[PATCH v9 2/3] ptrace: add PTRACE_SET_SYSCALL_INFO syscall skipping support
flat view
WARM1d
From: Renzo Davoli <hidden>
Date: 2026-10-20 15:30:00
Also in:
linux-kselftest, linux-s390, lkml
Subsystem:
ptrace support, the rest · Maintainers:
Oleg Nesterov, Linus Torvalds
Revision v9 (9 revisions archived).
Revisions (9)
Extend PTRACE_SET_SYSCALL_INFO to support skipping a system call triggered via seccomp. When a tracer retrieves a ptrace_syscall_info structure with 'op' set to PTRACE_SYSCALL_INFO_SECCOMP, it can now choose to skip the system call. To do this, the tracer changes 'op' to PTRACE_SYSCALL_INFO_EXIT and populates the exit union fields (rval and is_error) to define the return value and error status for the tracee. The skip request is passed to seccomp with seccomp_ptrace_skip_syscall() rather than by setting the system call number to -1, so that it does not depend on how the architecture lays out the syscall number and the return value in the registers. The tracee then skips the system call the same way as for SECCOMP_RET_ERRNO. Once the system call has been skipped, a further PTRACE_SET_SYSCALL_INFO with op == PTRACE_SYSCALL_INFO_SECCOMP during the same stop fails with -EINVAL, as the return value may already have overwritten registers holding the syscall number or arguments; op == PTRACE_SYSCALL_INFO_EXIT can still be used to change the return value. System call suppression via PTRACE_SYSCALL_INFO_ENTRY is currently not implemented. On some architectures (e.g. MIPS), when a system call is skipped by setting the syscall number to -1 at the entry stop, the architecture entry path unconditionally overwrites the return value register with -ENOSYS, clobbering any custom return value set by the tracer at the entry stop. Signed-off-by: Renzo Davoli <redacted> [v8: skip via seccomp_ptrace_skip_syscall() instead of syscall_set_nr(-1), separate ptrace_set_syscall_info_seccomp_skip(), reject later PTRACE_SYSCALL_INFO_SECCOMP updates during the same stop] Assisted-by: claude-opus-5-5 --- kernel/ptrace.c | 45 +++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 43 insertions(+), 2 deletions(-)
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 4e9822a87aab..221e3e91f01d 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c@@ -34,6 +34,7 @@ #include <linux/sched/signal.h> #include <linux/minmax.h> #include <linux/syscall_user_dispatch.h> +#include <linux/seccomp.h> #include <asm/syscall.h> /* for syscall_get_* */
@@ -1119,12 +1120,35 @@ ptrace_set_syscall_info_exit(struct task_struct *child, struct pt_regs *regs, return 0; } +/* + * Skip the system call at a PTRACE_SYSCALL_INFO_SECCOMP stop and set its + * return value as specified by info->exit. + * + * The skip request is passed to seccomp out of band instead of by setting + * the system call number to -1: on some architectures the syscall number, + * or the register seccomp reads it from, shares a register with the return + * value, and on others -1 cannot be represented as a syscall number. + */ +static int +ptrace_set_syscall_info_seccomp_skip(struct task_struct *child, + struct pt_regs *regs, + struct ptrace_syscall_info *info) +{ + int ret = ptrace_set_syscall_info_exit(child, regs, info); + + if (!ret) + seccomp_ptrace_skip_syscall(child); + + return ret; +} + static int ptrace_set_syscall_info(struct task_struct *child, unsigned long user_size, const void __user *datavp) { struct pt_regs *regs = task_pt_regs(child); struct ptrace_syscall_info info; + int op; if (user_size < sizeof(info)) return -EINVAL;
@@ -1141,8 +1165,25 @@ ptrace_set_syscall_info(struct task_struct *child, unsigned long user_size, if (info.flags || info.reserved) return -EINVAL; - /* Changing the type of the system call stop is not supported yet. */ - if (ptrace_get_syscall_info_op(child) != info.op) + op = ptrace_get_syscall_info_op(child); + + /* + * Changing the type of the system call stop is not supported, except + * that a PTRACE_SYSCALL_INFO_SECCOMP stop can be turned into a + * PTRACE_SYSCALL_INFO_EXIT one to skip the system call and set its + * return value. Once that is done, the system call number and + * arguments cannot be changed anymore during the same stop, as the + * return value might share registers with them. + */ + if (op == PTRACE_SYSCALL_INFO_SECCOMP) { + if (info.op == PTRACE_SYSCALL_INFO_EXIT) + return ptrace_set_syscall_info_seccomp_skip(child, regs, + &info); + if (seccomp_ptrace_syscall_skipped(child)) + return -EINVAL; + } + + if (op != info.op) return -EINVAL; switch (info.op) {
--
2.55.0