Containers Archive mirror
 help / color / mirror / Atom feed
From: Sargun Dhillon <sargun@sargun.me>
To: Kees Cook <keescook@chromium.org>,
	LKML <linux-kernel@vger.kernel.org>,
	Linux Containers <containers@lists.linux.dev>,
	Tycho Andersen <tycho@tycho.pizza>,
	Andy Lutomirski <luto@kernel.org>
Cc: "Sargun Dhillon" <sargun@sargun.me>,
	"Mauricio Vásquez Bernal" <mauricio@kinvolk.io>,
	"Rodrigo Campos" <rodrigo@kinvolk.io>,
	"Giuseppe Scrivano" <gscrivan@redhat.com>,
	"Christian Brauner" <christian.brauner@ubuntu.com>,
	"Mickaël Salaün" <mic@linux.microsoft.com>
Subject: [PATCH 0/4] Atomic addfd send and reply
Date: Sat,  1 May 2021 17:18:47 -0700	[thread overview]
Message-ID: <20210502001851.3346-1-sargun@sargun.me> (raw)

This is somewhat of a respin of "Handle seccomp notification preemption"
but without the controversial parts.

This patchset addresses a race condition we've dealt with recently with
seccomp. Specifically programs interrupting syscalls while they're in
progress. This was exacerbated by Golang's recent adoption of "async
preemption", in which they try to interrupt any syscall that's been
running for more than 10ms during GC. During certain syscalls, it's
non-trivial to write them in a reetrant manner in userspace (socket).

Rodrigo Campos (2):
  seccomp: Support atomic "addfd + send reply"
  selftests/seccomp: Add test for atomic addfd+send

Sargun Dhillon (2):
  Documentation: seccomp: Fix user notification documentation
  seccomp: Refactor notification handler to prepare for new semantics

 .../userspace-api/seccomp_filter.rst          | 28 +++++--
 include/uapi/linux/seccomp.h                  |  1 +
 kernel/seccomp.c                              | 79 ++++++++++++++-----
 tools/testing/selftests/seccomp/seccomp_bpf.c | 38 +++++++++
 4 files changed, 120 insertions(+), 26 deletions(-)

-- 
2.25.1


             reply	other threads:[~2021-05-02  0:19 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-02  0:18 Sargun Dhillon [this message]
2021-05-02  0:18 ` [PATCH 1/4] Documentation: seccomp: Fix user notification documentation Sargun Dhillon
2021-05-02  0:18 ` [PATCH 2/4] seccomp: Refactor notification handler to prepare for new semantics Sargun Dhillon
2021-05-02  0:18 ` [PATCH 3/4] seccomp: Support atomic "addfd + send reply" Sargun Dhillon
2021-05-11 21:50   ` Tycho Andersen
2021-05-17 17:53     ` Sargun Dhillon
2021-05-17 18:10       ` Tycho Andersen
2021-05-02  0:18 ` [PATCH 4/4] selftests/seccomp: Add test for atomic addfd+send Sargun Dhillon

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210502001851.3346-1-sargun@sargun.me \
    --to=sargun@sargun.me \
    --cc=christian.brauner@ubuntu.com \
    --cc=containers@lists.linux.dev \
    --cc=gscrivan@redhat.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mauricio@kinvolk.io \
    --cc=mic@linux.microsoft.com \
    --cc=rodrigo@kinvolk.io \
    --cc=tycho@tycho.pizza \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).