Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp5090637iob; Mon, 9 May 2022 08:25:13 -0700 (PDT) X-Google-Smtp-Source: ABdhPJy6bteF8jyDBgcuvnKBITu4NcSOYxBFQvqSLxA9f+yVtle6d0rd73Wx55eEYWBtKAC5LWIy X-Received: by 2002:a05:6808:56b:b0:325:9f5e:3fd4 with SMTP id j11-20020a056808056b00b003259f5e3fd4mr11245262oig.199.1652109912857; Mon, 09 May 2022 08:25:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1652109912; cv=none; d=google.com; s=arc-20160816; b=w6qxFgBUXnYoua4FHEKZmIcECF+MwIIZzgzDnCqSZY55//z5uRazDS41yx7n+oU3Xl j1eQKZ1p7XCydP5WiZowFgl4gl5NFhUZoePIh0AfSPZDVUyEsE62NqYHowiTJGzUUEZF AH4avwSWb8Ohw4hGxeCq3huDbgLUDjmH0POWgEdmB89twtj8bG3ezbX0zRJ/fKnji1b7 8fm9aoVxTKdxhEV5cFXk5hOqmhGDGTr3RBDiy2grE0Dg7p52CaBQmM9rubXEbpdooFsw KfiBMD0/WBu/W3sIxuxlL+t9BhRtMc5axSI50PvDjPpsvTRJe1OaQ0l0t2qz/6SBW0/W 9kpA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature:dkim-filter; bh=XfhHrRThZF8aOS0rr6qXUwCmQQucSBuKvTVfiEM2qbk=; b=yAKSduIPp8ilYjRhWnrxy8KFRAbeil94liRGqBcH2H9iPKrJXpwprQWoZLpkFI0E2x bCDxx+t8sgSnmss35iO03mSTBZ7r0XIcT9Tt4Mu3uomLYmkUUNqcYyJPesAvC1TNDePi lw1TCvJJ8q53ZBENIwbAVX8MqJvyYLWSFnasX1UOkC0u+DAaOByoQ9ebqB2q1vUA7052 43iFqKQHrGQJr5ilSZUxVLQ1ehRdpJL38Sv8jQ3WC+ccj7wdvdjj/FAh53XvZrx/pqVB EB3pxizxiOKqhpo0jw9L4fVse/f7ds8sUVq3VZba2JEBo+i+hKy+cH03wA4m5gN4giUD T7qg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=KfP8DfNA; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [23.128.96.19]) by mx.google.com with ESMTPS id bg10-20020a056808178a00b00326bab97d47si5565356oib.84.2022.05.09.08.25.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 May 2022 08:25:12 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.microsoft.com header.s=default header.b=KfP8DfNA; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.microsoft.com Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id AD26C291CF3; Mon, 9 May 2022 08:20:34 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238267AbiEIPYU (ORCPT + 99 others); Mon, 9 May 2022 11:24:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50798 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238199AbiEIPYN (ORCPT ); Mon, 9 May 2022 11:24:13 -0400 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 2F77F28FE9E; Mon, 9 May 2022 08:20:19 -0700 (PDT) Received: from localhost.localdomain (154.pool92-186-13.dynamic.orange.es [92.186.13.154]) by linux.microsoft.com (Postfix) with ESMTPSA id AD3C920EC5B5; Mon, 9 May 2022 08:20:14 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com AD3C920EC5B5 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1652109618; bh=XfhHrRThZF8aOS0rr6qXUwCmQQucSBuKvTVfiEM2qbk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KfP8DfNAI4MBKVrm9g3GFZPRXm2UsXbAXmZc9kUs++r8+cQlyhl2L3hojSj8kbyi4 Vksl/ezacECICq5brWkqXPeiatkBkOPvlSoGfhRmHcvqaLVLc9mAWgvZaAN2kd2Whq xO/hMuKxaUpjSDLfB2hPytjNjVLDSjgFwtltB4lo= From: Francis Laniel To: linux-arm-kernel@lists.infradead.org Cc: linux-trace-devel@vger.kernel.org, Francis Laniel , Catalin Marinas , Will Deacon , Mark Brown , Peter Collingbourne , Mark Rutland , Kees Cook , Daniel Kiss , linux-kernel@vger.kernel.org Subject: [RFC PATCH v1 1/1] arm64: Forget syscall if different from execve*() Date: Mon, 9 May 2022 16:19:57 +0100 Message-Id: <20220509151958.441240-2-flaniel@linux.microsoft.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220509151958.441240-1-flaniel@linux.microsoft.com> References: <20220509151958.441240-1-flaniel@linux.microsoft.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-9.5 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE, USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch enables exeve*() to be traced by syscalls:sys_exit_execve tracepoint. Previously, calling forget_syscall() would set syscall to -1, which impedes this tracepoint to prints its information. So, this patch makes call to forget_syscall() conditional by only calling it when syscall number is not execve() or execveat(). Signed-off-by: Francis Laniel --- arch/arm64/include/asm/processor.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h index 73e38d9a540c..e12ceb363d6a 100644 --- a/arch/arm64/include/asm/processor.h +++ b/arch/arm64/include/asm/processor.h @@ -34,6 +34,8 @@ #include +#include + #include #include #include @@ -250,8 +252,12 @@ void tls_preserve_current_state(void); static inline void start_thread_common(struct pt_regs *regs, unsigned long pc) { + s32 previous_syscall = regs->syscallno; memset(regs, 0, sizeof(*regs)); - forget_syscall(regs); + if (previous_syscall == __NR_execve || previous_syscall == __NR_execveat) + regs->syscallno = previous_syscall; + else + forget_syscall(regs); regs->pc = pc; if (system_uses_irq_prio_masking()) -- 2.25.1