lkml.org 
[lkml]   [2014]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v5 3/6] seccomp: introduce writer locking
    On Thu, May 22, 2014 at 04:05:33PM -0700, Kees Cook wrote:
    > Normally, task_struct.seccomp.filter is only ever read or modified by
    > the task that owns it (current). This property aids in fast access
    > during system call filtering as read access is lockless.
    >
    > Updating the pointer from another task, however, opens up race
    > conditions. To allow cross-task filter pointer updates, writes to the
    > seccomp fields are now protected by a spinlock. Read access remains
    > lockless because pointer updates themselves are atomic. However, writes
    > (or cloning) often entail additional checking (like maximum instruction
    > counts) which require locking to perform safely.
    >
    > In the case of cloning threads, the child is invisible to the system
    > until it enters the task list. To make sure a child can't be cloned
    > from a thread and left in a prior state, seccomp duplication is moved
    > under the tasklist_lock. Then parent and child are certain have the same
    > seccomp state when they exit the lock.
    >

    So I'm a complete noob on the whole seccomp thing, so maybe this is a
    silly question, but.. what about object lifetimes?

    Looking at put_seccomp_filter() it explicitly takes a tsk pointer,
    suggesting one can call it on !current. And while it does a dec_and_test
    on the object itself, run_filter() does nothing with refcounts, and
    therefore can be touching dead memory.


    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2014-05-23 11:21    [W:2.722 / U:1.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site