1 /* Linux-specific ptrace manipulation routines. 2 Copyright (C) 2012-2013 Free Software Foundation, Inc. 3 4 This file is part of GDB. 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License as published by 8 the Free Software Foundation; either version 3 of the License, or 9 (at your option) any later version. 10 11 This program is distributed in the hope that it will be useful, 12 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 GNU General Public License for more details. 15 16 You should have received a copy of the GNU General Public License 17 along with this program. If not, see <http://www.gnu.org/licenses/>. */ 18 19 #ifdef GDBSERVER 20 #include "server.h" 21 #else 22 #include "defs.h" 23 #include "gdb_string.h" 24 #endif 25 26 #include "linux-ptrace.h" 27 #include "linux-procfs.h" 28 #include "buffer.h" 29 #include "gdb_assert.h" 30 #include "gdb_wait.h" 31 32 /* Find all possible reasons we could fail to attach PID and append these 33 newline terminated reason strings to initialized BUFFER. '\0' termination 34 of BUFFER must be done by the caller. */ 35 36 void 37 linux_ptrace_attach_warnings (pid_t pid, struct buffer *buffer) 38 { 39 pid_t tracerpid; 40 41 tracerpid = linux_proc_get_tracerpid (pid); 42 if (tracerpid > 0) 43 buffer_xml_printf (buffer, _("warning: process %d is already traced " 44 "by process %d\n"), 45 (int) pid, (int) tracerpid); 46 47 if (linux_proc_pid_is_zombie (pid)) 48 buffer_xml_printf (buffer, _("warning: process %d is a zombie " 49 "- the process has already terminated\n"), 50 (int) pid); 51 } 52 53 #if defined __i386__ || defined __x86_64__ 54 55 /* Address of the 'ret' instruction in asm code block below. */ 56 extern void (linux_ptrace_test_ret_to_nx_instr) (void); 57 58 #include <sys/reg.h> 59 #include <sys/mman.h> 60 #include <signal.h> 61 #include <stdint.h> 62 63 #endif /* defined __i386__ || defined __x86_64__ */ 64 65 /* Test broken off-trunk Linux kernel patchset for NX support on i386. It was 66 removed in Fedora kernel 88fa1f0332d188795ed73d7ac2b1564e11a0b4cd. 67 68 Test also x86_64 arch for PaX support. */ 69 70 static void 71 linux_ptrace_test_ret_to_nx (void) 72 { 73 #if defined __i386__ || defined __x86_64__ 74 pid_t child, got_pid; 75 gdb_byte *return_address, *pc; 76 long l; 77 int status, kill_status; 78 79 return_address = mmap (NULL, 2, PROT_READ | PROT_WRITE, 80 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 81 if (return_address == MAP_FAILED) 82 { 83 warning (_("linux_ptrace_test_ret_to_nx: Cannot mmap: %s"), 84 strerror (errno)); 85 return; 86 } 87 88 /* Put there 'int3'. */ 89 *return_address = 0xcc; 90 91 child = fork (); 92 switch (child) 93 { 94 case -1: 95 warning (_("linux_ptrace_test_ret_to_nx: Cannot fork: %s"), 96 strerror (errno)); 97 return; 98 99 case 0: 100 l = ptrace (PTRACE_TRACEME, 0, NULL, NULL); 101 if (l != 0) 102 warning (_("linux_ptrace_test_ret_to_nx: Cannot PTRACE_TRACEME: %s"), 103 strerror (errno)); 104 else 105 { 106 #if defined __i386__ 107 asm volatile ("pushl %0;" 108 ".globl linux_ptrace_test_ret_to_nx_instr;" 109 "linux_ptrace_test_ret_to_nx_instr:" 110 "ret" 111 : : "r" (return_address) : "%esp", "memory"); 112 #elif defined __x86_64__ 113 asm volatile ("pushq %0;" 114 ".globl linux_ptrace_test_ret_to_nx_instr;" 115 "linux_ptrace_test_ret_to_nx_instr:" 116 "ret" 117 : : "r" ((uint64_t) (uintptr_t) return_address) 118 : "%rsp", "memory"); 119 #else 120 # error "!__i386__ && !__x86_64__" 121 #endif 122 gdb_assert_not_reached ("asm block did not terminate"); 123 } 124 125 _exit (1); 126 } 127 128 errno = 0; 129 got_pid = waitpid (child, &status, 0); 130 if (got_pid != child) 131 { 132 warning (_("linux_ptrace_test_ret_to_nx: waitpid returned %ld: %s"), 133 (long) got_pid, strerror (errno)); 134 return; 135 } 136 137 if (WIFSIGNALED (status)) 138 { 139 if (WTERMSIG (status) != SIGKILL) 140 warning (_("linux_ptrace_test_ret_to_nx: WTERMSIG %d is not SIGKILL!"), 141 (int) WTERMSIG (status)); 142 else 143 warning (_("Cannot call inferior functions, Linux kernel PaX " 144 "protection forbids return to non-executable pages!")); 145 return; 146 } 147 148 if (!WIFSTOPPED (status)) 149 { 150 warning (_("linux_ptrace_test_ret_to_nx: status %d is not WIFSTOPPED!"), 151 status); 152 return; 153 } 154 155 /* We may get SIGSEGV due to missing PROT_EXEC of the return_address. */ 156 if (WSTOPSIG (status) != SIGTRAP && WSTOPSIG (status) != SIGSEGV) 157 { 158 warning (_("linux_ptrace_test_ret_to_nx: " 159 "WSTOPSIG %d is neither SIGTRAP nor SIGSEGV!"), 160 (int) WSTOPSIG (status)); 161 return; 162 } 163 164 errno = 0; 165 #if defined __i386__ 166 l = ptrace (PTRACE_PEEKUSER, child, (void *) (uintptr_t) (EIP * 4), NULL); 167 #elif defined __x86_64__ 168 l = ptrace (PTRACE_PEEKUSER, child, (void *) (uintptr_t) (RIP * 8), NULL); 169 #else 170 # error "!__i386__ && !__x86_64__" 171 #endif 172 if (errno != 0) 173 { 174 warning (_("linux_ptrace_test_ret_to_nx: Cannot PTRACE_PEEKUSER: %s"), 175 strerror (errno)); 176 return; 177 } 178 pc = (void *) (uintptr_t) l; 179 180 kill (child, SIGKILL); 181 ptrace (PTRACE_KILL, child, NULL, NULL); 182 183 errno = 0; 184 got_pid = waitpid (child, &kill_status, 0); 185 if (got_pid != child) 186 { 187 warning (_("linux_ptrace_test_ret_to_nx: " 188 "PTRACE_KILL waitpid returned %ld: %s"), 189 (long) got_pid, strerror (errno)); 190 return; 191 } 192 if (!WIFSIGNALED (kill_status)) 193 { 194 warning (_("linux_ptrace_test_ret_to_nx: " 195 "PTRACE_KILL status %d is not WIFSIGNALED!"), 196 status); 197 return; 198 } 199 200 /* + 1 is there as x86* stops after the 'int3' instruction. */ 201 if (WSTOPSIG (status) == SIGTRAP && pc == return_address + 1) 202 { 203 /* PASS */ 204 return; 205 } 206 207 /* We may get SIGSEGV due to missing PROT_EXEC of the RETURN_ADDRESS page. */ 208 if (WSTOPSIG (status) == SIGSEGV && pc == return_address) 209 { 210 /* PASS */ 211 return; 212 } 213 214 if ((void (*) (void)) pc != &linux_ptrace_test_ret_to_nx_instr) 215 warning (_("linux_ptrace_test_ret_to_nx: PC %p is neither near return " 216 "address %p nor is the return instruction %p!"), 217 pc, return_address, &linux_ptrace_test_ret_to_nx_instr); 218 else 219 warning (_("Cannot call inferior functions on this system - " 220 "Linux kernel with broken i386 NX (non-executable pages) " 221 "support detected!")); 222 #endif /* defined __i386__ || defined __x86_64__ */ 223 } 224 225 /* Display possible problems on this system. Display them only once per GDB 226 execution. */ 227 228 void 229 linux_ptrace_init_warnings (void) 230 { 231 static int warned = 0; 232 233 if (warned) 234 return; 235 warned = 1; 236 237 linux_ptrace_test_ret_to_nx (); 238 } 239