From patchwork Wed Oct 22 21:36:01 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Gleixner X-Patchwork-Id: 5149891 Return-Path: X-Original-To: patchwork-intel-gfx@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id CEF4C9F374 for ; Fri, 24 Oct 2014 21:29:27 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 1BA1A201C7 for ; Fri, 24 Oct 2014 21:29:27 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 1781220268 for ; Fri, 24 Oct 2014 21:29:26 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id C41316EB30; Fri, 24 Oct 2014 14:24:58 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org X-Greylist: delayed 1653 seconds by postgrey-1.34 at gabe; Wed, 22 Oct 2014 15:03:45 PDT Received: from Galois.linutronix.de (www.linutronix.de [62.245.132.108]) by gabe.freedesktop.org (Postfix) with ESMTP id 24E2D6E394 for ; Wed, 22 Oct 2014 15:03:45 -0700 (PDT) Received: from localhost ([127.0.0.1]) by Galois.linutronix.de with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from ) id 1Xh3Za-0000E2-DR; Wed, 22 Oct 2014 23:36:02 +0200 Date: Wed, 22 Oct 2014 23:36:01 +0200 (CEST) From: Thomas Gleixner To: Eric Paris In-Reply-To: <1414002190.30946.95.camel@localhost> Message-ID: References: <1414002190.30946.95.camel@localhost> User-Agent: Alpine 2.11 (DEB 23 2013-08-11) MIME-Version: 1.0 X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1, SHORTCIRCUIT=-0.0001 Cc: linux-audit@redhat.com, Richard Guy Briggs , Intel Graphics Development , x86@kernel.org, "linux-kernel@vger.kernel.org" , Ingo Molnar , "H. Peter Anvin" Subject: Re: [Intel-gfx] Regression: audit: x86: drop arch from __audit_syscall_entry() interface X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Spam-Status: No, score=-5.6 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Wed, 22 Oct 2014, Eric Paris wrote: > That's really serious. Looking now. Indeed its serious. And it's even more serious as this masterpiece of assembly wreckage was pulled in via your tree w/o having an acked-by one of the x86 maintainers. > On Wed, 2014-10-22 at 16:08 -0200, Paulo Zanoni wrote: > > commit b4f0d3755c5e9cc86292d5fd78261903b4f23d4a > > Author: Richard Guy Briggs > > Date: Tue Mar 4 10:38:06 2014 -0500 > > audit: x86: drop arch from __audit_syscall_entry() interface > > > > According to our QA, their i386 machine doesn't boot anymore. I tried > > to write my own revert for the patch, asked QA to test, and they > > confirmed it "solves" the problem. tglx diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S index 0d0c9d4ab6d5..f9e3fabc8716 100644 --- a/arch/x86/kernel/entry_32.S +++ b/arch/x86/kernel/entry_32.S @@ -449,12 +449,11 @@ sysenter_audit: jnz syscall_trace_entry addl $4,%esp CFI_ADJUST_CFA_OFFSET -4 - /* %esi already in 8(%esp) 6th arg: 4th syscall arg */ - /* %edx already in 4(%esp) 5th arg: 3rd syscall arg */ - /* %ecx already in 0(%esp) 4th arg: 2nd syscall arg */ - movl %ebx,%ecx /* 3rd arg: 1st syscall arg */ - movl %eax,%edx /* 2nd arg: syscall number */ - movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */ + movl %esi,4(%esp) /* 5th arg: 4th syscall arg */ + movl %edx,(%esp) /* 4th arg: 3rd syscall arg */ Bilndly overwriting the stack which holds the syscall arguments is really a brilliant way to ensure security. Thanks,