Refactor syscall_trace_enter() by open-coding the seccomp check
to align with the generic entry framework.
[Background]
The generic entry implementation expands the seccomp check in-place
instead of using the secure_computing() wrapper. It directly tests
SYSCALL_WORK_SECCOMP and calls the underlying __secure_computing()
function to handle syscall filtering.
[Changes]
1. Open-code seccomp check:
- Instead of calling the secure_computing() wrapper, explicitly check
the 'flags' parameter for _TIF_SECCOMP.
- Call __secure_computing() directly if the flag is set.
2. Refine return value handling:
- Use 'return ret ? : syscall' to propagate the return value.
- Ensures any unexpected non-zero return from __secure_computing()
is properly propagated is properly propagated.
- This matches the logic in the generic entry code.
[Why this matters]
- Aligns the arm64 syscall path with the generic entry implementation,
simplifying future migration to the generic entry framework.
- No functional changes are intended; seccomp behavior remains identical.
Cc: Will Deacon <[email protected]>
Cc: Catalin Marinas <[email protected]>
Reviewed-by: Kevin Brodsky <[email protected]>
Signed-off-by: Jinjie Ruan <[email protected]>
---
arch/arm64/kernel/ptrace.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 8d296a07fbf7..d68f872339c7 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -2420,8 +2420,11 @@ int syscall_trace_enter(struct pt_regs *regs, unsigned
long flags)
}
/* Do the secure computing after ptrace; failures should be fast. */
- if (secure_computing() == -1)
- return NO_SYSCALL;
+ if (flags & _TIF_SECCOMP) {
+ ret = __secure_computing();
+ if (ret == -1)
+ return NO_SYSCALL;
+ }
/* Either of the above might have changed the syscall number */
syscall = syscall_get_nr(current, regs);
@@ -2439,7 +2442,7 @@ int syscall_trace_enter(struct pt_regs *regs, unsigned
long flags)
audit_syscall_entry(syscall, regs->orig_x0, regs->regs[1],
regs->regs[2], regs->regs[3]);
- return syscall;
+ return ret ? : syscall;
}
void syscall_trace_exit(struct pt_regs *regs, unsigned long flags)
--
2.34.1
