summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry
AgeCommit message (Collapse)Author
2020-10-23Merge release-20201019.0-37-g39e9b3bb8 (automated)gVisor bot
2020-10-23Support getsockopt for SO_ACCEPTCONN.Nayana Bidari
The SO_ACCEPTCONN option is used only on getsockopt(). When this option is specified, getsockopt() indicates whether socket listening is enabled for the socket. A value of zero indicates that socket listening is disabled; non-zero that it is enabled. PiperOrigin-RevId: 338703206
2020-10-23Merge release-20201019.0-34-g9ca66ec59 (automated)gVisor bot
2020-10-23Rewrite reference leak checker without finalizers.Dean Deng
Our current reference leak checker uses finalizers to verify whether an object has reached zero references before it is garbage collected. There are multiple problems with this mechanism, so a rewrite is in order. With finalizers, there is no way to guarantee that a finalizer will run before the program exits. When an unreachable object with a finalizer is garbage collected, its finalizer will be added to a queue and run asynchronously. The best we can do is run garbage collection upon sandbox exit to make sure that all finalizers are enqueued. Furthermore, if there is a chain of finalized objects, e.g. A points to B points to C, garbage collection needs to run multiple times before all of the finalizers are enqueued. The first GC run will register the finalizer for A but not free it. It takes another GC run to free A, at which point B's finalizer can be registered. As a result, we need to run GC as many times as the length of the longest such chain to have a somewhat reliable leak checker. Finally, a cyclical chain of structs pointing to one another will never be garbage collected if a finalizer is set. This is a well-known issue with Go finalizers (https://github.com/golang/go/issues/7358). Using leak checking on filesystem objects that produce cycles will not work and even result in memory leaks. The new leak checker stores reference counted objects in a global map when leak check is enabled and removes them once they are destroyed. At sandbox exit, any remaining objects in the map are considered as leaked. This provides a deterministic way of detecting leaks without relying on the complexities of finalizers and garbage collection. This approach has several benefits over the former, including: - Always detects leaks of objects that should be destroyed very close to sandbox exit. The old checker very rarely detected these leaks, because it relied on garbage collection to be run in a short window of time. - Panics if we forgot to enable leak check on a ref-counted object (we will try to remove it from the map when it is destroyed, but it will never have been added). - Can store extra logging information in the map values without adding to the size of the ref count struct itself. With the size of just an int64, the ref count object remains compact, meaning frequent operations like IncRef/DecRef are more cache-efficient. - Can aggregate leak results in a single report after the sandbox exits. Instead of having warnings littered in the log, which were non-deterministically triggered by garbage collection, we can print all warning messages at once. Note that this could also be a limitation--the sandbox must exit properly for leaks to be detected. Some basic benchmarking indicates that this change does not significantly affect performance when leak checking is enabled, which is understandable since registering/unregistering is only done once for each filesystem object. Updates #1486. PiperOrigin-RevId: 338685972
2020-10-22Merge release-20201019.0-28-g4e389c785 (automated)gVisor bot
2020-10-21Check for nil in kernel.FSContext functions.Dean Deng
Reported-by: syzbot+c0e175d2b10708314eb3@syzkaller.appspotmail.com PiperOrigin-RevId: 338386575
2020-10-21Merge release-20201019.0-22-g1b2097f84 (automated)gVisor bot
2020-10-21Merge pull request #4535 from lubinszARM:pr_kvm_exec_binary_1gVisor bot
PiperOrigin-RevId: 338321125
2020-10-20Merge release-20201005.0-111-gd45d57f49 (automated)gVisor bot
2020-10-20Merge pull request #4524 from lemin9538:lemin_arm64gVisor bot
PiperOrigin-RevId: 338126491
2020-10-20Merge release-20201005.0-108-g34a6e9576 (automated)gVisor bot
2020-10-19loader/elf: validate file offsetAndrei Vagin
Reported-by: syzbot+7406eef8247cb5a20855@syzkaller.appspotmail.com PiperOrigin-RevId: 337974474
2020-10-20Merge release-20201005.0-107-gdcc1b71f1 (automated)gVisor bot
2020-10-19Fix reference counting on kcov mappings.Dean Deng
Reported-by: syzbot+078580ce5dd6d607fcd8@syzkaller.appspotmail.com Reported-by: syzbot+2096681f6891e7bf8aed@syzkaller.appspotmail.com PiperOrigin-RevId: 337973519
2020-10-20Merge release-20201005.0-104-gcd86bd493 (automated)gVisor bot
2020-10-19Fix runsc tests on VFS2 overlay.Jamie Liu
- Check the sticky bit in overlay.filesystem.UnlinkAt(). Fixes StickyTest.StickyBitPermDenied. - When configuring a VFS2 overlay in runsc, copy the lower layer's root owner/group/mode to the upper layer's root (as in the VFS1 equivalent, boot.addOverlay()). This makes the overlay root owned by UID/GID 65534 with mode 0755 rather than owned by UID/GID 0 with mode 01777. Fixes CreateTest.CreateFailsOnUnpermittedDir, which assumes that the test cannot create files in /. - MknodTest.UnimplementedTypesReturnError assumes that the creation of device special files is not supported. However, while the VFS2 gofer client still doesn't support device special files, VFS2 tmpfs does, and in the overlay test dimension mknod() targets a tmpfs upper layer. The test initially has all capabilities, including CAP_MKNOD, so its creation of these files succeeds. Constrain these tests to VFS1. - Rename overlay.nonDirectoryFD to overlay.regularFileFD and only use it for regular files, using the original FD for pipes and device special files. This is more consistent with Linux (which gets the original inode_operations, and therefore file_operations, for these file types from ovl_fill_inode() => init_special_inode()) and fixes remaining mknod and pipe tests. - Read/write 1KB at a time in PipeTest.Streaming, rather than 4 bytes. This isn't strictly necessary, but it makes the test less obnoxiously slow on ptrace. Fixes #4407 PiperOrigin-RevId: 337971042
2020-10-19Merge release-20201005.0-102-g54e989ec3 (automated)gVisor bot
2020-10-19Merge release-20201005.0-100-g63f4cef4d (automated)gVisor bot
2020-10-19[vfs2] Fix fork reference leaks.Dean Deng
PiperOrigin-RevId: 337919424
2020-10-19Merge release-20201005.0-99-gcd108432a (automated)gVisor bot
2020-10-19splice: return EINVAL is len is negativeAndrei Vagin
Reported-by: syzbot+0268cc591c0f517a1de0@syzkaller.appspotmail.com PiperOrigin-RevId: 337901664
2020-10-19Merge release-20201005.0-98-gc206fcbfc (automated)gVisor bot
2020-10-19pgalloc: Do not hold MemoryFile.mu while calling mincore.Ayush Ranjan
This change makes the following changes: - Unlocks MemoryFile.mu while calling mincore (checkCommitted) because mincore can take a really long time. Accordingly looks up the segment in the tree tree again and handles changes to the segment. - MemoryFile.UpdateUsage() can now only be called at frequency at most 100Hz. 100 Hz = linux.CLOCKS_PER_SEC. Co-authored-by: Jamie Liu <jamieliu@google.com> PiperOrigin-RevId: 337865250
2020-10-18arm64 kvm: handle exception from accessing undefined instructionBin Lu
Consistent with the linux approach, we will produce a sigill to handle el0_undef. After applying this patch, exec_binary_test_runsc_kvm will be passed on Arm64. Signed-off-by: Bin Lu <bin.lu@arm.com>
2020-10-16Merge release-20201005.0-92-gb491712e1 (automated)gVisor bot
2020-10-16Merge pull request #4387 from lubinszARM:pr_tls_host_sentry_1gVisor bot
PiperOrigin-RevId: 337544656
2020-10-16Merge release-20201005.0-87-gc002fc36f (automated)gVisor bot
2020-10-15sockets: ignore io.EOF from view.ReadAtAndrei Vagin
Reported-by: syzbot+5466463b7604c2902875@syzkaller.appspotmail.com PiperOrigin-RevId: 337451896
2020-10-15Change verity isEnable to be a member of dentryChong Cai
PiperOrigin-RevId: 337384146
2020-10-15arm64: the ASID offset of TTBR register is 48Min Le
Signed-off-by: Min Le <lemin.lm@antgroup.com>
2020-10-14Merge release-20200928.0-116-gfc1e65397 (automated)gVisor bot
2020-10-14Fix SCM Rights reference leaks.Dean Deng
Control messages should be released on Read (which ignores the control message) or zero-byte Send. Otherwise, open fds sent through the control messages will be leaked. PiperOrigin-RevId: 337110774
2020-10-14Merge release-20200928.0-115-ga7b7b7b98 (automated)gVisor bot
2020-10-14Fix shm reference leak.Dean Deng
All shm segments in an IPC namespace should be released once that namespace is destroyed. Add reference counting to IPCNamespace so that once the last task with a reference on it exits, we can trigger a destructor that will clean up all shm segments that have not been explicitly freed by the application. PiperOrigin-RevId: 337032977
2020-10-13Merge release-20200928.0-113-g7eeeff426 (automated)gVisor bot
2020-10-13Merge pull request #4482 from lemin9538:lemin_arm64gVisor bot
PiperOrigin-RevId: 336976081
2020-10-13Merge pull request #4386 from lubinszARM:pr_testutil_tls_usrgVisor bot
PiperOrigin-RevId: 336970511
2020-10-13Merge release-20200928.0-107-gb99f15e06 (automated)gVisor bot
2020-10-13Merge pull request #4374 from lubinszARM:pr_ffmpeg_kvm_01gVisor bot
PiperOrigin-RevId: 336962937
2020-10-13Merge release-20200928.0-104-g1a6948737 (automated)gVisor bot
2020-10-13Don't read beyond EOF when inserting into sentry page cache.Jamie Liu
The sentry page cache stores file contents at page granularity; this is necessary for memory mappings. Thus file offset ranges passed to fsutil.FileRangeSet.Fill() must be page-aligned. If the read callback passed to Fill() returns (partial read, nil error) when reading up to EOF (which is the case for p9.ClientFile.ReadAt() since 9P's Rread cannot convey both a partial read and EOF), Fill() will re-invoke the read callback to try to read from EOF to the end of the containing page, which is harmless but needlessly expensive. Fix this by handling file size explicitly in fsutil.FileRangeSet.Fill(). PiperOrigin-RevId: 336934075
2020-10-13Merge release-20200928.0-102-g432963dd2 (automated)gVisor bot
2020-10-13[vfs2] Don't take reference in Task.MountNamespaceVFS2 and MountNamespace.Root.Dean Deng
This fixes reference leaks related to accidentally forgetting to DecRef() after calling one or the other. PiperOrigin-RevId: 336918922
2020-10-13Merge release-20200928.0-101-gd9b32efb3 (automated)gVisor bot
2020-10-13Avoid excessive Tgkill and wait operations.Adin Scannell
The required states may simply not be observed by the thread running bounce, so track guest and user generations to ensure that at least one of the desired state transitions happens. Fixes #3532 PiperOrigin-RevId: 336908216
2020-10-13Merge release-20200928.0-100-g60f159b55 (automated)gVisor bot
2020-10-13[vfs2] Destroy all tmpfs files when the filesystem is released.Dean Deng
In addition to fixing reference leaks, this change also releases memory used by regular tmpfs files once the containing filesystem is released. PiperOrigin-RevId: 336833111
2020-10-13Merge release-20200928.0-99-g577c82f22 (automated)gVisor bot
2020-10-13[vfs2] Add FilesystemType.Release to avoid reference leaks.Dean Deng
Singleton filesystem like devpts and devtmpfs have a single filesystem shared among all mounts, so they acquire a "self-reference" when initialized that must be released when the entire virtual filesystem is released at sandbox exit. PiperOrigin-RevId: 336828852
2020-10-13Merge release-20200928.0-98-gfc7df5322 (automated)gVisor bot
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 05:18:34 +0000