Re: [PATCH] x86/entry: Fix ptrace regression

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] x86/entry: missing nr != -1L check in do_syscall_32_irqs_on()
--

commit 99103a6b0e601cd2293cec25712d5b3e23db9efc
Author: Thomas Gleixner <tglx@kernel.org>

x86/entry: Fix ptrace regression

This commit restores the historical syscall entry behavior of preserving
tracer modifications to regs->ax when a syscall is aborted with -1L while
overwriting regs->ax with -ENOSYS when the syscall number is rewritten to an
invalid value.

Closes: https://lore.kernel.org/all/20261022142425.3Wx-RrU5@linutronix.de

> diff --git a/arch/x86/entry/syscall_32.c b/arch/x86/entry/syscall_32.c
> index a59509bb460ab..1f91444d01a8e 100644
> --- a/arch/x86/entry/syscall_32.c
> +++ b/arch/x86/entry/syscall_32.c
> @@ -77,6 +77,8 @@ static __always_inline void do_syscall_32_irqs_on(struct pt_regs *regs, unsigned
>  	if (likely(nr < IA32_NR_syscalls)) {
>  		nr = array_index_nospec(nr, IA32_NR_syscalls);
>  		regs->ax = ia32_sys_call(regs, (unsigned int)nr);
> +	} else {
> +		regs->ax = -ENOSYS;
>  	}
>  }

[Severity: High]
Should the else branch in do_syscall_32_irqs_on() in
arch/x86/entry/syscall_32.c also check that nr != -1L before setting
regs->ax = -ENOSYS, matching the check added to do_syscall_64() in
arch/x86/entry/syscall_64.c and the logic prior to commit 1b1f3b3e1b39
("x86/entry: Get rid of the sys_ni_syscall() indirection")?

When a 32-bit syscall (entered via do_int80_emulation(),
fred_int80_emulation(), do_int80_syscall_32(), or __do_fast_syscall_32()) is
traced with PTRACE_SYSCALL without SYSCALL_WORK_SYSCALL_EMU,
syscall_enter_from_user_mode_work() runs:

include/linux/entry-common.h:syscall_enter_from_user_mode_work() {
    ...
	if (unlikely(!syscall_trace_enter(regs, work, *syscall)))
		return false;

	/* Reread the syscall number as it might have been modified */
	*syscall = syscall_get_nr(current, regs);

	return true;
}

If the tracer aborts the syscall at the syscall-entry stop by setting
orig_ax to -1 and writing a return value into regs->ax,
syscall_trace_enter() -> arch_ptrace_report_syscall_permit_entry() ->
ptrace_report_syscall_permit_entry() returns true (unless a fatal signal is
pending). syscall_enter_from_user_mode_work() then updates *syscall to -1L
and returns true.

The caller then passes nr == (unsigned long)-1L into
do_syscall_32_irqs_on(), where nr < IA32_NR_syscalls is false and the
unconditional else branch overwrites the tracer-supplied regs->ax value with
-ENOSYS.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/87mrrvxaty.ffs@fw13?part=1