mirror of
https://github.com/cloud-hypervisor/cloud-hypervisor.git
synced 2024-08-22 07:51:16 +00:00
vmm, virtio-devices: allow mremap for consoles
SerialBuffer uses VecDeque::extend, which calls realloc, which a maximum buffer size of 1 MiB. Starting at allocation sizes of 128 KiB, musl's mallocng allocator will use mremap for the allocation. Since this was not permitted by the seccomp rules, heavy write load could crash cloud-hypervisor with a seccomp failure. (Encountered using virtio-console, but I don't see any reason it wouldn't happen for the legacy serial device too.) Signed-off-by: Alyssa Ross <hi@alyssa.is>
This commit is contained in:
parent
7feb25daf0
commit
beed5e5d6d
@ -259,6 +259,7 @@ fn virtio_thread_common() -> Vec<(i64, Vec<SeccompRule>)> {
|
|||||||
(libc::SYS_madvise, vec![]),
|
(libc::SYS_madvise, vec![]),
|
||||||
(libc::SYS_mmap, vec![]),
|
(libc::SYS_mmap, vec![]),
|
||||||
(libc::SYS_mprotect, vec![]),
|
(libc::SYS_mprotect, vec![]),
|
||||||
|
(libc::SYS_mremap, vec![]),
|
||||||
(libc::SYS_munmap, vec![]),
|
(libc::SYS_munmap, vec![]),
|
||||||
(libc::SYS_openat, vec![]),
|
(libc::SYS_openat, vec![]),
|
||||||
(libc::SYS_read, vec![]),
|
(libc::SYS_read, vec![]),
|
||||||
|
@ -717,6 +717,7 @@ fn vcpu_thread_rules(
|
|||||||
(libc::SYS_madvise, vec![]),
|
(libc::SYS_madvise, vec![]),
|
||||||
(libc::SYS_mmap, vec![]),
|
(libc::SYS_mmap, vec![]),
|
||||||
(libc::SYS_mprotect, vec![]),
|
(libc::SYS_mprotect, vec![]),
|
||||||
|
(libc::SYS_mremap, vec![]),
|
||||||
(libc::SYS_munmap, vec![]),
|
(libc::SYS_munmap, vec![]),
|
||||||
(libc::SYS_nanosleep, vec![]),
|
(libc::SYS_nanosleep, vec![]),
|
||||||
(libc::SYS_newfstatat, vec![]),
|
(libc::SYS_newfstatat, vec![]),
|
||||||
|
Loading…
Reference in New Issue
Block a user