Re: [PATCH] audit: do a quick exit when syscall number is invalid

Hi, Thank you for the patch! Yet something to improve: [auto build test ERROR on pcmoore-audit/next] [also build test ERROR on v5.17 next-20220325] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/intel-lab-lkp/linux/commits/cgel-zte-gmail-com/audit-d... base: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git next config: alpha-allyesconfig (https://download.01.org/0day-ci/archive/20220327/202203270449.WBYQF9X3-lk...) compiler: alpha-linux-gcc (GCC) 11.2.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/intel-lab-lkp/linux/commit/052b1a11a0bec23358ecc22ad9b... git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review cgel-zte-gmail-com/audit-do-a-quick-exit-when-syscall-number-is-invalid/20220326-174904 git checkout 052b1a11a0bec23358ecc22ad9b085590efd3057 # save the config file to linux build tree mkdir build_dir COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=alpha SHELL=/bin/bash If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; All errors (new ones prefixed by >>): In file included from include/linux/init.h:5, from kernel/auditsc.c:34: kernel/auditsc.c: In function '__audit_syscall_exit': 2081 | unlikely(context->major < 0 || context->major > NR_syscalls)) | ^~~~~~~~~~~ include/linux/compiler.h:78:45: note: in definition of macro 'unlikely' 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ kernel/auditsc.c:2081:61: note: each undeclared identifier is reported only once for each function it appears in 2081 | unlikely(context->major < 0 || context->major > NR_syscalls)) | ^~~~~~~~~~~ include/linux/compiler.h:78:45: note: in definition of macro 'unlikely' 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ vim +2081 kernel/auditsc.c 2063 2064 /** 2065 * __audit_syscall_exit - deallocate audit context after a system call 2066 * @success: success value of the syscall 2067 * @return_code: return value of the syscall 2068 * 2069 * Tear down after system call. If the audit context has been marked as 2070 * auditable (either because of the AUDIT_STATE_RECORD state from 2071 * filtering, or because some other part of the kernel wrote an audit 2072 * message), then write out the syscall information. In call cases, 2073 * free the names stored from getname(). 2074 */ 2075 void __audit_syscall_exit(int success, long return_code) 2076 { 2077 struct audit_context *context = audit_context(); 2078 2079 if (!context || context->dummy || 2080 context->context != AUDIT_CTX_SYSCALL || 2082 goto out; 2083 2084 /* this may generate CONFIG_CHANGE records */ 2085 if (!list_empty(&context->killed_trees)) 2086 audit_kill_trees(context); 2087 2088 /* run through both filters to ensure we set the filterkey properly */ 2089 audit_filter_syscall(current, context); 2090 audit_filter_inodes(current, context); 2091 if (context->current_state < AUDIT_STATE_RECORD) 2092 goto out; 2093 2094 audit_return_fixup(context, success, return_code); 2095 audit_log_exit(); 2096 2097 out: 2098 audit_reset_context(context); 2099 } 2100 -- 0-DAY CI Kernel Test Service https://01.org/lkp