[PATCH] x32: Mask the syscall number before passing it to audit

[PATCH] x32: Mask the syscall number before passing it to audit

[Philipp Kern]

audit_filter_syscall uses the syscall number to reference into a
bitmask (e->rule.mask[word]). Not removing the x32 bit before passing
the number to this architecture independent codepath will fail to
lookup the proper audit bit. Furthermore it will cause an invalid memory
access in the kernel if the out of bound location is not mapped:

  BUG: unable to handle kernel paging request at ffff8800e5446630
  IP: [<ffffffff810fcdd0>] audit_filter_syscall+0x90/0xf0

Cc: linux-kernel@vger.kernel.org
Cc: H. J. Lu <hjl.tools@gmail.com>
Signed-off-by: Philipp Kern <pkern@google.com>
---
 arch/x86/kernel/entry_64.S | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 1e96c36..c9aaf60 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -699,6 +699,9 @@ auditsys:
 	movq %rsi,%rcx			/* 4th arg: 2nd syscall arg */
 	movq %rdi,%rdx			/* 3rd arg: 1st syscall arg */
 	movq %rax,%rsi			/* 2nd arg: syscall number */
+#if __SYSCALL_MASK != ~0
+	andl $__SYSCALL_MASK,%esi
+#endif
 	movl $AUDIT_ARCH_X86_64,%edi	/* 1st arg: audit arch */
 	call __audit_syscall_entry
 	LOAD_ARGS 0		/* reload call-clobbered registers */
-- 
1.9.1.423.g4596e3a