* [PATCH v2] s390: ensure that syscall arguments are properly masked on s390
@ 2016-06-27 14:34 Paul Moore
2016-06-27 14:37 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2016-06-27 14:34 UTC (permalink / raw)
To: linux-s390, linux-audit; +Cc: Heiko Carstens
From: Paul Moore <paul@paul-moore.com>
When executing s390 code on s390x the syscall arguments are not
properly masked, leading to some malformed audit records.
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
arch/s390/kernel/ptrace.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 49b1c13..defc0dc 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -822,6 +822,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
{
long ret = 0;
+ unsigned long mask = -1UL;
/* Do the secure computing check first. */
if (secure_computing()) {
@@ -849,9 +850,12 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
trace_sys_enter(regs, regs->gprs[2]);
- audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
- regs->gprs[3], regs->gprs[4],
- regs->gprs[5]);
+ if (is_compat_task())
+ mask = 0xffffffff;
+
+ audit_syscall_entry(regs->gprs[2], regs->orig_gpr2 & mask,
+ regs->gprs[3] & mask, regs->gprs[4] & mask,
+ regs->gprs[5] & mask);
out:
return ret ?: regs->gprs[2];
}
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] s390: ensure that syscall arguments are properly masked on s390
2016-06-27 14:34 [PATCH v2] s390: ensure that syscall arguments are properly masked on s390 Paul Moore
@ 2016-06-27 14:37 ` Paul Moore
2016-06-28 4:51 ` Heiko Carstens
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2016-06-27 14:37 UTC (permalink / raw)
To: linux-s390, linux-audit; +Cc: Heiko Carstens
On Mon, Jun 27, 2016 at 10:34 AM, Paul Moore <pmoore@redhat.com> wrote:
> From: Paul Moore <paul@paul-moore.com>
>
> When executing s390 code on s390x the syscall arguments are not
> properly masked, leading to some malformed audit records.
>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
> arch/s390/kernel/ptrace.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
The only change between v2 and the original patch is the use of
is_compat_task() instead of the #ifdef, as suggested by Heiko. Like
before, I've added this patch to the audit#next branch; I think we
have sorted all the feedback, but if any objections remain please let
me know.
> diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
> index 49b1c13..defc0dc 100644
> --- a/arch/s390/kernel/ptrace.c
> +++ b/arch/s390/kernel/ptrace.c
> @@ -822,6 +822,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
> asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
> {
> long ret = 0;
> + unsigned long mask = -1UL;
>
> /* Do the secure computing check first. */
> if (secure_computing()) {
> @@ -849,9 +850,12 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
> if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
> trace_sys_enter(regs, regs->gprs[2]);
>
> - audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
> - regs->gprs[3], regs->gprs[4],
> - regs->gprs[5]);
> + if (is_compat_task())
> + mask = 0xffffffff;
> +
> + audit_syscall_entry(regs->gprs[2], regs->orig_gpr2 & mask,
> + regs->gprs[3] & mask, regs->gprs[4] & mask,
> + regs->gprs[5] & mask);
> out:
> return ret ?: regs->gprs[2];
> }
>
--
paul moore
security @ redhat
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] s390: ensure that syscall arguments are properly masked on s390
2016-06-27 14:37 ` Paul Moore
@ 2016-06-28 4:51 ` Heiko Carstens
0 siblings, 0 replies; 3+ messages in thread
From: Heiko Carstens @ 2016-06-28 4:51 UTC (permalink / raw)
To: Paul Moore; +Cc: linux-s390, linux-audit
On Mon, Jun 27, 2016 at 10:37:59AM -0400, Paul Moore wrote:
> On Mon, Jun 27, 2016 at 10:34 AM, Paul Moore <pmoore@redhat.com> wrote:
> > From: Paul Moore <paul@paul-moore.com>
> >
> > When executing s390 code on s390x the syscall arguments are not
> > properly masked, leading to some malformed audit records.
> >
> > Signed-off-by: Paul Moore <paul@paul-moore.com>
> > ---
> > arch/s390/kernel/ptrace.c | 10 +++++++---
> > 1 file changed, 7 insertions(+), 3 deletions(-)
>
> The only change between v2 and the original patch is the use of
> is_compat_task() instead of the #ifdef, as suggested by Heiko. Like
> before, I've added this patch to the audit#next branch; I think we
> have sorted all the feedback, but if any objections remain please let
> me know.
Thanks!
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-06-28 4:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-27 14:34 [PATCH v2] s390: ensure that syscall arguments are properly masked on s390 Paul Moore
2016-06-27 14:37 ` Paul Moore
2016-06-28 4:51 ` Heiko Carstens
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.