Linux Audio

Check our new training course

Loading...
v3.5.6
   1/*
   2 * linux/kernel/ptrace.c
   3 *
   4 * (C) Copyright 1999 Linus Torvalds
   5 *
   6 * Common interfaces for "ptrace()" which we do not want
   7 * to continually duplicate across every architecture.
   8 */
   9
  10#include <linux/capability.h>
  11#include <linux/export.h>
  12#include <linux/sched.h>
  13#include <linux/errno.h>
  14#include <linux/mm.h>
  15#include <linux/highmem.h>
  16#include <linux/pagemap.h>
  17#include <linux/ptrace.h>
  18#include <linux/security.h>
  19#include <linux/signal.h>
 
  20#include <linux/audit.h>
  21#include <linux/pid_namespace.h>
  22#include <linux/syscalls.h>
  23#include <linux/uaccess.h>
  24#include <linux/regset.h>
  25#include <linux/hw_breakpoint.h>
  26#include <linux/cn_proc.h>
 
  27
  28
  29static int ptrace_trapping_sleep_fn(void *flags)
 
 
 
 
 
  30{
  31	schedule();
  32	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  33}
  34
 
  35/*
  36 * ptrace a task: make the debugger its new parent and
  37 * move it to the ptrace list.
  38 *
  39 * Must be called with the tasklist lock write-held.
  40 */
  41void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
  42{
  43	BUG_ON(!list_empty(&child->ptrace_entry));
  44	list_add(&child->ptrace_entry, &new_parent->ptraced);
  45	child->parent = new_parent;
 
 
 
  46}
  47
  48/**
  49 * __ptrace_unlink - unlink ptracee and restore its execution state
  50 * @child: ptracee to be unlinked
  51 *
  52 * Remove @child from the ptrace list, move it back to the original parent,
  53 * and restore the execution state so that it conforms to the group stop
  54 * state.
  55 *
  56 * Unlinking can happen via two paths - explicit PTRACE_DETACH or ptracer
  57 * exiting.  For PTRACE_DETACH, unless the ptracee has been killed between
  58 * ptrace_check_attach() and here, it's guaranteed to be in TASK_TRACED.
  59 * If the ptracer is exiting, the ptracee can be in any state.
  60 *
  61 * After detach, the ptracee should be in a state which conforms to the
  62 * group stop.  If the group is stopped or in the process of stopping, the
  63 * ptracee should be put into TASK_STOPPED; otherwise, it should be woken
  64 * up from TASK_TRACED.
  65 *
  66 * If the ptracee is in TASK_TRACED and needs to be moved to TASK_STOPPED,
  67 * it goes through TRACED -> RUNNING -> STOPPED transition which is similar
  68 * to but in the opposite direction of what happens while attaching to a
  69 * stopped task.  However, in this direction, the intermediate RUNNING
  70 * state is not hidden even from the current ptracer and if it immediately
  71 * re-attaches and performs a WNOHANG wait(2), it may fail.
  72 *
  73 * CONTEXT:
  74 * write_lock_irq(tasklist_lock)
  75 */
  76void __ptrace_unlink(struct task_struct *child)
  77{
 
  78	BUG_ON(!child->ptrace);
  79
  80	child->ptrace = 0;
 
  81	child->parent = child->real_parent;
  82	list_del_init(&child->ptrace_entry);
 
 
 
  83
  84	spin_lock(&child->sighand->siglock);
  85
  86	/*
  87	 * Clear all pending traps and TRAPPING.  TRAPPING should be
  88	 * cleared regardless of JOBCTL_STOP_PENDING.  Do it explicitly.
  89	 */
  90	task_clear_jobctl_pending(child, JOBCTL_TRAP_MASK);
  91	task_clear_jobctl_trapping(child);
  92
  93	/*
  94	 * Reinstate JOBCTL_STOP_PENDING if group stop is in effect and
  95	 * @child isn't dead.
  96	 */
  97	if (!(child->flags & PF_EXITING) &&
  98	    (child->signal->flags & SIGNAL_STOP_STOPPED ||
  99	     child->signal->group_stop_count)) {
 100		child->jobctl |= JOBCTL_STOP_PENDING;
 101
 102		/*
 103		 * This is only possible if this thread was cloned by the
 104		 * traced task running in the stopped group, set the signal
 105		 * for the future reports.
 106		 * FIXME: we should change ptrace_init_task() to handle this
 107		 * case.
 108		 */
 109		if (!(child->jobctl & JOBCTL_STOP_SIGMASK))
 110			child->jobctl |= SIGSTOP;
 111	}
 112
 113	/*
 114	 * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick
 115	 * @child in the butt.  Note that @resume should be used iff @child
 116	 * is in TASK_TRACED; otherwise, we might unduly disrupt
 117	 * TASK_KILLABLE sleeps.
 118	 */
 119	if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child))
 120		signal_wake_up(child, task_is_traced(child));
 121
 122	spin_unlock(&child->sighand->siglock);
 123}
 124
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 125/**
 126 * ptrace_check_attach - check whether ptracee is ready for ptrace operation
 127 * @child: ptracee to check for
 128 * @ignore_state: don't check whether @child is currently %TASK_TRACED
 129 *
 130 * Check whether @child is being ptraced by %current and ready for further
 131 * ptrace operations.  If @ignore_state is %false, @child also should be in
 132 * %TASK_TRACED state and on return the child is guaranteed to be traced
 133 * and not executing.  If @ignore_state is %true, @child can be in any
 134 * state.
 135 *
 136 * CONTEXT:
 137 * Grabs and releases tasklist_lock and @child->sighand->siglock.
 138 *
 139 * RETURNS:
 140 * 0 on success, -ESRCH if %child is not ready.
 141 */
 142int ptrace_check_attach(struct task_struct *child, bool ignore_state)
 143{
 144	int ret = -ESRCH;
 145
 146	/*
 147	 * We take the read lock around doing both checks to close a
 148	 * possible race where someone else was tracing our child and
 149	 * detached between these two checks.  After this locked check,
 150	 * we are sure that this is our traced child and that can only
 151	 * be changed by us so it's not changing right after this.
 152	 */
 153	read_lock(&tasklist_lock);
 154	if ((child->ptrace & PT_PTRACED) && child->parent == current) {
 
 155		/*
 156		 * child->sighand can't be NULL, release_task()
 157		 * does ptrace_unlink() before __exit_signal().
 158		 */
 159		spin_lock_irq(&child->sighand->siglock);
 160		WARN_ON_ONCE(task_is_stopped(child));
 161		if (ignore_state || (task_is_traced(child) &&
 162				     !(child->jobctl & JOBCTL_LISTENING)))
 163			ret = 0;
 164		spin_unlock_irq(&child->sighand->siglock);
 165	}
 166	read_unlock(&tasklist_lock);
 167
 168	if (!ret && !ignore_state)
 169		ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
 
 
 
 
 
 
 
 
 
 170
 171	/* All systems go.. */
 172	return ret;
 173}
 174
 175static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
 176{
 177	if (mode & PTRACE_MODE_NOAUDIT)
 178		return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
 179	else
 180		return has_ns_capability(current, ns, CAP_SYS_PTRACE);
 181}
 182
 183int __ptrace_may_access(struct task_struct *task, unsigned int mode)
 
 184{
 185	const struct cred *cred = current_cred(), *tcred;
 
 
 
 
 
 
 
 
 186
 187	/* May we inspect the given task?
 188	 * This check is used both for attaching with ptrace
 189	 * and for allowing access to sensitive information in /proc.
 190	 *
 191	 * ptrace_attach denies several cases that /proc allows
 192	 * because setting up the necessary parent/child relationship
 193	 * or halting the specified task is impossible.
 194	 */
 195	int dumpable = 0;
 196	/* Don't let security modules deny introspection */
 197	if (task == current)
 198		return 0;
 199	rcu_read_lock();
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 200	tcred = __task_cred(task);
 201	if (uid_eq(cred->uid, tcred->euid) &&
 202	    uid_eq(cred->uid, tcred->suid) &&
 203	    uid_eq(cred->uid, tcred->uid)  &&
 204	    gid_eq(cred->gid, tcred->egid) &&
 205	    gid_eq(cred->gid, tcred->sgid) &&
 206	    gid_eq(cred->gid, tcred->gid))
 207		goto ok;
 208	if (ptrace_has_cap(tcred->user_ns, mode))
 209		goto ok;
 210	rcu_read_unlock();
 211	return -EPERM;
 212ok:
 213	rcu_read_unlock();
 214	smp_rmb();
 215	if (task->mm)
 216		dumpable = get_dumpable(task->mm);
 217	if (!dumpable  && !ptrace_has_cap(task_user_ns(task), mode))
 218		return -EPERM;
 219
 220	return security_ptrace_access_check(task, mode);
 221}
 222
 223bool ptrace_may_access(struct task_struct *task, unsigned int mode)
 224{
 225	int err;
 226	task_lock(task);
 227	err = __ptrace_may_access(task, mode);
 228	task_unlock(task);
 229	return !err;
 230}
 231
 232static int ptrace_attach(struct task_struct *task, long request,
 233			 unsigned long addr,
 234			 unsigned long flags)
 235{
 236	bool seize = (request == PTRACE_SEIZE);
 237	int retval;
 238
 239	retval = -EIO;
 240	if (seize) {
 241		if (addr != 0)
 242			goto out;
 243		if (flags & ~(unsigned long)PTRACE_O_MASK)
 244			goto out;
 245		flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT);
 246	} else {
 247		flags = PT_PTRACED;
 248	}
 249
 250	audit_ptrace(task);
 251
 252	retval = -EPERM;
 253	if (unlikely(task->flags & PF_KTHREAD))
 254		goto out;
 255	if (same_thread_group(task, current))
 256		goto out;
 257
 258	/*
 259	 * Protect exec's credential calculations against our interference;
 260	 * SUID, SGID and LSM creds get determined differently
 261	 * under ptrace.
 262	 */
 263	retval = -ERESTARTNOINTR;
 264	if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))
 265		goto out;
 266
 267	task_lock(task);
 268	retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
 269	task_unlock(task);
 270	if (retval)
 271		goto unlock_creds;
 272
 273	write_lock_irq(&tasklist_lock);
 274	retval = -EPERM;
 275	if (unlikely(task->exit_state))
 276		goto unlock_tasklist;
 277	if (task->ptrace)
 278		goto unlock_tasklist;
 279
 280	if (seize)
 281		flags |= PT_SEIZED;
 282	if (ns_capable(task_user_ns(task), CAP_SYS_PTRACE))
 283		flags |= PT_PTRACE_CAP;
 284	task->ptrace = flags;
 285
 286	__ptrace_link(task, current);
 287
 288	/* SEIZE doesn't trap tracee on attach */
 289	if (!seize)
 290		send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);
 291
 292	spin_lock(&task->sighand->siglock);
 293
 294	/*
 295	 * If the task is already STOPPED, set JOBCTL_TRAP_STOP and
 296	 * TRAPPING, and kick it so that it transits to TRACED.  TRAPPING
 297	 * will be cleared if the child completes the transition or any
 298	 * event which clears the group stop states happens.  We'll wait
 299	 * for the transition to complete before returning from this
 300	 * function.
 301	 *
 302	 * This hides STOPPED -> RUNNING -> TRACED transition from the
 303	 * attaching thread but a different thread in the same group can
 304	 * still observe the transient RUNNING state.  IOW, if another
 305	 * thread's WNOHANG wait(2) on the stopped tracee races against
 306	 * ATTACH, the wait(2) may fail due to the transient RUNNING.
 307	 *
 308	 * The following task_is_stopped() test is safe as both transitions
 309	 * in and out of STOPPED are protected by siglock.
 310	 */
 311	if (task_is_stopped(task) &&
 312	    task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING))
 313		signal_wake_up(task, 1);
 314
 315	spin_unlock(&task->sighand->siglock);
 316
 317	retval = 0;
 318unlock_tasklist:
 319	write_unlock_irq(&tasklist_lock);
 320unlock_creds:
 321	mutex_unlock(&task->signal->cred_guard_mutex);
 322out:
 323	if (!retval) {
 324		wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT,
 325			    ptrace_trapping_sleep_fn, TASK_UNINTERRUPTIBLE);
 
 
 
 
 
 
 326		proc_ptrace_connector(task, PTRACE_ATTACH);
 327	}
 328
 329	return retval;
 330}
 331
 332/**
 333 * ptrace_traceme  --  helper for PTRACE_TRACEME
 334 *
 335 * Performs checks and sets PT_PTRACED.
 336 * Should be used by all ptrace implementations for PTRACE_TRACEME.
 337 */
 338static int ptrace_traceme(void)
 339{
 340	int ret = -EPERM;
 341
 342	write_lock_irq(&tasklist_lock);
 343	/* Are we already being traced? */
 344	if (!current->ptrace) {
 345		ret = security_ptrace_traceme(current->parent);
 346		/*
 347		 * Check PF_EXITING to ensure ->real_parent has not passed
 348		 * exit_ptrace(). Otherwise we don't report the error but
 349		 * pretend ->real_parent untraces us right after return.
 350		 */
 351		if (!ret && !(current->real_parent->flags & PF_EXITING)) {
 352			current->ptrace = PT_PTRACED;
 353			__ptrace_link(current, current->real_parent);
 354		}
 355	}
 356	write_unlock_irq(&tasklist_lock);
 357
 358	return ret;
 359}
 360
 361/*
 362 * Called with irqs disabled, returns true if childs should reap themselves.
 363 */
 364static int ignoring_children(struct sighand_struct *sigh)
 365{
 366	int ret;
 367	spin_lock(&sigh->siglock);
 368	ret = (sigh->action[SIGCHLD-1].sa.sa_handler == SIG_IGN) ||
 369	      (sigh->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT);
 370	spin_unlock(&sigh->siglock);
 371	return ret;
 372}
 373
 374/*
 375 * Called with tasklist_lock held for writing.
 376 * Unlink a traced task, and clean it up if it was a traced zombie.
 377 * Return true if it needs to be reaped with release_task().
 378 * (We can't call release_task() here because we already hold tasklist_lock.)
 379 *
 380 * If it's a zombie, our attachedness prevented normal parent notification
 381 * or self-reaping.  Do notification now if it would have happened earlier.
 382 * If it should reap itself, return true.
 383 *
 384 * If it's our own child, there is no notification to do. But if our normal
 385 * children self-reap, then this child was prevented by ptrace and we must
 386 * reap it now, in that case we must also wake up sub-threads sleeping in
 387 * do_wait().
 388 */
 389static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
 390{
 391	bool dead;
 392
 393	__ptrace_unlink(p);
 394
 395	if (p->exit_state != EXIT_ZOMBIE)
 396		return false;
 397
 398	dead = !thread_group_leader(p);
 399
 400	if (!dead && thread_group_empty(p)) {
 401		if (!same_thread_group(p->real_parent, tracer))
 402			dead = do_notify_parent(p, p->exit_signal);
 403		else if (ignoring_children(tracer->sighand)) {
 404			__wake_up_parent(p, tracer);
 405			dead = true;
 406		}
 407	}
 408	/* Mark it as in the process of being reaped. */
 409	if (dead)
 410		p->exit_state = EXIT_DEAD;
 411	return dead;
 412}
 413
 414static int ptrace_detach(struct task_struct *child, unsigned int data)
 415{
 416	bool dead = false;
 417
 418	if (!valid_signal(data))
 419		return -EIO;
 420
 421	/* Architecture-specific hardware disable .. */
 422	ptrace_disable(child);
 423	clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 424
 425	write_lock_irq(&tasklist_lock);
 426	/*
 427	 * This child can be already killed. Make sure de_thread() or
 428	 * our sub-thread doing do_wait() didn't do release_task() yet.
 429	 */
 430	if (child->ptrace) {
 431		child->exit_code = data;
 432		dead = __ptrace_detach(current, child);
 433	}
 
 
 
 434	write_unlock_irq(&tasklist_lock);
 435
 436	proc_ptrace_connector(child, PTRACE_DETACH);
 437	if (unlikely(dead))
 438		release_task(child);
 439
 440	return 0;
 441}
 442
 443/*
 444 * Detach all tasks we were using ptrace on. Called with tasklist held
 445 * for writing, and returns with it held too. But note it can release
 446 * and reacquire the lock.
 447 */
 448void exit_ptrace(struct task_struct *tracer)
 449	__releases(&tasklist_lock)
 450	__acquires(&tasklist_lock)
 451{
 452	struct task_struct *p, *n;
 453	LIST_HEAD(ptrace_dead);
 454
 455	if (likely(list_empty(&tracer->ptraced)))
 456		return;
 457
 458	list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) {
 459		if (__ptrace_detach(tracer, p))
 460			list_add(&p->ptrace_entry, &ptrace_dead);
 461	}
 462
 463	write_unlock_irq(&tasklist_lock);
 464	BUG_ON(!list_empty(&tracer->ptraced));
 465
 466	list_for_each_entry_safe(p, n, &ptrace_dead, ptrace_entry) {
 467		list_del_init(&p->ptrace_entry);
 468		release_task(p);
 469	}
 470
 471	write_lock_irq(&tasklist_lock);
 472}
 473
 474int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len)
 475{
 476	int copied = 0;
 477
 478	while (len > 0) {
 479		char buf[128];
 480		int this_len, retval;
 481
 482		this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
 483		retval = access_process_vm(tsk, src, buf, this_len, 0);
 
 484		if (!retval) {
 485			if (copied)
 486				break;
 487			return -EIO;
 488		}
 489		if (copy_to_user(dst, buf, retval))
 490			return -EFAULT;
 491		copied += retval;
 492		src += retval;
 493		dst += retval;
 494		len -= retval;
 495	}
 496	return copied;
 497}
 498
 499int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len)
 500{
 501	int copied = 0;
 502
 503	while (len > 0) {
 504		char buf[128];
 505		int this_len, retval;
 506
 507		this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
 508		if (copy_from_user(buf, src, this_len))
 509			return -EFAULT;
 510		retval = access_process_vm(tsk, dst, buf, this_len, 1);
 
 511		if (!retval) {
 512			if (copied)
 513				break;
 514			return -EIO;
 515		}
 516		copied += retval;
 517		src += retval;
 518		dst += retval;
 519		len -= retval;
 520	}
 521	return copied;
 522}
 523
 524static int ptrace_setoptions(struct task_struct *child, unsigned long data)
 525{
 526	unsigned flags;
 527
 528	if (data & ~(unsigned long)PTRACE_O_MASK)
 529		return -EINVAL;
 530
 
 
 
 
 
 
 
 
 
 
 
 
 
 531	/* Avoid intermediate state when all opts are cleared */
 532	flags = child->ptrace;
 533	flags &= ~(PTRACE_O_MASK << PT_OPT_FLAG_SHIFT);
 534	flags |= (data << PT_OPT_FLAG_SHIFT);
 535	child->ptrace = flags;
 536
 537	return 0;
 538}
 539
 540static int ptrace_getsiginfo(struct task_struct *child, siginfo_t *info)
 541{
 542	unsigned long flags;
 543	int error = -ESRCH;
 544
 545	if (lock_task_sighand(child, &flags)) {
 546		error = -EINVAL;
 547		if (likely(child->last_siginfo != NULL)) {
 548			*info = *child->last_siginfo;
 549			error = 0;
 550		}
 551		unlock_task_sighand(child, &flags);
 552	}
 553	return error;
 554}
 555
 556static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
 557{
 558	unsigned long flags;
 559	int error = -ESRCH;
 560
 561	if (lock_task_sighand(child, &flags)) {
 562		error = -EINVAL;
 563		if (likely(child->last_siginfo != NULL)) {
 564			*child->last_siginfo = *info;
 565			error = 0;
 566		}
 567		unlock_task_sighand(child, &flags);
 568	}
 569	return error;
 570}
 571
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 572
 573#ifdef PTRACE_SINGLESTEP
 574#define is_singlestep(request)		((request) == PTRACE_SINGLESTEP)
 575#else
 576#define is_singlestep(request)		0
 577#endif
 578
 579#ifdef PTRACE_SINGLEBLOCK
 580#define is_singleblock(request)		((request) == PTRACE_SINGLEBLOCK)
 581#else
 582#define is_singleblock(request)		0
 583#endif
 584
 585#ifdef PTRACE_SYSEMU
 586#define is_sysemu_singlestep(request)	((request) == PTRACE_SYSEMU_SINGLESTEP)
 587#else
 588#define is_sysemu_singlestep(request)	0
 589#endif
 590
 591static int ptrace_resume(struct task_struct *child, long request,
 592			 unsigned long data)
 593{
 
 
 594	if (!valid_signal(data))
 595		return -EIO;
 596
 597	if (request == PTRACE_SYSCALL)
 598		set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 599	else
 600		clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 601
 602#ifdef TIF_SYSCALL_EMU
 603	if (request == PTRACE_SYSEMU || request == PTRACE_SYSEMU_SINGLESTEP)
 604		set_tsk_thread_flag(child, TIF_SYSCALL_EMU);
 605	else
 606		clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
 607#endif
 608
 609	if (is_singleblock(request)) {
 610		if (unlikely(!arch_has_block_step()))
 611			return -EIO;
 612		user_enable_block_step(child);
 613	} else if (is_singlestep(request) || is_sysemu_singlestep(request)) {
 614		if (unlikely(!arch_has_single_step()))
 615			return -EIO;
 616		user_enable_single_step(child);
 617	} else {
 618		user_disable_single_step(child);
 619	}
 620
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 621	child->exit_code = data;
 622	wake_up_state(child, __TASK_TRACED);
 
 
 623
 624	return 0;
 625}
 626
 627#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
 628
 629static const struct user_regset *
 630find_regset(const struct user_regset_view *view, unsigned int type)
 631{
 632	const struct user_regset *regset;
 633	int n;
 634
 635	for (n = 0; n < view->n; ++n) {
 636		regset = view->regsets + n;
 637		if (regset->core_note_type == type)
 638			return regset;
 639	}
 640
 641	return NULL;
 642}
 643
 644static int ptrace_regset(struct task_struct *task, int req, unsigned int type,
 645			 struct iovec *kiov)
 646{
 647	const struct user_regset_view *view = task_user_regset_view(task);
 648	const struct user_regset *regset = find_regset(view, type);
 649	int regset_no;
 650
 651	if (!regset || (kiov->iov_len % regset->size) != 0)
 652		return -EINVAL;
 653
 654	regset_no = regset - view->regsets;
 655	kiov->iov_len = min(kiov->iov_len,
 656			    (__kernel_size_t) (regset->n * regset->size));
 657
 658	if (req == PTRACE_GETREGSET)
 659		return copy_regset_to_user(task, view, regset_no, 0,
 660					   kiov->iov_len, kiov->iov_base);
 661	else
 662		return copy_regset_from_user(task, view, regset_no, 0,
 663					     kiov->iov_len, kiov->iov_base);
 664}
 665
 
 
 
 
 
 
 666#endif
 667
 668int ptrace_request(struct task_struct *child, long request,
 669		   unsigned long addr, unsigned long data)
 670{
 671	bool seized = child->ptrace & PT_SEIZED;
 672	int ret = -EIO;
 673	siginfo_t siginfo, *si;
 674	void __user *datavp = (void __user *) data;
 675	unsigned long __user *datalp = datavp;
 676	unsigned long flags;
 677
 678	switch (request) {
 679	case PTRACE_PEEKTEXT:
 680	case PTRACE_PEEKDATA:
 681		return generic_ptrace_peekdata(child, addr, data);
 682	case PTRACE_POKETEXT:
 683	case PTRACE_POKEDATA:
 684		return generic_ptrace_pokedata(child, addr, data);
 685
 686#ifdef PTRACE_OLDSETOPTIONS
 687	case PTRACE_OLDSETOPTIONS:
 688#endif
 689	case PTRACE_SETOPTIONS:
 690		ret = ptrace_setoptions(child, data);
 691		break;
 692	case PTRACE_GETEVENTMSG:
 693		ret = put_user(child->ptrace_message, datalp);
 694		break;
 695
 
 
 
 
 696	case PTRACE_GETSIGINFO:
 697		ret = ptrace_getsiginfo(child, &siginfo);
 698		if (!ret)
 699			ret = copy_siginfo_to_user(datavp, &siginfo);
 700		break;
 701
 702	case PTRACE_SETSIGINFO:
 703		if (copy_from_user(&siginfo, datavp, sizeof siginfo))
 704			ret = -EFAULT;
 705		else
 706			ret = ptrace_setsiginfo(child, &siginfo);
 707		break;
 708
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 709	case PTRACE_INTERRUPT:
 710		/*
 711		 * Stop tracee without any side-effect on signal or job
 712		 * control.  At least one trap is guaranteed to happen
 713		 * after this request.  If @child is already trapped, the
 714		 * current trap is not disturbed and another trap will
 715		 * happen after the current trap is ended with PTRACE_CONT.
 716		 *
 717		 * The actual trap might not be PTRACE_EVENT_STOP trap but
 718		 * the pending condition is cleared regardless.
 719		 */
 720		if (unlikely(!seized || !lock_task_sighand(child, &flags)))
 721			break;
 722
 723		/*
 724		 * INTERRUPT doesn't disturb existing trap sans one
 725		 * exception.  If ptracer issued LISTEN for the current
 726		 * STOP, this INTERRUPT should clear LISTEN and re-trap
 727		 * tracee into STOP.
 728		 */
 729		if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP)))
 730			signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
 731
 732		unlock_task_sighand(child, &flags);
 733		ret = 0;
 734		break;
 735
 736	case PTRACE_LISTEN:
 737		/*
 738		 * Listen for events.  Tracee must be in STOP.  It's not
 739		 * resumed per-se but is not considered to be in TRACED by
 740		 * wait(2) or ptrace(2).  If an async event (e.g. group
 741		 * stop state change) happens, tracee will enter STOP trap
 742		 * again.  Alternatively, ptracer can issue INTERRUPT to
 743		 * finish listening and re-trap tracee into STOP.
 744		 */
 745		if (unlikely(!seized || !lock_task_sighand(child, &flags)))
 746			break;
 747
 748		si = child->last_siginfo;
 749		if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) {
 750			child->jobctl |= JOBCTL_LISTENING;
 751			/*
 752			 * If NOTIFY is set, it means event happened between
 753			 * start of this trap and now.  Trigger re-trap.
 754			 */
 755			if (child->jobctl & JOBCTL_TRAP_NOTIFY)
 756				signal_wake_up(child, true);
 757			ret = 0;
 758		}
 759		unlock_task_sighand(child, &flags);
 760		break;
 761
 762	case PTRACE_DETACH:	 /* detach a process that was attached. */
 763		ret = ptrace_detach(child, data);
 764		break;
 765
 766#ifdef CONFIG_BINFMT_ELF_FDPIC
 767	case PTRACE_GETFDPIC: {
 768		struct mm_struct *mm = get_task_mm(child);
 769		unsigned long tmp = 0;
 770
 771		ret = -ESRCH;
 772		if (!mm)
 773			break;
 774
 775		switch (addr) {
 776		case PTRACE_GETFDPIC_EXEC:
 777			tmp = mm->context.exec_fdpic_loadmap;
 778			break;
 779		case PTRACE_GETFDPIC_INTERP:
 780			tmp = mm->context.interp_fdpic_loadmap;
 781			break;
 782		default:
 783			break;
 784		}
 785		mmput(mm);
 786
 787		ret = put_user(tmp, datalp);
 788		break;
 789	}
 790#endif
 791
 792#ifdef PTRACE_SINGLESTEP
 793	case PTRACE_SINGLESTEP:
 794#endif
 795#ifdef PTRACE_SINGLEBLOCK
 796	case PTRACE_SINGLEBLOCK:
 797#endif
 798#ifdef PTRACE_SYSEMU
 799	case PTRACE_SYSEMU:
 800	case PTRACE_SYSEMU_SINGLESTEP:
 801#endif
 802	case PTRACE_SYSCALL:
 803	case PTRACE_CONT:
 804		return ptrace_resume(child, request, data);
 805
 806	case PTRACE_KILL:
 807		if (child->exit_state)	/* already dead */
 808			return 0;
 809		return ptrace_resume(child, request, SIGKILL);
 810
 811#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
 812	case PTRACE_GETREGSET:
 813	case PTRACE_SETREGSET:
 814	{
 815		struct iovec kiov;
 816		struct iovec __user *uiov = datavp;
 817
 818		if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
 819			return -EFAULT;
 820
 821		if (__get_user(kiov.iov_base, &uiov->iov_base) ||
 822		    __get_user(kiov.iov_len, &uiov->iov_len))
 823			return -EFAULT;
 824
 825		ret = ptrace_regset(child, request, addr, &kiov);
 826		if (!ret)
 827			ret = __put_user(kiov.iov_len, &uiov->iov_len);
 828		break;
 829	}
 830#endif
 
 
 
 
 
 831	default:
 832		break;
 833	}
 834
 835	return ret;
 836}
 837
 838static struct task_struct *ptrace_get_task_struct(pid_t pid)
 839{
 840	struct task_struct *child;
 841
 842	rcu_read_lock();
 843	child = find_task_by_vpid(pid);
 844	if (child)
 845		get_task_struct(child);
 846	rcu_read_unlock();
 847
 848	if (!child)
 849		return ERR_PTR(-ESRCH);
 850	return child;
 851}
 852
 853#ifndef arch_ptrace_attach
 854#define arch_ptrace_attach(child)	do { } while (0)
 855#endif
 856
 857SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
 858		unsigned long, data)
 859{
 860	struct task_struct *child;
 861	long ret;
 862
 863	if (request == PTRACE_TRACEME) {
 864		ret = ptrace_traceme();
 865		if (!ret)
 866			arch_ptrace_attach(current);
 867		goto out;
 868	}
 869
 870	child = ptrace_get_task_struct(pid);
 871	if (IS_ERR(child)) {
 872		ret = PTR_ERR(child);
 873		goto out;
 874	}
 875
 876	if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
 877		ret = ptrace_attach(child, request, addr, data);
 878		/*
 879		 * Some architectures need to do book-keeping after
 880		 * a ptrace attach.
 881		 */
 882		if (!ret)
 883			arch_ptrace_attach(child);
 884		goto out_put_task_struct;
 885	}
 886
 887	ret = ptrace_check_attach(child, request == PTRACE_KILL ||
 888				  request == PTRACE_INTERRUPT);
 889	if (ret < 0)
 890		goto out_put_task_struct;
 891
 892	ret = arch_ptrace(child, request, addr, data);
 
 
 893
 894 out_put_task_struct:
 895	put_task_struct(child);
 896 out:
 897	return ret;
 898}
 899
 900int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
 901			    unsigned long data)
 902{
 903	unsigned long tmp;
 904	int copied;
 905
 906	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
 907	if (copied != sizeof(tmp))
 908		return -EIO;
 909	return put_user(tmp, (unsigned long __user *)data);
 910}
 911
 912int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
 913			    unsigned long data)
 914{
 915	int copied;
 916
 917	copied = access_process_vm(tsk, addr, &data, sizeof(data), 1);
 
 918	return (copied == sizeof(data)) ? 0 : -EIO;
 919}
 920
 921#if defined CONFIG_COMPAT
 922#include <linux/compat.h>
 923
 924int compat_ptrace_request(struct task_struct *child, compat_long_t request,
 925			  compat_ulong_t addr, compat_ulong_t data)
 926{
 927	compat_ulong_t __user *datap = compat_ptr(data);
 928	compat_ulong_t word;
 929	siginfo_t siginfo;
 930	int ret;
 931
 932	switch (request) {
 933	case PTRACE_PEEKTEXT:
 934	case PTRACE_PEEKDATA:
 935		ret = access_process_vm(child, addr, &word, sizeof(word), 0);
 
 936		if (ret != sizeof(word))
 937			ret = -EIO;
 938		else
 939			ret = put_user(word, datap);
 940		break;
 941
 942	case PTRACE_POKETEXT:
 943	case PTRACE_POKEDATA:
 944		ret = access_process_vm(child, addr, &data, sizeof(data), 1);
 
 945		ret = (ret != sizeof(data) ? -EIO : 0);
 946		break;
 947
 948	case PTRACE_GETEVENTMSG:
 949		ret = put_user((compat_ulong_t) child->ptrace_message, datap);
 950		break;
 951
 952	case PTRACE_GETSIGINFO:
 953		ret = ptrace_getsiginfo(child, &siginfo);
 954		if (!ret)
 955			ret = copy_siginfo_to_user32(
 956				(struct compat_siginfo __user *) datap,
 957				&siginfo);
 958		break;
 959
 960	case PTRACE_SETSIGINFO:
 961		memset(&siginfo, 0, sizeof siginfo);
 962		if (copy_siginfo_from_user32(
 963			    &siginfo, (struct compat_siginfo __user *) datap))
 964			ret = -EFAULT;
 965		else
 966			ret = ptrace_setsiginfo(child, &siginfo);
 967		break;
 968#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
 969	case PTRACE_GETREGSET:
 970	case PTRACE_SETREGSET:
 971	{
 972		struct iovec kiov;
 973		struct compat_iovec __user *uiov =
 974			(struct compat_iovec __user *) datap;
 975		compat_uptr_t ptr;
 976		compat_size_t len;
 977
 978		if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
 979			return -EFAULT;
 980
 981		if (__get_user(ptr, &uiov->iov_base) ||
 982		    __get_user(len, &uiov->iov_len))
 983			return -EFAULT;
 984
 985		kiov.iov_base = compat_ptr(ptr);
 986		kiov.iov_len = len;
 987
 988		ret = ptrace_regset(child, request, addr, &kiov);
 989		if (!ret)
 990			ret = __put_user(kiov.iov_len, &uiov->iov_len);
 991		break;
 992	}
 993#endif
 994
 995	default:
 996		ret = ptrace_request(child, request, addr, data);
 997	}
 998
 999	return ret;
1000}
1001
1002asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
1003				  compat_long_t addr, compat_long_t data)
1004{
1005	struct task_struct *child;
1006	long ret;
1007
1008	if (request == PTRACE_TRACEME) {
1009		ret = ptrace_traceme();
1010		goto out;
1011	}
1012
1013	child = ptrace_get_task_struct(pid);
1014	if (IS_ERR(child)) {
1015		ret = PTR_ERR(child);
1016		goto out;
1017	}
1018
1019	if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
1020		ret = ptrace_attach(child, request, addr, data);
1021		/*
1022		 * Some architectures need to do book-keeping after
1023		 * a ptrace attach.
1024		 */
1025		if (!ret)
1026			arch_ptrace_attach(child);
1027		goto out_put_task_struct;
1028	}
1029
1030	ret = ptrace_check_attach(child, request == PTRACE_KILL ||
1031				  request == PTRACE_INTERRUPT);
1032	if (!ret)
1033		ret = compat_arch_ptrace(child, request, addr, data);
 
 
 
1034
1035 out_put_task_struct:
1036	put_task_struct(child);
1037 out:
1038	return ret;
1039}
1040#endif	/* CONFIG_COMPAT */
1041
1042#ifdef CONFIG_HAVE_HW_BREAKPOINT
1043int ptrace_get_breakpoints(struct task_struct *tsk)
1044{
1045	if (atomic_inc_not_zero(&tsk->ptrace_bp_refcnt))
1046		return 0;
1047
1048	return -1;
1049}
1050
1051void ptrace_put_breakpoints(struct task_struct *tsk)
1052{
1053	if (atomic_dec_and_test(&tsk->ptrace_bp_refcnt))
1054		flush_ptrace_hw_breakpoint(tsk);
1055}
1056#endif /* CONFIG_HAVE_HW_BREAKPOINT */
v4.10.11
   1/*
   2 * linux/kernel/ptrace.c
   3 *
   4 * (C) Copyright 1999 Linus Torvalds
   5 *
   6 * Common interfaces for "ptrace()" which we do not want
   7 * to continually duplicate across every architecture.
   8 */
   9
  10#include <linux/capability.h>
  11#include <linux/export.h>
  12#include <linux/sched.h>
  13#include <linux/errno.h>
  14#include <linux/mm.h>
  15#include <linux/highmem.h>
  16#include <linux/pagemap.h>
  17#include <linux/ptrace.h>
  18#include <linux/security.h>
  19#include <linux/signal.h>
  20#include <linux/uio.h>
  21#include <linux/audit.h>
  22#include <linux/pid_namespace.h>
  23#include <linux/syscalls.h>
  24#include <linux/uaccess.h>
  25#include <linux/regset.h>
  26#include <linux/hw_breakpoint.h>
  27#include <linux/cn_proc.h>
  28#include <linux/compat.h>
  29
  30/*
  31 * Access another process' address space via ptrace.
  32 * Source/target buffer must be kernel space,
  33 * Do not walk the page table directly, use get_user_pages
  34 */
  35int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
  36		     void *buf, int len, unsigned int gup_flags)
  37{
  38	struct mm_struct *mm;
  39	int ret;
  40
  41	mm = get_task_mm(tsk);
  42	if (!mm)
  43		return 0;
  44
  45	if (!tsk->ptrace ||
  46	    (current != tsk->parent) ||
  47	    ((get_dumpable(mm) != SUID_DUMP_USER) &&
  48	     !ptracer_capable(tsk, mm->user_ns))) {
  49		mmput(mm);
  50		return 0;
  51	}
  52
  53	ret = __access_remote_vm(tsk, mm, addr, buf, len, gup_flags);
  54	mmput(mm);
  55
  56	return ret;
  57}
  58
  59
  60/*
  61 * ptrace a task: make the debugger its new parent and
  62 * move it to the ptrace list.
  63 *
  64 * Must be called with the tasklist lock write-held.
  65 */
  66void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
  67{
  68	BUG_ON(!list_empty(&child->ptrace_entry));
  69	list_add(&child->ptrace_entry, &new_parent->ptraced);
  70	child->parent = new_parent;
  71	rcu_read_lock();
  72	child->ptracer_cred = get_cred(__task_cred(new_parent));
  73	rcu_read_unlock();
  74}
  75
  76/**
  77 * __ptrace_unlink - unlink ptracee and restore its execution state
  78 * @child: ptracee to be unlinked
  79 *
  80 * Remove @child from the ptrace list, move it back to the original parent,
  81 * and restore the execution state so that it conforms to the group stop
  82 * state.
  83 *
  84 * Unlinking can happen via two paths - explicit PTRACE_DETACH or ptracer
  85 * exiting.  For PTRACE_DETACH, unless the ptracee has been killed between
  86 * ptrace_check_attach() and here, it's guaranteed to be in TASK_TRACED.
  87 * If the ptracer is exiting, the ptracee can be in any state.
  88 *
  89 * After detach, the ptracee should be in a state which conforms to the
  90 * group stop.  If the group is stopped or in the process of stopping, the
  91 * ptracee should be put into TASK_STOPPED; otherwise, it should be woken
  92 * up from TASK_TRACED.
  93 *
  94 * If the ptracee is in TASK_TRACED and needs to be moved to TASK_STOPPED,
  95 * it goes through TRACED -> RUNNING -> STOPPED transition which is similar
  96 * to but in the opposite direction of what happens while attaching to a
  97 * stopped task.  However, in this direction, the intermediate RUNNING
  98 * state is not hidden even from the current ptracer and if it immediately
  99 * re-attaches and performs a WNOHANG wait(2), it may fail.
 100 *
 101 * CONTEXT:
 102 * write_lock_irq(tasklist_lock)
 103 */
 104void __ptrace_unlink(struct task_struct *child)
 105{
 106	const struct cred *old_cred;
 107	BUG_ON(!child->ptrace);
 108
 109	clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 110
 111	child->parent = child->real_parent;
 112	list_del_init(&child->ptrace_entry);
 113	old_cred = child->ptracer_cred;
 114	child->ptracer_cred = NULL;
 115	put_cred(old_cred);
 116
 117	spin_lock(&child->sighand->siglock);
 118	child->ptrace = 0;
 119	/*
 120	 * Clear all pending traps and TRAPPING.  TRAPPING should be
 121	 * cleared regardless of JOBCTL_STOP_PENDING.  Do it explicitly.
 122	 */
 123	task_clear_jobctl_pending(child, JOBCTL_TRAP_MASK);
 124	task_clear_jobctl_trapping(child);
 125
 126	/*
 127	 * Reinstate JOBCTL_STOP_PENDING if group stop is in effect and
 128	 * @child isn't dead.
 129	 */
 130	if (!(child->flags & PF_EXITING) &&
 131	    (child->signal->flags & SIGNAL_STOP_STOPPED ||
 132	     child->signal->group_stop_count)) {
 133		child->jobctl |= JOBCTL_STOP_PENDING;
 134
 135		/*
 136		 * This is only possible if this thread was cloned by the
 137		 * traced task running in the stopped group, set the signal
 138		 * for the future reports.
 139		 * FIXME: we should change ptrace_init_task() to handle this
 140		 * case.
 141		 */
 142		if (!(child->jobctl & JOBCTL_STOP_SIGMASK))
 143			child->jobctl |= SIGSTOP;
 144	}
 145
 146	/*
 147	 * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick
 148	 * @child in the butt.  Note that @resume should be used iff @child
 149	 * is in TASK_TRACED; otherwise, we might unduly disrupt
 150	 * TASK_KILLABLE sleeps.
 151	 */
 152	if (child->jobctl & JOBCTL_STOP_PENDING || task_is_traced(child))
 153		ptrace_signal_wake_up(child, true);
 154
 155	spin_unlock(&child->sighand->siglock);
 156}
 157
 158/* Ensure that nothing can wake it up, even SIGKILL */
 159static bool ptrace_freeze_traced(struct task_struct *task)
 160{
 161	bool ret = false;
 162
 163	/* Lockless, nobody but us can set this flag */
 164	if (task->jobctl & JOBCTL_LISTENING)
 165		return ret;
 166
 167	spin_lock_irq(&task->sighand->siglock);
 168	if (task_is_traced(task) && !__fatal_signal_pending(task)) {
 169		task->state = __TASK_TRACED;
 170		ret = true;
 171	}
 172	spin_unlock_irq(&task->sighand->siglock);
 173
 174	return ret;
 175}
 176
 177static void ptrace_unfreeze_traced(struct task_struct *task)
 178{
 179	if (task->state != __TASK_TRACED)
 180		return;
 181
 182	WARN_ON(!task->ptrace || task->parent != current);
 183
 184	/*
 185	 * PTRACE_LISTEN can allow ptrace_trap_notify to wake us up remotely.
 186	 * Recheck state under the lock to close this race.
 187	 */
 188	spin_lock_irq(&task->sighand->siglock);
 189	if (task->state == __TASK_TRACED) {
 190		if (__fatal_signal_pending(task))
 191			wake_up_state(task, __TASK_TRACED);
 192		else
 193			task->state = TASK_TRACED;
 194	}
 195	spin_unlock_irq(&task->sighand->siglock);
 196}
 197
 198/**
 199 * ptrace_check_attach - check whether ptracee is ready for ptrace operation
 200 * @child: ptracee to check for
 201 * @ignore_state: don't check whether @child is currently %TASK_TRACED
 202 *
 203 * Check whether @child is being ptraced by %current and ready for further
 204 * ptrace operations.  If @ignore_state is %false, @child also should be in
 205 * %TASK_TRACED state and on return the child is guaranteed to be traced
 206 * and not executing.  If @ignore_state is %true, @child can be in any
 207 * state.
 208 *
 209 * CONTEXT:
 210 * Grabs and releases tasklist_lock and @child->sighand->siglock.
 211 *
 212 * RETURNS:
 213 * 0 on success, -ESRCH if %child is not ready.
 214 */
 215static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
 216{
 217	int ret = -ESRCH;
 218
 219	/*
 220	 * We take the read lock around doing both checks to close a
 221	 * possible race where someone else was tracing our child and
 222	 * detached between these two checks.  After this locked check,
 223	 * we are sure that this is our traced child and that can only
 224	 * be changed by us so it's not changing right after this.
 225	 */
 226	read_lock(&tasklist_lock);
 227	if (child->ptrace && child->parent == current) {
 228		WARN_ON(child->state == __TASK_TRACED);
 229		/*
 230		 * child->sighand can't be NULL, release_task()
 231		 * does ptrace_unlink() before __exit_signal().
 232		 */
 233		if (ignore_state || ptrace_freeze_traced(child))
 
 
 
 234			ret = 0;
 
 235	}
 236	read_unlock(&tasklist_lock);
 237
 238	if (!ret && !ignore_state) {
 239		if (!wait_task_inactive(child, __TASK_TRACED)) {
 240			/*
 241			 * This can only happen if may_ptrace_stop() fails and
 242			 * ptrace_stop() changes ->state back to TASK_RUNNING,
 243			 * so we should not worry about leaking __TASK_TRACED.
 244			 */
 245			WARN_ON(child->state == __TASK_TRACED);
 246			ret = -ESRCH;
 247		}
 248	}
 249
 
 250	return ret;
 251}
 252
 253static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
 254{
 255	if (mode & PTRACE_MODE_NOAUDIT)
 256		return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
 257	else
 258		return has_ns_capability(current, ns, CAP_SYS_PTRACE);
 259}
 260
 261/* Returns 0 on success, -errno on denial. */
 262static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
 263{
 264	const struct cred *cred = current_cred(), *tcred;
 265	struct mm_struct *mm;
 266	kuid_t caller_uid;
 267	kgid_t caller_gid;
 268
 269	if (!(mode & PTRACE_MODE_FSCREDS) == !(mode & PTRACE_MODE_REALCREDS)) {
 270		WARN(1, "denying ptrace access check without PTRACE_MODE_*CREDS\n");
 271		return -EPERM;
 272	}
 273
 274	/* May we inspect the given task?
 275	 * This check is used both for attaching with ptrace
 276	 * and for allowing access to sensitive information in /proc.
 277	 *
 278	 * ptrace_attach denies several cases that /proc allows
 279	 * because setting up the necessary parent/child relationship
 280	 * or halting the specified task is impossible.
 281	 */
 282
 283	/* Don't let security modules deny introspection */
 284	if (same_thread_group(task, current))
 285		return 0;
 286	rcu_read_lock();
 287	if (mode & PTRACE_MODE_FSCREDS) {
 288		caller_uid = cred->fsuid;
 289		caller_gid = cred->fsgid;
 290	} else {
 291		/*
 292		 * Using the euid would make more sense here, but something
 293		 * in userland might rely on the old behavior, and this
 294		 * shouldn't be a security problem since
 295		 * PTRACE_MODE_REALCREDS implies that the caller explicitly
 296		 * used a syscall that requests access to another process
 297		 * (and not a filesystem syscall to procfs).
 298		 */
 299		caller_uid = cred->uid;
 300		caller_gid = cred->gid;
 301	}
 302	tcred = __task_cred(task);
 303	if (uid_eq(caller_uid, tcred->euid) &&
 304	    uid_eq(caller_uid, tcred->suid) &&
 305	    uid_eq(caller_uid, tcred->uid)  &&
 306	    gid_eq(caller_gid, tcred->egid) &&
 307	    gid_eq(caller_gid, tcred->sgid) &&
 308	    gid_eq(caller_gid, tcred->gid))
 309		goto ok;
 310	if (ptrace_has_cap(tcred->user_ns, mode))
 311		goto ok;
 312	rcu_read_unlock();
 313	return -EPERM;
 314ok:
 315	rcu_read_unlock();
 316	mm = task->mm;
 317	if (mm &&
 318	    ((get_dumpable(mm) != SUID_DUMP_USER) &&
 319	     !ptrace_has_cap(mm->user_ns, mode)))
 320	    return -EPERM;
 321
 322	return security_ptrace_access_check(task, mode);
 323}
 324
 325bool ptrace_may_access(struct task_struct *task, unsigned int mode)
 326{
 327	int err;
 328	task_lock(task);
 329	err = __ptrace_may_access(task, mode);
 330	task_unlock(task);
 331	return !err;
 332}
 333
 334static int ptrace_attach(struct task_struct *task, long request,
 335			 unsigned long addr,
 336			 unsigned long flags)
 337{
 338	bool seize = (request == PTRACE_SEIZE);
 339	int retval;
 340
 341	retval = -EIO;
 342	if (seize) {
 343		if (addr != 0)
 344			goto out;
 345		if (flags & ~(unsigned long)PTRACE_O_MASK)
 346			goto out;
 347		flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT);
 348	} else {
 349		flags = PT_PTRACED;
 350	}
 351
 352	audit_ptrace(task);
 353
 354	retval = -EPERM;
 355	if (unlikely(task->flags & PF_KTHREAD))
 356		goto out;
 357	if (same_thread_group(task, current))
 358		goto out;
 359
 360	/*
 361	 * Protect exec's credential calculations against our interference;
 362	 * SUID, SGID and LSM creds get determined differently
 363	 * under ptrace.
 364	 */
 365	retval = -ERESTARTNOINTR;
 366	if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))
 367		goto out;
 368
 369	task_lock(task);
 370	retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS);
 371	task_unlock(task);
 372	if (retval)
 373		goto unlock_creds;
 374
 375	write_lock_irq(&tasklist_lock);
 376	retval = -EPERM;
 377	if (unlikely(task->exit_state))
 378		goto unlock_tasklist;
 379	if (task->ptrace)
 380		goto unlock_tasklist;
 381
 382	if (seize)
 383		flags |= PT_SEIZED;
 
 
 384	task->ptrace = flags;
 385
 386	__ptrace_link(task, current);
 387
 388	/* SEIZE doesn't trap tracee on attach */
 389	if (!seize)
 390		send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);
 391
 392	spin_lock(&task->sighand->siglock);
 393
 394	/*
 395	 * If the task is already STOPPED, set JOBCTL_TRAP_STOP and
 396	 * TRAPPING, and kick it so that it transits to TRACED.  TRAPPING
 397	 * will be cleared if the child completes the transition or any
 398	 * event which clears the group stop states happens.  We'll wait
 399	 * for the transition to complete before returning from this
 400	 * function.
 401	 *
 402	 * This hides STOPPED -> RUNNING -> TRACED transition from the
 403	 * attaching thread but a different thread in the same group can
 404	 * still observe the transient RUNNING state.  IOW, if another
 405	 * thread's WNOHANG wait(2) on the stopped tracee races against
 406	 * ATTACH, the wait(2) may fail due to the transient RUNNING.
 407	 *
 408	 * The following task_is_stopped() test is safe as both transitions
 409	 * in and out of STOPPED are protected by siglock.
 410	 */
 411	if (task_is_stopped(task) &&
 412	    task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING))
 413		signal_wake_up_state(task, __TASK_STOPPED);
 414
 415	spin_unlock(&task->sighand->siglock);
 416
 417	retval = 0;
 418unlock_tasklist:
 419	write_unlock_irq(&tasklist_lock);
 420unlock_creds:
 421	mutex_unlock(&task->signal->cred_guard_mutex);
 422out:
 423	if (!retval) {
 424		/*
 425		 * We do not bother to change retval or clear JOBCTL_TRAPPING
 426		 * if wait_on_bit() was interrupted by SIGKILL. The tracer will
 427		 * not return to user-mode, it will exit and clear this bit in
 428		 * __ptrace_unlink() if it wasn't already cleared by the tracee;
 429		 * and until then nobody can ptrace this task.
 430		 */
 431		wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT, TASK_KILLABLE);
 432		proc_ptrace_connector(task, PTRACE_ATTACH);
 433	}
 434
 435	return retval;
 436}
 437
 438/**
 439 * ptrace_traceme  --  helper for PTRACE_TRACEME
 440 *
 441 * Performs checks and sets PT_PTRACED.
 442 * Should be used by all ptrace implementations for PTRACE_TRACEME.
 443 */
 444static int ptrace_traceme(void)
 445{
 446	int ret = -EPERM;
 447
 448	write_lock_irq(&tasklist_lock);
 449	/* Are we already being traced? */
 450	if (!current->ptrace) {
 451		ret = security_ptrace_traceme(current->parent);
 452		/*
 453		 * Check PF_EXITING to ensure ->real_parent has not passed
 454		 * exit_ptrace(). Otherwise we don't report the error but
 455		 * pretend ->real_parent untraces us right after return.
 456		 */
 457		if (!ret && !(current->real_parent->flags & PF_EXITING)) {
 458			current->ptrace = PT_PTRACED;
 459			__ptrace_link(current, current->real_parent);
 460		}
 461	}
 462	write_unlock_irq(&tasklist_lock);
 463
 464	return ret;
 465}
 466
 467/*
 468 * Called with irqs disabled, returns true if childs should reap themselves.
 469 */
 470static int ignoring_children(struct sighand_struct *sigh)
 471{
 472	int ret;
 473	spin_lock(&sigh->siglock);
 474	ret = (sigh->action[SIGCHLD-1].sa.sa_handler == SIG_IGN) ||
 475	      (sigh->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT);
 476	spin_unlock(&sigh->siglock);
 477	return ret;
 478}
 479
 480/*
 481 * Called with tasklist_lock held for writing.
 482 * Unlink a traced task, and clean it up if it was a traced zombie.
 483 * Return true if it needs to be reaped with release_task().
 484 * (We can't call release_task() here because we already hold tasklist_lock.)
 485 *
 486 * If it's a zombie, our attachedness prevented normal parent notification
 487 * or self-reaping.  Do notification now if it would have happened earlier.
 488 * If it should reap itself, return true.
 489 *
 490 * If it's our own child, there is no notification to do. But if our normal
 491 * children self-reap, then this child was prevented by ptrace and we must
 492 * reap it now, in that case we must also wake up sub-threads sleeping in
 493 * do_wait().
 494 */
 495static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
 496{
 497	bool dead;
 498
 499	__ptrace_unlink(p);
 500
 501	if (p->exit_state != EXIT_ZOMBIE)
 502		return false;
 503
 504	dead = !thread_group_leader(p);
 505
 506	if (!dead && thread_group_empty(p)) {
 507		if (!same_thread_group(p->real_parent, tracer))
 508			dead = do_notify_parent(p, p->exit_signal);
 509		else if (ignoring_children(tracer->sighand)) {
 510			__wake_up_parent(p, tracer);
 511			dead = true;
 512		}
 513	}
 514	/* Mark it as in the process of being reaped. */
 515	if (dead)
 516		p->exit_state = EXIT_DEAD;
 517	return dead;
 518}
 519
 520static int ptrace_detach(struct task_struct *child, unsigned int data)
 521{
 
 
 522	if (!valid_signal(data))
 523		return -EIO;
 524
 525	/* Architecture-specific hardware disable .. */
 526	ptrace_disable(child);
 
 527
 528	write_lock_irq(&tasklist_lock);
 529	/*
 530	 * We rely on ptrace_freeze_traced(). It can't be killed and
 531	 * untraced by another thread, it can't be a zombie.
 532	 */
 533	WARN_ON(!child->ptrace || child->exit_state);
 534	/*
 535	 * tasklist_lock avoids the race with wait_task_stopped(), see
 536	 * the comment in ptrace_resume().
 537	 */
 538	child->exit_code = data;
 539	__ptrace_detach(current, child);
 540	write_unlock_irq(&tasklist_lock);
 541
 542	proc_ptrace_connector(child, PTRACE_DETACH);
 
 
 543
 544	return 0;
 545}
 546
 547/*
 548 * Detach all tasks we were using ptrace on. Called with tasklist held
 549 * for writing.
 
 550 */
 551void exit_ptrace(struct task_struct *tracer, struct list_head *dead)
 
 
 552{
 553	struct task_struct *p, *n;
 
 
 
 
 554
 555	list_for_each_entry_safe(p, n, &tracer->ptraced, ptrace_entry) {
 556		if (unlikely(p->ptrace & PT_EXITKILL))
 557			send_sig_info(SIGKILL, SEND_SIG_FORCED, p);
 
 
 
 
 558
 559		if (__ptrace_detach(tracer, p))
 560			list_add(&p->ptrace_entry, dead);
 
 561	}
 
 
 562}
 563
 564int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len)
 565{
 566	int copied = 0;
 567
 568	while (len > 0) {
 569		char buf[128];
 570		int this_len, retval;
 571
 572		this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
 573		retval = ptrace_access_vm(tsk, src, buf, this_len, FOLL_FORCE);
 574
 575		if (!retval) {
 576			if (copied)
 577				break;
 578			return -EIO;
 579		}
 580		if (copy_to_user(dst, buf, retval))
 581			return -EFAULT;
 582		copied += retval;
 583		src += retval;
 584		dst += retval;
 585		len -= retval;
 586	}
 587	return copied;
 588}
 589
 590int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len)
 591{
 592	int copied = 0;
 593
 594	while (len > 0) {
 595		char buf[128];
 596		int this_len, retval;
 597
 598		this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
 599		if (copy_from_user(buf, src, this_len))
 600			return -EFAULT;
 601		retval = ptrace_access_vm(tsk, dst, buf, this_len,
 602				FOLL_FORCE | FOLL_WRITE);
 603		if (!retval) {
 604			if (copied)
 605				break;
 606			return -EIO;
 607		}
 608		copied += retval;
 609		src += retval;
 610		dst += retval;
 611		len -= retval;
 612	}
 613	return copied;
 614}
 615
 616static int ptrace_setoptions(struct task_struct *child, unsigned long data)
 617{
 618	unsigned flags;
 619
 620	if (data & ~(unsigned long)PTRACE_O_MASK)
 621		return -EINVAL;
 622
 623	if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {
 624		if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) ||
 625		    !IS_ENABLED(CONFIG_SECCOMP))
 626			return -EINVAL;
 627
 628		if (!capable(CAP_SYS_ADMIN))
 629			return -EPERM;
 630
 631		if (seccomp_mode(&current->seccomp) != SECCOMP_MODE_DISABLED ||
 632		    current->ptrace & PT_SUSPEND_SECCOMP)
 633			return -EPERM;
 634	}
 635
 636	/* Avoid intermediate state when all opts are cleared */
 637	flags = child->ptrace;
 638	flags &= ~(PTRACE_O_MASK << PT_OPT_FLAG_SHIFT);
 639	flags |= (data << PT_OPT_FLAG_SHIFT);
 640	child->ptrace = flags;
 641
 642	return 0;
 643}
 644
 645static int ptrace_getsiginfo(struct task_struct *child, siginfo_t *info)
 646{
 647	unsigned long flags;
 648	int error = -ESRCH;
 649
 650	if (lock_task_sighand(child, &flags)) {
 651		error = -EINVAL;
 652		if (likely(child->last_siginfo != NULL)) {
 653			*info = *child->last_siginfo;
 654			error = 0;
 655		}
 656		unlock_task_sighand(child, &flags);
 657	}
 658	return error;
 659}
 660
 661static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
 662{
 663	unsigned long flags;
 664	int error = -ESRCH;
 665
 666	if (lock_task_sighand(child, &flags)) {
 667		error = -EINVAL;
 668		if (likely(child->last_siginfo != NULL)) {
 669			*child->last_siginfo = *info;
 670			error = 0;
 671		}
 672		unlock_task_sighand(child, &flags);
 673	}
 674	return error;
 675}
 676
 677static int ptrace_peek_siginfo(struct task_struct *child,
 678				unsigned long addr,
 679				unsigned long data)
 680{
 681	struct ptrace_peeksiginfo_args arg;
 682	struct sigpending *pending;
 683	struct sigqueue *q;
 684	int ret, i;
 685
 686	ret = copy_from_user(&arg, (void __user *) addr,
 687				sizeof(struct ptrace_peeksiginfo_args));
 688	if (ret)
 689		return -EFAULT;
 690
 691	if (arg.flags & ~PTRACE_PEEKSIGINFO_SHARED)
 692		return -EINVAL; /* unknown flags */
 693
 694	if (arg.nr < 0)
 695		return -EINVAL;
 696
 697	if (arg.flags & PTRACE_PEEKSIGINFO_SHARED)
 698		pending = &child->signal->shared_pending;
 699	else
 700		pending = &child->pending;
 701
 702	for (i = 0; i < arg.nr; ) {
 703		siginfo_t info;
 704		s32 off = arg.off + i;
 705
 706		spin_lock_irq(&child->sighand->siglock);
 707		list_for_each_entry(q, &pending->list, list) {
 708			if (!off--) {
 709				copy_siginfo(&info, &q->info);
 710				break;
 711			}
 712		}
 713		spin_unlock_irq(&child->sighand->siglock);
 714
 715		if (off >= 0) /* beyond the end of the list */
 716			break;
 717
 718#ifdef CONFIG_COMPAT
 719		if (unlikely(in_compat_syscall())) {
 720			compat_siginfo_t __user *uinfo = compat_ptr(data);
 721
 722			if (copy_siginfo_to_user32(uinfo, &info) ||
 723			    __put_user(info.si_code, &uinfo->si_code)) {
 724				ret = -EFAULT;
 725				break;
 726			}
 727
 728		} else
 729#endif
 730		{
 731			siginfo_t __user *uinfo = (siginfo_t __user *) data;
 732
 733			if (copy_siginfo_to_user(uinfo, &info) ||
 734			    __put_user(info.si_code, &uinfo->si_code)) {
 735				ret = -EFAULT;
 736				break;
 737			}
 738		}
 739
 740		data += sizeof(siginfo_t);
 741		i++;
 742
 743		if (signal_pending(current))
 744			break;
 745
 746		cond_resched();
 747	}
 748
 749	if (i > 0)
 750		return i;
 751
 752	return ret;
 753}
 754
 755#ifdef PTRACE_SINGLESTEP
 756#define is_singlestep(request)		((request) == PTRACE_SINGLESTEP)
 757#else
 758#define is_singlestep(request)		0
 759#endif
 760
 761#ifdef PTRACE_SINGLEBLOCK
 762#define is_singleblock(request)		((request) == PTRACE_SINGLEBLOCK)
 763#else
 764#define is_singleblock(request)		0
 765#endif
 766
 767#ifdef PTRACE_SYSEMU
 768#define is_sysemu_singlestep(request)	((request) == PTRACE_SYSEMU_SINGLESTEP)
 769#else
 770#define is_sysemu_singlestep(request)	0
 771#endif
 772
 773static int ptrace_resume(struct task_struct *child, long request,
 774			 unsigned long data)
 775{
 776	bool need_siglock;
 777
 778	if (!valid_signal(data))
 779		return -EIO;
 780
 781	if (request == PTRACE_SYSCALL)
 782		set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 783	else
 784		clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
 785
 786#ifdef TIF_SYSCALL_EMU
 787	if (request == PTRACE_SYSEMU || request == PTRACE_SYSEMU_SINGLESTEP)
 788		set_tsk_thread_flag(child, TIF_SYSCALL_EMU);
 789	else
 790		clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
 791#endif
 792
 793	if (is_singleblock(request)) {
 794		if (unlikely(!arch_has_block_step()))
 795			return -EIO;
 796		user_enable_block_step(child);
 797	} else if (is_singlestep(request) || is_sysemu_singlestep(request)) {
 798		if (unlikely(!arch_has_single_step()))
 799			return -EIO;
 800		user_enable_single_step(child);
 801	} else {
 802		user_disable_single_step(child);
 803	}
 804
 805	/*
 806	 * Change ->exit_code and ->state under siglock to avoid the race
 807	 * with wait_task_stopped() in between; a non-zero ->exit_code will
 808	 * wrongly look like another report from tracee.
 809	 *
 810	 * Note that we need siglock even if ->exit_code == data and/or this
 811	 * status was not reported yet, the new status must not be cleared by
 812	 * wait_task_stopped() after resume.
 813	 *
 814	 * If data == 0 we do not care if wait_task_stopped() reports the old
 815	 * status and clears the code too; this can't race with the tracee, it
 816	 * takes siglock after resume.
 817	 */
 818	need_siglock = data && !thread_group_empty(current);
 819	if (need_siglock)
 820		spin_lock_irq(&child->sighand->siglock);
 821	child->exit_code = data;
 822	wake_up_state(child, __TASK_TRACED);
 823	if (need_siglock)
 824		spin_unlock_irq(&child->sighand->siglock);
 825
 826	return 0;
 827}
 828
 829#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
 830
 831static const struct user_regset *
 832find_regset(const struct user_regset_view *view, unsigned int type)
 833{
 834	const struct user_regset *regset;
 835	int n;
 836
 837	for (n = 0; n < view->n; ++n) {
 838		regset = view->regsets + n;
 839		if (regset->core_note_type == type)
 840			return regset;
 841	}
 842
 843	return NULL;
 844}
 845
 846static int ptrace_regset(struct task_struct *task, int req, unsigned int type,
 847			 struct iovec *kiov)
 848{
 849	const struct user_regset_view *view = task_user_regset_view(task);
 850	const struct user_regset *regset = find_regset(view, type);
 851	int regset_no;
 852
 853	if (!regset || (kiov->iov_len % regset->size) != 0)
 854		return -EINVAL;
 855
 856	regset_no = regset - view->regsets;
 857	kiov->iov_len = min(kiov->iov_len,
 858			    (__kernel_size_t) (regset->n * regset->size));
 859
 860	if (req == PTRACE_GETREGSET)
 861		return copy_regset_to_user(task, view, regset_no, 0,
 862					   kiov->iov_len, kiov->iov_base);
 863	else
 864		return copy_regset_from_user(task, view, regset_no, 0,
 865					     kiov->iov_len, kiov->iov_base);
 866}
 867
 868/*
 869 * This is declared in linux/regset.h and defined in machine-dependent
 870 * code.  We put the export here, near the primary machine-neutral use,
 871 * to ensure no machine forgets it.
 872 */
 873EXPORT_SYMBOL_GPL(task_user_regset_view);
 874#endif
 875
 876int ptrace_request(struct task_struct *child, long request,
 877		   unsigned long addr, unsigned long data)
 878{
 879	bool seized = child->ptrace & PT_SEIZED;
 880	int ret = -EIO;
 881	siginfo_t siginfo, *si;
 882	void __user *datavp = (void __user *) data;
 883	unsigned long __user *datalp = datavp;
 884	unsigned long flags;
 885
 886	switch (request) {
 887	case PTRACE_PEEKTEXT:
 888	case PTRACE_PEEKDATA:
 889		return generic_ptrace_peekdata(child, addr, data);
 890	case PTRACE_POKETEXT:
 891	case PTRACE_POKEDATA:
 892		return generic_ptrace_pokedata(child, addr, data);
 893
 894#ifdef PTRACE_OLDSETOPTIONS
 895	case PTRACE_OLDSETOPTIONS:
 896#endif
 897	case PTRACE_SETOPTIONS:
 898		ret = ptrace_setoptions(child, data);
 899		break;
 900	case PTRACE_GETEVENTMSG:
 901		ret = put_user(child->ptrace_message, datalp);
 902		break;
 903
 904	case PTRACE_PEEKSIGINFO:
 905		ret = ptrace_peek_siginfo(child, addr, data);
 906		break;
 907
 908	case PTRACE_GETSIGINFO:
 909		ret = ptrace_getsiginfo(child, &siginfo);
 910		if (!ret)
 911			ret = copy_siginfo_to_user(datavp, &siginfo);
 912		break;
 913
 914	case PTRACE_SETSIGINFO:
 915		if (copy_from_user(&siginfo, datavp, sizeof siginfo))
 916			ret = -EFAULT;
 917		else
 918			ret = ptrace_setsiginfo(child, &siginfo);
 919		break;
 920
 921	case PTRACE_GETSIGMASK:
 922		if (addr != sizeof(sigset_t)) {
 923			ret = -EINVAL;
 924			break;
 925		}
 926
 927		if (copy_to_user(datavp, &child->blocked, sizeof(sigset_t)))
 928			ret = -EFAULT;
 929		else
 930			ret = 0;
 931
 932		break;
 933
 934	case PTRACE_SETSIGMASK: {
 935		sigset_t new_set;
 936
 937		if (addr != sizeof(sigset_t)) {
 938			ret = -EINVAL;
 939			break;
 940		}
 941
 942		if (copy_from_user(&new_set, datavp, sizeof(sigset_t))) {
 943			ret = -EFAULT;
 944			break;
 945		}
 946
 947		sigdelsetmask(&new_set, sigmask(SIGKILL)|sigmask(SIGSTOP));
 948
 949		/*
 950		 * Every thread does recalc_sigpending() after resume, so
 951		 * retarget_shared_pending() and recalc_sigpending() are not
 952		 * called here.
 953		 */
 954		spin_lock_irq(&child->sighand->siglock);
 955		child->blocked = new_set;
 956		spin_unlock_irq(&child->sighand->siglock);
 957
 958		ret = 0;
 959		break;
 960	}
 961
 962	case PTRACE_INTERRUPT:
 963		/*
 964		 * Stop tracee without any side-effect on signal or job
 965		 * control.  At least one trap is guaranteed to happen
 966		 * after this request.  If @child is already trapped, the
 967		 * current trap is not disturbed and another trap will
 968		 * happen after the current trap is ended with PTRACE_CONT.
 969		 *
 970		 * The actual trap might not be PTRACE_EVENT_STOP trap but
 971		 * the pending condition is cleared regardless.
 972		 */
 973		if (unlikely(!seized || !lock_task_sighand(child, &flags)))
 974			break;
 975
 976		/*
 977		 * INTERRUPT doesn't disturb existing trap sans one
 978		 * exception.  If ptracer issued LISTEN for the current
 979		 * STOP, this INTERRUPT should clear LISTEN and re-trap
 980		 * tracee into STOP.
 981		 */
 982		if (likely(task_set_jobctl_pending(child, JOBCTL_TRAP_STOP)))
 983			ptrace_signal_wake_up(child, child->jobctl & JOBCTL_LISTENING);
 984
 985		unlock_task_sighand(child, &flags);
 986		ret = 0;
 987		break;
 988
 989	case PTRACE_LISTEN:
 990		/*
 991		 * Listen for events.  Tracee must be in STOP.  It's not
 992		 * resumed per-se but is not considered to be in TRACED by
 993		 * wait(2) or ptrace(2).  If an async event (e.g. group
 994		 * stop state change) happens, tracee will enter STOP trap
 995		 * again.  Alternatively, ptracer can issue INTERRUPT to
 996		 * finish listening and re-trap tracee into STOP.
 997		 */
 998		if (unlikely(!seized || !lock_task_sighand(child, &flags)))
 999			break;
1000
1001		si = child->last_siginfo;
1002		if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) {
1003			child->jobctl |= JOBCTL_LISTENING;
1004			/*
1005			 * If NOTIFY is set, it means event happened between
1006			 * start of this trap and now.  Trigger re-trap.
1007			 */
1008			if (child->jobctl & JOBCTL_TRAP_NOTIFY)
1009				ptrace_signal_wake_up(child, true);
1010			ret = 0;
1011		}
1012		unlock_task_sighand(child, &flags);
1013		break;
1014
1015	case PTRACE_DETACH:	 /* detach a process that was attached. */
1016		ret = ptrace_detach(child, data);
1017		break;
1018
1019#ifdef CONFIG_BINFMT_ELF_FDPIC
1020	case PTRACE_GETFDPIC: {
1021		struct mm_struct *mm = get_task_mm(child);
1022		unsigned long tmp = 0;
1023
1024		ret = -ESRCH;
1025		if (!mm)
1026			break;
1027
1028		switch (addr) {
1029		case PTRACE_GETFDPIC_EXEC:
1030			tmp = mm->context.exec_fdpic_loadmap;
1031			break;
1032		case PTRACE_GETFDPIC_INTERP:
1033			tmp = mm->context.interp_fdpic_loadmap;
1034			break;
1035		default:
1036			break;
1037		}
1038		mmput(mm);
1039
1040		ret = put_user(tmp, datalp);
1041		break;
1042	}
1043#endif
1044
1045#ifdef PTRACE_SINGLESTEP
1046	case PTRACE_SINGLESTEP:
1047#endif
1048#ifdef PTRACE_SINGLEBLOCK
1049	case PTRACE_SINGLEBLOCK:
1050#endif
1051#ifdef PTRACE_SYSEMU
1052	case PTRACE_SYSEMU:
1053	case PTRACE_SYSEMU_SINGLESTEP:
1054#endif
1055	case PTRACE_SYSCALL:
1056	case PTRACE_CONT:
1057		return ptrace_resume(child, request, data);
1058
1059	case PTRACE_KILL:
1060		if (child->exit_state)	/* already dead */
1061			return 0;
1062		return ptrace_resume(child, request, SIGKILL);
1063
1064#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
1065	case PTRACE_GETREGSET:
1066	case PTRACE_SETREGSET: {
 
1067		struct iovec kiov;
1068		struct iovec __user *uiov = datavp;
1069
1070		if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
1071			return -EFAULT;
1072
1073		if (__get_user(kiov.iov_base, &uiov->iov_base) ||
1074		    __get_user(kiov.iov_len, &uiov->iov_len))
1075			return -EFAULT;
1076
1077		ret = ptrace_regset(child, request, addr, &kiov);
1078		if (!ret)
1079			ret = __put_user(kiov.iov_len, &uiov->iov_len);
1080		break;
1081	}
1082#endif
1083
1084	case PTRACE_SECCOMP_GET_FILTER:
1085		ret = seccomp_get_filter(child, addr, datavp);
1086		break;
1087
1088	default:
1089		break;
1090	}
1091
1092	return ret;
1093}
1094
1095static struct task_struct *ptrace_get_task_struct(pid_t pid)
1096{
1097	struct task_struct *child;
1098
1099	rcu_read_lock();
1100	child = find_task_by_vpid(pid);
1101	if (child)
1102		get_task_struct(child);
1103	rcu_read_unlock();
1104
1105	if (!child)
1106		return ERR_PTR(-ESRCH);
1107	return child;
1108}
1109
1110#ifndef arch_ptrace_attach
1111#define arch_ptrace_attach(child)	do { } while (0)
1112#endif
1113
1114SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
1115		unsigned long, data)
1116{
1117	struct task_struct *child;
1118	long ret;
1119
1120	if (request == PTRACE_TRACEME) {
1121		ret = ptrace_traceme();
1122		if (!ret)
1123			arch_ptrace_attach(current);
1124		goto out;
1125	}
1126
1127	child = ptrace_get_task_struct(pid);
1128	if (IS_ERR(child)) {
1129		ret = PTR_ERR(child);
1130		goto out;
1131	}
1132
1133	if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
1134		ret = ptrace_attach(child, request, addr, data);
1135		/*
1136		 * Some architectures need to do book-keeping after
1137		 * a ptrace attach.
1138		 */
1139		if (!ret)
1140			arch_ptrace_attach(child);
1141		goto out_put_task_struct;
1142	}
1143
1144	ret = ptrace_check_attach(child, request == PTRACE_KILL ||
1145				  request == PTRACE_INTERRUPT);
1146	if (ret < 0)
1147		goto out_put_task_struct;
1148
1149	ret = arch_ptrace(child, request, addr, data);
1150	if (ret || request != PTRACE_DETACH)
1151		ptrace_unfreeze_traced(child);
1152
1153 out_put_task_struct:
1154	put_task_struct(child);
1155 out:
1156	return ret;
1157}
1158
1159int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
1160			    unsigned long data)
1161{
1162	unsigned long tmp;
1163	int copied;
1164
1165	copied = ptrace_access_vm(tsk, addr, &tmp, sizeof(tmp), FOLL_FORCE);
1166	if (copied != sizeof(tmp))
1167		return -EIO;
1168	return put_user(tmp, (unsigned long __user *)data);
1169}
1170
1171int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
1172			    unsigned long data)
1173{
1174	int copied;
1175
1176	copied = ptrace_access_vm(tsk, addr, &data, sizeof(data),
1177			FOLL_FORCE | FOLL_WRITE);
1178	return (copied == sizeof(data)) ? 0 : -EIO;
1179}
1180
1181#if defined CONFIG_COMPAT
 
1182
1183int compat_ptrace_request(struct task_struct *child, compat_long_t request,
1184			  compat_ulong_t addr, compat_ulong_t data)
1185{
1186	compat_ulong_t __user *datap = compat_ptr(data);
1187	compat_ulong_t word;
1188	siginfo_t siginfo;
1189	int ret;
1190
1191	switch (request) {
1192	case PTRACE_PEEKTEXT:
1193	case PTRACE_PEEKDATA:
1194		ret = ptrace_access_vm(child, addr, &word, sizeof(word),
1195				FOLL_FORCE);
1196		if (ret != sizeof(word))
1197			ret = -EIO;
1198		else
1199			ret = put_user(word, datap);
1200		break;
1201
1202	case PTRACE_POKETEXT:
1203	case PTRACE_POKEDATA:
1204		ret = ptrace_access_vm(child, addr, &data, sizeof(data),
1205				FOLL_FORCE | FOLL_WRITE);
1206		ret = (ret != sizeof(data) ? -EIO : 0);
1207		break;
1208
1209	case PTRACE_GETEVENTMSG:
1210		ret = put_user((compat_ulong_t) child->ptrace_message, datap);
1211		break;
1212
1213	case PTRACE_GETSIGINFO:
1214		ret = ptrace_getsiginfo(child, &siginfo);
1215		if (!ret)
1216			ret = copy_siginfo_to_user32(
1217				(struct compat_siginfo __user *) datap,
1218				&siginfo);
1219		break;
1220
1221	case PTRACE_SETSIGINFO:
1222		memset(&siginfo, 0, sizeof siginfo);
1223		if (copy_siginfo_from_user32(
1224			    &siginfo, (struct compat_siginfo __user *) datap))
1225			ret = -EFAULT;
1226		else
1227			ret = ptrace_setsiginfo(child, &siginfo);
1228		break;
1229#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
1230	case PTRACE_GETREGSET:
1231	case PTRACE_SETREGSET:
1232	{
1233		struct iovec kiov;
1234		struct compat_iovec __user *uiov =
1235			(struct compat_iovec __user *) datap;
1236		compat_uptr_t ptr;
1237		compat_size_t len;
1238
1239		if (!access_ok(VERIFY_WRITE, uiov, sizeof(*uiov)))
1240			return -EFAULT;
1241
1242		if (__get_user(ptr, &uiov->iov_base) ||
1243		    __get_user(len, &uiov->iov_len))
1244			return -EFAULT;
1245
1246		kiov.iov_base = compat_ptr(ptr);
1247		kiov.iov_len = len;
1248
1249		ret = ptrace_regset(child, request, addr, &kiov);
1250		if (!ret)
1251			ret = __put_user(kiov.iov_len, &uiov->iov_len);
1252		break;
1253	}
1254#endif
1255
1256	default:
1257		ret = ptrace_request(child, request, addr, data);
1258	}
1259
1260	return ret;
1261}
1262
1263COMPAT_SYSCALL_DEFINE4(ptrace, compat_long_t, request, compat_long_t, pid,
1264		       compat_long_t, addr, compat_long_t, data)
1265{
1266	struct task_struct *child;
1267	long ret;
1268
1269	if (request == PTRACE_TRACEME) {
1270		ret = ptrace_traceme();
1271		goto out;
1272	}
1273
1274	child = ptrace_get_task_struct(pid);
1275	if (IS_ERR(child)) {
1276		ret = PTR_ERR(child);
1277		goto out;
1278	}
1279
1280	if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
1281		ret = ptrace_attach(child, request, addr, data);
1282		/*
1283		 * Some architectures need to do book-keeping after
1284		 * a ptrace attach.
1285		 */
1286		if (!ret)
1287			arch_ptrace_attach(child);
1288		goto out_put_task_struct;
1289	}
1290
1291	ret = ptrace_check_attach(child, request == PTRACE_KILL ||
1292				  request == PTRACE_INTERRUPT);
1293	if (!ret) {
1294		ret = compat_arch_ptrace(child, request, addr, data);
1295		if (ret || request != PTRACE_DETACH)
1296			ptrace_unfreeze_traced(child);
1297	}
1298
1299 out_put_task_struct:
1300	put_task_struct(child);
1301 out:
1302	return ret;
1303}
1304#endif	/* CONFIG_COMPAT */