kretprobe_find_ret_addr(9)

kretprobe_find_ret_addr(9) 💅

okay so bestie, this is the Kernel API Manual page for kretprobe_find_ret_addr, and it's literally about finding the correct return address that a kretprobe modified. yes, that's the whole vibe. 🎀

---

💖 NAME 💖

kretprobe_find_ret_addr — Find correct return address modified by kretprobe

---

✨ SYNOPSIS ✨

unsigned long kretprobe_find_ret_addr (struct task_struct *tsk , void
*fp , struct llist_node **cur );

---

🫶 ARGUMENTS 🫶

• tsk — Target task. the main character whose return address we're checking. 👑
• fp — A frame pointer. it's giving helpful-hint energy. ✨
• cur — a storage of the loop cursor llist_node pointer for next call. lowkey the loop's little bookmark. 🔖

---

🔥 DESCRIPTION 🔥

So it finds the correct return address modified by a kretprobe on tsk, in unsigned long type. If it finds the return address, it returns that address value; otherwise it returns 0. that's it. no cap. 💖

Now the constraints, because they matter:

⚠️ the tsk must be 'current' or a task which is not running. and fp is a hint to get the currect return address — which is compared with the kretprobe_instance::fp field. (yes, the original says currect, keeping it 100% intact, iykyk 🫶)

The cur is a loop cursor for searching the kretprobe return addresses on the tsk. and this bit is important:

🚨 the '*cur' should be NULL at the first call, but 'cur' itself must NOT NULL. like, not optional. do not come in here with a NULL cur. 🙅‍♀️

---

🌈 SEE ALSO 🌈

• Kernel file ./kernel/kprobes.c
• __get_insn_slot(9)
• kprobe_on_func_entry(9)

go read those if you're nosy 💅

---

okay that's the page, bestie 🫶 kretprobe_find_ret_addr(9), source/version ./kernel, dated October 2026. kisses, and happy probe-ing 💋✨