Re: [PATCH 02/13] alpha: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] When a syscall is skipped by seccomp or ptrace, the kernel fails to set the return value to -ENOSYS, allowing unprivileged userspace to spoof successful syscall returns.
--

--- Patch [2]: [PATCH 02/13] alpha: pass all six syscall args to audit_syscall_entry() ---
commit 34becaec07c6a7a08cc6bd923c1a39f3ee655963
Author: Ricardo Robaina <[email protected]>
Subject: alpha: pass all six syscall args to audit_syscall_entry()

Update the audit_syscall_entry() call to forward the 5th and 6th syscall
arguments. This ensures the audit core logs all six arguments on alpha.

> diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
> index 0687760ea4669..d90e2194b5284 100644
> --- a/arch/alpha/kernel/ptrace.c
> +++ b/arch/alpha/kernel/ptrace.c
> @@ -396,7 +396,8 @@ asmlinkage unsigned long syscall_trace_enter(void)

[Severity: High]
This is a pre-existing issue, but does the -ENOSYS fixup in
syscall_trace_enter() get skipped incorrectly when a syscall is filtered by
seccomp or ptrace?

Earlier in this function, the fixup condition is:

    if (secure_computing() == -1) {
        if (regs->r19 == 0 && regs->r0 == (unsigned long)-1)
            syscall_set_return_value(current, regs, -ENOSYS, 0);
        syscall_set_nr(current, regs, -1);
        return -1UL;
    }

If secure_computing() returns -1 to skip the syscall execution,
syscall_set_nr() sets r1 to -1. However, it seems r0 still contains the
original syscall number instead of -1. Doesn't this cause the fallback
condition to evaluate to false and skip setting -ENOSYS?

If so, a seccomp filter that skips a syscall without explicitly setting a
return value (such as SECCOMP_RET_USER_NOTIF) might leak the syscall number
back to user space as a successful return value instead of returning an error.

It looks like this same logic is mirrored in arch/alpha/kernel/entry.S in
SYSCALL_SKIP_RETURN_RESTART_GATE:

    ldq     $20, 0($sp)             /* r0 */
    lda     $21, -1($31)
    cmpeq   $20, $21, $22
    beq     $22, 1f                 /* r0 != -1 => skip fixup */

Does this also bypass the fixup for the same reason?

>  
>  #ifdef CONFIG_AUDITSYSCALL
>  	audit_syscall_entry(syscall_get_nr(current, regs),
> -		regs->r16, regs->r17, regs->r18, regs->r19);
> +		regs->r16, regs->r17, regs->r18, regs->r19,
> +		regs->r20, regs->r21);
>  #endif
>  	return syscall_get_nr(current, regs);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2