• Matt Redfearn's avatar
    MIPS: scall: Handle seccomp filters which redirect syscalls · a400bed6
    Matt Redfearn authored
    Commit d218af78 ("MIPS: scall: Always run the seccomp syscall
    filters") modified the syscall code to always call the seccomp filters,
    but missed the case where a filter may redirect the syscall, as
    revealed by the seccomp_bpf self test.
    
    The syscall path now restores the syscall from the stack after the
    filter rather than saving it locally. Syscall number checking and
    syscall function table lookup is done after the filter may have run such
    that redirected syscalls are also checked, and executed.
    
    The regular path of syscall number checking and pointer lookup is also
    made more consistent between ABIs with scall64-64.S being the reference.
    
    With this patch in place, the seccomp_bpf self test now passes
    TRACE_syscall.syscall_redirected and TRACE_syscall.syscall_dropped on
    all MIPS ABIs.
    
    Fixes: d218af78 ("MIPS: scall: Always run the seccomp syscall filters")
    Signed-off-by: default avatarMatt Redfearn <matt.redfearn@imgtec.com>
    Acked-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Eric B Munson <emunson@akamai.com>
    Cc: James Hogan <james.hogan@imgtec.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: linux-mips@linux-mips.org
    Cc: IMG-MIPSLinuxKerneldevelopers@imgtec.com
    Cc: linux-kernel@vger.kernel.org
    Patchwork: https://patchwork.linux-mips.org/patch/12916/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
    a400bed6
scall64-64.S 9.67 KB