Re: Regression: audit: x86: drop arch from __audit_syscall_entry() interface

[Andy Lutomirski <luto@amacapital.net>]

On 10/22/2014 11:23 AM, Eric Paris wrote:
> That's really serious.  Looking now.
> 
> On Wed, 2014-10-22 at 16:08 -0200, Paulo Zanoni wrote:
>> Hi
>>
>> (Cc'ing everybody mentioned in the original patch)
>>
>> I work for Intel, on our Linux Graphics driver - aka i915.ko - and our
>> QA team recently reported a regression on:
>>
>> commit b4f0d3755c5e9cc86292d5fd78261903b4f23d4a
>> Author: Richard Guy Briggs
>> Date:   Tue Mar 4 10:38:06 2014 -0500
>>     audit: x86: drop arch from __audit_syscall_entry() interface
>>
>> According to our QA, their i386 machine doesn't boot anymore. I tried
>> to write my own revert for the patch, asked QA to test, and they
>> confirmed it "solves" the problem.
>>
>> Here are the details of QA' s bug report:
>> https://bugs.freedesktop.org/show_bug.cgi?id=85277 .
>>
>> The trees our QA tests are the development trees from i915.ko:
>> http://cgit.freedesktop.org/drm-intel?h=drm-intel-fixes .
>>
>> I tried searching for other bug reports on the same patch, but
>> couldn't find any. Forgive me if this bug was already reported.
>>
>> Feel free to continue this discussion on the bugzilla report if you want.

This piece:

	movl %esi,4(%esp)		/* 5th arg: 4th syscall arg */
	movl %edx,(%esp)		/* 4th arg: 3rd syscall arg */

looks like it's overwriting syscall arguments.

This is clearly fixable, but an even better fix would be to drop the asm
entirely and switch to two-phase tracing.  Want to do it?  I can test
the seccomp bits if you switch over the asm :)

--Andy