Re: [PATCH v2 3/3] audit: Use syscall_get_return_value to get syscall return code in audit_syscall_exit

On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he(a)windriver.com&gt; wrote: > regs_return_value for some architectures like arm64 simply retrieve > register value from pt_regs without sign extension in 32-bit compatible > case and cause audit to have false syscall return code. For example, > 32-bit -13 would be treated as 4294967283 below. > > type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 > success=yes exit=4294967283 > > We just added proper sign extension in syscall_get_return_value which > should be used instead. > > Signed-off-by: He Zhe <zhe.he(a)windriver.com&gt; > --- > v1 to v2: No change > > include/linux/audit.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Perhaps I missed it but did you address the compile error that was found by the kernel test robot?

Regardless, one comment inline below ... > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 82b7c1116a85..135adbe22c19 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) > { > if (unlikely(audit_context())) { > int success = is_syscall_success(pt_regs); Since we are shifting to use syscall_get_return_value() below, would it also make sense to shift to using syscall_get_error() here instead of is_syscall_success()?

> - long return_code = regs_return_value(pt_regs); > + long return_code = syscall_get_return_value(current, pt_regs); > > __audit_syscall_exit(success, return_code); > }