Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
References: <20220927225944.2254360-1-ankur.a.arora@oracle.com>
 <20220927225944.2254360-2-ankur.a.arora@oracle.com>
 <CAHC9VhRZzU5-+65AFOK826rA0xo-nbgRK_pP05Q_zjvAQvLnRw@mail.gmail.com>
User-agent: mu4e 1.4.10; emacs 27.2
From:   Ankur Arora <ankur.a.arora@oracle.com>
To:     Paul Moore <paul@paul-moore.com>
Cc:     Ankur Arora <ankur.a.arora@oracle.com>, linux-audit@redhat.com,
        eparis@redhat.com, linux-kernel@vger.kernel.org,
        boris.ostrovsky@oracle.com, konrad.wilk@oracle.com
Subject: Re: [PATCH 1/3] audit: cache ctx->major in audit_filter_syscall()
In-reply-to: <CAHC9VhRZzU5-+65AFOK826rA0xo-nbgRK_pP05Q_zjvAQvLnRw@mail.gmail.com>
Date:   Thu, 29 Sep 2022 13:20:40 -0700
Message-ID: <87tu4qexuv.fsf@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?TkjQH8772lg6uEYcyPf6HC2mWL7Cy1VaLNxiTSro/j0YaGb9wKc+nHcVEq3b?=
 =?us-ascii?Q?csHdlhYTfkzK45vbYQiTUPvb8PRJEjtXl6n8rUWB45YlJAAnjA3Y5MafiqRq?=
 =?us-ascii?Q?JirSwBkPs6/ujf7zkAKwblEjoDrAgp+gr1w8/bUWzneuyLPWXirIT7Zy3gIQ?=
 =?us-ascii?Q?AkIrbNxuR0V0nsp9QLWOZxy9ZxlUrDZ8vPxreH0GeY6RMTZRI8sElMJDe4i9?=
 =?us-ascii?Q?pI7OVhAZOW1ml1j9a3Npz/mA/3qi4GK578MbiW+348Tt+SCzUuuPhzNldDoy?=
 =?us-ascii?Q?oDrZ+6Kxs0gGg1+NtSHSXf8taByxlxCitqKAM6vgeCvwu6r5M846dm1XWUjR?=
 =?us-ascii?Q?Zr8Ra1vJgIWD6Kdv6ceRPJuyqQEXC48I7mG1hujxDx0FhzJc3BlHhjcQoMSd?=
 =?us-ascii?Q?5PPhqD5QuJRVt9FkAykhVc1aCGanWnUHoPCGFMUBfbF93iNYmhMzI3qBDSie?=
 =?us-ascii?Q?E4FI10OQcXR/fvrNI0xAT31XrKX800VpuVggBCOwwzDT9zu8vemuzxS9qruQ?=
 =?us-ascii?Q?xNX0MWa/673P4/avzYKOXmNxL8e+mFP/WiwgPgtjQIlxCWfueA0o6/J0TTtN?=
 =?us-ascii?Q?dohhmGTHbp/o4X9+IoO/GtcTu5L4TJ4+TvLL43KMYqNZ0VonOs1GZX0pTtwc?=
 =?us-ascii?Q?IkTVB9mixE3pKj3rjQcY/VYevXVbMY7ijeBkK9IJKCpdf1t0iIDYqSgmdfih?=
 =?us-ascii?Q?2esuHs1rHbjMpCQz9vKiaBTOIPHhujsH/NagcY4C2EJXElcKjjcYEnOYaibE?=
 =?us-ascii?Q?tVcAVVgDisghFw5EAVXeOxlL7Ery7ftE7FJMNrs5x0jrCSMpz2Pj7lxiP/iN?=
 =?us-ascii?Q?060XnZONw/aXm4uUpI3yg0Of1EXF70uXvbuE7f457D3IBqX5rcYVnbPOT5jg?=
 =?us-ascii?Q?cV+Gpyz/XVDlhYAWkveyWUyxoypR1hf52VgIWnxInADYzSzWTuBylebFiU9m?=
 =?us-ascii?Q?4ZncYYwx6qYRdRyXBH+yb3ZF+yd6cQCWS1YSxn2DpfQTmOMImb/zeFZesFYk?=
 =?us-ascii?Q?YtOD5mPQvgjW+/ZD8c8EnxbJSMtRGsstxnl+0aUdmcpMp83U9uSk1BWnomml?=
 =?us-ascii?Q?StJiJ8BG3pEKcDYXFON4iGhPtUrDveTSuq8WacG6u7e5mZiHtJX0fDAiu4lY?=
 =?us-ascii?Q?eQMkI6hIFsEphIDCqgZr++gfurXoKmj1jB/iLf1enbNH7y3QYJ4wlSUV5lOx?=
 =?us-ascii?Q?WgG4/dB8ghmAkBsAHFTf2yqzs+uh7R1z8ZHLm3/1hSG6ImHVPDIUO4sU/fOu?=
 =?us-ascii?Q?23gnZ9oF+dU7uhNLPAtUR0HpJgUbZQaLN/oKcqV4rnsqQj9rqEaPPrUUgtgX?=
 =?us-ascii?Q?ZwUFjzlKKgToQ3SUEQ/vzyNP8fvODZ7ClJfORpO/1nWDxPLnufnDq5LwxndP?=
 =?us-ascii?Q?L/o5RWGc78Rg2k7sKVg5qSVFUENbUojkVk7eJygjeBLkQHo/kmGcgKMjG860?=
 =?us-ascii?Q?zCUx84eNW42WQMQ2i3ll2MFEWgVXQ7uul47Ye+VIUmLsqBu4lFYtrf/e/n18?=
 =?us-ascii?Q?Hfw+15APSyBM64+4hA2Zr8pPQpHTbVe4RTx1+B/Y2CruUWOd2pR5H/Nz7fBm?=
 =?us-ascii?Q?R+nSkzwAoEZ/yxIEDyhJ2uEOkRTPZ1HW3mq8+B5IvBe+Da+ocHi1KHIJPHNm?=
 =?us-ascii?Q?Wg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 059a4c84-8ba2-4f48-430d-08daa25815eb
X-MS-Exchange-CrossTenant-AuthSource: CO6PR10MB5409.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Sep 2022 20:20:43.9440
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 9JXm2nSwIoa0Cda4d6VDpyzH+X+xDri5gRBF9Oz+Jyi2f8wJLwJDPwEvoxRFVEzm3CxsEk+TNbtXwQjU+DHLlWbjJyi7Mvy1rxi9vN+z7TI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR10MB6005
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-29_11,2022-09-29_03,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 malwarescore=0
 suspectscore=0 adultscore=0 mlxscore=0 spamscore=0 bulkscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2209130000 definitions=main-2209290128
X-Proofpoint-ORIG-GUID: jTmFSmFtC6OtFEcAuzF-TV0ccqqaY43O
X-Proofpoint-GUID: jTmFSmFtC6OtFEcAuzF-TV0ccqqaY43O
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


Paul Moore <paul@paul-moore.com> writes:

> On Tue, Sep 27, 2022 at 6:59 PM Ankur Arora <ankur.a.arora@oracle.com> wrote:
>>
>> ctx->major contains the current syscall number. This is, of course, a
>> constant for the duration of the syscall. Unfortunately, GCC's alias
>> analysis cannot prove that it is not modified via a pointer in the
>> audit_filter_syscall() loop, and so always loads it from memory.
>>
>> ...
>>
>> Signed-off-by: Ankur Arora <ankur.a.arora@oracle.com>
>> ---
>>  kernel/auditsc.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> This looks pretty trivial to me, but it's too late in the current -rc
> cycle for this to be merged, I'll queue it up for after the upcoming
> merge window closes.  Thanks.

Thanks.

Ankur

>
>> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
>> index 79a5da1bc5bb..533b087c3c02 100644
>> --- a/kernel/auditsc.c
>> +++ b/kernel/auditsc.c
>> @@ -843,13 +843,14 @@ static void audit_filter_syscall(struct task_struct *tsk,
>>  {
>>         struct audit_entry *e;
>>         enum audit_state state;
>> +       unsigned long major = ctx->major;
>>
>>         if (auditd_test_task(tsk))
>>                 return;
>>
>>         rcu_read_lock();
>>         list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXIT], list) {
>> -               if (audit_in_mask(&e->rule, ctx->major) &&
>> +               if (audit_in_mask(&e->rule, major) &&
>>                     audit_filter_rules(tsk, &e->rule, ctx, NULL,
>>                                        &state, false)) {
>>                         rcu_read_unlock();
>> --
>> 2.31.1


--
ankur