On Tue, Jan 14, 2025 at 12:01:50PM +0100, Oleg Nesterov wrote: > On 01/14, Peter Zijlstra wrote: > > > > On Tue, Jan 14, 2025 at 10:22:20AM +0100, Jiri Olsa wrote: > > > > > > hack below seems to fix the issue, it's using rbx to signal that uretprobe > > > syscall got executed, if not, trampoline does int3 and executes uretprobe > > > handler in the old way > > > > > > unfortunately now the uretprobe trampoline size crosses the xol slot limit so > > > will need to come up with some generic/arch code solution for that, code below > > > is neglecting that for now > > > > Can't you detect the filter earlier and simply not install the > > trampoline? > > Did you mean detect the filter in prepare_uretprobe() ? Yep. Aren't syscall filters static for the duration of the task? > The probed function can install the filter before return... If you're running a task with dynamic syscall filtering, you get to keep the pieces no?
