[PATCH] audit: do a quick exit when syscall number is invalid

Enzo Matsumiya ematsumiya at suse.de
Tue Mar 29 02:19:41 UTC 2022


On 03/29, CGEL wrote:
>>    In file included from include/linux/init.h:5,
>>                     from kernel/auditsc.c:34:
>>    kernel/auditsc.c: In function '__audit_syscall_exit':
>> >> kernel/auditsc.c:2081:61: error: 'NR_syscalls' undeclared (first use in this function); did you mean 'si_syscall'?
>>     2081 |             unlikely(context->major < 0 || context->major > NR_syscalls))
>>          |                                                             ^~~~~~~~~~~
>
>Sorry could anybody give a hand to solve this? It works well on x86_64 and arm64.
>I have no alpha environment and not familiar to this arch, much thanks!

Sorry, no experience either, but from a quick look at arch/alpha/include/asm/unistd.h
shows that it's called NR_SYSCALLS for alpha arch, for whatever reason.


HTH

Enzo



More information about the Linux-audit mailing list