1 /* Linux-specific ptrace manipulation routines.
2    Copyright (C) 2012-2013 Free Software Foundation, Inc.
3 
4    This file is part of GDB.
5 
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 3 of the License, or
9    (at your option) any later version.
10 
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15 
16    You should have received a copy of the GNU General Public License
17    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
18 
19 #ifdef GDBSERVER
20 #include "server.h"
21 #else
22 #include "defs.h"
23 #include "gdb_string.h"
24 #endif
25 
26 #include "linux-ptrace.h"
27 #include "linux-procfs.h"
28 #include "buffer.h"
29 #include "gdb_assert.h"
30 #include "gdb_wait.h"
31 
32 /* Find all possible reasons we could fail to attach PID and append these
33    newline terminated reason strings to initialized BUFFER.  '\0' termination
34    of BUFFER must be done by the caller.  */
35 
36 void
linux_ptrace_attach_warnings(pid_t pid,struct buffer * buffer)37 linux_ptrace_attach_warnings (pid_t pid, struct buffer *buffer)
38 {
39   pid_t tracerpid;
40 
41   tracerpid = linux_proc_get_tracerpid (pid);
42   if (tracerpid > 0)
43     buffer_xml_printf (buffer, _("warning: process %d is already traced "
44 				 "by process %d\n"),
45 		       (int) pid, (int) tracerpid);
46 
47   if (linux_proc_pid_is_zombie (pid))
48     buffer_xml_printf (buffer, _("warning: process %d is a zombie "
49 				 "- the process has already terminated\n"),
50 		       (int) pid);
51 }
52 
53 #if defined __i386__ || defined __x86_64__
54 
55 /* Address of the 'ret' instruction in asm code block below.  */
56 extern void (linux_ptrace_test_ret_to_nx_instr) (void);
57 
58 #include <sys/reg.h>
59 #include <sys/mman.h>
60 #include <signal.h>
61 #include <stdint.h>
62 
63 #endif /* defined __i386__ || defined __x86_64__ */
64 
65 /* Test broken off-trunk Linux kernel patchset for NX support on i386.  It was
66    removed in Fedora kernel 88fa1f0332d188795ed73d7ac2b1564e11a0b4cd.
67 
68    Test also x86_64 arch for PaX support.  */
69 
70 static void
linux_ptrace_test_ret_to_nx(void)71 linux_ptrace_test_ret_to_nx (void)
72 {
73 #if defined __i386__ || defined __x86_64__
74   pid_t child, got_pid;
75   gdb_byte *return_address, *pc;
76   long l;
77   int status, kill_status;
78 
79   return_address = mmap (NULL, 2, PROT_READ | PROT_WRITE,
80 			 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
81   if (return_address == MAP_FAILED)
82     {
83       warning (_("linux_ptrace_test_ret_to_nx: Cannot mmap: %s"),
84 	       strerror (errno));
85       return;
86     }
87 
88   /* Put there 'int3'.  */
89   *return_address = 0xcc;
90 
91   child = fork ();
92   switch (child)
93     {
94     case -1:
95       warning (_("linux_ptrace_test_ret_to_nx: Cannot fork: %s"),
96 	       strerror (errno));
97       return;
98 
99     case 0:
100       l = ptrace (PTRACE_TRACEME, 0, NULL, NULL);
101       if (l != 0)
102 	warning (_("linux_ptrace_test_ret_to_nx: Cannot PTRACE_TRACEME: %s"),
103 		 strerror (errno));
104       else
105 	{
106 #if defined __i386__
107 	  asm volatile ("pushl %0;"
108 			".globl linux_ptrace_test_ret_to_nx_instr;"
109 			"linux_ptrace_test_ret_to_nx_instr:"
110 			"ret"
111 			: : "r" (return_address) : "%esp", "memory");
112 #elif defined __x86_64__
113 	  asm volatile ("pushq %0;"
114 			".globl linux_ptrace_test_ret_to_nx_instr;"
115 			"linux_ptrace_test_ret_to_nx_instr:"
116 			"ret"
117 			: : "r" ((uint64_t) (uintptr_t) return_address)
118 			: "%rsp", "memory");
119 #else
120 # error "!__i386__ && !__x86_64__"
121 #endif
122 	  gdb_assert_not_reached ("asm block did not terminate");
123 	}
124 
125       _exit (1);
126     }
127 
128   errno = 0;
129   got_pid = waitpid (child, &status, 0);
130   if (got_pid != child)
131     {
132       warning (_("linux_ptrace_test_ret_to_nx: waitpid returned %ld: %s"),
133 	       (long) got_pid, strerror (errno));
134       return;
135     }
136 
137   if (WIFSIGNALED (status))
138     {
139       if (WTERMSIG (status) != SIGKILL)
140 	warning (_("linux_ptrace_test_ret_to_nx: WTERMSIG %d is not SIGKILL!"),
141 		 (int) WTERMSIG (status));
142       else
143 	warning (_("Cannot call inferior functions, Linux kernel PaX "
144 		   "protection forbids return to non-executable pages!"));
145       return;
146     }
147 
148   if (!WIFSTOPPED (status))
149     {
150       warning (_("linux_ptrace_test_ret_to_nx: status %d is not WIFSTOPPED!"),
151 	       status);
152       return;
153     }
154 
155   /* We may get SIGSEGV due to missing PROT_EXEC of the return_address.  */
156   if (WSTOPSIG (status) != SIGTRAP && WSTOPSIG (status) != SIGSEGV)
157     {
158       warning (_("linux_ptrace_test_ret_to_nx: "
159 		 "WSTOPSIG %d is neither SIGTRAP nor SIGSEGV!"),
160 	       (int) WSTOPSIG (status));
161       return;
162     }
163 
164   errno = 0;
165 #if defined __i386__
166   l = ptrace (PTRACE_PEEKUSER, child, (void *) (uintptr_t) (EIP * 4), NULL);
167 #elif defined __x86_64__
168   l = ptrace (PTRACE_PEEKUSER, child, (void *) (uintptr_t) (RIP * 8), NULL);
169 #else
170 # error "!__i386__ && !__x86_64__"
171 #endif
172   if (errno != 0)
173     {
174       warning (_("linux_ptrace_test_ret_to_nx: Cannot PTRACE_PEEKUSER: %s"),
175 	       strerror (errno));
176       return;
177     }
178   pc = (void *) (uintptr_t) l;
179 
180   kill (child, SIGKILL);
181   ptrace (PTRACE_KILL, child, NULL, NULL);
182 
183   errno = 0;
184   got_pid = waitpid (child, &kill_status, 0);
185   if (got_pid != child)
186     {
187       warning (_("linux_ptrace_test_ret_to_nx: "
188 		 "PTRACE_KILL waitpid returned %ld: %s"),
189 	       (long) got_pid, strerror (errno));
190       return;
191     }
192   if (!WIFSIGNALED (kill_status))
193     {
194       warning (_("linux_ptrace_test_ret_to_nx: "
195 		 "PTRACE_KILL status %d is not WIFSIGNALED!"),
196 	       status);
197       return;
198     }
199 
200   /* + 1 is there as x86* stops after the 'int3' instruction.  */
201   if (WSTOPSIG (status) == SIGTRAP && pc == return_address + 1)
202     {
203       /* PASS */
204       return;
205     }
206 
207   /* We may get SIGSEGV due to missing PROT_EXEC of the RETURN_ADDRESS page.  */
208   if (WSTOPSIG (status) == SIGSEGV && pc == return_address)
209     {
210       /* PASS */
211       return;
212     }
213 
214   if ((void (*) (void)) pc != &linux_ptrace_test_ret_to_nx_instr)
215     warning (_("linux_ptrace_test_ret_to_nx: PC %p is neither near return "
216 	       "address %p nor is the return instruction %p!"),
217 	     pc, return_address, &linux_ptrace_test_ret_to_nx_instr);
218   else
219     warning (_("Cannot call inferior functions on this system - "
220 	       "Linux kernel with broken i386 NX (non-executable pages) "
221 	       "support detected!"));
222 #endif /* defined __i386__ || defined __x86_64__ */
223 }
224 
225 /* Display possible problems on this system.  Display them only once per GDB
226    execution.  */
227 
228 void
linux_ptrace_init_warnings(void)229 linux_ptrace_init_warnings (void)
230 {
231   static int warned = 0;
232 
233   if (warned)
234     return;
235   warned = 1;
236 
237   linux_ptrace_test_ret_to_nx ();
238 }
239