[S390] audit: get s390 ret_from_fork in sync with other architectures

	On s390 we have ret_from_fork jump not to the "do all work we
normally do on return from syscall" as on x86, ppc, etc., but to the
"do all such work except audit".  Historical reasons - the codepath
triggered when we have AUDIT process flag set is separated from the
normall one and they converge at sysc_return, which is the common
part of post-syscall work.  And does not include calling audit_syscall_exit() -
that's done in the end of sysc_tracesys path, just before that path jumps
to sysc_return.

	IOW, the child returning from fork()/clone()/vfork() doesn't
call audit_syscall_exit() at all, so no matter what we do with its
audit context, we are not going to see the audit entry.

	The fix is simple: have ret_from_fork go to the point just past
the call of sys_.... in the 'we have AUDIT flag set' path.  There we
have (64bit variant; for 31bit the situation is the same):
sysc_tracenogo:
        tm      __TI_flags+7(%r9),(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT)
        jz      sysc_return
        la      %r2,SP_PTREGS(%r15)     # load pt_regs
        larl    %r14,sysc_return        # return point is sysc_return
        jg      do_syscall_trace_exit
which is precisely what we need - check the flag, bugger off to sysc_return
if not set, otherwise call do_syscall_trace_exit() and bugger off to
sysc_return.  r9 has just been properly set by ret_from_fork itself,
so we are fine.

	Tested on s390x, seems to work fine.  WARNING: it's been about
16 years since my last contact with 3X0 assembler[1], so additional
review would be very welcome.  I don't think I've managed to screw it
up, but...

[1] that *was* in another country and besides, the box is dead...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 198ea18a534d0d9c74e68f99b44649b92e852c69..c1cfc7e39ec9204a66e85dd96a402be42304aa63 100644 (file)
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -436,7 +436,7 @@ ret_from_fork:
        basr    %r14,%r1
        TRACE_IRQS_ON
        stosm   __SF_EMPTY(%r15),0x03   # reenable interrupts
-       b       BASED(sysc_return)
+       b       BASED(sysc_tracenogo)
 
 #
 # kernel_execve function needs to deal with pt_regs that is not

diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 89c121ae63391ef0453367cd26efa36d10296cf3..ea90d9a676f8c99e3b887effe88b8de2296ba765 100644 (file)
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -417,7 +417,7 @@ ret_from_fork:
 0:     brasl   %r14,schedule_tail
        TRACE_IRQS_ON
        stosm   24(%r15),0x03           # reenable interrupts
-       j       sysc_return
+       j       sysc_tracenogo
 
 #
 # kernel_execve function needs to deal with pt_regs that is not