linux-kernel - Re: [PATCH] audit: do a quick exit when syscall number is invalid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202203270449.WBYQF9X3-lkp@intel.com>
Date:   Sun, 27 Mar 2022 04:55:01 +0800
From:   kernel test robot <lkp@...el.com>
To:     cgel.zte@...il.com, paul@...l-moore.com, eparis@...hat.com,
        linux-audit@...hat.com
Cc:     kbuild-all@...ts.01.org, linux-kernel@...r.kernel.org,
        Yang Yang <yang.yang29@....com.cn>,
        Zeal Robot <zealci@....com.cn>
Subject: Re: [PATCH] audit: do a quick exit when syscall number is invalid

Hi,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on pcmoore-audit/next]
[also build test ERROR on v5.17 next-20220325]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/intel-lab-lkp/linux/commits/cgel-zte-gmail-com/audit-do-a-quick-exit-when-syscall-number-is-invalid/20220326-174904
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git next
config: alpha-allyesconfig (https://download.01.org/0day-ci/archive/20220327/202203270449.WBYQF9X3-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/intel-lab-lkp/linux/commit/052b1a11a0bec23358ecc22ad9b085590efd3057
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review cgel-zte-gmail-com/audit-do-a-quick-exit-when-syscall-number-is-invalid/20220326-174904
        git checkout 052b1a11a0bec23358ecc22ad9b085590efd3057
        # save the config file to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=alpha SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>

All errors (new ones prefixed by >>):

   In file included from include/linux/init.h:5,
                    from kernel/auditsc.c:34:
   kernel/auditsc.c: In function '__audit_syscall_exit':
>> kernel/auditsc.c:2081:61: error: 'NR_syscalls' undeclared (first use in this function); did you mean 'si_syscall'?
    2081 |             unlikely(context->major < 0 || context->major > NR_syscalls))
         |                                                             ^~~~~~~~~~~
   include/linux/compiler.h:78:45: note: in definition of macro 'unlikely'
      78 | # define unlikely(x)    __builtin_expect(!!(x), 0)
         |                                             ^
   kernel/auditsc.c:2081:61: note: each undeclared identifier is reported only once for each function it appears in
    2081 |             unlikely(context->major < 0 || context->major > NR_syscalls))
         |                                                             ^~~~~~~~~~~
   include/linux/compiler.h:78:45: note: in definition of macro 'unlikely'
      78 | # define unlikely(x)    __builtin_expect(!!(x), 0)
         |                                             ^


vim +2081 kernel/auditsc.c

  2063	
  2064	/**
  2065	 * __audit_syscall_exit - deallocate audit context after a system call
  2066	 * @success: success value of the syscall
  2067	 * @return_code: return value of the syscall
  2068	 *
  2069	 * Tear down after system call.  If the audit context has been marked as
  2070	 * auditable (either because of the AUDIT_STATE_RECORD state from
  2071	 * filtering, or because some other part of the kernel wrote an audit
  2072	 * message), then write out the syscall information.  In call cases,
  2073	 * free the names stored from getname().
  2074	 */
  2075	void __audit_syscall_exit(int success, long return_code)
  2076	{
  2077		struct audit_context *context = audit_context();
  2078	
  2079		if (!context || context->dummy ||
  2080		    context->context != AUDIT_CTX_SYSCALL ||
> 2081		    unlikely(context->major < 0 || context->major > NR_syscalls))
  2082			goto out;
  2083	
  2084		/* this may generate CONFIG_CHANGE records */
  2085		if (!list_empty(&context->killed_trees))
  2086			audit_kill_trees(context);
  2087	
  2088		/* run through both filters to ensure we set the filterkey properly */
  2089		audit_filter_syscall(current, context);
  2090		audit_filter_inodes(current, context);
  2091		if (context->current_state < AUDIT_STATE_RECORD)
  2092			goto out;
  2093	
  2094		audit_return_fixup(context, success, return_code);
  2095		audit_log_exit();
  2096	
  2097	out:
  2098		audit_reset_context(context);
  2099	}
  2100	

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp