Received-SPF: pass (google.com: domain of linux-kernel+bounces-112466-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
From: Thomas Gleixner <tglx@linutronix.de>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, x86@kernel.org
Subject: [GIT pull] core/entry for v6.9-rc1
Message-ID: <171122346785.2772088.10596056144848184713.tglx@xen13>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
MIME-Version: 1.0
Date: Sat, 23 Mar 2024 20:51:59 +0100 (CET)

Linus,

please pull the latest core/entry branch from:

   git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git core-entry-2024-=
03-23

up to:  fb13b11d5387: entry: Respect changes to system call number by trace_s=
ys_enter()

A single fix for the generic entry code:

  THe trace_sys_enter() tracepoint can modify the syscall number via
  kprobes or BPF in pt_regs, but that requires that the syscall number is
  re-evaluted from pt_regs after the tracepoint.

  A seccomp fix in that area removed the re-evaluation so the change does
  not take effect as the code just uses the locally cached number.

  Restore the original behaviour by re-evaluating the syscall number after
  the tracepoint.


Thanks,

	tglx

------------------>
Andr=C3=A9 R=C3=B6sti (1):
      entry: Respect changes to system call number by trace_sys_enter()


 kernel/entry/common.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/kernel/entry/common.c b/kernel/entry/common.c
index 88cb3c88aaa5..90843cc38588 100644
--- a/kernel/entry/common.c
+++ b/kernel/entry/common.c
@@ -57,8 +57,14 @@ long syscall_trace_enter(struct pt_regs *regs, long syscal=
l,
 	/* Either of the above might have changed the syscall number */
 	syscall =3D syscall_get_nr(current, regs);
=20
-	if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT))
+	if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT)) {
 		trace_sys_enter(regs, syscall);
+		/*
+		 * Probes or BPF hooks in the tracepoint may have changed the
+		 * system call number as well.
+		 */
+		syscall =3D syscall_get_nr(current, regs);
+	}
=20
 	syscall_enter_audit(regs, syscall);
=20