[PATCH] uprobes: Skip breakpoint installation on non executable vmas

Sumanth Korikkar <[email protected]> Wed, 5 Aug 2026 15:19:04 +0200
Newsgroups org.kernel.vger.linux-trace-kernel,org.kernel.vger.linux-kernel
Message-ID <[email protected]>
bpftrace  -e 'usdt:./testprogs/usdt_semaphore_test:tracetest:testprobe {
printf("%s\n", str(arg1) ); exit(); }'

expects a semaphore increment of 1, but semaphore gets double incremented

Test program:
https://github.com/bpftrace/bpftrace/blob/master/tests/testprogs/usdt_semaphore_test.c

Reason: .text mapping and RELRO mapping resolve to the same page aligned
file offset 0
01000000-01001000 r-xp 00000000 5e:01 usdt_semaphore_test (.text)
01001000-01002000 r--p 00000000 5e:01 usdt_semaphore_test (RELRO)
01002000-01003000 rw-p 00001000 5e:01 usdt_semaphore_test (semaphore)

valid_vma() currently accepts both mappings (which contains executable
text and RELRO mapping) during uprobe registration, since both have
VM_MAYEXEC set. This causes register_for_each_vma() to call
install_breakpoint() twice for the same underlying uprobe offset in the
process.  This means, update_ref_ctr() is called twice for the same
process, so a usdt semaphore is incremented from 0 to 2.

Installing a breakpoint for mapping without VM_EXEC and
updating usdt reference counter in that case is not useful.

Skip non VM_EXEC mappings in install_breakpoint(). This fixes semaphore
double increment as shown in the above usecase.

Signed-off-by: Sumanth Korikkar <[email protected]>
---
 kernel/events/uprobes.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 6300b216012c..9e0bbc3cf401 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1155,6 +1155,9 @@ static int install_breakpoint(struct uprobe *uprobe, struct vm_area_struct *vma,
 	bool first_uprobe;
 	int ret;
 
+	if (!(vma->vm_flags & VM_EXEC))
+		return 0;
+
 	ret = prepare_uprobe(uprobe, vma->vm_file, mm, vaddr);
 	if (ret)
 		return ret;
-- 
2.53.0