Commit ccbe495c authored Feb 27, 2009 by Roland McGrath Committed by Linus Torvalds Mar 02, 2009

x86-64: syscall-audit: fix 32/64 syscall hole

On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with
ljmp, and then use the "syscall" instruction to make a 64-bit system
call. A 64-bit process make a 32-bit system call with int $0x80.

In both these cases, audit_syscall_entry() will use the wrong system
call number table and the wrong system call argument registers. This
could be used to circumvent a syscall audit configuration that filters
based on the syscall numbers or argument details.

Signed-off-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 778ef1e6

arch/x86/kernel/ptrace.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1388,7 +1388,7 @@ void send_sigtrap(struct task_struct tsk, struct pt_regs regs,
	#ifdef CONFIG_X86_32		#ifdef CONFIG_X86_32
	# define IS_IA32 1		# define IS_IA32 1
	#elif defined CONFIG_IA32_EMULATION		#elif defined CONFIG_IA32_EMULATION
	# define IS_IA32 test_thread_flag(TIF_IA32)		# define IS_IA32 is_compat_task()
	#else		#else
	# define IS_IA32 0		# define IS_IA32 0
	#endif		#endif