| Message ID | 20210423103533.30121-3-zhe.he@windriver.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2,1/3] arm64: ptrace: Add is_syscall_success to handle compat | expand |
On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he@windriver.com> wrote: > > regs_return_value for some architectures like arm64 simply retrieve > register value from pt_regs without sign extension in 32-bit compatible > case and cause audit to have false syscall return code. For example, > 32-bit -13 would be treated as 4294967283 below. > > type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 > success=yes exit=4294967283 > > We just added proper sign extension in syscall_get_return_value which > should be used instead. > > Signed-off-by: He Zhe <zhe.he@windriver.com> > --- > v1 to v2: No change > > include/linux/audit.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Perhaps I missed it but did you address the compile error that was found by the kernel test robot? Regardless, one comment inline below ... > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 82b7c1116a85..135adbe22c19 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) > { > if (unlikely(audit_context())) { > int success = is_syscall_success(pt_regs); Since we are shifting to use syscall_get_return_value() below, would it also make sense to shift to using syscall_get_error() here instead of is_syscall_success()? > - long return_code = regs_return_value(pt_regs); > + long return_code = syscall_get_return_value(current, pt_regs); > > __audit_syscall_exit(success, return_code); > }
On 5/11/21 6:38 AM, Paul Moore wrote: > On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he@windriver.com> wrote: >> regs_return_value for some architectures like arm64 simply retrieve >> register value from pt_regs without sign extension in 32-bit compatible >> case and cause audit to have false syscall return code. For example, >> 32-bit -13 would be treated as 4294967283 below. >> >> type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 >> success=yes exit=4294967283 >> >> We just added proper sign extension in syscall_get_return_value which >> should be used instead. >> >> Signed-off-by: He Zhe <zhe.he@windriver.com> >> --- >> v1 to v2: No change >> >> include/linux/audit.h | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) > Perhaps I missed it but did you address the compile error that was > found by the kernel test robot? I sent a patch adding syscall_get_return_value for alpha to fix this bot warning. https://lore.kernel.org/lkml/20210426091629.45020-1-zhe.he@windriver.com/ which can be found in this mail thread. > > Regardless, one comment inline below ... > >> diff --git a/include/linux/audit.h b/include/linux/audit.h >> index 82b7c1116a85..135adbe22c19 100644 >> --- a/include/linux/audit.h >> +++ b/include/linux/audit.h >> @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) >> { >> if (unlikely(audit_context())) { >> int success = is_syscall_success(pt_regs); > Since we are shifting to use syscall_get_return_value() below, would > it also make sense to shift to using syscall_get_error() here instead > of is_syscall_success()? In [PATCH v2 1/3], is_syscall_success calls syscall_get_return_value to take care of the sign extension issue. Keeping using is_syscall_success is to not potentially changing other architectures' behavior. Thanks, Zhe > >> - long return_code = regs_return_value(pt_regs); >> + long return_code = syscall_get_return_value(current, pt_regs); >> >> __audit_syscall_exit(success, return_code); >> }
On Mon, May 10, 2021 at 11:19 PM He Zhe <zhe.he@windriver.com> wrote: > On 5/11/21 6:38 AM, Paul Moore wrote: > > On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he@windriver.com> wrote: > >> regs_return_value for some architectures like arm64 simply retrieve > >> register value from pt_regs without sign extension in 32-bit compatible > >> case and cause audit to have false syscall return code. For example, > >> 32-bit -13 would be treated as 4294967283 below. > >> > >> type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 > >> success=yes exit=4294967283 > >> > >> We just added proper sign extension in syscall_get_return_value which > >> should be used instead. > >> > >> Signed-off-by: He Zhe <zhe.he@windriver.com> > >> --- > >> v1 to v2: No change > >> > >> include/linux/audit.h | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > > > > Perhaps I missed it but did you address the compile error that was > > found by the kernel test robot? > > I sent a patch adding syscall_get_return_value for alpha to fix this bot warning. > https://lore.kernel.org/lkml/20210426091629.45020-1-zhe.he@windriver.com/ > which can be found in this mail thread. At the very least you should respin the patchset with the alpha fix included in the patchset; it's a bit messy otherwise. > >> diff --git a/include/linux/audit.h b/include/linux/audit.h > >> index 82b7c1116a85..135adbe22c19 100644 > >> --- a/include/linux/audit.h > >> +++ b/include/linux/audit.h > >> @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) > >> { > >> if (unlikely(audit_context())) { > >> int success = is_syscall_success(pt_regs); > > > > Since we are shifting to use syscall_get_return_value() below, would > > it also make sense to shift to using syscall_get_error() here instead > > of is_syscall_success()? > > In [PATCH v2 1/3], is_syscall_success calls syscall_get_return_value to take > care of the sign extension issue. Keeping using is_syscall_success is to not > potentially changing other architectures' behavior. That was only for aarch64, right? What about all the other architectures? The comment block for syscall_get_return_value() advises that syscall_get_error() should be used and that appears to be what is done in the ptrace code.
On 5/11/21 10:51 PM, Paul Moore wrote: > On Mon, May 10, 2021 at 11:19 PM He Zhe <zhe.he@windriver.com> wrote: >> On 5/11/21 6:38 AM, Paul Moore wrote: >>> On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he@windriver.com> wrote: >>>> regs_return_value for some architectures like arm64 simply retrieve >>>> register value from pt_regs without sign extension in 32-bit compatible >>>> case and cause audit to have false syscall return code. For example, >>>> 32-bit -13 would be treated as 4294967283 below. >>>> >>>> type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 >>>> success=yes exit=4294967283 >>>> >>>> We just added proper sign extension in syscall_get_return_value which >>>> should be used instead. >>>> >>>> Signed-off-by: He Zhe <zhe.he@windriver.com> >>>> --- >>>> v1 to v2: No change >>>> >>>> include/linux/audit.h | 2 +- >>>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> Perhaps I missed it but did you address the compile error that was >>> found by the kernel test robot? >> I sent a patch adding syscall_get_return_value for alpha to fix this bot warning. >> https://lore.kernel.org/lkml/20210426091629.45020-1-zhe.he@windriver.com/ >> which can be found in this mail thread. > At the very least you should respin the patchset with the alpha fix > included in the patchset; it's a bit messy otherwise. > >>>> diff --git a/include/linux/audit.h b/include/linux/audit.h >>>> index 82b7c1116a85..135adbe22c19 100644 >>>> --- a/include/linux/audit.h >>>> +++ b/include/linux/audit.h >>>> @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) >>>> { >>>> if (unlikely(audit_context())) { >>>> int success = is_syscall_success(pt_regs); >>> Since we are shifting to use syscall_get_return_value() below, would >>> it also make sense to shift to using syscall_get_error() here instead >>> of is_syscall_success()? >> In [PATCH v2 1/3], is_syscall_success calls syscall_get_return_value to take >> care of the sign extension issue. Keeping using is_syscall_success is to not >> potentially changing other architectures' behavior. > That was only for aarch64, right? What about all the other > architectures? The comment block for syscall_get_return_value() > advises that syscall_get_error() should be used and that appears to be > what is done in the ptrace code. Yes, it was only for aarch64. No similar issue hasn't observed for other architectures on my side, so I was trying to minimize the impact. The "comment block" you mentioned is the following line, right? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/asm-generic/syscall.h#n77 [PATCH v2 2/3] was used to cover this concern. But as we can see in Mark Rutland's last reply, there'are more things to be considered and we are still trying to find a proper solution. Thanks, Zhe >
On Wed, May 12, 2021 at 4:43 AM He Zhe <zhe.he@windriver.com> wrote: > On 5/11/21 10:51 PM, Paul Moore wrote: > > On Mon, May 10, 2021 at 11:19 PM He Zhe <zhe.he@windriver.com> wrote: > >> On 5/11/21 6:38 AM, Paul Moore wrote: > >>> On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he@windriver.com> wrote: > >>>> regs_return_value for some architectures like arm64 simply retrieve > >>>> register value from pt_regs without sign extension in 32-bit compatible > >>>> case and cause audit to have false syscall return code. For example, > >>>> 32-bit -13 would be treated as 4294967283 below. > >>>> > >>>> type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 > >>>> success=yes exit=4294967283 > >>>> > >>>> We just added proper sign extension in syscall_get_return_value which > >>>> should be used instead. > >>>> > >>>> Signed-off-by: He Zhe <zhe.he@windriver.com> > >>>> --- > >>>> v1 to v2: No change > >>>> > >>>> include/linux/audit.h | 2 +- > >>>> 1 file changed, 1 insertion(+), 1 deletion(-) > >>> Perhaps I missed it but did you address the compile error that was > >>> found by the kernel test robot? > >> I sent a patch adding syscall_get_return_value for alpha to fix this bot warning. > >> https://lore.kernel.org/lkml/20210426091629.45020-1-zhe.he@windriver.com/ > >> which can be found in this mail thread. > > At the very least you should respin the patchset with the alpha fix > > included in the patchset; it's a bit messy otherwise. > > > >>>> diff --git a/include/linux/audit.h b/include/linux/audit.h > >>>> index 82b7c1116a85..135adbe22c19 100644 > >>>> --- a/include/linux/audit.h > >>>> +++ b/include/linux/audit.h > >>>> @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) > >>>> { > >>>> if (unlikely(audit_context())) { > >>>> int success = is_syscall_success(pt_regs); > >>> Since we are shifting to use syscall_get_return_value() below, would > >>> it also make sense to shift to using syscall_get_error() here instead > >>> of is_syscall_success()? > >> In [PATCH v2 1/3], is_syscall_success calls syscall_get_return_value to take > >> care of the sign extension issue. Keeping using is_syscall_success is to not > >> potentially changing other architectures' behavior. > > That was only for aarch64, right? What about all the other > > architectures? The comment block for syscall_get_return_value() > > advises that syscall_get_error() should be used and that appears to be > > what is done in the ptrace code. > > Yes, it was only for aarch64. No similar issue hasn't observed for other > architectures on my side, so I was trying to minimize the impact. > > The "comment block" you mentioned is the following line, right? > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/asm-generic/syscall.h#n77 > [PATCH v2 2/3] was used to cover this concern. But as we can see in > Mark Rutland's last reply, there'are more things to be considered and we are > still trying to find a proper solution. It sounds like you are going to be submitting another patchset at some point in the future - that's good - when you do please use syscall_get_error() in conjunction with syscall_get_return_value() or explain why doing so is wrong. The explanation should be in a code comment, not just an email and/or commit description.
diff --git a/include/linux/audit.h b/include/linux/audit.h index 82b7c1116a85..135adbe22c19 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) { if (unlikely(audit_context())) { int success = is_syscall_success(pt_regs); - long return_code = regs_return_value(pt_regs); + long return_code = syscall_get_return_value(current, pt_regs); __audit_syscall_exit(success, return_code); }
regs_return_value for some architectures like arm64 simply retrieve register value from pt_regs without sign extension in 32-bit compatible case and cause audit to have false syscall return code. For example, 32-bit -13 would be treated as 4294967283 below. type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 success=yes exit=4294967283 We just added proper sign extension in syscall_get_return_value which should be used instead. Signed-off-by: He Zhe <zhe.he@windriver.com> --- v1 to v2: No change include/linux/audit.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)