[PATCH v2 0/2] syscall_user_dispatch: add build/runtime configs

[PATCH v2 0/2] syscall_user_dispatch: add build/runtime configs

[Gregory Price]

Syscall User Dispatch is presently compiled in by default for all
architectures enabling CONFIG_GENERIC_SYSCALL, and some users may
not wish to have the feature functional at runtime.

Add CONFIG_SYSCALL_USER_DISPATCH and kernel.syscall_user_dispatch
to make it a configurable feature at both build and runtime.

CONFIG_SYSCALL_USER_DISPATCH depends on CONFIG_GENERIC_SYSCALL
but is separately configurable.

The sysctl is enabled by default, and disabling the feature while a
task has already enabled it does not cause it to become inactive in
that task's conetxt. Instead it remains active until the user attempts
to disable/re-enable via prctl or ptrace.  On the next attempt to
re-enable, the prctl/ptrace call fails gracefully.

Gregory Price (2):
  syscall_user_dispatch: Make it configurable in Kconfig
  syscall_user_dispatch: add kernel.syscall_user_dispatch sysctl

 Documentation/admin-guide/sysctl/kernel.rst | 16 ++++++++++++
 arch/Kconfig                                | 11 ++++++++
 include/linux/entry-common.h                |  6 ++---
 include/linux/syscall_user_dispatch.h       | 28 +++++++++++++++++++--
 include/linux/syscall_user_dispatch_types.h |  2 +-
 kernel/entry/Makefile                       |  3 ++-
 kernel/entry/syscall_user_dispatch.c        | 28 +++++++++++++++++++++
 7 files changed, 86 insertions(+), 8 deletions(-)

-- 
2.54.0

[PATCH v2 1/2] syscall_user_dispatch: Make it configurable in Kconfig

[Gregory Price]

Syscall User Dispatch is presently built under CONFIG_GENERIC_SYSCALL
and cannot be disabled independently.

Add CONFIG_SYSCALL_USER_DISPATCH to make it an optional feature.

Signed-off-by: Gregory Price <gourry@gourry.net>
---
 arch/Kconfig                                | 11 ++++++++
 include/linux/entry-common.h                |  6 ++---
 include/linux/syscall_user_dispatch.h       | 28 +++++++++++++++++++--
 include/linux/syscall_user_dispatch_types.h |  2 +-
 kernel/entry/Makefile                       |  3 ++-
 5 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/arch/Kconfig b/arch/Kconfig
index fa7507ac8e13..192b9d8abb5f 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -114,6 +114,17 @@ config GENERIC_ENTRY
 	select GENERIC_IRQ_ENTRY
 	select GENERIC_SYSCALL
 
+config SYSCALL_USER_DISPATCH
+	bool "Syscall User Dispatch"
+	depends on GENERIC_ENTRY
+	default y
+	help
+	  Syscall User Dispatch lets a thread have its own system calls outside
+          an allowed IP address range to be intercepted and redirected to a
+          userspace signal handler.
+
+	  If unsure, say Y.
+
 config KPROBES
 	bool "Kprobes"
 	depends on HAVE_KPROBES
diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h
index 416a3352261f..9336516430a1 100644
--- a/include/linux/entry-common.h
+++ b/include/linux/entry-common.h
@@ -9,6 +9,7 @@
 #include <linux/resume_user_mode.h>
 #include <linux/seccomp.h>
 #include <linux/sched.h>
+#include <linux/syscall_user_dispatch.h>
 
 #include <asm/entry-common.h>
 #include <asm/syscall.h>
@@ -55,7 +56,6 @@ static __always_inline int arch_ptrace_report_syscall_entry(struct pt_regs *regs
 }
 #endif
 
-bool syscall_user_dispatch(struct pt_regs *regs);
 long trace_syscall_enter(struct pt_regs *regs, long syscall);
 void trace_syscall_exit(struct pt_regs *regs, long ret);
 
@@ -232,10 +232,8 @@ static __always_inline void syscall_exit_work(struct pt_regs *regs, unsigned lon
 	 * of these syscalls is unknown.
 	 */
 	if (work & SYSCALL_WORK_SYSCALL_USER_DISPATCH) {
-		if (unlikely(current->syscall_dispatch.on_dispatch)) {
-			current->syscall_dispatch.on_dispatch = false;
+		if (syscall_user_dispatch_clear_on_dispatch())
 			return;
-		}
 	}
 
 	audit_syscall_exit(regs);
diff --git a/include/linux/syscall_user_dispatch.h b/include/linux/syscall_user_dispatch.h
index 3858a6ffdd5c..c466af02da36 100644
--- a/include/linux/syscall_user_dispatch.h
+++ b/include/linux/syscall_user_dispatch.h
@@ -7,8 +7,22 @@
 
 #include <linux/thread_info.h>
 #include <linux/syscall_user_dispatch_types.h>
+#include <linux/sched.h>
 
-#ifdef CONFIG_GENERIC_ENTRY
+struct pt_regs;
+
+#ifdef CONFIG_SYSCALL_USER_DISPATCH
+
+bool syscall_user_dispatch(struct pt_regs *regs);
+
+static __always_inline bool syscall_user_dispatch_clear_on_dispatch(void)
+{
+	if (likely(!current->syscall_dispatch.on_dispatch))
+		return false;
+
+	current->syscall_dispatch.on_dispatch = false;
+	return true;
+}
 
 int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,
 			      unsigned long len, char __user *selector);
@@ -24,6 +38,16 @@ int syscall_user_dispatch_set_config(struct task_struct *task, unsigned long siz
 
 #else
 
+static inline bool syscall_user_dispatch(struct pt_regs *regs)
+{
+	return false;
+}
+
+static inline bool syscall_user_dispatch_clear_on_dispatch(void)
+{
+	return false;
+}
+
 static inline int set_syscall_user_dispatch(unsigned long mode, unsigned long offset,
 					    unsigned long len, char __user *selector)
 {
@@ -46,6 +70,6 @@ static inline int syscall_user_dispatch_set_config(struct task_struct *task,
 	return -EINVAL;
 }
 
-#endif /* CONFIG_GENERIC_ENTRY */
+#endif /* CONFIG_SYSCALL_USER_DISPATCH */
 
 #endif /* _SYSCALL_USER_DISPATCH_H */
diff --git a/include/linux/syscall_user_dispatch_types.h b/include/linux/syscall_user_dispatch_types.h
index 3be36b06c7d7..c0bdd4f760d3 100644
--- a/include/linux/syscall_user_dispatch_types.h
+++ b/include/linux/syscall_user_dispatch_types.h
@@ -4,7 +4,7 @@
 
 #include <linux/types.h>
 
-#ifdef CONFIG_GENERIC_ENTRY
+#ifdef CONFIG_SYSCALL_USER_DISPATCH
 
 struct syscall_user_dispatch {
 	char __user	*selector;
diff --git a/kernel/entry/Makefile b/kernel/entry/Makefile
index 2333d70802e4..f220bae86b12 100644
--- a/kernel/entry/Makefile
+++ b/kernel/entry/Makefile
@@ -13,5 +13,6 @@ CFLAGS_REMOVE_common.o	 = -fstack-protector -fstack-protector-strong
 CFLAGS_common.o		+= -fno-stack-protector
 
 obj-$(CONFIG_GENERIC_IRQ_ENTRY) 	+= common.o
-obj-$(CONFIG_GENERIC_SYSCALL) 		+= syscall-common.o syscall_user_dispatch.o
+obj-$(CONFIG_GENERIC_SYSCALL) 		+= syscall-common.o
+obj-$(CONFIG_SYSCALL_USER_DISPATCH)	+= syscall_user_dispatch.o
 obj-$(CONFIG_VIRT_XFER_TO_GUEST_WORK)	+= virt.o
-- 
2.54.0

[PATCH v2 2/2] syscall_user_dispatch: add kernel.syscall_user_dispatch sysctl

[Gregory Price]

Add a matching sysctl to go with CONFIG_SYSCALL_USER_DISPATCH.

kernel.syscall_user_dispatch (default 1 - allow) controls whether
userspace may arm syscall user dispatch (both via prctl and ptrace).

Disarming is always permitted - same semantics as comparable knobs.

Disabling while a task has armed syscall user dispatch does not
cause it to become inactive - instead it remains active until the
user attempts to disable/re-enable via prctl or ptrace.  On the
next attempt to re-enable, the prctl/ptrace call fails gracefully.

The alternative would cause programs translating non-linux syscalls
to interpret those syscalls as linux syscalls, resulting in undefined
userland behavior.

Signed-off-by: Gregory Price <gourry@gourry.net>
---
 Documentation/admin-guide/sysctl/kernel.rst | 16 ++++++++++++
 kernel/entry/syscall_user_dispatch.c        | 28 +++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
index c6994e55d141..46e418e686c2 100644
--- a/Documentation/admin-guide/sysctl/kernel.rst
+++ b/Documentation/admin-guide/sysctl/kernel.rst
@@ -1402,6 +1402,22 @@ Note that if you change this from 0 to 1, already created segments
 without users and with a dead originative process will be destroyed.
 
 
+syscall_user_dispatch
+=====================
+
+Controls whether userspace may arm Syscall User Dispatch via
+``prctl(PR_SET_SYSCALL_USER_DISPATCH, ...)`` or the
+``PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG`` ptrace request:
+
+  ==  ===================================================================
+  0   Arming syscall user dispatch is denied with ``-EPERM``.  Tasks that
+      already armed it keep it, and disabling it is always permitted.
+  1   (default) Arming syscall user dispatch is permitted.
+  ==  ===================================================================
+
+Only present when the kernel is built with ``CONFIG_SYSCALL_USER_DISPATCH``.
+
+
 sysctl_writes_strict
 ====================
 
diff --git a/kernel/entry/syscall_user_dispatch.c b/kernel/entry/syscall_user_dispatch.c
index d89dffcc2d64..1c39ccd733f5 100644
--- a/kernel/entry/syscall_user_dispatch.c
+++ b/kernel/entry/syscall_user_dispatch.c
@@ -11,12 +11,15 @@
 #include <linux/uaccess.h>
 #include <linux/signal.h>
 #include <linux/elf.h>
+#include <linux/sysctl.h>
 
 #include <linux/sched/signal.h>
 #include <linux/sched/task_stack.h>
 
 #include <asm/syscall.h>
 
+static int syscall_user_dispatch_allowed __read_mostly = 1;
+
 static void trigger_sigsys(struct pt_regs *regs)
 {
 	struct kernel_siginfo info;
@@ -102,6 +105,10 @@ static int task_set_syscall_user_dispatch(struct task_struct *task, unsigned lon
 		return -EINVAL;
 	}
 
+	/* Arming can be denied at runtime via sysctl, disarming is allowed */
+	if (mode != PR_SYS_DISPATCH_OFF && !syscall_user_dispatch_allowed)
+		return -EPERM;
+
 	/*
 	 * access_ok() will clear memory tags for tagged addresses
 	 * if current has memory tagging enabled.
@@ -172,3 +179,24 @@ int syscall_user_dispatch_set_config(struct task_struct *task, unsigned long siz
 	return task_set_syscall_user_dispatch(task, cfg.mode, cfg.offset, cfg.len,
 					      (char __user *)(uintptr_t)cfg.selector);
 }
+
+#ifdef CONFIG_SYSCTL
+static const struct ctl_table syscall_user_dispatch_sysctls[] = {
+	{
+		.procname	= "syscall_user_dispatch",
+		.data		= &syscall_user_dispatch_allowed,
+		.maxlen		= sizeof(syscall_user_dispatch_allowed),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= SYSCTL_ZERO,
+		.extra2		= SYSCTL_ONE,
+	},
+};
+
+static int __init syscall_user_dispatch_sysctl_init(void)
+{
+	register_sysctl_init("kernel", syscall_user_dispatch_sysctls);
+	return 0;
+}
+late_initcall(syscall_user_dispatch_sysctl_init);
+#endif /* CONFIG_SYSCTL */
-- 
2.54.0

Re: [PATCH v2 1/2] syscall_user_dispatch: Make it configurable in Kconfig

[Matthew Wilcox]

On Fri, Jul 03, 2026 at 09:58:58PM -0400, Gregory Price wrote:
> +config SYSCALL_USER_DISPATCH
> +	bool "Syscall User Dispatch"
> +	depends on GENERIC_ENTRY
> +	default y
> +	help
> +	  Syscall User Dispatch lets a thread have its own system calls outside
> +          an allowed IP address range to be intercepted and redirected to a
> +          userspace signal handler.

I was very confused when I read this.  IP expands to Internet Protocol
long before it gets to Instruction Pointer in my brain.

Re: [PATCH v2 1/2] syscall_user_dispatch: Make it configurable in Kconfig

[Gregory Price]

On Sat, Jul 04, 2026 at 04:22:20PM +0100, Matthew Wilcox wrote:
> On Fri, Jul 03, 2026 at 09:58:58PM -0400, Gregory Price wrote:
> > +config SYSCALL_USER_DISPATCH
> > +	bool "Syscall User Dispatch"
> > +	depends on GENERIC_ENTRY
> > +	default y
> > +	help
> > +	  Syscall User Dispatch lets a thread have its own system calls outside
> > +          an allowed IP address range to be intercepted and redirected to a
> > +          userspace signal handler.
> 
> I was very confused when I read this.  IP expands to Internet Protocol
> long before it gets to Instruction Pointer in my brain.

Hah, fair, i was just going with tglx's [1] explanation.

https://lore.kernel.org/all/87a4s8m69c.ffs@fw13/

Re: [PATCH v2 1/2] syscall_user_dispatch: Make it configurable in Kconfig

[Thomas Gleixner]

On Fri, Jul 03 2026 at 21:58, Gregory Price wrote:

> Syscall User Dispatch is presently built under CONFIG_GENERIC_SYSCALL
> and cannot be disabled independently.
>
> Add CONFIG_SYSCALL_USER_DISPATCH to make it an optional feature.
>
> Signed-off-by: Gregory Price <gourry@gourry.net>
> ---
>  arch/Kconfig                                | 11 ++++++++
>  include/linux/entry-common.h                |  6 ++---
>  include/linux/syscall_user_dispatch.h       | 28 +++++++++++++++++++--
>  include/linux/syscall_user_dispatch_types.h |  2 +-
>  kernel/entry/Makefile                       |  3 ++-
>  5 files changed, 42 insertions(+), 8 deletions(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index fa7507ac8e13..192b9d8abb5f 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -114,6 +114,17 @@ config GENERIC_ENTRY
>  	select GENERIC_IRQ_ENTRY
>  	select GENERIC_SYSCALL
>  
> +config SYSCALL_USER_DISPATCH
> +	bool "Syscall User Dispatch"
> +	depends on GENERIC_ENTRY
> +	default y
> +	help
> +	  Syscall User Dispatch lets a thread have its own system calls outside
> +          an allowed IP address range to be intercepted and redirected to a
> +          userspace signal handler.

Space/TAB mismatch.

Also the mechanism allows to filter either outside an allowed range or
inside an allowed range depending on the mode which is handed to the PRCTL.

> +static inline bool syscall_user_dispatch(struct pt_regs *regs)

__always_inline for the very same reason. Sorry compilers _are_ silly.

Re: [PATCH v2 2/2] syscall_user_dispatch: add kernel.syscall_user_dispatch sysctl

[Thomas Gleixner]

On Fri, Jul 03 2026 at 21:58, Gregory Price wrote:
> --- a/kernel/entry/syscall_user_dispatch.c
> +++ b/kernel/entry/syscall_user_dispatch.c
> @@ -11,12 +11,15 @@
>  #include <linux/uaccess.h>
>  #include <linux/signal.h>
>  #include <linux/elf.h>
> +#include <linux/sysctl.h>

It's already not ordered correctly, but the rule is that we fix up the
include order to alphabetic ordering when we touch it.

>  #include <linux/sched/signal.h>
>  #include <linux/sched/task_stack.h>
>  
>  #include <asm/syscall.h>
>  
> +static int syscall_user_dispatch_allowed __read_mostly = 1;
> +
>  static void trigger_sigsys(struct pt_regs *regs)
>  {
>  	struct kernel_siginfo info;
> @@ -102,6 +105,10 @@ static int task_set_syscall_user_dispatch(struct task_struct *task, unsigned lon
>  		return -EINVAL;
>  	}
>  
> +	/* Arming can be denied at runtime via sysctl, disarming is allowed */
> +	if (mode != PR_SYS_DISPATCH_OFF && !syscall_user_dispatch_allowed)
> +		return -EPERM;
> +
>  	/*
>  	 * access_ok() will clear memory tags for tagged addresses
>  	 * if current has memory tagging enabled.
> @@ -172,3 +179,24 @@ int syscall_user_dispatch_set_config(struct task_struct *task, unsigned long siz
>  	return task_set_syscall_user_dispatch(task, cfg.mode, cfg.offset, cfg.len,
>  					      (char __user *)(uintptr_t)cfg.selector);
>  }
> +
> +#ifdef CONFIG_SYSCTL
> +static const struct ctl_table syscall_user_dispatch_sysctls[] = {
> +	{
> +		.procname	= "syscall_user_dispatch",
> +		.data		= &syscall_user_dispatch_allowed,
> +		.maxlen		= sizeof(syscall_user_dispatch_allowed),
> +		.mode		= 0644,
> +		.proc_handler	= proc_dointvec_minmax,

proc_dobool() exists for a reason.

Re: [PATCH v2 1/2] syscall_user_dispatch: Make it configurable in Kconfig

[Randy Dunlap]

On July 4, 2026 8:22:20 AM PDT, Matthew Wilcox <willy@infradead.org> wrote:
>On Fri, Jul 03, 2026 at 09:58:58PM -0400, Gregory Price wrote:
>> +config SYSCALL_USER_DISPATCH
>> +	bool "Syscall User Dispatch"
>> +	depends on GENERIC_ENTRY
>> +	default y
>> +	help
>> +	  Syscall User Dispatch lets a thread have its own system calls outside
>> +          an allowed IP address range to be intercepted and redirected to a
>> +          userspace signal handler.
>
>I was very confused when I read this.  IP expands to Internet Protocol
>long before it gets to Instruction Pointer in my brain.
>

Ditto



~Randy

Re: [PATCH v2 2/2] syscall_user_dispatch: add kernel.syscall_user_dispatch sysctl

[Gregory Price]

On Sun, Jul 05, 2026 at 10:35:08PM +0200, Thomas Gleixner wrote:
> >  #include <linux/signal.h>
> >  #include <linux/elf.h>
> > +#include <linux/sysctl.h>
> 
> It's already not ordered correctly, but the rule is that we fix up the
> include order to alphabetic ordering when we touch it.
>

ack.

> > +#ifdef CONFIG_SYSCTL
> > +static const struct ctl_table syscall_user_dispatch_sysctls[] = {
> > +	{
> > +		.procname	= "syscall_user_dispatch",
> > +		.data		= &syscall_user_dispatch_allowed,
> > +		.maxlen		= sizeof(syscall_user_dispatch_allowed),
> > +		.mode		= 0644,
> > +		.proc_handler	= proc_dointvec_minmax,
> 
> proc_dobool() exists for a reason.

ack.

Re: [PATCH v2 1/2] syscall_user_dispatch: Make it configurable in Kconfig

[Gregory Price]

On Sun, Jul 05, 2026 at 10:31:51PM +0200, Thomas Gleixner wrote:
> On Fri, Jul 03 2026 at 21:58, Gregory Price wrote:
> > +	default y
> > +	help
> > +	  Syscall User Dispatch lets a thread have its own system calls outside
> > +          an allowed IP address range to be intercepted and redirected to a
> > +          userspace signal handler.
> 
> Space/TAB mismatch.
>

bleh switched dev environments and forgot checkpatch doesn't catch this

> Also the mechanism allows to filter either outside an allowed range or
> inside an allowed range depending on the mode which is handed to the PRCTL.
> 

hadn't noticed that feature actually got merged.

ack, will just go with the general language

> > +static inline bool syscall_user_dispatch(struct pt_regs *regs)
> 
> __always_inline for the very same reason. Sorry compilers _are_ silly.
> 

ack.

Re: [PATCH v2 1/2] syscall_user_dispatch: Make it configurable in Kconfig

[Gregory Price]

On Sun, Jul 05, 2026 at 02:49:56PM -0700, Randy Dunlap wrote:
> On July 4, 2026 8:22:20 AM PDT, Matthew Wilcox <willy@infradead.org> wrote:
> >On Fri, Jul 03, 2026 at 09:58:58PM -0400, Gregory Price wrote:
> >> +config SYSCALL_USER_DISPATCH
> >> +	bool "Syscall User Dispatch"
> >> +	depends on GENERIC_ENTRY
> >> +	default y
> >> +	help
> >> +	  Syscall User Dispatch lets a thread have its own system calls outside
> >> +          an allowed IP address range to be intercepted and redirected to a
> >> +          userspace signal handler.
> >
> >I was very confused when I read this.  IP expands to Internet Protocol
> >long before it gets to Instruction Pointer in my brain.
> >
> 
> Ditto
>

ack.