On 01/14, Peter Zijlstra wrote:

On Tue, Jan 14, 2025 at 10:22:20AM +0100, Jiri Olsa wrote:

quoted

hack below seems to fix the issue, it's using rbx to signal that uretprobe
syscall got executed, if not, trampoline does int3 and executes uretprobe
handler in the old way

unfortunately now the uretprobe trampoline size crosses the xol slot limit so
will need to come up with some generic/arch code solution for that, code below
is neglecting that for now

Can't you detect the filter earlier and simply not install the
trampoline?

Did you mean detect the filter in prepare_uretprobe() ?

The probed function can install the filter before return...

Oleg.