From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751961AbbIKAXU (ORCPT ); Thu, 10 Sep 2015 20:23:20 -0400 Received: from mail-io0-f171.google.com ([209.85.223.171]:35941 "EHLO mail-io0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751270AbbIKAWK (ORCPT ); Thu, 10 Sep 2015 20:22:10 -0400 From: Tycho Andersen To: Kees Cook , Alexei Starovoitov Cc: "David S. Miller" , Will Drewry , Oleg Nesterov , Andy Lutomirski , Pavel Emelyanov , "Serge E. Hallyn" , Daniel Borkmann , linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-api@vger.kernel.org, Tycho Andersen Subject: [PATCH v2 2/5] seccomp: make underlying bpf ref counted as well Date: Thu, 10 Sep 2015 18:20:59 -0600 Message-Id: <1441930862-14347-3-git-send-email-tycho.andersen@canonical.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1441930862-14347-1-git-send-email-tycho.andersen@canonical.com> References: <1441930862-14347-1-git-send-email-tycho.andersen@canonical.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In the next patch, we're going to add a way to access the underlying filters via bpf fds. This means that we need to ref-count both the struct seccomp_filter objects and the struct bpf_prog objects separately, in case a process dies but a filter is still referred to by another process. Additionally, we mark classic converted seccomp filters as seccomp eBPF programs, since they are a subset of what is supported in seccomp eBPF. Signed-off-by: Tycho Andersen CC: Kees Cook CC: Will Drewry CC: Oleg Nesterov CC: Andy Lutomirski CC: Pavel Emelyanov CC: Serge E. Hallyn CC: Alexei Starovoitov CC: Daniel Borkmann --- kernel/seccomp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 245df6b..afaeddf 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -378,6 +378,8 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog) } atomic_set(&sfilter->usage, 1); + atomic_set(&sfilter->prog->aux->refcnt, 1); + sfilter->prog->type = BPF_PROG_TYPE_SECCOMP; return sfilter; } @@ -470,7 +472,7 @@ void get_seccomp_filter(struct task_struct *tsk) static inline void seccomp_filter_free(struct seccomp_filter *filter) { if (filter) { - bpf_prog_free(filter->prog); + bpf_prog_put(filter->prog); kfree(filter); } } -- 2.1.4