Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Lecopzer Chen <lecopzer.chen@mediatek.com>
To:     <arnd@arndb.de>, <linux-arm-kernel@lists.infradead.org>,
        <linux-kernel@vger.kernel.org>
CC:     <linux@armlinux.org.uk>, <linus.walleij@linaro.org>,
        <yj.chiang@mediatek.com>,
        Lecopzer Chen <lecopzer.chen@mediatek.com>
Subject: [PATCH] ARM: ptrace: fix scno of -1 cause SIGILL
Date:   Mon, 24 Jul 2023 20:16:55 +0800
Message-ID: <20230724121655.7894-1-lecopzer.chen@mediatek.com>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

In commit [1], the -1 scno is used as a special scno when the task's
syscall is traced.

After commit [2], PTRACE_SET_SYSCALL will always mask syscall with
__NR_SYSCALL_MASK, this makes the condition `cmp scno, #-1` broken,
and some test like Android VTS[3] is also failed because SIGILL
interrupt the test program.

Let's test with `and` logic with #0x0ff000. Instead of #__NR_SYSCALL_MASK
because of the constraint of ARM Operand2 rules and avoid conflicting
with ARM private syscall.

[1] commit ad75b51459ae ("ARM: 7579/1: arch/allow a scno of -1 to not cause a SIGILL")
[2] commit 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
[3] vts_linux_kselftest_arm_32 seccomp_seccomp_bpf_arm_32#seccomp_seccomp_bpf_arm_32

Fixes: 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
---
 arch/arm/kernel/entry-common.S | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index bcc4c9ec3aa4..8ff3ff476266 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -298,8 +298,15 @@ __sys_trace:
 	bl	syscall_trace_enter
 	mov	scno, r0
 	invoke_syscall tbl, scno, r10, __sys_trace_return, reload=1
-	cmp	scno, #-1			@ skip the syscall?
-	bne	2b
+	/*
+	 * We'd like to skip scno=-1 for avoiding SIGILL for tracer,
+	 * however, tracer or seccomp may have changed syscall and masked
+	 * with __NR_SYSCALL_MASK, make sure -1 is compared with correct
+	 * masked syscall number.
+	 */
+	and r10, scno, #0x0ff000
+	cmp r10, #0x0ff000
+	bne 2b
 	add	sp, sp, #S_OFF			@ restore stack
 
 __sys_trace_return_nosave:
-- 
2.18.0