libsandbox: only lookup syscall number on entry

The ptrace API does not guarantee the syscall number lookup will be
valid on syscall exit (since the underlying register might have been
clobbered), so stop trying to look it up then.  We only used it when
decoding entry anyways, so this is more minor housekeeping.

Signed-off-by: Mike Frysinger <vapier@gentoo.org>

1 files changed, 6 insertions, 4 deletions

diff --git a/libsandbox/trace.c b/libsandbox/trace.c
index 77991e1..89bd591 100644
--- a/libsandbox/trace.c
+++ b/libsandbox/trace.c
@@ -390,8 +390,8 @@ static void trace_loop(void)
 	bool before_exec, before_syscall, fake_syscall_ret;
 	unsigned event;
 	long ret;
-	int nr, status, sig;
-	const struct syscall_entry *se, *tbl_after_fork;
+	int status, sig;
+	const struct syscall_entry *tbl_after_fork;
 
 	before_exec = true;
 	before_syscall = false;
@@ -461,10 +461,12 @@ static void trace_loop(void)
 		}
 
 		ret = trace_get_regs(&regs);
-		nr = trace_get_sysnum(&regs);
-		se = lookup_syscall_in_tbl(tbl_after_fork, nr);
 
 		if (before_syscall) {
+			/* NB: The kernel guarantees syscall NR is valid only on entry. */
+			int nr = trace_get_sysnum(&regs);
+			const struct syscall_entry *se = lookup_syscall_in_tbl(tbl_after_fork, nr);
+
 			_sb_debug("%s:%i", se ? se->name : "IDK", nr);
 			if (!trace_check_syscall(se, &regs)) {
 				sb_debug_dyn("trace_loop: forcing EPERM after %s\n", se->name);