[PATCH 0/4] seccomp: fix user-notification state transitions

[Andrea Parri <parri.andrea@gmail.com>]

An atomic SECCOMP_IOCTL_NOTIF_ADDFD request moves a notification from
SENT to REPLIED, so the listener stops reporting EPOLLOUT for it.  Two
paths move it back to SENT without waking poll waiters, so a supervisor
waiting for EPOLLOUT, with edge- or level-triggered epoll, poll() or
select(), can remain asleep, leaving the target blocked in the trapped
syscall.

Patch 1 fixes the failed descriptor install, present since commit
0ae71c7720e3a ("seccomp: Support atomic "addfd + send reply"").  Patch 2
fixes the restore on signal interruption, added by
commit 832b9b176be06 ("seccomp: restore knotif->state when
SECCOMP_ADDFD_FLAG_SEND is interrupted").  Patch 3 moves the state change
and the wakeup into one helper, with no functional change.

SECCOMP_IOCTL_NOTIF_RECV marks a notification SENT before copying it to
userspace.  Unless SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV is also set, a
signal during the copy makes the target return EINTR, even with
SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV, while the supervisor can receive
a withdrawn ID.  With it, the signal is held back as if the notification
had already been received.  Patch 4 adds a RECEIVING state and marks the
notification SENT only after the copy.

Patch 4 affects all filters, not only those using RESTART_BEFORE_RECV:
RECV now fails with ENOENT if the target withdraws the notification during
the copy.  It clears the buffer first, and
Documentation/userspace-api/seccomp_filter.rst already asks supervisors to
retry on ENOENT.

All four patches concern transitions into SENT; patch 4 takes its
post-copy transition through the helper added by patch 3.

Tested in vng on x86_64 with the full seccomp_bpf suite, using the seccomp
selftest config plus CHECKPOINT_RESTORE: 146 passed, 0 failed, 0 skipped.
Reverting the kernel/seccomp.c changes of the whole series makes
user_notification_addfd_rlimit and user_notification_addfd_send_interrupted
time out on their second epoll_wait() and all four during_receive variants
fail; reverting only those of patch 4 makes just the during_receive
variants fail.

The bugs were found and the patches were written with the help of an LLM.

---
Reviewer notes: 832b9b176be06 and f7952251ecc3, fixed by patches 2 and 4,
are in v7.4-rc1.  Patches 3 and 4 only need backporting to 7.4.x:
f7952251ecc3 adds a new flag that is not tagged for stable itself,
unlike 832b9b176be06, and patch 3 is tagged only because patch 4 needs
it.

Patches 1 and 2 do not depend on patches 3 and 4 and can be applied
first.

The series conflicts with Cong Wang's RFC "seccomp: report the result of
continued system calls" [1], which is based on v7.3.  After patch 4, a
task killed while its held notification is being received is in
RECEIVING, so the "killed unseen" check in seccomp_hold_result() would
need to become n.state <= SECCOMP_NOTIFY_RECEIVING for the result to
still be queued.

[1] https://lore.kernel.org/all/20261020001124.974063-1-xiyou.wangcong@gmail.com/

Andrea Parri (4):
  seccomp: wake poll waiters after failed addfd send
  seccomp: wake poll waiters after interrupted addfd send
  seccomp: add a helper to move a notification to SENT
  seccomp: publish user notifications after copying them to userspace

 kernel/seccomp.c                              |  79 +++++----
 tools/testing/selftests/seccomp/config        |   1 +
 tools/testing/selftests/seccomp/seccomp_bpf.c | 162 +++++++++++++++++-
 3 files changed, 204 insertions(+), 38 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.53.0