On Wed, Aug 19, 2020 at 09:44:39PM +0200, Thomas Gleixner wrote: > On Wed, Aug 19 2020 at 10:14, Kyle Huey wrote: > > tl;dr: after 27d6b4d14f5c3ab21c4aef87dd04055a2d7adf14 ptracer > > modifications to orig_ax in a syscall entry trace stop are not honored > > and this breaks our code. > > My fault and I have no idead why none of the silly test cases > noticed. Fix below. Hmm, which were you trying? Looking just now, I see that the seccomp selftests were failing for all their syscall-changing tests. Regardless, I can confirm both the failure and the fix. Reported-by: Kyle Huey <me@xxxxxxxxxxxx> Tested-by: Kees Cook <keescook@xxxxxxxxxxxx> Acked-by: Kees Cook <keescook@xxxxxxxxxxxx> kernelci.org is *so* close to having the kernel selftests actually running with their builds. :) https://github.com/kernelci/kernelci-core/issues/331 -Kees > > Thanks, > > tglx > --- > diff --git a/kernel/entry/common.c b/kernel/entry/common.c > index 9852e0d62d95..fcae019158ca 100644 > --- a/kernel/entry/common.c > +++ b/kernel/entry/common.c > @@ -65,7 +65,8 @@ static long syscall_trace_enter(struct pt_regs *regs, long syscall, > > syscall_enter_audit(regs, syscall); > > - return ret ? : syscall; > + /* The above might have changed the syscall number */ > + return ret ? : syscall_get_nr(current, regs); > } > > noinstr long syscall_enter_from_user_mode(struct pt_regs *regs, long syscall) -- Kees Cook
