[PATCH v3 1/2] ptrace: PTRACE_SET_SYSCALL_INFO syscall skipping support

[Dmitry V. Levin]

On Tue, Jul 07, 2026 at 01:21:06PM +0200, Renzo Davoli wrote:
> This patch extends PTRACE_SET_SYSCALL_INFO with support for skipping a system
> call triggered via seccomp.
> 
> When the tracer retrieves a ptrace_syscall_info structure with op ==
> PTRACE_SYSCALL_INFO_SECCOMP, it may choose to skip the system call by changing
> op to PTRACE_SYSCALL_INFO_EXIT and populating the exit union fields (rval and
> is_error) to define the return value and error status for the tracee.

I suggest changing the wording of the commit message as follows:

ptrace: add PTRACE_SET_SYSCALL_INFO syscall skipping support

Extend PTRACE_SET_SYSCALL_INFO to support skipping a system call triggered
via seccomp.

When a tracer retrieves a ptrace_syscall_info structure with 'op' set to
PTRACE_SYSCALL_INFO_SECCOMP, it can now choose to skip the system call.
To do this, the tracer changes 'op' to PTRACE_SYSCALL_INFO_EXIT and
populates the exit union fields (rval and is_error) to define the return
value and error status for the tracee.

> Signed-off-by: Renzo Davoli <renzo at cs.unibo.it>
> ---
>  kernel/ptrace.c | 27 ++++++++++++++++++++++-----
>  1 file changed, 22 insertions(+), 5 deletions(-)
> 
> diff --git a/kernel/ptrace.c b/kernel/ptrace.c
> index d041645d9d17..8ea807981390 100644
> --- a/kernel/ptrace.c
> +++ b/kernel/ptrace.c
> @@ -1099,7 +1099,7 @@ ptrace_set_syscall_info_seccomp(struct task_struct *child, struct pt_regs *regs,
>  
>  static int
>  ptrace_set_syscall_info_exit(struct task_struct *child, struct pt_regs *regs,
> -			     struct ptrace_syscall_info *info)
> +			     struct ptrace_syscall_info *info, bool skip_syscall)
>  {
>  	long rval = info->exit.rval;
>  
> @@ -1111,6 +1111,9 @@ ptrace_set_syscall_info_exit(struct task_struct *child, struct pt_regs *regs,
>  	if (rval != info->exit.rval)
>  		return -ERANGE;
>  
> +	if (skip_syscall)
> +		syscall_set_nr(child, regs, -1);
> +
>  	if (info->exit.is_error)
>  		syscall_set_return_value(child, regs, rval, 0);
>  	else
> @@ -1125,6 +1128,8 @@ ptrace_set_syscall_info(struct task_struct *child, unsigned long user_size,
>  {
>  	struct pt_regs *regs = task_pt_regs(child);
>  	struct ptrace_syscall_info info;
> +	int child_op;
> +	bool skip_syscall = false;
>  
>  	if (user_size < sizeof(info))
>  		return -EINVAL;
> @@ -1141,15 +1146,27 @@ ptrace_set_syscall_info(struct task_struct *child, unsigned long user_size,
>  	if (info.flags || info.reserved)
>  		return -EINVAL;
>  
> -	/* Changing the type of the system call stop is not supported yet. */
> -	if (ptrace_get_syscall_info_op(child) != info.op)
> -		return -EINVAL;
> +	/*
> +	 * Changing the type of the system call stop is not allowed, with the
> +	 * following exception:
> +	 * PTRACE_SYSCALL_INFO_SECCOMP can be changed to PTRACE_SYSCALL_INFO_EXIT
> +	 * to skip the system call
> +	 */
> +
> +	child_op = ptrace_get_syscall_info_op(child);

Apparently, Oleg is not quite happy with the name child_op,
so let's rename it to reported_op.

> +	if (child_op != info.op) {
> +		if (info.op == PTRACE_SYSCALL_INFO_EXIT &&
> +				 child_op == PTRACE_SYSCALL_INFO_SECCOMP)

Indentation of the last line looks somewhat unusual.

> +			skip_syscall = true;
> +		else
> +			return -EINVAL;
> +	}
>  	switch (info.op) {
>  	case PTRACE_SYSCALL_INFO_ENTRY:
>  		return ptrace_set_syscall_info_entry(child, regs, &info);
>  	case PTRACE_SYSCALL_INFO_EXIT:
> -		return ptrace_set_syscall_info_exit(child, regs, &info);
> +		return ptrace_set_syscall_info_exit(child, regs, &info, skip_syscall);
>  	case PTRACE_SYSCALL_INFO_SECCOMP:
>  		return ptrace_set_syscall_info_seccomp(child, regs, &info);
>  	default:

Feel free to add:
Reviewed-by: Dmitry V. Levin <ldv at strace.io>


-- 
ldv