From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76B8B4968EB for ; Thu, 13 Aug 2026 17:04:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640646; cv=none; b=Nk6ZCPNczB0qfY1CKEXyuA1yHU8d5LXATyLU/A3WPHZzkJ6Ag3GjqranxjLp986aA3FmxoLOB6exCzqv+N5Bgd4VpXeeaOmTQGph5e1Gu9g+GLeIyHKkdRm2JWCpVuUqlzqeOXj+dGfyKEZQg6wBCOQ06uUilOnNuXKErFAKH+w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640646; c=relaxed/simple; bh=2dYxDdYBYptEeVdS3EGZmjtxZPQ6vwqrh2eIQ6PP7v8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JVJFxEc7blv+nYNSg1Rbuq23+QmY+Z9cOMJhzXF13Xt7twzUOetDaeC8Y1S/5bxrTWZPGlM9aYbdATAJgILkZBrwo+ItYjT2OI2bZHMm61bXd4nlmyDvgx9MyGoOKJkT4OPIdbiLPFEzIeT+txCkPSO5VKYkphCpldgo/8yZJBM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Q4r7p9+W; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Q4r7p9+W" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640643; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hcj1jFC26/Dufc2/bYrj4t3DzvO2jGBOUyeCAQas2/U=; b=Q4r7p9+W1m8PADbZjTuD3dUZ7X0BtuUqDh+T10FYd9dQDmO6n41VU3aMD73keph6vRNrNh JMZSEzRq1N42PgV3UBMMCQC1EX062usqYTeT9gcWX/x9IkhKKcDqvvl2+2uPdDLZ9Ohf2m I/sWiHA+J9V5GJY37O0YHjhrVh1bOr0= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-482-LYHm2ovYMG-hpFzaOlC5Pw-1; Thu, 13 Aug 2026 13:04:00 -0400 X-MC-Unique: LYHm2ovYMG-hpFzaOlC5Pw-1 X-Mimecast-MFC-AGG-ID: LYHm2ovYMG-hpFzaOlC5Pw_1786640635 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 72D121955F7A; Thu, 13 Aug 2026 17:03:51 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D6B8A195DF9A; Thu, 13 Aug 2026 17:03:36 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 01/13] audit: log all six syscall arguments in the SYSCALL record Date: Thu, 13 Aug 2026 14:02:51 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" The SYSCALL record currently logs only four of the six syscall arguments (a0-a3). The remaining two are captured but silently discarded before reaching the audit context. This leads to the need for auxiliary records when audit-relevant data lands in the 5th or 6th argument of a syscall. Extend the SYSCALL record to log all six arguments, by adding arguments a4 and a5 (5th and 6th syscall argument respectively) inline within the existing record. Additionally, add the two new args to audit rules switch case, so audit rules can filter on them. Lastly, as a minor cleanup, rename params from (a1-a4) to (a0-a5) in __audit_syscall_entry(), for consistency. type=3DSYSCALL ... syscall=3Dopenat ... a3=3D0x0 a4=3D0 a5=3D0 ... type=3DSYSCALL ... syscall=3Dsendto ... a3=3D0x0 a4=3D7fff68843bcc a5=3Dc = ... Link: https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=3Dgqy7dX= 4Ah11RVhdyCBUQ@mail.gmail.com/T/#t Signed-off-by: Ricardo Robaina --- include/linux/audit.h | 11 +++++++---- include/linux/entry-common.h | 3 ++- include/uapi/linux/audit.h | 2 ++ kernel/audit.h | 2 +- kernel/auditfilter.c | 2 ++ kernel/auditsc.c | 31 ++++++++++++++++++++----------- 6 files changed, 34 insertions(+), 17 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 45abb3722d30..7306d7861159 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -324,7 +324,8 @@ extern void __audit_free(struct task_struct *task); extern void __audit_uring_entry(u8 op); extern void __audit_uring_exit(int success, long code); extern void __audit_syscall_entry(int major, unsigned long a0, unsigned lo= ng a1, - unsigned long a2, unsigned long a3); + unsigned long a2, unsigned long a3, + unsigned long a4, unsigned long a5); extern void __audit_syscall_exit(int ret_success, long ret_value); extern void __audit_getname(struct filename *name); extern void __audit_inode(struct filename *name, const struct dentry *dent= ry, @@ -375,10 +376,11 @@ static inline void audit_uring_exit(int success, long= code) } static inline void audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, - unsigned long a3) + unsigned long a3, unsigned long a4, + unsigned long a5) { if (unlikely(audit_context())) - __audit_syscall_entry(major, a0, a1, a2, a3); + __audit_syscall_entry(major, a0, a1, a2, a3, a4, a5); } static inline void audit_syscall_exit(void *pt_regs) { @@ -613,7 +615,8 @@ static inline void audit_uring_exit(int success, long c= ode) { } static inline void audit_syscall_entry(int major, unsigned long a0, unsigned long a1, unsigned long a2, - unsigned long a3) + unsigned long a3, unsigned long a4, + unsigned long a5) { } static inline void audit_syscall_exit(void *pt_regs) { } diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h index 416a3352261f..cf2d9989e3fe 100644 --- a/include/linux/entry-common.h +++ b/include/linux/entry-common.h @@ -65,7 +65,8 @@ static inline void syscall_enter_audit(struct pt_regs *re= gs, long syscall) unsigned long args[6]; =20 syscall_get_arguments(current, regs, args); - audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]); + audit_syscall_entry(syscall, args[0], args[1], args[2], args[3], + args[4], args[5]); } } =20 diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index e8f5ce677df7..6726059d6df1 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -303,6 +303,8 @@ #define AUDIT_ARG1 (AUDIT_ARG0+1) #define AUDIT_ARG2 (AUDIT_ARG0+2) #define AUDIT_ARG3 (AUDIT_ARG0+3) +#define AUDIT_ARG4 (AUDIT_ARG0+4) +#define AUDIT_ARG5 (AUDIT_ARG0+5) =20 #define AUDIT_FILTERKEY 210 =20 diff --git a/kernel/audit.h b/kernel/audit.h index 92d5e723d570..83011b14af18 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -117,7 +117,7 @@ struct audit_context { struct audit_stamp stamp; /* event identifier */ int major; /* syscall number */ int uring_op; /* uring operation */ - unsigned long argv[4]; /* syscall arguments */ + unsigned long argv[6]; /* syscall arguments */ long return_code;/* syscall return code */ u64 prio; int return_valid; /* return code is valid */ diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 7f791afe5791..4bf539d6937d 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -358,6 +358,8 @@ static int audit_field_valid(struct audit_entry *entry,= struct audit_field *f) case AUDIT_ARG1: case AUDIT_ARG2: case AUDIT_ARG3: + case AUDIT_ARG4: + case AUDIT_ARG5: case AUDIT_PERS: /* */ case AUDIT_DEVMINOR: /* all ops are valid */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 6610e667c728..7a9d65a6b1cc 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -728,6 +728,8 @@ static int audit_filter_rules(struct task_struct *tsk, case AUDIT_ARG1: case AUDIT_ARG2: case AUDIT_ARG3: + case AUDIT_ARG4: + case AUDIT_ARG5: if (ctx) result =3D audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->v= al); break; @@ -1674,11 +1676,13 @@ static void audit_log_exit(void) AUDITSC_SUCCESS), context->return_code); audit_log_format(ab, - " a0=3D%lx a1=3D%lx a2=3D%lx a3=3D%lx items=3D%d", + " a0=3D%lx a1=3D%lx a2=3D%lx a3=3D%lx a4=3D%lx a5=3D%lx items=3D%d", context->argv[0], context->argv[1], context->argv[2], context->argv[3], + context->argv[4], + context->argv[5], context->name_count); audit_log_task_info(ab); audit_log_key(ab, context->filterkey); @@ -1970,10 +1974,12 @@ void __audit_uring_exit(int success, long code) /** * __audit_syscall_entry - fill in an audit record at syscall entry * @major: major syscall type (function) - * @a1: additional syscall register 1 - * @a2: additional syscall register 2 - * @a3: additional syscall register 3 - * @a4: additional syscall register 4 + * @a0: additional syscall register 1 + * @a1: additional syscall register 2 + * @a2: additional syscall register 3 + * @a3: additional syscall register 4 + * @a4: additional syscall register 5 + * @a5: additional syscall register 6 * * Fill in audit context at syscall entry. This only happens if the * audit context was created when the task was created and the state or @@ -1983,8 +1989,9 @@ void __audit_uring_exit(int success, long code) * will only be written if another part of the kernel requests that it * be written). */ -void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, - unsigned long a3, unsigned long a4) +void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1, + unsigned long a2, unsigned long a3, + unsigned long a4, unsigned long a5) { struct audit_context *context =3D audit_context(); enum audit_state state; @@ -2012,10 +2019,12 @@ void __audit_syscall_entry(int major, unsigned long= a1, unsigned long a2, =20 context->arch =3D syscall_get_arch(current); context->major =3D major; - context->argv[0] =3D a1; - context->argv[1] =3D a2; - context->argv[2] =3D a3; - context->argv[3] =3D a4; + context->argv[0] =3D a0; + context->argv[1] =3D a1; + context->argv[2] =3D a2; + context->argv[3] =3D a3; + context->argv[4] =3D a4; + context->argv[5] =3D a5; context->context =3D AUDIT_CTX_SYSCALL; context->current_state =3D state; ktime_get_coarse_real_ts64(&context->stamp.ctime); --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3AE0D370AE7 for ; Thu, 13 Aug 2026 17:04:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640659; cv=none; b=bRObamsX1EUujnUNr/CZty0UNj7omevNAwGz+pVL6INxLlu/Oq3kIfL3sUyjW14FxL1IHUddBJcOH7Fbr85UWxhvlvsoH3nZN00AYRew4yB8NsOR1UcBA6gsA+wakCaIltRFGCnoiltgPyQpv7M5uA8BjQBfb8qjO8bunPnkbhs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640659; c=relaxed/simple; bh=9XBV5I17RwFW6E8XHjBQf72B0dwOKDgYR3HERS1dxTU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JsZD0nDSIKYjNKZQAWr95DWUGQ0otI78m0+HSIIxOEGYG/VBwZ7nVDrNvLROtoXT7uDdaojV0mlINulXINtNRQt5EoAHVXyXRnVN/f1sIFqe/ifJhWdyQrWV1Jai8x3hc6UhDYfFIGA0zGdirTc2kIQ51Fda6SJiVY19J9752js= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=VE4HuYQw; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="VE4HuYQw" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GgHNIRpaiGrsleuWQ8qibHY2uklIV42xG6wSQPY4e1M=; b=VE4HuYQwf0ip2zOrU2vqA57BHxzCxI4qtIso3th1iQBVNH65LUVYi7HLcOLUzciHR23wt+ uDb/4KsZUL49YVTfWh/7E0Jc+4eYCouN+b1RjCvvCp+RNkHBeu8HCO3rkutin+jICrRyrS 2A7CtZaqsH5mm/TuFUpsFpnyMjs49J4= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-350-v7F3cTZiOfi696D6EVHhdQ-1; Thu, 13 Aug 2026 13:04:13 -0400 X-MC-Unique: v7F3cTZiOfi696D6EVHhdQ-1 X-Mimecast-MFC-AGG-ID: v7F3cTZiOfi696D6EVHhdQ_1786640647 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5FFB5180066A; Thu, 13 Aug 2026 17:04:06 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 07750195608A; Thu, 13 Aug 2026 17:03:51 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 02/13] alpha: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:02:52 -0300 Message-ID: <7dec380a50e3db536bdec61a33b8f3b2e2e7ec65.1786626275.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (r20, r21) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/alpha/kernel/ptrace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c index 0687760ea466..d90e2194b528 100644 --- a/arch/alpha/kernel/ptrace.c +++ b/arch/alpha/kernel/ptrace.c @@ -396,7 +396,8 @@ asmlinkage unsigned long syscall_trace_enter(void) =20 #ifdef CONFIG_AUDITSYSCALL audit_syscall_entry(syscall_get_nr(current, regs), - regs->r16, regs->r17, regs->r18, regs->r19); + regs->r16, regs->r17, regs->r18, regs->r19, + regs->r20, regs->r21); #endif return syscall_get_nr(current, regs); } --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75B734963A7 for ; Thu, 13 Aug 2026 17:04:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640684; cv=none; b=fe/GA1ju4EAzddeJlRsUdQeDdQyM7DETseDKFkNZqg6gSncLgko7n7j5tNRsRG1bbn2nSZgbcB+AjlS3an8xXH5mqaEV1vJLNXvZR4v76M4hA0UT6VSiWQ/XdrfBrTsBeyLESUzNXyiVAoo9yYg4NWNwc2QoGn9a5Y2uWE92kd0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640684; c=relaxed/simple; bh=CNJuBEFpfNHhwlYW7A4OqSS81mlR/xDc5WSiAgnzZ/A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rf+I/Jwnzhb/nAfc1xmWb9GAjHlRyqZuv4zVpKInAbfSEinArXinjt/UHoMPxEiUyLxeg7zsEU51G1R5WpKr8BsAgWodUHU08xJ2e9dxUfBVNbr0ZvmY+clnKqdS6qwYkcPj9nNoYuMNSzHyfQ6R56ocox6OwB/vZZ2U/zv/Lf0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=KL84zq3h; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="KL84zq3h" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640682; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=n7xFlZn2dL19In3v56MGA4NWAnpSd0AP0zpWmikwEks=; b=KL84zq3hs4GVnPON9BBhMNtVenhrENcsYguwkBCBcqkSfaB2V+3V1ytrLMcVsOYOmrDpcP cyxKbZb6m+My0VnI+qdQdGp3cfQ68wz17P/6q8YeOgBWawfDI5nP2Bk7JW5wsuOD/WA/vd 1tWxEzKILTNe9TyzUk9yQjekSDAwtuo= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-18-F1ZGOoBaOWWr19b0IGlNbA-1; Thu, 13 Aug 2026 13:04:34 -0400 X-MC-Unique: F1ZGOoBaOWWr19b0IGlNbA-1 X-Mimecast-MFC-AGG-ID: F1ZGOoBaOWWr19b0IGlNbA_1786640663 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D1D601955E7A; Thu, 13 Aug 2026 17:04:21 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id CEE67195DF98; Thu, 13 Aug 2026 17:04:06 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 03/13] arm: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:02:53 -0300 Message-ID: <4f787a0c2a27eb919c481875b61a7467ef8ce547.1786626275.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (ARM_r4, ARM_r5) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/arm/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c index 7951b2c06fec..ace74207738d 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c @@ -869,7 +869,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs) trace_sys_enter(regs, scno); =20 audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2, - regs->ARM_r3); + regs->ARM_r3, regs->ARM_r4, regs->ARM_r5); =20 return scno; } --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 89AAC499F0C for ; Thu, 13 Aug 2026 17:04:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640688; cv=none; b=IIFmBMPVrU1IPljRh+PjxbAnTxqeOcMLcebkwWMcGsKXqDdU++jFfWHFuE5XnsxYDtW/uXZ3Y4g6wV/2jp2I91QXhAPTDHr8uX4AX4zSVuJ9CUUnbmvZAKTpWcID/3mCEL4M3FLSTykYSGilYWfbi36lAarpuK2KXUgbJ295yO0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640688; c=relaxed/simple; bh=P4bEV+TSyucsB+oOwDWR+Lt2K4iI4VujhWz5lQywp/s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dA4tH3PjjsiQTf3xj9mNcTaXcJkVVV3nIPeoQWdDW7g2rtf0DzZOR3C4B4+LJ2HYb0XA0IRsxhv+NaocQsnmpKEhU9upy/GqPJFrM+UfyFLjORm2deFd9uK1mrECXrRRbv/Njy+RiAhPSTLNtqPoRdRgq3OxGTncPZtkIDXxqv0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=QvydkzyP; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="QvydkzyP" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640685; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UIpmsX6WtXNHFCRHtGccortX+Ir4DIAT5TQlZZyNQeo=; b=QvydkzyP9xfoLtxWV5/HyYmL+26vW5O7cKwklR87ohpOgpDxOxdAhYd+p7y1prTQfaUBNE BULmGamObwn+PZ1JbQlAuLrwkoA0z86PleG/yljvAPUYydrVUp4xovR91KPPn19LqbAP4I kTB2vJ3TXlp3H9Vijvz1oMSakUWeYT8= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-54-6MwurZx8OlqzEe_HJiXJUg-1; Thu, 13 Aug 2026 13:04:43 -0400 X-MC-Unique: 6MwurZx8OlqzEe_HJiXJUg-1 X-Mimecast-MFC-AGG-ID: 6MwurZx8OlqzEe_HJiXJUg_1786640677 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B9356195609D; Thu, 13 Aug 2026 17:04:35 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 5B0A8195DF9A; Thu, 13 Aug 2026 17:04:22 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 04/13] arm64: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:02:54 -0300 Message-ID: <84e977166dfd72c8c5b53a54e86e149e7ed60672.1786626275.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (regs[4], regs[5]) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/arm64/kernel/ptrace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 4d08598e2891..093c20bff38a 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -2427,7 +2427,8 @@ int syscall_trace_enter(struct pt_regs *regs) trace_sys_enter(regs, regs->syscallno); =20 audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1], - regs->regs[2], regs->regs[3]); + regs->regs[2], regs->regs[3], + regs->regs[4], regs->regs[5]); =20 return regs->syscallno; } --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19DA048F83A for ; Thu, 13 Aug 2026 17:05:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640706; cv=none; b=tg0EF4VVTtP+Z6EvU9Izm/2IoOPmEe8HEWJ5I499MYLRIABITaMluT2HcncGc2xd6wBzGGbWOvWtr9LgWAxP8LMXPemBOwwtFCxuo8FT8zRFD3E3ZOtT2lJaX4hDHP9BaphbOpoVpUj6s+0UkduIAAKlJ8anh+xvb/feNLzNwuI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640706; c=relaxed/simple; bh=ROVvxQd1RBUsp3BLfPbpP5zvkH7LlYcGT22RZlveHG0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Yvxn7KR80u6IqgJRpgfZOfGi+Kzcm9gNdZHyh8R+KV4zgvx++arH6L75WTlYN5LITVk0Ur7Nad9NWIg9DCCE6fCNqXQQk/gvnVkvpqqmUOrjadyD97+q7MSPRWq+jB9KbszpY3W3OLaKoFHiTDwdeBlrkzacLcFDx8pn6SxUGTw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=LT3Jdbot; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="LT3Jdbot" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640704; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RoUr+H27+L/TVykPAPX1fThxJpoZ/Q7OPCOqzzA9raI=; b=LT3JdbotQmfIbVmwIilc74CVx96JOHtbKwd/7EaXiq/e7zO4cPzXremeipKQYK6JaEy/1n d/firoPRfA3DEbRn/bGvWkDieiRowc40N+ESi7nBytFNs6fiYlbeqJ/0dyXaUpXV0yFJEP JzcHZkYHG2NnhgqOVz5JpUu3o50pPx8= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-118-IN5bJnN_OxCEbFxwlktk6Q-1; Thu, 13 Aug 2026 13:04:55 -0400 X-MC-Unique: IN5bJnN_OxCEbFxwlktk6Q-1 X-Mimecast-MFC-AGG-ID: IN5bJnN_OxCEbFxwlktk6Q_1786640690 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 164D9195604C; Thu, 13 Aug 2026 17:04:49 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 31DA8195608A; Thu, 13 Aug 2026 17:04:35 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 05/13] csky: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:02:55 -0300 Message-ID: <0b18395deee1e30aaa53e4cc402f93e6e273a9ad.1786626275.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (a4, a5) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/csky/kernel/ptrace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c index 6bb685a2646b..562eaf23be82 100644 --- a/arch/csky/kernel/ptrace.c +++ b/arch/csky/kernel/ptrace.c @@ -329,7 +329,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, syscall_get_nr(current, regs)); =20 - audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, regs->a2, r= egs->a3); + audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, + regs->a2, regs->a3, regs->a4, regs->a5); return 0; } =20 --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9FEE94968FF for ; Thu, 13 Aug 2026 17:05:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640715; cv=none; b=Zy5LqrAYwU/juUYhTee3QpCdrWZxAUoOITzPCzICiBZc27H+aFirFPDoinMPjkpzthekuuBXDqWIaJu2W60Qg5Sqw+HG+pGLiykO28LK+NeocA/ArJyBPH5yFnfnGdLppd0/N9REUv+cKDG6umKhQK8OIdhbA7w/DXHi6V/hYuk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640715; c=relaxed/simple; bh=GbfZpaJBd81q0U+Y+6xRQMaEOr/17VF6ef/kRJ6DddU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GL517KNWkKntIy6RvRN1BypN+yMO+NFVOY4zs737wmXjCbsdpPDxHu/j9tgKVv5tDiWpuiQyhPmieiQORwEABygVl/PWcwLWTQL/lnwI0AsYAi0v+LWKTTKgS3VAoiM6fG1D/qSZ8s9E7bc2fR6IVbbp6nkSjx9fUS2CHGbRWPU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=SfJH4qLM; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="SfJH4qLM" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640712; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4hWmoGsUF+splwZL2Jc4XbPhM/cn3FE+Io5Xgg3E/U0=; b=SfJH4qLMW4N1pSKs+d0rftV6/yIUzH5twJYbDQJAOtg9ufSWEIGlYesTfahWI71mlIfZsY CI6cJGMXUTO7p6qpnzd8WzLERO8z2qAH6ZDvLgEsd8beSyhA3ZSWnEnTVJQilU8wPxo+/N gKXZIdCW+aReXRRWTCem8UOhXdYZev8= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-541-gbL4XSmqN4CGUkdxqhGf9w-1; Thu, 13 Aug 2026 13:05:07 -0400 X-MC-Unique: gbL4XSmqN4CGUkdxqhGf9w-1 X-Mimecast-MFC-AGG-ID: gbL4XSmqN4CGUkdxqhGf9w_1786640703 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 80F231955E76; Thu, 13 Aug 2026 17:05:02 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 85526195DF98; Thu, 13 Aug 2026 17:04:49 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 06/13] microblaze: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:02:56 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (r9, r10) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/microblaze/kernel/ptrace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrac= e.c index 5234d0c1dcaa..21bcd8dfe42d 100644 --- a/arch/microblaze/kernel/ptrace.c +++ b/arch/microblaze/kernel/ptrace.c @@ -147,7 +147,8 @@ asmlinkage unsigned long do_syscall_trace_enter(struct = pt_regs *regs) */ ret =3D -1L; =20 - audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8); + audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, + regs->r8, regs->r9, regs->r10); =20 return ret ?: regs->r12; } --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F516495539 for ; Thu, 13 Aug 2026 17:05:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640724; cv=none; b=uXVg1cc1dw6SzMo8l1Ohu7ugZQkL6gYzkk9IVQMiLqJxaryWUmXXWQSerFdUA5QSTwOV/rZ5qchqsFnt39QmKOr3+H6Sj5fyKVHzy2hs8pULoxmRi//1IRujMZKW+S95hZHmxinkxJT7yOcphcDFXPHhluxTXi0PpDPvT9c3HZE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640724; c=relaxed/simple; bh=IeB67JuyzakqY1S7Y0qG7Z83fsUgRUkVDzxqGH/T7BQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QojYk/GaLCBzsTTE93T2eI1n6Q2knpqUJJqXImJeDn1Z+w5LSwKDVnxA5iGmjUbZr5BUaHqkEQHkcrGFA6hDEuPOUvM6RZ3Zus5veoNEEcxY7ZpiDQyQwJ4gQgjb4tI1zX6/iENnHpWJ59ldjVlrDAVl/qG1UgOqdL4r7mfJbFU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=O8HEvH9U; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="O8HEvH9U" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640722; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rmq0hRGs7XLSkpGEwHv2UKKAjTQAHgK3a7MrJIwRAjY=; b=O8HEvH9UHjHXYHyK0u2PyATa+Y3XWhiNhXRv5ABDGnqticWqVXjWDfp9Qo34FDGwPohmEZ IvbPgQU5LAUh96btAMTI1r7dvsKt7A3RH5NbRgbr5oEuiTbp+GmQ6dJQgSYN8/fuXMqu1G 8wi7DTe97GE/++zq2CLJwSK1w36Y8SU= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-321-ArqhbR0JPReXkqbQc_9JUg-1; Thu, 13 Aug 2026 13:05:20 -0400 X-MC-Unique: ArqhbR0JPReXkqbQc_9JUg-1 X-Mimecast-MFC-AGG-ID: ArqhbR0JPReXkqbQc_9JUg_1786640715 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E37A91800643; Thu, 13 Aug 2026 17:05:14 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id DBDD3195608A; Thu, 13 Aug 2026 17:05:02 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 07/13] mips: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:02:57 -0300 Message-ID: <212ca026f8a19f564f3b37b03d1d3e09e0de3e47.1786626275.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Use syscall_get_arguments() to retrieve all six arguments portably. On 32-bit MIPS (O32 ABI), arguments 5 and 6 live on the user stack rather than in registers, so direct register access would be wrong. Signed-off-by: Ricardo Robaina --- arch/mips/kernel/ptrace.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c index 3f4c94c88124..9e6f9accdb41 100644 --- a/arch/mips/kernel/ptrace.c +++ b/arch/mips/kernel/ptrace.c @@ -1334,9 +1334,14 @@ asmlinkage long syscall_trace_enter(struct pt_regs *= regs) if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->regs[2]); =20 - audit_syscall_entry(current_thread_info()->syscall, - regs->regs[4], regs->regs[5], - regs->regs[6], regs->regs[7]); + { + unsigned long args[6]; + + syscall_get_arguments(current, regs, args); + audit_syscall_entry(current_thread_info()->syscall, + args[0], args[1], args[2], args[3], + args[4], args[5]); + } =20 /* * Negative syscall numbers are mistaken for rejected syscalls, but --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD4514968FE for ; Thu, 13 Aug 2026 17:05:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640742; cv=none; b=ixdy7BqMFXnAxhwhfQ8gxiXReklL2Zv6ciNuEZ9yzbn48JKH/RWZSKeN8xoyB6Y7DarOhlzMNiQ9EcAsb4cibRVT4t2Frjk4LZT63epGuwKHpJvMkNPfLZK6pjkgzHJIszx9O/FFUdS9hYHpxLKOWj7oi3qZ5CwakbhZRgFfcEA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640742; c=relaxed/simple; bh=BF7Rk9ys0WDDHzHflGAuEI24btvVlm2FbGxQmoRlJhE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AsRg2+DP40d75THtKGuIzx4JtkMAJ8l+xlzuLMqGfp1kBiqatoIYYi+YI5yhqM/XCNlJkvSS71rqJIWjczKHCGdwoR9zEajKd5tHc0ZaDYlOjRmERFXUBsXI7zCNiQ7cnef3/TbboA0hG3AxcHrkKZjZ5Tqzyj+tesBkBf2jCFs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=V6XTLMlB; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="V6XTLMlB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640739; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=m7DByCcmMjMcU6fVtAV0LTF+gTPKITg6ZRJZBP5hclI=; b=V6XTLMlBWq/tDVkNkqnZuXZWwohCXBytxra0TPB0ygSAfigd0Sdci1N5pHZw8fHCiA2pFh HvjM1eYTNp4IkYUJzJ2CjS6FQb2Cqczsd3kXRo6nOFJj2LKusODkqNbeOVFWVhfdbe3tiU qHG3n/9vZPB2bT9exlC+ylRS7eBiSCc= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-483-dZ4Wkn9xN22gyZ5-MF-yqw-1; Thu, 13 Aug 2026 13:05:34 -0400 X-MC-Unique: dZ4Wkn9xN22gyZ5-MF-yqw-1 X-Mimecast-MFC-AGG-ID: dZ4Wkn9xN22gyZ5-MF-yqw_1786640728 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A2B841956071; Thu, 13 Aug 2026 17:05:27 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 76CC6195DF98; Thu, 13 Aug 2026 17:05:15 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 08/13] openrisc: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:02:58 -0300 Message-ID: <1616198d0cfa9434b36fc1ac6055064ae8c08057.1786626275.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (gpr[7], gpr[8]) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/openrisc/kernel/ptrace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c index 552489b24855..197a616d6c65 100644 --- a/arch/openrisc/kernel/ptrace.c +++ b/arch/openrisc/kernel/ptrace.c @@ -302,7 +302,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *= regs) ret =3D -1L; =20 audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4], - regs->gpr[5], regs->gpr[6]); + regs->gpr[5], regs->gpr[6], + regs->gpr[7], regs->gpr[8]); =20 return ret ? : regs->gpr[11]; } --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88BD2499F1E for ; Thu, 13 Aug 2026 17:06:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640765; cv=none; b=ICAkCIOPGz7CubVfEbuy1SuM5silG4b5uJTsnxV/NJ8VBXZU9IEMu1aVlJW+ZZLUlenmVyfm9huc47c63Qiuc9QyaZwEtMlri2PMcFBLXM1qS5lNWB64oD2uJAmQZNYcExZMhtir1E5bt3mDSuObedAn8MM8xo1H5oTpkz07l1c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640765; c=relaxed/simple; bh=fWWVqwOTWCCSPtiWZgdZQXWWck9/HAOBYmYhJBJ4P7M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s6NQ85W5vVN1nN6gCXHpcDJNWqHknEe4WYKSKtQGrLgzx7byxcat8Hc7Pi+0Ql0SVhCBnUloz0YMaU+vkW3xR2ckUwa00tVUSpL2F00xKj0YqscSDEern4Iw0ZS6HtAfu3OnCLq77cIUL6lXQ+qvGqu76Q+Tk7i6iVeunu+gcyM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=FUUpLXff; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="FUUpLXff" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640762; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5/fapztvh+JYJWSbiim6bS/NIIaWMImlcOIjrLe7Emw=; b=FUUpLXffMeeqflmXxott/1tKl804OB+VnWppe9TWqaQE0M7XasknkN7nSNQOaKxZlJq+1f ngH/g8hsU9cEh+W6b5pWbqQH4Z3DIunkiw/fGgOr62P6fY4ZEswN7hiuie1qF8rSINQ0kQ l09ZZpXIXd+zeUCUZ23OU6vIeF457n0= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-478-zTkj5BKiPqGG_JDe6Pk0tQ-1; Thu, 13 Aug 2026 13:05:46 -0400 X-MC-Unique: zTkj5BKiPqGG_JDe6Pk0tQ-1 X-Mimecast-MFC-AGG-ID: zTkj5BKiPqGG_JDe6Pk0tQ_1786640741 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B3E701955F1B; Thu, 13 Aug 2026 17:05:40 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1BBA5195608A; Thu, 13 Aug 2026 17:05:27 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 09/13] parisc: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:02:59 -0300 Message-ID: <90512a215fb9bdd39471c241057c097ed8b93186.1786626275.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update both the native and compat audit_syscall_entry() calls to forward the 5th and 6th syscall arguments (gr[22], gr[21]) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/parisc/kernel/ptrace.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c index 8a17ab7e6e0b..75e74d214a3b 100644 --- a/arch/parisc/kernel/ptrace.c +++ b/arch/parisc/kernel/ptrace.c @@ -362,14 +362,17 @@ long do_syscall_trace_enter(struct pt_regs *regs) #ifdef CONFIG_64BIT if (!is_compat_task()) audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25], - regs->gr[24], regs->gr[23]); + regs->gr[24], regs->gr[23], + regs->gr[22], regs->gr[21]); else #endif audit_syscall_entry(regs->gr[20] & 0xffffffff, regs->gr[26] & 0xffffffff, regs->gr[25] & 0xffffffff, regs->gr[24] & 0xffffffff, - regs->gr[23] & 0xffffffff); + regs->gr[23] & 0xffffffff, + regs->gr[22] & 0xffffffff, + regs->gr[21] & 0xffffffff); =20 /* * Sign extend the syscall number to 64bit since it may have been --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1059E499F24 for ; Thu, 13 Aug 2026 17:06:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640764; cv=none; b=WtyzhWG1aZq/1pXY2SzZMkmc6rP8eRMfrnLf+zA45aD0g2//2VSDy9vnSdtuc9vJBTPmv31YND21kS5/U4C0dCAxFY9Sfb7YyqaYkxkmm4xJV0Wl1XZR2JiJU+63XyrvQG+rJz0OJ47dNnYqohSx9rxtitw3Zat6ZTOR1aTvTc0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640764; c=relaxed/simple; bh=GQUGo/K0SSZv8gZ1d5IhkMoOWnLCmA4LLvNgg0xtwHQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nWRWbSJWrOGW6SqJxDZ5TPZnBbn3Qk/ArhRaTB7Z/VQE5KppLRCZq+XI3+yHkAg3wMp5B/QUUoH0qbk2RFjsNXDU0Hovz/hR2/CF+c12ZvYiUG+i5EK1CcVHT8+ir7FwpR5ZM/FTbCc4oyp3MDnP0Yg5ioZCRwjJSX9nNJUTYWM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=aXtO8MXC; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="aXtO8MXC" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640762; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=PT2ri8aRhgjrTVSTpNbQtsdRkL9ZTdzAq1eD0J7E/1k=; b=aXtO8MXCG2wcq1iEgYrktlt4Y7+3Dl9r7uo/+90Iyhj9O/ClRKU0g6jbrW/M7HSpZBa0Tq xHHK27DkZz/sfe1osicsvKD847Cpx92gWFKVPi1EsQEKgXJGaSSmvlmPDOxKX2PMapiD4F oqIUQt7ssUo1px1MNH7aH6b9SPXrI+Q= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-670-wSnG0OpgNy-hiywKDHrLxQ-1; Thu, 13 Aug 2026 13:05:58 -0400 X-MC-Unique: wSnG0OpgNy-hiywKDHrLxQ-1 X-Mimecast-MFC-AGG-ID: wSnG0OpgNy-hiywKDHrLxQ_1786640753 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id BD6931955DC9; Thu, 13 Aug 2026 17:05:53 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 2F3A4195608A; Thu, 13 Aug 2026 17:05:40 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 10/13] sh: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:03:00 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (regs[0], regs[1]) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/sh/kernel/ptrace_32.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c index 06f765d71a29..3efefd67b457 100644 --- a/arch/sh/kernel/ptrace_32.c +++ b/arch/sh/kernel/ptrace_32.c @@ -467,7 +467,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *= regs) trace_sys_enter(regs, regs->regs[0]); =20 audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5], - regs->regs[6], regs->regs[7]); + regs->regs[6], regs->regs[7], + regs->regs[0], regs->regs[1]); =20 return 0; } --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A9504499F2B for ; Thu, 13 Aug 2026 17:06:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640776; cv=none; b=DKakmNVyyIByo8Q1ct8tP/6EBQd05H4ilTd3eExFoPrZsGQg/GB0maKXKnUrUGgZThrVEHNI/kjM5dvAH4XJxaBIOU9UqVul4w4f6t/BdUAx5to8Uh4Ok9/+L30e/8LbPSrQX9Npqc58t6j6RFBazBYbAhVFy7mWVSW7m36mwsY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640776; c=relaxed/simple; bh=w0jbd1lgYBWjloNI+GXG0PPjt/OCDX0+pwpLokZvL6I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZqDZoCdzQwCFJhQjqBJ5aK34mU44rSHUhkTVGL1/olixpTzkbhtHvYmqlwvaeDQRsalyKti3IsHCoORCadAAU5pye/nfCrAtK/XUAi5OweYYPlEjbern9ZXexLNV0LuzWbZPGGauuyBhyhHliERy15MtAWWXXpVQd1CPemHkuCo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=ODCXjiS1; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ODCXjiS1" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640773; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jpaakGs2Tf7xeoHHoL80KxzX2+hb3XlzydpXYC2fGY4=; b=ODCXjiS12sc6EZtSeLBwzmOVHAibo31rdCKU/M1qsQlP9keQU7j1oafNDYDlDo09ypcsAA L1ETFXVDd85di0u/GRq48treBUTy9bB7oumUjzExXGOp6lrhOdi8J8A4KN3ChiCVFZjaoS bhGrSt0ww4/8+6iWSnpm2nJpWpndB3Q= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-689-wBrpiqygOMm-ilyseSAiJg-1; Thu, 13 Aug 2026 13:06:10 -0400 X-MC-Unique: wBrpiqygOMm-ilyseSAiJg-1 X-Mimecast-MFC-AGG-ID: wBrpiqygOMm-ilyseSAiJg_1786640766 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id EA6521955F3F; Thu, 13 Aug 2026 17:06:05 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 375D4195608A; Thu, 13 Aug 2026 17:05:53 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 11/13] sparc64: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:03:01 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (UREG_I4, UREG_I5) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/sparc/kernel/ptrace_64.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c index 9fc67fa9336f..d0ad3200d789 100644 --- a/arch/sparc/kernel/ptrace_64.c +++ b/arch/sparc/kernel/ptrace_64.c @@ -1100,7 +1100,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *re= gs) =20 audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0], regs->u_regs[UREG_I1], regs->u_regs[UREG_I2], - regs->u_regs[UREG_I3]); + regs->u_regs[UREG_I3], regs->u_regs[UREG_I4], + regs->u_regs[UREG_I5]); =20 return ret; } --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD912499F28 for ; Thu, 13 Aug 2026 17:06:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640790; cv=none; b=uYa5zvkTKey/t3yVtm5FqEwxjJYgxCVFo+8sgnTX5tJHjMb2BQd56lqMiNr+D1J/9XTXWzcA5dGx3HOfGhkCba0PRop44NZhst1i3y+0EKtXDM3LrNecQsizsfDn+Fkl/9TR/KTJCtCDJpbBpFH0sN2bM/lcjb9N+mzk6MaJZ5I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640790; c=relaxed/simple; bh=NpNfO1oxWkx5Q2CNwypUnwKHU6qaSbdW69UUIfjLVL4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GqxajoXvc8aXgD3fNoTh4+f79TQ0ggpPgNxXZGUME2CRLMRc/5ICBVk1Bq847UiH7SerI12nbwhWFXtMjl8PA2qVeRIFcxju2aea/3Ie5RG/O1OHahoA+5oEWRWOQpYqnxhO61rWLbJWWp2gTfLmHz2XwxOvEZjjzDmiiYtrSRo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Hx55e8KH; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Hx55e8KH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640787; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0X07In1qldTGybmdx53x+y5tR/aR+S5pQLXMdfQFUQ4=; b=Hx55e8KH22ARrzwuDEHsOEO9Wqp+OlN3UZDCYJuQhJSzAu4Ta65pP+66AuzcqRvKFHUQJb boIOY311Q+mT8i910/zTJ6te5OfZh6LPolz7W7MMb6CRzxWyc1zBKN9ylb6gG7/wwR/SV0 FLSkM/JPlI0XsiuQ/FLQysR5zg+LLxU= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-537-HbeFCVHqOGGW_1hh13qClQ-1; Thu, 13 Aug 2026 13:06:23 -0400 X-MC-Unique: HbeFCVHqOGGW_1hh13qClQ-1 X-Mimecast-MFC-AGG-ID: HbeFCVHqOGGW_1hh13qClQ_1786640778 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B963618001E6; Thu, 13 Aug 2026 17:06:18 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7586A195608A; Thu, 13 Aug 2026 17:06:06 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 12/13] um: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:03:02 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (UPT_SYSCALL_ARG5, UPT_SYSCALL_ARG6) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/um/kernel/ptrace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c index fdbb37b5c399..c597a368592d 100644 --- a/arch/um/kernel/ptrace.c +++ b/arch/um/kernel/ptrace.c @@ -127,7 +127,9 @@ int syscall_trace_enter(struct pt_regs *regs) UPT_SYSCALL_ARG1(®s->regs), UPT_SYSCALL_ARG2(®s->regs), UPT_SYSCALL_ARG3(®s->regs), - UPT_SYSCALL_ARG4(®s->regs)); + UPT_SYSCALL_ARG4(®s->regs), + UPT_SYSCALL_ARG5(®s->regs), + UPT_SYSCALL_ARG6(®s->regs)); =20 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, UPT_SYSCALL_NR(®s->regs)); --=20 2.55.0 From nobody Tue Sep 29 01:59:55 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E41F439015 for ; Thu, 13 Aug 2026 17:06:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640802; cv=none; b=BfVup1z0jg8S1TbqgXn4FVz2d/gM0fqDL5X8ioW6BOw0633OFuL1qzxixsg/lxd1L4Irr8BMTY5i1mcU0Dq/v9xfBvs/YEKBLSsCk8mKf9dAsuzj9p2hZAt5VnWy/MwAbkCqYaS5pByujrsgawxaWVwuqqp8TOsoul8fZuv/WKI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786640802; c=relaxed/simple; bh=lR8qSzQmvWmaB4RQMK4RGGNQKS1QaeJDt2mblFTguaY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=enyx4TJTvI90JNyXYO6a/1vspstHKytGcihQch81I7mzMQ9444Rgzb+RjBSY4dr3m2znpWrGL2hHi8FLeUMdFVRGIGyu1WVYuppXFa8LaahugKO2AVR4xA+hhpLE3WMmJwc8RanujsHBzBQ6lwp/eg9GzsgiX91w7N7sa/GXgbY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=S5C/n9jn; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="S5C/n9jn" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786640800; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9TxFFtT5q6hhEXv1kvzuRF0i2wkqVQa93JW+RoA9mS8=; b=S5C/n9jnXOQI/9TJ9/zMzVVnfFtqQdYTcUe5/XCetVpCm3VMK1nqrjQgEHlaZD6XLD28hT Xmruhk+TlPHdl4BrZZ+EwlxPwrCHpN02tGw0VqEWz3tJZWS50WTx1vwtEQevh5aEZ40NeS 5Tdk73mzTJTKDd4dXOhWuWr/Kqnhai0= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-448-kZvjQ2dNO5aDefn4CIGjPA-1; Thu, 13 Aug 2026 13:06:37 -0400 X-MC-Unique: kZvjQ2dNO5aDefn4CIGjPA-1 X-Mimecast-MFC-AGG-ID: kZvjQ2dNO5aDefn4CIGjPA_1786640791 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 0777C18002C4; Thu, 13 Aug 2026 17:06:31 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.24]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3411D195608A; Thu, 13 Aug 2026 17:06:18 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH 13/13] xtensa: pass all six syscall args to audit_syscall_entry() Date: Thu, 13 Aug 2026 14:03:03 -0300 Message-ID: <0c7aa94c05b08d959d885b3b0434646a6b2fcfd0.1786626275.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (areg[8], areg[9]) now that the audit core logs all six. Signed-off-by: Ricardo Robaina --- arch/xtensa/kernel/ptrace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c index b80d54b2ea34..122a6ffc0757 100644 --- a/arch/xtensa/kernel/ptrace.c +++ b/arch/xtensa/kernel/ptrace.c @@ -564,7 +564,8 @@ int do_syscall_trace_enter(struct pt_regs *regs) =20 audit_syscall_entry(regs->syscall, regs->areg[6], regs->areg[3], regs->areg[4], - regs->areg[5]); + regs->areg[5], regs->areg[8], + regs->areg[9]); return 1; } =20 --=20 2.55.0