I attached a uprobe to a function in a system library. The uprobe is intercepting function calls as expected. Let's say I delete the library the uprobe is attached to, but don't manually unload the uprobe first. A practical example of this is if I attach to a library within a container, and then delete the container, but leave the eBPF program with the uprobe still running. How is the uprobe stored in kernel memory, and how would deleting the library it attaches to affect this? Is the uprobe basically a JMP pointer in a kernel hashmap that gets injected whenever the function it attaches to is called? Does the uprobe automatically get cleaned up, or does it become a dangling pointer? If it becomes a dangling pointer, what is the best way to detect that and clean it up from the eBPF loader? Sorry if my terminology or concepts aren't quite right. I'm still learning operating systems :). Appreciate any help and advice. Thanks, Yadunandan Pillai
