On Fri, 08 Nov 2024 12:34:24 +0100, Marco Elver wrote:

prctl() is a complex syscall which multiplexes its functionality based
on a large set of PR_* options. Currently we count 64 such options. The
return value of unknown options is -EINVAL, and doesn't distinguish from
known options that were passed invalid args that also return -EINVAL.

To understand if programs are attempting to use prctl() options not yet
available on the running kernel, provide the task_prctl_unknown
tracepoint.

[...]

Applied to for-next/hardening, thanks!

[1/2] tracing: Add task_prctl_unknown tracepoint
      https://git.kernel.org/kees/c/57a6baf3a3ea
[2/2] tracing: Remove pid in task_rename tracing output
      https://git.kernel.org/kees/c/a6115cceb1dd

Take care,

-- 
Kees Cook