Commit 94c80b25 authored by Bodo Stroesser's avatar Bodo Stroesser Committed by Linus Torvalds
Browse files

[PATCH] Ptrace/i386: fix "syscall audit" interaction with singlestep

      Paolo 'Blaisorblade' Giarrusso <>

Avoid giving two traps for singlestep instead of one, when syscall auditing is

In fact no singlestep trap is sent on syscall entry, only on syscall exit, as
can be seen in entry.S:

# Note that in this mask _TIF_SINGLESTEP is not tested !!! <<<<<<<<<<<<<<
        jnz syscall_trace_entry
	call do_syscall_trace

But auditing a SINGLESTEP'ed process causes do_syscall_trace to be called, so
the tracer will get one more trap on the syscall entry path, which it
Signed-off-by: default avatarPaolo 'Blaisorblade' Giarrusso <>
CC: Roland McGrath <>
Cc: Jeff Dike <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 08b178eb
...@@ -683,9 +683,20 @@ void do_syscall_trace(struct pt_regs *regs, int entryexit) ...@@ -683,9 +683,20 @@ void do_syscall_trace(struct pt_regs *regs, int entryexit)
/* do the secure computing check first */ /* do the secure computing check first */
secure_computing(regs->orig_eax); secure_computing(regs->orig_eax);
if (unlikely(current->audit_context) && entryexit) if (unlikely(current->audit_context)) {
if (entryexit)
audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax); audit_syscall_exit(current, AUDITSC_RESULT(regs->eax), regs->eax);
/* Debug traps, when using PTRACE_SINGLESTEP, must be sent only
* on the syscall exit path. Normally, when TIF_SYSCALL_AUDIT is
* not used, entry.S will call us only on syscall exit, not
* entry ; so when TIF_SYSCALL_AUDIT is used we must avoid
* calling send_sigtrap() on syscall entry.
else if (is_singlestep)
goto out;
if (!(current->ptrace & PT_PTRACED)) if (!(current->ptrace & PT_PTRACED))
goto out; goto out;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment