From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: Regression: audit: x86: drop arch from __audit_syscall_entry() interface Date: Wed, 22 Oct 2014 12:01:36 -0700 Message-ID: <5447FF10.3060506@amacapital.net> References: <1414002190.30946.95.camel@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-pa0-f48.google.com (mail-pa0-f48.google.com [209.85.220.48]) by gabe.freedesktop.org (Postfix) with ESMTP id 41C9E6E369 for ; Wed, 22 Oct 2014 12:01:40 -0700 (PDT) Received: by mail-pa0-f48.google.com with SMTP id ey11so2269093pad.35 for ; Wed, 22 Oct 2014 12:01:39 -0700 (PDT) In-Reply-To: <1414002190.30946.95.camel@localhost> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" To: Eric Paris , Paulo Zanoni Cc: Richard Guy Briggs , Intel Graphics Development , x86@kernel.org, "linux-kernel@vger.kernel.org" , linux-audit@redhat.com, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar List-Id: intel-gfx@lists.freedesktop.org On 10/22/2014 11:23 AM, Eric Paris wrote: > That's really serious. Looking now. > > On Wed, 2014-10-22 at 16:08 -0200, Paulo Zanoni wrote: >> Hi >> >> (Cc'ing everybody mentioned in the original patch) >> >> I work for Intel, on our Linux Graphics driver - aka i915.ko - and our >> QA team recently reported a regression on: >> >> commit b4f0d3755c5e9cc86292d5fd78261903b4f23d4a >> Author: Richard Guy Briggs >> Date: Tue Mar 4 10:38:06 2014 -0500 >> audit: x86: drop arch from __audit_syscall_entry() interface >> >> According to our QA, their i386 machine doesn't boot anymore. I tried >> to write my own revert for the patch, asked QA to test, and they >> confirmed it "solves" the problem. >> >> Here are the details of QA' s bug report: >> https://bugs.freedesktop.org/show_bug.cgi?id=85277 . >> >> The trees our QA tests are the development trees from i915.ko: >> http://cgit.freedesktop.org/drm-intel?h=drm-intel-fixes . >> >> I tried searching for other bug reports on the same patch, but >> couldn't find any. Forgive me if this bug was already reported. >> >> Feel free to continue this discussion on the bugzilla report if you want. This piece: movl %esi,4(%esp) /* 5th arg: 4th syscall arg */ movl %edx,(%esp) /* 4th arg: 3rd syscall arg */ looks like it's overwriting syscall arguments. This is clearly fixable, but an even better fix would be to drop the asm entirely and switch to two-phase tracing. Want to do it? I can test the seccomp bits if you switch over the asm :) --Andy