On Wed, Jul 01 2026 at 19:42, Michal Suchánek wrote:
>
> if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT))
> - syscall = trace_syscall_enter(regs, syscall);
> + *syscall = trace_syscall_enter(regs, *syscall);
>
> - syscall_enter_audit(regs, syscall);
> + syscall_enter_audit(regs, *syscall);
>
> - return ret ? : syscall;
> + return 0;
That breaks trace_syscall_enter() because the probes/BPF muck attached
ot that can:
1) set the return code
2) set syscall to -1L
That works correctly today, but with your sloppy hackery the low level
x86 code falls into sys_ni_syscall() which sets the return code to
-ENOSYS.
