Currently the __uprobe_register will return 0 (success) when called with negative offset. The reason is that the call to register_for_each_vma and then build_map_info won't return error for negative offset. They just won't do anything - no matching vma is found so there's no registered breakpoint for the uprobe. I don't think we can change the behaviour of __uprobe_register and fail for negative uprobe offset, because apps might depend on that already. But I think we can still make the change and check for it on bpf multi link syscall level. Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx> --- kernel/trace/bpf_trace.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 774cf476a892..0dbf8d9b3ace 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -3397,6 +3397,11 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr goto error_free; } + if (uprobes[i].offset < 0) { + err = -EINVAL; + goto error_free; + } + uprobes[i].link = link; if (flags & BPF_F_UPROBE_MULTI_RETURN) -- 2.43.0