syscall_set_return_value(9)

✨ syscall_set_return_value(9) ✨ — Kernel API Manual, bestie edition 🎀

okay so picture this: you're deep in the kernel, lowkey living your best ptrace life, and you just need to edit the outcome of a syscall before user mode ever lays eyes on it. that's this function. that's the whole vibe. it's from the Kernel API Manual and honestly it ate. 💅

---

🦋 NAME 🦋

syscall_set_return_value — change the return value of a traced system call. that's it, that's the girl. she rewrites history (the syscall's history, specifically). ✨

---

🌸 SYNOPSIS 🌸

void syscall_set_return_value (struct task_struct *task , struct pt_regs *regs , int error , long val );

like, look at her. four args. no notes. 🫶

---

💖 ARGUMENTS 💖

• task — the task of interest, bestie, and it must be blocked. not "probably blocked," not "blocked-ish." blocked. periodt. 💀
• regs — task_pt_regs of task. the regs, the whole regs, and nothing but the regs. 🫶
• error — a negative error code, or zero to indicate success. zero = slay, negative = it's giving failure. 🌈
• val — the user return value, but only if error is zero. if error isn't zero, girl, this one's just vibing in the void. 🙈

---

🔥 DESCRIPTION 🔥

so here's the tea ☕ — this changes the results of the system call that user mode will see. literally rewriting the ending of the story before anyone reads it. main character energy fr fr.

• if error is zero → user sees a successful system call with a return value of val. 🎀
• if error is nonzero → it's a negated errno code, and user sees a failed system call with this errno code. 😭

⚠️ and now the important bit, don't scroll past: it's only valid to call this when task is stopped for tracing on exit from a system call, due to SYSCALL_WORK_SYSCALL_TRACE or SYSCALL_WORK_SYSCALL_AUDIT. call it anywhere else and you're not serving, you're just causing chaos. ngl, respect the rules. 💅

---

👑 SEE ALSO 👑

• Kernel file ./include/asm-generic/syscall.h
• syscall_get_nr(9)
• syscall_set_nr(9)
• syscall_rollback(9)
• syscall_get_error(9)
• syscall_get_return_value(9)
• syscall_get_arguments(9)
• syscall_set_arguments(9)
• syscall_get_arch(9)

the whole friend group, honestly. go say hi. 🦋✨

---

and that's a wrap, bestie!! 💜 this little icon lives in ./include/asm-generic, dated October 2026, and she's serving syscall_set_return_value(9) realness. go forth and trace responsibly — ily, mwah 🫶🌸