Re: [PATCH 1/7] uprobes/x86: Move optimized uprobe from nop5 to nop10

[Jiri Olsa <olsajiri@gmail.com>]

On Sun, May 17, 2026 at 01:42:50PM +0200, Jiri Olsa wrote:

SNIP

> > > Is there a similar issue for forked children that inherit the optimized
> > > 10-byte sequence?
> > > 
> > > During fork, uprobe_mmap() installs a breakpoint in the child by writing
> > > 0xCC to the first byte, changing the instruction from 48 8d... to cc 8d...
> > > 
> > > If the uprobe is unregistered before the child hits and re-optimizes it,
> > > __is_optimized() will return false because is_lea_insn() strictly expects
> > > the first byte to be 0x48:
> > > 
> > > arch/x86/kernel/uprobes.c:is_lea_insn() {
> > >         return !memcmp(insn, lea_rsp, LEA_INSN_SIZE);
> > > }
> > > 
> > > The fallback check for the re-attached probe on top of jmp8 also fails
> > > because insn[1] is 0x8d, not OPT_JMP8_OFFSET.
> > > 
> > > Could set_orig_insn() then fall back to writing just the first byte of
> > > the original instruction over the 0xcc, again leaving 66 8d 64 24 80 e8 ...
> > > and silently truncating the child's stack pointer?
> > 
> > nice.. maybe we can skip the install_breakpoint call in uprobe_mmap
> > for optimized probes.. will check
> 
> I think we need to dup uprobe trampolines on fork like below

or just allow it to be copied on fork

jirka


---
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 4d91930aa792..e0067d1b6242 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -719,7 +719,7 @@ static struct uprobe_trampoline *create_uprobe_trampoline(unsigned long vaddr)
 
 	tramp->vaddr = vaddr;
 	vma = _install_special_mapping(mm, tramp->vaddr, PAGE_SIZE,
-				VM_READ|VM_EXEC|VM_MAYEXEC|VM_MAYREAD|VM_DONTCOPY|VM_IO,
+				VM_READ|VM_EXEC|VM_MAYEXEC|VM_MAYREAD|VM_IO,
 				&tramp_mapping);
 	if (IS_ERR(vma)) {
 		kfree(tramp);