rethook_find_ret_addr(9)

💅 rethook_find_ret_addr — Kernel API Manual, bestie edition

Okay so we're deep in the kernel manual pages today and this one is literally called rethook_find_ret_addr from the Kernel API Manual, and it does exactly what it says on the tin: it finds the correct return address that a rethook went and modified. Let's get into it 🫶

---

✨ NAME ✨

rethook_find_ret_addr — find the correct return address modified by rethook

No cap, that's the whole vibe. It finds the real return address after a rethook has done its little makeover on it 💅

---

🌸 SYNOPSIS 🌸

unsigned long rethook_find_ret_addr (struct task_struct *tsk , unsigned
long frame , struct llist_node **cur );

Three args, one unsigned long coming back at you. Slay.

---

🎀 ARGUMENTS 🎀

• tsk — the target task. The one we're snooping the return address for 👀
• frame — a frame pointer. It's your little hint for locating the address.
• cur — a storage of the loop cursor llist_node pointer, so the next call knows where to pick up. It's giving bookmark energy 🔖

---

🦋 DESCRIPTION 🦋

So here's the tea: this function finds the correct return address modified by a rethook on tsk, and it hands it back to you as an unsigned long. ✨

Now, the important bits — read these twice, bestie, because this is where people trip:

The tsk must be 'current' or a task which is not running. That's a hard requirement, not a suggestion 💀

frame is a hint to get the correct return address — which is compared with the rethook::frame field. And cur is a loop cursor for searching the kretprobe return addresses on the tsk.

And the bit everyone gets wrong, okay, listen:

The '*cur' should be NULL at the first call, but 'cur' itself must NOT be NULL. Two very different things, don't mix them up 🙈

Returns the found address value, or zero if not found. Zero = not found, periodt ⭐

---

🔥 SEE ALSO 🔥

• Kernel file ./kernel/trace/rethook.c
• rethook_stop(9)
• rethook_free(9)
• rethook_alloc(9)
• rethook_recycle(9)
• rethook_try_get(9)
• rethook_hook(9)

Go read the whole rethook friend group, they're all iconic 👑

---

Alright bestie, that's the page! This one lives in ./kernel/trace and it's the October 2026 edition of rethook_find_ret_addr(9) — go find those return addresses, iykyk 💖🧚✨