From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA6F452F8B for ; Sun, 22 Mar 2026 16:36:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774197418; cv=none; b=i5G6clI/pGO/zqIEqRtQ6pBYw0sstrR5a8K9S/5GumPRKRJPbWp5cNxqLKIRZvj/mhr5dNGAmuJUMwGvGu1Bcd7S3eWrBrS7dUGIlSE88N5EgpSws+6/Y80psk0/y5E7dUe6vqucZk+8iF+K4hTnzUdD5+Gu9+Xd3CytXjrEViw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774197418; c=relaxed/simple; bh=5ZRh+c0oHdoPXvXuF1sqe1bZjJplBDR96D9ppPJfyO4=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=rYVkKxR71VqhTyGMT3YSY4Cep+U9gKm98FEmr6VNs2iE2s426XetG7poa6mhJIDhMnxQVQSyHTjMuEtVLuEOpeGK17csqyOh6C0lHeAFwy8i6fG7Zath3OyrSnpE2z7yZna1k5zNQ6VtfH4pizqsRwhwWNl15zuuTMvjNvSRFpg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=ArF3YTPI; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="ArF3YTPI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6068DC19424; Sun, 22 Mar 2026 16:36:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1774197417; bh=5ZRh+c0oHdoPXvXuF1sqe1bZjJplBDR96D9ppPJfyO4=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=ArF3YTPIB76bYrCMTMEc3VHd15zcMJH/0wycZ/44MckqiAasMh8VrKdMM1ccwRBuC BX6HdTidWeUV91IgtPCmTcj4tX0l5b0cdxuCNtdcf8lTWMn/PMifS/b28B8JpT1lmT AHXpFcRS8yn7O1zCjLTWa9QfcRZKQml0ht+2078k= Date: Sun, 22 Mar 2026 09:36:56 -0700 From: Andrew Morton To: Oleg Nesterov Cc: Andy Lutomirski , Kees Cook , Peter Zijlstra , Thomas Gleixner , Will Drewry , Max Ver , linux-kernel@vger.kernel.org Subject: Re: [RFC PATCH] ptrace: don't report syscall-exit if the tracee was killed by seccomp Message-Id: <20260322093656.2e327439df04b183078e5cef@linux-foundation.org> In-Reply-To: References: X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Sun, 22 Mar 2026 14:44:54 +0100 Oleg Nesterov wrote: > __seccomp_filter() does > > case SECCOMP_RET_KILL_THREAD: > case SECCOMP_RET_KILL_PROCESS: > ... > /* Show the original registers in the dump. */ > syscall_rollback(current, current_pt_regs()); > > /* Trigger a coredump with SIGSYS */ > force_sig_seccomp(this_syscall, data, true); > > syscall_rollback() does regs->ax == orig_ax. This means that > ptrace_get_syscall_info_exit() will see .is_error == 0. To the tracer, > it looks as if the aborted syscall actually succeeded and returned its > own syscall number. > > And since force_sig_seccomp() uses force_coredump == true, SIGSYS won't > be reported (see the SA_IMMUTABLE check in get_signal()), so the tracee > will "silently" exit with error_code == SIGSYS after the bogus report. > > Change syscall_exit_work() to avoid the bogus single-step/syscall-exit > reports if the tracee is SECCOMP_MODE_DEAD. > > TODO: With or without this change, get_signal() -> ptrace_signal() may > report other !SA_IMMUTABLE pending signals before it dequeues SIGSYS. > Perhaps it makes sense to change get_signal() to check SECCOMP_MODE_DEAD > too and prioritize the fatal SIGSYS. AI review has questions: https://sashiko.dev/#/patchset/ab_yVqQ7WW3flal3@redhat.com