audit: log all six syscall arguments in the SYSCALL record

PATCH Superseded Ricardo Robaina 3 participants 29 messages Aug 13 – Aug 14

Subsystems (16)

Arm (32-bit) MIPS BPF arm64 +12 more subsystems

lore

Share & tools

lore

Ricardo Robaina

author

2026-08-13 17:03 UTC #0 lore raw

cover audit: log all six syscall arguments in the SYSCALL record

The SYSCALL record currently logs only four of the six syscall arguments (a0-a3), silently discarding the remaining two. This leads to the need for auxiliary records when audit-relevant data lands in the 5th or 6th argument of a syscall.

This series extends the SYSCALL record to log all six arguments, by adding arguments a4 and a5 inline within the existing record.

The audit testsuite runs successfully:

 # make test
 make -C tests test
 chmod +x */test
 Running as   user    root
        with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        on   system  Fedora

amcast_joinpart/test ................. ok
backlog_wait_time_actual_reset/test .. ok
bpf/test ............................. ok
coredump/test ........................ ok
exec_execve/test ..................... ok
exec_name/test ....................... ok
fanotify/test ........................ ok
field_compare/test ................... ok
file_create/test ..................... ok
file_delete/test ..................... ok
file_permission/test ................. ok
file_rename/test ..................... ok
filter_device/test ................... ok
filter_exclude/test .................. ok
filter_exit/test ..................... ok
filter_inode/test .................... ok
filter_saddr_fam/test ................ ok
filter_sessionid/test ................ ok
io_uring/test ........................ ok
login_tty/test ....................... ok
lost_reset/test ...................... ok
netfilter_pkt/test ................... ok
signal/test .......................... ok
syscalls_file/test ................... ok
syscall_module/test .................. ok
syscall_socketcall/test .............. ok
time_change/test ..................... ok
user_msg/test ........................ ok
All tests successful.
Result: PASS

Ricardo Robaina (13):
audit: log all six syscall arguments in the SYSCALL record
alpha: pass all six syscall args to audit_syscall_entry()
arm: pass all six syscall args to audit_syscall_entry()
arm64: pass all six syscall args to audit_syscall_entry()
csky: pass all six syscall args to audit_syscall_entry()
microblaze: pass all six syscall args to audit_syscall_entry()
mips: pass all six syscall args to audit_syscall_entry()
openrisc: pass all six syscall args to audit_syscall_entry()
parisc: pass all six syscall args to audit_syscall_entry()
sh: pass all six syscall args to audit_syscall_entry()
sparc64: pass all six syscall args to audit_syscall_entry()
um: pass all six syscall args to audit_syscall_entry()
xtensa: pass all six syscall args to audit_syscall_entry()

 arch/alpha/kernel/ptrace.c      |  3 ++-
 arch/arm/kernel/ptrace.c        |  2 +-
 arch/arm64/kernel/ptrace.c      |  3 ++-
 arch/csky/kernel/ptrace.c       |  3 ++-
 arch/microblaze/kernel/ptrace.c |  3 ++-
 arch/mips/kernel/ptrace.c       | 11 ++++++++---
 arch/openrisc/kernel/ptrace.c   |  3 ++-
 arch/parisc/kernel/ptrace.c     |  7 +++++--
 arch/sh/kernel/ptrace_32.c      |  3 ++-
 arch/sparc/kernel/ptrace_64.c   |  3 ++-
 arch/um/kernel/ptrace.c         |  4 +++-
 arch/xtensa/kernel/ptrace.c     |  3 ++-
 include/linux/audit.h           | 11 +++++++----
 include/linux/entry-common.h    |  3 ++-
 include/uapi/linux/audit.h      |  2 ++
 kernel/audit.h                  |  2 +-
 kernel/auditfilter.c            |  2 ++
 kernel/auditsc.c                | 31 ++++++++++++++++++++-----------
 18 files changed, 67 insertions(+), 32 deletions(-)

Signature · 1 line

2.55.0

Ricardo Robaina

author

2026-08-13 17:04 UTC #1 lore raw

PATCH 1/13 audit: log all six syscall arguments in the SYSCALL record

The SYSCALL record currently logs only four of the six syscall arguments (a0-a3). The remaining two are captured but silently discarded before reaching the audit context. This leads to the need for auxiliary records when audit-relevant data lands in the 5th or 6th argument of a syscall.

Extend the SYSCALL record to log all six arguments, by adding arguments a4 and a5 (5th and 6th syscall argument respectively) inline within the existing record. Additionally, add the two new args to audit rules switch case, so audit rules can filter on them. Lastly, as a minor cleanup, rename params from (a1-a4) to (a0-a5) in __audit_syscall_entry(), for consistency.

type=SYSCALL ... syscall=openat ... a3=0x0 a4=0 a5=0 ... type=SYSCALL ... syscall=sendto ... a3=0x0 a4=7fff68843bcc a5=c ...

Link https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dX4Ah11RVhdyCBUQ@mail.gmail.com/T/#t open here

Signed-off-by Ricardo Robaina <[email protected]>

---
 include/linux/audit.h        | 11 +++++++----
 include/linux/entry-common.h |  3 ++-
 include/uapi/linux/audit.h   |  2 ++
 kernel/audit.h               |  2 +-
 kernel/auditfilter.c         |  2 ++
 kernel/auditsc.c             | 31 ++++++++++++++++++++-----------
 6 files changed, 34 insertions(+), 17 deletions(-)

include/linux/audit.h +7 -4

index 45abb3722d30..7306d7861159 100644
@@ -324,7 +324,8 @@ extern void __audit_free(struct task_struct *task);
 extern void __audit_uring_entry(u8 op);
 extern void __audit_uring_exit(int success, long code);
 extern void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
-				  unsigned long a2, unsigned long a3);
+				  unsigned long a2, unsigned long a3,
+				  unsigned long a4, unsigned long a5);
 extern void __audit_syscall_exit(int ret_success, long ret_value);
 extern void __audit_getname(struct filename *name);
 extern void __audit_inode(struct filename *name, const struct dentry *dentry,

@@ -375,10 +376,11 @@ static inline void audit_uring_exit(int success, long code)
 }
 static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
+				       unsigned long a3, unsigned long a4,
+				       unsigned long a5)
 {
 	if (unlikely(audit_context()))
-		__audit_syscall_entry(major, a0, a1, a2, a3);
+		__audit_syscall_entry(major, a0, a1, a2, a3, a4, a5);
 }
 static inline void audit_syscall_exit(void *pt_regs)
 {

@@ -613,7 +615,8 @@ static inline void audit_uring_exit(int success, long code)
 { }
 static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
+				       unsigned long a3, unsigned long a4,
+				       unsigned long a5)
 { }
 static inline void audit_syscall_exit(void *pt_regs)
 { }

include/linux/entry-common.h +2 -1

index 416a3352261f..cf2d9989e3fe 100644
@@ -65,7 +65,8 @@ static inline void syscall_enter_audit(struct pt_regs *regs, long syscall)
 		unsigned long args[6];
 
 		syscall_get_arguments(current, regs, args);
-		audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
+		audit_syscall_entry(syscall, args[0], args[1], args[2], args[3],
+				    args[4], args[5]);
 	}
 }

include/uapi/linux/audit.h +2 -0

index e8f5ce677df7..6726059d6df1 100644
@@ -303,6 +303,8 @@
 #define AUDIT_ARG1      (AUDIT_ARG0+1)
 #define AUDIT_ARG2      (AUDIT_ARG0+2)
 #define AUDIT_ARG3      (AUDIT_ARG0+3)
+#define AUDIT_ARG4      (AUDIT_ARG0+4)
+#define AUDIT_ARG5      (AUDIT_ARG0+5)
 
 #define AUDIT_FILTERKEY	210

kernel/audit.h +1 -1

index 92d5e723d570..83011b14af18 100644
@@ -117,7 +117,7 @@ struct audit_context {
 	struct audit_stamp  stamp;	/* event identifier */
 	int		    major;      /* syscall number */
 	int		    uring_op;   /* uring operation */
-	unsigned long	    argv[4];    /* syscall arguments */
+	unsigned long	    argv[6];    /* syscall arguments */
 	long		    return_code;/* syscall return code */
 	u64		    prio;
 	int		    return_valid; /* return code is valid */

kernel/auditfilter.c +2 -0

index 7f791afe5791..4bf539d6937d 100644
@@ -358,6 +358,8 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
 	case AUDIT_ARG1:
 	case AUDIT_ARG2:
 	case AUDIT_ARG3:
+	case AUDIT_ARG4:
+	case AUDIT_ARG5:
 	case AUDIT_PERS: /* <uapi/linux/personality.h> */
 	case AUDIT_DEVMINOR:
 		/* all ops are valid */

kernel/auditsc.c +20 ~~-11~~

index 6610e667c728..7a9d65a6b1cc 100644
@@ -728,6 +728,8 @@ static int audit_filter_rules(struct task_struct *tsk,
 		case AUDIT_ARG1:
 		case AUDIT_ARG2:
 		case AUDIT_ARG3:
+		case AUDIT_ARG4:
+		case AUDIT_ARG5:
 			if (ctx)
 				result = audit_comparator(ctx->argv[f->type-AUDIT_ARG0], f->op, f->val);
 			break;

@@ -1674,11 +1676,13 @@ static void audit_log_exit(void)
 						    AUDITSC_SUCCESS),
 					 context->return_code);
 		audit_log_format(ab,
-				 " a0=%lx a1=%lx a2=%lx a3=%lx items=%d",
+				 " a0=%lx a1=%lx a2=%lx a3=%lx a4=%lx a5=%lx items=%d",
 				 context->argv[0],
 				 context->argv[1],
 				 context->argv[2],
 				 context->argv[3],
+				 context->argv[4],
+				 context->argv[5],
 				 context->name_count);
 		audit_log_task_info(ab);
 		audit_log_key(ab, context->filterkey);

@@ -1970,10 +1974,12 @@ void __audit_uring_exit(int success, long code)
 /**
  * __audit_syscall_entry - fill in an audit record at syscall entry
  * @major: major syscall type (function)
- * @a1: additional syscall register 1
- * @a2: additional syscall register 2
- * @a3: additional syscall register 3
- * @a4: additional syscall register 4
+ * @a0: additional syscall register 1
+ * @a1: additional syscall register 2
+ * @a2: additional syscall register 3
+ * @a3: additional syscall register 4
+ * @a4: additional syscall register 5
+ * @a5: additional syscall register 6
  *
  * Fill in audit context at syscall entry.  This only happens if the
  * audit context was created when the task was created and the state or

@@ -1983,8 +1989,9 @@ void __audit_uring_exit(int success, long code)
  * will only be written if another part of the kernel requests that it
  * be written).
  */
-void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
-			   unsigned long a3, unsigned long a4)
+void __audit_syscall_entry(int major, unsigned long a0, unsigned long a1,
+			   unsigned long a2, unsigned long a3,
+			   unsigned long a4, unsigned long a5)
 {
 	struct audit_context *context = audit_context();
 	enum audit_state     state;

@@ -2012,10 +2019,12 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
 
 	context->arch	    = syscall_get_arch(current);
 	context->major      = major;
-	context->argv[0]    = a1;
-	context->argv[1]    = a2;
-	context->argv[2]    = a3;
-	context->argv[3]    = a4;
+	context->argv[0]    = a0;
+	context->argv[1]    = a1;
+	context->argv[2]    = a2;
+	context->argv[3]    = a3;
+	context->argv[4]    = a4;
+	context->argv[5]    = a5;
 	context->context = AUDIT_CTX_SYSCALL;
 	context->current_state  = state;
 	ktime_get_coarse_real_ts64(&context->stamp.ctime);

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:20 UTC #2 lore raw

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] The patch changes the signature of `audit_syscall_entry()` and `__audit_syscall_entry()` to require…

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch changes the signature of audit_syscall_entry() and __audit_syscall_entry() to require 7 arguments instead of 5, but fails to update direct callers in architectures not using the generic entry code (e.g., ARM, ARM64, MIPS, PowerPC). This mismatch results in widespread "too few arguments to function" compilation errors. --

--- Patch [1]: [PATCH 01/13] audit: log all six syscall arguments in the SYSCALL record --- commit 078f116f3b4c24869c2f9f6df42833c2c348b962
Author: Ricardo Robaina <[email protected]>

audit: log all six syscall arguments in the SYSCALL record

This patch extends the SYSCALL audit record to log all six syscall arguments, adding arguments a4 and a5 inline within the existing record. It updates the audit_syscall_entry() function signature to accommodate these new parameters.

Link https://lore.kernel.org/audit/CAHC9VhSjEt_-Bsra4AEqWv+Daw5Ff=gqy7dX4Ah11RVhdyCBUQ@mail.gmail.com/T/#t open here

Quoted 4 lines

include/linux/audit.h +0 -0
index 803b0183d98dd..5c3486dd691f6 100644

[ ... ]

include/linux/audit.h static inline void audit_uring_exit(int success, long code) · line 380

Quoted 7 lines

include/linux/audit.h +2 -1

@@ -375,10 +376,11 @@ static inline void audit_uring_exit(int success, long code)
 }
 static inline void audit_syscall_entry(int major, unsigned long a0,
 				       unsigned long a1, unsigned long a2,
-				       unsigned long a3)
+				       unsigned long a3, unsigned long a4,
+				       unsigned long a5)

[Severity: Low]
Will this break the build for architectures that do not use the generic entry code?

For example, looking at arch/arm/kernel/ptrace.c:syscall_trace_enter(), it still calls this function with only five arguments:

	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
			    regs->ARM_r3);

Similarly, arch/arm64/kernel/ptrace.c:syscall_trace_enter() and arch/powerpc/kernel/ptrace/ptrace.c:do_syscall_trace_enter() also appear to call audit_syscall_entry() without the newly required arguments.

Should these architecture-specific callers be updated as well to prevent "too few arguments to function" compilation errors?

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Ricardo Robaina

author

2026-08-13 17:04 UTC #3 lore raw

PATCH 2/13 alpha: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (r20, r21) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/alpha/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/alpha/kernel/ptrace.c +2 -1

index 0687760ea466..d90e2194b528 100644
@@ -396,7 +396,8 @@ asmlinkage unsigned long syscall_trace_enter(void)
 
 #ifdef CONFIG_AUDITSYSCALL
 	audit_syscall_entry(syscall_get_nr(current, regs),
-		regs->r16, regs->r17, regs->r18, regs->r19);
+		regs->r16, regs->r17, regs->r18, regs->r19,
+		regs->r20, regs->r21);
 #endif
 	return syscall_get_nr(current, regs);
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:18 UTC #4 lore raw

Re: [PATCH 02/13] alpha: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] When a syscall is skipped by seccomp or ptrace, the kernel fails to set the return value to -ENOSYS, allowing unprivileged userspace to spoof successful syscall returns. --

--- Patch [2]: [PATCH 02/13] alpha: pass all six syscall args to audit_syscall_entry() --- commit 34becaec07c6a7a08cc6bd923c1a39f3ee655963
Author: Ricardo Robaina <[email protected]>
Subject: alpha: pass all six syscall args to audit_syscall_entry()

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments. This ensures the audit core logs all six arguments on alpha.

arch/alpha/kernel/ptrace.c asmlinkage unsigned long syscall_trace_enter(void)

Quoted 5 lines

arch/alpha/kernel/ptrace.c +0 -0

index 0687760ea4669..d90e2194b5284 100644
@@ -396,7 +396,8 @@ asmlinkage unsigned long syscall_trace_enter(void)

[Severity: High]
This is a pre-existing issue, but does the -ENOSYS fixup in syscall_trace_enter() get skipped incorrectly when a syscall is filtered by seccomp or ptrace?

Earlier in this function, the fixup condition is:

    if (secure_computing() == -1) {
        if (regs->r19 == 0 && regs->r0 == (unsigned long)-1)
            syscall_set_return_value(current, regs, -ENOSYS, 0);
        syscall_set_nr(current, regs, -1);
        return -1UL;
    }

If secure_computing() returns -1 to skip the syscall execution, syscall_set_nr() sets r1 to -1. However, it seems r0 still contains the original syscall number instead of -1. Doesn't this cause the fallback condition to evaluate to false and skip setting -ENOSYS?

If so, a seccomp filter that skips a syscall without explicitly setting a return value (such as SECCOMP_RET_USER_NOTIF) might leak the syscall number back to user space as a successful return value instead of returning an error.

It looks like this same logic is mirrored in arch/alpha/kernel/entry.S in SYSCALL_SKIP_RETURN_RESTART_GATE:

    ldq     $20, 0($sp)             /* r0 */
    lda     $21, -1($31)
    cmpeq   $20, $21, $22
    beq     $22, 1f                 /* r0 != -1 => skip fixup */

Does this also bypass the fixup for the same reason?

Quoted 9 lines

arch/alpha/kernel/ptrace.c +2 -1

 #ifdef CONFIG_AUDITSYSCALL
 	audit_syscall_entry(syscall_get_nr(current, regs),
-		regs->r16, regs->r17, regs->r18, regs->r19);
+		regs->r16, regs->r17, regs->r18, regs->r19,
+		regs->r20, regs->r21);
 #endif
 	return syscall_get_nr(current, regs);
 }

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2

Ricardo Robaina

author

2026-08-13 17:04 UTC #5 lore raw

PATCH 3/13 arm: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (ARM_r4, ARM_r5) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/arm/kernel/ptrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/arm/kernel/ptrace.c +1 -1

index 7951b2c06fec..ace74207738d 100644
@@ -869,7 +869,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, scno);
 
 	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
-			    regs->ARM_r3);
+			    regs->ARM_r3, regs->ARM_r4, regs->ARM_r5);
 
 	return scno;
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:20 UTC #6 lore raw

Re: [PATCH 03/13] arm: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] The patch series changes the signature of audit_syscall_entry() globally but fails to update numerous architectures, breaking their builds.

Pre-existing issues:
- [High] A tracer can bypass seccomp filters on ARM by modifying ARM_r0 via ptrace, as seccomp incorrectly evaluates the unmodified ARM_ORIG_r0. --

--- Patch [3]: [PATCH 03/13] arm: pass all six syscall args to audit_syscall_entry() --- commit 5e37711667e9af11aeb7334ef9ee7ed66cadd89d
Author: Ricardo Robaina <[email protected]>

arm: pass all six syscall args to audit_syscall_entry()

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (ARM_r4, ARM_r5) now that the audit core logs all six.

arch/arm/kernel/ptrace.c asmlinkage int syscall_trace_enter(struct pt_regs *regs)

Quoted 5 lines

arch/arm/kernel/ptrace.c +0 -0

index 7951b2c06fec6..ace74207738d0 100644
@@ -869,7 +869,7 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)

[Severity: High]
This is a pre-existing issue, but can a tracer bypass seccomp filters here?

The ptrace intercept occurs before seccomp:

arch/arm/kernel/ptrace.c:syscall_trace_enter() {
    ...
    if (test_thread_flag(TIF_SYSCALL_TRACE))
        report_syscall(regs, PTRACE_SYSCALL_ENTER);

#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
    if (secure_computing() == -1)
        return -1;
    ...
}

If the tracer modifies the tracee's first syscall argument (ARM_r0) via ptrace, does seccomp evaluate the unmodified ARM_ORIG_r0 instead?

arch/arm/include/asm/syscall.h:syscall_get_arguments() {
    ...
    args[0] = regs->ARM_ORIG_r0;
    ...
}

Could this allow restricted system calls to be executed with arbitrary first arguments?

arch/arm/kernel/ptrace.c asmlinkage int syscall_trace_enter(struct pt_regs *regs) · line 872

Quoted 5 lines

arch/arm/kernel/ptrace.c +1 -1

 		trace_sys_enter(regs, scno);
 
 	audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
-			    regs->ARM_r3);
+			    regs->ARM_r3, regs->ARM_r4, regs->ARM_r5);

[Severity: High]
Does this patch series break the build for other architectures?

The series changes the signature of audit_syscall_entry() globally to require 7 arguments instead of 5:

include/linux/audit.h:
static inline void audit_syscall_entry(int major, unsigned long a0,
unsigned long a1, unsigned long a2, unsigned long a3, unsigned long a4, unsigned long a5)

Are other architectures like arm64 still calling it with 5 arguments?

arch/arm64/kernel/ptrace.c:syscall_trace_enter() {
    ...
    audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
                        regs->regs[2], regs->regs[3]);
    ...
}

Will this result in too few arguments to function compiler errors for architectures that do not use generic entry?

Quoted 3 lines

arch/arm/kernel/ptrace.c +0 -0
 	return scno;
 }

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3

Ricardo Robaina

author

2026-08-13 17:04 UTC #7 lore raw

PATCH 4/13 arm64: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (regs[4], regs[5]) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/arm64/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/arm64/kernel/ptrace.c +2 -1

index 4d08598e2891..093c20bff38a 100644
@@ -2427,7 +2427,8 @@ int syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->syscallno);
 
 	audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
-			    regs->regs[2], regs->regs[3]);
+			    regs->regs[2], regs->regs[3],
+			    regs->regs[4], regs->regs[5]);
 
 	return regs->syscallno;
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:17 UTC #8 lore raw

Re: [PATCH 04/13] arm64: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] Tree-wide API change for `audit_syscall_entry()` missed several architectures, causing build…

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Tree-wide API change for audit_syscall_entry() missed several architectures, causing build failures due to an argument count mismatch. --

--- Patch [4]: [PATCH 04/13] arm64: pass all six syscall args to audit_syscall_entry() --- commit 5064bc40e84bac75de063321783c252440dbc0f5
Author: Ricardo Robaina <[email protected]>

arm64: pass all six syscall args to audit_syscall_entry()

This commit updates the arm64 syscall entry path to pass all six syscall arguments to audit_syscall_entry(). This aligns with updates to the audit core which now expects these additional arguments.

arch/arm64/kernel/ptrace.c int syscall_trace_enter(struct pt_regs *regs) · line 2431

Quoted 11 lines

arch/arm64/kernel/ptrace.c +2 -1

index 4d08598e2891d..093c20bff38a9 100644
@@ -2427,7 +2427,8 @@ int syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->syscallno);
 
 	audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
-			    regs->regs[2], regs->regs[3]);
+			    regs->regs[2], regs->regs[3],
+			    regs->regs[4], regs->regs[5]);

[Severity: Low]
Does this change need to be applied to other architectures as well to avoid build failures?

It looks like several other architectures were not updated to match the new 7-argument signature of audit_syscall_entry(), which will cause them to fail to compile due to 'too few arguments to function' errors.

For example, MIPS continues to pass only 5 arguments:

arch/mips/kernel/ptrace.c:syscall_trace_enter() {
	...
	audit_syscall_entry(current_thread_info()->syscall,
			    regs->regs[4], regs->regs[5],
			    regs->regs[6], regs->regs[7]);
	...
}

Similar missing updates appear in C-Sky's syscall_trace_enter() (arch/csky/kernel/ptrace.c), Microblaze's do_syscall_trace_enter() (arch/microblaze/kernel/ptrace.c), and PowerPC's do_syscall_trace_enter() (arch/powerpc/kernel/ptrace/ptrace.c).

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4

Ricardo Robaina

author

2026-08-13 17:04 UTC #9 lore raw

PATCH 5/13 csky: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (a4, a5) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/csky/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/csky/kernel/ptrace.c +2 -1

index 6bb685a2646b..562eaf23be82 100644
@@ -329,7 +329,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, regs->a2, regs->a3);
+	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1,
+			    regs->a2, regs->a3, regs->a4, regs->a5);
 	return 0;
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:16 UTC #10 lore raw

Re: [PATCH 05/13] csky: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] The patch introduces a compile error by accessing `a4` and `a5` members of `struct pt_regs`, which…

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch introduces a compile error by accessing a4 and a5 members of struct pt_regs, which do not exist on the csky architecture. --

--- Patch [5]: [PATCH 05/13] csky: pass all six syscall args to audit_syscall_entry() --- commit 048151cce10f914f8f5068a59ec81b9462f22b0f
Author: Ricardo Robaina <[email protected]>

csky: pass all six syscall args to audit_syscall_entry()

This commit updates the audit_syscall_entry() call in the csky architecture to pass the 5th and 6th syscall arguments. It attempts to access these arguments via the pt_regs structure.

arch/csky/kernel/ptrace.c asmlinkage int syscall_trace_enter(struct pt_regs *regs) · line 333

Quoted 11 lines

arch/csky/kernel/ptrace.c +2 -1

index 6bb685a2646b5..562eaf23be82d 100644
@@ -329,7 +329,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, syscall_get_nr(current, regs));
 
-	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1, regs->a2, regs->a3);
+	audit_syscall_entry(regs_syscallid(regs), regs->a0, regs->a1,
+			    regs->a2, regs->a3, regs->a4, regs->a5);

[Severity: Low]
Will this cause a build failure? Looking at struct pt_regs for csky, it appears the a4 and a5 members do not exist. Accessing regs->a4 and regs->a5 here in syscall_trace_enter() seems like it will prevent the csky architecture from compiling.

Quoted 2 lines

arch/csky/kernel/ptrace.c +0 -0
 	return 0;
 }

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=5

Ricardo Robaina

author

2026-08-13 17:05 UTC #11 lore raw

PATCH 6/13 microblaze: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (r9, r10) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/microblaze/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/microblaze/kernel/ptrace.c +2 -1

index 5234d0c1dcaa..21bcd8dfe42d 100644
@@ -147,7 +147,8 @@ asmlinkage unsigned long do_syscall_trace_enter(struct pt_regs *regs)
 		 */
 		ret = -1L;
 
-	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7, regs->r8);
+	audit_syscall_entry(regs->r12, regs->r5, regs->r6, regs->r7,
+			    regs->r8, regs->r9, regs->r10);
 
 	return ret ?: regs->r12;
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:15 UTC #12 lore raw

Re: [PATCH 06/13] microblaze: pass all six syscall args to audit_syscall_entry()

Sashiko has reviewed this patch and found no issues. It looks great!

Quoted 4 lines

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (r9, r10) now that the audit core logs all six.
Signed-off-by Ricardo Robaina <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=6

Ricardo Robaina

author

2026-08-13 17:05 UTC #13 lore raw

PATCH 7/13 mips: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Use syscall_get_arguments() to retrieve all six arguments portably. On 32-bit MIPS (O32 ABI), arguments 5 and 6 live on the user stack rather than in registers, so direct register access would be wrong.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/mips/kernel/ptrace.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

arch/mips/kernel/ptrace.c +8 -3

index 3f4c94c88124..9e6f9accdb41 100644
@@ -1334,9 +1334,14 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs)
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 		trace_sys_enter(regs, regs->regs[2]);
 
-	audit_syscall_entry(current_thread_info()->syscall,
-			    regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+	{
+		unsigned long args[6];
+
+		syscall_get_arguments(current, regs, args);
+		audit_syscall_entry(current_thread_info()->syscall,
+				    args[0], args[1], args[2], args[3],
+				    args[4], args[5]);
+	}
 
 	/*
 	 * Negative syscall numbers are mistaken for rejected syscalls, but

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:15 UTC #14 lore raw

Re: [PATCH 07/13] mips: pass all six syscall args to audit_syscall_entry()

Sashiko has reviewed this patch and found no issues. It looks great!

Quoted 5 lines

Use syscall_get_arguments() to retrieve all six arguments portably. On 32-bit MIPS (O32 ABI), arguments 5 and 6 live on the user stack rather than in registers, so direct register access would be wrong.
Signed-off-by Ricardo Robaina <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=7

Ricardo Robaina

author

2026-08-13 17:05 UTC #15 lore raw

PATCH 8/13 openrisc: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (gpr[7], gpr[8]) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/openrisc/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/openrisc/kernel/ptrace.c +2 -1

index 552489b24855..197a616d6c65 100644
@@ -302,7 +302,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		ret = -1L;
 
 	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
-			    regs->gpr[5], regs->gpr[6]);
+			    regs->gpr[5], regs->gpr[6],
+			    regs->gpr[7], regs->gpr[8]);
 
 	return ret ? : regs->gpr[11];
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:20 UTC #16 lore raw

Re: [PATCH 08/13] openrisc: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] The patch series breaks git bisectability by changing a core function signature before updating all architecture callers.

Pre-existing issues:
- [High] The return value of do_syscall_trace_enter() is ignored, breaking ptrace syscall abortion (e.g., PTRACE_SYSEMU). --

--- Patch [8]: [PATCH 08/13] openrisc: pass all six syscall args to audit_syscall_entry() --- commit 9ca4bd79e1e00767e994486accfe2484de6f3a04
Author: Ricardo Robaina <[email protected]>

openrisc: pass all six syscall args to audit_syscall_entry()

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (gpr[7], gpr[8]) now that the audit core logs all six.

arch/openrisc/kernel/ptrace.c asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) · line 306

Quoted 11 lines

arch/openrisc/kernel/ptrace.c +2 -1

index 552489b24855c..197a616d6c65c 100644
@@ -302,7 +302,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		ret = -1L;
 
 	audit_syscall_entry(regs->gpr[11], regs->gpr[3], regs->gpr[4],
-			    regs->gpr[5], regs->gpr[6]);
+			    regs->gpr[5], regs->gpr[6],
+			    regs->gpr[7], regs->gpr[8]);

[Severity: Low]
Will this change cause a git bisectability regression if architecture callers are updated in subsequent commits?

If the core function signature of audit_syscall_entry() was changed in a previous commit, intermediate commits checked out between the core change and this architecture update will fail to compile on OpenRISC with a "too few arguments to function" error.

arch/openrisc/kernel/ptrace.c asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) · line 309

Quoted 3 lines

arch/openrisc/kernel/ptrace.c +0 -0
 	return ret ? : regs->gpr[11];
 }

[Severity: High]
This isn't a bug introduced by this patch, but is the return value ignored by the assembly caller, potentially breaking ptrace syscall abortion?

If tracing decides a syscall should not happen (e.g., via PTRACE_SYSEMU) and ptrace_report_syscall_entry() returns non-zero, this function attempts to abort the syscall by returning -1L in r11.

However, the caller in arch/openrisc/kernel/entry.S unconditionally reloads the original syscall number into r11, discarding the return value:

arch/openrisc/kernel/entry.S:_syscall_trace_enter()

    ...
    l.jal   do_syscall_trace_enter
     l.addi r3,r1,0

    /* Restore arguments ... */
    l.lwz   r11,PT_GPR11(r1)
    ...

Can this allow the original syscall to execute regardless of the tracer's abort request?

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=8

Ricardo Robaina

author

2026-08-13 17:05 UTC #17 lore raw

PATCH 9/13 parisc: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update both the native and compat audit_syscall_entry() calls to forward the 5th and 6th syscall arguments (gr[22], gr[21]) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/parisc/kernel/ptrace.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

arch/parisc/kernel/ptrace.c +5 -2

index 8a17ab7e6e0b..75e74d214a3b 100644
@@ -362,14 +362,17 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
 		audit_syscall_entry(regs->gr[20], regs->gr[26], regs->gr[25],
-				    regs->gr[24], regs->gr[23]);
+				    regs->gr[24], regs->gr[23],
+				    regs->gr[22], regs->gr[21]);
 	else
 #endif
 		audit_syscall_entry(regs->gr[20] & 0xffffffff,
 			regs->gr[26] & 0xffffffff,
 			regs->gr[25] & 0xffffffff,
 			regs->gr[24] & 0xffffffff,
-			regs->gr[23] & 0xffffffff);
+			regs->gr[23] & 0xffffffff,
+			regs->gr[22] & 0xffffffff,
+			regs->gr[21] & 0xffffffff);
 
 	/*
 	 * Sign extend the syscall number to 64bit since it may have been

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:13 UTC #18 lore raw

Re: [PATCH 09/13] parisc: pass all six syscall args to audit_syscall_entry()

Sashiko has reviewed this patch and found no issues. It looks great!

Quoted 5 lines

Update both the native and compat audit_syscall_entry() calls to forward the 5th and 6th syscall arguments (gr[22], gr[21]) now that the audit core logs all six.
Signed-off-by Ricardo Robaina <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=9

Ricardo Robaina

author

2026-08-13 17:06 UTC #19 lore raw

PATCH 10/13 sh: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (regs[0], regs[1]) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/sh/kernel/ptrace_32.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/sh/kernel/ptrace_32.c +2 -1

index 06f765d71a29..3efefd67b457 100644
@@ -467,7 +467,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->regs[0]);
 
 	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+			    regs->regs[6], regs->regs[7],
+			    regs->regs[0], regs->regs[1]);
 
 	return 0;
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:24 UTC #20 lore raw

Re: [PATCH 10/13] sh: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the sys_enter tracepoint is incorrectly invoked with the 5th syscall argument (regs->regs[0]) instead of the system call number, allowing userspace to spoof syscall trace events. --

--- Patch [10]: [PATCH 10/13] sh: pass all six syscall args to audit_syscall_entry() --- commit 3f32d157a274ce4c78e2758720926d9048ca177a
Author: Ricardo Robaina <[email protected]>

sh: pass all six syscall args to audit_syscall_entry()

This commit updates the audit_syscall_entry() call to forward the 5th and 6th syscall arguments. This aligns with the audit core which now logs all six arguments.

arch/sh/kernel/ptrace_32.c asmlinkage long do_syscall_trace_enter(struct pt_regs *regs) · line 467

Quoted 6 lines

arch/sh/kernel/ptrace_32.c +0 -0

index 06f765d71a295..3efefd67b457c 100644
@@ -467,7 +467,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 		trace_sys_enter(regs, regs->regs[0]);

[Severity: High]
This is a pre-existing issue in do_syscall_trace_enter(), but is trace_sys_enter() receiving the correct system call number here?

Since regs->regs[0] holds the 5th syscall argument on SuperH, passing it here means security monitoring tools attached to the sys_enter tracepoint might receive an incorrect, user-controlled syscall number. Could a local unprivileged attacker exploit this by placing a sensitive syscall number in the actual syscall register and a benign one in r0 to bypass security auditing?

Quoted 8 lines

arch/sh/kernel/ptrace_32.c +2 -1

 	audit_syscall_entry(regs->regs[3], regs->regs[4], regs->regs[5],
-			    regs->regs[6], regs->regs[7]);
+			    regs->regs[6], regs->regs[7],
+			    regs->regs[0], regs->regs[1]);
 
 	return 0;
 }

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=10

Ricardo Robaina

author

2026-08-13 17:06 UTC #21 lore raw

PATCH 11/13 sparc64: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (UREG_I4, UREG_I5) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/sparc/kernel/ptrace_64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/sparc/kernel/ptrace_64.c +2 -1

index 9fc67fa9336f..d0ad3200d789 100644
@@ -1100,7 +1100,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 
 	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
 			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
-			    regs->u_regs[UREG_I3]);
+			    regs->u_regs[UREG_I3], regs->u_regs[UREG_I4],
+			    regs->u_regs[UREG_I5]);
 
 	return ret;
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:26 UTC #22 lore raw

Re: [PATCH 11/13] sparc64: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] 32-bit compat syscall arguments are not zero-extended before being passed to audit_syscall_entry(), leading to a high-severity audit evasion vulnerability for socketcall multiplexed syscalls. --

--- Patch [11]: [PATCH 11/13] sparc64: pass all six syscall args to audit_syscall_entry() --- commit 5c60aff4dd1af29adf66c85f200b0a80fe2238fb
Author: Ricardo Robaina <[email protected]>

sparc64: pass all six syscall args to audit_syscall_entry()

This commit updates syscall_trace_enter() to forward the 5th and 6th syscall arguments (UREG_I4, UREG_I5) to audit_syscall_entry(). This change ensures all six arguments are passed, aligning with the audit core's expectations.

arch/sparc/kernel/ptrace_64.c asmlinkage int syscall_trace_enter(struct pt_regs *regs) · line 1104

Quoted 11 lines

arch/sparc/kernel/ptrace_64.c +2 -1

index 9fc67fa9336fe..d0ad3200d789c 100644
@@ -1100,7 +1100,8 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
 
 	audit_syscall_entry(regs->u_regs[UREG_G1], regs->u_regs[UREG_I0],
 			    regs->u_regs[UREG_I1], regs->u_regs[UREG_I2],
-			    regs->u_regs[UREG_I3]);
+			    regs->u_regs[UREG_I3], regs->u_regs[UREG_I4],
+			    regs->u_regs[UREG_I5]);

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for a 32-bit compat process to evade audit rules because these arguments are not zero-extended?

For a 32-bit process executing a multiplexed system call like socketcall, an attacker could intentionally leave non-zero garbage in the upper 32 bits of the registers.

Because syscall_trace_enter() passes the raw 64-bit values directly from regs->u_regs without zero-extending them, the audit subsystem stores the full 64-bit value. When the audit core later evaluates rules (e.g., checking ctx->argv[0] == SYS_BIND), the comparison fails due to the upper 32-bit garbage, bypassing the rule.

Since the SPARC64 assembly later zero-extends the arguments before invoking the actual compat syscall handler, the syscall succeeds without being properly audited.

Could we zero-extend these register values for 32-bit compat tasks before passing them to audit_syscall_entry() to prevent this bypass?

Quoted 3 lines

arch/sparc/kernel/ptrace_64.c +0 -0
 	return ret;
 }

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=11

Ricardo Robaina

author

2026-08-13 17:06 UTC #23 lore raw

PATCH 12/13 um: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (UPT_SYSCALL_ARG5, UPT_SYSCALL_ARG6) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/um/kernel/ptrace.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

arch/um/kernel/ptrace.c +3 -1

index fdbb37b5c399..c597a368592d 100644
@@ -127,7 +127,9 @@ int syscall_trace_enter(struct pt_regs *regs)
 			    UPT_SYSCALL_ARG1(&regs->regs),
 			    UPT_SYSCALL_ARG2(&regs->regs),
 			    UPT_SYSCALL_ARG3(&regs->regs),
-			    UPT_SYSCALL_ARG4(&regs->regs));
+			    UPT_SYSCALL_ARG4(&regs->regs),
+			    UPT_SYSCALL_ARG5(&regs->regs),
+			    UPT_SYSCALL_ARG6(&regs->regs));
 
 	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
 		trace_sys_enter(regs, UPT_SYSCALL_NR(&regs->regs));

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:19 UTC #24 lore raw

Re: [PATCH 12/13] um: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] The patch series changes the signature of `audit_syscall_entry()` globally but splits caller…

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch series changes the signature of audit_syscall_entry() globally but splits caller updates into separate commits and completely misses updating the PowerPC and Xtensa architectures, causing a tree-wide build failure. --

--- Patch [12]: [PATCH 12/13] um: pass all six syscall args to audit_syscall_entry() --- commit 9c50f8d1e9a5a601156f9a077df794dd83a368a0
Author: Ricardo Robaina <[email protected]>

um: pass all six syscall args to audit_syscall_entry()

This commit updates the syscall_trace_enter function in the UML architecture to pass the 5th and 6th syscall arguments to audit_syscall_entry. This aligns with the new audit core API which logs all six arguments.

Quoted 3 lines

arch/um/kernel/ptrace.c +0 -0

[ ... ]

arch/um/kernel/ptrace.c int syscall_trace_enter(struct pt_regs *regs) · line 132

Quoted 8 lines

arch/um/kernel/ptrace.c +3 -1

@@ -127,7 +127,9 @@ int syscall_trace_enter(struct pt_regs *regs)
 			    UPT_SYSCALL_ARG1(&regs->regs),
 			    UPT_SYSCALL_ARG2(&regs->regs),
 			    UPT_SYSCALL_ARG3(&regs->regs),
-			    UPT_SYSCALL_ARG4(&regs->regs));
+			    UPT_SYSCALL_ARG4(&regs->regs),
+			    UPT_SYSCALL_ARG5(&regs->regs),
+			    UPT_SYSCALL_ARG6(&regs->regs));

[Severity: Low]
Does splitting the caller updates into separate commits from the core API change break bisection for architectures not using the generic entry code?

If the core API was changed in a previous commit, building this intermediate commit during git bisect will fail since architectures not yet updated will have callers expecting the old signature.

Additionally, were the PowerPC and Xtensa architectures missed entirely in this series? For example, do_syscall_trace_enter() in arch/powerpc/kernel/ptrace/ptrace.c still passes 5 arguments instead of the required 7:

		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
				    regs->gpr[5], regs->gpr[6]);

A similar issue occurs in do_syscall_trace_enter() in arch/xtensa/kernel/ptrace.c. Will this cause an unconditional build failure for these architectures when compiled with CONFIG_AUDITSYSCALL=y?

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=12

Ricardo Robaina

author

2026-08-13 17:06 UTC #25 lore raw

PATCH 13/13 xtensa: pass all six syscall args to audit_syscall_entry()

In reply to Ricardo Robaina

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (areg[8], areg[9]) now that the audit core logs all six.

Signed-off-by Ricardo Robaina <[email protected]>

---
 arch/xtensa/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/xtensa/kernel/ptrace.c +2 -1

index b80d54b2ea34..122a6ffc0757 100644
@@ -564,7 +564,8 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 
 	audit_syscall_entry(regs->syscall, regs->areg[6],
 			    regs->areg[3], regs->areg[4],
-			    regs->areg[5]);
+			    regs->areg[5], regs->areg[8],
+			    regs->areg[9]);
 	return 1;
 }

Signature · 1 line

2.55.0

[email protected]

AI review

2026-08-13 17:23 UTC #26 lore raw

Re: [PATCH 13/13] xtensa: pass all six syscall args to audit_syscall_entry()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] The core API patch in this series ('audit: log all six syscall arguments in the SYSCALL record')…

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The core API patch in this series ('audit: log all six syscall arguments in the SYSCALL record') changed the signature of audit_syscall_entry() from 5 to 7 arguments, but the PowerPC architecture was missed. This leaves PowerPC passing 5 arguments, resulting in a build failure. --

--- Patch [13]: [PATCH 13/13] xtensa: pass all six syscall args to audit_syscall_entry() --- commit 7f8e4937464dcba7a1012a4d48470ce510d233d3
Author: Ricardo Robaina <[email protected]>

xtensa: pass all six syscall args to audit_syscall_entry()

Update the audit_syscall_entry() call to forward the 5th and 6th syscall arguments (areg[8], areg[9]) now that the audit core logs all six.

arch/xtensa/kernel/ptrace.c int do_syscall_trace_enter(struct pt_regs *regs) · line 568

Quoted 11 lines

arch/xtensa/kernel/ptrace.c +2 -1

index b80d54b2ea34e..122a6ffc0757e 100644
@@ -564,7 +564,8 @@ int do_syscall_trace_enter(struct pt_regs *regs)
 
 	audit_syscall_entry(regs->syscall, regs->areg[6],
 			    regs->areg[3], regs->areg[4],
-			    regs->areg[5]);
+			    regs->areg[5], regs->areg[8],
+			    regs->areg[9]);

[Severity: Low]
Is it possible that the powerpc architecture was missed in this series?

While xtensa is correctly updated here, it looks like do_syscall_trace_enter() in arch/powerpc/kernel/ptrace/ptrace.c still passes 5 arguments:

arch/powerpc/kernel/ptrace/ptrace.c:do_syscall_trace_enter() {
    ...
		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
				    regs->gpr[5], regs->gpr[6]);
    ...
}

Will this cause a build regression on powerpc since the new signature requires 7 arguments?

Quoted 2 lines

arch/xtensa/kernel/ptrace.c +0 -0
 	return 1;
 }

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=13

Will Deacon

maintainer

2026-08-14 08:40 UTC #27 lore raw

In reply to Ricardo Robaina

Quoted 48 lines · Ricardo Robaina

The SYSCALL record currently logs only four of the six syscall arguments (a0-a3), silently discarding the remaining two. This leads to the need for auxiliary records when audit-relevant data lands in the 5th or 6th argument of a syscall.
This series extends the SYSCALL record to log all six arguments, by adding arguments a4 and a5 inline within the existing record.
The audit testsuite runs successfully:
 # make test
 make -C tests test
 chmod +x */test
 Running as   user    root
        with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        on   system  Fedora
amcast_joinpart/test ................. ok
backlog_wait_time_actual_reset/test .. ok
bpf/test ............................. ok
coredump/test ........................ ok
exec_execve/test ..................... ok
exec_name/test ....................... ok
fanotify/test ........................ ok
field_compare/test ................... ok
file_create/test ..................... ok
file_delete/test ..................... ok
file_permission/test ................. ok
file_rename/test ..................... ok
filter_device/test ................... ok
filter_exclude/test .................. ok
filter_exit/test ..................... ok
filter_inode/test .................... ok
filter_saddr_fam/test ................ ok
filter_sessionid/test ................ ok
io_uring/test ........................ ok
login_tty/test ....................... ok
lost_reset/test ...................... ok
netfilter_pkt/test ................... ok
signal/test .......................... ok
syscalls_file/test ................... ok
syscall_module/test .................. ok
syscall_socketcall/test .............. ok
time_change/test ..................... ok
user_msg/test ........................ ok
All tests successful.
Result: PASS

Quoted 14 lines

Ricardo Robaina (13):
audit: log all six syscall arguments in the SYSCALL record
alpha: pass all six syscall args to audit_syscall_entry()
arm: pass all six syscall args to audit_syscall_entry()
arm64: pass all six syscall args to audit_syscall_entry()
csky: pass all six syscall args to audit_syscall_entry()
microblaze: pass all six syscall args to audit_syscall_entry()
mips: pass all six syscall args to audit_syscall_entry()
openrisc: pass all six syscall args to audit_syscall_entry()
parisc: pass all six syscall args to audit_syscall_entry()
sh: pass all six syscall args to audit_syscall_entry()
sparc64: pass all six syscall args to audit_syscall_entry()
um: pass all six syscall args to audit_syscall_entry()
xtensa: pass all six syscall args to audit_syscall_entry()

Could audit make use of syscall_get_arguments() instead?

Will

Ricardo Robaina

author

2026-08-14 18:37 UTC #28 lore raw

Quoted 65 lines · Will Deacon

Quoted 48 lines · Ricardo Robaina
The SYSCALL record currently logs only four of the six syscall arguments (a0-a3), silently discarding the remaining two. This leads to the need for auxiliary records when audit-relevant data lands in the 5th or 6th argument of a syscall.
This series extends the SYSCALL record to log all six arguments, by adding arguments a4 and a5 inline within the existing record.
The audit testsuite runs successfully:
 # make test
 make -C tests test
 chmod +x */test
 Running as   user    root
        with context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
        on   system  Fedora
amcast_joinpart/test ................. ok
backlog_wait_time_actual_reset/test .. ok
bpf/test ............................. ok
coredump/test ........................ ok
exec_execve/test ..................... ok
exec_name/test ....................... ok
fanotify/test ........................ ok
field_compare/test ................... ok
file_create/test ..................... ok
file_delete/test ..................... ok
file_permission/test ................. ok
file_rename/test ..................... ok
filter_device/test ................... ok
filter_exclude/test .................. ok
filter_exit/test ..................... ok
filter_inode/test .................... ok
filter_saddr_fam/test ................ ok
filter_sessionid/test ................ ok
io_uring/test ........................ ok
login_tty/test ....................... ok
lost_reset/test ...................... ok
netfilter_pkt/test ................... ok
signal/test .......................... ok
syscalls_file/test ................... ok
syscall_module/test .................. ok
syscall_socketcall/test .............. ok
time_change/test ..................... ok
user_msg/test ........................ ok
All tests successful.
Result: PASS
Quoted 14 lines
Ricardo Robaina (13):
audit: log all six syscall arguments in the SYSCALL record
alpha: pass all six syscall args to audit_syscall_entry()
arm: pass all six syscall args to audit_syscall_entry()
arm64: pass all six syscall args to audit_syscall_entry()
csky: pass all six syscall args to audit_syscall_entry()
microblaze: pass all six syscall args to audit_syscall_entry()
mips: pass all six syscall args to audit_syscall_entry()
openrisc: pass all six syscall args to audit_syscall_entry()
parisc: pass all six syscall args to audit_syscall_entry()
sh: pass all six syscall args to audit_syscall_entry()
sparc64: pass all six syscall args to audit_syscall_entry()
um: pass all six syscall args to audit_syscall_entry()
xtensa: pass all six syscall args to audit_syscall_entry()

Quoted 4 lines

Could audit make use of syscall_get_arguments() instead?
Will

Hi Will,

Thanks for reviewing this patch. Yes, I think so. I'll fix that in the v2.

Thanks,
-Ricardo