seccomp-bpf: Allow MADV_FREE in madvise(2)

sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
 
 #include <errno.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/syscall.h>
@@ skipping 156 matching lines @@
     return Error(EPERM);
 
   if (sysno == __NR_getpriority || sysno ==__NR_setpriority)
     return RestrictGetSetpriority(current_pid);
 
   if (sysno == __NR_getrandom) {
     return RestrictGetRandom();
   }
 
   if (sysno == __NR_madvise) {
-    // Only allow MADV_DONTNEED (aka MADV_FREE).
+    // Only allow MADV_DONTNEED and MADV_FREE.
     const Arg<int> advice(2);
-    return If(advice == MADV_DONTNEED, Allow()).Else(Error(EPERM));
+    return If(AnyOf(advice == MADV_DONTNEED
+#if defined(MADV_FREE)
+                    // MADV_FREE was introduced in Linux 4.5 and started being
+                    // defined in glibc 2.24.
+                    , advice == MADV_FREE
+#endif
+                    ), Allow()).Else(Error(EPERM));
   }
 
 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \
     defined(__aarch64__)
   if (sysno == __NR_mmap)
     return RestrictMmapFlags();
 #endif
 
 #if defined(__i386__) || defined(__arm__) || defined(__mips__)
   if (sysno == __NR_mmap2)
@@ skipping 89 matching lines @@
     DCHECK_EQ(sys_getpid(), policy_pid_);
   }
   return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno);
 }
 
 ResultExpr BaselinePolicy::InvalidSyscall() const {
   return CrashSIGSYS();
 }
 
 }  // namespace sandbox.