Re: [PATCH v2] seccomp: avoid the lock trip seccomp_filter_release in common case

[Kees Cook]

On Thu, 13 Feb 2025 18:09:10 +0100, Mateusz Guzik wrote:
> Vast majority of threads don't have any seccomp filters, all while the
> lock taken here is shared between all threads in given process and
> frequently used.
> 
> Safety of the check relies on the following:
> - seccomp_filter_release is only legally called for PF_EXITING threads
> - SIGNAL_GROUP_EXIT is only ever set with the sighand lock held
> - PF_EXITING is only ever set with the sighand lock held *or* after
>   SIGNAL_GROUP_EXIT is set *or* the process is single-threaded
> - seccomp_sync_threads holds the sighand lock and skips all threads if
>   SIGNAL_GROUP_EXIT is set, PF_EXITING threads if not
> 
> [...]

Applied to for-next/seccomp, thanks!

[1/1] seccomp: avoid the lock trip seccomp_filter_release in common case
      https://git.kernel.org/kees/c/8f19331384e6

Take care,

-- 
Kees Cook