1 // SPDX-License-Identifier: GPL-2.0
2 #define _GNU_SOURCE
3
4 #include <sys/ptrace.h>
5 #include <sys/types.h>
6 #include <sys/wait.h>
7 #include <sys/syscall.h>
8 #include <sys/user.h>
9 #include <unistd.h>
10 #include <errno.h>
11 #include <stddef.h>
12 #include <stdio.h>
13 #include <err.h>
14 #include <string.h>
15 #include <asm/ptrace-abi.h>
16 #include <sys/auxv.h>
17
18 #include "helpers.h"
19
20 /* Bitness-agnostic defines for user_regs_struct fields. */
21 #ifdef __x86_64__
22 # define user_syscall_nr orig_rax
23 # define user_arg0 rdi
24 # define user_arg1 rsi
25 # define user_arg2 rdx
26 # define user_arg3 r10
27 # define user_arg4 r8
28 # define user_arg5 r9
29 # define user_ip rip
30 # define user_ax rax
31 #else
32 # define user_syscall_nr orig_eax
33 # define user_arg0 ebx
34 # define user_arg1 ecx
35 # define user_arg2 edx
36 # define user_arg3 esi
37 # define user_arg4 edi
38 # define user_arg5 ebp
39 # define user_ip eip
40 # define user_ax eax
41 #endif
42
43 static int nerrs = 0;
44
45 struct syscall_args32 {
46 uint32_t nr, arg0, arg1, arg2, arg3, arg4, arg5;
47 };
48
49 #ifdef __i386__
50 extern void sys32_helper(struct syscall_args32 *, void *);
51 extern void int80_and_ret(void);
52 #endif
53
54 /*
55 * Helper to invoke int80 with controlled regs and capture the final regs.
56 */
do_full_int80(struct syscall_args32 * args)57 static void do_full_int80(struct syscall_args32 *args)
58 {
59 #ifdef __x86_64__
60 register unsigned long bp asm("bp") = args->arg5;
61 asm volatile ("int $0x80"
62 : "+a" (args->nr),
63 "+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2),
64 "+S" (args->arg3), "+D" (args->arg4), "+r" (bp)
65 : : "r8", "r9", "r10", "r11");
66 args->arg5 = bp;
67 #else
68 sys32_helper(args, int80_and_ret);
69 #endif
70 }
71
72 #ifdef __i386__
73 static void (*vsyscall32)(void);
74
75 /*
76 * Nasty helper to invoke AT_SYSINFO (i.e. __kernel_vsyscall) with
77 * controlled regs and capture the final regs. This is so nasty that it
78 * crashes my copy of gdb :)
79 */
do_full_vsyscall32(struct syscall_args32 * args)80 static void do_full_vsyscall32(struct syscall_args32 *args)
81 {
82 sys32_helper(args, vsyscall32);
83 }
84 #endif
85
wait_trap(pid_t chld)86 static siginfo_t wait_trap(pid_t chld)
87 {
88 siginfo_t si;
89 if (waitid(P_PID, chld, &si, WEXITED|WSTOPPED) != 0)
90 err(1, "waitid");
91 if (si.si_pid != chld)
92 errx(1, "got unexpected pid in event\n");
93 if (si.si_code != CLD_TRAPPED)
94 errx(1, "got unexpected event type %d\n", si.si_code);
95 return si;
96 }
97
setsigign(int sig,int flags)98 static void setsigign(int sig, int flags)
99 {
100 struct sigaction sa;
101 memset(&sa, 0, sizeof(sa));
102 sa.sa_sigaction = (void *)SIG_IGN;
103 sa.sa_flags = flags;
104 sigemptyset(&sa.sa_mask);
105 if (sigaction(sig, &sa, 0))
106 err(1, "sigaction");
107 }
108
109 #ifdef __x86_64__
110 # define REG_BP REG_RBP
111 #else
112 # define REG_BP REG_EBP
113 #endif
114
empty_handler(int sig,siginfo_t * si,void * ctx_void)115 static void empty_handler(int sig, siginfo_t *si, void *ctx_void)
116 {
117 }
118
test_sys32_regs(void (* do_syscall)(struct syscall_args32 *))119 static void test_sys32_regs(void (*do_syscall)(struct syscall_args32 *))
120 {
121 struct syscall_args32 args = {
122 .nr = 224, /* gettid */
123 .arg0 = 10, .arg1 = 11, .arg2 = 12,
124 .arg3 = 13, .arg4 = 14, .arg5 = 15,
125 };
126
127 do_syscall(&args);
128
129 if (args.nr != getpid() ||
130 args.arg0 != 10 || args.arg1 != 11 || args.arg2 != 12 ||
131 args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
132 printf("[FAIL]\tgetpid() failed to preserve regs\n");
133 nerrs++;
134 } else {
135 printf("[OK]\tgetpid() preserves regs\n");
136 }
137
138 sethandler(SIGUSR1, empty_handler, 0);
139
140 args.nr = 37; /* kill */
141 args.arg0 = getpid();
142 args.arg1 = SIGUSR1;
143 do_syscall(&args);
144 if (args.nr != 0 ||
145 args.arg0 != getpid() || args.arg1 != SIGUSR1 || args.arg2 != 12 ||
146 args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
147 printf("[FAIL]\tkill(getpid(), SIGUSR1) failed to preserve regs\n");
148 nerrs++;
149 } else {
150 printf("[OK]\tkill(getpid(), SIGUSR1) preserves regs\n");
151 }
152 clearhandler(SIGUSR1);
153 }
154
test_ptrace_syscall_restart(void)155 static void test_ptrace_syscall_restart(void)
156 {
157 printf("[RUN]\tptrace-induced syscall restart\n");
158 pid_t chld = fork();
159 if (chld < 0)
160 err(1, "fork");
161
162 if (chld == 0) {
163 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
164 err(1, "PTRACE_TRACEME");
165
166 pid_t pid = getpid(), tid = syscall(SYS_gettid);
167
168 printf("\tChild will make one syscall\n");
169 syscall(SYS_tgkill, pid, tid, SIGSTOP);
170
171 syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
172 _exit(0);
173 }
174
175 int status;
176
177 /* Wait for SIGSTOP. */
178 if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
179 err(1, "waitpid");
180
181 struct user_regs_struct regs;
182
183 printf("[RUN]\tSYSEMU\n");
184 if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
185 err(1, "PTRACE_SYSEMU");
186 wait_trap(chld);
187
188 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
189 err(1, "PTRACE_GETREGS");
190
191 if (regs.user_syscall_nr != SYS_gettid ||
192 regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
193 regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
194 regs.user_arg4 != 14 || regs.user_arg5 != 15) {
195 printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
196 nerrs++;
197 } else {
198 printf("[OK]\tInitial nr and args are correct\n");
199 }
200
201 printf("[RUN]\tRestart the syscall (ip = 0x%lx)\n",
202 (unsigned long)regs.user_ip);
203
204 /*
205 * This does exactly what it appears to do if syscall is int80 or
206 * SYSCALL64. For SYSCALL32 or SYSENTER, though, this is highly
207 * magical. It needs to work so that ptrace and syscall restart
208 * work as expected.
209 */
210 regs.user_ax = regs.user_syscall_nr;
211 regs.user_ip -= 2;
212 if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0)
213 err(1, "PTRACE_SETREGS");
214
215 if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
216 err(1, "PTRACE_SYSEMU");
217 wait_trap(chld);
218
219 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
220 err(1, "PTRACE_GETREGS");
221
222 if (regs.user_syscall_nr != SYS_gettid ||
223 regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
224 regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
225 regs.user_arg4 != 14 || regs.user_arg5 != 15) {
226 printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
227 nerrs++;
228 } else {
229 printf("[OK]\tRestarted nr and args are correct\n");
230 }
231
232 printf("[RUN]\tChange nr and args and restart the syscall (ip = 0x%lx)\n",
233 (unsigned long)regs.user_ip);
234
235 regs.user_ax = SYS_getpid;
236 regs.user_arg0 = 20;
237 regs.user_arg1 = 21;
238 regs.user_arg2 = 22;
239 regs.user_arg3 = 23;
240 regs.user_arg4 = 24;
241 regs.user_arg5 = 25;
242 regs.user_ip -= 2;
243
244 if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0)
245 err(1, "PTRACE_SETREGS");
246
247 if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
248 err(1, "PTRACE_SYSEMU");
249 wait_trap(chld);
250
251 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
252 err(1, "PTRACE_GETREGS");
253
254 if (regs.user_syscall_nr != SYS_getpid ||
255 regs.user_arg0 != 20 || regs.user_arg1 != 21 || regs.user_arg2 != 22 ||
256 regs.user_arg3 != 23 || regs.user_arg4 != 24 || regs.user_arg5 != 25) {
257 printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
258 nerrs++;
259 } else {
260 printf("[OK]\tReplacement nr and args are correct\n");
261 }
262
263 if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
264 err(1, "PTRACE_CONT");
265 if (waitpid(chld, &status, 0) != chld)
266 err(1, "waitpid");
267 if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
268 printf("[FAIL]\tChild failed\n");
269 nerrs++;
270 } else {
271 printf("[OK]\tChild exited cleanly\n");
272 }
273 }
274
test_restart_under_ptrace(void)275 static void test_restart_under_ptrace(void)
276 {
277 printf("[RUN]\tkernel syscall restart under ptrace\n");
278 pid_t chld = fork();
279 if (chld < 0)
280 err(1, "fork");
281
282 if (chld == 0) {
283 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
284 err(1, "PTRACE_TRACEME");
285
286 pid_t pid = getpid(), tid = syscall(SYS_gettid);
287
288 printf("\tChild will take a nap until signaled\n");
289 setsigign(SIGUSR1, SA_RESTART);
290 syscall(SYS_tgkill, pid, tid, SIGSTOP);
291
292 syscall(SYS_pause, 0, 0, 0, 0, 0, 0);
293 _exit(0);
294 }
295
296 int status;
297
298 /* Wait for SIGSTOP. */
299 if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
300 err(1, "waitpid");
301
302 struct user_regs_struct regs;
303
304 printf("[RUN]\tSYSCALL\n");
305 if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
306 err(1, "PTRACE_SYSCALL");
307 wait_trap(chld);
308
309 /* We should be stopped at pause(2) entry. */
310
311 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
312 err(1, "PTRACE_GETREGS");
313
314 if (regs.user_syscall_nr != SYS_pause ||
315 regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
316 regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
317 regs.user_arg4 != 0 || regs.user_arg5 != 0) {
318 printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
319 nerrs++;
320 } else {
321 printf("[OK]\tInitial nr and args are correct\n");
322 }
323
324 /* Interrupt it. */
325 kill(chld, SIGUSR1);
326
327 /* Advance. We should be stopped at exit. */
328 printf("[RUN]\tSYSCALL\n");
329 if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
330 err(1, "PTRACE_SYSCALL");
331 wait_trap(chld);
332
333 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
334 err(1, "PTRACE_GETREGS");
335
336 if (regs.user_syscall_nr != SYS_pause ||
337 regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
338 regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
339 regs.user_arg4 != 0 || regs.user_arg5 != 0) {
340 printf("[FAIL]\tArgs after SIGUSR1 are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
341 nerrs++;
342 } else {
343 printf("[OK]\tArgs after SIGUSR1 are correct (ax = %ld)\n",
344 (long)regs.user_ax);
345 }
346
347 /* Poke the regs back in. This must not break anything. */
348 if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0)
349 err(1, "PTRACE_SETREGS");
350
351 /* Catch the (ignored) SIGUSR1. */
352 if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
353 err(1, "PTRACE_CONT");
354 if (waitpid(chld, &status, 0) != chld)
355 err(1, "waitpid");
356 if (!WIFSTOPPED(status)) {
357 printf("[FAIL]\tChild was stopped for SIGUSR1 (status = 0x%x)\n", status);
358 nerrs++;
359 } else {
360 printf("[OK]\tChild got SIGUSR1\n");
361 }
362
363 /* The next event should be pause(2) again. */
364 printf("[RUN]\tStep again\n");
365 if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
366 err(1, "PTRACE_SYSCALL");
367 wait_trap(chld);
368
369 /* We should be stopped at pause(2) entry. */
370
371 if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
372 err(1, "PTRACE_GETREGS");
373
374 if (regs.user_syscall_nr != SYS_pause ||
375 regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
376 regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
377 regs.user_arg4 != 0 || regs.user_arg5 != 0) {
378 printf("[FAIL]\tpause did not restart (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
379 nerrs++;
380 } else {
381 printf("[OK]\tpause(2) restarted correctly\n");
382 }
383
384 /* Kill it. */
385 kill(chld, SIGKILL);
386 if (waitpid(chld, &status, 0) != chld)
387 err(1, "waitpid");
388 }
389
main()390 int main()
391 {
392 printf("[RUN]\tCheck int80 return regs\n");
393 test_sys32_regs(do_full_int80);
394
395 #if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ > 2 || __GLIBC_MINOR__ >= 16)
396 vsyscall32 = (void *)getauxval(AT_SYSINFO);
397 if (vsyscall32) {
398 printf("[RUN]\tCheck AT_SYSINFO return regs\n");
399 test_sys32_regs(do_full_vsyscall32);
400 } else {
401 printf("[SKIP]\tAT_SYSINFO is not available\n");
402 }
403 #endif
404
405 test_ptrace_syscall_restart();
406
407 test_restart_under_ptrace();
408
409 return 0;
410 }
411