Re: Crash when attaching uretprobes to processes running in Docker

On Tue, Jan 14, 2025 at 12:01:50PM +0100, Oleg Nesterov wrote:

On 01/14, Peter Zijlstra wrote:

quoted

On Tue, Jan 14, 2025 at 10:22:20AM +0100, Jiri Olsa wrote:

quoted

hack below seems to fix the issue, it's using rbx to signal that uretprobe
syscall got executed, if not, trampoline does int3 and executes uretprobe
handler in the old way

unfortunately now the uretprobe trampoline size crosses the xol slot limit so
will need to come up with some generic/arch code solution for that, code below
is neglecting that for now

Can't you detect the filter earlier and simply not install the
trampoline?

Did you mean detect the filter in prepare_uretprobe() ?

Yep. Aren't syscall filters static for the duration of the task?

The probed function can install the filter before return...

If you're running a task with dynamic syscall filtering, you get to keep
the pieces no?