Bug Summary

File:kern/sys_process.c
Warning:line 877, column 2
Value stored to 'addr' is never read

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name sys_process.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/kern/sys_process.c
1/* $OpenBSD: sys_process.c,v 1.95 2023/11/21 14:00:13 bluhm Exp $ */
2/* $NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $ */
3
4/*-
5 * Copyright (c) 1994 Christopher G. Demetriou. All rights reserved.
6 * Copyright (c) 1982, 1986, 1989, 1993
7 * The Regents of the University of California. All rights reserved.
8 * (c) UNIX System Laboratories, Inc.
9 * All or some portions of this file are derived from material licensed
10 * to the University of California by American Telephone and Telegraph
11 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
12 * the permission of UNIX System Laboratories, Inc.
13 *
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
16 * are met:
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
22 * 3. Neither the name of the University nor the names of its contributors
23 * may be used to endorse or promote products derived from this software
24 * without specific prior written permission.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
38 * from: @(#)sys_process.c 8.1 (Berkeley) 6/10/93
39 */
40
41/*
42 * References:
43 * (1) Bach's "The Design of the UNIX Operating System",
44 * (2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
45 * (3) the "4.4BSD Programmer's Reference Manual" published
46 * by USENIX and O'Reilly & Associates.
47 * The 4.4BSD PRM does a reasonably good job of documenting what the various
48 * ptrace() requests should actually do, and its text is quoted several times
49 * in this file.
50 */
51
52#include <sys/param.h>
53#include <sys/systm.h>
54#include <sys/exec.h>
55#include <sys/proc.h>
56#include <sys/signalvar.h>
57#include <sys/errno.h>
58#include <sys/malloc.h>
59#include <sys/ptrace.h>
60#include <sys/uio.h>
61#include <sys/sched.h>
62#include <sys/exec_elf.h>
63
64#include <sys/mount.h>
65#include <sys/syscallargs.h>
66
67#include <uvm/uvm_extern.h>
68
69#include <machine/reg.h>
70
71#ifdef PTRACE1
72
73static inline int process_checktracestate(struct process *_curpr,
74 struct process *_tr, struct proc *_t);
75static inline struct process *process_tprfind(pid_t _tpid, struct proc **_tp);
76
77int ptrace_ctrl(struct proc *, int, pid_t, caddr_t, int);
78int ptrace_ustate(struct proc *, int, pid_t, void *, int, register_t *);
79int ptrace_kstate(struct proc *, int, pid_t, void *);
80
81int global_ptrace; /* permit tracing of not children */
82
83
84/*
85 * Process debugging system call.
86 */
87int
88sys_ptrace(struct proc *p, void *v, register_t *retval)
89{
90 struct sys_ptrace_args /* {
91 syscallarg(int) req;
92 syscallarg(pid_t) pid;
93 syscallarg(caddr_t) addr;
94 syscallarg(int) data;
95 } */ *uap = v;
96 int req = SCARG(uap, req)((uap)->req.le.datum);
97 pid_t pid = SCARG(uap, pid)((uap)->pid.le.datum);
98 caddr_t uaddr = SCARG(uap, addr)((uap)->addr.le.datum); /* userspace */
99 void *kaddr = NULL((void *)0); /* kernelspace */
100 int data = SCARG(uap, data)((uap)->data.le.datum);
101 union {
102 struct ptrace_thread_state u_pts;
103 struct ptrace_io_desc u_piod;
104 struct ptrace_event u_pe;
105 struct ptrace_state u_ps;
106 register_t u_wcookie;
107 register_t u_pacmask[2];
108 } u;
109 int size = 0;
110 enum { NONE, IN, IN_ALLOC, OUT, OUT_ALLOC, IN_OUT } mode;
111 int kstate = 0;
112 int error;
113
114 *retval = 0;
115
116 /* Figure out what sort of copyin/out operations we'll do */
117 switch (req) {
118 case PT_TRACE_ME0:
119 case PT_CONTINUE7:
120 case PT_KILL8:
121 case PT_ATTACH9:
122 case PT_DETACH10:
123#ifdef PT_STEP(32 + 0)
124 case PT_STEP(32 + 0):
125#endif
126 /* control operations do no copyin/out; dispatch directly */
127 return ptrace_ctrl(p, req, pid, uaddr, data);
128
129 case PT_READ_I1:
130 case PT_READ_D2:
131 case PT_WRITE_I4:
132 case PT_WRITE_D5:
133 mode = NONE;
134 break;
135 case PT_IO11:
136 mode = IN_OUT;
137 size = sizeof u.u_piod;
138 data = size; /* suppress the data == size check */
139 break;
140 case PT_GET_THREAD_FIRST15:
141 mode = OUT;
142 size = sizeof u.u_pts;
143 kstate = 1;
144 break;
145 case PT_GET_THREAD_NEXT16:
146 mode = IN_OUT;
147 size = sizeof u.u_pts;
148 kstate = 1;
149 break;
150 case PT_GET_EVENT_MASK13:
151 mode = OUT;
152 size = sizeof u.u_pe;
153 kstate = 1;
154 break;
155 case PT_SET_EVENT_MASK12:
156 mode = IN;
157 size = sizeof u.u_pe;
158 kstate = 1;
159 break;
160 case PT_GET_PROCESS_STATE14:
161 mode = OUT;
162 size = sizeof u.u_ps;
163 kstate = 1;
164 break;
165 case PT_GETREGS(32 + 1):
166 mode = OUT_ALLOC;
167 size = sizeof(struct reg);
168 break;
169 case PT_SETREGS(32 + 2):
170 mode = IN_ALLOC;
171 size = sizeof(struct reg);
172 break;
173#ifdef PT_GETFPREGS(32 + 3)
174 case PT_GETFPREGS(32 + 3):
175 mode = OUT_ALLOC;
176 size = sizeof(struct fpreg);
177 break;
178#endif
179#ifdef PT_SETFPREGS(32 + 4)
180 case PT_SETFPREGS(32 + 4):
181 mode = IN_ALLOC;
182 size = sizeof(struct fpreg);
183 break;
184#endif
185#ifdef PT_GETXMMREGS
186 case PT_GETXMMREGS:
187 mode = OUT_ALLOC;
188 size = sizeof(struct xmmregs);
189 break;
190#endif
191#ifdef PT_SETXMMREGS
192 case PT_SETXMMREGS:
193 mode = IN_ALLOC;
194 size = sizeof(struct xmmregs);
195 break;
196#endif
197#ifdef PT_WCOOKIE
198 case PT_WCOOKIE:
199 mode = OUT;
200 size = sizeof u.u_wcookie;
201 data = size; /* suppress the data == size check */
202 break;
203#endif
204#ifdef PT_PACMASK
205 case PT_PACMASK:
206 mode = OUT;
207 size = sizeof u.u_pacmask;
208 break;
209#endif
210 default:
211 return EINVAL22;
212 }
213
214
215 /* Now do any copyin()s and allocations in a consistent manner */
216 switch (mode) {
217 case NONE:
218 kaddr = uaddr;
219 break;
220 case IN:
221 case IN_OUT:
222 case OUT:
223 KASSERT(size <= sizeof u)((size <= sizeof u) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/kern/sys_process.c"
, 223, "size <= sizeof u"));
224 if (data != size)
225 return EINVAL22;
226 if (mode == OUT)
227 memset(&u, 0, size)__builtin_memset((&u), (0), (size));
228 else { /* IN or IN_OUT */
229 if ((error = copyin(uaddr, &u, size)))
230 return error;
231 }
232 kaddr = &u;
233 break;
234 case IN_ALLOC:
235 kaddr = malloc(size, M_TEMP127, M_WAITOK0x0001);
236 if ((error = copyin(uaddr, kaddr, size))) {
237 free(kaddr, M_TEMP127, size);
238 return error;
239 }
240 break;
241 case OUT_ALLOC:
242 kaddr = malloc(size, M_TEMP127, M_WAITOK0x0001 | M_ZERO0x0008);
243 break;
244 }
245
246 if (kstate)
247 error = ptrace_kstate(p, req, pid, kaddr);
248 else
249 error = ptrace_ustate(p, req, pid, kaddr, data, retval);
250
251 /* Do any copyout()s and frees */
252 if (error == 0) {
253 switch (mode) {
254 case NONE:
255 case IN:
256 case IN_ALLOC:
257 break;
258 case IN_OUT:
259 case OUT:
260 error = copyout(&u, uaddr, size);
261 if (req == PT_IO11) {
262 /* historically, errors here are ignored */
263 error = 0;
264 }
265 break;
266 case OUT_ALLOC:
267 error = copyout(kaddr, uaddr, size);
268 break;
269 }
270 }
271
272 if (mode == IN_ALLOC || mode == OUT_ALLOC)
273 free(kaddr, M_TEMP127, size);
274 return error;
275}
276
277/*
278 * ptrace control requests: attach, detach, continue, kill, single-step, etc
279 */
280int
281ptrace_ctrl(struct proc *p, int req, pid_t pid, caddr_t addr, int data)
282{
283 struct proc *t; /* target thread */
284 struct process *tr; /* target process */
285 int error = 0;
286 int s;
287
288 switch (req) {
289 case PT_TRACE_ME0:
290 /* Just set the trace flag. */
291 tr = p->p_p;
292 if (ISSET(tr->ps_flags, PS_TRACED)((tr->ps_flags) & (0x00000200)))
293 return EBUSY16;
294 atomic_setbits_intx86_atomic_setbits_u32(&tr->ps_flags, PS_TRACED0x00000200);
295 tr->ps_oppid = tr->ps_pptr->ps_pid;
296 if (tr->ps_ptstat == NULL((void *)0))
297 tr->ps_ptstat = malloc(sizeof(*tr->ps_ptstat),
298 M_SUBPROC42, M_WAITOK0x0001);
299 memset(tr->ps_ptstat, 0, sizeof(*tr->ps_ptstat))__builtin_memset((tr->ps_ptstat), (0), (sizeof(*tr->ps_ptstat
)));
300 return 0;
301
302 /* calls that only operate on the PID */
303 case PT_KILL8:
304 case PT_ATTACH9:
305 case PT_DETACH10:
306 /* Find the process we're supposed to be operating on. */
307 if ((tr = prfind(pid)) == NULL((void *)0)) {
308 error = ESRCH3;
309 goto fail;
310 }
311 t = TAILQ_FIRST(&tr->ps_threads)((&tr->ps_threads)->tqh_first);
312 break;
313
314 /* calls that accept a PID or a thread ID */
315 case PT_CONTINUE7:
316#ifdef PT_STEP(32 + 0)
317 case PT_STEP(32 + 0):
318#endif
319 if ((tr = process_tprfind(pid, &t)) == NULL((void *)0)) {
320 error = ESRCH3;
321 goto fail;
322 }
323 break;
324 }
325
326 /* Check permissions/state */
327 if (req != PT_ATTACH9) {
328 /* Check that the data is a valid signal number or zero. */
329 if (req != PT_KILL8 && (data < 0 || data >= NSIG33)) {
330 error = EINVAL22;
331 goto fail;
332 }
333
334 /* Most operations require the target to already be traced */
335 if ((error = process_checktracestate(p->p_p, tr, t)))
336 goto fail;
337
338 /* Do single-step fixup if needed. */
339 FIX_SSTEP(t);
340 } else {
341 /*
342 * PT_ATTACH is the opposite; you can't attach to a process if:
343 * (1) it's the process that's doing the attaching,
344 */
345 if (tr == p->p_p) {
346 error = EINVAL22;
347 goto fail;
348 }
349
350 /*
351 * (2) it's a system process
352 */
353 if (ISSET(tr->ps_flags, PS_SYSTEM)((tr->ps_flags) & (0x00010000))) {
354 error = EPERM1;
355 goto fail;
356 }
357
358 /*
359 * (3) it's already being traced, or
360 */
361 if (ISSET(tr->ps_flags, PS_TRACED)((tr->ps_flags) & (0x00000200))) {
362 error = EBUSY16;
363 goto fail;
364 }
365
366 /*
367 * (4) it's in the middle of execve(2)
368 */
369 if (ISSET(tr->ps_flags, PS_INEXEC)((tr->ps_flags) & (0x00000004))) {
370 error = EAGAIN35;
371 goto fail;
372 }
373
374 /*
375 * (5) it's not owned by you, or the last exec
376 * gave us setuid/setgid privs (unless
377 * you're root), or...
378 *
379 * [Note: once PS_SUGID or PS_SUGIDEXEC gets set in
380 * execve(), they stay set until the process does
381 * another execve(). Hence this prevents a setuid
382 * process which revokes its special privileges using
383 * setuid() from being traced. This is good security.]
384 */
385 if ((tr->ps_ucred->cr_ruid != p->p_ucred->cr_ruid ||
386 ISSET(tr->ps_flags, PS_SUGIDEXEC | PS_SUGID)((tr->ps_flags) & (0x00000020 | 0x00000010))) &&
387 (error = suser(p)) != 0)
388 goto fail;
389
390 /*
391 * (5.5) it's not a child of the tracing process.
392 */
393 if (global_ptrace == 0 && !inferior(tr, p->p_p) &&
394 (error = suser(p)) != 0)
395 goto fail;
396
397 /*
398 * (6) ...it's init, which controls the security level
399 * of the entire system, and the system was not
400 * compiled with permanently insecure mode turned
401 * on.
402 */
403 if ((tr->ps_pid == 1) && (securelevel > -1)) {
404 error = EPERM1;
405 goto fail;
406 }
407
408 /*
409 * (7) it's an ancestor of the current process and
410 * not init (because that would create a loop in
411 * the process graph).
412 */
413 if (tr->ps_pid != 1 && inferior(p->p_p, tr)) {
414 error = EINVAL22;
415 goto fail;
416 }
417 }
418
419 switch (req) {
420
421#ifdef PT_STEP(32 + 0)
422 case PT_STEP(32 + 0):
423 /*
424 * From the 4.4BSD PRM:
425 * "Execution continues as in request PT_CONTINUE; however
426 * as soon as possible after execution of at least one
427 * instruction, execution stops again. [ ... ]"
428 */
429#endif
430 case PT_CONTINUE7:
431 /*
432 * From the 4.4BSD PRM:
433 * "The data argument is taken as a signal number and the
434 * child's execution continues at location addr as if it
435 * incurred that signal. Normally the signal number will
436 * be either 0 to indicate that the signal that caused the
437 * stop should be ignored, or that value fetched out of
438 * the process's image indicating which signal caused
439 * the stop. If addr is (int *)1 then execution continues
440 * from where it stopped."
441 */
442
443 if (pid < THREAD_PID_OFFSET100000 && tr->ps_single)
444 t = tr->ps_single;
445
446 /* If the address parameter is not (int *)1, set the pc. */
447 if ((int *)addr != (int *)1)
448 if ((error = process_set_pc(t, addr)) != 0)
449 goto fail;
450
451#ifdef PT_STEP(32 + 0)
452 /*
453 * Arrange for a single-step, if that's requested and possible.
454 */
455 error = process_sstep(t, req == PT_STEP(32 + 0));
456 if (error)
457 goto fail;
458#endif
459 goto sendsig;
460
461 case PT_DETACH10:
462 /*
463 * From the 4.4BSD PRM:
464 * "The data argument is taken as a signal number and the
465 * child's execution continues at location addr as if it
466 * incurred that signal. Normally the signal number will
467 * be either 0 to indicate that the signal that caused the
468 * stop should be ignored, or that value fetched out of
469 * the process's image indicating which signal caused
470 * the stop. If addr is (int *)1 then execution continues
471 * from where it stopped."
472 */
473
474 if (pid < THREAD_PID_OFFSET100000 && tr->ps_single)
475 t = tr->ps_single;
476
477#ifdef PT_STEP(32 + 0)
478 /*
479 * Stop single stepping.
480 */
481 error = process_sstep(t, 0);
482 if (error)
483 goto fail;
484#endif
485
486 process_untrace(tr);
487 atomic_clearbits_intx86_atomic_clearbits_u32(&tr->ps_flags, PS_WAITED0x00000400);
488
489 sendsig:
490 memset(tr->ps_ptstat, 0, sizeof(*tr->ps_ptstat))__builtin_memset((tr->ps_ptstat), (0), (sizeof(*tr->ps_ptstat
)));
491
492 /* Finally, deliver the requested signal (or none). */
493 if (t->p_stat == SSTOP4) {
494 tr->ps_xsig = data;
495 SCHED_LOCK(s)do { s = splraise(0xc); __mp_lock(&sched_lock); } while (
0);
496 setrunnable(t);
497 SCHED_UNLOCK(s)do { __mp_unlock(&sched_lock); spllower(s); } while ( 0);
498 } else {
499 if (data != 0)
500 psignal(t, data);
501 }
502 break;
503
504 case PT_KILL8:
505 if (pid < THREAD_PID_OFFSET100000 && tr->ps_single)
506 t = tr->ps_single;
507
508 /* just send the process a KILL signal. */
509 data = SIGKILL9;
510 goto sendsig; /* in PT_CONTINUE, above. */
511
512 case PT_ATTACH9:
513 /*
514 * As was done in procfs:
515 * Go ahead and set the trace flag.
516 * Save the old parent (it's reset in
517 * _DETACH, and also in kern_exit.c:wait4()
518 * Reparent the process so that the tracing
519 * proc gets to see all the action.
520 * Stop the target.
521 */
522 atomic_setbits_intx86_atomic_setbits_u32(&tr->ps_flags, PS_TRACED0x00000200);
523 tr->ps_oppid = tr->ps_pptr->ps_pid;
524 process_reparent(tr, p->p_p);
525 if (tr->ps_ptstat == NULL((void *)0))
526 tr->ps_ptstat = malloc(sizeof(*tr->ps_ptstat),
527 M_SUBPROC42, M_WAITOK0x0001);
528 data = SIGSTOP17;
529 goto sendsig;
530 default:
531 KASSERTMSG(0, "%s: unhandled request %d", __func__, req)((0) ? (void)0 : panic("kernel %sassertion \"%s\" failed: file \"%s\", line %d"
" " "%s: unhandled request %d", "diagnostic ", "0", "/usr/src/sys/kern/sys_process.c"
, 531, __func__, req));
532 break;
533 }
534
535fail:
536 return error;
537}
538
539/*
540 * ptrace kernel-state requests: thread list, event mask, process state
541 */
542int
543ptrace_kstate(struct proc *p, int req, pid_t pid, void *addr)
544{
545 struct process *tr; /* target process */
546 struct ptrace_event *pe = addr;
547 int error;
548
549 KASSERT((p->p_flag & P_SYSTEM) == 0)(((p->p_flag & 0x00000200) == 0) ? (void)0 : __assert(
"diagnostic ", "/usr/src/sys/kern/sys_process.c", 549, "(p->p_flag & P_SYSTEM) == 0"
));
550
551 /* Find the process we're supposed to be operating on. */
552 if ((tr = prfind(pid)) == NULL((void *)0))
553 return ESRCH3;
554
555 if ((error = process_checktracestate(p->p_p, tr, NULL((void *)0))))
556 return error;
557
558 switch (req) {
559 case PT_GET_THREAD_FIRST15:
560 case PT_GET_THREAD_NEXT16:
561 {
562 struct ptrace_thread_state *pts = addr;
563 struct proc *t;
564
565 if (req == PT_GET_THREAD_NEXT16) {
566 t = tfind_user(pts->pts_tid, tr);
567 if (t == NULL((void *)0) || ISSET(t->p_flag, P_WEXIT)((t->p_flag) & (0x00002000)))
568 return ESRCH3;
569 t = TAILQ_NEXT(t, p_thr_link)((t)->p_thr_link.tqe_next);
570 } else {
571 t = TAILQ_FIRST(&tr->ps_threads)((&tr->ps_threads)->tqh_first);
572 }
573
574 if (t == NULL((void *)0))
575 pts->pts_tid = -1;
576 else
577 pts->pts_tid = t->p_tid + THREAD_PID_OFFSET100000;
578 return 0;
579 }
580 }
581
582 switch (req) {
583 case PT_GET_EVENT_MASK13:
584 pe->pe_set_event = tr->ps_ptmask;
585 break;
586 case PT_SET_EVENT_MASK12:
587 tr->ps_ptmask = pe->pe_set_event;
588 break;
589 case PT_GET_PROCESS_STATE14:
590 if (tr->ps_single)
591 tr->ps_ptstat->pe_tid =
592 tr->ps_single->p_tid + THREAD_PID_OFFSET100000;
593 memcpy(addr, tr->ps_ptstat, sizeof *tr->ps_ptstat)__builtin_memcpy((addr), (tr->ps_ptstat), (sizeof *tr->
ps_ptstat));
594 break;
595 default:
596 KASSERTMSG(0, "%s: unhandled request %d", __func__, req)((0) ? (void)0 : panic("kernel %sassertion \"%s\" failed: file \"%s\", line %d"
" " "%s: unhandled request %d", "diagnostic ", "0", "/usr/src/sys/kern/sys_process.c"
, 596, __func__, req));
597 break;
598 }
599
600 return 0;
601}
602
603/*
604 * ptrace user-state requests: memory access, registers, stack cookie
605 */
606int
607ptrace_ustate(struct proc *p, int req, pid_t pid, void *addr, int data,
608 register_t *retval)
609{
610 struct proc *t; /* target thread */
611 struct process *tr; /* target process */
612 struct uio uio;
613 struct iovec iov;
614 int error, write;
615 int temp = 0;
616
617 KASSERT((p->p_flag & P_SYSTEM) == 0)(((p->p_flag & 0x00000200) == 0) ? (void)0 : __assert(
"diagnostic ", "/usr/src/sys/kern/sys_process.c", 617, "(p->p_flag & P_SYSTEM) == 0"
));
618
619 /* Accept either PID or TID */
620 if ((tr = process_tprfind(pid, &t)) == NULL((void *)0))
621 return ESRCH3;
622
623 if ((error = process_checktracestate(p->p_p, tr, t)))
624 return error;
625
626 FIX_SSTEP(t);
627
628 /* Now do the operation. */
629 write = 0;
630
631 if ((error = process_checkioperm(p, tr)) != 0)
632 return error;
633
634 switch (req) {
635 case PT_WRITE_I4: /* XXX no separate I and D spaces */
636 case PT_WRITE_D5:
637 write = 1;
638 temp = data;
639 case PT_READ_I1: /* XXX no separate I and D spaces */
640 case PT_READ_D2:
641 /* write = 0 done above. */
642 iov.iov_base = (caddr_t)&temp;
643 iov.iov_len = sizeof(int);
644 uio.uio_iov = &iov;
645 uio.uio_iovcnt = 1;
646 uio.uio_offset = (off_t)(vaddr_t)addr;
647 uio.uio_resid = sizeof(int);
648 uio.uio_segflg = UIO_SYSSPACE;
649 uio.uio_rw = write ? UIO_WRITE : UIO_READ;
650 uio.uio_procp = p;
651 error = process_domem(p, tr, &uio, write ? PT_WRITE_I4 :
652 PT_READ_I1);
653 if (write == 0)
654 *retval = temp;
655 return error;
656
657 case PT_IO11:
658 {
659 struct ptrace_io_desc *piod = addr;
660
661 iov.iov_base = piod->piod_addr;
662 iov.iov_len = piod->piod_len;
663 uio.uio_iov = &iov;
664 uio.uio_iovcnt = 1;
665 uio.uio_offset = (off_t)(vaddr_t)piod->piod_offs;
666 uio.uio_resid = piod->piod_len;
667 uio.uio_segflg = UIO_USERSPACE;
668 uio.uio_procp = p;
669 switch (piod->piod_op) {
670 case PIOD_READ_I3:
671 req = PT_READ_I1;
672 uio.uio_rw = UIO_READ;
673 break;
674 case PIOD_READ_D1:
675 req = PT_READ_D2;
676 uio.uio_rw = UIO_READ;
677 break;
678 case PIOD_WRITE_I4:
679 req = PT_WRITE_I4;
680 uio.uio_rw = UIO_WRITE;
681 break;
682 case PIOD_WRITE_D2:
683 req = PT_WRITE_D5;
684 uio.uio_rw = UIO_WRITE;
685 break;
686 case PIOD_READ_AUXV5:
687 req = PT_READ_D2;
688 uio.uio_rw = UIO_READ;
689 temp = ELF_AUX_WORDS(sizeof(Aux64Info) * 9 / sizeof(char *)) * sizeof(char *);
690 if (uio.uio_offset > temp)
691 return EIO5;
692 if (uio.uio_resid > temp - uio.uio_offset)
693 uio.uio_resid = temp - uio.uio_offset;
694 piod->piod_len = iov.iov_len = uio.uio_resid;
695 uio.uio_offset += tr->ps_auxinfo;
696#ifdef MACHINE_STACK_GROWS_UP
697 if (uio.uio_offset < (off_t)tr->ps_strings)
698 return EIO5;
699#else
700 if (uio.uio_offset > (off_t)tr->ps_strings)
701 return EIO5;
702 if ((uio.uio_offset + uio.uio_resid) >
703 (off_t)tr->ps_strings)
704 uio.uio_resid = (off_t)tr->ps_strings -
705 uio.uio_offset;
706#endif
707 break;
708 default:
709 return EINVAL22;
710 }
711 error = process_domem(p, tr, &uio, req);
712 piod->piod_len -= uio.uio_resid;
713 return error;
714 }
715
716 case PT_SETREGS(32 + 2):
717 return process_write_regs(t, addr);
718 case PT_GETREGS(32 + 1):
719 return process_read_regs(t, addr);
720
721#ifdef PT_SETFPREGS(32 + 4)
722 case PT_SETFPREGS(32 + 4):
723 return process_write_fpregs(t, addr);
724#endif
725#ifdef PT_SETFPREGS(32 + 4)
726 case PT_GETFPREGS(32 + 3):
727 return process_read_fpregs(t, addr);
728#endif
729#ifdef PT_SETXMMREGS
730 case PT_SETXMMREGS:
731 return process_write_xmmregs(t, addr);
732#endif
733#ifdef PT_SETXMMREGS
734 case PT_GETXMMREGS:
735 return process_read_xmmregs(t, addr);
736#endif
737#ifdef PT_WCOOKIE
738 case PT_WCOOKIE:
739 *(register_t *)addr = process_get_wcookie(t);
740 return 0;
741#endif
742#ifdef PT_PACMASK
743 case PT_PACMASK:
744 ((register_t *)addr)[0] = process_get_pacmask(t);
745 ((register_t *)addr)[1] = process_get_pacmask(t);
746 return 0;
747#endif
748 default:
749 KASSERTMSG(0, "%s: unhandled request %d", __func__, req)((0) ? (void)0 : panic("kernel %sassertion \"%s\" failed: file \"%s\", line %d"
" " "%s: unhandled request %d", "diagnostic ", "0", "/usr/src/sys/kern/sys_process.c"
, 749, __func__, req));
750 break;
751 }
752
753 return 0;
754}
755
756
757/*
758 * Helper for doing "it could be a PID or TID" lookup. On failure
759 * returns NULL; on success returns the selected process and sets *tp
760 * to an appropriate thread in that process.
761 */
762static inline struct process *
763process_tprfind(pid_t tpid, struct proc **tp)
764{
765 if (tpid > THREAD_PID_OFFSET100000) {
766 struct proc *t = tfind(tpid - THREAD_PID_OFFSET100000);
767
768 if (t == NULL((void *)0))
769 return NULL((void *)0);
770 *tp = t;
771 return t->p_p;
772 } else {
773 struct process *tr = prfind(tpid);
774
775 if (tr == NULL((void *)0))
776 return NULL((void *)0);
777 *tp = TAILQ_FIRST(&tr->ps_threads)((&tr->ps_threads)->tqh_first);
778 return tr;
779 }
780}
781
782
783/*
784 * Check whether 'tr' is currently traced by 'curpr' and in a state
785 * to be manipulated. If 't' is supplied then it must be stopped and
786 * waited for.
787 */
788static inline int
789process_checktracestate(struct process *curpr, struct process *tr,
790 struct proc *t)
791{
792 /*
793 * You can't do what you want to the process if:
794 * (1) It's not being traced at all,
795 */
796 if (!ISSET(tr->ps_flags, PS_TRACED)((tr->ps_flags) & (0x00000200)))
797 return EPERM1;
798
799 /*
800 * (2) it's not being traced by _you_, or
801 */
802 if (tr->ps_pptr != curpr)
803 return EBUSY16;
804
805 /*
806 * (3) it's in the middle of execve(2)
807 */
808 if (ISSET(tr->ps_flags, PS_INEXEC)((tr->ps_flags) & (0x00000004)))
809 return EAGAIN35;
810
811 /*
812 * (4) if a thread was specified and it's not currently stopped.
813 */
814 if (t != NULL((void *)0) &&
815 (t->p_stat != SSTOP4 || !ISSET(tr->ps_flags, PS_WAITED)((tr->ps_flags) & (0x00000400))))
816 return EBUSY16;
817
818 return 0;
819}
820
821#endif /* PTRACE */
822
823/*
824 * Check if a process is allowed to fiddle with the memory of another.
825 *
826 * p = tracer
827 * tr = tracee
828 *
829 * 1. You can't attach to a process not owned by you or one that has raised
830 * its privileges.
831 * 1a. ...unless you are root.
832 *
833 * 2. init is always off-limits because it can control the securelevel.
834 * 2a. ...unless securelevel is permanently set to insecure.
835 *
836 * 3. Processes that are in the process of doing an exec() are always
837 * off-limits because of the can of worms they are. Just wait a
838 * second.
839 */
840int
841process_checkioperm(struct proc *p, struct process *tr)
842{
843 int error;
844
845 if ((tr->ps_ucred->cr_ruid != p->p_ucred->cr_ruid ||
846 ISSET(tr->ps_flags, PS_SUGIDEXEC | PS_SUGID)((tr->ps_flags) & (0x00000020 | 0x00000010))) &&
847 (error = suser(p)) != 0)
848 return (error);
849
850 if ((tr->ps_pid == 1) && (securelevel > -1))
851 return (EPERM1);
852
853 if (ISSET(tr->ps_flags, PS_INEXEC)((tr->ps_flags) & (0x00000004)))
854 return (EAGAIN35);
855
856 return (0);
857}
858
859int
860process_domem(struct proc *curp, struct process *tr, struct uio *uio, int req)
861{
862 struct vmspace *vm;
863 int error;
864 vaddr_t addr;
865 vsize_t len;
866
867 len = uio->uio_resid;
868 if (len == 0)
869 return 0;
870
871 if ((error = process_checkioperm(curp, tr)) != 0)
872 return error;
873
874 vm = tr->ps_vmspace;
875 if ((tr->ps_flags & PS_EXITING0x00000008) || (vm->vm_refcnt < 1))
876 return EFAULT14;
877 addr = uio->uio_offset;
Value stored to 'addr' is never read
878
879 uvmspace_addref(vm);
880
881 error = uvm_io(&vm->vm_map, uio, UVM_IO_FIXPROT0x01);
882
883 uvmspace_free(vm);
884
885 if (error == 0 && req == PT_WRITE_I4)
886 pmap_proc_iflush(tr, addr, len);
887
888 return error;
889}