seccomp: Make syscall skipping and nr changes more consistent

This fixes two issues that could cause incompatibility between
kernel versions:

 - If a tracer uses SECCOMP_RET_TRACE to select a syscall number
   higher than the largest known syscall, emulate the unknown
   vsyscall by returning -ENOSYS.  (This is unlikely to make a
   noticeable difference on x86-64 due to the way the system call
   entry works.)

 - On x86-64 with vsyscall=emulate, skipped vsyscalls were buggy.

This updates the documentation accordingly.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Will Drewry <wad@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>

1 files changed, 10 insertions, 3 deletions

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index ee376beedaf9..5af44b593770 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -396,25 +396,29 @@ int __secure_computing(int this_syscall)
 #ifdef CONFIG_SECCOMP_FILTER
         case SECCOMP_MODE_FILTER: {
                 int data;
+                struct pt_regs *regs = task_pt_regs(current);
                 ret = seccomp_run_filters(this_syscall);
                 data = ret & SECCOMP_RET_DATA;
                 ret &= SECCOMP_RET_ACTION;
                 switch (ret) {
                 case SECCOMP_RET_ERRNO:
                         /* Set the low-order 16-bits as a errno. */
-                        syscall_set_return_value(current, task_pt_regs(current),
+                        syscall_set_return_value(current, regs,
                                                  -data, 0);
                         goto skip;
                 case SECCOMP_RET_TRAP:
                         /* Show the handler the original registers. */
-                        syscall_rollback(current, task_pt_regs(current));
+                        syscall_rollback(current, regs);
                         /* Let the filter pass back 16 bits of data. */
                         seccomp_send_sigsys(this_syscall, data);
                         goto skip;
                 case SECCOMP_RET_TRACE:
                         /* Skip these calls if there is no tracer. */
-                        if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP))
+                        if (!ptrace_event_enabled(current, PTRACE_EVENT_SECCOMP)) {
+                                syscall_set_return_value(current, regs,
+                                                         -ENOSYS, 0);
                                 goto skip;
+                        }
                         /* Allow the BPF to provide the event message */
                         ptrace_event(PTRACE_EVENT_SECCOMP, data);
                         /*
@@ -425,6 +429,9 @@ int __secure_computing(int this_syscall)
                          */
                         if (fatal_signal_pending(current))
                                 break;
+                        if (syscall_get_nr(current, regs) < 0)
+                                goto skip;  /* Explicit request to skip. */
+
                         return 0;
                 case SECCOMP_RET_ALLOW:
                         return 0;