Re: Crash when attaching uretprobes to processes running in Docker
From: Oleg Nesterov <oleg@redhat.com>
Date: 2025-01-14 12:33:41
Also in:
bpf, linux-api, lkml
On 01/14, Peter Zijlstra wrote:
On Tue, Jan 14, 2025 at 12:01:50PM +0100, Oleg Nesterov wrote:quoted
On 01/14, Peter Zijlstra wrote:quoted
On Tue, Jan 14, 2025 at 10:22:20AM +0100, Jiri Olsa wrote:quoted
hack below seems to fix the issue, it's using rbx to signal that uretprobe syscall got executed, if not, trampoline does int3 and executes uretprobe handler in the old way unfortunately now the uretprobe trampoline size crosses the xol slot limit so will need to come up with some generic/arch code solution for that, code below is neglecting that for nowCan't you detect the filter earlier and simply not install the trampoline?Did you mean detect the filter in prepare_uretprobe() ?Yep. Aren't syscall filters static for the duration of the task?quoted
The probed function can install the filter before return...If you're running a task with dynamic syscall filtering, you get to keep the pieces no?
Sorry, I don't understand... Perhaps because I am enjoying my state after
dentist appointment ;)
OK, suppose we have
void start_SECCOMP_MODE_STRICT(void)
{
// in particular nacks __NR_uretprobe
seccomp(SECCOMP_MODE_STRICT, ...);
}
and we want to add uretprobe to this function.
In this case prepare_uretprobe() can't know that sys_uretprobe() won't
work when this function returns?
Oleg.