Re: [PATCH 01/13] audit: log all six syscall arguments in the SYSCALL record

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch changes the signature of `audit_syscall_entry()` and `__audit_syscall_entry()` to require 7 arguments instead of 5, but fails to update direct callers in architectures not using the generic entry code (e.g., ARM, ARM64, MIPS, PowerPC). This mismatch results in widespread "too few arguments to function" compilation errors.
--

--- Patch [1]: [PATCH 01/13] audit: log all six syscall arguments in the SYSCALL record ---
commit 078f116f3b4c24869c2f9f6df42833c2c348b962
Author: Ricardo Robaina <rrobaina@redhat.com>

audit: log all six syscall arguments in the SYSCALL record

This patch extends the SYSCALL audit record to log all six syscall arguments,
adding arguments a4 and a5 inline within the existing record. It updates the
audit_syscall_entry() function signature to accommodate these new parameters.

Link: https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dX4Ah11RVhdyCBUQ@mail.gmail.com/T/#t

> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 803b0183d98dd..5c3486dd691f6 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
[ ... ]
> @@ -375,10 +376,11 @@ static inline void audit_uring_exit(int success, long code)
>  }
>  static inline void audit_syscall_entry(int major, unsigned long a0,
>  				       unsigned long a1, unsigned long a2,
> -				       unsigned long a3)
> +				       unsigned long a3, unsigned long a4,
> +				       unsigned long a5)

[Severity: Low]
Will this break the build for architectures that do not use the generic entry
code?

For example, looking at arch/arm/kernel/ptrace.c:syscall_trace_enter(), it
still calls this function with only five arguments:

	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
			    regs->ARM_r3);

Similarly, arch/arm64/kernel/ptrace.c:syscall_trace_enter() and
arch/powerpc/kernel/ptrace/ptrace.c:do_syscall_trace_enter() also appear
to call audit_syscall_entry() without the newly required arguments.

Should these architecture-specific callers be updated as well to prevent
"too few arguments to function" compilation errors?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786626275.git.rrobaina@redhat.com?part=1