Thread (11 messages) flat view 11 messages, 3 authors, 6h ago
HOTtoday

[PATCH] uprobes: Skip breakpoint installation on non executable vmas

From: Sumanth Korikkar <hidden>
Date: 2026-08-05 13:19:55
Also in: lkml
Subsystem: performance events subsystem, the rest, uprobes · Maintainers: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Linus Torvalds, Masami Hiramatsu, Oleg Nesterov

bpftrace  -e 'usdt:./testprogs/usdt_semaphore_test:tracetest:testprobe {
printf("%s\n", str(arg1) ); exit(); }'

expects a semaphore increment of 1, but semaphore gets double incremented

Test program:
https://github.com/bpftrace/bpftrace/blob/master/tests/testprogs/usdt_semaphore_test.c

Reason: .text mapping and RELRO mapping resolve to the same page aligned
file offset 0
01000000-01001000 r-xp 00000000 5e:01 usdt_semaphore_test (.text)
01001000-01002000 r--p 00000000 5e:01 usdt_semaphore_test (RELRO)
01002000-01003000 rw-p 00001000 5e:01 usdt_semaphore_test (semaphore)

valid_vma() currently accepts both mappings (which contains executable
text and RELRO mapping) during uprobe registration, since both have
VM_MAYEXEC set. This causes register_for_each_vma() to call
install_breakpoint() twice for the same underlying uprobe offset in the
process.  This means, update_ref_ctr() is called twice for the same
process, so a usdt semaphore is incremented from 0 to 2.

Installing a breakpoint for mapping without VM_EXEC and
updating usdt reference counter in that case is not useful.

Skip non VM_EXEC mappings in install_breakpoint(). This fixes semaphore
double increment as shown in the above usecase.

Signed-off-by: Sumanth Korikkar <redacted>
---
 kernel/events/uprobes.c | 3 +++
 1 file changed, 3 insertions(+)
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 6300b216012c..9e0bbc3cf401 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1155,6 +1155,9 @@ static int install_breakpoint(struct uprobe *uprobe, struct vm_area_struct *vma,
 	bool first_uprobe;
 	int ret;
 
+	if (!(vma->vm_flags & VM_EXEC))
+		return 0;
+
 	ret = prepare_uprobe(uprobe, vma->vm_file, mm, vaddr);
 	if (ret)
 		return ret;
-- 
2.53.0
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help