* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-14 14:35 [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Will Deacon
@ 2026-07-15 11:39 ` Jinjie Ruan
2026-07-15 13:16 ` Will Deacon
2026-07-16 2:57 ` Jinjie Ruan
` (2 subsequent siblings)
3 siblings, 1 reply; 13+ messages in thread
From: Jinjie Ruan @ 2026-07-15 11:39 UTC (permalink / raw)
To: Will Deacon, linux-arm-kernel
Cc: linux-kernel, Kees Cook, Mark Rutland, Yiqi Sun, Catalin Marinas
On 7/14/2026 10:35 PM, Will Deacon wrote:
> When seccomp support was originally added to arm64 in a1ae65b21941
> ("arm64: add seccomp support"), seccomp was erroneously called _before_
> the ptrace syscall-enter-stop and therefore the tracer could trivially
> manipulate the syscall register state after the seccomp check had
> passed. This was subsequently fixed in a5cd110cb836 ("arm64/ptrace: run
> seccomp after ptrace") by moving the seccomp check after the tracer has
> run. Unfortunately, a decade later, that fix has been reported to be
> incomplete.
>
> On arm64, both the first argument to a syscall and its eventual return
> value are allocated to register x0. In order to facilitate syscall
> restarting and querying of syscall arguments on the syscall exit path,
> the original value of x0 is stashed in 'struct pt_regs::orig_x0' early
> during the syscall entry path and is returned for the first argument by
> syscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not
> directly exposed via ptrace() and so changes to register x0 made by the
> tracer on a syscall-enter-stop are not reflected in 'orig_x0'. This
> means that seccomp and audit can observe a stale value for the register
> compared to the argument that will be observed by the actual syscall.
>
> Re-sync 'orig_x0' from x0 on the syscall entry path following a
> potential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or
> SECCOMP_RET_TRACE). This behaviour is limited to native tasks (because
> compat tasks expose 'orig_r0' to ptrace) where the syscall is not being
> skipped (because x0 is updated to hold the return value of -ENOSYS in
> that case).
>
> Cc: Kees Cook <kees@kernel.org>
> Cc: Jinjie Ruan <ruanjinjie@huawei.com>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Reported-by: Yiqi Sun <sunyiqixm@gmail.com>
> Link: https://lore.kernel.org/all/20260529065444.1336608-1-sunyiqixm@gmail.com/
> Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
> Fixes: a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace")
> Signed-off-by: Will Deacon <will@kernel.org>
> ---
> arch/arm64/kernel/ptrace.c | 24 ++++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> index 4d08598e2891..57e8c6714d44 100644
> --- a/arch/arm64/kernel/ptrace.c
> +++ b/arch/arm64/kernel/ptrace.c
> @@ -2408,6 +2408,21 @@ static void report_syscall_exit(struct pt_regs *regs)
> }
> }
>
> +static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
> +{
> + /*
> + * Keep orig_x0 authoritative so that seccomp (via
> + * syscall_get_arguments()), audit and the restart path all see the same
> + * first argument the syscall is dispatched with, even if it has been
> + * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
> + * or the tracer), as regs[0] holds the return value (see the comment in
> + * el0_svc_common()) and can be unwound using syscall_rollback().
> + * For compat tasks, orig_r0 is provided directly through GPR index 17.
> + */
> + if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
> + regs->orig_x0 = regs->regs[0];
> +}
> +
> int syscall_trace_enter(struct pt_regs *regs)
> {
> unsigned long flags = read_thread_flags();
> @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
> ret = report_syscall_entry(regs);
> if (ret || (flags & _TIF_SYSCALL_EMU))
> return NO_SYSCALL;
> +
> + /*
> + * Ensure ptrace changes to x0 are visible to seccomp
> + * ptrace exits (SECCOMP_RET_TRACE).
> + */
Hi, will,
After delving into the seccomp code, I believe the comments are not
quite accurate, I think SECCOMP_RET_TRACE not return to here.
maybe,
/*
* Ensure ptrace changes to x0 during a regular syscall-enter-stop
* (PTRACE_SYSCALL) are visible to subsequent seccomp and audit
* checking.
*/
> + update_syscall_orig_x0_after_ptrace(regs);
> }
>
> /* Do the secure computing after ptrace; failures should be fast. */
> if (secure_computing() == -1)
> return NO_SYSCALL;
>
> + /* Ensure seccomp updates to x0 are visible to audit. */
This comment is also not quite accurate, it implies that Seccomp itself
(such as SECCOMP_RET_ERRNO) modifies x0, but in this scenario, the audit
is not executed, because __seccomp_filter() skip the syscall.
1279 >-------switch (action) {
1280 >-------case SECCOMP_RET_ERRNO:
1281 >------->-------/* Set low-order bits as an errno, capped at
MAX_ERRNO. */
1282 >------->-------if (data > MAX_ERRNO)
1283 >------->------->-------data = MAX_ERRNO;
1284 >------->-------syscall_set_return_value(current, current_pt_regs(),
1285 >------->------->------->------->------- -data, 0);
1286 >------->-------goto skip;
^^^^^^^^^^^^^<- we skip the syscall if
SECCOMP_RET_ERRNO changes x0
Here what we actually need to synchronize is the tracer's modification
of x0 in the SECCOMP_RET_TRACE path, the SECCOMP_RET_TRACE logic
notifies the tracer, the tracer modifies x0 and modifies the system call
number to a legal value and so we can continue the latter audit.
1295 case SECCOMP_RET_TRACE:
1296 /* We've been put in this state by the ptracer already. */
1297 if (recheck_after_trace)
1298 return true;
^^^^^^^^^^^^^^^^^^^^^^^^^^^ <- I think we return here.
1299
1300 /* ENOSYS these calls if there is no tracer attached. */
1301 if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
1302 syscall_set_return_value(current,
1303 current_pt_regs(),
1304 -ENOSYS, 0);
1305 goto skip;
1306 }
1307
1308 /* Allow the BPF to provide the event message */
1309 ptrace_event(PTRACE_EVENT_SECCOMP, data);
1310 /*
1311 * The delivery of a fatal signal during event
1312 * notification may silently skip tracer notification,
1313 * which could leave us with a potentially unmodified
1314 * syscall that the tracer would have liked to have
1315 * changed. Since the process is about to die, we just
1316 * force the syscall to be skipped and let the signal
1317 * kill the process and correctly handle any tracer exit
1318 * notifications.
1319 */
1320 if (fatal_signal_pending(current))
1321 goto skip;
1322 /* Check if the tracer forced the syscall to be skipped. */
1323 this_syscall = syscall_get_nr(current, current_pt_regs());
1324 if (this_syscall < 0)
1325 goto skip;
1326
1327 /*
1328 * Recheck the syscall, since it may have changed. This
1329 * intentionally uses a NULL struct seccomp_data to force
1330 * a reload of all registers. This does not goto skip since
1331 * a skip would have already been reported.
1332 */
1333 return __seccomp_filter(this_syscall, true);
maybe,
/*
* Ensure tracer changes to x0 during SECCOMP_RET_TRACE processing
* are visible to later trace and audit.
*/
Otherwsie, LGTM
Best reagards,
Jinjie
> + update_syscall_orig_x0_after_ptrace(regs);
> +
> if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
> trace_sys_enter(regs, regs->syscallno);
>
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-15 11:39 ` Jinjie Ruan
@ 2026-07-15 13:16 ` Will Deacon
2026-07-16 2:09 ` Jinjie Ruan
0 siblings, 1 reply; 13+ messages in thread
From: Will Deacon @ 2026-07-15 13:16 UTC (permalink / raw)
To: Jinjie Ruan
Cc: linux-arm-kernel, linux-kernel, Kees Cook, Mark Rutland, Yiqi Sun,
Catalin Marinas
Hi Jinjie,
Thank you for having a look at this. We're nearly there!
On Wed, Jul 15, 2026 at 07:39:43PM +0800, Jinjie Ruan wrote:
> On 7/14/2026 10:35 PM, Will Deacon wrote:
> > diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> > index 4d08598e2891..57e8c6714d44 100644
> > --- a/arch/arm64/kernel/ptrace.c
> > +++ b/arch/arm64/kernel/ptrace.c
> > @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
> > ret = report_syscall_entry(regs);
> > if (ret || (flags & _TIF_SYSCALL_EMU))
> > return NO_SYSCALL;
> > +
> > + /*
> > + * Ensure ptrace changes to x0 are visible to seccomp
> > + * ptrace exits (SECCOMP_RET_TRACE).
> > + */
>
> After delving into the seccomp code, I believe the comments are not
> quite accurate, I think SECCOMP_RET_TRACE not return to here.
>
> maybe,
>
> /*
> * Ensure ptrace changes to x0 during a regular syscall-enter-stop
> * (PTRACE_SYSCALL) are visible to subsequent seccomp and audit
> * checking.
> */
Yes, that's better. Seccomp BPF filters will get passed whatever comes
back from syscall_get_arguments(), so mentioning SECCOMP_RET_TRACE is
confusing here.
> > + update_syscall_orig_x0_after_ptrace(regs);
> > }
> >
> > /* Do the secure computing after ptrace; failures should be fast. */
> > if (secure_computing() == -1)
> > return NO_SYSCALL;
> >
> > + /* Ensure seccomp updates to x0 are visible to audit. */
>
> This comment is also not quite accurate, it implies that Seccomp itself
> (such as SECCOMP_RET_ERRNO) modifies x0, but in this scenario, the audit
> is not executed, because __seccomp_filter() skip the syscall.
>
> 1279 >-------switch (action) {
> 1280 >-------case SECCOMP_RET_ERRNO:
> 1281 >------->-------/* Set low-order bits as an errno, capped at
> MAX_ERRNO. */
> 1282 >------->-------if (data > MAX_ERRNO)
> 1283 >------->------->-------data = MAX_ERRNO;
> 1284 >------->-------syscall_set_return_value(current, current_pt_regs(),
> 1285 >------->------->------->------->------- -data, 0);
> 1286 >------->-------goto skip;
> ^^^^^^^^^^^^^<- we skip the syscall if
> SECCOMP_RET_ERRNO changes x0
>
>
> Here what we actually need to synchronize is the tracer's modification
> of x0 in the SECCOMP_RET_TRACE path, the SECCOMP_RET_TRACE logic
> notifies the tracer, the tracer modifies x0 and modifies the system call
> number to a legal value and so we can continue the latter audit.
Right, the 'SECCOMP_RET_TRACE' example should be in _this_ comment, not
the previous one.
> /*
> * Ensure tracer changes to x0 during SECCOMP_RET_TRACE processing
> * are visible to later trace and audit.
> */
I'll tweak that, as I don't think the tracing part matters (it doesn't
see orig_x0 afaict) and I'd like to be very clear that this is down
to the secure_computing() call. So it becomes:
/*
* Ensure tracer changes to x0 during seccomp ptrace exit processing
* (SECCOMP_RET_TRACE) are visible to audit.
*/
Will
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-15 13:16 ` Will Deacon
@ 2026-07-16 2:09 ` Jinjie Ruan
2026-07-16 11:50 ` Will Deacon
0 siblings, 1 reply; 13+ messages in thread
From: Jinjie Ruan @ 2026-07-16 2:09 UTC (permalink / raw)
To: Will Deacon
Cc: linux-arm-kernel, linux-kernel, Kees Cook, Mark Rutland, Yiqi Sun,
Catalin Marinas
On 7/15/2026 9:16 PM, Will Deacon wrote:
> Hi Jinjie,
>
> Thank you for having a look at this. We're nearly there!
>
> On Wed, Jul 15, 2026 at 07:39:43PM +0800, Jinjie Ruan wrote:
>> On 7/14/2026 10:35 PM, Will Deacon wrote:
>>> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
>>> index 4d08598e2891..57e8c6714d44 100644
>>> --- a/arch/arm64/kernel/ptrace.c
>>> +++ b/arch/arm64/kernel/ptrace.c
>>> @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
>>> ret = report_syscall_entry(regs);
>>> if (ret || (flags & _TIF_SYSCALL_EMU))
>>> return NO_SYSCALL;
>>> +
>>> + /*
>>> + * Ensure ptrace changes to x0 are visible to seccomp
>>> + * ptrace exits (SECCOMP_RET_TRACE).
>>> + */
>>
>> After delving into the seccomp code, I believe the comments are not
>> quite accurate, I think SECCOMP_RET_TRACE not return to here.
>>
>> maybe,
>>
>> /*
>> * Ensure ptrace changes to x0 during a regular syscall-enter-stop
>> * (PTRACE_SYSCALL) are visible to subsequent seccomp and audit
>> * checking.
>> */
>
> Yes, that's better. Seccomp BPF filters will get passed whatever comes
> back from syscall_get_arguments(), so mentioning SECCOMP_RET_TRACE is
> confusing here.
>
>>> + update_syscall_orig_x0_after_ptrace(regs);
>>> }
>>>
>>> /* Do the secure computing after ptrace; failures should be fast. */
>>> if (secure_computing() == -1)
>>> return NO_SYSCALL;
>>>
>>> + /* Ensure seccomp updates to x0 are visible to audit. */
>>
>> This comment is also not quite accurate, it implies that Seccomp itself
>> (such as SECCOMP_RET_ERRNO) modifies x0, but in this scenario, the audit
>> is not executed, because __seccomp_filter() skip the syscall.
>>
>> 1279 >-------switch (action) {
>> 1280 >-------case SECCOMP_RET_ERRNO:
>> 1281 >------->-------/* Set low-order bits as an errno, capped at
>> MAX_ERRNO. */
>> 1282 >------->-------if (data > MAX_ERRNO)
>> 1283 >------->------->-------data = MAX_ERRNO;
>> 1284 >------->-------syscall_set_return_value(current, current_pt_regs(),
>> 1285 >------->------->------->------->------- -data, 0);
>> 1286 >------->-------goto skip;
>> ^^^^^^^^^^^^^<- we skip the syscall if
>> SECCOMP_RET_ERRNO changes x0
>>
>>
>> Here what we actually need to synchronize is the tracer's modification
>> of x0 in the SECCOMP_RET_TRACE path, the SECCOMP_RET_TRACE logic
>> notifies the tracer, the tracer modifies x0 and modifies the system call
>> number to a legal value and so we can continue the latter audit.
>
> Right, the 'SECCOMP_RET_TRACE' example should be in _this_ comment, not
> the previous one.
>
>> /*
>> * Ensure tracer changes to x0 during SECCOMP_RET_TRACE processing
>> * are visible to later trace and audit.
>> */
>
> I'll tweak that, as I don't think the tracing part matters (it doesn't
> see orig_x0 afaict) and I'd like to be very clear that this is down
> to the secure_computing() call. So it becomes:
Hi Will,
Looking forward to your update.
I do not think so, I think the trace part also matters, because the
tracepoint also reads orig_x0 through syscall_get_arguments().
18 TRACE_EVENT_SYSCALL(sys_enter,
19
20 >-------TP_PROTO(struct pt_regs *regs, long id),
21
22 >-------TP_ARGS(regs, id),
23
24 >-------TP_STRUCT__entry(
25 >------->-------__field(>-------long,>-->-------id>----->-------)
26 >------->-------__array(>-------unsigned long,>-args,>--6>------)
27 >-------),
28
29 >-------TP_fast_assign(
30 >------->-------__entry->id>----= id;
31 >------->-------syscall_get_arguments(current, regs, __entry->args);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
32 >-------),
33
34 >-------TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
35 >------->------- __entry->id,
36 >------->------- __entry->args[0], __entry->args[1], __entry->args[2],
37 >------->------- __entry->args[3], __entry->args[4], __entry->args[5]),
38
39 >-------syscall_regfunc, syscall_unregfunc
40 );
Based on a fix patch by Kees six years ago, I understand that system
call parameters are similar to system call numbers. If ptrace or seccomp
modifies the system call parameters, then at that time, the tracing and
auditing mechanisms also need to be able to see this change.
I understand that the semantics of seccomp and trace/audit are intended
to reflect the latest relevant data of system calls that are "actually
executed" (invoke_syscall()).
Link: https://lkml.org/lkml/2020/9/11/1282
Best regards,
Jinjie
>
> /*
> * Ensure tracer changes to x0 during seccomp ptrace exit processing
> * (SECCOMP_RET_TRACE) are visible to audit.
> */
>
> Will
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-16 2:09 ` Jinjie Ruan
@ 2026-07-16 11:50 ` Will Deacon
0 siblings, 0 replies; 13+ messages in thread
From: Will Deacon @ 2026-07-16 11:50 UTC (permalink / raw)
To: Jinjie Ruan
Cc: linux-arm-kernel, linux-kernel, Kees Cook, Mark Rutland, Yiqi Sun,
Catalin Marinas
On Thu, Jul 16, 2026 at 10:09:55AM +0800, Jinjie Ruan wrote:
> On 7/15/2026 9:16 PM, Will Deacon wrote:
> >> /*
> >> * Ensure tracer changes to x0 during SECCOMP_RET_TRACE processing
> >> * are visible to later trace and audit.
> >> */
> >
> > I'll tweak that, as I don't think the tracing part matters (it doesn't
> > see orig_x0 afaict) and I'd like to be very clear that this is down
> > to the secure_computing() call. So it becomes:
>
> I do not think so, I think the trace part also matters, because the
> tracepoint also reads orig_x0 through syscall_get_arguments().
>
> 18 TRACE_EVENT_SYSCALL(sys_enter,
> 19
> 20 >-------TP_PROTO(struct pt_regs *regs, long id),
> 21
> 22 >-------TP_ARGS(regs, id),
> 23
> 24 >-------TP_STRUCT__entry(
> 25 >------->-------__field(>-------long,>-->-------id>----->-------)
> 26 >------->-------__array(>-------unsigned long,>-args,>--6>------)
> 27 >-------),
> 28
> 29 >-------TP_fast_assign(
> 30 >------->-------__entry->id>----= id;
> 31 >------->-------syscall_get_arguments(current, regs, __entry->args);
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> 32 >-------),
> 33
> 34 >-------TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
> 35 >------->------- __entry->id,
> 36 >------->------- __entry->args[0], __entry->args[1], __entry->args[2],
> 37 >------->------- __entry->args[3], __entry->args[4], __entry->args[5]),
> 38
> 39 >-------syscall_regfunc, syscall_unregfunc
> 40 );
Well spotted, I was looking for "orig_x0" when I initially looked at the
tracing code but it's hidden behind that call to syscall_get_arguments().
Will
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-14 14:35 [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Will Deacon
2026-07-15 11:39 ` Jinjie Ruan
@ 2026-07-16 2:57 ` Jinjie Ruan
2026-07-16 3:05 ` Kees Cook
2026-07-16 11:53 ` Will Deacon
2026-08-20 6:54 ` kernel test robot
2026-08-20 11:25 ` kernel test robot
3 siblings, 2 replies; 13+ messages in thread
From: Jinjie Ruan @ 2026-07-16 2:57 UTC (permalink / raw)
To: Will Deacon, linux-arm-kernel
Cc: linux-kernel, Kees Cook, Mark Rutland, Yiqi Sun, Catalin Marinas
On 7/14/2026 10:35 PM, Will Deacon wrote:
> When seccomp support was originally added to arm64 in a1ae65b21941
> ("arm64: add seccomp support"), seccomp was erroneously called _before_
> the ptrace syscall-enter-stop and therefore the tracer could trivially
> manipulate the syscall register state after the seccomp check had
> passed. This was subsequently fixed in a5cd110cb836 ("arm64/ptrace: run
> seccomp after ptrace") by moving the seccomp check after the tracer has
> run. Unfortunately, a decade later, that fix has been reported to be
> incomplete.
>
> On arm64, both the first argument to a syscall and its eventual return
> value are allocated to register x0. In order to facilitate syscall
> restarting and querying of syscall arguments on the syscall exit path,
> the original value of x0 is stashed in 'struct pt_regs::orig_x0' early
> during the syscall entry path and is returned for the first argument by
> syscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not
> directly exposed via ptrace() and so changes to register x0 made by the
> tracer on a syscall-enter-stop are not reflected in 'orig_x0'. This
> means that seccomp and audit can observe a stale value for the register
> compared to the argument that will be observed by the actual syscall.
>
> Re-sync 'orig_x0' from x0 on the syscall entry path following a
> potential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or
> SECCOMP_RET_TRACE). This behaviour is limited to native tasks (because
> compat tasks expose 'orig_r0' to ptrace) where the syscall is not being
> skipped (because x0 is updated to hold the return value of -ENOSYS in
> that case).
>
> Cc: Kees Cook <kees@kernel.org>
> Cc: Jinjie Ruan <ruanjinjie@huawei.com>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Reported-by: Yiqi Sun <sunyiqixm@gmail.com>
> Link: https://lore.kernel.org/all/20260529065444.1336608-1-sunyiqixm@gmail.com/
> Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
> Fixes: a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace")
> Signed-off-by: Will Deacon <will@kernel.org>
> ---
> arch/arm64/kernel/ptrace.c | 24 ++++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> index 4d08598e2891..57e8c6714d44 100644
> --- a/arch/arm64/kernel/ptrace.c
> +++ b/arch/arm64/kernel/ptrace.c
> @@ -2408,6 +2408,21 @@ static void report_syscall_exit(struct pt_regs *regs)
> }
> }
>
> +static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
> +{
> + /*
> + * Keep orig_x0 authoritative so that seccomp (via
> + * syscall_get_arguments()), audit and the restart path all see the same
> + * first argument the syscall is dispatched with, even if it has been
> + * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
> + * or the tracer), as regs[0] holds the return value (see the comment in
> + * el0_svc_common()) and can be unwound using syscall_rollback().
> + * For compat tasks, orig_r0 is provided directly through GPR index 17.
> + */
> + if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
> + regs->orig_x0 = regs->regs[0];
> +}
> +
> int syscall_trace_enter(struct pt_regs *regs)
> {
> unsigned long flags = read_thread_flags();
> @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
> ret = report_syscall_entry(regs);
> if (ret || (flags & _TIF_SYSCALL_EMU))
> return NO_SYSCALL;
> +
> + /*
> + * Ensure ptrace changes to x0 are visible to seccomp
> + * ptrace exits (SECCOMP_RET_TRACE).
> + */
> + update_syscall_orig_x0_after_ptrace(regs);
> }
>
> /* Do the secure computing after ptrace; failures should be fast. */
> if (secure_computing() == -1)
> return NO_SYSCALL;
>
> + /* Ensure seccomp updates to x0 are visible to audit. */
> + update_syscall_orig_x0_after_ptrace(regs);
Hi, will
I think unconditionally updating orig_x0 here is unnecessary, we could
Expand seccomp check in place as below the same as generic entry.
In this way, in most cases where seccomp is not used, the overhead of
updating orig_x0 is eliminated. Moreover, we only need to define an
architecture-specific version of the seccomp function, thus avoiding the
pain of switching from arm64 to the generic entry.
So this patch can be like below.
int syscall_trace_enter(struct pt_regs *regs)
{
unsigned long flags = read_thread_flags();
@@ -2420,12 +2435,24 @@ int syscall_trace_enter(struct pt_regs *regs)
/* ptrace might have changed work flags */
flags = read_thread_flags();
+ /*
+ * Ensure ptrace changes to x0 during a regular
syscall-enter-stop
+ * (PTRACE_SYSCALL) are visible to subsequent seccomp trace
+ * and audit checking.
+ */
+ update_syscall_orig_x0_after_ptrace(regs);
}
/* Do the secure computing after ptrace; failures should be fast. */
if (unlikely(flags & _TIF_SECCOMP)) {
if (!__seccomp_permit_syscall())
return NO_SYSCALL;
+
+ /*
+ * Ensure tracer changes to x0 during seccomp ptrace
exit processing
+ * (SECCOMP_RET_TRACE) are visible to audit.
+ */
+ update_syscall_orig_x0_after_ptrace(regs);
}
Author: Jinjie Ruan <ruanjinjie@huawei.com>
Date: Tue Oct 29 19:08:03 2024 +0800
arm64: ptrace: Expand seccomp check in place
Refactor syscall_trace_enter() by open-coding the seccomp check
to align with the generic entry framework. While the original call to
seccomp_permit_syscall() internally re-reads the thread flags and is
therefore safe against flag changes during ptrace stops, the new
open-coded version must explicitly re-read the flags after ptrace
handling to preserve that safety.
[Background]
The generic entry implementation expands the seccomp check in-place
instead of using the seccomp_permit_syscall() wrapper. It directly
tests SYSCALL_WORK_SECCOMP and calls the underlying
__seccomp_permit_syscall() function to handle syscall filtering.
[Changes]
1. After ptrace handling, re-read thread flags:
This ensures that any _TIF_SECCOMP set during the ptrace stop is
observed before the seccomp check.
2. Open-code seccomp check:
- Instead of calling the seccomp_permit_syscall() wrapper, explicitly
check the updated 'flags' parameter for _TIF_SECCOMP.
- Call __seccomp_permit_syscall() directly if the flag is set.
[Why this matters]
- Aligns the arm64 syscall path with the generic entry implementation,
simplifying future migration to the generic entry framework.
- No functional changes are intended; seccomp behavior remains
identical.
The explicit re-read ensures the open-coded version retains the same
safety as the original wrapper, preventing the race condition
described
in the generic entry fix.
- Performance: Non-ptrace fast path avoids atomic test_bit overhead via
cached flags.
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Link:
https://lore.kernel.org/all/20260713025712.416366-1-ruanjinjie@huawei.com/
Reviewed-by: Ada Couprie Diaz <ada.coupriediaz@arm.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 5709e9d3c321..941752656ea6 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -2417,11 +2417,16 @@ int syscall_trace_enter(struct pt_regs *regs)
ret = report_syscall_entry(regs);
if (ret || (flags & _TIF_SYSCALL_EMU))
return NO_SYSCALL;
+
+ /* ptrace might have changed the flags */
+ flags = read_thread_flags();
}
/* Do the secure computing after ptrace; failures should be fast. */
- if (!seccomp_permit_syscall())
- return NO_SYSCALL;
+ if (unlikely(flags & _TIF_SECCOMP)) {
+ if (!__seccomp_permit_syscall())
+ return NO_SYSCALL;
+ }
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
trace_sys_enter(regs, regs->syscallno);
Best regards,
Jinjie
> +
> if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
> trace_sys_enter(regs, regs->syscallno);
>
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-16 2:57 ` Jinjie Ruan
@ 2026-07-16 3:05 ` Kees Cook
2026-07-16 3:25 ` Jinjie Ruan
2026-07-16 11:53 ` Will Deacon
1 sibling, 1 reply; 13+ messages in thread
From: Kees Cook @ 2026-07-16 3:05 UTC (permalink / raw)
To: Jinjie Ruan
Cc: Will Deacon, linux-arm-kernel, linux-kernel, Mark Rutland,
Yiqi Sun, Catalin Marinas
On Thu, Jul 16, 2026 at 10:57:34AM +0800, Jinjie Ruan wrote:
>
>
> On 7/14/2026 10:35 PM, Will Deacon wrote:
> > When seccomp support was originally added to arm64 in a1ae65b21941
> > ("arm64: add seccomp support"), seccomp was erroneously called _before_
> > the ptrace syscall-enter-stop and therefore the tracer could trivially
> > manipulate the syscall register state after the seccomp check had
> > passed. This was subsequently fixed in a5cd110cb836 ("arm64/ptrace: run
> > seccomp after ptrace") by moving the seccomp check after the tracer has
> > run. Unfortunately, a decade later, that fix has been reported to be
> > incomplete.
> >
> > On arm64, both the first argument to a syscall and its eventual return
> > value are allocated to register x0. In order to facilitate syscall
> > restarting and querying of syscall arguments on the syscall exit path,
> > the original value of x0 is stashed in 'struct pt_regs::orig_x0' early
> > during the syscall entry path and is returned for the first argument by
> > syscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not
> > directly exposed via ptrace() and so changes to register x0 made by the
> > tracer on a syscall-enter-stop are not reflected in 'orig_x0'. This
> > means that seccomp and audit can observe a stale value for the register
> > compared to the argument that will be observed by the actual syscall.
> >
> > Re-sync 'orig_x0' from x0 on the syscall entry path following a
> > potential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or
> > SECCOMP_RET_TRACE). This behaviour is limited to native tasks (because
> > compat tasks expose 'orig_r0' to ptrace) where the syscall is not being
> > skipped (because x0 is updated to hold the return value of -ENOSYS in
> > that case).
> >
> > Cc: Kees Cook <kees@kernel.org>
> > Cc: Jinjie Ruan <ruanjinjie@huawei.com>
> > Cc: Mark Rutland <mark.rutland@arm.com>
> > Reported-by: Yiqi Sun <sunyiqixm@gmail.com>
> > Link: https://lore.kernel.org/all/20260529065444.1336608-1-sunyiqixm@gmail.com/
> > Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
> > Fixes: a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace")
> > Signed-off-by: Will Deacon <will@kernel.org>
> > ---
> > arch/arm64/kernel/ptrace.c | 24 ++++++++++++++++++++++++
> > 1 file changed, 24 insertions(+)
> >
> > diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> > index 4d08598e2891..57e8c6714d44 100644
> > --- a/arch/arm64/kernel/ptrace.c
> > +++ b/arch/arm64/kernel/ptrace.c
> > @@ -2408,6 +2408,21 @@ static void report_syscall_exit(struct pt_regs *regs)
> > }
> > }
> >
> > +static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
> > +{
> > + /*
> > + * Keep orig_x0 authoritative so that seccomp (via
> > + * syscall_get_arguments()), audit and the restart path all see the same
> > + * first argument the syscall is dispatched with, even if it has been
> > + * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
> > + * or the tracer), as regs[0] holds the return value (see the comment in
> > + * el0_svc_common()) and can be unwound using syscall_rollback().
> > + * For compat tasks, orig_r0 is provided directly through GPR index 17.
> > + */
> > + if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
> > + regs->orig_x0 = regs->regs[0];
> > +}
> > +
> > int syscall_trace_enter(struct pt_regs *regs)
> > {
> > unsigned long flags = read_thread_flags();
> > @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
> > ret = report_syscall_entry(regs);
> > if (ret || (flags & _TIF_SYSCALL_EMU))
> > return NO_SYSCALL;
> > +
> > + /*
> > + * Ensure ptrace changes to x0 are visible to seccomp
> > + * ptrace exits (SECCOMP_RET_TRACE).
> > + */
> > + update_syscall_orig_x0_after_ptrace(regs);
> > }
> >
> > /* Do the secure computing after ptrace; failures should be fast. */
> > if (secure_computing() == -1)
> > return NO_SYSCALL;
> >
> > + /* Ensure seccomp updates to x0 are visible to audit. */
> > + update_syscall_orig_x0_after_ptrace(regs);
>
>
> Hi, will
>
> I think unconditionally updating orig_x0 here is unnecessary, we could
> Expand seccomp check in place as below the same as generic entry.
>
> In this way, in most cases where seccomp is not used, the overhead of
> updating orig_x0 is eliminated. Moreover, we only need to define an
> architecture-specific version of the seccomp function, thus avoiding the
> pain of switching from arm64 to the generic entry.
>
> So this patch can be like below.
>
> int syscall_trace_enter(struct pt_regs *regs)
> {
> unsigned long flags = read_thread_flags();
> @@ -2420,12 +2435,24 @@ int syscall_trace_enter(struct pt_regs *regs)
>
> /* ptrace might have changed work flags */
> flags = read_thread_flags();
> + /*
> + * Ensure ptrace changes to x0 during a regular
> syscall-enter-stop
> + * (PTRACE_SYSCALL) are visible to subsequent seccomp trace
> + * and audit checking.
> + */
> + update_syscall_orig_x0_after_ptrace(regs);
> }
>
> /* Do the secure computing after ptrace; failures should be fast. */
> if (unlikely(flags & _TIF_SECCOMP)) {
> if (!__seccomp_permit_syscall())
> return NO_SYSCALL;
> +
> + /*
> + * Ensure tracer changes to x0 during seccomp ptrace
> exit processing
> + * (SECCOMP_RET_TRACE) are visible to audit.
> + */
> + update_syscall_orig_x0_after_ptrace(regs);
> }
>
>
> Author: Jinjie Ruan <ruanjinjie@huawei.com>
> Date: Tue Oct 29 19:08:03 2024 +0800
>
> arm64: ptrace: Expand seccomp check in place
>
> Refactor syscall_trace_enter() by open-coding the seccomp check
> to align with the generic entry framework. While the original call to
> seccomp_permit_syscall() internally re-reads the thread flags and is
> therefore safe against flag changes during ptrace stops, the new
> open-coded version must explicitly re-read the flags after ptrace
> handling to preserve that safety.
>
> [Background]
> The generic entry implementation expands the seccomp check in-place
> instead of using the seccomp_permit_syscall() wrapper. It directly
> tests SYSCALL_WORK_SECCOMP and calls the underlying
> __seccomp_permit_syscall() function to handle syscall filtering.
>
> [Changes]
> 1. After ptrace handling, re-read thread flags:
> This ensures that any _TIF_SECCOMP set during the ptrace stop is
> observed before the seccomp check.
>
> 2. Open-code seccomp check:
> - Instead of calling the seccomp_permit_syscall() wrapper, explicitly
> check the updated 'flags' parameter for _TIF_SECCOMP.
> - Call __seccomp_permit_syscall() directly if the flag is set.
>
> [Why this matters]
> - Aligns the arm64 syscall path with the generic entry implementation,
> simplifying future migration to the generic entry framework.
>
> - No functional changes are intended; seccomp behavior remains
> identical.
> The explicit re-read ensures the open-coded version retains the same
> safety as the original wrapper, preventing the race condition
> described
> in the generic entry fix.
>
> - Performance: Non-ptrace fast path avoids atomic test_bit overhead via
> cached flags.
>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Link:
> https://lore.kernel.org/all/20260713025712.416366-1-ruanjinjie@huawei.com/
> Reviewed-by: Ada Couprie Diaz <ada.coupriediaz@arm.com>
> Reviewed-by: Linus Walleij <linusw@kernel.org>
> Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
>
> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> index 5709e9d3c321..941752656ea6 100644
> --- a/arch/arm64/kernel/ptrace.c
> +++ b/arch/arm64/kernel/ptrace.c
> @@ -2417,11 +2417,16 @@ int syscall_trace_enter(struct pt_regs *regs)
> ret = report_syscall_entry(regs);
> if (ret || (flags & _TIF_SYSCALL_EMU))
> return NO_SYSCALL;
> +
> + /* ptrace might have changed the flags */
> + flags = read_thread_flags();
> }
>
> /* Do the secure computing after ptrace; failures should be fast. */
> - if (!seccomp_permit_syscall())
> - return NO_SYSCALL;
> + if (unlikely(flags & _TIF_SECCOMP)) {
> + if (!__seccomp_permit_syscall())
> + return NO_SYSCALL;
> + }
>
> if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
> trace_sys_enter(regs, regs->syscallno);
Do we have a corresponding seccomp_bpf.c selftest we can add for this? I
would really like to have a regression test that would catch this
issue...
-Kees
--
Kees Cook
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-16 3:05 ` Kees Cook
@ 2026-07-16 3:25 ` Jinjie Ruan
0 siblings, 0 replies; 13+ messages in thread
From: Jinjie Ruan @ 2026-07-16 3:25 UTC (permalink / raw)
To: Kees Cook
Cc: Will Deacon, linux-arm-kernel, linux-kernel, Mark Rutland,
Yiqi Sun, Catalin Marinas
On 7/16/2026 11:05 AM, Kees Cook wrote:
> On Thu, Jul 16, 2026 at 10:57:34AM +0800, Jinjie Ruan wrote:
>>
>>
>> On 7/14/2026 10:35 PM, Will Deacon wrote:
>>> When seccomp support was originally added to arm64 in a1ae65b21941
>>> ("arm64: add seccomp support"), seccomp was erroneously called _before_
>>> the ptrace syscall-enter-stop and therefore the tracer could trivially
>>> manipulate the syscall register state after the seccomp check had
>>> passed. This was subsequently fixed in a5cd110cb836 ("arm64/ptrace: run
>>> seccomp after ptrace") by moving the seccomp check after the tracer has
>>> run. Unfortunately, a decade later, that fix has been reported to be
>>> incomplete.
>>>
>>> On arm64, both the first argument to a syscall and its eventual return
>>> value are allocated to register x0. In order to facilitate syscall
>>> restarting and querying of syscall arguments on the syscall exit path,
>>> the original value of x0 is stashed in 'struct pt_regs::orig_x0' early
>>> during the syscall entry path and is returned for the first argument by
>>> syscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not
>>> directly exposed via ptrace() and so changes to register x0 made by the
>>> tracer on a syscall-enter-stop are not reflected in 'orig_x0'. This
>>> means that seccomp and audit can observe a stale value for the register
>>> compared to the argument that will be observed by the actual syscall.
>>>
>>> Re-sync 'orig_x0' from x0 on the syscall entry path following a
>>> potential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or
>>> SECCOMP_RET_TRACE). This behaviour is limited to native tasks (because
>>> compat tasks expose 'orig_r0' to ptrace) where the syscall is not being
>>> skipped (because x0 is updated to hold the return value of -ENOSYS in
>>> that case).
>>>
>>> Cc: Kees Cook <kees@kernel.org>
>>> Cc: Jinjie Ruan <ruanjinjie@huawei.com>
>>> Cc: Mark Rutland <mark.rutland@arm.com>
>>> Reported-by: Yiqi Sun <sunyiqixm@gmail.com>
>>> Link: https://lore.kernel.org/all/20260529065444.1336608-1-sunyiqixm@gmail.com/
>>> Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
>>> Fixes: a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace")
>>> Signed-off-by: Will Deacon <will@kernel.org>
>>> ---
>>> arch/arm64/kernel/ptrace.c | 24 ++++++++++++++++++++++++
>>> 1 file changed, 24 insertions(+)
>>>
>>> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
>>> index 4d08598e2891..57e8c6714d44 100644
>>> --- a/arch/arm64/kernel/ptrace.c
>>> +++ b/arch/arm64/kernel/ptrace.c
>>> @@ -2408,6 +2408,21 @@ static void report_syscall_exit(struct pt_regs *regs)
>>> }
>>> }
>>>
>>> +static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
>>> +{
>>> + /*
>>> + * Keep orig_x0 authoritative so that seccomp (via
>>> + * syscall_get_arguments()), audit and the restart path all see the same
>>> + * first argument the syscall is dispatched with, even if it has been
>>> + * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
>>> + * or the tracer), as regs[0] holds the return value (see the comment in
>>> + * el0_svc_common()) and can be unwound using syscall_rollback().
>>> + * For compat tasks, orig_r0 is provided directly through GPR index 17.
>>> + */
>>> + if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
>>> + regs->orig_x0 = regs->regs[0];
>>> +}
>>> +
>>> int syscall_trace_enter(struct pt_regs *regs)
>>> {
>>> unsigned long flags = read_thread_flags();
>>> @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
>>> ret = report_syscall_entry(regs);
>>> if (ret || (flags & _TIF_SYSCALL_EMU))
>>> return NO_SYSCALL;
>>> +
>>> + /*
>>> + * Ensure ptrace changes to x0 are visible to seccomp
>>> + * ptrace exits (SECCOMP_RET_TRACE).
>>> + */
>>> + update_syscall_orig_x0_after_ptrace(regs);
>>> }
>>>
>>> /* Do the secure computing after ptrace; failures should be fast. */
>>> if (secure_computing() == -1)
>>> return NO_SYSCALL;
>>>
>>> + /* Ensure seccomp updates to x0 are visible to audit. */
>>> + update_syscall_orig_x0_after_ptrace(regs);
>>
>>
>> Hi, will
>>
>> I think unconditionally updating orig_x0 here is unnecessary, we could
>> Expand seccomp check in place as below the same as generic entry.
>>
>> In this way, in most cases where seccomp is not used, the overhead of
>> updating orig_x0 is eliminated. Moreover, we only need to define an
>> architecture-specific version of the seccomp function, thus avoiding the
>> pain of switching from arm64 to the generic entry.
>>
>> So this patch can be like below.
>>
>> int syscall_trace_enter(struct pt_regs *regs)
>> {
>> unsigned long flags = read_thread_flags();
>> @@ -2420,12 +2435,24 @@ int syscall_trace_enter(struct pt_regs *regs)
>>
>> /* ptrace might have changed work flags */
>> flags = read_thread_flags();
>> + /*
>> + * Ensure ptrace changes to x0 during a regular
>> syscall-enter-stop
>> + * (PTRACE_SYSCALL) are visible to subsequent seccomp trace
>> + * and audit checking.
>> + */
>> + update_syscall_orig_x0_after_ptrace(regs);
>> }
>>
>> /* Do the secure computing after ptrace; failures should be fast. */
>> if (unlikely(flags & _TIF_SECCOMP)) {
>> if (!__seccomp_permit_syscall())
>> return NO_SYSCALL;
>> +
>> + /*
>> + * Ensure tracer changes to x0 during seccomp ptrace
>> exit processing
>> + * (SECCOMP_RET_TRACE) are visible to audit.
>> + */
>> + update_syscall_orig_x0_after_ptrace(regs);
>> }
>>
>>
>> Author: Jinjie Ruan <ruanjinjie@huawei.com>
>> Date: Tue Oct 29 19:08:03 2024 +0800
>>
>> arm64: ptrace: Expand seccomp check in place
>>
>> Refactor syscall_trace_enter() by open-coding the seccomp check
>> to align with the generic entry framework. While the original call to
>> seccomp_permit_syscall() internally re-reads the thread flags and is
>> therefore safe against flag changes during ptrace stops, the new
>> open-coded version must explicitly re-read the flags after ptrace
>> handling to preserve that safety.
>>
>> [Background]
>> The generic entry implementation expands the seccomp check in-place
>> instead of using the seccomp_permit_syscall() wrapper. It directly
>> tests SYSCALL_WORK_SECCOMP and calls the underlying
>> __seccomp_permit_syscall() function to handle syscall filtering.
>>
>> [Changes]
>> 1. After ptrace handling, re-read thread flags:
>> This ensures that any _TIF_SECCOMP set during the ptrace stop is
>> observed before the seccomp check.
>>
>> 2. Open-code seccomp check:
>> - Instead of calling the seccomp_permit_syscall() wrapper, explicitly
>> check the updated 'flags' parameter for _TIF_SECCOMP.
>> - Call __seccomp_permit_syscall() directly if the flag is set.
>>
>> [Why this matters]
>> - Aligns the arm64 syscall path with the generic entry implementation,
>> simplifying future migration to the generic entry framework.
>>
>> - No functional changes are intended; seccomp behavior remains
>> identical.
>> The explicit re-read ensures the open-coded version retains the same
>> safety as the original wrapper, preventing the race condition
>> described
>> in the generic entry fix.
>>
>> - Performance: Non-ptrace fast path avoids atomic test_bit overhead via
>> cached flags.
>>
>> Cc: Mark Rutland <mark.rutland@arm.com>
>> Cc: Will Deacon <will@kernel.org>
>> Cc: Catalin Marinas <catalin.marinas@arm.com>
>> Link:
>> https://lore.kernel.org/all/20260713025712.416366-1-ruanjinjie@huawei.com/
>> Reviewed-by: Ada Couprie Diaz <ada.coupriediaz@arm.com>
>> Reviewed-by: Linus Walleij <linusw@kernel.org>
>> Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
>> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
>> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
>>
>> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
>> index 5709e9d3c321..941752656ea6 100644
>> --- a/arch/arm64/kernel/ptrace.c
>> +++ b/arch/arm64/kernel/ptrace.c
>> @@ -2417,11 +2417,16 @@ int syscall_trace_enter(struct pt_regs *regs)
>> ret = report_syscall_entry(regs);
>> if (ret || (flags & _TIF_SYSCALL_EMU))
>> return NO_SYSCALL;
>> +
>> + /* ptrace might have changed the flags */
>> + flags = read_thread_flags();
>> }
>>
>> /* Do the secure computing after ptrace; failures should be fast. */
>> - if (!seccomp_permit_syscall())
>> - return NO_SYSCALL;
>> + if (unlikely(flags & _TIF_SECCOMP)) {
>> + if (!__seccomp_permit_syscall())
>> + return NO_SYSCALL;
>> + }
>>
>> if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>> trace_sys_enter(regs, regs->syscallno);
>
> Do we have a corresponding seccomp_bpf.c selftest we can add for this? I
> would really like to have a regression test that would catch this
> issue...
Hi Kees,
I also believe that we need a test case to prevent functional regression.
I have provided a reproducible case and test results in the link below.
If everyone finds it reasonable, I can modify it into a test case and
submit it.
Link:
https://lore.kernel.org/all/1d55c62e-7c08-4b2b-a009-b770c5ac13bc@huawei.com/
>
> -Kees
>
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-16 2:57 ` Jinjie Ruan
2026-07-16 3:05 ` Kees Cook
@ 2026-07-16 11:53 ` Will Deacon
2026-07-16 12:04 ` Jinjie Ruan
1 sibling, 1 reply; 13+ messages in thread
From: Will Deacon @ 2026-07-16 11:53 UTC (permalink / raw)
To: Jinjie Ruan
Cc: linux-arm-kernel, linux-kernel, Kees Cook, Mark Rutland, Yiqi Sun,
Catalin Marinas
On Thu, Jul 16, 2026 at 10:57:34AM +0800, Jinjie Ruan wrote:
> On 7/14/2026 10:35 PM, Will Deacon wrote:
> > diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> > index 4d08598e2891..57e8c6714d44 100644
> > --- a/arch/arm64/kernel/ptrace.c
> > +++ b/arch/arm64/kernel/ptrace.c
> > @@ -2408,6 +2408,21 @@ static void report_syscall_exit(struct pt_regs *regs)
> > }
> > }
> >
> > +static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
> > +{
> > + /*
> > + * Keep orig_x0 authoritative so that seccomp (via
> > + * syscall_get_arguments()), audit and the restart path all see the same
> > + * first argument the syscall is dispatched with, even if it has been
> > + * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
> > + * or the tracer), as regs[0] holds the return value (see the comment in
> > + * el0_svc_common()) and can be unwound using syscall_rollback().
> > + * For compat tasks, orig_r0 is provided directly through GPR index 17.
> > + */
> > + if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
> > + regs->orig_x0 = regs->regs[0];
> > +}
> > +
> > int syscall_trace_enter(struct pt_regs *regs)
> > {
> > unsigned long flags = read_thread_flags();
> > @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
> > ret = report_syscall_entry(regs);
> > if (ret || (flags & _TIF_SYSCALL_EMU))
> > return NO_SYSCALL;
> > +
> > + /*
> > + * Ensure ptrace changes to x0 are visible to seccomp
> > + * ptrace exits (SECCOMP_RET_TRACE).
> > + */
> > + update_syscall_orig_x0_after_ptrace(regs);
> > }
> >
> > /* Do the secure computing after ptrace; failures should be fast. */
> > if (secure_computing() == -1)
> > return NO_SYSCALL;
> >
> > + /* Ensure seccomp updates to x0 are visible to audit. */
> > + update_syscall_orig_x0_after_ptrace(regs);
>
> I think unconditionally updating orig_x0 here is unnecessary, we could
> Expand seccomp check in place as below the same as generic entry.
Let's leave any micro-optimisations for later, please. We're going to
need to backport this fix _way_ back, so I've been trying to keep it as
simple as possible. You're also going to end up replacing all of this
with the generic entry code, anyway.
I'll send a v2 with the comment changes shortly, then hopefully I can
send it as a fix for stable.
Thanks,
Will
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-16 11:53 ` Will Deacon
@ 2026-07-16 12:04 ` Jinjie Ruan
0 siblings, 0 replies; 13+ messages in thread
From: Jinjie Ruan @ 2026-07-16 12:04 UTC (permalink / raw)
To: Will Deacon
Cc: linux-arm-kernel, linux-kernel, Kees Cook, Mark Rutland, Yiqi Sun,
Catalin Marinas
On 7/16/2026 7:53 PM, Will Deacon wrote:
> On Thu, Jul 16, 2026 at 10:57:34AM +0800, Jinjie Ruan wrote:
>> On 7/14/2026 10:35 PM, Will Deacon wrote:
>>> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
>>> index 4d08598e2891..57e8c6714d44 100644
>>> --- a/arch/arm64/kernel/ptrace.c
>>> +++ b/arch/arm64/kernel/ptrace.c
>>> @@ -2408,6 +2408,21 @@ static void report_syscall_exit(struct pt_regs *regs)
>>> }
>>> }
>>>
>>> +static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
>>> +{
>>> + /*
>>> + * Keep orig_x0 authoritative so that seccomp (via
>>> + * syscall_get_arguments()), audit and the restart path all see the same
>>> + * first argument the syscall is dispatched with, even if it has been
>>> + * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
>>> + * or the tracer), as regs[0] holds the return value (see the comment in
>>> + * el0_svc_common()) and can be unwound using syscall_rollback().
>>> + * For compat tasks, orig_r0 is provided directly through GPR index 17.
>>> + */
>>> + if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
>>> + regs->orig_x0 = regs->regs[0];
>>> +}
>>> +
>>> int syscall_trace_enter(struct pt_regs *regs)
>>> {
>>> unsigned long flags = read_thread_flags();
>>> @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
>>> ret = report_syscall_entry(regs);
>>> if (ret || (flags & _TIF_SYSCALL_EMU))
>>> return NO_SYSCALL;
>>> +
>>> + /*
>>> + * Ensure ptrace changes to x0 are visible to seccomp
>>> + * ptrace exits (SECCOMP_RET_TRACE).
>>> + */
>>> + update_syscall_orig_x0_after_ptrace(regs);
>>> }
>>>
>>> /* Do the secure computing after ptrace; failures should be fast. */
>>> if (secure_computing() == -1)
>>> return NO_SYSCALL;
>>>
>>> + /* Ensure seccomp updates to x0 are visible to audit. */
>>> + update_syscall_orig_x0_after_ptrace(regs);
>>
>> I think unconditionally updating orig_x0 here is unnecessary, we could
>> Expand seccomp check in place as below the same as generic entry.
>
> Let's leave any micro-optimisations for later, please. We're going to
That sounds good. We can make these changes that are not closely related
to this fix when we switch to the generic entry.
> need to backport this fix _way_ back, so I've been trying to keep it as
> simple as possible. You're also going to end up replacing all of this
> with the generic entry code, anyway.
>
> I'll send a v2 with the comment changes shortly, then hopefully I can
> send it as a fix for stable.
Thanks for the update. If v2 comes out, I am happy to help test it again.
>
> Thanks,
>
> Will
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-14 14:35 [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Will Deacon
2026-07-15 11:39 ` Jinjie Ruan
2026-07-16 2:57 ` Jinjie Ruan
@ 2026-08-20 6:54 ` kernel test robot
2026-08-20 11:25 ` kernel test robot
3 siblings, 0 replies; 13+ messages in thread
From: kernel test robot @ 2026-08-20 6:54 UTC (permalink / raw)
To: Will Deacon, linux-arm-kernel
Cc: llvm, oe-kbuild-all, linux-kernel, Will Deacon, Kees Cook,
Jinjie Ruan, Mark Rutland, Yiqi Sun, Catalin Marinas
Hi Will,
kernel test robot noticed the following build errors:
[auto build test ERROR on linux-review/Yiqi-Sun/arm64-ptrace-use-live-x0-for-seccomp-and-audit-after-ptrace/20260815-210721]
url: https://github.com/intel-lab-lkp/linux/commits/Will-Deacon/arm64-syscall-Ensure-saved-x0-is-kept-in-sync-with-tracer-updates/20260815-220235
base: https://github.com/intel-lab-lkp/linux Yiqi-Sun/arm64-ptrace-use-live-x0-for-seccomp-and-audit-after-ptrace/20260815-210721
patch link: https://lore.kernel.org/r/20260714143600.23853-1-will%40kernel.org
patch subject: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
config: arm64-randconfig-001-20260820 (https://download.01.org/0day-ci/archive/20260820/202608201418.4wnOzo3P-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 935bfc708590c60147a79c7df145bb6e68b1d388)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260820/202608201418.4wnOzo3P-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608201418.4wnOzo3P-lkp@intel.com/
All errors (new ones prefixed by >>):
>> arch/arm64/kernel/ptrace.c:2461:13: error: conflicting types for 'update_syscall_orig_x0_after_ptrace'
2461 | static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
| ^
arch/arm64/kernel/ptrace.c:563:13: note: previous definition is here
563 | static void update_syscall_orig_x0_after_ptrace(struct task_struct *target)
| ^
>> arch/arm64/kernel/ptrace.c:2490:39: error: incompatible pointer types passing 'struct pt_regs *' to parameter of type 'struct task_struct *' [-Wincompatible-pointer-types]
2490 | update_syscall_orig_x0_after_ptrace(regs);
| ^~~~
arch/arm64/kernel/ptrace.c:563:69: note: passing argument to parameter 'target' here
563 | static void update_syscall_orig_x0_after_ptrace(struct task_struct *target)
| ^
arch/arm64/kernel/ptrace.c:2498:38: error: incompatible pointer types passing 'struct pt_regs *' to parameter of type 'struct task_struct *' [-Wincompatible-pointer-types]
2498 | update_syscall_orig_x0_after_ptrace(regs);
| ^~~~
arch/arm64/kernel/ptrace.c:563:69: note: passing argument to parameter 'target' here
563 | static void update_syscall_orig_x0_after_ptrace(struct task_struct *target)
| ^
3 errors generated.
vim +/update_syscall_orig_x0_after_ptrace +2461 arch/arm64/kernel/ptrace.c
2460
> 2461 static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
2462 {
2463 /*
2464 * Keep orig_x0 authoritative so that seccomp (via
2465 * syscall_get_arguments()), audit and the restart path all see the same
2466 * first argument the syscall is dispatched with, even if it has been
2467 * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
2468 * or the tracer), as regs[0] holds the return value (see the comment in
2469 * el0_svc_common()) and can be unwound using syscall_rollback().
2470 * For compat tasks, orig_r0 is provided directly through GPR index 17.
2471 */
2472 if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
2473 regs->orig_x0 = regs->regs[0];
2474 }
2475
2476 int syscall_trace_enter(struct pt_regs *regs)
2477 {
2478 unsigned long flags = read_thread_flags();
2479 int ret;
2480
2481 if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
2482 ret = report_syscall_entry(regs);
2483 if (ret || (flags & _TIF_SYSCALL_EMU))
2484 return NO_SYSCALL;
2485
2486 /*
2487 * Ensure ptrace changes to x0 are visible to seccomp
2488 * ptrace exits (SECCOMP_RET_TRACE).
2489 */
> 2490 update_syscall_orig_x0_after_ptrace(regs);
2491 }
2492
2493 /* Do the secure computing after ptrace; failures should be fast. */
2494 if (secure_computing() == -1)
2495 return NO_SYSCALL;
2496
2497 /* Ensure seccomp updates to x0 are visible to audit. */
2498 update_syscall_orig_x0_after_ptrace(regs);
2499
2500 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
2501 trace_sys_enter(regs, regs->syscallno);
2502
2503 audit_syscall_entry(regs->syscallno, regs->regs[0], regs->regs[1],
2504 regs->regs[2], regs->regs[3]);
2505
2506 return regs->syscallno;
2507 }
2508
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
2026-07-14 14:35 [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Will Deacon
` (2 preceding siblings ...)
2026-08-20 6:54 ` kernel test robot
@ 2026-08-20 11:25 ` kernel test robot
3 siblings, 0 replies; 13+ messages in thread
From: kernel test robot @ 2026-08-20 11:25 UTC (permalink / raw)
To: Will Deacon, linux-arm-kernel
Cc: oe-kbuild-all, linux-kernel, Will Deacon, Kees Cook, Jinjie Ruan,
Mark Rutland, Yiqi Sun, Catalin Marinas
Hi Will,
kernel test robot noticed the following build errors:
[auto build test ERROR on linux-review/Yiqi-Sun/arm64-ptrace-use-live-x0-for-seccomp-and-audit-after-ptrace/20260815-210721]
url: https://github.com/intel-lab-lkp/linux/commits/Will-Deacon/arm64-syscall-Ensure-saved-x0-is-kept-in-sync-with-tracer-updates/20260815-220235
base: https://github.com/intel-lab-lkp/linux Yiqi-Sun/arm64-ptrace-use-live-x0-for-seccomp-and-audit-after-ptrace/20260815-210721
patch link: https://lore.kernel.org/r/20260714143600.23853-1-will%40kernel.org
patch subject: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
config: arm64-randconfig-001 (https://download.01.org/0day-ci/archive/20260820/202608201957.jszjEpsE-lkp@intel.com/config)
compiler: aarch64-linux-gcc (GCC) 14.3.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260820/202608201957.jszjEpsE-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608201957.jszjEpsE-lkp@intel.com/
All errors (new ones prefixed by >>):
>> arch/arm64/kernel/ptrace.c:2461:13: error: conflicting types for 'update_syscall_orig_x0_after_ptrace'; have 'void(struct pt_regs *)'
2461 | static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/arm64/kernel/ptrace.c:563:13: note: previous definition of 'update_syscall_orig_x0_after_ptrace' with type 'void(struct task_struct *)'
563 | static void update_syscall_orig_x0_after_ptrace(struct task_struct *target)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +2461 arch/arm64/kernel/ptrace.c
2460
> 2461 static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
2462 {
2463 /*
2464 * Keep orig_x0 authoritative so that seccomp (via
2465 * syscall_get_arguments()), audit and the restart path all see the same
2466 * first argument the syscall is dispatched with, even if it has been
2467 * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
2468 * or the tracer), as regs[0] holds the return value (see the comment in
2469 * el0_svc_common()) and can be unwound using syscall_rollback().
2470 * For compat tasks, orig_r0 is provided directly through GPR index 17.
2471 */
2472 if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
2473 regs->orig_x0 = regs->regs[0];
2474 }
2475
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 13+ messages in thread