ptrace.c 22.2 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9
/*
 * linux/kernel/ptrace.c
 *
 * (C) Copyright 1999 Linus Torvalds
 *
 * Common interfaces for "ptrace()" which we do not want
 * to continually duplicate across every architecture.
 */

10
#include <linux/capability.h>
L
Linus Torvalds 已提交
11 12 13 14 15 16 17 18
#include <linux/module.h>
#include <linux/sched.h>
#include <linux/errno.h>
#include <linux/mm.h>
#include <linux/highmem.h>
#include <linux/pagemap.h>
#include <linux/ptrace.h>
#include <linux/security.h>
19
#include <linux/signal.h>
A
Al Viro 已提交
20
#include <linux/audit.h>
21
#include <linux/pid_namespace.h>
22
#include <linux/syscalls.h>
R
Roland McGrath 已提交
23
#include <linux/uaccess.h>
24
#include <linux/regset.h>
L
Linus Torvalds 已提交
25

26

L
Linus Torvalds 已提交
27 28 29 30 31 32
/*
 * ptrace a task: make the debugger its new parent and
 * move it to the ptrace list.
 *
 * Must be called with the tasklist lock write-held.
 */
33
void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
L
Linus Torvalds 已提交
34
{
R
Roland McGrath 已提交
35 36
	BUG_ON(!list_empty(&child->ptrace_entry));
	list_add(&child->ptrace_entry, &new_parent->ptraced);
L
Linus Torvalds 已提交
37 38
	child->parent = new_parent;
}
R
Roland McGrath 已提交
39

40 41 42 43
/**
 * __ptrace_unlink - unlink ptracee and restore its execution state
 * @child: ptracee to be unlinked
 *
44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
 * Remove @child from the ptrace list, move it back to the original parent,
 * and restore the execution state so that it conforms to the group stop
 * state.
 *
 * Unlinking can happen via two paths - explicit PTRACE_DETACH or ptracer
 * exiting.  For PTRACE_DETACH, unless the ptracee has been killed between
 * ptrace_check_attach() and here, it's guaranteed to be in TASK_TRACED.
 * If the ptracer is exiting, the ptracee can be in any state.
 *
 * After detach, the ptracee should be in a state which conforms to the
 * group stop.  If the group is stopped or in the process of stopping, the
 * ptracee should be put into TASK_STOPPED; otherwise, it should be woken
 * up from TASK_TRACED.
 *
 * If the ptracee is in TASK_TRACED and needs to be moved to TASK_STOPPED,
 * it goes through TRACED -> RUNNING -> STOPPED transition which is similar
 * to but in the opposite direction of what happens while attaching to a
 * stopped task.  However, in this direction, the intermediate RUNNING
 * state is not hidden even from the current ptracer and if it immediately
 * re-attaches and performs a WNOHANG wait(2), it may fail.
64 65 66
 *
 * CONTEXT:
 * write_lock_irq(tasklist_lock)
L
Linus Torvalds 已提交
67
 */
68
void __ptrace_unlink(struct task_struct *child)
L
Linus Torvalds 已提交
69
{
70 71 72 73 74 75
	BUG_ON(!child->ptrace);

	child->ptrace = 0;
	child->parent = child->real_parent;
	list_del_init(&child->ptrace_entry);

L
Linus Torvalds 已提交
76
	spin_lock(&child->sighand->siglock);
77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95

	/*
	 * Reinstate GROUP_STOP_PENDING if group stop is in effect and
	 * @child isn't dead.
	 */
	if (!(child->flags & PF_EXITING) &&
	    (child->signal->flags & SIGNAL_STOP_STOPPED ||
	     child->signal->group_stop_count))
		child->group_stop |= GROUP_STOP_PENDING;

	/*
	 * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick
	 * @child in the butt.  Note that @resume should be used iff @child
	 * is in TASK_TRACED; otherwise, we might unduly disrupt
	 * TASK_KILLABLE sleeps.
	 */
	if (child->group_stop & GROUP_STOP_PENDING || task_is_traced(child))
		signal_wake_up(child, task_is_traced(child));

L
Linus Torvalds 已提交
96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113
	spin_unlock(&child->sighand->siglock);
}

/*
 * Check that we have indeed attached to the thing..
 */
int ptrace_check_attach(struct task_struct *child, int kill)
{
	int ret = -ESRCH;

	/*
	 * We take the read lock around doing both checks to close a
	 * possible race where someone else was tracing our child and
	 * detached between these two checks.  After this locked check,
	 * we are sure that this is our traced child and that can only
	 * be changed by us so it's not changing right after this.
	 */
	read_lock(&tasklist_lock);
114 115 116 117 118
	if ((child->ptrace & PT_PTRACED) && child->parent == current) {
		/*
		 * child->sighand can't be NULL, release_task()
		 * does ptrace_unlink() before __exit_signal().
		 */
L
Linus Torvalds 已提交
119
		spin_lock_irq(&child->sighand->siglock);
120 121 122
		WARN_ON_ONCE(task_is_stopped(child));
		if (task_is_traced(child) || kill)
			ret = 0;
L
Linus Torvalds 已提交
123 124 125 126
		spin_unlock_irq(&child->sighand->siglock);
	}
	read_unlock(&tasklist_lock);

127
	if (!ret && !kill)
R
Roland McGrath 已提交
128
		ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
L
Linus Torvalds 已提交
129 130 131 132 133

	/* All systems go.. */
	return ret;
}

134
int __ptrace_may_access(struct task_struct *task, unsigned int mode)
135
{
136
	const struct cred *cred = current_cred(), *tcred;
137

138 139 140 141 142 143 144 145 146 147 148 149
	/* May we inspect the given task?
	 * This check is used both for attaching with ptrace
	 * and for allowing access to sensitive information in /proc.
	 *
	 * ptrace_attach denies several cases that /proc allows
	 * because setting up the necessary parent/child relationship
	 * or halting the specified task is impossible.
	 */
	int dumpable = 0;
	/* Don't let security modules deny introspection */
	if (task == current)
		return 0;
150 151 152 153 154 155 156 157 158 159
	rcu_read_lock();
	tcred = __task_cred(task);
	if ((cred->uid != tcred->euid ||
	     cred->uid != tcred->suid ||
	     cred->uid != tcred->uid  ||
	     cred->gid != tcred->egid ||
	     cred->gid != tcred->sgid ||
	     cred->gid != tcred->gid) &&
	    !capable(CAP_SYS_PTRACE)) {
		rcu_read_unlock();
160
		return -EPERM;
161 162
	}
	rcu_read_unlock();
163
	smp_rmb();
164
	if (task->mm)
165
		dumpable = get_dumpable(task->mm);
166
	if (!dumpable && !capable(CAP_SYS_PTRACE))
167 168
		return -EPERM;

169
	return security_ptrace_access_check(task, mode);
170 171
}

172
bool ptrace_may_access(struct task_struct *task, unsigned int mode)
173 174 175
{
	int err;
	task_lock(task);
176
	err = __ptrace_may_access(task, mode);
177
	task_unlock(task);
R
Roland McGrath 已提交
178
	return !err;
179 180
}

181
static int ptrace_attach(struct task_struct *task)
L
Linus Torvalds 已提交
182
{
183
	bool wait_trap = false;
L
Linus Torvalds 已提交
184
	int retval;
185

A
Al Viro 已提交
186 187
	audit_ptrace(task);

L
Linus Torvalds 已提交
188
	retval = -EPERM;
189 190
	if (unlikely(task->flags & PF_KTHREAD))
		goto out;
191
	if (same_thread_group(task, current))
192 193
		goto out;

194 195
	/*
	 * Protect exec's credential calculations against our interference;
196 197
	 * interference; SUID, SGID and LSM creds get determined differently
	 * under ptrace.
D
David Howells 已提交
198
	 */
199
	retval = -ERESTARTNOINTR;
200
	if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))
D
David Howells 已提交
201
		goto out;
202

203
	task_lock(task);
204
	retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
205
	task_unlock(task);
L
Linus Torvalds 已提交
206
	if (retval)
207
		goto unlock_creds;
L
Linus Torvalds 已提交
208

209
	write_lock_irq(&tasklist_lock);
210 211
	retval = -EPERM;
	if (unlikely(task->exit_state))
212
		goto unlock_tasklist;
213
	if (task->ptrace)
214
		goto unlock_tasklist;
215

216
	task->ptrace = PT_PTRACED;
L
Linus Torvalds 已提交
217 218 219 220
	if (capable(CAP_SYS_PTRACE))
		task->ptrace |= PT_PTRACE_CAP;

	__ptrace_link(task, current);
221
	send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);
222

223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249
	spin_lock(&task->sighand->siglock);

	/*
	 * If the task is already STOPPED, set GROUP_STOP_PENDING and
	 * TRAPPING, and kick it so that it transits to TRACED.  TRAPPING
	 * will be cleared if the child completes the transition or any
	 * event which clears the group stop states happens.  We'll wait
	 * for the transition to complete before returning from this
	 * function.
	 *
	 * This hides STOPPED -> RUNNING -> TRACED transition from the
	 * attaching thread but a different thread in the same group can
	 * still observe the transient RUNNING state.  IOW, if another
	 * thread's WNOHANG wait(2) on the stopped tracee races against
	 * ATTACH, the wait(2) may fail due to the transient RUNNING.
	 *
	 * The following task_is_stopped() test is safe as both transitions
	 * in and out of STOPPED are protected by siglock.
	 */
	if (task_is_stopped(task)) {
		task->group_stop |= GROUP_STOP_PENDING | GROUP_STOP_TRAPPING;
		signal_wake_up(task, 1);
		wait_trap = true;
	}

	spin_unlock(&task->sighand->siglock);

250
	retval = 0;
251 252 253
unlock_tasklist:
	write_unlock_irq(&tasklist_lock);
unlock_creds:
254
	mutex_unlock(&task->signal->cred_guard_mutex);
255
out:
256 257 258
	if (wait_trap)
		wait_event(current->signal->wait_chldexit,
			   !(task->group_stop & GROUP_STOP_TRAPPING));
L
Linus Torvalds 已提交
259 260 261
	return retval;
}

262 263 264 265 266 267
/**
 * ptrace_traceme  --  helper for PTRACE_TRACEME
 *
 * Performs checks and sets PT_PTRACED.
 * Should be used by all ptrace implementations for PTRACE_TRACEME.
 */
268
static int ptrace_traceme(void)
269 270 271
{
	int ret = -EPERM;

272 273
	write_lock_irq(&tasklist_lock);
	/* Are we already being traced? */
274 275 276 277 278 279 280 281 282 283 284 285
	if (!current->ptrace) {
		ret = security_ptrace_traceme(current->parent);
		/*
		 * Check PF_EXITING to ensure ->real_parent has not passed
		 * exit_ptrace(). Otherwise we don't report the error but
		 * pretend ->real_parent untraces us right after return.
		 */
		if (!ret && !(current->real_parent->flags & PF_EXITING)) {
			current->ptrace = PT_PTRACED;
			__ptrace_link(current, current->real_parent);
		}
	}
286 287
	write_unlock_irq(&tasklist_lock);

288 289 290
	return ret;
}

291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313
/*
 * Called with irqs disabled, returns true if childs should reap themselves.
 */
static int ignoring_children(struct sighand_struct *sigh)
{
	int ret;
	spin_lock(&sigh->siglock);
	ret = (sigh->action[SIGCHLD-1].sa.sa_handler == SIG_IGN) ||
	      (sigh->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT);
	spin_unlock(&sigh->siglock);
	return ret;
}

/*
 * Called with tasklist_lock held for writing.
 * Unlink a traced task, and clean it up if it was a traced zombie.
 * Return true if it needs to be reaped with release_task().
 * (We can't call release_task() here because we already hold tasklist_lock.)
 *
 * If it's a zombie, our attachedness prevented normal parent notification
 * or self-reaping.  Do notification now if it would have happened earlier.
 * If it should reap itself, return true.
 *
314 315 316 317
 * If it's our own child, there is no notification to do. But if our normal
 * children self-reap, then this child was prevented by ptrace and we must
 * reap it now, in that case we must also wake up sub-threads sleeping in
 * do_wait().
318 319 320 321 322 323 324 325 326
 */
static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
{
	__ptrace_unlink(p);

	if (p->exit_state == EXIT_ZOMBIE) {
		if (!task_detached(p) && thread_group_empty(p)) {
			if (!same_thread_group(p->real_parent, tracer))
				do_notify_parent(p, p->exit_signal);
327 328
			else if (ignoring_children(tracer->sighand)) {
				__wake_up_parent(p, tracer);
329
				p->exit_signal = -1;
330
			}
331 332 333 334 335 336 337 338 339 340 341
		}
		if (task_detached(p)) {
			/* Mark it as in the process of being reaped. */
			p->exit_state = EXIT_DEAD;
			return true;
		}
	}

	return false;
}

342
static int ptrace_detach(struct task_struct *child, unsigned int data)
L
Linus Torvalds 已提交
343
{
344
	bool dead = false;
345

346
	if (!valid_signal(data))
347
		return -EIO;
L
Linus Torvalds 已提交
348 349 350

	/* Architecture-specific hardware disable .. */
	ptrace_disable(child);
351
	clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
L
Linus Torvalds 已提交
352

353
	write_lock_irq(&tasklist_lock);
354 355 356 357
	/*
	 * This child can be already killed. Make sure de_thread() or
	 * our sub-thread doing do_wait() didn't do release_task() yet.
	 */
358 359
	if (child->ptrace) {
		child->exit_code = data;
360
		dead = __ptrace_detach(current, child);
361
	}
L
Linus Torvalds 已提交
362 363
	write_unlock_irq(&tasklist_lock);

364 365 366
	if (unlikely(dead))
		release_task(child);

L
Linus Torvalds 已提交
367 368 369
	return 0;
}

370
/*
371 372 373
 * Detach all tasks we were using ptrace on. Called with tasklist held
 * for writing, and returns with it held too. But note it can release
 * and reacquire the lock.
374 375
 */
void exit_ptrace(struct task_struct *tracer)
376 377
	__releases(&tasklist_lock)
	__acquires(&tasklist_lock)
378 379 380 381
{
	struct task_struct *p, *n;
	LIST_HEAD(ptrace_dead);

382 383 384
	if (likely(list_empty(&tracer->ptraced)))
		return;

385 386 387 388 389
	list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) {
		if (__ptrace_detach(tracer, p))
			list_add(&p->ptrace_entry, &ptrace_dead);
	}

390
	write_unlock_irq(&tasklist_lock);
391 392 393 394 395 396
	BUG_ON(!list_empty(&tracer->ptraced));

	list_for_each_entry_safe(p, n, &ptrace_dead, ptrace_entry) {
		list_del_init(&p->ptrace_entry);
		release_task(p);
	}
397 398

	write_lock_irq(&tasklist_lock);
399 400
}

L
Linus Torvalds 已提交
401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420
int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len)
{
	int copied = 0;

	while (len > 0) {
		char buf[128];
		int this_len, retval;

		this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
		retval = access_process_vm(tsk, src, buf, this_len, 0);
		if (!retval) {
			if (copied)
				break;
			return -EIO;
		}
		if (copy_to_user(dst, buf, retval))
			return -EFAULT;
		copied += retval;
		src += retval;
		dst += retval;
R
Roland McGrath 已提交
421
		len -= retval;
L
Linus Torvalds 已提交
422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445
	}
	return copied;
}

int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len)
{
	int copied = 0;

	while (len > 0) {
		char buf[128];
		int this_len, retval;

		this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
		if (copy_from_user(buf, src, this_len))
			return -EFAULT;
		retval = access_process_vm(tsk, dst, buf, this_len, 1);
		if (!retval) {
			if (copied)
				break;
			return -EIO;
		}
		copied += retval;
		src += retval;
		dst += retval;
R
Roland McGrath 已提交
446
		len -= retval;
L
Linus Torvalds 已提交
447 448 449 450
	}
	return copied;
}

451
static int ptrace_setoptions(struct task_struct *child, unsigned long data)
L
Linus Torvalds 已提交
452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478
{
	child->ptrace &= ~PT_TRACE_MASK;

	if (data & PTRACE_O_TRACESYSGOOD)
		child->ptrace |= PT_TRACESYSGOOD;

	if (data & PTRACE_O_TRACEFORK)
		child->ptrace |= PT_TRACE_FORK;

	if (data & PTRACE_O_TRACEVFORK)
		child->ptrace |= PT_TRACE_VFORK;

	if (data & PTRACE_O_TRACECLONE)
		child->ptrace |= PT_TRACE_CLONE;

	if (data & PTRACE_O_TRACEEXEC)
		child->ptrace |= PT_TRACE_EXEC;

	if (data & PTRACE_O_TRACEVFORKDONE)
		child->ptrace |= PT_TRACE_VFORK_DONE;

	if (data & PTRACE_O_TRACEEXIT)
		child->ptrace |= PT_TRACE_EXIT;

	return (data & ~PTRACE_O_MASK) ? -EINVAL : 0;
}

479
static int ptrace_getsiginfo(struct task_struct *child, siginfo_t *info)
L
Linus Torvalds 已提交
480
{
481
	unsigned long flags;
L
Linus Torvalds 已提交
482 483
	int error = -ESRCH;

484
	if (lock_task_sighand(child, &flags)) {
L
Linus Torvalds 已提交
485 486
		error = -EINVAL;
		if (likely(child->last_siginfo != NULL)) {
487
			*info = *child->last_siginfo;
L
Linus Torvalds 已提交
488 489
			error = 0;
		}
490
		unlock_task_sighand(child, &flags);
L
Linus Torvalds 已提交
491 492 493 494
	}
	return error;
}

495
static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
L
Linus Torvalds 已提交
496
{
497
	unsigned long flags;
L
Linus Torvalds 已提交
498 499
	int error = -ESRCH;

500
	if (lock_task_sighand(child, &flags)) {
L
Linus Torvalds 已提交
501 502
		error = -EINVAL;
		if (likely(child->last_siginfo != NULL)) {
503
			*child->last_siginfo = *info;
L
Linus Torvalds 已提交
504 505
			error = 0;
		}
506
		unlock_task_sighand(child, &flags);
L
Linus Torvalds 已提交
507 508 509 510
	}
	return error;
}

R
Roland McGrath 已提交
511 512 513 514 515 516 517

#ifdef PTRACE_SINGLESTEP
#define is_singlestep(request)		((request) == PTRACE_SINGLESTEP)
#else
#define is_singlestep(request)		0
#endif

518 519 520 521 522 523
#ifdef PTRACE_SINGLEBLOCK
#define is_singleblock(request)		((request) == PTRACE_SINGLEBLOCK)
#else
#define is_singleblock(request)		0
#endif

R
Roland McGrath 已提交
524 525 526 527 528 529
#ifdef PTRACE_SYSEMU
#define is_sysemu_singlestep(request)	((request) == PTRACE_SYSEMU_SINGLESTEP)
#else
#define is_sysemu_singlestep(request)	0
#endif

530 531
static int ptrace_resume(struct task_struct *child, long request,
			 unsigned long data)
R
Roland McGrath 已提交
532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547
{
	if (!valid_signal(data))
		return -EIO;

	if (request == PTRACE_SYSCALL)
		set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
	else
		clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);

#ifdef TIF_SYSCALL_EMU
	if (request == PTRACE_SYSEMU || request == PTRACE_SYSEMU_SINGLESTEP)
		set_tsk_thread_flag(child, TIF_SYSCALL_EMU);
	else
		clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
#endif

548 549 550 551 552
	if (is_singleblock(request)) {
		if (unlikely(!arch_has_block_step()))
			return -EIO;
		user_enable_block_step(child);
	} else if (is_singlestep(request) || is_sysemu_singlestep(request)) {
R
Roland McGrath 已提交
553 554 555
		if (unlikely(!arch_has_single_step()))
			return -EIO;
		user_enable_single_step(child);
R
Roland McGrath 已提交
556
	} else {
R
Roland McGrath 已提交
557
		user_disable_single_step(child);
R
Roland McGrath 已提交
558
	}
R
Roland McGrath 已提交
559 560 561 562 563 564 565

	child->exit_code = data;
	wake_up_process(child);

	return 0;
}

566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590
#ifdef CONFIG_HAVE_ARCH_TRACEHOOK

static const struct user_regset *
find_regset(const struct user_regset_view *view, unsigned int type)
{
	const struct user_regset *regset;
	int n;

	for (n = 0; n < view->n; ++n) {
		regset = view->regsets + n;
		if (regset->core_note_type == type)
			return regset;
	}

	return NULL;
}

static int ptrace_regset(struct task_struct *task, int req, unsigned int type,
			 struct iovec *kiov)
{
	const struct user_regset_view *view = task_user_regset_view(task);
	const struct user_regset *regset = find_regset(view, type);
	int regset_no;

	if (!regset || (kiov->iov_len % regset->size) != 0)
591
		return -EINVAL;
592 593 594 595 596 597 598 599 600 601 602 603 604 605 606

	regset_no = regset - view->regsets;
	kiov->iov_len = min(kiov->iov_len,
			    (__kernel_size_t) (regset->n * regset->size));

	if (req == PTRACE_GETREGSET)
		return copy_regset_to_user(task, view, regset_no, 0,
					   kiov->iov_len, kiov->iov_base);
	else
		return copy_regset_from_user(task, view, regset_no, 0,
					     kiov->iov_len, kiov->iov_base);
}

#endif

L
Linus Torvalds 已提交
607
int ptrace_request(struct task_struct *child, long request,
608
		   unsigned long addr, unsigned long data)
L
Linus Torvalds 已提交
609 610
{
	int ret = -EIO;
611
	siginfo_t siginfo;
N
Namhyung Kim 已提交
612 613
	void __user *datavp = (void __user *) data;
	unsigned long __user *datalp = datavp;
L
Linus Torvalds 已提交
614 615

	switch (request) {
616 617 618 619 620 621 622
	case PTRACE_PEEKTEXT:
	case PTRACE_PEEKDATA:
		return generic_ptrace_peekdata(child, addr, data);
	case PTRACE_POKETEXT:
	case PTRACE_POKEDATA:
		return generic_ptrace_pokedata(child, addr, data);

L
Linus Torvalds 已提交
623 624 625 626 627 628 629
#ifdef PTRACE_OLDSETOPTIONS
	case PTRACE_OLDSETOPTIONS:
#endif
	case PTRACE_SETOPTIONS:
		ret = ptrace_setoptions(child, data);
		break;
	case PTRACE_GETEVENTMSG:
N
Namhyung Kim 已提交
630
		ret = put_user(child->ptrace_message, datalp);
L
Linus Torvalds 已提交
631
		break;
632

L
Linus Torvalds 已提交
633
	case PTRACE_GETSIGINFO:
634 635
		ret = ptrace_getsiginfo(child, &siginfo);
		if (!ret)
N
Namhyung Kim 已提交
636
			ret = copy_siginfo_to_user(datavp, &siginfo);
L
Linus Torvalds 已提交
637
		break;
638

L
Linus Torvalds 已提交
639
	case PTRACE_SETSIGINFO:
N
Namhyung Kim 已提交
640
		if (copy_from_user(&siginfo, datavp, sizeof siginfo))
641 642 643
			ret = -EFAULT;
		else
			ret = ptrace_setsiginfo(child, &siginfo);
L
Linus Torvalds 已提交
644
		break;
645

A
Alexey Dobriyan 已提交
646 647 648
	case PTRACE_DETACH:	 /* detach a process that was attached. */
		ret = ptrace_detach(child, data);
		break;
R
Roland McGrath 已提交
649

650 651
#ifdef CONFIG_BINFMT_ELF_FDPIC
	case PTRACE_GETFDPIC: {
652
		struct mm_struct *mm = get_task_mm(child);
653 654
		unsigned long tmp = 0;

655 656 657 658
		ret = -ESRCH;
		if (!mm)
			break;

659 660
		switch (addr) {
		case PTRACE_GETFDPIC_EXEC:
661
			tmp = mm->context.exec_fdpic_loadmap;
662 663
			break;
		case PTRACE_GETFDPIC_INTERP:
664
			tmp = mm->context.interp_fdpic_loadmap;
665 666 667 668
			break;
		default:
			break;
		}
669
		mmput(mm);
670

N
Namhyung Kim 已提交
671
		ret = put_user(tmp, datalp);
672 673 674 675
		break;
	}
#endif

R
Roland McGrath 已提交
676 677 678
#ifdef PTRACE_SINGLESTEP
	case PTRACE_SINGLESTEP:
#endif
679 680 681
#ifdef PTRACE_SINGLEBLOCK
	case PTRACE_SINGLEBLOCK:
#endif
R
Roland McGrath 已提交
682 683 684 685 686 687 688 689 690 691 692 693 694
#ifdef PTRACE_SYSEMU
	case PTRACE_SYSEMU:
	case PTRACE_SYSEMU_SINGLESTEP:
#endif
	case PTRACE_SYSCALL:
	case PTRACE_CONT:
		return ptrace_resume(child, request, data);

	case PTRACE_KILL:
		if (child->exit_state)	/* already dead */
			return 0;
		return ptrace_resume(child, request, SIGKILL);

695 696 697 698 699
#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
	case PTRACE_GETREGSET:
	case PTRACE_SETREGSET:
	{
		struct iovec kiov;
N
Namhyung Kim 已提交
700
		struct iovec __user *uiov = datavp;
701 702 703 704 705 706 707 708 709 710 711 712 713 714

		if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
			return -EFAULT;

		if (__get_user(kiov.iov_base, &uiov->iov_base) ||
		    __get_user(kiov.iov_len, &uiov->iov_len))
			return -EFAULT;

		ret = ptrace_regset(child, request, addr, &kiov);
		if (!ret)
			ret = __put_user(kiov.iov_len, &uiov->iov_len);
		break;
	}
#endif
L
Linus Torvalds 已提交
715 716 717 718 719 720
	default:
		break;
	}

	return ret;
}
721

722
static struct task_struct *ptrace_get_task_struct(pid_t pid)
723 724
{
	struct task_struct *child;
725

726
	rcu_read_lock();
727
	child = find_task_by_vpid(pid);
728 729
	if (child)
		get_task_struct(child);
730
	rcu_read_unlock();
731

732
	if (!child)
733 734
		return ERR_PTR(-ESRCH);
	return child;
735 736
}

737 738 739 740
#ifndef arch_ptrace_attach
#define arch_ptrace_attach(child)	do { } while (0)
#endif

741 742
SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
		unsigned long, data)
743 744 745 746
{
	struct task_struct *child;
	long ret;

747 748
	if (request == PTRACE_TRACEME) {
		ret = ptrace_traceme();
749 750
		if (!ret)
			arch_ptrace_attach(current);
751
		goto out;
752 753 754 755 756 757 758
	}

	child = ptrace_get_task_struct(pid);
	if (IS_ERR(child)) {
		ret = PTR_ERR(child);
		goto out;
	}
759 760 761

	if (request == PTRACE_ATTACH) {
		ret = ptrace_attach(child);
762 763 764 765 766 767
		/*
		 * Some architectures need to do book-keeping after
		 * a ptrace attach.
		 */
		if (!ret)
			arch_ptrace_attach(child);
768
		goto out_put_task_struct;
769 770 771 772 773 774 775 776 777 778 779 780 781
	}

	ret = ptrace_check_attach(child, request == PTRACE_KILL);
	if (ret < 0)
		goto out_put_task_struct;

	ret = arch_ptrace(child, request, addr, data);

 out_put_task_struct:
	put_task_struct(child);
 out:
	return ret;
}
A
Alexey Dobriyan 已提交
782

783 784
int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
			    unsigned long data)
A
Alexey Dobriyan 已提交
785 786 787 788 789 790 791 792 793
{
	unsigned long tmp;
	int copied;

	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
	if (copied != sizeof(tmp))
		return -EIO;
	return put_user(tmp, (unsigned long __user *)data);
}
A
Alexey Dobriyan 已提交
794

795 796
int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
			    unsigned long data)
A
Alexey Dobriyan 已提交
797 798 799 800 801 802
{
	int copied;

	copied = access_process_vm(tsk, addr, &data, sizeof(data), 1);
	return (copied == sizeof(data)) ? 0 : -EIO;
}
R
Roland McGrath 已提交
803

804
#if defined CONFIG_COMPAT
R
Roland McGrath 已提交
805 806 807 808 809 810 811
#include <linux/compat.h>

int compat_ptrace_request(struct task_struct *child, compat_long_t request,
			  compat_ulong_t addr, compat_ulong_t data)
{
	compat_ulong_t __user *datap = compat_ptr(data);
	compat_ulong_t word;
812
	siginfo_t siginfo;
R
Roland McGrath 已提交
813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834
	int ret;

	switch (request) {
	case PTRACE_PEEKTEXT:
	case PTRACE_PEEKDATA:
		ret = access_process_vm(child, addr, &word, sizeof(word), 0);
		if (ret != sizeof(word))
			ret = -EIO;
		else
			ret = put_user(word, datap);
		break;

	case PTRACE_POKETEXT:
	case PTRACE_POKEDATA:
		ret = access_process_vm(child, addr, &data, sizeof(data), 1);
		ret = (ret != sizeof(data) ? -EIO : 0);
		break;

	case PTRACE_GETEVENTMSG:
		ret = put_user((compat_ulong_t) child->ptrace_message, datap);
		break;

835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850
	case PTRACE_GETSIGINFO:
		ret = ptrace_getsiginfo(child, &siginfo);
		if (!ret)
			ret = copy_siginfo_to_user32(
				(struct compat_siginfo __user *) datap,
				&siginfo);
		break;

	case PTRACE_SETSIGINFO:
		memset(&siginfo, 0, sizeof siginfo);
		if (copy_siginfo_from_user32(
			    &siginfo, (struct compat_siginfo __user *) datap))
			ret = -EFAULT;
		else
			ret = ptrace_setsiginfo(child, &siginfo);
		break;
851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876
#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
	case PTRACE_GETREGSET:
	case PTRACE_SETREGSET:
	{
		struct iovec kiov;
		struct compat_iovec __user *uiov =
			(struct compat_iovec __user *) datap;
		compat_uptr_t ptr;
		compat_size_t len;

		if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
			return -EFAULT;

		if (__get_user(ptr, &uiov->iov_base) ||
		    __get_user(len, &uiov->iov_len))
			return -EFAULT;

		kiov.iov_base = compat_ptr(ptr);
		kiov.iov_len = len;

		ret = ptrace_regset(child, request, addr, &kiov);
		if (!ret)
			ret = __put_user(kiov.iov_len, &uiov->iov_len);
		break;
	}
#endif
877

R
Roland McGrath 已提交
878 879 880 881 882 883
	default:
		ret = ptrace_request(child, request, addr, data);
	}

	return ret;
}
R
Roland McGrath 已提交
884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921

asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
				  compat_long_t addr, compat_long_t data)
{
	struct task_struct *child;
	long ret;

	if (request == PTRACE_TRACEME) {
		ret = ptrace_traceme();
		goto out;
	}

	child = ptrace_get_task_struct(pid);
	if (IS_ERR(child)) {
		ret = PTR_ERR(child);
		goto out;
	}

	if (request == PTRACE_ATTACH) {
		ret = ptrace_attach(child);
		/*
		 * Some architectures need to do book-keeping after
		 * a ptrace attach.
		 */
		if (!ret)
			arch_ptrace_attach(child);
		goto out_put_task_struct;
	}

	ret = ptrace_check_attach(child, request == PTRACE_KILL);
	if (!ret)
		ret = compat_arch_ptrace(child, request, addr, data);

 out_put_task_struct:
	put_task_struct(child);
 out:
	return ret;
}
922
#endif	/* CONFIG_COMPAT */