From de71aae89aedec8e005c5999ab046d4d67677e91 Mon Sep 17 00:00:00 2001 From: Etienne Perot Date: Thu, 28 Dec 2023 13:34:53 -0800 Subject: [PATCH] `seccomp`: Use dedicated input buffer for populating seccomp cache. `seccomp` filters can be applied to multiple tasks at once (`SECCOMP_FILTER_FLAG_TSYNC`), so we cannot always use the scratch buffer of goroutines being modified in this way. This change uses a dedicated byte buffer instead. Reported-by: syzbot+5bca3987b1db489fa2ab@syzkaller.appspotmail.com Reported-by: syzbot+9cc36be78bb43ded3b96@syzkaller.appspotmail.com PiperOrigin-RevId: 594308358 --- pkg/sentry/kernel/seccomp.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/sentry/kernel/seccomp.go b/pkg/sentry/kernel/seccomp.go index b698e543f..ea5f48a9a 100644 --- a/pkg/sentry/kernel/seccomp.go +++ b/pkg/sentry/kernel/seccomp.go @@ -230,13 +230,15 @@ func checkFilterCacheability(program bpf.Program, input bpf.Input) (uint32, erro // populateCache recomputes `ts.cache` from `ts.filters`. func (ts *taskSeccomp) populateCache(t *Task) { - sd := linux.SeccompData{} ts.cacheAuditNumber = t.image.st.AuditNumber + sd := linux.SeccompData{} + input := bpf.Input(make([]byte, sd.SizeBytes())) for sysno := int32(0); sysno <= sentry.MaxSyscallNum; sysno++ { sd.Nr = sysno sd.Arch = ts.cacheAuditNumber - input := dataAsBPFInput(t, &sd) + clear(input) + sd.MarshalBytes(input) sysnoIsCacheable := true ret := linux.BPFAction(linux.SECCOMP_RET_ALLOW) // See notes in `evaluateSyscallFilters` for how to properly interpret