File: | kern/sys_process.c |
Warning: | line 877, column 2 Value stored to 'addr' is never read |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: sys_process.c,v 1.95 2023/11/21 14:00:13 bluhm Exp $ */ |
2 | /* $NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $ */ |
3 | |
4 | /*- |
5 | * Copyright (c) 1994 Christopher G. Demetriou. All rights reserved. |
6 | * Copyright (c) 1982, 1986, 1989, 1993 |
7 | * The Regents of the University of California. All rights reserved. |
8 | * (c) UNIX System Laboratories, Inc. |
9 | * All or some portions of this file are derived from material licensed |
10 | * to the University of California by American Telephone and Telegraph |
11 | * Co. or Unix System Laboratories, Inc. and are reproduced herein with |
12 | * the permission of UNIX System Laboratories, Inc. |
13 | * |
14 | * Redistribution and use in source and binary forms, with or without |
15 | * modification, are permitted provided that the following conditions |
16 | * are met: |
17 | * 1. Redistributions of source code must retain the above copyright |
18 | * notice, this list of conditions and the following disclaimer. |
19 | * 2. Redistributions in binary form must reproduce the above copyright |
20 | * notice, this list of conditions and the following disclaimer in the |
21 | * documentation and/or other materials provided with the distribution. |
22 | * 3. Neither the name of the University nor the names of its contributors |
23 | * may be used to endorse or promote products derived from this software |
24 | * without specific prior written permission. |
25 | * |
26 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
27 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
28 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
29 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
30 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
31 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
32 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
33 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
34 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
35 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
36 | * SUCH DAMAGE. |
37 | * |
38 | * from: @(#)sys_process.c 8.1 (Berkeley) 6/10/93 |
39 | */ |
40 | |
41 | /* |
42 | * References: |
43 | * (1) Bach's "The Design of the UNIX Operating System", |
44 | * (2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution, |
45 | * (3) the "4.4BSD Programmer's Reference Manual" published |
46 | * by USENIX and O'Reilly & Associates. |
47 | * The 4.4BSD PRM does a reasonably good job of documenting what the various |
48 | * ptrace() requests should actually do, and its text is quoted several times |
49 | * in this file. |
50 | */ |
51 | |
52 | #include <sys/param.h> |
53 | #include <sys/systm.h> |
54 | #include <sys/exec.h> |
55 | #include <sys/proc.h> |
56 | #include <sys/signalvar.h> |
57 | #include <sys/errno.h> |
58 | #include <sys/malloc.h> |
59 | #include <sys/ptrace.h> |
60 | #include <sys/uio.h> |
61 | #include <sys/sched.h> |
62 | #include <sys/exec_elf.h> |
63 | |
64 | #include <sys/mount.h> |
65 | #include <sys/syscallargs.h> |
66 | |
67 | #include <uvm/uvm_extern.h> |
68 | |
69 | #include <machine/reg.h> |
70 | |
71 | #ifdef PTRACE1 |
72 | |
73 | static inline int process_checktracestate(struct process *_curpr, |
74 | struct process *_tr, struct proc *_t); |
75 | static inline struct process *process_tprfind(pid_t _tpid, struct proc **_tp); |
76 | |
77 | int ptrace_ctrl(struct proc *, int, pid_t, caddr_t, int); |
78 | int ptrace_ustate(struct proc *, int, pid_t, void *, int, register_t *); |
79 | int ptrace_kstate(struct proc *, int, pid_t, void *); |
80 | |
81 | int global_ptrace; /* permit tracing of not children */ |
82 | |
83 | |
84 | /* |
85 | * Process debugging system call. |
86 | */ |
87 | int |
88 | sys_ptrace(struct proc *p, void *v, register_t *retval) |
89 | { |
90 | struct sys_ptrace_args /* { |
91 | syscallarg(int) req; |
92 | syscallarg(pid_t) pid; |
93 | syscallarg(caddr_t) addr; |
94 | syscallarg(int) data; |
95 | } */ *uap = v; |
96 | int req = SCARG(uap, req)((uap)->req.le.datum); |
97 | pid_t pid = SCARG(uap, pid)((uap)->pid.le.datum); |
98 | caddr_t uaddr = SCARG(uap, addr)((uap)->addr.le.datum); /* userspace */ |
99 | void *kaddr = NULL((void *)0); /* kernelspace */ |
100 | int data = SCARG(uap, data)((uap)->data.le.datum); |
101 | union { |
102 | struct ptrace_thread_state u_pts; |
103 | struct ptrace_io_desc u_piod; |
104 | struct ptrace_event u_pe; |
105 | struct ptrace_state u_ps; |
106 | register_t u_wcookie; |
107 | register_t u_pacmask[2]; |
108 | } u; |
109 | int size = 0; |
110 | enum { NONE, IN, IN_ALLOC, OUT, OUT_ALLOC, IN_OUT } mode; |
111 | int kstate = 0; |
112 | int error; |
113 | |
114 | *retval = 0; |
115 | |
116 | /* Figure out what sort of copyin/out operations we'll do */ |
117 | switch (req) { |
118 | case PT_TRACE_ME0: |
119 | case PT_CONTINUE7: |
120 | case PT_KILL8: |
121 | case PT_ATTACH9: |
122 | case PT_DETACH10: |
123 | #ifdef PT_STEP(32 + 0) |
124 | case PT_STEP(32 + 0): |
125 | #endif |
126 | /* control operations do no copyin/out; dispatch directly */ |
127 | return ptrace_ctrl(p, req, pid, uaddr, data); |
128 | |
129 | case PT_READ_I1: |
130 | case PT_READ_D2: |
131 | case PT_WRITE_I4: |
132 | case PT_WRITE_D5: |
133 | mode = NONE; |
134 | break; |
135 | case PT_IO11: |
136 | mode = IN_OUT; |
137 | size = sizeof u.u_piod; |
138 | data = size; /* suppress the data == size check */ |
139 | break; |
140 | case PT_GET_THREAD_FIRST15: |
141 | mode = OUT; |
142 | size = sizeof u.u_pts; |
143 | kstate = 1; |
144 | break; |
145 | case PT_GET_THREAD_NEXT16: |
146 | mode = IN_OUT; |
147 | size = sizeof u.u_pts; |
148 | kstate = 1; |
149 | break; |
150 | case PT_GET_EVENT_MASK13: |
151 | mode = OUT; |
152 | size = sizeof u.u_pe; |
153 | kstate = 1; |
154 | break; |
155 | case PT_SET_EVENT_MASK12: |
156 | mode = IN; |
157 | size = sizeof u.u_pe; |
158 | kstate = 1; |
159 | break; |
160 | case PT_GET_PROCESS_STATE14: |
161 | mode = OUT; |
162 | size = sizeof u.u_ps; |
163 | kstate = 1; |
164 | break; |
165 | case PT_GETREGS(32 + 1): |
166 | mode = OUT_ALLOC; |
167 | size = sizeof(struct reg); |
168 | break; |
169 | case PT_SETREGS(32 + 2): |
170 | mode = IN_ALLOC; |
171 | size = sizeof(struct reg); |
172 | break; |
173 | #ifdef PT_GETFPREGS(32 + 3) |
174 | case PT_GETFPREGS(32 + 3): |
175 | mode = OUT_ALLOC; |
176 | size = sizeof(struct fpreg); |
177 | break; |
178 | #endif |
179 | #ifdef PT_SETFPREGS(32 + 4) |
180 | case PT_SETFPREGS(32 + 4): |
181 | mode = IN_ALLOC; |
182 | size = sizeof(struct fpreg); |
183 | break; |
184 | #endif |
185 | #ifdef PT_GETXMMREGS |
186 | case PT_GETXMMREGS: |
187 | mode = OUT_ALLOC; |
188 | size = sizeof(struct xmmregs); |
189 | break; |
190 | #endif |
191 | #ifdef PT_SETXMMREGS |
192 | case PT_SETXMMREGS: |
193 | mode = IN_ALLOC; |
194 | size = sizeof(struct xmmregs); |
195 | break; |
196 | #endif |
197 | #ifdef PT_WCOOKIE |
198 | case PT_WCOOKIE: |
199 | mode = OUT; |
200 | size = sizeof u.u_wcookie; |
201 | data = size; /* suppress the data == size check */ |
202 | break; |
203 | #endif |
204 | #ifdef PT_PACMASK |
205 | case PT_PACMASK: |
206 | mode = OUT; |
207 | size = sizeof u.u_pacmask; |
208 | break; |
209 | #endif |
210 | default: |
211 | return EINVAL22; |
212 | } |
213 | |
214 | |
215 | /* Now do any copyin()s and allocations in a consistent manner */ |
216 | switch (mode) { |
217 | case NONE: |
218 | kaddr = uaddr; |
219 | break; |
220 | case IN: |
221 | case IN_OUT: |
222 | case OUT: |
223 | KASSERT(size <= sizeof u)((size <= sizeof u) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/kern/sys_process.c" , 223, "size <= sizeof u")); |
224 | if (data != size) |
225 | return EINVAL22; |
226 | if (mode == OUT) |
227 | memset(&u, 0, size)__builtin_memset((&u), (0), (size)); |
228 | else { /* IN or IN_OUT */ |
229 | if ((error = copyin(uaddr, &u, size))) |
230 | return error; |
231 | } |
232 | kaddr = &u; |
233 | break; |
234 | case IN_ALLOC: |
235 | kaddr = malloc(size, M_TEMP127, M_WAITOK0x0001); |
236 | if ((error = copyin(uaddr, kaddr, size))) { |
237 | free(kaddr, M_TEMP127, size); |
238 | return error; |
239 | } |
240 | break; |
241 | case OUT_ALLOC: |
242 | kaddr = malloc(size, M_TEMP127, M_WAITOK0x0001 | M_ZERO0x0008); |
243 | break; |
244 | } |
245 | |
246 | if (kstate) |
247 | error = ptrace_kstate(p, req, pid, kaddr); |
248 | else |
249 | error = ptrace_ustate(p, req, pid, kaddr, data, retval); |
250 | |
251 | /* Do any copyout()s and frees */ |
252 | if (error == 0) { |
253 | switch (mode) { |
254 | case NONE: |
255 | case IN: |
256 | case IN_ALLOC: |
257 | break; |
258 | case IN_OUT: |
259 | case OUT: |
260 | error = copyout(&u, uaddr, size); |
261 | if (req == PT_IO11) { |
262 | /* historically, errors here are ignored */ |
263 | error = 0; |
264 | } |
265 | break; |
266 | case OUT_ALLOC: |
267 | error = copyout(kaddr, uaddr, size); |
268 | break; |
269 | } |
270 | } |
271 | |
272 | if (mode == IN_ALLOC || mode == OUT_ALLOC) |
273 | free(kaddr, M_TEMP127, size); |
274 | return error; |
275 | } |
276 | |
277 | /* |
278 | * ptrace control requests: attach, detach, continue, kill, single-step, etc |
279 | */ |
280 | int |
281 | ptrace_ctrl(struct proc *p, int req, pid_t pid, caddr_t addr, int data) |
282 | { |
283 | struct proc *t; /* target thread */ |
284 | struct process *tr; /* target process */ |
285 | int error = 0; |
286 | int s; |
287 | |
288 | switch (req) { |
289 | case PT_TRACE_ME0: |
290 | /* Just set the trace flag. */ |
291 | tr = p->p_p; |
292 | if (ISSET(tr->ps_flags, PS_TRACED)((tr->ps_flags) & (0x00000200))) |
293 | return EBUSY16; |
294 | atomic_setbits_intx86_atomic_setbits_u32(&tr->ps_flags, PS_TRACED0x00000200); |
295 | tr->ps_oppid = tr->ps_pptr->ps_pid; |
296 | if (tr->ps_ptstat == NULL((void *)0)) |
297 | tr->ps_ptstat = malloc(sizeof(*tr->ps_ptstat), |
298 | M_SUBPROC42, M_WAITOK0x0001); |
299 | memset(tr->ps_ptstat, 0, sizeof(*tr->ps_ptstat))__builtin_memset((tr->ps_ptstat), (0), (sizeof(*tr->ps_ptstat ))); |
300 | return 0; |
301 | |
302 | /* calls that only operate on the PID */ |
303 | case PT_KILL8: |
304 | case PT_ATTACH9: |
305 | case PT_DETACH10: |
306 | /* Find the process we're supposed to be operating on. */ |
307 | if ((tr = prfind(pid)) == NULL((void *)0)) { |
308 | error = ESRCH3; |
309 | goto fail; |
310 | } |
311 | t = TAILQ_FIRST(&tr->ps_threads)((&tr->ps_threads)->tqh_first); |
312 | break; |
313 | |
314 | /* calls that accept a PID or a thread ID */ |
315 | case PT_CONTINUE7: |
316 | #ifdef PT_STEP(32 + 0) |
317 | case PT_STEP(32 + 0): |
318 | #endif |
319 | if ((tr = process_tprfind(pid, &t)) == NULL((void *)0)) { |
320 | error = ESRCH3; |
321 | goto fail; |
322 | } |
323 | break; |
324 | } |
325 | |
326 | /* Check permissions/state */ |
327 | if (req != PT_ATTACH9) { |
328 | /* Check that the data is a valid signal number or zero. */ |
329 | if (req != PT_KILL8 && (data < 0 || data >= NSIG33)) { |
330 | error = EINVAL22; |
331 | goto fail; |
332 | } |
333 | |
334 | /* Most operations require the target to already be traced */ |
335 | if ((error = process_checktracestate(p->p_p, tr, t))) |
336 | goto fail; |
337 | |
338 | /* Do single-step fixup if needed. */ |
339 | FIX_SSTEP(t); |
340 | } else { |
341 | /* |
342 | * PT_ATTACH is the opposite; you can't attach to a process if: |
343 | * (1) it's the process that's doing the attaching, |
344 | */ |
345 | if (tr == p->p_p) { |
346 | error = EINVAL22; |
347 | goto fail; |
348 | } |
349 | |
350 | /* |
351 | * (2) it's a system process |
352 | */ |
353 | if (ISSET(tr->ps_flags, PS_SYSTEM)((tr->ps_flags) & (0x00010000))) { |
354 | error = EPERM1; |
355 | goto fail; |
356 | } |
357 | |
358 | /* |
359 | * (3) it's already being traced, or |
360 | */ |
361 | if (ISSET(tr->ps_flags, PS_TRACED)((tr->ps_flags) & (0x00000200))) { |
362 | error = EBUSY16; |
363 | goto fail; |
364 | } |
365 | |
366 | /* |
367 | * (4) it's in the middle of execve(2) |
368 | */ |
369 | if (ISSET(tr->ps_flags, PS_INEXEC)((tr->ps_flags) & (0x00000004))) { |
370 | error = EAGAIN35; |
371 | goto fail; |
372 | } |
373 | |
374 | /* |
375 | * (5) it's not owned by you, or the last exec |
376 | * gave us setuid/setgid privs (unless |
377 | * you're root), or... |
378 | * |
379 | * [Note: once PS_SUGID or PS_SUGIDEXEC gets set in |
380 | * execve(), they stay set until the process does |
381 | * another execve(). Hence this prevents a setuid |
382 | * process which revokes its special privileges using |
383 | * setuid() from being traced. This is good security.] |
384 | */ |
385 | if ((tr->ps_ucred->cr_ruid != p->p_ucred->cr_ruid || |
386 | ISSET(tr->ps_flags, PS_SUGIDEXEC | PS_SUGID)((tr->ps_flags) & (0x00000020 | 0x00000010))) && |
387 | (error = suser(p)) != 0) |
388 | goto fail; |
389 | |
390 | /* |
391 | * (5.5) it's not a child of the tracing process. |
392 | */ |
393 | if (global_ptrace == 0 && !inferior(tr, p->p_p) && |
394 | (error = suser(p)) != 0) |
395 | goto fail; |
396 | |
397 | /* |
398 | * (6) ...it's init, which controls the security level |
399 | * of the entire system, and the system was not |
400 | * compiled with permanently insecure mode turned |
401 | * on. |
402 | */ |
403 | if ((tr->ps_pid == 1) && (securelevel > -1)) { |
404 | error = EPERM1; |
405 | goto fail; |
406 | } |
407 | |
408 | /* |
409 | * (7) it's an ancestor of the current process and |
410 | * not init (because that would create a loop in |
411 | * the process graph). |
412 | */ |
413 | if (tr->ps_pid != 1 && inferior(p->p_p, tr)) { |
414 | error = EINVAL22; |
415 | goto fail; |
416 | } |
417 | } |
418 | |
419 | switch (req) { |
420 | |
421 | #ifdef PT_STEP(32 + 0) |
422 | case PT_STEP(32 + 0): |
423 | /* |
424 | * From the 4.4BSD PRM: |
425 | * "Execution continues as in request PT_CONTINUE; however |
426 | * as soon as possible after execution of at least one |
427 | * instruction, execution stops again. [ ... ]" |
428 | */ |
429 | #endif |
430 | case PT_CONTINUE7: |
431 | /* |
432 | * From the 4.4BSD PRM: |
433 | * "The data argument is taken as a signal number and the |
434 | * child's execution continues at location addr as if it |
435 | * incurred that signal. Normally the signal number will |
436 | * be either 0 to indicate that the signal that caused the |
437 | * stop should be ignored, or that value fetched out of |
438 | * the process's image indicating which signal caused |
439 | * the stop. If addr is (int *)1 then execution continues |
440 | * from where it stopped." |
441 | */ |
442 | |
443 | if (pid < THREAD_PID_OFFSET100000 && tr->ps_single) |
444 | t = tr->ps_single; |
445 | |
446 | /* If the address parameter is not (int *)1, set the pc. */ |
447 | if ((int *)addr != (int *)1) |
448 | if ((error = process_set_pc(t, addr)) != 0) |
449 | goto fail; |
450 | |
451 | #ifdef PT_STEP(32 + 0) |
452 | /* |
453 | * Arrange for a single-step, if that's requested and possible. |
454 | */ |
455 | error = process_sstep(t, req == PT_STEP(32 + 0)); |
456 | if (error) |
457 | goto fail; |
458 | #endif |
459 | goto sendsig; |
460 | |
461 | case PT_DETACH10: |
462 | /* |
463 | * From the 4.4BSD PRM: |
464 | * "The data argument is taken as a signal number and the |
465 | * child's execution continues at location addr as if it |
466 | * incurred that signal. Normally the signal number will |
467 | * be either 0 to indicate that the signal that caused the |
468 | * stop should be ignored, or that value fetched out of |
469 | * the process's image indicating which signal caused |
470 | * the stop. If addr is (int *)1 then execution continues |
471 | * from where it stopped." |
472 | */ |
473 | |
474 | if (pid < THREAD_PID_OFFSET100000 && tr->ps_single) |
475 | t = tr->ps_single; |
476 | |
477 | #ifdef PT_STEP(32 + 0) |
478 | /* |
479 | * Stop single stepping. |
480 | */ |
481 | error = process_sstep(t, 0); |
482 | if (error) |
483 | goto fail; |
484 | #endif |
485 | |
486 | process_untrace(tr); |
487 | atomic_clearbits_intx86_atomic_clearbits_u32(&tr->ps_flags, PS_WAITED0x00000400); |
488 | |
489 | sendsig: |
490 | memset(tr->ps_ptstat, 0, sizeof(*tr->ps_ptstat))__builtin_memset((tr->ps_ptstat), (0), (sizeof(*tr->ps_ptstat ))); |
491 | |
492 | /* Finally, deliver the requested signal (or none). */ |
493 | if (t->p_stat == SSTOP4) { |
494 | tr->ps_xsig = data; |
495 | SCHED_LOCK(s)do { s = splraise(0xc); __mp_lock(&sched_lock); } while ( 0); |
496 | setrunnable(t); |
497 | SCHED_UNLOCK(s)do { __mp_unlock(&sched_lock); spllower(s); } while ( 0); |
498 | } else { |
499 | if (data != 0) |
500 | psignal(t, data); |
501 | } |
502 | break; |
503 | |
504 | case PT_KILL8: |
505 | if (pid < THREAD_PID_OFFSET100000 && tr->ps_single) |
506 | t = tr->ps_single; |
507 | |
508 | /* just send the process a KILL signal. */ |
509 | data = SIGKILL9; |
510 | goto sendsig; /* in PT_CONTINUE, above. */ |
511 | |
512 | case PT_ATTACH9: |
513 | /* |
514 | * As was done in procfs: |
515 | * Go ahead and set the trace flag. |
516 | * Save the old parent (it's reset in |
517 | * _DETACH, and also in kern_exit.c:wait4() |
518 | * Reparent the process so that the tracing |
519 | * proc gets to see all the action. |
520 | * Stop the target. |
521 | */ |
522 | atomic_setbits_intx86_atomic_setbits_u32(&tr->ps_flags, PS_TRACED0x00000200); |
523 | tr->ps_oppid = tr->ps_pptr->ps_pid; |
524 | process_reparent(tr, p->p_p); |
525 | if (tr->ps_ptstat == NULL((void *)0)) |
526 | tr->ps_ptstat = malloc(sizeof(*tr->ps_ptstat), |
527 | M_SUBPROC42, M_WAITOK0x0001); |
528 | data = SIGSTOP17; |
529 | goto sendsig; |
530 | default: |
531 | KASSERTMSG(0, "%s: unhandled request %d", __func__, req)((0) ? (void)0 : panic("kernel %sassertion \"%s\" failed: file \"%s\", line %d" " " "%s: unhandled request %d", "diagnostic ", "0", "/usr/src/sys/kern/sys_process.c" , 531, __func__, req)); |
532 | break; |
533 | } |
534 | |
535 | fail: |
536 | return error; |
537 | } |
538 | |
539 | /* |
540 | * ptrace kernel-state requests: thread list, event mask, process state |
541 | */ |
542 | int |
543 | ptrace_kstate(struct proc *p, int req, pid_t pid, void *addr) |
544 | { |
545 | struct process *tr; /* target process */ |
546 | struct ptrace_event *pe = addr; |
547 | int error; |
548 | |
549 | KASSERT((p->p_flag & P_SYSTEM) == 0)(((p->p_flag & 0x00000200) == 0) ? (void)0 : __assert( "diagnostic ", "/usr/src/sys/kern/sys_process.c", 549, "(p->p_flag & P_SYSTEM) == 0" )); |
550 | |
551 | /* Find the process we're supposed to be operating on. */ |
552 | if ((tr = prfind(pid)) == NULL((void *)0)) |
553 | return ESRCH3; |
554 | |
555 | if ((error = process_checktracestate(p->p_p, tr, NULL((void *)0)))) |
556 | return error; |
557 | |
558 | switch (req) { |
559 | case PT_GET_THREAD_FIRST15: |
560 | case PT_GET_THREAD_NEXT16: |
561 | { |
562 | struct ptrace_thread_state *pts = addr; |
563 | struct proc *t; |
564 | |
565 | if (req == PT_GET_THREAD_NEXT16) { |
566 | t = tfind_user(pts->pts_tid, tr); |
567 | if (t == NULL((void *)0) || ISSET(t->p_flag, P_WEXIT)((t->p_flag) & (0x00002000))) |
568 | return ESRCH3; |
569 | t = TAILQ_NEXT(t, p_thr_link)((t)->p_thr_link.tqe_next); |
570 | } else { |
571 | t = TAILQ_FIRST(&tr->ps_threads)((&tr->ps_threads)->tqh_first); |
572 | } |
573 | |
574 | if (t == NULL((void *)0)) |
575 | pts->pts_tid = -1; |
576 | else |
577 | pts->pts_tid = t->p_tid + THREAD_PID_OFFSET100000; |
578 | return 0; |
579 | } |
580 | } |
581 | |
582 | switch (req) { |
583 | case PT_GET_EVENT_MASK13: |
584 | pe->pe_set_event = tr->ps_ptmask; |
585 | break; |
586 | case PT_SET_EVENT_MASK12: |
587 | tr->ps_ptmask = pe->pe_set_event; |
588 | break; |
589 | case PT_GET_PROCESS_STATE14: |
590 | if (tr->ps_single) |
591 | tr->ps_ptstat->pe_tid = |
592 | tr->ps_single->p_tid + THREAD_PID_OFFSET100000; |
593 | memcpy(addr, tr->ps_ptstat, sizeof *tr->ps_ptstat)__builtin_memcpy((addr), (tr->ps_ptstat), (sizeof *tr-> ps_ptstat)); |
594 | break; |
595 | default: |
596 | KASSERTMSG(0, "%s: unhandled request %d", __func__, req)((0) ? (void)0 : panic("kernel %sassertion \"%s\" failed: file \"%s\", line %d" " " "%s: unhandled request %d", "diagnostic ", "0", "/usr/src/sys/kern/sys_process.c" , 596, __func__, req)); |
597 | break; |
598 | } |
599 | |
600 | return 0; |
601 | } |
602 | |
603 | /* |
604 | * ptrace user-state requests: memory access, registers, stack cookie |
605 | */ |
606 | int |
607 | ptrace_ustate(struct proc *p, int req, pid_t pid, void *addr, int data, |
608 | register_t *retval) |
609 | { |
610 | struct proc *t; /* target thread */ |
611 | struct process *tr; /* target process */ |
612 | struct uio uio; |
613 | struct iovec iov; |
614 | int error, write; |
615 | int temp = 0; |
616 | |
617 | KASSERT((p->p_flag & P_SYSTEM) == 0)(((p->p_flag & 0x00000200) == 0) ? (void)0 : __assert( "diagnostic ", "/usr/src/sys/kern/sys_process.c", 617, "(p->p_flag & P_SYSTEM) == 0" )); |
618 | |
619 | /* Accept either PID or TID */ |
620 | if ((tr = process_tprfind(pid, &t)) == NULL((void *)0)) |
621 | return ESRCH3; |
622 | |
623 | if ((error = process_checktracestate(p->p_p, tr, t))) |
624 | return error; |
625 | |
626 | FIX_SSTEP(t); |
627 | |
628 | /* Now do the operation. */ |
629 | write = 0; |
630 | |
631 | if ((error = process_checkioperm(p, tr)) != 0) |
632 | return error; |
633 | |
634 | switch (req) { |
635 | case PT_WRITE_I4: /* XXX no separate I and D spaces */ |
636 | case PT_WRITE_D5: |
637 | write = 1; |
638 | temp = data; |
639 | case PT_READ_I1: /* XXX no separate I and D spaces */ |
640 | case PT_READ_D2: |
641 | /* write = 0 done above. */ |
642 | iov.iov_base = (caddr_t)&temp; |
643 | iov.iov_len = sizeof(int); |
644 | uio.uio_iov = &iov; |
645 | uio.uio_iovcnt = 1; |
646 | uio.uio_offset = (off_t)(vaddr_t)addr; |
647 | uio.uio_resid = sizeof(int); |
648 | uio.uio_segflg = UIO_SYSSPACE; |
649 | uio.uio_rw = write ? UIO_WRITE : UIO_READ; |
650 | uio.uio_procp = p; |
651 | error = process_domem(p, tr, &uio, write ? PT_WRITE_I4 : |
652 | PT_READ_I1); |
653 | if (write == 0) |
654 | *retval = temp; |
655 | return error; |
656 | |
657 | case PT_IO11: |
658 | { |
659 | struct ptrace_io_desc *piod = addr; |
660 | |
661 | iov.iov_base = piod->piod_addr; |
662 | iov.iov_len = piod->piod_len; |
663 | uio.uio_iov = &iov; |
664 | uio.uio_iovcnt = 1; |
665 | uio.uio_offset = (off_t)(vaddr_t)piod->piod_offs; |
666 | uio.uio_resid = piod->piod_len; |
667 | uio.uio_segflg = UIO_USERSPACE; |
668 | uio.uio_procp = p; |
669 | switch (piod->piod_op) { |
670 | case PIOD_READ_I3: |
671 | req = PT_READ_I1; |
672 | uio.uio_rw = UIO_READ; |
673 | break; |
674 | case PIOD_READ_D1: |
675 | req = PT_READ_D2; |
676 | uio.uio_rw = UIO_READ; |
677 | break; |
678 | case PIOD_WRITE_I4: |
679 | req = PT_WRITE_I4; |
680 | uio.uio_rw = UIO_WRITE; |
681 | break; |
682 | case PIOD_WRITE_D2: |
683 | req = PT_WRITE_D5; |
684 | uio.uio_rw = UIO_WRITE; |
685 | break; |
686 | case PIOD_READ_AUXV5: |
687 | req = PT_READ_D2; |
688 | uio.uio_rw = UIO_READ; |
689 | temp = ELF_AUX_WORDS(sizeof(Aux64Info) * 9 / sizeof(char *)) * sizeof(char *); |
690 | if (uio.uio_offset > temp) |
691 | return EIO5; |
692 | if (uio.uio_resid > temp - uio.uio_offset) |
693 | uio.uio_resid = temp - uio.uio_offset; |
694 | piod->piod_len = iov.iov_len = uio.uio_resid; |
695 | uio.uio_offset += tr->ps_auxinfo; |
696 | #ifdef MACHINE_STACK_GROWS_UP |
697 | if (uio.uio_offset < (off_t)tr->ps_strings) |
698 | return EIO5; |
699 | #else |
700 | if (uio.uio_offset > (off_t)tr->ps_strings) |
701 | return EIO5; |
702 | if ((uio.uio_offset + uio.uio_resid) > |
703 | (off_t)tr->ps_strings) |
704 | uio.uio_resid = (off_t)tr->ps_strings - |
705 | uio.uio_offset; |
706 | #endif |
707 | break; |
708 | default: |
709 | return EINVAL22; |
710 | } |
711 | error = process_domem(p, tr, &uio, req); |
712 | piod->piod_len -= uio.uio_resid; |
713 | return error; |
714 | } |
715 | |
716 | case PT_SETREGS(32 + 2): |
717 | return process_write_regs(t, addr); |
718 | case PT_GETREGS(32 + 1): |
719 | return process_read_regs(t, addr); |
720 | |
721 | #ifdef PT_SETFPREGS(32 + 4) |
722 | case PT_SETFPREGS(32 + 4): |
723 | return process_write_fpregs(t, addr); |
724 | #endif |
725 | #ifdef PT_SETFPREGS(32 + 4) |
726 | case PT_GETFPREGS(32 + 3): |
727 | return process_read_fpregs(t, addr); |
728 | #endif |
729 | #ifdef PT_SETXMMREGS |
730 | case PT_SETXMMREGS: |
731 | return process_write_xmmregs(t, addr); |
732 | #endif |
733 | #ifdef PT_SETXMMREGS |
734 | case PT_GETXMMREGS: |
735 | return process_read_xmmregs(t, addr); |
736 | #endif |
737 | #ifdef PT_WCOOKIE |
738 | case PT_WCOOKIE: |
739 | *(register_t *)addr = process_get_wcookie(t); |
740 | return 0; |
741 | #endif |
742 | #ifdef PT_PACMASK |
743 | case PT_PACMASK: |
744 | ((register_t *)addr)[0] = process_get_pacmask(t); |
745 | ((register_t *)addr)[1] = process_get_pacmask(t); |
746 | return 0; |
747 | #endif |
748 | default: |
749 | KASSERTMSG(0, "%s: unhandled request %d", __func__, req)((0) ? (void)0 : panic("kernel %sassertion \"%s\" failed: file \"%s\", line %d" " " "%s: unhandled request %d", "diagnostic ", "0", "/usr/src/sys/kern/sys_process.c" , 749, __func__, req)); |
750 | break; |
751 | } |
752 | |
753 | return 0; |
754 | } |
755 | |
756 | |
757 | /* |
758 | * Helper for doing "it could be a PID or TID" lookup. On failure |
759 | * returns NULL; on success returns the selected process and sets *tp |
760 | * to an appropriate thread in that process. |
761 | */ |
762 | static inline struct process * |
763 | process_tprfind(pid_t tpid, struct proc **tp) |
764 | { |
765 | if (tpid > THREAD_PID_OFFSET100000) { |
766 | struct proc *t = tfind(tpid - THREAD_PID_OFFSET100000); |
767 | |
768 | if (t == NULL((void *)0)) |
769 | return NULL((void *)0); |
770 | *tp = t; |
771 | return t->p_p; |
772 | } else { |
773 | struct process *tr = prfind(tpid); |
774 | |
775 | if (tr == NULL((void *)0)) |
776 | return NULL((void *)0); |
777 | *tp = TAILQ_FIRST(&tr->ps_threads)((&tr->ps_threads)->tqh_first); |
778 | return tr; |
779 | } |
780 | } |
781 | |
782 | |
783 | /* |
784 | * Check whether 'tr' is currently traced by 'curpr' and in a state |
785 | * to be manipulated. If 't' is supplied then it must be stopped and |
786 | * waited for. |
787 | */ |
788 | static inline int |
789 | process_checktracestate(struct process *curpr, struct process *tr, |
790 | struct proc *t) |
791 | { |
792 | /* |
793 | * You can't do what you want to the process if: |
794 | * (1) It's not being traced at all, |
795 | */ |
796 | if (!ISSET(tr->ps_flags, PS_TRACED)((tr->ps_flags) & (0x00000200))) |
797 | return EPERM1; |
798 | |
799 | /* |
800 | * (2) it's not being traced by _you_, or |
801 | */ |
802 | if (tr->ps_pptr != curpr) |
803 | return EBUSY16; |
804 | |
805 | /* |
806 | * (3) it's in the middle of execve(2) |
807 | */ |
808 | if (ISSET(tr->ps_flags, PS_INEXEC)((tr->ps_flags) & (0x00000004))) |
809 | return EAGAIN35; |
810 | |
811 | /* |
812 | * (4) if a thread was specified and it's not currently stopped. |
813 | */ |
814 | if (t != NULL((void *)0) && |
815 | (t->p_stat != SSTOP4 || !ISSET(tr->ps_flags, PS_WAITED)((tr->ps_flags) & (0x00000400)))) |
816 | return EBUSY16; |
817 | |
818 | return 0; |
819 | } |
820 | |
821 | #endif /* PTRACE */ |
822 | |
823 | /* |
824 | * Check if a process is allowed to fiddle with the memory of another. |
825 | * |
826 | * p = tracer |
827 | * tr = tracee |
828 | * |
829 | * 1. You can't attach to a process not owned by you or one that has raised |
830 | * its privileges. |
831 | * 1a. ...unless you are root. |
832 | * |
833 | * 2. init is always off-limits because it can control the securelevel. |
834 | * 2a. ...unless securelevel is permanently set to insecure. |
835 | * |
836 | * 3. Processes that are in the process of doing an exec() are always |
837 | * off-limits because of the can of worms they are. Just wait a |
838 | * second. |
839 | */ |
840 | int |
841 | process_checkioperm(struct proc *p, struct process *tr) |
842 | { |
843 | int error; |
844 | |
845 | if ((tr->ps_ucred->cr_ruid != p->p_ucred->cr_ruid || |
846 | ISSET(tr->ps_flags, PS_SUGIDEXEC | PS_SUGID)((tr->ps_flags) & (0x00000020 | 0x00000010))) && |
847 | (error = suser(p)) != 0) |
848 | return (error); |
849 | |
850 | if ((tr->ps_pid == 1) && (securelevel > -1)) |
851 | return (EPERM1); |
852 | |
853 | if (ISSET(tr->ps_flags, PS_INEXEC)((tr->ps_flags) & (0x00000004))) |
854 | return (EAGAIN35); |
855 | |
856 | return (0); |
857 | } |
858 | |
859 | int |
860 | process_domem(struct proc *curp, struct process *tr, struct uio *uio, int req) |
861 | { |
862 | struct vmspace *vm; |
863 | int error; |
864 | vaddr_t addr; |
865 | vsize_t len; |
866 | |
867 | len = uio->uio_resid; |
868 | if (len == 0) |
869 | return 0; |
870 | |
871 | if ((error = process_checkioperm(curp, tr)) != 0) |
872 | return error; |
873 | |
874 | vm = tr->ps_vmspace; |
875 | if ((tr->ps_flags & PS_EXITING0x00000008) || (vm->vm_refcnt < 1)) |
876 | return EFAULT14; |
877 | addr = uio->uio_offset; |
Value stored to 'addr' is never read | |
878 | |
879 | uvmspace_addref(vm); |
880 | |
881 | error = uvm_io(&vm->vm_map, uio, UVM_IO_FIXPROT0x01); |
882 | |
883 | uvmspace_free(vm); |
884 | |
885 | if (error == 0 && req == PT_WRITE_I4) |
886 | pmap_proc_iflush(tr, addr, len); |
887 | |
888 | return error; |
889 | } |