[PATCH] fix ia64 syscall auditing

[David Woodhouse]

On Thu, 2005-03-31 at 16:30 -0500, Amy Griffis wrote:
> Attached is a patch against David's audit.17 kernel that adds checks
> for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and
> signal handling code paths.  The patch enables auditing of system
> calls set up via fsys_bubble_down, as well as ensuring that
> audit_syscall_exit() is called on return from sigreturn.
> 
> Neglecting to check for TIF_SYSCALL_AUDIT at these points results in
> incorrect information in audit_context, causing frequent system panics
> when system call auditing is enabled on an ia64 system.
> 
> I have tested this patch and have seen no problems with it.

Thanks. I'll apply it to the next build of the kernel.

I had to modify it to apply to Linus' current kernel -- please could you
verify that my modification to fsys.S was correct? Note the new line
immediately after the addition. The only IA64 hardware I have easy
access to has wheels, and I believe it's too old to run _any_ Linux
kernel any more.

===== arch/ia64/kernel/fsys.S 1.34 vs edited =====
--- 1.34/arch/ia64/kernel/fsys.S	2005-01-22 22:19:11 +00:00
+++ edited/arch/ia64/kernel/fsys.S	2005-04-01 00:20:32 +01:00
@@ -611,8 +611,10 @@
 	movl r2=ia64_ret_from_syscall
 	;;
 	mov rp=r2				// set the real return addr
-	tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
+	and r3=_TIF_SYSCALL_TRACEAUDIT,r3
 	;;
+	cmp.eq p8,p0=r3,r0
+
 (p10)	br.cond.spnt.many ia64_ret_from_syscall	// p10==true means out registers are more than 8
 (p8)	br.call.sptk.many b6=b6		// ignore this return addr
 	br.cond.sptk ia64_trace_syscall
===== arch/ia64/kernel/signal.c 1.49 vs edited =====
--- 1.49/arch/ia64/kernel/signal.c	2005-01-25 20:23:45 +00:00
+++ edited/arch/ia64/kernel/signal.c	2005-04-01 00:18:29 +01:00
@@ -224,7 +224,8 @@
 	 * could be corrupted.
 	 */
 	retval = (long) &ia64_leave_kernel;
-	if (test_thread_flag(TIF_SYSCALL_TRACE))
+	if (test_thread_flag(TIF_SYSCALL_TRACE) 
+	    || test_thread_flag(TIF_SYSCALL_AUDIT))
 		/*
 		 * strace expects to be notified after sigreturn returns even though the
 		 * context to which we return may not be in the middle of a syscall.


-- 
dwmw2