Re: [PATCH v2 09/13] parisc: pass pt_regs to audit_syscall_entry()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Removal of explicit 32-bit masking for compat syscall arguments allows a ptracer to bypass audit filters and leaks upper 32 bits into audit logs.

Pre-existing issues:
- [High] Seccomp evaluates unmasked 64-bit register values for 32-bit compat tasks, allowing bypass of reject filters.
--

commit 78cafbbd76943b4c2f06e1817363e637bd633afe
Author: Ricardo Robaina <rrobaina@redhat.com>

parisc: pass pt_regs to audit_syscall_entry()

This commit changes audit_syscall_entry() to take a pointer to pt_regs
and extract the syscall arguments itself via syscall_get_arguments(). The
individual argument registers are dropped from the call.

> diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
> index 1d9e210702e1f..948e0cf29ba47 100644
> --- a/arch/parisc/kernel/ptrace.c
> +++ b/arch/parisc/kernel/ptrace.c

[ ... ]

> @@ -359,15 +359,10 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_64BIT
>  	if (!is_compat_task())
> -		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
> -				    regs->gr[24], regs->gr[23]);
> +		audit_syscall_entry(regs->gr[20], regs);
>  	else
>  #endif
> -		audit_syscall_entry(regs->gr[20] & 0xffffffff,
> -			regs->gr[26] & 0xffffffff,
> -			regs->gr[25] & 0xffffffff,
> -			regs->gr[24] & 0xffffffff,
> -			regs->gr[23] & 0xffffffff);
> +		audit_syscall_entry(regs->gr[20] & 0xffffffff, regs);

[Severity: High]
Does removing the explicit 32-bit masking for compat syscall arguments allow
a ptracer to bypass audit filters?

Since audit_syscall_entry() now uses syscall_get_arguments() internally to
extract the registers, and syscall_get_arguments() does not truncate the
arguments to 32 bits on PARISC:

arch/parisc/include/asm/syscall.h:syscall_get_arguments() {
	args[5] = regs->gr[21];
	args[4] = regs->gr[22];
	args[3] = regs->gr[23];
	args[2] = regs->gr[24];
	args[1] = regs->gr[25];
	args[0] = regs->gr[26];
}

An attacker in a 32-bit compat task could manipulate the upper 32 bits of
syscall argument registers via ptrace. Audit would evaluate the unmasked
64-bit values, while the syscall wrapper would truncate them to 32 bits,
potentially leading to an evasion of security audit logging.

[Severity: High]
This is a pre-existing issue, but does Seccomp also evaluate unmasked 64-bit
register values for 32-bit compat tasks on PARISC?

Seccomp relies on syscall_get_arguments() in populate_seccomp_data():

kernel/seccomp.c:populate_seccomp_data() {
	...
	syscall_get_arguments(task, regs, args);
	sd->args[0] = args[0];
	sd->args[1] = args[1];
	...
}

Because syscall_get_arguments() does not mask the upper 32 bits for compat
tasks, could an attacker bypass Seccomp reject filters by injecting 64-bit
values with garbage in the upper 32 bits before Seccomp evaluates them?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1788351089.git.rrobaina@redhat.com?part=9