ptrace_syscall.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430
  1. // SPDX-License-Identifier: GPL-2.0
  2. #define _GNU_SOURCE
  3. #include <sys/ptrace.h>
  4. #include <sys/types.h>
  5. #include <sys/wait.h>
  6. #include <sys/syscall.h>
  7. #include <sys/user.h>
  8. #include <unistd.h>
  9. #include <errno.h>
  10. #include <stddef.h>
  11. #include <stdio.h>
  12. #include <err.h>
  13. #include <string.h>
  14. #include <asm/ptrace-abi.h>
  15. #include <sys/auxv.h>
  16. /* Bitness-agnostic defines for user_regs_struct fields. */
  17. #ifdef __x86_64__
  18. # define user_syscall_nr orig_rax
  19. # define user_arg0 rdi
  20. # define user_arg1 rsi
  21. # define user_arg2 rdx
  22. # define user_arg3 r10
  23. # define user_arg4 r8
  24. # define user_arg5 r9
  25. # define user_ip rip
  26. # define user_ax rax
  27. #else
  28. # define user_syscall_nr orig_eax
  29. # define user_arg0 ebx
  30. # define user_arg1 ecx
  31. # define user_arg2 edx
  32. # define user_arg3 esi
  33. # define user_arg4 edi
  34. # define user_arg5 ebp
  35. # define user_ip eip
  36. # define user_ax eax
  37. #endif
  38. static int nerrs = 0;
  39. struct syscall_args32 {
  40. uint32_t nr, arg0, arg1, arg2, arg3, arg4, arg5;
  41. };
  42. #ifdef __i386__
  43. extern void sys32_helper(struct syscall_args32 *, void *);
  44. extern void int80_and_ret(void);
  45. #endif
  46. /*
  47. * Helper to invoke int80 with controlled regs and capture the final regs.
  48. */
  49. static void do_full_int80(struct syscall_args32 *args)
  50. {
  51. #ifdef __x86_64__
  52. register unsigned long bp asm("bp") = args->arg5;
  53. asm volatile ("int $0x80"
  54. : "+a" (args->nr),
  55. "+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2),
  56. "+S" (args->arg3), "+D" (args->arg4), "+r" (bp)
  57. : : "r8", "r9", "r10", "r11");
  58. args->arg5 = bp;
  59. #else
  60. sys32_helper(args, int80_and_ret);
  61. #endif
  62. }
  63. #ifdef __i386__
  64. static void (*vsyscall32)(void);
  65. /*
  66. * Nasty helper to invoke AT_SYSINFO (i.e. __kernel_vsyscall) with
  67. * controlled regs and capture the final regs. This is so nasty that it
  68. * crashes my copy of gdb :)
  69. */
  70. static void do_full_vsyscall32(struct syscall_args32 *args)
  71. {
  72. sys32_helper(args, vsyscall32);
  73. }
  74. #endif
  75. static siginfo_t wait_trap(pid_t chld)
  76. {
  77. siginfo_t si;
  78. if (waitid(P_PID, chld, &si, WEXITED|WSTOPPED) != 0)
  79. err(1, "waitid");
  80. if (si.si_pid != chld)
  81. errx(1, "got unexpected pid in event\n");
  82. if (si.si_code != CLD_TRAPPED)
  83. errx(1, "got unexpected event type %d\n", si.si_code);
  84. return si;
  85. }
  86. static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
  87. int flags)
  88. {
  89. struct sigaction sa;
  90. memset(&sa, 0, sizeof(sa));
  91. sa.sa_sigaction = handler;
  92. sa.sa_flags = SA_SIGINFO | flags;
  93. sigemptyset(&sa.sa_mask);
  94. if (sigaction(sig, &sa, 0))
  95. err(1, "sigaction");
  96. }
  97. static void setsigign(int sig, int flags)
  98. {
  99. struct sigaction sa;
  100. memset(&sa, 0, sizeof(sa));
  101. sa.sa_sigaction = (void *)SIG_IGN;
  102. sa.sa_flags = flags;
  103. sigemptyset(&sa.sa_mask);
  104. if (sigaction(sig, &sa, 0))
  105. err(1, "sigaction");
  106. }
  107. static void clearhandler(int sig)
  108. {
  109. struct sigaction sa;
  110. memset(&sa, 0, sizeof(sa));
  111. sa.sa_handler = SIG_DFL;
  112. sigemptyset(&sa.sa_mask);
  113. if (sigaction(sig, &sa, 0))
  114. err(1, "sigaction");
  115. }
  116. #ifdef __x86_64__
  117. # define REG_BP REG_RBP
  118. #else
  119. # define REG_BP REG_EBP
  120. #endif
  121. static void empty_handler(int sig, siginfo_t *si, void *ctx_void)
  122. {
  123. }
  124. static void test_sys32_regs(void (*do_syscall)(struct syscall_args32 *))
  125. {
  126. struct syscall_args32 args = {
  127. .nr = 224, /* gettid */
  128. .arg0 = 10, .arg1 = 11, .arg2 = 12,
  129. .arg3 = 13, .arg4 = 14, .arg5 = 15,
  130. };
  131. do_syscall(&args);
  132. if (args.nr != getpid() ||
  133. args.arg0 != 10 || args.arg1 != 11 || args.arg2 != 12 ||
  134. args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
  135. printf("[FAIL]\tgetpid() failed to preserve regs\n");
  136. nerrs++;
  137. } else {
  138. printf("[OK]\tgetpid() preserves regs\n");
  139. }
  140. sethandler(SIGUSR1, empty_handler, 0);
  141. args.nr = 37; /* kill */
  142. args.arg0 = getpid();
  143. args.arg1 = SIGUSR1;
  144. do_syscall(&args);
  145. if (args.nr != 0 ||
  146. args.arg0 != getpid() || args.arg1 != SIGUSR1 || args.arg2 != 12 ||
  147. args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
  148. printf("[FAIL]\tkill(getpid(), SIGUSR1) failed to preserve regs\n");
  149. nerrs++;
  150. } else {
  151. printf("[OK]\tkill(getpid(), SIGUSR1) preserves regs\n");
  152. }
  153. clearhandler(SIGUSR1);
  154. }
  155. static void test_ptrace_syscall_restart(void)
  156. {
  157. printf("[RUN]\tptrace-induced syscall restart\n");
  158. pid_t chld = fork();
  159. if (chld < 0)
  160. err(1, "fork");
  161. if (chld == 0) {
  162. if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
  163. err(1, "PTRACE_TRACEME");
  164. pid_t pid = getpid(), tid = syscall(SYS_gettid);
  165. printf("\tChild will make one syscall\n");
  166. syscall(SYS_tgkill, pid, tid, SIGSTOP);
  167. syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
  168. _exit(0);
  169. }
  170. int status;
  171. /* Wait for SIGSTOP. */
  172. if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
  173. err(1, "waitpid");
  174. struct user_regs_struct regs;
  175. printf("[RUN]\tSYSEMU\n");
  176. if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
  177. err(1, "PTRACE_SYSEMU");
  178. wait_trap(chld);
  179. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  180. err(1, "PTRACE_GETREGS");
  181. if (regs.user_syscall_nr != SYS_gettid ||
  182. regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
  183. regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
  184. regs.user_arg4 != 14 || regs.user_arg5 != 15) {
  185. printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  186. nerrs++;
  187. } else {
  188. printf("[OK]\tInitial nr and args are correct\n");
  189. }
  190. printf("[RUN]\tRestart the syscall (ip = 0x%lx)\n",
  191. (unsigned long)regs.user_ip);
  192. /*
  193. * This does exactly what it appears to do if syscall is int80 or
  194. * SYSCALL64. For SYSCALL32 or SYSENTER, though, this is highly
  195. * magical. It needs to work so that ptrace and syscall restart
  196. * work as expected.
  197. */
  198. regs.user_ax = regs.user_syscall_nr;
  199. regs.user_ip -= 2;
  200. if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
  201. err(1, "PTRACE_SETREGS");
  202. if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
  203. err(1, "PTRACE_SYSEMU");
  204. wait_trap(chld);
  205. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  206. err(1, "PTRACE_GETREGS");
  207. if (regs.user_syscall_nr != SYS_gettid ||
  208. regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
  209. regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
  210. regs.user_arg4 != 14 || regs.user_arg5 != 15) {
  211. printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  212. nerrs++;
  213. } else {
  214. printf("[OK]\tRestarted nr and args are correct\n");
  215. }
  216. printf("[RUN]\tChange nr and args and restart the syscall (ip = 0x%lx)\n",
  217. (unsigned long)regs.user_ip);
  218. regs.user_ax = SYS_getpid;
  219. regs.user_arg0 = 20;
  220. regs.user_arg1 = 21;
  221. regs.user_arg2 = 22;
  222. regs.user_arg3 = 23;
  223. regs.user_arg4 = 24;
  224. regs.user_arg5 = 25;
  225. regs.user_ip -= 2;
  226. if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
  227. err(1, "PTRACE_SETREGS");
  228. if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
  229. err(1, "PTRACE_SYSEMU");
  230. wait_trap(chld);
  231. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  232. err(1, "PTRACE_GETREGS");
  233. if (regs.user_syscall_nr != SYS_getpid ||
  234. regs.user_arg0 != 20 || regs.user_arg1 != 21 || regs.user_arg2 != 22 ||
  235. regs.user_arg3 != 23 || regs.user_arg4 != 24 || regs.user_arg5 != 25) {
  236. printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  237. nerrs++;
  238. } else {
  239. printf("[OK]\tReplacement nr and args are correct\n");
  240. }
  241. if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
  242. err(1, "PTRACE_CONT");
  243. if (waitpid(chld, &status, 0) != chld)
  244. err(1, "waitpid");
  245. if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
  246. printf("[FAIL]\tChild failed\n");
  247. nerrs++;
  248. } else {
  249. printf("[OK]\tChild exited cleanly\n");
  250. }
  251. }
  252. static void test_restart_under_ptrace(void)
  253. {
  254. printf("[RUN]\tkernel syscall restart under ptrace\n");
  255. pid_t chld = fork();
  256. if (chld < 0)
  257. err(1, "fork");
  258. if (chld == 0) {
  259. if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
  260. err(1, "PTRACE_TRACEME");
  261. pid_t pid = getpid(), tid = syscall(SYS_gettid);
  262. printf("\tChild will take a nap until signaled\n");
  263. setsigign(SIGUSR1, SA_RESTART);
  264. syscall(SYS_tgkill, pid, tid, SIGSTOP);
  265. syscall(SYS_pause, 0, 0, 0, 0, 0, 0);
  266. _exit(0);
  267. }
  268. int status;
  269. /* Wait for SIGSTOP. */
  270. if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
  271. err(1, "waitpid");
  272. struct user_regs_struct regs;
  273. printf("[RUN]\tSYSCALL\n");
  274. if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
  275. err(1, "PTRACE_SYSCALL");
  276. wait_trap(chld);
  277. /* We should be stopped at pause(2) entry. */
  278. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  279. err(1, "PTRACE_GETREGS");
  280. if (regs.user_syscall_nr != SYS_pause ||
  281. regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
  282. regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
  283. regs.user_arg4 != 0 || regs.user_arg5 != 0) {
  284. printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  285. nerrs++;
  286. } else {
  287. printf("[OK]\tInitial nr and args are correct\n");
  288. }
  289. /* Interrupt it. */
  290. kill(chld, SIGUSR1);
  291. /* Advance. We should be stopped at exit. */
  292. printf("[RUN]\tSYSCALL\n");
  293. if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
  294. err(1, "PTRACE_SYSCALL");
  295. wait_trap(chld);
  296. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  297. err(1, "PTRACE_GETREGS");
  298. if (regs.user_syscall_nr != SYS_pause ||
  299. regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
  300. regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
  301. regs.user_arg4 != 0 || regs.user_arg5 != 0) {
  302. printf("[FAIL]\tArgs after SIGUSR1 are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  303. nerrs++;
  304. } else {
  305. printf("[OK]\tArgs after SIGUSR1 are correct (ax = %ld)\n",
  306. (long)regs.user_ax);
  307. }
  308. /* Poke the regs back in. This must not break anything. */
  309. if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
  310. err(1, "PTRACE_SETREGS");
  311. /* Catch the (ignored) SIGUSR1. */
  312. if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
  313. err(1, "PTRACE_CONT");
  314. if (waitpid(chld, &status, 0) != chld)
  315. err(1, "waitpid");
  316. if (!WIFSTOPPED(status)) {
  317. printf("[FAIL]\tChild was stopped for SIGUSR1 (status = 0x%x)\n", status);
  318. nerrs++;
  319. } else {
  320. printf("[OK]\tChild got SIGUSR1\n");
  321. }
  322. /* The next event should be pause(2) again. */
  323. printf("[RUN]\tStep again\n");
  324. if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
  325. err(1, "PTRACE_SYSCALL");
  326. wait_trap(chld);
  327. /* We should be stopped at pause(2) entry. */
  328. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  329. err(1, "PTRACE_GETREGS");
  330. if (regs.user_syscall_nr != SYS_pause ||
  331. regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
  332. regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
  333. regs.user_arg4 != 0 || regs.user_arg5 != 0) {
  334. printf("[FAIL]\tpause did not restart (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  335. nerrs++;
  336. } else {
  337. printf("[OK]\tpause(2) restarted correctly\n");
  338. }
  339. /* Kill it. */
  340. kill(chld, SIGKILL);
  341. if (waitpid(chld, &status, 0) != chld)
  342. err(1, "waitpid");
  343. }
  344. int main()
  345. {
  346. printf("[RUN]\tCheck int80 return regs\n");
  347. test_sys32_regs(do_full_int80);
  348. #if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ > 2 || __GLIBC_MINOR__ >= 16)
  349. vsyscall32 = (void *)getauxval(AT_SYSINFO);
  350. if (vsyscall32) {
  351. printf("[RUN]\tCheck AT_SYSINFO return regs\n");
  352. test_sys32_regs(do_full_vsyscall32);
  353. } else {
  354. printf("[SKIP]\tAT_SYSINFO is not available\n");
  355. }
  356. #endif
  357. test_ptrace_syscall_restart();
  358. test_restart_under_ptrace();
  359. return 0;
  360. }