From: Andrei Vagin <avagin@gmail.com> To: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Jann Horn <jannh@google.com>, Andy Lutomirski <luto@kernel.org>, Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, Linux API <linux-api@vger.kernel.org>, linux-um@lists.infradead.org, criu@openvz.org, avagin@google.com, Andrew Morton <akpm@linux-foundation.org>, Anton Ivanov <anton.ivanov@cambridgegreys.com>, Christian Brauner <christian.brauner@ubuntu.com>, Dmitry Safonov <0x7f454c46@gmail.com>, Ingo Molnar <mingo@redhat.com>, Jeff Dike <jdike@addtoit.com>, Mike Rapoport <rppt@linux.ibm.com>, Michael Kerrisk <mtk.manpages@gmail.com>, Oleg Nesterov <oleg@redhat.com>, "Peter Zijlstra (Intel)" <peterz@infradead.org>, Richard Weinberger <richard@nod.at>, Thomas Gleixner <tglx@linutronix.de> Subject: Re: [PATCH 2/4] arch/x86: implement the process_vm_exec syscall Date: Mon, 28 Jun 2021 18:01:43 -0700 [thread overview] Message-ID: <YNpw92ji12g9+W3D@gmail.com> (raw) In-Reply-To: <87o8bpyhsw.fsf@disp2133> On Mon, Jun 28, 2021 at 01:18:07PM -0500, Eric W. Biederman wrote: > Jann Horn <jannh@google.com> writes: > > > On Mon, Jun 28, 2021 at 6:30 PM Andy Lutomirski <luto@kernel.org> wrote: > >> On Mon, Jun 28, 2021, at 9:13 AM, Jann Horn wrote: > >> > On Wed, Apr 14, 2021 at 7:59 AM Andrei Vagin <avagin@gmail.com> wrote: > >> > > This change introduces the new system call: > >> > > process_vm_exec(pid_t pid, struct sigcontext *uctx, unsigned long flags, > >> > > siginfo_t * uinfo, sigset_t *sigmask, size_t sizemask) > >> > > > >> > > process_vm_exec allows to execute the current process in an address > >> > > space of another process. > >> > [...] > >> > > >> > I still think that this whole API is fundamentally the wrong approach > >> > because it tries to shoehorn multiple usecases with different > >> > requirements into a single API. But that aside: > >> > > >> > > +static void swap_mm(struct mm_struct *prev_mm, struct mm_struct *target_mm) > >> > > +{ > >> > > + struct task_struct *tsk = current; > >> > > + struct mm_struct *active_mm; > >> > > + > >> > > + task_lock(tsk); > >> > > + /* Hold off tlb flush IPIs while switching mm's */ > >> > > + local_irq_disable(); > >> > > + > >> > > + sync_mm_rss(prev_mm); > >> > > + > >> > > + vmacache_flush(tsk); > >> > > + > >> > > + active_mm = tsk->active_mm; > >> > > + if (active_mm != target_mm) { > >> > > + mmgrab(target_mm); > >> > > + tsk->active_mm = target_mm; > >> > > + } > >> > > + tsk->mm = target_mm; > >> > > >> > I'm pretty sure you're not currently allowed to overwrite the ->mm > >> > pointer of a userspace thread. For example, zap_threads() assumes that > >> > all threads running under a process have the same ->mm. (And if you're > >> > fiddling with ->mm stuff, you should probably CC linux-mm@.) > >> > >> exec_mmap() does it, so it can’t be entirely impossible. > > > > Yeah, true, execve can do it - I guess the thing that makes that > > special is that it's running after de_thread(), so it's guaranteed to > > be single-threaded? > > Even the implementation detail of swapping the mm aside. Even the idea > of swaping the mm is completely broken, as an endless system calls > depend upon the state held in task_struct. io_uring just tried running > system calls of a process in a different context and we ultimately had > to make the threads part of the original process to make enough things > work to keep the problem tractable. > > System calls deeply and fundamentally depend on task_struct and > signal_struct. In opposite to io_uring, process_vm_exec doesn't intend to run system calls in the context of the target process. We initially declare that system calls are executed in the context of the current process with just another mm. If we are talking about user-mode kernels, they will need just two system calls: mmap and munmap. In case of CRIU, vmsplice will be used too. > > I can think of two possibilities. > 1) Hijack and existing process thread. > 2) Inject a new thread into an existing process. I am not sure that I understand what you mean here, but it sounds like we will need to do a context switch to execute anything in a context of a hijacked thread. If I am right, it kills the main idea of process_vm_exec. If I misunderstand your idea, maybe you can describe it with more details. Thanks, Andrei
WARNING: multiple messages have this Message-ID (diff)
From: Andrei Vagin <avagin@gmail.com> To: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Jann Horn <jannh@google.com>, Andy Lutomirski <luto@kernel.org>, Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, Linux API <linux-api@vger.kernel.org>, linux-um@lists.infradead.org, criu@openvz.org, avagin@google.com, Andrew Morton <akpm@linux-foundation.org>, Anton Ivanov <anton.ivanov@cambridgegreys.com>, Christian Brauner <christian.brauner@ubuntu.com>, Dmitry Safonov <0x7f454c46@gmail.com>, Ingo Molnar <mingo@redhat.com>, Jeff Dike <jdike@addtoit.com>, Mike Rapoport <rppt@linux.ibm.com>, Michael Kerrisk <mtk.manpages@gmail.com>, Oleg Nesterov <oleg@redhat.com>, "Peter Zijlstra (Intel)" <peterz@infradead.org>, Richard Weinberger <richard@nod.at>, Thomas Gleixner <tglx@linutronix.de> Subject: Re: [PATCH 2/4] arch/x86: implement the process_vm_exec syscall Date: Mon, 28 Jun 2021 18:01:43 -0700 [thread overview] Message-ID: <YNpw92ji12g9+W3D@gmail.com> (raw) In-Reply-To: <87o8bpyhsw.fsf@disp2133> On Mon, Jun 28, 2021 at 01:18:07PM -0500, Eric W. Biederman wrote: > Jann Horn <jannh@google.com> writes: > > > On Mon, Jun 28, 2021 at 6:30 PM Andy Lutomirski <luto@kernel.org> wrote: > >> On Mon, Jun 28, 2021, at 9:13 AM, Jann Horn wrote: > >> > On Wed, Apr 14, 2021 at 7:59 AM Andrei Vagin <avagin@gmail.com> wrote: > >> > > This change introduces the new system call: > >> > > process_vm_exec(pid_t pid, struct sigcontext *uctx, unsigned long flags, > >> > > siginfo_t * uinfo, sigset_t *sigmask, size_t sizemask) > >> > > > >> > > process_vm_exec allows to execute the current process in an address > >> > > space of another process. > >> > [...] > >> > > >> > I still think that this whole API is fundamentally the wrong approach > >> > because it tries to shoehorn multiple usecases with different > >> > requirements into a single API. But that aside: > >> > > >> > > +static void swap_mm(struct mm_struct *prev_mm, struct mm_struct *target_mm) > >> > > +{ > >> > > + struct task_struct *tsk = current; > >> > > + struct mm_struct *active_mm; > >> > > + > >> > > + task_lock(tsk); > >> > > + /* Hold off tlb flush IPIs while switching mm's */ > >> > > + local_irq_disable(); > >> > > + > >> > > + sync_mm_rss(prev_mm); > >> > > + > >> > > + vmacache_flush(tsk); > >> > > + > >> > > + active_mm = tsk->active_mm; > >> > > + if (active_mm != target_mm) { > >> > > + mmgrab(target_mm); > >> > > + tsk->active_mm = target_mm; > >> > > + } > >> > > + tsk->mm = target_mm; > >> > > >> > I'm pretty sure you're not currently allowed to overwrite the ->mm > >> > pointer of a userspace thread. For example, zap_threads() assumes that > >> > all threads running under a process have the same ->mm. (And if you're > >> > fiddling with ->mm stuff, you should probably CC linux-mm@.) > >> > >> exec_mmap() does it, so it can’t be entirely impossible. > > > > Yeah, true, execve can do it - I guess the thing that makes that > > special is that it's running after de_thread(), so it's guaranteed to > > be single-threaded? > > Even the implementation detail of swapping the mm aside. Even the idea > of swaping the mm is completely broken, as an endless system calls > depend upon the state held in task_struct. io_uring just tried running > system calls of a process in a different context and we ultimately had > to make the threads part of the original process to make enough things > work to keep the problem tractable. > > System calls deeply and fundamentally depend on task_struct and > signal_struct. In opposite to io_uring, process_vm_exec doesn't intend to run system calls in the context of the target process. We initially declare that system calls are executed in the context of the current process with just another mm. If we are talking about user-mode kernels, they will need just two system calls: mmap and munmap. In case of CRIU, vmsplice will be used too. > > I can think of two possibilities. > 1) Hijack and existing process thread. > 2) Inject a new thread into an existing process. I am not sure that I understand what you mean here, but it sounds like we will need to do a context switch to execute anything in a context of a hijacked thread. If I am right, it kills the main idea of process_vm_exec. If I misunderstand your idea, maybe you can describe it with more details. Thanks, Andrei _______________________________________________ linux-um mailing list linux-um@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-um
next prev parent reply other threads:[~2021-06-29 1:05 UTC|newest] Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-04-14 5:52 [PATCH 0/4 POC] Allow executing code and syscalls in another address space Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 1/4] signal: add a helper to restore a process state from sigcontex Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 2/4] arch/x86: implement the process_vm_exec syscall Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 17:09 ` Oleg Nesterov 2021-04-14 17:09 ` Oleg Nesterov 2021-04-23 6:59 ` Andrei Vagin 2021-04-23 6:59 ` Andrei Vagin 2021-06-28 16:13 ` Jann Horn 2021-06-28 16:13 ` Jann Horn 2021-06-28 16:30 ` Andy Lutomirski 2021-06-28 17:14 ` Jann Horn 2021-06-28 17:14 ` Jann Horn 2021-06-28 18:18 ` Eric W. Biederman 2021-06-28 18:18 ` Eric W. Biederman 2021-06-29 1:01 ` Andrei Vagin [this message] 2021-06-29 1:01 ` Andrei Vagin 2021-07-02 6:22 ` Andrei Vagin 2021-07-02 6:22 ` Andrei Vagin 2021-07-02 11:51 ` Jann Horn 2021-07-02 11:51 ` Jann Horn 2021-07-02 11:51 ` Jann Horn 2021-07-02 20:40 ` Andy Lutomirski 2021-07-02 20:40 ` Andy Lutomirski 2021-07-02 8:51 ` Peter Zijlstra 2021-07-02 8:51 ` Peter Zijlstra 2021-07-02 22:21 ` Andrei Vagin 2021-07-02 22:21 ` Andrei Vagin 2021-07-02 20:56 ` Jann Horn 2021-07-02 20:56 ` Jann Horn 2021-07-02 22:48 ` Andrei Vagin 2021-07-02 22:48 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 3/4] arch/x86: allow to execute syscalls via process_vm_exec Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 4/4] selftests: add tests for process_vm_exec Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 6:46 ` [PATCH 0/4 POC] Allow executing code and syscalls in another address space Jann Horn 2021-04-14 6:46 ` Jann Horn 2021-04-14 22:10 ` Andrei Vagin 2021-04-14 22:10 ` Andrei Vagin 2021-07-02 6:57 ` Andrei Vagin 2021-07-02 6:57 ` Andrei Vagin 2021-07-02 15:12 ` Jann Horn 2021-07-02 15:12 ` Jann Horn 2021-07-02 15:12 ` Jann Horn 2021-07-18 0:38 ` Andrei Vagin 2021-07-18 0:38 ` Andrei Vagin 2021-04-14 7:22 ` Anton Ivanov 2021-04-14 7:22 ` Anton Ivanov 2021-04-14 7:34 ` Johannes Berg 2021-04-14 7:34 ` Johannes Berg 2021-04-14 9:24 ` Benjamin Berg 2021-04-14 9:24 ` Benjamin Berg 2021-04-14 10:27 ` Florian Weimer 2021-04-14 10:27 ` Florian Weimer 2021-04-14 11:24 ` Jann Horn 2021-04-14 11:24 ` Jann Horn 2021-04-14 12:20 ` Florian Weimer 2021-04-14 12:20 ` Florian Weimer 2021-04-14 13:58 ` Jann Horn 2021-04-14 13:58 ` Jann Horn 2021-04-16 19:29 ` Kirill Smelkov 2021-04-16 19:29 ` Kirill Smelkov 2021-04-17 16:28 ` sbaugh 2021-04-17 16:28 ` sbaugh 2021-07-02 22:44 ` Andy Lutomirski 2021-07-02 22:44 ` Andy Lutomirski 2021-07-18 1:34 ` Andrei Vagin 2021-07-18 1:34 ` Andrei Vagin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=YNpw92ji12g9+W3D@gmail.com \ --to=avagin@gmail.com \ --cc=0x7f454c46@gmail.com \ --cc=akpm@linux-foundation.org \ --cc=anton.ivanov@cambridgegreys.com \ --cc=avagin@google.com \ --cc=christian.brauner@ubuntu.com \ --cc=criu@openvz.org \ --cc=ebiederm@xmission.com \ --cc=jannh@google.com \ --cc=jdike@addtoit.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-um@lists.infradead.org \ --cc=luto@kernel.org \ --cc=mingo@redhat.com \ --cc=mtk.manpages@gmail.com \ --cc=oleg@redhat.com \ --cc=peterz@infradead.org \ --cc=richard@nod.at \ --cc=rppt@linux.ibm.com \ --cc=tglx@linutronix.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.