[PATCH] ARM: ptrace: fix scno of -1 cause SIGILL

[PATCH] ARM: ptrace: fix scno of -1 cause SIGILL

[Lecopzer Chen]

In commit [1], the -1 scno is used as a special scno when the task's
syscall is traced.

After commit [2], PTRACE_SET_SYSCALL will always mask syscall with
__NR_SYSCALL_MASK, this makes the condition `cmp scno, #-1` broken,
and some test like Android VTS[3] is also failed because SIGILL
interrupt the test program.

Let's test with `and` logic with #0x0ff000. Instead of #__NR_SYSCALL_MASK
because of the constraint of ARM Operand2 rules and avoid conflicting
with ARM private syscall.

[1] commit ad75b51459ae ("ARM: 7579/1: arch/allow a scno of -1 to not cause a SIGILL")
[2] commit 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
[3] vts_linux_kselftest_arm_32 seccomp_seccomp_bpf_arm_32#seccomp_seccomp_bpf_arm_32

Fixes: 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
---
 arch/arm/kernel/entry-common.S | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index bcc4c9ec3aa4..8ff3ff476266 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -298,8 +298,15 @@ __sys_trace:
 	bl	syscall_trace_enter
 	mov	scno, r0
 	invoke_syscall tbl, scno, r10, __sys_trace_return, reload=1
-	cmp	scno, #-1			@ skip the syscall?
-	bne	2b
+	/*
+	 * We'd like to skip scno=-1 for avoiding SIGILL for tracer,
+	 * however, tracer or seccomp may have changed syscall and masked
+	 * with __NR_SYSCALL_MASK, make sure -1 is compared with correct
+	 * masked syscall number.
+	 */
+	and r10, scno, #0x0ff000
+	cmp r10, #0x0ff000
+	bne 2b
 	add	sp, sp, #S_OFF			@ restore stack
 
 __sys_trace_return_nosave:
-- 
2.18.0

Re: [PATCH] ARM: ptrace: fix scno of -1 cause SIGILL

[Lecopzer Chen]

> In commit [1], the -1 scno is used as a special scno when the task's
> syscall is traced.

> After commit [2], PTRACE_SET_SYSCALL will always mask syscall with
> __NR_SYSCALL_MASK, this makes the condition `cmp scno, #-1` broken,
> and some test like Android VTS[3] is also failed because SIGILL
> interrupt the test program.

> Let's test with `and` logic with #0x0ff000. Instead of #__NR_SYSCALL_MASK
> because of the constraint of ARM Operand2 rules and avoid conflicting
> with ARM private syscall.

...

Please follow the commit from Kees below and ignore this patch, thanks.

https://lore.kernel.org/all/20230804071045.never.134-kees@kernel.org/