On 10/23/2014 12:38 PM, Eric Paris wrote:
>>
>> After the call __audit_syscall_entry aren't they already polluted?
>> Isn't that the reason we need to reload EAX?
>
> Well, I guess EAX is special...
>
Because system calls are "asmlinkage", all the parameters are on the
stack, but %eax is used as the index into the system call table. This
should thus be fine until we get rid of regparm(0) entirely, if that
ever happens.
-hpa
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
