[PATCH] s390: ensure that syscall arguments are properly masked on s390

Paul Moore pmoore at redhat.com
Wed Jun 22 20:42:51 UTC 2016


From: Paul Moore <paul at paul-moore.com>

When executing s390 code on s390x the syscall arguments are not
properly masked, leading to some malformed audit records.

Signed-off-by: Paul Moore <paul at paul-moore.com>
---
 arch/s390/kernel/ptrace.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 49b1c13..ac1dc74 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -822,6 +822,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 {
 	long ret = 0;
+	unsigned long mask = -1UL;
 
 	/* Do the secure computing check first. */
 	if (secure_computing()) {
@@ -849,9 +850,13 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->gprs[2]);
 
-	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
-			    regs->gprs[3], regs->gprs[4],
-			    regs->gprs[5]);
+#ifdef CONFIG_COMPAT
+        if (test_thread_flag(TIF_31BIT))
+                mask = 0xffffffff;
+#endif
+	audit_syscall_entry(regs->gprs[2], regs->orig_gpr2 & mask,
+			    regs->gprs[3] & mask, regs->gprs[4] & mask,
+			    regs->gprs[5] & mask);
 out:
 	return ret ?: regs->gprs[2];
 }




More information about the Linux-audit mailing list