Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames

[Google]

Cc: Jiri,

On Tue, 20 Oct 2026 00:37:04 +0000, shaos <shawnq1@xxxxxxx> wrote:
> Hello,
> 
> The x86 uprobe syscall checks only that regs->ip lies somewhere in the
> caller's executable [uprobes-trampoline] VMA, then trusts ax, r11, cx
> and retaddr copied from the user stack.  A process can jump into that
> VMA with a fabricated frame and make an enabled uprobe report a hit at
> a site it never executed, with caller-chosen register values.

Thanks for reporting!
So, in short, would you mean user program can mimic to call uprobe syscall
if it can detect whether it is probed ? (Like shooting their foot by itself)

If this is a problem, I think we need to introduce a "reliable-binaries" list
and instruments uprobe syscall only for the reliable binaries.
(It may also need to check the integrity, but it depends user's operation.)

Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>