From: Andrei Vagin <avagin@gmail.com> To: Peter Zijlstra <peterz@infradead.org> Cc: linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, linux-um@lists.infradead.org, criu@openvz.org, avagin@google.com, Andrew Morton <akpm@linux-foundation.org>, Andy Lutomirski <luto@kernel.org>, Anton Ivanov <anton.ivanov@cambridgegreys.com>, Christian Brauner <christian.brauner@ubuntu.com>, Dmitry Safonov <0x7f454c46@gmail.com>, Ingo Molnar <mingo@redhat.com>, Jeff Dike <jdike@addtoit.com>, Mike Rapoport <rppt@linux.ibm.com>, Michael Kerrisk <mtk.manpages@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Richard Weinberger <richard@nod.at>, Thomas Gleixner <tglx@linutronix.de> Subject: Re: [PATCH 2/4] arch/x86: implement the process_vm_exec syscall Date: Fri, 2 Jul 2021 15:21:22 -0700 [thread overview] Message-ID: <YN+RYi5honrgjFAw@gmail.com> (raw) In-Reply-To: <YN7TgV9RDJTRaY8R@hirez.programming.kicks-ass.net> On Fri, Jul 02, 2021 at 10:51:13AM +0200, Peter Zijlstra wrote: > > I'm terrified of all of this... > > On Tue, Apr 13, 2021 at 10:52:15PM -0700, Andrei Vagin wrote: > > > +long swap_vm_exec_context(struct sigcontext __user *uctx) > > +{ > > + struct sigcontext ctx = {}; > > + sigset_t set = {}; > > + > > + > > + if (copy_from_user(&ctx, uctx, CONTEXT_COPY_SIZE)) > > + return -EFAULT; > > + /* A floating point state is managed from user-space. */ > > + if (ctx.fpstate != 0) > > + return -EINVAL; Here, we check that ctx doesn't have an FPU state. > > + if (!user_access_begin(uctx, sizeof(*uctx))) > > + return -EFAULT; > > + unsafe_put_sigcontext(uctx, NULL, current_pt_regs(), (&set), Efault); > > + user_access_end(); > > But here you save the sigcontext without FPU state. > > > + > > + if (__restore_sigcontext(current_pt_regs(), &ctx, 0)) > > + goto badframe; > > And here you restore sigcontext, *with* FPU state. At which point your > FPU state is irrecoverably lost. process_vm_exec doesn't change a process FPU state. Unlike signals, here we can control it from a user-space. A process can set an FPU state before process_vm_exec and then retore its FPU state after the call. This version of patches has a bug that I fixed in my tree when I implemented the user-space part for gVisor. I didn't take into account that restore_sigcontext(ctx) clears a process fpu state if ctx->fpstate is zero. I moved fpu__restore_sig out from __restore_sigcontext to fix this issue: https://github.com/avagin/linux-task-diag/commit/55b7194d00ff > > Also, I'm not at all convinced this can ever do the right thing when the > tasks don't agree on what the FPU state is. I suppose in the best case > the save will EFAULT. > > > + > > + return 0; > > +Efault: > > + user_access_end(); > > +badframe: > > + signal_fault(current_pt_regs(), uctx, "swap_vm_exec_context"); > > + return -EFAULT; > > +}
WARNING: multiple messages have this Message-ID (diff)
From: Andrei Vagin <avagin@gmail.com> To: Peter Zijlstra <peterz@infradead.org> Cc: linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, linux-um@lists.infradead.org, criu@openvz.org, avagin@google.com, Andrew Morton <akpm@linux-foundation.org>, Andy Lutomirski <luto@kernel.org>, Anton Ivanov <anton.ivanov@cambridgegreys.com>, Christian Brauner <christian.brauner@ubuntu.com>, Dmitry Safonov <0x7f454c46@gmail.com>, Ingo Molnar <mingo@redhat.com>, Jeff Dike <jdike@addtoit.com>, Mike Rapoport <rppt@linux.ibm.com>, Michael Kerrisk <mtk.manpages@gmail.com>, Oleg Nesterov <oleg@redhat.com>, Richard Weinberger <richard@nod.at>, Thomas Gleixner <tglx@linutronix.de> Subject: Re: [PATCH 2/4] arch/x86: implement the process_vm_exec syscall Date: Fri, 2 Jul 2021 15:21:22 -0700 [thread overview] Message-ID: <YN+RYi5honrgjFAw@gmail.com> (raw) In-Reply-To: <YN7TgV9RDJTRaY8R@hirez.programming.kicks-ass.net> On Fri, Jul 02, 2021 at 10:51:13AM +0200, Peter Zijlstra wrote: > > I'm terrified of all of this... > > On Tue, Apr 13, 2021 at 10:52:15PM -0700, Andrei Vagin wrote: > > > +long swap_vm_exec_context(struct sigcontext __user *uctx) > > +{ > > + struct sigcontext ctx = {}; > > + sigset_t set = {}; > > + > > + > > + if (copy_from_user(&ctx, uctx, CONTEXT_COPY_SIZE)) > > + return -EFAULT; > > + /* A floating point state is managed from user-space. */ > > + if (ctx.fpstate != 0) > > + return -EINVAL; Here, we check that ctx doesn't have an FPU state. > > + if (!user_access_begin(uctx, sizeof(*uctx))) > > + return -EFAULT; > > + unsafe_put_sigcontext(uctx, NULL, current_pt_regs(), (&set), Efault); > > + user_access_end(); > > But here you save the sigcontext without FPU state. > > > + > > + if (__restore_sigcontext(current_pt_regs(), &ctx, 0)) > > + goto badframe; > > And here you restore sigcontext, *with* FPU state. At which point your > FPU state is irrecoverably lost. process_vm_exec doesn't change a process FPU state. Unlike signals, here we can control it from a user-space. A process can set an FPU state before process_vm_exec and then retore its FPU state after the call. This version of patches has a bug that I fixed in my tree when I implemented the user-space part for gVisor. I didn't take into account that restore_sigcontext(ctx) clears a process fpu state if ctx->fpstate is zero. I moved fpu__restore_sig out from __restore_sigcontext to fix this issue: https://github.com/avagin/linux-task-diag/commit/55b7194d00ff > > Also, I'm not at all convinced this can ever do the right thing when the > tasks don't agree on what the FPU state is. I suppose in the best case > the save will EFAULT. > > > + > > + return 0; > > +Efault: > > + user_access_end(); > > +badframe: > > + signal_fault(current_pt_regs(), uctx, "swap_vm_exec_context"); > > + return -EFAULT; > > +} _______________________________________________ linux-um mailing list linux-um@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-um
next prev parent reply other threads:[~2021-07-02 22:24 UTC|newest] Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-04-14 5:52 [PATCH 0/4 POC] Allow executing code and syscalls in another address space Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 1/4] signal: add a helper to restore a process state from sigcontex Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 2/4] arch/x86: implement the process_vm_exec syscall Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 17:09 ` Oleg Nesterov 2021-04-14 17:09 ` Oleg Nesterov 2021-04-23 6:59 ` Andrei Vagin 2021-04-23 6:59 ` Andrei Vagin 2021-06-28 16:13 ` Jann Horn 2021-06-28 16:13 ` Jann Horn 2021-06-28 16:30 ` Andy Lutomirski 2021-06-28 17:14 ` Jann Horn 2021-06-28 17:14 ` Jann Horn 2021-06-28 18:18 ` Eric W. Biederman 2021-06-28 18:18 ` Eric W. Biederman 2021-06-29 1:01 ` Andrei Vagin 2021-06-29 1:01 ` Andrei Vagin 2021-07-02 6:22 ` Andrei Vagin 2021-07-02 6:22 ` Andrei Vagin 2021-07-02 11:51 ` Jann Horn 2021-07-02 11:51 ` Jann Horn 2021-07-02 11:51 ` Jann Horn 2021-07-02 20:40 ` Andy Lutomirski 2021-07-02 20:40 ` Andy Lutomirski 2021-07-02 8:51 ` Peter Zijlstra 2021-07-02 8:51 ` Peter Zijlstra 2021-07-02 22:21 ` Andrei Vagin [this message] 2021-07-02 22:21 ` Andrei Vagin 2021-07-02 20:56 ` Jann Horn 2021-07-02 20:56 ` Jann Horn 2021-07-02 22:48 ` Andrei Vagin 2021-07-02 22:48 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 3/4] arch/x86: allow to execute syscalls via process_vm_exec Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 5:52 ` [PATCH 4/4] selftests: add tests for process_vm_exec Andrei Vagin 2021-04-14 5:52 ` Andrei Vagin 2021-04-14 6:46 ` [PATCH 0/4 POC] Allow executing code and syscalls in another address space Jann Horn 2021-04-14 6:46 ` Jann Horn 2021-04-14 22:10 ` Andrei Vagin 2021-04-14 22:10 ` Andrei Vagin 2021-07-02 6:57 ` Andrei Vagin 2021-07-02 6:57 ` Andrei Vagin 2021-07-02 15:12 ` Jann Horn 2021-07-02 15:12 ` Jann Horn 2021-07-02 15:12 ` Jann Horn 2021-07-18 0:38 ` Andrei Vagin 2021-07-18 0:38 ` Andrei Vagin 2021-04-14 7:22 ` Anton Ivanov 2021-04-14 7:22 ` Anton Ivanov 2021-04-14 7:34 ` Johannes Berg 2021-04-14 7:34 ` Johannes Berg 2021-04-14 9:24 ` Benjamin Berg 2021-04-14 9:24 ` Benjamin Berg 2021-04-14 10:27 ` Florian Weimer 2021-04-14 10:27 ` Florian Weimer 2021-04-14 11:24 ` Jann Horn 2021-04-14 11:24 ` Jann Horn 2021-04-14 12:20 ` Florian Weimer 2021-04-14 12:20 ` Florian Weimer 2021-04-14 13:58 ` Jann Horn 2021-04-14 13:58 ` Jann Horn 2021-04-16 19:29 ` Kirill Smelkov 2021-04-16 19:29 ` Kirill Smelkov 2021-04-17 16:28 ` sbaugh 2021-04-17 16:28 ` sbaugh 2021-07-02 22:44 ` Andy Lutomirski 2021-07-02 22:44 ` Andy Lutomirski 2021-07-18 1:34 ` Andrei Vagin 2021-07-18 1:34 ` Andrei Vagin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=YN+RYi5honrgjFAw@gmail.com \ --to=avagin@gmail.com \ --cc=0x7f454c46@gmail.com \ --cc=akpm@linux-foundation.org \ --cc=anton.ivanov@cambridgegreys.com \ --cc=avagin@google.com \ --cc=christian.brauner@ubuntu.com \ --cc=criu@openvz.org \ --cc=jdike@addtoit.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-um@lists.infradead.org \ --cc=luto@kernel.org \ --cc=mingo@redhat.com \ --cc=mtk.manpages@gmail.com \ --cc=oleg@redhat.com \ --cc=peterz@infradead.org \ --cc=richard@nod.at \ --cc=rppt@linux.ibm.com \ --cc=tglx@linutronix.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.