[lkml]   [2005]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[03/08] fix ia64 syscall auditing
-stable review patch.  If anyone has any objections, please let us know.


Attached is a patch against David's audit.17 kernel that adds checks
for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and
signal handling code paths. The patch enables auditing of system
calls set up via fsys_bubble_down, as well as ensuring that
audit_syscall_exit() is called on return from sigreturn.

Neglecting to check for TIF_SYSCALL_AUDIT at these points results in
incorrect information in audit_context, causing frequent system panics
when system call auditing is enabled on an ia64 system.

I have tested this patch and have seen no problems with it.

[Original patch from Amy Griffis ported to current kernel by David Woodhouse]

From: Amy Griffis <>
From: David Woodhouse <>
Signed-off-by: Chris Wright <>
Signed-off-by: Greg Kroah-Hartman <>

--- 1.34/arch/ia64/kernel/fsys.S 2005-01-22 22:19:11 +00:00
+++ edited/arch/ia64/kernel/fsys.S 2005-04-01 00:20:32 +01:00
@@ -611,8 +611,10 @@
movl r2=ia64_ret_from_syscall
mov rp=r2 // set the real return addr
- tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
+ cmp.eq p8,p0=r3,r0
(p10) br.cond.spnt.many ia64_ret_from_syscall // p10==true means out registers are more than 8
(p8) b6=b6 // ignore this return addr
br.cond.sptk ia64_trace_syscall
===== arch/ia64/kernel/signal.c 1.49 vs edited =====
--- 1.49/arch/ia64/kernel/signal.c 2005-01-25 20:23:45 +00:00
+++ edited/arch/ia64/kernel/signal.c 2005-04-01 00:18:29 +01:00
@@ -224,7 +224,8 @@
* could be corrupted.
retval = (long) &ia64_leave_kernel;
- if (test_thread_flag(TIF_SYSCALL_TRACE))
+ if (test_thread_flag(TIF_SYSCALL_TRACE)
+ || test_thread_flag(TIF_SYSCALL_AUDIT))
* strace expects to be notified after sigreturn returns even though the
* context to which we return may not be in the middle of a syscall.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at
 \ /
  Last update: 2005-04-06 13:31    [W:0.102 / U:3.040 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site