lkml.org 
[lkml]   [2014]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] x32: Mask the syscall number before passing it to audit
Date
audit_filter_syscall uses the syscall number to reference into a
bitmask (e->rule.mask[word]). Not removing the x32 bit before passing
the number to this architecture independent codepath will fail to
lookup the proper audit bit. Furthermore it will cause an invalid memory
access in the kernel if the out of bound location is not mapped:

BUG: unable to handle kernel paging request at ffff8800e5446630
IP: [<ffffffff810fcdd0>] audit_filter_syscall+0x90/0xf0

Cc: linux-kernel@vger.kernel.org
Cc: H. J. Lu <hjl.tools@gmail.com>
Signed-off-by: Philipp Kern <pkern@google.com>
---
arch/x86/kernel/entry_64.S | 3 +++
1 file changed, 3 insertions(+)

diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 1e96c36..c9aaf60 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -699,6 +699,9 @@ auditsys:
movq %rsi,%rcx /* 4th arg: 2nd syscall arg */
movq %rdi,%rdx /* 3rd arg: 1st syscall arg */
movq %rax,%rsi /* 2nd arg: syscall number */
+#if __SYSCALL_MASK != ~0
+ andl $__SYSCALL_MASK,%esi
+#endif
movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
call __audit_syscall_entry
LOAD_ARGS 0 /* reload call-clobbered registers */
--
1.9.1.423.g4596e3a


\
 
 \ /
  Last update: 2014-05-26 14:41    [W:0.032 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site