set_robust_list¶

Intro¶

set_robust_list - Sets head for the list of robust futexes for the current thread

Description¶

The set_robust_list syscall sets the head for the list of robust futexes for the current thread. This list is created when a robust futex is allocated. The set_robust_list syscall can be used to create, modify and/or remove the list. It takes two arguments, head and len. The head is a pointer to the list of robust futexes and the len is the size of the list in bytes.

The set_robust_list syscall is used to guard against data races in user-space software. If the robust futex is detected to be in use by another thread, it means that a data race is occurring and the current thread can take steps to avoid the race condition.

Arguments¶

head: struct robust_list_head*[U] - Pointer to the head of the list of robust futexes.
len: size_t[U] - Size of the list in bytes.

Available Tags¶

K - Originated from kernel-space.
U - Originated from user space (for example, pointer to user space memory used to get it)
TOCTOU - Vulnerable to TOCTOU (time of check, time of use)
OPT - Optional argument - might not always be available (passed with null value)

Hooks¶

sys_set_robust_list¶

Type¶

Kprobe

Purpose¶

Hooking on sys_set_robust_list is useful for tracking when the list of robust futexes is modified or created.

Example Use Case¶

One example of set_robust_list being used is in thread synchronization mechanisms. In this case, a thread can call the set_robust_list syscall in order to create or modify a list of robust futexes in order to guard against data races.

Issues¶

The set_robust_list syscall is vulnerable to TOCTOU (time of check, time of use) attacks and in some cases it may be necessary to take extra precautions to secure this system call.

The get_robust_list syscall can be used to get the current list of robust futexes from a thread and is related to the set_robust_list syscall.

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.