ptrace: add PTRACE_GET_SYSCALL_INFO request

---

Notes:
v11: unchanged
v10: added Acked-by from https://lore.kernel.org/lkml/CAEbi=3dzY7ihDLu=LFnHs_2_5BdAFyi4663W5g1JC+=QaiR7kQ@mail.gmail.com/
v9: rebased to linux-next again due to syscall_get_arguments() signature change
v8: unchanged
v7: initial revision

 arch/nds32/include/asm/syscall.h | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

arch/nds32/include/asm/syscall.h +17 ~~-10~~

index 174b8571d362..d08439a54034 100644
@@ -26,7 +26,8 @@ struct pt_regs;
  *
  * It's only valid to call this when @task is known to be blocked.
  */
-int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
+static inline int
+syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
 {
 	return regs->syscallno;
 }

@@ -47,7 +48,8 @@ int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
  * system call instruction.  This may not be the same as what the
  * register state looked like at system call entry tracing.
  */
-void syscall_rollback(struct task_struct *task, struct pt_regs *regs)
+static inline void
+syscall_rollback(struct task_struct *task, struct pt_regs *regs)
 {
 	regs->uregs[0] = regs->orig_r0;
 }

@@ -62,7 +64,8 @@ void syscall_rollback(struct task_struct *task, struct pt_regs *regs)
  * It's only valid to call this when @task is stopped for tracing on exit
  * from a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
  */
-long syscall_get_error(struct task_struct *task, struct pt_regs *regs)
+static inline long
+syscall_get_error(struct task_struct *task, struct pt_regs *regs)
 {
 	unsigned long error = regs->uregs[0];
 	return IS_ERR_VALUE(error) ? error : 0;

@@ -79,7 +82,8 @@ long syscall_get_error(struct task_struct *task, struct pt_regs *regs)
  * It's only valid to call this when @task is stopped for tracing on exit
  * from a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
  */
-long syscall_get_return_value(struct task_struct *task, struct pt_regs *regs)
+static inline long
+syscall_get_return_value(struct task_struct *task, struct pt_regs *regs)
 {
 	return regs->uregs[0];
 }

@@ -99,8 +103,9 @@ long syscall_get_return_value(struct task_struct *task, struct pt_regs *regs)
  * It's only valid to call this when @task is stopped for tracing on exit
  * from a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
  */
-void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
-			      int error, long val)
+static inline void
+syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
+			 int error, long val)
 {
 	regs->uregs[0] = (long)error ? error : val;
 }

@@ -118,8 +123,9 @@ void syscall_set_return_value(struct task_struct *task, struct pt_regs *regs,
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
  */
 #define SYSCALL_MAX_ARGS 6
-void syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
-			   unsigned long *args)
+static inline void
+syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
+		      unsigned long *args)
 {
 	args[0] = regs->orig_r0;
 	args++;

@@ -138,8 +144,9 @@ void syscall_get_arguments(struct task_struct *task, struct pt_regs *regs,
  * It's only valid to call this when @task is stopped for tracing on
  * entry to a system call, due to %TIF_SYSCALL_TRACE or %TIF_SYSCALL_AUDIT.
  */
-void syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
-			   const unsigned long *args)
+static inline void
+syscall_set_arguments(struct task_struct *task, struct pt_regs *regs,
+		      const unsigned long *args)
 {
 	regs->orig_r0 = args[0];
 	args++;

Signature · 1 line

ldv

Dmitry V. Levin

author

2019-05-10 15:27 UTC #2 lore raw

PATCH v11 2/7 hexagon: define syscall_get_error() and syscall_get_return_value()

syscall_get_* functions are required to be implemented on all architectures in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request.

This adds remaining 2 syscall_get_* functions as documented in asm-generic/syscall.h: syscall_get_error and syscall_get_return_value.

Cc Richard Kuo <[email protected]>

Cc Elvira Khabirova <[email protected]>

Cc Eugene Syromyatnikov <[email protected]>

Cc Oleg Nesterov <[email protected]>

Cc Andy Lutomirski <[email protected]>

---

Richard, this patch is waiting for ACK since November.

Notes:
v11: unchanged
v10: unchanged
v9: unchanged
v8: moved syscall_get_arch to separate audit patchset
v7: unchanged
v6: added missing includes
v5: added syscall_get_error and syscall_get_return_value
v4: unchanged
v3: unchanged
v2: unchanged

 arch/hexagon/include/asm/syscall.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

arch/hexagon/include/asm/syscall.h +14 -0

index dab26a71f577..0f28a6a39c3a 100644
@@ -22,6 +22,8 @@
 #define _ASM_HEXAGON_SYSCALL_H
 
 #include <uapi/linux/audit.h>
+#include <linux/err.h>
+#include <asm/ptrace.h>
 
 typedef long (*syscall_fn)(unsigned long, unsigned long,
 	unsigned long, unsigned long,

@@ -44,6 +46,18 @@ static inline void syscall_get_arguments(struct task_struct *task,
 	memcpy(args, &(&regs->r00)[0], 6 * sizeof(args[0]));
 }
 
+static inline long syscall_get_error(struct task_struct *task,
+				     struct pt_regs *regs)
+{
+	return IS_ERR_VALUE(regs->r00) ? regs->r00 : 0;
+}
+
+static inline long syscall_get_return_value(struct task_struct *task,
+					    struct pt_regs *regs)
+{
+	return regs->r00;
+}
+
 static inline int syscall_get_arch(struct task_struct *task)
 {
 	return AUDIT_ARCH_HEXAGON;

Signature · 1 line

ldv

Dmitry V. Levin

author

2019-05-10 15:28 UTC #3 lore raw

PATCH v11 3/7 mips: define syscall_get_error()

syscall_get_error() is required to be implemented on all architectures in addition to already implemented syscall_get_nr(), syscall_get_arguments(), syscall_get_return_value(), and syscall_get_arch() functions in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request.

Acked-by Paul Burton <[email protected]>

Cc Elvira Khabirova <[email protected]>

Cc Eugene Syromyatnikov <[email protected]>

Cc Ralf Baechle <[email protected]>

Cc James Hogan <[email protected]>

Cc Oleg Nesterov <[email protected]>

Cc Andy Lutomirski <[email protected]>

---

Notes:
v11: unchanged
v10: unchanged
v9: unchanged
v8: unchanged
v7: added Acked-by from https://lore.kernel.org/lkml/20181213190015.olf6vhuimjl4jixs@pburton-laptop/
v6: unchanged
v5: initial revision

 arch/mips/include/asm/syscall.h | 6 ++++++
 1 file changed, 6 insertions(+)

arch/mips/include/asm/syscall.h +6 -0

index acf80ae0a430..83bb439597d8 100644
@@ -89,6 +89,12 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
 	unreachable();
 }
 
+static inline long syscall_get_error(struct task_struct *task,
+				     struct pt_regs *regs)
+{
+	return regs->regs[7] ? -regs->regs[2] : 0;
+}
+
 static inline long syscall_get_return_value(struct task_struct *task,
 					    struct pt_regs *regs)
 {

Signature · 1 line

ldv

Dmitry V. Levin

author

2019-05-10 15:28 UTC #4 lore raw

PATCH v11 4/7 parisc: define syscall_get_error()

syscall_get_error() is required to be implemented on all architectures in addition to already implemented syscall_get_nr(), syscall_get_arguments(), syscall_get_return_value(), and syscall_get_arch() functions in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request.

Acked-by Helge Deller <[email protected]> # parisc

Cc James E.J. Bottomley <[email protected]>

Cc Elvira Khabirova <[email protected]>

Cc Eugene Syromyatnikov <[email protected]>

Cc Oleg Nesterov <[email protected]>

Cc Andy Lutomirski <[email protected]>

---

Notes:
v11: unchanged
v10: unchanged
v9: unchanged
v8: added Acked-by from https://lore.kernel.org/lkml/[email protected]/
v7: unchanged
v6: unchanged
v5: initial revision

 arch/parisc/include/asm/syscall.h | 7 +++++++
 1 file changed, 7 insertions(+)

arch/parisc/include/asm/syscall.h +7 -0

index 80757e43cf2c..00b127a5e09b 100644
@@ -29,6 +29,13 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
 	args[0] = regs->gr[26];
 }
 
+static inline long syscall_get_error(struct task_struct *task,
+				     struct pt_regs *regs)
+{
+	unsigned long error = regs->gr[28];
+	return IS_ERR_VALUE(error) ? error : 0;
+}
+
 static inline long syscall_get_return_value(struct task_struct *task,
 						struct pt_regs *regs)
 {

Signature · 1 line

ldv

Dmitry V. Levin

author

2019-05-10 15:28 UTC #5 lore raw

PATCH v11 5/7 powerpc: define syscall_get_error()

syscall_get_error() is required to be implemented on this architecture in addition to already implemented syscall_get_nr(), syscall_get_arguments(), syscall_get_return_value(), and syscall_get_arch() functions in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request.

Acked-by Michael Ellerman <[email protected]>

Cc Elvira Khabirova <[email protected]>

Cc Eugene Syromyatnikov <[email protected]>

Cc Benjamin Herrenschmidt <[email protected]>

Cc Paul Mackerras <[email protected]>

Cc Oleg Nesterov <[email protected]>

Cc Andy Lutomirski <[email protected]>

---

Notes:
v11: added Acked-by from https://lore.kernel.org/lkml/[email protected]/
v10: unchanged
v9: unchanged
v8: unchanged
v7: unchanged
v6: unchanged
v5: initial revision

This change has been tested with tools/testing/selftests/ptrace/get_syscall_info.c and strace, so it's correct from PTRACE_GET_SYSCALL_INFO point of view.

This cast doubts on commit v4.3-rc1~86^2~81 that changed syscall_set_return_value() in a way that doesn't quite match syscall_get_error(), but syscall_set_return_value() is out of scope of this series, so I'll just let you know my concerns.

See also https://lore.kernel.org/lkml/[email protected]/
and https://lore.kernel.org/lkml/[email protected]/
for more details on powerpc syscall_set_return_value() confusion.

 arch/powerpc/include/asm/syscall.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

arch/powerpc/include/asm/syscall.h +10 -0

index a048fed0722f..bd9663137d57 100644
@@ -38,6 +38,16 @@ static inline void syscall_rollback(struct task_struct *task,
 	regs->gpr[3] = regs->orig_gpr3;
 }
 
+static inline long syscall_get_error(struct task_struct *task,
+				     struct pt_regs *regs)
+{
+	/*
+	 * If the system call failed,
+	 * regs->gpr[3] contains a positive ERRORCODE.
+	 */
+	return (regs->ccr & 0x10000000UL) ? -regs->gpr[3] : 0;
+}
+
 static inline long syscall_get_return_value(struct task_struct *task,
 					    struct pt_regs *regs)
 {

Signature · 1 line

ldv

Dmitry V. Levin

author

2019-05-10 15:28 UTC #6 lore raw

PATCH v11 6/7 ptrace: add PTRACE_GET_SYSCALL_INFO request

From: Elvira Khabirova <lineprinter-u2l5PoMzF/[email protected]>

PTRACE_GET_SYSCALL_INFO is a generic ptrace API that lets ptracer obtain details of the syscall the tracee is blocked in.

There are two reasons for a special syscall-related ptrace request.

Firstly, with the current ptrace API there are cases when ptracer cannot retrieve necessary information about syscalls. Some examples include:
* The notorious int-0x80-from-64-bit-task issue. See [1] for details. In short, if a 64-bit task performs a syscall through int 0x80, its tracer has no reliable means to find out that the syscall was, in fact, a compat syscall, and misidentifies it.
* Syscall-enter-stop and syscall-exit-stop look the same for the tracer. Common practice is to keep track of the sequence of ptrace-stops in order not to mix the two syscall-stops up. But it is not as simple as it looks; for example, strace had a (just recently fixed) long-standing bug where attaching strace to a tracee that is performing the execve system call led to the tracer identifying the following syscall-exit-stop as syscall-enter-stop, which messed up all the state tracking.
* Since the introduction of commit 84d77d3f06e7e8dea057d10e8ec77ad71f721be3 ("ptrace: Don't allow accessing an undumpable mm"), both PTRACE_PEEKDATA and process_vm_readv become unavailable when the process dumpable flag is cleared. On such architectures as ia64 this results in all syscall arguments being unavailable for the tracer.

Secondly, ptracers also have to support a lot of arch-specific code for obtaining information about the tracee. For some architectures, this requires a ptrace(PTRACE_PEEKUSER, ...) invocation for every syscall argument and return value.

ptrace(2) man page:

long ptrace(enum __ptrace_request request, pid_t pid,

            void *addr, void *data);

...
PTRACE_GET_SYSCALL_INFO
Retrieve information about the syscall that caused the stop. The information is placed into the buffer pointed by "data" argument, which should be a pointer to a buffer of type "struct ptrace_syscall_info".
The "addr" argument contains the size of the buffer pointed to by "data" argument (i.e., sizeof(struct ptrace_syscall_info)). The return value contains the number of bytes available to be written by the kernel.
If the size of data to be written by the kernel exceeds the size specified by "addr" argument, the output is truncated.

Co-authored-by Dmitry V. Levin <ldv-u2l5PoMzF/[email protected]>

Reviewed-by Oleg Nesterov <[email protected]>

Reviewed-by Kees Cook <[email protected]>

Cc Andy Lutomirski <[email protected]>

Cc Eugene Syromyatnikov <[email protected]>

Signed-off-by Elvira Khabirova <lineprinter-u2l5PoMzF/[email protected]>

Signed-off-by Dmitry V. Levin <ldv-u2l5PoMzF/[email protected]>

---

Notes:
v11: unchanged

v10: unchanged

v9:
* Rebased to linux-next again due to syscall_get_arguments() signature change.

v8:
* Rebased to linux-next.
* Moved ptrace_get_syscall_info code under #ifdef CONFIG_HAVE_ARCH_TRACEHOOK, narrowing down the set of architectures supported by this implementation back to those 19 that enable CONFIG_HAVE_ARCH_TRACEHOOK because I failed to get all syscall_get_*(), instruction_pointer(), and user_stack_pointer() functions implemented on some niche architectures. This leaves the following architectures out:
alpha, h8300, m68k, microblaze, and unicore32.

v7: unchanged

v6:
* Changed PTRACE_GET_SYSCALL_INFO return code after discussion with Oleg:
do not take trailing paddings into account, use the end of the last field
of the structure being written.
* Changed struct ptrace_syscall_info after discussion in lkml:
* removed .frame_pointer field, is is not needed and not portable;
* made .arch field explicitly aligned, removed no longer needed
padding before .arch field;
* removed trailing pads, they are no longer needed.
* Added Reviewed-by
from https://lore.kernel.org/lkml/[email protected]/
and https://lore.kernel.org/lkml/CAGXu5j+t1LqRC7KCHkdYhv6icgf01Lk6v=fAhPWGys=1g49=Qg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org/

v5:
* Changed PTRACE_EVENTMSG_SYSCALL_{ENTRY,EXIT} values as requested by Oleg.
* Changed struct ptrace_syscall_info: generalized instruction_pointer, stack_pointer, and frame_pointer fields by moving them from ptrace_syscall_info.{entry,seccomp} substructures to ptrace_syscall_info and initializing them for all stops.
* Added PTRACE_SYSCALL_INFO_NONE, set it when not in a syscall stop, so e.g. "strace -i" could use PTRACE_SYSCALL_INFO_SECCOMP to obtain instruction_pointer when the tracee is in a signal stop.
* Made available for all architectures: do not conditionalize on CONFIG_HAVE_ARCH_TRACEHOOK since all syscall_get_* functions are implemented on all architectures.

v4:
* Revisited PTRACE_EVENT_SECCOMP support:
do not introduce task_struct.ptrace_event, use child->last_siginfo->si_code instead.
* Implemented PTRACE_SYSCALL_INFO_SECCOMP and ptrace_syscall_info.seccomp support along with PTRACE_SYSCALL_INFO_{ENTRY,EXIT} and ptrace_syscall_info.{entry,exit}.

v3:
* Changed struct ptrace_syscall_info.
* Added PTRACE_EVENT_SECCOMP support by adding ptrace_event to task_struct.
* Added proper defines for ptrace_syscall_info.op values.
* Renamed PT_SYSCALL_IS_ENTERING and PT_SYSCALL_IS_EXITING to PTRACE_EVENTMSG_SYSCALL_ENTRY and PTRACE_EVENTMSG_SYSCALL_EXIT and moved them to uapi.

v2:
* Stopped using task->ptrace.
* Replaced entry_info.is_compat with entry_info.arch, used syscall_get_arch().
* Used addr argument of sys_ptrace to get expected size of the struct; return full size of the struct.

 include/linux/tracehook.h   |   9 ++--
 include/uapi/linux/ptrace.h |  35 +++++++++++++
 kernel/ptrace.c             | 101 +++++++++++++++++++++++++++++++++++-
 3 files changed, 141 insertions(+), 4 deletions(-)

include/linux/tracehook.h +6 -3

index df20f8bdbfa3..6bc7a3d58e2f 100644
@@ -57,13 +57,15 @@ struct linux_binprm;
 /*
  * ptrace report for syscall entry and exit looks identical.
  */
-static inline int ptrace_report_syscall(struct pt_regs *regs)
+static inline int ptrace_report_syscall(struct pt_regs *regs,
+					unsigned long message)
 {
 	int ptrace = current->ptrace;
 
 	if (!(ptrace & PT_PTRACED))
 		return 0;
 
+	current->ptrace_message = message;
 	ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
 
 	/*

@@ -76,6 +78,7 @@ static inline int ptrace_report_syscall(struct pt_regs *regs)
 		current->exit_code = 0;
 	}
 
+	current->ptrace_message = 0;
 	return fatal_signal_pending(current);
 }

@@ -101,7 +104,7 @@ static inline int ptrace_report_syscall(struct pt_regs *regs)
 static inline __must_check int tracehook_report_syscall_entry(
 	struct pt_regs *regs)
 {
-	return ptrace_report_syscall(regs);
+	return ptrace_report_syscall(regs, PTRACE_EVENTMSG_SYSCALL_ENTRY);
 }
 
 /**

@@ -126,7 +129,7 @@ static inline void tracehook_report_syscall_exit(struct pt_regs *regs, int step)
 	if (step)
 		user_single_step_report(regs);
 	else
-		ptrace_report_syscall(regs);
+		ptrace_report_syscall(regs, PTRACE_EVENTMSG_SYSCALL_EXIT);
 }
 
 /**

include/uapi/linux/ptrace.h +35 -0

index d5a1b8a492b9..a71b6e3b03eb 100644
@@ -73,6 +73,41 @@ struct seccomp_metadata {
 	__u64 flags;		/* Output: filter's flags */
 };
 
+#define PTRACE_GET_SYSCALL_INFO		0x420e
+#define PTRACE_SYSCALL_INFO_NONE	0
+#define PTRACE_SYSCALL_INFO_ENTRY	1
+#define PTRACE_SYSCALL_INFO_EXIT	2
+#define PTRACE_SYSCALL_INFO_SECCOMP	3
+
+struct ptrace_syscall_info {
+	__u8 op;	/* PTRACE_SYSCALL_INFO_* */
+	__u32 arch __attribute__((__aligned__(sizeof(__u32))));
+	__u64 instruction_pointer;
+	__u64 stack_pointer;
+	union {
+		struct {
+			__u64 nr;
+			__u64 args[6];
+		} entry;
+		struct {
+			__s64 rval;
+			__u8 is_error;
+		} exit;
+		struct {
+			__u64 nr;
+			__u64 args[6];
+			__u32 ret_data;
+		} seccomp;
+	};
+};
+
+/*
+ * These values are stored in task->ptrace_message
+ * by tracehook_report_syscall_* to describe the current syscall-stop.
+ */
+#define PTRACE_EVENTMSG_SYSCALL_ENTRY	1
+#define PTRACE_EVENTMSG_SYSCALL_EXIT	2
+
 /* Read signals from a shared (process wide) queue */
 #define PTRACE_PEEKSIGINFO_SHARED	(1 << 0)

kernel/ptrace.c +100 -1

119 lines not on this page · raw message

Signature · 5 lines

ldv
-- 
Strace-devel mailing list
[email protected]
https://lists.strace.io/mailman/listinfo/strace-devel

Dmitry V. Levin

author

2019-05-10 15:28 UTC #7 lore raw

PATCH v11 7/7 selftests/ptrace: add a test case for PTRACE_GET_SYSCALL_INFO