ptrace_syscall.c

  1// SPDX-License-Identifier: GPL-2.0
  2#define _GNU_SOURCE
  3
  4#include <sys/ptrace.h>
  5#include <sys/types.h>
  6#include <sys/wait.h>
  7#include <sys/syscall.h>
  8#include <sys/user.h>
  9#include <unistd.h>
 10#include <errno.h>
 11#include <stddef.h>
 12#include <stdio.h>
 13#include <err.h>
 14#include <string.h>
 15#include <asm/ptrace-abi.h>
 16#include <sys/auxv.h>
 17
 18#include "helpers.h"
 19
 20/* Bitness-agnostic defines for user_regs_struct fields. */
 21#ifdef __x86_64__
 22# define user_syscall_nr	orig_rax
 23# define user_arg0		rdi
 24# define user_arg1		rsi
 25# define user_arg2		rdx
 26# define user_arg3		r10
 27# define user_arg4		r8
 28# define user_arg5		r9
 29# define user_ip		rip
 30# define user_ax		rax
 31#else
 32# define user_syscall_nr	orig_eax
 33# define user_arg0		ebx
 34# define user_arg1		ecx
 35# define user_arg2		edx
 36# define user_arg3		esi
 37# define user_arg4		edi
 38# define user_arg5		ebp
 39# define user_ip		eip
 40# define user_ax		eax
 41#endif
 42
 43static int nerrs = 0;
 44
 45struct syscall_args32 {
 46	uint32_t nr, arg0, arg1, arg2, arg3, arg4, arg5;
 47};
 48
 49#ifdef __i386__
 50extern void sys32_helper(struct syscall_args32 *, void *);
 51extern void int80_and_ret(void);
 52#endif
 53
 54/*
 55 * Helper to invoke int80 with controlled regs and capture the final regs.
 56 */
 57static void do_full_int80(struct syscall_args32 *args)
 58{
 59#ifdef __x86_64__
 60	register unsigned long bp asm("bp") = args->arg5;
 61	asm volatile ("int $0x80"
 62		      : "+a" (args->nr),
 63			"+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2),
 64			"+S" (args->arg3), "+D" (args->arg4), "+r" (bp)
 65			: : "r8", "r9", "r10", "r11");
 66	args->arg5 = bp;
 67#else
 68	sys32_helper(args, int80_and_ret);
 69#endif
 70}
 71
 72#ifdef __i386__
 73static void (*vsyscall32)(void);
 74
 75/*
 76 * Nasty helper to invoke AT_SYSINFO (i.e. __kernel_vsyscall) with
 77 * controlled regs and capture the final regs.  This is so nasty that it
 78 * crashes my copy of gdb :)
 79 */
 80static void do_full_vsyscall32(struct syscall_args32 *args)
 81{
 82	sys32_helper(args, vsyscall32);
 83}
 84#endif
 85
 86static siginfo_t wait_trap(pid_t chld)
 87{
 88	siginfo_t si;
 89	if (waitid(P_PID, chld, &si, WEXITED|WSTOPPED) != 0)
 90		err(1, "waitid");
 91	if (si.si_pid != chld)
 92		errx(1, "got unexpected pid in event\n");
 93	if (si.si_code != CLD_TRAPPED)
 94		errx(1, "got unexpected event type %d\n", si.si_code);
 95	return si;
 96}
 97
 98static void setsigign(int sig, int flags)
 99{
100	struct sigaction sa;
101	memset(&sa, 0, sizeof(sa));
102	sa.sa_sigaction = (void *)SIG_IGN;
103	sa.sa_flags = flags;
104	sigemptyset(&sa.sa_mask);
105	if (sigaction(sig, &sa, 0))
106		err(1, "sigaction");
107}
108
109#ifdef __x86_64__
110# define REG_BP REG_RBP
111#else
112# define REG_BP REG_EBP
113#endif
114
115static void empty_handler(int sig, siginfo_t *si, void *ctx_void)
116{
117}
118
119static void test_sys32_regs(void (*do_syscall)(struct syscall_args32 *))
120{
121	struct syscall_args32 args = {
122		.nr = 224,	/* gettid */
123		.arg0 = 10, .arg1 = 11, .arg2 = 12,
124		.arg3 = 13, .arg4 = 14, .arg5 = 15,
125	};
126
127	do_syscall(&args);
128
129	if (args.nr != getpid() ||
130	    args.arg0 != 10 || args.arg1 != 11 || args.arg2 != 12 ||
131	    args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
132		printf("[FAIL]\tgetpid() failed to preserve regs\n");
133		nerrs++;
134	} else {
135		printf("[OK]\tgetpid() preserves regs\n");
136	}
137
138	sethandler(SIGUSR1, empty_handler, 0);
139
140	args.nr = 37;	/* kill */
141	args.arg0 = getpid();
142	args.arg1 = SIGUSR1;
143	do_syscall(&args);
144	if (args.nr != 0 ||
145	    args.arg0 != getpid() || args.arg1 != SIGUSR1 || args.arg2 != 12 ||
146	    args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
147		printf("[FAIL]\tkill(getpid(), SIGUSR1) failed to preserve regs\n");
148		nerrs++;
149	} else {
150		printf("[OK]\tkill(getpid(), SIGUSR1) preserves regs\n");
151	}
152	clearhandler(SIGUSR1);
153}
154
155static void test_ptrace_syscall_restart(void)
156{
157	printf("[RUN]\tptrace-induced syscall restart\n");
158	pid_t chld = fork();
159	if (chld < 0)
160		err(1, "fork");
161
162	if (chld == 0) {
163		if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
164			err(1, "PTRACE_TRACEME");
165
166		pid_t pid = getpid(), tid = syscall(SYS_gettid);
167
168		printf("\tChild will make one syscall\n");
169		syscall(SYS_tgkill, pid, tid, SIGSTOP);
170
171		syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
172		_exit(0);
173	}
174
175	int status;
176
177	/* Wait for SIGSTOP. */
178	if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
179		err(1, "waitpid");
180
181	struct user_regs_struct regs;
182
183	printf("[RUN]\tSYSEMU\n");
184	if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
185		err(1, "PTRACE_SYSEMU");
186	wait_trap(chld);
187
188	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
189		err(1, "PTRACE_GETREGS");
190
191	if (regs.user_syscall_nr != SYS_gettid ||
192	    regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
193	    regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
194	    regs.user_arg4 != 14 || regs.user_arg5 != 15) {
195		printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
196		nerrs++;
197	} else {
198		printf("[OK]\tInitial nr and args are correct\n");
199	}
200
201	printf("[RUN]\tRestart the syscall (ip = 0x%lx)\n",
202	       (unsigned long)regs.user_ip);
203
204	/*
205	 * This does exactly what it appears to do if syscall is int80 or
206	 * SYSCALL64.  For SYSCALL32 or SYSENTER, though, this is highly
207	 * magical.  It needs to work so that ptrace and syscall restart
208	 * work as expected.
209	 */
210	regs.user_ax = regs.user_syscall_nr;
211	regs.user_ip -= 2;
212	if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
213		err(1, "PTRACE_SETREGS");
214
215	if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
216		err(1, "PTRACE_SYSEMU");
217	wait_trap(chld);
218
219	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
220		err(1, "PTRACE_GETREGS");
221
222	if (regs.user_syscall_nr != SYS_gettid ||
223	    regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
224	    regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
225	    regs.user_arg4 != 14 || regs.user_arg5 != 15) {
226		printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
227		nerrs++;
228	} else {
229		printf("[OK]\tRestarted nr and args are correct\n");
230	}
231
232	printf("[RUN]\tChange nr and args and restart the syscall (ip = 0x%lx)\n",
233	       (unsigned long)regs.user_ip);
234
235	regs.user_ax = SYS_getpid;
236	regs.user_arg0 = 20;
237	regs.user_arg1 = 21;
238	regs.user_arg2 = 22;
239	regs.user_arg3 = 23;
240	regs.user_arg4 = 24;
241	regs.user_arg5 = 25;
242	regs.user_ip -= 2;
243
244	if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
245		err(1, "PTRACE_SETREGS");
246
247	if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
248		err(1, "PTRACE_SYSEMU");
249	wait_trap(chld);
250
251	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
252		err(1, "PTRACE_GETREGS");
253
254	if (regs.user_syscall_nr != SYS_getpid ||
255	    regs.user_arg0 != 20 || regs.user_arg1 != 21 || regs.user_arg2 != 22 ||
256	    regs.user_arg3 != 23 || regs.user_arg4 != 24 || regs.user_arg5 != 25) {
257		printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
258		nerrs++;
259	} else {
260		printf("[OK]\tReplacement nr and args are correct\n");
261	}
262
263	if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
264		err(1, "PTRACE_CONT");
265	if (waitpid(chld, &status, 0) != chld)
266		err(1, "waitpid");
267	if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
268		printf("[FAIL]\tChild failed\n");
269		nerrs++;
270	} else {
271		printf("[OK]\tChild exited cleanly\n");
272	}
273}
274
275static void test_restart_under_ptrace(void)
276{
277	printf("[RUN]\tkernel syscall restart under ptrace\n");
278	pid_t chld = fork();
279	if (chld < 0)
280		err(1, "fork");
281
282	if (chld == 0) {
283		if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
284			err(1, "PTRACE_TRACEME");
285
286		pid_t pid = getpid(), tid = syscall(SYS_gettid);
287
288		printf("\tChild will take a nap until signaled\n");
289		setsigign(SIGUSR1, SA_RESTART);
290		syscall(SYS_tgkill, pid, tid, SIGSTOP);
291
292		syscall(SYS_pause, 0, 0, 0, 0, 0, 0);
293		_exit(0);
294	}
295
296	int status;
297
298	/* Wait for SIGSTOP. */
299	if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
300		err(1, "waitpid");
301
302	struct user_regs_struct regs;
303
304	printf("[RUN]\tSYSCALL\n");
305	if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
306		err(1, "PTRACE_SYSCALL");
307	wait_trap(chld);
308
309	/* We should be stopped at pause(2) entry. */
310
311	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
312		err(1, "PTRACE_GETREGS");
313
314	if (regs.user_syscall_nr != SYS_pause ||
315	    regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
316	    regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
317	    regs.user_arg4 != 0 || regs.user_arg5 != 0) {
318		printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
319		nerrs++;
320	} else {
321		printf("[OK]\tInitial nr and args are correct\n");
322	}
323
324	/* Interrupt it. */
325	kill(chld, SIGUSR1);
326
327	/* Advance.  We should be stopped at exit. */
328	printf("[RUN]\tSYSCALL\n");
329	if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
330		err(1, "PTRACE_SYSCALL");
331	wait_trap(chld);
332
333	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
334		err(1, "PTRACE_GETREGS");
335
336	if (regs.user_syscall_nr != SYS_pause ||
337	    regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
338	    regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
339	    regs.user_arg4 != 0 || regs.user_arg5 != 0) {
340		printf("[FAIL]\tArgs after SIGUSR1 are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
341		nerrs++;
342	} else {
343		printf("[OK]\tArgs after SIGUSR1 are correct (ax = %ld)\n",
344		       (long)regs.user_ax);
345	}
346
347	/* Poke the regs back in.  This must not break anything. */
348	if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
349		err(1, "PTRACE_SETREGS");
350
351	/* Catch the (ignored) SIGUSR1. */
352	if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
353		err(1, "PTRACE_CONT");
354	if (waitpid(chld, &status, 0) != chld)
355		err(1, "waitpid");
356	if (!WIFSTOPPED(status)) {
357		printf("[FAIL]\tChild was stopped for SIGUSR1 (status = 0x%x)\n", status);
358		nerrs++;
359	} else {
360		printf("[OK]\tChild got SIGUSR1\n");
361	}
362
363	/* The next event should be pause(2) again. */
364	printf("[RUN]\tStep again\n");
365	if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
366		err(1, "PTRACE_SYSCALL");
367	wait_trap(chld);
368
369	/* We should be stopped at pause(2) entry. */
370
371	if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
372		err(1, "PTRACE_GETREGS");
373
374	if (regs.user_syscall_nr != SYS_pause ||
375	    regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
376	    regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
377	    regs.user_arg4 != 0 || regs.user_arg5 != 0) {
378		printf("[FAIL]\tpause did not restart (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
379		nerrs++;
380	} else {
381		printf("[OK]\tpause(2) restarted correctly\n");
382	}
383
384	/* Kill it. */
385	kill(chld, SIGKILL);
386	if (waitpid(chld, &status, 0) != chld)
387		err(1, "waitpid");
388}
389
390int main()
391{
392	printf("[RUN]\tCheck int80 return regs\n");
393	test_sys32_regs(do_full_int80);
394
395#if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ > 2 || __GLIBC_MINOR__ >= 16)
396	vsyscall32 = (void *)getauxval(AT_SYSINFO);
397	if (vsyscall32) {
398		printf("[RUN]\tCheck AT_SYSINFO return regs\n");
399		test_sys32_regs(do_full_vsyscall32);
400	} else {
401		printf("[SKIP]\tAT_SYSINFO is not available\n");
402	}
403#endif
404
405	test_ptrace_syscall_restart();
406
407	test_restart_under_ptrace();
408
409	return 0;
410}