From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1EB0FC433B4 for ; Fri, 23 Apr 2021 10:51:31 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6988861452 for ; Fri, 23 Apr 2021 10:51:30 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6988861452 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=windriver.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=linux-audit-bounces@redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-318-MjVsRYBBMVCL3WWC6Em4qg-1; Fri, 23 Apr 2021 06:51:27 -0400 X-MC-Unique: MjVsRYBBMVCL3WWC6Em4qg-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id DA1F110054F6; Fri, 23 Apr 2021 10:51:23 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 839B55C5FD; Fri, 23 Apr 2021 10:51:22 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id E0B6B1806D1A; Fri, 23 Apr 2021 10:51:20 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 13NAa8fw003923 for ; Fri, 23 Apr 2021 06:36:08 -0400 Received: by smtp.corp.redhat.com (Postfix) id 918AB11301EC; Fri, 23 Apr 2021 10:36:08 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast06.extmail.prod.ext.rdu2.redhat.com [10.11.55.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 8BD3911301DC for ; Fri, 23 Apr 2021 10:36:08 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 6E65B183B3C0 for ; Fri, 23 Apr 2021 10:36:08 +0000 (UTC) Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2073.outbound.protection.outlook.com [40.107.237.73]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-43-GRAYIIOdOkSUcvs5o82z1w-1; Fri, 23 Apr 2021 06:36:03 -0400 X-MC-Unique: GRAYIIOdOkSUcvs5o82z1w-1 Received: from MWHPR1101MB2351.namprd11.prod.outlook.com (2603:10b6:300:74::18) by MWHPR1101MB2192.namprd11.prod.outlook.com (2603:10b6:301:59::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4065.23; Fri, 23 Apr 2021 10:36:01 +0000 Received: from MWHPR1101MB2351.namprd11.prod.outlook.com ([fe80::c156:455d:860e:ba87]) by MWHPR1101MB2351.namprd11.prod.outlook.com ([fe80::c156:455d:860e:ba87%4]) with mapi id 15.20.4065.024; Fri, 23 Apr 2021 10:36:01 +0000 From: He Zhe To: oleg@redhat.com, catalin.marinas@arm.com, will@kernel.org, linux-arm-kernel@lists.infradead.org, paul@paul-moore.com, eparis@redhat.com, linux-audit@redhat.com, linux-kernel@vger.kernel.org, zhe.he@windriver.com Subject: [PATCH v2 3/3] audit: Use syscall_get_return_value to get syscall return code in audit_syscall_exit Date: Fri, 23 Apr 2021 18:35:33 +0800 Message-Id: <20210423103533.30121-3-zhe.he@windriver.com> In-Reply-To: <20210423103533.30121-1-zhe.he@windriver.com> References: <20210423103533.30121-1-zhe.he@windriver.com> X-Originating-IP: [60.247.85.82] X-ClientProxiedBy: CY4PR19CA0041.namprd19.prod.outlook.com (2603:10b6:903:103::27) To MWHPR1101MB2351.namprd11.prod.outlook.com (2603:10b6:300:74::18) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from pek-lpg-core2.corp.ad.wrs.com (60.247.85.82) by CY4PR19CA0041.namprd19.prod.outlook.com (2603:10b6:903:103::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4065.21 via Frontend Transport; Fri, 23 Apr 2021 10:35:58 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 921bf59d-fabe-4092-ba5c-08d9064396bf X-MS-TrafficTypeDiagnostic: MWHPR1101MB2192: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0 X-Microsoft-Antispam-Message-Info: Is8jUvCqnbR3C9XWtNccKw6oF0RlgPFOn28/74fbuAaEtvBE4e+igvMMebr4MF5wb+GxTf/Nkz/nLvieNImGPye+hzfFz0oyKZhmCYJsWzx1lKqHukMfeZLtm2BSva0pL5F1zfrUD0kqah4iH6VLd2a334L40NT39++6hJtPbNn0Up7xrSKHkkKHHrbDuFW7ZiPnWfjiO+kOehvn1MhnMsQXnLoc5/v5UoyycqKMjb7+C4s36BHmeERvgqL6dOXXzJ62/Gh1uV7Ax61JqKz+l1Oi1tfjAKLqNvQlcsO+3wvBW3NTJq9JbC4SxLjYBPZN5f8tjgUwrwkbO1XwzMw0+idYriXPTr+BkeFtn6JsPEHNYNNNLjfjgPehWRIHaZONH3hJkXoyxe+Dmqbhy3TtSJrSbYwzueq+lrQ8TZRtgIH1GlsqcglxbHWpUW1EZk7J/j7EGUjit/f4xyunW2BkNuBsbVEbz+BlsbC9x7jfGED0STk2VqtSYZ/Ccetn3i8RPyBQeQHlt/kVTMJNmMi85/PrO5X+gAECJf34Ax2gPcWmRVAwl/dlIiiuY1EGOvNY213rdXDIghCyvETtquoISzVBu9M+OjWoTXuD0UpG9TpLOgnvEVVA6lLAmg2LubQZQghosT8yeQmTsJ9jMKOVWg== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MWHPR1101MB2351.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(346002)(376002)(39850400004)(396003)(136003)(366004)(52116002)(38100700002)(86362001)(38350700002)(8676002)(6486002)(8936002)(6512007)(26005)(186003)(16526019)(316002)(6666004)(1076003)(6506007)(478600001)(2906002)(5660300002)(66946007)(2616005)(83380400001)(956004)(66476007)(66556008)(36756003); DIR:OUT; SFP:1101 X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?07XBfvUSdKahtoPPECYmjAYmn9mBZ3ptoxBx0YSoMXAygONKBKjxutZyjH1Q?= =?us-ascii?Q?eQKOgfGz49vQ6aLW1fJGPPS5e41WlCpXYBezFj8wYEQbb4bDdNHjVJj4VKnU?= =?us-ascii?Q?IweIM+i9ucdmZ41wFe88ec/o3CieI5oY2exZ2zwmx/nqmZO5e8fg7CUAUW9b?= =?us-ascii?Q?QK0gOxTS7no0GHE06qq/mr113+V87t4ngu2ddwXWEkZKrO0c7k+zJJyCWWRK?= =?us-ascii?Q?JXVRfYjq62u2bYDypaCFpI2zRFbsnENSp+XQp1RjzXSM0ZpM5d/BxdEZPtcT?= =?us-ascii?Q?JPAMTUwgOdr/QnOcF8Y9TlBAr3STU2rqwG9fHl5MD1aI1Ew5Lc0nK/dper7/?= =?us-ascii?Q?mtCzkwRqZTgKc+ijxiFU/WSfoOdZkrsRaghJYdXZSTmWIq08v3n0mMHDR4Gw?= =?us-ascii?Q?6Dl6p0HvTQTK4aoAN3xTlyr+pLR9+7vQn8vWd6HUUuXDN0RI33NeXl6FHOj0?= =?us-ascii?Q?jlaQqKoUmXkiXbJ2/ZZ8bH/P/A0nwT/4Ik38PAQFdlVncmanu1ZGbkBlemiD?= =?us-ascii?Q?qoeD7r8e7hloeJHb1jHw22Y5BfN0TIMCCAna2qpIsmH3svc1rrOhPUuz3O2P?= =?us-ascii?Q?Y5lyuyxs7VnSv/I9A+Mv6Qra2XwrUN30YRmmLj3uGk9w9+mRjoYOlwPi/0j3?= =?us-ascii?Q?wsPdAdf/VOaUvNsCv9nxSy6qIirvHO4yYmCJsgoMzuwSJkYVBql27B8K0lmO?= =?us-ascii?Q?qv6jIxj1J3Up5z5w2PJRSQ2ocG117SOHEJG5fZGefW3h06JC9+zDSpzIK9Ll?= =?us-ascii?Q?SlJF3qHmdg+ZCTUeIA4UiGtSmlQCaMKO5YdN5W1wxYeFwzXbOT2iaSzfLLE2?= =?us-ascii?Q?uZU3qzyyUZk7feDSjbN89GCR94lz9eI1pXfpTWlSF+2m6mtNYG0UQkeSgBTx?= =?us-ascii?Q?uRLAkrpjxPb2SqlnB8DFAqJIAkIUwtjl7wlTOgM7f2pXSomDxg7oANJg6Pc0?= =?us-ascii?Q?6NrxBRrcEOYlSqSxG6ULd04mQstdHJmyRp4ELxg/i4HzVkUd2Y+c7aF2a+O2?= =?us-ascii?Q?t6BX60qhU6D+cLkuC2b5S/LGR/GlL7BYS9E+JxSFn3gq+s8hfVy28bdILcwE?= =?us-ascii?Q?qBQ7b6znlNl1Ws/EhHApuSMBqs+3JAkIqnOrqQ0EmGUAqACObJFOplzIHhGR?= =?us-ascii?Q?B40dZ5wyur9z1pE4u7g3mQ6j9+PHZjqJfimrwLqDO4Y9e6cbvKsXSeaNBmE+?= =?us-ascii?Q?yOpZqDmf3rxepb3s9swbTg9z/E49i04OafxsP5T7yA1Sirfqa8RUVerwhED2?= =?us-ascii?Q?8wnjf3OErUVzF4CV71p9qQ1jEyem0HaWD81TaCA07gYq1TrkcCSTwy7+NUmU?= =?us-ascii?Q?+cyltcJNlH+Z7xNcgmPOezWk?= X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 921bf59d-fabe-4092-ba5c-08d9064396bf X-MS-Exchange-CrossTenant-AuthSource: MWHPR1101MB2351.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Apr 2021 10:36:01.5486 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: xqazgfDpZ+/85GbbQb2VFIU6kn2bvhD+EcvwMIHT/8uEB4eh9ADupV8uGBMmNSpzZFoDmb06pFOZI6AeHMYgtw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1101MB2192 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-loop: linux-audit@redhat.com X-Mailman-Approved-At: Fri, 23 Apr 2021 06:50:23 -0400 X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit regs_return_value for some architectures like arm64 simply retrieve register value from pt_regs without sign extension in 32-bit compatible case and cause audit to have false syscall return code. For example, 32-bit -13 would be treated as 4294967283 below. type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 success=yes exit=4294967283 We just added proper sign extension in syscall_get_return_value which should be used instead. Signed-off-by: He Zhe --- v1 to v2: No change include/linux/audit.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 82b7c1116a85..135adbe22c19 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) { if (unlikely(audit_context())) { int success = is_syscall_success(pt_regs); - long return_code = regs_return_value(pt_regs); + long return_code = syscall_get_return_value(current, pt_regs); __audit_syscall_exit(success, return_code); } -- 2.17.1 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit