Do you happen to have the raw, unprocessed audit records available still?  If so, it would be nice to see those instead of the results from ausearch.

Yes, of course. I even have the machine reserved, if you would need to access it.

Here is the rew record from audit.log:

type=SYSCALL msg=audit(1459239702.446:248): arch=16 syscall=102 success=yes exit=21 a0=ffffffff0000000b a1=3ff7f90c3d0 a2=3ff00000000 a3=426028 items=0 ppid=53322 pid=53324 auid=1000 uid=0 gid=0 euid=0 suid=0 fs
0 tty=pts1 ses=2 comm="do_socketcall" exe="/usr/local/eal4_testing/audit-test/utils/bin/do_socketcall" subj=system_u:system_r:unconfined_t:s0 key=(null)
type=SOCKADDR msg=audit(1459239702.446:248): saddr=000ACD6D000000000000000000000000000000000000000100000000

Thanks, it looks like we definitely have a problem sending 64-bit values for a 32/31-bit ABI.

It would appear that the registers passed into audit_syscall_entry() are not masked in the case of s390; compare the code in arch/s390/include/asm/syscall.h:syscall_get_arguments() with arch/390/kernel/ptrace.c:do_syscall_trace_enter().

>>>
static inline void syscall_get_arguments(struct task_struct *task,
                                         struct pt_regs *regs,
                                         unsigned int i, unsigned int n,
                                         unsigned long *args)
{
        unsigned long mask = -1UL;

        BUG_ON(i + n > 6);
#ifdef CONFIG_COMPAT
        if (test_tsk_thread_flag(task, TIF_31BIT))
                mask = 0xffffffff;
#endif
        while (n-- > 0)
                if (i + n > 0)
                        args[n] = regs->gprs[2 + i + n] & mask;
        if (i == 0)
                args[0] = regs->orig_gpr2 & mask;
}
>>>

>>>
asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
{
        long ret = 0;

        /* Do the secure computing check first. */
        if (secure_computing()) {
                /* seccomp failures shouldn't expose any additional code. */
                ret = -1;
                goto out;
        }

        /*
         * The sysc_tracesys code in entry.S stored the system
         * call number to gprs[2].
         */
        if (test_thread_flag(TIF_SYSCALL_TRACE) &&
            (tracehook_report_syscall_entry(regs) ||
             regs->gprs[2] >= NR_syscalls)) {
                /*
                 * Tracing decided this syscall should not happen or the
                 * debugger stored an invalid system call number. Skip
                 * the system call and the system call restart handling.
                 */
                clear_pt_regs_flag(regs, PIF_SYSCALL);
                ret = -1;
        }

        if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                trace_sys_enter(regs, regs->gprs[2]);

        audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
                            regs->gprs[3], regs->gprs[4],
                            regs->gprs[5]);
out:
        return ret ?: regs->gprs[2];
}
>>>

Completely untested and unsubmitted code:

>>>
commit 72715d6884c24ac0d3438ab718e09736a7acadf7
Author: Paul Moore <paul>
Date:   Tue Jun 7 15:41:38 2016 -0400

    s390: ensure that syscall arguments are properly masked on s390
    
    When executing s390 code on s390x the syscall arguments are not
    properly masked, leading to some malformed audit records.
    
    Signed-off-by: Paul Moore <paul>

diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 49b1c13..ac1dc74 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -822,6 +822,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 {
        long ret = 0;
+       unsigned long mask = -1UL;
 
        /* Do the secure computing check first. */
        if (secure_computing()) {
@@ -849,9 +850,13 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
        if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                trace_sys_enter(regs, regs->gprs[2]);
 
-       audit_syscall_entry(regs->gprs[2], regs->orig_gpr2,
-                           regs->gprs[3], regs->gprs[4],
-                           regs->gprs[5]);
+#ifdef CONFIG_COMPAT
+        if (test_thread_flag(TIF_31BIT))
+                mask = 0xffffffff;
+#endif
+       audit_syscall_entry(regs->gprs[2], regs->orig_gpr2 & mask,
+                           regs->gprs[3] & mask, regs->gprs[4] & mask,
+                           regs->gprs[5] & mask);
 out:
        return ret ?: regs->gprs[2];
 }
>>>

Has the patch been merged into upstream yet?

(In reply to xzhou from comment #8)
> Has the patch been merged into upstream yet?

No, the patch in comment #5 is still completely untested.  I'm hoping to be able to test it soon, but if you have access to a s390x system and are able to test it that would be very helpful.

(In reply to Paul Moore from comment #9)
> (In reply to xzhou from comment #8)
> > Has the patch been merged into upstream yet?
> 
> No, the patch in comment #5 is still completely untested.  I'm hoping to be
> able to test it soon, but if you have access to a s390x system and are able
> to test it that would be very helpful.

Sorry i can't reproduce this issue.

Created attachment 1171074 [details]
bz1321096_test.c

Simplified test tool that doesn't require the full audit-test harness to be installed.

Download and compile the test tool source:

  # gcc -o bz1321096_test -g -O0 -m31 bz1321096_test.c

Run the test:

  # auditctl -D
  # auditctl -a exit,always -F arch=b32
  # ./bz1321096_test
  RHBZ #1321096: starting test ...
  RHBZ #1321096: result = -1
  # ausearch -i -ts recent -m SYSCALL | grep syscall=socketcall
  type=SYSCALL msg=audit(06/22/2016 16:14:55.674:242) : arch=s390   
    syscall=socketcall(socket) success=no exit=EFAULT(Bad address) a0=socket 
    a1=0x2 a2=0x3 a3=0x4 items=0 ppid=10272 pid=10498 auid=root uid=root gid=root 
    euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=8 
    comm=bz1321096_test exe=/root/sources/bz1321096/bz1321096_test 
    subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

Using the patch in comment #5 and the test in comment #12, it appears that this problem is fixed.  I'll post the fix upstream today and then we can backport it to RHEL-7.x once we have basic acceptance upstream.

Patch posted upstream:

 * https://www.redhat.com/archives/linux-audit/2016-June/msg00051.html

We can provide automatic test coverage for this issue. Setting myself as QA contact.

(In reply to Miroslav Vadkerti from comment #17)
> We can provide automatic test coverage for this issue. Setting myself as QA
> contact.

Thank you very much!

Created attachment 1172907 [details]
01-bz1321096.patch

Patch(es) committed on kernel repository and an interim kernel build is undergoing testing

Patch(es) available on kernel-3.10.0-457.el7

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2574.html