From: Andrei Vagin <avagin@gmail.com> To: linux-kernel@vger.kernel.org, linux-api@vger.kernel.org Cc: linux-um@lists.infradead.org, criu@openvz.org, avagin@google.com, Andrei Vagin <avagin@gmail.com>, Andrew Morton <akpm@linux-foundation.org>, Andy Lutomirski <luto@kernel.org>, Anton Ivanov <anton.ivanov@cambridgegreys.com>, Christian Brauner <christian.brauner@ubuntu.com>, Dmitry Safonov <0x7f454c46@gmail.com>, Ingo Molnar <mingo@redhat.com>, Jeff Dike <jdike@addtoit.com>, Mike Rapoport <rppt@linux.ibm.com>, Michael Kerrisk <mtk.manpages@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Peter Zijlstra <peterz@infradead.org>, Richard Weinberger <richard@nod.at>, Thomas Gleixner <tglx@linutronix.de> Subject: [PATCH 3/4] arch/x86: allow to execute syscalls via process_vm_exec Date: Tue, 13 Apr 2021 22:52:16 -0700 [thread overview] Message-ID: <20210414055217.543246-4-avagin@gmail.com> (raw) In-Reply-To: <20210414055217.543246-1-avagin@gmail.com> process_vm_exec allows to execute code in an address space of another process. It changes the current address space to the target address space and resume the current process with registers from sigcontex that is passed in the arguments. This changes adds the PROCESS_VM_EXEC_SYSCALL flag and if it is set process_vm_exec will execute a system call with arguments from sigcontext. process_vm_exec retuns 0 if the system call has been executed and an error code in other cases. A return code of the system call can be found in a proper register in sigcontext. Signed-off-by: Andrei Vagin <avagin@gmail.com> --- arch/x86/entry/common.c | 5 ++++- arch/x86/kernel/process_vm_exec.c | 29 +++++++++++++++++++++++++++- include/linux/entry-common.h | 2 ++ include/linux/process_vm_exec.h | 2 ++ include/uapi/linux/process_vm_exec.h | 8 ++++++++ kernel/entry/common.c | 2 +- 6 files changed, 45 insertions(+), 3 deletions(-) create mode 100644 include/uapi/linux/process_vm_exec.h diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index 42eac459b25b..8de02ca19aca 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -40,7 +40,10 @@ __visible noinstr void do_syscall_64(unsigned long nr, struct pt_regs *regs) { #ifdef CONFIG_PROCESS_VM_EXEC - if (current->exec_mm && current->exec_mm->ctx) { + struct exec_mm *exec_mm = current->exec_mm; + + if (exec_mm && exec_mm->ctx && + !(exec_mm->flags & PROCESS_VM_EXEC_SYSCALL)) { kernel_siginfo_t info = { .si_signo = SIGSYS, .si_call_addr = (void __user *)KSTK_EIP(current), diff --git a/arch/x86/kernel/process_vm_exec.c b/arch/x86/kernel/process_vm_exec.c index 28b32330f744..9124b23f1e9b 100644 --- a/arch/x86/kernel/process_vm_exec.c +++ b/arch/x86/kernel/process_vm_exec.c @@ -11,6 +11,7 @@ #include <linux/sched/mm.h> #include <linux/syscalls.h> #include <linux/vmacache.h> +#include <linux/entry-common.h> #include <linux/process_vm_exec.h> static void swap_mm(struct mm_struct *prev_mm, struct mm_struct *target_mm) @@ -73,7 +74,7 @@ SYSCALL_DEFINE6(process_vm_exec, pid_t, pid, struct sigcontext __user *, uctx, sigset_t mask; - if (flags) + if (flags & ~PROCESS_VM_EXEC_SYSCALL) return -EINVAL; if (sizemask != sizeof(sigset_t)) @@ -97,6 +98,9 @@ SYSCALL_DEFINE6(process_vm_exec, pid_t, pid, struct sigcontext __user *, uctx, } current_pt_regs()->ax = 0; + if (flags & PROCESS_VM_EXEC_SYSCALL) + syscall_exit_to_user_mode_prepare(current_pt_regs()); + ret = swap_vm_exec_context(uctx); if (ret < 0) goto err_mm_put; @@ -117,6 +121,29 @@ SYSCALL_DEFINE6(process_vm_exec, pid_t, pid, struct sigcontext __user *, uctx, mmgrab(prev_mm); swap_mm(prev_mm, mm); + if (flags & PROCESS_VM_EXEC_SYSCALL) { + struct pt_regs *regs = current_pt_regs(); + kernel_siginfo_t info; + int sysno; + + regs->orig_ax = regs->ax; + regs->ax = -ENOSYS; + sysno = syscall_get_nr(current, regs); + + do_syscall_64(sysno, regs); + + restore_vm_exec_context(regs); + info.si_signo = SIGSYS; + info.si_call_addr = (void __user *)KSTK_EIP(current); + info.si_arch = syscall_get_arch(current); + info.si_syscall = sysno; + ret = copy_siginfo_to_user(current->exec_mm->siginfo, &info); + current_pt_regs()->orig_ax = __NR_process_vm_exec; + current_pt_regs()->ax = -ENOSYS; + syscall_enter_from_user_mode_work(current_pt_regs(), current_pt_regs()->orig_ax); + return ret; + } + ret = current_pt_regs()->ax; return ret; diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h index 474f29638d2c..d0ebbe9ca9e4 100644 --- a/include/linux/entry-common.h +++ b/include/linux/entry-common.h @@ -285,6 +285,8 @@ static inline void arch_syscall_exit_tracehook(struct pt_regs *regs, bool step) } #endif +void syscall_exit_to_user_mode_prepare(struct pt_regs *regs); + /** * syscall_exit_to_user_mode - Handle work before returning to user mode * @regs: Pointer to currents pt_regs diff --git a/include/linux/process_vm_exec.h b/include/linux/process_vm_exec.h index a02535fbd5c8..2e04b4875a92 100644 --- a/include/linux/process_vm_exec.h +++ b/include/linux/process_vm_exec.h @@ -2,6 +2,8 @@ #ifndef _LINUX_PROCESS_VM_EXEC_H #define _LINUX_PROCESS_VM_EXEC_H +#include <uapi/linux/process_vm_exec.h> + struct exec_mm { struct sigcontext *ctx; struct mm_struct *mm; diff --git a/include/uapi/linux/process_vm_exec.h b/include/uapi/linux/process_vm_exec.h new file mode 100644 index 000000000000..35465b5d3ebf --- /dev/null +++ b/include/uapi/linux/process_vm_exec.h @@ -0,0 +1,8 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + +#ifndef _UAPI_LINUX_PROCESS_VM_EXEC_H +#define _UAPI_LINUX_PROCESS_VM_EXEC_H + +#define PROCESS_VM_EXEC_SYSCALL 0x1UL + +#endif diff --git a/kernel/entry/common.c b/kernel/entry/common.c index e9e2df3f3f9e..c325a2e5ecf4 100644 --- a/kernel/entry/common.c +++ b/kernel/entry/common.c @@ -235,7 +235,7 @@ static void syscall_exit_work(struct pt_regs *regs, unsigned long ti_work) * Syscall specific exit to user mode preparation. Runs with interrupts * enabled. */ -static void syscall_exit_to_user_mode_prepare(struct pt_regs *regs) +void syscall_exit_to_user_mode_prepare(struct pt_regs *regs) { u32 cached_flags = READ_ONCE(current_thread_info()->flags); unsigned long nr = syscall_get_nr(current, regs); -- 2.29.2
WARNING: multiple messages have this Message-ID (diff)
From: Andrei Vagin <avagin@gmail.com> To: linux-kernel@vger.kernel.org, linux-api@vger.kernel.org Cc: linux-um@lists.infradead.org, criu@openvz.org, avagin@google.com, Andrei Vagin <avagin@gmail.com>, Andrew Morton <akpm@linux-foundation.org>, Andy Lutomirski <luto@kernel.org>, Anton Ivanov <anton.ivanov@cambridgegreys.com>, Christian Brauner <christian.brauner@ubuntu.com>, Dmitry Safonov <0x7f454c46@gmail.com>, Ingo Molnar <mingo@redhat.com>, Jeff Dike <jdike@addtoit.com>, Mike Rapoport <rppt@linux.ibm.com>, Michael Kerrisk <mtk.manpages@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Peter Zijlstra <peterz@infradead.org>, Richard Weinberger <richard@nod.at>, Thomas Gleixner <tglx@linutronix.de> Subject: [PATCH 3/4] arch/x86: allow to execute syscalls via process_vm_exec Date: Tue, 13 Apr 2021 22:52:16 -0700 [thread overview] Message-ID: <20210414055217.543246-4-avagin@gmail.com> (raw) In-Reply-To: <20210414055217.543246-1-avagin@gmail.com> process_vm_exec allows to execute code in an address space of another process. It changes the current address space to the target address space and resume the current process with registers from sigcontex that is passed in the arguments. This changes adds the PROCESS_VM_EXEC_SYSCALL flag and if it is set process_vm_exec will execute a system call with arguments from sigcontext. process_vm_exec retuns 0 if the system call has been executed and an error code in other cases. A return code of the system call can be found in a proper register in sigcontext. Signed-off-by: Andrei Vagin <avagin@gmail.com> --- arch/x86/entry/common.c | 5 ++++- arch/x86/kernel/process_vm_exec.c | 29 +++++++++++++++++++++++++++- include/linux/entry-common.h | 2 ++ include/linux/process_vm_exec.h | 2 ++ include/uapi/linux/process_vm_exec.h | 8 ++++++++ kernel/entry/common.c | 2 +- 6 files changed, 45 insertions(+), 3 deletions(-) create mode 100644 include/uapi/linux/process_vm_exec.h diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index 42eac459b25b..8de02ca19aca 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -40,7 +40,10 @@ __visible noinstr void do_syscall_64(unsigned long nr, struct pt_regs *regs) { #ifdef CONFIG_PROCESS_VM_EXEC - if (current->exec_mm && current->exec_mm->ctx) { + struct exec_mm *exec_mm = current->exec_mm; + + if (exec_mm && exec_mm->ctx && + !(exec_mm->flags & PROCESS_VM_EXEC_SYSCALL)) { kernel_siginfo_t info = { .si_signo = SIGSYS, .si_call_addr = (void __user *)KSTK_EIP(current), diff --git a/arch/x86/kernel/process_vm_exec.c b/arch/x86/kernel/process_vm_exec.c index 28b32330f744..9124b23f1e9b 100644 --- a/arch/x86/kernel/process_vm_exec.c +++ b/arch/x86/kernel/process_vm_exec.c @@ -11,6 +11,7 @@ #include <linux/sched/mm.h> #include <linux/syscalls.h> #include <linux/vmacache.h> +#include <linux/entry-common.h> #include <linux/process_vm_exec.h> static void swap_mm(struct mm_struct *prev_mm, struct mm_struct *target_mm) @@ -73,7 +74,7 @@ SYSCALL_DEFINE6(process_vm_exec, pid_t, pid, struct sigcontext __user *, uctx, sigset_t mask; - if (flags) + if (flags & ~PROCESS_VM_EXEC_SYSCALL) return -EINVAL; if (sizemask != sizeof(sigset_t)) @@ -97,6 +98,9 @@ SYSCALL_DEFINE6(process_vm_exec, pid_t, pid, struct sigcontext __user *, uctx, } current_pt_regs()->ax = 0; + if (flags & PROCESS_VM_EXEC_SYSCALL) + syscall_exit_to_user_mode_prepare(current_pt_regs()); + ret = swap_vm_exec_context(uctx); if (ret < 0) goto err_mm_put; @@ -117,6 +121,29 @@ SYSCALL_DEFINE6(process_vm_exec, pid_t, pid, struct sigcontext __user *, uctx, mmgrab(prev_mm); swap_mm(prev_mm, mm); + if (flags & PROCESS_VM_EXEC_SYSCALL) { + struct pt_regs *regs = current_pt_regs(); + kernel_siginfo_t info; + int sysno; + + regs->orig_ax = regs->ax; + regs->ax = -ENOSYS; + sysno = syscall_get_nr(current, regs); + + do_syscall_64(sysno, regs); + + restore_vm_exec_context(regs); + info.si_signo = SIGSYS; + info.si_call_addr = (void __user *)KSTK_EIP(current); + info.si_arch = syscall_get_arch(current); + info.si_syscall = sysno; + ret = copy_siginfo_to_user(current->exec_mm->siginfo, &info); + current_pt_regs()->orig_ax = __NR_process_vm_exec; + current_pt_regs()->ax = -ENOSYS; + syscall_enter_from_user_mode_work(current_pt_regs(), current_pt_regs()->orig_ax); + return ret; + } + ret = current_pt_regs()->ax; return ret; diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h index 474f29638d2c..d0ebbe9ca9e4 100644 --- a/include/linux/entry-common.h +++ b/include/linux/entry-common.h @@ -285,6 +285,8 @@ static inline void arch_syscall_exit_tracehook(struct pt_regs *regs, bool step) } #endif +void syscall_exit_to_user_mode_prepare(struct pt_regs *regs); + /** * syscall_exit_to_user_mode - Handle work before returning to user mode * @regs: Pointer to currents pt_regs diff --git a/include/linux/process_vm_exec.h b/include/linux/process_vm_exec.h index a02535fbd5c8..2e04b4875a92 100644 --- a/include/linux/process_vm_exec.h +++ b/include/linux/process_vm_exec.h @@ -2,6 +2,8 @@ #ifndef _LINUX_PROCESS_VM_EXEC_H #define _LINUX_PROCESS_VM_EXEC_H +#include <uapi/linux/process_vm_exec.h> + struct exec_mm { struct sigcontext *ctx; struct mm_struct *mm; diff --git a/include/uapi/linux/process_vm_exec.h b/include/uapi/linux/process_vm_exec.h new file mode 100644 index 000000000000..35465b5d3ebf --- /dev/null +++ b/include/uapi/linux/process_vm_exec.h @@ -0,0 +1,8 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + +#ifndef _UAPI_LINUX_PROCESS_VM_EXEC_H +#define _UAPI_LINUX_PROCESS_VM_EXEC_H + +#define PROCESS_VM_EXEC_SYSCALL 0x1UL + +#endif diff --git a/kernel/entry/common.c b/kernel/entry/common.c index e9e2df3f3f9e..c325a2e5ecf4 100644 --- a/kernel/entry/common.c +++ b/kernel/entry/common.c @@ -235,7 +235,7 @@ static void syscall_exit_work(struct pt_regs *regs, unsigned long ti_work) * Syscall specific exit to user mode preparation. Runs with interrupts * enabled. */ -static void syscall_exit_to_user_mode_prepare(struct pt_regs *regs) +void syscall_exit_to_user_mode_prepare(struct pt_regs *regs) { u32 cached_flags = READ_ONCE(current_thread_info()->flags); unsigned long nr = syscall_get_nr(current, regs); -- 2.29.2 _______________________________________________ linux-um mailing list linux-um@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-um
next prev parent reply other threads:[~2021-04-14 5:55 UTC|newest] Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-04-14 5:52 [PATCH 0/4 POC] Allow executing code and syscalls in another address space Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 1/4] signal: add a helper to restore a process state from sigcontex Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 2/4] arch/x86: implement the process_vm_exec syscall Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 17:09 ` Oleg Nesterov 2021-04-14 17:09 ` Oleg Nesterov 2021-04-23 6:59 ` Andrei Vagin 2021-04-23 6:59 ` Andrei Vagin 2021-06-28 16:13 ` Jann Horn 2021-06-28 16:13 ` Jann Horn 2021-06-28 16:30 ` Andy Lutomirski 2021-06-28 17:14 ` Jann Horn 2021-06-28 17:14 ` Jann Horn 2021-06-28 18:18 ` Eric W. Biederman 2021-06-28 18:18 ` Eric W. Biederman 2021-06-29 1:01 ` Andrei Vagin 2021-06-29 1:01 ` Andrei Vagin 2021-07-02 6:22 ` Andrei Vagin 2021-07-02 6:22 ` Andrei Vagin 2021-07-02 11:51 ` Jann Horn 2021-07-02 11:51 ` Jann Horn 2021-07-02 11:51 ` Jann Horn 2021-07-02 20:40 ` Andy Lutomirski 2021-07-02 20:40 ` Andy Lutomirski 2021-07-02 8:51 ` Peter Zijlstra 2021-07-02 8:51 ` Peter Zijlstra 2021-07-02 22:21 ` Andrei Vagin 2021-07-02 22:21 ` Andrei Vagin 2021-07-02 20:56 ` Jann Horn 2021-07-02 20:56 ` Jann Horn 2021-07-02 22:48 ` Andrei Vagin 2021-07-02 22:48 ` Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin [this message] 2021-04-14 5:52 ` [PATCH 3/4] arch/x86: allow to execute syscalls via process_vm_exec Andrei Vagin 2021-04-14 5:52 ` [PATCH 4/4] selftests: add tests for process_vm_exec Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 6:46 ` [PATCH 0/4 POC] Allow executing code and syscalls in another address space Jann Horn 2021-04-14 6:46 ` Jann Horn 2021-04-14 22:10 ` Andrei Vagin 2021-04-14 22:10 ` Andrei Vagin 2021-07-02 6:57 ` Andrei Vagin 2021-07-02 6:57 ` Andrei Vagin 2021-07-02 15:12 ` Jann Horn 2021-07-02 15:12 ` Jann Horn 2021-07-02 15:12 ` Jann Horn 2021-07-18 0:38 ` Andrei Vagin 2021-07-18 0:38 ` Andrei Vagin 2021-04-14 7:22 ` Anton Ivanov 2021-04-14 7:22 ` Anton Ivanov 2021-04-14 7:34 ` Johannes Berg 2021-04-14 7:34 ` Johannes Berg 2021-04-14 9:24 ` Benjamin Berg 2021-04-14 9:24 ` Benjamin Berg 2021-04-14 10:27 ` Florian Weimer 2021-04-14 10:27 ` Florian Weimer 2021-04-14 11:24 ` Jann Horn 2021-04-14 11:24 ` Jann Horn 2021-04-14 12:20 ` Florian Weimer 2021-04-14 12:20 ` Florian Weimer 2021-04-14 13:58 ` Jann Horn 2021-04-14 13:58 ` Jann Horn 2021-04-16 19:29 ` Kirill Smelkov 2021-04-16 19:29 ` Kirill Smelkov 2021-04-17 16:28 ` sbaugh 2021-04-17 16:28 ` sbaugh 2021-07-02 22:44 ` Andy Lutomirski 2021-07-02 22:44 ` Andy Lutomirski 2021-07-18 1:34 ` Andrei Vagin 2021-07-18 1:34 ` Andrei Vagin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210414055217.543246-4-avagin@gmail.com \ --to=avagin@gmail.com \ --cc=0x7f454c46@gmail.com \ --cc=akpm@linux-foundation.org \ --cc=anton.ivanov@cambridgegreys.com \ --cc=avagin@google.com \ --cc=christian.brauner@ubuntu.com \ --cc=criu@openvz.org \ --cc=jdike@addtoit.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-um@lists.infradead.org \ --cc=luto@kernel.org \ --cc=mingo@redhat.com \ --cc=mtk.manpages@gmail.com \ --cc=oleg@redhat.com \ --cc=peterz@infradead.org \ --cc=richard@nod.at \ --cc=rppt@linux.ibm.com \ --cc=tglx@linutronix.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.