[PATCH 00/13] audit: log all six syscall arguments in the SYSCALL record

[PATCH 00/13] audit: log all six syscall arguments in the SYSCALL record

[Ricardo Robaina]

The SYSCALL record currently logs only four of the six syscall
arguments (a0-a3), silently discarding the remaining two. This
leads to the need for auxiliary records when audit-relevant
data lands in the 5th or 6th argument of a syscall.

This series extends the SYSCALL record to log all six arguments,
by adding arguments a4 and a5 inline within the existing record.

The audit testsuite runs successfully:

 # make test
 make -C tests test
 chmod +x */test
 Running as   user    root
        with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        on   system  Fedora

 amcast_joinpart/test ................. ok   
 backlog_wait_time_actual_reset/test .. ok   
 bpf/test ............................. ok   
 coredump/test ........................ ok   
 exec_execve/test ..................... ok   
 exec_name/test ....................... ok     
 fanotify/test ........................ ok   
 field_compare/test ................... ok     
 file_create/test ..................... ok   
 file_delete/test ..................... ok   
 file_permission/test ................. ok   
 file_rename/test ..................... ok   
 filter_device/test ................... ok     
 filter_exclude/test .................. ok     
 filter_exit/test ..................... ok   
 filter_inode/test .................... ok   
 filter_saddr_fam/test ................ ok   
 filter_sessionid/test ................ ok   
 io_uring/test ........................ ok   
 login_tty/test ....................... ok   
 lost_reset/test ...................... ok   
 netfilter_pkt/test ................... ok     
 signal/test .......................... ok   
 syscalls_file/test ................... ok   
 syscall_module/test .................. ok   
 syscall_socketcall/test .............. ok   
 time_change/test ..................... ok     
 user_msg/test ........................ ok   
 All tests successful.
 Result: PASS

Ricardo Robaina (13):
  audit: log all six syscall arguments in the SYSCALL record
  alpha: pass all six syscall args to audit_syscall_entry()
  arm: pass all six syscall args to audit_syscall_entry()
  arm64: pass all six syscall args to audit_syscall_entry()
  csky: pass all six syscall args to audit_syscall_entry()
  microblaze: pass all six syscall args to audit_syscall_entry()
  mips: pass all six syscall args to audit_syscall_entry()
  openrisc: pass all six syscall args to audit_syscall_entry()
  parisc: pass all six syscall args to audit_syscall_entry()
  sh: pass all six syscall args to audit_syscall_entry()
  sparc64: pass all six syscall args to audit_syscall_entry()
  um: pass all six syscall args to audit_syscall_entry()
  xtensa: pass all six syscall args to audit_syscall_entry()

 arch/alpha/kernel/ptrace.c      |  3 ++-
 arch/arm/kernel/ptrace.c        |  2 +-
 arch/arm64/kernel/ptrace.c      |  3 ++-
 arch/csky/kernel/ptrace.c       |  3 ++-
 arch/microblaze/kernel/ptrace.c |  3 ++-
 arch/mips/kernel/ptrace.c       | 11 ++++++++---
 arch/openrisc/kernel/ptrace.c   |  3 ++-
 arch/parisc/kernel/ptrace.c     |  7 +++++--
 arch/sh/kernel/ptrace_32.c      |  3 ++-
 arch/sparc/kernel/ptrace_64.c   |  3 ++-
 arch/um/kernel/ptrace.c         |  4 +++-
 arch/xtensa/kernel/ptrace.c     |  3 ++-
 include/linux/audit.h           | 11 +++++++----
 include/linux/entry-common.h    |  3 ++-
 include/uapi/linux/audit.h      |  2 ++
 kernel/audit.h                  |  2 +-
 kernel/auditfilter.c            |  2 ++
 kernel/auditsc.c                | 31 ++++++++++++++++++++-----------
 18 files changed, 67 insertions(+), 32 deletions(-)

-- 
2.55.0

[PATCH 01/13] audit: log all six syscall arguments in the SYSCALL record

[Ricardo Robaina]

The SYSCALL record currently logs only four of the six syscall
arguments (a0-a3). The remaining two are captured but silently
discarded before reaching the audit context. This leads to the
need for auxiliary records when audit-relevant data lands in
the 5th or 6th argument of a syscall.

Extend the SYSCALL record to log all six arguments, by adding
arguments a4 and a5 (5th and 6th syscall argument respectively)
inline within the existing record. Additionally, add the two
new args to audit rules switch case, so audit rules can filter
on them. Lastly, as a minor cleanup, rename params from (a1-a4)
to (a0-a5) in __audit_syscall_entry(), for consistency.

 type=SYSCALL ... syscall=openat ... a3=0x0 a4=0 a5=0 ...
 type=SYSCALL ... syscall=sendto ... a3=0x0 a4=7fff68843bcc a5=c ...

Link: https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dX4Ah11RVhdyCBUQ@mail.gmail.com/T/#t
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 include/linux/audit.h        | 11 +++++++----
 include/linux/entry-common.h |  3 ++-
 include/uapi/linux/audit.h   |  2 ++
 kernel/audit.h               |  2 +-
 kernel/auditfilter.c         |  2 ++
 kernel/auditsc.c             | 31 ++++++++++++++++++++-----------
 6 files changed, 34 insertions(+), 17 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 45abb3722d30..7306d7861159 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -324,7 +324,8 @@ extern void __audit_free(struct task_struct *task);
 extern void __audit_uring_entry(u8 op);
 extern void __audit_uring_exit(int success, long code);
 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
-				  unsigned long a2, unsigned long a3);
+				  unsigned long a2, unsigned long a3,
+				  unsigned long a4, unsigned long a5);
 extern void __audit_syscall_exit(int ret_success, long ret_value);
 extern void __audit_getname(struct filename *name);
 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
@@ -375,10 +376,11 @@ static inline void audit_uring_exit(int success, long code)
 }
 static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
+				       unsigned long a3, unsigned long a4,
+				       unsigned long a5)
 {
 	if (unlikely(audit_context()))
-		__audit_syscall_entry(major, a0, a1, a2, a3);
+		__audit_syscall_entry(major, a0, a1, a2, a3, a4, a5);
 }
 static inline void audit_syscall_exit(void *pt_regs)
 {
@@ -613,7 +615,8 @@ static inline void audit_uring_exit(int success, long code)
 { }
 static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
+				       unsigned long a3, unsigned long a4,
+				       unsigned long a5)
 { }
 static inline void audit_syscall_exit(void *pt_regs)
 { }
diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h
index 416a3352261f..cf2d9989e3fe 100644
--- a/include/linux/entry-common.h
+++ b/include/linux/entry-common.h
@@ -65,7 +65,8 @@ static inline void syscall_enter_audit(struct pt_regs *regs, long syscall)
 		unsigned long args[6];
 
 		syscall_get_arguments(current, regs, args);
-		audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
+		audit_syscall_entry(syscall, args[0], args[1], args[2], args[3],
+				    args[4], args[5]);
 	}
 }
 
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index e8f5ce677df7..6726059d6df1 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -303,6 +303,8 @@
 #define AUDIT_ARG1      (AUDIT_ARG0+1)
 #define AUDIT_ARG2      (AUDIT_ARG0+2)
 #define AUDIT_ARG3      (AUDIT_ARG0+3)
+#define AUDIT_ARG4      (AUDIT_ARG0+4)
+#define AUDIT_ARG5      (AUDIT_ARG0+5)
 
 #define AUDIT_FILTERKEY	210
 
diff --git a/kernel/audit.h b/kernel/audit.h
index 92d5e723d570..83011b14af18 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -117,7 +117,7 @@ struct audit_context {
 	struct audit_stamp  stamp;	/* event identifier */
 	int		    major;      /* syscall number */
 	int		    uring_op;   /* uring operation */
-	unsigned long	    argv[4];    /* syscall arguments */
+	unsigned long	    argv[6];    /* syscall arguments */
 	long		    return_code;/* syscall return code */
 	u64		    prio;
 	int		    return_valid; /* return code is valid */
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 7f791afe5791..4bf539d6937d 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -358,6 +358,8 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
 	case AUDIT_ARG1:
 	case AUDIT_ARG2:
 	case AUDIT_ARG3:
+	case AUDIT_ARG4:
+	case AUDIT_ARG5:
 	case AUDIT_PERS: /* <uapi/linux/personality.h> */
 	case AUDIT_DEVMINOR:
 		/* all ops are valid */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 6610e667c728..7a9d65a6b1cc 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -728,6 +728,8 @@ static int audit_filter_rules(struct task_struct *tsk,
 		case AUDIT_ARG1:
 		case AUDIT_ARG2:
 		case AUDIT_ARG3:
+		case AUDIT_ARG4:
+		case AUDIT_ARG5:
 			if (ctx)
 				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
 			break;
@@ -1674,11 +1676,13 @@ static void audit_log_exit(void)
 						    AUDITSC_SUCCESS),
 					 context->return_code);
 		audit_log_format(ab,
-				 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
+				 " a0=%lx a1=%lx a2=%lx a3=%lx a4=%lx a5=%lx items=%d",
 				 context->argv[0],
 				 context->argv[1],
 				 context->argv[2],
 				 context->argv[3],
+				 context->argv[4],
+				 context->argv[5],
 				 context->name_count);
 		audit_log_task_info(ab);
 		audit_log_key(ab, context->filterkey);
@@ -1970,10 +1974,12 @@ void __audit_uring_exit(int success, long code)
 /**
  * __audit_syscall_entry - fill in an audit record at syscall entry
  * @major: major syscall type (function)
- * @a1: additional syscall register 1
- * @a2: additional syscall register 2
- * @a3: additional syscall register 3
- * @a4: additional syscall register 4
+ * @a0: additional syscall register 1
+ * @a1: additional syscall register 2
+ * @a2: additional syscall register 3
+ * @a3: additional syscall register 4
+ * @a4: additional syscall register 5
+ * @a5: additional syscall register 6
  *
  * Fill in audit context at syscall entry.  This only happens if the
  * audit context was created when the task was created and the state or
@@ -1983,8 +1989,9 @@ void __audit_uring_exit(int success, long code)
  * will only be written if another part of the kernel requests that it
  * be written).
  */
-void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
-			   unsigned long a3, unsigned long a4)
+void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
+			   unsigned long a2, unsigned long a3,
+			   unsigned long a4, unsigned long a5)
 {
 	struct audit_context *context = audit_context();
 	enum audit_state     state;
@@ -2012,10 +2019,12 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
 
 	context->arch	    = syscall_get_arch(current);
 	context->major      = major;
-	context->argv[0]    = a1;
-	context->argv[1]    = a2;
-	context->argv[2]    = a3;
-	context->argv[3]    = a4;
+	context->argv[0]    = a0;
+	context->argv[1]    = a1;
+	context->argv[2]    = a2;
+	context->argv[3]    = a3;
+	context->argv[4]    = a4;
+	context->argv[5]    = a5;
 	context->context = AUDIT_CTX_SYSCALL;
 	context->current_state  = state;
 	ktime_get_coarse_real_ts64(&context->stamp.ctime);
-- 
2.55.0

Re: [PATCH 01/13] audit: log all six syscall arguments in the SYSCALL record

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch changes the signature of `audit_syscall_entry()` and `__audit_syscall_entry()` to require 7 arguments instead of 5, but fails to update direct callers in architectures not using the generic entry code (e.g., ARM, ARM64, MIPS, PowerPC). This mismatch results in widespread "too few arguments to function" compilation errors.
--

--- Patch [1]: [PATCH 01/13] audit: log all six syscall arguments in the SYSCALL record ---
commit 078f116f3b4c24869c2f9f6df42833c2c348b962
Author: Ricardo Robaina <rrobaina@redhat.com>

audit: log all six syscall arguments in the SYSCALL record

This patch extends the SYSCALL audit record to log all six syscall arguments,
adding arguments a4 and a5 inline within the existing record. It updates the
audit_syscall_entry() function signature to accommodate these new parameters.

Link: https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dX4Ah11RVhdyCBUQ@mail.gmail.com/T/#t

> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 803b0183d98dd..5c3486dd691f6 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
[ ... ]
> @@ -375,10 +376,11 @@ static inline void audit_uring_exit(int success, long code)
>  }
>  static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
> -				       unsigned long a3)
> +				       unsigned long a3, unsigned long a4,
> +				       unsigned long a5)

[Severity: Low]
Will this break the build for architectures that do not use the generic entry
code?

For example, looking at arch/arm/kernel/ptrace.c:syscall_trace_enter(), it
still calls this function with only five arguments:

	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
			    regs->ARM_r3);

Similarly, arch/arm64/kernel/ptrace.c:syscall_trace_enter() and
arch/powerpc/kernel/ptrace/ptrace.c:do_syscall_trace_enter() also appear
to call audit_syscall_entry() without the newly required arguments.

Should these architecture-specific callers be updated as well to prevent
"too few arguments to function" compilation errors?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=1

[PATCH 02/13] alpha: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (r20, r21) now that the audit core logs all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/alpha/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index 0687760ea466..d90e2194b528 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -396,7 +396,8 @@ asmlinkage unsigned long syscall_trace_enter(void)
 
 #ifdef CONFIG_AUDITSYSCALL
 	audit_syscall_entry(syscall_get_nr(current, regs),
-		regs->r16, regs->r17, regs->r18, regs->r19);
+		regs->r16, regs->r17, regs->r18, regs->r19,
+		regs->r20, regs->r21);
 #endif
 	return syscall_get_nr(current, regs);
 }
-- 
2.55.0

Re: [PATCH 02/13] alpha: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] When a syscall is skipped by seccomp or ptrace, the kernel fails to set the return value to -ENOSYS, allowing unprivileged userspace to spoof successful syscall returns.
--

--- Patch [2]: [PATCH 02/13] alpha: pass all six syscall args to audit_syscall_entry() ---
commit 34becaec07c6a7a08cc6bd923c1a39f3ee655963
Author: Ricardo Robaina <rrobaina@redhat.com>
Subject: alpha: pass all six syscall args to audit_syscall_entry()

Update the audit_syscall_entry() call to forward the 5th and 6th syscall
arguments. This ensures the audit core logs all six arguments on alpha.

> diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
> index 0687760ea4669..d90e2194b5284 100644
> --- a/arch/alpha/kernel/ptrace.c
> +++ b/arch/alpha/kernel/ptrace.c
> @@ -396,7 +396,8 @@ asmlinkage unsigned long syscall_trace_enter(void)

[Severity: High]
This is a pre-existing issue, but does the -ENOSYS fixup in
syscall_trace_enter() get skipped incorrectly when a syscall is filtered by
seccomp or ptrace?

Earlier in this function, the fixup condition is:

    if (secure_computing() == -1) {
        if (regs->r19 == 0 && regs->r0 == (unsigned long)-1)
            syscall_set_return_value(current, regs, -ENOSYS, 0);
        syscall_set_nr(current, regs, -1);
        return -1UL;
    }

If secure_computing() returns -1 to skip the syscall execution,
syscall_set_nr() sets r1 to -1. However, it seems r0 still contains the
original syscall number instead of -1. Doesn't this cause the fallback
condition to evaluate to false and skip setting -ENOSYS?

If so, a seccomp filter that skips a syscall without explicitly setting a
return value (such as SECCOMP_RET_USER_NOTIF) might leak the syscall number
back to user space as a successful return value instead of returning an error.

It looks like this same logic is mirrored in arch/alpha/kernel/entry.S in
SYSCALL_SKIP_RETURN_RESTART_GATE:

    ldq     $20, 0($sp)             /* r0 */
    lda     $21, -1($31)
    cmpeq   $20, $21, $22
    beq     $22, 1f                 /* r0 != -1 => skip fixup */

Does this also bypass the fixup for the same reason?

>  
>  #ifdef CONFIG_AUDITSYSCALL
>  	audit_syscall_entry(syscall_get_nr(current, regs),
> -		regs->r16, regs->r17, regs->r18, regs->r19);
> +		regs->r16, regs->r17, regs->r18, regs->r19,
> +		regs->r20, regs->r21);
>  #endif
>  	return syscall_get_nr(current, regs);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=2

[PATCH 03/13] arm: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (ARM_r4, ARM_r5) now that the audit core logs
all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/arm/kernel/ptrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 7951b2c06fec..ace74207738d 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -869,7 +869,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, scno);
 
 	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
-			    regs->ARM_r3);
+			    regs->ARM_r3, regs->ARM_r4, regs->ARM_r5);
 
 	return scno;
 }
-- 
2.55.0

Re: [PATCH 03/13] arm: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] The patch series changes the signature of `audit_syscall_entry()` globally but fails to update numerous architectures, breaking their builds.

Pre-existing issues:
- [High] A tracer can bypass seccomp filters on ARM by modifying `ARM_r0` via ptrace, as seccomp incorrectly evaluates the unmodified `ARM_ORIG_r0`.
--

--- Patch [3]: [PATCH 03/13] arm: pass all six syscall args to audit_syscall_entry() ---
commit 5e37711667e9af11aeb7334ef9ee7ed66cadd89d
Author: Ricardo Robaina <rrobaina@redhat.com>

arm: pass all six syscall args to audit_syscall_entry()
    
Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (ARM_r4, ARM_r5) now that the audit core logs
all six.

> diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
> index 7951b2c06fec6..ace74207738d0 100644
> --- a/arch/arm/kernel/ptrace.c
> +++ b/arch/arm/kernel/ptrace.c
> @@ -869,7 +869,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)

[Severity: High]
This is a pre-existing issue, but can a tracer bypass seccomp filters here?

The ptrace intercept occurs before seccomp:

arch/arm/kernel/ptrace.c:syscall_trace_enter() {
    ...
    if (test_thread_flag(TIF_SYSCALL_TRACE))
        report_syscall(regs, PTRACE_SYSCALL_ENTER);

#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
    if (secure_computing() == -1)
        return -1;
    ...
}

If the tracer modifies the tracee's first syscall argument (ARM_r0) via
ptrace, does seccomp evaluate the unmodified ARM_ORIG_r0 instead?

arch/arm/include/asm/syscall.h:syscall_get_arguments() {
    ...
    args[0] = regs->ARM_ORIG_r0;
    ...
}

Could this allow restricted system calls to be executed with arbitrary first
arguments?

>  		trace_sys_enter(regs, scno);
>  
>  	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
> -			    regs->ARM_r3);
> +			    regs->ARM_r3, regs->ARM_r4, regs->ARM_r5);

[Severity: High]
Does this patch series break the build for other architectures?

The series changes the signature of audit_syscall_entry() globally to require
7 arguments instead of 5:

include/linux/audit.h:
static inline void audit_syscall_entry(int major, unsigned long a0,
                                       unsigned long a1, unsigned long a2,
                                       unsigned long a3, unsigned long a4,
                                       unsigned long a5)

Are other architectures like arm64 still calling it with 5 arguments?

arch/arm64/kernel/ptrace.c:syscall_trace_enter() {
    ...
    audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
                        regs->regs[2], regs->regs[3]);
    ...
}

Will this result in too few arguments to function compiler errors for
architectures that do not use generic entry?

>  
>  	return scno;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=3

[PATCH 04/13] arm64: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (regs[4], regs[5]) now that the audit core logs
all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/arm64/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 4d08598e2891..093c20bff38a 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -2427,7 +2427,8 @@ int syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->syscallno);
 
 	audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
-			    regs->regs[2], regs->regs[3]);
+			    regs->regs[2], regs->regs[3],
+			    regs->regs[4], regs->regs[5]);
 
 	return regs->syscallno;
 }
-- 
2.55.0

Re: [PATCH 04/13] arm64: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Tree-wide API change for `audit_syscall_entry()` missed several architectures, causing build failures due to an argument count mismatch.
--

--- Patch [4]: [PATCH 04/13] arm64: pass all six syscall args to audit_syscall_entry() ---
commit 5064bc40e84bac75de063321783c252440dbc0f5
Author: Ricardo Robaina <rrobaina@redhat.com>

arm64: pass all six syscall args to audit_syscall_entry()

This commit updates the arm64 syscall entry path to pass all six syscall
arguments to audit_syscall_entry(). This aligns with updates to the audit
core which now expects these additional arguments.

> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> index 4d08598e2891d..093c20bff38a9 100644
> --- a/arch/arm64/kernel/ptrace.c
> +++ b/arch/arm64/kernel/ptrace.c
> @@ -2427,7 +2427,8 @@ int syscall_trace_enter(struct pt_regs *regs)
>  		trace_sys_enter(regs, regs->syscallno);
>  
>  	audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
> -			    regs->regs[2], regs->regs[3]);
> +			    regs->regs[2], regs->regs[3],
> +			    regs->regs[4], regs->regs[5]);

[Severity: Low]
Does this change need to be applied to other architectures as well to avoid
build failures?

It looks like several other architectures were not updated to match the new
7-argument signature of audit_syscall_entry(), which will cause them to fail
to compile due to 'too few arguments to function' errors.

For example, MIPS continues to pass only 5 arguments:

arch/mips/kernel/ptrace.c:syscall_trace_enter() {
	...
	audit_syscall_entry(current_thread_info()->syscall,
			    regs->regs[4], regs->regs[5],
			    regs->regs[6], regs->regs[7]);
	...
}

Similar missing updates appear in C-Sky's syscall_trace_enter()
(arch/csky/kernel/ptrace.c), Microblaze's do_syscall_trace_enter()
(arch/microblaze/kernel/ptrace.c), and PowerPC's do_syscall_trace_enter()
(arch/powerpc/kernel/ptrace/ptrace.c).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=4

[PATCH 05/13] csky: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (a4, a5) now that the audit core logs all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/csky/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c
index 6bb685a2646b..562eaf23be82 100644
--- a/arch/csky/kernel/ptrace.c
+++ b/arch/csky/kernel/ptrace.c
@@ -329,7 +329,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, regs->a2, regs->a3);
+	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1,
+			    regs->a2, regs->a3, regs->a4, regs->a5);
 	return 0;
 }
 
-- 
2.55.0

Re: [PATCH 05/13] csky: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch introduces a compile error by accessing `a4` and `a5` members of `struct pt_regs`, which do not exist on the csky architecture.
--

--- Patch [5]: [PATCH 05/13] csky: pass all six syscall args to audit_syscall_entry() ---
commit 048151cce10f914f8f5068a59ec81b9462f22b0f
Author: Ricardo Robaina <rrobaina@redhat.com>

csky: pass all six syscall args to audit_syscall_entry()

This commit updates the audit_syscall_entry() call in the csky architecture to
pass the 5th and 6th syscall arguments. It attempts to access these arguments
via the pt_regs structure.

> diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c
> index 6bb685a2646b5..562eaf23be82d 100644
> --- a/arch/csky/kernel/ptrace.c
> +++ b/arch/csky/kernel/ptrace.c
> @@ -329,7 +329,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>  		trace_sys_enter(regs, syscall_get_nr(current, regs));
>  
> -	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, regs->a2, regs->a3);
> +	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1,
> +			    regs->a2, regs->a3, regs->a4, regs->a5);

[Severity: Low]
Will this cause a build failure? Looking at struct pt_regs for csky, it
appears the a4 and a5 members do not exist. Accessing regs->a4 and regs->a5
here in syscall_trace_enter() seems like it will prevent the csky
architecture from compiling.

>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=5

[PATCH 06/13] microblaze: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (r9, r10) now that the audit core logs all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/microblaze/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 5234d0c1dcaa..21bcd8dfe42d 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,7 +147,8 @@ asmlinkage unsigned long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
+	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7,
+			    regs->r8, regs->r9, regs->r10);
 
 	return ret ?: regs->r12;
 }
-- 
2.55.0

Re: [PATCH 06/13] microblaze: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

> Update the audit_syscall_entry() call to forward the 5th and 6th
> syscall arguments (r9, r10) now that the audit core logs all six.
> 
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=6

[PATCH 07/13] mips: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Use syscall_get_arguments() to retrieve all six arguments portably.
On 32-bit MIPS (O32 ABI), arguments 5 and 6 live on the user stack
rather than in registers, so direct register access would be wrong.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/mips/kernel/ptrace.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 3f4c94c88124..9e6f9accdb41 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -1334,9 +1334,14 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(current_thread_info()->syscall,
-			    regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+	{
+		unsigned long args[6];
+
+		syscall_get_arguments(current, regs, args);
+		audit_syscall_entry(current_thread_info()->syscall,
+				    args[0], args[1], args[2], args[3],
+				    args[4], args[5]);
+	}
 
 	/*
 	 * Negative syscall numbers are mistaken for rejected syscalls, but
-- 
2.55.0

Re: [PATCH 07/13] mips: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

> Use syscall_get_arguments() to retrieve all six arguments portably.
> On 32-bit MIPS (O32 ABI), arguments 5 and 6 live on the user stack
> rather than in registers, so direct register access would be wrong.
> 
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=7

[PATCH 08/13] openrisc: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (gpr[7], gpr[8]) now that the audit core logs
all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/openrisc/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 552489b24855..197a616d6c65 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -302,7 +302,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		ret = -1L;
 
 	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
-			    regs->gpr[5], regs->gpr[6]);
+			    regs->gpr[5], regs->gpr[6],
+			    regs->gpr[7], regs->gpr[8]);
 
 	return ret ? : regs->gpr[11];
 }
-- 
2.55.0

Re: [PATCH 08/13] openrisc: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] The patch series breaks git bisectability by changing a core function signature before updating all architecture callers.

Pre-existing issues:
- [High] The return value of `do_syscall_trace_enter()` is ignored, breaking ptrace syscall abortion (e.g., PTRACE_SYSEMU).
--

--- Patch [8]: [PATCH 08/13] openrisc: pass all six syscall args to audit_syscall_entry() ---
commit 9ca4bd79e1e00767e994486accfe2484de6f3a04
Author: Ricardo Robaina <rrobaina@redhat.com>

openrisc: pass all six syscall args to audit_syscall_entry()

Update the audit_syscall_entry() call to forward the 5th and 6th syscall
arguments (gpr[7], gpr[8]) now that the audit core logs all six.

> diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
> index 552489b24855c..197a616d6c65c 100644
> --- a/arch/openrisc/kernel/ptrace.c
> +++ b/arch/openrisc/kernel/ptrace.c
> @@ -302,7 +302,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		ret = -1L;
>  
>  	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
> -			    regs->gpr[5], regs->gpr[6]);
> +			    regs->gpr[5], regs->gpr[6],
> +			    regs->gpr[7], regs->gpr[8]);

[Severity: Low]
Will this change cause a git bisectability regression if architecture
callers are updated in subsequent commits?

If the core function signature of audit_syscall_entry() was changed in a
previous commit, intermediate commits checked out between the core change
and this architecture update will fail to compile on OpenRISC with a
"too few arguments to function" error.

>  
>  	return ret ? : regs->gpr[11];
>  }

[Severity: High]
This isn't a bug introduced by this patch, but is the return value ignored
by the assembly caller, potentially breaking ptrace syscall abortion?

If tracing decides a syscall should not happen (e.g., via PTRACE_SYSEMU)
and ptrace_report_syscall_entry() returns non-zero, this function attempts
to abort the syscall by returning -1L in r11.

However, the caller in arch/openrisc/kernel/entry.S unconditionally
reloads the original syscall number into r11, discarding the return value:

arch/openrisc/kernel/entry.S:_syscall_trace_enter()
    ...
    l.jal   do_syscall_trace_enter
     l.addi r3,r1,0

    /* Restore arguments ... */
    l.lwz   r11,PT_GPR11(r1)
    ...

Can this allow the original syscall to execute regardless of the tracer's
abort request?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=8

[PATCH 09/13] parisc: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update both the native and compat audit_syscall_entry() calls to
forward the 5th and 6th syscall arguments (gr[22], gr[21]) now
that the audit core logs all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/parisc/kernel/ptrace.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 8a17ab7e6e0b..75e74d214a3b 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -362,14 +362,17 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
 		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
-				    regs->gr[24], regs->gr[23]);
+				    regs->gr[24], regs->gr[23],
+				    regs->gr[22], regs->gr[21]);
 	else
 #endif
 		audit_syscall_entry(regs->gr[20] & 0xffffffff,
 			regs->gr[26] & 0xffffffff,
 			regs->gr[25] & 0xffffffff,
 			regs->gr[24] & 0xffffffff,
-			regs->gr[23] & 0xffffffff);
+			regs->gr[23] & 0xffffffff,
+			regs->gr[22] & 0xffffffff,
+			regs->gr[21] & 0xffffffff);
 
 	/*
 	 * Sign extend the syscall number to 64bit since it may have been
-- 
2.55.0

Re: [PATCH 09/13] parisc: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

> Update both the native and compat audit_syscall_entry() calls to
> forward the 5th and 6th syscall arguments (gr[22], gr[21]) now
> that the audit core logs all six.
> 
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=9

[PATCH 10/13] sh: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (regs[0], regs[1]) now that the audit core logs
all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/sh/kernel/ptrace_32.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 06f765d71a29..3efefd67b457 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -467,7 +467,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->regs[0]);
 
 	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+			    regs->regs[6], regs->regs[7],
+			    regs->regs[0], regs->regs[1]);
 
 	return 0;
 }
-- 
2.55.0

Re: [PATCH 10/13] sh: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the `sys_enter` tracepoint is incorrectly invoked with the 5th syscall argument (`regs->regs[0]`) instead of the system call number, allowing userspace to spoof syscall trace events.
--

--- Patch [10]: [PATCH 10/13] sh: pass all six syscall args to audit_syscall_entry() ---
commit 3f32d157a274ce4c78e2758720926d9048ca177a
Author: Ricardo Robaina <rrobaina@redhat.com>

sh: pass all six syscall args to audit_syscall_entry()

This commit updates the audit_syscall_entry() call to forward the 5th
and 6th syscall arguments. This aligns with the audit core which now
logs all six arguments.

> diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
> index 06f765d71a295..3efefd67b457c 100644
> --- a/arch/sh/kernel/ptrace_32.c
> +++ b/arch/sh/kernel/ptrace_32.c
> @@ -467,7 +467,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
>  		trace_sys_enter(regs, regs->regs[0]);

[Severity: High]
This is a pre-existing issue in do_syscall_trace_enter(), but is
trace_sys_enter() receiving the correct system call number here?

Since regs->regs[0] holds the 5th syscall argument on SuperH, passing it
here means security monitoring tools attached to the sys_enter tracepoint
might receive an incorrect, user-controlled syscall number. Could a local
unprivileged attacker exploit this by placing a sensitive syscall number
in the actual syscall register and a benign one in r0 to bypass security
auditing?

>  
>  	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
> -			    regs->regs[6], regs->regs[7]);
> +			    regs->regs[6], regs->regs[7],
> +			    regs->regs[0], regs->regs[1]);
>  
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=10

[PATCH 11/13] sparc64: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (UREG_I4, UREG_I5) now that the audit core logs
all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/sparc/kernel/ptrace_64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 9fc67fa9336f..d0ad3200d789 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1100,7 +1100,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 
 	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
 			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
-			    regs->u_regs[UREG_I3]);
+			    regs->u_regs[UREG_I3], regs->u_regs[UREG_I4],
+			    regs->u_regs[UREG_I5]);
 
 	return ret;
 }
-- 
2.55.0

Re: [PATCH 11/13] sparc64: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] 32-bit compat syscall arguments are not zero-extended before being passed to audit_syscall_entry(), leading to a high-severity audit evasion vulnerability for socketcall multiplexed syscalls.
--

--- Patch [11]: [PATCH 11/13] sparc64: pass all six syscall args to audit_syscall_entry() ---
commit 5c60aff4dd1af29adf66c85f200b0a80fe2238fb
Author: Ricardo Robaina <rrobaina@redhat.com>

sparc64: pass all six syscall args to audit_syscall_entry()

This commit updates syscall_trace_enter() to forward the 5th and 6th syscall
arguments (UREG_I4, UREG_I5) to audit_syscall_entry(). This change ensures
all six arguments are passed, aligning with the audit core's expectations.

> diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
> index 9fc67fa9336fe..d0ad3200d789c 100644
> --- a/arch/sparc/kernel/ptrace_64.c
> +++ b/arch/sparc/kernel/ptrace_64.c
> @@ -1100,7 +1100,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>  
>  	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
>  			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
> -			    regs->u_regs[UREG_I3]);
> +			    regs->u_regs[UREG_I3], regs->u_regs[UREG_I4],
> +			    regs->u_regs[UREG_I5]);

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for a 32-bit
compat process to evade audit rules because these arguments are not
zero-extended?

For a 32-bit process executing a multiplexed system call like socketcall,
an attacker could intentionally leave non-zero garbage in the upper 32 bits of
the registers. 

Because syscall_trace_enter() passes the raw 64-bit values directly from
regs->u_regs without zero-extending them, the audit subsystem stores the full
64-bit value. When the audit core later evaluates rules (e.g., checking
ctx->argv[0] == SYS_BIND), the comparison fails due to the upper 32-bit
garbage, bypassing the rule.

Since the SPARC64 assembly later zero-extends the arguments before invoking the
actual compat syscall handler, the syscall succeeds without being properly
audited.

Could we zero-extend these register values for 32-bit compat tasks before
passing them to audit_syscall_entry() to prevent this bypass?

>  
>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=11

[PATCH 12/13] um: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (UPT_SYSCALL_ARG5, UPT_SYSCALL_ARG6) now that
the audit core logs all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/um/kernel/ptrace.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index fdbb37b5c399..c597a368592d 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -127,7 +127,9 @@ int syscall_trace_enter(struct pt_regs *regs)
 			    UPT_SYSCALL_ARG1(&regs->regs),
 			    UPT_SYSCALL_ARG2(&regs->regs),
 			    UPT_SYSCALL_ARG3(&regs->regs),
-			    UPT_SYSCALL_ARG4(&regs->regs));
+			    UPT_SYSCALL_ARG4(&regs->regs),
+			    UPT_SYSCALL_ARG5(&regs->regs),
+			    UPT_SYSCALL_ARG6(&regs->regs));
 
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, UPT_SYSCALL_NR(&regs->regs));
-- 
2.55.0

Re: [PATCH 12/13] um: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch series changes the signature of `audit_syscall_entry()` globally but splits caller updates into separate commits and completely misses updating the PowerPC and Xtensa architectures, causing a tree-wide build failure.
--

--- Patch [12]: [PATCH 12/13] um: pass all six syscall args to audit_syscall_entry() ---
commit 9c50f8d1e9a5a601156f9a077df794dd83a368a0
Author: Ricardo Robaina <rrobaina@redhat.com>

um: pass all six syscall args to audit_syscall_entry()

This commit updates the syscall_trace_enter function in the UML architecture
to pass the 5th and 6th syscall arguments to audit_syscall_entry. This aligns
with the new audit core API which logs all six arguments.

> diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
> --- a/arch/um/kernel/ptrace.c
> +++ b/arch/um/kernel/ptrace.c
[ ... ]
> @@ -127,7 +127,9 @@ int syscall_trace_enter(struct pt_regs *regs)
>  			    UPT_SYSCALL_ARG1(&regs->regs),
>  			    UPT_SYSCALL_ARG2(&regs->regs),
>  			    UPT_SYSCALL_ARG3(&regs->regs),
> -			    UPT_SYSCALL_ARG4(&regs->regs));
> +			    UPT_SYSCALL_ARG4(&regs->regs),
> +			    UPT_SYSCALL_ARG5(&regs->regs),
> +			    UPT_SYSCALL_ARG6(&regs->regs));

[Severity: Low]
Does splitting the caller updates into separate commits from the core API
change break bisection for architectures not using the generic entry code?

If the core API was changed in a previous commit, building this intermediate
commit during git bisect will fail since architectures not yet updated will
have callers expecting the old signature.

Additionally, were the PowerPC and Xtensa architectures missed entirely in
this series? For example, do_syscall_trace_enter() in
arch/powerpc/kernel/ptrace/ptrace.c still passes 5 arguments instead of the
required 7:

		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
				    regs->gpr[5], regs->gpr[6]);

A similar issue occurs in do_syscall_trace_enter() in
arch/xtensa/kernel/ptrace.c. Will this cause an unconditional build failure
for these architectures when compiled with CONFIG_AUDITSYSCALL=y?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=12

[PATCH 13/13] xtensa: pass all six syscall args to audit_syscall_entry()

[Ricardo Robaina]

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (areg[8], areg[9]) now that the audit core logs
all six.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/xtensa/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index b80d54b2ea34..122a6ffc0757 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -564,7 +564,8 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 
 	audit_syscall_entry(regs->syscall, regs->areg[6],
 			    regs->areg[3], regs->areg[4],
-			    regs->areg[5]);
+			    regs->areg[5], regs->areg[8],
+			    regs->areg[9]);
 	return 1;
 }
 
-- 
2.55.0

Re: [PATCH 13/13] xtensa: pass all six syscall args to audit_syscall_entry()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The core API patch in this series ('audit: log all six syscall arguments in the SYSCALL record') changed the signature of `audit_syscall_entry()` from 5 to 7 arguments, but the PowerPC architecture was missed. This leaves PowerPC passing 5 arguments, resulting in a build failure.
--

--- Patch [13]: [PATCH 13/13] xtensa: pass all six syscall args to audit_syscall_entry() ---
commit 7f8e4937464dcba7a1012a4d48470ce510d233d3
Author: Ricardo Robaina <rrobaina@redhat.com>

xtensa: pass all six syscall args to audit_syscall_entry()

Update the audit_syscall_entry() call to forward the 5th and 6th
syscall arguments (areg[8], areg[9]) now that the audit core logs
all six.

> diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
> index b80d54b2ea34e..122a6ffc0757e 100644
> --- a/arch/xtensa/kernel/ptrace.c
> +++ b/arch/xtensa/kernel/ptrace.c
> @@ -564,7 +564,8 @@ int do_syscall_trace_enter(struct pt_regs *regs)
>  
>  	audit_syscall_entry(regs->syscall, regs->areg[6],
>  			    regs->areg[3], regs->areg[4],
> -			    regs->areg[5]);
> +			    regs->areg[5], regs->areg[8],
> +			    regs->areg[9]);

[Severity: Low]
Is it possible that the powerpc architecture was missed in this series?

While xtensa is correctly updated here, it looks like do_syscall_trace_enter()
in arch/powerpc/kernel/ptrace/ptrace.c still passes 5 arguments:

arch/powerpc/kernel/ptrace/ptrace.c:do_syscall_trace_enter() {
    ...
		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
				    regs->gpr[5], regs->gpr[6]);
    ...
}

Will this cause a build regression on powerpc since the new signature requires
7 arguments?

>  	return 1;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=13

Re: [PATCH 00/13] audit: log all six syscall arguments in the SYSCALL record

[Will Deacon]

On Thu, Aug 13, 2026 at 02:02:50PM -0300, Ricardo Robaina wrote:
> The SYSCALL record currently logs only four of the six syscall
> arguments (a0-a3), silently discarding the remaining two. This
> leads to the need for auxiliary records when audit-relevant
> data lands in the 5th or 6th argument of a syscall.
> 
> This series extends the SYSCALL record to log all six arguments,
> by adding arguments a4 and a5 inline within the existing record.
> 
> The audit testsuite runs successfully:
> 
>  # make test
>  make -C tests test
>  chmod +x */test
>  Running as   user    root
>         with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>         on   system  Fedora
> 
>  amcast_joinpart/test ................. ok   
>  backlog_wait_time_actual_reset/test .. ok   
>  bpf/test ............................. ok   
>  coredump/test ........................ ok   
>  exec_execve/test ..................... ok   
>  exec_name/test ....................... ok     
>  fanotify/test ........................ ok   
>  field_compare/test ................... ok     
>  file_create/test ..................... ok   
>  file_delete/test ..................... ok   
>  file_permission/test ................. ok   
>  file_rename/test ..................... ok   
>  filter_device/test ................... ok     
>  filter_exclude/test .................. ok     
>  filter_exit/test ..................... ok   
>  filter_inode/test .................... ok   
>  filter_saddr_fam/test ................ ok   
>  filter_sessionid/test ................ ok   
>  io_uring/test ........................ ok   
>  login_tty/test ....................... ok   
>  lost_reset/test ...................... ok   
>  netfilter_pkt/test ................... ok     
>  signal/test .......................... ok   
>  syscalls_file/test ................... ok   
>  syscall_module/test .................. ok   
>  syscall_socketcall/test .............. ok   
>  time_change/test ..................... ok     
>  user_msg/test ........................ ok   
>  All tests successful.
>  Result: PASS
> 
> Ricardo Robaina (13):
>   audit: log all six syscall arguments in the SYSCALL record
>   alpha: pass all six syscall args to audit_syscall_entry()
>   arm: pass all six syscall args to audit_syscall_entry()
>   arm64: pass all six syscall args to audit_syscall_entry()
>   csky: pass all six syscall args to audit_syscall_entry()
>   microblaze: pass all six syscall args to audit_syscall_entry()
>   mips: pass all six syscall args to audit_syscall_entry()
>   openrisc: pass all six syscall args to audit_syscall_entry()
>   parisc: pass all six syscall args to audit_syscall_entry()
>   sh: pass all six syscall args to audit_syscall_entry()
>   sparc64: pass all six syscall args to audit_syscall_entry()
>   um: pass all six syscall args to audit_syscall_entry()
>   xtensa: pass all six syscall args to audit_syscall_entry()

Could audit make use of syscall_get_arguments() instead?

Will