Re: Regression: audit: x86: drop arch from __audit_syscall_entry() interface
On 10/22/2014 11:23 AM, Eric Paris wrote:
That's really serious. Looking now.
On Wed, 2014-10-22 at 16:08 -0200, Paulo Zanoni wrote:
> Hi
>
> (Cc'ing everybody mentioned in the original patch)
>
> I work for Intel, on our Linux Graphics driver - aka i915.ko - and our
> QA team recently reported a regression on:
>
> commit b4f0d3755c5e9cc86292d5fd78261903b4f23d4a
> Author: Richard Guy Briggs
> Date: Tue Mar 4 10:38:06 2014 -0500
> audit: x86: drop arch from __audit_syscall_entry() interface
>
> According to our QA, their i386 machine doesn't boot anymore. I tried
> to write my own revert for the patch, asked QA to test, and they
> confirmed it "solves" the problem.
>
> Here are the details of QA' s bug report:
> https://bugs.freedesktop.org/show_bug.cgi?id=85277 .
>
> The trees our QA tests are the development trees from i915.ko:
> http://cgit.freedesktop.org/drm-intel?h=drm-intel-fixes .
>
> I tried searching for other bug reports on the same patch, but
> couldn't find any. Forgive me if this bug was already reported.
>
> Feel free to continue this discussion on the bugzilla report if you want.
This piece:
movl %esi,4(%esp) /* 5th arg: 4th syscall arg */
movl %edx,(%esp) /* 4th arg: 3rd syscall arg */
looks like it's overwriting syscall arguments.
This is clearly fixable, but an even better fix would be to drop the asm
entirely and switch to two-phase tracing. Want to do it? I can test
the seccomp bits if you switch over the asm :)
--Andy