linux-kernel - Re: Regression: audit: x86: drop arch from __audit_syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5447FF10.3060506@amacapital.net>
Date:	Wed, 22 Oct 2014 12:01:36 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Eric Paris <eparis@...hat.com>, Paulo Zanoni <przanoni@...il.com>
CC:	linux-audit@...hat.com, Richard Guy Briggs <rgb@...hat.com>,
	Intel Graphics Development <intel-gfx@...ts.freedesktop.org>,
	x86@...nel.org,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: Regression: audit: x86: drop arch from __audit_syscall_entry()
 interface

On 10/22/2014 11:23 AM, Eric Paris wrote:
> That's really serious.  Looking now.
> 
> On Wed, 2014-10-22 at 16:08 -0200, Paulo Zanoni wrote:
>> Hi
>>
>> (Cc'ing everybody mentioned in the original patch)
>>
>> I work for Intel, on our Linux Graphics driver - aka i915.ko - and our
>> QA team recently reported a regression on:
>>
>> commit b4f0d3755c5e9cc86292d5fd78261903b4f23d4a
>> Author: Richard Guy Briggs
>> Date:   Tue Mar 4 10:38:06 2014 -0500
>>     audit: x86: drop arch from __audit_syscall_entry() interface
>>
>> According to our QA, their i386 machine doesn't boot anymore. I tried
>> to write my own revert for the patch, asked QA to test, and they
>> confirmed it "solves" the problem.
>>
>> Here are the details of QA' s bug report:
>> https://bugs.freedesktop.org/show_bug.cgi?id=85277 .
>>
>> The trees our QA tests are the development trees from i915.ko:
>> http://cgit.freedesktop.org/drm-intel?h=drm-intel-fixes .
>>
>> I tried searching for other bug reports on the same patch, but
>> couldn't find any. Forgive me if this bug was already reported.
>>
>> Feel free to continue this discussion on the bugzilla report if you want.

This piece:

	movl %esi,4(%esp)		/* 5th arg: 4th syscall arg */
	movl %edx,(%esp)		/* 4th arg: 3rd syscall arg */

looks like it's overwriting syscall arguments.

This is clearly fixable, but an even better fix would be to drop the asm
entirely and switch to two-phase tracing.  Want to do it?  I can test
the seccomp bits if you switch over the asm :)

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/