From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: amy.griffis@hp.com, tony.luck@intel.com,
linux-ia64@vger.kernel.org, dwmw2@infradead.org
Subject: [03/08] fix ia64 syscall auditing
Date: Tue, 05 Apr 2005 16:46:48 +0000 [thread overview]
Message-ID: <20050405164647.GD17299@kroah.com> (raw)
In-Reply-To: <20050405164539.GA17299@kroah.com>
-stable review patch. If anyone has any objections, please let us know.
------------------
Attached is a patch against David's audit.17 kernel that adds checks
for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and
signal handling code paths. The patch enables auditing of system
calls set up via fsys_bubble_down, as well as ensuring that
audit_syscall_exit() is called on return from sigreturn.
Neglecting to check for TIF_SYSCALL_AUDIT at these points results in
incorrect information in audit_context, causing frequent system panics
when system call auditing is enabled on an ia64 system.
I have tested this patch and have seen no problems with it.
[Original patch from Amy Griffis ported to current kernel by David Woodhouse]
From: Amy Griffis <amy.griffis@hp.com>
From: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- 1.34/arch/ia64/kernel/fsys.S 2005-01-22 22:19:11 +00:00
+++ edited/arch/ia64/kernel/fsys.S 2005-04-01 00:20:32 +01:00
@@ -611,8 +611,10 @@
movl r2=ia64_ret_from_syscall
;;
mov rp=r2 // set the real return addr
- tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
+ and r3=_TIF_SYSCALL_TRACEAUDIT,r3
;;
+ cmp.eq p8,p0=r3,r0
+
(p10) br.cond.spnt.many ia64_ret_from_syscall // p10=true means out registers are more than 8
(p8) br.call.sptk.many b6¶ // ignore this return addr
br.cond.sptk ia64_trace_syscall
=== arch/ia64/kernel/signal.c 1.49 vs edited ==--- 1.49/arch/ia64/kernel/signal.c 2005-01-25 20:23:45 +00:00
+++ edited/arch/ia64/kernel/signal.c 2005-04-01 00:18:29 +01:00
@@ -224,7 +224,8 @@
* could be corrupted.
*/
retval = (long) &ia64_leave_kernel;
- if (test_thread_flag(TIF_SYSCALL_TRACE))
+ if (test_thread_flag(TIF_SYSCALL_TRACE)
+ || test_thread_flag(TIF_SYSCALL_AUDIT))
/*
* strace expects to be notified after sigreturn returns even though the
* context to which we return may not be in the middle of a syscall.
next parent reply other threads:[~2005-04-05 16:46 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20050405164539.GA17299@kroah.com>
2005-04-05 16:46 ` Greg KH [this message]
2005-04-05 20:27 ` [03/08] fix ia64 syscall auditing David Mosberger
2005-04-05 20:49 ` Greg KH
2005-04-05 21:01 ` Randy.Dunlap
2005-04-05 23:46 ` Ryan Anderson
2005-04-06 0:05 ` Greg KH
2005-04-06 0:48 ` Dave Jones
2005-04-06 22:43 ` Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050405164647.GD17299@kroah.com \
--to=gregkh@suse.de \
--cc=amy.griffis@hp.com \
--cc=dwmw2@infradead.org \
--cc=linux-ia64@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@kernel.org \
--cc=tony.luck@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox