netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

seccomp: Use dedicated input buffer for populating seccomp cache.

Browse Source 
`seccomp` filters can be applied to multiple tasks at once
(`SECCOMP_FILTER_FLAG_TSYNC`), so we cannot always use the scratch buffer
of goroutines being modified in this way. This change uses a dedicated
byte buffer instead.

Reported-by: syzbot+5bca3987b1db489fa2ab@syzkaller.appspotmail.com
Reported-by: syzbot+9cc36be78bb43ded3b96@syzkaller.appspotmail.com
PiperOrigin-RevId: 594308358
This commit is contained in:
Etienne Perot
2023-12-28 13:37:32 -08:00
committed by gVisor bot
parent f3864daf7a
commit de71aae89a
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/kernel/seccomp.go
+4 -2
View File
@@ -230,13 +230,15 @@ func checkFilterCacheability(program bpf.Program, input bpf.Input) (uint32, erro
// populateCache recomputes `ts.cache` from `ts.filters`.
func (ts *taskSeccomp) populateCache(t *Task) {
sd := linux.SeccompData{}
ts.cacheAuditNumber = t.image.st.AuditNumber
sd := linux.SeccompData{}
input := bpf.Input(make([]byte, sd.SizeBytes()))
for sysno := int32(0); sysno <= sentry.MaxSyscallNum; sysno++ {
sd.Nr = sysno
sd.Arch = ts.cacheAuditNumber
input := dataAsBPFInput(t, &sd)
clear(input)
sd.MarshalBytes(input)
sysnoIsCacheable := true
ret := linux.BPFAction(linux.SECCOMP_RET_ALLOW)
// See notes in `evaluateSyscallFilters` for how to properly interpret