linux-kernel - Re: [PATCH] arm: prevent BUG_ON in audit_syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 5 Sep 2014 10:52:52 +0100
From:	Russell King - ARM Linux <linux@....linux.org.uk>
To:	AKASHI Takahiro <takahiro.akashi@...aro.org>
Cc:	will.deacon@....com, viro@...iv.linux.org.uk, eparis@...hat.com,
	rgb@...hat.com, dsaxena@...aro.org,
	linux-arm-kernel@...ts.infradead.org,
	linaro-kernel@...ts.linaro.org, linux-kernel@...r.kernel.org,
	linux-audit@...hat.com
Subject: Re: [PATCH] arm: prevent BUG_ON in audit_syscall_entry()

On Fri, Sep 05, 2014 at 06:46:33PM +0900, AKASHI Takahiro wrote:
> BUG_ON() in audit_syscall_entry() will be hit if user issues syscall(-1)
> while syscall auditing is enabled (that is, by starting auditd).
> In fact, syscall(-1) just fails (not signaled despite the expectation,
> this is another minor bug), but the succeeding syscall hits BUG_ON.
> 
> When auditing syscall(-1), audit_syscall_entry() is called anyway, but
> audit_syscall_exit() is not called and then 'in_syscall' flag in thread's
> audit context is kept on. In this way, audit_syscall_entry() against
> the succeeding syscall will see BUG_ON(in_syscall).
> 
> This patch fixes this bug by
> 1) enforcing syscall exit tracing, including audit_syscall_exit(), to be
>    executed in all cases,

Really, no.  That adds additional overhead to every syscall, and that
matters for system performance.  We want to have as little as possible
overhead here.

The second issue here is that you haven't explained where the oops
occurs.  It's seen as a good practice to include the oops dump for the
bug you're fixing in the commit changelog, so that others can see the
starting point for the investigation, and see exactly where things are
going wrong.

-- 
FTTC broadband for 0.8mile line: currently at 9.5Mbps down 400kbps up
according to speedtest.net.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/