ptrace_syscall.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421
  1. #define _GNU_SOURCE
  2. #include <sys/ptrace.h>
  3. #include <sys/types.h>
  4. #include <sys/wait.h>
  5. #include <sys/syscall.h>
  6. #include <sys/user.h>
  7. #include <unistd.h>
  8. #include <errno.h>
  9. #include <stddef.h>
  10. #include <stdio.h>
  11. #include <err.h>
  12. #include <string.h>
  13. #include <asm/ptrace-abi.h>
  14. #include <sys/auxv.h>
  15. /* Bitness-agnostic defines for user_regs_struct fields. */
  16. #ifdef __x86_64__
  17. # define user_syscall_nr orig_rax
  18. # define user_arg0 rdi
  19. # define user_arg1 rsi
  20. # define user_arg2 rdx
  21. # define user_arg3 r10
  22. # define user_arg4 r8
  23. # define user_arg5 r9
  24. # define user_ip rip
  25. # define user_ax rax
  26. #else
  27. # define user_syscall_nr orig_eax
  28. # define user_arg0 ebx
  29. # define user_arg1 ecx
  30. # define user_arg2 edx
  31. # define user_arg3 esi
  32. # define user_arg4 edi
  33. # define user_arg5 ebp
  34. # define user_ip eip
  35. # define user_ax eax
  36. #endif
  37. static int nerrs = 0;
  38. struct syscall_args32 {
  39. uint32_t nr, arg0, arg1, arg2, arg3, arg4, arg5;
  40. };
  41. #ifdef __i386__
  42. extern void sys32_helper(struct syscall_args32 *, void *);
  43. extern void int80_and_ret(void);
  44. #endif
  45. /*
  46. * Helper to invoke int80 with controlled regs and capture the final regs.
  47. */
  48. static void do_full_int80(struct syscall_args32 *args)
  49. {
  50. #ifdef __x86_64__
  51. register unsigned long bp asm("bp") = args->arg5;
  52. asm volatile ("int $0x80"
  53. : "+a" (args->nr),
  54. "+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2),
  55. "+S" (args->arg3), "+D" (args->arg4), "+r" (bp)
  56. : : "r8", "r9", "r10", "r11");
  57. args->arg5 = bp;
  58. #else
  59. sys32_helper(args, int80_and_ret);
  60. #endif
  61. }
  62. #ifdef __i386__
  63. static void (*vsyscall32)(void);
  64. /*
  65. * Nasty helper to invoke AT_SYSINFO (i.e. __kernel_vsyscall) with
  66. * controlled regs and capture the final regs. This is so nasty that it
  67. * crashes my copy of gdb :)
  68. */
  69. static void do_full_vsyscall32(struct syscall_args32 *args)
  70. {
  71. sys32_helper(args, vsyscall32);
  72. }
  73. #endif
  74. static siginfo_t wait_trap(pid_t chld)
  75. {
  76. siginfo_t si;
  77. if (waitid(P_PID, chld, &si, WEXITED|WSTOPPED) != 0)
  78. err(1, "waitid");
  79. if (si.si_pid != chld)
  80. errx(1, "got unexpected pid in event\n");
  81. if (si.si_code != CLD_TRAPPED)
  82. errx(1, "got unexpected event type %d\n", si.si_code);
  83. return si;
  84. }
  85. static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
  86. int flags)
  87. {
  88. struct sigaction sa;
  89. memset(&sa, 0, sizeof(sa));
  90. sa.sa_sigaction = handler;
  91. sa.sa_flags = SA_SIGINFO | flags;
  92. sigemptyset(&sa.sa_mask);
  93. if (sigaction(sig, &sa, 0))
  94. err(1, "sigaction");
  95. }
  96. static void setsigign(int sig, int flags)
  97. {
  98. struct sigaction sa;
  99. memset(&sa, 0, sizeof(sa));
  100. sa.sa_sigaction = (void *)SIG_IGN;
  101. sa.sa_flags = flags;
  102. sigemptyset(&sa.sa_mask);
  103. if (sigaction(sig, &sa, 0))
  104. err(1, "sigaction");
  105. }
  106. static void clearhandler(int sig)
  107. {
  108. struct sigaction sa;
  109. memset(&sa, 0, sizeof(sa));
  110. sa.sa_handler = SIG_DFL;
  111. sigemptyset(&sa.sa_mask);
  112. if (sigaction(sig, &sa, 0))
  113. err(1, "sigaction");
  114. }
  115. #ifdef __x86_64__
  116. # define REG_BP REG_RBP
  117. #else
  118. # define REG_BP REG_EBP
  119. #endif
  120. static void empty_handler(int sig, siginfo_t *si, void *ctx_void)
  121. {
  122. }
  123. static void test_sys32_regs(void (*do_syscall)(struct syscall_args32 *))
  124. {
  125. struct syscall_args32 args = {
  126. .nr = 224, /* gettid */
  127. .arg0 = 10, .arg1 = 11, .arg2 = 12,
  128. .arg3 = 13, .arg4 = 14, .arg5 = 15,
  129. };
  130. do_syscall(&args);
  131. if (args.nr != getpid() ||
  132. args.arg0 != 10 || args.arg1 != 11 || args.arg2 != 12 ||
  133. args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
  134. printf("[FAIL]\tgetpid() failed to preserve regs\n");
  135. nerrs++;
  136. } else {
  137. printf("[OK]\tgetpid() preserves regs\n");
  138. }
  139. sethandler(SIGUSR1, empty_handler, 0);
  140. args.nr = 37; /* kill */
  141. args.arg0 = getpid();
  142. args.arg1 = SIGUSR1;
  143. do_syscall(&args);
  144. if (args.nr != 0 ||
  145. args.arg0 != getpid() || args.arg1 != SIGUSR1 || args.arg2 != 12 ||
  146. args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
  147. printf("[FAIL]\tkill(getpid(), SIGUSR1) failed to preserve regs\n");
  148. nerrs++;
  149. } else {
  150. printf("[OK]\tkill(getpid(), SIGUSR1) preserves regs\n");
  151. }
  152. clearhandler(SIGUSR1);
  153. }
  154. static void test_ptrace_syscall_restart(void)
  155. {
  156. printf("[RUN]\tptrace-induced syscall restart\n");
  157. pid_t chld = fork();
  158. if (chld < 0)
  159. err(1, "fork");
  160. if (chld == 0) {
  161. if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
  162. err(1, "PTRACE_TRACEME");
  163. printf("\tChild will make one syscall\n");
  164. raise(SIGSTOP);
  165. syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
  166. _exit(0);
  167. }
  168. int status;
  169. /* Wait for SIGSTOP. */
  170. if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
  171. err(1, "waitpid");
  172. struct user_regs_struct regs;
  173. printf("[RUN]\tSYSEMU\n");
  174. if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
  175. err(1, "PTRACE_SYSEMU");
  176. wait_trap(chld);
  177. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  178. err(1, "PTRACE_GETREGS");
  179. if (regs.user_syscall_nr != SYS_gettid ||
  180. regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
  181. regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
  182. regs.user_arg4 != 14 || regs.user_arg5 != 15) {
  183. printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  184. nerrs++;
  185. } else {
  186. printf("[OK]\tInitial nr and args are correct\n");
  187. }
  188. printf("[RUN]\tRestart the syscall (ip = 0x%lx)\n",
  189. (unsigned long)regs.user_ip);
  190. /*
  191. * This does exactly what it appears to do if syscall is int80 or
  192. * SYSCALL64. For SYSCALL32 or SYSENTER, though, this is highly
  193. * magical. It needs to work so that ptrace and syscall restart
  194. * work as expected.
  195. */
  196. regs.user_ax = regs.user_syscall_nr;
  197. regs.user_ip -= 2;
  198. if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
  199. err(1, "PTRACE_SETREGS");
  200. if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
  201. err(1, "PTRACE_SYSEMU");
  202. wait_trap(chld);
  203. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  204. err(1, "PTRACE_GETREGS");
  205. if (regs.user_syscall_nr != SYS_gettid ||
  206. regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
  207. regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
  208. regs.user_arg4 != 14 || regs.user_arg5 != 15) {
  209. printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  210. nerrs++;
  211. } else {
  212. printf("[OK]\tRestarted nr and args are correct\n");
  213. }
  214. printf("[RUN]\tChange nr and args and restart the syscall (ip = 0x%lx)\n",
  215. (unsigned long)regs.user_ip);
  216. regs.user_ax = SYS_getpid;
  217. regs.user_arg0 = 20;
  218. regs.user_arg1 = 21;
  219. regs.user_arg2 = 22;
  220. regs.user_arg3 = 23;
  221. regs.user_arg4 = 24;
  222. regs.user_arg5 = 25;
  223. regs.user_ip -= 2;
  224. if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
  225. err(1, "PTRACE_SETREGS");
  226. if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
  227. err(1, "PTRACE_SYSEMU");
  228. wait_trap(chld);
  229. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  230. err(1, "PTRACE_GETREGS");
  231. if (regs.user_syscall_nr != SYS_getpid ||
  232. regs.user_arg0 != 20 || regs.user_arg1 != 21 || regs.user_arg2 != 22 ||
  233. regs.user_arg3 != 23 || regs.user_arg4 != 24 || regs.user_arg5 != 25) {
  234. printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  235. nerrs++;
  236. } else {
  237. printf("[OK]\tReplacement nr and args are correct\n");
  238. }
  239. if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
  240. err(1, "PTRACE_CONT");
  241. if (waitpid(chld, &status, 0) != chld)
  242. err(1, "waitpid");
  243. if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
  244. printf("[FAIL]\tChild failed\n");
  245. nerrs++;
  246. } else {
  247. printf("[OK]\tChild exited cleanly\n");
  248. }
  249. }
  250. static void test_restart_under_ptrace(void)
  251. {
  252. printf("[RUN]\tkernel syscall restart under ptrace\n");
  253. pid_t chld = fork();
  254. if (chld < 0)
  255. err(1, "fork");
  256. if (chld == 0) {
  257. if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
  258. err(1, "PTRACE_TRACEME");
  259. printf("\tChild will take a nap until signaled\n");
  260. setsigign(SIGUSR1, SA_RESTART);
  261. raise(SIGSTOP);
  262. syscall(SYS_pause, 0, 0, 0, 0, 0, 0);
  263. _exit(0);
  264. }
  265. int status;
  266. /* Wait for SIGSTOP. */
  267. if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
  268. err(1, "waitpid");
  269. struct user_regs_struct regs;
  270. printf("[RUN]\tSYSCALL\n");
  271. if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
  272. err(1, "PTRACE_SYSCALL");
  273. wait_trap(chld);
  274. /* We should be stopped at pause(2) entry. */
  275. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  276. err(1, "PTRACE_GETREGS");
  277. if (regs.user_syscall_nr != SYS_pause ||
  278. regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
  279. regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
  280. regs.user_arg4 != 0 || regs.user_arg5 != 0) {
  281. printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  282. nerrs++;
  283. } else {
  284. printf("[OK]\tInitial nr and args are correct\n");
  285. }
  286. /* Interrupt it. */
  287. kill(chld, SIGUSR1);
  288. /* Advance. We should be stopped at exit. */
  289. printf("[RUN]\tSYSCALL\n");
  290. if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
  291. err(1, "PTRACE_SYSCALL");
  292. wait_trap(chld);
  293. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  294. err(1, "PTRACE_GETREGS");
  295. if (regs.user_syscall_nr != SYS_pause ||
  296. regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
  297. regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
  298. regs.user_arg4 != 0 || regs.user_arg5 != 0) {
  299. printf("[FAIL]\tArgs after SIGUSR1 are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  300. nerrs++;
  301. } else {
  302. printf("[OK]\tArgs after SIGUSR1 are correct (ax = %ld)\n",
  303. (long)regs.user_ax);
  304. }
  305. /* Poke the regs back in. This must not break anything. */
  306. if (ptrace(PTRACE_SETREGS, chld, 0, &regs) != 0)
  307. err(1, "PTRACE_SETREGS");
  308. /* Catch the (ignored) SIGUSR1. */
  309. if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
  310. err(1, "PTRACE_CONT");
  311. if (waitpid(chld, &status, 0) != chld)
  312. err(1, "waitpid");
  313. if (!WIFSTOPPED(status)) {
  314. printf("[FAIL]\tChild was stopped for SIGUSR1 (status = 0x%x)\n", status);
  315. nerrs++;
  316. } else {
  317. printf("[OK]\tChild got SIGUSR1\n");
  318. }
  319. /* The next event should be pause(2) again. */
  320. printf("[RUN]\tStep again\n");
  321. if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
  322. err(1, "PTRACE_SYSCALL");
  323. wait_trap(chld);
  324. /* We should be stopped at pause(2) entry. */
  325. if (ptrace(PTRACE_GETREGS, chld, 0, &regs) != 0)
  326. err(1, "PTRACE_GETREGS");
  327. if (regs.user_syscall_nr != SYS_pause ||
  328. regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
  329. regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
  330. regs.user_arg4 != 0 || regs.user_arg5 != 0) {
  331. printf("[FAIL]\tpause did not restart (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
  332. nerrs++;
  333. } else {
  334. printf("[OK]\tpause(2) restarted correctly\n");
  335. }
  336. /* Kill it. */
  337. kill(chld, SIGKILL);
  338. if (waitpid(chld, &status, 0) != chld)
  339. err(1, "waitpid");
  340. }
  341. int main()
  342. {
  343. printf("[RUN]\tCheck int80 return regs\n");
  344. test_sys32_regs(do_full_int80);
  345. #if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ > 2 || __GLIBC_MINOR__ >= 16)
  346. vsyscall32 = (void *)getauxval(AT_SYSINFO);
  347. printf("[RUN]\tCheck AT_SYSINFO return regs\n");
  348. test_sys32_regs(do_full_vsyscall32);
  349. #endif
  350. test_ptrace_syscall_restart();
  351. test_restart_under_ptrace();
  352. return 0;
  353. }