[PATCH v2 3/3] audit: Use syscall_get_return_value to get syscall return code in audit_syscall_exit

[He Zhe]

On 5/11/21 10:51 PM, Paul Moore wrote:
> On Mon, May 10, 2021 at 11:19 PM He Zhe <zhe.he at windriver.com> wrote:
>> On 5/11/21 6:38 AM, Paul Moore wrote:
>>> On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he at windriver.com> wrote:
>>>> regs_return_value for some architectures like arm64 simply retrieve
>>>> register value from pt_regs without sign extension in 32-bit compatible
>>>> case and cause audit to have false syscall return code. For example,
>>>> 32-bit -13 would be treated as 4294967283 below.
>>>>
>>>> type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322
>>>> success=yes exit=4294967283
>>>>
>>>> We just added proper sign extension in syscall_get_return_value which
>>>> should be used instead.
>>>>
>>>> Signed-off-by: He Zhe <zhe.he at windriver.com>
>>>> ---
>>>> v1 to v2: No change
>>>>
>>>>  include/linux/audit.h | 2 +-
>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>> Perhaps I missed it but did you address the compile error that was
>>> found by the kernel test robot?
>> I sent a patch adding syscall_get_return_value for alpha to fix this bot warning.
>> https://lore.kernel.org/lkml/20210426091629.45020-1-zhe.he@windriver.com/
>> which can be found in this mail thread.
> At the very least you should respin the patchset with the alpha fix
> included in the patchset; it's a bit messy otherwise.
>
>>>> diff --git a/include/linux/audit.h b/include/linux/audit.h
>>>> index 82b7c1116a85..135adbe22c19 100644
>>>> --- a/include/linux/audit.h
>>>> +++ b/include/linux/audit.h
>>>> @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs)
>>>>  {
>>>>         if (unlikely(audit_context())) {
>>>>                 int success = is_syscall_success(pt_regs);
>>> Since we are shifting to use syscall_get_return_value() below, would
>>> it also make sense to shift to using syscall_get_error() here instead
>>> of is_syscall_success()?
>> In [PATCH v2 1/3], is_syscall_success calls syscall_get_return_value to take
>> care of the sign extension issue. Keeping using is_syscall_success is to not
>> potentially changing other architectures' behavior.
> That was only for aarch64, right?  What about all the other
> architectures?  The comment block for syscall_get_return_value()
> advises that syscall_get_error() should be used and that appears to be
> what is done in the ptrace code.

Yes, it was only for aarch64. No similar issue hasn't observed for other
architectures on my side, so I was trying to minimize the impact.

The "comment block" you mentioned is the following line, right?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/asm-generic/syscall.h#n77
[PATCH v2 2/3] was used to cover this concern. But as we can see in
Mark Rutland's last reply, there'are more things to be considered and we are
still trying to find a proper solution.

Thanks,
Zhe

>