Re: Regression: audit: x86: drop arch from __audit_syscall_entry() interface

[Richard Guy Briggs <rgb@redhat.com>]

On 14/10/22, Andy Lutomirski wrote:
> On 10/22/2014 11:23 AM, Eric Paris wrote:
> > That's really serious.  Looking now.
> > 
> > On Wed, 2014-10-22 at 16:08 -0200, Paulo Zanoni wrote:
> >> Hi
> >>
> >> (Cc'ing everybody mentioned in the original patch)
> >>
> >> I work for Intel, on our Linux Graphics driver - aka i915.ko - and our
> >> QA team recently reported a regression on:
> >>
> >> commit b4f0d3755c5e9cc86292d5fd78261903b4f23d4a
> >> Author: Richard Guy Briggs
> >> Date:   Tue Mar 4 10:38:06 2014 -0500
> >>     audit: x86: drop arch from __audit_syscall_entry() interface
> >>
> >> According to our QA, their i386 machine doesn't boot anymore. I tried
> >> to write my own revert for the patch, asked QA to test, and they
> >> confirmed it "solves" the problem.
> >>
> >> Here are the details of QA' s bug report:
> >> https://bugs.freedesktop.org/show_bug.cgi?id=85277 .
> >>
> >> The trees our QA tests are the development trees from i915.ko:
> >> http://cgit.freedesktop.org/drm-intel?h=drm-intel-fixes .
> >>
> >> I tried searching for other bug reports on the same patch, but
> >> couldn't find any. Forgive me if this bug was already reported.
> >>
> >> Feel free to continue this discussion on the bugzilla report if you want.
> 
> This piece:
> 
> 	movl %esi,4(%esp)		/* 5th arg: 4th syscall arg */
> 	movl %edx,(%esp)		/* 4th arg: 3rd syscall arg */
> 
> looks like it's overwriting syscall arguments.
> 
> This is clearly fixable, but an even better fix would be to drop the asm
> entirely and switch to two-phase tracing.  Want to do it?  I can test
> the seccomp bits if you switch over the asm :)

Like what you did for x86_64.  That sounds worth investigating.

I'll have a look at the asm, but I'm being distracted by a gunman loose
2km from me and my wife and kids under lockdown in two different
locations on the other side of the shooting site.  Had to cancel lunch
today with two work colleagues 1/2km away from that site.  ...not been a
productive day.

> --Andy

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545