Skip to content

Commit 7b35184

Browse files
author
Alexandra Iordache
committed
seccomp: allow madvise(*, *, MADV_DONTNEED)
The musl allocator calls it to punch holes in large chunks of allocated memory: https://elixir.bootlin.com/musl/v1.1.20/source/src/malloc/malloc.c#L501 Signed-off-by: Alexandra Iordache <[email protected]>
1 parent ac2fe79 commit 7b35184

File tree

2 files changed

+21
-0
lines changed

2 files changed

+21
-0
lines changed

CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@
99
- When running with `jailer` the location of the API socket has changed to
1010
`<jail-root-path>/api.socket` (API socket was moved _inside_ the jail).
1111

12+
### Fixed
13+
14+
- A `madvise` call issued by the `musl` allocator was added to the seccomp
15+
whitelist to prevent Firecracker from terminating abruptly when allocating
16+
memory in certain conditions.
17+
1218
### Removed
1319

1420
- Removed the `seccomp.bad_syscalls` metric.

vmm/src/default_syscalls/x86_64.rs

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ pub const ALLOWED_SYSCALLS: &[i64] = &[
2323
libc::SYS_futex,
2424
libc::SYS_ioctl,
2525
libc::SYS_lseek,
26+
libc::SYS_madvise,
2627
libc::SYS_mmap,
2728
libc::SYS_munmap,
2829
libc::SYS_open,
@@ -241,6 +242,20 @@ pub fn default_context() -> Result<SeccompFilterContext, Error> {
241242
libc::SYS_lseek,
242243
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
243244
),
245+
(
246+
libc::SYS_madvise,
247+
(
248+
0,
249+
vec![SeccompRule::new(
250+
vec![SeccompCondition::new(
251+
2,
252+
SeccompCmpOp::Eq,
253+
libc::MADV_DONTNEED as u64,
254+
)?],
255+
SeccompAction::Allow,
256+
)],
257+
),
258+
),
244259
(
245260
libc::SYS_mmap,
246261
(

0 commit comments

Comments
 (0)