Re: [PATCH v2 3/3] audit: Use syscall_get_return_value to get syscall return code in audit_syscall_exit

On Mon, May 10, 2021 at 11:19 PM He Zhe <zhe.he(a)windriver.com&gt; wrote: > On 5/11/21 6:38 AM, Paul Moore wrote: >> On Fri, Apr 23, 2021 at 6:36 AM He Zhe <zhe.he(a)windriver.com&gt; wrote: >>> regs_return_value for some architectures like arm64 simply retrieve >>> register value from pt_regs without sign extension in 32-bit compatible >>> case and cause audit to have false syscall return code. For example, >>> 32-bit -13 would be treated as 4294967283 below. >>>>> type=SYSCALL msg=audit(1611110715.887:582): arch=40000028 syscall=322 >>> success=yes exit=4294967283 >>>>> We just added proper sign extension in syscall_get_return_value which >>> should be used instead. >>>>> Signed-off-by: He Zhe <zhe.he(a)windriver.com>>> --- >>> v1 to v2: No change >>>>> include/linux/audit.h | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >> Perhaps I missed it but did you address the compile error that was >> found by the kernel test robot? > I sent a patch adding syscall_get_return_value for alpha to fix this bot warning. > https://lore.kernel.org/lkml/20210426091629.45020-1-zhe.he@windriver.com/ > which can be found in this mail thread. At the very least you should respin the patchset with the alpha fix included in the patchset; it's a bit messy otherwise. >>> diff --git a/include/linux/audit.h b/include/linux/audit.h >>> index 82b7c1116a85..135adbe22c19 100644 >>> --- a/include/linux/audit.h >>> +++ b/include/linux/audit.h >>> @@ -334,7 +334,7 @@ static inline void audit_syscall_exit(void *pt_regs) >>> { >>> if (unlikely(audit_context())) { >>> int success = is_syscall_success(pt_regs); >> Since we are shifting to use syscall_get_return_value() below, would >> it also make sense to shift to using syscall_get_error() here instead >> of is_syscall_success()? > In [PATCH v2 1/3], is_syscall_success calls syscall_get_return_value to take > care of the sign extension issue. Keeping using is_syscall_success is to not > potentially changing other architectures' behavior. That was only for aarch64, right? What about all the other architectures? The comment block for syscall_get_return_value() advises that syscall_get_error() should be used and that appears to be what is done in the ptrace code.