YiFei Zhu
c639e51eef
UPSTREAM: seccomp/cache: Add "emulator" to check if filter is constant allow ...
SECCOMP_CACHE will only operate on syscalls that do not access
any syscall arguments or instruction pointer. To facilitate
this we need a static analyser to know whether a filter will
return allow regardless of syscall arguments for a given
architecture number / syscall number pair. This is implemented
here with a pseudo-emulator, and stored in a per-filter bitmap.
In order to build this bitmap at filter attach time, each filter is
emulated for every syscall (under each possible architecture), and
checked for any accesses of struct seccomp_data that are not the "arch"
nor "nr" (syscall) members. If only "arch" and "nr" are examined, and
the program returns allow, then we can be sure that the filter must
return allow independent from syscall arguments.
Nearly all seccomp filters are built from these cBPF instructions:
BPF_LD | BPF_W | BPF_ABS
BPF_JMP | BPF_JEQ | BPF_K
BPF_JMP | BPF_JGE | BPF_K
BPF_JMP | BPF_JGT | BPF_K
BPF_JMP | BPF_JSET | BPF_K
BPF_JMP | BPF_JA
BPF_RET | BPF_K
BPF_ALU | BPF_AND | BPF_K
Each of these instructions are emulated. Any weirdness or loading
from a syscall argument will cause the emulator to bail.
The emulation is also halted if it reaches a return. In that case,
if it returns an SECCOMP_RET_ALLOW, the syscall is marked as good.
Emulator structure and comments are from Kees [1] and Jann [2].
Emulation is done at attach time. If a filter depends on more
filters, and if the dependee does not guarantee to allow the
syscall, then we skip the emulation of this syscall.
[1] https://lore.kernel.org/lkml/20200923232923.3142503-5-keescook@chromium.org/
[2] https://lore.kernel.org/lkml/CAG48ez1p=dR_2ikKq=xVxkoGg0fYpTBpkhJSv1w-6BG=76PAvw@mail.gmail.com/
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: YiFei Zhu <yifeifz2@illinois.edu>
Reviewed-by: Jann Horn <jannh@google.com>
Co-developed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/71c7be2db5ee08905f41c3be5c1ad6e2601ce88f.1602431034.git.yifeifz2@illinois.edu
(cherry picked from commit 8e01b51a31a1e08e2c3e8fcc0ef6790441be2f61)
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Change-Id: I5047f7f0d6502e5de6c047743f1053fda3025a6e
Bug: 176068146
2026-05-07 10:17:17 -04:00
UPSTREAM: bpf, netns: Fix build without CONFIG_INET
2026-01-14 18:13:18 -08:00
UPSTREAM: cgroup: remove redundant kernfs_activate in cgroup_setup_root()
2026-01-14 18:13:14 -08:00
BACKPORT: maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
2026-01-14 18:13:21 -08:00
Merge tag 'ASB-2024-10-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2024-10-09 18:08:17 +00:00
UPSTREAM: bpf: Fail PERF_EVENT_IOC_SET_BPF when bpf_get_[stack|stackid] cannot work
2026-01-14 18:12:08 -08:00
gcov: add support for GCC 15
2025-12-03 12:45:19 +01:00
Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-10-08 15:23:13 +03:00
UPSTREAM: ftrace: Introduce PERMANENT ftrace_ops flag
2025-12-23 13:35:45 -08:00
Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-06-30 10:49:17 +03:00
Merge tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-10-08 15:17:54 +03:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: rcu-tasks: Add a grace-period start time for throttling and debug
2026-01-14 18:13:22 -08:00
UPSTREAM: sched/core: Add function to sample state of locked-down task
2026-01-14 18:13:18 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
UPSTREAM: bpf: Fix passing zero to PTR_ERR() in bpf_btf_printf_prepare
2026-02-01 20:44:47 -08:00
acct: perform last write from workqueue
2025-03-13 12:43:26 +01:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
audit: Send netlink ACK before setting connection in auditd_set
2024-02-23 08:24:54 +01:00
audit: log AUDIT_TIME_* records only from rules
2022-04-15 14:18:04 +02:00
audit: fix potential double free on error path from fsnotify_add_inode_mark
2022-09-05 10:27:38 +02:00
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
2021-09-03 10:08:16 +02:00
audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
2023-11-28 16:50:18 +00:00
audit: fix possible soft lockup in __audit_inode_child()
2023-09-23 10:59:46 +02:00
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
2023-04-20 12:07:32 +02:00
bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
2024-05-02 16:18:37 +02:00
sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
2023-04-05 11:16:42 +02:00
hrtimers: Handle CPU state correctly on hotplug
2025-02-01 18:18:51 +01:00
Revert "cred: switch to using atomic_long_t"
2024-01-03 17:00:08 +00:00
BACKPORT: seccomp: release filter after task is fully dead
2026-05-07 10:17:17 -04:00
UPSTREAM: bpf: Remove bpf_image tree
2025-12-23 13:36:07 -08:00
kernel/fail_function: fix memory leak with using debugfs_lookup()
2023-03-11 16:44:15 +01:00
BACKPORT: seccomp: release filter after task is fully dead
2026-05-07 10:17:17 -04:00
Merge 5.4.246 into android11-5.4-lts
2023-06-20 19:13:58 +00:00
Merge tag 'ASB-2025-03-05_11-5.4' into android13-5.4-lahaina
2025-04-12 09:31:28 +00:00
BACKPORT: mm: remove the pgprot argument to __vmalloc
2026-01-14 17:48:09 -08:00
kernel/hung_task.c: make type annotations consistent
2026-02-01 20:38:49 -08:00
UPSTREAM: irq_work: Convert flags to atomic_t
2025-12-23 13:35:39 -08:00
kexec: fix a memory leak in crash_shrink_memory()
2023-07-27 08:37:10 +02:00
kexec: initialize ELF lowest address to ULONG_MAX
2025-04-10 14:29:41 +02:00
kexec: support purgatories with .text.hot sections
2023-06-21 15:44:10 +02:00
kheaders: Use array declaration instead of char
2023-05-17 11:35:33 +02:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
2026-01-14 18:13:21 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
UPSTREAM: bpf: Add kernel module with user mode driver that populates bpffs.
2026-01-14 18:12:16 -08:00
BACKPORT: mm: remove the pgprot argument to __vmalloc
2026-01-14 17:48:09 -08:00
padata: Reset next CPU when reorder sequence wraps around
2025-10-29 14:00:01 +01:00
panic: Flush kernel log buffer at the end
2024-04-13 12:51:37 +02:00
module: ensure that kobject_put() is safe for module type kobjects
2025-06-04 14:32:27 +02:00
Merge tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-12-04 19:21:35 +02:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
profiling: fix shift too large makes kernel panic
2022-08-25 11:18:02 +02:00
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
2022-06-14 18:11:24 +02:00
This is the 5.4.262 stable release
2023-11-29 10:18:14 +00:00
relayfs: fix out-of-bounds access in relay_file_read
2023-05-17 11:35:58 +02:00
resource: fix region_intersects() vs add_memory_driver_managed()
2024-11-08 16:20:46 +01:00
UPSTREAM: seccomp/cache: Add "emulator" to check if filter is constant allow
2026-05-07 10:17:17 -04:00
Merge tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2024-12-17 03:24:53 +02:00
Merge tag 'ASB-2024-11-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2024-11-08 15:36:32 +00:00
Revert "tasklet: Introduce new initialization API"
2025-03-13 17:21:46 +00:00
stackleak: let stack_erasing_sysctl take a kernel pointer buffer
2026-02-01 20:38:37 -08:00
Merge 5.4.272 into android11-5.4-lts
2024-04-05 12:37:33 +00:00
BACKPORT: epoll: wire up syscall epoll_pwait2
2025-12-22 07:42:50 +02:00
bpf, sysctl: Let bpf_stats_handler take a kernel pointer buffer
2026-02-01 20:37:19 -08:00
taskstats: properly account NR_KERNEL_MISC_RECLAIMABLE
2021-07-01 06:18:34 -07:00
UPSTREAM: module: Fix up module_notifier return values
2026-01-14 18:12:53 -08:00
taskstats: Cleanup the use of task->exit_code
2022-02-23 11:59:57 +01:00
BACKPORT: umh: Separate the user mode driver and the user mode helper support
2026-01-14 18:12:14 -08:00
UPSTREAM: bpf: Fix umd memory leak in copy_process()
2026-01-14 18:12:50 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
2024-08-19 05:33:39 +02:00
BACKPORT: maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
2026-01-14 18:13:21 -08:00
c639e51eef