linux-kernel - Re: [PATCH] audit: do a quick exit when syscall number is invalid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 29 Mar 2022 01:48:01 +0000
From:   CGEL <cgel.zte@...il.com>
To:     rth@...ddle.net, ink@...assic.park.msu.ru, mattst88@...il.com,
        paul@...l-moore.com
Cc:     paul@...l-moore.com, eparis@...hat.com, linux-audit@...hat.com,
        kbuild-all@...ts.01.org, linux-kernel@...r.kernel.org,
        Yang Yang <yang.yang29@....com.cn>,
        Zeal Robot <zealci@....com.cn>
Subject: Re: [PATCH] audit: do a quick exit when syscall number is invalid

On Sun, Mar 27, 2022 at 04:55:01AM +0800, kernel test robot wrote:
> Hi,
> 
> Thank you for the patch! Yet something to improve:
> 
> [auto build test ERROR on pcmoore-audit/next]
> [also build test ERROR on v5.17 next-20220325]
> [If your patch is applied to the wrong git tree, kindly drop us a note.
> And when submitting patch, we suggest to use '--base' as documented in
> https://git-scm.com/docs/git-format-patch]
> 
> url:    https://github.com/intel-lab-lkp/linux/commits/cgel-zte-gmail-com/audit-do-a-quick-exit-when-syscall-number-is-invalid/20220326-174904
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git next
> config: alpha-allyesconfig (https://download.01.org/0day-ci/archive/20220327/202203270449.WBYQF9X3-lkp@intel.com/config)
> compiler: alpha-linux-gcc (GCC) 11.2.0
> reproduce (this is a W=1 build):
>         wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
>         chmod +x ~/bin/make.cross
>         # https://github.com/intel-lab-lkp/linux/commit/052b1a11a0bec23358ecc22ad9b085590efd3057
>         git remote add linux-review https://github.com/intel-lab-lkp/linux
>         git fetch --no-tags linux-review cgel-zte-gmail-com/audit-do-a-quick-exit-when-syscall-number-is-invalid/20220326-174904
>         git checkout 052b1a11a0bec23358ecc22ad9b085590efd3057
>         # save the config file to linux build tree
>         mkdir build_dir
>         COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=alpha SHELL=/bin/bash
> 
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@...el.com>
> 
> All errors (new ones prefixed by >>):
> 
>    In file included from include/linux/init.h:5,
>                     from kernel/auditsc.c:34:
>    kernel/auditsc.c: In function '__audit_syscall_exit':
> >> kernel/auditsc.c:2081:61: error: 'NR_syscalls' undeclared (first use in this function); did you mean 'si_syscall'?
>     2081 |             unlikely(context->major < 0 || context->major > NR_syscalls))
>          |                                                             ^~~~~~~~~~~

Sorry could anybody give a hand to solve this? It works well on x86_64 and arm64.
I have no alpha environment and not familiar to this arch, much thanks!

>    include/linux/compiler.h:78:45: note: in definition of macro 'unlikely'
>       78 | # define unlikely(x)    __builtin_expect(!!(x), 0)
>          |                                             ^
>    kernel/auditsc.c:2081:61: note: each undeclared identifier is reported only once for each function it appears in
>     2081 |             unlikely(context->major < 0 || context->major > NR_syscalls))
>          |                                                             ^~~~~~~~~~~
>    include/linux/compiler.h:78:45: note: in definition of macro 'unlikely'
>       78 | # define unlikely(x)    __builtin_expect(!!(x), 0)
>          |                                             ^
> 
> 
> vim +2081 kernel/auditsc.c
> 
>   2063	
>   2064	/**
>   2065	 * __audit_syscall_exit - deallocate audit context after a system call
>   2066	 * @success: success value of the syscall
>   2067	 * @return_code: return value of the syscall
>   2068	 *
>   2069	 * Tear down after system call.  If the audit context has been marked as
>   2070	 * auditable (either because of the AUDIT_STATE_RECORD state from
>   2071	 * filtering, or because some other part of the kernel wrote an audit
>   2072	 * message), then write out the syscall information.  In call cases,
>   2073	 * free the names stored from getname().
>   2074	 */
>   2075	void __audit_syscall_exit(int success, long return_code)
>   2076	{
>   2077		struct audit_context *context = audit_context();
>   2078	
>   2079		if (!context || context->dummy ||
>   2080		    context->context != AUDIT_CTX_SYSCALL ||
> > 2081		    unlikely(context->major < 0 || context->major > NR_syscalls))
>   2082			goto out;
>   2083	
>   2084		/* this may generate CONFIG_CHANGE records */
>   2085		if (!list_empty(&context->killed_trees))
>   2086			audit_kill_trees(context);
>   2087	
>   2088		/* run through both filters to ensure we set the filterkey properly */
>   2089		audit_filter_syscall(current, context);
>   2090		audit_filter_inodes(current, context);
>   2091		if (context->current_state < AUDIT_STATE_RECORD)
>   2092			goto out;
>   2093	
>   2094		audit_return_fixup(context, success, return_code);
>   2095		audit_log_exit();
>   2096	
>   2097	out:
>   2098		audit_reset_context(context);
>   2099	}
>   2100	
> 
> -- 
> 0-DAY CI Kernel Test Service
> https://01.org/lkp