[PATCH] fix ia64 syscall auditing

[Amy Griffis]

Hello,

Attached is a patch against David's audit.17 kernel that adds checks
for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and
signal handling code paths.  The patch enables auditing of system
calls set up via fsys_bubble_down, as well as ensuring that
audit_syscall_exit() is called on return from sigreturn.

Neglecting to check for TIF_SYSCALL_AUDIT at these points results in
incorrect information in audit_context, causing frequent system panics
when system call auditing is enabled on an ia64 system.

I have tested this patch and have seen no problems with it.

Thanks,
Amy

-------------- next part --------------
diff -Nru linux-2.6.9.orig/arch/ia64/kernel/fsys.S linux-2.6.9/arch/ia64/kernel/fsys.S
--- linux-2.6.9.orig/arch/ia64/kernel/fsys.S	2005-03-31 15:12:33.576513775 -0500
+++ linux-2.6.9/arch/ia64/kernel/fsys.S	2005-03-31 15:51:56.936836386 -0500
@@ -611,7 +611,9 @@
 	movl r2=ia64_ret_from_syscall
 	;;
 	mov rp=r2				// set the real return addr
-	tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
+	and r3=_TIF_SYSCALL_TRACEAUDIT,r3
+	;;
+	cmp.eq p8,p0=r3,r0
 
 (p8)	br.call.sptk.many b6=b6			// ignore this return addr
 	br.cond.sptk ia64_trace_syscall
diff -Nru linux-2.6.9.orig/arch/ia64/kernel/signal.c linux-2.6.9/arch/ia64/kernel/signal.c
--- linux-2.6.9.orig/arch/ia64/kernel/signal.c	2004-10-18 17:54:32.000000000 -0400
+++ linux-2.6.9/arch/ia64/kernel/signal.c	2005-03-31 15:51:56.937812949 -0500
@@ -225,7 +225,8 @@
 	 * could be corrupted.
 	 */
 	retval = (long) &ia64_leave_kernel;
-	if (test_thread_flag(TIF_SYSCALL_TRACE))
+	if (test_thread_flag(TIF_SYSCALL_TRACE) 
+	    || test_thread_flag(TIF_SYSCALL_AUDIT))
 		/*
 		 * strace expects to be notified after sigreturn returns even though the
 		 * context to which we return may not be in the middle of a syscall.