From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 173704A2A5A for ; Tue, 22 Sep 2026 19:21:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104900; cv=none; b=oBlEEDvhD3LL1kHBdGgO7UsHLucMDVHBH0qrxuaqep+c8rTTCFUEF2t6NG/e733FT0VEVzDj9O5ITc+CEe8qhbsRtBRMA2JF3N4U7al1GFWsw+5wJL2OukHgx37YUfgePtuQ2tnGJOkojGdwIzZWNGb0EaPpMYIgtUs7RFG7Bp0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104900; c=relaxed/simple; bh=iLauW72EWyHueuXG3EXD+TLJ1Aa3TyP73GOPu2LgyR8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rAe1le0pCfOFLq/Qg4NUHbT2m6SdwDwzHU11ppq/cgDwEX1kZ0OnxDQjl/PS0+k7Q1vo90iSI/kwN89J72JADRTSJWwUMOciuTJmTQ6TSDlTUIrTqXJtUC8emSUH85Oe/Q8uUr1CrfiH/AIhQ/Qu/MwyTXJUvWXlJKwVJKqX3bE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Ywdm2urz; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Ywdm2urz" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790104893; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=cvbbR+jvfRtJnkcvWRUCSpiRDTc8Jp7qlX4ZPaYYSmM=; b=Ywdm2urz9oXFsFb7jP0ybIZ62LgAhhFy1z2z+aqeXnnObnCExJDyMwxLYbl3tnO8L0BFc0 GOJgrjVM+h35PO/GSjtkNRly5ZgaVRHtgYQZK57Pv3YfgNwU2VhDRtWrlB60gFcb24TsAZ opYXtHG0HrfGXkb2VFzokcJUamAKq6Q= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-127-Slu2K4xJNmy9lFCzEvpBYA-1; Tue, 22 Sep 2026 15:21:29 -0400 X-MC-Unique: Slu2K4xJNmy9lFCzEvpBYA-1 X-Mimecast-MFC-AGG-ID: Slu2K4xJNmy9lFCzEvpBYA_1790104885 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 84CD61955DC8; Tue, 22 Sep 2026 19:21:23 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 59E523000223; Tue, 22 Sep 2026 19:20:48 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 01/14] audit: log all six syscall arguments in the SYSCALL record Date: Tue, 22 Sep 2026 16:19:53 -0300 Message-ID: <855572d1b7461e7f258547be0f11c74029755110.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" The SYSCALL record currently logs only four of the six syscall arguments (a0-a3). The remaining two are captured but silently discarded before reaching the audit context. This leads to the need for auxiliary records when audit-relevant data lands in the 5th or 6th argument of a syscall. Extend the SYSCALL record to log all six arguments, by adding arguments a4 and a5 (5th and 6th syscall arguments respectively) inline within the existing record. Also add the two new args to the audit rules switch case, so audit rules can filter on them. Rather than plumbing two more register arguments through every architecture's syscall entry path, retrieve the arguments from pt_regs via syscall_get_arguments(). To keep the series bisectable, add new helpers audit_syscall_entry_regs() and __audit_syscall_entry_regs() that take a pointer to pt_regs, rather than modifying the existing ones in place. Later patches convert each architecture over to the new helpers, and a final patch removes the legacy helpers and renames the new ones back to the original naming. audit-testsuite# make test audit-testsuite# ausearch -i -m SYSCALL ... type=3DSYSCALL ... syscall=3Dsendto success=3Dyes exit=3D1088 a0=3D0x4 a1=3D0x7ffe43518b60 a2=3D0x440 a3=3D0x0 a4=3D7ffe43518b4c a5=3Dc type=3DSYSCALL ... syscall=3Dopenat2 success=3Dyes exit=3D4 a0=3D0x3 a1=3D0x7fffc74692c8 a2=3D0x7fffc7467390 a3=3D0x18 a4=3D0 a5=3D7fffc74674f8 type=3DSYSCALL ... syscall=3Dopenat success=3Dyes exit=3D3 a0=3DAT_FDCWD a1=3D0x557ced4141a2 a2=3DO_RDWR|O_NONBLOCK a3=3D0x0 a4=3D0 a5=3D0 ... Suggested-by: Will Deacon Link: https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=3Dgqy7dX= 4Ah11RVhdyCBUQ@mail.gmail.com/T/#t Signed-off-by: Ricardo Robaina Reviewed-by: Oleg Nesterov --- include/linux/audit.h | 8 ++++++ include/uapi/linux/audit.h | 2 ++ kernel/audit.h | 2 +- kernel/auditfilter.c | 2 ++ kernel/auditsc.c | 53 ++++++++++++++++++++++++++++++++++- kernel/entry/syscall-common.c | 4 +-- 6 files changed, 66 insertions(+), 5 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 45abb3722d30..22ffad5b2060 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -325,6 +325,7 @@ extern void __audit_uring_entry(u8 op); extern void __audit_uring_exit(int success, long code); extern void __audit_syscall_entry(int major, unsigned long a0, unsigned lo= ng a1, unsigned long a2, unsigned long a3); +extern void __audit_syscall_entry_regs(int major, struct pt_regs *regs); extern void __audit_syscall_exit(int ret_success, long ret_value); extern void __audit_getname(struct filename *name); extern void __audit_inode(struct filename *name, const struct dentry *dent= ry, @@ -380,6 +381,11 @@ static inline void audit_syscall_entry(int major, unsi= gned long a0, if (unlikely(audit_context())) __audit_syscall_entry(major, a0, a1, a2, a3); } +static inline void audit_syscall_entry_regs(int major, struct pt_regs *reg= s) +{ + if (unlikely(audit_context())) + __audit_syscall_entry_regs(major, regs); +} static inline void audit_syscall_exit(void *pt_regs) { if (unlikely(audit_context())) { @@ -615,6 +621,8 @@ static inline void audit_syscall_entry(int major, unsig= ned long a0, unsigned long a1, unsigned long a2, unsigned long a3) { } +static inline void audit_syscall_entry_regs(int major, struct pt_regs *reg= s) +{ } static inline void audit_syscall_exit(void *pt_regs) { } static inline bool audit_dummy_context(void) diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index e8f5ce677df7..6726059d6df1 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -303,6 +303,8 @@ #define AUDIT_ARG1 (AUDIT_ARG0+1) #define AUDIT_ARG2 (AUDIT_ARG0+2) #define AUDIT_ARG3 (AUDIT_ARG0+3) +#define AUDIT_ARG4 (AUDIT_ARG0+4) +#define AUDIT_ARG5 (AUDIT_ARG0+5) =20 #define AUDIT_FILTERKEY 210 =20 diff --git a/kernel/audit.h b/kernel/audit.h index 92d5e723d570..83011b14af18 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -117,7 +117,7 @@ struct audit_context { struct audit_stamp stamp; /* event identifier */ int major; /* syscall number */ int uring_op; /* uring operation */ - unsigned long argv[4]; /* syscall arguments */ + unsigned long argv[6]; /* syscall arguments */ long return_code;/* syscall return code */ u64 prio; int return_valid; /* return code is valid */ diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index f52645625214..cded3696e3c5 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -358,6 +358,8 @@ static int audit_field_valid(struct audit_entry *entry,= struct audit_field *f) case AUDIT_ARG1: case AUDIT_ARG2: case AUDIT_ARG3: + case AUDIT_ARG4: + case AUDIT_ARG5: case AUDIT_PERS: /* */ case AUDIT_DEVMINOR: /* all ops are valid */ diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 2b9ce0b52511..89f5c518c6f0 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -728,6 +728,8 @@ static int audit_filter_rules(struct task_struct *tsk, case AUDIT_ARG1: case AUDIT_ARG2: case AUDIT_ARG3: + case AUDIT_ARG4: + case AUDIT_ARG5: if (ctx) result =3D audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->v= al); break; @@ -1674,11 +1676,13 @@ static void audit_log_exit(void) AUDITSC_SUCCESS), context->return_code); audit_log_format(ab, - " a0=3D%lx a1=3D%lx a2=3D%lx a3=3D%lx items=3D%d", + " a0=3D%lx a1=3D%lx a2=3D%lx a3=3D%lx a4=3D%lx a5=3D%lx items=3D%d", context->argv[0], context->argv[1], context->argv[2], context->argv[3], + context->argv[4], + context->argv[5], context->name_count); audit_log_task_info(ab); audit_log_key(ab, context->filterkey); @@ -2021,6 +2025,53 @@ void __audit_syscall_entry(int major, unsigned long = a1, unsigned long a2, ktime_get_coarse_real_ts64(&context->stamp.ctime); } =20 +/** + * __audit_syscall_entry_regs - fill in an audit record at syscall entry + * @major: major syscall type (function) + * @regs: the task's register state at syscall entry + * + * Fill in audit context at syscall entry. This only happens if the + * audit context was created when the task was created and the state or + * filters demand the audit context be built. If the state from the + * per-task filter or from the per-syscall filter is AUDIT_STATE_RECORD, + * then the record will be written at syscall exit time (otherwise, it + * will only be written if another part of the kernel requests that it + * be written). + */ +void __audit_syscall_entry_regs(int major, struct pt_regs *regs) +{ + struct audit_context *context =3D audit_context(); + enum audit_state state; + + if (!audit_enabled || !context) + return; + + WARN_ON(context->context !=3D AUDIT_CTX_UNUSED); + WARN_ON(context->name_count); + if (context->context !=3D AUDIT_CTX_UNUSED || context->name_count) { + audit_panic("unrecoverable error in audit_syscall_entry_regs()"); + return; + } + + state =3D context->state; + if (state =3D=3D AUDIT_STATE_DISABLED) + return; + + context->dummy =3D !audit_n_rules; + if (!context->dummy && state =3D=3D AUDIT_STATE_BUILD) { + context->prio =3D 0; + if (auditd_test_task(current)) + return; + } + + context->arch =3D syscall_get_arch(current); + context->major =3D major; + syscall_get_arguments(current, regs, context->argv); + context->context =3D AUDIT_CTX_SYSCALL; + context->current_state =3D state; + ktime_get_coarse_real_ts64(&context->stamp.ctime); +} + /** * __audit_syscall_exit - deallocate audit context after a system call * @success: success value of the syscall diff --git a/kernel/entry/syscall-common.c b/kernel/entry/syscall-common.c index b8eac9efb6fd..70941008beb6 100644 --- a/kernel/entry/syscall-common.c +++ b/kernel/entry/syscall-common.c @@ -22,9 +22,7 @@ void trace_syscall_exit(struct pt_regs *regs, long ret) void syscall_enter_audit(struct pt_regs *regs) { long syscall =3D syscall_get_nr(current, regs); - unsigned long args[6]; =20 - syscall_get_arguments(current, regs, args); - __audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]); + __audit_syscall_entry_regs(syscall, regs); } #endif --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77AEF4A3407 for ; Tue, 22 Sep 2026 19:21:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104920; cv=none; b=esqAX5IHSdFaho7OlzuUWW+XVD+o7dVAYVGxL8nGEzNCD3qn1l5Akmdlh4EBqMSCu+Ow9K8bu8O/NB9+X/Rab6rGINDbvyg9IFLsih83yzuLEQnREdep8zWIbBNfibD4VXfYp5snS+BmvO6q6xlw2D2opiVzCyZTdqfEGZD2JUw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104920; c=relaxed/simple; bh=VrVho6blkpeB6QAuDT/b+bZQOzocsJYbVbZJSeSdyBU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Mt3Id+ufY+f+bzN/BJrB3gOVIiK2RgHsVNYyUfmVAT0MGZjA0TKd/KhMb+W5rj9OjCA4Z1ZoezxGZdXcykfAEPvNtUTNWh4qRGmom/wuwI2hASPN2hFAZ7An3AkIfj5wECPYPe3KdB75xrHkSQYvbQNMnCx1Ub0AuEmzgrIXq2Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=PNYhU7i/; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="PNYhU7i/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790104917; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gYww0Jdljq0rMJ+Cdd9cIDLE5sIonrX21XcvYtukylE=; b=PNYhU7i/aPHPIr3dQFFF9TaUXfMP02EIMer8EwTBmwtb2l/r2MEfR1P2GMj5eVJtJp27qk 3Mb4VhCcYYuUZWghG6kpMAxcCDzP4uCk4IDjUL085tdZqgnrdVUNespHnh/8IP3lb7OJw0 e/2MBBzdVMgGXIVWpNytbQd2fOfUQnU= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-36-9TY9hPQUPFKfrjSHzvaKBQ-1; Tue, 22 Sep 2026 15:21:53 -0400 X-MC-Unique: 9TY9hPQUPFKfrjSHzvaKBQ-1 X-Mimecast-MFC-AGG-ID: 9TY9hPQUPFKfrjSHzvaKBQ_1790104908 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 0B1D91955DC7; Tue, 22 Sep 2026 19:21:46 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 078BE30001B9; Tue, 22 Sep 2026 19:21:23 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 02/14] arm: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:19:54 -0300 Message-ID: <619ddff49b82e8e494c96dc749c8c5114d6df07f.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/arm/kernel/ptrace.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c index ed7a2a87a670..3c5d7fd733ec 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c @@ -868,8 +868,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, scno); =20 - audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2, - regs->ARM_r3); + audit_syscall_entry_regs(scno, regs); =20 return scno; } --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 552D94A3876 for ; Tue, 22 Sep 2026 19:22:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104937; cv=none; b=ISIJ33FvuqhE37zYaJTc+Fk6UsGbN/UaX44BG5Y9vNwlKzZ0IxgmxxLaasc0wbT1B7U2htyRvcF7JjhTNC1pNemJulsWeRPlN7gVkMe1VhNA0apK7CYE4rSS9VSlNoFgCQpxcqww6oiRvIAojDAC+t60lA81RXMc8zIbfm83x6s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104937; c=relaxed/simple; bh=tm4XcfEuI+QOoeC8bRKy7JwvN2QUt9tLxMKVnk5q4O8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eZYU+oUsWOe18Wt3OAQWehLvueRJxhfEuRtH11J1h9AH/nU9hZcO3/GeO9pXJVnCKodZSNaYOs7+oei8KVoUmDyUR3sw3/hEZ6mlFqZcf/KLf5U2mEj3viTudsAXv7JiCmNorFxF3LMau06UQCHwcPqAK7P6Y9qvFvTF9Wyq+l8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=LOj8uDPh; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="LOj8uDPh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790104934; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=G0w6TIumnXpzqNfCSuq+1rdNxssrZo1KLrQHndDrMM8=; b=LOj8uDPh1T04ksEcSy33Dhv/bk3ro1H9nz+vbg7hn1HUFb8zjH3lQM3Ns+E4wBoIPj7Ojp uClzaVZyeo4tAAPsVkImyvt7M9ax2qYxwELCfMEPwZDtvXkmRuXjmFJpH9XiJ6wFk8sUi/ 6Zypytx2lxdIH6xrWkTw8IkC0Gy3q6E= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-694-PxsW4rXUMSytPcy4D04V6w-1; Tue, 22 Sep 2026 15:22:10 -0400 X-MC-Unique: PxsW4rXUMSytPcy4D04V6w-1 X-Mimecast-MFC-AGG-ID: PxsW4rXUMSytPcy4D04V6w_1790104926 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DDED41955DCC; Tue, 22 Sep 2026 19:22:04 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id F26D6300106C; Tue, 22 Sep 2026 19:21:46 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 03/14] arm64: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:19:55 -0300 Message-ID: <8fdf9691eeb33df50ad1257eb36e9ed91a114afc.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina Acked-by: Will Deacon --- arch/arm64/kernel/ptrace.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index f743cbec1c3a..2bcbeafe26a3 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -2476,8 +2476,7 @@ int syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, regs->syscallno); =20 - audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1], - regs->regs[2], regs->regs[3]); + audit_syscall_entry_regs(regs->syscallno, regs); =20 return regs->syscallno; } --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6EFF44A3840 for ; Tue, 22 Sep 2026 19:22:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104967; cv=none; b=UKeORst0FEYoXrK71Z3htB72Zesk4zTrSo6awsJBPmhZHWMkGFifsTN8Kh7209ssw462RW3a/KwGxBs5MITmWs035E0c4y9WQLKqp+KRMDjhPRgSxYztsZ7XEyoQlyIoQ97riuz43oc8lnA0rcxFZ7tcBKCWpKMXnSB4dsB3a14= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104967; c=relaxed/simple; bh=qwZ7Q6/iqFZYSdCeMPVKw2wnPeHY/7WTpvTKRtjLuZ8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C4wZFEGcbYNyuCcLbc6zq3O11fBMiVISBHKGNH67uuYd7Ix1qU6S5DC676Z/oGVTMLXo/txGV7BJLUMQvhH7Tjrtmc42LKBBbNqSo3gIvL8icnE5OElWC4Ccr/90AetxtDI2GBevJwRp6TS6zRrev/VwbhuEpCN9qZUeYWpKeiQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=LxXGInJi; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="LxXGInJi" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790104964; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Wg+mOhQZVjPh8lKEZVXhQ6N0B98P307cOQjP9SNFdaU=; b=LxXGInJi73p5wHjJbVPXeDeMafogTT+g75dk1lG2rK+HVhVlBerMKtN19BSekMLtFKOP6x ttK+tFquHaItka5FC8Z5dTcZHk9zWiPJIv9jW5pk1sqjsVDE1mPJU5EmV+H7eOCnQPR2p2 TIwcQSwYlQqsuOSBZrqQLXt57lbQ1go= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-580-ITGiaM1hPMG-Wxz-vHTsVw-1; Tue, 22 Sep 2026 15:22:39 -0400 X-MC-Unique: ITGiaM1hPMG-Wxz-vHTsVw-1 X-Mimecast-MFC-AGG-ID: ITGiaM1hPMG-Wxz-vHTsVw_1790104954 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9BBA11977304; Tue, 22 Sep 2026 19:22:31 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D28573000223; Tue, 22 Sep 2026 19:22:05 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 04/14] csky: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:19:56 -0300 Message-ID: <6081699cf912416878c42769821a6c6a477a5e13.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/csky/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c index ee2867a1576e..e61b1408737c 100644 --- a/arch/csky/kernel/ptrace.c +++ b/arch/csky/kernel/ptrace.c @@ -329,7 +329,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, syscall_get_nr(current, regs)); =20 - audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, regs->a2, r= egs->a3); + audit_syscall_entry_regs(regs_syscallid(regs), regs); return 0; } =20 --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64EB64A2A40 for ; Tue, 22 Sep 2026 19:23:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104983; cv=none; b=eDEgfo8tFML2Hvkr4yenJNBJvw3RUNBQQjHRyJrLcMPLOXYl18rIXNOlTl4dTh21edEITmBSSXe6mTO65M7OfFTg2LKUC743jUgs//c5FoE7LJF4fvtogk/MCKsIYDj9zWB0P5bnpadcZUO5lYeqxXXSy5/Ukm1ZPHl2vxZ2p7o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790104983; c=relaxed/simple; bh=p/Z9tMB7L2aGlSR1rBtd/rXtDQgfW7fpyP5+y2Yh/rY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Gn/8sfp3Y1rwJdU8LIeaXiOYv1dIqCq/tI+OF/1RwL1E9E4w7LTKT72QFDJ41tLeL9sMHskUtiGqWf8gDHlONUwDFPcT3soyQM5vXoiD4HF337+KG7ydc6P/JOLp1e0B5OZFB6eiGukOqsiD02Ydlnho4kSdcVhjMkLgKnBlAL0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=PbUXwHlf; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="PbUXwHlf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790104980; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mZmcd8+UVmTX70fsiVoE5rvFQv/gCCUJFz3bb+eoWBI=; b=PbUXwHlfpmJQj/Hb0curZudtgrlkmkQvHx98HIbH9xQnlYrQTTKX1sPraS0HEGyiH/ndRR k38QgKEyR7UrRPupLzF5flwazEQWT4D79ofdnfSxrmLpSLoiLVudRmwLwyGPFwGa2wXrlV 0cHHkwP+cpEBRN3DoIEZAZp4DpZzDKI= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-186-joQOHxrGOqy_Cpzz6IZdDA-1; Tue, 22 Sep 2026 15:22:57 -0400 X-MC-Unique: joQOHxrGOqy_Cpzz6IZdDA-1 X-Mimecast-MFC-AGG-ID: joQOHxrGOqy_Cpzz6IZdDA_1790104972 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9AD2818007FD; Tue, 22 Sep 2026 19:22:51 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 20CEA30001B9; Tue, 22 Sep 2026 19:22:31 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 05/14] microblaze: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:19:57 -0300 Message-ID: <8bf782579aa4e549f201e67856600b4a3445ad66.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/microblaze/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrac= e.c index 236264e932d6..d0a540b7370f 100644 --- a/arch/microblaze/kernel/ptrace.c +++ b/arch/microblaze/kernel/ptrace.c @@ -147,7 +147,7 @@ asmlinkage unsigned long do_syscall_trace_enter(struct = pt_regs *regs) */ ret =3D -1L; =20 - audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8); + audit_syscall_entry_regs(regs->r12, regs); =20 return ret ?: regs->r12; } --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 574564A2058 for ; Tue, 22 Sep 2026 19:23:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105005; cv=none; b=ZVMEh/evQTzaFlalfmmXqX3XxwqP4PrM9m5jLYQCXyWjWpT2dcfICiAm6jufYlqv+8Zm0beVZZ10k6WoEdy2oS+tQEMrxbXIeJWT71VgCSIQrQ1ORUSxWzsuTccIqOiuQPIsdUdhmfuoknl+1hv9o1BMP0sL+l8QK0xlf6Ri7qo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105005; c=relaxed/simple; bh=7Muid3eY0Q5+9CzXdt1nCxBCxSWyOFhu9qjSiaxjaVo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FA0Xhw0yMnK2GRaNeWm3Qkld65mIUtbfTrJ4cqm+LAOGlwJ5xF6O6Gl7M+FYettDxVWpg4Ldj0xai1umiYV+25KNO4Y+jLPZ/kuB34CY22mHAe4bIXeDikxprOhRVNtUHPeApJDx5UZPkLD2AW4+1rURXKwzQZllgR6kzKjN0jk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=OdHzwHCv; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="OdHzwHCv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790104998; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vQAC0it22WmNqLqirMrRoxhux+gr8MPT7ObOzletlqE=; b=OdHzwHCvU0musKziMX5nrXW5q9KEHLsNV/3jzM6s52Rxl1hXSwEFHbc0kSm2Fx6mVO2vVC rEHo0Br0zpnokxtgBOkHbf6kXbGxJCzqGR/ypKZJ+3apKpUe2Nu3rXqVjC5ewXVMK6GnQW phGL/j8qG2jMXkwCa9651H9/VHlrsZk= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-543-a_kUyRYgOCyg9kJI5fcJtQ-1; Tue, 22 Sep 2026 15:23:14 -0400 X-MC-Unique: a_kUyRYgOCyg9kJI5fcJtQ-1 X-Mimecast-MFC-AGG-ID: a_kUyRYgOCyg9kJI5fcJtQ_1790104988 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E1BF2195606B; Tue, 22 Sep 2026 19:23:07 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1F59C3001070; Tue, 22 Sep 2026 19:22:51 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 06/14] mips: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:19:58 -0300 Message-ID: <682a26fb450b72cd72d438a089093b7ef42a825a.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/mips/kernel/ptrace.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c index 17dc7249b8ca..c6f4e801cfae 100644 --- a/arch/mips/kernel/ptrace.c +++ b/arch/mips/kernel/ptrace.c @@ -1338,9 +1338,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *r= egs) if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->regs[2]); =20 - audit_syscall_entry(current_thread_info()->syscall, - regs->regs[4], regs->regs[5], - regs->regs[6], regs->regs[7]); + audit_syscall_entry_regs(current_thread_info()->syscall, regs); =20 /* * Negative syscall numbers are mistaken for rejected syscalls, but --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD7173A8737 for ; Tue, 22 Sep 2026 19:23:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105023; cv=none; b=XmV6WEgPE1E9VnuQNG0J/y8xFc+YYsoOKjqaEVNwNKdxWNA09EQO0a45/GwmiQ6ybdQP2JBlQTuXBcf+eBV4whg/a1or9O/OxpeGX789/qXfvS684JYJQ5ixalWy6ww0cBzZOAFErTeYHitapZvif45rnIoNIHIT5H/aZK3gIkI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105023; c=relaxed/simple; bh=ckGciYrVAAhC2Z2sKGVwC12tNKAh/xW2DMu/M5cx2SY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NPgxqWu/ciR+So3dsYArTxK2NbLC231d2toiMPPqxYlwKdA+RkZFM7s+qZlEMZ3wTW6UEsXtjUMGra/wWUhTfOc/QeRSLZgbCnGqRTFYZ6bnVka+GgBXUM5H7sxATHKJsqaQ3Jm8fwM5yf+4X0bgmnid3WIm7ycaMqvI6B9fnMA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NV5zXtJ3; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NV5zXtJ3" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790105020; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SXY6W20YvBti6kb+KXglvixKfo4L3tBRxK3Okw7Om88=; b=NV5zXtJ3mr5lCeql3Ngo5S9UpOCOqCttcOpvRMvLrlBIxakRt6ITc6ZjN7e8qh677WyJlF eHCsXNaV4YfFjCHnPmyggYk+Ak1kPGht1Lfa+LYx2/0xuTKOs1HHH+sAyyKD30XSWTO4Hh yrnxCsC4DYbP+6MiNZyPyLns2Ys/OYc= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-102-1xwJAG4GPBOnmbkxqOi1bA-1; Tue, 22 Sep 2026 15:23:33 -0400 X-MC-Unique: 1xwJAG4GPBOnmbkxqOi1bA-1 X-Mimecast-MFC-AGG-ID: 1xwJAG4GPBOnmbkxqOi1bA_1790105007 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 68B93180062D; Tue, 22 Sep 2026 19:23:26 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 65BAC30001B9; Tue, 22 Sep 2026 19:23:08 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 07/14] openrisc: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:19:59 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/openrisc/kernel/ptrace.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c index 287a9718f0c6..78294c84e4de 100644 --- a/arch/openrisc/kernel/ptrace.c +++ b/arch/openrisc/kernel/ptrace.c @@ -301,8 +301,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *= regs) */ ret =3D -1L; =20 - audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4], - regs->gpr[5], regs->gpr[6]); + audit_syscall_entry_regs(regs->gpr[11], regs); =20 return ret ? : regs->gpr[11]; } --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 84DD5494802 for ; Tue, 22 Sep 2026 19:23:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105035; cv=none; b=NEhvasIHhXCbHmg7A96g2EViZ/qg/njXFPcLLV+xsml+CYxv+SiPQq/JLnaNI+MLiampztoFfO4kGLAKUpkGnAICvJbURkDnOIhWd6ezGpXYpuSMXyZQNj4CsjDNwlN4qAXSffHv2et6RIc6cBEKcbfF1W1aMjXlqxwZeTpssfk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105035; c=relaxed/simple; bh=AlEwOJCqXj75nlY4mRvsGPrbuus/qC7ZFbxnPlHbnpk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e0qSPUEX4HFiAGv02I3H2cibN+68mmgTlxrt6pZ/TLZaqojhX2rUXIySzLlfmdL6CzBjxPKhXBHZwG7ZOKqMSXlOmVJTncSkbfK2jL2OIohx9X4LKlodfC3xqrOTw+Pvp2GNeY9HMqb2xnPaV+F6HqhwfJJQBjK3temXI7eqoMw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=L9GSAW7v; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="L9GSAW7v" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790105032; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4g6Pqq5n7M/gwYtRIbDe68QQcgDz6vnWXZj4Z/2+yek=; b=L9GSAW7vp+JOp9oudnkUi+llwAXwC+UwOaIpzRjRLc0U2Nt0XbE0LMvFcEBTyXpbIRyGNW j82DhE116+1Pmbg1KAMKZ2VyYbaepwygchOGlJXo/nj4whYfrBIr2fAE+Vl1sQGhqUe9Hk iTos0LU6APdQoTyYyxMbfaOKVMSv25U= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-345-WgDPjhSqNVm4ukglLylNhQ-1; Tue, 22 Sep 2026 15:23:50 -0400 X-MC-Unique: WgDPjhSqNVm4ukglLylNhQ-1 X-Mimecast-MFC-AGG-ID: WgDPjhSqNVm4ukglLylNhQ_1790105026 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E3BAE1955E87; Tue, 22 Sep 2026 19:23:45 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E03C63000223; Tue, 22 Sep 2026 19:23:26 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 08/14] parisc: mask compat syscall arguments in syscall_get_arguments() Date: Tue, 22 Sep 2026 16:20:00 -0300 Message-ID: <65f32a82d590b11984723fa6f26ff96175679f9a.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" A 32-bit compat task may leave garbage in the upper 32 bits of the argument registers. Mask it off in syscall_get_arguments() so that in-kernel consumers such as seccomp and audit observe the same values the syscall actually used. This previously happened for audit in the parisc do_syscall_trace_enter() compat path; do it in the helper so all callers benefit and to prepare for passing pt_regs to audit_syscall_entry(). Signed-off-by: Ricardo Robaina --- arch/parisc/include/asm/syscall.h | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/sy= scall.h index c11222798ab2..9d10fada3b48 100644 --- a/arch/parisc/include/asm/syscall.h +++ b/arch/parisc/include/asm/syscall.h @@ -28,12 +28,18 @@ static inline void syscall_get_arguments(struct task_st= ruct *tsk, struct pt_regs *regs, unsigned long *args) { - args[5] =3D regs->gr[21]; - args[4] =3D regs->gr[22]; - args[3] =3D regs->gr[23]; - args[2] =3D regs->gr[24]; - args[1] =3D regs->gr[25]; - args[0] =3D regs->gr[26]; + unsigned long mask =3D -1UL; + + /* Mask off garbage in the upper 32 bits for compat tasks. */ + if (__is_compat_task(tsk)) + mask =3D 0xffffffff; + + args[5] =3D regs->gr[21] & mask; + args[4] =3D regs->gr[22] & mask; + args[3] =3D regs->gr[23] & mask; + args[2] =3D regs->gr[24] & mask; + args[1] =3D regs->gr[25] & mask; + args[0] =3D regs->gr[26] & mask; } =20 static inline void syscall_set_arguments(struct task_struct *tsk, --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76E674A3407 for ; Tue, 22 Sep 2026 19:24:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105053; cv=none; b=XwGeUHcZxSWQ4ivhvVZvWukHlkAoAhxZr+p/cgXLvf3xP5EJDPc/8zos2/Aop3WXWzCKs8yyjzJl6/by4pq1AqT3PNAKdhRsQl1DpD9WETU9RWbghZqJR4at/2K3GZfa86JRVgks8s2GadPSypwmqZ5wdBAWBYUEJIHk86RNExw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105053; c=relaxed/simple; bh=1YIRcw6TVMcmgO62i3P5UTqUzmBXzR6bwpjqAvgmaHo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rRT34xFXru6qlxuynSoOm7xrL4c+aGh1cAZTVFix0+zlnMbKoIH+x+mxApSuQtFiC5jv58mFj3Ly9LeWKqhYhy8MA15TeFSGk21IKqTkkeWu6g+aSq5VjemnBUQ7NqqbjLja9R7EarpuXqPcj3JlfPv58ITjDIcv3Ii/BtgIwvY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=TRiQIpvB; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="TRiQIpvB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790105050; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BCkLKZy59p7aSSwyfXTPaoOl48Jr0ljTw2NZSx5GJk8=; b=TRiQIpvBew2/yMpSX7mxRXhr0ea4LMpMwoDQsS62z6cpJrFfeO9+QFPJRbcVF7SUni3GIh j9c6unPMHzf5vmuUapD6OtVs+Phx6+uT0Ku8bNqpy9Lk1S/bDnOEUZl9vrNSAAcpDZxHN7 OdnKx6PKE9UlfWR3QBvrVQMQOi2cwAY= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-442-IW0o-oMYNpOyqGDeiDJV9Q-1; Tue, 22 Sep 2026 15:24:06 -0400 X-MC-Unique: IW0o-oMYNpOyqGDeiDJV9Q-1 X-Mimecast-MFC-AGG-ID: IW0o-oMYNpOyqGDeiDJV9Q_1790105041 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1BC1E1956050; Tue, 22 Sep 2026 19:24:01 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id CA19B30001B9; Tue, 22 Sep 2026 19:23:47 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 09/14] parisc: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:20:01 -0300 Message-ID: <385724169e030185dc9e0deefb52457ba5581090.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Per-argument compat masking is now handled in syscall_get_arguments() (see the preceding patch), so it is dropped here; the syscall number still needs masking for compat tasks and is left in place. Signed-off-by: Ricardo Robaina --- arch/parisc/kernel/ptrace.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c index 1d9e210702e1..4e62d6bd6466 100644 --- a/arch/parisc/kernel/ptrace.c +++ b/arch/parisc/kernel/ptrace.c @@ -359,15 +359,10 @@ long do_syscall_trace_enter(struct pt_regs *regs) =20 #ifdef CONFIG_64BIT if (!is_compat_task()) - audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25], - regs->gr[24], regs->gr[23]); + audit_syscall_entry_regs(regs->gr[20], regs); else #endif - audit_syscall_entry(regs->gr[20] & 0xffffffff, - regs->gr[26] & 0xffffffff, - regs->gr[25] & 0xffffffff, - regs->gr[24] & 0xffffffff, - regs->gr[23] & 0xffffffff); + audit_syscall_entry_regs(regs->gr[20] & 0xffffffff, regs); =20 /* * Sign extend the syscall number to 64bit since it may have been --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 296704A262D for ; Tue, 22 Sep 2026 19:24:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105069; cv=none; b=J2LWiUQQTLeY5Ah4HB0zSDacMO2gBIwtAGifh+32vmMgg/KxoqGXjzJPmmnQ+6m/dx+hxem/4iLscc+mhmfWXlIpBfWUAvEdx8U+Mc46TPsdSZbYmRPloxfLTVPKZNgbz6cDrEZvVmlTi6G2Fi+84tdxxrrCdlCEulSJA9KLeSg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105069; c=relaxed/simple; bh=/ckS0ToKtmeBUsA/aT3+Ib/WhP7pvCCY4PPu9ccy0cA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=R2Zag+dCDh3djplknO+VNQomjcip30LpWHqrhLtU8KU4wwG+INJC0ucCsx6ggzSXzJ5AzskWxNNf8ItpTM5k+TfjYoRxyVlcjyIT0ojvmkDa8RaoqzPjhfhDBEnW2YdqyTTmm/rR9fBdn3iGDJUAHHeFkwRfRzHvyR/Kcq2iExE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=EVWfTgcf; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="EVWfTgcf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790105067; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=meDQjL8MjPBKtsYVSz6hbRgI19ephdeNDZ0ubR6sAM8=; b=EVWfTgcfBZiRPagn7fIEXe2e8BM6ni7J1vklLQGFN8Ghf7kaoaCWTVjgXe2eMKxPwjvD1I CcWngFjjzNJNbiTV9UX+GBLPdo+95W8Lf/EJkpDm4dK4Mh528kEntnWHPHiqfhYsnM7Us2 7JlCbhpsJK/dnCSd6VY0tE/khnLWsBY= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-226-seAsvbf8MGegDJNPj7g7ig-1; Tue, 22 Sep 2026 15:24:23 -0400 X-MC-Unique: seAsvbf8MGegDJNPj7g7ig-1 X-Mimecast-MFC-AGG-ID: seAsvbf8MGegDJNPj7g7ig_1790105058 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A43411800596; Tue, 22 Sep 2026 19:24:18 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 96C3030001B9; Tue, 22 Sep 2026 19:24:01 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 10/14] sh: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:20:02 -0300 Message-ID: <5dfecab68baf591c7d4c9778550bdc134f81c00e.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/sh/kernel/ptrace_32.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c index 8794081483fb..c82d336611ef 100644 --- a/arch/sh/kernel/ptrace_32.c +++ b/arch/sh/kernel/ptrace_32.c @@ -466,8 +466,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *= regs) if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->regs[0]); =20 - audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5], - regs->regs[6], regs->regs[7]); + audit_syscall_entry_regs(regs->regs[3], regs); =20 return 0; } --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A7100494802 for ; Tue, 22 Sep 2026 19:24:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105088; cv=none; b=FtFuDMAjHWHZHs6TJoFls82StM1gNLTvpc4zeRJzRFFpU0DqvfaItsH+WcVSn9CFY05E0izsfQMiRCtz76CcTCjQf+59eEUQyqY3JEhf4aa6OFM5Ua2P95N8IotGokqgaVGdHBIej5xba9PdLIgSshzsMwR/r01Sb5OlYeJO+t4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105088; c=relaxed/simple; bh=VbSDbmzFXekOoO3LGIjmRkrITdAoQBv92DxIF8ZX1S4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=u8Qsr9ftAt4cQ3tyQPv1WBJq5vS9uRIo7UBpxNfXMAlwbVra3eNICmp5E9b8w0jncTnjBCQc/3IxmeTkgfu0eF0t5rRoFZUiBpRNejF9eZh4AjReXlU/Xl1CDzAVMCCrVq4qFVZNb4Vh9HLSZX/lY3l7Q3jjtNpGpRFyuY5TmwI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=epNuswr1; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="epNuswr1" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790105085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=glfsyXWfGqWjer6O9bWJ0V7bkI/IRLtGkNu2MKc3ICA=; b=epNuswr1hkAzSwEvcwRLKST1/9lhmgeXYvEN4H5YTNeMFj9g0b+UWPTwHQSISRgw9G2z6g bI+8a3tW1GxOm6oNh0W2Lk+K+JGdPHeXPsN0H3YEugzTTt7EXB9W/0UB3Kl7CaeA0NC76+ riuJVAI8vcJE+r0JpObNBiazdBZws0M= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-78-fc3x8R0DMDqODNFNq0UUoQ-1; Tue, 22 Sep 2026 15:24:40 -0400 X-MC-Unique: fc3x8R0DMDqODNFNq0UUoQ-1 X-Mimecast-MFC-AGG-ID: fc3x8R0DMDqODNFNq0UUoQ_1790105076 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 76CDC1955E94; Tue, 22 Sep 2026 19:24:35 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9945330001B9; Tue, 22 Sep 2026 19:24:18 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 11/14] sparc64: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:20:03 -0300 Message-ID: <7e9a7d36bb02704cf8cbab9b4d78832536698470.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/sparc/kernel/ptrace_64.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c index 825ddf55fece..6197de10b45c 100644 --- a/arch/sparc/kernel/ptrace_64.c +++ b/arch/sparc/kernel/ptrace_64.c @@ -1098,9 +1098,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *re= gs) if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->u_regs[UREG_G1]); =20 - audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0], - regs->u_regs[UREG_I1], regs->u_regs[UREG_I2], - regs->u_regs[UREG_I3]); + audit_syscall_entry_regs(regs->u_regs[UREG_G1], regs); =20 return ret; } --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0FA4449C4B7 for ; Tue, 22 Sep 2026 19:25:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105102; cv=none; b=LU1YUcnDHyboOhD0pxDq32hqO644Tm2qpYmT5HeczmJ9R9kg4krAqDkthDFck7NW2XW7qiKUqyV0xlhKXV++L0Nqje6Lo7HcN159Vfe0v82B6gRmRTIM12rQsFoIuhwv/FLBd7TuRu9W84gSeRHbufA88FDloRWe5k5P1TpZbno= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105102; c=relaxed/simple; bh=5zqxZ2fMrgeFI0IviH9NhO2Po/9ZuxvL1LWrp6wrFng=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YHZMXr4mB6CVh3iVog2ohH+f0qgEw2qcJp32xrDhKDQUIdFkSpcLjz88QovnyFsa7iA/2WtAuco6JDMDqIN7kXXabu0qb8VDrkk25D9TWMjB/L2fAZJW2EfHS0Ih4FcNLgXW0ym95F+XGF+/SgskZllVw9Uv/6puog6+cDV0iMs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=c00Ufw62; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="c00Ufw62" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790105099; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=O3tG3UXSO9esh9XEohfwLr6jDVetgvbetn2t8cbip0E=; b=c00Ufw62lqsIxs7WcnoSvVhLnbt6XJ1XGWVdwblU39G02OPXX3JfRel8cguGHesZOvavFA +4AscAAcGndaaZ+fOk6POTV5tbbEwTgy8VpRogV5E0ZLqKh/hJwyU+0guwUXrwQUhgDAn1 nsOJlqQk0m91X/wZ21Y9LCGU/RL8kkE= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-687-G3QXsmNyPDu_3hqtRLUBaw-1; Tue, 22 Sep 2026 15:24:56 -0400 X-MC-Unique: G3QXsmNyPDu_3hqtRLUBaw-1 X-Mimecast-MFC-AGG-ID: G3QXsmNyPDu_3hqtRLUBaw_1790105092 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B137A18007FD; Tue, 22 Sep 2026 19:24:51 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id EFA8A3000223; Tue, 22 Sep 2026 19:24:35 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 12/14] um: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:20:04 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/um/kernel/ptrace.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c index 7da0a5223aa6..17c285e49ddc 100644 --- a/arch/um/kernel/ptrace.c +++ b/arch/um/kernel/ptrace.c @@ -123,11 +123,7 @@ static void send_sigtrap(struct uml_pt_regs *regs, int= error_code) */ int syscall_trace_enter(struct pt_regs *regs) { - audit_syscall_entry(UPT_SYSCALL_NR(®s->regs), - UPT_SYSCALL_ARG1(®s->regs), - UPT_SYSCALL_ARG2(®s->regs), - UPT_SYSCALL_ARG3(®s->regs), - UPT_SYSCALL_ARG4(®s->regs)); + audit_syscall_entry_regs(UPT_SYSCALL_NR(®s->regs), regs); =20 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, UPT_SYSCALL_NR(®s->regs)); --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C4D0F4A3F1C for ; Tue, 22 Sep 2026 19:25:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105121; cv=none; b=UVRC6BCQgqdm09+TKjlVXkd8vutccu6NSroFUOya+7TaJjrApmPk52ffaU7F9xj2lnPrAnQZz8HgW1ryFAb0xWbwIy5GIbQVe3XUTbCeDRyTCXDz7MOdPS/kAx3CajqRHQUheQLAm/jiC6qniwSIXcg+zIHNQXUwzBYZXo8NTvA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105121; c=relaxed/simple; bh=WiI1+Q3KXF64j+A+tGrMh931oj6CMlmz3FGwcX3Ccx4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=K1NAWFPP4aQlrQz/WzBqqoKt0teD3l2VXB+vbLZ4C39zJpsl9WusZxgYyJc9DhZTaTryT/qNVmFUOasbF3vMm6DARd6WDiYP+tF1ogg3tJoh4LgXebMiL8Gzob7YwrMGMKykzeltE9GKu+V4bjAMzlQaskg8klUcyxC8aZH2Vwo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=FSYiC0em; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="FSYiC0em" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790105118; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HtUcIYS68y1afCRJ7EGhHRzm775hNsRrdlPZxwjTWb8=; b=FSYiC0emRcikfUZQ8qYaUCRro7KSFhPFu4FScUMCdM4lu4lL6Nt4iQb/vME+i+dNh6TNOo 1YHtgvwARJkFENKzczxV9dHDtfTTB4uNFF3mXWh632QECaKJNzvefyWoYm8ptfgN6nUpWr 975GuYJ0LYI5yP20yZY8JssQrLn/A7k= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-411-Arzj8FT-PFuOUEU0fp97OQ-1; Tue, 22 Sep 2026 15:25:14 -0400 X-MC-Unique: Arzj8FT-PFuOUEU0fp97OQ-1 X-Mimecast-MFC-AGG-ID: Arzj8FT-PFuOUEU0fp97OQ_1790105108 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A3AA71800BCE; Tue, 22 Sep 2026 19:25:08 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 36BEB30001B9; Tue, 22 Sep 2026 19:24:51 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 13/14] xtensa: pass pt_regs to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:20:05 -0300 Message-ID: <84d1ceabecaa1ddb22600e1b58ea9341c612680b.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" audit_syscall_entry() now takes a pointer to pt_regs and extracts the syscall arguments itself via syscall_get_arguments(). Drop the individual argument registers from the call and pass regs instead. Signed-off-by: Ricardo Robaina --- arch/xtensa/kernel/ptrace.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c index 364e4fdabb00..86e4679b5869 100644 --- a/arch/xtensa/kernel/ptrace.c +++ b/arch/xtensa/kernel/ptrace.c @@ -561,9 +561,7 @@ int do_syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, syscall_get_nr(current, regs)); =20 - audit_syscall_entry(regs->syscall, regs->areg[6], - regs->areg[3], regs->areg[4], - regs->areg[5]); + audit_syscall_entry_regs(regs->syscall, regs); return 1; } =20 --=20 2.55.0 From nobody Thu Sep 24 15:09:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 643774A2E32 for ; Tue, 22 Sep 2026 19:25:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105139; cv=none; b=VIZGlBKBL7SDFf2+BWwW3bN6pIHnhOYu7eiurKoiLemwOVToOYOe02EcfgtA0G1XYfXGA8QD2UHkG/GDDEQT+/Cb4YJVIS3XWOm6fKEO9LwPYrs9vrOQEMY10giSWEaMN8dC0ao+1UnhCiFRLUowcDn4W+qvqZyZj6ZTMQPP+/o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790105139; c=relaxed/simple; bh=8spCMQsob0cbxv0j4UMVHPSzWk2o5wd/oncgmW1WbhE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HUxfrfjvEQrntfJ+ZXhSlOgf91bGTjiTU4LScCqxaJKDlvU0iMlSJDw6Es9Tc+mWKX1VdKY5Tk2H0EESlK3UGBV/j/idL0s2kdtRxr4kRgtt8dkQdqgzMUcbfUvE3Oj24JKrYVBcjrUcU1Xjlpyol55nfLFskFTqziMkmZI1UKo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=EDCxgERT; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="EDCxgERT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790105136; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=b6TM6uu+FM58oALQCRrt4iHL681e2T+gM7AtXU+yYTA=; b=EDCxgERTshi0RBmcW5tZ40xxceecF1q75TUw7Qd1g6NRpLBIaY/FAVv4EkZ+pfOwsuYZP+ OcKYxbsVEeEl0Eev/Vi9Yqj+zwk6O2YZEyJdub9WG16TpQHPBhB6pGWqANEiPVGj+NZTOS t3fLUGVCBtkc33AibTc2jQ1jBKuy06E= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-133-IRN1w4lsMay6e_AHh4r-gw-1; Tue, 22 Sep 2026 15:25:28 -0400 X-MC-Unique: IRN1w4lsMay6e_AHh4r-gw-1 X-Mimecast-MFC-AGG-ID: IRN1w4lsMay6e_AHh4r-gw_1790105124 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 209BD1809C98; Tue, 22 Sep 2026 19:25:24 +0000 (UTC) Received: from wsxc.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 281A830001B9; Tue, 22 Sep 2026 19:25:08 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, bpf@vger.kernel.org Cc: paul@paul-moore.com, eparis@redhat.com, sgrubb@redhat.com, oleg@redhat.com, richard.henderson@linaro.org, mattst88@gmail.com, linmag7@gmail.com, linux@armlinux.org.uk, catalin.marinas@arm.com, will@kernel.org, guoren@kernel.org, monstr@monstr.eu, tsbogend@alpha.franken.de, jonas@southpole.se, stefan.kristiansson@saunalahti.fi, shorne@gmail.com, James.Bottomley@HansenPartnership.com, deller@gmx.de, ysato@users.sourceforge.jp, dalias@libc.org, glaubitz@physik.fu-berlin.de, davem@davemloft.net, andreas@gaisler.com, richard@nod.at, anton.ivanov@cambridgegreys.com, johannes@sipsolutions.net, chris@zankel.net, jcmvbkbc@gmail.com, tglx@kernel.org, peterz@infradead.org, luto@kernel.org, Ricardo Robaina Subject: [PATCH v3 14/14] audit: rename audit_syscall_entry_regs() to audit_syscall_entry() Date: Tue, 22 Sep 2026 16:20:06 -0300 Message-ID: <0bb32d256099870f3f9ca2632cccf58538f882ed.1790088067.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" Now that every architecture has been converted to the pt_regs-based audit_syscall_entry_regs(), the legacy audit_syscall_entry() and __audit_syscall_entry() helpers that took the individual syscall argument registers (a0-a3) no longer have any callers. Remove those legacy helpers and rename audit_syscall_entry_regs() and __audit_syscall_entry_regs() back to audit_syscall_entry() and __audit_syscall_entry(), restoring the original naming. The _regs variants were introduced separately, and the architectures converted one per patch, specifically so this final rename is the only step that removes the old prototype. That keeps the series bisectable: every commit builds, and no caller is ever left referencing a helper that has been removed. Suggested-by: Will Deacon Signed-off-by: Ricardo Robaina Reviewed-by: Oleg Nesterov --- arch/arm/kernel/ptrace.c | 2 +- arch/arm64/kernel/ptrace.c | 2 +- arch/csky/kernel/ptrace.c | 2 +- arch/microblaze/kernel/ptrace.c | 2 +- arch/mips/kernel/ptrace.c | 2 +- arch/openrisc/kernel/ptrace.c | 2 +- arch/parisc/kernel/ptrace.c | 4 +-- arch/sh/kernel/ptrace_32.c | 2 +- arch/sparc/kernel/ptrace_64.c | 2 +- arch/um/kernel/ptrace.c | 2 +- arch/xtensa/kernel/ptrace.c | 2 +- include/linux/audit.h | 21 +++--------- kernel/auditsc.c | 58 ++------------------------------- kernel/entry/syscall-common.c | 2 +- 14 files changed, 19 insertions(+), 86 deletions(-) diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c index 3c5d7fd733ec..e103ec2661cd 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c @@ -868,7 +868,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, scno); =20 - audit_syscall_entry_regs(scno, regs); + audit_syscall_entry(scno, regs); =20 return scno; } diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 2bcbeafe26a3..65532b2a8cd4 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -2476,7 +2476,7 @@ int syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, regs->syscallno); =20 - audit_syscall_entry_regs(regs->syscallno, regs); + audit_syscall_entry(regs->syscallno, regs); =20 return regs->syscallno; } diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c index e61b1408737c..5c3051bcd78c 100644 --- a/arch/csky/kernel/ptrace.c +++ b/arch/csky/kernel/ptrace.c @@ -329,7 +329,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, syscall_get_nr(current, regs)); =20 - audit_syscall_entry_regs(regs_syscallid(regs), regs); + audit_syscall_entry(regs_syscallid(regs), regs); return 0; } =20 diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrac= e.c index d0a540b7370f..5fe9e3a150f4 100644 --- a/arch/microblaze/kernel/ptrace.c +++ b/arch/microblaze/kernel/ptrace.c @@ -147,7 +147,7 @@ asmlinkage unsigned long do_syscall_trace_enter(struct = pt_regs *regs) */ ret =3D -1L; =20 - audit_syscall_entry_regs(regs->r12, regs); + audit_syscall_entry(regs->r12, regs); =20 return ret ?: regs->r12; } diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c index c6f4e801cfae..7a09b4671a54 100644 --- a/arch/mips/kernel/ptrace.c +++ b/arch/mips/kernel/ptrace.c @@ -1338,7 +1338,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *r= egs) if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->regs[2]); =20 - audit_syscall_entry_regs(current_thread_info()->syscall, regs); + audit_syscall_entry(current_thread_info()->syscall, regs); =20 /* * Negative syscall numbers are mistaken for rejected syscalls, but diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c index 78294c84e4de..eca613b84ff8 100644 --- a/arch/openrisc/kernel/ptrace.c +++ b/arch/openrisc/kernel/ptrace.c @@ -301,7 +301,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *= regs) */ ret =3D -1L; =20 - audit_syscall_entry_regs(regs->gpr[11], regs); + audit_syscall_entry(regs->gpr[11], regs); =20 return ret ? : regs->gpr[11]; } diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c index 4e62d6bd6466..948e0cf29ba4 100644 --- a/arch/parisc/kernel/ptrace.c +++ b/arch/parisc/kernel/ptrace.c @@ -359,10 +359,10 @@ long do_syscall_trace_enter(struct pt_regs *regs) =20 #ifdef CONFIG_64BIT if (!is_compat_task()) - audit_syscall_entry_regs(regs->gr[20], regs); + audit_syscall_entry(regs->gr[20], regs); else #endif - audit_syscall_entry_regs(regs->gr[20] & 0xffffffff, regs); + audit_syscall_entry(regs->gr[20] & 0xffffffff, regs); =20 /* * Sign extend the syscall number to 64bit since it may have been diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c index c82d336611ef..e138f529ee7e 100644 --- a/arch/sh/kernel/ptrace_32.c +++ b/arch/sh/kernel/ptrace_32.c @@ -466,7 +466,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *= regs) if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->regs[0]); =20 - audit_syscall_entry_regs(regs->regs[3], regs); + audit_syscall_entry(regs->regs[3], regs); =20 return 0; } diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c index 6197de10b45c..b162585b4a74 100644 --- a/arch/sparc/kernel/ptrace_64.c +++ b/arch/sparc/kernel/ptrace_64.c @@ -1098,7 +1098,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *re= gs) if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) trace_sys_enter(regs, regs->u_regs[UREG_G1]); =20 - audit_syscall_entry_regs(regs->u_regs[UREG_G1], regs); + audit_syscall_entry(regs->u_regs[UREG_G1], regs); =20 return ret; } diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c index 17c285e49ddc..bdc1b18bb342 100644 --- a/arch/um/kernel/ptrace.c +++ b/arch/um/kernel/ptrace.c @@ -123,7 +123,7 @@ static void send_sigtrap(struct uml_pt_regs *regs, int = error_code) */ int syscall_trace_enter(struct pt_regs *regs) { - audit_syscall_entry_regs(UPT_SYSCALL_NR(®s->regs), regs); + audit_syscall_entry(UPT_SYSCALL_NR(®s->regs), regs); =20 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, UPT_SYSCALL_NR(®s->regs)); diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c index 86e4679b5869..327e00c2ebde 100644 --- a/arch/xtensa/kernel/ptrace.c +++ b/arch/xtensa/kernel/ptrace.c @@ -561,7 +561,7 @@ int do_syscall_trace_enter(struct pt_regs *regs) if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) trace_sys_enter(regs, syscall_get_nr(current, regs)); =20 - audit_syscall_entry_regs(regs->syscall, regs); + audit_syscall_entry(regs->syscall, regs); return 1; } =20 diff --git a/include/linux/audit.h b/include/linux/audit.h index 22ffad5b2060..9ce5962bc537 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -323,9 +323,7 @@ extern int audit_alloc(struct task_struct *task); extern void __audit_free(struct task_struct *task); extern void __audit_uring_entry(u8 op); extern void __audit_uring_exit(int success, long code); -extern void __audit_syscall_entry(int major, unsigned long a0, unsigned lo= ng a1, - unsigned long a2, unsigned long a3); -extern void __audit_syscall_entry_regs(int major, struct pt_regs *regs); +extern void __audit_syscall_entry(int major, struct pt_regs *regs); extern void __audit_syscall_exit(int ret_success, long ret_value); extern void __audit_getname(struct filename *name); extern void __audit_inode(struct filename *name, const struct dentry *dent= ry, @@ -374,17 +372,10 @@ static inline void audit_uring_exit(int success, long= code) if (unlikely(audit_context())) __audit_uring_exit(success, code); } -static inline void audit_syscall_entry(int major, unsigned long a0, - unsigned long a1, unsigned long a2, - unsigned long a3) +static inline void audit_syscall_entry(int major, struct pt_regs *regs) { if (unlikely(audit_context())) - __audit_syscall_entry(major, a0, a1, a2, a3); -} -static inline void audit_syscall_entry_regs(int major, struct pt_regs *reg= s) -{ - if (unlikely(audit_context())) - __audit_syscall_entry_regs(major, regs); + __audit_syscall_entry(major, regs); } static inline void audit_syscall_exit(void *pt_regs) { @@ -617,11 +608,7 @@ static inline void audit_uring_entry(u8 op) { } static inline void audit_uring_exit(int success, long code) { } -static inline void audit_syscall_entry(int major, unsigned long a0, - unsigned long a1, unsigned long a2, - unsigned long a3) -{ } -static inline void audit_syscall_entry_regs(int major, struct pt_regs *reg= s) +static inline void audit_syscall_entry(int major, struct pt_regs *regs) { } static inline void audit_syscall_exit(void *pt_regs) { } diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 89f5c518c6f0..cf45c782b03d 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1974,60 +1974,6 @@ void __audit_uring_exit(int success, long code) /** * __audit_syscall_entry - fill in an audit record at syscall entry * @major: major syscall type (function) - * @a1: additional syscall register 1 - * @a2: additional syscall register 2 - * @a3: additional syscall register 3 - * @a4: additional syscall register 4 - * - * Fill in audit context at syscall entry. This only happens if the - * audit context was created when the task was created and the state or - * filters demand the audit context be built. If the state from the - * per-task filter or from the per-syscall filter is AUDIT_STATE_RECORD, - * then the record will be written at syscall exit time (otherwise, it - * will only be written if another part of the kernel requests that it - * be written). - */ -void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, - unsigned long a3, unsigned long a4) -{ - struct audit_context *context =3D audit_context(); - enum audit_state state; - - if (!audit_enabled || !context) - return; - - WARN_ON(context->context !=3D AUDIT_CTX_UNUSED); - WARN_ON(context->name_count); - if (context->context !=3D AUDIT_CTX_UNUSED || context->name_count) { - audit_panic("unrecoverable error in audit_syscall_entry()"); - return; - } - - state =3D context->state; - if (state =3D=3D AUDIT_STATE_DISABLED) - return; - - context->dummy =3D !audit_n_rules; - if (!context->dummy && state =3D=3D AUDIT_STATE_BUILD) { - context->prio =3D 0; - if (auditd_test_task(current)) - return; - } - - context->arch =3D syscall_get_arch(current); - context->major =3D major; - context->argv[0] =3D a1; - context->argv[1] =3D a2; - context->argv[2] =3D a3; - context->argv[3] =3D a4; - context->context =3D AUDIT_CTX_SYSCALL; - context->current_state =3D state; - ktime_get_coarse_real_ts64(&context->stamp.ctime); -} - -/** - * __audit_syscall_entry_regs - fill in an audit record at syscall entry - * @major: major syscall type (function) * @regs: the task's register state at syscall entry * * Fill in audit context at syscall entry. This only happens if the @@ -2038,7 +1984,7 @@ void __audit_syscall_entry(int major, unsigned long a= 1, unsigned long a2, * will only be written if another part of the kernel requests that it * be written). */ -void __audit_syscall_entry_regs(int major, struct pt_regs *regs) +void __audit_syscall_entry(int major, struct pt_regs *regs) { struct audit_context *context =3D audit_context(); enum audit_state state; @@ -2049,7 +1995,7 @@ void __audit_syscall_entry_regs(int major, struct pt_= regs *regs) WARN_ON(context->context !=3D AUDIT_CTX_UNUSED); WARN_ON(context->name_count); if (context->context !=3D AUDIT_CTX_UNUSED || context->name_count) { - audit_panic("unrecoverable error in audit_syscall_entry_regs()"); + audit_panic("unrecoverable error in audit_syscall_entry()"); return; } =20 diff --git a/kernel/entry/syscall-common.c b/kernel/entry/syscall-common.c index 70941008beb6..471db2a8e09d 100644 --- a/kernel/entry/syscall-common.c +++ b/kernel/entry/syscall-common.c @@ -23,6 +23,6 @@ void syscall_enter_audit(struct pt_regs *regs) { long syscall =3D syscall_get_nr(current, regs); =20 - __audit_syscall_entry_regs(syscall, regs); + __audit_syscall_entry(syscall, regs); } #endif --=20 2.55.0