mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2026-10-28 11:54:41 +08:00
Daniel P. Berrangé
e9f2ecafb1
We have seccomp matches for clone() which mandate the presence of
several flags, in order to permit pthreads_create:
REQUIRE_CLONE_FLAG(CLONE_VM);
REQUIRE_CLONE_FLAG(CLONE_FS);
...
Given those mandatory matches, it is impossible for flags == 0 to
pass the filter. This is fortunate, since the explicit match on
flags == 0 is in fact broken, as it has a silent size extension
from 32-bits to 64-bits.
This results in seccomp generating pseudo code of:
if ($arch == 3221225534)
# filter for syscall "clone" (56) [priority: 65531]
if ($syscall == 56)
if ($a0.hi32 & 0xffffffff == 0)
if ($a0.lo32 & 0xffffff00 == 0)
action ERRNO(1);
# default action
action ALLOW;
# invalid architecture action
action KILL;
Since the clone() flag is passed as a 32-bit value in the syscall,
the high 32-bits are liable to be undefined/uninitialized garbage
The desired match for flags == 0 was
if ($arch == 3221225534)
# filter for syscall "clone" (56) [priority: 65532]
if ($syscall == 56)
if ($a0.hi32 & 0x00000000 == 0)
if ($a0.lo32 & 0xffffff00 == 0)
action ERRNO(1);
# default action
action ALLOW;
# invalid architecture action
action KILL;
That is redundant, however, as can be seen if we look at the
(fixed) program with the CLONE_THREAD rule also present:
if ($arch == 3221225534)
# filter for syscall "clone" (56) [priority: 65532]
if ($syscall == 56)
if ($a0.hi32 & 0x00000000 == 0)
if ($a0.lo32 & 0xffffff00 == 0)
action ERRNO(1);
if ($a0.lo32 & 0x00010000 == 0)
action ERRNO(1);
# default action
action ALLOW;
# invalid architecture action
action KILL;
That "($a0.lo32 & 0x00010000 == 0)" match will catch the case
of flags == 0 and do the right thing.
Reported-by: Ricardo Branco (https://gitlab.com/ricardobranco777)
Related: https://gitlab.com/qemu-project/qemu/-/work_items/4671
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>