From nobody Tue Sep 29 02:34:37 2026 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 01B0340B0FC for ; Thu, 13 Aug 2026 06:20:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786602052; cv=none; b=o2rgVq51EEhLilMM2aDNtclIXvPNAj0BNHKH/HntcX0MaBt6xiYB5xt5sNakFyYbuHlYjxVJz2Pigq0XvuzOw7eEex9nMFnIh/WPTCY+gmYidpjqJyVLvlmWI1rpnG04WFm+Znjcl7L7rtiuE656V0ayyXvj4JpLdsUTbgQ74yE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786602052; c=relaxed/simple; bh=+E4sr3ApYAx67ojdfuoIfGZdLzMgR7BzhkRi3joo42E=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=tpn6w+66QpMVhB/Dt3c6v2BoWoay1vtvujg4g6SA++JEEGkCyh66RGMpRZSvkqVDN6g6WYsUvVV/NWdtVLtkRBEUuQXyUwY3s+u1eWh1JC+5w9IugrRuWphDCuaWy6mQvF5sc6CyIXx48ndaGyXeASwLxRRjlPs7uPTIyvUZocs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iXUnv+/d; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iXUnv+/d" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-490cf322ed0so3162325e9.1 for ; Wed, 12 Aug 2026 23:20:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786602049; x=1787206849; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=bIkogX0nsWcChibFiyEXOsML18t7FCRxTFSNVsFKCxc=; b=iXUnv+/dJcleU3ffidMuB2hUWAtz2dp74VXFyTGyHhcSGYGQHuqAs8kXlQBIddpzBa C0R3G/Cu0ukmWl05F+Xv1cws4ty2iHlE1X5rWCL/ZdpkRXEuAliXdEA8CV41wR4ekloP JOzBocarRKClPrxV5+DsaEBzWBmt1Lz8sOwtEk45T/8LDU2c1wzR9kx9Cmv90NrDU4v9 +3gi+j50Uxo/Yi0SkKQwLcjk+AWkiisZW04sard9+BONx4tILwVR+WZX/Zn/JtdqqDdG Cwc8H98pEWvzKUUlgojqHahpdp6ZdNHgX4ESGwcRzA7Tdk+odK4aVzmOCRudJUiH4GHK mgrg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786602049; x=1787206849; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bIkogX0nsWcChibFiyEXOsML18t7FCRxTFSNVsFKCxc=; b=QOsmHsb9en7ei+mz+eogtVyjYkdpQHd8lQEqUX/wHN/6roIE9xjPa/uWtlhqjOVoiS 2ots1khMjRPyF2v0p/9iAvkEjBBFhy3yRls4eWkUbrSSYAW5N5agOJXA73zAlNy7W3Vg tmbuQe0ZeoVVOvRmHB/4NUrwngl4PopYQ8nrfDOKqHexPHGwQCKrIj3d0kdzdRaTTqXh xFCQ/3ZzvOq6Y5eBRXjKB5bbNcvvAKUyfDXIHXa2O4oTuMin37RCeCemnXTNU81Au5aK M3dbc0Eq83iO2qx/P3jw+CI4IKRhJMbRwG+64KWsGxdY93Dx1ygV4oiUKjlDxvKFbkJG L/fQ== X-Forwarded-Encrypted: i=1; AHgh+RqFKb8fdQszpN4Aa30n1/cbW1nzPujpHXzmupeKUe0Y6LbTqJRNzj0QVP1445nfQL+78yVpdTlFspQ/K+A=@vger.kernel.org X-Gm-Message-State: AOJu0Yz1Pnc+0KlwNgixjTEderwnIhjjksQT7yYvECHyKS9KQgZFtwCD hWehqswlIJMFBDIVR5mWVJQVvE/laVQcKrYZQAmQYRUnspx917tjpvjR X-Gm-Gg: AR+sD13LdWHkV2tSEsZbvnK0n+dQvStqcGfV2CfhXQCneiVbO9LgQX7rgv/WYn2Pttv ek3XKq0D1R2CE1JB6QWBX8tErOhj5A8Q8sdh1RmuiZiaqKUqAmM09I5XEOK9nr67uU+lZfun4VO mbx7fs8vRwrwF9dhNmAt9mprf1KM46Se84TnxKJREgsSVQxxxFWOvFYh/qKiVwMxJhVTS+FdbSs 1S5X5Jjjde7+/1OTi2ogsMVej8Vx/Ulv8P8+oswDqPXJ4yh92LbpaG8O/YXHXhjZzqkppBxXfhm 3pvxaz267G3Fgq0nEt5dwQ2ymnMio7ienB/Zv5gU+hnPc+SG5I67X70OT+wvHlQ339P5NhoqlsP CmUg7SswBBSCA59fvH3GbCIMU1yQJtvCRzF3u45xWWTB+6OMOXy/no790bqIAjSizeDH50+M65d /xE9hMMP73nrAe8AtoCz55AEWl+Is3kWAFXAlVT5LQuqfRtjKfh7FyrOCyzMa100KOioGM9ooXn qkusVr6SMIBlQ3HrUMDvoXxH17T3uztCdMBSCe7dz8cmMw/p+w/g67X8nH9ysZoIbZlsOOLQ6gh hZKPyFJxTws0qC+sygyOHejQ54tkCJFu4yZT4/OSXNGoJvfNbRZb1uMBVrXbkOryni5czEgJuQ= = X-Received: by 2002:a05:600c:a4b:b0:495:5858:8101 with SMTP id 5b1f17b1804b1-499821f2e1bmr32499355e9.15.1786602048980; Wed, 12 Aug 2026 23:20:48 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-9c79-1f01-1565-573d-10dc-99f9.310.pool.telefonica.de. [2a02:3100:9c79:1f01:1565:573d:10dc:99f9]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49981b0f4afsm47001025e9.5.2026.08.12.23.20.47 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 12 Aug 2026 23:20:48 -0700 (PDT) From: Karl Mehltretter To: Thomas Gleixner Cc: Karl Mehltretter , Gregory Price , Peter Zijlstra , Andy Lutomirski , Kees Cook , Joel Granados , Oleg Nesterov , Jonathan Corbet , Shuah Khan , Mark Brown , Stephen Rothwell , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-next@vger.kernel.org Subject: [PATCH] syscall_user_dispatch: Use CONFIG_SYSCTL for sysctl guard Date: Thu, 13 Aug 2026 08:20:39 +0200 Message-Id: <20260813062039.14567-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" sysctl-next removes CONFIG_PROC_SYSCTL because it mirrors CONFIG_SYSCTL. When combined with the syscall user dispatch sysctl in linux-next, the stale guard prevents registration of kernel.syscall_user_dispatch. syscall_user_dispatch_allowed defaults to true. SUD therefore remains available, but administrators cannot disable new activations. Use CONFIG_SYSCTL for the guard and documentation. Fixes: 5b6e32ba7b59 ("syscall_user_dispatch: Add kernel.syscall_user_dispat= ch sysctl") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Karl Mehltretter Acked-by: Oleg Nesterov Reviewed-by: Joel Granados --- The conflicting sysctl-next commit is currently: 8d75c338f0bc ("sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_= SYSCTL") This is a cross-tree integration fix intended for the tip tree. It has no functional effect in tip/master, but restores the sysctl when combined with sysctl-next. Verified in linux-next with an x86_64 object build using CONFIG_SYSCALL_USER_DISPATCH=3Dy and CONFIG_SYSCTL=3Dy. Documentation/admin-guide/sysctl/kernel.rst | 2 +- kernel/entry/syscall_user_dispatch.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/ad= min-guide/sysctl/kernel.rst index b6328cd0f43e9..ffea61d448ebb 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -1416,7 +1416,7 @@ Controls whether userspace may arm Syscall User Dispa= tch via =3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 Only present when the kernel is built with ``CONFIG_SYSCALL_USER_DISPATCH`` -and ``CONFIG_PROC_SYSCTL``. +and ``CONFIG_SYSCTL``. =20 =20 sysctl_writes_strict diff --git a/kernel/entry/syscall_user_dispatch.c b/kernel/entry/syscall_us= er_dispatch.c index 2002c7aae4358..59c861866941d 100644 --- a/kernel/entry/syscall_user_dispatch.c +++ b/kernel/entry/syscall_user_dispatch.c @@ -178,7 +178,7 @@ int syscall_user_dispatch_set_config(struct task_struct= *task, unsigned long siz (char __user *)(uintptr_t)cfg.selector); } =20 -#ifdef CONFIG_PROC_SYSCTL +#ifdef CONFIG_SYSCTL static const struct ctl_table syscall_user_dispatch_sysctls[] =3D { { .procname =3D "syscall_user_dispatch", @@ -195,4 +195,4 @@ static int __init syscall_user_dispatch_sysctl_init(voi= d) return 0; } late_initcall(syscall_user_dispatch_sysctl_init); -#endif /* CONFIG_PROC_SYSCTL */ +#endif /* CONFIG_SYSCTL */ base-commit: 98292902c7108717c4f4bea7226520b336f9a8bc --=20 2.53.0