From: Kevin Brodsky <kevin.brodsky@arm.com>
To: Jinjie Ruan <ruanjinjie@huawei.com>, Will Deacon <will@kernel.org>
Cc: mark.rutland@arm.com, peterz@infradead.org,
catalin.marinas@arm.com, ldv@strace.io, song@kernel.org,
linux-kselftest@vger.kernel.org, shuah@kernel.org,
kees@kernel.org, linux-arm-kernel@lists.infradead.org,
kmal@cock.li, thuth@redhat.com, ryan.roberts@arm.com,
anshuman.khandual@arm.com, charlie@rivosinc.com,
pengcan@kylinos.cn, broonie@kernel.org, luto@kernel.org,
tglx@linutronix.de, richard.weiyang@gmail.com,
dvyukov@google.com, wad@chromium.org, oleg@redhat.com,
linux-kernel@vger.kernel.org, liqiang01@kylinos.cn,
akpm@linux-foundation.org, reddybalavignesh9979@gmail.com,
macro@orcam.me.uk
Subject: Re: [PATCH v10 05/16] arm64: ptrace: Move rseq_syscall() before audit_syscall_exit()
Date: Tue, 27 Jan 2026 16:06:58 +0100 [thread overview]
Message-ID: <0f6212c1-7034-42f4-ba77-10e9ec52a4f5@arm.com> (raw)
In-Reply-To: <4891191c-d1c3-6985-c2ea-1b29deb8abe1@huawei.com>
On 27/01/2026 12:34, Jinjie Ruan wrote:
>> [...]
>>
>>> I'm also concerned that rseq_debug_update_user_cs()
>>> operates on instruction_pointer(regs) which is something that can be
>>> chaned by ptrace.
>> Isn't that true regardless of where rseq_syscall() is called on the
>> syscall exit path, though?
> My understanding is that if instruction_pointer(regs) is hijacked and
> modified via ptrace at the syscall exit (ptrace_report_syscall_exit()),
> this modification will not be observed by rseq. Specifically, in the
> generic entry syscall exit path, rseq_syscall() is unable to detect such
> a PC modification.
Good point. So concretely that means that currently on arm64, one could
make the rseq debug check pass/fail by using the syscall exit trap to
modify PC. OTOH this is impossible with generic entry because the rseq
check is performed first. I'm not sure this is a feature anyone has even
noticed, but it is a user-visible change indeed.
- Kevin
next prev parent reply other threads:[~2026-01-27 15:07 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-22 11:47 [PATCH v10 00/16] arm64: entry: Convert to Generic Entry Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 01/16] arm64: Remove unused _TIF_WORK_MASK Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 02/16] arm64/ptrace: Split report_syscall() Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 03/16] arm64/ptrace: Return early for ptrace_report_syscall_entry() error Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 04/16] arm64/ptrace: Refactor syscall_trace_enter/exit() Jinjie Ruan
2026-01-26 16:42 ` Will Deacon
2026-01-27 3:01 ` Jinjie Ruan
2026-01-27 9:43 ` Kevin Brodsky
2026-01-27 11:02 ` Jinjie Ruan
2026-01-27 14:54 ` Kevin Brodsky
2025-12-22 11:47 ` [PATCH v10 05/16] arm64: ptrace: Move rseq_syscall() before audit_syscall_exit() Jinjie Ruan
2026-01-26 19:02 ` Will Deacon
2026-01-27 9:44 ` Kevin Brodsky
2026-01-27 11:34 ` Jinjie Ruan
2026-01-27 15:06 ` Kevin Brodsky [this message]
2026-01-28 1:09 ` Jinjie Ruan
2026-01-28 14:53 ` Kevin Brodsky
2026-01-29 3:50 ` Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 06/16] arm64: syscall: Rework el0_svc_common() Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 07/16] arm64/ptrace: Not check _TIF_SECCOMP/SYSCALL_EMU for syscall_exit_work() Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 08/16] arm64/ptrace: Do not report_syscall_exit() for PTRACE_SYSEMU_SINGLESTEP Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 09/16] arm64/ptrace: Expand secure_computing() in place Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 10/16] arm64/ptrace: Use syscall_get_arguments() helper Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 11/16] entry: Split syscall_exit_to_user_mode_work() for arch reuse Jinjie Ruan
2025-12-29 18:03 ` Kevin Brodsky
2025-12-31 1:35 ` Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 12/16] entry: Add arch_ptrace_report_syscall_entry/exit() Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 13/16] arm64: entry: Convert to generic entry Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 14/16] arm64: Inline el0_svc_common() Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 15/16] entry: Inline syscall_exit_work() and syscall_trace_enter() Jinjie Ruan
2025-12-22 11:47 ` [PATCH v10 16/16] selftests: sud_test: Support aarch64 Jinjie Ruan
2026-01-19 2:02 ` [PATCH v10 00/16] arm64: entry: Convert to Generic Entry Jinjie Ruan
2026-01-27 11:39 ` Will Deacon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0f6212c1-7034-42f4-ba77-10e9ec52a4f5@arm.com \
--to=kevin.brodsky@arm.com \
--cc=akpm@linux-foundation.org \
--cc=anshuman.khandual@arm.com \
--cc=broonie@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=charlie@rivosinc.com \
--cc=dvyukov@google.com \
--cc=kees@kernel.org \
--cc=kmal@cock.li \
--cc=ldv@strace.io \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=liqiang01@kylinos.cn \
--cc=luto@kernel.org \
--cc=macro@orcam.me.uk \
--cc=mark.rutland@arm.com \
--cc=oleg@redhat.com \
--cc=pengcan@kylinos.cn \
--cc=peterz@infradead.org \
--cc=reddybalavignesh9979@gmail.com \
--cc=richard.weiyang@gmail.com \
--cc=ruanjinjie@huawei.com \
--cc=ryan.roberts@arm.com \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=tglx@linutronix.de \
--cc=thuth@redhat.com \
--cc=wad@chromium.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox