[PATCH] fix kill_proc_info() vs fork() theoretical race
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / kernel / ptrace.c
CommitLineData
1da177e4
LT
1/*
2 * linux/kernel/ptrace.c
3 *
4 * (C) Copyright 1999 Linus Torvalds
5 *
6 * Common interfaces for "ptrace()" which we do not want
7 * to continually duplicate across every architecture.
8 */
9
c59ede7b 10#include <linux/capability.h>
1da177e4
LT
11#include <linux/module.h>
12#include <linux/sched.h>
13#include <linux/errno.h>
14#include <linux/mm.h>
15#include <linux/highmem.h>
16#include <linux/pagemap.h>
17#include <linux/smp_lock.h>
18#include <linux/ptrace.h>
19#include <linux/security.h>
7ed20e1a 20#include <linux/signal.h>
1da177e4
LT
21
22#include <asm/pgtable.h>
23#include <asm/uaccess.h>
24
25/*
26 * ptrace a task: make the debugger its new parent and
27 * move it to the ptrace list.
28 *
29 * Must be called with the tasklist lock write-held.
30 */
31void __ptrace_link(task_t *child, task_t *new_parent)
32{
33 if (!list_empty(&child->ptrace_list))
34 BUG();
35 if (child->parent == new_parent)
36 return;
37 list_add(&child->ptrace_list, &child->parent->ptrace_children);
38 REMOVE_LINKS(child);
39 child->parent = new_parent;
40 SET_LINKS(child);
41}
42
43/*
44 * Turn a tracing stop into a normal stop now, since with no tracer there
45 * would be no way to wake it up with SIGCONT or SIGKILL. If there was a
46 * signal sent that would resume the child, but didn't because it was in
47 * TASK_TRACED, resume it now.
48 * Requires that irqs be disabled.
49 */
50void ptrace_untrace(task_t *child)
51{
52 spin_lock(&child->sighand->siglock);
53 if (child->state == TASK_TRACED) {
54 if (child->signal->flags & SIGNAL_STOP_STOPPED) {
55 child->state = TASK_STOPPED;
56 } else {
57 signal_wake_up(child, 1);
58 }
59 }
30e0fca6
AA
60 if (child->signal->flags & SIGNAL_GROUP_EXIT) {
61 sigaddset(&child->pending.signal, SIGKILL);
62 signal_wake_up(child, 1);
63 }
1da177e4
LT
64 spin_unlock(&child->sighand->siglock);
65}
66
67/*
68 * unptrace a task: move it back to its original parent and
69 * remove it from the ptrace list.
70 *
71 * Must be called with the tasklist lock write-held.
72 */
73void __ptrace_unlink(task_t *child)
74{
75 if (!child->ptrace)
76 BUG();
77 child->ptrace = 0;
78 if (!list_empty(&child->ptrace_list)) {
79 list_del_init(&child->ptrace_list);
80 REMOVE_LINKS(child);
81 child->parent = child->real_parent;
82 SET_LINKS(child);
83 }
84
30e0fca6 85 ptrace_untrace(child);
1da177e4
LT
86}
87
88/*
89 * Check that we have indeed attached to the thing..
90 */
91int ptrace_check_attach(struct task_struct *child, int kill)
92{
93 int ret = -ESRCH;
94
95 /*
96 * We take the read lock around doing both checks to close a
97 * possible race where someone else was tracing our child and
98 * detached between these two checks. After this locked check,
99 * we are sure that this is our traced child and that can only
100 * be changed by us so it's not changing right after this.
101 */
102 read_lock(&tasklist_lock);
103 if ((child->ptrace & PT_PTRACED) && child->parent == current &&
104 (!(child->ptrace & PT_ATTACHED) || child->real_parent != current)
105 && child->signal != NULL) {
106 ret = 0;
107 spin_lock_irq(&child->sighand->siglock);
108 if (child->state == TASK_STOPPED) {
109 child->state = TASK_TRACED;
110 } else if (child->state != TASK_TRACED && !kill) {
111 ret = -ESRCH;
112 }
113 spin_unlock_irq(&child->sighand->siglock);
114 }
115 read_unlock(&tasklist_lock);
116
117 if (!ret && !kill) {
118 wait_task_inactive(child);
119 }
120
121 /* All systems go.. */
122 return ret;
123}
124
ab8d11be
MS
125static int may_attach(struct task_struct *task)
126{
127 if (!task->mm)
128 return -EPERM;
129 if (((current->uid != task->euid) ||
130 (current->uid != task->suid) ||
131 (current->uid != task->uid) ||
132 (current->gid != task->egid) ||
133 (current->gid != task->sgid) ||
134 (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE))
135 return -EPERM;
136 smp_rmb();
137 if (!task->mm->dumpable && !capable(CAP_SYS_PTRACE))
138 return -EPERM;
139
140 return security_ptrace(current, task);
141}
142
143int ptrace_may_attach(struct task_struct *task)
144{
145 int err;
146 task_lock(task);
147 err = may_attach(task);
148 task_unlock(task);
149 return !err;
150}
151
1da177e4
LT
152int ptrace_attach(struct task_struct *task)
153{
154 int retval;
155 task_lock(task);
156 retval = -EPERM;
157 if (task->pid <= 1)
158 goto bad;
28d838cc 159 if (task->tgid == current->tgid)
1da177e4 160 goto bad;
1da177e4
LT
161 /* the same process cannot be attached many times */
162 if (task->ptrace & PT_PTRACED)
163 goto bad;
ab8d11be 164 retval = may_attach(task);
1da177e4
LT
165 if (retval)
166 goto bad;
167
168 /* Go */
169 task->ptrace |= PT_PTRACED | ((task->real_parent != current)
170 ? PT_ATTACHED : 0);
171 if (capable(CAP_SYS_PTRACE))
172 task->ptrace |= PT_PTRACE_CAP;
173 task_unlock(task);
174
175 write_lock_irq(&tasklist_lock);
176 __ptrace_link(task, current);
177 write_unlock_irq(&tasklist_lock);
178
179 force_sig_specific(SIGSTOP, task);
180 return 0;
181
182bad:
183 task_unlock(task);
184 return retval;
185}
186
187int ptrace_detach(struct task_struct *child, unsigned int data)
188{
7ed20e1a 189 if (!valid_signal(data))
1da177e4
LT
190 return -EIO;
191
192 /* Architecture-specific hardware disable .. */
193 ptrace_disable(child);
194
195 /* .. re-parent .. */
196 child->exit_code = data;
197
198 write_lock_irq(&tasklist_lock);
199 __ptrace_unlink(child);
200 /* .. and wake it up. */
201 if (child->exit_state != EXIT_ZOMBIE)
202 wake_up_process(child);
203 write_unlock_irq(&tasklist_lock);
204
205 return 0;
206}
207
208/*
209 * Access another process' address space.
210 * Source/target buffer must be kernel space,
211 * Do not walk the page table directly, use get_user_pages
212 */
213
214int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write)
215{
216 struct mm_struct *mm;
217 struct vm_area_struct *vma;
218 struct page *page;
219 void *old_buf = buf;
220
221 mm = get_task_mm(tsk);
222 if (!mm)
223 return 0;
224
225 down_read(&mm->mmap_sem);
226 /* ignore errors, just check how much was sucessfully transfered */
227 while (len) {
228 int bytes, ret, offset;
229 void *maddr;
230
231 ret = get_user_pages(tsk, mm, addr, 1,
232 write, 1, &page, &vma);
233 if (ret <= 0)
234 break;
235
236 bytes = len;
237 offset = addr & (PAGE_SIZE-1);
238 if (bytes > PAGE_SIZE-offset)
239 bytes = PAGE_SIZE-offset;
240
241 maddr = kmap(page);
242 if (write) {
243 copy_to_user_page(vma, page, addr,
244 maddr + offset, buf, bytes);
16bf1348 245 set_page_dirty_lock(page);
1da177e4
LT
246 } else {
247 copy_from_user_page(vma, page, addr,
248 buf, maddr + offset, bytes);
249 }
250 kunmap(page);
251 page_cache_release(page);
252 len -= bytes;
253 buf += bytes;
254 addr += bytes;
255 }
256 up_read(&mm->mmap_sem);
257 mmput(mm);
258
259 return buf - old_buf;
260}
261
262int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len)
263{
264 int copied = 0;
265
266 while (len > 0) {
267 char buf[128];
268 int this_len, retval;
269
270 this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
271 retval = access_process_vm(tsk, src, buf, this_len, 0);
272 if (!retval) {
273 if (copied)
274 break;
275 return -EIO;
276 }
277 if (copy_to_user(dst, buf, retval))
278 return -EFAULT;
279 copied += retval;
280 src += retval;
281 dst += retval;
282 len -= retval;
283 }
284 return copied;
285}
286
287int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len)
288{
289 int copied = 0;
290
291 while (len > 0) {
292 char buf[128];
293 int this_len, retval;
294
295 this_len = (len > sizeof(buf)) ? sizeof(buf) : len;
296 if (copy_from_user(buf, src, this_len))
297 return -EFAULT;
298 retval = access_process_vm(tsk, dst, buf, this_len, 1);
299 if (!retval) {
300 if (copied)
301 break;
302 return -EIO;
303 }
304 copied += retval;
305 src += retval;
306 dst += retval;
307 len -= retval;
308 }
309 return copied;
310}
311
312static int ptrace_setoptions(struct task_struct *child, long data)
313{
314 child->ptrace &= ~PT_TRACE_MASK;
315
316 if (data & PTRACE_O_TRACESYSGOOD)
317 child->ptrace |= PT_TRACESYSGOOD;
318
319 if (data & PTRACE_O_TRACEFORK)
320 child->ptrace |= PT_TRACE_FORK;
321
322 if (data & PTRACE_O_TRACEVFORK)
323 child->ptrace |= PT_TRACE_VFORK;
324
325 if (data & PTRACE_O_TRACECLONE)
326 child->ptrace |= PT_TRACE_CLONE;
327
328 if (data & PTRACE_O_TRACEEXEC)
329 child->ptrace |= PT_TRACE_EXEC;
330
331 if (data & PTRACE_O_TRACEVFORKDONE)
332 child->ptrace |= PT_TRACE_VFORK_DONE;
333
334 if (data & PTRACE_O_TRACEEXIT)
335 child->ptrace |= PT_TRACE_EXIT;
336
337 return (data & ~PTRACE_O_MASK) ? -EINVAL : 0;
338}
339
340static int ptrace_getsiginfo(struct task_struct *child, siginfo_t __user * data)
341{
342 siginfo_t lastinfo;
343 int error = -ESRCH;
344
345 read_lock(&tasklist_lock);
346 if (likely(child->sighand != NULL)) {
347 error = -EINVAL;
348 spin_lock_irq(&child->sighand->siglock);
349 if (likely(child->last_siginfo != NULL)) {
350 lastinfo = *child->last_siginfo;
351 error = 0;
352 }
353 spin_unlock_irq(&child->sighand->siglock);
354 }
355 read_unlock(&tasklist_lock);
356 if (!error)
357 return copy_siginfo_to_user(data, &lastinfo);
358 return error;
359}
360
361static int ptrace_setsiginfo(struct task_struct *child, siginfo_t __user * data)
362{
363 siginfo_t newinfo;
364 int error = -ESRCH;
365
366 if (copy_from_user(&newinfo, data, sizeof (siginfo_t)))
367 return -EFAULT;
368
369 read_lock(&tasklist_lock);
370 if (likely(child->sighand != NULL)) {
371 error = -EINVAL;
372 spin_lock_irq(&child->sighand->siglock);
373 if (likely(child->last_siginfo != NULL)) {
374 *child->last_siginfo = newinfo;
375 error = 0;
376 }
377 spin_unlock_irq(&child->sighand->siglock);
378 }
379 read_unlock(&tasklist_lock);
380 return error;
381}
382
383int ptrace_request(struct task_struct *child, long request,
384 long addr, long data)
385{
386 int ret = -EIO;
387
388 switch (request) {
389#ifdef PTRACE_OLDSETOPTIONS
390 case PTRACE_OLDSETOPTIONS:
391#endif
392 case PTRACE_SETOPTIONS:
393 ret = ptrace_setoptions(child, data);
394 break;
395 case PTRACE_GETEVENTMSG:
396 ret = put_user(child->ptrace_message, (unsigned long __user *) data);
397 break;
398 case PTRACE_GETSIGINFO:
399 ret = ptrace_getsiginfo(child, (siginfo_t __user *) data);
400 break;
401 case PTRACE_SETSIGINFO:
402 ret = ptrace_setsiginfo(child, (siginfo_t __user *) data);
403 break;
404 default:
405 break;
406 }
407
408 return ret;
409}
481bed45 410
6b9c7ed8
CH
411/**
412 * ptrace_traceme -- helper for PTRACE_TRACEME
413 *
414 * Performs checks and sets PT_PTRACED.
415 * Should be used by all ptrace implementations for PTRACE_TRACEME.
416 */
417int ptrace_traceme(void)
481bed45 418{
481bed45
CH
419 int ret;
420
421 /*
6b9c7ed8
CH
422 * Are we already being traced?
423 */
424 if (current->ptrace & PT_PTRACED)
425 return -EPERM;
426 ret = security_ptrace(current->parent, current);
427 if (ret)
428 return -EPERM;
429 /*
430 * Set the ptrace bit in the process ptrace flags.
481bed45 431 */
6b9c7ed8
CH
432 current->ptrace |= PT_PTRACED;
433 return 0;
434}
481bed45 435
6b9c7ed8
CH
436/**
437 * ptrace_get_task_struct -- grab a task struct reference for ptrace
438 * @pid: process id to grab a task_struct reference of
439 *
440 * This function is a helper for ptrace implementations. It checks
441 * permissions and then grabs a task struct for use of the actual
442 * ptrace implementation.
443 *
444 * Returns the task_struct for @pid or an ERR_PTR() on failure.
445 */
446struct task_struct *ptrace_get_task_struct(pid_t pid)
447{
448 struct task_struct *child;
481bed45
CH
449
450 /*
6b9c7ed8 451 * Tracing init is not allowed.
481bed45
CH
452 */
453 if (pid == 1)
6b9c7ed8 454 return ERR_PTR(-EPERM);
481bed45 455
481bed45
CH
456 read_lock(&tasklist_lock);
457 child = find_task_by_pid(pid);
458 if (child)
459 get_task_struct(child);
460 read_unlock(&tasklist_lock);
461 if (!child)
6b9c7ed8
CH
462 return ERR_PTR(-ESRCH);
463 return child;
481bed45
CH
464}
465
6b9c7ed8 466#ifndef __ARCH_SYS_PTRACE
481bed45
CH
467asmlinkage long sys_ptrace(long request, long pid, long addr, long data)
468{
469 struct task_struct *child;
470 long ret;
471
472 /*
473 * This lock_kernel fixes a subtle race with suid exec
474 */
475 lock_kernel();
6b9c7ed8
CH
476 if (request == PTRACE_TRACEME) {
477 ret = ptrace_traceme();
481bed45 478 goto out;
6b9c7ed8
CH
479 }
480
481 child = ptrace_get_task_struct(pid);
482 if (IS_ERR(child)) {
483 ret = PTR_ERR(child);
484 goto out;
485 }
481bed45
CH
486
487 if (request == PTRACE_ATTACH) {
488 ret = ptrace_attach(child);
005f18df 489 goto out_put_task_struct;
481bed45
CH
490 }
491
492 ret = ptrace_check_attach(child, request == PTRACE_KILL);
493 if (ret < 0)
494 goto out_put_task_struct;
495
496 ret = arch_ptrace(child, request, addr, data);
497 if (ret < 0)
498 goto out_put_task_struct;
499
500 out_put_task_struct:
501 put_task_struct(child);
502 out:
503 unlock_kernel();
504 return ret;
505}
506#endif /* __ARCH_SYS_PTRACE */