Commit 446b8831 authored by David Woodhouse's avatar David Woodhouse Committed by Tony Luck

[IA64] fix ia64 syscall auditing

Attached is a patch against David's audit.17 kernel that adds checks
for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and
signal handling code paths.  The patch enables auditing of system
calls set up via fsys_bubble_down, as well as ensuring that
audit_syscall_exit() is called on return from sigreturn.

Neglecting to check for TIF_SYSCALL_AUDIT at these points results in
incorrect information in audit_context, causing frequent system panics
when system call auditing is enabled on an ia64 system.

I have tested this patch and have seen no problems with it.

[Original patch from Amy Griffis ported to current kernel by David Woodhouse]

From: Amy Griffis <amy.griffis@hp.com>
From: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: default avatarChris Wright <chrisw@osdl.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
parent 7d5f9c0f
...@@ -611,8 +611,10 @@ GLOBAL_ENTRY(fsys_bubble_down) ...@@ -611,8 +611,10 @@ GLOBAL_ENTRY(fsys_bubble_down)
movl r2=ia64_ret_from_syscall movl r2=ia64_ret_from_syscall
;; ;;
mov rp=r2 // set the real return addr mov rp=r2 // set the real return addr
tbit.z p8,p0=r3,TIF_SYSCALL_TRACE and r3=_TIF_SYSCALL_TRACEAUDIT,r3
;; ;;
cmp.eq p8,p0=r3,r0
(p10) br.cond.spnt.many ia64_ret_from_syscall // p10==true means out registers are more than 8 (p10) br.cond.spnt.many ia64_ret_from_syscall // p10==true means out registers are more than 8
(p8) br.call.sptk.many b6=b6 // ignore this return addr (p8) br.call.sptk.many b6=b6 // ignore this return addr
br.cond.sptk ia64_trace_syscall br.cond.sptk ia64_trace_syscall
......
...@@ -224,7 +224,8 @@ ia64_rt_sigreturn (struct sigscratch *scr) ...@@ -224,7 +224,8 @@ ia64_rt_sigreturn (struct sigscratch *scr)
* could be corrupted. * could be corrupted.
*/ */
retval = (long) &ia64_leave_kernel; retval = (long) &ia64_leave_kernel;
if (test_thread_flag(TIF_SYSCALL_TRACE)) if (test_thread_flag(TIF_SYSCALL_TRACE)
|| test_thread_flag(TIF_SYSCALL_AUDIT))
/* /*
* strace expects to be notified after sigreturn returns even though the * strace expects to be notified after sigreturn returns even though the
* context to which we return may not be in the middle of a syscall. * context to which we return may not be in the middle of a syscall.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment