From 8a14f64964668d56938efae1f0577e06f3f5c583 Mon Sep 17 00:00:00 2001
From: ShirkNeko <109797057+ShirkNeko@users.noreply.github.com>
Date: Tue, 23 Sep 2025 21:22:34 +0800
Subject: [PATCH] kernel: `sys_execve_kp` remains the preferred choice for the
 first registration.

---
 kernel/ksud.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/kernel/ksud.c b/kernel/ksud.c
index 203ed787..54f08619 100644
--- a/kernel/ksud.c
+++ b/kernel/ksud.c
@@ -516,15 +516,6 @@ static int register_execve_kprobe(void)
 {
 	int ret;
 
-	ret = register_kprobe(&bprm_check_kp);
-	if (ret == 0) {
-		execve_kprobe = &bprm_check_kp;
-		pr_info("ksud: registered bprm_check_kprobe\n");
-		return 0;
-	}
-
-	pr_warn("ksud: failed to register bprm_check_kprobe (%d), falling back to sys_execve_kprobe\n", ret);
-
 	ret = register_kprobe(&sys_execve_kp);
 	if (ret == 0) {
 		execve_kprobe = &sys_execve_kp;
@@ -532,6 +523,13 @@ static int register_execve_kprobe(void)
 		return 0;
 	}
 
+	ret = register_kprobe(&bprm_check_kp);
+	if (ret == 0) {
+		execve_kprobe = &bprm_check_kp;
+		pr_info("ksud: registered bprm_check_kprobe\n");
+		return 0;
+	}
+
 	pr_err("ksud: failed to register sys_execve_kprobe (%d)\n", ret);
 	return ret;
 }