Recently, a security issue related to orig_x0 was discovered and fixed in arm64, but there are still no test cases covering it. Seccomp, tracepoints, and audit can observe a stale value for x0 after a ptracer or SECCOMP_RET_TRACE modifies x0.
As Kees suggested, this series adds two kselftests for arm64 that validate the orig_x0 re-synchronisation fix in ptrace, the first one is for ptrace update, the second one is for SECCOMP_RET_TRACE update. Link: https://lore.kernel.org/all/[email protected]/ Link: https://lore.kernel.org/all/[email protected]/ Link: https://lore.kernel.org/all/202607152004.DEA95D63@keescook/ Changes in v3: - Fix Big Endian issues. - Add missing fork error check. - Fix error BPF branch offset. - Tighten exit status checks to ensure the child was terminated precisely by the expected SIGSYS signal. Link: https://sashiko.dev/#/patchset/20260720085145.247690-1-ruanjinjie%40huawei.com Changes in v2: - Update the 2st testcase to cover the corner case pointed out by Sashiko[1]. [1]: https://sashiko.dev/#/patchset/[email protected] Jinjie Ruan (2): kselftest/arm64: Add seccomp ptrace x0 bypass test kselftest/arm64: Add testcase for SECCOMP_RET_TRACE orig_x0 bypass tools/testing/selftests/arm64/abi/.gitignore | 2 + tools/testing/selftests/arm64/abi/Makefile | 2 +- .../arm64/abi/seccomp_ptrace_x0_bypass.c | 195 +++++++++++++++++ .../arm64/abi/seccomp_ret_trace_x0_bypass.c | 204 ++++++++++++++++++ 4 files changed, 402 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/arm64/abi/seccomp_ptrace_x0_bypass.c create mode 100644 tools/testing/selftests/arm64/abi/seccomp_ret_trace_x0_bypass.c -- 2.34.1
