From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: Audit not recording the correct syscall return value in Fedora 10? Date: Tue, 5 May 2009 15:50:01 -0400 Message-ID: <200905051550.01946.paul.moore@hp.com> References: <200904071134.35379.paul.moore@hp.com> <200905051520.52317.paul.moore@hp.com> <20090505193443.GA20428@suse.de> Mime-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n45JoM8w032318 for ; Tue, 5 May 2009 15:50:22 -0400 Received: from g4t0017.houston.hp.com (g4t0017.houston.hp.com [15.201.24.20]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n45Jo5Kt027950 for ; Tue, 5 May 2009 15:50:05 -0400 In-Reply-To: <20090505193443.GA20428@suse.de> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Tony Jones Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 05 May 2009 03:34:43 pm Tony Jones wrote: > On Tue, May 05, 2009 at 03:20:52PM -0400, Paul Moore wrote: > > On Tuesday 05 May 2009 03:07:36 pm Tony Jones wrote: > > > On Tue, May 05, 2009 at 02:22:04PM -0400, Paul Moore wrote: > > > > I believe Matt Anderson (CC'd) reported the bug you are referring to > > > > and the workaround I posted seemed to fix the issue for him. I've > > > > stopped looking > > > > > > I'll check it out, I see the commit: > > > 6d208da89aabee8502debe842832ca0ab298d16d > > > > Well, that commit does solve a return value problem on 64 bit systems but > > it isn't the workaround I was referring to ... the mail which I sent that > > started this thread (April 7, 2009) has a small patch to > > arch/x86/kernel/entry_64.S to load the return value directly from the > > stack and not %rax to workaround the corruption issue. > > Sorry, my bad. I went back to grab the code snippet to check if it was in > git put pulled it from your earlier (Apr 1) thread by mistake. That said, I > think it's the issue I'm seeing on x86_64 but I'll try the calling sequence > fix also. > > So what is the status of the entry_64.S fix? Did discussion go beyond this > list? > > Apologies for the confusion. No problem. As far as I'm aware the discussion never went beyond this thread as I was unable to recreate the problem with the (then) current kernels but it may not be a bad idea to get the arch folks and perhaps lkml involved if we can narrow this down a little. -- paul moore linux @ hp