[PATCH v3 00/14] audit: log all six syscall arguments in the SYSCALL record

[PATCH v3 00/14] audit: log all six syscall arguments in the SYSCALL record

[Ricardo Robaina]

The SYSCALL record currently logs only four of the six syscall
arguments (a0-a3), silently discarding the remaining two. This
leads to the need for auxiliary records when audit-relevant
data lands in the 5th or 6th argument of a syscall.

This series extends the SYSCALL record to log all six arguments,
by adding arguments a4 and a5 inline within the existing record.

Rather than plumbing two more argument registers through every
architecture's syscall entry path, audit_syscall_entry() now takes a
struct pt_regs * and retrieves all six arguments itself via
syscall_get_arguments(); the per-arch patches simply pass regs. The two
new arguments are also wired into the audit filter, so rules can match
on a4 and a5.

To keep the series bisectable, the new pt_regs-based helpers are added
first (patch 1), each architecture is converted one per patch, and the
final patch removes the legacy argument-register helpers and renames the
new ones back to audit_syscall_entry(). Every commit builds on its own.

The audit testsuite runs successfully:

 # make test
 make -C tests test
 Running as   user    root
        with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        on   system  Fedora

 amcast_joinpart/test ................. ok
 backlog_wait_time_actual_reset/test .. ok
 bpf/test ............................. ok
 coredump/test ........................ ok
 exec_execve/test ..................... ok
 exec_name/test ....................... ok
 fanotify/test ........................ ok
 field_compare/test ................... ok
 file_create/test ..................... ok
 file_delete/test ..................... ok
 file_permission/test ................. ok
 file_rename/test ..................... ok
 filter_device/test ................... ok
 filter_exclude/test .................. ok
 filter_exit/test ..................... ok
 filter_inode/test .................... ok
 filter_saddr_fam/test ................ ok
 filter_sessionid/test ................ ok
 io_uring/test ........................ ok
 login_tty/test ....................... ok
 lost_reset/test ...................... ok
 netfilter_pkt/test ................... ok
 signal/test .......................... ok
 syscalls_file/test ................... ok
 syscall_module/test .................. ok
 syscall_socketcall/test .............. ok
 time_change/test ..................... ok
 user_msg/test ........................ ok
 All tests successful.
 Result: PASS

Changes in v3:
- Make the series bisectable, as requested by Will Deacon. Rather
  than changing __audit_syscall_entry()'s signature in place (which
  broke the build between the core patch and the per-arch conversions),
  patch 1 now adds audit_syscall_entry_regs()/__audit_syscall_entry_regs()
  alongside the existing helpers. The per-arch patches switch to the new
  helpers, and the final patch removes the legacy helpers and renames
  the new ones back to audit_syscall_entry().
- Drop the alpha conversion patch. Per Magnus Lindholm, alpha is
  being moved onto the generic entry framework, which removes its
  private syscall_trace_enter() and routes syscall auditing through
  syscall_enter_audit(); no alpha-specific change is needed once that
  series lands. This series should therefore be applied on top of it.
- Add "parisc: mask compat syscall arguments in syscall_get_arguments()"
  (new patch 8). Moving argument retrieval into syscall_get_arguments()
  would otherwise drop the low-32-bit masking parisc previously did
  inline in its compat audit path, exposing the upper 32 bits of the
  argument registers to audit (and seccomp) for 32-bit tasks. Mask in
  the helper instead, before the parisc conversion, so the series stays
  correct and bisectable.

Changes in v2:
- Rework the core change per Will Deacon's suggestion: instead of
  plumbing all six arguments through every architecture's syscall
  entry path, __audit_syscall_entry() now takes a struct pt_regs *
  and retrieves the arguments itself via syscall_get_arguments().
- Per-arch patches now simply pass regs instead of the individual
  argument registers.
- Fetch the arguments directly into context->argv, dropping the
  temporary array.

Ricardo Robaina (14):
  audit: log all six syscall arguments in the SYSCALL record
  arm: pass pt_regs to audit_syscall_entry()
  arm64: pass pt_regs to audit_syscall_entry()
  csky: pass pt_regs to audit_syscall_entry()
  microblaze: pass pt_regs to audit_syscall_entry()
  mips: pass pt_regs to audit_syscall_entry()
  openrisc: pass pt_regs to audit_syscall_entry()
  parisc: mask compat syscall arguments in syscall_get_arguments()
  parisc: pass pt_regs to audit_syscall_entry()
  sh: pass pt_regs to audit_syscall_entry()
  sparc64: pass pt_regs to audit_syscall_entry()
  um: pass pt_regs to audit_syscall_entry()
  xtensa: pass pt_regs to audit_syscall_entry()
  audit: rename audit_syscall_entry_regs() to audit_syscall_entry()

 arch/arm/kernel/ptrace.c          |  3 +--
 arch/arm64/kernel/ptrace.c        |  3 +--
 arch/csky/kernel/ptrace.c         |  2 +-
 arch/microblaze/kernel/ptrace.c   |  2 +-
 arch/mips/kernel/ptrace.c         |  4 +---
 arch/openrisc/kernel/ptrace.c     |  3 +--
 arch/parisc/include/asm/syscall.h | 18 ++++++++++++------
 arch/parisc/kernel/ptrace.c       |  9 ++-------
 arch/sh/kernel/ptrace_32.c        |  3 +--
 arch/sparc/kernel/ptrace_64.c     |  4 +---
 arch/um/kernel/ptrace.c           |  6 +-----
 arch/xtensa/kernel/ptrace.c       |  4 +---
 include/linux/audit.h             | 13 ++++---------
 include/uapi/linux/audit.h        |  2 ++
 kernel/audit.h                    |  2 +-
 kernel/auditfilter.c              |  2 ++
 kernel/auditsc.c                  | 19 ++++++++-----------
 kernel/entry/syscall-common.c     |  4 +---
 18 files changed, 42 insertions(+), 61 deletions(-)

-- 
2.55.0

[PATCH v3 01/14] audit: log all six syscall arguments in the SYSCALL record

[Ricardo Robaina]

The SYSCALL record currently logs only four of the six syscall
arguments (a0-a3). The remaining two are captured but silently
discarded before reaching the audit context. This leads to the
need for auxiliary records when audit-relevant data lands in the
5th or 6th argument of a syscall.

Extend the SYSCALL record to log all six arguments, by adding
arguments a4 and a5 (5th and 6th syscall arguments respectively)
inline within the existing record. Also add the two new args to
the audit rules switch case, so audit rules can filter on them.

Rather than plumbing two more register arguments through every
architecture's syscall entry path, retrieve the arguments from
pt_regs via syscall_get_arguments(). To keep the series bisectable,
add new helpers audit_syscall_entry_regs() and
__audit_syscall_entry_regs() that take a pointer to pt_regs, rather
than modifying the existing ones in place. Later patches convert
each architecture over to the new helpers, and a final patch removes
the legacy helpers and renames the new ones back to the original
naming.

 audit-testsuite# make test
 audit-testsuite# ausearch -i -m SYSCALL
 ...
 type=SYSCALL ... syscall=sendto success=yes exit=1088 a0=0x4
  a1=0x7ffe43518b60 a2=0x440 a3=0x0 a4=7ffe43518b4c a5=c
 type=SYSCALL ... syscall=openat2 success=yes exit=4 a0=0x3
  a1=0x7fffc74692c8 a2=0x7fffc7467390 a3=0x18 a4=0 a5=7fffc74674f8
 type=SYSCALL ... syscall=openat success=yes exit=3 a0=AT_FDCWD
  a1=0x557ced4141a2 a2=O_RDWR|O_NONBLOCK a3=0x0 a4=0 a5=0
 ...

Suggested-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dX4Ah11RVhdyCBUQ@mail.gmail.com/T/#t
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 include/linux/audit.h         |  8 ++++++
 include/uapi/linux/audit.h    |  2 ++
 kernel/audit.h                |  2 +-
 kernel/auditfilter.c          |  2 ++
 kernel/auditsc.c              | 53 ++++++++++++++++++++++++++++++++++-
 kernel/entry/syscall-common.c |  4 +--
 6 files changed, 66 insertions(+), 5 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 45abb3722d30..22ffad5b2060 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -325,6 +325,7 @@ extern void __audit_uring_entry(u8 op);
 extern void __audit_uring_exit(int success, long code);
 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
 				  unsigned long a2, unsigned long a3);
+extern void __audit_syscall_entry_regs(int major, struct pt_regs *regs);
 extern void __audit_syscall_exit(int ret_success, long ret_value);
 extern void __audit_getname(struct filename *name);
 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
@@ -380,6 +381,11 @@ static inline void audit_syscall_entry(int major, unsigned long a0,
 	if (unlikely(audit_context()))
 		__audit_syscall_entry(major, a0, a1, a2, a3);
 }
+static inline void audit_syscall_entry_regs(int major, struct pt_regs *regs)
+{
+	if (unlikely(audit_context()))
+		__audit_syscall_entry_regs(major, regs);
+}
 static inline void audit_syscall_exit(void *pt_regs)
 {
 	if (unlikely(audit_context())) {
@@ -615,6 +621,8 @@ static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
 				       unsigned long a3)
 { }
+static inline void audit_syscall_entry_regs(int major, struct pt_regs *regs)
+{ }
 static inline void audit_syscall_exit(void *pt_regs)
 { }
 static inline bool audit_dummy_context(void)
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index e8f5ce677df7..6726059d6df1 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -303,6 +303,8 @@
 #define AUDIT_ARG1      (AUDIT_ARG0+1)
 #define AUDIT_ARG2      (AUDIT_ARG0+2)
 #define AUDIT_ARG3      (AUDIT_ARG0+3)
+#define AUDIT_ARG4      (AUDIT_ARG0+4)
+#define AUDIT_ARG5      (AUDIT_ARG0+5)
 
 #define AUDIT_FILTERKEY	210
 
diff --git a/kernel/audit.h b/kernel/audit.h
index 92d5e723d570..83011b14af18 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -117,7 +117,7 @@ struct audit_context {
 	struct audit_stamp  stamp;	/* event identifier */
 	int		    major;      /* syscall number */
 	int		    uring_op;   /* uring operation */
-	unsigned long	    argv[4];    /* syscall arguments */
+	unsigned long	    argv[6];    /* syscall arguments */
 	long		    return_code;/* syscall return code */
 	u64		    prio;
 	int		    return_valid; /* return code is valid */
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index f52645625214..cded3696e3c5 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -358,6 +358,8 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
 	case AUDIT_ARG1:
 	case AUDIT_ARG2:
 	case AUDIT_ARG3:
+	case AUDIT_ARG4:
+	case AUDIT_ARG5:
 	case AUDIT_PERS: /* <uapi/linux/personality.h> */
 	case AUDIT_DEVMINOR:
 		/* all ops are valid */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 2b9ce0b52511..89f5c518c6f0 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -728,6 +728,8 @@ static int audit_filter_rules(struct task_struct *tsk,
 		case AUDIT_ARG1:
 		case AUDIT_ARG2:
 		case AUDIT_ARG3:
+		case AUDIT_ARG4:
+		case AUDIT_ARG5:
 			if (ctx)
 				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
 			break;
@@ -1674,11 +1676,13 @@ static void audit_log_exit(void)
 						    AUDITSC_SUCCESS),
 					 context->return_code);
 		audit_log_format(ab,
-				 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
+				 " a0=%lx a1=%lx a2=%lx a3=%lx a4=%lx a5=%lx items=%d",
 				 context->argv[0],
 				 context->argv[1],
 				 context->argv[2],
 				 context->argv[3],
+				 context->argv[4],
+				 context->argv[5],
 				 context->name_count);
 		audit_log_task_info(ab);
 		audit_log_key(ab, context->filterkey);
@@ -2021,6 +2025,53 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
 	ktime_get_coarse_real_ts64(&context->stamp.ctime);
 }
 
+/**
+ * __audit_syscall_entry_regs - fill in an audit record at syscall entry
+ * @major: major syscall type (function)
+ * @regs: the task's register state at syscall entry
+ *
+ * Fill in audit context at syscall entry.  This only happens if the
+ * audit context was created when the task was created and the state or
+ * filters demand the audit context be built.  If the state from the
+ * per-task filter or from the per-syscall filter is AUDIT_STATE_RECORD,
+ * then the record will be written at syscall exit time (otherwise, it
+ * will only be written if another part of the kernel requests that it
+ * be written).
+ */
+void __audit_syscall_entry_regs(int major, struct pt_regs *regs)
+{
+	struct audit_context *context = audit_context();
+	enum audit_state     state;
+
+	if (!audit_enabled || !context)
+		return;
+
+	WARN_ON(context->context != AUDIT_CTX_UNUSED);
+	WARN_ON(context->name_count);
+	if (context->context != AUDIT_CTX_UNUSED || context->name_count) {
+		audit_panic("unrecoverable error in audit_syscall_entry_regs()");
+		return;
+	}
+
+	state = context->state;
+	if (state == AUDIT_STATE_DISABLED)
+		return;
+
+	context->dummy = !audit_n_rules;
+	if (!context->dummy && state == AUDIT_STATE_BUILD) {
+		context->prio = 0;
+		if (auditd_test_task(current))
+			return;
+	}
+
+	context->arch	    = syscall_get_arch(current);
+	context->major      = major;
+	syscall_get_arguments(current, regs, context->argv);
+	context->context = AUDIT_CTX_SYSCALL;
+	context->current_state  = state;
+	ktime_get_coarse_real_ts64(&context->stamp.ctime);
+}
+
 /**
  * __audit_syscall_exit - deallocate audit context after a system call
  * @success: success value of the syscall
diff --git a/kernel/entry/syscall-common.c b/kernel/entry/syscall-common.c
index b8eac9efb6fd..70941008beb6 100644
--- a/kernel/entry/syscall-common.c
+++ b/kernel/entry/syscall-common.c
@@ -22,9 +22,7 @@ void trace_syscall_exit(struct pt_regs *regs, long ret)
 void syscall_enter_audit(struct pt_regs *regs)
 {
 	long syscall = syscall_get_nr(current, regs);
-	unsigned long args[6];
 
-	syscall_get_arguments(current, regs, args);
-	__audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
+	__audit_syscall_entry_regs(syscall, regs);
 }
 #endif
-- 
2.55.0

[PATCH v3 02/14] arm: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/arm/kernel/ptrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index ed7a2a87a670..3c5d7fd733ec 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -868,8 +868,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, scno);
 
-	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
-			    regs->ARM_r3);
+	audit_syscall_entry_regs(scno, regs);
 
 	return scno;
 }
-- 
2.55.0

[PATCH v3 03/14] arm64: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Acked-by: Will Deacon <will@kernel.org>
---
 arch/arm64/kernel/ptrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index f743cbec1c3a..2bcbeafe26a3 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -2476,8 +2476,7 @@ int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, regs->syscallno);
 
-	audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
-			    regs->regs[2], regs->regs[3]);
+	audit_syscall_entry_regs(regs->syscallno, regs);
 
 	return regs->syscallno;
 }
-- 
2.55.0

[PATCH v3 04/14] csky: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/csky/kernel/ptrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c
index ee2867a1576e..e61b1408737c 100644
--- a/arch/csky/kernel/ptrace.c
+++ b/arch/csky/kernel/ptrace.c
@@ -329,7 +329,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, regs->a2, regs->a3);
+	audit_syscall_entry_regs(regs_syscallid(regs), regs);
 	return 0;
 }
 
-- 
2.55.0

[PATCH v3 05/14] microblaze: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/microblaze/kernel/ptrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 236264e932d6..d0a540b7370f 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,7 +147,7 @@ asmlinkage unsigned long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
+	audit_syscall_entry_regs(regs->r12, regs);
 
 	return ret ?: regs->r12;
 }
-- 
2.55.0

[PATCH v3 06/14] mips: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/mips/kernel/ptrace.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 17dc7249b8ca..c6f4e801cfae 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -1338,9 +1338,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(current_thread_info()->syscall,
-			    regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+	audit_syscall_entry_regs(current_thread_info()->syscall, regs);
 
 	/*
 	 * Negative syscall numbers are mistaken for rejected syscalls, but
-- 
2.55.0

[PATCH v3 07/14] openrisc: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/openrisc/kernel/ptrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 287a9718f0c6..78294c84e4de 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -301,8 +301,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
-			    regs->gpr[5], regs->gpr[6]);
+	audit_syscall_entry_regs(regs->gpr[11], regs);
 
 	return ret ? : regs->gpr[11];
 }
-- 
2.55.0

[PATCH v3 08/14] parisc: mask compat syscall arguments in syscall_get_arguments()

[Ricardo Robaina]

A 32-bit compat task may leave garbage in the upper 32 bits of the
argument registers. Mask it off in syscall_get_arguments() so that
in-kernel consumers such as seccomp and audit observe the same values
the syscall actually used.

This previously happened for audit in the parisc do_syscall_trace_enter()
compat path; do it in the helper so all callers benefit and to prepare
for passing pt_regs to audit_syscall_entry().

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/parisc/include/asm/syscall.h | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
index c11222798ab2..9d10fada3b48 100644
--- a/arch/parisc/include/asm/syscall.h
+++ b/arch/parisc/include/asm/syscall.h
@@ -28,12 +28,18 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
 					 struct pt_regs *regs,
 					 unsigned long *args)
 {
-	args[5] = regs->gr[21];
-	args[4] = regs->gr[22];
-	args[3] = regs->gr[23];
-	args[2] = regs->gr[24];
-	args[1] = regs->gr[25];
-	args[0] = regs->gr[26];
+	unsigned long mask = -1UL;
+
+	/* Mask off garbage in the upper 32 bits for compat tasks. */
+	if (__is_compat_task(tsk))
+		mask = 0xffffffff;
+
+	args[5] = regs->gr[21] & mask;
+	args[4] = regs->gr[22] & mask;
+	args[3] = regs->gr[23] & mask;
+	args[2] = regs->gr[24] & mask;
+	args[1] = regs->gr[25] & mask;
+	args[0] = regs->gr[26] & mask;
 }
 
 static inline void syscall_set_arguments(struct task_struct *tsk,
-- 
2.55.0

[PATCH v3 09/14] parisc: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Per-argument compat masking is now handled in syscall_get_arguments()
(see the preceding patch), so it is dropped here; the syscall number
still needs masking for compat tasks and is left in place.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/parisc/kernel/ptrace.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 1d9e210702e1..4e62d6bd6466 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -359,15 +359,10 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
-		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
-				    regs->gr[24], regs->gr[23]);
+		audit_syscall_entry_regs(regs->gr[20], regs);
 	else
 #endif
-		audit_syscall_entry(regs->gr[20] & 0xffffffff,
-			regs->gr[26] & 0xffffffff,
-			regs->gr[25] & 0xffffffff,
-			regs->gr[24] & 0xffffffff,
-			regs->gr[23] & 0xffffffff);
+		audit_syscall_entry_regs(regs->gr[20] & 0xffffffff, regs);
 
 	/*
 	 * Sign extend the syscall number to 64bit since it may have been
-- 
2.55.0

[PATCH v3 10/14] sh: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/sh/kernel/ptrace_32.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 8794081483fb..c82d336611ef 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -466,8 +466,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[0]);
 
-	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+	audit_syscall_entry_regs(regs->regs[3], regs);
 
 	return 0;
 }
-- 
2.55.0

[PATCH v3 11/14] sparc64: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/sparc/kernel/ptrace_64.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 825ddf55fece..6197de10b45c 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1098,9 +1098,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
-			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
-			    regs->u_regs[UREG_I3]);
+	audit_syscall_entry_regs(regs->u_regs[UREG_G1], regs);
 
 	return ret;
 }
-- 
2.55.0

[PATCH v3 12/14] um: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/um/kernel/ptrace.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 7da0a5223aa6..17c285e49ddc 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -123,11 +123,7 @@ static void send_sigtrap(struct uml_pt_regs *regs, int error_code)
  */
 int syscall_trace_enter(struct pt_regs *regs)
 {
-	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs),
-			    UPT_SYSCALL_ARG1(&regs->regs),
-			    UPT_SYSCALL_ARG2(&regs->regs),
-			    UPT_SYSCALL_ARG3(&regs->regs),
-			    UPT_SYSCALL_ARG4(&regs->regs));
+	audit_syscall_entry_regs(UPT_SYSCALL_NR(&regs->regs), regs);
 
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, UPT_SYSCALL_NR(&regs->regs));
-- 
2.55.0

[PATCH v3 13/14] xtensa: pass pt_regs to audit_syscall_entry()

[Ricardo Robaina]

audit_syscall_entry() now takes a pointer to pt_regs and extracts
the syscall arguments itself via syscall_get_arguments(). Drop the
individual argument registers from the call and pass regs instead.

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/xtensa/kernel/ptrace.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index 364e4fdabb00..86e4679b5869 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -561,9 +561,7 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry(regs->syscall, regs->areg[6],
-			    regs->areg[3], regs->areg[4],
-			    regs->areg[5]);
+	audit_syscall_entry_regs(regs->syscall, regs);
 	return 1;
 }
 
-- 
2.55.0

[PATCH v3 14/14] audit: rename audit_syscall_entry_regs() to audit_syscall_entry()

[Ricardo Robaina]

Now that every architecture has been converted to the pt_regs-based
audit_syscall_entry_regs(), the legacy audit_syscall_entry() and
__audit_syscall_entry() helpers that took the individual syscall
argument registers (a0-a3) no longer have any callers.

Remove those legacy helpers and rename audit_syscall_entry_regs() and
__audit_syscall_entry_regs() back to audit_syscall_entry() and
__audit_syscall_entry(), restoring the original naming.

The _regs variants were introduced separately, and the architectures
converted one per patch, specifically so this final rename is the only
step that removes the old prototype. That keeps the series bisectable:
every commit builds, and no caller is ever left referencing a helper
that has been removed.

Suggested-by: Will Deacon <will@kernel.org>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 arch/arm/kernel/ptrace.c        |  2 +-
 arch/arm64/kernel/ptrace.c      |  2 +-
 arch/csky/kernel/ptrace.c       |  2 +-
 arch/microblaze/kernel/ptrace.c |  2 +-
 arch/mips/kernel/ptrace.c       |  2 +-
 arch/openrisc/kernel/ptrace.c   |  2 +-
 arch/parisc/kernel/ptrace.c     |  4 +--
 arch/sh/kernel/ptrace_32.c      |  2 +-
 arch/sparc/kernel/ptrace_64.c   |  2 +-
 arch/um/kernel/ptrace.c         |  2 +-
 arch/xtensa/kernel/ptrace.c     |  2 +-
 include/linux/audit.h           | 21 +++---------
 kernel/auditsc.c                | 58 ++-------------------------------
 kernel/entry/syscall-common.c   |  2 +-
 14 files changed, 19 insertions(+), 86 deletions(-)

diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 3c5d7fd733ec..e103ec2661cd 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -868,7 +868,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, scno);
 
-	audit_syscall_entry_regs(scno, regs);
+	audit_syscall_entry(scno, regs);
 
 	return scno;
 }
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 2bcbeafe26a3..65532b2a8cd4 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -2476,7 +2476,7 @@ int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, regs->syscallno);
 
-	audit_syscall_entry_regs(regs->syscallno, regs);
+	audit_syscall_entry(regs->syscallno, regs);
 
 	return regs->syscallno;
 }
diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c
index e61b1408737c..5c3051bcd78c 100644
--- a/arch/csky/kernel/ptrace.c
+++ b/arch/csky/kernel/ptrace.c
@@ -329,7 +329,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry_regs(regs_syscallid(regs), regs);
+	audit_syscall_entry(regs_syscallid(regs), regs);
 	return 0;
 }
 
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index d0a540b7370f..5fe9e3a150f4 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,7 +147,7 @@ asmlinkage unsigned long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry_regs(regs->r12, regs);
+	audit_syscall_entry(regs->r12, regs);
 
 	return ret ?: regs->r12;
 }
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index c6f4e801cfae..7a09b4671a54 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -1338,7 +1338,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry_regs(current_thread_info()->syscall, regs);
+	audit_syscall_entry(current_thread_info()->syscall, regs);
 
 	/*
 	 * Negative syscall numbers are mistaken for rejected syscalls, but
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 78294c84e4de..eca613b84ff8 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -301,7 +301,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry_regs(regs->gpr[11], regs);
+	audit_syscall_entry(regs->gpr[11], regs);
 
 	return ret ? : regs->gpr[11];
 }
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 4e62d6bd6466..948e0cf29ba4 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -359,10 +359,10 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
-		audit_syscall_entry_regs(regs->gr[20], regs);
+		audit_syscall_entry(regs->gr[20], regs);
 	else
 #endif
-		audit_syscall_entry_regs(regs->gr[20] & 0xffffffff, regs);
+		audit_syscall_entry(regs->gr[20] & 0xffffffff, regs);
 
 	/*
 	 * Sign extend the syscall number to 64bit since it may have been
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index c82d336611ef..e138f529ee7e 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -466,7 +466,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[0]);
 
-	audit_syscall_entry_regs(regs->regs[3], regs);
+	audit_syscall_entry(regs->regs[3], regs);
 
 	return 0;
 }
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 6197de10b45c..b162585b4a74 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1098,7 +1098,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-	audit_syscall_entry_regs(regs->u_regs[UREG_G1], regs);
+	audit_syscall_entry(regs->u_regs[UREG_G1], regs);
 
 	return ret;
 }
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 17c285e49ddc..bdc1b18bb342 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -123,7 +123,7 @@ static void send_sigtrap(struct uml_pt_regs *regs, int error_code)
  */
 int syscall_trace_enter(struct pt_regs *regs)
 {
-	audit_syscall_entry_regs(UPT_SYSCALL_NR(&regs->regs), regs);
+	audit_syscall_entry(UPT_SYSCALL_NR(&regs->regs), regs);
 
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, UPT_SYSCALL_NR(&regs->regs));
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index 86e4679b5869..327e00c2ebde 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -561,7 +561,7 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry_regs(regs->syscall, regs);
+	audit_syscall_entry(regs->syscall, regs);
 	return 1;
 }
 
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 22ffad5b2060..9ce5962bc537 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -323,9 +323,7 @@ extern int  audit_alloc(struct task_struct *task);
 extern void __audit_free(struct task_struct *task);
 extern void __audit_uring_entry(u8 op);
 extern void __audit_uring_exit(int success, long code);
-extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
-				  unsigned long a2, unsigned long a3);
-extern void __audit_syscall_entry_regs(int major, struct pt_regs *regs);
+extern void __audit_syscall_entry(int major, struct pt_regs *regs);
 extern void __audit_syscall_exit(int ret_success, long ret_value);
 extern void __audit_getname(struct filename *name);
 extern void __audit_inode(struct filename *name, const struct dentry *dentry,
@@ -374,17 +372,10 @@ static inline void audit_uring_exit(int success, long code)
 	if (unlikely(audit_context()))
 		__audit_uring_exit(success, code);
 }
-static inline void audit_syscall_entry(int major, unsigned long a0,
-				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
+static inline void audit_syscall_entry(int major, struct pt_regs *regs)
 {
 	if (unlikely(audit_context()))
-		__audit_syscall_entry(major, a0, a1, a2, a3);
-}
-static inline void audit_syscall_entry_regs(int major, struct pt_regs *regs)
-{
-	if (unlikely(audit_context()))
-		__audit_syscall_entry_regs(major, regs);
+		__audit_syscall_entry(major, regs);
 }
 static inline void audit_syscall_exit(void *pt_regs)
 {
@@ -617,11 +608,7 @@ static inline void audit_uring_entry(u8 op)
 { }
 static inline void audit_uring_exit(int success, long code)
 { }
-static inline void audit_syscall_entry(int major, unsigned long a0,
-				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
-{ }
-static inline void audit_syscall_entry_regs(int major, struct pt_regs *regs)
+static inline void audit_syscall_entry(int major, struct pt_regs *regs)
 { }
 static inline void audit_syscall_exit(void *pt_regs)
 { }
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 89f5c518c6f0..cf45c782b03d 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1974,60 +1974,6 @@ void __audit_uring_exit(int success, long code)
 /**
  * __audit_syscall_entry - fill in an audit record at syscall entry
  * @major: major syscall type (function)
- * @a1: additional syscall register 1
- * @a2: additional syscall register 2
- * @a3: additional syscall register 3
- * @a4: additional syscall register 4
- *
- * Fill in audit context at syscall entry.  This only happens if the
- * audit context was created when the task was created and the state or
- * filters demand the audit context be built.  If the state from the
- * per-task filter or from the per-syscall filter is AUDIT_STATE_RECORD,
- * then the record will be written at syscall exit time (otherwise, it
- * will only be written if another part of the kernel requests that it
- * be written).
- */
-void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
-			   unsigned long a3, unsigned long a4)
-{
-	struct audit_context *context = audit_context();
-	enum audit_state     state;
-
-	if (!audit_enabled || !context)
-		return;
-
-	WARN_ON(context->context != AUDIT_CTX_UNUSED);
-	WARN_ON(context->name_count);
-	if (context->context != AUDIT_CTX_UNUSED || context->name_count) {
-		audit_panic("unrecoverable error in audit_syscall_entry()");
-		return;
-	}
-
-	state = context->state;
-	if (state == AUDIT_STATE_DISABLED)
-		return;
-
-	context->dummy = !audit_n_rules;
-	if (!context->dummy && state == AUDIT_STATE_BUILD) {
-		context->prio = 0;
-		if (auditd_test_task(current))
-			return;
-	}
-
-	context->arch	    = syscall_get_arch(current);
-	context->major      = major;
-	context->argv[0]    = a1;
-	context->argv[1]    = a2;
-	context->argv[2]    = a3;
-	context->argv[3]    = a4;
-	context->context = AUDIT_CTX_SYSCALL;
-	context->current_state  = state;
-	ktime_get_coarse_real_ts64(&context->stamp.ctime);
-}
-
-/**
- * __audit_syscall_entry_regs - fill in an audit record at syscall entry
- * @major: major syscall type (function)
  * @regs: the task's register state at syscall entry
  *
  * Fill in audit context at syscall entry.  This only happens if the
@@ -2038,7 +1984,7 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
  * will only be written if another part of the kernel requests that it
  * be written).
  */
-void __audit_syscall_entry_regs(int major, struct pt_regs *regs)
+void __audit_syscall_entry(int major, struct pt_regs *regs)
 {
 	struct audit_context *context = audit_context();
 	enum audit_state     state;
@@ -2049,7 +1995,7 @@ void __audit_syscall_entry_regs(int major, struct pt_regs *regs)
 	WARN_ON(context->context != AUDIT_CTX_UNUSED);
 	WARN_ON(context->name_count);
 	if (context->context != AUDIT_CTX_UNUSED || context->name_count) {
-		audit_panic("unrecoverable error in audit_syscall_entry_regs()");
+		audit_panic("unrecoverable error in audit_syscall_entry()");
 		return;
 	}
 
diff --git a/kernel/entry/syscall-common.c b/kernel/entry/syscall-common.c
index 70941008beb6..471db2a8e09d 100644
--- a/kernel/entry/syscall-common.c
+++ b/kernel/entry/syscall-common.c
@@ -23,6 +23,6 @@ void syscall_enter_audit(struct pt_regs *regs)
 {
 	long syscall = syscall_get_nr(current, regs);
 
-	__audit_syscall_entry_regs(syscall, regs);
+	__audit_syscall_entry(syscall, regs);
 }
 #endif
-- 
2.55.0

Re: [PATCH v3 01/14] audit: log all six syscall arguments in the SYSCALL record

[Oleg Nesterov]

On 09/22, Ricardo Robaina wrote:
>
> The SYSCALL record currently logs only four of the six syscall
> arguments (a0-a3). The remaining two are captured but silently
> discarded before reaching the audit context. This leads to the
> need for auxiliary records when audit-relevant data lands in the
> 5th or 6th argument of a syscall.
>
> Extend the SYSCALL record to log all six arguments, by adding
> arguments a4 and a5 (5th and 6th syscall arguments respectively)
> inline within the existing record. Also add the two new args to
> the audit rules switch case, so audit rules can filter on them.
>
> Rather than plumbing two more register arguments through every
> architecture's syscall entry path, retrieve the arguments from
> pt_regs via syscall_get_arguments(). To keep the series bisectable,
> add new helpers audit_syscall_entry_regs() and
> __audit_syscall_entry_regs() that take a pointer to pt_regs, rather
> than modifying the existing ones in place. Later patches convert
> each architecture over to the new helpers, and a final patch removes
> the legacy helpers and renames the new ones back to the original
> naming.

Reviewed-by: Oleg Nesterov <oleg@redhat.com>

Re: [PATCH v3 14/14] audit: rename audit_syscall_entry_regs() to audit_syscall_entry()

[Oleg Nesterov]

On 09/22, Ricardo Robaina wrote:
>
> Now that every architecture has been converted to the pt_regs-based
> audit_syscall_entry_regs(), the legacy audit_syscall_entry() and
> __audit_syscall_entry() helpers that took the individual syscall
> argument registers (a0-a3) no longer have any callers.
>
> Remove those legacy helpers and rename audit_syscall_entry_regs() and
> __audit_syscall_entry_regs() back to audit_syscall_entry() and
> __audit_syscall_entry(), restoring the original naming.
>
> The _regs variants were introduced separately, and the architectures
> converted one per patch, specifically so this final rename is the only
> step that removes the old prototype. That keeps the series bisectable:
> every commit builds, and no caller is ever left referencing a helper
> that has been removed.
>
> Suggested-by: Will Deacon <will@kernel.org>
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>

Reviewed-by: Oleg Nesterov <oleg@redhat.com>