linux-kernel - Re: Regression: audit: x86: drop arch from __audit_syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 22 Oct 2014 12:20:31 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Richard Guy Briggs <rgb@...hat.com>
Cc:	Eric Paris <eparis@...hat.com>, Paulo Zanoni <przanoni@...il.com>,
	linux-audit@...hat.com,
	Intel Graphics Development <intel-gfx@...ts.freedesktop.org>,
	X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: Regression: audit: x86: drop arch from __audit_syscall_entry() interface

On Wed, Oct 22, 2014 at 12:16 PM, Richard Guy Briggs <rgb@...hat.com> wrote:
> On 14/10/22, Andy Lutomirski wrote:
>> On 10/22/2014 11:23 AM, Eric Paris wrote:
>> > That's really serious.  Looking now.
>> >
>> > On Wed, 2014-10-22 at 16:08 -0200, Paulo Zanoni wrote:
>> >> Hi
>> >>
>> >> (Cc'ing everybody mentioned in the original patch)
>> >>
>> >> I work for Intel, on our Linux Graphics driver - aka i915.ko - and our
>> >> QA team recently reported a regression on:
>> >>
>> >> commit b4f0d3755c5e9cc86292d5fd78261903b4f23d4a
>> >> Author: Richard Guy Briggs
>> >> Date:   Tue Mar 4 10:38:06 2014 -0500
>> >>     audit: x86: drop arch from __audit_syscall_entry() interface
>> >>
>> >> According to our QA, their i386 machine doesn't boot anymore. I tried
>> >> to write my own revert for the patch, asked QA to test, and they
>> >> confirmed it "solves" the problem.
>> >>
>> >> Here are the details of QA' s bug report:
>> >> https://bugs.freedesktop.org/show_bug.cgi?id=85277 .
>> >>
>> >> The trees our QA tests are the development trees from i915.ko:
>> >> http://cgit.freedesktop.org/drm-intel?h=drm-intel-fixes .
>> >>
>> >> I tried searching for other bug reports on the same patch, but
>> >> couldn't find any. Forgive me if this bug was already reported.
>> >>
>> >> Feel free to continue this discussion on the bugzilla report if you want.
>>
>> This piece:
>>
>>       movl %esi,4(%esp)               /* 5th arg: 4th syscall arg */
>>       movl %edx,(%esp)                /* 4th arg: 3rd syscall arg */
>>
>> looks like it's overwriting syscall arguments.
>>
>> This is clearly fixable, but an even better fix would be to drop the asm
>> entirely and switch to two-phase tracing.  Want to do it?  I can test
>> the seccomp bits if you switch over the asm :)
>
> Like what you did for x86_64.  That sounds worth investigating.
>
> I'll have a look at the asm, but I'm being distracted by a gunman loose
> 2km from me and my wife and kids under lockdown in two different
> locations on the other side of the shooting site.  Had to cancel lunch
> today with two work colleagues 1/2km away from that site.  ...not been a
> productive day.
>

That's putting it mildly.  Stay safe.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/