[patch 4/5] audit mips fix

[patch 4/5] audit mips fix

[akpm]

From: Yoichi Yuasa <yuasa@hh.iij4u.or.jp>

  CC      arch/mips/kernel/ptrace.o
arch/mips/kernel/ptrace.c: In function 'do_syscall_trace':
arch/mips/kernel/ptrace.c:310: warning: implicit declaration of function 'audit_syscall_entry'
arch/mips/kernel/ptrace.c:310: error: 'struct pt_regs' has no member named 'orig_eax'
arch/mips/kernel/ptrace.c:314: warning: implicit declaration of function 'audit_syscall_exit'

Signed-off-by: Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 25-akpm/arch/mips/kernel/ptrace.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

diff -puN arch/mips/kernel/ptrace.c~audit-mips-fix arch/mips/kernel/ptrace.c
--- 25/arch/mips/kernel/ptrace.c~audit-mips-fix	2005-03-04 13:16:25.000000000 -0800
+++ 25-akpm/arch/mips/kernel/ptrace.c	2005-03-04 13:16:25.000000000 -0800
@@ -21,6 +21,7 @@
 #include <linux/mm.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
+#include <linux/audit.h>
 #include <linux/smp.h>
 #include <linux/smp_lock.h>
 #include <linux/user.h>
@@ -307,7 +308,7 @@ asmlinkage void do_syscall_trace(struct 
 {
 	if (unlikely(current->audit_context)) {
 		if (!entryexit)
-			audit_syscall_entry(current, regs->orig_eax,
+			audit_syscall_entry(current, regs->regs[2],
 			                    regs->regs[4], regs->regs[5],
 			                    regs->regs[6], regs->regs[7]);
 		else
_

Re: [patch 4/5] audit mips fix

[Greg KH]

On Fri, Mar 04, 2005 at 01:16:57PM -0800, akpm@osdl.org wrote:
> 
> From: Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
> 
>   CC      arch/mips/kernel/ptrace.o
> arch/mips/kernel/ptrace.c: In function 'do_syscall_trace':
> arch/mips/kernel/ptrace.c:310: warning: implicit declaration of function 'audit_syscall_entry'
> arch/mips/kernel/ptrace.c:310: error: 'struct pt_regs' has no member named 'orig_eax'
> arch/mips/kernel/ptrace.c:314: warning: implicit declaration of function 'audit_syscall_exit'
> 
> Signed-off-by: Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
> Signed-off-by: Andrew Morton <akpm@osdl.org>

Added to the -stable queue, thanks.

greg k-h

Re: [patch 4/5] audit mips fix

[Ralf Baechle]

On Fri, Mar 04, 2005 at 01:16:57PM -0800, akpm@osdl.org wrote:

> Signed-off-by: Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
> Signed-off-by: Andrew Morton <akpm@osdl.org>

> @@ -307,7 +308,7 @@ asmlinkage void do_syscall_trace(struct 
>  {
>  	if (unlikely(current->audit_context)) {
>  		if (!entryexit)
> -			audit_syscall_entry(current, regs->orig_eax,
> +			audit_syscall_entry(current, regs->regs[2],

Wrong.  regs[2] can will contain the syscall return value and can be
modified by ptrace also.

  Ralf

Re: [patch 4/5] audit mips fix

[Yoichi Yuasa]

Hi Ralf,

On Thu, 10 Mar 2005 17:14:29 +0000
Ralf Baechle <ralf@linux-mips.org> wrote:

> On Fri, Mar 04, 2005 at 01:16:57PM -0800, akpm@osdl.org wrote:
> 
> > Signed-off-by: Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
> > Signed-off-by: Andrew Morton <akpm@osdl.org>
> 
> > @@ -307,7 +308,7 @@ asmlinkage void do_syscall_trace(struct 
> >  {
> >  	if (unlikely(current->audit_context)) {
> >  		if (!entryexit)
> > -			audit_syscall_entry(current, regs->orig_eax,
> > +			audit_syscall_entry(current, regs->regs[2],
> 
> Wrong.  regs[2] can will contain the syscall return value and can be
> modified by ptrace also.

Thank you for your comment,
I consider a good way based on your comment. 

Do you already have a good idea?

Yoichi

Re: [patch 4/5] audit mips fix

[Ralf Baechle]

On Fri, Mar 11, 2005 at 09:58:39AM +0900, Yoichi Yuasa wrote:

> > > Signed-off-by: Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
> > > Signed-off-by: Andrew Morton <akpm@osdl.org>
> > 
> > > @@ -307,7 +308,7 @@ asmlinkage void do_syscall_trace(struct 
> > >  {
> > >  	if (unlikely(current->audit_context)) {
> > >  		if (!entryexit)
> > > -			audit_syscall_entry(current, regs->orig_eax,
> > > +			audit_syscall_entry(current, regs->regs[2],
> > 
> > Wrong.  regs[2] can will contain the syscall return value and can be
> > modified by ptrace also.
> 
> Thank you for your comment,
> I consider a good way based on your comment. 
> 
> Do you already have a good idea?

Basically do what x86 did, keep a copy of the the original regs[2] around.
The only potencial problem with this approach is debuggers might be
affected so I want to look into that first.

  Ralf