Re: [tip:x86/urgent] i386/audit: stop scribbling on the stack frame

[Thomas Gleixner <tglx@linutronix.de>]

On Fri, 24 Oct 2014, tip-bot for Eric Paris wrote:
>  sysenter_audit:
>  	testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%ebp)
>  	jnz syscall_trace_entry
> -	addl $4,%esp
> -	CFI_ADJUST_CFA_OFFSET -4
> -	movl %esi,4(%esp)		/* 5th arg: 4th syscall arg */
> -	movl %edx,(%esp)		/* 4th arg: 3rd syscall arg */
> -	/* %ecx already in %ecx		   3rd arg: 2nd syscall arg */
> -	movl %ebx,%edx			/* 2nd arg: 1st syscall arg */
> -	/* %eax already in %eax		   1st arg: syscall number */
> +	/* movl PT_EAX(%esp), %eax	already set, syscall number: 1st arg to audit */
> +	movl PT_EBX(%esp), %edx		/* ebx/a0: 2nd arg to audit */
> +	/* movl PT_ECX(%esp), %ecx	already set, a1: 3nd arg to audit */
> +	pushl_cfi PT_ESI(%esp)		/* a3: 5th arg */
> +	pushl_cfi PT_EDX+4(%esp)	/* a2: 4th arg */

Why are we grabbing that from the stack? AFAICT all arguments are in
the registers still.

Thanks,

	tglx