[PATCH v2 0/2] ARM: ptrace: Fix seccomp seeing stale syscall arguments

[Jinjie Ruan]

On arm32 the syscall entry code copies r0 into ARM_ORIG_r0, and seccomp,
the sys_enter tracepoint and the syscall restart path read the first
argument from that copy, while audit and the syscall itself runs
with r0.

If a tracer rewrites r0 before the syscall is dispatched, at a
syscall-entry stop or at a SECCOMP_RET_TRACE stop, leaves ARM_ORIG_r0
stale: seccomp and the tracepoint see the old argument while audit and
the syscall runs with the new one.

arm64 has the same problem with orig_x0 and it is already fixed there in
commit 88b839ce497c ("arm64: ptrace: Keep 'orig_x0' in-sync with x0 on
syscall entry").

The fisrt patch fix this issue, and the second add testcases.

Changes since v1:
- Fix the sashiko issues.
- As Linus suggested, expand the explanation content from
  the previous version into the commit message.
- Add the selftests.
- Link to v1: https://lore.kernel.org/all/20260725091452.1875627-1-ruanjinjie@huawei.com/

- Link: https://sashiko.dev/#/patchset/20260725091452.1875627-1-ruanjinjie%40huawei.com

Jinjie Ruan (2):
  ARM: ptrace: Fix seccomp seeing stale syscall arguments
  selftests/seccomp: Add tests for syscall argument rewrite

 arch/arm/kernel/ptrace.c                      |  41 +-
 tools/testing/selftests/seccomp/.gitignore    |   1 +
 tools/testing/selftests/seccomp/Makefile      |   2 +-
 .../selftests/seccomp/seccomp_ptrace_args.c   | 463 ++++++++++++++++++
 4 files changed, 505 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/seccomp/seccomp_ptrace_args.c

-- 
2.34.1