From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 204A83D333B for ; Wed, 24 Jun 2026 17:15:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782321333; cv=none; b=tVOtSJSTKSoJCBSxzWxBGl+jJfFXRqunw5xZnAizIkdEB3RYy9QNr0Iwz4KpIvdqj/uIWwNIDWssn6eJTE0zmr8ShKvtwZBUOgxGQ/SjyfJcPNybJVOhvsTMzTmrnd2Me+6D+x+dH4rK6dD5IE1NACc9XN+OgG6ZFd/QnSnIncM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782321333; c=relaxed/simple; bh=SVvP0ZA0EYk+ZSTiHYOMsqtmzK0C6ZlARQ5j2BE0Pz4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=FuVJpH6tXSu88YtML/3FfYP3euuuoLYDkH8X4dIlVh0sjUb1SrM1oUfkhmb4ok+IqTKL+8/W+i4x3IAmV8wHUxU9Il61EUgfIBxlwyXHGsID7YZTX8RC5UCR/wsLwC63ltnWh/lxYVChe2+VoYfxVv4xZUD8Cs9/EErZ0ovIgnQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QulwoLXD; arc=none smtp.client-ip=209.85.215.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QulwoLXD" Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-c8deb37737dso534493a12.1 for ; Wed, 24 Jun 2026 10:15:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782321331; x=1782926131; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=U/G1JgxwMKv+niNn6F5i+1VXQFhS2/7uV7yXwnMuPUA=; b=QulwoLXD5F2aCcPVscdVSjz53+vflsMWL7gF3QzGDf99QmBfqkxVhSsgJCzEHYDvXa CWVpew8UiUGb6hHXS0XqMktAEA99aKPGNQu1k1Y0Wc1DscphDvaZ1YywfCmJ9maeozU9 v/BPn32qC+maWB/5OSGahtfvYLBfAOIJ5zu04+dO71Kd9NGT+4mKredhG5GqmUIEuqph l8u0B1cTN3gp3uvjv3gl9A9iAiKG8naA/Uxjk/JwYSclvafq61duFBM1JqLQErYABblm u8MqPzicQmiVXWmNOE1Wk+9OmwjmQ3yGJ0x/kj8BDxuPXs7juvslNmUnyHRrJ3nq1iaX hQ8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782321331; x=1782926131; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=U/G1JgxwMKv+niNn6F5i+1VXQFhS2/7uV7yXwnMuPUA=; b=kuT2Dr5lfSUBmK0fdta7Wx+oYvN2L0paDmURgUW8DKoWLoA1/IV7X7bVjDXrMSB53I PwAwyCC8bNCuao+jE6taLTT7jr9OeTp0MTlehaB0+Xn+caHYbecsoDu2eMAf/xmiVDEL QeBOtSgeo669ZagMuitpLAT2BmAuXH8PanRURS5+mAmT+eo/q2GQFFnlJUfURWmAvRBk eWwKjF26gAPyb/DAXEKnYf97zqYjRItU3Occa11ePRmUTlrfM7zcMgOE468AfE6hGJy1 ePlnBldi85vgfQt1l8WNaLU+6cMwNBwAJOJlNGOOulXh0CTiY42ajGL2/oyBSONICZoz KGlA== X-Forwarded-Encrypted: i=1; AFNElJ+0vZH17zbX1sR6B/A0qPQIXqDP8lvWmvbbx6SIyI6vtgWH20cZSw3ROqPd875hVd6tjOzWDLUl6iIL2iw=@vger.kernel.org X-Gm-Message-State: AOJu0YyEYvCeA0ri0CJgOlkmHS7enS9arSG3ovK6phx6IkPKVJP8VD49 IzS3sHBJLZaYat0UKk92aL+RtDtLm9NyzGYab6McCLwG72EnA351XH6Q X-Gm-Gg: AfdE7ckxV7DVCLkaSxXASRgqKeGEf5E6lCtPeeR9xb4azhb3+ufay2b9VfW3D7QlDlo URNqSJVpW9xeCY9E/cUE7mW3GCv1mleDLtgAIm/6pE3P/nJOBBPZct7klC3cYnwOJxh/sKNUKKs KFfao5gxV/BeFWpEbFaOeRFKCt91m00ZAkl4fd+GgW9yWbOV/8ZsmvWCgS8VHFJbylyT5KOVlAu ItHyoj7WhUKN5B07MEz4/jhmiwGi6Nbd9M8bpgd+seyQewBxhEOTAaqucXQNY28VrNETw7XyjT3 cE/+wqh5hSqRMTrs+kfOIEBtQBkLj+I5GWyRNITbaCa/mdkbYBL9P43zWEDoLSLyhnpmdrw1S3N 1aNvp0cZiiCSpOw0L8PVK6BHRy+0ma62owYXisN3g9obVJ0KGhYmvHwh4BCW5rDu4yniDZpBxMI AE6e4wnpjWZooXIgGBxL/I+HZb2l9ZmqhAIkOJGq6O4GEy1gtdW2qdPwyZy7h3fmhI8Q== X-Received: by 2002:a05:6a20:ce4b:b0:398:840d:39aa with SMTP id adf61e73a8af0-3bd2d23dad1mr5089082637.29.1782321331219; Wed, 24 Jun 2026 10:15:31 -0700 (PDT) Received: from li-1a3e774c-28e4-11b2-a85c-acc9f2883e29.ibm.com.com ([106.51.160.236]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c92bcc90af5sm186497a12.28.2026.06.24.10.15.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Jun 2026 10:15:30 -0700 (PDT) From: "Mukesh Kumar Chaurasiya (IBM)" To: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, chleroy@kernel.org, sshegde@linux.ibm.com, mkchauras@linux.ibm.com, kees@kernel.org, mark.rutland@arm.com, mkchauras@gmail.com, ryan.roberts@arm.com, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org Cc: =?UTF-8?q?Michal=20Such=C3=A1nek?= Subject: [PATCH] powerpc/syscall: Fix seccomp errno handling with GENERIC_ENTRY Date: Wed, 24 Jun 2026 22:45:20 +0530 Message-ID: <20260624171520.772408-1-mkchauras@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After enabling GENERIC_ENTRY on PowerPC, seccomp filters using SCMP_ACT_ERRNO without an explicit errnoRet value return ENOSYS (Function not implemented) instead of the expected EPERM (Operation not permitted). The issue occurs in system_call_exception() when syscall_enter_from_user_mode() returns -1 to indicate the syscall should be skipped (e.g., blocked by seccomp). The current code treats this -1 as a syscall number and compares it against NR_syscalls. Since -1 (when cast to unsigned long) is greater than NR_syscalls, the code incorrectly returns -ENOSYS, overwriting the errno that seccomp already set via syscall_set_return_value(). The generic entry code in syscall_trace_enter() calls __secure_computing(), which sets the appropriate errno in regs->gpr[3] and returns -1 to signal that the syscall should be skipped. However, the PowerPC syscall handler was not checking for this -1 return value before validating the syscall number. Fix this by explicitly checking if syscall_enter_from_user_mode() returns -1 and returning the value already set in regs->gpr[3] (the errno from seccomp) before performing the syscall number validation. This aligns PowerPC's behavior with other architectures using GENERIC_ENTRY and restores correct seccomp errno handling. Fixes: bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") Reported-by: Michal Suchánek Signed-off-by: Mukesh Kumar Chaurasiya (IBM) --- arch/powerpc/kernel/syscall.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/kernel/syscall.c b/arch/powerpc/kernel/syscall.c index a9da2af6efa8..5b58c8d396c8 100644 --- a/arch/powerpc/kernel/syscall.c +++ b/arch/powerpc/kernel/syscall.c @@ -22,6 +22,10 @@ notrace long system_call_exception(struct pt_regs *regs, unsigned long r0) add_random_kstack_offset(); r0 = syscall_enter_from_user_mode(regs, r0); + /* Seccomp or ptrace may have set return value, skip syscall */ + if (unlikely(r0 == -1L)) + return regs->gpr[3]; + if (unlikely(r0 >= NR_syscalls)) { if (unlikely(trap_is_unsupported_scv(regs))) { /* Unsupported scv vector */ -- 2.54.0