syscall_rollback(9)

🎀 syscall_rollback 🎀

okay so this is syscall_rollback(9) from the Kernel API Manual — a tiny kernel helper with main-character energy, and she’s here to undo a syscall’s whole situation after it got aborted. bestie, it’s giving “ctrl+z but for registers,” and we’re gonna get into it 💅✨

🌸 NAME 🌸

syscall_rollback — roll back registers after an aborted system call.

🌀 SYNOPSIS 🌀

void syscall_rollback (struct task_struct *task , struct pt_regs *regs
       );

🫶 ARGUMENTS 🫶

• task — task of interest, must be in system call exit tracing. 🫡
• regs — task_pt_regs of task. ✨

💖 DESCRIPTION 💖

⚠️ okay so the only valid moment to call this is when task is stopped for system call exit tracing (due to SYSCALL_WORK_SYSCALL_TRACE or SYSCALL_WORK_SYSCALL_AUDIT), after ptrace_report_syscall_permit_entry returned False to prevent the system call from taking place. no cap, that’s the whole entry ticket.

So what does it actually do? It rolls back the register state in regs so it’s as if the system call instruction was a no-op. The registers containing the system call number and arguments are as they were before the system call instruction. And bestie, this may not be the same as what the register state looked like at system call entry tracing — so don’t assume those two snapshots match. 💀

🌈 SEE ALSO 🌈

Kernel file ./include/asm-generic/syscall.h is the whole friend group — go say hi:

• syscall_get_nr(9)
• syscall_set_nr(9)
• syscall_get_error(9)
• syscall_get_return_value(9)
• syscall_set_return_value(9)
• syscall_get_arguments(9)
• syscall_set_arguments(9)
• syscall_get_arch(9)

mwah 💋 source/version: ./include/asm-generic • date: October 2026 • this page: syscall_rollback(9). stay slay, bestie 🫶🎀