audit_filter_syscall uses the syscall number to reference into a
bitmask (e->rule.mask[word]). Not removing the x32 bit before passing
the number to this architecture independent codepath will fail to
lookup the proper audit bit. Furthermore it will cause an invalid memory
access in the kernel if the out of bound location is not mapped:
BUG: unable to handle kernel paging request at ffff8800e5446630
IP: [<ffffffff810fcdd0>] audit_filter_syscall+0x90/0xf0
Together with the entrypoint in entry_64.S this change causes x32
programs to pass in both AUDIT_ARCH_X86_64 and AUDIT_ARCH_I386 depending
on the syscall path.
Cc: linux-kernel@vger.kernel.org
Cc: H. J. Lu <hjl.to...@gmail.com>
Cc: Eric Paris <epa...@redhat.com>
Signed-off-by: Philipp Kern <pk...@google.com>
---
arch/x86/kernel/ptrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 678c0ad..166a3c7 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1489,7 +1489,7 @@ long syscall_trace_enter(struct pt_regs *regs)
if (IS_IA32)
audit_syscall_entry(AUDIT_ARCH_I386,
- regs->orig_ax,
+ regs->orig_ax & __SYSCALL_MASK,
regs->bx, regs->cx,
regs->dx, regs->si);
#ifdef CONFIG_X86_64
--
1.9.1.423.g4596e3a
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
