On 2025/12/9 21:46, Kevin Brodsky wrote:
> On 04/12/2025 09:21, Jinjie Ruan wrote:
>> The generic entry abort the syscall_trace_enter() sequence if
>> ptrace_report_syscall_entry() errors out, but arm64 not.
>>
>> As the ptrace_report_syscall_entry() comment said, the calling arch code
>> should abort the system call and must prevent normal entry so no system
>> call is made if ptrace_report_syscall_entry() return nonzero.
>
> This patch is now in the right position, which means that arm64 does
> abort the syscall already without this patch. What we're changing here
> is that the tracing sequence is interrupted. The comment you're
> referring to says nothing about tracing so I'm not sure it helps to
> refer to it.
I think “must prevent normal entry ”means When ptrace requests
interception, all subsequent processing, including audit and seccomp,
should completely bypassed.
>
> Otherwise:
>
> Reviewed-by: Kevin Brodsky <[email protected]>
>
>> In preparation for moving arm64 over to the generic entry code,
>> return early if ptrace_report_syscall_entry() encounters an error.
>>
>> Signed-off-by: Jinjie Ruan <[email protected]>
>> ---
>> arch/arm64/kernel/ptrace.c | 14 +++++++++-----
>> 1 file changed, 9 insertions(+), 5 deletions(-)
>>
>> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
>> index 4532e9831856..3926ce6aa268 100644
>> --- a/arch/arm64/kernel/ptrace.c
>> +++ b/arch/arm64/kernel/ptrace.c
>> @@ -2346,15 +2346,18 @@ static __always_inline unsigned long
>> ptrace_save_reg(struct pt_regs *regs,
>> return saved_reg;
>> }
>>
>> -static void report_syscall_entry(struct pt_regs *regs)
>> +static int report_syscall_entry(struct pt_regs *regs)
>> {
>> unsigned long saved_reg;
>> - int regno;
>> + int regno, ret;
>>
>> saved_reg = ptrace_save_reg(regs, PTRACE_SYSCALL_ENTER, ®no);
>> - if (ptrace_report_syscall_entry(regs))
>> + ret = ptrace_report_syscall_entry(regs);
>> + if (ret)
>> forget_syscall(regs);
>> regs->regs[regno] = saved_reg;
>> +
>> + return ret;
>> }
>>
>> static void report_syscall_exit(struct pt_regs *regs)
>> @@ -2381,10 +2384,11 @@ static void report_syscall_exit(struct pt_regs *regs)
>> int syscall_trace_enter(struct pt_regs *regs)
>> {
>> unsigned long flags = read_thread_flags();
>> + int ret;
>>
>> if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
>> - report_syscall_entry(regs);
>> - if (flags & _TIF_SYSCALL_EMU)
>> + ret = report_syscall_entry(regs);
>> + if (ret || (flags & _TIF_SYSCALL_EMU))
>> return NO_SYSCALL;
>> }
>>
>
