PR20333/compat_execve

diff --git a/tapset/linux/s390/nd_syscalls.stp b/tapset/linux/s390/nd_syscalls.stp
index c53f1869b1df496eeba34aabaf5cc7ede96ca619..f8efa6596e389585f6bfaa42012b2a4d4cf3b77f 100644 (file)
--- a/tapset/linux/s390/nd_syscalls.stp
+++ b/tapset/linux/s390/nd_syscalls.stp
@@ -1,34 +1,3 @@
-%)
-
-%( kernel_v < "3.7" %?
-# execve _____________________________________________________
-#
-#   asmlinkage long sys32_execve(struct pt_regs regs)
-#   asmlinkage long sys32_execve(char __user *name, compat_uptr_t __user *argv,
-#                           compat_uptr_t __user *envp)
-probe nd_syscall.compat_execve = kprobe.function("sys32_execve") ?
-{
-       asmlinkage()
-       name = "execve"
-%( kernel_v < "2.6.32" %?
-       __regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
-       filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
-       args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
-       env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
-%:
-       filename = user_string_quoted(pointer_arg(1))
-       args = __get_compat_argv(pointer_arg(2), 0)
-       env_str = __count_compat_envp(pointer_arg(3))
-%)
-       argstr = sprintf("%s, %s, %s", filename, args, env_str)
-}
-probe nd_syscall.compat_execve.return =
-       kprobe.function("sys32_execve").return ?
-{
-       name = "execve"
-       retstr = returnstr(1)
-}
-%)
 
 # lookup_dcookie _____________________________________________
 # rhel7: COMPAT_SYSCALL_DEFINE4(lookup_dcookie, u32, w0, u32, w1, char __user *,

diff --git a/tapset/linux/s390/sysc_compat_execve.stp b/tapset/linux/s390/sysc_compat_execve.stp
new file mode 100644 (file)
index 0000000..645ad14
--- /dev/null
+++ b/tapset/linux/s390/sysc_compat_execve.stp
@@ -0,0 +1,71 @@
+%( kernel_v < "3.7" %?
+# execve _____________________________________________________
+#
+#   asmlinkage long sys32_execve(struct pt_regs regs)
+#   asmlinkage long sys32_execve(char __user *name, compat_uptr_t __user *argv,
+#                           compat_uptr_t __user *envp)
+
+@define _SYSCALL_COMPAT_EXECVE_NAME
+%(
+       name = "execve"
+%)
+
+@define _SYSCALL_COMPAT_EXECVE_ARGSTR
+%(
+       argstr = sprintf("%s, %s, %s", filename, args, env_str)
+%)
+
+probe syscall.compat_execve = dw_syscall.compat_execve !, nd_syscall.compat_execve {}
+probe syscall.compat_execve.return = dw_syscall.compat_execve.return !,
+                                     nd_syscall.compat_execve.return {}
+
+# dw_compat_execve _____________________________________________________
+
+probe dw_syscall.compat_execve = kernel.function("sys32_execve").call ?
+{
+       @_SYSCALL_COMPAT_EXECVE_NAME
+%( kernel_v < "2.6.32" %?
+       # The fact that the struct is passed in instead of a pointer
+       # confuses things.
+       __regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
+       filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
+       args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
+       env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
+%:
+       filename = user_string_quoted(@choose_defined($name, $filename))
+       args = __get_compat_argv($argv, 0)
+       env_str = __count_compat_envp($envp)
+%)
+       @_SYSCALL_COMPAT_EXECVE_ARGSTR
+}
+probe dw_syscall.compat_execve.return = kernel.function("sys32_execve").return ?
+{
+       @_SYSCALL_COMPAT_EXECVE_NAME
+       retstr = return_str(1, $return)
+}
+
+# nd_compat_execve _____________________________________________________
+
+probe nd_syscall.compat_execve = kprobe.function("sys32_execve") ?
+{
+       asmlinkage()
+       @_SYSCALL_COMPAT_EXECVE_NAME
+%( kernel_v < "2.6.32" %?
+       __regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
+       filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
+       args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
+       env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
+%:
+       filename = user_string_quoted(pointer_arg(1))
+       args = __get_compat_argv(pointer_arg(2), 0)
+       env_str = __count_compat_envp(pointer_arg(3))
+%)
+       @_SYSCALL_COMPAT_EXECVE_ARGSTR
+}
+probe nd_syscall.compat_execve.return =
+       kprobe.function("sys32_execve").return ?
+{
+       @_SYSCALL_COMPAT_EXECVE_NAME
+       retstr = returnstr(1)
+}
+%)

diff --git a/tapset/linux/s390/syscalls.stp b/tapset/linux/s390/syscalls.stp
index 63c3aa5f4c1cc60f6ea0cb2c65b037df95d8380b..ed8c624363478e47b09792773597ab5e65097001 100644 (file)
--- a/tapset/linux/s390/syscalls.stp
+++ b/tapset/linux/s390/syscalls.stp
@@ -1,34 +1,4 @@
 
-%( kernel_v < "3.7" %?
-# execve _____________________________________________________
-#
-#   asmlinkage long sys32_execve(struct pt_regs regs)
-#   asmlinkage long sys32_execve(char __user *name, compat_uptr_t __user *argv,
-#                           compat_uptr_t __user *envp)
-probe syscall.compat_execve = kernel.function("sys32_execve").call ?
-{
-       name = "execve"
-%( kernel_v < "2.6.32" %?
-       # The fact that the struct is passed in instead of a pointer
-       # confuses things.
-       __regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
-       filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
-       args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
-       env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
-%:
-       filename = user_string_quoted(@choose_defined($name, $filename))
-       args = __get_compat_argv($argv, 0)
-       env_str = __count_compat_envp($envp)
-%)
-       argstr = sprintf("%s, %s, %s", filename, args, env_str)
-}
-probe syscall.compat_execve.return = kernel.function("sys32_execve").return ?
-{
-       name = "execve"
-       retstr = return_str(1, $return)
-}
-%)
-
 # lookup_dcookie _____________________________________________
 # long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
 # there is compat_SyS_lookup_dcookie on thel7, but not on older distros,