfo __user *) datap))
 662                         ret = -EFAULT;
 663                 else
 664                         ret = ptrace_setsiginfo(child, &siginfo);
 665                 break;
 666
 667         default:
 668                 ret = ptrace_request(child, request, addr, data);
 669         }
 670
 671         return ret;
 672 }
 673
 674 asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
 675                                   compat_long_t addr, compat_long_t data)
 676 {
 677         struct task_struct *child;
 678         long ret;
 679
 680         /*
 681          * This lock_kernel fixes a subtle race with suid exec
 682          */
 683         lock_kernel();
 684         if (request == PTRACE_TRACEME) {
 685                 ret = ptrace_traceme();
 686                 goto out;
 687         }
 688
 689         child = ptrace_get_task_struct(pid);
 690         if (IS_ERR(child)) {
 691                 ret = PTR_ERR(child);
 692                 goto out;
 693         }
 694
 695         if (request == PTRACE_ATTACH) {
 696                 ret = ptrace_attach(child);
 697                 /*
 698                  * Some architectures need to do book-keeping after
 699                  * a ptrace attach.
 700                  */
 701                 if (!ret)
 702                         arch_ptrace_attach(child);
 703                 goto out_put_task_struct;
 704         }
 705
 706         ret = ptrace_check_attach(child, request == PTRACE_KILL);
 707         if (!ret)
 708                 ret = compat_arch_ptrace(child, request, addr, data);
 709
 710  out_put_task_struct:
 711         put_task_struct(child);
 712  out:
 713         unlock_kernel();
 714         return ret;
 715 }
 716 #endif  /* CONFIG_COMPAT && __ARCH_WANT_COMPAT_SYS_PTRACE */