linux-kernel - Re: [PATCH v10 05/16] arm64: ptrace: Move rseq_syscall() before audit_syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1543d9ab-f8b0-8221-c885-b031008ad3f5@huawei.com>
Date: Thu, 29 Jan 2026 11:50:43 +0800
From: Jinjie Ruan <ruanjinjie@...wei.com>
To: Kevin Brodsky <kevin.brodsky@....com>, Will Deacon <will@...nel.org>
CC: <catalin.marinas@....com>, <oleg@...hat.com>, <tglx@...utronix.de>,
	<peterz@...radead.org>, <luto@...nel.org>, <shuah@...nel.org>,
	<kees@...nel.org>, <wad@...omium.org>, <macro@...am.me.uk>,
	<charlie@...osinc.com>, <akpm@...ux-foundation.org>, <ldv@...ace.io>,
	<anshuman.khandual@....com>, <mark.rutland@....com>, <thuth@...hat.com>,
	<song@...nel.org>, <ryan.roberts@....com>, <ada.coupriediaz@....com>,
	<broonie@...nel.org>, <liqiang01@...inos.cn>, <pengcan@...inos.cn>,
	<kmal@...k.li>, <dvyukov@...gle.com>, <richard.weiyang@...il.com>,
	<reddybalavignesh9979@...il.com>, <linux-arm-kernel@...ts.infradead.org>,
	<linux-kernel@...r.kernel.org>, <linux-kselftest@...r.kernel.org>
Subject: Re: [PATCH v10 05/16] arm64: ptrace: Move rseq_syscall() before
 audit_syscall_exit()



On 2026/1/28 22:53, Kevin Brodsky wrote:
> On 28/01/2026 02:09, Jinjie Ruan wrote:
>>
>> On 2026/1/27 23:06, Kevin Brodsky wrote:
>>> On 27/01/2026 12:34, Jinjie Ruan wrote:
>>>>> [...]
>>>>>
>>>>>>  I'm also concerned that rseq_debug_update_user_cs()
>>>>>> operates on instruction_pointer(regs) which is something that can be
>>>>>> chaned by ptrace.
>>>>> Isn't that true regardless of where rseq_syscall() is called on the
>>>>> syscall exit path, though?
>>>> My understanding is that if instruction_pointer(regs) is hijacked and
>>>> modified via ptrace at the syscall exit (ptrace_report_syscall_exit()),
>>>> this modification will not be observed by rseq. Specifically, in the
>>>> generic entry syscall exit path, rseq_syscall() is unable to detect such
>>>> a PC modification.
>>> Good point. So concretely that means that currently on arm64, one could
>>> make the rseq debug check pass/fail by using the syscall exit trap to
>>> modify PC. OTOH this is impossible with generic entry because the rseq
>>> check is performed first. I'm not sure this is a feature anyone has even
>>> noticed, but it is a user-visible change indeed.
>> After digging into the ptrace code, I found that ptrace does not modify
>> instruction_pointer(regs) on the syscall exit path; it only changes the
>> return value as below.
>> Therefore, if my understanding is correct, Will's concern does not apply
>> here.
>>
>> ptrace_set_syscall_info()
>>   -> ptrace_set_syscall_info_exit()
>>      -> syscall_set_return_value(child, regs, 0, rval)
> 
> I'm not following, how is that related to the call to
> ptrace_report_syscall_exit()? That eventually results in a call to
> ptrace_stop() (via ptrace_notify()), which synchronously causes the
> tracee to sleep and allows the tracer to issue ptrace commands, e.g.
> setting PC.

I realize I had a misunderstanding — PTRACE_SET_SYSCALL_INFO is only one
possible ptrace command. What I actually tried was to modify regs->pc on
the syscall return path using PTRACE_SETREGSET, and the result shows
that I can indeed change regs->pc to make the tracee segment fault.

> 
> - Kevin
>